fix: guard cli refresh token hydration by freshness

Author: ndycode

lib/accounts.ts

@@ -188,7 +188,11 @@ export class AccountManager {
 				changed = true;
 			}
 
-			if (cached.refreshToken && cached.refreshToken !== account.refreshToken) {
+			if (
+				cachedAccessUsable &&
+				cached.refreshToken &&
+				cached.refreshToken !== account.refreshToken
+			) {
 				account.refreshToken = cached.refreshToken;
 				changed = true;
 			}

test/accounts-edge.test.ts

@@ -188,7 +188,7 @@ describe("accounts edge branches", () => {
 
     const expired = snapshot[1];
     expect(expired?.access).toBe("existing-access");
-    expect(expired?.refreshToken).toBe("expired-refresh-updated");
+    expect(expired?.refreshToken).toBe("refresh-2");
     expect(expired?.accountId).toBe("expired-id");
     expect(expired?.accountIdSource).toBe("token");
   });