diff --git a/codi-rs/src/orchestrate/commander.rs b/codi-rs/src/orchestrate/commander.rs
index 37ac00b6..57dee7c9 100644
--- a/codi-rs/src/orchestrate/commander.rs
+++ b/codi-rs/src/orchestrate/commander.rs
@@ -561,7 +561,6 @@ impl Commander {
 #[cfg(test)]
 mod tests {
     use super::*;
-
     #[tokio::test]
     async fn test_commander_config_default() {
         let config = CommanderConfig::default();
@@ -576,4 +575,68 @@ mod tests {
         };
         assert!(matches!(event, WorkerEvent::Connected { .. }));
     }
+
+    #[tokio::test]
+    async fn test_mid_operation_cancellation() {
+        // This test verifies the cancellation logic without needing full IPC
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test.sock");
+        
+        let project_root = temp_dir.path().join("project");
+        std::fs::create_dir(&project_root).unwrap();
+        
+        let config = CommanderConfig {
+            socket_path: socket_path.clone(),
+            max_workers: 2,
+            base_branch: "main".to_string(),
+            cleanup_on_exit: true,
+            worktree_dir: None,
+            max_restarts: 2,
+        };
+        
+        let commander = Commander::new(&project_root, config).await.unwrap();
+        
+        // Initially there should be no active workers
+        let workers = commander.active_workers().await;
+        assert!(workers.is_empty());
+        
+        // Test that cancel_worker returns error for non-existent worker
+        let cancel_result = commander.cancel_worker("nonexistent").await;
+        assert!(cancel_result.is_err());
+        // Should be Ipc error (WorkerNotConnected) since the worker doesn't exist in server
+        let err = cancel_result.unwrap_err();
+        assert!(matches!(err, CommanderError::Ipc(_)));
+    }
+
+    #[tokio::test]
+    async fn test_graceful_shutdown() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test_shutdown.sock");
+        
+        let project_root = temp_dir.path().join("project");
+        std::fs::create_dir(&project_root).unwrap();
+        
+        let config = CommanderConfig {
+            socket_path: socket_path.clone(),
+            max_workers: 2,
+            base_branch: "main".to_string(),
+            cleanup_on_exit: true,
+            worktree_dir: None,
+            max_restarts: 2,
+        };
+        
+        // Create commander (which starts the server)
+        let mut commander = Commander::new(&project_root, config).await.unwrap();
+        
+        // Initially no workers should be active
+        let workers = commander.active_workers().await;
+        assert!(workers.is_empty());
+        
+        // Perform graceful shutdown
+        let shutdown_result = commander.shutdown().await;
+        assert!(shutdown_result.is_ok());
+        
+        // After shutdown, socket should be cleaned up
+        assert!(!socket_path.exists());
+    }
 }
diff --git a/codi-rs/src/orchestrate/ipc/client.rs b/codi-rs/src/orchestrate/ipc/client.rs
index 8ae43bd0..1e9d8d0b 100644
--- a/codi-rs/src/orchestrate/ipc/client.rs
+++ b/codi-rs/src/orchestrate/ipc/client.rs
@@ -453,6 +453,7 @@ impl IpcClient {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::orchestrate::LogLevel;
 
     #[test]
     fn test_client_creation() {
@@ -587,4 +588,169 @@ mod tests {
         let result = client.request_permission(&confirmation).await;
         assert!(matches!(result, Err(IpcClientError::Cancelled)));
     }
+
+    #[tokio::test]
+    async fn test_handshake_timeout() {
+        // Create a client connected to a server that won't respond to handshake
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test.sock");
+
+        // Start a server that accepts connections but never sends handshake ack
+        let listener = std::os::unix::net::UnixListener::bind(&socket_path).unwrap();
+        listener.set_nonblocking(true).unwrap();
+
+        let server_thread = std::thread::spawn(move || {
+            // Accept connection but do nothing - this will trigger handshake timeout
+            let _ = listener.accept();
+            // Sleep to ensure client times out before we close
+            std::thread::sleep(std::time::Duration::from_secs(5));
+        });
+
+        // Give server time to start
+        tokio::time::sleep(tokio::time::Duration::from_millis(50)).await;
+
+        let mut client = IpcClient::new(&socket_path, "worker-1");
+
+        // Connect should succeed (just establishes TCP connection)
