gloomberb 0.12.0 → 0.13.2

package/src/plugins/builtin/chat/controller/channels.ts

@@ -104,12 +104,13 @@ export class ChatControllerChannels {
     return request;
   }
 
-  async refreshChatState(): Promise<void> {
+  async refreshChatState(isCurrent: () => boolean = () => true): Promise<void> {
     if (!this.options.canLoadPrivateState()) {
       await this.refreshPresence();
       return;
     }
     const state = await apiClient.getChatState();
+    if (!isCurrent()) return;
     this.channels = normalizeChannels(state.channels);
     this.onlineCount = state.onlineCount;
     for (const entry of state.channelStates) {

package/src/plugins/builtin/chat/controller/index.ts

@@ -197,9 +197,15 @@ export class ChatController {
   /** Single-flight: every open chat pane calls this on mount. */
   async refreshSession(): Promise<void> {
     if (this.sessionRefreshPromise) return this.sessionRefreshPromise;
-    const request = this.runSessionRefresh().finally(() => {
-      this.sessionRefreshPromise = null;
-    });
+    this.realtime.stopSessionRetry();
+    const request = this.runSessionRefresh()
+      .catch((error) => {
+        this.realtime.scheduleSessionRetry();
+        throw error;
+      })
+      .finally(() => {
+        this.sessionRefreshPromise = null;
+      });
     this.sessionRefreshPromise = request;
     return request;
   }
@@ -215,7 +221,8 @@ export class ChatController {
       ensureRealtimeSubscriptions: () => this.realtime.ensureRealtimeSubscriptions(),
       persistChannelState: (channelId) => this.storage.persistChannelState(channelId),
       persistSession: (sessionToken, user) => this.storage.persistSession(sessionToken, user),
-      refreshChatState: () => this.refreshChatState(),
+      refreshChatState: (isCurrent) => this.channelCatalog.refreshChatState(isCurrent),
+      scheduleSessionRetry: () => this.realtime.scheduleSessionRetry(),
       session: this.session,
       stopRealtimeSubscriptions: () => {
         this.realtime.stopRealtimeSubscriptions();
@@ -337,11 +344,12 @@ export class ChatController {
     this.appActive = appActive;
     if (!appActive) {
       this.realtime.stopVerificationPolling();
+      this.realtime.stopSessionRetry();
       return;
     }
     this.markFocusedViewsViewed();
     this.realtime.syncVerificationPolling();
-    void this.refreshChatState()
+    void this.refreshSession()
       .then(() => this.markFocusedViewsViewed())
       .catch(() => {});
   }

package/src/plugins/builtin/chat/controller/realtime.ts

@@ -1,6 +1,7 @@
 import { apiClient, type ChatNotification } from "../../../../api-client";
 import {
   SAFETY_REFRESH_MS,
+  SESSION_RETRY_MS,
   VERIFICATION_POLL_MS,
 } from "./state";
 
@@ -18,6 +19,7 @@ interface ChatControllerRealtimeOptions {
 
 export class ChatControllerRealtime {
   private verificationPollTimer: ReturnType<typeof setInterval> | null = null;
+  private sessionRetryTimer: ReturnType<typeof setTimeout> | null = null;
   private safetyRefreshTimer: ReturnType<typeof setInterval> | null = null;
   private chatNotificationUnsubscribe: (() => void) | null = null;
   private chatPresenceUnsubscribe: (() => void) | null = null;
@@ -36,6 +38,27 @@ export class ChatControllerRealtime {
     }, VERIFICATION_POLL_MS);
   }
 
+  scheduleSessionRetry(): void {
+    if (
+      this.sessionRetryTimer
+      || !this.options.getAppActive()
+      || !this.options.hasSession()
+    ) {
+      return;
+    }
+    this.sessionRetryTimer = setTimeout(() => {
+      this.sessionRetryTimer = null;
+      void this.options.refreshSession().catch(() => {});
+    }, SESSION_RETRY_MS);
+    this.sessionRetryTimer.unref?.();
+  }
+
+  stopSessionRetry(): void {
+    if (!this.sessionRetryTimer) return;
+    clearTimeout(this.sessionRetryTimer);
+    this.sessionRetryTimer = null;
+  }
+
   ensureRealtimeSubscriptions(): void {
     if (!this.chatNotificationUnsubscribe) {
       this.chatNotificationUnsubscribe = apiClient.subscribeChatNotifications((notification) => {
@@ -85,6 +108,7 @@ export class ChatControllerRealtime {
 
   stopAll(): void {
     this.stopVerificationPolling();
+    this.stopSessionRetry();
     this.stopSafetyRefresh();
     this.stopRealtimeSubscriptions();
   }

