Reset primary env state and re-auth on backend swap

When the desktop swaps backends (Windows / WSL), each backend has a
separate environment-id, separate sqlite, and separate session-signing
key. Without explicit handling, the renderer kept the previous backend's
threads/projects in the store and sent the previous backend's session
cookie, which the new backend rejected with 401 — leaving the UI showing
stale data and the WS connection unable to upgrade.

- store: add a clearPrimaryEnvironmentState action that drops the
  previous env's slice from environmentStateById on identity change.
  Unset activeEnvironmentId if it pointed at the cleared env. Aggregate
  selectors iterate the remaining entries directly.

- __root.tsx: track the last-seen primary env id in a ref and reconcile
  on every welcome / config event. On identity change: dispose the prior
  EnvironmentConnection, clear its store slice, and navigate the user
  off any /<oldEnvId>/<threadId> route they were sitting on. Bind
  startServerStateSync to the live primary id so it follows the swap.

- auth: add reauthenticatePrimaryEnvironment() that re-runs the desktop
  bootstrap exchange against the new backend so the renderer holds a
  cookie signed by the live key. Without this, every subsequent HTTP
  request and the WS upgrade itself 401, since /ws on desktop primary
  authenticates via session cookie (no wsToken query param). Bump
  BOOTSTRAP_RETRY_TIMEOUT_MS from 15s to 60s to cover cold WSL launches.

- runtime/{connection,service}: thread a reportLifecycleEvents option
  through dispose() so suppressed swaps do not churn the connection-status
  UI; add disconnectPrimaryEnvironment for the renderer to call when it
  reconciles env identity.

- rpc/{wsConnectionState,protocol,wsTransport,wsRpcClient}: introduce
  suppressWsConnectionLifecycle so the settings handler can stop
  reporting connect/disconnect events to the connection-status atom
  during the deliberate swap window. The lifecycle gate consults a
  shouldReportLifecycleEvent hook composed with the existing handlers.

- ProjectFavicon: render the placeholder folder icon when the env's
  HTTP base URL is briefly unavailable (e.g. during a swap) instead of
  building an invalid src URL.

Author: Jgratton24

apps/web/src/components/ProjectFavicon.tsx

@@ -1,7 +1,7 @@
 import type { EnvironmentId } from "@t3tools/contracts";
 import { FolderIcon } from "lucide-react";
 import { useState } from "react";
-import { resolveEnvironmentHttpUrl } from "../environments/runtime";
+import { getEnvironmentHttpBaseUrl } from "../environments/runtime";
 
 const loadedProjectFaviconSrcs = new Set<string>();
 
@@ -10,32 +10,38 @@ export function ProjectFavicon(input: {
   cwd: string;
   className?: string;
 }) {
-  const src = resolveEnvironmentHttpUrl({
-    environmentId: input.environmentId,
-    pathname: "/api/project-favicon",
-    searchParams: { cwd: input.cwd },
-  });
+  const httpBaseUrl = getEnvironmentHttpBaseUrl(input.environmentId);
+  const src = httpBaseUrl
+    ? (() => {
+        const url = new URL(httpBaseUrl);
+        url.pathname = "/api/project-favicon";
+        url.search = new URLSearchParams({ cwd: input.cwd }).toString();
+        return url.toString();
+      })()
+    : null;
   const [status, setStatus] = useState<"loading" | "loaded" | "error">(() =>
-    loadedProjectFaviconSrcs.has(src) ? "loaded" : "loading",
+    src && loadedProjectFaviconSrcs.has(src) ? "loaded" : "loading",
   );
 
   return (
     <>
-      {status !== "loaded" ? (
+      {status !== "loaded" || !src ? (
         <FolderIcon
           className={`size-3.5 shrink-0 text-muted-foreground/50 ${input.className ?? ""}`}
         />
       ) : null}
-      <img
-        src={src}
-        alt=""
-        className={`size-3.5 shrink-0 rounded-sm object-contain ${status === "loaded" ? "" : "hidden"} ${input.className ?? ""}`}
-        onLoad={() => {
-          loadedProjectFaviconSrcs.add(src);
-          setStatus("loaded");
-        }}
-        onError={() => setStatus("error")}
-      />
+      {src ? (
+        <img
+          src={src}
+          alt=""
+          className={`size-3.5 shrink-0 rounded-sm object-contain ${status === "loaded" ? "" : "hidden"} ${input.className ?? ""}`}
+          onLoad={() => {
+            loadedProjectFaviconSrcs.add(src);
+            setStatus("loaded");
+          }}
+          onError={() => setStatus("error")}
+        />
+      ) : null}
     </>
   );
 }

