The 401 Retry Bug: Auditing an Agent-Written Backoff Loop With a Fake Server

Описание и применение

Проблема: агент‑сгенерированный цикл повторных запросов с экспоненциальной задержкой неправильно обрабатывает ошибки, игнорирует статус‑коды и возвращает None, что может нарушить последующие вызовы. Решение: выявить дефекты в diff, запустить простую фиктивную серверную запись, написать юнит‑тесты для проверки таймингов и поведения.

Задача

A pull request added an exponential backoff loop that retries a 401 response six times, sleeping about 63 seconds, but the retry logic contains multiple defects: it catches all Exceptions, retries on non‑auth errors, ignores Retry‑After headers, and silently returns None.

Результат

The review uncovered that the agent‑written backoff loop incorrectly retries on all Exceptions, ignores status filtering, and silently returns None, potentially corrupting downstream callers. A minimal fake server and unit tests were used to validate timing and expose the defects.

Рабочий процесс

• Read the diff and identify retry smells
• Stand up a fake server that records timestamps
• Write unit tests that assert timing and behavior

Доказательства

It also retries a 401 six times. Along the way it sleeps about 63 seconds.

Источник

The first smell is except Exception. It catches KeyError from a bug in the caller. It catches programming errors and network errors with the same hand.

Источник

The second smell is the missing status filter. A 400 and a 503 produce identical behavior. Authentication failures get retried, which is pure latency with no upside.

Источник

The third smell is return None. A silent None corrupts every downstream caller.

Источник