opencode-anthropic-fix 0.2.1 → 0.3.0

package/lib/oauth.test.mjs

@@ -1,343 +0,0 @@
-import { beforeEach, afterEach, describe, expect, it, vi } from "vitest";
-import { exchange, parseOAuthCallback, refreshToken, revoke } from "./oauth.mjs";
-
-const mockFetch = vi.fn();
-
-describe("oauth headers", () => {
-  beforeEach(() => {
-    vi.resetAllMocks();
-    vi.stubGlobal("fetch", mockFetch);
-  });
-
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it("sends SDK native-fetch fingerprint by default on token exchange", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: false,
-      status: 400,
-      text: async () => "",
-    });
-
-    await exchange("code#state", "verifier");
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
-    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
-    expect("Accept" in init.headers).toBe(false);
-  });
-
-  it("sends SDK native-fetch fingerprint by default on token refresh", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
-    });
-
-    await refreshToken("refresh-token");
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
-    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
-    expect("Accept" in init.headers).toBe(false);
-  });
-
-  it("sends Claude Code user-agent on token revoke", async () => {
-    mockFetch.mockResolvedValueOnce({ ok: true });
-
-    await revoke("refresh-token");
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
-  });
-
-  it("flag OFF (default) keeps axios fingerprint on exchange", async () => {
-    mockFetch.mockResolvedValueOnce({ ok: false, status: 400, text: async () => "" });
-
-    await exchange("code#state", "verifier", { sdkTokenUserAgent: false });
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
-    expect(init.headers["Accept"]).toBe("application/json, text/plain, */*");
-    expect(init.headers["Content-Type"]).toBe("application/json");
-    expect(init.headers["anthropic-beta"]).toBeUndefined();
-  });
-
-  it("flag ON sends SDK native-fetch fingerprint on exchange", async () => {
-    mockFetch.mockResolvedValueOnce({ ok: false, status: 400, text: async () => "" });
-
-    await exchange("code#state", "verifier", { sdkTokenUserAgent: true });
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
-    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
-    expect(init.headers["Content-Type"]).toBe("application/json");
-    expect("Accept" in init.headers).toBe(false);
-  });
-
-  it("flag OFF (default) keeps axios fingerprint on refresh", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
-    });
-
-    await refreshToken("refresh-token", { sdkTokenUserAgent: false });
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
-    expect(init.headers["Accept"]).toBe("application/json, text/plain, */*");
-    expect(init.headers["Content-Type"]).toBe("application/json");
-    expect(init.headers["anthropic-beta"]).toBeUndefined();
-  });
-
-  it("flag ON sends SDK native-fetch fingerprint on refresh", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
-    });
-
-    await refreshToken("refresh-token", { sdkTokenUserAgent: true });
-
-    const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
-    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
-    expect(init.headers["Content-Type"]).toBe("application/json");
-    expect("Accept" in init.headers).toBe(false);
-  });
-
-  it("parses Anthropic nested error payloads on exchange failure", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: false,
-      status: 400,
-      headers: { get: () => null },
-      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad auth code." } }),
-    });
-
-    const result = await exchange("code#state", "verifier");
-    expect(result.type).toBe("failed");
-    expect(result.status).toBe(400);
-    expect(result.code).toBe("invalid_grant");
-    expect(result.reason).toBe("Bad auth code.");
-  });
-
-  it("retries token exchange on 429 before succeeding", async () => {
-    mockFetch
-      .mockResolvedValueOnce({
-        ok: false,
-        status: 429,
-        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
-        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
-      })
-      .mockResolvedValueOnce({
-        ok: true,
-        json: async () => ({
-          access_token: "access",
-          refresh_token: "refresh",
-          expires_in: 3600,
-          account: { email_address: "retry@example.com" },
-        }),
-      });
-
-    const result = await exchange("code#state", "verifier");
-    expect(result.type).toBe("success");
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("retries token refresh on 429 before succeeding", async () => {
-    mockFetch
-      .mockResolvedValueOnce({
-        ok: false,
-        status: 429,
-        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
