fix(connect): disconnect the local host before signing out

apps/server/src/cli/connect.ts

@@ -313,7 +313,7 @@ const runLiveCloudUnlink = Effect.fn("cloud.cli.run_live_unlink")(function* () {
         baseUrl: runtimeState.value.origin,
       }).pipe(
         Effect.flatMap((client) =>
-          client.connect.unlink({ headers: { authorization: `Bearer ${token}` } }),
+          client.connect.unlink({ headers: { authorization: `Bearer ${token}` }, query: {} }),
         ),
         Effect.timeout(CLOUD_CLI_LIVE_SERVER_TIMEOUT),
       ),

apps/server/src/cloud/CloudLink.lifecycle.test.ts

@@ -138,6 +138,7 @@ describe("releaseManagedTunnelOnShutdown", () => {
     readonly address?: HttpServer.HttpServer["Service"]["address"];
     readonly respondEffect?: Effect.Effect<Response>;
     readonly getExisting?: CliTokenManager.CloudCliTokenManager["Service"]["getExisting"];
+    readonly beforeLinkStateLock?: Effect.Effect<void>;
   }
 
   const writeLauncherState = (update: ServiceUpdateRecord) =>
@@ -200,7 +201,10 @@ describe("releaseManagedTunnelOnShutdown", () => {
             tunnelConnected: Stream.empty,
             inspectConnector: Effect.succeed(null),
             readinessChanged: Stream.empty,
-            withLinkStateLock: (effect) => effect,
+            withLinkStateLock: (effect) =>
+              harness.beforeLinkStateLock
+                ? harness.beforeLinkStateLock.pipe(Effect.andThen(effect))
+                : effect,
           }),
         ),
         Effect.provideService(
@@ -248,6 +252,78 @@ describe("releaseManagedTunnelOnShutdown", () => {
     [CLOUD_CLI_DESIRED_LINK_SECRET, "managed"],
   ] as const;
 
+  it.effect(
+    "account unlink stops the connector and prevents startup from recreating its link",
+    () => {
+      const { store, values } = makeMemorySecretStore([
+        ...managedLinkSecrets,
+        [CLOUD_LINKED_USER_ID, "user-123"],
+        [RELAY_ENVIRONMENT_CREDENTIAL_SECRET, "environment-credential"],
+      ]);
+      const applyConfigCalls: Array<unknown> = [];
+      const requests: Array<HttpClientRequest.HttpClientRequest> = [];
+
+      return Effect.gen(function* () {
+        const link = yield* CloudLink.CloudLink;
+        yield* link.unlink("user-123");
+
+        expect(applyConfigCalls).toEqual([null]);
+        expect(values.has(CLOUD_LINKED_USER_ID)).toBe(false);
+        expect(values.has(CLOUD_ENDPOINT_RUNTIME_CONFIG)).toBe(false);
+        expect(values.has(RELAY_ENVIRONMENT_CREDENTIAL_SECRET)).toBe(false);
+        expect(values.has(CLOUD_CLI_DESIRED_LINK_SECRET)).toBe(false);
+        expect(yield* link.reconcileDesiredLinkIfStillDesired("http://127.0.0.1:3773")).toBeNull();
+        expect(requests).toEqual([]);
+      }).pipe(provideReleaseHarness({ store, applyConfigCalls, requests }));
+    },
+  );
+
+  it.effect(
+    "a delayed account unlink preserves a host relinked before it acquired the lock",
+    () => {
+      const { store, values } = makeMemorySecretStore([
+        ...managedLinkSecrets,
+        [CLOUD_LINKED_USER_ID, "user-123"],
+      ]);
+      const applyConfigCalls: Array<unknown> = [];
+      const requests: Array<HttpClientRequest.HttpClientRequest> = [];
+
+      return Effect.gen(function* () {
+        const link = yield* CloudLink.CloudLink;
+        const error = yield* link.unlink("user-123").pipe(Effect.flip);
+
+        expect(error._tag).toBe("CloudLinkAccountMismatchError");
+        expect(applyConfigCalls).toEqual([]);
+        expect(values.has(CLOUD_CLI_DESIRED_LINK_SECRET)).toBe(true);
+        expect(values.has(CLOUD_ENDPOINT_RUNTIME_CONFIG)).toBe(true);
+        expect(new TextDecoder().decode(values.get(CLOUD_LINKED_USER_ID))).toBe("other-user");
+      }).pipe(
+        provideReleaseHarness({
+          store,
+          applyConfigCalls,
+          requests,
+          beforeLinkStateLock: store
+            .set(CLOUD_LINKED_USER_ID, new TextEncoder().encode("other-user"))
+            .pipe(Effect.orDie),
+        }),
+      );
+    },
+  );
+
+  it.effect("legacy unlink still stops a host without specifying its account", () => {
+    const { store, values } = makeMemorySecretStore(managedLinkSecrets);
+    const applyConfigCalls: Array<unknown> = [];
+    const requests: Array<HttpClientRequest.HttpClientRequest> = [];
+
+    return Effect.gen(function* () {
+      const link = yield* CloudLink.CloudLink;
+      yield* link.unlink();
+
+      expect(applyConfigCalls).toEqual([null]);
+      expect(values.has(CLOUD_CLI_DESIRED_LINK_SECRET)).toBe(false);
+    }).pipe(provideReleaseHarness({ store, applyConfigCalls, requests }));
+  });
+
   it.effect("does not recreate a link that was unlinked while startup registration retried", () => {
     const { store, values } = makeMemorySecretStore(managedLinkSecrets);
     const applyConfigCalls: Array<unknown> = [];

