chore(deps): bump @corbits/oauth-core to 0.3.3 (CL-11513)

package.json

@@ -90,7 +90,7 @@
     "@anthropic-ai/sandbox-runtime": "0.0.79",
     "@corbits/codex-provider": "0.1.3",
     "@corbits/meta-provider": "0.1.1",
-    "@corbits/oauth-core": "0.3.2",
+    "@corbits/oauth-core": "0.3.3",
     "@corbits/openai-responses": "0.2.2",
     "@corbits/xai-provider": "0.1.4",
     "@intx/agent": "workspace:*",

src/auth/codex/auth.test.ts

@@ -96,10 +96,10 @@ describe("codexTokensFromResponse", () => {
     expect(tokens.refresh).toBe("old-refresh");
   });
 
-  test("throws when no refresh token is available anywhere", () => {
-    expect(() => codexTokensFromResponse({ access_token: "a" }, 0)).toThrow(
-      /refresh_token/,
-    );
+  test("omits refresh when no refresh token is available anywhere", () => {
+    const tokens = codexTokensFromResponse({ access_token: "a" }, 0);
+    expect(tokens.access).toBe("a");
+    expect(tokens.refresh).toBeUndefined();
   });
 
   test("falls back to a default lifetime when expires_in is absent", () => {

src/auth/codex/session-failure.test.ts

@@ -106,7 +106,7 @@ describe("codex auth failure surface", () => {
       const auth = failure as CodexAuthError;
       const surfaced = authFailureSurface(auth);
       expect(surfaced).not.toContain(refresh);
-      expect(surfaced).toContain("grant rejected");
+      expect(surfaced).toContain("OAuth token endpoint returned 400");
       expect(surfaced).toContain("Re-authenticate");
     } finally {
       globalThis.fetch = originalFetch;

src/auth/meta/session.ts

@@ -1,6 +1,7 @@
 import {
   createTokenSession,
   isTokenExpired,
+  OAuthMissingRefreshTokenError,
   OAuthProfileNotFoundError,
   OAuthRefreshFailedError,
   type TokenSession,
@@ -145,11 +146,15 @@ export async function refreshStagedMetaTokens(
   now: number = Date.now(),
 ): Promise<MetaOAuthTokens> {
   if (!isMetaTokenExpired(tokens, now)) return tokens;
+  const refreshToken = tokens.refresh;
+  if (refreshToken === undefined || refreshToken.trim().length === 0) {
+    throw new OAuthMissingRefreshTokenError();
+  }
   let refreshed: MetaOAuthTokens;
   try {
-    refreshed = await refreshMetaTokens(tokens.refresh, now);
+    refreshed = await refreshMetaTokens(refreshToken, now);
   } catch (error) {
-    throw sanitizedRefreshFailure(error, tokens.refresh);
+    throw sanitizedRefreshFailure(error, refreshToken);
   }
   replaceMutableTokens(tokens, refreshed);
   return tokens;

src/auth/provider-token-session.ts

@@ -1,6 +1,7 @@
 import {
   createTokenSession,
   isTokenExpired,
+  OAuthMissingRefreshTokenError,
   OAuthProfileNotFoundError,
   OAuthRefreshFailedError,
   type AuthProfile,
@@ -195,11 +196,15 @@ export function createProviderTokenSession<TTokens extends BaseTokens, TAccess>(
     },
     refreshStaged: async (tokens, now = Date.now()) => {
       if (!isExpired(tokens, now)) return tokens;
+      const refreshToken = tokens.refresh;
+      if (refreshToken === undefined || refreshToken.trim().length === 0) {
+        throw new OAuthMissingRefreshTokenError();
+      }
       let refreshed: TTokens;
       try {
-        refreshed = await spec.refreshTokens(tokens.refresh, now, tokens);
+        refreshed = await spec.refreshTokens(refreshToken, now, tokens);
       } catch (error) {
-        throw sanitizedRefreshFailure(error, tokens.refresh);
+        throw sanitizedRefreshFailure(error, refreshToken);
       }
       replaceMutableTokens(tokens, refreshed);
       return tokens;

src/auth/xai/session-refresh-race.test.ts

@@ -235,7 +235,7 @@ describe("xAI shared-credential refresh race", () => {
       const auth = failure as XaiAuthError;
       const surfaced = authFailureSurface(auth);
       expect(surfaced).not.toContain(refresh);
-      expect(surfaced).toContain("grant rejected");
+      expect(surfaced).toContain("OAuth token endpoint returned 400");
       expect(surfaced).toContain("Re-authenticate");
     } finally {
       globalThis.fetch = originalFetch;