@iloveagents/foundry-agent 0.1.0 → 0.1.2

package/src/__tests__/token-fetch.test.ts

@@ -62,4 +62,60 @@ describe("tokenFetch", () => {
     const [, init] = fetchSpy.mock.calls[0]!;
     expect(init).toBeUndefined();
   });
+
+  it("retries once with forceRefresh when first attempt returns 401", async () => {
+    // Long-lived tab path: cached token is rejected by the API → MSAL is
+    // asked to round-trip the token endpoint with the refresh token.
+    getAccessToken
+      .mockResolvedValueOnce("stale-token")
+      .mockResolvedValueOnce("fresh-token");
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(new Response(null, { status: 401 }))
+      .mockResolvedValueOnce(new Response(null, { status: 200 }));
+
+    const res = await tokenFetch("https://example.com/api/items");
+
+    expect(res.status).toBe(200);
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+    expect(getAccessToken).toHaveBeenCalledTimes(2);
+    expect(getAccessToken).toHaveBeenNthCalledWith(1, "api", undefined);
+    expect(getAccessToken).toHaveBeenNthCalledWith(2, "api", { forceRefresh: true });
+
+    const firstAuth = new Headers(fetchSpy.mock.calls[0]![1]?.headers).get(
+      "Authorization",
+    );
+    const secondAuth = new Headers(fetchSpy.mock.calls[1]![1]?.headers).get(
+      "Authorization",
+    );
+    expect(firstAuth).toBe("Bearer stale-token");
+    expect(secondAuth).toBe("Bearer fresh-token");
+  });
+
+  it("does not retry on non-401 responses", async () => {
+    getAccessToken.mockResolvedValue("token");
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(new Response(null, { status: 500 }));
+
+    const res = await tokenFetch("https://example.com/api/items");
+
+    expect(res.status).toBe(500);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    expect(getAccessToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("only retries once on a hard 401-then-401 path", async () => {
+    getAccessToken.mockResolvedValue("token");
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(new Response(null, { status: 401 }))
+      .mockResolvedValueOnce(new Response(null, { status: 401 }));
+
+    const res = await tokenFetch("https://example.com/api/items");
+
+    expect(res.status).toBe(401);
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+    expect(getAccessToken).toHaveBeenCalledTimes(2);
+  });
 });

package/src/client/agui-runner.ts

@@ -48,6 +48,51 @@ export interface AGUIRunInput {
   context?: Context[];
 }
 
+function shouldPreserveAcrossVisibleHistory(message: Message): boolean {
+  return message.role === "system" || message.role === "developer" || message.role === "reasoning";
+}
+
+function mergeProtocolMessagesFromSnapshot(
+  previousMessages: Message[],
+  visibleMessages: Message[],
+): Message[] {
+  if (previousMessages.length === 0) return [...visibleMessages];
+
+  const visibleById = new Map(visibleMessages.map((message) => [message.id, message]));
+  const previousVisibleIds = new Set(
+    previousMessages
+      .filter((message) => !shouldPreserveAcrossVisibleHistory(message))
+      .map((message) => message.id),
+  );
+  const isSameVisibleThread = visibleMessages.some((message) => previousVisibleIds.has(message.id));
+  if (!isSameVisibleThread) return [...visibleMessages];
+
+  const merged: Message[] = [];
+  const emitted = new Set<string>();
+
+  for (const previous of previousMessages) {
+    const currentVisible = visibleById.get(previous.id);
+    if (currentVisible) {
+      merged.push(currentVisible);
+      emitted.add(currentVisible.id);
+      continue;
+    }
+
+    if (shouldPreserveAcrossVisibleHistory(previous)) {
+      merged.push(previous);
+      emitted.add(previous.id);
+    }
+  }
+
+  for (const message of visibleMessages) {
+    if (!emitted.has(message.id)) {
+      merged.push(message);
+    }
+  }
+
+  return merged;
+}
+
 /**
  * Bridges callback-driven `AgentSubscriber` events into an async-iterable
  * queue the runner's generator drains. Single-producer / single-consumer.
@@ -126,10 +171,17 @@ export class AGUIRunner {
   async *run(input: AGUIRunInput): AsyncGenerator<RunnerEvent> {
     const { messages, state, registry, abortSignal, context } = input;
     const toolCalls = new Map<string, ToolCallState>();
-    let currentMessages: Message[] = [...messages];
+    let currentMessages: Message[] = mergeProtocolMessagesFromSnapshot(
+      this.httpAgent.messages,
+      messages,
+    );
 
