fix(oauth): normalize Antigravity refresh margin

Author: Ingwannu

src/oauth/google-antigravity.ts

@@ -32,7 +32,8 @@ const SCOPES = [
 ];
 const CALLBACK_PORT = 51121;
 const CALLBACK_PATH = "/callback";
-const REFRESH_SKEW_MS = 50 * 60 * 1000; // refresh proactively ~50min before nominal 1h expiry
+// Keep provider-side margins small: the shared OAuth freshness gate applies an additional minute.
+const REFRESH_SKEW_MS = 5 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 30_000;
 const ONBOARD_ATTEMPTS = 5;
 const ONBOARD_POLL_MS = 2_000;

src/oauth/types.ts

@@ -13,7 +13,8 @@ export interface KiroOAuthMetadata {
 export type OAuthCredentials = {
   refresh: string;
   access: string;
-  expires: number; // epoch ms (already skew-adjusted by the provider flow)
+  /** Epoch ms after any small provider-specific early-refresh margin; the shared gate adds 1 minute. */
+  expires: number;
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;

tests/google-antigravity-oauth.test.ts

@@ -84,10 +84,15 @@ describe("antigravity refresh", () => {
       if (url.includes(":loadCodeAssist")) return new Response(JSON.stringify({ cloudaicompanionProject: "proj-R" }), { status: 200 });
       return new Response("no", { status: 404 });
     });
+    const issuedAt = Date.now();
     const cred = await refreshAntigravityToken("refresh-tok");
     expect(cred.access).toBe("fresh-access");
     expect(cred.refresh).toBe("refresh-tok");
     expect(cred.projectId).toBe("proj-R");
+    // A one-hour Google token must retain roughly 55 minutes after the provider margin. The
+    // previous 50-minute margin stored only ten minutes and caused repeated refreshes in use.
+    expect(cred.expires - issuedAt).toBeGreaterThanOrEqual(54 * 60 * 1000);
+    expect(cred.expires - issuedAt).toBeLessThanOrEqual(60 * 60 * 1000);
   });
 
   test("refresh failure carries status only, not the response body", async () => {