mulmoclaude 2.3.0 → 2.4.0

package/server/events/pub-sub/handshakeAuth.ts

@@ -0,0 +1,9 @@
+import { isAuthorizedToken } from "@mulmoclaude/common/token-guard";
+import { isRecord } from "../../utils/types.js";
+
+// `auth` is whatever the socket.io client put in `io({ auth })`. Only a record
+// whose `token` passes the shared bearer rule connects; a server with no token
+// yet refuses everything, as `bearerAuth` does for HTTP.
+export function isAuthorizedPubSubHandshake(auth: unknown, expectedToken: string | null): boolean {
+  return isRecord(auth) && isAuthorizedToken(auth.token, expectedToken);
+}

package/server/events/pub-sub/index.ts

@@ -1,26 +1,59 @@
 import http from "http";
-import { Server as IOServer } from "socket.io";
+import { Server as IOServer, type Socket } from "socket.io";
 
+import { UNAUTHORIZED_MESSAGE } from "@mulmoclaude/common/token-guard";
 import { log } from "../../system/logger/index.js";
+import { isAuthorizedPubSubHandshake } from "./handshakeAuth.js";
 
 export interface IPubSub {
   /** Publish data to all clients subscribed to this channel. */
   publish: (channel: string, data: unknown) => void;
 }
 
+export interface PubSubOptions {
+  /** The bearer token a handshake must present. `null` while the server
+   *  has none yet, which refuses every handshake. */
+  tokenProvider: () => string | null;
+}
+
 const logRoomError =
   (action: string, channel: string) =>
   (err: unknown): void => {
     log.warn("pubsub", `socket room ${action} failed`, { channel, error: String(err) });
   };
 
+// `join`/`leave` return `void | Promise<void>`: the in-memory adapter runs
+// synchronously and returns undefined, while a clustered adapter goes over
+// the wire. Nothing here depends on the result, but the promise branch
+// still needs a terminal handler — a bare `void` would turn an adapter
+// failure into an unhandled rejection. `Promise.resolve` normalises both.
+function bindRoomEvents(socket: Socket): void {
+  socket.on("subscribe", (channel: unknown) => {
+    if (typeof channel === "string") Promise.resolve(socket.join(channel)).catch(logRoomError("subscribe", channel));
+  });
+  socket.on("unsubscribe", (channel: unknown) => {
+    if (typeof channel === "string") Promise.resolve(socket.leave(channel)).catch(logRoomError("unsubscribe", channel));
+  });
+}
+
+// A refused handshake leaves the engine.io connection open, and that one
+// connection can keep sending CONNECT packets; one line per connection keeps
+// a misconfigured relay diagnosable without letting a loop fill the log.
+const warnedConnections = new WeakSet<object>();
+
+function warnRefusedOnce(socket: Socket): void {
+  if (warnedConnections.has(socket.conn)) return;
+  warnedConnections.add(socket.conn);
+  log.warn("pubsub", "handshake refused: bearer token missing or invalid", { address: socket.handshake.address });
+}
+
 // Channel names are treated as socket.io rooms — one room per
 // channel. Subscribe/unsubscribe is plain `socket.join` /
 // `socket.leave`. Publish broadcasts to the room. Reconnect /
 // heartbeat / multi-transport fallback are handled by socket.io
 // itself, which is why we switched off raw ws.
 
-export function createPubSub(server: http.Server): IPubSub {
+export function createPubSub(server: http.Server, options: PubSubOptions): IPubSub {
   const ioServer = new IOServer(server, {
     path: "/ws/pubsub",
     // Server binds to 127.0.0.1 only, so CORS is moot — but
@@ -36,20 +69,20 @@ export function createPubSub(server: http.Server): IPubSub {
     transports: ["websocket"],
   });
 
-  ioServer.on("connection", (socket) => {
-    // `join`/`leave` return `void | Promise<void>`: the in-memory adapter runs
-    // synchronously and returns undefined, while a clustered adapter goes over
-    // the wire. Nothing here depends on the result, but the promise branch
-    // still needs a terminal handler — a bare `void` would turn an adapter
-    // failure into an unhandled rejection. `Promise.resolve` normalises both.
-    socket.on("subscribe", (channel: unknown) => {
-      if (typeof channel === "string") Promise.resolve(socket.join(channel)).catch(logRoomError("subscribe", channel));
-    });
-    socket.on("unsubscribe", (channel: unknown) => {
-      if (typeof channel === "string") Promise.resolve(socket.leave(channel)).catch(logRoomError("unsubscribe", channel));
-    });
+  // Same token every `/api/*` call presents (#3433). A refused handshake
+  // destroys the client socket, so socket.io does not retry it — the SPA
+  // reads that as "reload for a fresh token" rather than spinning.
+  ioServer.use((socket, next) => {
+    if (isAuthorizedPubSubHandshake(socket.handshake.auth, options.tokenProvider())) {
+      next();
+      return;
+    }
+    warnRefusedOnce(socket);
+    next(new Error(UNAUTHORIZED_MESSAGE));
   });
 
