fix(provider): make session ownership transitions atomic

[bdsqqq]

What Changed

serialize provider session ownership transitions per thread, and fence delayed updates with a session generation.

failed start and resume attempts now clean up only the child and mcp credential created by that attempt. during cross-instance replacement, the committed session stays active until replacement persistence succeeds. same-instance activeSession: "replace" remains a destructive restart because adapters expose one session per thread.

Why

provider startup could orphan a child when adapter startup succeeded but persistence failed. concurrent start, resume, stop, recovery, and delayed updates could also overwrite newer ownership state.

i hit this while adding pi: a session started successfully, failed to persist the files it needed, and then nobody owned the child.

so the persisted binding is now the ownership boundary. transitions around it are serialized, stale updates are rejected by generation, and cleanup is scoped to resources created by the failed attempt. cleanup failures stay secondary to the original lifecycle failure.

Stack

1. #4189 — revoke credentials by provider session
2. #4190 — make session ownership transitions atomic (this PR)
3. #4191 — list only committed sessions

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Note

Make provider session ownership transitions atomic with per-thread locking and generation tracking

• Adds per-thread Semaphore-based locking and a generation counter to ProviderService so that session start, stop, send-turn, and recovery operations are serialized per thread and stale updates from superseded sessions are silently dropped.
• MCP credential lifecycle is now managed atomically with session persistence: new helpers (prepareMcpSession, commitMcpSession, rollbackMcpSession) issue, selectively revoke, or restore credentials as a unit with session binding changes.
• startSession accepts a new activeSession: 'reuse' | 'replace' option; ProviderCommandReactor passes 'replace' on restart and omits the option otherwise.
• McpSessionRegistry gains issueUncommittedMcpCredential and revokeActiveMcpProviderSession to support selective, single-credential revocation without affecting other credentials on the same thread.
• Risk: session operations that previously ran concurrently are now serialized under a per-thread lock, which may increase latency under high-concurrency workloads on a single thread.

📊 Macroscope summarized d3b944e. 4 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 920f1f97-c081-4034-b10e-801fcbe7ef0b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}