Users were asked to sign in again every ~30 minutes, even while active.
Session lifetime
- Browser: UDS_SESSION kept its login-time Max-Age and was never re-issued,
so the cookie vanished 30 min after login. Re-issue it on use (throttled
by slidingInterval).
- Desktop: remote.mux WS traffic never passed the HTTP auth middleware, so
the idle TTL never slid. assertPrincipalLive now reports activity and
slides the session and the account's bridges (throttled).
- New setting sessionIdleTimeoutHours (Settings page + config). Default 0 =
no automatic sign-out; only a manual sign-out ends a session, so
conversations and night-time cron are never cut off. 0.5-168 enables an
idle timeout with the 7-day cap. The TTL is read live.
- Stores support long TTLs: the absolute cap follows the TTL, older 7-day
sessions are lifted on activity, and expiry timers re-arm instead of
overflowing setTimeout (~24.8 days).
UAC token check
- Every 2 hours (and 1 min after start) each QR session's token is checked
against icenterapi. A rejected token is only flagged, never a sign-out.
Network errors, 5xx and bad JSON keep the previous verdict (the old 6h
check revoked all of an account's sessions on any failure, including
outages).
- GET /uds-auth/session-status (non-sliding) returns alive + tokenValid.
The client probes it every minute and on focus: a gone session signs the
UI out with a notice; a rejected token opens a refresh QR once.
- Scanning in refresh mode writes the new token into every live session of
the account and the skill credential cache in place: no new session, no
reload. Other accounts are rejected (token_refresh_emp_mismatch).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
