Surface a re-auth hint when the relayed-proxy 401 refresh fails - #374
Merged
Conversation
The retry-on-401 path in the relayed Claude Max/Enterprise proxy force- refreshes the Databricks swap token, but silently swallowed a failed refresh (`except RuntimeError: pass`). When the underlying Databricks OAuth session is fully expired -- not just the access token -- the token can't be re-minted non-interactively, so the user was left with a bare relayed 401 and no guidance. That reads as an Anthropic `/login` prompt and sends the user to the wrong remedy (Claude Code's `/login` only re-does the Anthropic OAuth). Call `_log_refresh_failure` in that branch so the actionable `databricks auth login` hint is printed, then still retry + relay as before. No happy-path behavior change. Co-authored-by: Isaac <no-reply@databricks.com>
masonc08
marked this pull request as ready for review
August 24, 2026 18:18
rohita5l
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The relayed Claude Max/Enterprise proxy (
gateway_proxy.py) carries two independently-expiring credentials: Claude Code's Anthropic subscription OAuth inAuthorization, and a short-lived Databricks token that this proxy mints intoX-Databricks-AI-Gateway-Token.On a
401/403,_ProxyHandler._handleforce-refreshes the Databricks swap token and retries once — a stale-access-token 401 self-heals. But whencache.refresh()itself fails (the underlying Databricks OAuth session is dead, not just the access token — e.g. after a long idle/overnight gap), the branch didexcept RuntimeError: pass, silently swallowing it. The user is then handed a bare relayed 401 with no guidance, which surfaces in Claude Code as a generic auth error → they try/login(which only re-does the Anthropic OAuth) instead of the actual fix,databricks auth login.Fix
Call the existing
_log_refresh_failure(exc)in that branch instead ofpass. It already prints the actionabledatabricks auth loginhint to stderr and is designed not to leak tokens. Behavior is otherwise unchanged: we still retry with the existing token and relay whatever comes back.Testing
ruff checkpasses.This pull request and its description were written by Isaac.