different-ai/openwork · error · ProbeFailure

CONTINUITY_REFRESH

CONTINUITY_REFRESH

Error message

Refresh unexpectedly succeeded after the mock credential expired

What it means

The continuity phase intentionally exercises an expired mock credential: the probe refreshes a token whose refresh token the mock has marked expired, expecting the token endpoint to reject it. If the refresh unexpectedly returns a 2xx, the probe throws CONTINUITY_REFRESH / oauth_refresh_unexpected_success because the mock's expiry enforcement is broken — the probe would never observe the intended expired-credential path.

Source

Thrown at packages/enterprise-mcp-mock-server/src/testing/probe.ts:710

    sensitiveValues.push(accessToken, refreshToken)
    recordPassed(phases, "AUTH_TOKEN_ACQUISITION", startedAt, "Authorization code and PKCE token exchange passed")

    if (activeFault?.effect === "refresh-expired") {
      startedAt = Date.now()
      const refreshForm = new URLSearchParams({
        grant_type: "refresh_token",
        client_id: clientId,
        refresh_token: refreshToken,
      })
      if (tokenAuthMethod === "client_secret_post") refreshForm.set("client_secret", clientSecret)
      const refreshResponse = await fetchStep(tokenEndpoint, {
        method: "POST",
        headers: { "content-type": "application/x-www-form-urlencoded" },
        body: refreshForm,
      }, "CONTINUITY_REFRESH", overallDeadline)
      if (refreshResponse.ok) {
        await discardResponseBody(refreshResponse, "CONTINUITY_REFRESH", "oauth_credential_expired")
        throw new ProbeFailure("CONTINUITY_REFRESH", "oauth_refresh_unexpected_success", "Refresh unexpectedly succeeded after the mock credential expired")
      }
      const message = await safeHttpErrorMessage(refreshResponse, "CONTINUITY_REFRESH", "oauth_credential_expired")
      throw new ProbeFailure("CONTINUITY_REFRESH", "oauth_credential_expired", `${message} Reauthorization is required.`)
    }

    const rpcHeaders = {
      authorization: `Bearer ${accessToken}`,
      accept: "application/json, text/event-stream",
      "content-type": "application/json",
      origin: baseUrl.origin,
    }
    startedAt = Date.now()
    const initializeRawResponse = await fetchStep(mcpUrl, {
        method: "POST",
        headers: rpcHeaders,
        body: JSON.stringify({
          jsonrpc: "2.0",
          id: 1,

View on GitHub (pinned to 2b7df46e8a)

Solutions

Fix the mock authorization server so expired refresh tokens are actually rejected (enforce the expiry timestamp before granting).
Verify the preceding step that expires the mock credential actually executed (check scenario ordering/flags).
Clear any token cache between expiry and refresh so the token endpoint sees the expired token.

Example fix

// before (mock token endpoint)
if (refreshTokenRecord) return issueTokens(refreshTokenRecord) // expiry ignored
// after
if (refreshTokenRecord && refreshTokenRecord.expiresAt > Date.now()) return issueTokens(refreshTokenRecord)
return res.status(400).json({ error: "invalid_grant" })

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await probeEnterpriseMcpMockServer(scenario)
} catch (e) {
  if (e instanceof ProbeFailure && e.message.includes('Refresh unexpectedly succeeded')) {
    // the mock's expiry enforcement is broken: fail the environment check loudly
    console.error('Mock AS did not reject expired refresh token — fix expiry enforcement', e)
    process.exitCode = 1
  } else throw e
}

Prevention

Unit-test that the mock token endpoint rejects expired refresh tokens.
Ensure the scenario step that expires the credential runs before the refresh.
Avoid caching issued tokens in a way that bypasses expiry checks.

When it happens

Trigger: Running probeEnterpriseMcpMockServer in a continuity scenario where the mock credential should be expired, but the POST to the token endpoint with grant_type=refresh_token returns ok (status 2xx) at probe.ts:708-711.

Common situations: Mock server clock/expiry bookkeeping not applied (expiry timestamps not enforced, or tokens never marked expired); scenario misconfiguration where the expiry-trigger step didn't run; caching layer serving stale non-expired tokens.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/2ffdc00691822397. Report an issue: GitHub.