discoclaw 0.1.0

package/dist/runtime/model-tiers.js

@@ -0,0 +1,33 @@
+const tiers = new Set(['fast', 'capable']);
+/** Type guard for ModelTier. */
+export function isModelTier(s) {
+    return tiers.has(s);
+}
+/**
+ * Maps tier × runtime to a concrete model string.
+ * Empty string = adapter-default sentinel (adapter uses its own defaultModel).
+ */
+const tierMap = {
+    claude_code: { fast: 'haiku', capable: 'opus' },
+    gemini: { fast: 'gemini-2.5-flash', capable: 'gemini-2.5-pro' },
+    openai: { fast: '', capable: '' },
+    codex: { fast: '', capable: '' },
+};
+/**
+ * Resolve a tier name or literal model string to a concrete model string.
+ *
+ * - Known tier name → look up in the built-in map for the given runtime.
+ * - Anything else → pass through unchanged (supports `RUNTIME_MODEL=opus`
+ *   or `RUNTIME_MODEL=claude-sonnet-4-5-20250929`).
+ *
+ * For runtimes not in the built-in map (`gemini`, `other`), tier inputs
+ * resolve to `''` (adapter-default sentinel).
+ */
+export function resolveModel(tierOrModel, runtimeId) {
+    if (!isModelTier(tierOrModel))
+        return tierOrModel;
+    const runtimeTiers = tierMap[runtimeId];
+    if (!runtimeTiers)
+        return '';
+    return runtimeTiers[tierOrModel];
+}

package/dist/runtime/model-tiers.test.js

@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest';
+import { isModelTier, resolveModel } from './model-tiers.js';
+describe('isModelTier', () => {
+    it('returns true for known tiers', () => {
+        expect(isModelTier('fast')).toBe(true);
+        expect(isModelTier('capable')).toBe(true);
+    });
+    it('returns false for legacy tier names', () => {
+        expect(isModelTier('haiku')).toBe(false);
+        expect(isModelTier('opus')).toBe(false);
+    });
+    it('returns false for arbitrary strings', () => {
+        expect(isModelTier('')).toBe(false);
+        expect(isModelTier('claude-sonnet-4-5-20250929')).toBe(false);
+    });
+});
+describe('resolveModel', () => {
+    describe('claude_code runtime', () => {
+        it('resolves fast → haiku', () => {
+            expect(resolveModel('fast', 'claude_code')).toBe('haiku');
+        });
+        it('resolves capable → opus', () => {
+            expect(resolveModel('capable', 'claude_code')).toBe('opus');
+        });
+    });
+    describe('openai runtime', () => {
+        it('resolves tiers to empty string (adapter-default)', () => {
+            expect(resolveModel('fast', 'openai')).toBe('');
+            expect(resolveModel('capable', 'openai')).toBe('');
+        });
+    });
+    describe('codex runtime', () => {
+        it('resolves tiers to empty string (adapter-default)', () => {
+            expect(resolveModel('fast', 'codex')).toBe('');
+            expect(resolveModel('capable', 'codex')).toBe('');
+        });
+    });
+    describe('gemini runtime', () => {
+        it('resolves fast → gemini-2.5-flash', () => {
+            expect(resolveModel('fast', 'gemini')).toBe('gemini-2.5-flash');
+        });
+        it('resolves capable → gemini-2.5-pro', () => {
+            expect(resolveModel('capable', 'gemini')).toBe('gemini-2.5-pro');
+        });
+    });
+    describe('unknown runtimes (other)', () => {
+        it('resolves tiers to empty string', () => {
+            expect(resolveModel('fast', 'other')).toBe('');
+            expect(resolveModel('capable', 'other')).toBe('');
+        });
+    });
+    describe('passthrough for non-tier strings', () => {
+        it('passes through legacy model names', () => {
+            expect(resolveModel('haiku', 'claude_code')).toBe('haiku');
+            expect(resolveModel('opus', 'claude_code')).toBe('opus');
+        });
+        it('passes through full model identifiers', () => {
+            expect(resolveModel('claude-sonnet-4-5-20250929', 'claude_code')).toBe('claude-sonnet-4-5-20250929');
+            expect(resolveModel('gpt-4o', 'openai')).toBe('gpt-4o');
+        });
+        it('passes through empty string', () => {
+            expect(resolveModel('', 'claude_code')).toBe('');
+        });
+    });
+});

package/dist/runtime/openai-auth.js

@@ -0,0 +1,151 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+// Codex CLI's registered OAuth client_id — see https://github.com/openai/codex
+export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const OPENAI_TOKEN_ENDPOINT = 'https://auth.openai.com/oauth/token';
+/** Read and parse the Codex auth file. Expects an absolute path. */
+export async function loadAuthFile(filePath) {
+    const raw = await fs.readFile(filePath, 'utf-8');
+    const data = JSON.parse(raw);
+    if (!data.tokens?.access_token || !data.tokens?.refresh_token) {
+        throw new Error(`Auth file ${filePath} missing required tokens (access_token, refresh_token)`);
+    }
+    return data;
+}
+/** Base64url-decode the JWT payload and extract the `exp` claim. */
+export function decodeJwtExp(token) {
+    const parts = token.split('.');
+    if (parts.length < 2) {
+        throw new Error('Invalid JWT: expected at least 2 dot-separated segments');
+    }
+    // Base64url → Base64 → Buffer → JSON
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const json = Buffer.from(base64, 'base64').toString('utf-8');
+    const payload = JSON.parse(json);
+    if (typeof payload.exp !== 'number') {
+        throw new Error('JWT payload missing numeric "exp" claim');
+    }
+    return payload.exp;
+}
+/**
+ * Returns true if the token's `exp` minus `bufferSecs` is before now.
