fix(den): tolerate concurrent MCP token refresh

[benjaminshafii]

Summary

• extend public MCP OAuth access tokens from 15 to 45 minutes while remaining below the one-hour JWKS grace period
• allow a 30-second refresh-token rotation overlap so near-simultaneous OpenCode/SDK refreshes receive sibling successor grants instead of invalid_grant
• retain stale-replay protection: after the overlap, replay revokes the client/user family and all successors become unusable
• update OpenWork Connect docs, agent knowledge, parity checks, evals, and the lifecycle proof

Security tradeoff

Only refresh-token hashes are stored, so Den cannot replay the first plaintext successor. During the 30-second overlap, possession of the previous token can issue another normal rotating successor with its own 30-day inactivity window. This is deliberately bounded in time and documented. Replay after 30 seconds still invalidates the full family.

Validation

• pnpm --filter @openwork-ee/den-api exec bun test --conditions development test/mcp-token-lifetime.test.ts test/mcp-auth.test.ts test/mcp-access-token-contract.test.ts test/auth-mcp-resource-normalization.test.ts test/mcp-oauth-refresh-flow.test.ts — 23 passed, 0 failed
• DEN_MCP_REFRESH_LIFECYCLE_CHILD=1 pnpm --filter @openwork-ee/den-api exec bun test --conditions development --timeout 20000 test/mcp-oauth-refresh-lifecycle.test.ts — 4 passed, 0 failed
• pnpm --filter @openwork-ee/den-api exec bun test --conditions development --rerun-each=3 --timeout 20000 test/mcp-oauth-refresh-lifecycle.test.ts — 3 passed, 0 failed
• pnpm --filter openwork-server exec bun test src/opencode-plugins/openwork-capabilities-knowledge.test.ts — 4 passed, 0 failed
• pnpm --filter @openwork-ee/den-api exec tsc --noEmit — passed
• node scripts/check-connect-installer-parity.mjs — passed
• pnpm install --force --frozen-lockfile — passed; linked patched package inspected
• pnpm fraimz --flow mcp-oauth-refresh-lifecycle — Passed, 1/1 claims

Stack

Depends on #2952, which adds the lifecycle regression harness and is fully green.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview, Comment	Jul 21, 2026 12:38pm
openwork-den	Ready	Preview, Comment	Jul 21, 2026 12:38pm
openwork-den-worker-proxy	Ready	Preview, Comment	Jul 21, 2026 12:38pm
openwork-diagnostics	Ready	Preview, Comment	Jul 21, 2026 12:38pm
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 21, 2026 12:38pm

[benjaminshafii]

fraimz — ✅ PASSED

1 passed · 0 failed · 0 skipped — run 2026-07-21T12-36-46-680Z

Full frame proof with validated screenshots: evals/results/2026-07-21T12-36-46-680Z/fraimz.html (re-run: pnpm fraimz --flow mcp-oauth-refresh-lifecycle)

✅ mcp-oauth-refresh-lifecycle — MCP OAuth refresh lifecycle remains observable under rapid expiry

Internal demo

1. The OAuth harness proves serial refresh, concurrent grace recovery, stale reuse revocation, and session revocation

   🎙 OpenWork exercises the real OAuth and MCP endpoints with two-second access tokens. Serial refreshes stay connected, concurrent refreshes recover during the rotation grace window, stale reuse revokes the family, and revoked sessions stay blocked.

   • ✅ Script frame 1 narrated: "OpenWork exercises the real OAuth and MCP endpoints with two-second access tokens. Seria"