-    // Replace once at the top: subsequent turns append to currentMessages
-    // (per AG-UI convention — see footgun in apps/web AGENTS.md cross-link).
+    // Replace once at the top with the reconciled AG-UI history. assistant-ui
+    // stores only visible chat turns, while AG-UI snapshots may contain
+    // model-visible but UI-hidden protocol messages such as system/developer
+    // guidance. Preserve those messages across turns when the visible history
+    // belongs to the same thread so the next request remains a complete AG-UI
+    // conversation without leaking system messages into the rendered chat.
     this.httpAgent.setMessages(currentMessages);
     if (state) this.httpAgent.setState(state);
 

package/src/client/service-fetch.ts

@@ -17,8 +17,14 @@ export interface ServiceFetchOptions {
    * Acquire an access token for outgoing requests. Return `null` to skip
    * token attachment (callers without auth — e.g. local dev — pass through
    * to native fetch).
+   *
+   * The optional ``{ forceRefresh: true }`` argument is passed by the
+   * fetch interceptor on a 401 retry — the auth layer should bypass
+   * its local token cache and round-trip the token endpoint so we
+   * stop re-sending an access token the resource server has already
+   * rejected (canonical MSAL.js fix for tab-open-overnight 401 loops).
    */
-  acquireToken: () => Promise<string | null>;
+  acquireToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;
 
   /**
    * Router FQDN for production (e.g. `https://lastspace-prod.eastus2.example.com`).
@@ -66,47 +72,86 @@ export function createServiceFetch(options: ServiceFetchOptions): ServiceFetch {
     // Request-input branch must preserve method / body / credentials /
     // signal / etc. — silently dropping them by reading only `.url` would
     // turn POST/PUT into GET and drop required headers.
-    const headers = new Headers(input instanceof Request ? input.headers : undefined);
+    const baseHeaders = new Headers(input instanceof Request ? input.headers : undefined);
     if (init?.headers) {
-      new Headers(init.headers).forEach((value, key) => headers.set(key, value));
-    }
-    if (!headers.has("Authorization")) {
-      try {
-        const token = await options.acquireToken();
-        if (token) {
-          headers.set("Authorization", `Bearer ${token}`);
-        }
-      } catch {
-        // Token acquisition failed — proceed without
-      }
+      new Headers(init.headers).forEach((value, key) => baseHeaders.set(key, value));
     }
+    const callerSuppliedAuth = baseHeaders.has("Authorization");
 
