Stop Cable when authentication ends

go.mod

@@ -7,7 +7,7 @@ require (
 	charm.land/bubbletea/v2 v2.0.9
 	charm.land/glamour/v2 v2.0.1
 	charm.land/lipgloss/v2 v2.0.6
-	github.com/basecamp/actioncable-go v1.0.0
+	github.com/basecamp/actioncable-go v1.1.0
 	github.com/basecamp/hey-sdk/go v0.31.1
 	github.com/basecamp/mcp v0.0.0-20260828100356-2d6f44b51e9d
 	github.com/charmbracelet/x/ansi v0.11.8

go.sum

@@ -87,8 +87,8 @@ github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/basecamp/actioncable-go v1.0.0 h1:m8UGFYfBfa/YivQNayc2VoS+oVKLG+ixKzhIzdACWDM=
-github.com/basecamp/actioncable-go v1.0.0/go.mod h1:ezaV5z1GXQAsqyejqTs6wCFl2D8Wj+COLQkHc/kwoRs=
+github.com/basecamp/actioncable-go v1.1.0 h1:AizmCxoKvmUMdqwMQCCLQrFaVbjp8RhkneWidxygc7E=
+github.com/basecamp/actioncable-go v1.1.0/go.mod h1:ezaV5z1GXQAsqyejqTs6wCFl2D8Wj+COLQkHc/kwoRs=
 github.com/basecamp/hey-sdk/go v0.31.1 h1:dFlCe4LMmLAHgRB05QRHaE26XPPkZVIMp0qCGEanVQU=
 github.com/basecamp/hey-sdk/go v0.31.1/go.mod h1:eCJOhTLOpi2FCQUXireHZQ7DzRs2TUqvYhRDTfVLoDY=
 github.com/basecamp/mcp v0.0.0-20260828100356-2d6f44b51e9d h1:zEQVGq1x1nhKMZ2TudFAcSJ32CHT8richI1vQakIKz4=

internal/cable/cable.go

@@ -4,6 +4,7 @@ package cable
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -13,6 +14,7 @@ import (
 
 	"github.com/basecamp/actioncable-go"
 
+	"github.com/basecamp/hey-cli/internal/apierr"
 	"github.com/basecamp/hey-cli/internal/auth"
 	"github.com/basecamp/hey-cli/internal/version"
 )
@@ -37,11 +39,12 @@ func Dial(ctx context.Context, baseURL string, authMgr *auth.Manager, options ..
 		return nil, err
 	}
 
-	settings := make([]actioncable.Option, 0, 1+len(options))
+	settings := make([]actioncable.Option, 0, 2+len(options))
 	settings = append(settings, actioncable.WithHeaderFunc(func(ctx context.Context) (http.Header, error) {
 		return authHeader(ctx, baseURL, authMgr)
 	}))
 	settings = append(settings, options...)
+	settings = append(settings, actioncable.WithStopOnError(terminalConnectionError))
 
 	opening, giveUp := context.WithTimeout(ctx, openTimeout)
 	defer giveUp()
@@ -81,6 +84,11 @@ func URL(baseURL string) (string, error) {
 	return parsed.String(), nil
 }
 
+func terminalConnectionError(err error) bool {
+	var classified *apierr.Error
+	return errors.As(err, &classified) && classified.Code == apierr.CodeAuth
+}
+
 func authHeader(ctx context.Context, baseURL string, authMgr *auth.Manager) (http.Header, error) {
 	request, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL, nil)
 	if err != nil {

internal/cable/cable_test.go

@@ -3,7 +3,10 @@ package cable
 import (
 	"context"
 	"errors"
+	"fmt"
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"slices"
 	"strings"
@@ -13,6 +16,7 @@ import (
 
 	actioncable "github.com/basecamp/actioncable-go"
 
+	"github.com/basecamp/hey-cli/internal/apierr"
 	"github.com/basecamp/hey-cli/internal/auth"
 )
 
@@ -131,6 +135,137 @@ func TestEveryDialCarriesCurrentCredentials(t *testing.T) {
 	}
 }
 
