Use asyncio.Lock for thread-safe token refresh

[Copilot]

The token refresh mechanism used a boolean flag _refresh_in_progress to prevent concurrent refreshes, which is not thread-safe in async contexts. Multiple tasks hitting auth errors simultaneously could all pass the check before any set the flag, triggering duplicate refresh attempts.

Changes:

• Replace _refresh_in_progress boolean with asyncio.Lock
• Implement double-check pattern: after acquiring lock, retry with current token before refreshing (handles case where another task already completed the refresh)
• Extract inline boolean expressions to variables for line length compliance

Before:

if is_auth_error and retry_on_auth_error and self._token_refresh_callback and not self._refresh_in_progress:
    try:
        self._refresh_in_progress = True
        new_token = await self._token_refresh_callback()
        # ... refresh logic
    finally:
        self._refresh_in_progress = False

After:

if is_auth_error and retry_on_auth_error and has_refresh:
    async with self._refresh_lock:
        # Retry with current token first - another task may have already refreshed
        response = await self._session.request(...)
        if response.status not in (401, 403):
            # Already refreshed by another task
            return
        # Still failing, perform refresh
        new_token = await self._token_refresh_callback()
        # ... refresh logic

Addresses #6 (comment)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.