+  ioServer.on("connection", bindRoomEvents);
+
   return {
     publish(channel: string, data: unknown): void {
       ioServer.to(channel).emit("data", { channel, data });

package/server/index.ts

@@ -1548,7 +1548,7 @@ process.on("SIGTERM", () => {
     // (CodeRabbit review on PR #1196). Both `createPubSub` and
     // `initNotifier` are sync, so wiring them up here costs nothing
     // and closes the window.
-    const earlyPubsub = createPubSub(httpServer);
+    const earlyPubsub = createPubSub(httpServer, { tokenProvider: getCurrentToken });
     initNotifier({
       publish: (channel, payload) => earlyPubsub.publish(channel, payload),
     });

package/server/plugins/dev-watcher.ts

@@ -6,7 +6,7 @@
 // chokidar to avoid pulling another runtime dependency. Recursive
 // watching is reliable on macOS / Linux / Windows starting from Node
 // 20.12 (Linux had race conditions and crash-on-delete bugs in earlier
-// 20.x patches), which engines.node (>=22.19) clears comfortably.
+// 20.x patches), which engines.node clears comfortably.
 //
 // The publish + warnServerSideChange callbacks are injected so tests
 // can exercise the debounce + classification logic without booting the

package/server/utils/launcher/preflight.d.mts

@@ -1,17 +1,20 @@
 // Type declarations for preflight.mjs.
 
-export interface NodeVersionRequirement {
+export interface NodeVersion {
   major: number;
   minor: number;
+  patch: number;
 }
 
-export const REQUIRED_NODE: NodeVersionRequirement;
+export const REQUIRED_NODE: readonly NodeVersion[];
 
-export function parseNodeVersion(raw: string): NodeVersionRequirement | null;
+export function parseNodeVersion(raw: string): NodeVersion | null;
 
-export function isNodeVersionSupported(raw: string, required?: NodeVersionRequirement): boolean;
+export function isNodeVersionSupported(raw: string, required?: readonly NodeVersion[]): boolean;
 
-export function formatRequiredNode(required?: NodeVersionRequirement): string;
+export function formatRequiredNode(required?: readonly NodeVersion[]): string;
+
+export function formatEnginesRange(required?: readonly NodeVersion[]): string;
 
 export interface CommandProbeOptions {
   env?: Record<string, string | undefined>;

package/server/utils/launcher/preflight.mjs

@@ -9,7 +9,13 @@ import { execFileSync } from "node:child_process";
 
 // Mirrors `engines.node` in packages/mulmoclaude/package.json.
 // test/utils/launcher/test_preflight.ts fails if the two drift.
-export const REQUIRED_NODE = { major: 22, minor: 19 };
+// One floor per supported major; the last also admits every later major,
+// and a major with no floor of its own (23, 25) is unsupported.
+export const REQUIRED_NODE = [
+  { major: 22, minor: 22, patch: 2 },
+  { major: 24, minor: 15, patch: 0 },
+  { major: 26, minor: 0, patch: 0 },
+];
 
 // These probes run a local binary that reads its own package metadata;
 // anything past a few seconds means it is wedged, not slow.
@@ -22,30 +28,50 @@ const COMMAND_PROBE_TIMEOUT_MS = 5000;
  * Returns null for anything unparseable rather than guessing — an
  * unknown version must not silently pass the requirement.
  * @param {string} raw
- * @returns {{ major: number, minor: number } | null}
+ * @returns {import("./preflight.d.mts").NodeVersion | null}
  */
 export function parseNodeVersion(raw) {
   if (typeof raw !== "string") return null;
-  const match = /^v?(\d+)\.(\d+)\./.exec(raw.trim());
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(raw.trim());
   if (!match) return null;
-  return { major: Number(match[1]), minor: Number(match[2]) };
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) };
+}
+
+function compareVersions(left, right) {
+  return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
+}
+
+function floorFor(found, required) {
+  const newest = required[required.length - 1];
+  if (found.major > newest.major) return newest;
+  return required.find((floor) => floor.major === found.major);
 }
 
