fix(client-runtime): re-pairing at a new address uses the new token

packages/client-runtime/src/connection/registry.test.ts

@@ -2090,6 +2090,38 @@ describe("EnvironmentRegistry routes", () => {
     }),
   );
 
+  it.effect("re-pairing at another loopback address prefers the new route", () =>
+    Effect.gen(function* () {
+      const loopback = (connectionId: string, host: string) =>
+        [
+          new BearerConnectionTarget({ ...LAN_TARGET, connectionId }),
+          new BearerConnectionProfile({
+            ...LAN_PROFILE,
+            connectionId,
+            httpBaseUrl: `http://${host}:3773/`,
+            wsBaseUrl: `ws://${host}:3773/`,
+          }),
+        ] as const;
+      const [savedTarget, savedProfile] = loopback("bearer:ip", "127.0.0.1");
+      const [pastedTarget, pastedProfile] = loopback("bearer:localhost", "localhost");
+      const harness = yield* makeHarness(
+        [savedTarget, RELAY_TARGET],
+        [savedProfile],
+        [[savedTarget.connectionId, BEARER_CREDENTIAL]],
+      );
+      yield* Effect.gen(function* () {
+        const registry = yield* EnvironmentRegistry.EnvironmentRegistry;
+        yield* registry.register(lanRegistration(pastedTarget, pastedProfile));
+
+        expect(routesOf(yield* Ref.get(harness.storedTargets), LAN_TARGET.environmentId)).toEqual([
+          pastedTarget,
+          savedTarget,
+          RELAY_TARGET,
+        ]);
+      }).pipe(Effect.provide(harness.layer), Effect.scoped);
+    }),
+  );
+
   it.effect(
     "adding a saved SSH host again replaces its route, whatever id it was saved under",
     () =>

packages/client-runtime/src/connection/routes.test.ts

@@ -89,6 +89,17 @@ describe("connection routes", () => {
     expect(upsertRoute([RELAY, LAN], repaired)).toEqual([RELAY, repaired]);
   });
 
+  it("puts a newly paired route ahead of saved routes of the same kind", () => {
+    const pasted = direct("lan-2", "http://192.168.1.11:3773/");
+    expect(upsertRoute([LAN, TAILNET], pasted)).toEqual([pasted, LAN, TAILNET]);
+  });
+
+  it("keeps a newly paired route behind a different kind of the same rank", () => {
+    const vpn = direct("vpn", "http://100.101.102.103:3773/");
+    const pasted = direct("ts-2", "http://[fd7a:115c:a1e0::2]:3773/");
+    expect(upsertRoute([vpn, TAILNET], pasted)).toEqual([vpn, pasted, TAILNET]);
+  });
+
   it("shows a dragged order only until the saved routes catch up or change", () => {
     const dragged = ["tailnet", "lan"];
     expect(pendingRouteOrder(dragged, ["lan", "tailnet"])).toBe(dragged);

packages/client-runtime/src/connection/routes.ts

@@ -115,11 +115,14 @@ const ROUTE_KIND_RANK: Record<ConnectionRouteKind, number> = {
 export function insertRoute(
   routes: ReadonlyArray<ConnectionRoute>,
   route: ConnectionRoute,
+  { aheadOfSameKind = false }: { readonly aheadOfSameKind?: boolean } = {},
 ): ReadonlyArray<ConnectionRoute> {
-  const rank = ROUTE_KIND_RANK[connectionRouteKind(route)];
-  const index = routes.findIndex(
-    (existing) => ROUTE_KIND_RANK[connectionRouteKind(existing)] > rank,
-  );
+  const kind = connectionRouteKind(route);
+  const rank = ROUTE_KIND_RANK[kind];
+  const index = routes.findIndex((existing) => {
+    const existingKind = connectionRouteKind(existing);
+    return ROUTE_KIND_RANK[existingKind] > rank || (aheadOfSameKind && existingKind === kind);
+  });
   return index === -1
     ? [...routes, route]
     : [...routes.slice(0, index), route, ...routes.slice(index)];
@@ -132,7 +135,9 @@ export function upsertRoute(
   const id = connectionRouteId(route.target);
   return routes.some((existing) => connectionRouteId(existing.target) === id)
     ? routes.map((existing) => (connectionRouteId(existing.target) === id ? route : existing))
-    : insertRoute(routes, route);
+    : // A route paired at a new address, such as localhost beside a saved
+      // 127.0.0.1, goes first among its kind so its fresh credential connects.
+      insertRoute(routes, route, { aheadOfSameKind: true });
 }
 
 export function findRouteToSameAddress(