aws-runtime-bridge 1.8.6 → 1.8.7

package/package/aws-client-agent-mcp/dist/http-client.test.js

@@ -1,19 +1,6 @@
 import assert from 'node:assert/strict';
-import { EventEmitter } from 'node:events';
 import { afterEach, beforeEach, describe, it, mock } from 'node:test';
-import WebSocket from 'ws';
 import { HttpClient } from './http-client.js';
-import { WebSocketClient } from './websocket-client.js';
-class FakeSocket extends EventEmitter {
-    readyState = WebSocket.CONNECTING;
-    send() { }
-    close() {
-        this.readyState = WebSocket.CLOSED;
-    }
-    terminate() {
-        this.readyState = WebSocket.CLOSED;
-    }
-}
 describe('HttpClient', () => {
     const originalFetch = global.fetch;
     let fetchCalls = [];
@@ -296,12 +283,12 @@ describe('HttpClient', () => {
                         statusText: 'Unauthorized',
                     };
                 }
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
+                        json: async () => ({ runtimeAccessToken: 'fresh-token' }),
                     };
                 }
                 return {
@@ -315,17 +302,15 @@ describe('HttpClient', () => {
             assert.deepEqual(result, { data: 'retried' });
             assert.equal(fetchCalls.length, 3);
             assert.equal(fetchCalls[0][1].headers['X-Runtime-Token'], 'stale-token');
-            assert.equal(fetchCalls[1][0], 'http://127.0.0.1:18081/runtime/binding/request-token');
+            assert.equal(fetchCalls[1][0], 'http://127.0.0.1:18081/runtime/binding/refresh-token');
             assert.equal(fetchCalls[1][1].body, JSON.stringify({
-                userId: 'user-1',
-                serverUrl: 'ws://localhost:8080/ws/agent',
-                forceRefresh: true,
-                rejectedRuntimeAccessToken: 'stale-token',
+                agentId: 'agent-1',
+                currentToken: 'stale-token',
             }));
             assert.equal(fetchCalls[2][1].headers['X-Runtime-Token'], 'fresh-token');
             assert.equal(config.runtimeAccessToken, 'fresh-token');
         });
-        it('shares one forced runtime token refresh across concurrent 401 responses', async () => {
+        it('shares one bridge token refresh across concurrent 401 responses', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -339,13 +324,13 @@ describe('HttpClient', () => {
             const staleTokenCalls = new Set();
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
                     await new Promise((resolve) => setTimeout(resolve, 10));
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
+                        json: async () => ({ runtimeAccessToken: 'fresh-token' }),
                     };
                 }
                 const body = JSON.parse(String(options?.body || '{}'));
@@ -372,10 +357,10 @@ describe('HttpClient', () => {
             assert.deepEqual(first, { tool: 'get_memory_stats', token: 'fresh-token' });
             assert.deepEqual(second, { tool: 'discover_group_rooms', token: 'fresh-token' });
             assert.deepEqual(staleTokenCalls, new Set(['get_memory_stats', 'discover_group_rooms']));
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
             assert.equal(config.runtimeAccessToken, 'fresh-token');
         });
-        it('shares one initial runtime token request across concurrent calls without a token', async () => {
+        it('throws when no runtimeAccessToken and no bridge for startup', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -385,270 +370,139 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            global.fetch = async (url, options) => {
-                fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
-                    await new Promise((resolve) => setTimeout(resolve, 10));
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'startup-token' }),
-                    };
-                }
-                const body = JSON.parse(String(options?.body || '{}'));
-                return {
-                    ok: true,
-                    status: 200,
-                    statusText: 'OK',
-                    json: async () => ({ tool: body.tool, token: options.headers['X-Runtime-Token'] }),
-                };
-            };
-            const [first, second] = await Promise.all([
-                client.callTool('get_memory_stats', { agentId: 'agent-1' }),
-                client.callTool('discover_group_rooms', { agentId: 'agent-1' }),
-            ]);
-            assert.deepEqual(first, { tool: 'get_memory_stats', token: 'startup-token' });
-            assert.deepEqual(second, { tool: 'discover_group_rooms', token: 'startup-token' });
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
-            assert.equal(fetchCalls[0][1].body, JSON.stringify({
-                userId: 'user-1',
-                serverUrl: 'ws://localhost:8080/ws/agent',
-                forceRefresh: false,
-            }));
-            assert.equal(config.runtimeAccessToken, 'startup-token');
+            global.fetch = async () => ({
+                ok: true,
+                status: 200,
+                statusText: 'OK',