apps/server/src/cloud/CloudLink.ts

@@ -452,7 +452,12 @@ export class CloudLink extends Context.Service<
       EnvironmentCloudLinkStateResult,
       CloudLinkInternalError
     >;
-    readonly unlink: () => Effect.Effect<EnvironmentCloudRelayConfigResult, CloudLinkInternalError>;
+    readonly unlink: (
+      expectedCloudUserId?: string,
+    ) => Effect.Effect<
+      EnvironmentCloudRelayConfigResult,
+      CloudLinkInternalError | CloudLinkAccountMismatchError
+    >;
     readonly updatePreferences: (
       input: EnvironmentCloudPreferencesRequest,
     ) => Effect.Effect<
@@ -1309,9 +1314,18 @@ const make = Effect.gen(function* () {
   );
 
   const unlink = Effect.fn("environment.cloud.unlink")(
-    function* () {
+    function* (expectedCloudUserId?: string) {
       return yield* endpointRuntime.withLinkStateLock(
         Effect.gen(function* () {
+          if (expectedCloudUserId !== undefined) {
+            const linkedUser = yield* secrets.get(CLOUD_LINKED_USER_ID);
+            if (
+              Option.isNone(linkedUser) ||
+              bytesToString(linkedUser.value) !== expectedCloudUserId
+            ) {
+              return yield* new CloudLinkAccountMismatchError({});
+            }
+          }
           const endpointRuntimeStatus = yield* endpointRuntime.applyConfig(null);
           yield* Effect.all(
             [

apps/server/src/cloud/http.ts

@@ -132,9 +132,9 @@ export const layer = HttpApiBuilder.group(
       .handle("checkReachability", () =>
         requireEnvironmentScope(AuthRelayReadScope).pipe(Effect.andThen(reachability.check)),
       )
-      .handle("unlink", () =>
+      .handle("unlink", ({ query }) =>
         requireEnvironmentScope(AuthRelayWriteScope).pipe(
-          Effect.andThen(toHttpError(cloudLink.unlink())),
+          Effect.andThen(toHttpError(cloudLink.unlink(query.expectedCloudUserId))),
         ),
       )
       .handle("preferences", ({ payload }) =>

apps/web/src/cloud/linkEnvironment.test.ts

@@ -25,7 +25,11 @@ import { ManagedRelay } from "@t3tools/client-runtime/relay";
 import { layerRemoteHttpClient } from "@t3tools/client-runtime/rpc";
 import { __resetDesktopPrimaryAuthForTests } from "../environments/primary/desktopAuth";
 
