Pasqal device-path launcher bypasses silent re-auth — expired token fails a solve fired >24h after connect

[kateebonner]

Follow-up from #194 (keychain silent re-auth interim). Found while implementing the workaround.

Important

Problem

The amico-pasqal launcher (packages/amico-run/src/pasqal_launch.ts) reads ~/.amico/pasqal.json directly and injects the token into the connector's env. It never talks to the fork server. So the #194 silent re-auth — which lives in the server's revalidate + background-revalidation paths — does not fire for a solve. A solve submitted >~24h after connect reads an expired token and fails with the shipped assertPasqalFresh error, even though the keychain holds a password that could mint a fresh one.

Approach

Give the launcher a pre-spawn freshness step that, on an expired/absent token, asks the running fork server to re-mint (the server owns the keychain + validator), then re-reads the file. Chosen because the server is the single owner of the password and the mint path — the launcher must not grow its own keychain/ROPC.

Scope

In: launcher pre-spawn check → server re-mint request → re-read token → proceed or fail with the existing actionable error. Out: any keychain or ROPC logic in the launcher itself (stays server-side). Out: the CLI/headless case where no fork server is running — falls back to today's expired-token error (documented).

Assumptions / Open Qs

• Assumes a reachable loopback fork server during a solve. Standalone amico-pasqal with no server up cannot silently re-mint — is that acceptable (error + "reconnect in the panel"), or does the launcher need a server-less mint path? (Leaning acceptable: the panel/agent flows always have the server.)

Acceptance Criteria

1. A solve with an expired pasqal.json token, a running server, and a stored keychain password: the launcher triggers a re-mint and the connector runs with a fresh token.
2. Expired token, no server reachable: the launcher fails with the existing actionable assertPasqalFresh-class message — never a silent hang, never a partial run.
3. The password never reaches the launcher process or its argv — the mint stays entirely server-side.
4. An unexpired token path is unchanged (no new server round-trip on the hot path).

Source

• Parent: Pasqal Cloud auth: keychain silent re-auth (interim) + service account (target) — browser/device/refresh ruled out by evidence #194. Server-side re-auth: opencode fork kate/connections-path-scaffold (pasqal-secret.ts, connections.ts attemptPasqalSilentReauth). ADR 0001 addendum.