Fix/claude refresh contract

open-sse/services/tokenRefresh.ts

@@ -16,6 +16,22 @@ function getRefreshCacheKey(provider, refreshToken) {
   return `${provider}:${tokenHash}`;
 }
 
+function buildClaudeRefreshRequestMeta(refreshToken, headers, body, hasProxyConfig) {
+  return {
+    method: "POST",
+    url: OAUTH_ENDPOINTS.anthropic.token,
+    contentType: headers["Content-Type"],
+    accept: headers.Accept,
+    anthropicBeta: headers["anthropic-beta"] || null,
+    bodyFormat:
+      headers["Content-Type"] === "application/x-www-form-urlencoded" ? "form-urlencoded" : "json",
+    bodyKeys: body instanceof URLSearchParams ? Array.from(body.keys()) : Object.keys(body || {}),
+    clientId: PROVIDERS.claude.clientId || null,
+    refreshTokenLength: typeof refreshToken === "string" ? refreshToken.length : 0,
+    hasProxyConfig: hasProxyConfig,
+  };
+}
+
 /**
  * Refresh OAuth access token using refresh token
  */
@@ -222,20 +238,27 @@ export async function refreshKimiCodingToken(refreshToken, log, proxyConfig = nu
  */
 export async function refreshClaudeOAuthToken(refreshToken, log, proxyConfig = null) {
   try {
+    const headers = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      "anthropic-beta": "oauth-2025-04-20",
+    };
     const params = new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
       client_id: PROVIDERS.claude.clientId,
     });
 
+    log?.warn?.(
+      "TOKEN_REFRESH",
+      "Claude OAuth refresh request details",
+      buildClaudeRefreshRequestMeta(refreshToken, headers, params, proxyConfig)
+    );
+
     const response = await runWithProxyContext(proxyConfig, () =>
       fetch(OAUTH_ENDPOINTS.anthropic.token, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json",
-          "anthropic-beta": "oauth-2025-04-20",
-        },
+        headers,
         body: params.toString(),
       })
     );

tests/unit/token-refresh-service.test.mjs

@@ -279,7 +279,7 @@ test("refreshKimiCodingToken adds provider-specific headers and fields", async (
   assert.match(bodyToString(calls[0].options.body), /grant_type=refresh_token/);
 });
 
-test("refreshClaudeOAuthToken matches upstream Claude refresh contract", async () => {
+test("refreshClaudeOAuthToken matches OmniRoute Claude refresh contract and emits redacted request details", async () => {
   const log = createLog();
   const calls = [];
 
@@ -310,6 +310,22 @@ test("refreshClaudeOAuthToken matches upstream Claude refresh contract", async (
     bodyToString(calls[0].options.body),
     `grant_type=refresh_token&refresh_token=claude-refresh&client_id=${encodeURIComponent(PROVIDERS.claude.clientId)}`
   );
+
+  const detailLog = log.entries.find(
+    (entry) => entry.level === "warn" && entry.message === "Claude OAuth refresh request details"
+  );
+  assert.deepEqual(detailLog?.meta, {
+    method: "POST",
+    url: OAUTH_ENDPOINTS.anthropic.token,
+    contentType: "application/x-www-form-urlencoded",
+    accept: "application/json",
+    anthropicBeta: "oauth-2025-04-20",
+    bodyFormat: "form-urlencoded",
+    bodyKeys: ["grant_type", "refresh_token", "client_id"],
+    clientId: PROVIDERS.claude.clientId || null,
+    refreshTokenLength: "claude-refresh".length,
+    hasProxyConfig: null,
+  });
 });
 
 test("refreshClaudeOAuthToken returns null on invalid Claude refresh contract rejection", async () => {
@@ -338,7 +354,7 @@ test("refreshClaudeOAuthToken returns null on invalid Claude refresh contract re
   assert.equal(calls[0].options.headers["anthropic-beta"], "oauth-2025-04-20");
   assert.equal(
     log.entries.some((entry) => entry.level === "warn"),
-    false
+    true
   );
   assert.equal(
     log.entries.some(