package/src/plugins/builtin/chat/controller/session-runtime.ts

@@ -1,4 +1,5 @@
 import { apiClient } from "../../../../api-client";
+import { ApiRequestError } from "../../../../api-client/errors";
 import {
   DEFAULT_CHAT_CHANNEL_ID,
   type ChannelRuntimeState,
@@ -93,7 +94,8 @@ interface RefreshChatControllerSessionOptions {
   ensureRealtimeSubscriptions: () => void;
   persistChannelState: (channelId: string) => void;
   persistSession: (sessionToken: string | null, user: ChatSessionUser | null) => void;
-  refreshChatState: () => Promise<void>;
+  refreshChatState: (isCurrent?: () => boolean) => Promise<void>;
+  scheduleSessionRetry: () => void;
   session: ChatControllerSessionState;
   stopRealtimeSubscriptions: () => void;
   stopSafetyRefresh: () => void;
@@ -110,6 +112,7 @@ export async function refreshChatControllerSession({
   persistChannelState,
   persistSession,
   refreshChatState,
+  scheduleSessionRetry,
   session,
   stopRealtimeSubscriptions,
   stopSafetyRefresh,
@@ -119,20 +122,85 @@ export async function refreshChatControllerSession({
   session.sessionToken = apiClient.getSessionToken();
   const apiSession = await apiClient.getSession();
   if (!apiSession) {
-    const persistedToken = apiClient.getSessionToken() || session.sessionToken;
-    // A 200 with no user is what /auth/get-session returns when no cookie
-    // reached the server. Desktop's backend process used to treat that as a
-    // real sign-out and persist a wiped token, so the next launch was logged
-    // out. Keep a captured native session; hard account-missing responses
-    // already clear the token inside getSession().
+    const persistedToken = apiClient.getSessionToken();
+    // A 200 with no user used to mean the desktop backend had not received the
+    // restored cookie yet, so do not discard a captured native session on that
+    // response alone. Probe another authenticated endpoint: success validates
+    // the token, a 401 proves it expired, and a transient failure keeps offline
+    // startup from signing the user out.
     if (persistedToken) {
       session.sessionToken = persistedToken;
       session.user = session.user ?? normalizeSessionUser(apiClient.getCurrentUser());
+      // getSession() clears the API client's cached user when the endpoint
+      // answers null. Keep both session views aligned while the protected
+      // request validates the preserved native credential.
+      apiClient.restoreCachedUser(session.user);
       session.sessionChecked = true;
       persistSession(session.sessionToken, session.user);
       emit();
+
+      const credentialIsCurrent = () =>
+        apiClient.getSessionToken() === persistedToken && session.sessionToken === persistedToken;
+      const handleValidationError = (error: unknown) => {
+        if (!credentialIsCurrent()) return;
+        if (error instanceof ApiRequestError && error.status === 401) {
+          apiClient.setSessionToken(null);
+          session.sessionToken = null;
+          applySignedOut();
+          return;
+        }
+        if (error instanceof ApiRequestError && error.status === 403 && session.user) {
+          session.user = { ...session.user, emailVerified: false };
+          apiClient.restoreCachedUser(session.user);
+          persistSession(session.sessionToken, session.user);
+          emit();
+          syncVerificationPolling();
+          stopSafetyRefresh();
+          stopRealtimeSubscriptions();
+          return;
+        }
+        scheduleSessionRetry();
+      };
+
+      if (!session.user?.emailVerified) {
+        try {
+          const profile = await apiClient.getAccountProfile();
+          if (!credentialIsCurrent()) return;
+          const persistedProfile = {
+            ...profile,
+            updatedAt: profile.updatedAt ?? undefined,
+          };
+          session.user = normalizeSessionUser(persistedProfile);
+          apiClient.restoreCachedUser(persistedProfile);
+          persistSession(session.sessionToken, session.user);
+          emit();
+        } catch (error) {
+          handleValidationError(error);
+          return;
+        }
+
+        if (!session.user?.emailVerified) {
+          syncVerificationPolling();
+          stopSafetyRefresh();
+          stopRealtimeSubscriptions();
+          return;
+        }
+      }
+
+      try {
+        await refreshChatState(credentialIsCurrent);
+      } catch (error) {
+        handleValidationError(error);
+        return;
+      }
+      if (!credentialIsCurrent()) return;
+
+      stopVerificationPolling();
+      ensureRealtimeSubscriptions();
+      ensureOpenChannelConnections();
       return;
     }
+    session.sessionToken = null;
     applySignedOut();
     return;
   }
@@ -152,7 +220,7 @@ export async function refreshChatControllerSession({
   if (nextUser?.emailVerified) {
     stopVerificationPolling();
     ensureRealtimeSubscriptions();
-    await refreshChatState().catch(() => {});
+    await refreshChatState().catch(() => scheduleSessionRetry());
     ensureOpenChannelConnections();
     return;
   }

