fix(core,web): retry transport and quota LLM errors, disable dead sessions on auth failure (#82)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

packages/web/src/api/endpoints.ts

@@ -51,6 +51,7 @@ import type {
   SessionTracesResponse,
   SkillInstallRequest,
   SkillLibraryResponse,
+  RetryNowResponse,
   SteerRequest,
   TaskCreateRequest,
   TaskCreateResponse,
@@ -265,6 +266,13 @@ export const postAbort = (sessionId: string) =>
     body: {},
   });
 
+/** "Retry now" on the reconnect countdown: skips the remaining backoff wait server-side (skipped:false is the benign "no wait in progress" case — e.g. the timer elapsed in a race — never an error). */
+export const postRetryNow = (sessionId: string) =>
+  apiFetch<RetryNowResponse>(`/api/sessions/${encodeURIComponent(sessionId)}/retry-now`, {
+    method: "POST",
+    body: {},
+  });
+
 /** Mid-run steering: queues a message for the running Task (delivered between turns as a standalone `[user_steering]` user message); 409 not_running when no Task is in progress. */
 export const postSteer = (sessionId: string, body: SteerRequest) =>
   apiFetch<void>(`/api/sessions/${encodeURIComponent(sessionId)}/steer`, {

packages/web/src/api/sse.ts

@@ -3,7 +3,8 @@
  *
  * - OmniMessage uses the default event (no `event:` line); data is the message envelope as
  *   raw JSON;
- * - Server events use `event: server_event` (approval_request / task_state / resync_required / hello);
+ * - Server events use `event: server_event` (approval_request / task_state / resync_required /
+ *   credentials_updated / hello);
  * - EventSource can't set custom request headers, so auth relies on same-origin cookies; on
  *   disconnect, the browser auto-reconnects and attaches a `Last-Event-ID` header (the server
  *   replays from its ring buffer; if the event was already evicted, it pushes resync_required