OAuth refresh tokens discarded on access_token rotation and on stale-credential delete

[nbardy]

Bug

Two issues in OAuth credential handling:

1. saveCredentials overwrites refresh tokens: Google's token refresh often returns only a new access_token (no refresh_token). The current code writes the new response verbatim, which drops the stored refresh_token to undefined. Next refresh then fails, forcing a full re-auth.
2. isExpired discards credentials that could silently refresh: credentials with a valid refresh_token are treated as unusable on expiry instead of letting the caller refresh the access token.

Impact

Users get kicked out to full OAuth re-auth periodically despite having a valid refresh token stored.

Proposal

• saveCredentials (both encrypted and file-based paths): merge with existing stored refresh_token when the new payload lacks one
• isExpired: keep credentials that have a refresh_token and let the caller refresh
• Tolerate missing credentials on delete (idempotent)

Related

Fix proposed in #21695 (closed per contribution policy).

[gemini-cli]

Found possible duplicate issues:

• OAuth refresh token lost during token refresh, causing 'No refresh token is set' after ~1 hour #21691

If you believe this is not a duplicate, please remove the status/possible-duplicate label.

[nbardy]

Fix ready in #25464 (rebased on current main). Per CONTRIBUTING.md, flagging this as a good community-contribution candidate — could a maintainer consider the help wanted label? cc @jacob314

[gemini-cli]

area/core: Relates to core OAuth credential management. kind/bug: Refresh tokens are incorrectly discarded during rotation. priority/p2: Significant issue leading to frequent session loss. status/need-information: Please provide the CLI version information.