diff --git a/src/agents/auth-profiles/oauth-refresh-queue.test.ts b/src/agents/auth-profiles/oauth-refresh-queue.test.ts
index 1d6eccf4ef7..f980b71d489 100644
--- a/src/agents/auth-profiles/oauth-refresh-queue.test.ts
+++ b/src/agents/auth-profiles/oauth-refresh-queue.test.ts
@@ -71,12 +71,17 @@ vi.mock("./external-auth.js", () => ({
   shouldPersistExternalAuthProfile: () => true,
 }));
 
-vi.mock("./external-cli-sync.js", () => ({
-  resolveExternalCliAuthProfiles: () => [],
-  syncExternalCliCredentials: () => false,
-  readManagedExternalCliCredential: () => null,
-  areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
-}));
+vi.mock("./external-cli-sync.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("./external-cli-sync.js")>("./external-cli-sync.js");
+  return {
+    ...actual,
+    syncExternalCliCredentials: () => false,
+    readManagedExternalCliCredential: () => null,
+    resolveExternalCliAuthProfiles: () => [],
+    areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
+  };
+});
 
 function createExpiredOauthStore(params: {
   profileId: string;
diff --git a/src/agents/auth-profiles/oauth.adopt-identity.test.ts b/src/agents/auth-profiles/oauth.adopt-identity.test.ts
index 57f283797e5..34f41a4ed8c 100644
--- a/src/agents/auth-profiles/oauth.adopt-identity.test.ts
+++ b/src/agents/auth-profiles/oauth.adopt-identity.test.ts
@@ -78,12 +78,17 @@ vi.mock("./doctor.js", () => ({
   formatAuthDoctorHint: async () => undefined,
 }));
 
-vi.mock("./external-cli-sync.js", () => ({
-  resolveExternalCliAuthProfiles: () => [],
-  syncExternalCliCredentials: () => false,
-  readManagedExternalCliCredential: () => null,
-  areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
-}));
+vi.mock("./external-cli-sync.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("./external-cli-sync.js")>("./external-cli-sync.js");
+  return {
+    ...actual,
+    syncExternalCliCredentials: () => false,
+    readManagedExternalCliCredential: () => null,
+    resolveExternalCliAuthProfiles: () => [],
+    areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
+  };
+});
 
 function oauthCred(params: {
   provider: string;
diff --git a/src/agents/auth-profiles/oauth.concurrent-agents.test.ts b/src/agents/auth-profiles/oauth.concurrent-agents.test.ts
index f074fb18b90..120827d1618 100644
--- a/src/agents/auth-profiles/oauth.concurrent-agents.test.ts
+++ b/src/agents/auth-profiles/oauth.concurrent-agents.test.ts
@@ -64,12 +64,17 @@ vi.mock("./doctor.js", () => ({
 // External-CLI sync does real I/O against the user's Codex/MiniMax CLI
 // credential files; it is slow and can pollute test state. Stub it to a no-op
 // so the suite only exercises in-repo auth-profile logic.
-vi.mock("./external-cli-sync.js", () => ({
-  resolveExternalCliAuthProfiles: () => [],
-  syncExternalCliCredentials: () => false,
-  readManagedExternalCliCredential: () => null,
-  areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
-}));
+vi.mock("./external-cli-sync.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("./external-cli-sync.js")>("./external-cli-sync.js");
+  return {
+    ...actual,
+    syncExternalCliCredentials: () => false,
+    readManagedExternalCliCredential: () => null,
+    resolveExternalCliAuthProfiles: () => [],
+    areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
+  };
+});
 
 function createExpiredOauthStore(params: {
   profileId: string;
diff --git a/src/agents/auth-profiles/oauth.mirror-refresh.test.ts b/src/agents/auth-profiles/oauth.mirror-refresh.test.ts
index 105455e3f16..33b8eeff32e 100644
--- a/src/agents/auth-profiles/oauth.mirror-refresh.test.ts
+++ b/src/agents/auth-profiles/oauth.mirror-refresh.test.ts
@@ -75,12 +75,17 @@ vi.mock("./doctor.js", () => ({
   formatAuthDoctorHint: async () => undefined,
 }));
 
