[kjgbot]

Draft / deploy hold. This is part of the system-held run token refresh (cloud #5161, relayauth #105, relaycast #550). It's safe for existing mounts, but hold it with the rest of that rollout.

Why

Cloud's system-held refresh worker keeps refresh tokens outside the sandbox. It pushes only access tokens, by atomically renaming an access-only {"token","expiresAt"} file into place every refresh cycle (15-minute access tokens). Before this change, relayfile-mount:

• read --creds-file once at startup and reread it only after a request got a 401;
• ignored the expiresAt key, so it treated those tokens as never expiring;
• kept each websocket on whatever bearer it dialed with.

Changes

• delegatedauth.Bundle and the mount creds struct accept expiresAt as the bearer expiry.
• mountsync.HTTPClient.SetTokenSourceFunc: an optional source consulted on every Token() call. relayfile-mount installs one for --creds-file. It stats the file on each use and reparses it only when the inode, mtime or size changes. It skips expired or unparseable content, and doesn't count the file that startup already read as a change. The existing 401 refresh path is unchanged.
• Websocket: rechecks the bearer every 15 seconds. When the bearer has rotated, it closes the socket and redials right away, without failure backoff.

No token values are logged.

Tests

• New: TestInstallCredsFileRefreshUsesPushedAccessTokenOnNextRequest (the next request uses the pushed token, with no 401 round trip).
• New: TestCredsFileTokenSourceIgnoresExpiredAccessOnlyToken.
• New: TestWebSocketRedialsWithRotatedBearer (passes 5/5 with -count=5).
• New: TestBearerExpiresAtAcceptsAccessOnlyShape.
• go test ./internal/delegatedauth ./cmd/relayfile-mount ./internal/mountsync -count=1: all pass. go vet is clean.

Not covered here

• Server-side revocation of an already-open websocket. The client redials within 15 seconds of a push. Cutting off a revoked token on a socket that's still open is the server's job, and the ≤60s staging test in cloud #5161 covers it.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Agent Relay sessions

• claude session 79b75307 · opened via gh pr create · last active 2026-10-18

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Relayfile Eval Review

Run: .relayfile/evals/runs/2026-10-18T03-47-09-872Z-HEAD-provider
Mode: provider
Git SHA: 6602bf3

Passed: 4 | Needs human: 0 | Reviewable: 0 | Missing output: 0 | Failed: 0 | Skipped: 0

Human Review Cases

No reviewable human-review cases captured Relayfile output.