fix(web): refresh T3 Connect switch after startup reconcile

apps/web/src/cloud/connectOnboarding.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import {
+  resolveOnboardingManagedTunnelActive,
+  resolveOnboardingReconcileDesired,
+  shouldSyncOnboardingToggleFromLinkState,
+} from "./connectOnboarding";
+
+describe("shouldSyncOnboardingToggleFromLinkState", () => {
+  it("resyncs an untouched toggle for the account being onboarded", () => {
+    expect(
+      shouldSyncOnboardingToggleFromLinkState({
+        touched: false,
+        openForAccount: "user-1",
+        linked: true,
+        cloudUserId: "user-1",
+      }),
+    ).toBe(true);
+  });
+
+  it("does not overwrite a toggle the user has already changed", () => {
+    expect(
+      shouldSyncOnboardingToggleFromLinkState({
+        touched: true,
+        openForAccount: "user-1",
+        linked: true,
+        cloudUserId: "user-1",
+      }),
+    ).toBe(false);
+  });
+
+  it("ignores link state from another account", () => {
+    expect(
+      shouldSyncOnboardingToggleFromLinkState({
+        touched: false,
+        openForAccount: "user-1",
+        linked: true,
+        cloudUserId: "user-2",
+      }),
+    ).toBe(false);
+  });
+
+  it("does not sync when the wizard is closed or the environment is unlinked", () => {
+    expect(
+      shouldSyncOnboardingToggleFromLinkState({
+        touched: false,
+        openForAccount: null,
+        linked: true,
+        cloudUserId: "user-1",
+      }),
+    ).toBe(false);
+    expect(
+      shouldSyncOnboardingToggleFromLinkState({
+        touched: false,
+        openForAccount: "user-1",
+        linked: false,
+        cloudUserId: "user-1",
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("resolveOnboardingManagedTunnelActive", () => {
+  it("uses the current tunnel only when the cached link belongs to this account", () => {
+    expect(
+      resolveOnboardingManagedTunnelActive({
+        managedTunnelActive: true,
+        cloudUserId: "user-1",
+        openForAccount: "user-1",
+      }),
+    ).toBe(true);
+  });
+
+  it("ignores a previous account's active tunnel after an account switch", () => {
+    expect(
+      resolveOnboardingManagedTunnelActive({
+        managedTunnelActive: true,
+        cloudUserId: "user-1",
+        openForAccount: "user-2",
+      }),
+    ).toBe(false);
+    expect(
+      resolveOnboardingReconcileDesired({
+        exposeEnvironment: false,
+        publishAgentActivity: true,
+        managedTunnelActive: resolveOnboardingManagedTunnelActive({
+          managedTunnelActive: true,
+          cloudUserId: "user-1",
+          openForAccount: "user-2",
+        }),
+      }),
+    ).toEqual({ managedTunnel: false, publish: true });
+  });
+});
+
+describe("resolveOnboardingReconcileDesired", () => {
+  it("does not tear down an active tunnel after a stale inactive prefill", () => {
+    expect(
+      resolveOnboardingReconcileDesired({
+        exposeEnvironment: false,
+        publishAgentActivity: true,
+        managedTunnelActive: true,
+      }),
+    ).toEqual({ managedTunnel: true, publish: true });
+  });
+
+  it("skips reconcile when nothing would be enabled", () => {
+    expect(
+      resolveOnboardingReconcileDesired({
+        exposeEnvironment: false,
+        publishAgentActivity: false,
+        managedTunnelActive: false,
+      }),
+    ).toBeNull();
+  });
+
+  it("does not rewrite publish when both toggles are off and a tunnel is already active", () => {
+    expect(
+      resolveOnboardingReconcileDesired({
+        exposeEnvironment: false,
+        publishAgentActivity: false,
+        managedTunnelActive: true,
+      }),
+    ).toBeNull();
+  });
+
+  it("keeps an explicit request to enable the managed tunnel", () => {
+    expect(
+      resolveOnboardingReconcileDesired({
+        exposeEnvironment: true,
+        publishAgentActivity: false,
+        managedTunnelActive: false,
+      }),
+    ).toEqual({ managedTunnel: true, publish: false });
+  });
+});

apps/web/src/cloud/connectOnboarding.ts

@@ -16,3 +16,45 @@ export type ConnectOnboardingOptOutState = typeof ConnectOnboardingOptOutSchema.
