[AlaeddineMessadi]

Follow-ups to #34 before 3.1.0.

Changes

• Stop retrying refused OpenChamber sign-ins (src/auth.ts). With a wrong OPENCODE_OPENCHAMBER_PASSWORD, every tool call and client retry posted the password again. OpenChamber locks the client IP out for 15 minutes, UI included, after 10 failures less than 5 minutes apart (checked in @openchamber/web 1.24.0, ui-auth.js). Even a 60s cooldown would only delay the lockout. Now:
  • a 401, or a 200 with no client token, is reported until restart, because the password comes from the environment;
  • a 429 waits for Retry-After, in seconds or as an HTTP date;
  • other 4xx responses wait 60s;
  • network errors and 5xx responses are retried as before, because they never reached the limiter.
• Dependency floors (package.json). @modelcontextprotocol/core and /server go to ^2.4.0, and zod to ^4.6.6, for GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-mrhx-c7xc-m3w5 and GHSA-rvq5-wwqv-78pq. The ranges are raised, not only the lockfile, because the published package doesn't ship one. Dev dependencies are refreshed too.
• Docs. 3.x needs OpenChamber 1.12 to 1.24. 1.12 added client tokens, and 2.x fronts OpenCode 2.x. The docs also now say when to set a stable OPENCODE_OPENCHAMBER_CLIENT_ID so restarts don't pile up trusted-device entries.

Validation

• npm test: 525 passed, 3 skipped. There are new tests for a wrong password held until restart, Retry-After, 5xx and network-error retries, and Retry-After parsing. I confirmed the retry tests fail if every error is cached.
• tsc --noEmit, npm run docs:check, npm pack --dry-run and git diff --check pass, and npm audit reports 0 vulnerabilities.
• Not tested against a live OpenChamber deployment.