Fix T3 Connect onboarding account races and reload gaps

- Trigger mobile onboarding on account switches, not only null -> account
- Drop stale onboarding requests when the signed-in account changes
- Persist mobile sheet completion only for the account it opened for
- Reload publish targets when bearer connections surface after first pass
- Open web wizard only after an in-session sign-in, matching mobile

Author: cursoragent

apps/mobile/src/features/cloud/CloudAuthProvider.tsx

@@ -18,7 +18,10 @@ import {
   setAgentAwarenessRelayTokenProvider,
   unregisterAgentAwarenessDeviceForCurrentUser,
 } from "../agent-awareness/remoteRegistration";
-import { requestConnectOnboardingIfNeeded } from "./connectOnboarding";
+import {
+  requestConnectOnboardingIfNeeded,
+  syncConnectOnboardingAccount,
+} from "./connectOnboarding";
 import { resolveCloudPublicConfig, resolveRelayClerkTokenOptions } from "./publicConfig";
 
 function resetManagedRelayTokenCache() {
@@ -67,11 +70,17 @@ function CloudAuthBridge(props: { readonly children: ReactNode }) {
     const previousObservedAccount = observedAccountRef.current;
     const nextAccount = isSignedIn && userId ? userId : null;
     observedAccountRef.current = nextAccount;
+    syncConnectOnboardingAccount(nextAccount);
 
-    // A sign-in that completed during this session (a cold start observes
-    // undefined → account and must not re-prompt) requests the T3 Connect
-    // onboarding sheet once per account.
-    if (previousObservedAccount === null && nextAccount !== null) {
+    // A sign-in that completed during this session — from signed-out or by
+    // switching accounts (a cold start observes undefined → account and must
+    // not re-prompt) — requests the T3 Connect onboarding sheet once per
+    // account.
+    if (
+      previousObservedAccount !== undefined &&
+      previousObservedAccount !== nextAccount &&
+      nextAccount !== null
+    ) {
       void (async () => {
         const result = await settlePromise(() => requestConnectOnboardingIfNeeded(nextAccount));
         reportAtomCommandResult(result, { label: "connect onboarding request" });

apps/mobile/src/features/cloud/ConnectOnboardingRouteScreen.tsx

@@ -78,15 +78,23 @@ function ConfiguredConnectOnboardingRouteScreen() {
     cloudEnvironments: null,
   });
 
-  // Dismissing the sheet (swipe, Skip, or Done) counts as completion.
+  // Dismissing the sheet (swipe, Skip, or Done) counts as completion — but
+  // only for the account the sheet opened for. Signing out or switching
+  // accounts mid-flow dismisses without persisting, so the new account still
+  // gets its own onboarding.
+  const openedForAccountRef = useRef<string | null>(null);
+  if (openedForAccountRef.current === null && userId) {
+    openedForAccountRef.current = userId;
+  }
   const completionPersistedRef = useRef(false);
   const persistCompletion = useCallback(() => {
-    if (completionPersistedRef.current || !userId) {
+    const accountId = openedForAccountRef.current;
+    if (completionPersistedRef.current || !accountId || accountId !== userId) {
       return;
     }
     completionPersistedRef.current = true;
     void (async () => {
-      const result = await settlePromise(() => markConnectOnboardingCompleted(userId));
+      const result = await settlePromise(() => markConnectOnboardingCompleted(accountId));
       reportAtomCommandResult(result, { label: "connect onboarding completion" });
     })();
   }, [userId]);
@@ -172,14 +180,26 @@ function ConfiguredConnectOnboardingRouteScreen() {
   );
 
   // Check authorization + link state once the locally saved connections are
-  // ready. Loaded once per mount: reconnect churn in the registry must not
-  // flip the section back to "checking" mid-interaction.
-  const loadedRef = useRef(false);
+  // ready. Bearer tokens can surface after the catalog is ready (prepared
+  // connections load asynchronously), so reload when a connection appears
+  // that was never checked — but never reload on removals or identity churn,
+  // which must not flip the section back to "checking" mid-interaction.
+  const loadedEnvironmentIdsRef = useRef<Set<string> | null>(null);
   useEffect(() => {
-    if (isLoadingSavedConnection || loadedRef.current) {
+    if (isLoadingSavedConnection) {
+      return;
+    }
+    const loadedIds = loadedEnvironmentIdsRef.current;
+    if (
+      loadedIds !== null &&
+      bearerConnections.every((connection) => loadedIds.has(connection.environmentId))
+    ) {
       return;
     }
-    loadedRef.current = true;
+    loadedEnvironmentIdsRef.current = new Set([
+      ...(loadedIds ?? []),
+      ...bearerConnections.map((connection) => connection.environmentId),
+    ]);
     void loadPublishTargets(bearerConnections);
   }, [bearerConnections, isLoadingSavedConnection, loadPublishTargets]);
 

apps/mobile/src/features/cloud/connectOnboarding.ts

@@ -15,12 +15,38 @@ const connectOnboardingRequestAtom = Atom.make<string | null>(null).pipe(
   Atom.withLabel("mobile:connect-onboarding-request"),
 );
 
