Problem
First-time manual proxy startup creates an API key before entering the serialized proxy operation. If API-key creation or the following key-list refresh is delayed while the user logs out, logout can reset the proxy first and the stale startup handler can enqueue a new start afterward using the prior account's key.
The component-level account guard explored in PR #652 would only partially mitigate this: it can leave a newly created remote key orphaned and does not move the account boundary into the service lifecycle.
Expected behavior
A manual proxy setup started by one authenticated account must not persist or start after that account logs out or another account becomes active.
Suggested direction
- Fence manual proxy startup at the lifecycle or service boundary using the initiating account and an auth generation.
- Coordinate key creation with logout cleanup rather than guarding only the React component.
- Revoke or otherwise roll back a key created by an operation that becomes stale.
- Add a deterministic test using delayed key creation followed by logout and account transition.
Track and fix this separately from the documentation and UI work in PR #652.
Problem
First-time manual proxy startup creates an API key before entering the serialized proxy operation. If API-key creation or the following key-list refresh is delayed while the user logs out, logout can reset the proxy first and the stale startup handler can enqueue a new start afterward using the prior account's key.
The component-level account guard explored in PR #652 would only partially mitigate this: it can leave a newly created remote key orphaned and does not move the account boundary into the service lifecycle.
Expected behavior
A manual proxy setup started by one authenticated account must not persist or start after that account logs out or another account becomes active.
Suggested direction
Track and fix this separately from the documentation and UI work in PR #652.