fix: auto-retry on 403 bearer-invalid after idle

[leecoder]

Problem

After a period of inactivity, the first API request fails with:

Kiro Error: 403 - The bearer token included in the request is invalid.

The token in the plugin DB matches the kiro-cli token, is not expired, and kiro-cli whoami succeeds. This is a server-side bearer invalidation that resolves on the next attempt. Users currently have to manually retry or do a full logout/login cycle.

Related: #82

Solution

On the first encounter of a 403 with "bearer token included in the request is invalid", the plugin now:

1. Forces a token refresh (kiro-cli sync -> if newer token available, use it; otherwise OIDC refresh)
2. Retries the same request transparently (user sees no error)

If the retry also fails with bearer-invalid, the existing permanent-failure classification applies unchanged.

Changes

• src/core/request/request-handler.ts: Added inline bearer-invalid detection before the error-handler, with a one-shot forceRefresh + continue
• src/core/auth/token-refresher.ts: Added forceRefresh() method that attempts CLI sync first, then falls back to OIDC refresh
• src/core/request/error-handler.ts: Added bearerRetried context flag and forceRefresh return field for defense-in-depth (error-handler path)

Testing

• Reproduced on v1.11.2 with IAM Identity Center auth after ~2-10 hour idle periods
• After patch: 403 is silently retried and succeeds on second attempt without user intervention
• No behavioral change for other error types (429, 400, 500, permanent 403s like suspended accounts)

[tickernelz]

Maintainer review found a retry-state propagation bug: after the first bearer-invalid retry, RequestHandler passed only retry to ErrorHandler, so repeated 403 responses could trigger forced refreshes until the global iteration cap.

I pushed 147b5b516ce2b222dc686f7c32a6d2dc3649d518 to the PR branch. It propagates bearerRetried and adds an integration regression test proving exactly one forced refresh and two request attempts.

Verified on the exact updated PR head:

• npm run typecheck
• npm run build
• Bun test suite: 35 passed, 0 failed
• npm pack --dry-run
• git diff --check
• GitGuardian: passed

[tickernelz]

Follow-up maintainer fix a47ff75dc8f5725aab374f0ed25d8f454fa09026 restores attempt-level API error logging for transient/recovered HTTP failures and extends the regression test to require one log record per failed attempt.

Final exact-head verification: typecheck passed, build passed, 35 tests passed, package dry-run passed, diff check passed, and GitGuardian passed.