diff --git a/internal/auth/refresh.go b/internal/auth/refresh.go
index bd8e0f1..9ce869d 100644
--- a/internal/auth/refresh.go
+++ b/internal/auth/refresh.go
@@ -10,6 +10,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path/filepath"
 	"sync"
 	"time"
 
@@ -105,13 +106,21 @@ func persistCredential(cred *Credential) error {
 		return nil
 	}
 
+	var doc map[string]any
 	raw, err := os.ReadFile(filePath)
 	if err != nil {
-		return err
-	}
-	var doc map[string]any
-	if err := json.Unmarshal(raw, &doc); err != nil {
-		return err
+		if !os.IsNotExist(err) {
+			return err
+		}
+		// File doesn't exist yet (cold start) — create from scratch
+		if mkdirErr := os.MkdirAll(filepath.Dir(filePath), 0700); mkdirErr != nil {
+			return fmt.Errorf("create credential dir: %w", mkdirErr)
+		}
+		doc = make(map[string]any)
+	} else {
+		if err := json.Unmarshal(raw, &doc); err != nil {
+			return err
+		}
 	}
 	oauth, _ := doc["claudeAiOauth"].(map[string]any)
 	if oauth == nil {