@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/src/__tests__/runner-token-coordinator.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { createRunnerTokenCoordinator } from "../runner-token-coordinator.js";
+import type { RefreshedRunnerToken } from "../bootstrap.js";
+
+/**
+ * Unit tests for the runner's two-writer token model.
+ *
+ * The load-bearing guarantee here is the anti-staleness regression: once the
+ * runner mints its own proxy token, a control-plane token push must NOT clobber
+ * it (the bug two earlier production fixes closed was the inverse — the proxy
+ * token froze and never refreshed). These tests pin both
+ * directions of that invariant.
+ */
+
+const silentLog = { log: vi.fn(), warn: vi.fn() };
+
+describe("createRunnerTokenCoordinator", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    silentLog.log.mockClear();
+    silentLog.warn.mockClear();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe("pre-mint (lockstep preserved)", () => {
+    it("applies a control-plane token to the proxy sink when nothing is minted", () => {
+      const applyProxyToken = vi.fn();
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint: vi.fn(),
+        log: silentLog,
+      });
+
+      coordinator.onControlPlaneTokenChanged("cp_token");
+
+      expect(coordinator.isProxyTokenMinted()).toBe(false);
+      expect(applyProxyToken).toHaveBeenCalledWith("cp_token");
+    });
+
+    it("ignores a null control-plane token (logout) without touching the proxy sink", () => {
+      const applyProxyToken = vi.fn();
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint: vi.fn(),
+        log: silentLog,
+      });
+
+      coordinator.onControlPlaneTokenChanged(null);
+
+      expect(applyProxyToken).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("after minting", () => {
+    it("applies the minted token and marks the proxy token as minted", () => {
+      const applyProxyToken = vi.fn();
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint: vi.fn(),
+        log: silentLog,
+      });
+
+      coordinator.adoptMintedToken("rt_minted", 14400);
+
+      expect(coordinator.isProxyTokenMinted()).toBe(true);
+      expect(applyProxyToken).toHaveBeenCalledWith("rt_minted");
+    });
+
+    it("ANTI-STALENESS: a control-plane push must NOT clobber the minted proxy token", () => {
+      const applyProxyToken = vi.fn();
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint: vi.fn(),
+        log: silentLog,
+      });
+
+      coordinator.adoptMintedToken("rt_minted", 14400);
+      applyProxyToken.mockClear();
+
+      // The desktop rotates its Auth0 token and pushes it as the control-plane
+      // credential. The proxy interceptors must keep the minted token.
+      coordinator.onControlPlaneTokenChanged("auth0_rotated");
+
+      expect(applyProxyToken).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("refresh timer", () => {
+    it("re-mints from the control-plane token before expiry and reschedules", async () => {
+      const applyProxyToken = vi.fn();
+      const reMint = vi
+        .fn<() => Promise<RefreshedRunnerToken | undefined>>()
+        .mockResolvedValueOnce({ token: "rt_v2", expiresInSeconds: 100 })
+        .mockResolvedValueOnce({ token: "rt_v3", expiresInSeconds: 100 });
+
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint,
+        log: silentLog,
+      });
+
+      // ttl=100s → refresh at 0.8 * 100s = 80s.
+      coordinator.adoptMintedToken("rt_v1", 100);
+      applyProxyToken.mockClear();
+
+      await vi.advanceTimersByTimeAsync(80_000);
+      expect(reMint).toHaveBeenCalledTimes(1);
+      expect(applyProxyToken).toHaveBeenCalledWith("rt_v2");
+
+      // It rescheduled; the next refresh re-mints again.
