fix(clerk-js): preserve trusted clients after satellite sign-out by tmilewski · Pull Request #10470 · clerk/javascript

tmilewski · 2026-10-27T19:47:34Z

Description

Signing out on a satellite leaves the primary domain holding a stale client cookie. The next primary password sign-in creates a new client and repeats the Device Trust challenge, even though the browser was already trusted.

Uses the optional repair URL from the companion backend change to refresh the primary cookie before continuing sign-out navigation. Repair applies to production browser satellites with client persistence enabled; the backend only offers it when Device Trust is enabled. Disabled persistence and malformed or unsupported destinations use the original removal path, so URL parsing cannot prevent session removal. Navigation errors still propagate.

Preserves the public signOut overloads and zero-argument callback contract. Built-in UI actions retain their original navigation closures and opt in with an internal return URL resolved through the active router. Only a usable backend repair URL replaces that navigation; missing or invalid responses invoke the original callback. Component-internal, hash/virtual, arbitrary customer callback, targeted multisession, primary, development, and native flows retain their existing paths. The transport method remains concrete-only rather than becoming a required ClientResource member.

Part of CORE-4146

Checklist

pnpm test runs as expected. Targeted ClerkJS, UI, and router suites passed; the full monorepo suite was not run.
pnpm build runs as expected. Browser bundles and relevant typechecks passed; the full monorepo build was not run.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

changeset-bot · 2026-10-27T19:47:39Z

🦋 Changeset detected

Latest commit: fcbf773

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/shared	Patch
@clerk/ui	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch
@clerk/mosaic	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/swingset	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-10-27T19:47:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 30, 2026 10:07pm UTC
swingset	Ready	Preview	Oct 30, 2026 10:07pm UTC

coderabbitai · 2026-10-27T19:47:43Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: tom/satellite-device-trust-investigation
File: .coderabbit.yaml
Commit: fcbf773
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: a13fb9cf-852e-4229-8537-8d08f8cb1a02

Commits

Reviewing files that changed from the base of the PR and between 1702463 and fcbf773.

Files selected for processing: 5

packages/clerk-js/src/core/__tests__/clerk.test.ts
packages/clerk-js/src/core/clerk.ts
packages/clerk-js/src/core/resources/Client.ts
packages/clerk-js/src/core/resources/__tests__/Client.test.ts
packages/shared/src/types/clerk.ts

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/clerk-android (auto-detected)
clerk/clerk-ios (auto-detected)
clerk/cli (auto-detected)

Included review availability: This review used your included allowance. 8 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

Walkthrough

The change adds a client sign-out request that can return a sign-out URL while retaining client data from its response. Clerk uses this request for eligible production satellite sign-outs with valid HTTPS redirects. A new UI hook passes eligible redirect destinations to Clerk, and sign-out components use the hook for last-account and all-account flows. Tests cover client responses, repair eligibility, fallback paths, and UI navigation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested reviewers: nikosdouvlis, wobsoriano

Merge Risk: Minimal · up to fcbf7

The reviewed sign-out paths preserve the intended navigation behavior, with no identified issue requiring a fix before merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: preserving trusted clients after satellite sign-out.
Description check		The description directly explains the stale primary-domain cookie, the repair URL flow, scope limits, fallback behavior, and validation performed. It is related to the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 21 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-10-27T19:53:08Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10470

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10470

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10470

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10470

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10470

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10470

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10470

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10470

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10470

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10470

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10470

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10470

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10470

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10470

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10470

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10470

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10470

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10470

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10470

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10470

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10470

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10470

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10470

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10470

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10470

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10470

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10470

commit: fcbf773

github-actions · 2026-10-30T18:50:44Z

API Changes Report

Generated by Break Check on 2026-10-30T22:08:21.131Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

@clerk/shared

Current version: 4.43.1
Recommended bump: MINOR → 4.44.0

Subpath `./types`

🟡 Non-breaking Changes (1)

Modified: `SignOutOptions`

  type SignOutOptions = {
+   __internal_satelliteSignOutRedirectUrl?: string;
    sessionId?: string;
    redirectUrl?: string;
  };

Static analyzer: Breaking change in type alias SignOutOptions: Type changed: {sessionId?:string;redirectUrl?:string;} → {__internal_satelliteSignOutRedirectUrl?:string;sessionId?:string;redirectUrl?:string;}

🤖 AI review (reclassified as non-breaking) (95%): A new optional property __internal_satelliteSignOutRedirectUrl? was added to SignOutOptions, which is used only as an optional input parameter to SignOut; existing callers that omit this property remain valid, so no well-typed consumer code breaks.

Report generated by Break Check

_{Last ran on fcbf773.}

jescalan · 2026-10-30T21:38:24Z

 * Configuration options.
 */
 export type SignOutOptions = {
+  __internal_satelliteSignOutRedirectUrl?: string;


This field is on the public SignOutOptions type but has no /** @internal */ tag, unlike the other __internal_ fields in this file. Our typedoc config uses excludeInternal: true, which hides members by that tag, so this one will appear in the generated signOut() reference docs and in customers' autocomplete. Customers could then pass it to opt arbitrary callbacks into repair, which contradicts the rule that custom callbacks don't opt in. The backend redirect allowlist still limits where users can be sent, so this is about the API contract, not security.

