Can Mercurial Detect and Handle Expired SSH or HTTP Credentials Without Requiring a New Connection?

Answer

Mercurial does not have a built‑in way to detect or refresh expired SSH or HTTP credentials during an ongoing push or pull. It relies entirely on the underlying transport (SSH client or HTTP library) to perform authentication once per command, and it will abort the operation when that transport reports an authentication failure.

Likely explanation

Because Mercurial delegates authentication to the transport layer, it only sees the result of that authentication after the transport has already succeeded or failed. There is no internal checkpoint where Mercurial can query the credential’s freshness before invoking the transport, and its hook system runs only after authentication succeeds, so hooks cannot pre‑empt a credential expiry.

Confirmed facts (from research)

• Mercurial performs authentication once per command; no retry logic attempts to refresh credentials without reconnecting.
• Hooks such as pretxnchangegroup, incoming, or outgoing execute after transport authentication succeeds and therefore cannot be used to check credential freshness beforehand.
• When credentials expire, the transport aborts and returns an error; Mercurial receives this as a transport failure and must retry after re‑authentication, which requires a new connection.
• No officially supported extension or experimental feature in the stable 6.x series allows Mercurial to intercept a transport error, trigger a credential refresh, and resume the same network session.

Steps to verify the behavior

1. Configure an SSH repository where the key or password expires after a short time (e.g., using ssh-agent with a timeout).
2. Start a large push (hg push) and observe that the operation fails with an authentication error once the credential expires.
3. Repeat with an HTTP repository using a credential helper that returns a short‑lived token; verify that the push/pull aborts when the token expires and that no mid‑session refresh occurs without a new connection.

If you are using an SSH agent that can reload keys without tearing down the underlying socket, note that Mercurial still sees the original authentication as valid until the transport reports an error; the agent’s internal refresh does not change Mercurial’s behavior.

Missing diagnostic detail

To determine whether a specific SSH implementation keeps the connection alive while reloading keys, you would need to know the exact SSH client version and its keep‑alive/rekey behavior. This detail only changes the recommendation if you rely on that client’s ability to maintain a session; otherwise, the conclusion remains that Mercurial cannot handle credential expiration without reconnecting.