+      await vi.advanceTimersByTimeAsync(80_000);
+      expect(reMint).toHaveBeenCalledTimes(2);
+      expect(applyProxyToken).toHaveBeenCalledWith("rt_v3");
+
+      coordinator.stop();
+    });
+
+    it("retries (without clobbering) when a re-mint fails, then recovers", async () => {
+      const applyProxyToken = vi.fn();
+      const reMint = vi
+        .fn<() => Promise<RefreshedRunnerToken | undefined>>()
+        .mockResolvedValueOnce(undefined) // first refresh fails to mint
+        .mockResolvedValueOnce({ token: "rt_recovered", expiresInSeconds: 100 });
+
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken,
+        reMint,
+        log: silentLog,
+      });
+
+      coordinator.adoptMintedToken("rt_v1", 100);
+      applyProxyToken.mockClear();
+
+      // First scheduled refresh (at 80s) returns undefined → no new proxy token,
+      // schedules a retry at 0.8 * 60s = 48s.
+      await vi.advanceTimersByTimeAsync(80_000);
+      expect(reMint).toHaveBeenCalledTimes(1);
+      expect(applyProxyToken).not.toHaveBeenCalled();
+
+      // Retry succeeds and recovers the proxy token.
+      await vi.advanceTimersByTimeAsync(48_000);
+      expect(reMint).toHaveBeenCalledTimes(2);
+      expect(applyProxyToken).toHaveBeenCalledWith("rt_recovered");
+
+      coordinator.stop();
+    });
+
+    it("stop() cancels the refresh timer", async () => {
+      const reMint = vi.fn<() => Promise<RefreshedRunnerToken | undefined>>();
+      const coordinator = createRunnerTokenCoordinator({
+        applyProxyToken: vi.fn(),
+        reMint,
+        log: silentLog,
+      });
+
+      coordinator.adoptMintedToken("rt_v1", 100);
+      coordinator.stop();
+
+      await vi.advanceTimersByTimeAsync(200_000);
+      expect(reMint).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/__tests__/runner.test.ts

@@ -0,0 +1,284 @@
+import { describe, it, expect, vi } from "vitest";
+import { mapOptionsToConfig, releaseAfterDrain } from "../runner.js";
+import type { StigmerRunnerOptions, StigmerRunner } from "../runner.js";
+import type { TokenRef } from "../config.js";
+
+/**
+ * Unit tests for the createStigmerRunner factory.
+ *
+ * These test the options validation and type contracts without starting
+ * a real Temporal worker (that requires integration test infrastructure).
+ * The factory is imported lazily to avoid triggering Temporal native
+ * module loading in the test environment.
+ */
+
+const VALID_OPTIONS: StigmerRunnerOptions = {
+  taskQueue: "session:test-123",
+  temporalAddress: "localhost:7233",
+  stigmerEndpoint: "http://localhost:7234",
+};
+
+describe("StigmerRunnerOptions validation", () => {
+  async function importFactory() {
+    return (await import("../runner.js")).createStigmerRunner;
+  }
+
+  it("rejects missing taskQueue", async () => {
+    const createStigmerRunner = await importFactory();
+    const options = { ...VALID_OPTIONS, taskQueue: "" };
+
+    await expect(createStigmerRunner(options)).rejects.toThrow(
+      "taskQueue is required",
+    );
+  });
+
+  it("rejects missing stigmerEndpoint", async () => {
+    const createStigmerRunner = await importFactory();
+    const options = { ...VALID_OPTIONS, stigmerEndpoint: "" };
+
+    await expect(createStigmerRunner(options)).rejects.toThrow(
+      "stigmerEndpoint is required",
+    );
+  });
+});
+
+describe("StigmerRunnerOptions type contract", () => {
+  it("accepts minimal required options", () => {
+    const options: StigmerRunnerOptions = {
+      taskQueue: "session:abc",
+      temporalAddress: "temporal:7233",
+      stigmerEndpoint: "https://api.stigmer.ai",
+    };
+
+    expect(options.taskQueue).toBe("session:abc");
+    expect(options.temporalAddress).toBe("temporal:7233");
+    expect(options.stigmerEndpoint).toBe("https://api.stigmer.ai");
+  });
+
+  it("accepts all optional fields", () => {
+    const options: StigmerRunnerOptions = {
+      taskQueue: "session:abc",
