auth: offline_access scope and logging for refresh token persistence

crates/goose/src/oauth/mod.rs

@@ -76,7 +76,7 @@ pub async fn oauth_flow(
     let mut oauth_state = OAuthState::new(mcp_server_url, None).await?;
     let redirect_uri = format!("http://localhost:{}/oauth_callback", used_addr.port());
     oauth_state
-        .start_authorization(&[], redirect_uri.as_str(), Some("goose"))
+        .start_authorization(&["offline_access"], redirect_uri.as_str(), Some("goose"))
         .await?;
 
     let authorization_url = oauth_state.get_authorization_url().await?;

crates/goose/src/oauth/persist.rs

@@ -2,6 +2,8 @@ use oauth2::{basic::BasicTokenType, EmptyExtraTokenFields, StandardTokenResponse
 use reqwest::IntoUrl;
 use rmcp::transport::{auth::OAuthState, AuthError};
 use serde::{Deserialize, Serialize};
+use oauth2::TokenResponse;
+use tracing::info;
 
 use crate::config::Config;
 
@@ -23,10 +25,18 @@ pub async fn save_credentials(
     let (client_id, token_response) = oauth_state.get_credentials().await?;
 
     let credentials = SerializableCredentials {
-        client_id,
-        token_response,
+        client_id: client_id.clone(),
+        token_response: token_response.clone(),
     };
 
+    // log whether we have a refresh token
+    if let Some(ref token_resp) = credentials.token_response {
+        let has_refresh = token_resp.refresh_token().is_some();
+        info!("save_credentials: client_id={}, has_refresh_token={}", client_id, has_refresh);
+    } else {
+        info!("save_credentials: client_id={}, no token response", client_id);
+    }
+
     let key = secret_key(name);
     config.set_secret(&key, &credentials)?;