[diegosouzapw]

Root cause

99ad15a (#8182 / #8286) added a terminal-connection guard in
checkConnection() (src/lib/tokenHealthCheck.ts) that returns early
for any testStatus in {credits_exhausted, banned, expired}, to stop
the sweep from wasting CPU/network on connections that can never
self-heal via a token refresh.

But testStatus="expired" + errorCode="no_refresh_token" is exactly
the state the pre-existing GitHub Copilot self-heal targets
(isGitHubAccessTokenOnlyConnection + canClearGitHubNoRefreshTokenState,
same file, ~lines 83-97 / 413-492): a Copilot connection with no OAuth
refresh token but a still-valid copilotToken, which the sweep is
supposed to flip back to "active" once the Copilot sub-token proves
usable. With the new guard placed unconditionally ahead of that block,
the self-heal became unreachable for exactly the state it exists to
clear.

Impact: healthy GitHub Copilot connections that once lost their
OAuth refresh token got stuck at testStatus="expired" in the
dashboard forever, even though their Copilot sub-token kept working
and the sweep would have cleared the stale status back to "active"
every cycle before #8182.

Fix

Carve out the exact recoverable shape from the terminal-skip guard:

const isRecoverableGithubCopilotNoRefresh =
  conn.testStatus === "expired" &&
  conn.errorCode === "no_refresh_token" &&
  isGitHubAccessTokenOnlyConnection(conn);

and require !isRecoverableGithubCopilotNoRefresh in the early-return
condition. isGitHubAccessTokenOnlyConnection was already defined in
this file (no new import). Every other terminal case — credits_exhausted,
banned, and expired for any other reason — is still skipped
untouched, matching #8182's original intent.

Validation (TDD)

tests/unit/token-health-no-refresh-token-expired-5326.test.ts was
red before the fix (1 fail / 4 pass):

• checkConnection clears stale no_refresh_token state for usable GitHub Copilot connections — asserted testStatus flips back to
  "active", got "expired".

Green after the fix (6/6 — added one boundary test):

• Added checkConnection still skips a GitHub Copilot connection expired for a non-no_refresh_token reason (#8182 boundary) — proves
  the exception is scoped tightly: a GitHub Copilot connection expired
  for a different reason (e.g. errorCode: "invalid_grant", manually
  banned) is still skipped and left completely untouched
  (lastHealthCheckAt stays null), so fix(resilience): credits_exhausted providers still consume CPU despite cooldown config #8182's original fix is not
  reopened for the general case.

Also reran every other checkConnection/tokenHealthCheck-adjacent
suite sequentially (env -u OMNIROUTE_API_KEY) to confirm no
regression in #8182's own behavior (it shipped without a dedicated
test file — confirmed via git show --stat 99ad15a37f, 11 lines added
to tokenHealthCheck.ts only):

• tests/unit/token-health-check.test.ts — 9/9
• tests/unit/token-health-check-circuit-breaker.test.ts — 7/7
• tests/unit/apikey-connection-health-check.test.ts — 5/5
• tests/unit/token-health-check-sweep.test.ts,
  token-health-check-tickms-defined.test.ts,
  tokenHealthCheck-batchSize.test.ts,
  codex-oauth-refresh-persist-6352.test.ts,
  oauth-providers-error-handling.test.ts — 25/25 combined

npm run typecheck:core — clean.

Refs #8182
Refs #8286
Refs #5326