From f43c65b8b41df2c269fff3c68b83732624d2f50d Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 20 Aug 2026 22:57:16 +0000 Subject: [PATCH] fix: read refreshed access token from Set-Cookie header The /auth/refresh_token endpoint delivers the new access token as an access_token cookie rather than in the JSON body, so every refresh failed with 'refresh returned empty access token'. Fall back to the cookie (and its Max-Age for expiry) when the body carries no token. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0192iXsk3yw2yf5r3cbtNDKu --- internal/auth/login.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/internal/auth/login.go b/internal/auth/login.go index d722ce4..0d06b5d 100644 --- a/internal/auth/login.go +++ b/internal/auth/login.go @@ -296,6 +296,20 @@ func refreshToken(ctx context.Context, host string, refreshTok string) (string, return "", err } + // The endpoint delivers the new access token as a Set-Cookie header + // rather than in the JSON body; fall back to it when the body has none. + if result.AccessToken == "" { + for _, c := range resp.Cookies() { + if c.Name == "access_token" { + result.AccessToken = c.Value + if result.ExpiresIn == 0 && c.MaxAge > 0 { + result.ExpiresIn = c.MaxAge + } + break + } + } + } + if result.AccessToken == "" { return "", fmt.Errorf("refresh returned empty access token") }