[TheGreatAxios]

Bug

withContinuationOAuthRefresh (src/subagent/refresh-inference-source.ts) caches its proxy in wrappedDirectors keyed only by the inner director. The cached-proxy fast path returned before reading options, and the decide closure captured the first wrap's options.sources/defaultSource. A second wrap of the same director with a different source set was silently dropped, so the continuation OAuth refresh ran against the stale source set.

Repro evidence

src/subagent/refresh-inference-source.cache.test.ts (authored first, failing on current code) wraps one inner director with options A then options B, triggers a continuation decide(), and asserts the agent receives B's sources. Before the fix:

error: expect(received).toBe(expected)
Expected: "other"
Received: "openai"

After the fix the test passes along with the existing suite (14 tests across the two files).

Fix

Keep the single proxy per inner director (one entry, no cache-key explosion), but store the latest options in the WeakMap entry and refresh them on re-wrap, so decide() reads entry.options at call time and refreshInferenceSourceBundle(options.sources, options.defaultSource, options.catalog) always uses the current wrap's options.

Fixes CL-10510
Related: CL-9483, CL-9484

[linear-code]

CL-10510