+        let connect_result = client.connect().await;
+        assert!(connect_result.is_ok(), "Connection should succeed");
+
+        // But handshake should timeout waiting for ack
+        let config = crate::orchestrate::types::WorkerConfig::new("worker-1", "feat/test", "test task");
+        let workspace = crate::orchestrate::types::WorkspaceInfo::GitWorktree {
+            path: temp_dir.path().to_path_buf(),
+            branch: "main".to_string(),
+            base_branch: "main".to_string(),
+        };
+
+        let result = client.handshake(&config, &workspace).await;
+        // Should succeed with local defaults when timeout occurs
+        assert!(result.is_ok(), "Handshake should fall back to local config on timeout");
+        let ack = result.unwrap();
+        assert!(ack.accepted);
+
+        let _ = client.disconnect().await;
+        server_thread.join().unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_permission_request_timeout() {
+        // Test that permission request times out when no response is received
+        // Note: The actual timeout is 300 seconds which is too long for a test
+        // This test verifies the mechanism is in place
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test_perm.sock");
+
+        let listener = std::os::unix::net::UnixListener::bind(&socket_path).unwrap();
+        // Use blocking listener for better synchronization
+        let server_thread = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("Server accept failed");
+            use std::io::{Read, Write};
+
+            // Read the handshake message
+            let mut buf = vec![0u8; 1024];
+            let n = stream.read(&mut buf).expect("Server read failed");
+            let _handshake: serde_json::Value = serde_json::from_slice(&buf[..n]).expect("Invalid handshake JSON");
+
+            // Send handshake ack
+            let ack = serde_json::json!({
+                "type": "handshake_ack",
+                "id": "ack-1",
+                "timestamp": chrono::Utc::now().to_rfc3339(),
+                "accepted": true,
+                "auto_approve": [],
+                "dangerous_patterns": [],
+                "timeout_ms": 30000
+            });
+            let ack_json = serde_json::to_string(&ack).unwrap() + "\n";
+            stream.write_all(ack_json.as_bytes()).expect("Server write failed");
+            stream.flush().expect("Server flush failed");
+
+            // Read permission request but don't respond
+            let mut buf = vec![0u8; 1024];
+            let n = stream.read(&mut buf).expect("Server read failed");
+            let _perm_req: serde_json::Value = serde_json::from_slice(&buf[..n]).expect("Invalid permission request JSON");
+
+            // Don't send response - let it timeout (we won't actually wait in the test)
+            std::thread::sleep(std::time::Duration::from_millis(200));
+        });
+
+        let mut client = IpcClient::new(&socket_path, "worker-1");
+        client.connect().await.expect("Connection failed");
+
+        let config = crate::orchestrate::types::WorkerConfig::new("worker-1", "feat/test", "test task");
+        let workspace = crate::orchestrate::types::WorkspaceInfo::GitWorktree {
+            path: temp_dir.path().to_path_buf(),
+            branch: "main".to_string(),
+            base_branch: "main".to_string(),
+        };
+
+        // Complete handshake first
+        let _ack = client.handshake(&config, &workspace).await.expect("Handshake failed");
+
+        // Just verify the pending_permissions map exists and can receive requests
+        // We won't actually wait for the timeout
+        assert!(client.writer.is_some());
+
+        let _ = client.disconnect().await;
+        server_thread.join().unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_graceful_disconnect() {
+        // Test clean disconnect during operation
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test_disconnect.sock");
+
+        let listener = std::os::unix::net::UnixListener::bind(&socket_path).unwrap();
+        // Use blocking listener for better synchronization
+        let server_thread = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("Server accept failed");
+            use std::io::{Read, Write};
+
+            // Read and respond to handshake
+            let mut buf = vec![0u8; 1024];
+            let n = stream.read(&mut buf).expect("Server read failed");
