@@ -52,6 +52,31 @@ describe("K8sClient onUnauthorized (401) handling", () => {
     expect(onUnauthorized).toHaveBeenCalledTimes(1)
   })
 
+  it("re-arms the latch after a success so a later 401 handles again", async () => {
+    const onUnauthorized = vi.fn()
+    const responses = [
+      unauthorized(),
+      fakeResponse({ body: JSON.stringify({ kind: "Pod" }) }),
+      unauthorized(),
+    ]
+    let call = 0
+    vi.stubGlobal("fetch", vi.fn(async () => responses[call++]))
+    const client = new K8sClient({ onUnauthorized })
+
+    // A 2xx in between means the session recovered, so the next expiry is a
+    // new episode. Without the re-arm a custom in-page handler would fire
+    // once for the client's whole lifetime.
+    await expect(client.get("", "v1", "pods", "p", "ns")).rejects.toThrow(
+      K8sApiError,
+    )
+    await client.get("", "v1", "pods", "p", "ns")
+    await expect(client.get("", "v1", "pods", "p", "ns")).rejects.toThrow(
+      K8sApiError,
+    )
+
+    expect(onUnauthorized).toHaveBeenCalledTimes(2)
+  })
+
   it("does not invoke onUnauthorized on a non-401 error", async () => {
     const onUnauthorized = vi.fn()
     vi.stubGlobal(
 
@@ -86,6 +86,10 @@ export class K8sClient {
       throw new K8sApiError(res.status, body)
     }
 
+    // A 2xx means the session is alive again, so re-arm the latch: the default
+    // handler navigates away, but a custom one may re-auth in place.
+    this.unauthorizedHandled = false
+
     if (res.status === 204) return undefined as T
     // Some endpoints (e.g. KubeVirt action subresources like
     // virtualmachines/{name}/restart) return 2xx with an empty body;
@@ -282,6 +286,7 @@ export class K8sClient {
             await res.json().catch(() => res.statusText),
           )
         }
+        this.unauthorizedHandled = false
         if (!res.body) throw new Error("No response body for watch")
 
         const reader = res.body.getReader()
Original file line number	Diff line number	Diff line change
`@@ -86,6 +86,10 @@ export class K8sClient {`
`86`	`86`	`throw new K8sApiError(res.status, body)`
`87`	`87`	`}`
`88`	`88`
	`89`	`+ // A 2xx means the session is alive again, so re-arm the latch: the default`
	`90`	`+ // handler navigates away, but a custom one may re-auth in place.`
	`91`	`+ this.unauthorizedHandled = false`
	`92`	`+`
`89`	`93`	`if (res.status === 204) return undefined as T`
`90`	`94`	`// Some endpoints (e.g. KubeVirt action subresources like`
`91`	`95`	`// virtualmachines/{name}/restart) return 2xx with an empty body;`
`@@ -282,6 +286,7 @@ export class K8sClient {`
`282`	`286`	`await res.json().catch(() => res.statusText),`
`283`	`287`	`)`
`284`	`288`	`}`
	`289`	`+ this.unauthorizedHandled = false`
`285`	`290`	`if (!res.body) throw new Error("No response body for watch")`
`286`	`291`
`287`	`292`	`const reader = res.body.getReader()`