apps/web/src/environments/primary/auth.ts

@@ -152,7 +152,7 @@ async function waitForAuthenticatedSessionAfterBootstrap(): Promise<AuthSessionS
 }
 
 const TRANSIENT_BOOTSTRAP_STATUS_CODES = new Set([502, 503, 504]);
-const BOOTSTRAP_RETRY_TIMEOUT_MS = 15_000;
+const BOOTSTRAP_RETRY_TIMEOUT_MS = 60_000;
 const BOOTSTRAP_RETRY_STEP_MS = 500;
 
 export async function retryTransientBootstrap<T>(operation: () => Promise<T>): Promise<T> {
@@ -231,6 +231,24 @@ export async function submitServerAuthCredential(credential: string): Promise<vo
   stripPairingTokenFromUrl();
 }
 
+/**
+ * Re-runs the desktop bootstrap exchange so the renderer holds a session cookie
+ * signed by the *current* backend's key. Required after a backend swap (e.g.
+ * Windows ↔ WSL), since each backend uses a distinct session-signing key, so
+ * cookies issued by the previous backend are rejected with 401 by the new one.
+ */
+export async function reauthenticatePrimaryEnvironment(): Promise<void> {
+  const credential = getDesktopBootstrapCredential();
+  if (!credential) {
+    throw new Error("Desktop bootstrap credential is unavailable.");
+  }
+
+  resolvedAuthenticatedGateState = null;
+  bootstrapPromise = null;
+  await exchangeBootstrapCredential(credential);
+  await waitForAuthenticatedSessionAfterBootstrap();
+}
+
 export async function createServerPairingCredential(
   label?: string,
 ): Promise<AuthPairingCredentialResult> {

apps/web/src/environments/primary/context.ts

@@ -109,6 +109,13 @@ export function resolveInitialPrimaryEnvironmentDescriptor(): Promise<ExecutionE
   });
 }
 
+export async function refreshPrimaryEnvironmentDescriptor(): Promise<ExecutionEnvironmentDescriptor> {
+  primaryEnvironmentDescriptorPromise = null;
+  const descriptor = await fetchPrimaryEnvironmentDescriptor();
+  writePrimaryEnvironmentDescriptor(descriptor);
+  return descriptor;
+}
+
 export function __resetPrimaryEnvironmentBootstrapForTests(): void {
   primaryEnvironmentDescriptorPromise = null;
   usePrimaryEnvironmentBootstrapStore.getState().reset();

apps/web/src/environments/primary/index.ts

@@ -1,6 +1,7 @@
 export {
   getPrimaryKnownEnvironment,
   readPrimaryEnvironmentDescriptor,
+  refreshPrimaryEnvironmentDescriptor,
   resetPrimaryEnvironmentDescriptorForTests,
   resolveInitialPrimaryEnvironmentDescriptor,
   usePrimaryEnvironmentId,
@@ -20,6 +21,7 @@ export {
   listServerClientSessions,
   listServerPairingLinks,
   peekPairingTokenFromUrl,
+  reauthenticatePrimaryEnvironment,
   resolveInitialServerAuthGateState,
   revokeOtherServerClientSessions,
   revokeServerClientSession,

apps/web/src/environments/runtime/connection.ts

@@ -17,7 +17,7 @@ export interface EnvironmentConnection {
   readonly client: WsRpcClient;
   readonly ensureBootstrapped: () => Promise<void>;
   readonly reconnect: () => Promise<void>;
-  readonly dispose: () => Promise<void>;
+  readonly dispose: (options?: { readonly reportLifecycleEvents?: boolean }) => Promise<void>;
 }
 
 interface OrchestrationHandlers {
@@ -165,9 +165,9 @@ export function createEnvironmentConnection(
         throw error;
       }
     },
-    dispose: async () => {
+    dispose: async (options) => {
       cleanup();
-      await input.client.dispose();
+      await input.client.dispose(options);
     },
   };
 }

apps/web/src/environments/runtime/index.ts

@@ -17,6 +17,7 @@ export {
 export {
   addSavedEnvironment,
   disconnectSavedEnvironment,
+  disconnectPrimaryEnvironment,
   ensureEnvironmentConnectionBootstrapped,
   getPrimaryEnvironmentConnection,
   readEnvironmentConnection,

apps/web/src/environments/runtime/service.ts

@@ -870,7 +870,10 @@ function registerConnection(connection: EnvironmentConnection): EnvironmentConne
   return connection;
 }
 