+      temporalAddress: "temporal:7233",
+      stigmerEndpoint: "https://api.stigmer.ai",
+      temporalNamespace: "prod",
+      stigmerToken: "tok_123",
+      cursorApiKey: "key_abc",
+      workspaceRootDir: "/workspace",
+      maxConcurrentActivities: 10,
+      proxyEndpoint: "https://proxy.stigmer.ai",
+      primaryModel: "claude-4",
+      checkpointerType: "http",
+      checkpointerProxyEndpoint: "https://cp.stigmer.ai",
+      cloudModeEnabled: true,
+      executionMode: "local",
+    };
+
+    expect(options.temporalNamespace).toBe("prod");
+    expect(options.maxConcurrentActivities).toBe(10);
+    expect(options.proxyEndpoint).toBe("https://proxy.stigmer.ai");
+    expect(options.checkpointerType).toBe("http");
+    expect(options.cloudModeEnabled).toBe(true);
+    expect(options.executionMode).toBe("local");
+  });
+
+  it("optional fields are truly optional at the type level", () => {
+    const options: StigmerRunnerOptions = {
+      taskQueue: "q",
+      temporalAddress: "t:7233",
+      stigmerEndpoint: "http://s:7234",
+    };
+
+    expect(options.temporalNamespace).toBeUndefined();
+    expect(options.stigmerToken).toBeUndefined();
+    expect(options.cursorApiKey).toBeUndefined();
+    expect(options.workspaceRootDir).toBeUndefined();
+    expect(options.maxConcurrentActivities).toBeUndefined();
+    expect(options.proxyEndpoint).toBeUndefined();
+    expect(options.primaryModel).toBeUndefined();
+    expect(options.checkpointerType).toBeUndefined();
+    expect(options.checkpointerProxyEndpoint).toBeUndefined();
+    expect(options.cloudModeEnabled).toBeUndefined();
+    expect(options.executionMode).toBeUndefined();
+  });
+});
+
+/**
+ * The static factory maps its options into a runner {@link Config}. These tests
+ * lock the invariant that execution location (`mode`) is decoupled from
+ * credential transport (`proxyEndpoint`): an explicit `executionMode` always
+ * wins, and only when it is unset does `mode` fall back to the proxy-derived
+ * default for backward compatibility. This mirrors `mapManagerOptionsToConfig`.
+ * The static root binds ONE ref as both the control-plane and the proxy
+ * credential (it mints no separate proxy token), and the config carries no
+ * credential by value (config.ts header).
+ */
+describe("mapOptionsToConfig — Temporal connection security", () => {
+  const base: StigmerRunnerOptions = {
+    taskQueue: "session:test-123",
+    temporalAddress: "localhost:7233",
+    stigmerEndpoint: "http://localhost:7234",
+  };
+  const refs = (): [TokenRef, TokenRef] => [{ current: null }, { current: null }];
+
+  it("carries an embedder's explicit settings", () => {
+    const temporalConnection = { tls: { serverNameOverride: "temporal.internal" }, apiKey: "k" };
+    expect(mapOptionsToConfig({ ...base, temporalConnection }, ...refs()).temporalConnection).toEqual(
+      temporalConnection,
+    );
+  });
+
+  it("falls back to the environment's STIGMER_TEMPORAL_* settings, plaintext when none is set", () => {
+    expect(mapOptionsToConfig(base, ...refs()).temporalConnection).toEqual({});
+  });
+});
+
+describe("mapOptionsToConfig — execution mode", () => {
+  const base: StigmerRunnerOptions = {
+    taskQueue: "session:test-123",
+    temporalAddress: "localhost:7233",
+    stigmerEndpoint: "http://localhost:7234",
+  };
+  const refs = (): [TokenRef, TokenRef] => [{ current: null }, { current: null }];
+
+  it("defaults mode to local with no proxy and no executionMode", () => {
+    const config = mapOptionsToConfig(base, ...refs());
+    expect(config.mode).toBe("local");
+  });
+
+  it("derives cloud from a proxy when executionMode is unset (backward compatible)", () => {
+    const config = mapOptionsToConfig({
+      ...base,
+      proxyEndpoint: "https://proxy.example.com",
+      stigmerToken: "tok",
+    }, ...refs());
+    expect(config.mode).toBe("cloud");
+    // Proxy transport still engages independently of execution location.
