From 6fe4a66e98adf722a56bf185a0a8f2083f13dcb2 Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Thu, 15 Oct 2026 05:00:13 +0200
Subject: auto: 2026-07-29_20:45 changes

---
 main.html                     | 6 +++---
 modules/core/module-loader.js | 2 +-
 modules/ext/webdav.js         | 8 +++++++-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/main.html b/main.html
index 0d7d598..035c329 100644
--- a/main.html
+++ b/main.html
@@ -1345,13 +1345,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.25"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.26"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.25"></script>
+<script src="modules/core/module-loader.js?v=v4.6.26"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.25"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.26"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 256d87c..5e69094 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.25';
+    const LATEST_VER = 'v4.6.26';
     const CACHE = '?v=' + LATEST_VER;
     const stored = localStorage.getItem('webx11_cache_ver');
     if (stored !== LATEST_VER) {
diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js
index 5cacea0..310d6f3 100644
--- a/modules/ext/webdav.js
+++ b/modules/ext/webdav.js
@@ -424,7 +424,13 @@ class WebDAVModule {
         // Avoid double slash when path starts with /
         const listUrl = host + '/spaces/' + spaceName + '/__list__' + (cleanPath === '/' ? '' : cleanPath.replace(/\/{2,}/g, '/'));
         try {
-            const resp = await fetch(listUrl, { method: 'GET' });
+            // 2026-10-11: __list__ is owner-gated — send the space token when we
+            // have one; if it is stale (401/403), retry cookie-only before failing.
+            const authHeaders = this._getAuthHeader();
+            let resp = await fetch(listUrl, { method: 'GET', headers: authHeaders });
+            if ((resp.status === 401 || resp.status === 403) && Object.keys(authHeaders).length) {
+                resp = await fetch(listUrl, { method: 'GET' });
+            }
             if (!resp.ok) throw new Error('Autoindex failed: HTTP ' + resp.status);
             const html = await resp.text();
             return this._parseAutoindex(html);
-- 
cgit v1.2.3