aws-runtime-bridge 1.8.4 → 1.8.6

package/package/aws-client-agent-mcp/dist/http-client.test.js

@@ -1,6 +1,19 @@
 import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
 import { afterEach, beforeEach, describe, it, mock } from 'node:test';
+import WebSocket from 'ws';
 import { HttpClient } from './http-client.js';
+import { WebSocketClient } from './websocket-client.js';
+class FakeSocket extends EventEmitter {
+    readyState = WebSocket.CONNECTING;
+    send() { }
+    close() {
+        this.readyState = WebSocket.CLOSED;
+    }
+    terminate() {
+        this.readyState = WebSocket.CLOSED;
+    }
+}
 describe('HttpClient', () => {
     const originalFetch = global.fetch;
     let fetchCalls = [];
@@ -283,12 +296,12 @@ describe('HttpClient', () => {
                         statusText: 'Unauthorized',
                     };
                 }
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: 'fresh-token' }),
+                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
                     };
                 }
                 return {
@@ -302,15 +315,17 @@ describe('HttpClient', () => {
             assert.deepEqual(result, { data: 'retried' });
             assert.equal(fetchCalls.length, 3);
             assert.equal(fetchCalls[0][1].headers['X-Runtime-Token'], 'stale-token');
-            assert.equal(fetchCalls[1][0], 'http://127.0.0.1:18081/runtime/binding/refresh-token');
+            assert.equal(fetchCalls[1][0], 'http://127.0.0.1:18081/runtime/binding/request-token');
             assert.equal(fetchCalls[1][1].body, JSON.stringify({
-                agentId: 'agent-1',
-                currentToken: 'stale-token',
+                userId: 'user-1',
+                serverUrl: 'ws://localhost:8080/ws/agent',
+                forceRefresh: true,
+                rejectedRuntimeAccessToken: 'stale-token',
             }));
             assert.equal(fetchCalls[2][1].headers['X-Runtime-Token'], 'fresh-token');
             assert.equal(config.runtimeAccessToken, 'fresh-token');
         });
-        it('shares one bridge token refresh across concurrent 401 responses', async () => {
+        it('shares one forced runtime token refresh across concurrent 401 responses', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -324,13 +339,13 @@ describe('HttpClient', () => {
             const staleTokenCalls = new Set();
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
                     await new Promise((resolve) => setTimeout(resolve, 10));
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: 'fresh-token' }),
+                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
                     };
                 }
                 const body = JSON.parse(String(options?.body || '{}'));
@@ -357,10 +372,10 @@ describe('HttpClient', () => {
             assert.deepEqual(first, { tool: 'get_memory_stats', token: 'fresh-token' });
             assert.deepEqual(second, { tool: 'discover_group_rooms', token: 'fresh-token' });
             assert.deepEqual(staleTokenCalls, new Set(['get_memory_stats', 'discover_group_rooms']));
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
             assert.equal(config.runtimeAccessToken, 'fresh-token');
         });
-        it('throws when no runtimeAccessToken and no bridge for startup', async () => {
+        it('shares one initial runtime token request across concurrent calls without a token', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -370,139 +385,270 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            global.fetch = async () => ({
-                ok: true,
-                status: 200,
-                statusText: 'OK',
-                json: async () => ({ result: 'success' }),
-            });
-            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /runtimeAccessToken is required; MCP nodes must claim a session token from launch binding/);
+            global.fetch = async (url, options) => {
+                fetchCalls.push([url.toString(), options]);
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                    await new Promise((resolve) => setTimeout(resolve, 10));
+                    return {
+                        ok: true,
+                        status: 200,
+                        statusText: 'OK',
+                        json: async () => ({ ok: true, runtimeAccessToken: 'startup-token' }),
+                    };
+                }
+                const body = JSON.parse(String(options?.body || '{}'));
+                return {
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({ tool: body.tool, token: options.headers['X-Runtime-Token'] }),
+                };
+            };
+            const [first, second] = await Promise.all([
+                client.callTool('get_memory_stats', { agentId: 'agent-1' }),
+                client.callTool('discover_group_rooms', { agentId: 'agent-1' }),
+            ]);
+            assert.deepEqual(first, { tool: 'get_memory_stats', token: 'startup-token' });
+            assert.deepEqual(second, { tool: 'discover_group_rooms', token: 'startup-token' });
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
+            assert.equal(fetchCalls[0][1].body, JSON.stringify({
+                userId: 'user-1',
+                serverUrl: 'ws://localhost:8080/ws/agent',
+                forceRefresh: false,
+            }));
+            assert.equal(config.runtimeAccessToken, 'startup-token');
         });
-        it('throws original 401 when bridge refresh fails', async () => {
+        it('clears failed runtime token refresh so later calls can retry', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
                 reconnectInterval: 200,
                 maxReconnectAttempts: -1,
                 userId: 'user-1',
-                runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
+            let tokenRequestCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    return {
-                        ok: false,
-                        status: 503,
-                        statusText: 'Service Unavailable',
-                    };
-                }
-                return {
-                    ok: false,
