Fix stale bearerToken closure by deferring registerConnection until after metadata refresh

Move registerConnection(connection) after the metadata refresh succeeds, so
a connection with a stale activeBearerToken is never registered in the global
map. In the 401 retry path, dispose the unregistered connection directly
instead of calling removeConnection (which expects a registered connection).
In the outer catch, handle both registered and unregistered connections.

Author: cursoragent

apps/web/src/environments/runtime/service.ts

@@ -1064,8 +1064,6 @@ async function ensureSavedEnvironmentConnection(
       ...createEnvironmentConnectionHandlers(),
     });
 
-    registerConnection(connection);
-
     try {
       try {
         await refreshSavedEnvironmentMetadata(
@@ -1087,18 +1085,22 @@ async function ensureSavedEnvironmentConnection(
         activeRecord = issued.record;
         bearerToken = issued.bearerToken;
         roleHint = issued.role;
-        await removeConnection(activeRecord.environmentId).catch(() => false);
+        await connection.dispose();
         pendingSavedEnvironmentConnections.delete(activeRecord.environmentId);
         return await ensureSavedEnvironmentConnection(activeRecord, {
           bearerToken,
           role: roleHint,
           serverConfig: options?.serverConfig ?? null,
         });
       }
+      registerConnection(connection);
       return connection;
     } catch (error) {
       setRuntimeError(activeRecord.environmentId, error);
-      await removeConnection(activeRecord.environmentId).catch(() => false);
+      const removed = await removeConnection(activeRecord.environmentId).catch(() => false);
+      if (!removed) {
+        await connection.dispose().catch(() => {});
+      }
       throw error;
     }
   })();