At most one HTTP client
Why it matters
Two HTTP clients create two error-handling conventions, two interceptor pipelines, two retry policies, and two authentication header-injection paths. A token refresh that works in your axios interceptor silently skips every ky call, producing inconsistent 401 behavior that depends on which file made the request. Request/response logging captures only half your traffic, and timeout defaults differ (axios has no default timeout, ky defaults to 10 seconds) creating unpredictable production behavior.
Severity rationale
High because inconsistent auth-header injection and timeout behavior produce hard-to-reproduce production incidents.
Remediation
Wrap your chosen client once and import only that wrapper everywhere.
// src/lib/http.ts
import ky from 'ky'
export const http = ky.extend({
prefixUrl: '/api',
timeout: 10000,
hooks: { beforeRequest: [addAuthHeader] },
})
Rewrite every axios call site to use import { http } from '@/lib/http', then npm uninstall axios. Add an ESLint rule forbidding direct imports of both libraries outside src/lib/http.ts.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Multi-Session Drift Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-code-drift·automated