{"version":"2.1.269","anchor":"account-plugin-sync-now-behind-its-own-experiment-flag","canonical_anchor":"refresh-retries-once-with-the-full-scope-set-if-the-server-r","heading":"OAuth tokens can now carry a user:plugins scope for plugin sync and search","tier":"soon","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/account-plugin-sync-now-behind-its-own-experiment-flag","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### OAuth tokens can now carry a user:plugins scope for plugin sync and search\n\nToken refresh can now request a user:plugins OAuth scope, used to gate account plugin sync and plugin\/skill search, with automatic retry if rejected\n\n**What**\n\n- Token refresh now requests the `user:plugins` OAuth scope alongside existing scopes. If the server rejects the expanded scope request with `invalid_scope`, the refresh automatically retries once with the original scope set, and the outcome is tagged `invalid_scope_retried` on both the success telemetry and the failure event's context.\n\n- The `tengu_oauth_token_refresh_success` telemetry event now records whether the `user:plugins` scope was requested and whether it was actually granted.\n\n- Account plugin sync now has its own experiment flag, `tengu_account_plugins_sync_enabled` (default off); when enabled and either the `allow_plugin_skill_search` or `allow_account_plugins_sync` policy is set, the `user:plugins` scope is included in the requested scope set.\n\n- A new gate decides whether to send a plugin\/skill search request at all, based on being first-party, not essential-traffic-only, not a CCR session token, and whether the current OAuth token already carries the `user:plugins` scope (refreshing the token first to check). Third-party OAuth clients or tokens without a refresh token still send the request; only a stock login token missing the scope skips it.\n\n**Why** This rolls out a new, narrower OAuth scope specifically for plugin-related features (account plugin sync, plugin\/skill search) instead of relying on broader existing scopes, while making sure older servers that don't yet recognize the scope don't break token refresh.\n\n- Area: Plugins\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}