+ * 5-minute buffer by default to avoid edge-case expiry mid-request.
+ */
+export function isTokenExpired(token, bufferSecs = 300) {
+    try {
+        const exp = decodeJwtExp(token);
+        return exp - bufferSecs < Date.now() / 1000;
+    }
+    catch {
+        // If we can't decode, treat as expired so we refresh
+        return true;
+    }
+}
+/** POST to OpenAI's OAuth endpoint to refresh the access token. */
+export async function refreshAccessToken(refreshToken, clientId = CODEX_CLIENT_ID) {
+    const response = await fetch(OPENAI_TOKEN_ENDPOINT, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: clientId,
+        }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Token refresh failed (${response.status}): ${body} [client_id=${clientId}]`);
+    }
+    const result = (await response.json());
+    if (!result.access_token) {
+        throw new Error(`Token refresh returned no access_token [client_id=${clientId}]`);
+    }
+    return result;
+}
+/**
+ * Write updated tokens back to the auth file.
+ * Atomic write via temp file + rename. On failure, logs a warning but does not throw
+ * — the in-memory token is still valid.
+ */
+export async function saveAuthFile(filePath, data, log) {
+    const dir = path.dirname(filePath);
+    const tmpPath = path.join(dir, `.auth.tmp.${process.pid}`);
+    try {
+        await fs.writeFile(tmpPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+        await fs.rename(tmpPath, filePath);
+    }
+    catch (err) {
+        log?.warn({ err, filePath }, 'openai-auth: failed to persist auth file (in-memory token still valid)');
+        // Clean up temp file on failure
+        try {
+            await fs.unlink(tmpPath);
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+/**
+ * Create a token provider that manages ChatGPT OAuth access tokens.
+ * Reads from the Codex CLI auth file, refreshes when expired, and persists updates.
+ * Uses a mutex to prevent concurrent refresh storms.