Suggested change

__internal_satelliteSignOutRedirectUrl?: string;

/** @internal */

__internal_satelliteSignOutRedirectUrl?: string;

~ 🤖

Added /** @internal */ to the optional metadata field, matching the existing annotations and excludeInternal configuration. Public signOut overloads and callback signatures remain unchanged. This hides the field from generated reference docs; it is metadata, not a runtime access restriction.

~ 🤖

jescalan · 2026-10-30T21:38:24Z

+      path: persistClient ? this.path() + '/sessions' : '/client',
+      search: { sign_out_redirect_url: redirectUrl },
+    });
+    this.fromJSON((json?.response || json) as ClientJSON | null);
+    SessionTokenCache.clear();
+    if (!persistClient) {
+      this.resetClient();


The only caller, clerk.ts:810, gates repair on persistClient, so this method always gets persistClient: true. The DELETE /client path and the resetClient() branch never run. I left a matching note on the backend's clear action in clerk_go#23504. If persistence-disabled repair is out of scope, both sides can drop it, and this method can lose the persistClient parameter.

~ 🤖

Removed the unused persistClient parameter and DELETE /client/reset branch from the concrete repair transport. It now only removes sessions while retaining the client. Persistence-disabled sign-out continues through the existing destroy branch with no repair redirect; updated transport tests retain the client-state assertions.

~ 🤖

Satellite sign-out could fail before removing sessions when its destination was malformed, and deliberately discarded clients took an unnecessary trip through the primary. Use the original removal and navigation paths for unsupported destinations and disabled client persistence, preserving callback and navigation error behavior. Part of CORE-4146

github-actions Bot added clerk-js ui labels Oct 27, 2026

vercel Bot deployed to Preview – swingset October 27, 2026 19:51

View deployment

tmilewski force-pushed the tom/satellite-device-trust-investigation branch from 5eb5789 to ce188e7 Compare October 27, 2026 20:25

vercel Bot deployed to Preview – clerk-js-sandbox October 27, 2026 20:26

View deployment

vercel Bot deployed to Preview – swingset October 27, 2026 20:29

View deployment

tmilewski force-pushed the tom/satellite-device-trust-investigation branch from ce188e7 to 132bc73 Compare October 30, 2026 18:44

tmilewski marked this pull request as ready for review October 30, 2026 18:44

vercel Bot deployed to Preview – clerk-js-sandbox October 30, 2026 18:45

View deployment

vercel Bot deployed to Preview – swingset October 30, 2026 18:49

View deployment

vercel Bot deployed to Preview – clerk-js-sandbox October 30, 2026 19:03

View deployment

vercel Bot deployed to Preview – swingset October 30, 2026 19:05

View deployment

jescalan reviewed Oct 30, 2026

View reviewed changes

tmilewski added 6 commits October 30, 2026 18:01

fix(clerk-js): repair primary client after satellite sign-out

451396b

fix: preserve UI sign-out navigation during satellite repair

67fb8ba

chore(clerk-js): account for satellite sign-out bundle growth

5134d67

chore(clerk-js): allow measured sign-out bundle growth

a0e6cf2

fix(clerk-js): narrow satellite repair to retained clients

fcbf773

tmilewski force-pushed the tom/satellite-device-trust-investigation branch from 1702463 to fcbf773 Compare October 30, 2026 22:04

vercel Bot deployed to Preview – clerk-js-sandbox October 30, 2026 22:05

View deployment

vercel Bot deployed to Preview – swingset October 30, 2026 22:07

View deployment

tmilewski requested a review from jescalan October 30, 2026 22:07

Navigation Menu

Repository navigation

fix(clerk-js): preserve trusted clients after satellite sign-out - #10470

fix(clerk-js): preserve trusted clients after satellite sign-out#10470
tmilewski wants to merge 6 commits into
mainfrom
tom/satellite-device-trust-investigation

tmilewski commented Oct 27, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

jescalan Oct 30, 2026

Uh oh!

tmilewski Oct 30, 2026

Uh oh!

jescalan Oct 30, 2026

Uh oh!

tmilewski Oct 30, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	__internal_satelliteSignOutRedirectUrl?: string;
	/** @internal */
	__internal_satelliteSignOutRedirectUrl?: string;

Conversation

tmilewski commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Uh oh!

changeset-bot Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Changes Report

Summary

@clerk/shared

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: SignOutOptions

Uh oh!

jescalan Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

tmilewski Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

jescalan Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

tmilewski Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tmilewski commented Oct 27, 2026 •

edited

Loading

changeset-bot Bot commented Oct 27, 2026 •

edited

Loading

vercel Bot commented Oct 27, 2026 •

edited

Loading

coderabbitai Bot commented Oct 27, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 27, 2026 •

edited

Loading

github-actions Bot commented Oct 30, 2026 •

edited

Loading

Subpath `./types`

Modified: `SignOutOptions`