fix(amr): recover late login failures and trace auth stages (#5986)

* fix(amr): recover late login failures and trace auth stages

* fix(amr): preserve scoped cancel attempt IDs

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): defer unsupported Vela auth stages

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): narrow fallback telemetry to shipped Vela

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): preserve live login after stale cancel

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): preserve cancel during login startup

Retain cancellation intent when a provisional cancel races the delayed canonical login response, then cancel the canonical attempt before polling can begin.

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): rejoin newer login after startup cancel

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): preserve cancel across web login starts

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): retain cancel when status refresh fails

Generated-By: looper 0.11.1 (runner=fixer, agent=codex)

* fix(amr): cancel onboarding status preflight

Treat cancellation before an auth attempt exists as a local preflight cancel so a delayed status response cannot start login.\n\nGenerated-By: looper 0.11.1 (runner=fixer, agent=codex)

Author: Siri-Ray

apps/daemon/src/integrations/vela.ts

@@ -1,4 +1,5 @@
 import type { Express, Request, Response } from 'express';
+import { randomUUID } from 'node:crypto';
 import dns from 'node:dns';
 import http from 'node:http';
 import https from 'node:https';
@@ -23,6 +24,8 @@ import {
   mirrorAmrOnboardingProfileAnalytics,
   parseAmrEntryAnalyticsPayload,
   parseAmrOnboardingProfileAnalyticsPayload,
+  parseVelaAuthAttemptId,
+  parseVelaAuthRequestId,
   applyVelaLiveAccount,
   clearAllVelaLiveAccounts,
   parseVelaLoginAttribution,
@@ -31,10 +34,11 @@ import {
   readVelaCredentialRevision,
   readVelaControlApiContext,
   readVelaLoginStatus,
+  readVelaLoginAttemptSnapshot,
   setVelaLiveAccount,
   shouldRefreshVelaLiveAccount,
   velaLiveAccountCacheKey,
-  spawnVelaLogin,
+  spawnVelaLoginWithFallback,
   type VelaLiveAccount,
 } from '../integrations/vela.js';
 import {
@@ -497,6 +501,20 @@ export function registerVelaRoutes(app: Express, deps: RegisterVelaRoutesDeps):
   });
 
