The 401 Retry Bug: Auditing an Agent-Written Backoff Loop With a Fake Server

说明与用途

问题：代理生成的 PR 添加了一个指数退避循环，错误地重试 401 响应，忽略 Retry-After 头并返回 None，导致 downstream 出错。解决方案：构建一个记录时间戳的假服务器，并编写单元测试验证重试行为。

问题

An agent-generated pull request added an exponential backoff loop that incorrectly retries 401 responses, ignores Retry-After headers, and silently returns None, causing downstream failures.

结果

The review uncovered that the backoff loop retries on authentication failures, ignores Retry-After, and silently returns None, which corrupts downstream callers. The fake server and tests demonstrated the problematic timing and request pattern.

工作流

• Read the diff and identify retry smells
• Build a fake HTTP server that records timestamps
• Write unit tests that assert request timing and count

证据

It also retries a 401 six times. Along the way it sleeps about 63 seconds.

来源

The first smell is except Exception. It catches KeyError from a bug in the caller. It catches programming errors and network errors with the same hand.

来源

The second smell is the missing status filter. A 400 and a 503 produce identical behavior. Authentication failures get retried, which is pure latency with no upside.

来源