+// The account CloudAuthBridge currently observes. Requests are only valid
+// while their account stays signed in.
+const connectOnboardingAccountAtom = Atom.make<string | null>(null).pipe(
+  Atom.keepAlive,
+  Atom.withLabel("mobile:connect-onboarding-account"),
+);
+
+/**
+ * Records the signed-in account observed by CloudAuthBridge. A sign-out or
+ * account switch drops any pending onboarding request for another account —
+ * including a request whose preference load is still in flight — so the sheet
+ * can never present for an account that is no longer signed in.
+ */
+export function syncConnectOnboardingAccount(accountId: string | null): void {
+  appAtomRegistry.set(connectOnboardingAccountAtom, accountId);
+  const requested = appAtomRegistry.get(connectOnboardingRequestAtom);
+  if (requested !== null && requested !== accountId) {
+    clearConnectOnboardingRequest();
+  }
+}
+
 /**
  * Requests the onboarding sheet for the given account unless it already
  * completed (or skipped) onboarding on this device.
  */
 export async function requestConnectOnboardingIfNeeded(accountId: string): Promise<void> {
   const preferences = await loadPreferences();
+  // The account may have signed out (or been switched) while the preference
+  // load was in flight; a stale request must not overwrite the current state.
+  if (appAtomRegistry.get(connectOnboardingAccountAtom) !== accountId) {
+    return;
+  }
   if (preferences.connectOnboardingCompletedAccounts?.includes(accountId)) {
     return;
   }

apps/web/src/components/cloud/ConnectOnboardingDialog.tsx

@@ -30,11 +30,12 @@ import { toastManager } from "../ui/toast";
 
 /**
  * Post-sign-in onboarding wizard for T3 Connect. Opens once per account (per
- * browser) after the user is signed in: first prompts to publish this
- * environment (managed tunnel + agent activity, both defaulting on) when the
- * current session is authorized to manage the relay link, then lists the
- * account's T3 Connect environments so every device can be connected right
- * away. Dismissing the dialog counts as completion — it never nags twice.
+ * browser) after a sign-in completes during this session: first prompts to
+ * publish this environment (managed tunnel + agent activity, both defaulting
+ * on) when the current session is authorized to manage the relay link, then
+ * lists the account's T3 Connect environments so every device can be
+ * connected right away. Dismissing the dialog counts as completion — it never
+ * nags twice.
  */
 export function ConnectOnboardingDialog() {
   if (!hasCloudPublicConfig()) return null;
@@ -84,8 +85,28 @@ function ConfiguredConnectOnboardingDialog() {
 
   const completedAccounts = onboardingState.completedAccounts;
 
+  // Only a sign-in that completed during this session prompts onboarding: a
+  // cold start (a page load observing an already signed-in user) must not
+  // re-prompt, matching the mobile trigger.
+  const observedAccountRef = useRef<string | null | undefined>(undefined);
+  const [signedInAccount, setSignedInAccount] = useState<string | null>(null);
+  useEffect(() => {
+    if (!isLoaded) return;
+    const previousObservedAccount = observedAccountRef.current;
+    const nextAccount = isSignedIn && userId ? userId : null;
+    observedAccountRef.current = nextAccount;
+    if (
+      previousObservedAccount !== undefined &&
+      previousObservedAccount !== nextAccount &&
+      nextAccount !== null
+    ) {
+      setSignedInAccount(nextAccount);
+    }
+  }, [isLoaded, isSignedIn, userId]);
+
   useEffect(() => {
     if (!isLoaded || !isSignedIn || !userId) return;
+    if (signedInAccount !== userId) return;
     if (openForAccount !== null) return;
     if (completedAccounts.includes(userId)) return;
     if (!sessionScopesKnown) return;
@@ -102,6 +123,7 @@ function ConfiguredConnectOnboardingDialog() {
     isSignedIn,
     openForAccount,
     sessionScopesKnown,
+    signedInAccount,
     userId,
   ]);