-                    status: 401,
-                    statusText: 'Unauthorized',
-                };
-            };
-            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /MCP tool get_memory_stats call failed: 401 Unauthorized/);
-            // Can retry again after failure
-            global.fetch = async (url, options) => {
-                fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                    tokenRequestCount += 1;
+                    if (tokenRequestCount === 1) {
+                        return {
+                            ok: false,
+                            status: 503,
+                            statusText: 'Service Unavailable',
+                            text: async () => 'bridge unavailable',
+                        };
+                    }
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: 'recovered-token' }),
-                    };
-                }
-                const token = options.headers['X-Runtime-Token'];
-                if (token === 'recovered-token') {
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: 'OK',
-                        json: async () => ({ token }),
+                        json: async () => ({ ok: true, runtimeAccessToken: 'recovered-token' }),
                     };
                 }
                 return {
-                    ok: false,
-                    status: 401,
-                    statusText: 'Unauthorized',
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({ token: options.headers['X-Runtime-Token'] }),
                 };
             };
+            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /Failed to request runtime token from runtime-bridge: 503 Service Unavailable - bridge unavailable/);
             const result = await client.callTool('get_memory_stats', { agentId: 'agent-1' });
             assert.deepEqual(result, { token: 'recovered-token' });
+            assert.equal(tokenRequestCount, 2);
             assert.equal(config.runtimeAccessToken, 'recovered-token');
         });
-        it('returns 401 when bridge refresh has no new token for running agent', async () => {
+        it('shares one runtime token refresh between HTTP tools and websocket recovery', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
-                heartbeatInterval: 15000,
-                reconnectInterval: 200,
-                maxReconnectAttempts: -1,
+                heartbeatInterval: 1000,
+                heartbeatTimeout: 3000,
+                reconnectInterval: 10,
+                maxReconnectAttempts: 2,
+                userId: 'user-1',
                 runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
-            const client = new HttpClient(config);
+            const httpClient = new HttpClient(config);
+            let tokenRequestCount = 0;
+            let websocketAttempt = 0;
+            const websocketUrls = [];
+            let releaseRefresh;
+            const refreshGate = new Promise((resolve) => {
+                releaseRefresh = resolve;
+            });
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    // Bridge says no new token available (409 conflict)
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                    tokenRequestCount += 1;
+                    await refreshGate;
+                    return {
+                        ok: true,
+                        status: 200,
+                        statusText: 'OK',
+                        json: async () => ({ ok: true, runtimeAccessToken: 'shared-fresh-token' }),
+                    };
+                }
+                const body = JSON.parse(String(options?.body || '{}'));
+                const token = options.headers['X-Runtime-Token'];
+                if (token === 'stale-token') {
                     return {
                         ok: false,
-                        status: 409,
-                        statusText: 'Conflict',
-                        json: async () => ({ error: 'token_unchanged' }),
+                        status: 401,
+                        statusText: 'Unauthorized',
                     };
                 }
                 return {
-                    ok: false,
-                    status: 401,
-                    statusText: 'Unauthorized',
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({ tool: body.tool, token }),
                 };
             };
-            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /MCP tool get_memory_stats call failed: 401 Unauthorized/);
-            // 1 initial MCP call + 1 refresh attempt + 0 retries (refresh failed)
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
-            assert.equal(config.runtimeAccessToken, 'stale-token');
-        });
-        it('returns 404 from bridge refresh when agent has no cached token', async () => {
+            const wsClient = new WebSocketClient(config, (url) => {
+                websocketUrls.push(url);
+                websocketAttempt += 1;
+                const socket = new FakeSocket();
+                setImmediate(() => {
+                    socket.readyState = WebSocket.OPEN;
+                    socket.emit('open');
+                    if (websocketAttempt === 1) {
+                        socket.readyState = WebSocket.CLOSED;
+                        socket.emit('close', 1008, Buffer.from('policy violation'));
+                    }
+                });
+                return socket;
+            });
+            try {
+                wsClient.on('error', () => {
+                    // suppress unhandled error event in test environment
+                });
+                const websocketConnected = wsClient.connect('agent-1');
+                const httpCall = httpClient.callTool('get_memory_stats', { agentId: 'agent-1' });
+                await new Promise((resolve, reject) => {
+                    const timer = setTimeout(() => reject(new Error('expected both refresh waiters')), 500);
+                    const interval = setInterval(() => {
+                        if (tokenRequestCount === 1 && config.runtimeAccessTokenRefreshPromise) {
+                            clearInterval(interval);
