v0.17.1rc4

Release candidate — for testing. agento upgrade will not pick this up; pin it.

Carries everything in v0.17.1rc3, plus the credential refresh change below.

Bug Fixes

• A near-expiry OAuth credential no longer blocks the pool for a whole job. Claude and Codex OAuth credentials close to expiry are now refreshed before the job starts, and the lease is released after a few seconds instead of when the job ends. Jobs that waited for the busy pool are woken when the lease is released.
• Codex OAuth credentials are refreshed with Codex 0.157. The CLI refreshes at startup only when the access token is expired, so the refresh now marks the token as expired in its temporary home. The changed token is never saved.
• A refused refresh token is a temporary auth error. The "could not be refreshed" messages from Claude Code 2.1.291 and Codex now throttle the credential instead of failing the job with an unknown error.
• The run's toolbox capability is created after the refresh, so a slow refresh can no longer use up most of its lifetime.
• The Outlook secret migration lists the commands for every stale secret, not only the client secret.

Upgrade

agento upgrade --version 0.17.1rc4