VERIFIED

azuread__microsoft-authentication-library-for-python-186

VERIFIED on first verdict

1 attempt, 0 appeals. 1 file, 10 added and 1 removed lines. Tokens: 1,374,492 tokens. Model cost: $0.42. Sandbox time: 2 min 37 s.

Open receipt

The plan

Repository: azuread/microsoft-authentication-library-for-python
Base commit: c235d4e (image tag)
Issue: Refresh token errors are discarded `acquire_token_silent_with_error` appears to be intended to return the last error response received from AAD, and the documentation implies it does so, but there are cases in which it does not. For example, if AAD rejects a refresh token, its error response is discarded (`at` is the response): https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/5c1f0f4ad18a61587393c290b1094b5f8fd014d4/msal/application.py#L601-L609 When AAD rejected the token, that token was evicted from the cache: https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/5c1f0f4ad18a61587393c290b1094b5f8fd014d4/msal/oauth2cli/oauth2.py#L449-L450

Files to edit

msal/application.py

Approach: Preserve the last non-None response from silent acquisition attempts even when the final lookup yields no tokens, ensuring error responses from AAD are not discarded.

Attempt 1

VERIFIED

Agent branch

Kind	Command	Exit	Duration	Digest
command	`git ls-files -z` exact command git ls-files -z	0	0.004s	759ecdaa
command	`grep -n "acquire_token_silent_with_error" msal/application.py` exact command grep -n "acquire_token_silent_with_error" msal/application.py	0	0.003s	94cc5915
command	`grep -n "test_preexisting_family_app_will_attempt_frt_and_return_error" tests/test_application.py` exact command grep -n "test_preexisting_family_app_will_attempt_frt_and_return_error" tests/test_application.py	0	0.003s	d5813bf9
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-2ee029a4dae64ee3bc0210ff9d8251f9/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-2ee029a4dae64ee3bc0210ff9d8251f9/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-4.xml	1	0.740s	325e389aa040
command	`grep -n "frt\\|FRT" tests/test_application.py` exact command grep -n "frt\\|FRT" tests/test_application.py	0	0.003s	72d04abe
command	`grep -n "remove_rt\\|on_removing_rt" msal/oauth2cli/oauth2.py` exact command grep -n "remove_rt\\|on_removing_rt" msal/oauth2cli/oauth2.py	0	0.003s	25ff01c9
command	`find tests -name ".py" -exec grep -l "TokenCacheTestCase" {} \;` exact command find tests -name ".py" -exec grep -l "TokenCacheTestCase" {} \;	0	0.016s	45f456ec
command	`grep -n "def add" msal/token_cache.py` exact command grep -n "def add" msal/token_cache.py	0	0.003s	622a7e1b