-async function removeConnection(environmentId: EnvironmentId): Promise<boolean> {
+async function removeConnection(
+  environmentId: EnvironmentId,
+  options?: { readonly reportLifecycleEvents?: boolean },
+): Promise<boolean> {
   const connection = environmentConnections.get(environmentId);
   if (!connection) {
     return false;
@@ -880,7 +883,7 @@ async function removeConnection(environmentId: EnvironmentId): Promise<boolean>
   lastAppliedProjectionVersionByEnvironment.delete(environmentId);
   environmentConnections.delete(environmentId);
   emitEnvironmentConnectionRegistryChange();
-  await connection.dispose();
+  await connection.dispose(options);
   return true;
 }
 
@@ -1045,6 +1048,15 @@ export async function disconnectSavedEnvironment(environmentId: EnvironmentId):
   await removeConnection(environmentId).catch(() => false);
 }
 
+export async function disconnectPrimaryEnvironment(environmentId: EnvironmentId): Promise<void> {
+  const connection = environmentConnections.get(environmentId);
+  if (connection?.kind !== "primary") {
+    return;
+  }
+
+  await removeConnection(environmentId, { reportLifecycleEvents: false }).catch(() => false);
+}
+
 export async function reconnectSavedEnvironment(environmentId: EnvironmentId): Promise<void> {
   const record = getSavedEnvironmentRecord(environmentId);
   if (!record) {

apps/web/src/routes/__root.tsx

@@ -1,4 +1,4 @@
-import { type ServerLifecycleWelcomePayload } from "@t3tools/contracts";
+import { type EnvironmentId, type ServerLifecycleWelcomePayload } from "@t3tools/contracts";
 import { scopedProjectKey, scopeProjectRef } from "@t3tools/client-runtime";
 import {
   Outlet,
@@ -44,15 +44,18 @@ import { useStore } from "../store";
 import { useUiStateStore } from "../uiStateStore";
 import { syncBrowserChromeTheme } from "../hooks/useTheme";
 import {
+  disconnectPrimaryEnvironment,
   ensureEnvironmentConnectionBootstrapped,
   getPrimaryEnvironmentConnection,
   startEnvironmentConnectionService,
 } from "../environments/runtime";
 import { configureClientTracing } from "../observability/clientTracing";
 import {
   ensurePrimaryEnvironmentReady,
+  readPrimaryEnvironmentDescriptor,
   resolveInitialServerAuthGateState,
   updatePrimaryEnvironmentDescriptor,
+  usePrimaryEnvironmentId,
 } from "../environments/primary";
 
 export const Route = createRootRouteWithContext<{
@@ -187,7 +190,12 @@ function errorDetails(error: unknown): string {
 }
 
 function ServerStateBootstrap() {
-  useEffect(() => startServerStateSync(getPrimaryEnvironmentConnection().client.server), []);
+  const primaryEnvironmentId = usePrimaryEnvironmentId();
+
+  useEffect(
+    () => startServerStateSync(getPrimaryEnvironmentConnection().client.server),
+    [primaryEnvironmentId],
+  );
 
   return null;
 }
@@ -222,11 +230,31 @@ function EventRouter() {
   const handledBootstrapThreadIdRef = useRef<string | null>(null);
   const seenServerConfigUpdateIdRef = useRef(getServerConfigUpdatedNotification()?.id ?? 0);
   const disposedRef = useRef(false);
+  const primaryEnvironmentIdRef = useRef<EnvironmentId | null>(
+    readPrimaryEnvironmentDescriptor()?.environmentId ?? null,
+  );
   const serverConfig = useServerConfig();
 
+  const reconcilePrimaryEnvironment = useEffectEvent((nextEnvironmentId: EnvironmentId) => {
+    const previousEnvironmentId = primaryEnvironmentIdRef.current;
+    primaryEnvironmentIdRef.current = nextEnvironmentId;
+    if (!previousEnvironmentId || previousEnvironmentId === nextEnvironmentId) {
+      return;
+    }
+
+    void disconnectPrimaryEnvironment(previousEnvironmentId);
+    useStore.getState().clearPrimaryEnvironmentState(previousEnvironmentId);
+
+    const routeEnvironmentId = readPathname().split("/").filter(Boolean)[0] ?? null;
+    if (routeEnvironmentId === previousEnvironmentId) {
+      void navigate({ to: "/", replace: true });
+    }
+  });
+
   const handleWelcome = useEffectEvent((payload: ServerLifecycleWelcomePayload | null) => {
     if (!payload) return;
 
