@skaile/workspaces 0.32.0 → 0.34.0

package/dist/{chunk-GXHJDQ37.js → chunk-WQRDLR3K.js}

@@ -1,11 +1,11 @@
 import { renderGoogleDriveConfig, renderOneDriveConfig, renderWebDAVConfig } from './chunk-OVRSNIKJ.js';
-import { resolveAuthRef, resolveAuth, resolveMountCredentialString } from './chunk-2RQ3KLY3.js';
-import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-74UKG2LA.js';
+import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-UQ5JY2GQ.js';
+import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-XT6AZWK3.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeFlowStateFromSnapshots } from './chunk-X46FY45B.js';
 import { renderStimulusPrompt } from './chunk-DEYYRFQU.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { portableSpawn } from './chunk-7WHBI3I6.js';
+import { portableSpawn } from './chunk-DVIIYYD5.js';
 import { createLogger } from './chunk-JB35MVBN.js';
 import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, cpSync, statSync, createReadStream, readdirSync, openSync, writeSync, closeSync, chmodSync } from 'fs';
 import path, { join, dirname, resolve, sep } from 'path';
@@ -3459,7 +3459,7 @@ var SharePointConnector = class extends AbstractConnector {
       });
       await ensureFleetMounted(targetDir, this.log);
       const fleetState = {
-        rcloneHandle: null,
+        handleRef: { current: null },
         fleetManaged: true
       };
       return this.makeHandle(declaration, fleetState, targetDir);
@@ -3475,10 +3475,8 @@ var SharePointConnector = class extends AbstractConnector {
       );
     }
     const basePath = String(opts?.basePath ?? "").replace(/^\/+|\/+$/g, "");
-    const auth = parseAuthBlob2(
-      await resolveMountCredentialString(declaration, secrets, tokenMediator),
-      this.log
-    );
+    const cred = await resolveMountCredential(declaration, secrets, tokenMediator, "initial");
+    const auth = parseAuthBlob2(cred.token, this.log);
     if (!auth.accessToken) {
       throw new Error(
         "SharePoint connector: no access token resolved. Use 'auth: backend' (platform) or 'auth: env:SHAREPOINT_TOKEN' (standalone)."
@@ -3497,16 +3495,29 @@ var SharePointConnector = class extends AbstractConnector {
       vfsCacheMode,
       hasRefresh: auth.refreshToken !== null
     });
-    const rcloneConfig = renderOneDriveConfig({
-      remoteName,
-      accessToken: auth.accessToken,
-      refreshToken: auth.refreshToken,
-      expiresAtMs: auth.expiresAtMs,
-      tenantId: auth.tenantId,
-      clientId: auth.clientId,
-      clientSecret: auth.clientSecret,
-      driveId
-    });
+    const renderConfig = (rawToken) => {
+      const a = parseAuthBlob2(rawToken, this.log);
+      return renderOneDriveConfig({
+        remoteName,
+        accessToken: a.accessToken,
+        refreshToken: a.refreshToken,
+        expiresAtMs: a.expiresAtMs,
+        tenantId: a.tenantId,
+        clientId: a.clientId,
+        clientSecret: a.clientSecret,
+        driveId
+      });
+    };
+    const handleRef = { current: null };
+    const refresh = declaration.auth === "backend" && tokenMediator ? createRcloneTokenRefresh({
+      connectorId: declaration.id,
+      tokenMediator,
+      renderConfig,
+      rclone: this.rclone,
+      handleRef,
+      log: (line) => this.log.info(line)
+    }) : void 0;
+    const rcloneConfig = renderConfig(cred.token ?? "");
     await ensureDirMode(base, this.log);
     await ensureDirMode(cacheDir, this.log);
     await ensureDirMode(targetDir, this.log);
@@ -3532,20 +3543,24 @@ var SharePointConnector = class extends AbstractConnector {
       ...cacheMaxAge !== void 0 ? { cacheMaxAge } : {},
