fix: a failed save can be retried, and the card can't be submitted twice

If recording a saved answer failed, the stored value stayed behind and the
user's retry was refused as already answered; the value is now removed so the
card can be saved again. The secret card guards against a double submit
synchronously on web and mobile. request_secret's docs say a new
clientRequestId asks again after timed_out or cancelled.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: juliusmarminge

apps/mobile/src/features/threads/SecretRequestCard.tsx

@@ -11,7 +11,7 @@ import {
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
 import type { EnvironmentId, OrchestrationV2ProjectedTurnItem } from "@t3tools/contracts";
-import { useState } from "react";
+import { useRef, useState } from "react";
 import { Pressable, View, type ColorValue } from "react-native";
 
 import { SymbolView, type AppSymbolName } from "../../components/AppSymbol";
@@ -76,16 +76,21 @@ function PendingSecretRequestForm(props: {
   const [secret, setSecret] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // Submit then a tap can both run before a re-render; this guard is synchronous.
+  const inFlight = useRef(false);
 
   const send = async (
     reply: { readonly type: "save"; readonly secret: string } | { readonly type: "decline" },
   ) => {
     const input = secretRequestAnswerInput(item, reply);
-    if (input === null || submitting) return;
+    if (input === null || inFlight.current) return;
+    inFlight.current = true;
     setSubmitting(true);
     setError(null);
-    const result = await answer({ environmentId: props.environmentId, input });
-    setSubmitting(false);
+    const result = await answer({ environmentId: props.environmentId, input }).finally(() => {
+      inFlight.current = false;
+      setSubmitting(false);
+    });
     if (result._tag === "Success") {
       // The card switches to its answered row once the item updates.
       setSecret("");

apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts

@@ -23,9 +23,6 @@ import * as ScheduledTaskService from "./ScheduledTaskService.ts";
 
 const decodeUpsertInput = Schema.decodeUnknownEffect(ScheduledTaskUpsertInput);
 
-/** Secrets the user entered for an agent, by ref; consuming one removes it. */
-const secretsByRef = new Map<string, string>();
-
 type LaunchInput = ThreadLaunchService.ThreadLaunchInput;
 
 const webhookTaskInput = (overrides: Record<string, unknown> = {}) =>
@@ -70,11 +67,14 @@ const withService = <A, E>(
   body: (input: {
     readonly service: ScheduledTaskService.ScheduledTaskService["Service"];
     readonly launches: Queue.Queue<LaunchInput>;
+    /** Secrets the user entered for an agent, by ref; consuming one removes it. */
+    readonly secretsByRef: Map<string, string>;
   }) => Effect.Effect<A, E, never>,
   options: { readonly gate?: Deferred.Deferred<void>; readonly relayHookBaseUrl?: string } = {},
 ) =>
   Effect.gen(function* () {
     const launches = yield* Queue.unbounded<LaunchInput>();
+    const secretsByRef = new Map<string, string>();
     const dependencies = Layer.mergeAll(
       NodePlatformCrypto.layer,
       Scheduler.layer,
@@ -102,7 +102,7 @@ const withService = <A, E>(
     );
     return yield* Effect.gen(function* () {
       const service = yield* ScheduledTaskService.ScheduledTaskService;
-      return yield* body({ service, launches });
+      return yield* body({ service, launches, secretsByRef });
     }).pipe(Effect.provide(ScheduledTaskService.layer.pipe(Layer.provide(dependencies))));
   }).pipe(Effect.provide(SqlitePersistenceMemory));
 
@@ -725,7 +725,7 @@ const githubSignature = (secret: string) =>
   `sha256=${NodeCrypto.createHmac("sha256", secret).update(pullRequestBody).digest("hex")}`;
 
 it.effect("a signature can take the user's secret by ref, which works only once", () =>
-  withService(({ service, launches }) =>
+  withService(({ service, launches, secretsByRef }) =>
     Effect.gen(function* () {
       secretsByRef.set("secret-ref:00000000000000000000000000000001", "github-secret");
       const githubSchedule = (secretRef: string) => ({
@@ -764,7 +764,7 @@ it.effect("a signature can take the user's secret by ref, which works only once"
 );
 
 it.effect("a retried save with an already used secretRef keeps the stored secret", () =>
-  withService(({ service, launches }) =>
+  withService(({ service, launches, secretsByRef }) =>
     Effect.gen(function* () {
       secretsByRef.set("secret-ref:00000000000000000000000000000002", "github-secret");
       const save = webhookTaskInput({

apps/server/src/secrets/SecretRequests.test.ts

@@ -38,12 +38,15 @@ const withService = <A, E>(
     readonly removeFails?: boolean;
     /** The agent's wait closes the card just before the answer's record lands. */
     readonly closedFirst?: boolean;
+    /** How many record dispatches fail before one succeeds. */
+    readonly failedRecords?: number;
   } = {},
 ) =>
   Effect.gen(function* () {
     const stored = new Map<string, Uint8Array>();
     const dispatched: Array<OrchestrationV2ServerCommand> = [];
     let secretStatus = "pending";
+    let failedRecords = options.failedRecords ?? 0;
     const requestThreadId = options.threadId ?? threadId;
     const dependencies = Layer.mergeAll(
       NodeCrypto.layer,
@@ -106,8 +109,12 @@ const withService = <A, E>(
               },
             ],
           } as never),
-        dispatch: (command) =>
-          Effect.sync(() => {
+        dispatch: (command) => {
+          if (command.type === "secret_request.record" && failedRecords > 0) {
+            failedRecords -= 1;
+            return Effect.fail(new Error("orchestrator unavailable") as never);
+          }
+          return Effect.sync(() => {
             dispatched.push(command);
             // Like the orchestrator, a card that is no longer pending keeps its answer.
             if (options.closedFirst && command.type === "secret_request.record") {
@@ -116,7 +123,8 @@ const withService = <A, E>(
               secretStatus = command.secretStatus;
             }
             return {} as never;
-          }),
+          });
+        },
       }),
     );
     return yield* Effect.gen(function* () {
@@ -190,6 +198,26 @@ it.effect("a save that loses to the card closing deletes the value and says so",
   ),
 );
 