+                json: async () => ({ result: 'success' }),
+            });
+            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /runtimeAccessToken is required; MCP nodes must claim a session token from launch binding/);
         });
-        it('clears failed runtime token refresh so later calls can retry', async () => {
+        it('throws original 401 when bridge refresh fails', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
                 reconnectInterval: 200,
                 maxReconnectAttempts: -1,
                 userId: 'user-1',
+                runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            let tokenRequestCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
-                    tokenRequestCount += 1;
-                    if (tokenRequestCount === 1) {
-                        return {
-                            ok: false,
-                            status: 503,
-                            statusText: 'Service Unavailable',
-                            text: async () => 'bridge unavailable',
-                        };
-                    }
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    return {
+                        ok: false,
+                        status: 503,
+                        statusText: 'Service Unavailable',
+                    };
+                }
+                return {
+                    ok: false,
+                    status: 401,
+                    statusText: 'Unauthorized',
+                };
+            };
+            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /MCP tool get_memory_stats call failed: 401 Unauthorized/);
+            // Can retry again after failure
+            global.fetch = async (url, options) => {
+                fetchCalls.push([url.toString(), options]);
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'recovered-token' }),
+                        json: async () => ({ runtimeAccessToken: 'recovered-token' }),
+                    };
+                }
+                const token = options.headers['X-Runtime-Token'];
+                if (token === 'recovered-token') {
+                    return {
+                        ok: true,
+                        status: 200,
+                        statusText: 'OK',
+                        json: async () => ({ token }),
                     };
                 }
                 return {
-                    ok: true,
-                    status: 200,
-                    statusText: 'OK',
-                    json: async () => ({ token: options.headers['X-Runtime-Token'] }),
+                    ok: false,
+                    status: 401,
+                    statusText: 'Unauthorized',
                 };
             };
-            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /Failed to request runtime token from runtime-bridge: 503 Service Unavailable - bridge unavailable/);
             const result = await client.callTool('get_memory_stats', { agentId: 'agent-1' });
             assert.deepEqual(result, { token: 'recovered-token' });
-            assert.equal(tokenRequestCount, 2);
             assert.equal(config.runtimeAccessToken, 'recovered-token');
         });
-        it('shares one runtime token refresh between HTTP tools and websocket recovery', async () => {
+        it('returns 401 when bridge refresh has no new token for running agent', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
-                heartbeatInterval: 1000,
-                heartbeatTimeout: 3000,
-                reconnectInterval: 10,
-                maxReconnectAttempts: 2,
-                userId: 'user-1',
+                heartbeatInterval: 15000,
+                reconnectInterval: 200,
+                maxReconnectAttempts: -1,
                 runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
-            const httpClient = new HttpClient(config);
-            let tokenRequestCount = 0;
-            let websocketAttempt = 0;
-            const websocketUrls = [];
-            let releaseRefresh;
-            const refreshGate = new Promise((resolve) => {
-                releaseRefresh = resolve;
-            });
+            const client = new HttpClient(config);
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
-                    tokenRequestCount += 1;
-                    await refreshGate;
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'shared-fresh-token' }),
-                    };
-                }
-                const body = JSON.parse(String(options?.body || '{}'));
-                const token = options.headers['X-Runtime-Token'];
-                if (token === 'stale-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    // Bridge says no new token available (409 conflict)
                     return {
                         ok: false,
-                        status: 401,
-                        statusText: 'Unauthorized',
+                        status: 409,
+                        statusText: 'Conflict',
+                        json: async () => ({ error: 'token_unchanged' }),
                     };
                 }
                 return {