       ...vfsWriteBack !== void 0 ? { vfsWriteBack } : {},
       ...ignoreSizeCheck ? { ignoreSizeCheck: true } : {},
+      ...refresh ? { onAuthError: () => refresh.onAuthError() } : {},
       log: this.log
     });
     this.log.info("mount ready", { pid: rcloneHandle.pid });
-    const state = { rcloneHandle };
+    handleRef.current = rcloneHandle;
+    refresh?.schedule(cred.expiresAt);
+    const state = { handleRef, refresh };
     return this.makeHandle(declaration, state, targetDir);
   }
   async disconnect(handle) {
     const s = handle.state;
-    if (s.fleetManaged || !s.rcloneHandle) return;
-    await this.rclone.stop(s.rcloneHandle, { graceMs: 3e4 });
+    s.refresh?.cancel();
+    if (s.fleetManaged || !s.handleRef.current) return;
+    await this.rclone.stop(s.handleRef.current, { graceMs: 3e4 });
   }
   async _sync(handle, options) {
     const s = handle.state;
-    if (s.fleetManaged || !s.rcloneHandle) {
+    if (s.fleetManaged || !s.handleRef.current) {
       options?.onSyncStatus?.({
         phase: "initial_sync_complete",
         totalFiles: 0,
@@ -3555,7 +3570,7 @@ var SharePointConnector = class extends AbstractConnector {
       });
       return { filesWritten: 0, filesDeleted: 0, bytesTransferred: 0 };
     }
-    await this.rclone.flush(s.rcloneHandle);
+    await this.rclone.flush(s.handleRef.current);
     options?.onSyncStatus?.({
       phase: "initial_sync_complete",
       totalFiles: 0,
@@ -4405,7 +4420,7 @@ var WebDAVConnector = class extends AbstractConnector {
       });
       await ensureFleetMounted(targetDir, this.log);
       const fleetState = {
-        rcloneHandle: null,
+        handleRef: { current: null },
         fleetManaged: true
       };
       return this.makeHandle(declaration, fleetState, targetDir);
@@ -4423,8 +4438,8 @@ var WebDAVConnector = class extends AbstractConnector {
     const vendor = vendorRaw;
     const basePath = String(opts?.basePath ?? "").replace(/^\/+|\/+$/g, "");
     const remotePath = basePath.length > 0 ? `/${basePath}` : "/";
-    const auth = parseAuth(await resolveMountCredentialString(declaration, secrets, tokenMediator));
-    const obscuredPassword = auth.password ? await this.obscure(auth.password) : null;
+    const cred = await resolveMountCredential(declaration, secrets, tokenMediator, "initial");
+    const auth = parseAuth(cred.token);
     const remoteName = `skaile-${declaration.id}`;
     const remote = `${remoteName}:${remotePath}`;
     const base = cacheBase3();
@@ -4438,14 +4453,28 @@ var WebDAVConnector = class extends AbstractConnector {
       vfsCacheMode,
       authKind: auth.bearerToken ? "bearer" : auth.username ? "basic" : "anonymous"
     });
-    const rcloneConfig = renderWebDAVConfig({
-      remoteName,
-      url,
-      vendor,
-      username: auth.username,
-      obscuredPassword,
-      bearerToken: auth.bearerToken
-    });
+    const renderConfig = async (rawToken) => {
+      const a = parseAuth(rawToken);
+      const obscured = a.password ? await this.obscure(a.password) : null;
+      return renderWebDAVConfig({
+        remoteName,
+        url,
+        vendor,
+        username: a.username,
+        obscuredPassword: obscured,
+        bearerToken: a.bearerToken
+      });
+    };
+    const handleRef = { current: null };
+    const refresh = declaration.auth === "backend" && tokenMediator ? createRcloneTokenRefresh({
+      connectorId: declaration.id,
+      tokenMediator,
+      renderConfig,
+      rclone: this.rclone,
+      handleRef,
+      log: (line) => this.log.info(line)
+    }) : void 0;