+it.effect("a save whose record failed can be saved again", () =>
+  withService(
+    ({ service }) =>
+      Effect.gen(function* () {
+        const failed = yield* service
+          .answer({ threadId, turnItemId, answer: { type: "save", secret: "ghp_secret" } })
+          .pipe(Effect.flip);
+        assert.equal(failed.reason, "record_failed");
+        yield* service.answer({
+          threadId,
+          turnItemId,
+          answer: { type: "save", secret: "ghp_secret" },
+        });
+        const ref = Option.getOrThrow(yield* service.savedRef({ threadId, turnItemId }));
+        assert.equal(yield* service.consume({ ref, projectId }), "ghp_secret");
+      }),
+    { failedRecords: 1 },
+  ),
+);
+
 it.effect("a ref only works in the project it was entered for", () =>
   withService(({ service }) =>
     Effect.gen(function* () {

apps/server/src/secrets/SecretRequests.ts

@@ -158,7 +158,16 @@ const make = Effect.gen(function* () {
           ...(item.placeholder === undefined ? {} : { placeholder: item.placeholder }),
           secretStatus,
         })
-        .pipe(Effect.mapError((cause) => fail("record_failed", cause)));
+        .pipe(
+          Effect.mapError((cause) => fail("record_failed", cause)),
+          // The card still says pending, so the user can save again; the value
+          // stored above would make that retry look already answered.
+          Effect.tapError(() =>
+            input.answer.type === "save"
+              ? removeLogged(storeName(refFor(salt, input.threadId, item.id)))
+              : Effect.void,
+          ),
+        );
       if (input.answer.type !== "save") return;
       // A request is answered once: if the agent's wait closed the card between
       // the checks above and this record, the record changed nothing. Nobody

apps/web/src/components/chat/SecretRequestCard.tsx

@@ -12,7 +12,7 @@ import {
 } from "@t3tools/client-runtime/state/runtime";
 import type { EnvironmentId, OrchestrationV2ProjectedTurnItem } from "@t3tools/contracts";
 import { CheckIcon, LockIcon, MinusIcon, ShieldCheckIcon } from "lucide-react";
-import { useId, useState, type FormEvent } from "react";
+import { useId, useRef, useState, type FormEvent } from "react";
 
 import { serverEnvironment } from "../../state/server";
 import { useAtomCommand } from "../../state/use-atom-command";
@@ -71,16 +71,21 @@ function PendingSecretRequestForm(props: {
   const [secret, setSecret] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // Enter then a click can both run before a re-render; this guard is synchronous.
+  const inFlight = useRef(false);
 
   const send = async (
     reply: { readonly type: "save"; readonly secret: string } | { readonly type: "decline" },
   ) => {
     const input = secretRequestAnswerInput(item, reply);
-    if (input === null || submitting) return;
+    if (input === null || inFlight.current) return;
+    inFlight.current = true;
     setSubmitting(true);
     setError(null);
-    const result = await answer({ environmentId: props.environmentId, input });
-    setSubmitting(false);
+    const result = await answer({ environmentId: props.environmentId, input }).finally(() => {
+      inFlight.current = false;
+      setSubmitting(false);
+    });
     if (result._tag === "Success") {
       // The card switches to its answered row once the item updates.
       setSecret("");

packages/contracts/src/orchestratorMcp.ts

@@ -600,15 +600,15 @@ export const OrchestratorMcpRequestSecretInput = Schema.Struct({
   ).annotate({ description: "How long to wait for the user. Default 10 minutes." }),
   clientRequestId: Schema.optional(OrchestratorMcpClientRequestId).annotate({
     description:
-      "Reuse when retrying, so the user sees one card and a saved answer is returned again.",
+      "Reuse when retrying a call that lost its result, so the user sees one card and its answer is returned again. Use a new id to ask again after timed_out or cancelled.",
   }),
 });
 export type OrchestratorMcpRequestSecretInput = typeof OrchestratorMcpRequestSecretInput.Type;
 
 export const OrchestratorMcpRequestSecretResult = Schema.Struct({
   status: Schema.Literals(["saved", "declined", "cancelled", "timed_out"]).annotate({
     description:
-      "saved: secretRef holds the value. declined: the user chose not to. cancelled: the request ended with the run. timed_out: the user did not answer in time; the card is closed, so ask again if still needed.",
+      "saved: secretRef holds the value. declined: the user chose not to. cancelled: the request ended with the run. timed_out: the user did not answer in time; the card is closed, so ask again with a new clientRequestId if still needed.",
   }),
   secretRef: Schema.optional(SecretRef).annotate({
     description: