Method refreshClientOnAuthError

cli/cli_llm.go:551–575

refreshClientOnAuthError checks if the error is a 401/auth error from an OAuth provider. If so, it invalidates the auth cache, refreshes credentials, and recreates the client. Returns true if the client was refreshed and the caller should retry. A 403 that carries WAF / proxy / firewall signals is

(err error)

// the corporate proxy rejected the payload or URL). Such 403s fall
// through for payload-recovery handling further up the call chain.
func (cli *ChatCLI) refreshClientOnAuthError(err error) bool {
	if err == nil {
		return false
	}
	if agent.IsProxyWAFRejection(err) {
		return false
	}
	var apiErr *utils.APIError
	if errors.As(err, &apiErr) && (apiErr.StatusCode == 401 || apiErr.StatusCode == 403) {
		cli.logger.Info("Auth error detected, refreshing OAuth credentials",
			zap.Int("status", apiErr.StatusCode),
			zap.String("provider", cli.Provider))
		auth.InvalidateCache()
		cli.manager.RefreshProviders()
		if newClient, cerr := cli.manager.GetClient(cli.Provider, cli.Model); cerr == nil {
			cli.mu.Lock()
			cli.Client = newClient
			cli.mu.Unlock()
			return true
		}
		cli.logger.Warn("Failed to recreate client after auth refresh",
			zap.String("provider", cli.Provider))
	}
	return false
}

// getClient returns the current LLM client, safe for use from background goroutines.
func (cli *ChatCLI) getClient() client.LLMClient {