+    const rcloneConfig = await renderConfig(cred.token ?? "");
     await ensureDirMode(base, this.log);
     await ensureDirMode(cacheDir, this.log);
     await ensureDirMode(targetDir, this.log);
@@ -4463,20 +4492,24 @@ var WebDAVConnector = class extends AbstractConnector {
       ...cacheMaxSize !== void 0 ? { cacheMaxSize } : {},
       ...cacheMaxAge !== void 0 ? { cacheMaxAge } : {},
       ...vfsWriteBack !== void 0 ? { vfsWriteBack } : {},
+      ...refresh ? { onAuthError: () => refresh.onAuthError() } : {},
       log: this.log
     });
     this.log.info("mount ready", { pid: rcloneHandle.pid });
-    const state = { rcloneHandle };
+    handleRef.current = rcloneHandle;
+    refresh?.schedule(cred.expiresAt);
+    const state = { handleRef, refresh };
     return this.makeHandle(declaration, state, targetDir);
   }
   async disconnect(handle) {
     const s = handle.state;
-    if (s.fleetManaged || !s.rcloneHandle) return;
-    await this.rclone.stop(s.rcloneHandle, { graceMs: 3e4 });
+    s.refresh?.cancel();
+    if (s.fleetManaged || !s.handleRef.current) return;
+    await this.rclone.stop(s.handleRef.current, { graceMs: 3e4 });
   }
   async _sync(handle, options) {
     const s = handle.state;
-    if (s.fleetManaged || !s.rcloneHandle) {
+    if (s.fleetManaged || !s.handleRef.current) {
       options?.onSyncStatus?.({
         phase: "initial_sync_complete",
         totalFiles: 0,
@@ -4486,7 +4519,7 @@ var WebDAVConnector = class extends AbstractConnector {
       });
       return { filesWritten: 0, filesDeleted: 0, bytesTransferred: 0 };
     }
-    await this.rclone.flush(s.rcloneHandle);
+    await this.rclone.flush(s.handleRef.current);
     options?.onSyncStatus?.({
       phase: "initial_sync_complete",
       totalFiles: 0,
@@ -5240,6 +5273,115 @@ var ConnectorStartupError = class extends Error {
     this.failedReadWrite = failedReadWrite;
   }
 };
+
+// connectors/src/fleet-health-gate.ts
+var FleetHealthGate = class {
+  constructor(target, barrier, log, opts) {
+    this.target = target;
+    this.barrier = barrier;
+    this.log = log;
+    this.unhealthyThreshold = Math.max(1, opts?.unhealthyThreshold ?? 2);
+    this.healthyThreshold = Math.max(1, opts?.healthyThreshold ?? 2);
+  }
+  target;
+  barrier;
+  log;
+  unhealthyThreshold;
+  healthyThreshold;
+  /** True while the read-only barrier is established over the target. */
+  gated = false;
+  /**
+   * The gate state that the most recently *enqueued* transition will settle on.
+   * Hysteresis is measured against this, not `gated`, so that verdicts arriving
+   * while a (slow, async) establish/remove is still in flight are counted toward
+   * the post-transition state rather than the stale pre-transition one. Without
+   * this, fast healthy verdicts arriving during a slow `establish()` could meet
+   * `healthyThreshold` before the gate finished tripping, ungating it on the
+   * first healthy verdict afterwards and defeating the threshold.
+   */
+  pendingGated = false;
+  /** Consecutive same-verdict run length, signed by the *current* run's verdict. */
+  unhealthyRun = 0;
+  healthyRun = 0;
+  /** Serialises establish/remove so overlapping observe() calls can't race. */
+  transition = Promise.resolve();
+  /** True while the read-only barrier is established (test/observability hook). */
+  get isGated() {
+    return this.gated;
+  }
+  /**
+   * Feed one health verdict. Applies hysteresis, then establishes or removes the
+   * barrier on a state change. Resolves once the (possibly no-op) transition is
+   * applied. Never throws — a failed establish is treated as gated (fail-closed).