 export const EMPTY_CONNECT_ONBOARDING_OPT_OUT_STATE: ConnectOnboardingOptOutState = {
   optOutAccounts: [],
 };
+
+export function shouldSyncOnboardingToggleFromLinkState(input: {
+  readonly touched: boolean;
+  readonly openForAccount: string | null;
+  readonly linked: boolean;
+  readonly cloudUserId: string | null;
+}): boolean {
+  return (
+    !input.touched &&
+    input.openForAccount !== null &&
+    input.linked &&
+    input.cloudUserId === input.openForAccount
+  );
+}
+
+// controller.managedTunnelActive is environment-global. After an account
+// switch the cached link can still belong to the previous user — only treat
+// it as this wizard's tunnel when the linked user matches.
+export function resolveOnboardingManagedTunnelActive(input: {
+  readonly managedTunnelActive: boolean;
+  readonly cloudUserId: string | null | undefined;
+  readonly openForAccount: string | null;
+}): boolean {
+  return input.cloudUserId === input.openForAccount ? input.managedTunnelActive : false;
+}
+
+// The wizard only ever enables. Both toggles off means skip — do not unlink,
+// downgrade, or rewrite publish. A stale expose=false after startup
+// reconcile must also not submit publish_only and tear the tunnel down.
+export function resolveOnboardingReconcileDesired(input: {
+  readonly exposeEnvironment: boolean;
+  readonly publishAgentActivity: boolean;
+  readonly managedTunnelActive: boolean;
+}): { readonly managedTunnel: boolean; readonly publish: boolean } | null {
+  if (!input.exposeEnvironment && !input.publishAgentActivity) {
+    return null;
+  }
+  return {
+    managedTunnel: input.exposeEnvironment || input.managedTunnelActive,
+    publish: input.publishAgentActivity,
+  };
+}

apps/web/src/cloud/primaryCloudLinkState.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+
+import type { CloudLinkTarget } from "./linkEnvironment";
+import {
+  __resetStartupCloudLinkRefreshForTests,
+  CONNECTIONS_CLOUD_LINK_RETRY_BUDGET_MS,
+  resolveManagedTunnelActive,
+  scheduleStartupReconcileLinkStateRefresh,
+  shouldContinueConnectionsCloudLinkRetry,
+  STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS,
+  stopStartupReconcileLinkStateRefresh,
+} from "./primaryCloudLinkState";
+
+const TARGET: CloudLinkTarget = {
+  environmentId: "environment-1",
+  label: "Desktop",
+  httpBaseUrl: "http://127.0.0.1:3000",
+  wsBaseUrl: "ws://127.0.0.1:3000",
+};
+
+describe("resolveManagedTunnelActive", () => {
+  it("falls back to linked when older servers omit managedTunnelActive", () => {
+    expect(resolveManagedTunnelActive({ linked: true })).toBe(true);
+    expect(resolveManagedTunnelActive({ linked: false })).toBe(false);
+  });
+
+  it("does not treat a publish-only or pre-reconcile link as an active tunnel", () => {
+    expect(resolveManagedTunnelActive({ linked: true, managedTunnelActive: false })).toBe(false);
+  });
+
+  it("is inactive when link state has not loaded", () => {
+    expect(resolveManagedTunnelActive(null)).toBe(false);
+    expect(resolveManagedTunnelActive(undefined)).toBe(false);
+  });
+});
+
+describe("shouldContinueConnectionsCloudLinkRetry", () => {
+  it("stops once the managed tunnel is active", () => {
+    expect(shouldContinueConnectionsCloudLinkRetry(0, true)).toBe(false);
+  });
+
+  it("retries while inactive inside the budget and stops after it", () => {
+    expect(shouldContinueConnectionsCloudLinkRetry(0, false)).toBe(true);
+    expect(
+      shouldContinueConnectionsCloudLinkRetry(CONNECTIONS_CLOUD_LINK_RETRY_BUDGET_MS - 1, false),
+    ).toBe(true);
