Keep refreshing a connection that has no recorded scope

The scope validation compared the provider's reported scope against the
connection's recorded grant set. When that set is empty the comparison had no
subset to accept, so every reported scope failed the whole refresh — and the
failure is a retryable StorageError, so the connection would retry a grant that
could never succeed, indefinitely.

An empty grant set is a legitimate state, not a corrupt one: RFC 6749 §5.1
lets an authorization server omit the scope it granted, and the refresh request
then omits the scope parameter entirely. With nothing recorded there is also
nothing to widen away from, so the safe action is to keep the refresh and
record no scope. The provider's string is still never persisted, which is the
property the validation exists to hold.

Author: GeiserX

packages/core/sdk/src/executor.ts

@@ -2045,6 +2045,15 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea
                   reportedScope === null
                     ? null
                     : [...new Set(reportedScope.split(/\s+/).filter(Boolean))];
+                // With no recorded grant there is nothing to validate against — and nothing to
+                // widen FROM either, since the request omits the scope parameter entirely. Failing
+                // here would strand a legitimate connection in a permanent retry loop, because
+                // RFC 6749 §5.1 lets an authorization server omit the scope it granted. So keep
+                // the refresh and simply record no scope: the reported value is still never
+                // persisted, which is the property this validation exists to hold.
+                if (trustedScopes.size === 0) {
+                  return Effect.succeed({ expiresInSeconds, scope: null });
+                }
                 if (
                   reportedScopes !== null &&
                   reportedScopes.some((scope) => !trustedScopes.has(scope))

packages/core/sdk/src/oauth-refresh-grant-delegation.test.ts

@@ -879,4 +879,31 @@ describe("provider-owned OAuth refresh grant", () => {
       }),
     ),
   );
+
+  it.effect("keeps refreshing a connection that has no recorded scope", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const { config, executor } = yield* scenario({ behaviour: SEALS });
+        // RFC 6749 §5.1 lets an authorization server omit the granted scope, so a live connection
+        // can legitimately carry none. The scope validation must not turn that into a permanent
+        // failure: with nothing recorded there is nothing to widen from.
+        yield* Effect.promise(() =>
+          config.db.updateMany("connection", {
+            where: (b) => b("name", "=", "main"),
+            set: { oauth_scope: null },
+          }),
+        );
+
+        const out = yield* executor.execute(TOOL, {});
+        expect(out).toEqual({ token: "delegated-access-token" });
+
+        // The provider's scope string is still never persisted — that is the property the
+        // validation exists to hold, and it holds here by recording nothing at all.
+        const row = yield* Effect.promise(() =>
+          config.db.findFirst("connection", { where: (b) => b("name", "=", "main") }),
+        );
+        expect(row?.oauth_scope).toBeNull();
+      }),
+    ),
+  );
 });