-        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
-      })
-      .mockResolvedValueOnce({
-        ok: true,
-        json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
-      });
-
-    const result = await refreshToken("refresh-token");
-    expect(result.access_token).toBe("a");
-    expect(mockFetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("uses nested error type as refresh error code", async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: false,
-      status: 400,
-      headers: { get: () => null },
-      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad refresh token." } }),
-    });
-
-    await expect(refreshToken("refresh-token")).rejects.toMatchObject({
-      status: 400,
-      code: "invalid_grant",
-    });
-  });
-
-  it("returns cooldown hint on exchange 429 without Retry-After headers", async () => {
-    vi.useFakeTimers();
-    try {
-      mockFetch.mockResolvedValue({
-        ok: false,
-        status: 429,
-        headers: { get: () => null },
-        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
-      });
-
-      const promise = exchange("code#state", "verifier");
-      await vi.runAllTimersAsync();
-      const result = await promise;
-
-      expect(result).toMatchObject({
-        type: "failed",
-        status: 429,
-        code: "rate_limit_error",
-        retryAfterMs: 30_000,
-      });
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  it("throws 30s cooldown hint on refresh 429 without Retry-After headers", async () => {
-    vi.useFakeTimers();
-    try {
-      mockFetch.mockResolvedValue({
-        ok: false,
-        status: 429,
-        headers: { get: () => null },
-        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
-      });
-
-      const assertion = expect(refreshToken("refresh-token")).rejects.toMatchObject({
-        status: 429,
-        code: "rate_limit_error",
-        retryAfterMs: 30_000,
-      });
-      await vi.runAllTimersAsync();
-      await assertion;
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-});
-
-describe("parseOAuthCallback", () => {
-  it("returns empty code and null state for empty/falsy input", () => {
-    expect(parseOAuthCallback("")).toEqual({ code: "", state: null });
-    expect(parseOAuthCallback("   ")).toEqual({ code: "", state: null });
-    expect(parseOAuthCallback(null)).toEqual({ code: "", state: null });
-  });
-
-  it("handles plain authorization code (no state)", () => {
-    expect(parseOAuthCallback("myplaincode123")).toEqual({ code: "myplaincode123", state: null });
-  });
-
-  it("trims surrounding whitespace from plain code", () => {
-    expect(parseOAuthCallback("  abc123  ")).toEqual({ code: "abc123", state: null });
-  });
-
-  it("parses legacy code#state bare format", () => {
-    expect(parseOAuthCallback("authcode#statetoken")).toEqual({ code: "authcode", state: "statetoken" });
-  });
-
-  it("returns null state when # present but empty state segment", () => {
-    expect(parseOAuthCallback("authcode#")).toEqual({ code: "authcode", state: null });
-  });
-
-  it("parses full redirect URL with query params", () => {
-    expect(parseOAuthCallback("https://example.com/callback?code=MYCODE&state=MYSTATE")).toEqual({
-      code: "MYCODE",
-      state: "MYSTATE",
-    });
-  });
-
-  it("parses full redirect URL with only code param", () => {
-    expect(parseOAuthCallback("https://example.com/callback?code=ONLYCODE")).toEqual({
-      code: "ONLYCODE",
-      state: null,
-    });
-  });
-
-  it("parses query string with leading ?", () => {
-    expect(parseOAuthCallback("?code=QS_CODE&state=QS_STATE")).toEqual({
-      code: "QS_CODE",
-      state: "QS_STATE",
-    });
-  });
-
-  it("parses bare query string without leading ?", () => {
-    expect(parseOAuthCallback("code=BARE_CODE&state=BARE_STATE")).toEqual({
-      code: "BARE_CODE",
-      state: "BARE_STATE",
-    });
-  });
-
-  it("parses hash fragment URL (OAuth implicit / SPA flows)", () => {
-    expect(parseOAuthCallback("https://example.com/callback#code=HASH_CODE&state=HASH_STATE")).toEqual({
-      code: "HASH_CODE",
-      state: "HASH_STATE",
-    });
-  });
-
-  it("parses bare hash fragment string", () => {
-    expect(parseOAuthCallback("#code=HFRAG_CODE&state=HFRAG_STATE")).toEqual({
-      code: "HFRAG_CODE",
-      state: "HFRAG_STATE",
-    });
-  });
-
-  it("URL-decodes percent-encoded code and state values", () => {
-    expect(parseOAuthCallback("?code=hello%20world&state=foo%2Bbar")).toEqual({
-      code: "hello world",
-      state: "foo+bar",
-    });
-  });
-
-  it("returns empty string (not null) when state query param is present but empty", () => {
-    // state= is explicitly present with an empty value; URLSearchParams.get() returns ""
-    // for keys that exist with no value, so state is "" not null.
