auto: 2026-07-29_20:45 changes

3 files changed, 11 insertions, 5 deletions

diff --git a/main.html b/main.html
index 0d7d598..035c329 100644
--- a/main.html
+++ b/main.html
@@ -1345,13 +1345,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.25"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.26"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.25"></script>
+<script src="modules/core/module-loader.js?v=v4.6.26"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.25"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.26"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 256d87c..5e69094 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.25';
+    const LATEST_VER = 'v4.6.26';
     const CACHE = '?v=' + LATEST_VER;
     const stored = localStorage.getItem('webx11_cache_ver');
     if (stored !== LATEST_VER) {
diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js
index 5cacea0..310d6f3 100644
--- a/modules/ext/webdav.js
+++ b/modules/ext/webdav.js
@@ -424,7 +424,13 @@ class WebDAVModule {
         // Avoid double slash when path starts with /
         const listUrl = host + '/spaces/' + spaceName + '/__list__' + (cleanPath === '/' ? '' : cleanPath.replace(/\/{2,}/g, '/'));
         try {
-            const resp = await fetch(listUrl, { method: 'GET' });
+            // 2026-10-11: __list__ is owner-gated — send the space token when we
+            // have one; if it is stale (401/403), retry cookie-only before failing.
+            const authHeaders = this._getAuthHeader();
+            let resp = await fetch(listUrl, { method: 'GET', headers: authHeaders });
+            if ((resp.status === 401 || resp.status === 403) && Object.keys(authHeaders).length) {
+                resp = await fetch(listUrl, { method: 'GET' });
+            }
             if (!resp.ok) throw new Error('Autoindex failed: HTTP ' + resp.status);
             const html = await resp.text();
             return this._parseAutoindex(html);