fix(client-runtime): retry auth-blocked reconnects during server-update resume

[gannonh]

What Changed

nudgeReconnectDuringUpdateRestart now also retries when the connection supervisor is blocked on authentication during a remote server-update resume. Permission and configuration blocks stay idle.

Why

A restarted remote server can reject the first environment credential. The supervisor then parks in blocked, and the resume loop used to stop nudging because it only watched backoff. Recovery could sit until the four-minute timeout.

This ports upstream pingdotgg/t3code#7953 and keeps the existing one-second pacing and four-minute resume lifetime.

Scope

• packages/client-runtime/src/state/server.ts. Widen the nudge stream type and admit phase === "blocked" only when lastFailure?.reason === "authentication".
• packages/client-runtime/src/state/server.test.ts. Helper filter test plus a command-boundary test of createServerEnvironmentAtoms(...).updateServer.

Out of scope: credential storage, authorization policy, supervisor retry policy, contracts, server, UI.

Closes #134

Tradeoffs

Retrying every blocked reason would hide real setup failures. The filter admits only authentication.

Blast Radius

Web, desktop, and mobile share this client-runtime command. Remote update resume is the only new retry path. Idle blocked permission and configuration behavior is unchanged.

Verification

• vp test run packages/client-runtime/src/state/server.test.ts (15 passed)
• vp run --filter @kata-sh/code-client-runtime typecheck (exit 0)
• Identity grep of the diff for @t3tools/, T3CODE_, t3@, t3code, pingdotgg/t3code (no matches)

Build report: #134 (comment)

Acceptance criteria matrix

Full matrix: #134 (comment)

Criterion	Result	Evidence
Every backoff entry schedules one reconnect nudge after the existing pacing interval	Pass	Helper tests: 3 backoff entries, 3 nudges; TestClock pacing
An authentication-blocked state schedules one reconnect nudge after the existing pacing interval	Pass	updateServer command-boundary test plus filter
Permission-blocked and configuration-blocked states schedule no reconnect nudge	Pass	Helper streams permission, authentication, configuration; expects 1 retry
Retry loop stops when the update command settles, fails, or reaches its existing resume timeout	Pass	Command test settles to idle. Fail and timeout paths not driven. Lifetime still forkChild plus timeoutOption (4 minutes)
Deterministic command test: transient auth block, ready event, success, idle	Pass	recovers the update command after a transient credential rejection
Focused client-runtime server tests and typecheck pass	Pass	15 tests, typecheck exit 0
Product diff preserves #127 Kata update copy and contains no new T3 identity	Pass	@kata-sh/code-cli@ copy test; identity grep empty

Totals: 7 Pass / 0 Fail / 0 Blocked (acceptance checkboxes). Supplementary live remote update: Blocked (no disposable target).

Convergence: #134 (comment)

UI Changes

None.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d4649ab5-3006-449a-9c03-4ab0c2c9bd41

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gannonh]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f2875ccb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".