fix(server): prevent silent session forks when switching provider accounts

[DavidIlie]

Problem

T3 Code can configure multiple instances of the same provider for different accounts—for example, a CLI-proxy account and a personal account for either Codex or Claude Code.

When an existing thread moved between account instances, ProviderService discarded its persisted resume cursor whenever the instance IDs differed, even when both instances shared the same continuation storage. That provider-wide behavior could start a blank native session and overwrite resume_cursor_json, leaving the UI transcript intact while the agent had no native context.

Codex had a second destructive path: it treated a failed thread/resume as permission to call thread/start.

Related: #4766 and #5433.

Fix

ProviderService.startSession now compares provider continuation identities before crossing account instance IDs. Codex and Claude Code instances that share their configured home carry the persisted cursor and cwd. Instances with incompatible storage, or a removed source configuration, fail before adapter startup and leave the original binding unchanged across retries.

Cursor, Grok, and OpenCode currently advertise instance-scoped continuation storage. Switching those providers between instances therefore fails loudly and preserves the cursor instead of assuming that another account can resolve it.

An explicitly supplied resume cursor remains authoritative, so a deliberate recovery can proceed without validating stale persisted state from an old account configuration.

Codex resume failures now propagate without starting a replacement thread.

Verification

• pnpm exec vp test run apps/server/src/provider/Layers/CodexSessionRuntime.test.ts apps/server/src/provider/Layers/ProviderService.test.ts apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts apps/server/src/provider/Layers/CodexAdapter.test.ts (123 passed)
• pnpm exec vp run --filter t3 typecheck
• Targeted provider lint, formatting, and git diff --check

Non-goals

• No session-history reconstruction or force-new escape hatch.
• No changes to provider continuation identity definitions.
• No changes to session lifecycle projection or general stopped-session routing.

Authored with Codex (GPT-5.6 Sol) in T3 Code.

---

Note

Medium Risk
Changes session restart and cross-account routing for persisted provider state; failed Codex resumes now error instead of auto-recovering with a fresh thread.

Overview
Fixes thread history loss when switching between provider account instances (e.g. personal vs proxy Codex) that share the same underlying storage.

ProviderService.startSession now treats instance IDs as routing labels and compares continuationIdentity (driver + continuation key) before reusing a persisted resume cursor or cwd across a different instance. Compatible instances get the stored cursor/cwd; incompatible switches or an unavailable previous instance fail with ProviderValidationError before any adapter runs, leaving the persisted binding unchanged. An explicitly requested resumeCursor still wins and skips stale persisted validation.

Codex no longer treats failed thread/resume as a signal to fall back to thread/start—resume errors surface to the caller instead of silently starting a blank thread.

Tests cover cross-instance continuation, orchestration error surfacing on stopped-session restart failure, and updated Codex open-thread behavior.

^{Reviewed by Cursor Bugbot for commit 9d16f9b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent silent session forks when switching provider accounts by validating continuation identity

• ProviderService.startSession now checks whether persisted resume state is compatible before reusing it across provider instance switches, comparing continuationIdentity (driver kind and continuation key) between the old and new instances.
• If the previous instance is unavailable or has an incompatible continuation identity, startSession returns a ProviderValidationError instead of silently starting a new session with stale state.
• CodexSessionRuntime.openCodexThread removes the fallback that previously started a fresh thread on recoverable resume errors; resume failures now propagate up as errors.
• Risk: sessions that previously recovered silently by forking a new thread will now surface as errors, requiring callers to handle the failure explicitly.

^{Macroscope summarized 9d16f9b.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 328b26ba-17c9-44d0-bc8b-0bfd152a05d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes runtime behavior by blocking provider account switches that previously succeeded silently (via thread forking). The new validation logic for continuation identity compatibility gates whether sessions can continue, representing a significant behavioral change that should be reviewed by someone familiar with the provider session flow.

^{You can customize Macroscope's approvability policy. Learn more.}