show all 26 steps

Kind	Command	Exit	Duration	Digest
write	`write tests/test_application.py` exact command /opt/receipts-7d527a85da8a43e48d7a0c238e898dd4/bin/busybox sh -c 'mkdir -p /microsoft-authentication-library-for-python/tests && cp /opt/receipts-7d527a85da8a43e48d7a0c238e898dd4/incoming/a4ad1bc81ebf6f4a90bf76d5a2590c8bed8831a78d14e01d69dc2ddcf9e6f373 /microsoft-authentication-library-for-python/tests/test_application.py'	0	0.004s	99cb12d5
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-fd369f7672b4446bb45e362b0828ebd2/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-fd369f7672b4446bb45e362b0828ebd2/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-10.xml	1	0.736s	e9d6052f2ae8
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors::test_acquire_token_silent_with_error_will_return_error -v` exact command /opt/receipts-a05baaf9dc5e4fe1a8a2e67413aca751/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-a05baaf9dc5e4fe1a8a2e67413aca751/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors::test_acquire_token_silent_with_error_will_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-11.xml	0	0.750s	e9d6052f2ae8
write	`write msal/application.py` exact command /opt/receipts-2c351e67f17a4e0bbba47c8cb430e18d/bin/busybox sh -c 'mkdir -p /microsoft-authentication-library-for-python/msal && cp /opt/receipts-2c351e67f17a4e0bbba47c8cb430e18d/incoming/c8faa63b7394b7d2c2acca7da7b0af1fd0c5863b4eb198839eb229a427a591b0 /microsoft-authentication-library-for-python/msal/application.py'	0	0.005s	9b22f393
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-6ebb537bced54fcbbdc80920a3b61f20/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-6ebb537bced54fcbbdc80920a3b61f20/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-13.xml	1	0.745s	07031d09acc1
write	`write msal/application.py` exact command /opt/receipts-acdd2719549a4e9cb366d0e569450567/bin/busybox sh -c 'mkdir -p /microsoft-authentication-library-for-python/msal && cp /opt/receipts-acdd2719549a4e9cb366d0e569450567/incoming/e4447368d41f8a68e6d6c22d061ab3a67c3604a3d2cbdfa905829d1c5c7a4b91 /microsoft-authentication-library-for-python/msal/application.py'	0	0.005s	e8cedfc8
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors::test_acquire_token_silent_with_error_will_return_error -v` exact command /opt/receipts-5db17683030548ab90ba63cfece80a8e/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-5db17683030548ab90ba63cfece80a8e/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors::test_acquire_token_silent_with_error_will_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-15.xml	0	0.749s	e9d6052f2ae8
write	`write tests/test_application.py` exact command /opt/receipts-9d6c9110ba814865be8696eef83a310c/bin/busybox sh -c 'mkdir -p /microsoft-authentication-library-for-python/tests && cp /opt/receipts-9d6c9110ba814865be8696eef83a310c/incoming/0e1fcb970d6c69835a5b8d7430feed0dc78a50bf720239dd86e2de7f48042e11 /microsoft-authentication-library-for-python/tests/test_application.py'	0	0.005s	57494be2
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-d13defd4a0f944d7b29284b93b2a9f7b/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-d13defd4a0f944d7b29284b93b2a9f7b/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-17.xml	1	0.739s	325e389aa040
write	`write msal/application.py` exact command /opt/receipts-b75555d801e24b2a936efbfd3591d2c2/bin/busybox sh -c 'mkdir -p /microsoft-authentication-library-for-python/msal && cp /opt/receipts-b75555d801e24b2a936efbfd3591d2c2/incoming/a82dfb62e8be71301183e2f40425517e09d72433b9dab9fe1c6ff02ae490ae68 /microsoft-authentication-library-for-python/msal/application.py'	0	0.005s	bb6171ed
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-217c6747fb3d4448b2d22fdc18d024df/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-217c6747fb3d4448b2d22fdc18d024df/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-19.xml	0	0.739s	a042af18cc8b
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors -v` exact command /opt/receipts-5b06190d8fbb407ca3f88ae88719e349/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-5b06190d8fbb407ca3f88ae88719e349/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentErrorBehaviors -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-20.xml	0	0.953s	a042af18cc8b
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors -v` exact command /opt/receipts-91b6e97eb5dd4c898d2fb979a565c59b/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-91b6e97eb5dd4c898d2fb979a565c59b/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-21.xml	0	0.811s	a042af18cc8b
command	`pytest tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v` exact command /opt/receipts-fe9125f62c8e40858ad4bdee1248535f/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-fe9125f62c8e40858ad4bdee1248535f/receipts_pytest.py tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error -v -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/agent1-22.xml	0	0.719s	a042af18cc8b

Kind	Command	Exit	Duration	Digest
write	`write /tmp/test_error_preservation.py` exact command /opt/receipts-98239929987c45baa5d16f903e8335be/bin/busybox sh -c 'mkdir -p /tmp && cp /opt/receipts-98239929987c45baa5d16f903e8335be/incoming/275b2c94f8f90e538df54e2f42201efd50b833f4440e99d90f194eb92f949b4f /tmp/test_error_preservation.py'	0	0.005s	c6a3441e
command	`cd /microsoft-authentication-library-for-python && python /tmp/test_error_preservation.py` exact command cd /microsoft-authentication-library-for-python && python /tmp/test_error_preservation.py	1	0.127s	203942e8
write	`write /tmp/test_error_preservation.py` exact command /opt/receipts-f81bfe5aff51467eb2de77d57a989f8f/bin/busybox sh -c 'mkdir -p /tmp && cp /opt/receipts-f81bfe5aff51467eb2de77d57a989f8f/incoming/cda90201e66fc0d7229e1e92ec6cd24cb8b6bd1fdc4a0f3caf3d50223427e42d /tmp/test_error_preservation.py'	0	0.005s	caa17901
diff	`capture patch` exact command compute patch in executor staging agent1-243018c66c8247c89a2396afeee3c411: /opt/homebrew/Cellar/git/2.53.0/bin/git -c core.hooksPath=/dev/null -c core.attributesFile=/dev/null -c diff.external= -c core.quotePath=false add -A && /opt/homebrew/Cellar/git/2.53.0/bin/git -c core.hooksPath=/dev/null -c core.attributesFile=/dev/null -c diff.external= -c core.quotePath=false diff --cached --binary --no-ext-diff --no-textconv --no-renames c6e3e926ccea69b30d313da1b592a1bb7810c5ec	0	0.042s	a042af18cc8b

