fix(coding): preserve runtime model and failure contracts

tests/unit/coding-provider-auth.test.ts

@@ -0,0 +1,63 @@
+// @vitest-environment node
+
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  getAccount: vi.fn(),
+  updateAccount: vi.fn(),
+  resolveCredential: vi.fn(),
+  getFreshCredential: vi.fn(),
+  markExpired: vi.fn(),
+}));
+
+vi.mock('../../electron/services/providers/provider-service', () => ({
+  getProviderService: () => ({
+    getAccount: mocks.getAccount,
+    updateAccount: mocks.updateAccount,
+  }),
+}));
+
+vi.mock('../../electron/coding-runtime/pi/provider-config', () => ({
+  resolvePiProviderCredentialFromSecretStore: mocks.resolveCredential,
+}));
+
+vi.mock('../../electron/services/works-square-ai-gateway', () => ({
+  getFreshWorksSquareAIGatewayCredential: mocks.getFreshCredential,
+  markWorksSquareAIGatewayCredentialExpired: mocks.markExpired,
+}));
+
+import {
+  CodingProviderCredentialRefreshError,
+  isCodingProviderAuthenticationError,
+  refreshCodingProviderCredential,
+} from '../../electron/api/coding-provider-auth';
+
+describe('coding Provider credential refresh boundary', () => {
+  beforeEach(() => {
+    for (const mock of Object.values(mocks)) mock.mockReset();
+  });
+
+  it('types a rejected production refresh callback as an authentication failure', async () => {
+    mocks.getAccount.mockRejectedValueOnce(new Error('secure store unavailable'));
+
+    const failure = await refreshCodingProviderCredential('account-a').catch((error) => error);
+    expect(failure).toBeInstanceOf(CodingProviderCredentialRefreshError);
+    expect(isCodingProviderAuthenticationError(failure)).toBe(true);
+  });
+
+  it('types a missing refreshed Works credential as an authentication failure', async () => {
+    mocks.getAccount.mockResolvedValueOnce({
+      id: 'account-works',
+      enabled: true,
+      authMode: 'api_key',
+      metadata: { worksSquareCredentialMode: 'works_square_ai_gateway' },
+    });
+    mocks.getFreshCredential.mockResolvedValueOnce(null);
+
+    const failure = await refreshCodingProviderCredential('account-works').catch((error) => error);
+    expect(mocks.markExpired).toHaveBeenCalledTimes(1);
+    expect(failure).toBeInstanceOf(CodingProviderCredentialRefreshError);
+    expect(isCodingProviderAuthenticationError(failure)).toBe(true);
+    expect(mocks.updateAccount).not.toHaveBeenCalled();
+  });
+});