Allow retrying provider authentication failures

- Detect provider auth failures in persisted assistant responses
- Retry with a fresh provider message ID while preserving the transcript message
- Update orchestration contracts, chat UI state, and coverage

Author: badcuban

apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts

@@ -607,6 +607,71 @@ describe("ProviderCommandReactor", () => {
     });
   });
 
+  it("uses a fresh provider message id when retrying a persisted user message", async () => {
+    const harness = await createHarness();
+    const threadId = ThreadId.make("thread-1");
+    const messageId = asMessageId("user-message-retry");
+    const now = "2026-01-01T00:00:00.000Z";
+
+    await Effect.runPromise(
+      harness.engine.dispatch({
+        type: "thread.turn.start",
+        commandId: CommandId.make("cmd-turn-before-retry"),
+        threadId,
+        message: {
+          messageId,
+          role: "user",
+          text: "retry this request",
+          attachments: [],
+        },
+        interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
+        runtimeMode: "approval-required",
+        createdAt: now,
+      }),
+    );
+    await waitFor(() => harness.sendTurn.mock.calls.length === 1);
+
+    await Effect.runPromise(
+      harness.engine.dispatch({
+        type: "thread.session.set",
+        commandId: CommandId.make("cmd-mark-turn-failed"),
+        threadId,
+        session: {
+          threadId,
+          status: "error",
+          providerName: "codex",
+          providerInstanceId: ProviderInstanceId.make("codex"),
+          runtimeMode: "approval-required",
+          activeTurnId: null,
+          lastError: "authentication expired",
+          updatedAt: "2026-01-01T00:00:01.000Z",
+        },
+        createdAt: "2026-01-01T00:00:01.000Z",
+      }),
+    );
+    await Effect.runPromise(
+      harness.engine.dispatch({
+        type: "thread.turn.retry",
+        commandId: CommandId.make("cmd-turn-retry"),
+        threadId,
+        createdAt: "2026-01-01T00:00:02.000Z",
+      }),
+    );
+
+    await waitFor(() => harness.sendTurn.mock.calls.length === 2);
+    expect(harness.sendTurn.mock.calls[0]?.[0]).toMatchObject({ messageId });
+    expect(harness.sendTurn.mock.calls[1]?.[0]).toMatchObject({
+      threadId,
+      input: "retry this request",
+    });
+    const retryProviderMessageId = (
+      harness.sendTurn.mock.calls[1]?.[0] as { messageId?: MessageId } | undefined
+    )?.messageId;
+    expect(retryProviderMessageId).toBeDefined();
+    expect(retryProviderMessageId).not.toBe(messageId);
+    await harness.drain();
+  });
+
   it("reacts to thread.goal.set by ensuring a session and setting the provider goal", async () => {
     const harness = await createHarness();
     const now = "2026-01-01T00:00:00.000Z";

apps/server/src/orchestration/Layers/ProviderCommandReactor.ts

@@ -854,6 +854,7 @@ const make = Effect.gen(function* () {
   const buildSendTurnRequestForThread = Effect.fnUntraced(function* (input: {
     readonly threadId: ThreadId;
     readonly messageId: MessageId;
+    readonly providerMessageId?: MessageId;
     readonly messageText: string;
     readonly attachments?: ReadonlyArray<ChatAttachment>;
     readonly skills?: ReadonlyArray<ChatSkillReference>;
@@ -998,7 +999,7 @@ const make = Effect.gen(function* () {
 
     return {
       threadId: input.threadId,
-      messageId: input.messageId,
+      messageId: input.providerMessageId ?? input.messageId,
       ...(normalizedInput ? { input: normalizedInput } : {}),
       ...(normalizedAttachments.length > 0 ? { attachments: normalizedAttachments } : {}),
       ...(input.skills !== undefined && input.skills.length > 0 ? { skills: input.skills } : {}),
@@ -1282,6 +1283,9 @@ const make = Effect.gen(function* () {
     const sendTurnRequest = yield* buildSendTurnRequestForThread({
       threadId: event.payload.threadId,
       messageId: event.payload.messageId,
+      ...(event.payload.providerMessageId !== undefined
+        ? { providerMessageId: event.payload.providerMessageId }
+        : {}),
       messageText: message.text,
       ...(message.attachments !== undefined ? { attachments: message.attachments } : {}),
       ...(event.payload.skills !== undefined ? { skills: event.payload.skills } : {}),

apps/server/src/orchestration/decider.ts

@@ -1,12 +1,14 @@
 import {
   DEFAULT_PROJECT_KIND,
+  MessageId,
   type OrchestrationCommand,
   type OrchestrationEvent,
   type OrchestrationReadModel,
 } from "@threadlines/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import { areFilesystemPathsEqual } from "@threadlines/shared/path";
+import { findProviderAuthRetryUserMessageIndex } from "@threadlines/shared/providerAuth";
 
