Function connect_channel

crates/openshell-core/src/grpc_client.rs:195–209

Build a Bearer-authenticated channel to the gateway. First call per process resolves the sandbox JWT via the three-step lookup (env → file → K8s SA bootstrap exchange) and installs it into the process-wide [`TOKEN_SLOT`]. Subsequent calls reuse the cached slot — the renewal loop keeps the value fresh, so re-running the bootstrap is both unnecessary and (on the K8s SA path) expensive (one apiserve

(endpoint: &str)

/// (one apiserver round-trip per call). The renewal loop itself is
/// spawned once per process via [`REFRESH_SPAWNED`].
async fn connect_channel(endpoint: &str) -> Result<AuthedChannel> {
    let channel = build_plain_channel(endpoint).await?;
    let (slot, refresh_mode) = token_slot(endpoint, &channel).await?;
    let plain_channel = channel.clone();
    let intercepted = InterceptedService::new(channel, AuthInterceptor::new(slot.clone()));
    if REFRESH_SPAWNED.set(()).is_ok() {
        let RefreshMode::GatewayJwt(source) = refresh_mode;
        let refresh_channel = intercepted.clone();
        let endpoint = endpoint.to_string();
        tokio::spawn(async move {
            refresh_token_loop(refresh_channel, slot, source, endpoint, plain_channel).await;
        });
    }
    Ok(intercepted)
}

async fn token_slot(endpoint: &str, plain_channel: &Channel) -> Result<(TokenSlot, RefreshMode)> {
    if let Some(existing) = TOKEN_SLOT.get() {