Sign-out triggers an endless auto-login loop when the auth page errors; and should the not-logged-in option exist?

Overview Files Skills Discover Packages Releases Dependencies Issues20 Breadcrumbs Pull Requests Activity

Closed bug report

John Lauer · 1mo ago ·closed by John Lauer

Reported by John (2026-09-02): after signing out of Hydrogen, the app kept trying to auto-login, the Adom auth page was erroring at the time, and the two together made an endless loop with no way to just sit signed out.

Expected: a sign-out is a decision. After it, the app shows a Sign in button and waits. Auto-login may run once at launch when a session file exists, never after an explicit sign-out, and never more than once per launch when the auth page fails (surface the error, back off, offer Sign in).

Also to decide (John is debating it): whether the "use Hydrogen without logging in" option should exist at all. The insiders tier, skills delivery, and fleet reporting all key off the login; an anonymous install is invisible to every one of them.

2 Replies

John Lauer · 1mo ago

Fixed in 1.0.174 (insiders). Sign-out now deletes the replay copy of the revoked token as well as the session, and leaves a flag that parks every automatic sign-in: the login page shows a Sign in button and nothing opens on its own. A user-clicked Sign in (or a token landing by any path) clears the flag. The consent URL already opened is remembered across a route bounce, so a 401 bounce can no longer reopen the same auth page. Not yet exercised live (a sign-out on a real box needs a human to sign back in); leaving this open until John or a tester confirms the behaviour, then close. The not-logged-in-mode question stays for John.

John Lauer · 1mo ago

Closing. Fixed in 1.0.174: sign-out parks every automatic sign-in until the user clicks Sign in, and a failed auth page can no longer reopen itself. John's second question, whether the not-logged-in option should exist at all, is decided separately: it stays for now.