 import { OrchestrationCommandInvariantError } from "./Errors.ts";
 import {
@@ -716,13 +718,19 @@ export const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand"
           detail: `Thread '${command.threadId}' already has a turn in flight and cannot retry.`,
         });
       }
-      if (!session || session.lastError === null) {
+      const providerAuthRetryUserMessageIndex = findProviderAuthRetryUserMessageIndex(
+        targetThread.messages,
+      );
+      if (!session || (session.lastError === null && providerAuthRetryUserMessageIndex === null)) {
         return yield* new OrchestrationCommandInvariantError({
           commandType: command.type,
           detail: `Thread '${command.threadId}' has no failed turn to retry.`,
         });
       }
-      const lastUserMessage = targetThread.messages.findLast((message) => message.role === "user");
+      const lastUserMessage =
+        providerAuthRetryUserMessageIndex === null
+          ? targetThread.messages.findLast((message) => message.role === "user")
+          : targetThread.messages[providerAuthRetryUserMessageIndex];
       if (!lastUserMessage) {
         return yield* new OrchestrationCommandInvariantError({
           commandType: command.type,
@@ -731,9 +739,9 @@ export const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand"
       }
       // Mirrors thread.turn.start, but re-points at the persisted last user
       // message instead of appending a new one: the transcript keeps a single
-      // bubble and attachments are reused as stored. lastError is carried
-      // forward (as in turn.start) so the failure stays visible until the
-      // provider actually accepts the turn.
+      // bubble and attachments are reused as stored. A projected lastError is
+      // carried forward (as in turn.start); providers that encode auth failure
+      // as a completed assistant response can legitimately keep it null.
       const retrySessionEvent: Omit<OrchestrationEvent, "sequence"> = {
         ...withEventBase({
           aggregateKind: "thread",
@@ -771,6 +779,11 @@ export const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand"
         payload: {
           threadId: command.threadId,
           messageId: lastUserMessage.id,
+          // Claude uses the provider-facing message id as a command UUID and
+          // ignores a repeated UUID after reporting it completed. Keep the
+          // persisted transcript message id stable while giving every retry
+          // attempt a fresh provider command identity.
+          providerMessageId: MessageId.make(crypto.randomUUID()),
           runtimeMode: targetThread.runtimeMode,
           interactionMode: targetThread.interactionMode,
           ...(lastUserMessage.skills !== undefined ? { skills: lastUserMessage.skills } : {}),

apps/server/src/orchestration/decider.turnRetry.test.ts

@@ -152,6 +152,7 @@ describe("decider turn retry", () => {
       payload: {
         threadId,
         messageId: MessageId.make("message-user-2"),
+        providerMessageId: expect.any(String),
         runtimeMode: "full-access",
         interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
         skills: [
@@ -162,6 +163,10 @@ describe("decider turn retry", () => {
         ],
       },
     });
+    if (events[1]?.type !== "thread.turn-start-requested") {
+      throw new Error("Expected retry turn start event.");
+    }
+    expect(events[1].payload.providerMessageId).not.toBe(events[1].payload.messageId);
   });
 
   it("emits events the projector can apply", async () => {
@@ -247,6 +252,63 @@ describe("decider turn retry", () => {
     ).rejects.toThrow("has no failed turn to retry");
   });
 
+  it("retries a completed Claude authentication response without duplicating the user message", async () => {
+    const authMessageId = MessageId.make("message-assistant-auth");
+    const settledAuthThread = makeThread({
+      latestTurn: {
+        turnId: TurnId.make("turn-auth"),
+        state: "completed",
+        requestedAt: "2026-01-01T00:00:01.000Z",
+        startedAt: "2026-01-01T00:00:02.000Z",
+        completedAt: "2026-01-01T00:00:04.000Z",
+        assistantMessageId: authMessageId,
+      },
+      messages: [
+        ...makeThread().messages,
+        {
+          id: authMessageId,
+          role: "assistant",
+          text: "Not logged in · Please run /login",
+          turnId: TurnId.make("turn-auth"),
+          streaming: false,
+          createdAt: "2026-01-01T00:00:04.000Z",
+          updatedAt: "2026-01-01T00:00:04.000Z",
+        },
+      ],
+      session: {
+        ...failedSession,
+        status: "ready",
+        lastError: null,
+      },
+    });
+
+    const decided = await Effect.runPromise(
+      decideOrchestrationCommand({
+        command: retryCommand,
+        readModel: makeReadModel(settledAuthThread),
+      }),
+    );
+    const events = Array.isArray(decided) ? decided : [decided];
+
+    expect(events).toHaveLength(2);
+    expect(events[0]).toMatchObject({
+      type: "thread.session-set",
+      payload: {
+        session: {
+          status: "starting",
+          lastError: null,
+        },
+      },
+    });
+    expect(events[1]).toMatchObject({
+      type: "thread.turn-start-requested",
+      payload: {
+        messageId: MessageId.make("message-user-2"),
+        providerMessageId: expect.any(String),
+      },
+    });
+  });
+
   it("rejects retrying a thread without user messages", async () => {
     const emptyThread = makeThread({ messages: [] });
 