-import { readPrimaryCloudLinkState, type CloudLinkTarget } from "./linkEnvironment";
+import {
+  readPrimaryCloudLinkState,
+  unlinkPrimaryEnvironmentFromCloud,
+  type CloudLinkTarget,
+} from "./linkEnvironment";
 
 const TARGET: CloudLinkTarget = {
   environmentId: "environment-1",
@@ -145,6 +149,93 @@ afterEach(() => {
 });
 
 describe("web cloud link environment client", () => {
+  it.effect(
+    "unlinks without relay-read access before deregistering the account from the relay",
+    () =>
+      Effect.gen(function* () {
+        const fetchMock = vi
+          .fn()
+          .mockImplementation((input: RequestInfo | URL, init?: RequestInit) => {
+            const request = new Request(input, init);
+            return Promise.resolve(
+              request.method === "GET"
+                ? Response.json(
+                    { _tag: "EnvironmentHttpForbiddenError", message: "Missing relay:read" },
+                    { status: 403 },
+                  )
+                : Response.json({ ok: true, endpointRuntimeStatus: { status: "disabled" } }),
+            );
+          });
+        vi.stubGlobal("fetch", fetchMock);
+        vi.stubGlobal("window", { location: { origin: "http://127.0.0.1:3000" } });
+
+        yield* withServices(
+          unlinkPrimaryEnvironmentFromCloud({
+            target: TARGET,
+            clerkToken: "clerk-token",
+            expectedCloudUserId: "user-1",
+          }),
+        );
+
+        const requests = fetchMock.mock.calls.map(([input, init]) => new Request(input, init));
+        expect(requests.map((request) => [request.method, new URL(request.url).pathname])).toEqual([
+          ["POST", "/api/connect/unlink"],
+          ["DELETE", "/v1/client/environment-links/environment-1"],
+        ]);
+        expect(new URL(requests[0]!.url).searchParams.get("expectedCloudUserId")).toBe("user-1");
+        expect(requests[1]!.headers.get("authorization")).toBe("Bearer clerk-token");
+      }),
+  );
+
+  it.effect("skips relay deregistration when guarded unlink reports an account mismatch", () =>
+    Effect.gen(function* () {
+      const fetchMock = vi
+        .fn()
+        .mockResolvedValue(
+          Response.json(
+            { _tag: "EnvironmentHttpConflictError", message: "Account mismatch" },
+            { status: 409 },
+          ),
+        );
+      vi.stubGlobal("fetch", fetchMock);
+      vi.stubGlobal("window", { location: { origin: "http://127.0.0.1:3000" } });
+
+      yield* withServices(
+        unlinkPrimaryEnvironmentFromCloud({
+          target: TARGET,
+          clerkToken: "clerk-token",
+          expectedCloudUserId: "user-1",
+        }),
+      );
+
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      const request = new Request(fetchMock.mock.calls[0]![0], fetchMock.mock.calls[0]![1]);
+      expect(request.method).toBe("POST");
+      expect(new URL(request.url).searchParams.get("expectedCloudUserId")).toBe("user-1");
+    }),
+  );
+
+  it.effect("preserves conflict failures for unguarded unlink", () =>
+    Effect.gen(function* () {
+      const fetchMock = vi
+        .fn()
+        .mockResolvedValue(
+          Response.json(
+            { _tag: "EnvironmentHttpConflictError", message: "Unlink conflict" },
+            { status: 409 },
+          ),
+        );
+      vi.stubGlobal("fetch", fetchMock);
+      vi.stubGlobal("window", { location: { origin: "http://127.0.0.1:3000" } });
+
+      const error = yield* withServices(
+        unlinkPrimaryEnvironmentFromCloud({ target: TARGET, clerkToken: "clerk-token" }),
+      ).pipe(Effect.flip);
+
+      expect(error.message).toContain("Unlink conflict");
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    }),
+  );
   it.effect("uses desktop bearer auth for primary cloud link state", () =>
     Effect.gen(function* () {
       const fetchMock = vi.fn().mockResolvedValue(

