- Refresh failure now falls back to injecting a still-present stored access
token instead of hard-exiting 3, so a transient auth-server hiccup doesn't
regress a previously-working invocation (review #1). Only a failure with no
access token to fall back on surfaces as exit 3.
- Persist rotated tokens via the shared writeStoreFile (0o600 + mkdir -p)
instead of a raw writeFile, so the secrets file keeps owner-only perms
identical to the web backend (review #2).
- Missing clientInformation now throws the distinct no_client_information
envelope code rather than reusing no_stored_token (review #5a).
- Docs: --wait-for-auth no longer claims parity with --use-stored-auth (it
injects the freshly-landed token without refreshing); noted the
always-refresh rotation/concurrency caveat (review #3, #4).
- Tests: discovery-returns-undefined metadata path, no_client_information
code, and an e2e refresh-failure → access-token fallback.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw
59f3bd92a4