From 703488f0f37175e58f21e1bed56ed8be18a3ac2a Mon Sep 17 00:00:00 2001
From: gsxdsm <gsxdsm@users.noreply.github.com>
Date: Fri, 17 Jul 2026 16:26:20 -0700
Subject: [PATCH] fix(FN-8142): restore Anthropic OAuth refresh

Use the Claude OAuth client identity issued by the login flow and lock the request contract down with a regression assertion.
---
 .changeset/fix-anthropic-oauth-refresh.md          | 7 +++++++
 packages/engine/src/__tests__/auth-storage.test.ts | 6 ++++++
 packages/engine/src/auth-storage.ts                | 2 +-
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/fix-anthropic-oauth-refresh.md

diff --git a/.changeset/fix-anthropic-oauth-refresh.md b/.changeset/fix-anthropic-oauth-refresh.md
new file mode 100644
index 0000000000..0302f4e7ff
--- /dev/null
+++ b/.changeset/fix-anthropic-oauth-refresh.md
@@ -0,0 +1,7 @@
+---
+"@runfusion/fusion": patch
+---
+
+summary: Keep Anthropic subscription sessions connected by refreshing OAuth credentials with the correct client identity.
+category: fix
+dev: Corrects the Claude OAuth client ID used by the engine refresh request and adds request-contract coverage.
diff --git a/packages/engine/src/__tests__/auth-storage.test.ts b/packages/engine/src/__tests__/auth-storage.test.ts
index 42c25ca968..3a56840d23 100644
--- a/packages/engine/src/__tests__/auth-storage.test.ts
+++ b/packages/engine/src/__tests__/auth-storage.test.ts
@@ -484,6 +484,12 @@ describe("createFusionAuthStorage", () => {
           body: expect.not.stringContaining("\"scope\""),
         }),
       );
+      const refreshRequest = fetchMock.mock.calls[0]?.[1] as RequestInit | undefined;
+      expect(JSON.parse(String(refreshRequest?.body))).toMatchObject({
+        grant_type: "refresh_token",
+        client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+        refresh_token: "subscription-refresh-token",
+      });
       expect(authStorage.get("anthropic-subscription")).toEqual({
         type: "oauth",
         access: "refreshed-subscription-access-token",
diff --git a/packages/engine/src/auth-storage.ts b/packages/engine/src/auth-storage.ts
index 6099e7dde1..a24cc7c991 100644
--- a/packages/engine/src/auth-storage.ts
+++ b/packages/engine/src/auth-storage.ts
@@ -352,7 +352,7 @@ async function refreshAnthropicOAuthCredential(credential: StoredCredential): Pr
       // Do not include scope: RFC 6749 refreshes preserve the granted scope only when omitted.
       body: JSON.stringify({
         grant_type: "refresh_token",
-        client_id: "9d1c250a-e6a1-44d9-88ed-5944d1962f5e",
+        client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
         refresh_token: credential.refresh,
       }),
     });