Skip to content

fix(coding-agent): run OAuth refresh outside the auth.json file lock - #1887

Closed
veerareddyvishal144 wants to merge 1 commit into
PrimeIntellect-ai:mainfrom
veerareddyvishal144:fix/oauth-refresh-outside-lock
Closed

fix(coding-agent): run OAuth refresh outside the auth.json file lock#1887
veerareddyvishal144 wants to merge 1 commit into
PrimeIntellect-ai:mainfrom
veerareddyvishal144:fix/oauth-refresh-outside-lock

Conversation

@veerareddyvishal144

@veerareddyvishal144 veerareddyvishal144 commented Aug 28, 2026

Copy link
Copy Markdown

Fixes #999.

What was broken

refreshOAuthTokenWithLock awaited the provider's token refresh (an HTTP round-trip) inside the withLockAsync callback, holding the auth.json file lock across the network call. This blocked other processes/threads from reading or refreshing credentials, causing hangs and stale auth state.

Fix

  • Take snapshot under lock, release lock before network request.
  • Re-acquire lock only to merge/persist refreshed credential (race-safe vs concurrent refresher).
  • Adds regression test 999-oauth-refresh-lock.test.ts.

Replaces #1001 (closed in Aug 15 backlog sweep, not merged).

Fixes #999

Note

Move OAuth token refresh outside the auth.json file lock in AuthStorage

  • Rewrites AuthStorage.refreshOAuthTokenWithLock to a two-phase lock protocol: read expired credentials under lock, release it, run provider.refreshToken outside the lock, then reacquire the lock to persist.
  • Adds conflict detection: after reacquiring the lock, compares cred.refresh and cred.expires against the snapshot; if another process wrote fresher credentials mid-refresh, the stale result is discarded and the freshest credentials are returned.
  • Removes the getOAuthApiKey import and replaces the old oauthCreds-map delegation with direct provider.refreshToken calls and explicit merge/persist logic.
  • Adds regression tests in 999-oauth-refresh-lock.test.ts verifying the lock is not held during refresh and concurrent fresher writes are preserved.
  • Behavioral Change: the lock is now only held during read/parse and write/persist, not during the network round-trip; callers receive the freshest stored credentials when a concurrent writer wins.

Macroscope summarized e40b5fd.

@github-actions

Copy link
Copy Markdown

Hi @veerareddyvishal144, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/PrimeIntellect-ai/prime-agent/blob/main/CONTRIBUTING.md for more details.

@github-actions github-actions Bot closed this Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth token refresh holds the auth.json file lock across the network call

1 participant