Finish summary: turn budget exhausted after 60 turn(s)
Worker outcome: budget_exhausted

Claims not recorded

Witness branch w1

Kind Command Exit Duration Digest

apply

Kind	Command	Exit	Duration	Digest
apply	`apply patch bc2a3f8e4146` exact command git update-index -q --refresh; git apply -v --3way --recount --ignore-space-change --whitespace=nowarn /opt/receipts-b2ffe0dd3df54f34a2e3d135038f1b3a/incoming/bc2a3f8e4146dde4df243761a138b6f394acd6b172ae96ea777a4eabde487926.diff	0	0.008s	a042af18cc8b
verification	`pytest (witness) tests/test_application.py` exact command /opt/receipts-75cc59e42a4a4011a7be9def7bb1c06d/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-75cc59e42a4a4011a7be9def7bb1c06d/receipts_pytest.py --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning tests/test_application.py -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/w1-2.xml	0	1.107s	a042af18cc8b

apply patch bc2a3f8e4146

exact command

git update-index -q --refresh; git apply -v --3way --recount --ignore-space-change --whitespace=nowarn /opt/receipts-b2ffe0dd3df54f34a2e3d135038f1b3a/incoming/bc2a3f8e4146dde4df243761a138b6f394acd6b172ae96ea777a4eabde487926.diff

0.008s

a042af18cc8b

verification

pytest (witness) tests/test_application.py

exact command

/opt/receipts-75cc59e42a4a4011a7be9def7bb1c06d/bin/busybox mkdir -p /opt/receipts/reports && python -I /opt/receipts-75cc59e42a4a4011a7be9def7bb1c06d/receipts_pytest.py --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning tests/test_application.py -o junit_family=xunit1 -p no:cacheprovider -rA --continue-on-collection-errors --junitxml=/opt/receipts/reports/w1-2.xml

1.107s

a042af18cc8b

Gate predicate checklist

Predicate	Name	Status	Evidence
`R1_fail_to_pass`	Failing specification tests now pass	PASS	target tests passed: tests/test_application.py::TestClientApplicationAcquireTokenSilentFociBehaviors::test_preexisting_family_app_will_attempt_frt_and_return_error
`R2_pass_to_pass`	Previously passing tests kept	PASS	17 baseline-passing tests still pass
`R3_no_shrink`	No removed tests or new skips	PASS	all 18 baseline tests collected; skips unchanged (0)
`R4_patch_scope`	Patch scope	PASS	patch touches 1 file(s), all in scope
`R5_provenance`	Witness chain and patch digest	PASS	agent chain d626db55 -> caa17901 unbroken over 26 receipt(s); witness chain d626db55 -> e3010190 unbroken over 2 receipt(s); applied digest matches
`R6_claim_audit`	Agent claim audit (advisory)	FAIL	branch ended without a finish call

What it said

Finish summary: turn budget exhausted after 60 turn(s)
Worker outcome: budget_exhausted

