fix(auth): use correct OAuth endpoint, parse Retry-After, add backoff guard

[iceteaSA]

Problem

Three issues with OAuth token refresh:

1. Wrong endpoint: Token refresh was hitting api.anthropic.com/v1/oauth/token (the Workload Identity Federation endpoint) instead of platform.claude.com/v1/oauth/token (the Claude Code OAuth endpoint). The authorize URL was already platform.claude.com — the token URL was the only inconsistency. This mismatch caused 429 rate limits because Claude Code PKCE refresh tokens are not intended for the WIF endpoint.

2. Retry-After ignored: 429 responses include a Retry-After header that was ignored. Backoff used a flat exponential starting at 5 minutes regardless of the server's requested delay.

3. Noisy per-request retries: When the token is expired and backoff is active, every request entered refreshMainAccessToken(), checked backoff internally, threw, and logged — generating noisy per-request log entries.

Fix

1. Use correct token endpoint (platform.claude.com)

Changed TOKEN_URL from api.anthropic.com/v1/oauth/token to platform.claude.com/v1/oauth/token. This is the dedicated OAuth service that Claude Code binary, ex-machina plugin, and OpenClaw plugin all use successfully without 429s.

2. Retry-After header support

ClaudeOAuthRefreshError now captures the Retry-After header from 429 responses. Supports both seconds (60) and HTTP date formats. buildRefreshOperationError uses it as the backoff duration when available, falling back to exponential backoff otherwise.

3. Request-path backoff guard

Checks backoff before entering refreshMainAccessToken() on the request path. When backoff is active, throws immediately with a clean log entry — no lease check, no file lock, no redundant log noise.

4. Debug logging improvements

• Logs new token expiry after successful refresh (was logging stale pre-refresh value)
• Logs how long ago the token expired on request-path refresh (expiredAgoMs)
• Includes expiresInMs in background timer backoff skip log

Changes

File	Change
packages/core/src/constants.ts	Fix TOKEN_URL to platform.claude.com
packages/core/src/auth.ts	Add retryAfter to ClaudeOAuthRefreshError, parse header
packages/core/src/accounts.ts	Use retryAfter in backoff calculation
packages/opencode/src/index.ts	Request-path backoff guard, improved debug logging
packages/opencode/src/tests/*.ts	Updated tests

[cubic-dev-ai]

No issues found across 6 files

_{Re-trigger cubic}