 /**
  * @param {string} raw
- * @param {{ major: number, minor: number }} [required]
+ * @param {readonly import("./preflight.d.mts").NodeVersion[]} [required]
  * @returns {boolean}
  */
 export function isNodeVersionSupported(raw, required = REQUIRED_NODE) {
   const found = parseNodeVersion(raw);
   if (found === null) return false;
-  if (found.major !== required.major) return found.major > required.major;
-  return found.minor >= required.minor;
+  const floor = floorFor(found, required);
+  return floor !== undefined && compareVersions(found, floor) >= 0;
+}
+
+function formatVersion({ major, minor, patch }) {
+  return `${major}.${minor}.${patch}`;
 }
 
 /** Human-readable form of a requirement, for the {required} placeholder. */
 export function formatRequiredNode(required = REQUIRED_NODE) {
-  return `${required.major}.${required.minor}`;
+  return required.map(formatVersion).join(" / ");
+}
+
+/** The same requirement as an `engines.node` range. */
+export function formatEnginesRange(required = REQUIRED_NODE) {
+  const carets = required.slice(0, -1).map((floor) => `^${formatVersion(floor)}`);
+  return [...carets, `>=${formatVersion(required[required.length - 1])}`].join(" || ");
 }
 
 /**

package/src/App.vue

@@ -4,6 +4,10 @@
          it's the first thing the user sees when the server isn't
          reachable. Self-hiding when fetchHealth succeeds. -->
     <BackendOfflineBanner :on-retry="fetchHealth" />
+    <!-- Stale-token notice (#3438) — the server refused this page's token and
+         fetching index.html again did not produce one it accepts. Recovery is
+         the normal path after a restart; this is its last resort. -->
+    <AuthTokenStaleBanner />
     <!-- Remote-host disconnect notice (#2535) — shown when the host was meant to
          be connected (a session is parked) but dropped and a silent reconnect
          couldn't restore it. Offers a one-click re-login. -->
@@ -361,6 +365,7 @@ import { ref, computed, watch, nextTick, onMounted, onScopeDispose, reactive } f
 import { useI18n } from "vue-i18n";
 import { getPlugin } from "./tools";
 import type { ToolResultComplete } from "gui-chat-protocol/vue";
+import AuthTokenStaleBanner from "./components/AuthTokenStaleBanner.vue";
 import BackendOfflineBanner from "./components/BackendOfflineBanner.vue";
 import RemoteHostOfflineBanner from "./components/RemoteHostOfflineBanner.vue";
 import RightSidebar from "./components/RightSidebar.vue";

package/src/components/AuthTokenStaleBanner.vue

@@ -0,0 +1,27 @@
+<template>
+  <StatusBanner
+    v-if="authTokenStale"
+    tone="warning"
+    icon="sync_disabled"
+    testid="auth-token-stale-banner"
+    action-testid="auth-token-stale-reload"
+    :title="t('authTokenStale.title')"
+    :body="t('authTokenStale.body')"
+    :action-label="t('authTokenStale.reload')"
+    @action="reload"
+  />
+</template>
+
+<script setup lang="ts">
+// Shown once the server refused this page's token and fetching index.html
+// again did not produce one it accepts (#3438). Auto-recovery is the normal
+// path after a server restart; this is its last resort, and a reload is the
+// only thing left that fetches a fresh token.
+import { useI18n } from "vue-i18n";
+import StatusBanner from "./StatusBanner.vue";
+import { authTokenStale } from "../utils/auth/authTokenRecovery";
+
+const { t } = useI18n();
+
+const reload = (): void => window.location.reload();
+</script>