-                    ok: true,
-                    status: 200,
-                    statusText: 'OK',
-                    json: async () => ({ tool: body.tool, token }),
+                    ok: false,
+                    status: 401,
+                    statusText: 'Unauthorized',
                 };
             };
-            const wsClient = new WebSocketClient(config, (url) => {
-                websocketUrls.push(url);
-                websocketAttempt += 1;
-                const socket = new FakeSocket();
-                setImmediate(() => {
-                    socket.readyState = WebSocket.OPEN;
-                    socket.emit('open');
-                    if (websocketAttempt === 1) {
-                        socket.readyState = WebSocket.CLOSED;
-                        socket.emit('close', 1008, Buffer.from('policy violation'));
-                    }
-                });
-                return socket;
-            });
-            try {
-                wsClient.on('error', () => {
-                    // suppress unhandled error event in test environment
-                });
-                const websocketConnected = wsClient.connect('agent-1');
-                const httpCall = httpClient.callTool('get_memory_stats', { agentId: 'agent-1' });
-                await new Promise((resolve, reject) => {
-                    const timer = setTimeout(() => reject(new Error('expected both refresh waiters')), 500);
-                    const interval = setInterval(() => {
-                        if (tokenRequestCount === 1 && config.runtimeAccessTokenRefreshPromise) {
-                            clearInterval(interval);
-                            clearTimeout(timer);
-                            resolve();
-                        }
-                    }, 5);
-                });
-                const websocketReconnected = new Promise((resolve, reject) => {
-                    const timer = setTimeout(() => reject(new Error('expected websocket reconnect')), 500);
-                    wsClient.on('connected', () => {
-                        if (websocketAttempt >= 2) {
-                            clearTimeout(timer);
-                            resolve();
-                        }
-                    });
-                });
-                releaseRefresh?.();
-                const result = await httpCall;
-                await websocketConnected;
-                await websocketReconnected;
-                assert.deepEqual(result, { tool: 'get_memory_stats', token: 'shared-fresh-token' });
-                assert.equal(tokenRequestCount, 1);
-                assert.equal(config.runtimeAccessToken, 'shared-fresh-token');
-                assert.equal(new URL(websocketUrls[1] || '').searchParams.get('runtimeAccessToken'), 'shared-fresh-token');
-            }
-            finally {
-                releaseRefresh?.();
-                wsClient.disconnect();
-            }
-        });
-        it('shares one forced refresh among multiple waiters after an initial non-forced refresh', async () => {
+            await assert.rejects(() => client.callTool('get_memory_stats', { agentId: 'agent-1' }), /MCP tool get_memory_stats call failed: 401 Unauthorized/);
+            // 1 initial MCP call + 1 refresh attempt + 0 retries (refresh failed)
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
+            assert.equal(config.runtimeAccessToken, 'stale-token');
+        });
+        it('returns 404 from bridge refresh when agent has no cached token', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
                 reconnectInterval: 200,
                 maxReconnectAttempts: -1,
                 userId: 'user-1',
+                runtimeAccessToken: 'stale-token',
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
-            const initialClient = new HttpClient(config);
-            const forceClient = new HttpClient(config);
-            let tokenRequestCount = 0;
-            let forceRequestCount = 0;
-            let releaseInitialRefresh;
-            const initialRefreshGate = new Promise((resolve) => {
-                releaseInitialRefresh = resolve;
-            });
+            const client = new HttpClient(config);
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
-                    tokenRequestCount += 1;
-                    const body = JSON.parse(String(options?.body || '{}'));
-                    if (body.forceRefresh) {
-                        forceRequestCount += 1;
-                        await new Promise((resolve) => setTimeout(resolve, 10));
-                        return {
-                            ok: true,
-                            status: 200,
-                            statusText: 'OK',
-                            json: async () => ({ ok: true, runtimeAccessToken: 'forced-token' }),
-                        };
-                    }
-                    await initialRefreshGate;
-                    return {
-                        ok: true,
-                        status: 200,
-                        statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'initial-token' }),