package/src/plugins/builtin/chat/controller/state.ts

@@ -21,6 +21,7 @@ export const TRANSCRIPT_CACHE_POLICY = {
 };
 export const DRAFT_SYNC_DEBOUNCE_MS = 250;
 export const VERIFICATION_POLL_MS = 5_000;
+export const SESSION_RETRY_MS = 30_000;
 export const SAFETY_REFRESH_MS = 30_000;
 export const PENDING_RECONCILE_WINDOW_MS = 2 * 60_000;
 

package/src/plugins/builtin/chat/controller.test.ts

@@ -1,8 +1,16 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, jest, test } from "bun:test";
 import type { AppNotificationRequest } from "../../../types/plugin";
 import { MemoryPluginPersistence as MemoryPersistence } from "../../../test-support/plugin-persistence";
-import { apiClient, type ChatChannel, type ChatMessage, type ChatNotification } from "../../../api-client";
+import {
+  apiClient,
+  type ChatChannel,
+  type ChatMessage,
+  type ChatNotification,
+  type ChatStateResponse,
+} from "../../../api-client";
+import { ApiRequestError } from "../../../api-client/errors";
 import { ChatController } from "./controller";
+import { SESSION_RETRY_MS } from "./controller/state";
 
 const TRANSCRIPT_KIND = "channel-transcript";
 const TRANSCRIPT_KEY = "everyone";
@@ -14,6 +22,7 @@ const originalGetMessages = apiClient.getMessages.bind(apiClient);
 const originalGetChannels = apiClient.getChannels.bind(apiClient);
 const originalGetChatPresence = apiClient.getChatPresence.bind(apiClient);
 const originalGetChatState = apiClient.getChatState.bind(apiClient);
+const originalGetAccountProfile = apiClient.getAccountProfile.bind(apiClient);
 const originalUpdateChatChannelState = apiClient.updateChatChannelState.bind(apiClient);
 const originalMarkChatNotificationsDelivered = apiClient.markChatNotificationsDelivered.bind(apiClient);
 const originalSubscribeChatNotifications = apiClient.subscribeChatNotifications.bind(apiClient);
@@ -91,6 +100,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  jest.useRealTimers();
   apiClient.dispose();
   apiClient.setSessionToken(null);
   apiClient.setCookieSessionMode(false);
@@ -100,6 +110,7 @@ afterEach(() => {
   apiClient.getChannels = originalGetChannels;
   apiClient.getChatPresence = originalGetChatPresence;
   apiClient.getChatState = originalGetChatState;
+  apiClient.getAccountProfile = originalGetAccountProfile;
   apiClient.updateChatChannelState = originalUpdateChatChannelState;
   apiClient.markChatNotificationsDelivered = originalMarkChatNotificationsDelivered;
   apiClient.subscribeChatNotifications = originalSubscribeChatNotifications;
@@ -453,9 +464,15 @@ describe("ChatController", () => {
     }
   });
 
-  test("keeps a persisted native session when get-session returns no user", async () => {
+  test("validates a persisted native session through protected chat state", async () => {
     const persistence = new MemoryPersistence();
     const controller = new ChatController();
+    const directChannel: ChatChannel = {
+      id: "dm:u2",
+      name: "u2",
+      kind: "direct",
+      created_at: "2026-03-28T00:00:00.000Z",
+    };
 
     persistence.setState("session", {
       sessionToken: "token-123",
@@ -463,11 +480,22 @@ describe("ChatController", () => {
     }, { schemaVersion: 1 });
 
     controller.attachPersistence(persistence);
-    apiClient.getSession = async () => null;
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => ({
+      channels: [...SERVER_CHAT_CHANNELS, directChannel],
+      onlineCount: 0,
+      channelStates: [],
+      notifications: [],
+    });
 
     await controller.refreshSession();
 
     expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.id).toBe("u1");
+    expect(controller.getChannels()).toContainEqual(directChannel);
     expect(persistence.getState<{
       sessionToken: string;
       user: { id: string; username: string; emailVerified: boolean };
@@ -483,6 +511,232 @@ describe("ChatController", () => {
     controller.dispose();
   });
 