-    if (input instanceof Request) {
-      // Build a fresh Request against the rewritten URL, copying every
-      // field the runtime exposes on the original — explicit field copy
-      // is more portable than `new Request(url, originalRequest)`, which
-      // some runtimes (older undici/JSDOM in particular) do not honor
-      // for method/body. `init` then overrides anything the caller passed.
-      const cloned = input.clone();
-      const requestInit: RequestInit = {
-        method: cloned.method,
-        body:
-          cloned.method === "GET" || cloned.method === "HEAD" ? undefined : cloned.body,
-        headers,
-        credentials: cloned.credentials,
-        mode: cloned.mode,
-        cache: cloned.cache,
-        redirect: cloned.redirect,
-        referrer: cloned.referrer,
-        integrity: cloned.integrity,
-        signal: cloned.signal,
+    function buildRequestInitFrom(req: Request): RequestInit {
+      // ReadableStream bodies are single-consume. ``req.clone()`` returns a
+      // fresh Request whose body stream is independent — call it once per
+      // dispatch attempt so the 401 retry can replay POST/PUT bodies
+      // intact.
+      const fresh = req.clone();
+      const ri: RequestInit = {
+        method: fresh.method,
+        body: fresh.method === "GET" || fresh.method === "HEAD" ? undefined : fresh.body,
+        credentials: fresh.credentials,
+        mode: fresh.mode,
+        cache: fresh.cache,
+        redirect: fresh.redirect,
+        referrer: fresh.referrer,
+        integrity: fresh.integrity,
+        signal: fresh.signal,
       };
       // Streaming bodies need duplex: "half"; harmless when there's no body.
-      if (cloned.body !== null) {
-        (requestInit as RequestInit & { duplex?: string }).duplex = "half";
+      if (fresh.body !== null) {
+        (ri as RequestInit & { duplex?: string }).duplex = "half";
       }
-      return fetch(resolvedUrl, { ...requestInit, ...init, headers });
+      return ri;
+    }
+
+    async function dispatch(forceRefreshToken: boolean): Promise<Response> {
+      const headers = new Headers(baseHeaders);
+      if (!callerSuppliedAuth) {
+        try {
+          const token = await options.acquireToken(
+            forceRefreshToken ? { forceRefresh: true } : undefined,
+          );
+          if (token) {
+            headers.set("Authorization", `Bearer ${token}`);
+          }
+        } catch (error) {
+          // A thrown token acquisition error usually means the auth layer
+          // is starting an interactive recovery. Do not downgrade protected
+          // API calls to anonymous requests; that creates noisy 401s and
+          // stale UI.
+          throw error;
+        }
+      }
+      if (input instanceof Request) {
+        // Re-clone for THIS attempt — the body stream of the original is
+        // either still pristine (first attempt) or already consumed
+        // (second attempt); ``clone()`` always returns a fresh, replayable
+        // copy.
+        const requestInit = buildRequestInitFrom(input);
+        return fetch(resolvedUrl, { ...requestInit, ...init, headers });
+      }
+      return fetch(resolvedUrl, { ...init, headers });
+    }
+
+    const response = await dispatch(false);
+
+    // Long-lived tab recovery: when the resource server returns 401 the
+    // local MSAL cache may still hold a token MSAL itself thinks is valid
+    // (claims challenge, conditional-access re-eval, audience drift, or
+    // the user simply left the tab open past the cached access token's
+    // server-side validity). Force-refresh the token via the refresh
+    // token grant and replay the request once. If the refresh-token is
+    // also gone (24h SPA cap), ``acquireToken`` will throw an
+    // interaction-required error and the auth layer kicks off
+    // ``loginRedirect`` — that's the only correct UX for a hard expiry.
+    //
+    // Conditions for retry: 401, no caller-supplied auth header (we own
+    // the token), and the server didn't already see a fresh token (we
+    // only retry once).
+    if (response.status !== 401 || callerSuppliedAuth) {
+      return response;
     }
-    return fetch(resolvedUrl, { ...init, headers });
+    // Drain the failed response body — letting it sit unread keeps the
+    // underlying connection occupied on some runtimes.
+    response.body?.cancel().catch(() => undefined);
+    return dispatch(true);
   };
 }

package/src/index.ts

@@ -10,19 +10,18 @@ export {
 } from "./client/service-fetch.ts";
 
 // --- Tool registry ---
-export {
-  clientToolRegistry,
-  type ClientToolEntry,
-  type ToolRegistry,
-} from "./tools/registry.ts";
+export { clientToolRegistry, type ClientToolEntry, type ToolRegistry } from "./tools/registry.ts";
 
 // --- Stores (vanilla) ---
-export {
-  streamingStatusStore,
-  type StreamingStatus,
-} from "./store/streaming-status-store.ts";
+export { streamingStatusStore, type StreamingStatus } from "./store/streaming-status-store.ts";
 export {
   citationStore,
   type CitationResult,
   type CitationHandler,
 } from "./store/citation-store.ts";
+export {
+  linkStore,
+  resolveLinkHandler,
+  type LinkHandler,
+  type ResolvedLinkHandler,
+} from "./store/link-store.ts";

package/src/msal/auth-config.ts

@@ -25,6 +25,7 @@ export interface MsalAccountInfo {
 export interface MsalClientApplication {
   initialize(): Promise<void>;
   handleRedirectPromise(): Promise<unknown>;
+  clearCache(request?: { account?: MsalAccountInfo }): Promise<void>;
   getAllAccounts(): MsalAccountInfo[];
   loginRedirect(request: { scopes: string[]; prompt?: string }): Promise<void>;
   logoutRedirect(): Promise<void>;
@@ -32,6 +33,16 @@ export interface MsalClientApplication {
   acquireTokenSilent(request: {
     scopes: string[];
     account: MsalAccountInfo;
+    /**
+     * Skip MSAL's local cache and force a round-trip to the token
+     * endpoint using the cached refresh token. The fetch interceptor
+     * uses this on a 401 retry — the first attempt may have served a
+     * cached access token MSAL still thought valid (within
+     * ``tokenRenewalOffsetSeconds``) that the resource server has
+     * since rejected (claims challenge, conditional access re-eval,
+     * audience drift).
+     */
+    forceRefresh?: boolean;
   }): Promise<{ accessToken: string }>;
   acquireTokenRedirect(request: {
     scopes: string[];
@@ -57,6 +68,13 @@ export async function initializeMsal(
 
   const { PublicClientApplication: PCA } = await import("@azure/msal-browser");
 
