fix(server): prevent silent session forks when switching provider accounts

[DavidIlie]

What changed

Threads can move between provider instances for different accounts—for example, a proxy-backed Codex account and a personal Codex account. T3 previously discarded the stored resume cursor whenever the instance ID changed, even when both instances used the same continuation storage. Codex could also replace a failed resume with a fresh thread. Together, those paths left the UI transcript intact while silently dropping the provider's native context.

Provider instance switches now compare continuation identities. Compatible Codex and Claude Code instances retain the existing cursor and cwd; incompatible or missing source instances fail before adapter startup and preserve the original binding. Codex resume failures now surface instead of falling back to thread/start.

An explicitly supplied resume cursor remains authoritative. Cursor, Grok, and OpenCode keep instance-scoped continuation identities.

Related: #4766 and #5433.

Validation

• pnpm exec vp test run apps/server/src/provider/Layers/CodexSessionRuntime.test.ts apps/server/src/provider/Layers/ProviderService.test.ts apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts apps/server/src/provider/Layers/CodexAdapter.test.ts — 123 tests passed
• pnpm exec vp run --filter t3 typecheck
• Targeted provider lint, formatting, and git diff --check

Model: GPT-5.6 Sol · Harness: Codex in T3 Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 328b26ba-17c9-44d0-bc8b-0bfd152a05d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes runtime behavior by blocking provider account switches that previously succeeded silently (via thread forking). The new validation logic for continuation identity compatibility gates whether sessions can continue, representing a significant behavioral change that should be reviewed by someone familiar with the provider session flow.

^{You can customize Macroscope's approvability policy. Learn more.}

[reed-yang]

Confirmed that this PR addresses a real regression still reproducible on T3 Code v0.0.38.

In the observed stopped-session switch between two Claude account instances sharing the same continuation identity, T3 emitted:

provider.resume_cursor.source=none
provider.resume_cursor.present=false
claude.resume.source=generated-session

It then launched Claude with --session-id instead of --resume, while the UI continued displaying the complete historical thread without warning.

The continuation-identity comparison and the test named carries Claude Code history across account instances sharing a home match the required behavior exactly.

One important regression shape to retain when rebasing: exercise the full ProviderCommandReactor ordering where the model-selection update to instance B is projected before the next stopped-session turn starts. That ordering causes the reactor to lose sight of source instance A and is what triggered the real incident.

Could this PR be rebased onto current main and reviewed? GitHub currently reports it as conflicting, while the released and current-main paths still contain the instance-ID equality gate.

[DavidIlie]

pllsssss merge

[shivamhwp]

Note: GPT-6 on behalf of shivam (@shivamhwp).

The explicit-cursor shortcut needs to preserve the newer instance-owned conversation guard when rebasing. With an Antigravity thread bound to instance A, startSession on instance B with a supplied { sessionId } now skips compatibility validation and starts B. Current main rejects this and retains A's binding, including when A has been removed. Antigravity resume state belongs to its original profile, so a caller-supplied cursor cannot establish compatibility with B.

Keep the intended explicit-cursor behavior for Codex and Claude while retaining the ownership check for instance-scoped providers. The cross-driver restriction and the existing test's deliberate clearing of the old cursor should remain as authored. The rebase also needs to retain current Codex metadata-only resume parsing and excludeTurns while removing the fresh-thread fallback.