+    expect(config.proxyEndpoint).toBe("https://proxy.example.com");
+    expect(config.cursorApiKey).toBe("proxy-managed");
+    expect(config.checkpointerType).toBe("http");
+  });
+
+  it("honors explicit local executionMode even with a proxy (the desktop case)", () => {
+    const config = mapOptionsToConfig({
+      ...base,
+      executionMode: "local",
+      proxyEndpoint: "https://proxy.example.com",
+      stigmerToken: "tok",
+    }, ...refs());
+    expect(config.mode).toBe("local");
+    // Transport still routes through the proxy despite local execution.
+    expect(config.proxyEndpoint).toBe("https://proxy.example.com");
+    expect(config.cursorApiKey).toBe("proxy-managed");
+  });
+
+  it("honors explicit cloud executionMode without a proxy", () => {
+    const config = mapOptionsToConfig({ ...base, executionMode: "cloud" }, ...refs());
+    expect(config.mode).toBe("cloud");
+  });
+
+  it("binds the one ref as both the control-plane and the proxy credential, and carries no credential by value", () => {
+    const tokenRef: TokenRef = { current: "boot-credential" };
+    const runnerTokenRef: TokenRef = { current: null };
+    const config = mapOptionsToConfig(
+      { ...base, proxyEndpoint: "https://proxy.example.com", stigmerToken: "boot-credential" },
+      tokenRef,
+      runnerTokenRef,
+    );
+    expect(config.stigmerTokenRef).toBe(tokenRef);
+    expect(config.proxyTokenRef).toBe(tokenRef);
+    expect(config.stigmerRunnerTokenRef).toBe(runnerTokenRef);
+    expect(config.cursorApiKey).toBe("proxy-managed");
+
+    tokenRef.current = "renewed-credential";
+    expect(config.stigmerTokenRef.current).toBe("renewed-credential");
+    expect(config.proxyTokenRef?.current).toBe("renewed-credential");
+    expect(JSON.stringify(config)).not.toContain("boot-credential");
+  });
+});
+
+describe("StigmerRunner type contract", () => {
+  it("defines start and shutdown methods", () => {
+    const runner: StigmerRunner = {
+      start: async () => {},
+      shutdown: () => {},
+    };
+
+    expect(typeof runner.start).toBe("function");
+    expect(typeof runner.shutdown).toBe("function");
+  });
+
+  it("start returns a Promise", () => {
+    const runner: StigmerRunner = {
+      start: async () => {},
+      shutdown: () => {},
+    };
+
+    const result = runner.start();
+    expect(result).toBeInstanceOf(Promise);
+  });
+});
+
+describe("public API exports", () => {
+  it("exports createStigmerRunner from index", async () => {
+    const mod = await import("../index.js");
+    expect(typeof mod.createStigmerRunner).toBe("function");
+  });
+});
+
+describe("releaseAfterDrain", () => {
+  function resources(opts: { harnessFails?: boolean; closeFails?: boolean } = {}) {
+    const order: string[] = [];
+    return {
+      order,
+      value: {
+        shutdownHarnesses: vi.fn(async () => {
+          order.push("harnesses");
+          if (opts.harnessFails) {
+            throw new Error("harness boom");
+          }
+        }),
+        connection: {
+          close: vi.fn(async () => {
+            order.push("connection");
+            if (opts.closeFails) {
+              throw new Error("close boom");
+            }
+          }),
+        },
+      },
+    };
+  }
+
+  it("releases the harnesses, then closes the Temporal connection", async () => {
+    const r = resources();
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).not.toHaveBeenCalled();
+  });
+
+  it("still closes the connection when a harness teardown fails, and logs it", async () => {
