What causes "close Claude OAuth %s decoder: %w" in router-for-me/CLIProxyAPI?

Treat as a data-integrity warning: retry the OAuth request and compare responses.

close Claude OAuth %s decoder: %w

Error message

close Claude OAuth %s decoder: %w

What it means

After successfully reading the decoded body, the code closes the codec reader and reports a close failure. For gzip this close writes the trailer/checksum, so it can surface write-side errors; for the no-op and read-only wrappers it is almost impossible to trigger. Seeing it usually means the underlying stream was in a bad state that ReadAll did not fully expose.

Source

Thrown at internal/auth/claude/oauth_response.go:69

		if errZlib == nil {
			reader = zlibReader
		} else {
			reader = flate.NewReader(bytes.NewReader(encoded))
		}
	case "br":
		reader = io.NopCloser(brotli.NewReader(bytes.NewReader(encoded)))
	case "compress":
		reader = lzw.NewReader(bytes.NewReader(encoded), lzw.MSB, 8)
	default:
		return nil, fmt.Errorf("decode Claude OAuth response: unsupported content encoding %q", encoding)
	}
	decoded, errDecoded := io.ReadAll(reader)
	if errDecoded != nil {
		_ = reader.Close()
		return nil, fmt.Errorf("decode Claude OAuth %s response: %w", encoding, errDecoded)
	}
	if errClose := reader.Close(); errClose != nil {
		return nil, fmt.Errorf("close Claude OAuth %s decoder: %w", encoding, errClose)
	}
	return decoded, nil
}

View on GitHub (pinned to 78f0c4079e)

Solutions

Treat as a data-integrity warning: retry the OAuth request and compare responses.
If it recurs on the same endpoint, capture the raw body and run `gzip -t` on it to verify the stream.
In tests, make stub readers' Close return nil unless you specifically test this path.

Defensive patterns

Strategy: fallback

Try / catch

decoded, err := decodeClaudeOAuthEncoding(raw, enc)
if err != nil && strings.Contains(err.Error(), "close Claude OAuth") {
    // body was fully read; the decoded payload is usable — log and continue
    log.Warnf("decoder close failed after full read: %v", err)
}

Prevention

Remember the body is already fully read when only Close fails; prefer logging over discarding.
In tests, have stub readers return nil from Close unless testing this path.

When it happens

Trigger: gzip.NewReader stream whose footer verification fails at Close time; a custom io.ReadCloser injected in tests whose Close returns an error; extremely rare transport-level errors surfacing only during finalization.

Common situations: Essentially only in unit tests with stub readers, or exotic gzip streams with checksum mismatches that gzip tolerates during read but flags at close. Production occurrences are negligible next to errors 181/183.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/68f5ef73f4375b9c. Report an issue: GitHub.