-    expect(parseOAuthCallback("?code=CODE&state=")).toEqual({ code: "CODE", state: "" });
-  });
-
-  it("exchange function uses parseOAuthCallback internally (code#state still works)", async () => {
-    const mockFetch = vi.fn().mockResolvedValueOnce({
-      ok: true,
-      status: 200,
-      headers: { get: () => null },
-      json: async () => ({ access_token: "test_token", token_type: "bearer" }),
-      text: async () => '{"access_token":"test_token","token_type":"bearer"}',
-    });
-    vi.stubGlobal("fetch", mockFetch);
-    try {
-      await exchange("CODE_VALUE#STATE_VALUE", "verifier123");
-      expect(mockFetch).toHaveBeenCalledTimes(1);
-      const bodyStr = mockFetch.mock.calls[0][1].body;
-      const body = JSON.parse(bodyStr);
-      expect(body.code).toBe("CODE_VALUE");
-      expect(body.state).toBe("STATE_VALUE");
-    } finally {
-      vi.unstubAllGlobals();
-    }
-  });
-
-  it("exchange omits state field in body when input is a plain code", async () => {
-    const mockFetch = vi.fn().mockResolvedValueOnce({
-      ok: false,
-      status: 400,
-      headers: { get: () => null },
-      text: async () => "",
-    });
-    vi.stubGlobal("fetch", mockFetch);
-    try {
-      await exchange("PLAINCODE", "verifier456");
-      const bodyStr = mockFetch.mock.calls[0][1].body;
-      const body = JSON.parse(bodyStr);
-      expect(body.code).toBe("PLAINCODE");
-      expect(Object.prototype.hasOwnProperty.call(body, "state")).toBe(false);
-    } finally {
-      vi.unstubAllGlobals();
-    }
-  });
-});

package/lib/redact.test.mjs

@@ -1,154 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { redactHeaders, redactSecrets, redactString } from "./redact.mjs";
-
-describe("redactSecrets", () => {
-  it("masks authorization without retaining token content", () => {
-    const token = "sk-ant-oat01-XXXX";
-    const input = { Authorization: `Bearer ${token}` };
-    const result = redactHeaders(input);
-
-    expect(result.Authorization).toMatch(/^Bearer \[redacted sha256:[0-9a-f]{12}\]$/);
-    expect(result.Authorization).not.toContain(token);
-    expect(input.Authorization).toBe(`Bearer ${token}`);
-  });
-
-  it("masks cookie and API key header values", () => {
-    const result = redactHeaders({ "set-cookie": "session=secret", "x-api-key": "key-secret" });
-
-    expect(result["set-cookie"]).toMatch(/^\[redacted sha256:[0-9a-f]{12}\]$/);
-    expect(result["x-api-key"]).toMatch(/^\[redacted sha256:[0-9a-f]{12}\]$/);
-    expect(result["set-cookie"]).not.toContain("session=secret");
-    expect(result["x-api-key"]).not.toContain("key-secret");
-  });
-
-  it("masks nested account credentials", () => {
-    const input = { account: { refreshToken: "refresh-secret", access: "access-secret" } };
-    const result = redactSecrets(input);
-
-    expect(result.account.refreshToken).toMatch(/^\[redacted sha256:[0-9a-f]{12}\]$/);
-    expect(result.account.access).toMatch(/^\[redacted sha256:[0-9a-f]{12}\]$/);
-    expect(result).not.toBe(input);
-    expect(result.account).not.toBe(input.account);
-  });
-
-  it("leaves mimicry fingerprint headers byte-identical", () => {