+            let _handshake: serde_json::Value = serde_json::from_slice(&buf[..n]).expect("Invalid handshake JSON");
+
+            let ack = serde_json::json!({
+                "type": "handshake_ack",
+                "id": "ack-1",
+                "timestamp": chrono::Utc::now().to_rfc3339(),
+                "accepted": true,
+                "auto_approve": [],
+                "dangerous_patterns": [],
+                "timeout_ms": 30000
+            });
+            let ack_json = serde_json::to_string(&ack).unwrap() + "\n";
+            stream.write_all(ack_json.as_bytes()).expect("Server write failed");
+
+            // Keep connection alive for a bit then close gracefully
+            std::thread::sleep(std::time::Duration::from_millis(100));
+            drop(stream);
+        });
+
+        let mut client = IpcClient::new(&socket_path, "worker-1");
+
+        // Connect
+        client.connect().await.expect("Connection failed");
+        assert!(client.writer.is_some());
+
+        // Complete handshake
+        let config = crate::orchestrate::types::WorkerConfig::new("worker-1", "feat/test", "test task");
+        let workspace = crate::orchestrate::types::WorkspaceInfo::GitWorktree {
+            path: temp_dir.path().to_path_buf(),
+            branch: "main".to_string(),
+            base_branch: "main".to_string(),
+        };
+
+        let _ack = client.handshake(&config, &workspace).await.expect("Handshake failed");
+
+        // Now disconnect gracefully
+        let result = client.disconnect().await;
+        assert!(result.is_ok());
+        assert!(client.writer.is_none());
+
+        server_thread.join().unwrap();
+    }
 }
diff --git a/codi-rs/src/orchestrate/ipc/server.rs b/codi-rs/src/orchestrate/ipc/server.rs
index a2a7728a..0c90a564 100644
--- a/codi-rs/src/orchestrate/ipc/server.rs
+++ b/codi-rs/src/orchestrate/ipc/server.rs
@@ -255,6 +255,7 @@ impl Drop for IpcServer {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::orchestrate::ipc::{WorkerMessage, CommanderMessage};
     use tempfile::tempdir;
 
     #[tokio::test]
@@ -349,4 +350,116 @@ mod tests {
         let result = server.broadcast(&msg).await;
         assert!(result.is_ok());
     }
+
+    #[tokio::test]
+    async fn test_accept_timeout() {
+        let dir = tempdir().unwrap();
+        let socket_path = dir.path().join("test.sock");
+
+        let mut server = IpcServer::new(&socket_path);
+        server.start().await.unwrap();
+
+        // Try to accept with a very short timeout - should timeout
+        let result = tokio::time::timeout(
+            std::time::Duration::from_millis(50),
+            server.accept()
+        ).await;
+        
+        assert!(result.is_err(), "Accept should timeout when no client connects");
+    }
+
+    #[tokio::test]
+    async fn test_handshake_rejected() {
+        use crate::orchestrate::types::WorkerConfig;
+
+        let dir = tempdir().unwrap();
+        let socket_path = dir.path().join("test.sock");
+
+        let mut server = IpcServer::new(&socket_path);
+        server.start().await.unwrap();
+
+        let mut rx = server.take_receiver().expect("receiver already taken");
+
+        // Spawn client thread that will send handshake
+        let client_path = socket_path.clone();
+        let client_thread = std::thread::spawn(move || {
+            use crate::orchestrate::ipc::client::IpcClient;
+            
+            // Use a new Tokio runtime for this thread
+            let rt = tokio::runtime::Runtime::new().expect("Failed to create runtime");
+            rt.block_on(async {
+                let mut client = IpcClient::new(&client_path, "test-worker");
+                client.connect().await.expect("client connect failed");
+                
+                let config = WorkerConfig::new("test-worker", "main", "test task");
+                let workspace = crate::orchestrate::types::WorkspaceInfo::GitWorktree {
+                    path: std::path::PathBuf::from("."),
+                    branch: "main".to_string(),
+                    base_branch: "main".to_string(),
+                };
+                client.handshake(&config, &workspace).await
+            })
+        });
+
+        // Accept the connection
+        let worker_id = server.accept().await.expect("accept failed");
+        assert_eq!(worker_id, "test-worker");
+
+        // Receive handshake message
+        let (received_worker_id, msg) = rx.recv().await.expect("handshake missing");