package/src/components/BackendOfflineBanner.vue

@@ -1,34 +1,23 @@
 <template>
-  <div
+  <StatusBanner
     v-if="!backendReachable"
-    data-testid="backend-offline-banner"
-    role="alert"
-    class="flex items-center gap-2 px-3 py-2 bg-red-50 border-b border-red-200 text-red-700 text-sm"
-  >
-    <span class="material-icons text-base" aria-hidden="true">cloud_off</span>
-    <div class="flex-1 min-w-0">
-      <div class="font-medium">{{ t("backendOffline.title") }}</div>
-      <div class="text-xs text-red-600 truncate">
-        <span>{{ t("backendOffline.body") }}</span>
-        <span v-if="lastBackendError" class="opacity-70">{{ ` — ${lastBackendError}` }}</span>
-      </div>
-    </div>
-    <button
-      type="button"
-      data-testid="backend-offline-retry"
-      class="h-8 px-2.5 flex items-center gap-1 text-sm rounded border border-red-300 text-red-700 hover:bg-red-100 disabled:opacity-40"
-      :disabled="retrying"
-      @click="retry"
-    >
-      <span class="material-icons text-sm" :class="retrying ? 'animate-spin' : ''" aria-hidden="true">refresh</span>
-      {{ t("backendOffline.retry") }}
-    </button>
-  </div>
+    tone="error"
+    icon="cloud_off"
+    testid="backend-offline-banner"
+    action-testid="backend-offline-retry"
+    :title="t('backendOffline.title')"
+    :body="t('backendOffline.body')"
+    :detail="lastBackendError"
+    :action-label="t('backendOffline.retry')"
+    :busy="retrying"
+    @action="retry"
+  />
 </template>
 
 <script setup lang="ts">
 import { ref } from "vue";
 import { useI18n } from "vue-i18n";
+import StatusBanner from "./StatusBanner.vue";
 import { backendReachable, lastBackendError } from "../utils/api";
 
 const { t } = useI18n();

package/src/components/RemoteHostOfflineBanner.vue

@@ -1,26 +1,16 @@
 <template>
-  <div
+  <StatusBanner
     v-if="needsReconnect"
-    data-testid="remote-host-offline-banner"
-    role="alert"
-    class="flex items-center gap-2 px-3 py-2 bg-amber-50 border-b border-amber-200 text-amber-800 text-sm"
-  >
-    <span class="material-icons text-base" aria-hidden="true">phonelink_off</span>
-    <div class="flex-1 min-w-0">
-      <div class="font-medium">{{ t("remoteHostOffline.title") }}</div>
-      <div class="text-xs text-amber-700 truncate">{{ t("remoteHostOffline.body") }}</div>
-    </div>
-    <button
-      type="button"
-      data-testid="remote-host-offline-reconnect"
-      class="h-8 px-2.5 flex items-center gap-1 text-sm rounded border border-amber-300 text-amber-800 hover:bg-amber-100 disabled:opacity-40"
-      :disabled="busy"
-      @click="reconnect"
-    >
-      <span class="material-icons text-sm" :class="busy ? 'animate-spin' : ''" aria-hidden="true">refresh</span>
-      {{ t("remoteHostOffline.reconnect") }}
-    </button>
-  </div>
+    tone="warning"
+    icon="phonelink_off"
+    testid="remote-host-offline-banner"
+    action-testid="remote-host-offline-reconnect"
+    :title="t('remoteHostOffline.title')"
+    :body="t('remoteHostOffline.body')"
+    :action-label="t('remoteHostOffline.reconnect')"
+    :busy="busy"
+    @action="reconnect"
+  />
 </template>
 
 <script setup lang="ts">
@@ -29,6 +19,7 @@
 // session expired). Reads the shared `useRemoteHost` store; Reconnect re-runs the
 // Google sign-in popup from this click (a user gesture, so the popup isn't blocked).
 import { useI18n } from "vue-i18n";
+import StatusBanner from "./StatusBanner.vue";
 import { useRemoteHost } from "../composables/useRemoteHost";
 
 const { t } = useI18n();