+type droppingConn struct {
+	reads   chan []byte
+	dropped chan struct{}
+	once    sync.Once
+}
+
+func newDroppingConn() *droppingConn {
+	return &droppingConn{
+		reads:   make(chan []byte, 1),
+		dropped: make(chan struct{}),
+	}
+}
+
+func (c *droppingConn) Subprotocol() string { return actioncable.V1JSON{}.Subprotocol() }
+
+func (c *droppingConn) Read(ctx context.Context) ([]byte, error) {
+	select {
+	case payload := <-c.reads:
+		return payload, nil
+	case <-c.dropped:
+		return nil, io.EOF
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func (c *droppingConn) Write(context.Context, []byte) error { return nil }
+
+func (c *droppingConn) Close() error {
+	c.once.Do(func() { close(c.dropped) })
+	return nil
+}
+
+type singleConnTransport struct {
+	conn *droppingConn
+
+	mu    sync.Mutex
+	dials int
+}
+
+func (t *singleConnTransport) Dial(context.Context, string, actioncable.DialOptions) (actioncable.Conn, error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.dials++
+	if t.dials > 1 {
+		return nil, errors.New("unexpected second transport dial")
+	}
+	return t.conn, nil
+}
+
+func TestOnlyAuthenticationFailuresStopReconnects(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{name: "authentication", err: apierr.ErrAuth("signed out"), want: true},
+		{name: "rate limit", err: apierr.ErrRateLimit(30), want: false},
+		{name: "network", err: apierr.ErrNetwork(io.EOF), want: false},
+		{name: "storage", err: errors.New("keyring is locked"), want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := terminalConnectionError(tt.err); got != tt.want {
+				t.Errorf("terminalConnectionError(%v) = %t, want %t", tt.err, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestAuthenticationFailureStopsAReconnect(t *testing.T) {
+	refreshCalls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/oauth/tokens" {
+			t.Errorf("path = %q, want /oauth/tokens", r.URL.Path)
+		}
+		refreshCalls++
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = fmt.Fprint(w, `{"error":"invalid_grant"}`)
+	}))
+	defer server.Close()
+
+	t.Setenv("HEY_NO_KEYRING", "1")
+	t.Setenv("HEY_TOKEN", "")
+	configDir := t.TempDir()
+	manager := auth.NewManager(server.URL, server.Client(), configDir)
+	if err := manager.GetStore().Save(manager.CredentialKey(), &auth.Credentials{
+		AccessToken:  "working-access",
+		RefreshToken: "dead-refresh",
+		ExpiresAt:    time.Now().Add(time.Hour).Unix(),
+	}); err != nil {
+		t.Fatalf("save working credential: %v", err)
+	}
+
+	conn := newDroppingConn()
+	conn.reads <- []byte(`{"type":"welcome"}`)
+	transport := &singleConnTransport{conn: conn}
+	client, err := Dial(t.Context(), server.URL, manager,
+		actioncable.WithTransport(transport),
+		actioncable.WithBackoff(time.Millisecond, time.Millisecond))
+	if err != nil {
+		t.Fatalf("Dial: %v", err)
+	}
+	t.Cleanup(func() { _ = client.Close() })
+
+	replacement := auth.NewManager(server.URL, server.Client(), configDir)
+	if err := replacement.GetStore().Save(replacement.CredentialKey(), &auth.Credentials{
+		AccessToken:  "expired-access",
+		RefreshToken: "dead-refresh",
+		ExpiresAt:    time.Now().Add(-time.Hour).Unix(),
+	}); err != nil {
+		t.Fatalf("save expired credential: %v", err)
+	}
+	_ = conn.Close()
+
+	select {
+	case <-client.Done():
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("client kept reconnecting after authentication failed")
+	}
+	var authErr *apierr.Error
+	if err := client.Err(); !errors.As(err, &authErr) || authErr.Code != apierr.CodeAuth {
+		t.Fatalf("client error = %v, want authentication failure", err)
+	}
+	if refreshCalls != 1 {
+		t.Errorf("refresh requests = %d, want 1", refreshCalls)
+	}
+}
+
 func TestDialHeaderRereadsStoredCredentials(t *testing.T) {
 	t.Setenv("HEY_NO_KEYRING", "1")
 	t.Setenv("HEY_TOKEN", "")