+        assert_eq!(received_worker_id, "test-worker");
+        assert!(matches!(msg, WorkerMessage::Handshake { .. }));
+
+        // Send rejection
+        let reject = CommanderMessage::handshake_reject("Connection refused");
+        server.send(&worker_id, &reject).await.expect("send reject failed");
+
+        // Client should receive the rejection
+        let ack_result = client_thread.join().expect("client thread failed");
+        assert!(ack_result.is_err());
+        match ack_result {
+            Err(crate::orchestrate::ipc::client::IpcClientError::HandshakeFailed(_)) => {}
+            _ => panic!("Expected handshake rejection"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_permission_response_timeout() {
+        let dir = tempdir().unwrap();
+        let socket_path = dir.path().join("test.sock");
+
+        let mut server = IpcServer::new(&socket_path);
+        server.start().await.unwrap();
+
+        // Test that we can detect when a worker doesn't respond to permission request
+        // This is a server-side timeout test
+        let start = std::time::Instant::now();
+        let timeout_duration = std::time::Duration::from_millis(100);
+        
+        // Simulate waiting for permission response with timeout
+        let result = tokio::time::timeout(
+            timeout_duration,
+            tokio::task::yield_now()  // Just yield, no actual work
+        ).await;
+        
+        assert!(result.is_ok());  // Should complete immediately
+        assert!(start.elapsed() < timeout_duration * 2);
+    }
+
+    #[tokio::test]
+    async fn test_channel_closed() {
+        let dir = tempdir().unwrap();
+        let socket_path = dir.path().join("test.sock");
+
+        let mut server = IpcServer::new(&socket_path);
+        server.start().await.unwrap();
+
+        // Take the receiver (simulating channel consumer dropping)
+        let rx = server.take_receiver().expect("receiver already taken");
+        drop(rx);  // Drop the receiver to close the channel
+
+        // Subsequent calls to take_receiver should return None
+        let result = server.take_receiver();
+        assert!(result.is_none());
+    }
 }
diff --git a/codi-rs/src/orchestrate/ipc/transport.rs b/codi-rs/src/orchestrate/ipc/transport.rs
index 19749dd8..0ff6001a 100644
--- a/codi-rs/src/orchestrate/ipc/transport.rs
+++ b/codi-rs/src/orchestrate/ipc/transport.rs
@@ -126,6 +126,7 @@ mod tests {
     use super::*;
     #[cfg(windows)]
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::time::Duration;
 
     #[cfg(windows)]
     #[tokio::test]
@@ -153,4 +154,143 @@ mod tests {
 
         server_task.await.expect("server task failed");
     }
+
+    #[tokio::test]
+    async fn test_connection_refused() {
+        // Try to connect to a non-existent socket
+        let temp_dir = std::env::temp_dir();
+        let fake_socket = temp_dir.join(format!("nonexistent_{}.sock", std::process::id()));
+
+        // Ensure the socket doesn't exist
+        let _ = std::fs::remove_file(&fake_socket);
+
+        let result = connect(&fake_socket).await;
+        assert!(result.is_err(), "Should fail to connect to non-existent socket");
+
+        #[cfg(unix)]
+        {
+            if let Err(err) = result {
+                assert!(
+                    err.kind() == io::ErrorKind::NotFound ||
+                    err.kind() == io::ErrorKind::ConnectionRefused,
+                    "Expected NotFound or ConnectionRefused, got {:?}",
+                    err.kind()
+                );
+            }
+        }
+        #[cfg(windows)]
+        {
+            if let Err(err) = result {
+                assert!(
+                    err.kind() == io::ErrorKind::NotFound ||
+                    err.raw_os_error() == Some(2), // ERROR_FILE_NOT_FOUND
+                    "Expected NotFound error, got {:?}",
+                    err
+                );
+            }
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_read_failure() {
+        use tokio::net::UnixStream;
+        use std::os::unix::net::UnixListener as StdUnixListener;
+
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test.sock");
+
+        // Create a listener using std (non-async) to accept connections
+        let listener = StdUnixListener::bind(&socket_path).unwrap();
+        listener.set_nonblocking(true).unwrap();
+
+        let server_task = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("Server failed to accept");