+  test("clears an expired persisted session when protected chat rejects it", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "expired-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.getCurrentUser()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    expect(persistence.getState("session", { schemaVersion: 1 })).toEqual({
+      sessionToken: null,
+      user: null,
+    });
+    controller.dispose();
+  });
+
+  test("clears an expired persisted session for an unverified user", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let profileRequests = 0;
+
+    persistence.setState("session", {
+      sessionToken: "expired-token",
+      user: { id: "u1", username: "vince", emailVerified: false },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getAccountProfile = async () => {
+      profileRequests += 1;
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+
+    await controller.refreshSession();
+
+    expect(profileRequests).toBe(1);
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.getCurrentUser()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    controller.dispose();
+  });
+
+  test("downgrades stale verification state when protected chat rejects it", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "token-123",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Email verification required", 403);
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.emailVerified).toBe(false);
+    expect(controller.getSnapshot().user?.emailVerified).toBe(false);
+    expect(persistence.getState<{
+      sessionToken: string;
+      user: { id: string; username: string; emailVerified: boolean };
+    }>("session", { schemaVersion: 1 })?.user.emailVerified).toBe(false);
+    controller.dispose();
+  });
+
+  test("does not let a stale validation failure clear a replacement session", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let rejectProbe: ((error: Error) => void) | null = null;
+    let markProbeStarted: (() => void) | null = null;
+    const probeStarted = new Promise<void>((resolve) => {
+      markProbeStarted = resolve;
+    });
+
+    persistence.setState("session", {
+      sessionToken: "old-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = () => new Promise((_, reject) => {
+      rejectProbe = reject;
+      markProbeStarted?.();
+    });
+
+    const refresh = controller.refreshSession();
+    await probeStarted;
+    controller.adoptSession("new-token", {
+      id: "u2",
+      username: "mara",
+      emailVerified: true,
+    });
+    rejectProbe?.(new ApiRequestError("Unauthorized", 401));
+    await refresh;
+
+    expect(apiClient.getSessionToken()).toBe("new-token");
+    expect(apiClient.getCurrentUser()?.id).toBe("u2");
+    expect(controller.getSnapshot().user?.id).toBe("u2");
+    expect(persistence.getState<{
+      sessionToken: string;
+      user: { id: string };
+    }>("session", { schemaVersion: 1 })).toMatchObject({
+      sessionToken: "new-token",
+      user: { id: "u2" },
+    });
+    controller.dispose();
+  });
+
+  test("does not apply stale chat state after a replacement session", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let resolveProbe: ((state: ChatStateResponse) => void) | null = null;
+    let markProbeStarted: (() => void) | null = null;
+    const probeStarted = new Promise<void>((resolve) => {
+      markProbeStarted = resolve;
+    });
+    const oldDirectChannel: ChatChannel = {
+      id: "dm:old-account",
+      name: "old-account",
+      kind: "direct",
+      created_at: "2026-03-28T00:00:00.000Z",
+    };
+
+    persistence.setState("session", {
+      sessionToken: "old-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = () => new Promise<ChatStateResponse>((resolve) => {
+      resolveProbe = resolve;
+      markProbeStarted?.();
+    });
+
+    const refresh = controller.refreshSession();
+    await probeStarted;
+    controller.adoptSession("new-token", {
+      id: "u2",
+      username: "mara",
+      emailVerified: true,
+    });
+    resolveProbe?.({
+      channels: [...SERVER_CHAT_CHANNELS, oldDirectChannel],
+      onlineCount: 0,
+      channelStates: [],
+      notifications: [],
+    });
+    await refresh;
+
+    expect(apiClient.getSessionToken()).toBe("new-token");
+    expect(controller.getSnapshot().user?.id).toBe("u2");
+    expect(controller.getChannels()).not.toContainEqual(oldDirectChannel);
+    controller.dispose();
+  });
+
+  test("revalidates a persisted session after an offline validation probe", async () => {
+    jest.useFakeTimers();
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "token-123",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new Error("network down");
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.id).toBe("u1");
+    expect(controller.getSnapshot().user?.id).toBe("u1");
+    expect((controller as any).realtime.sessionRetryTimer).not.toBeNull();
+
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+    jest.advanceTimersByTime(SESSION_RETRY_MS);
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    expect((controller as any).realtime.sessionRetryTimer).toBeNull();
+    controller.dispose();
+    jest.useRealTimers();
+  });
+
   test("signs out when get-session returns no user and no token is stored", async () => {
     const persistence = new MemoryPersistence();
     const controller = new ChatController();
@@ -530,6 +784,8 @@ describe("ChatController", () => {
       username: "vince",
       emailVerified: true,
     });
+    expect((controller as any).realtime.sessionRetryTimer).not.toBeNull();
+    controller.dispose();
   });
 
   test("refreshes the public transcript without requiring a session", async () => {