+    const r = resources({ harnessFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Harness shutdown failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("harness boom");
+  });
+
+  it("logs a failed close instead of throwing, so a clean stop stays clean", async () => {
+    const r = resources({ closeFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await expect(releaseAfterDrain(r.value, logError)).resolves.toBeUndefined();
+
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Temporal connection close failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("close boom");
+  });
+});

package/src/__tests__/sandbox-token-renewal.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  isRenewableSandboxToken,
+  startSandboxTokenRenewal,
+} from "../sandbox-token-renewal.js";
+import type { SandboxTokenRenewal } from "../sandbox-token-renewal.js";
+
+/** Build an unsigned JWT carrying exactly the claims under test. */
+function fakeJwt(claims: Record<string, unknown>): string {
+  const b64 = (o: object) => Buffer.from(JSON.stringify(o)).toString("base64url");
+  return `${b64({ alg: "RS256", typ: "JWT" })}.${b64(claims)}.fake-signature`;
+}
+
+function nowSeconds(): number {
+  return Math.floor(Date.now() / 1000);
+}
+
+/** A sandbox token issued now with the given lifetime. */
+function sandboxToken(ttlSeconds: number, tokenType = "sandbox"): string {
+  const iat = nowSeconds();
+  return fakeJwt({ token_type: tokenType, iat, exp: iat + ttlSeconds });
+}
+
+describe("isRenewableSandboxToken", () => {
+  it("accepts a sandbox token with an expiry", () => {
+    expect(isRenewableSandboxToken(sandboxToken(3600))).toBe(true);
+  });
+
+  it("rejects every non-sandbox credential class", () => {
+    expect(isRenewableSandboxToken(sandboxToken(3600, "embedded_runner"))).toBe(false);
+    expect(isRenewableSandboxToken(sandboxToken(3600, "pool_sandbox"))).toBe(false);
+    // The retired workflow sandbox's class: no lane renews it any more.
+    expect(isRenewableSandboxToken(sandboxToken(3600, "workflow_sandbox"))).toBe(false);
+    expect(isRenewableSandboxToken(fakeJwt({ iat: 1, exp: 2 }))).toBe(false);
+  });
+
+  it("rejects a renewable class without an expiry (renew-before-expiry is undefined)", () => {
+    expect(isRenewableSandboxToken(fakeJwt({ token_type: "sandbox" }))).toBe(false);
+  });
+
+  it("rejects absent and undecodable tokens", () => {
+    expect(isRenewableSandboxToken(null)).toBe(false);
+    expect(isRenewableSandboxToken(undefined)).toBe(false);
+    expect(isRenewableSandboxToken("not-a-jwt")).toBe(false);
+    expect(isRenewableSandboxToken("a.%%%.c")).toBe(false);
+  });
+});
+
+describe("startSandboxTokenRenewal", () => {
+  const silentLog = { log: vi.fn(), warn: vi.fn() };
+  let handle: SandboxTokenRenewal | undefined;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    silentLog.log.mockClear();
+    silentLog.warn.mockClear();
+  });
+
+  afterEach(() => {
+    handle?.stop();
+    handle = undefined;
+    vi.useRealTimers();
+  });
+
+  it("renews at 80% of the issued lifetime and applies the fresh token", async () => {
+    const initial = sandboxToken(1000);
+    let current = initial;
+    // Mint lazily so the renewed token's iat reflects the (fake) clock at
+    // renewal time, exactly like the real server would stamp it.
+    const renew = vi.fn().mockImplementation(
+      async () => ({ token: sandboxToken(1000), expiresInSeconds: 1000 }),
+    );
+    const applyToken = vi.fn((t: string) => { current = t; });
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => current, renew, applyToken, log: silentLog,
+    });
+
+    // Just before the 80% point: nothing has fired.
