fix(auth): sign out without posting a logout the proxy cannot deliver

[dawsontoth]

⊙ Problem

Signing out of Studio posts logout to every remembered instance and cluster sign-in before the central-manager /Logout/. For an entity reached through the Fabric Connect proxy, that logout can't end anything. The host manager calls the instance with no cookie or token, so Harper has no session of the user's to end and answers 500. In 30 days of RUM, 16 of 24 proxied logouts were 500s, each a round trip /Logout/ waited on. Closes #1973.

🤔 Is skipping the request the right fix, rather than making it work?

Yes as filed: a proxied connection holds no credential of the user's on the instance, so no logout could end anything. On app sign-out, /Logout/ ends the only session there is. The 8 answers that were not 500 (6 × 400, 2 × 200) are unexplained, but carried no session either. Reverting is one line.

💡 Solution

• Sign out skips the instance logout for an entity that connects through the proxy, using the predicate getInstanceClient already exports.
• Its local state is still cleared by the shared helper's callers: the sign-out sweep and signOutEntities (self-hosted cluster removal).
• Direct, basic-auth and cookie sign-ins keep their logout.
• A second tab, which sees another tab's direct sign-in as proxied, no longer posts the doomed logout either.

⚖️ Alternatives

• Central manager refuses logout on the proxy — still one round trip per entity that /Logout/ waits on; useful hardening for older clients, not the fix.
• Keep proxied entities out of the sign-in markers — the marker also shows a proxied connection as signed in and controls the proxy fallback.
• Read the mode from the built client instead of calling connectsThroughProxy — one source of truth for routing, but the predicate already mirrors getInstanceClient, and the existing src/config/getInstanceClient.test.ts pins that they agree. They differ only for an id without an ins-/clu- prefix, which no entity has.

🤔 Should the skip also apply when a self-hosted cluster is removed?

Yes: signOutEntities shares buildLogoutClient, so removing a cluster now skips a proxied sign-in too. There is no /Logout/ on that path. There was never anything on the instance for the proxied logout to end either. A terminated cluster's proxy answers 400. Narrowing the skip to the app sweep is a one-line move if you disagree.

🔧 Changes

• src/features/auth/store/authStore.ts — buildLogoutClient returns no client for a proxied entity, inside its existing try so a corrupt stored credential still only skips that entity; connectsThroughProxy is imported beside getInstanceClient.
• src/features/auth/store/signOutFromPotentiallyAuthenticatedInstances.test.ts — the former proxy-routing test becomes a mixed sweep: a proxied entity and one with a leftover Fabric flag over a stored Basic Auth credential get no logout, a Basic Auth and a cookie sign-in still do, and every entity is cleared; the fixture also stands for another tab's direct sign-in.
• src/features/auth/store/signOutEntities.test.ts — the same proxy case on the cluster-removal path.
• DESIGN.md — records the credential rule, both callers, the second-tab case and the Disconnect issue (HarperFast/studio#1974).
• src/features/cluster/DESIGN.md — no longer says every remembered host gets a logout on app sign-out or cluster removal.

✅ Verification

• npx vitest run: 566 files, 5,855 tests passed (1 expected fail, 11 skipped). tsc -b, oxlint and dprint check clean.
• Mutation check: with the predicate disabled, both new tests fail (the sweep's and signOutEntities'); every existing direct-Bearer, corrupt-storage, timeout and race test stays green.
• Not observable end to end from the repo: it needs a signed-in Fabric cluster. Rollout evidence is RUM: POST /Cluster/*/operation and /HDBInstance/*/operation within 3 s before POST /Logout/ should drop to zero after the next production deploy.

_{🤖 Generated by Claude Code (Claude Mythos 5.1); posted via @dawsontoth.}

Related PRs: #1966 overlaps (added the shared buildLogoutClient this guard lives in), 4 others independent
Complexity: easy

Deferred findings

• 1c2b8342a1512922 minor reliability — src/features/cluster/ClusterHome.tsx — Fabric Connect Disconnect and signOutOfInstance still await the doomed proxied logout before clearing local state — filed Disconnect and per-instance sign-out still post a logout through the Fabric Connect proxy, which can never succeed #1974

_{Review-Coverage: authored=claude; ran=gemini,codex,cursor-grok,cursor-muse; adjudicated=domain; blocked=claude(fallback)(out-of-budget),cursor-composer(out-of-budget); declined=cursor-kimi,muse; rounds=3; full=1 @ 1d7404f}

_{Review-Attention: study ~9m (sensitive: authStore.ts; raised: degraded review) @ 1d7404f}

[gemini-code-assist]

Code Review

This pull request prevents sending logout requests to instances connected through the Fabric Connect proxy during app sign-out or cluster removal, as these proxied instances do not hold user credentials and would otherwise return 500 errors. The AuthStore has been updated to skip creating a logout client for these connections, and corresponding unit tests and design documentation have been updated to reflect this change. There are no review comments, and I have no additional feedback to provide.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.99%	14917 / 18647
🔵	Statements	79.95%	15831 / 19801
🔵	Functions	75.43%	3977 / 5272
🔵	Branches	74.67%	11572 / 15497

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/auth/store/authStore.ts	94.76%	85.88%	97.16%	94.63%	138, 281-282, 291-294, 342, 363, 394-405, 413, 418-421, 528-531, 847, 967, 972, 1101, 1126

Generated in workflow #2389 for commit 1d7404f by the Vitest Coverage Report Action