[diegosouzapw]

Summary

Closes part of #4038 (the credential-loss failure mode). Implements the compare-and-swap (CAS) guard on the OAuth refresh persist that #5292 described but did not actually contain — #5292 was closed as unmergeable (a 2,333-file diverged-fork diff with no CAS code in its tree). Full credit to @KooshaPari for the root-cause diagnosis; carried forward here as co-author.

Problem

The per-connection refresh mutex makes [network refresh + DB write] atomic for one connection, but it does not protect against a third writer (a sibling request, a concurrent HealthCheck, or a replica) landing a fresher refresh_token rotation on the same connection_id between the staleness read and the persist. Overwriting that fresher row reverts the sibling's rotation; the next caller loads the now-consumed token, Auth0/Anthropic flag refresh_token_reused, and the whole token family is revoked (the 1352× claude/aa5dd5cf invalidation storm).

Fix

• runWithCasGuard / getActiveCasGuard AsyncLocalStorage pair (mirrors the existing runWithOnPersist Fix-A pattern). The guard carries the refresh_token the caller presented (the natural CAS version token, since refresh_tokens rotate every refresh) plus a reread of the row's current refresh_token.
• Inside the per-connection mutex, getAccessToken re-reads via casGuardShouldSkipPersist immediately before effectiveOnPersist; if a concurrent writer rotated the row past the presented token (wasRefreshTokenRotated), the persist is skipped so the DB stays at the fresher state. The caller still receives the new access token — upstream already authenticated the request.
• chatCore.ts builds the reread from getProviderConnectionById(connectionId) and wraps the reactive 401/403 refresh in runWithCasGuard.
• Opt-in: no active guard ⇒ byte-identical behavior. Skip/persist counters via getCasGuardStats().

Note: the PR body of #5292 also mentioned a "Bifrost outcome mutex split" — that targets bifrostShadow.ts, which is part of the fork's bifrost architecture and does not exist in OmniRoute, so it is N/A here.

Validation (TDD)

tests/unit/token-refresh-cas-guard-4038.test.ts — 3 cases driving the real getAccessToken with a mocked Anthropic token endpoint + an injected reread:

1. concurrent rotation ⇒ persist skipped, getCasGuardStats().skipped === 1, caller still gets the access token;
2. unchanged row ⇒ persist runs, persisted === 1;
3. no guard ⇒ persist always runs (opt-in, zero behavior change).

Fails without the skip (verified). npm run typecheck:core clean; the existing 55 token-refresh tests (race-comprehensive + service + this) pass; check:file-size OK (baseline bumped with justification).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.