-                    };
-                }
-                const body = JSON.parse(String(options?.body || '{}'));
-                const token = options.headers['X-Runtime-Token'];
-                if (token === 'initial-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    // Bridge has no cached token for this agent
                     return {
                         ok: false,
-                        status: 401,
-                        statusText: 'Unauthorized',
+                        status: 404,
+                        statusText: 'Not Found',
+                        json: async () => ({ error: 'no cached token for agent' }),
                     };
                 }
                 return {
-                    ok: true,
-                    status: 200,
-                    statusText: 'OK',
-                    json: async () => ({ tool: body.tool, token }),
+                    ok: false,
+                    status: 401,
+                    statusText: 'Unauthorized',
                 };
             };
-            try {
-                const initialCall = initialClient.callTool('get_profile', { agentId: 'agent-1' });
-                await new Promise((resolve, reject) => {
-                    const timer = setTimeout(() => reject(new Error('expected initial refresh to start')), 500);
-                    const interval = setInterval(() => {
-                        if (tokenRequestCount === 1 && config.runtimeAccessTokenRefreshPromise) {
-                            clearInterval(interval);
-                            clearTimeout(timer);
-                            resolve();
-                        }
-                    }, 5);
-                });
-                const firstForceCall = forceClient.callTool('get_memory_stats', { agentId: 'agent-1' });
-                const secondForceCall = forceClient.callTool('discover_group_rooms', { agentId: 'agent-1' });
-                releaseInitialRefresh?.();
-                const [initialResult, firstForceResult, secondForceResult] = await Promise.all([
-                    initialCall,
-                    firstForceCall,
-                    secondForceCall,
-                ]);
-                assert.deepEqual(initialResult, { tool: 'get_profile', token: 'forced-token' });
-                assert.deepEqual(firstForceResult, { tool: 'get_memory_stats', token: 'forced-token' });
-                assert.deepEqual(secondForceResult, { tool: 'discover_group_rooms', token: 'forced-token' });
-                assert.equal(tokenRequestCount, 2);
-                assert.equal(forceRequestCount, 1);
-                assert.equal(config.runtimeAccessToken, 'forced-token');
-            }
-            finally {
-                releaseInitialRefresh?.();
-            }
-        });
-        it('does not retry 401 more than once after forced token refresh', async () => {
+            await assert.rejects(() => client.callTool('get_profile', { agentId: 'agent-unknown' }), /MCP tool get_profile call failed: 401 Unauthorized/);
+            // 1 initial MCP call + 1 refresh attempt (404) + 0 retries
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
+            assert.equal(config.runtimeAccessToken, 'stale-token');
+        });
+        it('does not retry 401 after bridge refresh returns same token', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -660,12 +514,13 @@ describe('HttpClient', () => {
             const client = new HttpClient(config);
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    // Bridge returns same token
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-token' }),
+                        json: async () => ({ runtimeAccessToken: 'stale-token' }),
                     };
                 }
                 return {
@@ -675,11 +530,11 @@ describe('HttpClient', () => {
                 };
             };
             await assert.rejects(() => client.callTool('my_task', { agentId: 'agent-1' }), /MCP tool my_task call failed: 401 Unauthorized/);
-            assert.equal(fetchCalls.length, 3);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 2);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
+            // 1 initial MCP call + 1 refresh + 0 retries (same token, not updated)
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
         });
-        it('does not repeatedly force-refresh the same rejected runtime token across calls', async () => {
+        it('retries refresh on second call if first call 401 with different fresh token', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -690,14 +545,24 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
+            let refreshCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    refreshCount += 1;
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-but-rejected-token' }),
+                        json: async () => ({ runtimeAccessToken: `fresh-token-${refreshCount}` }),
+                    };
+                }
+                const token = options.headers['X-Runtime-Token'];
+                if (token && token.startsWith('fresh-token-')) {
+                    return {
+                        ok: false,