package/src/components/StatusBanner.vue

@@ -0,0 +1,65 @@
+<template>
+  <div :data-testid="testid" role="alert" class="flex items-center gap-2 px-3 py-2 border-b text-sm" :class="palette.root">
+    <span class="material-icons text-base" aria-hidden="true">{{ icon }}</span>
+    <div class="flex-1 min-w-0">
+      <div class="font-medium">{{ title }}</div>
+      <div class="text-xs truncate" :class="palette.body">
+        <span>{{ body }}</span>
+        <span v-if="detail" class="opacity-70">{{ ` — ${detail}` }}</span>
+      </div>
+    </div>
+    <button
+      type="button"
+      :data-testid="actionTestid"
+      class="h-8 px-2.5 flex items-center gap-1 text-sm rounded border disabled:opacity-40"
+      :class="palette.button"
+      :disabled="busy"
+      @click="emit('action')"
+    >
+      <span class="material-icons text-sm" :class="busy ? 'animate-spin' : ''" aria-hidden="true">refresh</span>
+      {{ actionLabel }}
+    </button>
+  </div>
+</template>
+
+<script setup lang="ts">
+// The one chrome for a page-wide status notice pinned above the top bar: an
+// icon, a title, one line of body with optional small print, and one action.
+// The wrapper that mounts it owns the signal (`v-if`) and the action.
+import { computed } from "vue";
+
+const PALETTES = {
+  error: {
+    root: "bg-red-50 border-red-200 text-red-700",
+    body: "text-red-600",
+    button: "border-red-300 text-red-700 hover:bg-red-100",
+  },
+  warning: {
+    root: "bg-amber-50 border-amber-200 text-amber-800",
+    body: "text-amber-700",
+    button: "border-amber-300 text-amber-800 hover:bg-amber-100",
+  },
+} as const;
+
+const props = withDefaults(
+  defineProps<{
+    tone: keyof typeof PALETTES;
+    /** A Material Icons name. */
+    icon: string;
+    title: string;
+    body: string;
+    /** Small print after the body, rendered dimmer. */
+    detail?: string | null;
+    actionLabel: string;
+    /** Disables the action and spins its icon. */
+    busy?: boolean;
+    testid: string;
+    actionTestid: string;
+  }>(),
+  { detail: null, busy: false },
+);
+
+const emit = defineEmits<{ action: [] }>();
+
+const palette = computed(() => PALETTES[props.tone]);
+</script>

package/src/composables/usePubSub.ts

@@ -1,4 +1,6 @@
 import { io, type Socket } from "socket.io-client";
+import { getAuthToken } from "../utils/auth/authToken";
+import { authTokenStale, recoverAuthToken } from "../utils/auth/authTokenRecovery";
 
 interface PubSubMessage {
   channel: string;
@@ -35,6 +37,23 @@ function fireReconnectHandlers(): void {
   }
 }
 
+/** The server refused the handshake. The token is regenerated at every server
+ *  start, so this is what a restart looks like from a page that stayed open;
+ *  index.html carries the new token, and `auth` re-reads it on the next
+ *  CONNECT. socket.io does not retry a refusal on its own (#3433), so the
+ *  reconnect is explicit — and only with a token the server has not refused
+ *  yet, so a second refusal ends with the banner rather than a loop (#3438). */
+async function reconnectWithFreshToken(refusedSocket: Socket): Promise<void> {
+  const recovery = await recoverAuthToken();
+  // `maybeDisconnect` may have let go of this socket while index.html was fetched.
+  if (socket !== refusedSocket) return;
+  if (recovery === "installed") {
+    refusedSocket.connect();
+    return;
+  }
+  authTokenStale.value = true;
+}
+
 function connect(): Socket {
   if (socket) return socket;
 
@@ -42,9 +61,13 @@ function connect(): Socket {
     path: "/ws/pubsub",
     // Server refuses long-polling fallback, so fail fast here too if the WS upgrade doesn't go through.
     transports: ["websocket"],
+    // The same bearer token every `apiCall` attaches (#3433). A function, so
+    // each CONNECT re-reads it instead of re-sending the first value.
+    auth: (provide) => provide({ token: getAuthToken() }),
   });
 
   sock.on("connect", () => {
+    authTokenStale.value = false;
     resendSubscriptions(sock);
     if (hasConnectedOnce) {
       fireReconnectHandlers();
@@ -53,6 +76,15 @@ function connect(): Socket {
     }
   });
 
+  sock.on("connect_error", (err: Error) => {
+    // A transport failure leaves `active` true and socket.io retries it on its
+    // own. A refusal from the server middleware destroys the socket (`active`
+    // false) and nothing else will retry it.
+    if (sock.active) return;
+    console.error("[usePubSub] handshake refused by the server:", err.message);
+    void reconnectWithFreshToken(sock);
+  });
+
   sock.on("data", (msg: PubSubMessage) => {
     const cbs = listeners.get(msg.channel);
     if (cbs) {

package/src/lang/de.ts

@@ -139,6 +139,11 @@ const deMessages = {
     body: "Ihr Telefon kann erst nach dem erneuten Verbinden an dieses Gerät senden.",
     reconnect: "Erneut verbinden",
   },
+  authTokenStale: {
+    title: "Diese Seite muss neu geladen werden",
+    body: "Der Server hat das Token dieser Seite abgelehnt, und ein neues konnte nicht abgerufen werden. Laden Sie die Seite neu, um fortzufahren.",
+    reload: "Neu laden",
+  },
   remoteHost: {
     title: "Remote-Host",
     online: "Remote-Host online",

