stacklok / toolhive / 27764848604

push

github

Sync LLM token refresh window with helper TTL (#5557)

When ToolHive configures Claude Code, it writes an apiKeyHelper
(thv llm token) that Claude Code re-invokes on a fixed cadence. The
token source only refreshed 30s before expiry, far shorter than that
cadence, so a helper call near the token boundary could be handed an
about-to-expire token and in-flight requests would 401 before the next
re-invoke recovered. The 401 retry self-heals, but the blip is visible
(and amplified under parallel agent traffic).

Fix it belt-and-suspenders: pin the helper TTL and widen the token
source's preemptive window so the window always exceeds the TTL. Every
helper call in the final window then forces a refresh, so Claude Code
never holds an expired token.

- Add ClaudeCodeHelperTTL (5m) and LLMTokenRefreshWindow (2x TTL) to
  pkg/llmgateway as the single source of truth, kept in sync by a guard
  test asserting window > TTL.
- Add an optional per-source Options.PreemptiveRefreshWindow to the
  token source (0 = default 30s, negative panics). Only the LLM gateway
  path widens it; registry auth keeps the 30s default.
- Write CLAUDE_CODE_API_KEY_HELPER_TTL_MS into ~/.claude/settings.json
  via a new ValueField; RevertLLMGateway removes it on teardown.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

21 of 21 new or added lines in 2 files covered. (100.0%)

69349 of 103373 relevant lines covered (67.09%)

65.13 hits per line