+  // Token-renewal config — see Microsoft Learn:
+  // https://learn.microsoft.com/entra/msal/javascript/browser/errors
+  //
+  // SPA refresh tokens are 24 h, non-sliding, non-renewable. After that
+  // window the user MUST re-auth; nothing the SPA can do silently saves
+  // it. Goal of these knobs is to make the unavoidable interactive
+  // bounce predictable and to keep the silent path healthy in between.
   const msalConfiguration = {
     auth: {
       clientId: config.clientId,
@@ -68,6 +86,24 @@ export async function initializeMsal(
       // localStorage is required for Playwright E2E tests — sessionStorage
       // is not preserved across page navigations in the Playwright context.
       cacheLocation: "localStorage",
+      // Cache key includes a hash of any `claims` parameter. Without
+      // this, MSAL serves the same cached access token even after a
+      // claims-challenge / token revocation / role change. The MSAL
+      // team has signalled this will become the default; opt in early.
+      claimsBasedCachingEnabled: true,
+    },
+    system: {
+      // Treat access tokens as "expired" 10 min before the actual exp
+      // claim instead of MSAL's default 5 min. Eliminates the race
+      // where the SPA's clock thinks the token is still valid but the
+      // resource server rejects it as expired (clock skew, slow request
+      // queueing, etc.).
+      tokenRenewalOffsetSeconds: 600,
+      // Default 6 s is too tight on modern browsers — third-party
+      // storage partitioning + slower CPUs in the silent iframe can
+      // push the round-trip past it. 10 s is the value MSAL Angular
+      // and React samples ship with.
+      iframeHashTimeout: 10000,
     },
   };
 

package/src/msal/auth-store.ts

@@ -1,5 +1,6 @@
 import { createStore } from "zustand/vanilla";
 import { getMsalInstance, getMsalConfig } from "./auth-config.ts";
+import type { MsalAccountInfo, MsalClientApplication } from "./auth-config.ts";
 
 export interface AuthUser {
   name: string;
@@ -8,6 +9,18 @@ export interface AuthUser {
   oid?: string;
 }
 
