What's wrong with this entry?
Anonymous. No account, no email.
What
Expired OAuth refresh tokens now throw a distinct OAuthRefreshDeadError with a clear message, rather than a generic error.
Details
- Message: "OAuth refresh token is no longer valid; run /login to re-authenticate"
- The error class name
"OAuthRefreshDeadError"is surfaced in logs and can be caught specifically by error handlers. - The error is thrown at API client construction time when all three conditions hold: no API key is available, no current OAuth access token exists, and
OGt()is true — meaning the stored OAuth refresh token is either an empty string""or is found in an in-memory dead-token blacklist set (populated whenever a token refresh request fails). - When this error propagates to the request error handler, the displayed UI message branches by session type: interactive REPL sessions show
"Login expired · Please run /login"; agent/non-interactive sessions show"Failed to authenticate: OAuth session expired and could not be refreshed". - The error condition is also checked in the first-party HTTP client's teleport-org auth path: after a forced token refresh attempt, if
OGt()is still true, the request returns{ ok: false, reason: "no-auth" }with the same detail message rather than throwing. - Previously, token expiry produced ambiguous error messages that did not distinguish between a missing token and a definitively-expired one.
Evidence
Error class (search for "OAuthRefreshDeadError"); dead-token check (search for "OGt()"); UI message branching (search for "Login expired" alongside "OAuthRefreshDeadError")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.