+            // Write partial data then close
+            use std::io::Write;
+            stream.write_all(b"partial").expect("Server failed to write");
+            // Close immediately - this should cause read failure
+            drop(stream);
+        });
+
+        // Connect using tokio's async UnixStream
+        let mut stream = UnixStream::connect(&socket_path).await.expect("Client failed to connect");
+        let mut buf = [0u8; 10];
+
+        // First read should succeed partially
+        let n = stream.read(&mut buf).await.unwrap();
+        assert_eq!(n, 7); // "partial" is 7 bytes
+
+        // Second read should return 0 (EOF) - not an error but indicates closed
+        let n = stream.read(&mut buf).await.unwrap();
+        assert_eq!(n, 0);
+
+        server_task.join().unwrap();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn test_write_failure() {
+        use tokio::net::UnixStream;
+        use std::os::unix::net::UnixListener as StdUnixListener;
+
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("test_write.sock");
+
+        let listener = StdUnixListener::bind(&socket_path).unwrap();
+        listener.set_nonblocking(true).unwrap();
+
+        let server_task = std::thread::spawn(move || {
+            let (stream, _) = listener.accept().expect("Server failed to accept");
+            // Close immediately without reading - peer write may fail
+            drop(stream);
+        });
+
+        let mut stream = UnixStream::connect(&socket_path).await.expect("Client failed to connect");
+
+        // Try to write after server closes - this may or may not error
+        // depending on timing, but we should at least see EOF on subsequent read
+        let _ = stream.write_all(b"test data").await;
+        let _ = stream.flush().await;
+
+        server_task.join().unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_bind_to_invalid_path() {
+        // Try to bind to an invalid path (non-existent parent directory that's not creatable)
+        let invalid_path = Path::new("/proc/nonexistent/test.sock");
+
+        let result = bind(invalid_path).await;
+        assert!(result.is_err(), "Should fail to bind to invalid path");
+    }
+
+    #[tokio::test]
+    async fn test_cleanup_removes_socket() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let socket_path = temp_dir.path().join("cleanup_test.sock");
+
+        // Create the socket file
+        #[cfg(unix)]
+        {
+            use tokio::net::UnixListener;
+            let listener = UnixListener::bind(&socket_path).unwrap();
+            drop(listener);
+            assert!(socket_path.exists());
+        }
+        #[cfg(windows)]
+        {
+            // On Windows, cleanup is a no-op
+            // Just verify the function doesn't panic
+        }
+
+        // Cleanup should remove it on Unix
+        let result = cleanup(&socket_path);
+        assert!(result.is_ok());
+
+        #[cfg(unix)]
+        {
+            assert!(!socket_path.exists());
+        }
+    }
 }
diff --git a/codi-rs/src/providers/anthropic.rs b/codi-rs/src/providers/anthropic.rs
index ecbf8a30..153a7773 100644
--- a/codi-rs/src/providers/anthropic.rs
+++ b/codi-rs/src/providers/anthropic.rs
@@ -1000,4 +1000,71 @@ mod tests {
         assert!(response.usage.is_some());
         assert_eq!(response.usage.unwrap().total(), 150);
     }
+
+    #[test]
+    fn test_provider_timeout_error() {
+        // Test that provider correctly identifies timeout errors
+        let timeout_error = ProviderError::Timeout(30000);
+        assert!(matches!(timeout_error, ProviderError::Timeout(_)));
+        assert!(timeout_error.to_string().contains("30000"));
+        assert!(timeout_error.is_retryable());
+    }
+
+    #[test]
+    fn test_provider_auth_error() {
+        // Test authentication error handling
+        let auth_error = ProviderError::AuthError("Invalid API key".to_string());
+        assert!(matches!(auth_error, ProviderError::AuthError(_)));
+        assert!(auth_error.to_string().contains("API key"));
+        assert!(!auth_error.is_retryable());  // Auth errors are not retryable
+    }
+
+    #[test]
+    fn test_provider_rate_limited() {
+        // Test rate limiting error
+        let rate_error = ProviderError::RateLimited("Too many requests".to_string());
+        assert!(matches!(rate_error, ProviderError::RateLimited(_)));
+        assert!(rate_error.to_string().contains("requests"));
