web: fix auth session races, ws token drift, and unread clear behavior

web/src/components/MessageComposer.tsx

@@ -96,6 +96,7 @@ export function MessageComposer() {
 
   const [text, setText] = useState("");
   const wsRef = useRef<WebSocket | null>(null);
+  const wsTokenRef = useRef<string | null>(null);
   const recorderRef = useRef<MediaRecorder | null>(null);
   const recordingStreamRef = useRef<MediaStream | null>(null);
   const chunksRef = useRef<BlobPart[]>([]);
@@ -252,9 +253,21 @@ export function MessageComposer() {
       if (typingStopTimerRef.current !== null) {
         window.clearTimeout(typingStopTimerRef.current);
       }
+      wsRef.current?.close();
+      wsRef.current = null;
+      wsTokenRef.current = null;
     };
   }, [previewUrl]);
 
+  useEffect(() => {
+    const activeToken = accessToken ?? null;
+    if (wsRef.current && wsTokenRef.current !== activeToken) {
+      wsRef.current.close();
+      wsRef.current = null;
+    }
+    wsTokenRef.current = activeToken;
+  }, [accessToken]);
+
   useEffect(() => {
     if (!activeChatId && recordingStateRef.current !== "idle") {
       stopRecord(false);
@@ -318,11 +331,16 @@ export function MessageComposer() {
     if (!accessToken || !activeChatId) {
       return null;
     }
+    if (wsRef.current && wsTokenRef.current !== accessToken) {
+      wsRef.current.close();
+      wsRef.current = null;
+    }
     if (wsRef.current && wsRef.current.readyState === WebSocket.OPEN) {
       return wsRef.current;
     }
     const wsUrl = buildWsUrl(accessToken);
     wsRef.current = new WebSocket(wsUrl);
+    wsTokenRef.current = accessToken;
     return wsRef.current;
   }