+export class AuthInteractionRequiredError extends Error {
+  readonly code?: string;
+  readonly cause?: unknown;
+
+  constructor(message: string, options: { code?: string; cause?: unknown } = {}) {
+    super(message);
+    this.name = "AuthInteractionRequiredError";
+    this.code = options.code;
+    this.cause = options.cause;
+  }
+}
+
 interface AuthState {
   user: AuthUser | null;
   isAuthenticated: boolean;
@@ -21,8 +34,159 @@ interface AuthState {
   /**
    * Acquire an access token for the given audience.
    * Returns null when MSAL is not configured (local dev).
+   *
+   * Recovery semantics — follows the canonical MSAL.js pattern documented
+   * at https://learn.microsoft.com/entra/msal/javascript/browser/errors:
+   *
+   *   Try acquireTokenSilent first, then use an interactive redirect when
+   *   MSAL reports that user interaction is required.
+   *
+   * Plus one extra recoverable case explicitly called out in those docs:
+   * `BrowserAuthError: monitor_window_timeout`. Microsoft's recommendation
+   * is to either backoff, fix the redirectUri page, or "invoke an
+   * interactive API such as acquireTokenPopup or acquireTokenRedirect" —
+   * we take the last option, which matches third-party-iframe storage
+   * blocking on Chrome 120+ / Edge / Safari (the silent iframe times
+   * out because the cross-site cookie is partitioned).
+   *
+   * Before starting that redirect, clear the stale local account/token
+   * cache. This avoids the broken half-authenticated state where the SPA
+   * still renders an account but every API call goes out without a bearer
+   * token after MSAL returned `interaction_required`.
+   *
+   * Recoverable auth failures reject with `AuthInteractionRequiredError`
+   * after recovery has been started. The error exposes `code` and `cause`
+   * so callers can distinguish a normal interaction-required redirect from
+   * a blocked/failed redirect attempt.
+   *
+   * Other `BrowserAuthError` codes (`interaction_in_progress`,
+   * `hash_empty_error`, `hash_does_not_contain_known_properties`,
+   * `block_iframe_reload`) are config / race-condition bugs that another
+   * redirect won't fix — propagate them as null without navigating.
+   *
+   * The "no account in cache" case is handled at boot by `AuthGuard`,
+   * which calls `loginRedirect` when `accounts.length === 0`. If we
+   * still reach this method without an account, it's an unusual state;
+   * return null and let the next AuthGuard render recover.
+   *
+   * Errors are matched by `name` / `errorCode` rather than `instanceof`
+   * because `@azure/msal-browser` is loaded via dynamic import; the
+   * error class identity isn't shared across module boundaries.
+   *
+   * `forceRefresh: true` skips MSAL's local cache and goes back to the
+   * token endpoint with the cached refresh token. Use it from the
+   * fetch interceptor when a protected API returns 401 — the first
+   * attempt may have used a stale cached access token (claims
+   * challenge, conditional-access re-eval, audience drift, etc.) that
+   * MSAL still considered valid against its own clock.
    */
-  getAccessToken: (audience?: "api" | "spaces") => Promise<string | null>;
+  getAccessToken: (
+    audience?: "api" | "spaces",
+    options?: { forceRefresh?: boolean },
+  ) => Promise<string | null>;
+}
+
+/** Recoverable error codes per MSAL.js docs — every one of these has the
+ * documented remedy "invoke an interactive API". */
+const RECOVERABLE_ERROR_CODES = new Set([
+  // InteractionRequiredAuthError — canonical fallback case.
+  "interaction_required",
+  "login_required",
+  "consent_required",
+  // BrowserAuthError: monitor_window_timeout. Documented remedy includes
+  // "Invoke an interactive API" (Microsoft Learn → "Common errors in
+  // MSAL JS" → monitor_window_timeout → "Throttling" + "X-Frame-Options
+  // Deny"). Real-world trigger on Chrome 120+ is third-party-iframe
+  // storage partitioning blocking the silent SSO frame.
+  "monitor_window_timeout",
+]);
+
+/** `InteractionRequiredAuthError` always triggers the redirect — match by
+ * class name as a fallback when the error code isn't set. */
+const INTERACTION_REQUIRED_NAME = "InteractionRequiredAuthError";
+
+let interactiveRecoveryStarted = false;
+
+function isRecoverableAuthError(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  const name = (err as { name?: string }).name ?? "";
+  const code = (err as { errorCode?: string }).errorCode ?? "";
+  return name === INTERACTION_REQUIRED_NAME || RECOVERABLE_ERROR_CODES.has(code);
+}
+
+function authErrorName(err: unknown): string | undefined {
+  return err && typeof err === "object" ? (err as { name?: string }).name : undefined;
+}
+
+function authErrorCode(err: unknown): string | undefined {
+  return err && typeof err === "object" ? (err as { errorCode?: string }).errorCode : undefined;
+}
+
+function authErrorMessage(err: unknown): string | undefined {
+  if (err instanceof Error) return err.message;
+  return err && typeof err === "object" ? (err as { message?: string }).message : undefined;
+}
+
+function describeAuthError(err: unknown): string {
+  const parts = [
+    authErrorName(err) ? `name=${authErrorName(err)}` : undefined,
+    authErrorCode(err) ? `code=${authErrorCode(err)}` : undefined,
+    authErrorMessage(err) ? `message=${authErrorMessage(err)}` : undefined,
+  ].filter(Boolean);
+  return parts.join(", ");
+}
+
+function createInteractionRequiredError(
+  tokenError: unknown,
+  redirectError?: unknown,
+): AuthInteractionRequiredError {
+  const tokenDetail = describeAuthError(tokenError) || "unknown token acquisition error";
+  const redirectDetail = redirectError ? describeAuthError(redirectError) : "";
+
+  if (redirectError) {
+    return new AuthInteractionRequiredError(
+      `Authentication interaction required, but login redirect failed (${redirectDetail}). Original token error: ${tokenDetail}.`,
+      {
+        code: authErrorCode(redirectError) ?? authErrorCode(tokenError),
+        cause: redirectError,
+      },
+    );
+  }
+
+  return new AuthInteractionRequiredError(
+    `Authentication interaction required after token acquisition failed (${tokenDetail}).`,
+    {
+      code: authErrorCode(tokenError),
+      cause: tokenError,
+    },
+  );
+}
+
+async function startInteractiveRecovery(
+  msal: MsalClientApplication,
+  account: MsalAccountInfo,
+  scope: string,
+  reason: unknown,
+): Promise<never> {
+  let redirectError: unknown;
+  if (!interactiveRecoveryStarted) {
+    interactiveRecoveryStarted = true;
+    authStore.setState({ user: null, isAuthenticated: false });
+    msal.setActiveAccount(null);
+    await msal.clearCache({ account }).catch(() => undefined);
+    try {
+      await msal.loginRedirect({ scopes: [scope] });
+    } catch (err) {
+      // The redirect is expected to navigate away; if it settles by throwing,
+      // keep that failure attached so logs/UI can show what blocked recovery.
+      redirectError = err;
+    } finally {
+      // In tests or blocked-popup environments the promise can settle without
+      // navigation. Allow a later user action/retry to start recovery again.
+      interactiveRecoveryStarted = false;
+    }
+  }
+  throw createInteractionRequiredError(reason, redirectError);
 }
 
