{"record":{"id":"540dcb1354779efc","repo":"plandex-ai/plandex","slug":"refresh-failed-http-w","errorCode":null,"errorMessage":"refresh failed - http: %w","messagePattern":"refresh failed - http: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/cli/lib/claude_max.go","lineNumber":309,"sourceCode":"\tbody, err := json.Marshal(map[string]any{\n\t\t\"grant_type\":    \"refresh_token\",\n\t\t\"refresh_token\": creds.RefreshToken,\n\t\t\"client_id\":     claudeMaxClientId,\n\t})\n\tif err != nil {\n\t\treturn nil, 0, fmt.Errorf(\"refresh failed - marshal: %w\", err)\n\t}\n\n\treq, err := http.NewRequest(\"POST\", claudeMaxTokenUrl, bytes.NewReader(body))\n\tif err != nil {\n\t\treturn nil, 0, fmt.Errorf(\"refresh failed - create request: %w\", err)\n\t}\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"anthropic-beta\", shared.AnthropicClaudeMaxBetaHeader)\n\n\tresp, err := http.DefaultClient.Do(req)\n\tif err != nil {\n\t\treturn nil, 0, fmt.Errorf(\"refresh failed - http: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tb, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, 0, fmt.Errorf(\"refresh failed - read body: %w\", err)\n\t\t}\n\t\treturn nil, resp.StatusCode, fmt.Errorf(\"refresh failed - status %d: %s\", resp.StatusCode, b)\n\t}\n\n\tvar r types.OauthResponse\n\tif err := json.NewDecoder(resp.Body).Decode(&r); err != nil {\n\t\treturn nil, 0, fmt.Errorf(\"refresh failed - decode: %w\", err)\n\t}\n\n\tnewCreds := &types.OauthCreds{\n\t\tOauthResponse: r,","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/plandex-ai/plandex/blob/e2d772072efadbe41d2946d97d79be55532dbab5/app/cli/lib/claude_max.go#L291-L327","documentation":"refreshCreds wraps the error from http.DefaultClient.Do when the POST to the Claude Max OAuth token endpoint fails at the transport level. This means no HTTP response was received: DNS failure, refused connection, TLS error, timeout, or proxy problem.","triggerScenarios":"http.DefaultClient.Do(req) returns err while refreshing OAuth credentials — network unreachable, DNS resolution failure for the token host, TLS handshake failure, or the default HTTP client's timeout (or context deadline) expiring.","commonSituations":"Offline or restricted network, corporate proxy/firewall blocking the token endpoint, DNS misconfiguration, expired local CA certs causing TLS errors, or http.DefaultClient's zero-value timeout plus a hanging connection.","solutions":["Check network connectivity and that the token endpoint host is resolvable (curl the claudeMaxTokenUrl from the same machine).","Verify proxy env vars (HTTP_PROXY/HTTPS_PROXY) and corporate CA certificates (SSL_CERT_FILE) are correct.","Retry the refresh with backoff; transient network errors are common for background token refresh.","Configure a client with an explicit timeout instead of http.DefaultClient so failures are deterministic.","If using a custom endpoint, confirm it is reachable and not blocked by firewall rules."],"exampleFix":"// before\nclient := http.DefaultClient\n// after\nclient := &http.Client{Timeout: 15 * time.Second}\nresp, err := client.Do(req)\nif err != nil {\n    return nil, 0, fmt.Errorf(\"refresh failed - http: %w\", err)\n}","handlingStrategy":"retry","validationCode":"// quick reachability probe before refresh\nconn, err := net.DialTimeout(\"tcp\", host+\":443\", 5*time.Second)\nif err != nil {\n    return fmt.Errorf(\"token endpoint unreachable: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"var netErr net.Error\nresp, err := client.Do(req)\nif err != nil {\n    if errors.As(err, &netErr) && netErr.Timeout() {\n        return retryWithBackoff(refreshCreds, 3) // transient\n    }\n    return fmt.Errorf(\"refresh failed - http: %w\", err)\n}","preventionTips":["Use an http.Client with an explicit Timeout instead of http.DefaultClient.","Add exponential backoff with jitter for transient network failures.","Monitor proxy env vars and corporate CA trust in the deployment environment.","Cache valid credentials and refresh proactively before expiry to reduce request pressure."],"tags":["network","http","oauth","timeout","dns"],"backgroundTag":"network-request-failed","analyzedSha":"e2d772072efadbe41d2946d97d79be55532dbab5","analyzedAt":"2026-09-05T20:56:53.631Z","contentChangedAt":"2026-09-05T20:56:53.631Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}