Vouch request: xsvm

[xsvm]

What do you want to work on?

I want to fix #4919: the Python SDK's OIDC refresher doesn't send the gateway's oidc_scopes on the refresh_token grant, while the CLI does.

_OidcRefresher._refresh in python/openshell/sandbox.py posts only grant_type, refresh_token, and client_id. My fix reads oidc_scopes from the gateway's metadata.json at refresh time and sends it as scope when present; without scopes the request is unchanged. It's one commit, about 60 lines, with two unit tests (scope sent / not sent). The scope test fails on main and passes with the fix; ruff and the full pytest python/ suite (243 tests) pass on my fork: https://github.com/xsvm/OpenShell/actions/runs/40210147228

Branch: https://github.com/xsvm/OpenShell/tree/fix/python-refresh-scopes/xsvm

Why this change?

I'm a student and use OpenShell in a personal project that drives sandboxes from the Python SDK; I ran into this while working on it. With identity providers that require scope on refresh or pick the token's resource by scope (e.g. Entra ID), the Python SDK's automatic refresh fails or gets a token the gateway rejects, while the CLI works against the same gateway. Long-running Python processes can't rely on the CLI to renew the token.

Previously merged open-source contributions:

• volcano-sh/volcano: #6116, #6098
• civitai/cli: #545, #526
• storytold/photocraft: e.g. #8318, #8554, #7930, #8013
• boykopovar/AnyPS5: #1393, #1401
• kklimuk/docx-cli: #7

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md