[Arlieeee]

A token refresh in one process no longer breaks the others. The API ends the previous access token as soon as it issues a new one, so before this change a refresh in one command (a terminal, another agent, a host app) made every other holder of the old token fail with 401: a running wait, or a credential a host app handed over.

Fixed

• Refresh under the lock. The OAuth refresh runs entirely under the credentials lock, and the profile is re-read there: commands started together refresh once, and the rest use the new token instead of spending the refresh token again.
• A started refresh is always saved. From the refresh request to the save, a second Ctrl-C or the end of a terminate signal's grace period waits; the exit follows the save. A process stopped in between used to leave only a spent refresh token, which ended the login on the next refresh.
• A replaced token is retried once. After a 401 with an OAuth token (stored, or handed over through DSH_MESHY_CREDENTIAL), the request is retried once with the token now stored for the same login. Another account's token is never used.
• Windows: wait for PowerShell. The key store waits up to 30 seconds for Windows PowerShell (was 5). PowerShell can take several seconds to start on a cold or busy machine, which made the CLI fall back to the key file when saving a login, or fail to open a stored one. DPAPI never prompts; the Keychain and the Secret Service keep 5 seconds.

🤖 Generated with Claude Code