apps/web/src/cloud/linkEnvironment.ts

@@ -220,18 +220,34 @@ export const updatePrimaryCloudPreferences: (input: {
 export const unlinkPrimaryEnvironmentFromCloud: (input: {
   readonly target: CloudLinkTarget;
   readonly clerkToken: string | null;
+  readonly expectedCloudUserId?: string;
 }) => Effect.Effect<
   void,
   CloudEnvironmentLinkError,
   HttpClient.HttpClient | ManagedRelay.ManagedRelayClient
 > = Effect.fn("linkEnvironment.unlinkPrimaryEnvironmentFromCloud")(function* (input: {
   readonly target: CloudLinkTarget;
   readonly clerkToken: string | null;
+  readonly expectedCloudUserId?: string;
 }) {
   const client = yield* makeEnvironmentHttpApiClient(input.target.httpBaseUrl);
-  yield* client.connect
-    .unlink({ headers: {} })
-    .pipe(Effect.mapError(environmentApiError("Could not unlink the environment from cloud.")));
+  const unlinked = yield* client.connect
+    .unlink({
+      headers: {},
+      query:
+        input.expectedCloudUserId === undefined
+          ? {}
+          : { expectedCloudUserId: input.expectedCloudUserId },
+    })
+    .pipe(
+      Effect.catchTags({
+        // Guarded unlink conflicts mean this host is outside the departing account's scope.
+        EnvironmentHttpConflictError: (error) =>
+          input.expectedCloudUserId === undefined ? Effect.fail(error) : Effect.succeed(null),
+      }),
+      Effect.mapError(environmentApiError("Could not unlink the environment from cloud.")),
+    );
+  if (unlinked === null) return;
 
   const configuredRelayUrl = relayUrl();
   if (configuredRelayUrl && input.clerkToken) {

apps/web/src/cloud/linkEnvironmentAtoms.ts

@@ -33,8 +33,11 @@ export const unlinkPrimaryEnvironment = createRuntimeCommand(connectionAtomRunti
   label: "web:cloud:unlink-primary-environment",
   scheduler: cloudLinkScheduler,
   concurrency: cloudLinkConcurrency,
-  execute: (input: { readonly target: CloudLinkTarget; readonly clerkToken: string | null }) =>
-    unlinkPrimaryEnvironmentFromCloud(input),
+  execute: (input: {
+    readonly target: CloudLinkTarget;
+    readonly clerkToken: string | null;
+    readonly expectedCloudUserId?: string;
+  }) => unlinkPrimaryEnvironmentFromCloud(input),
 });
 
 export const updatePrimaryEnvironmentPreferences = createRuntimeCommand(connectionAtomRuntime, {

apps/web/src/components/clerk/T3ConnectSidebarSignIn.tsx

@@ -1,10 +1,11 @@
 import { UserButton, useAuth } from "@clerk/react";
-import { LogInIcon } from "lucide-react";
+import { LogInIcon, LogOutIcon } from "lucide-react";
 
 import { hasCloudPublicConfig } from "../../cloud/publicConfig";
 import { SidebarMenu, SidebarMenuButton, SidebarMenuItem } from "../ui/sidebar";
 import { T3_CONNECT_ACCOUNT_PAGES } from "./T3ConnectAccountPages";
 import { useT3ConnectAuthPrompt } from "./useT3ConnectAuthPrompt";
+import { useT3ConnectSignOut } from "./useT3ConnectSignOut";
 
 export function T3ConnectSidebarSignIn() {
   if (!hasCloudPublicConfig()) return null;
@@ -20,6 +21,7 @@ export function T3ConnectSidebarAvatar() {
 
 function ConfiguredT3ConnectSidebarAvatar() {
   const { isLoaded, isSignedIn } = useAuth();
+  const { signOut, signOutAll, hasOtherSessions } = useT3ConnectSignOut();
 
   if (!isLoaded || !isSignedIn) return null;
 
@@ -30,9 +32,22 @@ function ConfiguredT3ConnectSidebarAvatar() {
           avatarBox: "size-7",
           // Clerk's unlayered trigger reset (padding, radius, background) beats layered utilities.
           userButtonTrigger: "mb-1! rounded-lg! p-1! hover:bg-sidebar-row-hover!",
+          // Host cleanup must finish before Clerk removes the session or navigates away.
+          userButtonPopoverActionButton__signOut: { display: "none" },
+          userButtonPopoverActionButton__signOutAll: { display: "none" },
         },
       }}
     >
+      <UserButton.MenuItems>
+        <UserButton.Action label="Sign out" labelIcon={<LogOutIcon />} onClick={signOut} />
+        {hasOtherSessions ? (
+          <UserButton.Action
+            label="Sign out of all accounts"
+            labelIcon={<LogOutIcon />}
+            onClick={signOutAll}
+          />
+        ) : null}
+      </UserButton.MenuItems>
       {T3_CONNECT_ACCOUNT_PAGES.map((page) => (
         <UserButton.UserProfilePage
           key={page.url}