+                        status: 401,
+                        statusText: 'Unauthorized',
                     };
                 }
                 return {
@@ -707,13 +572,12 @@ describe('HttpClient', () => {
                 };
             };
             await assert.rejects(() => client.callTool('discover_group_rooms', { agentId: 'agent-1' }), /MCP tool discover_group_rooms call failed: 401 Unauthorized/);
+            // Second call also tries refresh
             await assert.rejects(() => client.callTool('poll_message', { agentId: 'agent-1' }), /MCP tool poll_message call failed: 401 Unauthorized/);
-            assert.equal(config.runtimeAccessToken, 'fresh-but-rejected-token');
-            assert.equal(config.lastForceRefreshAttemptedForToken, 'fresh-but-rejected-token');
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 3);
+            assert.equal(config.runtimeAccessToken, 'fresh-token-2');
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 2);
         });
-        it('does not force-refresh again while the fresh runtime token is being validated', async () => {
+        it('shares one refresh promise among concurrent 401 calls', async () => {
             const config = {
                 serverUrl: 'ws://localhost:8080/ws/agent',
                 heartbeatInterval: 15000,
@@ -724,32 +588,27 @@ describe('HttpClient', () => {
                 runtimeBridgeBaseUrl: 'http://127.0.0.1:18081',
             };
             const client = new HttpClient(config);
-            let resolveFreshTokenValidationStarted = () => { };
-            let releaseFreshTokenValidation = () => { };
-            const freshTokenValidationStarted = new Promise((resolve) => {
-                resolveFreshTokenValidationStarted = resolve;
-            });
-            const freshTokenValidationReleased = new Promise((resolve) => {
-                releaseFreshTokenValidation = resolve;
+            let resolveRefresh = () => { };
+            const refreshGate = new Promise((resolve) => {
+                resolveRefresh = resolve;
             });
+            let refreshCallCount = 0;
             let freshTokenMcpCallCount = 0;
             global.fetch = async (url, options) => {
                 fetchCalls.push([url.toString(), options]);
-                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/request-token') {
+                if (url.toString() === 'http://127.0.0.1:18081/runtime/binding/refresh-token') {
+                    refreshCallCount += 1;
+                    await refreshGate;
                     return {
                         ok: true,
                         status: 200,
                         statusText: 'OK',
-                        json: async () => ({ ok: true, runtimeAccessToken: 'fresh-but-rejected-token' }),
+                        json: async () => ({ runtimeAccessToken: 'fresh-but-rejected-token' }),
                     };
                 }
                 const requestHeaders = (options?.headers ?? {});
                 if (requestHeaders.Authorization === 'Bearer fresh-but-rejected-token') {
                     freshTokenMcpCallCount += 1;
-                    if (freshTokenMcpCallCount === 1) {
-                        resolveFreshTokenValidationStarted();
-                        await freshTokenValidationReleased;
-                    }
                 }
                 return {
                     ok: false,
@@ -758,14 +617,19 @@ describe('HttpClient', () => {
                 };
             };
             const firstCall = client.callTool('discover_group_rooms', { agentId: 'agent-1' });
-            await freshTokenValidationStarted;
-            await assert.rejects(() => client.callTool('poll_message', { agentId: 'agent-1' }), /MCP tool poll_message call failed: 401 Unauthorized/);
-            releaseFreshTokenValidation();
+            // Wait for the refresh to start
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            // Second call should share the same refresh promise
+            const secondCall = client.callTool('poll_message', { agentId: 'agent-1' });
+            resolveRefresh();
             await assert.rejects(() => firstCall, /MCP tool discover_group_rooms call failed: 401 Unauthorized/);
+            await assert.rejects(() => secondCall, /MCP tool poll_message call failed: 401 Unauthorized/);
             assert.equal(config.runtimeAccessToken, 'fresh-but-rejected-token');
-            assert.equal(config.lastForceRefreshAttemptedForToken, 'fresh-but-rejected-token');
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/request-token').length, 1);
-            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:8080/mcp/call').length, 3);
+            // Only one refresh call to bridge
+            assert.equal(refreshCallCount, 1);
+            assert.equal(fetchCalls.filter(([url]) => url === 'http://127.0.0.1:18081/runtime/binding/refresh-token').length, 1);
+            // Both tools retried once with fresh token
+            assert.equal(freshTokenMcpCallCount, 2);
         });
         it('handles 404 not found response', async () => {
             const config = {