Skip to content

auth-broken owner alert prescribes shared-creds re-auth for provider-lane agents — wrong runbook for proxy-lane 401s #872

Description

@olegbrok

Summary

The "Claude auth broken" owner alert fires a fixed remediation — "SSH to the host, run 'claude' to log back in, then restart" — that assumes the shared-credentials de-auth failure class. For provider-lane agents (custom provider_url, e.g. solik through claude-code-proxy), authentication_failed StopFailures usually mean the PROVIDER lane is failing (last night: the proxy's token-refresh race, raine/claude-code-proxy#42), and the suggested remediation is wrong — re-logging-in Claude would do nothing, and an owner following it at 3am wastes the effort (Brad received exactly this pair of alerts 2026-07-12 03:12).

Ask

When the failing agent's registry row has a non-empty provider_url, the alert should say so and point at the provider lane instead: e.g. "agent runs via custom provider {url} — check the provider service/logs; Claude re-auth will NOT fix this." Optionally include the last upstream status when available. The watchdog can't diagnose, but it can stop prescribing the wrong runbook.

Evidence: solik alerts 03:12 2026-07-12 ("3/4 failures in window") during the proxy 401 storm; root cause + fix documented in #871 (comment 4951580414).

🤖 Opened by Barsik

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions