Function may_refresh 

pub fn may_refresh(auth: &[u8], now: i64) -> bool

Whether a run on login auth (an auth.json) may refresh its tokens at now (unix seconds; pure): the access token ends within 10 minutes, the last refresh is a week old (Codex refreshes ahead of time), or either can’t be read.

Such a run should go alone (refresh_lock): ChatGPT’s refresh tokens are single-use, and two runs refreshing the same one get it revoked (refresh_token_reused) until the user signs in again.