+    await vi.advanceTimersByTimeAsync(790_000);
+    expect(renew).not.toHaveBeenCalled();
+
+    // Crossing 80% of the 1000s lifetime triggers the renewal.
+    await vi.advanceTimersByTimeAsync(20_000);
+    expect(renew).toHaveBeenCalledWith(initial);
+    expect(applyToken).toHaveBeenCalledTimes(1);
+    expect(current).not.toBe(initial);
+
+    // The next renewal is scheduled from the FRESH token's own lifetime:
+    // nothing re-fires within the first half of it.
+    renew.mockClear();
+    await vi.advanceTimersByTimeAsync(400_000);
+    expect(renew).not.toHaveBeenCalled();
+  });
+
+  it("parks on a non-renewable credential and picks up a renewable swap (pool claim)", async () => {
+    let current = sandboxToken(86_400, "pool_sandbox");
+    const renew = vi.fn().mockResolvedValue({ token: sandboxToken(1000) });
+    const applyToken = vi.fn();
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => current, renew, applyToken, log: silentLog,
+    });
+
+    // Parked: rechecks but never renews the pool credential.
+    await vi.advanceTimersByTimeAsync(300_000);
+    expect(renew).not.toHaveBeenCalled();
+
+    // The claim swaps in a session token (attach-session's updateToken).
+    current = sandboxToken(1000);
+
+    // Next recheck sees the renewable class and schedules from its lifetime.
+    await vi.advanceTimersByTimeAsync(60_000 + 800_000);
+    expect(renew).toHaveBeenCalled();
+  });
+
+  it("retries a failed renewal and succeeds on a later attempt", async () => {
+    const initial = sandboxToken(100);
+    const renewed = sandboxToken(1000);
+    let current = initial;
+    const renew = vi.fn()
+      .mockRejectedValueOnce(new Error("control plane unreachable"))
+      .mockResolvedValueOnce(undefined) // server minted nothing
+      .mockResolvedValue({ token: renewed });
+    const applyToken = vi.fn((t: string) => { current = t; });
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => current, renew, applyToken, log: silentLog,
+    });
+
+    // 80% of 100s is past MIN_DELAY, first attempt at ~80s, then two 60s retries.
+    await vi.advanceTimersByTimeAsync(80_000 + 60_000 + 60_000 + 5_000);
+    expect(renew).toHaveBeenCalledTimes(3);
+    expect(applyToken).toHaveBeenCalledWith(renewed);
+  });
+
+  it("attempts immediately when the pod boots with a token already past its renewal point", async () => {
+    // Issued 900s ago with a 1000s lifetime: 80% point long past.
+    const iat = nowSeconds() - 900;
+    const stale = fakeJwt({ token_type: "sandbox", iat, exp: iat + 1000 });
+    const renew = vi.fn().mockResolvedValue({ token: sandboxToken(1000) });
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => stale, renew, applyToken: vi.fn(), log: silentLog,
+    });
+
+    await vi.advanceTimersByTimeAsync(0);
+    expect(renew).toHaveBeenCalledWith(stale);
+  });
+
+  it("stop() cancels the loop", async () => {
+    const renew = vi.fn().mockResolvedValue({ token: sandboxToken(1000) });
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => sandboxToken(100), renew, applyToken: vi.fn(), log: silentLog,
+    });
+    handle.stop();
+
+    await vi.advanceTimersByTimeAsync(600_000);
+    expect(renew).not.toHaveBeenCalled();
+  });
+
+  it("parks (never spins) on a renewable-class token without an expiry", async () => {
+    const renew = vi.fn();
+
+    handle = startSandboxTokenRenewal({
+      getToken: () => fakeJwt({ token_type: "sandbox" }),
+      renew, applyToken: vi.fn(), log: silentLog,
+    });
+
+    await vi.advanceTimersByTimeAsync(300_000);
+    expect(renew).not.toHaveBeenCalled();
+    expect(silentLog.warn).toHaveBeenCalled();
+  });
+});