The refresh endpoint returns a rotated token with a fresh expiry on every successful call, but getUserInfo discarded it, so routine use never extended the stored token's life. Once the stored token aged out, accounts with 2FA enabled could not recover non-interactively and required a manual reconnect. Carry the rotated token out of getUserInfo and persist it in NewFs via the same jwtToOAuth2Token + oauthutil.PutToken path that refreshJWTToken uses, keeping f.cfg.Token in sync (same pattern as refreshOrReLogin). Fixes #9584 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>