fix(auth): stop stale chat threads after signup

[M3gA-Mind]

Summary

Fixes new signups showing conversation threads from the anonymous (users/local) workspace or stale Redux thread rows when auth hydrates without a full identity-flip restart.

Changes

• Core (store_session): After the first activation from signed-out (no prior active_user.toml), purge local conversation JSONL under the pre-login workspace so onboarding/demo threads are not retained in the shared bucket.
• UI (CoreStateProvider): When scoped caches clear for an identity change but handleIdentityFlip does not run, dispatch clearAllThreads() and loadThreads() so the thread list re-syncs from the core.
• Tests: Vitest coverage for the seed-matches-next-user hydration path.

Verification

• cargo fmt --check, cargo check (root crate)
• pnpm typecheck, pnpm lint, pnpm format:check, pnpm test
• cargo test -p openhuman credentials::ops

Closes #1157

Made with Cursor

Summary by CodeRabbit

• Bug Fixes

  • Improved session handling to ensure thread caches are cleared and reloaded when an authenticated identity changes (excluding restart-driven flips or logouts).
  • Enhanced initial-login cleanup to purge conversation threads from pre-login workspaces, non-fatal failures logged.

• Tests

  • Added test coverage for identity transition scenarios to verify thread cache invalidation and reload behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds cross-layer cleanup on identity activation: Rust purges pre-login workspace threads on first activation, and the React provider clears the Redux thread slice and reloads threads when identity hydrates (non-flip, non-logout) within the same process.

Changes

Cross-Layer Thread & Workspace Cleanup

Layer / File(s)	Summary
Rust import update src/openhuman/credentials/ops.rs	Reformats imports to include read_active_user_id alongside write_active_user_id.
Persistent pre-login cleanup (data/state snapshot) src/openhuman/credentials/ops.rs	store_session reads previous active user via read_active_user_id(&root_dir) to detect first activation.
Persistent pre-login cleanup (side-effect) src/openhuman/credentials/ops.rs	On first activation (previous_active.is_none()), calls conversations::purge_threads on pre_login_user_dir(...)/workspace; logs purge stats on success and continues on failure.
Thread slice import app/src/providers/CoreStateProvider.tsx	Adds imports clearAllThreads and loadThreads from ../store/threadSlice.
In-memory thread reset (control flow) app/src/providers/CoreStateProvider.tsx	In refreshCore, when shouldClearScopedCaches && !isFlip && !isLogout && nextIdentity and requestId still current, dispatches clearAllThreads() then loadThreads().unwrap(); catches and logs errors only if request still current.
Test coverage app/src/providers/__tests__/CoreStateProvider.identityFlip.test.tsx	Adds import for threadSlice and a test asserting identity hydration null→B triggers clearAllThreads() and loadThreads() without calling app restart.

Sequence Diagram

sequenceDiagram
    participant User as User/SignUp
    participant Rust as Rust Core
    participant FS as Filesystem
    participant Redux as Redux Store
    participant Provider as CoreStateProvider

    User->>Rust: Login / attach session
    Note over Rust: store_session() called
    Rust->>Rust: read_active_user_id(&root_dir)
    alt First activation (no previous active user)
        Rust->>FS: purge pre_login_user_dir/.../workspace
        Rust->>Rust: log purge stats or debug on error
        Rust->>FS: write active_user.toml
    else Subsequent activation
        Rust->>FS: write active_user.toml
    end

    Rust->>Redux: trigger refreshCore / identity snapshot update
    Redux->>Provider: notify identity changed
    Provider->>Provider: detect shouldClearScopedCaches && !isFlip && !isLogout && nextIdentity
    Provider->>Redux: dispatch clearAllThreads()
    Provider->>Redux: dispatch loadThreads()
    Redux->>Provider: threads reloaded
    Provider->>User: updated (clean) thread state

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• feat: scope user data to per-user directories #370: Modifies store_session / active-user activation flow — related to the pre-login purge logic.
• feat(home): banners, welcome typewriter, conversation gating #936: Changes to CoreStateProvider identity-change handling and scoped cache clearing — closely related to the provider-side logic.
• fix(threads): persist selectedThreadId across reloads #1168: Modifications around thread slice behavior and load/clear semantics — related to thread reload/clear operations.

Suggested reviewers

• senamakel

"i'm a rabbit with a tidy den,
i hop and clear old threads again,
rust scrubs the pre-login lane,
redux resets the thread domain,
fresh accounts now start clean and zen." 🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly and concisely describes the main fix: stopping stale chat threads after signup, which directly corresponds to the primary objective and linked issue #1157.
Linked Issues check	✅ Passed	Code changes address all primary objectives from #1157: purging pre-login conversation threads on first activation [app/src/providers/CoreStateProvider.tsx, src/openhuman/credentials/ops.rs], reloading thread state in UI [app/src/providers/tests/CoreStateProvider.identityFlip.test.tsx], and preventing cross-user thread leakage through scoped cache clearing and thread reload logic.
Out of Scope Changes check	✅ Passed	All changes are directly aligned with issue #1157 objectives: conversation purge on first activation, Redux thread cache clearing/reloading on identity hydration, and test coverage for the identity change path; no unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Review rate limit: 4/5 reviews remaining, refill in 12 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@app/src/providers/CoreStateProvider.tsx`:
- Around line 244-255: The thread-clear/reload branch can run for a stale auth
snapshot; capture the current snapshotRequestIdRef (e.g. const currentSnapshotId
= snapshotRequestIdRef.current) and only perform
store.dispatch(clearAllThreads()) and store.dispatch(loadThreads()) if
snapshotRequestIdRef.current === currentSnapshotId, and similarly skip the
loadThreads error handler if the snapshot id has changed; reference
snapshotRequestIdRef, clearAllThreads, loadThreads (and commitState for context)
when making this guard so stale/outsourced refreshes do not mutate the committed
identity's thread slice.

