[burnmandont]

Signing out of T3 Connect could clear a second connection runtime while the routed UI kept displaying account-owned Relay environments. The app registry provider now wraps the optional managed-auth shell and routed app together, so cleanup updates the catalog the UI reads. Independently authenticated direct routes remain available.

Maintainer takeover of @burnmandont’s original contribution, preserving the contributor commits and merging current main. The one-off bootstrap test was consolidated into the existing managed-auth suite: 3 tests across 2 files (186 lines) → 3 tests in 1 file (156 lines). The regression boots the production provider tree, signs out, and observes Relay removal while retaining a direct entry. It fails against main’s provider placement. The focused auth and real registry suites pass together: 48 tests; scoped web typecheck, touched lint, formatting and whitespace checks pass. Auth suite output. Independent full-diff Claude Opus 5.5 and Codex GPT-6 Sol reviews found no blockers in one round.

Verified in headless Linux Chromium against isolated worktree data: actual web bootstrap, auth cleanup, runtime catalog and Connections settings. A test-only Clerk provider simulates sign-out; Relay and direct entries are synthetic and intentionally offline. Both captures show the signed-out state at 1280×800 with identical data and scroll. The browser uses an injected fallback font because the container lacks the app font. Baseline production sources are from main 1451e7cb23; after is current head f6d7d750b3. No fixture or evidence assets are committed.

Before — signed out, Relay entry remains

After — signed out, Relay removed and independent direct entry retained

Sign-out recording on the rebuilt head

Live OAuth, account switching with real accounts, relay/tunnel connectivity, Electron desktop, macOS, Windows, iOS and Android were not verified. Browser and Electron shell selection and cloudless startup were reviewed; mobile already owns its separate outer registry boundary. Macroscope requires human approval for the managed-auth lifecycle change. This PR remains unmerged.

Implementation: Codex GPT-6.1 Sol; tests: Codex GPT-6 Astra (high); review: Claude Opus 5.5 and Codex GPT-6 Sol, through T3 Code delegated tasks. Integrated and verified in T3 Code using the Codex harness.

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This focused fix moves the existing atom registry boundary so sign-out cleanup removes account-owned Relay connections from the same catalog rendered by the UI, with a dedicated regression test. Because it changes managed authentication/sign-out lifecycle behavior in production, human review is warranted.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4ff1261b-6281-43ce-8908-3cf0f7d6198a

📥 Commits

Reviewing files that changed from the base of the PR and between 46c0413 and f6d7d75.

📒 Files selected for processing: 2

• apps/web/src/cloud/managedAuth.test.ts
• apps/web/src/main.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

AppAtomRegistryProvider now wraps the managed-auth shell or fallback app at the entry point instead of wrapping routed UI and browser components in AppRoot. An integration test checks that signing out removes the Relay environment from the rendered catalog and leaves the direct environment.

Changes: App provider scope

Layer / File(s)	Summary
Provider scope and auth cleanup test apps/web/src/main.tsx, apps/web/src/AppRoot.tsx, apps/web/src/cloud/managedAuth.test.ts	The app entry point wraps the managed-auth shell or fallback app in AppAtomRegistryProvider, while AppRoot no longer wraps its children in that provider. The integration test verifies that sign-out cleanup removes the Relay catalog entry while retaining the direct entry.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge, t3dotgg

Merge Risk: ⚪ Minimal · up to f6d7d

The app and managed-auth cleanup share the connection registry, and the sign-out test protects that behavior. No merge-blocking issue was identified.

Security architecture risk: ⚪ Minimal · up to f6d7d

The change makes sign-out update the connection catalog displayed by the app. Reviewed authentication and cleanup paths preserve independently authenticated connections, with no material security risk found to be introduced or worsened.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed authority is limited to managed-auth cleanup operating on the connection registry already used by the current application instance. The provider move does not itself add credentials, remote callers, or backend privileges.

Trust Boundaries and Controls

• observed — Managed session identity comes from the authentication provider. Sign-out clears that session before cleanup can fail, while direct-route authentication remains separate; retaining a direct entry therefore does not grant continued managed Relay authentication.

Resilience and Maintainability Implications

• observed — Catalog commands use serial scheduling, and route removal holds an environment lease lock across its decision and mutation. Cleanup can partially complete across environments on failure; this existing behavior is not a global transaction, but authentication deactivation does not wait for its success.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: signing out now clears the connection catalog used by the UI.
Description check		The description covers the problem, implementation, maintainer approval, focused verification, screenshots, recording, limitations, and test evidence. It is mostly complete despite not using the templ…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the problem, implementation, maintainer approval, focused verification, screenshots, recording, limitations, and test evidence. It is mostly complete despite not using the template headings explicitly.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Taking over this one as maintainer for batch ssh-relay-remote-06. I will preserve the contributor commits, verify the auth/provider boundary against current main, and add independent tests and adversarial review. Thanks @burnmandont for identifying the mismatched connection-catalog registry.

[juliusmarminge]

Thanks @burnmandont for identifying the sign-out catalog mismatch. #24974 (6016969887) now runs Relay cleanup against the same app registry used by the routed UI; independent direct connections are preserved. Closing as already covered on main.