[Due for payment 2026-07-23] Copilot: old design (Classic/OldDot) screens shown & stuck loading when copilot account's authToken expires

[melvin-bot]

Version Number:
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: N/A
Email or phone of affected tester (no customers): jenna@expensify.com (acting as copilot of jenna@cardtest.expensify.com)
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: Jenna Hay
Slack conversation (hyperlinked to channel name): https://expensify.slack.com/archives/C05LX9D6E07/p1780585697696809

Action Performed:

1. Sign in as your own account on the app.
2. Switch into a Copilot account (act as another user as their delegate).
3. Leave the app open/backgrounded overnight so the copilot account's authToken expires.
4. Reopen the app.

Expected Result:

The app reauthenticates cleanly and shows the current New Expensify UI (either staying in the copilot account or switching back to your main account).

Actual Result:

On reopening, the app renders old design (Classic / OldDot) screens and gets stuck on a long "Switching accounts" spinner. The expired copilot token triggers an OldDot reauthentication flow that fails, bouncing the user out of New Expensify into the legacy UI rather than restoring the session cleanly.

Workaround:

Yes — hard close and reopen the app returns the user to their correct New Expensify account.

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

See Slack thread (screenshots attached there).

Related PR: #93084 — fix: restore main session when authToken expires while in copilot mode.

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @mallenexpensify

[MelvinBot]

Issue Analysis

Root Cause: Two bugs in the delegate (copilot) reauthentication path, both confirmed on main:

1. Reauth reads the wrong credentials. When you connect as a delegate, the original user's credentials are stashed in ONYXKEYS.STASHED_CREDENTIALS and ONYXKEYS.CREDENTIALS is wiped (it's not in KEYS_TO_PRESERVE_DELEGATE_ACCESS). But reauthenticate() reads from CREDENTIALS, finds nothing, and bails to redirectToSignIn('No credentials available') — so the expired copilot token can never be refreshed.
2. Restoration never syncs OldDot. The reauth-driven restoreDelegateSession() only updates the NewDot session; it never calls HybridAppModule.switchAccount. On HybridApp (iOS/Android Native) OldDot stays on the stale delegate session, so NewDot and OldDot disagree about the active account — surfacing as the Classic/OldDot screens and the stuck "Switching accounts" spinner.

Status: This is already being fixed.

• App side: Expensify/App#93084 (open) — uses STASHED_CREDENTIALS when connected as a delegate, restores CREDENTIALS, and unifies disconnect + reauth restoration into a single restoreDelegateSession that calls HybridAppModule.switchAccount in both paths.
• OldDot side: Expensify/Mobile-Expensify#13973 — handles the OldDot half of the account switch.

Recommended action: No new fix needed — track/merge the two PRs above. Since the fix spans Mobile-Expensify (not part of the open-source App repo), the OldDot portion requires an internal engineer; this is not contributor-actionable.

Investigation details (evidence on App @ 5351d7b)

• Reauthentication.ts:169 — reauthenticate() sources credentials via getCredentials(), which mirrors ONYXKEYS.CREDENTIALS.
• Reauthentication.ts:183-188 — missing-credentials guard fires → redirectToSignIn('No credentials available').
• Delegate.ts:29-48 — KEYS_TO_PRESERVE_DELEGATE_ACCESS does not include CREDENTIALS; the original creds are stashed into STASHED_CREDENTIALS on connect (Delegate.ts:142), then everything else is cleared (clearOnyxAndSeedFullReconnect.ts:23).
• Delegate.ts:757-768 — restoreDelegateSession() on main updates session tokens and calls openApp(), but never calls HybridAppModule.switchAccount, so OldDot is never told to switch back.

Data flow: delegate connect stashes creds + wipes CREDENTIALS → copilot token expires → API request triggers reauthenticate() → getCredentials() empty → redirect to sign-in / stale OldDot session → Classic screens + stuck spinner. The hard-close workaround works because a cold start re-reads the persisted session from scratch rather than going through the broken reauth path.

Alternative explanations considered: A pure NewDot-only session bug was ruled out — the symptom (OldDot/Classic UI) requires the NewDot↔OldDot sync gap, which only exists on HybridApp; this matches the reported platforms (Android: App, iOS: App only).

---

Next Steps for Contributor+ team:
To accept: A fix is already open in #93084 + Mobile-Expensify#13973 — review/merge those rather than starting a new PR.
To refine: @MelvinBot <your feedback>
To reject: Explain why you are rejecting Melvin's analysis.

[abdulrahuman5196]

@mountiny Could you kindly assign me to this issue since I reviewed as C+?