Claims not recorded

What the record shows

no claim: branch ended without a finish call

SWE-rebench's official grader: resolved

Agrees with the gate

Shipped patch

diff --git a/msal/application.py b/msal/application.pyindex a17d359..ba17d22 100644--- a/msal/application.py+++ b/msal/application.py@@ -616,6 +616,7 @@ class ClientApplication(object):             # "realm": authority.tenant,  # AAD RTs are tenant-independent             }         app_metadata = self._get_app_metadata(authority.instance)+        last_error = None         if not app_metadata:  # Meaning this app is now used for the first time.             # When/if we have a way to directly detect current app's family,             # we'll rewrite this block, to support multiple families.@@ -633,16 +634,24 @@ class ClientApplication(object):                 **kwargs)             if at and "error" not in at:                 return at+            else:+                last_error = at         if app_metadata.get("family_id"):  # Meaning this app belongs to this family             at = self._acquire_token_silent_by_finding_specific_refresh_token(                 authority, scopes, dict(query, family_id=app_metadata["family_id"]),                 **kwargs)             if at and "error" not in at:                 return at+            else:+                last_error = at         # Either this app is an orphan, so we will naturally use its own RT;         # or all attempts above have failed, so we fall back to non-foci behavior.-        return self._acquire_token_silent_by_finding_specific_refresh_token(+        at = self._acquire_token_silent_by_finding_specific_refresh_token(             authority, scopes, dict(query, client_id=self.client_id), **kwargs)+        if at and "error" not in at:+            return at+        # Return the last error we saw if all attempts failed to get a token+        return last_error if last_error is not None else at      def _get_app_metadata(self, environment):         apps = self.token_cache.find(  # Use find(), rather than token_cache.get(...)

Model and costs

Model: NVIDIA Nemotron 3 Super thinking off · temperature 1.0 · top_p 0.95
Tokens: 1,374,492 tokens
Model cost: $0.42
Sandbox time: 2 min 37 s
Sandbox cost: Token Factory reported cost: 0.128 (unit not published)

Full environment disclosure

{
  "executor_kind": "tokenfactory",
  "lock_sha256": "c151d7e9bacfa8ee95a98f848dbdfa9929a3f4c7cf826e9c78be49171d89b6d5",
  "model": {
    "base_url": "https://api.tokenfactory.nebius.com/v1/",
    "client": "TokenFactoryClient",
    "max_tokens": null,
    "model": "nvidia/nemotron-3-super-120b-a12b",
    "temperature": 1.0,
    "thinking": false,
    "top_p": 0.95
  },
  "pytest_config_digests": {
    "setup.cfg": "da10534716df5a71d88112546d8efc9b6fa31a8f1212f2c36b07e4bef596f60c"
  },
  "receipts_version": "0.0.1",
  "test_digests": {
    "tests/__init__.py": "0fe05498aa5cd87e241fb5e5825afe59ccb2ccbf520376519b957364ead74fff",
    "tests/archan.us.mex.xml": "bcbf945c19cc25a59cf682e4ab3765de51506a9f0b21fd1172a35d925fe7b43b",
    "tests/arupela.mex.xml": "afffb101bb79919fb8059aa3997f20f69fed1d201211f11009aabd515a029b71",
    "tests/authcode.py": "3b7e2a27aaae0b8cfe37953533702a4dffed131feadd31e38d7dc52dd60d5839",
    "tests/http_client.py": "e150d9b7c4541bed99a7ab9c16c30dafe1ba64f1021ba2a3f0633aec0392072e",
    "tests/microsoft.mex.xml": "7832ad52273b2d4895681bad18ef3d654a583588f816997000dd58ff8e749525",
    "tests/rst_response.xml": "ff9239a4104d5dd83dafcfc802b8f4fdbac4a80a4962466504455388d83ab481",
    "tests/test_application.py": "0e1fcb970d6c69835a5b8d7430feed0dc78a50bf720239dd86e2de7f48042e11",
    "tests/test_assertion.py": "f9776a26c0cddb87e57dff8c2138669f3b043687b2ca1606b99a53b1c67024e5",
    "tests/test_authority.py": "518d40fc6557524c9a1bee752bd734bcee4becf5eb784baab3b27f4b8ab7d9ec",
    "tests/test_client.py": "e1058ec851eb79239db0072cab77b592810af4c24506466ad8f0ff414c8d00f0",
    "tests/test_e2e.py": "a63a3e84b0aadf3e6523a3605af01036514406443d0c922aceb5c519a91af176",
    "tests/test_mex.py": "f17ffc8733a0c21c0c0473efeca758658d3d027ff937dbece08678dd1cfe94d5",
    "tests/test_token_cache.py": "815e68385f4ea22fa447b395dfe18c21c37c7da8315fb5eb5ab0200678ce1d96",
    "tests/test_wstrust.py": "42780c22290b01fbe5d2a9161803f8fee23b78bd8b88b541dc7b5b17fd31b52d"
  }
}

The bundle

Recorded JSON and patches. In these copies the local checkout path is removed from file paths, and the home directory is shown as ~.