+                            clearTimeout(timer);
+                            resolve();
+                        }
+                    }, 5);
+                });
+                const websocketReconnected = new Promise((resolve, reject) => {
+                    const timer = setTimeout(() => reject(new Error('expected websocket reconnect')), 500);
+                    wsClient.on('connected', () => {
+                        if (websocketAttempt >= 2) {
+                            clearTimeout(timer);
+                            resolve();
+                        }
+                    });
+                });
+                releaseRefresh?.();
+                const result = await httpCall;
+                await websocketConnected;
+                await websocketReconnected;
+                assert.deepEqual(result, { tool: 'get_memory_stats', token: 'shared-fresh-token' });
+                assert.equal(tokenRequestCount, 1);
+                assert.equal(config.runtimeAccessToken, 'shared-fresh-token');
+                assert.equal(new URL(websocketUrls[1] || '').searchParams.get('runtimeAccessToken'), 'shared-fresh-token');
+            }
+            finally {
+                releaseRefresh?.();
+                wsClient.disconnect();
+            }
+        });
+        it('shares one forced refresh among multiple waiters after an initial non-forced refresh', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
                 reconnectInterval: 200,
                 maxReconnectAttempts: -1,
                 userId: 'user-1',
-                runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
-            const client = new HttpClient(config);
+            const initialClient = new HttpClient(config);
+            const forceClient = new HttpClient(config);
+            let tokenRequestCount = 0;
+            let forceRequestCount = 0;
+            let releaseInitialRefresh;
+            const initialRefreshGate = new Promise((resolve) => {
+                releaseInitialRefresh = resolve;
+            });
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    // Bridge has no cached token for this agent
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                    tokenRequestCount += 1;
+                    const body = JSON.parse(String(options?.body || '{}'));
+                    if (body.forceRefresh) {
+                        forceRequestCount += 1;
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        return {
+                            ok: true,
+                            status: 200,
+                            statusText: 'OK',
+                            json: async () => ({ ok: true, runtimeAccessToken: 'forced-token' }),
+                        };
+                    }
+                    await initialRefreshGate;
+                    return {
+                        ok: true,
+                        status: 200,
+                        statusText: 'OK',
+                        json: async () => ({ ok: true, runtimeAccessToken: 'initial-token' }),
+                    };
+                }
+                const body = JSON.parse(String(options?.body || '{}'));
+                const token = options.headers['X-Runtime-Token'];
+                if (token === 'initial-token') {
                     return {
                         ok: false,
-                        status: 404,
-                        statusText: 'Not Found',
-                        json: async () => ({ error: 'no cached token for agent' }),
+                        status: 401,
+                        statusText: 'Unauthorized',
                     };
                 }
                 return {
-                    ok: false,
-                    status: 401,
-                    statusText: 'Unauthorized',
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    json: async () => ({ tool: body.tool, token }),
                 };
             };
-            await assert.rejects(() => client.callTool('get_profile', { agentId: 'agent-unknown' }), /MCP tool get_profile call failed: 401 Unauthorized/);
-            // 1 initial MCP call + 1 refresh attempt (404) + 0 retries
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
-            assert.equal(config.runtimeAccessToken, 'stale-token');
-        });
-        it('does not retry 401 after bridge refresh returns same token', async () => {
+            try {
+                const initialCall = initialClient.callTool('get_profile', { agentId: 'agent-1' });
+                await new Promise((resolve, reject) => {
+                    const timer = setTimeout(() => reject(new Error('expected initial refresh to start')), 500);
+                    const interval = setInterval(() => {
+                        if (tokenRequestCount === 1 && config.runtimeAccessTokenRefreshPromise) {
+                            clearInterval(interval);
+                            clearTimeout(timer);
+                            resolve();
+                        }
+                    }, 5);
+                });
+                const firstForceCall = forceClient.callTool('get_memory_stats', { agentId: 'agent-1' });
+                const secondForceCall = forceClient.callTool('discover_group_rooms', { agentId: 'agent-1' });
+                releaseInitialRefresh?.();
+                const [initialResult, firstForceResult, secondForceResult] = await Promise.all([
+                    initialCall,
+                    firstForceCall,
+                    secondForceCall,
+                ]);
+                assert.deepEqual(initialResult, { tool: 'get_profile', token: 'forced-token' });
+                assert.deepEqual(firstForceResult, { tool: 'get_memory_stats', token: 'forced-token' });
+                assert.deepEqual(secondForceResult, { tool: 'discover_group_rooms', token: 'forced-token' });
+                assert.equal(tokenRequestCount, 2);
+                assert.equal(forceRequestCount, 1);
+                assert.equal(config.runtimeAccessToken, 'forced-token');
+            }
+            finally {
+                releaseInitialRefresh?.();
+            }
+        });
