fix(oauth): adopt newer disk credentials before cleanup

Author: luvs01

src/oauth/index.ts

@@ -786,10 +786,6 @@ export async function refreshAnthropicAccountWithLock(
     const account = getAccountSet(provider)?.accounts.find(candidate => candidate.id === accountId);
     const generation = credentialGeneration(stored);
     let pendingIntent = readOAuthRefreshIntent(provider, accountId);
-    if (pendingIntent?.cleanupPending && pendingIntent.generation === generation) {
-      resumeAnthropicRefreshIntentCleanup(provider, accountId, pendingIntent);
-      pendingIntent = undefined;
-    }
     const disk = newerClaudeCredential(stored, now());
     if (disk) {
       const outcome = await mergeAccountCredential(provider, accountId, disk, {
@@ -806,6 +802,10 @@ export async function refreshAnthropicAccountWithLock(
       if (pendingIntent) clearAnthropicRefreshIntentBestEffort(provider, accountId, pendingIntent);
       return disk.access;
     }
+    if (pendingIntent?.cleanupPending && pendingIntent.generation === generation) {
+      resumeAnthropicRefreshIntentCleanup(provider, accountId, pendingIntent);
+      pendingIntent = undefined;
+    }
     if (!pendingIntent?.uncertain && pendingIntent?.generation === generation) {
       if (pendingIntent.staleOwner) throw new OAuthTokenRefreshStaleError();
       if (deps.replacedStaleFlight && pendingIntent.flightId === deps.replacedStaleFlight.flightId) {

tests/oauth-refresh.test.ts

@@ -1210,8 +1210,13 @@ describe("oauth refresh hardening", () => {
     await saveCredential("anthropic", { access: "old", refresh: "rt-old", expires: 1, source: "local-cli" });
     const id = getAccountSet("anthropic")!.activeAccountId;
     const stored = getAccountCredential("anthropic", id)!;
-    writeOAuthRefreshIntent("anthropic", id, credentialGeneration(stored));
-    expect(readOAuthRefreshIntent("anthropic", id)).toBeDefined();
+    const pending = writeOAuthRefreshIntent("anthropic", id, credentialGeneration(stored));
+    expect(markOAuthRefreshIntentCleanupPending(
+      "anthropic",
+      id,
+      pending,
+      "definitive-rejection",
+    )).toMatchObject({ cleanupPending: "definitive-rejection" });
 
     seedClaudeCredentials("disk", "rt-new", Date.now() + 3600_000);
     const mock = mockRefreshFetch([new Response("unexpected", { status: 500 })]);
@@ -1234,6 +1239,7 @@ describe("oauth refresh hardening", () => {
     expect(mock.count()).toBe(0);
     expect(getCredential("anthropic")?.refresh).toBe("rt-new");
     expect(getAccountSet("anthropic")!.accounts[0]!.needsReauth).toBeUndefined();
+    expect(readOAuthRefreshIntent("anthropic", id)?.cleanupPending).toBe("definitive-rejection");
   });
 
   test("marked Anthropic local-cli account lazily recovers only from a newer disk generation", async () => {