alphaXiv login always fails with "fetch failed": clerk.alphaxiv.org is NXDOMAIN

[quantmind-br]

Summary

feynman setup cannot log in to alphaXiv. It always fails with the opaque message:

alphaXiv login skipped: fetch failed

Root cause: the Clerk issuer hardcoded in @companion-ai/alpha-hub — https://clerk.alphaxiv.org — does not resolve. It returns an authoritative NXDOMAIN from alphaXiv's own Cloudflare nameservers, so the very first request of the OAuth flow (POST /oauth/register) can never succeed.

Reproduction

1. Install feynman 0.3.5 (linux-x64).
2. Run feynman setup.
3. Answer Yes to "Connect alphaXiv now?".
4. Observe alphaXiv login skipped: fetch failed. ~/.ahub/auth.json is never written.

feynman alpha login fails the same way (Login failed: fetch failed).

Root cause

@companion-ai/alpha-hub@0.1.3 — src/lib/auth.js:9:

const CLERK_ISSUER = 'https://clerk.alphaxiv.org';
const REGISTER_ENDPOINT = `${CLERK_ISSUER}/oauth/register`;

login() calls registerClient() first, which fetches REGISTER_ENDPOINT. That host is NXDOMAIN, Node's undici throws TypeError: fetch failed on ENOTFOUND, and the generic message hides the real cause.

DNS check (via DoH against Cloudflare 1.1.1.1; the authority section of the NXDOMAIN response is alphaXiv's own SOA, ariella.ns.cloudflare.com):

Host	Result
clerk.alphaxiv.org	NXDOMAIN
accounts.alphaxiv.org	NXDOMAIN
clerk.alphaxiv.com	NXDOMAIN
api.alphaxiv.org	OK (200)
www.alphaxiv.org	OK (200)

So it is not a client-side network/DNS/proxy problem — the rest of the alphaXiv domain is up and reachable; only the auth subdomain is gone.

Additionally, the current alphaXiv web frontend no longer loads Clerk at all: grepping the served HTML and JS assets (index-*.js, user-*.js, api-client-*.js, root-*.js) for clerk or pk_live_ / pk_test_ returns zero matches. That suggests alphaXiv migrated off Clerk and decommissioned the subdomain, leaving the CLI's OAuth flow pointing at a dead host.

0.1.3 is the latest published version of @companion-ai/alpha-hub on npm, so there is no newer release with a corrected endpoint. The alpha-hub-auth-patch.mjs applied at build time only rewrites the success/error HTML and the openBrowser WSL branch — it does not touch the issuer.

Impact

• alphaXiv login is impossible for all users on the current release.
• Everything gated behind the alphaXiv MCP client (getClient() in src/lib/alphaxiv.js, which throws Not logged in. Run 'alpha login' first.) is unusable.
• Unauthenticated REST paper search still works, and feynman setup otherwise completes, so this is not a hard blocker — but the failure is silent and misleading.

Suggested fix

1. Point CLERK_ISSUER at whatever auth provider alphaXiv now uses (or make it overridable via env var, e.g. ALPHAXIV_ISSUER, so it can be corrected without a release).
2. Surface a real diagnostic instead of the bare fetch failed — e.g. catch ENOTFOUND/EAI_AGAIN on the registerClient() fetch and report the unreachable host, so this doesn't read as a user-side network problem.

Environment

• feynman 0.3.5 (linux-x64 tarball, bundled Node v24.17.0)
• @companion-ai/alpha-hub 0.1.3
• Linux (Arch), kernel 7.1.3-arch1-1

[advaitpaliwal]

Fixed and released in v0.3.6. The dead clerk.alphaxiv.org/oauth/* routes are replaced at the bundled owning layer with alphaXiv's current api.alphaxiv.org/auth/oauth2/* endpoints, the OAuth scope includes openid, callback state is validated, and feynman alpha status now verifies credentials through live userinfo instead of trusting any cached token.

The published npm package is integrity-checked and its verified SLSA provenance resolves to release commit ccc8030c1090efb6afab8c4f907115309d1eb788. Exact-candidate CI passed in run 30355913177; post-release identity reconciliation is green in run 30373237537. Closing as completed.