   app.post('/api/integrations/vela/login', async (req, res) => {
+    // Resolve a request-owned correlation id before any config or spawn work.
+    // A pre-spawn failure must never inherit the previous login's snapshot.
+    const requestAuthAttemptId = parseVelaAuthAttemptId(req.body) ?? randomUUID();
+    const requestAuthRequestId = parseVelaAuthRequestId(req.body);
+    const bodyHasRequestId = Boolean(
+      req.body
+      && typeof req.body === 'object'
+      && !Array.isArray(req.body)
+      && Object.prototype.hasOwnProperty.call(req.body, 'authRequestId'),
+    );
+    if (bodyHasRequestId && !requestAuthRequestId) {
+      res.status(400).json({ error: 'invalid_auth_request_id' });
+      return;
+    }
     try {
       const appConfig = await readAppConfig(RUNTIME_DATA_DIR);
       const configuredEnv = agentCliEnvForAgent(appConfig.agentCliEnv, 'amr');
@@ -525,43 +543,78 @@ export function registerVelaRoutes(app: Express, deps: RegisterVelaRoutesDeps):
       // 飞连/CorpLink → 30.x), that extra hop makes the upstream lose the
       // client IP and reject device authorization with
       // "502: Invalid IP address: undefined", even though the direct path
-      // resolves fine. So only fall back to the proxy when the direct attempt
-      // fails to start — never when a login is already in flight.
-      let spawned;
-      try {
-        spawned = await spawnVelaLogin({
-          configuredEnv,
-          attribution: loginAttribution,
-          correlationEnv,
-          // Block until the direct attempt reaches device-auth steady state or
-          // exits/errors before it, so a direct failure that arrives AFTER the
-          // 250ms startup grace (the common shape on a broken edge path) still
-          // falls through to the proxy retry below instead of returning 202.
-          waitForActivation: true,
-        });
-      } catch (directErr) {
-        const directMessage =
-          directErr instanceof Error ? directErr.message : String(directErr);
-        if (/already running/i.test(directMessage)) throw directErr;
-        spawned = await spawnVelaLogin({
-          configuredEnv,
-          attribution: loginAttribution,
-          correlationEnv,
-          defaultApiUrl: velaApiProxyBaseUrl(req, getPublicBaseUrl),
-          waitForActivation: true,
-        });
-      }
-      res.status(202).json(spawned);
+      // resolves fine. So only fall back to the proxy when the direct child
+      // actually terminates before activation (including after this request
+      // returns) — never merely because it is slow, already activated, or a
+      // login is already in flight.
+      const spawned = await spawnVelaLoginWithFallback({
+        authAttemptId: requestAuthAttemptId,
+        authRequestId: requestAuthRequestId,
+        configuredEnv,
+        attribution: loginAttribution,
+        correlationEnv,
+        proxyApiUrl: velaApiProxyBaseUrl(req, getPublicBaseUrl),
+        // Block until the direct attempt reaches device-auth steady state or
+        // exits/errors before it. If it remains alive beyond this grace, the
+        // attempt supervisor keeps watching after this route returns and owns
+        // a single non-overlapping proxy retry on a later pre-activation exit.
+        waitForActivation: true,
+      });
+      const snapshot = readVelaLoginAttemptSnapshot();
+      res.status(202).json({
+        ...spawned,
+        ...(snapshot.authAttemptId === requestAuthAttemptId ? snapshot : {}),
+      });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       const status = /already running/i.test(message) ? 409 : 500;
-      res.status(status).json({ error: message });
+      const snapshot = readVelaLoginAttemptSnapshot();
+      // 409 intentionally joins the already-running attempt so concurrent UI
+      // initiators can reconcile to its canonical id. Every other failure only
+      // exposes state created for this request; config/read failures before
+      // beginVelaLoginAttempt therefore cannot contaminate analytics.
+      const responseSnapshot = status === 409
+        || snapshot.authAttemptId === requestAuthAttemptId
+        ? snapshot
+        : {};
+      res.status(status).json({
+        error: message,
+        ...responseSnapshot,
+      });
     }
   });
 
-  app.post('/api/integrations/vela/login/cancel', (_req, res) => {
+  app.post('/api/integrations/vela/login/cancel', (req, res) => {
     try {
-      res.json(cancelVelaLogin());
+      const bodyHasAttemptId = Boolean(
+        req.body
+        && typeof req.body === 'object'
+        && !Array.isArray(req.body)
+        && Object.prototype.hasOwnProperty.call(req.body, 'authAttemptId'),
+      );
+      const authAttemptId = parseVelaAuthAttemptId(req.body);
+      const bodyHasRequestId = Boolean(
+        req.body
+        && typeof req.body === 'object'
+        && !Array.isArray(req.body)
+        && Object.prototype.hasOwnProperty.call(req.body, 'authRequestId'),
+      );
+      const authRequestId = parseVelaAuthRequestId(req.body);
+      if (
+        (bodyHasAttemptId && !authAttemptId)
+        || (bodyHasRequestId && !authRequestId)
+        || (bodyHasAttemptId && bodyHasRequestId)
+      ) {
+        res.status(400).json({ error: 'invalid_auth_attempt_id' });
+        return;
+      }
+      // No body remains a compatibility path for older web clients. New
+      // callers always target the attempt they observed so a delayed cancel
+      // can never terminate a newer login.
+      res.json(cancelVelaLogin(
+        authAttemptId ?? undefined,
+        authRequestId ?? undefined,
+      ));
     } catch (err) {
       res.status(500).json({ error: String(err) });
     }