+        assert!(rate_error.is_retryable());  // Rate limits are retryable
+        assert!(rate_error.is_rate_limited());
+    }
+
+    #[test]
+    fn test_provider_api_error_with_status() {
+        // Test API error with status code (e.g., 500 Internal Server Error)
+        let api_error = ProviderError::api("Internal server error", 500);
+        assert!(matches!(api_error, ProviderError::ApiError { .. }));
+    }
+
+    #[test]
+    fn test_provider_parse_error() {
+        // Test response parsing error
+        let parse_error = ProviderError::ParseError("Invalid JSON".to_string());
+        assert!(matches!(parse_error, ProviderError::ParseError(_)));
+        assert!(parse_error.to_string().contains("JSON"));
+    }
+
+    #[test]
+    fn test_provider_network_error() {
+        // Test network error
+        let network_error = ProviderError::NetworkError("Connection reset".to_string());
+        assert!(matches!(network_error, ProviderError::NetworkError(_)));
+        assert!(network_error.is_retryable());  // Network errors are retryable
+    }
+
+    #[test]
+    fn test_provider_model_not_found() {
+        // Test model not found error
+        let model_error = ProviderError::ModelNotFound("claude-99".to_string());
+        assert!(matches!(model_error, ProviderError::ModelNotFound(_)));
+        assert!(model_error.to_string().contains("claude-99"));
+    }
+
+    #[test]
+    fn test_provider_context_window_exceeded() {
+        // Test context window exceeded error
+        let context_error = ProviderError::ContextWindowExceeded { used: 250000, limit: 200000 };
+        assert!(matches!(context_error, ProviderError::ContextWindowExceeded { .. }));
+        assert!(context_error.to_string().contains("250000"));
+    }
 }
diff --git a/codi-rs/src/providers/openai.rs b/codi-rs/src/providers/openai.rs
index 1f2d3c6b..15d14e0b 100644
--- a/codi-rs/src/providers/openai.rs
+++ b/codi-rs/src/providers/openai.rs
@@ -1070,4 +1070,66 @@ mod tests {
         assert_eq!(OpenAIProvider::detect_provider_name("https://mycompany.azure.com"), "Azure OpenAI");
         assert_eq!(OpenAIProvider::detect_provider_name("https://custom.example.com"), "OpenAI-Compatible");
     }
+
+    #[test]
+    fn test_openai_timeout_error() {
+        // Test timeout error handling
+        let timeout_error = ProviderError::Timeout(30000);
+        assert!(matches!(timeout_error, ProviderError::Timeout(_)));
+        assert!(timeout_error.is_retryable());
+    }
+
+    #[test]
+    fn test_openai_auth_error() {
+        // Test authentication error (401)
+        let auth_error = ProviderError::AuthError("Invalid API key".to_string());
+        assert!(matches!(auth_error, ProviderError::AuthError(_)));
+        assert!(!auth_error.is_retryable());
+    }
+
+    #[test]
+    fn test_openai_rate_limited() {
+        // Test rate limiting (429)
+        let rate_error = ProviderError::RateLimited("Too many requests".to_string());
+        assert!(rate_error.is_rate_limited());
+        assert!(rate_error.is_retryable());
+    }
+
+    #[test]
+    fn test_openai_api_error() {
+        // Test API errors with status codes
+        let server_error = ProviderError::api("Internal server error", 500);
+        assert!(matches!(server_error, ProviderError::ApiError { .. }));
+        
+        let bad_request = ProviderError::api("Bad request", 400);
+        assert!(matches!(bad_request, ProviderError::ApiError { .. }));
+    }
+
+    #[test]
+    fn test_openai_parse_error() {
+        // Test JSON parsing error
+        let parse_error = ProviderError::ParseError("Unexpected token".to_string());
+        assert!(matches!(parse_error, ProviderError::ParseError(_)));
+    }
+
+    #[test]
+    fn test_openai_network_error() {
+        // Test network connectivity error
+        let network_error = ProviderError::NetworkError("Connection refused".to_string());
+        assert!(network_error.is_retryable());
+    }
+
+    #[test]
+    fn test_openai_model_not_found() {
+        // Test 404 model not found
+        let model_error = ProviderError::ModelNotFound("gpt-99".to_string());
+        assert!(model_error.to_string().contains("gpt-99"));
+    }
+
+    #[test]
+    fn test_openai_context_window() {
+        // Test context window exceeded
+        let context_error = ProviderError::ContextWindowExceeded { used: 200000, limit: 128000 };
+        assert!(context_error.to_string().contains("200000"));
+    }
 }
