Stop Cable when authentication ends

[robzolkos]

What changed

• stop the Action Cable client when reconnect authentication definitively fails
• keep network failures, rate limits, and temporary credential storage failures retryable
• preserve the authentication error through hey watch and the TUI connection lifecycle
• update Action Cable to the commit proposed in Stop reconnecting on terminal application errors actioncable-client#9

Validation

• make test
• make lint

This is stacked on #464 because that PR separates a missing credential from a temporary storage failure. It also depends on basecamp/actioncable-client#9. Neither dependency should be merged through this PR.

Basecamp card

---

Summary by cubic

Stops the Action Cable client from retrying reconnects when authentication definitively fails, so hey watch exits with the real auth error instead of retrying forever. Network failures, rate limits, and temporary credential storage failures stay retryable; terminal watch errors beat queued change notifications.

• Mail and calendar watches surface the original stop reason to the TUI, including authentication errors, and retry temporary failures.
• Bumps actioncable-go to v1.1.0 and updates the Nix vendor hash.
• Stacked on Distinguish missing credentials from storage failures #464; it should not be merged through this PR.

^{Written for commit e165bef. Summary will update on new commits.}

[cursor]

Stale comment

Approved. Cursor Bugbot and Cursor Security Agent were not present after the first check poll, so those signals were skipped; no approval policy required human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[Copilot]

Copilot review overview

🟡 Changes recommended

The TUI discards terminal authentication errors when active subscriptions close and continues retrying some watches.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Propagate TUI subscription auth errors to stop non-retryable reconnects · New

What changed in this PR

Stops Action Cable reconnects after definitive authentication failures while retaining retries for transient failures.

Changes:

• Classifies and preserves authentication failures.
• Adds terminal-error handling and reconnect tests.
• Updates actioncable-go to PR #9’s commit.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
internal/​cmd/​watch.go	Preserves authentication errors through watch shutdown.
internal/​cmd/​watch_test.go	Tests authentication error preservation.
internal/​cable/​cable.go	Stops reconnecting on terminal auth failures.
internal/​cable/​cable_test.go	Tests terminal and retryable failure handling.
go.mod	Updates Action Cable dependency.
go.sum	Records dependency checksums.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Calendar subscriptions added during polling can still discard authentication failures and schedule another retry.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Propagate subscription authentication failures from calendar polling · New

Resolved since last review (1)

• Propagate TUI subscription auth errors to stop non-retryable reconnects

[Copilot]

Copilot review overview

🟡 Changes recommended

Rate-limited calendar startup can permanently disable updates, and a race can discard terminal calendar errors.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Ensure terminal calendar events replace concurrent doorbells · New

Resolved since last review (1)

• Propagate subscription authentication failures from calendar polling

Previously missed (1)

In code that hasn't changed since last review

Retry calendar watch startup failures caused by rate limits

internal/​tui/​tui.go:454

calendarWatchFailed delegates to retryableMailWatchError, which only accepts CodeNetwork. An initial ListWithChanges response classified as CodeRateLimit therefore drops the calendar watch permanently, whereas this path retried every startup failure before this change and the PR explicitly says rate limits remain retryable. Include rate-limit errors in the retry policy and cover the startup path with a test.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Temporary credential-storage failures can permanently stop calendar watches instead of remaining retryable.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Ensure terminal calendar events replace concurrent doorbells

Previously missed (1)

In code that hasn't changed since last review

Preserve calendar watch retries for temporary credential-store failures

internal/​tui/​live.go:155

retryableWatchError also gates calendar startup failures, but temporary credential-store failures remain plain wrapped errors (credentialLoadError in internal/auth/auth.go:531-535). apierr.FromSDK therefore classifies them as a generic API error, so this returns false and calendarWatchFailed permanently drops a watch whose initial ListWithChanges hit a locked/unavailable keyring. Preserve retry behavior for storage failures (or have the calendar path stop only explicit authentication failures) and cover that case with a test.

[robzolkos]

Follow-up in 59a398c: calendar watches now stop only for explicit authentication failures. Rate limits, temporary credential-storage failures, network failures, and other transient startup errors keep the existing retry behavior. Added focused coverage for both rate limits and unavailable credential storage.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Authentication and concurrent stream shutdown behavior depends on two unmerged prerequisite changes and warrants final human verification.

Review effort: Balanced
Findings: None

[cursor]

Security review — filesystem_workspace_boundary module

All changed files in this PR are exclusively about WebSocket/Action Cable connection lifecycle and authentication error propagation. No added or modified lines touch workspace paths, plugin/cache/tarball paths, git status paths, project or canvas paths, or any agent/MCP/tool-controlled filesystem inputs.

No filesystem or workspace boundary findings.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[Copilot]

Copilot review overview

🔵 Needs a closer look

The concurrency-sensitive lifecycle changes depend on an open upstream Action Cable PR and stacked authentication changes.

Review effort: Balanced
Findings: None

Dismissed the prior approval because Cursor Security Agent was present on this head but completed as skipped, so the required security-review signal did not finish successfully. Cursor Bugbot was not present after the first poll. No reviewers were assigned.

[cursor]

Left a non-blocking comment; I did not approve and no reviewers were assigned. Cursor Bugbot was not present after the first poll, and the present Cursor Security Agent check completed as skipped, so this head does not meet the approval criteria. Human review is needed.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}