[alexandre-vl]

Summary

• An engine loaded session.json whatever edge it was started with, and on its first refresh handed the session's refresh token to that edge.
  • Another edge can only turn it down, and a definitive refusal signs out, deleting the file.
  • So a single start with another ZERON_EDGE_URL lost a session that still worked where it came from.
  • Zeron 0.3.0's app started the engine with production's edge whatever the environment said, so it signed a self-hosting user out this way each time it started the engine on ~/.zeron. The app side is zgx: the app starts its engine against the edge ZERON_EDGE_URL names #1389.
• A session now records the edge and WorkOS client that issued it.
  • An engine of another edge or client starts signed out, in local scope, and leaves the file as it is, logging a warning.
  • An engine of the issuing edge uses it, with or without a trailing slash on the URL.
  • A session from before carries no issuer and is taken as this engine's, as before, until its first successful refresh records the edge that took it.
• Compatibility: the new fields edgeUrl and workosClientId are optional (#[serde(default)], skipped when unset), and no persisted key is renamed.
  • Old files load.
  • Older engines ignore the fields. If an older engine rewrites the file it drops them, and the next refresh here records them again.
• Changed on purpose:
  • Starting with a different edge or client no longer presents the saved refresh token to it.
  • Signing in there still replaces the file, and zeron logout still removes it.
• Credentials (please review closely): this narrows where a refresh token goes, to the edge that issued it, for every session signed in or refreshed after this change.

Test plan

• cargo test --locked -p zeron-engine --test auth: 24 passed, three of them new:
  • a_session_another_edge_issued_is_left_as_it_is: another edge, and another client. The session is seeded with a refresh token this edge revokes. The test asserts the engine starts signed out, sends no /auth/refresh, and leaves the file byte-identical.
  • a_session_says_which_edge_and_client_issued_it: a headless sign-in records both, and an engine of that edge with a trailing slash in its URL loads the session.
  • a_session_from_before_learns_its_issuer_on_its_first_refresh.
  • All three fail against the engine without this change.
• --test local_first (11), --test misc local_profiles (6), --lib auth:: (4): pass. They seed sessions without the new fields.
• cargo clippy --locked -p zeron-engine --all-targets: nothing new. The two warnings in auth.rs and tests/auth.rs were already there.
• Not run: the crates/ui tests that seed session.json (state.rs, shell.rs). Their sessions carry no issuer, which load as before.

[alexandre-vl]

The red checks come from zeron/zgx itself. This change touches only crates/engine/src/auth.rs and crates/engine/tests/auth.rs.

• linux-ui / ui-tests: zeron-ui's tests don't compile. 398cdab made TranscriptFrame::reset generic, and crates/ui/src/state.rs:5987 and crates/ui/src/transcript.rs:12347 still call it with &[] (E0283, type annotations needed).
• zgx / zgx-linux:
  • plugins::official::tests::zeron_v2_is_in_step_with_the_default has failed since c153906 changed apps/zgx/ui/screens/panel/init.luau but not Zeron v2's copy. zgx: Zeron v2's panel gets the active-tab wash fix, so the v2 staleness test passes #1382 brings v2 in step.
  • The Luau UI test "long messages open folded, never at their whole height first; a click eases them" failed here and passed on other runs of the same base, so it looks flaky.
• Other PRs into zeron/zgx fail these jobs with the same errors, e.g. Plugins: a plugin's service gets zeron.db, the same file its windows open #1380 and Plugins: a service measures text as its window's canvas does #1367.
• zgx / zgx-macos: the same zeron_v2_is_in_step_with_the_default, plus four rendering tests (visuals_tests, transcript_paint_tests) and six chat-scrolling UI tests. Metal fails to compile zgx's shader fill pipeline ("Compilation failed") on the macos-26-arm64 runner image, 20261102.0473.1. Linux: the engine an app starts outlives the app's systemd unit #1391's run on the same image fails the same tests, and neither change touches rendering.