runStatus maps any 401 to ErrCloudRefreshExpired, but the client it calls authenticates with the delegated token. So a stale or under-scoped delegated credential makes relayfile status tell the operator to run agent-relay cloud login — a command that does not fix a delegated-credential problem.
This is the same defect class #426 just fixed on the mount path (an error prescribing an action that cannot work in the caller's context), left unclosed on the operator-facing surface.
Where
Line numbers are provisional against 407918b (tip of fix/delegated-credential-sdk-remint-0815, merged as c56c816):
cmd/relayfile-cli/main.go:9130 — runStatus does if isUnauthorizedAPIError(err) { return ErrCloudRefreshExpired }cmd/relayfile-cli/main.go:7755-7767 — prepareWorkspaceCommandClient builds that client with the delegated bearer token
Why it is wrong
#426 added a doc comment defining ErrCloudRefreshExpired as "canonical Cloud session absent/incomplete/cannot refresh". The runStatus call site violates that definition: the 401 it observes can equally come from a delegated credential that is expired or lacks the required scope, which is what ErrDelegatedScopeInsufficient / ErrDelegatedScopeInvalid exist to express.
Not a regression
The pre-#426 text was equally wrong, so nothing got worse. #426 closed the loop on the mount daemon path only.
Suggested fix
Classify at the runStatus call site the same way degradedStallClassFor does on the mount path — distinguish a canonical-session 401 from a delegated-credential 401 and return the matching sentinel — rather than collapsing both to ErrCloudRefreshExpired.
Definition of done
- A test that drives
runStatus with a 401 originating from a delegated credential and asserts the operator text does not prescribe agent-relay cloud login.
- A paired test for the genuine canonical-session 401 that asserts it still does. (Must-fire and must-not-fire, not just the new arm.)
Found by the independent review of #426 (reviewer rf426-independent-review-0816, finding F1); filed by factory-lead. Not dispatched — no readiness label.
runStatusmaps any 401 toErrCloudRefreshExpired, but the client it calls authenticates with the delegated token. So a stale or under-scoped delegated credential makesrelayfile statustell the operator to runagent-relay cloud login— a command that does not fix a delegated-credential problem.This is the same defect class #426 just fixed on the mount path (an error prescribing an action that cannot work in the caller's context), left unclosed on the operator-facing surface.
Where
Line numbers are provisional against
407918b(tip offix/delegated-credential-sdk-remint-0815, merged asc56c816):cmd/relayfile-cli/main.go:9130—runStatusdoesif isUnauthorizedAPIError(err) { return ErrCloudRefreshExpired }cmd/relayfile-cli/main.go:7755-7767—prepareWorkspaceCommandClientbuilds that client with the delegated bearer tokenWhy it is wrong
#426 added a doc comment defining
ErrCloudRefreshExpiredas "canonical Cloud session absent/incomplete/cannot refresh". TherunStatuscall site violates that definition: the 401 it observes can equally come from a delegated credential that is expired or lacks the required scope, which is whatErrDelegatedScopeInsufficient/ErrDelegatedScopeInvalidexist to express.Not a regression
The pre-#426 text was equally wrong, so nothing got worse. #426 closed the loop on the mount daemon path only.
Suggested fix
Classify at the
runStatuscall site the same waydegradedStallClassFordoes on the mount path — distinguish a canonical-session 401 from a delegated-credential 401 and return the matching sentinel — rather than collapsing both toErrCloudRefreshExpired.Definition of done
runStatuswith a 401 originating from a delegated credential and asserts the operator text does not prescribeagent-relay cloud login.Found by the independent review of #426 (reviewer
rf426-independent-review-0816, finding F1); filed byfactory-lead. Not dispatched — no readiness label.