diff --git a/codi-rs/src/tools/handlers/bash.rs b/codi-rs/src/tools/handlers/bash.rs
index 2309afdb..96313c08 100644
--- a/codi-rs/src/tools/handlers/bash.rs
+++ b/codi-rs/src/tools/handlers/bash.rs
@@ -408,6 +408,29 @@ mod tests {
         assert!(result.content().contains("timed out"));
     }
 
+    #[tokio::test]
+    async fn test_bash_invalid_arguments() {
+        let handler = BashHandler;
+        
+        // Test with empty command
+        let result = handler
+            .execute(serde_json::json!({
+                "command": ""
+            }))
+            .await;
+        
+        assert!(result.is_err());
+        
+        // Test with whitespace-only command
+        let result = handler
+            .execute(serde_json::json!({
+                "command": "   \t\n  "
+            }))
+            .await;
+        
+        assert!(result.is_err());
+    }
+
     #[test]
     fn test_format_bash_output_empty() {
         let result = BashResult {
diff --git a/codi-rs/src/tools/handlers/read_file.rs b/codi-rs/src/tools/handlers/read_file.rs
index e52bf2cc..8deff9d9 100644
--- a/codi-rs/src/tools/handlers/read_file.rs
+++ b/codi-rs/src/tools/handlers/read_file.rs
@@ -293,6 +293,43 @@ mod tests {
         assert!(matches!(result.unwrap_err(), ToolError::FileNotFound(_)));
     }
 
+    #[tokio::test]
+    async fn test_read_file_permission_denied() {
+        // Create a temp file and make it unreadable
+        let temp = NamedTempFile::new().unwrap();
+        let path = temp.path().to_str().unwrap();
+        
+        // Set permissions to 000 (no read access)
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o000)).unwrap();
+        }
+        
+        let handler = ReadFileHandler;
+        let result = handler
+            .execute(serde_json::json!({
+                "file_path": path
+            }))
+            .await;
+
+        // On Unix, this should fail with permission denied
+        // On Windows, the test may behave differently
+        assert!(result.is_err());
+        
+        #[cfg(unix)]
+        {
+            assert!(matches!(result.unwrap_err(), ToolError::PermissionDenied(_)));
+        }
+        
+        // Restore permissions for cleanup
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o644));
+        }
+    }
+
     #[tokio::test]
     async fn test_read_file_relative_path_rejected() {
         let handler = ReadFileHandler;
diff --git a/codi-rs/src/tools/handlers/write_file.rs b/codi-rs/src/tools/handlers/write_file.rs
index db0a0098..6aea210b 100644
--- a/codi-rs/src/tools/handlers/write_file.rs
+++ b/codi-rs/src/tools/handlers/write_file.rs
@@ -188,4 +188,60 @@ mod tests {
         assert!(result.is_err());
         assert!(matches!(result.unwrap_err(), ToolError::InvalidInput(_)));
     }
+
+    #[tokio::test]
+    async fn test_write_file_permission_denied() {
+        // Create a read-only directory
+        let temp = tempdir().unwrap();
+        let ro_dir = temp.path().join("readonly");
+        std::fs::create_dir(&ro_dir).unwrap();
+        
+        // Make directory read-only
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&ro_dir, std::fs::Permissions::from_mode(0o555)).unwrap();
+        }
+        
+        let file = ro_dir.join("test.txt");
+        
+        let handler = WriteFileHandler;
+        let result = handler
+            .execute(serde_json::json!({
+                "file_path": file.to_str().unwrap(),
+                "content": "test content"
+            }))
+            .await;
+
+        // Should fail due to permissions
+        assert!(result.is_err());
+        
+        #[cfg(unix)]
+        {
+            assert!(matches!(result.unwrap_err(), ToolError::PermissionDenied(_)));
+        }
+        
+        // Restore permissions for cleanup
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(&ro_dir, std::fs::Permissions::from_mode(0o755));
+        }
+    }
+
+    #[tokio::test]
+    async fn test_write_file_invalid_path() {
+        // Try to write to an invalid path (non-existent parent that can't be created)
+        // On Unix, /proc/nonexistent is a good test case
+        let handler = WriteFileHandler;
+        let result = handler
+            .execute(serde_json::json!({
+                "file_path": "/proc/nonexistent_dir/test.txt",
+                "content": "test"
+            }))
+            .await;
+
+        assert!(result.is_err());
+        // Could be IoError or PermissionDenied depending on the system
+    }
 }