+        it('does not retry 401 more than once after forced token refresh', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -514,13 +660,12 @@ describe('HttpClient', () => {
             const client = new HttpClient(config);
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    // Bridge returns same token
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: 'stale-token' }),
+                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
                     };
                 }
                 return {
@@ -530,11 +675,11 @@ describe('HttpClient', () => {
                 };
             };
             await assert.rejects(() => client.callTool('my_task', { agentId: 'agent-1' }), /MCP tool my_task call failed: 401 Unauthorized/);
-            // 1 initial MCP call + 1 refresh + 0 retries (same token, not updated)
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
+            assert.equal(fetchCalls.length, 3);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 2);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
         });
-        it('retries refresh on second call if first call 401 with different fresh token', async () => {
+        it('does not repeatedly force-refresh the same rejected runtime token across calls', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -545,24 +690,14 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            let refreshCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    refreshCount += 1;
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: `fresh-token-${refreshCount}` }),
-                    };
-                }
-                const token = options.headers['X-Runtime-Token'];
-                if (token && token.startsWith('fresh-token-')) {
-                    return {
-                        ok: false,
-                        status: 401,
-                        statusText: 'Unauthorized',
+                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-but-rejected-token' }),
                     };
                 }
                 return {
@@ -572,12 +707,13 @@ describe('HttpClient', () => {
                 };
             };
             await assert.rejects(() => client.callTool('discover_group_rooms', { agentId: 'agent-1' }), /MCP tool discover_group_rooms call failed: 401 Unauthorized/);
-            // Second call also tries refresh
             await assert.rejects(() => client.callTool('poll_message', { agentId: 'agent-1' }), /MCP tool poll_message call failed: 401 Unauthorized/);
-            assert.equal(config.runtimeAccessToken, 'fresh-token-2');
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 2);
+            assert.equal(config.runtimeAccessToken, 'fresh-but-rejected-token');
+            assert.equal(config.lastForceRefreshAttemptedForToken, 'fresh-but-rejected-token');
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 3);
         });
-        it('shares one refresh promise among concurrent 401 calls', async () => {
+        it('does not force-refresh again while the fresh runtime token is being validated', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -588,27 +724,32 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            let resolveRefresh = () => { };
-            const refreshGate = new Promise((resolve) => {
-                resolveRefresh = resolve;
+            let resolveFreshTokenValidationStarted = () => { };
+            let releaseFreshTokenValidation = () => { };
+            const freshTokenValidationStarted = new Promise((resolve) => {
+                resolveFreshTokenValidationStarted = resolve;
+            });
+            const freshTokenValidationReleased = new Promise((resolve) => {
+                releaseFreshTokenValidation = resolve;
             });
-            let refreshCallCount = 0;
             let freshTokenMcpCallCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
-                    refreshCallCount += 1;
-                    await refreshGate;
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ runtimeAccessToken: 'fresh-but-rejected-token' }),
+                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-but-rejected-token' }),
                     };
                 }
                 const requestHeaders = (options?.headers ?? {});
                 if (requestHeaders.Authorization === 'Bearer fresh-but-rejected-token') {
                     freshTokenMcpCallCount += 1;
+                    if (freshTokenMcpCallCount === 1) {
+                        resolveFreshTokenValidationStarted();
+                        await freshTokenValidationReleased;
+                    }
                 }
                 return {
                     ok: false,
@@ -617,19 +758,14 @@ describe('HttpClient', () => {
                 };
             };
             const firstCall = client.callTool('discover_group_rooms', { agentId: 'agent-1' });
-            // Wait for the refresh to start
-            await new Promise((resolve) => setTimeout(resolve, 20));
-            // Second call should share the same refresh promise
-            const secondCall = client.callTool('poll_message', { agentId: 'agent-1' });
-            resolveRefresh();
+            await freshTokenValidationStarted;
+            await assert.rejects(() => client.callTool('poll_message', { agentId: 'agent-1' }), /MCP tool poll_message call failed: 401 Unauthorized/);
+            releaseFreshTokenValidation();
             await assert.rejects(() => firstCall, /MCP tool discover_group_rooms call failed: 401 Unauthorized/);
-            await assert.rejects(() => secondCall, /MCP tool poll_message call failed: 401 Unauthorized/);
             assert.equal(config.runtimeAccessToken, 'fresh-but-rejected-token');
-            // Only one refresh call to bridge
-            assert.equal(refreshCallCount, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
-            // Both tools retried once with fresh token
-            assert.equal(freshTokenMcpCallCount, 2);
+            assert.equal(config.lastForceRefreshAttemptedForToken, 'fresh-but-rejected-token');
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 3);
         });
         it('handles 404 not found response', async () => {
             const config = {