Function install_token_slot

crates/openshell-core/src/grpc_client.rs:83–94

(token: &str)

}

fn install_token_slot(token: &str) -> Result<TokenSlot> {
    let bearer = AsciiMetadataValue::try_from(format!("Bearer {token}"))
        .into_diagnostic()
        .wrap_err("sandbox JWT contained characters not valid for a header value")?;
    if let Some(existing) = TOKEN_SLOT.get() {
        *existing.write().expect("token slot poisoned") = bearer;
        return Ok(existing.clone());
    }
    let slot: TokenSlot = Arc::new(RwLock::new(bearer));
    let _ = TOKEN_SLOT.set(slot.clone());
    Ok(TOKEN_SLOT.get().cloned().unwrap_or(slot))
}

/// gRPC interceptor that injects `authorization: Bearer <token>` on every
/// outbound request. The token lives in a shared [`TokenSlot`] so the renewal