+ */
+export function createChatGptTokenProvider(opts) {
+    const { authFilePath, log } = opts;
+    let cachedToken = null;
+    let cachedAuthData = null;
+    let acquirePromise = null;
+    /** Load file, check expiry, refresh if needed — all under a single mutex. */
+    async function acquireToken(forceRefresh) {
+        // Load auth data from file if not yet cached
+        if (!cachedAuthData) {
+            try {
+                cachedAuthData = await loadAuthFile(authFilePath);
+                cachedToken = cachedAuthData.tokens.access_token;
+            }
+            catch (err) {
+                log.error({ err }, 'openai-auth: failed to load auth file');
+                throw err;
+            }
+        }
+        // If token is still valid and not forcing, return it
+        if (!forceRefresh && cachedToken && !isTokenExpired(cachedToken)) {
+            return cachedToken;
+        }
+        // Refresh
+        log.debug('openai-auth: refreshing access token');
+        const result = await refreshAccessToken(cachedAuthData.tokens.refresh_token);
+        // Update cached auth data with new tokens
+        cachedAuthData = {
+            ...cachedAuthData,
+            tokens: {
+                ...cachedAuthData.tokens,
+                access_token: result.access_token,
+                ...(result.refresh_token ? { refresh_token: result.refresh_token } : {}),
+                ...(result.id_token ? { id_token: result.id_token } : {}),
+            },
+            last_refresh: new Date().toISOString(),
+        };
+        cachedToken = result.access_token;
+        // Persist to disk (non-throwing)
+        await saveAuthFile(authFilePath, cachedAuthData, log);
+        log.debug('openai-auth: token refreshed successfully');
+        return cachedToken;
+    }
+    return {
+        async getAccessToken(forceRefresh = false) {
+            // Fast path: return cached non-expired token (no async work)
+            if (!forceRefresh && cachedToken && !isTokenExpired(cachedToken)) {
+                return cachedToken;
+            }
+            // Mutex: if an acquire is already in progress, wait for it
+            if (acquirePromise) {
+                return acquirePromise;
+            }
+            acquirePromise = acquireToken(forceRefresh).finally(() => {
+                acquirePromise = null;
+            });
+            return acquirePromise;
+        },
+    };
+}

package/dist/runtime/openai-auth.test.js

@@ -0,0 +1,361 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { CODEX_CLIENT_ID, createChatGptTokenProvider, decodeJwtExp, isTokenExpired, loadAuthFile, refreshAccessToken, saveAuthFile, } from './openai-auth.js';
+/** Build a minimal JWT with the given payload claims. No signature. */
+function makeJwt(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'none' })).toString('base64url');
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${header}.${body}.`;
+}
+function makeAuthData(overrides) {
+    return {
+        auth_mode: 'chatgpt',
+        tokens: {
+            access_token: makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 }),
+            refresh_token: 'rt-test-refresh-token',
+            id_token: 'id-test',
+            account_id: 'acct-123',
+        },
+        last_refresh: new Date().toISOString(),
+        ...overrides,
+    };
+}
+function makeLogger() {
+    return {
+        debug: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+    };
+}
+describe('CODEX_CLIENT_ID', () => {
+    it('has the expected value', () => {
+        expect(CODEX_CLIENT_ID).toBe('app_EMoamEEZ73f0CkXaXp7hrann');
+    });
+});
+describe('decodeJwtExp', () => {
+    it('extracts exp from a valid JWT', () => {
+        const exp = 1700000000;
+        const token = makeJwt({ exp, sub: 'user-1' });
+        expect(decodeJwtExp(token)).toBe(exp);
+    });
+    it('throws for a token with fewer than 2 segments', () => {
+        expect(() => decodeJwtExp('just-one-segment')).toThrow('Invalid JWT');
+    });
+    it('throws when payload has no exp claim', () => {
+        const token = makeJwt({ sub: 'user-1' });
+        expect(() => decodeJwtExp(token)).toThrow('missing numeric "exp"');
+    });
+    it('handles base64url characters (- and _)', () => {
+        // Create payload with characters that produce -/_ in base64url
+        const exp = 1700000000;
+        const token = makeJwt({ exp, data: '>>>???<<<' });
+        expect(decodeJwtExp(token)).toBe(exp);
+    });
+});
+describe('isTokenExpired', () => {
+    it('returns false for a token expiring well in the future', () => {
+        const token = makeJwt({ exp: Math.floor(Date.now() / 1000) + 7200 });
+        expect(isTokenExpired(token)).toBe(false);
+    });
+    it('returns true for a token expiring within the buffer window', () => {
+        const token = makeJwt({ exp: Math.floor(Date.now() / 1000) + 100 });
+        // Default buffer is 300s, so 100s from now is "expired"
+        expect(isTokenExpired(token)).toBe(true);
+    });
+    it('returns true for an already-expired token', () => {
+        const token = makeJwt({ exp: Math.floor(Date.now() / 1000) - 100 });
+        expect(isTokenExpired(token)).toBe(true);
+    });
+    it('respects custom bufferSecs', () => {
+        const token = makeJwt({ exp: Math.floor(Date.now() / 1000) + 100 });
+        // With a 50s buffer, 100s from now is NOT expired
+        expect(isTokenExpired(token, 50)).toBe(false);
