fix: recover stale sketchi sessions and refresh oauth

[anand-testcompare]

Summary

• add a WorkOS refresh endpoint that returns rotated access and refresh tokens for Sketchi device auth
• refresh stored Sketchi OAuth credentials inside the OpenCode plugin before tool calls and clear invalid grants
• recover from stale cached Sketchi session continuity by retrying once without the cached session and surfacing clearer errors for explicit invalid session IDs
• document the refresh route in OpenAPI and classify session-not-found transport failures as NOT_FOUND

Validation

• bun x ultracite fix
• bun run build
• cd packages/backend && bun run test
• cd apps/web && bun run test -- src/app/api/auth/refresh/route.test.ts src/lib/workos-device-auth.test.ts
• cd packages/opencode-excalidraw && bun test src/index.test.ts src/lib/session-continuity.test.ts src/lib/sketchi-oauth.test.ts
• cd packages/opencode-excalidraw && bun run typecheck
• local tests/e2e opencode-web-continuity passed against http://localhost:3001 on 2026-04-16

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sketchi-web	Ready	Preview, Comment	Apr 16, 2026 10:50am

[github-actions]

Browserbase Replays

• Session 388f1740-46d1-4be0-a2a1-7cb99cce0a03 (scenario: visual-sanity.ts): replay | debug
• Session 3fb397dc-2648-44bd-bd55-6297f3ae358e (scenario: auth-gates.ts): replay | debug
• Session c1b1a5d3-fb2f-4bc5-961f-e2f27023ebff (scenario: opencode-web-continuity.ts): replay | debug
• Session 8fad071e-c1de-42af-a986-6c765801dbf9 (scenario: diagram-studio-happy-path.ts): replay | debug
• Session e938b2c2-3915-40d7-8754-1b26b8582ed6 (scenario: diagram-studio-occ-conflict.ts): replay | debug

Workflow run: 24506206041

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional findings.