revert(zoho-desk): back out both shared lib/oauth changes

Reverting two changes to shared OAuth code because their premise is inferred
rather than proven, and neither meets the bar for touching a path every provider
runs.

`refreshOAuthToken` body-error branch. The premise was that Zoho reports refresh
failures with HTTP 200 and an `error` body. That is documented and empirically
confirmed for the authorization-code EXCHANGE (see the comment on getToken in
auth.ts), but I never confirmed it for the REFRESH grant specifically - and if
Zoho returns a proper 4xx there, the existing `!response.ok` path already
classifies it via extractErrorCode, making the branch dead code that every one
of the ~34 providers still executes on each refresh. A shared branch whose only
justification is an unverified inference about one provider is not worth its
blast radius.

`invalid_code` in TERMINAL_ERRORS. Same problem, worse downside: the code is
sourced from a Zoho community post rather than official docs, TERMINAL_ERRORS is
consulted for every provider, and a false positive marks a credential dead for an
hour. Not adding it simply preserves today's behavior (retry rather than
dead-flag), so reverting costs nothing that was previously working.

Both are cheap to reinstate, correctly scoped, once a live Zoho account shows
what a revoked refresh token actually returns.

Kept: the token-redaction on the "no access token" warn, which is an unambiguous
improvement independent of Zoho.

Also kept, deliberately, is the serializer `trigger-advanced` exclusion - that one
rests on a reproduced bug rather than an inference, and it aligns the serializer
with the convention the rest of the codebase already follows (blocks.test.ts
treats `trigger` and `trigger-advanced` identically in six places, as does the
copilot block-metadata tool, and blocks/types.ts documents trigger-advanced as
"the advanced side of a trigger field").

Author: waleedlatif1

apps/sim/lib/oauth/oauth.ts

@@ -1878,48 +1878,6 @@ export async function refreshOAuthToken(
 
     const data = await response.json()
 
-    // Some providers - Zoho notably - report OAuth failures in the JSON body with
-    // HTTP 200 rather than a 4xx (e.g. `{"error":"invalid_client"}` for a revoked
-    // refresh token). Without this the `!accessToken` guard below returns a
-    // failure with no `errorCode`, so `isTerminalRefreshError` cannot recognize a
-    // terminal condition, the credential is never marked dead, and every later
-    // execution retries a refresh that can never succeed. Classify on the body
-    // before trusting the status, matching the token-exchange and service-account
-    // mint paths, which already do this.
-    // The `!data.access_token` guard matters because this branch runs for EVERY
-    // provider: without it, a provider that ever returns an informational `error`
-    // alongside a valid token would have all its credentials fail refresh - and
-    // if that string is one of TERMINAL_ERRORS, be marked dead for an hour. No
-    // current provider does that, but the branch should not depend on it. Zoho's
-    // failure bodies carry no token, so the guard costs nothing here.
-    if (
-      data &&
-      typeof data === 'object' &&
-      typeof data.error === 'string' &&
-      data.error &&
-      !data.access_token
-    ) {
-      logger.error('Token refresh failed with an error body:', {
-        status: response.status,
-        statusText: response.statusText,
-        error: data.error,
-        errorDescription:
-          typeof data.error_description === 'string' ? data.error_description : null,
-        providerId,
-        tokenEndpoint: config.tokenEndpoint,
-        hasClientId: !!config.clientId,
-        hasClientSecret: !!config.clientSecret,
-        hasRefreshToken: !!refreshToken,
-      })
-      return {
-        ok: false,
-        errorCode: data.error,
-        message: `Failed to refresh token: ${data.error}${
-          typeof data.error_description === 'string' ? ` - ${data.error_description}` : ''
-        }`,
-      }
-    }
-
     if (data && typeof data === 'object' && data.ok === false) {
       logger.error('Token refresh failed:', {
         status: response.status,
@@ -1950,8 +1908,8 @@ export async function refreshOAuthToken(
     const expiresIn = data.expires_in || data.expiresIn || 3600
 
     if (!accessToken) {
-      // Never log `data` itself here - on a partial success it carries live
-      // tokens. The error-body branch above already surfaces the diagnosable case.
+      // Log only the shape, never `data` itself - on a partial success it can
+      // carry live tokens.
       logger.warn('No access token found in refresh response', {
         providerId,
         responseKeys: Object.keys(data ?? {}),

apps/sim/lib/oauth/terminal-errors.ts

@@ -11,11 +11,6 @@ const TERMINAL_ERRORS = new Set<string>([
   'bad_client_secret',
   'invalid_client_id',
   'invalid_client',
-  // Zoho's code for a revoked or otherwise unusable refresh token (it reserves
-  // `invalid_client` for a wrong client id/secret). Without this a revoked Zoho
-  // credential is never dead-flagged and every execution retries a refresh that
-  // can never succeed.
-  'invalid_code',
   'bad_redirect_uri',
   'token_revoked',
 ])