Repository navigation
fix(orca-profiles): tell the renderer when a cloud session is revoked - #18694
Conversation
A revoked refresh-token family makes the main process clear the stored cloud session, but the renderer cached orcaProfileAuthStatus at startup and only re-fetched when it was empty. The account card kept showing "Connected" and Mobile pairing kept showing a generic Relay failure until the user restarted the app. - Push: clearing a session on an auth failure now emits an invalidation event that broadcasts orcaProfiles:authStatusChanged to every window; the renderer re-reads auth status from it. Explicit sign-out is unchanged. - Pull: every pane that renders auth state re-reads it on mount through useOrcaProfileAuthStatusRefresh instead of only when the store is empty. - Copy: a Relay mint failure re-reads auth status, and the failure notice says the session expired and to sign in again instead of offering a retry that cannot succeed. The LAN path is untouched.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
- Main-process push on revocation —
clearCloudSessionIfUnchangednow callsemitOrcaCloudSessionInvalidated()after actually clearing the session, wired to a newORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNELbroadcast across every liveBrowserWindow. Explicit sign-out is correctly excluded (it already returns the fresh status), and the emit is deliberately not routed throughonAuthMutationso it cannot re-enter the relay coordinator that just failed the refresh. - Renderer re-fetch bridge —
orca-profile-auth-ipc-bridgesubscribes to the push and re-reads auth status, guarded bytypeof subscribe !== 'function'so older preloads and the web client degrade to a noop. - Mount-time re-fetch hook —
useOrcaProfileAuthStatusRefreshreplaces the oldif (!authStatus)fetch guards on the account, mobile pairing, share-skills, artifacts, and dev-tools surfaces. It depends only on the stablefetchOrcaProfileAuthStatusstore action, so StrictMode cannot loop it. - Pairing copy — a
relay_mint_failedresult re-reads auth status; withreconnect-requiredthe notice switches to the "session expired" copy and hides the Retry button.
The change is well-scoped, and the tests pin the real regressions: the StrictMode "exactly 2 fetches" assertion (a genuine loop guard), the event→refetch→status-flip bridge test, and the 401-clears vs. rotation-race unit tests. The two-path design (broadcast for already-mounted surfaces + mount fetch for surfaces that mount after a revocation) cleanly closes the gap it targets.
DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏
📝 WalkthroughWalkthroughThe change adds cloud session invalidation notifications and broadcasts auth-status changes through Electron IPC. The preload and renderer layers subscribe to these events and refresh the application auth state. Settings surfaces use a shared refresh hook. Relay pairing refreshes auth status after mint failures and displays reconnect-specific guidance. Tests cover invalidation, IPC registration, store updates, and reconnect-required behavior. Merge Risk: 🟡 Moderate · up to After a revoked Relay session, both mobile pairing surfaces can remove the session-expired guidance instead of prompting the user to sign in again. These reachable regressions should be fixed before merge. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
Full details: Description checkExplanation The description explains the problem, changes, scope, and tests, but it omits several required template sections, including ELI5, Linked Issue, Visual Proof, Review, Agent skill upstream boundary, Notes, and Checklist. Resolution Add all required template sections. Include a linked issue after "Fixes #"; add Visual Proof with screenshots or videos, or write "N/A" with a reason; complete Testing with manual-test and automated-test details and platforms; complete AI Disclosure when applicable; complete Review, Agent skill upstream boundary, Notes, and Checklist; and add a concise ELI5 section. Full details: Docstring CoverageExplanation Docstring coverage is 30.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 20 functions across 26 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Team
Run ID: 5a2d148f-cadf-4403-80fd-33de0286eefe
📒 Files selected for processing (27)
src/main/ipc/orca-profile-auth-status-broadcast.tssrc/main/ipc/orca-profiles.tssrc/main/orca-profiles/profile-cloud-session-invalidation.tssrc/main/orca-profiles/profile-cloud-session-refresh.test.tssrc/main/orca-profiles/profile-cloud-session-refresh.tssrc/preload/api/orca-profile-api.tssrc/preload/api/orca-profiles-bridge.tssrc/renderer/src/components/mobile/MobilePage.test.tsxsrc/renderer/src/components/mobile/MobilePage.tsxsrc/renderer/src/components/mobile/mobile-relay-mint-failure-notice.tsxsrc/renderer/src/components/mobile/use-mobile-pairing-generation.tssrc/renderer/src/components/settings/ArtifactsSettingsPane.tsxsrc/renderer/src/components/settings/DevToolsPane.tsxsrc/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsxsrc/renderer/src/components/settings/MobilePairingConnectionOptions.tsxsrc/renderer/src/components/settings/MobilePane.test.tsxsrc/renderer/src/components/settings/MobilePane.tsxsrc/renderer/src/components/settings/OrcaAccountSettingsPane.tsxsrc/renderer/src/components/settings/ShareSkillsSettingsPane.tsxsrc/renderer/src/hooks/ipc-events/app-lifetime-ipc-bridge.tssrc/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.tssrc/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.tssrc/renderer/src/hooks/use-orca-profile-auth-status-refresh.tssrc/renderer/src/hooks/useIpcEvents-lifecycle.test.tssrc/renderer/src/i18n/locales/en.jsonsrc/renderer/src/web/preload-api/web-orca-profiles-api.tssrc/shared/orca-profiles.ts
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.
