fix(transport): reconnect used a fresh handshake token but a stale signaling one

Found live: every reconnect attempt failed "Signaling failed: 401 Invalid
or expired token", looping for 4+ minutes with no chance of ever
succeeding. connect() takes one token but uses it in two places — the
handshake sent to the node, and the Authorization header on the signaling
POST to the hub — and only the constructor's original `this._accessToken`
was ever used for the latter. onNeedToken correctly fetches a fresh token
for each reconnect attempt, but it only ever reached the handshake; the
signaling call kept sending whatever token the transport was constructed
with, no matter how many minutes had passed or how many attempts fetched
a new one.

connect() now updates this._accessToken on every call, reconnects included,
so both places use the same current token.

1 files changed, 9 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 35f729e..9f85ee1 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -305,6 +305,15 @@ class MeshBayTransport {
     // "failed" — see the pc.onconnectionstatechange handler further down.
     this._connectArgs = { nodeId, groupId, gekRaw, bundleKey, username, userId, joinCode };
     this._lastToken = jwtToken;
+    // The constructor sets this once from whatever token the caller had at
+    // the time — and the signaling POST below reads *this*, not `jwtToken`.
+    // A reconnect passes a freshly-fetched `jwtToken` (see onNeedToken) but
+    // that never reached here before, so the signaling call kept using the
+    // original token no matter how many minutes had passed or how many
+    // reconnect attempts fetched a new one — confirmed live: every attempt
+    // failed "Signaling failed: 401 Invalid or expired token" in a loop,
+    // never actually trying the fresh token connect() had just been handed.
+    this._accessToken = jwtToken;
     this._gekRaw = gekRaw || null;
     this._sessionKeys = sessionKeys || null;
     this._bundleKey = bundleKey || null;