package/src/lang/en.ts

@@ -157,6 +157,11 @@ const enMessages = {
     body: "Your phone can't send to this device until you reconnect.",
     reconnect: "Reconnect",
   },
+  authTokenStale: {
+    title: "This page needs a reload",
+    body: "The server refused this page's token and a new one could not be fetched. Reload to continue.",
+    reload: "Reload",
+  },
   remoteHost: {
     title: "Remote host",
     online: "Remote host online",

package/src/lang/es.ts

@@ -142,6 +142,11 @@ const esMessages = {
     body: "Tu teléfono no podrá enviar a este dispositivo hasta que vuelvas a conectarte.",
     reconnect: "Reconectar",
   },
+  authTokenStale: {
+    title: "Esta página necesita recargarse",
+    body: "El servidor rechazó el token de esta página y no se pudo obtener uno nuevo. Recarga para continuar.",
+    reload: "Recargar",
+  },
   remoteHost: {
     title: "Host remoto",
     online: "Host remoto en línea",

package/src/lang/fr.ts

@@ -137,6 +137,11 @@ const frMessages = {
     body: "Votre téléphone ne pourra pas envoyer vers cet appareil tant que vous n'êtes pas reconnecté.",
     reconnect: "Se reconnecter",
   },
+  authTokenStale: {
+    title: "Cette page doit être rechargée",
+    body: "Le serveur a refusé le jeton de cette page et un nouveau n'a pas pu être récupéré. Rechargez pour continuer.",
+    reload: "Recharger",
+  },
   remoteHost: {
     title: "Hôte distant",
     online: "Hôte distant en ligne",

package/src/lang/ja.ts

@@ -142,6 +142,11 @@ const jaMessages = {
     body: "再接続するまで、スマホからの送信はこの端末に届きません。",
     reconnect: "再接続",
   },
+  authTokenStale: {
+    title: "ページの再読み込みが必要です",
+    body: "サーバーがこのページのトークンを拒否し、新しいトークンを取得できませんでした。続けるには再読み込みしてください。",
+    reload: "再読み込み",
+  },
   remoteHost: {
     title: "リモートホスト",
     online: "リモートホスト: オンライン",

package/src/lang/ko.ts

@@ -143,6 +143,11 @@ const koMessages = {
     body: "다시 연결하기 전에는 휴대폰에서 이 기기로 보낼 수 없습니다.",
     reconnect: "다시 연결",
   },
+  authTokenStale: {
+    title: "페이지를 새로 고쳐야 합니다",
+    body: "서버가 이 페이지의 토큰을 거부했고 새 토큰을 가져오지 못했습니다. 계속하려면 새로 고침하세요.",
+    reload: "새로 고침",
+  },
   remoteHost: {
     title: "원격 호스트",
     online: "원격 호스트 온라인",

package/src/lang/pt-BR.ts

@@ -137,6 +137,11 @@ const ptBRMessages = {
     body: "Seu telefone não conseguirá enviar para este dispositivo até você reconectar.",
     reconnect: "Reconectar",
   },
+  authTokenStale: {
+    title: "Esta página precisa ser recarregada",
+    body: "O servidor recusou o token desta página e não foi possível obter um novo. Recarregue para continuar.",
+    reload: "Recarregar",
+  },
   remoteHost: {
     title: "Host remoto",
     online: "Host remoto on-line",

package/src/lang/zh.ts

@@ -138,6 +138,11 @@ const zhMessages = {
     body: "重新连接之前，手机将无法发送到此设备。",
     reconnect: "重新连接",
   },
+  authTokenStale: {
+    title: "此页面需要重新加载",
+    body: "服务器拒绝了此页面的令牌，且无法获取新令牌。请重新加载以继续。",
+    reload: "重新加载",
+  },
   remoteHost: {
     title: "远程主机",
     online: "远程主机在线",

package/src/main.ts

@@ -9,7 +9,7 @@ import App from "./App.vue";
 import router from "./router/index";
 import { installGuards } from "./router/guards";
 import i18n from "./lib/vue-i18n";
-import { setAuthToken } from "./utils/api";
+import { setAuthToken } from "./utils/auth/authToken";
 import { readAuthTokenFromMeta } from "./utils/dom/authTokenMeta";
 import { loadRuntimePlugins } from "./tools/runtimeLoader";
 import { startDevPluginReloadListener } from "./composables/useDevPluginReload";