Description
Every bearer bootstrap exchange minted a brand-new auth_sessions row and sessions live for 30 days, so Settings → Authorized clients fills with duplicate "T3 Code Desktop" entries from repeated desktop launches, window reloads, and dev restarts — all from a single machine.
A heavy user sees dozens of stale authorized clients, all labeled "T3 Code Desktop" on the same host.
Root cause
exchangeBootstrapCredentialForAccessToken in apps/server/src/auth/EnvironmentAuth.ts calls sessions.issue() unconditionally — no client identity key.DesktopLocalEnvironmentAuth (apps/desktop/src/backend/DesktopLocalEnvironmentAuth.ts) caches its bearer token in memory only (Ref), so every app relaunch adds a row that lingers for the 30-day TTL.- The web renderer's
clientMetadata() in apps/web/src/connection/platform.ts does the same per window reload for secondary backends.
- Nothing prunes expired or revoked rows, so
auth_sessions grows forever.
Expected behavior
- Clients present a stable per-install
client_instance_id on /oauth/token exchanges.
- Server reuses the existing compatible session (same
subject + method + instance_id): extend expiry, re-sign token against the same row. No new row on relaunch.
- Scope-widening issues a replacement and revokes the stale session.
- DPoP exchanges are exempt (key thumbprint not persisted).
- Issuance prunes expired and revoked rows.
- Wire format is additive: clients that never send
client_instance_id behave exactly as before.
Patch
Managed via fh as fix-auth-stop-accumulating-authorized-client-sessi-p5zy3k6c:
POST /oauth/token now accepts optional client_instance_id (contracts + deriveAuthClientMetadata + http handler)- Migration
041_AuthSessionClientInstanceId adds auth_sessions.client_instance_id
SessionStore.issue implements reuse-or-rotate + piggyback pruning- Desktop persists
<stateDir>/client-instance-id, web uses localStorage, mobile uses secure storage
Verify:
pnpm exec vp test run apps/server/src/auth/SessionStore.test.ts
pnpm exec vp test run apps/server/src/server.test.ts -t "collapses repeated token exchanges"
Manual: pair once, restart the desktop app repeatedly — Settings → Authorized clients shows exactly one "T3 Code Desktop" row.
Tracking
Description
Every bearer bootstrap exchange minted a brand-new
auth_sessionsrow and sessions live for 30 days, so Settings → Authorized clients fills with duplicate "T3 Code Desktop" entries from repeated desktop launches, window reloads, and dev restarts — all from a single machine.A heavy user sees dozens of stale authorized clients, all labeled "T3 Code Desktop" on the same host.
Root cause
exchangeBootstrapCredentialForAccessTokeninapps/server/src/auth/EnvironmentAuth.tscallssessions.issue()unconditionally — no client identity key.DesktopLocalEnvironmentAuth(apps/desktop/src/backend/DesktopLocalEnvironmentAuth.ts) caches its bearer token in memory only (Ref), so every app relaunch adds a row that lingers for the 30-day TTL.clientMetadata()inapps/web/src/connection/platform.tsdoes the same per window reload for secondary backends.auth_sessionsgrows forever.Expected behavior
client_instance_idon/oauth/tokenexchanges.subject+method+instance_id): extend expiry, re-sign token against the same row. No new row on relaunch.client_instance_idbehave exactly as before.Patch
Managed via
fhasfix-auth-stop-accumulating-authorized-client-sessi-p5zy3k6c:POST /oauth/tokennow accepts optionalclient_instance_id(contracts +deriveAuthClientMetadata+ http handler)041_AuthSessionClientInstanceIdaddsauth_sessions.client_instance_idSessionStore.issueimplements reuse-or-rotate + piggyback pruning<stateDir>/client-instance-id, web useslocalStorage, mobile uses secure storageVerify:
Manual: pair once, restart the desktop app repeatedly — Settings → Authorized clients shows exactly one "T3 Code Desktop" row.
Tracking
fix-auth-stop-accumulating-authorized-client-sessi-p5zy3k6cin ImBIOS/.forkhubfix/auth-client-session-rotationandfix-auth-stop-accumulating-authorized-client-sessi