{"record":{"id":"75adfd2b9c545dc7","repo":"coleam00/Archon","slug":"openai-token-operation-request-failed-error","errorCode":null,"errorMessage":"OpenAI token ${operation} request failed: ${error instanceof Error ? error.message : String(error)}","messagePattern":"OpenAI token (.+?) request failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/credentials/openai-oauth.ts","lineNumber":180,"sourceCode":"    response = await fetch(OPENAI_TOKEN_URL, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      // The 30s ceiling applies ALWAYS — combined with the caller's session\n      // signal when present. Without it, a hung token endpoint would leave a\n      // bridge login reporting `pending` for the session's full 10-minute TTL.\n      signal: signal\n        ? AbortSignal.any([signal, AbortSignal.timeout(30_000)])\n        : AbortSignal.timeout(30_000),\n    });\n  } catch (error) {\n    if (signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n    if (error instanceof Error && error.name === 'TimeoutError') {\n      throw new Error(`OpenAI token ${operation} request timed out.`);\n    }\n    throw new Error(\n      `OpenAI token ${operation} request failed: ${error instanceof Error ? error.message : String(error)}`\n    );\n  }\n  if (!response.ok) {\n    // Strip the error body down to the OAuth `error` code: this message flows\n    // into the bridge's session.detail (and on to the browser/CLI), and OpenAI\n    // error bodies can carry account identifiers. Never include the raw body.\n    const text = await response.text().catch(() => '');\n    let errorCode = '';\n    try {\n      const parsed = JSON.parse(text) as { error?: unknown };\n      if (typeof parsed.error === 'string') {\n        errorCode = parsed.error;\n      } else if (parsed.error && typeof parsed.error === 'object') {\n        const code = (parsed.error as { code?: unknown }).code;\n        if (typeof code === 'string') errorCode = code;\n      }\n    } catch {","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/core/src/credentials/openai-oauth.ts#L162-L198","documentation":"postTokenRequest (openai-oauth.ts:180) wraps any fetch rejection that is neither caller-abort nor TimeoutError into 'OpenAI token <operation> request failed: <cause>'. This is the catch-all for transport-level failures reaching OpenAI's token endpoint: DNS failure, connection refused/reset, TLS errors, etc. The original cause's message is preserved inline.","triggerScenarios":"fetch to OPENAI_TOKEN_URL throws for reasons other than caller abort or 30s timeout — connection refused, ENOTFOUND (DNS), ECONNRESET, TLS certificate errors, offline interfaces, or invalid proxy configuration.","commonSituations":"No internet access or DNS misconfiguration on the host; corporate proxy with TLS interception presenting an untrusted certificate; firewall blocking egress; transient network flap during login or refresh.","solutions":["Read the embedded cause message to identify the transport fault (DNS vs refused vs TLS).","Verify outbound HTTPS connectivity to the OpenAI token endpoint from the Archon host.","Fix proxy env vars (HTTPS_PROXY) or install the corporate CA so TLS interception validates.","Retry — transient connection resets resolve on the next attempt or refresh cycle."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight DNS/TLS check to the token endpoint host\ndns.promises.lookup('auth.openai.com').catch(() => {\n  throw new Error('DNS cannot resolve auth.openai.com; fix connectivity first.');\n});","typeGuard":null,"tryCatchPattern":"try {\n  await refreshToken(token);\n} catch (e) {\n  const m = e instanceof Error ? e.message : '';\n  if (m.startsWith('OpenAI token refresh request failed:')) {\n    // Transport-level fault: inspect cause (ENOTFOUND/ECONNRESET/TLS) before retry\n    getLog().warn({ cause: m }, 'openai_token_transport_failure');\n    return retryWithBackoff(() => refreshToken(token));\n  }\n  throw e;\n}","preventionTips":["Install corporate CA certificates so TLS interception validates.","Verify HTTPS_PROXY/NO_PROXY env vars point at a working egress proxy.","Monitor host DNS and outbound firewall rules.","Distinguish transport failures (retry) from HTTP rejections (don't blindly retry)."],"tags":["network","oauth","openai","connectivity"],"backgroundTag":"network-request-failed","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}