Extension uninstall/install failure can leave generated tokens behind

[ooaaqq]

Problem

A NodeGet-Alert user reported that after using the latest 0.3.3 extension and configuring Telegram alerts, the Dashboard Token page showed many newly-created tokens with empty username.

Original report: ooaaqq/NodeGet-Alert#1

After checking the Alert extension and Board code, this looks like an extension-manager token lifecycle issue rather than NodeGet-Alert creating tokens during alert configuration.

Evidence

In NodeGet-Alert v0.3.3:

• The extension config page saves settings with kv_set_value only.
• The Telegram test path sends a browser fetch() to Telegram; it does not call token_create.
• The worker runtime uses kv_get_value, agent_dynamic_summary_multi_last_query, kv_get_multi_value, and kv_set_value for alert state. It does not call token_create.

The only token_create path I found for normal extension installation is in Board:

• src/composables/useExtensions.ts createExtensionToken() calls token_create with username: null and the extension appJson.limits.
• installExtension() calls createExtensionToken() once for every fresh extension install.

deleteExtension() currently removes cron, JS worker, and the extension KV record, but does not delete the extension token saved in ext.token.

reinstallExtension() deletes the old token only when limits changed; otherwise it reuses the existing token, which is good. But a full delete + install, or an install failure after token creation, can leave generated tokens behind.

This matches the user-visible tokens: empty username and token limits matching extension permissions.

Expected behavior

Dashboard extension manager should probably manage generated extension tokens as part of the extension lifecycle:

1. When deleting an extension, delete the associated generated token (ext.token) if present.
2. If install fails after createExtensionToken() succeeds but before extension metadata is saved, clean up the newly-created token.
3. Optionally create extension tokens with an identifiable username/label such as extension:<extension-name>:<extension-id> so users can understand where they came from.

Reproduction idea

1. Install an extension that declares limits.
2. Observe that Dashboard creates a token with empty username.
3. Delete the extension.
4. Check the Token page: the generated token remains.
5. Repeat install/delete and the token list accumulates.

Notes

This issue was observed while testing NodeGet-Alert, but the Alert extension itself does not create Dashboard tokens when saving Telegram alert settings. The token is created by Board during extension installation.