 export const authStore = createStore<AuthState>((set) => ({
@@ -39,32 +203,32 @@ export const authStore = createStore<AuthState>((set) => ({
     }
   },
 
-  getAccessToken: async (_audience = "api") => {
+  getAccessToken: async (_audience = "api", options) => {
     const msal = getMsalInstance();
     const config = getMsalConfig();
     if (!msal || !config) return null;
 
     const accounts = msal.getAllAccounts();
-    if (accounts.length === 0) return null;
+    if (accounts.length === 0) {
+      // No cached account — `AuthGuard` will call `loginRedirect` on
+      // its next render. Don't double-redirect from here.
+      return null;
+    }
 
-    // Single API-scoped token — Spaces accepts both audiences (multi-audience JWT)
+    // Single API-scoped token — Spaces accepts both audiences (multi-audience JWT).
     const scope = config.apiScope;
+    const forceRefresh = options?.forceRefresh === true;
 
     try {
       const result = await msal.acquireTokenSilent({
         scopes: [scope],
         account: accounts[0],
+        forceRefresh,
       });
       return result.accessToken;
-    } catch {
-      // Silent acquisition failed — trigger interactive redirect
-      try {
-        await msal.acquireTokenRedirect({
-          scopes: [scope],
-          account: accounts[0],
-        });
-      } catch {
-        // Redirect will navigate away; nothing to return
+    } catch (err) {
+      if (isRecoverableAuthError(err)) {
+        return startInteractiveRecovery(msal, accounts[0], scope, err);
       }
       return null;
     }

package/src/msal/index.ts

@@ -1,4 +1,8 @@
-export { authStore, type AuthUser } from "./auth-store.ts";
+export {
+  AuthInteractionRequiredError,
+  authStore,
+  type AuthUser,
+} from "./auth-store.ts";
 export {
   type MsalAuthConfig,
   type MsalAccountInfo,

package/src/msal/token-fetch.ts

@@ -7,6 +7,11 @@
  * downstream services (e.g., Spaces).
  *
  * When MSAL is not configured, behaves identically to native `fetch()`.
+ *
+ * Long-lived tab recovery: on 401 the wrapper retries once with
+ * ``forceRefresh: true`` so the resource server doesn't keep seeing a
+ * stale-but-cached access token. See ``service-fetch.ts`` for the same
+ * pattern with URL rewriting + the deeper rationale.
  */
 
 import { authStore } from "./auth-store.ts";
@@ -15,16 +20,33 @@ export async function tokenFetch(
   input: string | URL | Request,
   init?: RequestInit,
 ): Promise<Response> {
-  const token = await authStore.getState().getAccessToken("api");
+  async function dispatch(forceRefreshToken: boolean): Promise<Response> {
+    const token = await authStore
+      .getState()
+      .getAccessToken("api", forceRefreshToken ? { forceRefresh: true } : undefined);
+
+    // Clone Request inputs per-attempt: ReadableStream bodies are single-
+    // consume, so the 401 retry would otherwise see an empty body.
+    // ``input.clone()`` returns a fresh Request whose body stream is
+    // independent of the original.
+    const target = input instanceof Request ? input.clone() : input;
+
+    if (!token) {
+      return fetch(target, init);
+    }
 
-  if (!token) {
-    return fetch(input, init);
+    const headers = new Headers(input instanceof Request ? input.headers : undefined);
+    if (init?.headers) {
+      new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+    }
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(target, { ...init, headers });
   }
 
-  const headers = new Headers(input instanceof Request ? input.headers : undefined);
-  if (init?.headers) {
-    new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+  const response = await dispatch(false);
+  if (response.status !== 401) {
+    return response;
   }
-  headers.set("Authorization", `Bearer ${token}`);
-  return fetch(input, { ...init, headers });
+  response.body?.cancel().catch(() => undefined);
+  return dispatch(true);
 }