Two bugs the ABS Android/iOS client surfaces against silo:
1. WebSocket upgrade returns 400. The access-log middleware wraps
the ResponseWriter in a statusRecorder that doesn't implement
http.Hijacker, so socket.io can't take ownership of the raw
connection. Engine.io rejects the upgrade with
{"code":3,"message":"Bad request"}. Fix: add Hijack + Flush
passthroughs on statusRecorder.
2. ABS v2.26+ clients prompt "Authentication has been improved for
security in server v2.26.0. All users are required to re-login."
on every layout mount. The client check is:
if (serverConfig.token === user.token || user.isOldToken)
silo's /authorize was echoing the inbound bearer back as
user.token — equality fires, re-login forced. Fix: mint a fresh
access JWT in /authorize, persist its JTI, and return it as
user.token / accessToken. Old JTI stays valid for its natural
TTL (multi-device share-on-login). Refresh token contract
unchanged.
Verified: curl /authorize returns user.token != original bearer;
WS upgrade probe now returns HTTP 101.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