apps/web/src/components/ChatView.logic.test.ts

@@ -24,6 +24,7 @@ import {
   backgroundRunCommandsMatch,
   deriveComposerSendState,
   deriveDetectedBackgroundRunLabel,
+  deriveFailedTurnRetryMessageId,
   deriveProviderBackgroundRuns,
   deriveProviderAuthReconnectPrompt,
   desktopCapturedScreenshotToFile,
@@ -39,6 +40,7 @@ import {
   reconcileMountedTerminalThreadIds,
   resolveSendEnvMode,
   shouldConfirmTerminalKill,
+  shouldOfferFailedTurnRetry,
   shouldRefreshThreadDetailAfterEventLoopStall,
   shouldWriteThreadErrorToCurrentServerThread,
   THREAD_DETAIL_STALL_REFRESH_COOLDOWN_MS,
@@ -474,6 +476,79 @@ describe("deriveProviderAuthReconnectPrompt", () => {
   });
 });
 
+describe("deriveFailedTurnRetryMessageId", () => {
+  const userMessage = {
+    id: MessageId.make("message-user"),
+    role: "user" as const,
+    text: "retry me",
+  };
+
+  it("targets a session failure or a completed provider-auth response", () => {
+    expect(
+      deriveFailedTurnRetryMessageId({
+        messages: [userMessage],
+        sessionLastError: "Provider process exited",
+      }),
+    ).toBe(userMessage.id);
+    expect(
+      deriveFailedTurnRetryMessageId({
+        messages: [
+          userMessage,
+          {
+            id: MessageId.make("message-auth"),
+            role: "assistant",
+            text: "Not logged in · Please run /login",
+          },
+        ],
+        sessionLastError: null,
+      }),
+    ).toBe(userMessage.id);
+    expect(
+      deriveFailedTurnRetryMessageId({
+        messages: [
+          userMessage,
+          {
+            id: MessageId.make("message-success"),
+            role: "assistant",
+            text: "Request completed.",
+          },
+        ],
+        sessionLastError: null,
+      }),
+    ).toBeNull();
+  });
+});
+
+describe("shouldOfferFailedTurnRetry", () => {
+  it("uses the session lifecycle instead of a stale projected turn", () => {
+    const failedMessageId = MessageId.make("message-user");
+
+    expect(
+      shouldOfferFailedTurnRetry({
+        isServerThread: true,
+        failedMessageId,
+        orchestrationStatus: "stopped",
+      }),
+    ).toBe(true);
+    expect(
+      shouldOfferFailedTurnRetry({
+        isServerThread: true,
+        failedMessageId,
+        orchestrationStatus: "ready",
+      }),
+    ).toBe(true);
+    for (const orchestrationStatus of ["starting", "running"] as const) {
+      expect(
+        shouldOfferFailedTurnRetry({
+          isServerThread: true,
+          failedMessageId,
+          orchestrationStatus,
+        }),
+      ).toBe(false);
+    }
+  });
+});
+
 describe("isRetryableThreadError", () => {
   function runtimeErrorActivity(input: {
     id: string;

apps/web/src/components/ChatView.logic.ts

@@ -1,5 +1,6 @@
 import {
   type EnvironmentId,
+  type MessageId,
   type OrchestrationRevertPlan,
   ProjectId,
   type ModelSelection,
@@ -10,6 +11,7 @@ import {
   type TurnId,
 } from "@threadlines/contracts";
 import {
+  findProviderAuthRetryUserMessageIndex,
   isProviderAuthErrorMessage,
   providerAuthReconnectCommand,
 } from "@threadlines/shared/providerAuth";
@@ -1527,6 +1529,37 @@ export function deriveProviderAuthReconnectPrompt(input: {
   return null;
 }
 
+export function deriveFailedTurnRetryMessageId(input: {
+  readonly messages: ReadonlyArray<Pick<ChatMessage, "id" | "role" | "text">>;
+  readonly sessionLastError: string | null | undefined;
+}): MessageId | null {
+  const lastUserMessage = input.messages.findLast((message) => message.role === "user");
+  if (!lastUserMessage) {
+    return null;
+  }
+  if (input.sessionLastError?.trim()) {
+    return lastUserMessage.id;
+  }
+
+  const authRetryUserMessageIndex = findProviderAuthRetryUserMessageIndex(input.messages);
+  return authRetryUserMessageIndex === null
+    ? null
+    : (input.messages[authRetryUserMessageIndex]?.id ?? null);
+}
+
+export function shouldOfferFailedTurnRetry(input: {
+  readonly isServerThread: boolean;
+  readonly failedMessageId: MessageId | null;
+  readonly orchestrationStatus: ThreadSession["orchestrationStatus"] | null | undefined;
+}): boolean {
+  return (
+    input.isServerThread &&
+    input.failedMessageId !== null &&
+    input.orchestrationStatus !== "starting" &&
+    input.orchestrationStatus !== "running"
+  );
+}
+
 /** Error classes where re-running the same turn would reproduce the failure;
  *  those surfaces get their own affordances (auth reconnect, usage reset). */
 const NON_RETRYABLE_RUNTIME_ERROR_CLASSES: ReadonlySet<string> = new Set([