Ensure an agent has a valid access token, refreshing via client credentials
if the cached one is missing or expired. Idempotent and safe to call
before every request.
Concurrent calls for the same agent.id are coalesced into a single
token POST via an in-process promise map — the common case of a
storyboard fan-out firing 10 tool calls in parallel does one refresh,
not ten.
Mutation: this function writes agent.oauth_tokens in place. That is
the contract the MCP SDK's OAuthClientProvider pattern also uses, and
it lets the CLI's file-backed storage see the same object. Callers that
share an AgentConfig across different logical agents must copy first.
Precondition: agent.oauth_client_credentials must be set. Throws a plain
Error if not — callers are expected to branch on its presence before
calling this.
Ensure an agent has a valid access token, refreshing via client credentials if the cached one is missing or expired. Idempotent and safe to call before every request.
Concurrent calls for the same
agent.idare coalesced into a single token POST via an in-process promise map — the common case of a storyboard fan-out firing 10 tool calls in parallel does one refresh, not ten.Mutation: this function writes
agent.oauth_tokensin place. That is the contract the MCP SDK'sOAuthClientProviderpattern also uses, and it lets the CLI's file-backed storage see the same object. Callers that share anAgentConfigacross different logical agents must copy first.Precondition:
agent.oauth_client_credentialsmust be set. Throws a plain Error if not — callers are expected to branch on its presence before calling this.