fix(ai): stop Codex OAuth stderr writes

closes #4141

packages/ai/test/openai-codex-oauth.test.ts

@@ -0,0 +1,32 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { refreshOpenAICodexToken } from "../src/utils/oauth/openai-codex.js";
+
+describe("OpenAI Codex OAuth", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+		vi.unstubAllGlobals();
+	});
+
+	it("does not write token refresh failures to stderr", async () => {
+		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {});
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async (): Promise<Response> => {
+				return new Response(
+					JSON.stringify({
+						error: {
+							message: "Could not validate your token. Please try signing in again.",
+							type: "invalid_request_error",
+						},
+					}),
+					{ status: 401, statusText: "Unauthorized", headers: { "Content-Type": "application/json" } },
+				);
+			}),
+		);
+
+		await expect(refreshOpenAICodexToken("invalid-refresh-token")).rejects.toThrow(
+			/OpenAI Codex token refresh failed \(401\).*Could not validate your token/,
+		);
+		expect(consoleError).not.toHaveBeenCalled();
+	});
+});