+   */
+  observe(verdict) {
+    if (verdict === "healthy") {
+      this.healthyRun += 1;
+      this.unhealthyRun = 0;
+      if (this.pendingGated && this.healthyRun >= this.healthyThreshold) {
+        this.pendingGated = false;
+        this.healthyRun = 0;
+        return this.enqueue(() => this.ungate());
+      }
+    } else {
+      this.unhealthyRun += 1;
+      this.healthyRun = 0;
+      if (!this.pendingGated && this.unhealthyRun >= this.unhealthyThreshold) {
+        this.pendingGated = true;
+        this.unhealthyRun = 0;
+        return this.enqueue(() => this.gate());
+      }
+    }
+    return this.transition;
+  }
+  /**
+   * Tear the gate down. If currently gated, removes the barrier so a leftover
+   * read-only tmpfs is not leaked. Call only after the connector above the target
+   * is disconnected (top-down, no leaked mount).
+   */
+  dispose() {
+    if (!this.gated) return this.transition;
+    return this.enqueue(() => this.ungate());
+  }
+  enqueue(step) {
+    this.transition = this.transition.then(step, step);
+    return this.transition;
+  }
+  async gate() {
+    if (this.gated) {
+      this.pendingGated = true;
+      return;
+    }
+    try {
+      await this.barrier.establish(this.target, this.log);
+      this.gated = true;
+      this.log?.warn("fleet mount unhealthy \u2014 gated read-only", { target: this.target });
+    } catch (err) {
+      this.gated = true;
+      this.log?.error(
+        "fleet read-only gate establish threw \u2014 treating as gated (fail-closed)",
+        err,
+        {
+          target: this.target
+        }
+      );
+    }
+  }
+  async ungate() {
+    if (!this.gated) return;
+    try {
+      await this.barrier.remove(this.target, this.log);
+    } catch (err) {
+      this.pendingGated = true;
+      this.log?.error("fleet read-only gate remove failed \u2014 staying gated", err, {
+        target: this.target
+      });
+      return;
+    }
+    this.gated = false;
+    this.log?.info("fleet mount recovered \u2014 gate lifted, writable again", { target: this.target });
+  }
+};
 function isFleetManaged(connectorId) {
   const raw = process.env.SKAILE_FLEET_MANAGED_MOUNTS ?? "";
   if (raw.length === 0) return false;
@@ -5268,6 +5410,16 @@ async function ensureFleetMounted(dir, log, options) {
     `fleet mount ${dir} not ready after ${timeoutMs}ms \u2014 check SKAILE_FLEET_MANAGED_MOUNTS env var and host bind: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
   );
 }
+async function probeFleetHealth(dir) {
+  try {
+    const st = await stat(dir);
+    if (!st.isDirectory()) return "error";
+    await readdir(dir);
+    return "healthy";
+  } catch {
+    return "error";
+  }
+}
 var NOT_READY_SENTINEL = ".skaile-workspace-not-ready";
 var SENTINEL_BODY = [
   "This workspace is backed by a remote mount that is not live yet.",
@@ -5394,6 +5546,12 @@ var defaultMountPlaceholderBarrier = new RoMountPlaceholderBarrier();
 
 // connectors/src/connector-manager.ts
 var KNOWN_PREFIXES = ["env:", "forge:", "op:", "kp:", "oauth:"];
+var DEFAULT_FLEET_HEALTH_POLL_MS = 5e3;
+function parseFleetHealthPollMs(raw = process.env.SKAILE_FLEET_HEALTH_POLL_MS) {
+  if (raw === void 0) return DEFAULT_FLEET_HEALTH_POLL_MS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_FLEET_HEALTH_POLL_MS;
+}
 function hasKnownPrefix(ref) {
   return KNOWN_PREFIXES.some((p) => ref.startsWith(p));
 }
@@ -5494,6 +5652,7 @@ var ConnectorManager = class {
     this.tokenMediator = opts.tokenMediator;
     this.preMintedSecrets = opts.preMintedSecrets;
     this.placeholderBarrier = opts.placeholderBarrier ?? defaultMountPlaceholderBarrier;
+    this.fleetHealthPollMs = opts.fleetHealthPollMs ?? parseFleetHealthPollMs();
     const secrets = opts.secrets;
     if (secrets && typeof secrets === "object" && "prepareRef" in secrets) {
       this.chain = secrets;
@@ -5522,6 +5681,10 @@ var ConnectorManager = class {
   disposeController = new AbortController();
   /** Tracks the background task driving deferred (rclone-backed) mounts. */
   deferredConnect;
+  /** Periodic local fleet-health probe; runs only while a fleet gate is active. */
+  fleetHealthTimer;
+  /** Local fleet-health poll interval (ms). 0 disables the local probe. */
+  fleetHealthPollMs;
   // ── Private helpers ──────────────────────────────────────────────────────────
   /**
    * Wrap the user-supplied `TokenMediator` so `reason: 'initial'` calls for an
@@ -5793,7 +5956,9 @@ var ConnectorManager = class {
         connector,
         handle,
         declaration: decl,
-        placeholderTarget: previous?.placeholderTarget
+        placeholderTarget: previous?.placeholderTarget,
+        fleetHealthGate: previous?.fleetHealthGate,
+        fleetHealthTarget: previous?.fleetHealthTarget
       });
       this.opts.onStatusChange?.({
         type: "connector_status",
@@ -5829,16 +5994,25 @@ var ConnectorManager = class {
    * prompt before the background mount completes.
