- Shipped
- August 7, 2026 at 4:57 PM UTC
- Author
- kamo
- Commit
- 12a85b1
The client activity tracker only ever gated whether we asked to extend; it never told the backend anything. SecurityService renewed the session TTL on every request that resolved a session, so the pollers that run regardless of user activity — the useUserInfo rights refresh every 5 minutes above all — kept the session alive all night and it could never expire. Stamp X-Kamo-Idle-Ms in the fetch layer alongside X-***-Token and forward it through the API proxy, so the backend can tell a real interaction from a background poll. getIdleMs() reports MAX_SAFE_INTEGER once tracking is disabled at logout, and never a negative value, which the server reads as "no signal" and would treat as active.