+        // With a 200s buffer, 100s from now IS expired
+        expect(isTokenExpired(token, 200)).toBe(true);
+    });
+    it('returns true for an unparseable token (treats as expired)', () => {
+        expect(isTokenExpired('not-a-jwt')).toBe(true);
+    });
+});
+describe('loadAuthFile', () => {
+    let tmpDir;
+    beforeEach(async () => {
+        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'openai-auth-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    });
+    it('parses a valid auth file', async () => {
+        const data = makeAuthData();
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        const loaded = await loadAuthFile(filePath);
+        expect(loaded.tokens.access_token).toBe(data.tokens.access_token);
+        expect(loaded.tokens.refresh_token).toBe(data.tokens.refresh_token);
+        expect(loaded.auth_mode).toBe('chatgpt');
+    });
+    it('throws for a file missing access_token', async () => {
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify({
+            auth_mode: 'chatgpt',
+            tokens: { refresh_token: 'rt-123' },
+        }));
+        await expect(loadAuthFile(filePath)).rejects.toThrow('missing required tokens');
+    });
+    it('throws for a file missing refresh_token', async () => {
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify({
+            auth_mode: 'chatgpt',
+            tokens: { access_token: 'at-123' },
+        }));
+        await expect(loadAuthFile(filePath)).rejects.toThrow('missing required tokens');
+    });
+    it('throws for a nonexistent file', async () => {
+        await expect(loadAuthFile(path.join(tmpDir, 'nope.json'))).rejects.toThrow();
+    });
+});
+describe('saveAuthFile', () => {
+    let tmpDir;
+    beforeEach(async () => {
+        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'openai-auth-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    });
+    it('writes and reads back correctly', async () => {
+        const data = makeAuthData();
+        const filePath = path.join(tmpDir, 'auth.json');
+        await saveAuthFile(filePath, data);
+        const raw = await fs.readFile(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        expect(parsed.tokens.access_token).toBe(data.tokens.access_token);
+        expect(parsed.tokens.refresh_token).toBe(data.tokens.refresh_token);
+    });
+    it('logs warning on write failure (does not throw)', async () => {
+        const log = makeLogger();
+        // Writing to a nonexistent directory should fail
+        const filePath = path.join(tmpDir, 'no', 'such', 'dir', 'auth.json');
+        await saveAuthFile(filePath, makeAuthData(), log);
+        expect(log.warn).toHaveBeenCalledTimes(1);
+        expect(log.warn.mock.calls[0][1]).toContain('failed to persist');
+    });
+});
+describe('refreshAccessToken', () => {
+    const originalFetch = globalThis.fetch;
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it('sends correct request and returns tokens', async () => {
+        const newAccessToken = 'new-access-token';
+        let capturedBody;
+        let capturedUrl;
+        globalThis.fetch = vi.fn().mockImplementation((url, init) => {
+            capturedUrl = url;
+            capturedBody = init?.body;
+            return Promise.resolve(new Response(JSON.stringify({
+                access_token: newAccessToken,
+                refresh_token: 'new-refresh',
+                id_token: 'new-id',
+            }), { status: 200 }));
+        });
+        const result = await refreshAccessToken('rt-old', 'test-client-id');
+        expect(capturedUrl).toBe('https://auth.openai.com/oauth/token');
+        const body = JSON.parse(capturedBody);
+        expect(body.grant_type).toBe('refresh_token');
+        expect(body.refresh_token).toBe('rt-old');
+        expect(body.client_id).toBe('test-client-id');
+        expect(result.access_token).toBe(newAccessToken);
+        expect(result.refresh_token).toBe('new-refresh');
+    });
+    it('defaults client_id to CODEX_CLIENT_ID', async () => {
+        let capturedBody;
+        globalThis.fetch = vi.fn().mockImplementation((_url, init) => {
+            capturedBody = init?.body;
+            return Promise.resolve(new Response(JSON.stringify({ access_token: 'at' }), { status: 200 }));
+        });
+        await refreshAccessToken('rt-test');
+        const body = JSON.parse(capturedBody);
+        expect(body.client_id).toBe(CODEX_CLIENT_ID);
+    });
+    it('throws on non-ok response with client_id in message', async () => {
+        globalThis.fetch = vi.fn().mockResolvedValue(new Response('bad request', { status: 400 }));
+        await expect(refreshAccessToken('rt-bad', 'my-client'))
+            .rejects.toThrow(/client_id=my-client/);
+    });
+    it('throws when response has no access_token', async () => {
+        globalThis.fetch = vi.fn().mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
+        await expect(refreshAccessToken('rt-test'))
+            .rejects.toThrow(/no access_token/);
+    });
+});
+describe('createChatGptTokenProvider', () => {
+    const originalFetch = globalThis.fetch;
+    let tmpDir;
+    beforeEach(async () => {
+        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'openai-auth-test-'));
+    });
+    afterEach(async () => {
+        globalThis.fetch = originalFetch;
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    });
+    function mockRefreshEndpoint(newAccessToken) {
