mirror of
https://github.com/expo/code-review-cli.git
synced 2026-11-15 13:08:14 -10:00
Brent Vatne
188f8521bf
* Detect provider rate limits and wait them out; subscription-aware concurrency A shared subscription credential can serve several PRs' reviews at once, so throttling is a normal condition to ride out, not a failure — and it must be distinguishable from a wedged request. - watch the OpenCode server's own log (isolated per run) for 429/rate-limit ERROR lines — explicit throttle evidence, the only kind that exists outside the provider; a silently parked request emits nothing anywhere - a stall WITH recent evidence waits in 90s beats (never consuming the one wedged retry, bounded by the pass deadline) instead of re-sending the pass's whole context into a limited account; without evidence, the wedged-retry behavior is unchanged - explicit 429 errors retry on a patient 15s/45s/90s schedule instead of 2s/8s - chunk.concurrency unset now resolves by auth mode: 3 on a subscription (oauth) credential, 6 on API keys — one account handles six parallel streams poorly (the parked-request stall signature on eas-cli#4084 hit both agents' chunk 2 simultaneously); an explicit value always wins - rate-limit events surface at run end and in the run log (rateLimitEvents), so throttle frequency is measurable across PRs * Support ChatGPT ACCESS tokens (rotation-safe); honest verdict when nothing ran The refresh-token-as-static-secret strategy died in production (euxy#8: every pass "Token refresh failed: 401" — refresh tokens are SINGLE-USE; the shared copy was spent by its first CI use and the sign-in with it). - oauthAuthJsonEntry detects the token kind: a JWT (ACCESS token) is used as-is with its exp claim as the expiry — no rotation involvement, safe as a shared/static secret; an opaque value keeps the refresh-token shape for sole-consumer setups - an expired access token fails fast naming the re-mint; near-expiry warns (doctor + preflight) — the credential can't silently lapse mid-run - setup-auth hands out the ACCESS token (default env CODEX_OAUTH_ACCESS_TOKEN) and never surfaces the refresh token, which stays in OpenCode's own store as its sole legitimate consumer - an all-passes-failed run no longer renders as "Approve with comments": couldNotComplete overrides the decision label with "No review — every pass failed" (single and per-scope comments) - README: retract the false "refresh-token reuse verified, static CI secret works" claim; document the access-token strategy - ROADMAP: token-rotator cron job added as the most important next item - this repo's config/workflow: tokenEnv renamed to CODEX_OAUTH_ACCESS_TOKEN