    *
    * Before exposing the target, a read-only barrier is established so the agent
-   * cannot write a phantom workspace into a not-yet-mounted remote. Fleet-managed
-   * mounts are skipped: the host already bound the live share at the target, so a
-   * barrier on top would shadow real content.
+   * cannot write a phantom workspace into a not-yet-mounted remote.
+   *
+   * Fleet-managed mounts skip the *static* boot-time barrier (the host already
+   * bound the live share at the target — a static barrier would shadow real
+   * content) but instead get a *dynamic* health gate: while the host fleet rclone
+   * is healthy the target stays writable exactly as before; when it wedges, the
+   * gate establishes the same read-only barrier until the mount recovers.
    */
   async preRegisterDeferred(decl, connector) {
     const mountTarget = this.resolveMountTarget(decl);
     if (!existsSync(mountTarget)) mkdirSync(mountTarget, { recursive: true });
     const fleetManaged = isFleetManaged(decl.id);
     let placeholderTarget;
-    if (!fleetManaged) {
+    let fleetHealthGate;
+    let fleetHealthTarget;
+    if (fleetManaged) {
+      fleetHealthGate = new FleetHealthGate(mountTarget, this.placeholderBarrier, this.mgrLog);
+      fleetHealthTarget = mountTarget;
+    } else {
       try {
         await this.placeholderBarrier.establish(mountTarget, this.mgrLog);
         placeholderTarget = mountTarget;
@@ -5857,7 +6031,58 @@ var ConnectorManager = class {
       // returns cleanly instead of dereferencing null state.
       state: {}
     };
-    this.active.set(decl.id, { connector, handle, declaration: decl, placeholderTarget });
+    this.active.set(decl.id, {
+      connector,
+      handle,
+      declaration: decl,
+      placeholderTarget,
+      fleetHealthGate,
+      fleetHealthTarget
+    });
+    if (fleetHealthGate) this.ensureFleetHealthPoll();
+  }
+  /**
+   * Start the periodic local fleet-health probe if it is not already running and
+   * the poll interval is enabled. Each tick `stat`+`readdir`s every fleet target
+   * and feeds the verdict to its gate (hysteresis lives in the gate). The probe
+   * only catches directly-detectable failures (EIO / dead bind); silent
+   * degradation is covered by the platform signal via `reportFleetHealth`.
+   */
+  ensureFleetHealthPoll() {
+    if (this.fleetHealthTimer || this.fleetHealthPollMs <= 0 || this.disposed) return;
+    this.fleetHealthTimer = setInterval(() => {
+      void this.runFleetHealthProbe();
+    }, this.fleetHealthPollMs);
+    this.fleetHealthTimer.unref?.();
+  }
+  async runFleetHealthProbe() {
+    if (this.disposed) return;
+    const gates = [...this.active.values()].filter(
+      (e) => e.fleetHealthGate != null && e.fleetHealthTarget != null
+    );
+    await Promise.all(
+      gates.map(async (e) => {
+        if (e.fleetHealthGate.isGated) return;
+        const verdict = await probeFleetHealth(e.fleetHealthTarget);
+        await e.fleetHealthGate.observe(verdict).catch(() => {
+        });
+      })
+    );
+  }
+  /**
+   * Feed an externally-derived fleet-health verdict for a connector into its gate.
