fix(init): retry transient auth validation once

[betegon]

Summary

Adds one narrowly authorized retry for transient authentication-service failures returned by the init Worker.

The retry gate requires all of the following:

• a real MastraClientError parsed from an HTTP response;
• status 503;
• safeToRetry: true; and
• code AUTH_UPSTREAM_TIMEOUT or AUTH_UPSTREAM_UNAVAILABLE.

It applies to create-run, start-async, and resume-async, waits 250 ms, and then makes exactly one second attempt. The underlying Mastra client remains configured with retries: 0, so there are no hidden retries and the hard maximum is two total attempts.

Generic 5xx responses, upstream rate limiting, 401/403, unknown codes, and ambiguous network errors are never replayed. For resume requests, a retryable auth failure is known to happen before Mastra executes; it therefore retries directly instead of entering the existing stale/ambiguous run-state recovery path.

The CLI emits a breadcrumb/tag for the retry and shows a temporary health overlay during resume. Overlay cleanup runs in finally for both success and failure.

Server contract

This is coordinated with getsentry/cli-init-api#194, which emits the structured 503 only from auth middleware before the workflow handler. Either deploy order is backward compatible, but server first is preferred.

The failure was observed in CLI-17A: one auth call in the run reached the Worker five-second validation deadline while the other calls completed normally. The server PR switches to the lightweight token-validation endpoint, captures the timeout, and tags run ID/endpoint before auth.

Safety properties

• create/start/resume integration tests assert exactly two calls after one retryable failure.
• A persistent retryable failure is attempted twice, never three times.
• Resume does not poll runById for this pre-workflow failure.
• Look-alike structural errors cannot authorize replay; the error must be a MastraClientError carrying the parsed server body.
• The existing 401 classification and user guidance remain unchanged.

Test plan

• pnpm exec vitest run test/lib/init/init-service-auth.test.ts test/lib/init/wizard-runner.test.ts — 68 tests pass.
• pnpm run typecheck — passes after generating the API schema required by a fresh worktree.
• pnpm run lint — 918 files pass.
• Broad suite under TZ=UTC, excluding the known bash completion simulation: 399 files, 8,462 tests pass, 14 skipped.
• The unmodified broad command reached 8,475 passing tests and 8 unrelated failures. All eight reproduce on main: six time-range assertions assume UTC while the local timezone is Europe/Madrid; two bash completion simulations return an empty completion in this shell environment.
• git diff --check passes.
• Three independent review passes completed; the replay gate was tightened from a structural look-alike to a real SDK error during review.

[github-actions]

Codecov Results 📊

✅ Patch coverage is 100.00%. Project has 5369 uncovered lines.
✅ Project coverage is 81.79%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    81.78%    81.79%    +0.01%
==========================================
  Files          424       424         —
  Lines        29452     29478       +26
  Branches     19190     19205       +15
==========================================
+ Hits         24085     24109       +24
- Misses        5367      5369        +2
- Partials      1999      2000        +1

---

Generated by Codecov Action