+    reconcilePrimaryEnvironment(payload.environment.environmentId);
     updatePrimaryEnvironmentDescriptor(payload.environment);
     setActiveEnvironmentId(payload.environment.environmentId);
     void (async () => {
@@ -339,9 +367,10 @@ function EventRouter() {
       return;
     }
 
+    reconcilePrimaryEnvironment(serverConfig.environment.environmentId);
     updatePrimaryEnvironmentDescriptor(serverConfig.environment);
     setActiveEnvironmentId(serverConfig.environment.environmentId);
-  }, [serverConfig, setActiveEnvironmentId]);
+  }, [reconcilePrimaryEnvironment, serverConfig, setActiveEnvironmentId]);
 
   useEffect(() => {
     disposedRef.current = false;

apps/web/src/rpc/protocol.ts

@@ -14,6 +14,7 @@ import {
   recordWsConnectionClosed,
   recordWsConnectionErrored,
   recordWsConnectionOpened,
+  isWsConnectionLifecycleSuppressed,
   WS_RECONNECT_MAX_RETRIES,
 } from "./wsConnectionState";
 
@@ -22,6 +23,7 @@ export interface WsProtocolLifecycleHandlers {
   readonly onOpen?: () => void;
   readonly onError?: (message: string) => void;
   readonly onClose?: (details: { readonly code: number; readonly reason: string }) => void;
+  readonly shouldReportLifecycleEvent?: () => boolean;
 }
 
 export const makeWsRpcProtocolClient = RpcClient.make(WsRpcGroup);
@@ -59,31 +61,47 @@ function defaultLifecycleHandlers(): Required<WsProtocolLifecycleHandlers> {
       clearAllTrackedRpcRequests();
       recordWsConnectionClosed(details);
     },
+    shouldReportLifecycleEvent: () => !isWsConnectionLifecycleSuppressed(),
   };
 }
 
 function composeLifecycleHandlers(
   handlers?: WsProtocolLifecycleHandlers,
 ): Required<WsProtocolLifecycleHandlers> {
   const defaults = defaultLifecycleHandlers();
+  const shouldReportLifecycleEvent = () =>
+    defaults.shouldReportLifecycleEvent() && handlers?.shouldReportLifecycleEvent?.() !== false;
 
   return {
     onAttempt: (socketUrl) => {
+      if (!shouldReportLifecycleEvent()) {
+        return;
+      }
       defaults.onAttempt(socketUrl);
       handlers?.onAttempt?.(socketUrl);
     },
     onOpen: () => {
+      if (!shouldReportLifecycleEvent()) {
+        return;
+      }
       defaults.onOpen();
       handlers?.onOpen?.();
     },
     onError: (message) => {
+      if (!shouldReportLifecycleEvent()) {
+        return;
+      }
       defaults.onError(message);
       handlers?.onError?.(message);
     },
     onClose: (details) => {
+      if (!shouldReportLifecycleEvent()) {
+        return;
+      }
       defaults.onClose(details);
       handlers?.onClose?.(details);
     },
+    shouldReportLifecycleEvent,
   };
 }
 

apps/web/src/rpc/wsConnectionState.ts

@@ -48,6 +48,8 @@ const INITIAL_WS_CONNECTION_STATUS = Object.freeze<WsConnectionStatus>({
   socketUrl: null,
 });
 
+let wsConnectionLifecycleSuppressionDepth = 0;
+
 export const wsConnectionStatusAtom = Atom.make(INITIAL_WS_CONNECTION_STATUS).pipe(
   Atom.keepAlive,
   Atom.withLabel("ws-connection-status"),
@@ -153,6 +155,25 @@ export function resetWsConnectionStateForTests(): void {
   appAtomRegistry.set(wsConnectionStatusAtom, INITIAL_WS_CONNECTION_STATUS);
 }
 
+export function resetWsConnectionState(): void {
+  appAtomRegistry.set(wsConnectionStatusAtom, INITIAL_WS_CONNECTION_STATUS);
+}
+
+export function isWsConnectionLifecycleSuppressed(): boolean {
+  return wsConnectionLifecycleSuppressionDepth > 0;
+}
+
+export async function suppressWsConnectionLifecycle<T>(operation: () => Promise<T>): Promise<T> {
+  wsConnectionLifecycleSuppressionDepth += 1;
+  resetWsConnectionState();
+  try {
+    return await operation();
+  } finally {
+    wsConnectionLifecycleSuppressionDepth -= 1;
+    resetWsConnectionState();
+  }
+}
+
 export function useWsConnectionStatus(): WsConnectionStatus {
   return useAtomValue(wsConnectionStatusAtom);
 }