fix(server): prevent duplicate desktop clients after restart

[seeb1337]

Summary

• rotate access sessions minted from the reusable desktop bootstrap credential instead of accumulating a new authorized client on every exchange
• replace matching sessions transactionally so concurrent exchanges leave exactly one valid token
• preserve browser and paired-client sessions, and remove stale desktop entries on the next bootstrap exchange

Root cause

The desktop bootstrap credential is intentionally reusable, but desktop and WSL bearer credentials are cached only for the lifetime of the app process. Each restart therefore exchanged the bootstrap credential again and SessionStore persisted another 30-day bearer session without revoking the previous one.

Tests

• vp test apps/server/src/auth/SessionStore.test.ts apps/server/src/auth/EnvironmentAuth.test.ts
• vp test apps/server/src/server.test.ts apps/server/src/persistence/RepositoryErrorCorrelation.test.ts
• vp check
• vp run typecheck

---

Note

Medium Risk
Touches auth session issuance and revocation persistence, including transactional revoke-and-create for matching sessions. Scoped to desktop-bootstrap exchanges and covered by concurrent replacement tests.

Overview
Stops desktop restarts from stacking duplicate authorized clients by rotating bearer sessions minted from the reusable desktop bootstrap credential.

exchangeBootstrapCredentialForAccessToken now sets replaceActiveForSubjectAndMethod for desktop-bootstrap grants. SessionStore.issue and a new transactional AuthSessionRepository.createReplacingActive revoke matching active subject+method sessions before inserting the new one, then emit client-removed updates. Browser and other paired sessions stay intact; only the previous desktop bearer token is invalidated.

^{Reviewed by Cursor Bugbot for commit b0f4893. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent duplicate desktop clients by revoking prior bearer sessions on reconnect

• When a desktop client exchanges a bootstrap token for a bearer access token, any existing active bearer sessions for the same subject and method are now revoked atomically before the new session is stored.
• Adds createReplacingActive to AuthSessionRepository, which revokes matching sessions in a single transaction and returns their IDs.
• SessionStore emits clientRemoved events for each revoked session so connected-session state stays consistent.
• EnvironmentAuth sets replaceActiveForSubjectAndMethod when issuing sessions from a desktop-bootstrap grant.
• Behavioral Change: after a desktop client restarts and re-authenticates, the previous bearer token becomes invalid immediately.

^{Macroscope summarized b0f4893.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 084976af-63de-44ce-88c4-647dfb82f0bb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies authentication/session management code in apps/server/src/auth/, which is treated as sensitive regardless of complexity. The changes affect runtime session behavior (atomically replacing sessions on desktop restarts) and warrant review by a domain expert.

^{You can customize Macroscope's approvability policy. Learn more.}