-    const input = {
-      "anthropic-beta": "oauth-2025-04-20,prompt-caching-2024-07-31",
-      "user-agent": "claude-cli/2.1.0 (external, cli)",
-      "x-stainless-arch": "x64",
-      "anthropic-version": "2023-06-01",
-    };
-
-    expect(redactHeaders(input)).toEqual(input);
-  });
-
-  it("leaves generic non-secret fields intact", () => {
-    const input = {
-      model: "claude-sonnet-4-5",
-      temperature: 0.7,
-      user: "alice",
-      messages: [{ role: "user", content: "hi" }],
-    };
-
-    expect(redactSecrets(input)).toEqual(input);
-  });
-
-  it("masks an email local part and preserves its domain", () => {
-    expect(redactSecrets({ email: "marco@example.com" })).toEqual({ email: "a***@example.com" });
-  });
-
-  it("is idempotent", () => {
-    const input = {
-      authorization: "Bearer secret-token",
-      account: { refresh_token: "refresh-secret", email: "marco@example.com" },
-    };
-    const once = redactSecrets(input);
-
-    expect(redactSecrets(once)).toEqual(once);
-  });
-
-  it("handles null, undefined, circular, and large objects without throwing", () => {
-    const circular = { token: "secret" };
-    circular.self = circular;
-    const large = Object.fromEntries(Array.from({ length: 10_000 }, (_, index) => [`key${index}`, `value${index}`]));
-    const redactedCircular = redactSecrets(circular);
-    const redactedLarge = redactSecrets(large);
-
-    expect(() => redactSecrets(null)).not.toThrow();
-    expect(() => redactSecrets(undefined)).not.toThrow();
-    expect(() => redactSecrets(circular)).not.toThrow();
-    expect(() => redactSecrets(large)).not.toThrow();
-    expect(redactedCircular.self).toBe(redactedCircular);
-    expect(Object.keys(redactedLarge)).toHaveLength(10_000);
-  });
-
-  it("grep-proof: no known secret survives redactSecrets over a realistic header+body fixture", () => {
-    const fakeSecrets = {
-      bearer: "sk-ant-FAKEAUTH123.def-456",
-      cookie: "session=FAKECOOKIE123",
-      apiKey: "FAKEAPIKEY123",
-      refreshToken: "FAKEREFRESH123",
-      access: "FAKEACCESS123",
-      code: "FAKECODE123",
-      email: "fake.user@example.test",
-      oauthToken: "oat01FAKEOAUTH12345",
-    };
-    const fixture = {
-      headers: {
-        authorization: `Bearer ${fakeSecrets.bearer}`,
-        cookie: fakeSecrets.cookie,
-        "x-api-key": fakeSecrets.apiKey,
-        "x-stainless-lang": "js",
-      },
-      body: {
-        account: {
-          refreshToken: fakeSecrets.refreshToken,
-          access: fakeSecrets.access,
-          code: fakeSecrets.code,
-          email: fakeSecrets.email,
-        },
-        callbackUrl: `https://auth.example.test/callback?token=${fakeSecrets.oauthToken}`,
-      },
-    };
-
-    const serialized = JSON.stringify(redactSecrets(fixture));
-
-    expect(serialized).not.toMatch(/Bearer\s+[A-Za-z0-9._-]{6,}/);
-    expect(serialized).not.toMatch(/sk-ant-[A-Za-z0-9]{6,}/);
-    expect(serialized).not.toMatch(/\boat01[A-Za-z0-9]{8,}/);
-    for (const secret of Object.values(fakeSecrets)) {
-      expect(serialized).not.toContain(secret);
-    }
