What
When Claude Code asks its SDK host to refresh an OAuth token, the host may now answer with no token plus an optional reason, and the client treats that as a clean decline rather than an assumed success.
Details
- The refresh path returns null when the host declines or answers empty, and records the host's stated reason.
- A new
tengu_sdk_oauth_refresh_unfulfilledevent distinguishes stream_closed, timeout, invalid_response, declined and null outcomes, with a duration. - The reason field is parsed leniently, so an unknown or malformed value becomes undefined and can never cost a token that was actually delivered.
- SDK transport only.
Evidence
tengu_sdk_oauth_refresh_unfulfilled, Why the host returned no token (only meaningful when accessToken is null)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.