apps/daemon/src/routes/vela.ts

@@ -53,6 +53,7 @@
  */
 
 import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';
+import { spawn as spawnChild } from 'node:child_process';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { argv, stdin, stdout, stderr, env, exit } from 'node:process';
@@ -348,6 +349,61 @@ stdin.on('end', () => {
 // handler above ignores login mode so delayed login tests can keep this
 // process alive without opening the ACP stdio bridge.
 function loginAndExit() {
+  const logLoginLifecycle = (event) => {
+    if (!env.FAKE_VELA_LOGIN_INVOCATION_LOG) return;
+    appendFileSync(env.FAKE_VELA_LOGIN_INVOCATION_LOG, `${JSON.stringify({
+      event,
+      route: (env.VELA_API_URL ?? '').trim() ? 'proxy' : 'direct',
+    })}\n`);
+  };
+  logLoginLifecycle('start');
+  if (
+    env.FAKE_VELA_LOGIN_ACTIVATION_THEN_EXIT_DELAY_MS
+    && !(env.VELA_API_URL ?? '').trim()
+  ) {
+    const delayMs = Number(env.FAKE_VELA_LOGIN_ACTIVATION_THEN_EXIT_DELAY_MS) || 1;
+    const exitCode = Number(env.FAKE_VELA_LOGIN_ACTIVATION_THEN_EXIT_CODE) || 0;
+    const activationBlock = [
+      'Open this URL to continue:',
+      'https://fake-vela.example/cli/activate?deviceId=activation-then-exit',
+      '',
+      'Code: ACTIVATE-EXIT',
+      '',
+    ].join('\n');
+    setTimeout(() => {
+      stdout.write(activationBlock, () => {
+        logLoginLifecycle('exit');
+        exit(exitCode);
+      });
+    }, delayMs);
+    return;
+  }
+  if (
+    env.FAKE_VELA_LOGIN_ACTIVATION_AFTER_PARENT_EXIT_MS
+    && !(env.VELA_API_URL ?? '').trim()
+  ) {
+    const delayMs = Number(env.FAKE_VELA_LOGIN_ACTIVATION_AFTER_PARENT_EXIT_MS) || 50;
+    const activationBlock = [
+      'Open this URL to continue:',
+      'https://fake-vela.example/cli/activate?deviceId=late-drain',
+      '',
+      'Code: LATE-DRAIN',
+      '',
+    ].join('\n');
+    const exitParent = () => {
+      const grandchild = spawnChild(
+        process.execPath,
+        ['-e', `setTimeout(() => process.stdout.write(${JSON.stringify(activationBlock)}), ${delayMs})`],
+        { stdio: ['ignore', stdout, stderr] },
+      );
+      grandchild.unref();
+      exit(0);
+    };
+    const parentDelayMs = Number(env.FAKE_VELA_LOGIN_PARENT_EXIT_DELAY_MS) || 0;
+    if (parentDelayMs > 0) setTimeout(exitParent, parentDelayMs);
+    else exitParent();
+    return;
+  }
   if (env.FAKE_VELA_LOGIN_FAIL) {
     stderr.write(`${env.FAKE_VELA_LOGIN_FAIL}\n`);
     exit(1);
@@ -356,6 +412,17 @@ function loginAndExit() {
   // (#3726): fail unless the daemon routed login through its IPv4 API proxy
   // (which sets VELA_API_URL). Lets tests assert the direct-first / proxy-
   // fallback contract of the login route.
+  if (
+    env.FAKE_VELA_LOGIN_EXIT_ZERO_WITHOUT_API_URL_DELAY_MS &&
+    !(env.VELA_API_URL ?? '').trim()
+  ) {
+    const delayMs = Number(env.FAKE_VELA_LOGIN_EXIT_ZERO_WITHOUT_API_URL_DELAY_MS) || 0;
+    setTimeout(() => {
+      logLoginLifecycle('exit');
+      exit(0);
+    }, delayMs);
+    return;
+  }
   if (
     env.FAKE_VELA_LOGIN_FAIL_WITHOUT_API_URL &&
     !(env.VELA_API_URL ?? '').trim()
@@ -368,11 +435,13 @@ function loginAndExit() {
     if (failDelayMs > 0) {
       setTimeout(() => {
         stderr.write(`${env.FAKE_VELA_LOGIN_FAIL_WITHOUT_API_URL}\n`);
+        logLoginLifecycle('exit');
         exit(1);
       }, failDelayMs);
       return;
     }
     stderr.write(`${env.FAKE_VELA_LOGIN_FAIL_WITHOUT_API_URL}\n`);
+    logLoginLifecycle('exit');
     exit(1);
   }
   if (env.FAKE_VELA_ENV_DUMP_PATH) {