+   *
+   * This is the consume side of the platform fleet-health signal: the host fleet
+   * health poll knows `core/stats.errors` and can detect a *silently-empty-but-
+   * writable* degraded mount that the local probe cannot. The runner watches the
+   * `<workspace>/.skaile/fleet-health/<connectorId>` flag and forwards its verdict
+   * here. Unknown / non-fleet ids are ignored.
+   */
+  async reportFleetHealth(connectorId, verdict) {
+    const entry = this.active.get(connectorId);
+    if (!entry?.fleetHealthGate) return;
+    await entry.fleetHealthGate.observe(verdict).catch(() => {
+    });
   }
   /** Drive all deferred mounts concurrently; resolves when every one settles. */
   async connectDeferred(deferred) {
@@ -5904,6 +6129,10 @@ var ConnectorManager = class {
     this.mgrLog.info("disconnectAll start", { count: this.active.size });
     this.disposed = true;
     this.disposeController.abort();
+    if (this.fleetHealthTimer) {
+      clearInterval(this.fleetHealthTimer);
+      this.fleetHealthTimer = void 0;
+    }
     if (this.deferredConnect) {
       try {
         await this.deferredConnect;
@@ -5921,6 +6150,8 @@ var ConnectorManager = class {
         await this.placeholderBarrier.remove(entry.placeholderTarget, this.mgrLog).catch(() => {
         });
       }
+      if (entry.fleetHealthGate) await entry.fleetHealthGate.dispose().catch(() => {
+      });
       this.opts.onStatusChange?.({
         type: "connector_status",
         connectorId: id,
@@ -6011,6 +6242,8 @@ var ConnectorManager = class {
             await this.placeholderBarrier.remove(entry.placeholderTarget, this.mgrLog).catch(() => {
             });
           }
+          if (entry.fleetHealthGate) await entry.fleetHealthGate.dispose().catch(() => {
+          });
           this.active.delete(id);
           this.opts.onStatusChange?.({
             type: "connector_status",
@@ -6982,6 +7215,135 @@ function isPackageResolvable(pkg, projectDir) {
 function findMissingPackages(packages, projectDir) {
   return packages.filter((p) => !isPackageResolvable(p, projectDir));
 }
+
+// connectors/src/rclone-token-refresh.ts
+var PROACTIVE_RCLONE_REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+var DEFAULT_REACTIVE_COOLDOWN_MS = 30 * 1e3;
+var MAX_TIMER_MS = 2147483647;
+function createRcloneTokenRefresh(deps) {
+  const now2 = deps.now ?? (() => Date.now());
+  const setTimeoutImpl = deps.setTimeoutImpl ?? ((handler, ms) => setTimeout(handler, ms));
+  const clearTimeoutImpl = deps.clearTimeoutImpl ?? ((handle) => {
+    clearTimeout(handle);
+  });
+  const marginMs = deps.marginMs ?? PROACTIVE_RCLONE_REFRESH_MARGIN_MS;
+  const reactiveCooldownMs = deps.reactiveCooldownMs ?? DEFAULT_REACTIVE_COOLDOWN_MS;
+  let timer = null;
+  let refreshing = false;
+  let disposed = false;
+  let lastRefreshAt = Number.NEGATIVE_INFINITY;
+  function clearTimer() {
+    if (timer !== null) {
+      clearTimeoutImpl(timer);
+      timer = null;
+    }
+  }
+  function cancel() {
+    disposed = true;
+    clearTimer();
+  }
+  async function fire(reason) {
+    if (refreshing || disposed) return;
+    refreshing = true;
+    try {
+      let result;
+      try {
+        result = await deps.tokenMediator({ connectorId: deps.connectorId, reason });
+      } catch (err) {
+        deps.log(
+          `[rclone-token-refresh] mediator threw: ${err instanceof Error ? err.message : String(err)}; reactive auth-error path remains as safety net`
+        );
+        return;
+      }