-    expect(serialized).toContain('"x-stainless-lang":"js"');
-  });
-});
-
-describe("redactString", () => {
-  it("removes bearer token markers from body dumps", () => {
-    const result = redactString("prefix Bearer sk-ant-oat01-abc.def suffix");
-
-    expect(result).not.toContain("sk-ant");
-    expect(result).not.toContain("oat01");
-    expect(result).toMatch(/Bearer \[redacted sha256:[0-9a-f]{12}\]/);
-  });
-
-  it("redacts a bearer/sk-ant/oat01 token embedded mid-string in a URL", () => {
-    const bearerCredential = "abc.def-123";
-    const skAntToken = "sk-ant-abc123.def-456";
-    const oauthToken = "oat01ABCDEFGH12345";
-    const bearerResult = redactString(`https://api.example.com/cb?x=1#Authorization=Bearer%20${bearerCredential}`);
-    const skAntResult = redactString(`prefix ${skAntToken} suffix`);
-    const oauthResult = redactString(`https://auth.example.com/cb#token=...${oauthToken}...`);
-
-    for (const [result, rawToken] of [
-      [bearerResult, bearerCredential],
-      [skAntResult, skAntToken],
-      [oauthResult, oauthToken],
-    ]) {
-      expect(result).not.toContain(rawToken);
-      expect(result).toMatch(/\[redacted sha256:[0-9a-f]{12}\]/);
-    }
-    expect(bearerResult).toContain("https://api.example.com/cb?x=1#Authorization=Bearer%20");
-    expect(oauthResult).toContain("https://auth.example.com/cb#token=...");
-  });
-});

package/lib/refresh-lock.test.mjs

@@ -1,131 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { promises as fs } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-const itPosix = process.platform === "win32" ? it.skip : it;
-const baseDir = join(tmpdir(), `opencode-refresh-lock-test-${process.pid}`);
-const storagePath = join(baseDir, "anthropic-accounts.json");
-
-vi.mock("./storage.mjs", () => ({
-  getStoragePath: () => storagePath,
-}));
-
-import { acquireRefreshLock, releaseRefreshLock } from "./refresh-lock.mjs";
-
-describe("refresh-lock", () => {
-  beforeEach(async () => {
-    await fs.rm(baseDir, { recursive: true, force: true });
-    await fs.mkdir(baseDir, { recursive: true });
-  });
-
-  afterEach(async () => {
-    await fs.rm(baseDir, { recursive: true, force: true });
-  });
-
-  it("acquires the lock on the first attempt", async () => {
-    const lock = await acquireRefreshLock("acc-first-acquire");
-
-    expect(lock.acquired).toBe(true);
-    expect(lock.lockPath).toMatch(/[\\/]locks[\\/]refresh-[0-9a-f]{24}\.lock$/);
-    expect(lock.owner).toMatch(/^[0-9a-f]{24}$/);
-    expect(lock.lockInode).toEqual(expect.any(Number));
-
-    await releaseRefreshLock(lock);
-  });
-
-  it("allows exactly one concurrent caller to acquire the lock", async () => {
-    const attempts = await Promise.all([
-      acquireRefreshLock("acc-concurrent", { timeoutMs: 150, backoffMs: 5, staleMs: 60_000 }),
-      acquireRefreshLock("acc-concurrent", { timeoutMs: 150, backoffMs: 5, staleMs: 60_000 }),
-    ]);
-    const winners = attempts.filter((attempt) => attempt.acquired);
-    const losers = attempts.filter((attempt) => !attempt.acquired);
-
-    expect(winners).toHaveLength(1);