+    expect(
+      shouldContinueConnectionsCloudLinkRetry(CONNECTIONS_CLOUD_LINK_RETRY_BUDGET_MS, false),
+    ).toBe(false);
+  });
+});
+
+describe("scheduleStartupReconcileLinkStateRefresh", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    __resetStartupCloudLinkRefreshForTests();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    __resetStartupCloudLinkRefreshForTests();
+  });
+
+  it("replaces a startup-stale inactive switch across the bounded refresh series", () => {
+    let state: { linked: boolean; managedTunnelActive?: boolean } = {
+      linked: true,
+      managedTunnelActive: false,
+    };
+    const refresh = vi.fn(() => {
+      if (refresh.mock.calls.length >= 2) {
+        state = { linked: true, managedTunnelActive: true };
+      }
+    });
+
+    expect(resolveManagedTunnelActive(state)).toBe(false);
+    expect(scheduleStartupReconcileLinkStateRefresh(TARGET, refresh)).toBe(true);
+    expect(scheduleStartupReconcileLinkStateRefresh(TARGET, refresh)).toBe(false);
+
+    vi.advanceTimersByTime(STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[0] - 1);
+    expect(refresh).not.toHaveBeenCalled();
+    expect(resolveManagedTunnelActive(state)).toBe(false);
+
+    vi.advanceTimersByTime(1);
+    expect(refresh).toHaveBeenCalledTimes(1);
+    expect(resolveManagedTunnelActive(state)).toBe(false);
+
+    vi.advanceTimersByTime(
+      STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[1] -
+        STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[0],
+    );
+    expect(refresh).toHaveBeenCalledTimes(2);
+    expect(resolveManagedTunnelActive(state)).toBe(true);
+
+    vi.advanceTimersByTime(
+      STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[2] -
+        STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[1],
+    );
+    expect(refresh).toHaveBeenCalledTimes(3);
+    expect(refresh).toHaveBeenNthCalledWith(1, TARGET);
+    expect(refresh).toHaveBeenNthCalledWith(2, TARGET);
+    expect(refresh).toHaveBeenNthCalledWith(3, TARGET);
+  });
+
+  it("cancels remaining startup refreshes once the tunnel is active", () => {
+    const refresh = vi.fn();
+    expect(scheduleStartupReconcileLinkStateRefresh(TARGET, refresh)).toBe(true);
+
+    vi.advanceTimersByTime(STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[0]);
+    expect(refresh).toHaveBeenCalledTimes(1);
+
+    stopStartupReconcileLinkStateRefresh(TARGET);
+    vi.advanceTimersByTime(STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[2]);
+    expect(refresh).toHaveBeenCalledTimes(1);
+    expect(scheduleStartupReconcileLinkStateRefresh(TARGET, refresh)).toBe(false);
+  });
+
+  it("does not schedule without a target", () => {
+    const refresh = vi.fn();
+    expect(scheduleStartupReconcileLinkStateRefresh(null, refresh)).toBe(false);
+    vi.advanceTimersByTime(STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[2]);
+    expect(refresh).not.toHaveBeenCalled();
+  });
+
+  it("schedules a separate follow-up for a different environment", () => {
+    const refresh = vi.fn();
+    const otherTarget = { ...TARGET, environmentId: "environment-2" };
+
+    expect(scheduleStartupReconcileLinkStateRefresh(TARGET, refresh)).toBe(true);
+    expect(scheduleStartupReconcileLinkStateRefresh(otherTarget, refresh)).toBe(true);
+
+    vi.advanceTimersByTime(STARTUP_CLOUD_LINK_RECONCILE_REFRESH_DELAYS_MS[0]);
+    expect(refresh).toHaveBeenCalledTimes(2);
+    expect(refresh).toHaveBeenNthCalledWith(1, TARGET);
+    expect(refresh).toHaveBeenNthCalledWith(2, otherTarget);
+  });
+});