Codex OAuth refresh can race across concurrent expired requests #28234

Description

Codex OAuth refresh can race when multiple requests enter the provider fetch path with an expired access token at the same time.

Each request sees expired auth state and independently calls the refresh-token grant with the same stored refresh token. Because the refresh token rotates, one refresh can succeed while the later concurrent refresh fails. This surfaces as intermittent Codex OAuth refresh failures instead of sharing the first successful refresh result.

Plugins

Built-in OpenAI / Codex OAuth provider

OpenCode version

dev branch as of May 18, 2026

Steps to reproduce

1. Sign in with OpenAI / Codex OAuth.
2. Let the stored access token expire.
3. Start two Codex-backed requests concurrently before refreshed auth state has been persisted.
4. Observe multiple refresh attempts using the same previous refresh token; one attempt may fail after the token rotates.

Screenshot and/or share link

N/A

Operating System

N/A

Terminal

N/A