-    expect(losers).toEqual([{ acquired: false, lockPath: null, owner: null, lockInode: null }]);
-
-    await releaseRefreshLock(winners[0]);
-
-    const reacquired = await acquireRefreshLock("acc-concurrent", { timeoutMs: 50 });
-    expect(reacquired.acquired).toBe(true);
-    await releaseRefreshLock(reacquired);
-  });
-
-  it("rejects when opening the lock file fails with a non-contention error", async () => {
-    const error = Object.assign(new Error("permission denied"), { code: "EACCES" });
-    const openSpy = vi.spyOn(fs, "open").mockRejectedValueOnce(error);
-
-    try {
-      await expect(acquireRefreshLock("acc-io-failure")).rejects.toMatchObject({ code: "EACCES" });
-      expect(openSpy).toHaveBeenCalledWith(expect.stringMatching(/refresh-[0-9a-f]{24}\.lock$/), "wx", 0o600);
-    } finally {
-      openSpy.mockRestore();
-    }
-  });
-
-  itPosix("creates the lock file with owner-only POSIX permissions", async () => {
-    const lock = await acquireRefreshLock("acc-posix-permissions");
-
-    expect(lock.acquired).toBe(true);
-    const stat = await fs.stat(lock.lockPath);
-    expect(stat.mode & 0o777).toBe(0o600);
-
-    await releaseRefreshLock(lock);
-  });
-
-  it("does not release lock with mismatched owner", async () => {
-    const lock = await acquireRefreshLock("acc-1");
-    expect(lock.acquired).toBe(true);
-    expect(lock.lockPath).toBeTruthy();
-
-    await releaseRefreshLock({ lockPath: lock.lockPath, owner: "wrong-owner" });
-
-    await expect(fs.stat(lock.lockPath)).resolves.toBeTruthy();
-
-    await releaseRefreshLock(lock);
-    await expect(fs.stat(lock.lockPath)).rejects.toMatchObject({ code: "ENOENT" });
-  });
-
-  it("acquires a new lock after stale lock timeout", async () => {
-    const first = await acquireRefreshLock("acc-2", { timeoutMs: 50, staleMs: 10_000 });
-    expect(first.acquired).toBe(true);
-
-    const old = Date.now() / 1000 - 120;
-    await fs.utimes(first.lockPath, old, old);
-
-    const second = await acquireRefreshLock("acc-2", { timeoutMs: 200, backoffMs: 5, staleMs: 20 });
-    expect(second.acquired).toBe(true);
-    expect(second.owner).not.toBe(first.owner);
-
-    await releaseRefreshLock(second);
-  });
-
-  it("returns not acquired when lock remains busy", async () => {
-    const first = await acquireRefreshLock("acc-3", { timeoutMs: 50 });
-    expect(first.acquired).toBe(true);
-
-    const second = await acquireRefreshLock("acc-3", { timeoutMs: 30, backoffMs: 5, staleMs: 60_000 });
-    expect(second.acquired).toBe(false);
-
-    await releaseRefreshLock(first);
-  });
-
-  it("does not release when inode changed even if owner matches", async () => {
-    const first = await acquireRefreshLock("acc-4");
-    expect(first.acquired).toBe(true);
-
-    // Replace lock file with a new inode that reuses owner text.
-    await fs.unlink(first.lockPath);
-    await fs.writeFile(first.lockPath, JSON.stringify({ owner: first.owner, createdAt: Date.now() }), {
-      encoding: "utf-8",
-      mode: 0o600,
-    });
-
-    await releaseRefreshLock(first);
-
-    await expect(fs.stat(first.lockPath)).resolves.toBeTruthy();
-
-    await fs.unlink(first.lockPath);
-  });
-});