In `@src/openhuman/credentials/ops.rs`:
- Around line 191-214: The purge can race with concurrent thread listing because
purge_threads (conversations::purge_threads) uses a write lock while the
read/list path in the conversations store is not synchronized; serialize the
operation by acquiring the same conversation store lock around the purge call or
by invoking a store-level API that performs both listing and removal under the
same lock (e.g., use the store's write-locked purge method instead of calling
purge_threads directly, or wrap pre_login workspace listing/removal in
conversations::with_store_write_lock(|store|
store.purge_pre_login_workspace(pre_ws))). Ensure you reference and use the same
lock mechanism implemented in src/openhuman/memory/conversations/store.rs (the
conversation store's read/write lock and its list/remove methods) so the purge
fully completes before any read/list (frontend loadThreads) can run.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e186ff05-b7fe-4c0a-a9e9-51846b42a772

📥 Commits

Reviewing files that changed from the base of the PR and between 995669f and 5ea76e0.

📒 Files selected for processing (3)

• app/src/providers/CoreStateProvider.tsx
• app/src/providers/__tests__/CoreStateProvider.identityFlip.test.tsx
• src/openhuman/credentials/ops.rs

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Serialize the pre-login purge with thread listing.

This new purge runs during login while the frontend now immediately calls loadThreads() on the no-restart path. purge_threads is write-locked, but the read/list side in src/openhuman/memory/conversations/store.rs is not, so thread listing can race with remove_dir_all() and observe an empty or partially deleted workspace. Please put the list/read path behind the same lock, or otherwise guarantee the purge finishes before any reload can run.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/credentials/ops.rs` around lines 191 - 214, The purge can race
with concurrent thread listing because purge_threads
(conversations::purge_threads) uses a write lock while the read/list path in the
conversations store is not synchronized; serialize the operation by acquiring
the same conversation store lock around the purge call or by invoking a
store-level API that performs both listing and removal under the same lock
(e.g., use the store's write-locked purge method instead of calling
purge_threads directly, or wrap pre_login workspace listing/removal in
conversations::with_store_write_lock(|store|
store.purge_pre_login_workspace(pre_ws))). Ensure you reference and use the same
lock mechanism implemented in src/openhuman/memory/conversations/store.rs (the
conversation store's read/write lock and its list/remove methods) so the purge
fully completes before any read/list (frontend loadThreads) can run.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/openhuman/credentials/ops.rs`:
- Around line 211-216: The Err branch that currently calls tracing::debug! when
the pre-login conversation purge fails should be changed to tracing::warn! so
failures are visible in production logs; update the call that logs error = %e
and pre_login_workspace = %pre_ws_log (the Err(e) branch in the pre-login purge
logic) to use warn level and keep the same structured fields and message
("[credentials] pre-login conversation purge skipped (non-fatal)").

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 14bfb15e-4ba2-41e5-976e-bd49cacc99f8

📥 Commits

Reviewing files that changed from the base of the PR and between 5ea76e0 and 027c46b.

📒 Files selected for processing (2)

• app/src/providers/CoreStateProvider.tsx
• src/openhuman/credentials/ops.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• app/src/providers/CoreStateProvider.tsx

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Promote purge-failure logging to warn for production visibility.

This cleanup directly protects against stale/shared pre-login thread carryover; keeping failures at debug makes incidents easy to miss in normal ops logs. Keep it non-fatal, but log at warning level.

Suggested patch

-                            tracing::debug!(
+                            tracing::warn!(
                                 error = %e,
                                 pre_login_workspace = %pre_ws_log,
                                 "[credentials] pre-login conversation purge skipped (non-fatal)"
                             );

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Err(e) => {
	tracing::debug!(
	error = %e,
	pre_login_workspace = %pre_ws_log,
	"[credentials] pre-login conversation purge skipped (non-fatal)"
	);
	Err(e) => {
	tracing::warn!(
	error = %e,
	pre_login_workspace = %pre_ws_log,
	"[credentials] pre-login conversation purge skipped (non-fatal)"
	);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/openhuman/credentials/ops.rs` around lines 211 - 216, The Err branch that
currently calls tracing::debug! when the pre-login conversation purge fails
should be changed to tracing::warn! so failures are visible in production logs;
update the call that logs error = %e and pre_login_workspace = %pre_ws_log (the
Err(e) branch in the pre-login purge logic) to use warn level and keep the same
structured fields and message ("[credentials] pre-login conversation purge
skipped (non-fatal)").