+      if (disposed) return;
+      if (!result.ok) {
+        deps.log(
+          `[rclone-token-refresh] mediator refused (${result.code}: ${result.message}); reactive auth-error path remains as safety net`
+        );
+        return;
+      }
+      if (!result.token) {
+        deps.log(
+          "[rclone-token-refresh] mediator returned an empty token; reactive auth-error path remains as safety net"
+        );
+        return;
+      }
+      const handle = deps.handleRef.current;
+      if (!handle) {
+        deps.log("[rclone-token-refresh] no live rclone handle to recycle; skipping refresh");
+        return;
+      }
+      const rcloneConfig = await deps.renderConfig(result.token);
+      if (disposed) return;
+      let next;
+      try {
+        next = await deps.rclone.reconfigure(handle, rcloneConfig);
+      } catch (err) {
+        deps.log(
+          `[rclone-token-refresh] reconfigure failed: ${err instanceof Error ? err.message : String(err)}; reactive auth-error path remains as safety net`
+        );
+        return;
+      }
+      if (disposed) {
+        deps.log("[rclone-token-refresh] disposed mid-recycle; stopping freshly-spawned process");
+        try {
+          await deps.rclone.stop(next);
+        } catch {
+        }
+        return;
+      }
+      deps.handleRef.current = next;
+      lastRefreshAt = now2();
+      deps.log(
+        `[rclone-token-refresh] recycled mount with refreshed token (reason=${reason}, expiresAt=${result.expiresAt ?? "none"})`
+      );
+      schedule(result.expiresAt);
+    } finally {
+      refreshing = false;
+    }
+  }
+  function armTimer(fireAtMs) {
+    const delayMs = Math.min(Math.max(0, fireAtMs - now2()), MAX_TIMER_MS);
+    timer = setTimeoutImpl(() => {
+      timer = null;
+      if (now2() < fireAtMs) armTimer(fireAtMs);
+      else void fire("refresh");
+    }, delayMs);
+    timer.unref?.();
+  }
+  function schedule(expiresAtIso) {
+    clearTimer();
+    if (disposed || !expiresAtIso) return;
+    const expiresAtMs = Date.parse(expiresAtIso);
+    if (!Number.isFinite(expiresAtMs)) return;
+    const fireAtMs = expiresAtMs - marginMs;
+    if (fireAtMs - now2() <= 0) {
+      deps.log(`[rclone-token-refresh] token within ${marginMs / 1e3}s of expiry; refreshing now`);
+    } else {
+      deps.log(
+        `[rclone-token-refresh] scheduled in ${Math.round((fireAtMs - now2()) / 1e3)}s (expiresAt=${expiresAtIso})`
+      );
+    }
+    armTimer(fireAtMs);
+  }
+  function onAuthError() {
+    if (refreshing || disposed) return;
+    if (now2() - lastRefreshAt < reactiveCooldownMs) {
+      deps.log(
+        "[rclone-token-refresh] auth-error within refresh cooldown; suppressing reactive refresh"
+      );
+      return;
+    }
+    clearTimer();
+    void fire("retry-401");
+  }
+  return {
+    schedule,
+    onAuthError,
+    cancel,
+    isPending: () => timer !== null
+  };
+}
 var WorktreeRegistryImpl = class {
   entries = /* @__PURE__ */ new Map();
   register(path2, owner) {
@@ -8002,6 +8364,6 @@ function createConnector() {
   return new FlowAdapter();
 }
 
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
-//# sourceMappingURL=chunk-GXHJDQ37.js.map
-//# sourceMappingURL=chunk-GXHJDQ37.js.map
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FleetHealthGate, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, probeFleetHealth, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
+//# sourceMappingURL=chunk-WQRDLR3K.js.map
+//# sourceMappingURL=chunk-WQRDLR3K.js.map