fix(evolve): invalid state after logout - #626
Conversation
If using any nixmac-hosted model, if you log out then try to evolve, it errors due to you no longer being authenticated and therefore unable to use the provider.
🎨 Storybook previewUpdated for 9261d51
|
📋 PR Overview
🔬 Coverage
|
![prelint[bot]](https://avatars.githubusercontent.com/in/2822344?s=60&v=4){kind=small}
| .status() | ||
| .then((status) => { | ||
| if (!cancelled && shouldPromptForHostedModelAuth(preferences, status)) { | ||
| nav.openSettings("ai-models", "hosted-auth"); |
There was a problem hiding this comment.
Warning
The hook calls client.account.status() directly via oRPC to fetch auth state, rather than reading it through a viewmodel sync module. The documented constraint is explicit: "Backend state must reach the UI through exactly one path: the viewmodel/.ts sync modules." Auth status (signedIn) is not surfaced anywhere in apps/native/src/viewmodel/, so this PR introduces a second, undeclared path for backend state to reach the UI — exactly what the architectural rule prohibits.
|
| Option | What the user experiences | Gap | Effort to reverse |
|---|---|---|---|
| Current (once-per-launch) | Clean startup redirect if already logged out | Mid-session logout still hits raw error | Minimal — add reactive subscriber |
| Reactive on auth state change | Prompt appears whenever sign-out is detected, regardless of session age | Potentially jarring if shown mid-prompt-compose | Low — auth state is already in ViewModel |
2. The auth guard checks both the evolve provider and the summary provider — either role using nixmac hosted inference triggers the warning.
Both roles make authenticated API calls. A user who only has the summary provider set to nixmac could be surprised when summarization silently fails after logout. Checking both roles is complete and correct. The abstraction (hasNixmacHostedModelSelected) is well-named and the tests cover both branches.
3. The warning alert persists across all settings tabs — it does not clear when the user navigates to the Account tab to log back in, nor when they successfully authenticate.
When the user clicks
4. The guard makes a live API call to check auth status rather than reading cached auth state from the ViewModel.
Using a live check avoids acting on stale cached state that might reflect a previous session. The concern is offline behavior: if the device has no network at startup, the call fails, the error is swallowed, and a logged-out user with a hosted model selected sees nothing. They only discover the problem when they try to evolve — which will also fail. A fallback to cached auth state (if available) on network error would give better offline-first behavior.
5. Users are given two resolution paths — log back in or select another provider — presented as peers of equal prominence.
Both are valid resolutions. Some users genuinely want to stop using the hosted model (e.g., they've subscribed to OpenRouter). Others just want to re-authenticate. Presenting both avoids forcing re-authentication as the only path. The "Log back in" button is primary (solid) and "Select another model" is secondary (outline), which appropriately weights toward the simpler recovery path.
6. The destructive alert styling is changed globally — removing text-destructive coloring from the body, keeping only the border and icon in destructive color — as part of this bug fix.
The visual change (red border + icon, normal text color) is defensible: it makes the alert feel like a callout rather than a full-system error, which matches how the hosted-auth alert is used. The concern is that this is a global change to all destructive alerts bundled into a targeted bug fix. Any existing destructive alert in the app — whether surfacing a critical error, a data-loss warning, or a build failure — will now have muted text. The change may be correct but deserves separate product review with a broader view of where destructive alerts appear.
7. The contextual prompt is encoded as a URL search parameter on the settings route, preserved when navigating between settings tabs.
Encoding the prompt in the route means deep-linking into a specific settings state is possible and the prompt survives tab navigation — both useful properties. The concern is that there is no mechanism to clear the prompt once the user resolves the issue (as discussed above). A well-bounded alternative would be component-local state (a useState flag) that dismisses when the user clicks either CTA, avoiding the persistence problem entirely at the cost of deep-link support that is unlikely to matter here.
8. The guard will not prompt during onboarding — it waits for `onboardingState.completedAt` to be set.
Prompting a user to fix their provider configuration before they have finished initial setup would be premature and confusing. Gating on onboarding completion is the correct ordering.
Open questions
-
Does the logout flow in nixmac cause the DarwinWidget component tree to unmount and remount? If so, the once-per-launch limitation is less severe because the
checkedref would reset, making the guard re-run after logout. If not, mid-session logout is still unhandled. -
Are there other destructive alerts in the app today (build failures, dangerous-tool warnings, configuration errors) that would be affected by the global alert styling change? The PR fixes one visual problem but may introduce muted styling in contexts where high-urgency color was appropriate.
-
What is the expected user journey for someone who has inadvertently been logged out — do they know they were using a hosted model, or will they be surprised by the prompt? Does the alert copy assume too much familiarity with the distinction between hosted and BYOK models?
Recommendation
Ship with changes
The startup-guard pattern and the two-CTA resolution flow are the right product instincts. However, the alert persisting visibly after the user has already acted to resolve it (by navigating to Account) is a concrete confusion to fix before shipping, and the question of whether mid-session logouts are actually caught should be confirmed. The global alert styling change should also be intentionally reviewed rather than landing as a side effect.
1 participant
If using any nixmac-hosted model, if you log out then try to evolve, it
errors due to you no longer being authenticated and therefore unable to
use the provider.