+        globalThis.fetch = vi.fn().mockResolvedValue(new Response(JSON.stringify({ access_token: newAccessToken }), { status: 200 }));
+    }
+    it('returns cached token from file when not expired', async () => {
+        const validToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: validToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        const fetchSpy = vi.fn();
+        globalThis.fetch = fetchSpy;
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        const token = await provider.getAccessToken();
+        expect(token).toBe(validToken);
+        // Should NOT have called fetch (no refresh needed)
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+    it('refreshes expired token', async () => {
+        const expiredToken = makeJwt({ exp: Math.floor(Date.now() / 1000) - 100 });
+        const newToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: expiredToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        mockRefreshEndpoint(newToken);
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        const token = await provider.getAccessToken();
+        expect(token).toBe(newToken);
+    });
+    it('refreshes when forceRefresh is true even if token is valid', async () => {
+        const validToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const newToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 7200 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: validToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        mockRefreshEndpoint(newToken);
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        // First call loads cached valid token
+        const token1 = await provider.getAccessToken();
+        expect(token1).toBe(validToken);
+        // Force refresh
+        const token2 = await provider.getAccessToken(true);
+        expect(token2).toBe(newToken);
+    });
+    it('persists refreshed tokens to disk', async () => {
+        const expiredToken = makeJwt({ exp: Math.floor(Date.now() / 1000) - 100 });
+        const newToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: expiredToken,
+                refresh_token: 'rt-original',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        globalThis.fetch = vi.fn().mockResolvedValue(new Response(JSON.stringify({
+            access_token: newToken,
+            refresh_token: 'rt-updated',
+        }), { status: 200 }));
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        await provider.getAccessToken();
+        // Read back from disk
+        const raw = await fs.readFile(filePath, 'utf-8');
+        const persisted = JSON.parse(raw);
+        expect(persisted.tokens.access_token).toBe(newToken);
+        expect(persisted.tokens.refresh_token).toBe('rt-updated');
+        expect(persisted.last_refresh).toBeDefined();
+    });
+    it('deduplicates concurrent refresh calls (mutex)', async () => {
+        const expiredToken = makeJwt({ exp: Math.floor(Date.now() / 1000) - 100 });
+        const newToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: expiredToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        let fetchCallCount = 0;
+        globalThis.fetch = vi.fn().mockImplementation(() => {
+            fetchCallCount++;
+            return Promise.resolve(new Response(JSON.stringify({ access_token: newToken }), { status: 200 }));
+        });
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        // Fire 3 concurrent getAccessToken calls
+        const [t1, t2, t3] = await Promise.all([
+            provider.getAccessToken(),
+            provider.getAccessToken(),
+            provider.getAccessToken(),
+        ]);
+        expect(t1).toBe(newToken);
+        expect(t2).toBe(newToken);
+        expect(t3).toBe(newToken);
+        // Only one actual refresh should have happened
+        expect(fetchCallCount).toBe(1);
+    });
+    it('returns cached token on second call without re-reading file', async () => {
+        const validToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: validToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        const token1 = await provider.getAccessToken();
+        // Delete the file — second call should still work from cache
+        await fs.unlink(filePath);
+        const token2 = await provider.getAccessToken();
+        expect(token1).toBe(validToken);
+        expect(token2).toBe(validToken);
+    });
+    it('propagates error when auth file does not exist', async () => {
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({
+            authFilePath: path.join(tmpDir, 'nope.json'),
+            log,
+        });
+        await expect(provider.getAccessToken()).rejects.toThrow();
+        expect(log.error).toHaveBeenCalled();
+    });
+    it('propagates error when refresh fails', async () => {
+        const expiredToken = makeJwt({ exp: Math.floor(Date.now() / 1000) - 100 });
+        const data = makeAuthData({
+            tokens: {
+                access_token: expiredToken,
+                refresh_token: 'rt-test',
+            },
+        });
+        const filePath = path.join(tmpDir, 'auth.json');
+        await fs.writeFile(filePath, JSON.stringify(data));
+        globalThis.fetch = vi.fn().mockResolvedValue(new Response('unauthorized', { status: 401 }));
+        const log = makeLogger();
+        const provider = createChatGptTokenProvider({ authFilePath: filePath, log });
+        await expect(provider.getAccessToken()).rejects.toThrow(/Token refresh failed/);
+    });
+});