-vi.mock("./external-cli-sync.js", () => ({
-  resolveExternalCliAuthProfiles: () => [],
-  syncExternalCliCredentials: () => false,
-  readManagedExternalCliCredential: () => null,
-  areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
-}));
+vi.mock("./external-cli-sync.js", async () => {
+  const actual =
+    await vi.importActual<typeof import("./external-cli-sync.js")>("./external-cli-sync.js");
+  return {
+    ...actual,
+    syncExternalCliCredentials: () => false,
+    readManagedExternalCliCredential: () => null,
+    resolveExternalCliAuthProfiles: () => [],
+    areOAuthCredentialsEquivalent: (a: unknown, b: unknown) => a === b,
+  };
+});
 
 function createExpiredOauthStore(params: {
   profileId: string;
diff --git a/src/agents/pi-auth-json.test.ts b/src/agents/pi-auth-json.test.ts
index 27c9c75a276..212756aaee4 100644
--- a/src/agents/pi-auth-json.test.ts
+++ b/src/agents/pi-auth-json.test.ts
@@ -9,10 +9,16 @@ vi.mock("../plugins/provider-runtime.js", () => ({
   resolveExternalAuthProfilesWithPlugins: () => [],
 }));
 
-vi.mock("./auth-profiles/external-cli-sync.js", () => ({
-  resolveExternalCliAuthProfiles: () => [],
-  readManagedExternalCliCredential: () => null,
-}));
+vi.mock("./auth-profiles/external-cli-sync.js", async () => {
+  const actual = await vi.importActual<typeof import("./auth-profiles/external-cli-sync.js")>(
+    "./auth-profiles/external-cli-sync.js",
+  );
+  return {
+    ...actual,
+    readManagedExternalCliCredential: () => null,
+    resolveExternalCliAuthProfiles: () => [],
+  };
+});
 
 type AuthProfileStore = Parameters<typeof saveAuthProfileStore>[0];
 
diff --git a/src/commands/channels.add.test.ts b/src/commands/channels.add.test.ts
index d618c5c3d69..faa054839a8 100644
--- a/src/commands/channels.add.test.ts
+++ b/src/commands/channels.add.test.ts
@@ -38,9 +38,15 @@ vi.mock("./channel-setup/discovery.js", () => ({
   isCatalogChannelInstalled: discoveryMocks.isCatalogChannelInstalled,
 }));
 
-vi.mock("../channels/plugins/bundled.js", () => ({
-  getBundledChannelPlugin: vi.fn(() => undefined),
-}));
+vi.mock("../channels/plugins/bundled.js", async () => {
+  const actual = await vi.importActual<typeof import("../channels/plugins/bundled.js")>(
+    "../channels/plugins/bundled.js",
+  );
+  return {
+    ...actual,
+    getBundledChannelPlugin: vi.fn(() => undefined),
+  };
+});
 
 vi.mock("./channel-setup/plugin-install.js", () => pluginInstallMocks);
 
diff --git a/src/commands/doctor-state-migrations.test.ts b/src/commands/doctor-state-migrations.test.ts
index cd88c7a0429..9588fc49113 100644
--- a/src/commands/doctor-state-migrations.test.ts
+++ b/src/commands/doctor-state-migrations.test.ts
@@ -14,7 +14,10 @@ import {
 
 let tempRoots: string[] = [];
 
-vi.mock("../channels/plugins/bundled.js", () => {
+vi.mock("../channels/plugins/bundled.js", async () => {
+  const actual = await vi.importActual<typeof import("../channels/plugins/bundled.js")>(
+    "../channels/plugins/bundled.js",
+  );
   function fileExists(filePath: string): boolean {
     try {
       return fs.existsSync(filePath) && fs.statSync(filePath).isFile();
@@ -88,6 +91,7 @@ vi.mock("../channels/plugins/bundled.js", () => {
   }
 
   return {
+    ...actual,
     listBundledChannelLegacySessionSurfaces: vi.fn(() => [
       {
         isLegacyGroupSessionKey: (key: string) => /^group:.+@g\.us$/i.test(key.trim()),