| setPairingQrError(false) | ||
| if (result.reason === 'relay_mint_failed' && result.relayFailure) { | ||
| setRelayMintFailure(result.relayFailure) | ||
| refreshAuthStatus() | ||
| } else { | ||
| setRelayMintFailure(null) | ||
| // Why: IPC now forwards reason/guidance for all unavailability paths; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve the Relay failure in MobilePage during auth invalidation. After relay_mint_failed, refreshAuthStatus() changes signedIn to false, and useMobilePairingQrInvalidation clears relayMintFailure while invalidating the stale QR. This removes the failure notice instead of retaining the sign-in guidance. Invalidate the QR and request state without clearing this failure until a retry succeeds or the user explicitly changes flow or connection mode.
| setRelayMintFailure(result.relayFailure) | ||
| // Why: a revoked session is the likeliest cause; re-read it so the | ||
| // notice can offer sign-in instead of a retry that cannot succeed. | ||
| void useAppStore.getState().fetchOrcaProfileAuthStatus() |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Preserve relayMintFailure during auth-driven invalidation.
When fetchOrcaProfileAuthStatus() changes signedIn to false, MobilePane calls its local invalidatePairing(). That callback clears relayMintFailure, so MobileRelayMintFailureNotice disappears before it can show session-expired guidance. Preserve the failure for this auth-refresh path while clearing stale QR/request state, and keep clearing it for unrelated path changes.
…stablyai#18694) A revoked refresh-token family makes the main process clear the stored cloud session, but the renderer cached orcaProfileAuthStatus at startup and only re-fetched when it was empty. The account card kept showing "Connected" and Mobile pairing kept showing a generic Relay failure until the user restarted the app. - Push: clearing a session on an auth failure now emits an invalidation event that broadcasts orcaProfiles:authStatusChanged to every window; the renderer re-reads auth status from it. Explicit sign-out is unchanged. - Pull: every pane that renders auth state re-reads it on mount through useOrcaProfileAuthStatusRefresh instead of only when the store is empty. - Copy: a Relay mint failure re-reads auth status, and the failure notice says the session expired and to sign in again instead of offering a retry that cannot succeed. The LAN path is untouched.
Why
When a background refresh gets a 401 (revoked or rotated-away refresh token), main clears the stored cloud session but the renderer keeps the auth status it cached at startup. The account card shows Connected and the Mobile pairing pane shows Orca Relay: Unavailable with a Retry button that can never succeed, until the app is restarted. On 2026-09-04 ~21,600 desktops sat in that state for hours (
cloud/docs/relay-reconnect-2026-09-findings.md, desktop UX finding).What
clearCloudSessionIfUnchangedemits a session-invalidated event after it actually clears; a new IPC channel broadcasts to every live window and the renderer re-fetches auth status. Explicit sign-out does not emit (it already returns the fresh status). Deliberately not routed throughonAuthMutation: that drives the relay coordinator, which is the caller that just failed the refresh.relay_mint_failedresult re-reads auth status; withreconnect-requiredthe notice says "Your Orca account session expired. Sign in again to use Orca Relay, or use LAN…" and hides Retry. LAN path untouched.Tests
MobilePairingConnectionOptions.test.tsx: mounts under StrictMode with a staleconnectedstore while IPC returnsreconnect-required; asserts the "Sign in again for Relay" button and exactly 2 fetches. Verified failing on the pre-fix guard.orca-profile-auth-ipc-bridge.test.ts: event → refetch → status flips; unsubscribe honored.profile-cloud-session-refresh.test.ts: 401 clear notifies; rotation race does not.Gates:
pnpm tc,typecheck:tsc:node/web,check:code-quality:changed,check:react-doctor:changed,verify:localization-catalog,verify:localization-coverageall pass.Scope note
This does not help desktops already hit by the 2026-09-04 incident: their session was cleared before this code existed, so they still need a restart to see the sign-in prompt. It fixes every future revocation.