Keep credential failures on login copy

Auth and OAuth-refresh send failures were still suggesting /model.
Keep that copy on login, drop the fused task coverage after spawn/wait
became the only path, and document the no-failover behavior.

Author: TheGreatAxios

CHANGELOG.md

@@ -31,6 +31,8 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 
 - Cancelling a `task` or `wait_agents` worker reports wait status `interrupted`,
   not `failed`.
+- Inference no longer fails over to a backup provider. A selected-provider
+  failure stays on that provider; switch with `/model`.
 
 ### Fixed
 
@@ -44,6 +46,8 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
   longer swallow `--*` or `-h` as their option values.
 - `wait_agents` no longer collects a stale completed or interrupted stamp
   when a followup is already in flight.
+- Credential-refresh and auth send failures tell the user to log in again
+  instead of suggesting `/model`.
 
 ## [0.3.11] - 2026-08-31
 

src/exec/runner.ts

@@ -63,6 +63,7 @@ import { createAgentWithLiveToolDispatch } from "../agent/live-tool-dispatch.js"
 import { liveTelemetry } from "../telemetry/singleton.js";
 import { createTurnObserver } from "../telemetry/ai-observability.js";
 import {
+  CREDENTIAL_FAILURE_USER_MESSAGE,
   isResolvedProviderFailureError,
   terminalProviderFailureMessage,
 } from "../inference-error-message.js";
@@ -136,11 +137,10 @@ export function execUserFailureMessage(
   err: unknown,
   providerFailureObserved: boolean,
 ): string {
-  if (
-    providerFailureObserved ||
-    isResolvedProviderFailureError(err) ||
-    (err instanceof Error && err.name === SELECTED_PROVIDER_FAILURE)
-  ) {
+  if (err instanceof Error && err.name === SELECTED_PROVIDER_FAILURE) {
+    return CREDENTIAL_FAILURE_USER_MESSAGE;
+  }
+  if (providerFailureObserved || isResolvedProviderFailureError(err)) {
     return terminalProviderFailureMessage(
       config.providerName,
       config.settings?.providers[config.providerName]?.name,

src/subagent/run-resolved-provider-failure.test.ts

@@ -11,9 +11,8 @@ import {
   type ResolvedProviderFailureError,
 } from "../inference-error-message.js";
 import { createPermissionGate } from "../permission/gate.js";
-import { createFleetRecords, createSpawnAgentTool, createWaitAgentsTool } from "./agent-fleet.js";
+import { createFleetMailbox, createSpawnAgentTool, createWaitAgentsTool } from "./agent-fleet.js";
 import { createSubAgentSessionStore } from "./session-store.js";
-import { createTaskTool } from "./task-tool.js";
 import type { RunSubAgentParams, RunSubAgentResult } from "./types.js";
 
 const RAW_DIAGNOSTIC = "POST https://provider.invalid returned secret response body";
@@ -130,33 +129,10 @@ describe("resolved sub-agent provider failures", () => {
     expect(observed.some((event) => JSON.stringify(event).includes(RAW_DIAGNOSTIC))).toBe(true);
   });
 
-  test("fused task returns only the safe message for the resolved reply sequence", async () => {
-    await withResolvedProviderRun(async (run, cwd) => {
-      const sessions = createSubAgentSessionStore();
-      const task = createTaskTool({
-        ...runParams(cwd),
-        getWorkdirBase: () => join(cwd, ".ctx"),
-        sessions,
-        fleetRecords: createFleetRecords(),
-        run,
-      });
-      const result = await callTool(task, "task", {
-        description: "provider failure",
-        prompt: "trigger it",
-        intent: "explore",
-      });
-
-      expect(result.isError).toBe(true);
-      expect(result.content).toBe(SAFE_MESSAGE);
-      expect(String(result.content)).not.toContain(RAW_DIAGNOSTIC);
-      expect(sessions.list()[0]?.error).toBe(SAFE_MESSAGE);
-    });
-  });
-
   test("split spawn_agent and wait_agents return only the safe message", async () => {
     await withResolvedProviderRun(async (run, cwd) => {
       const sessions = createSubAgentSessionStore();
-      const fleetRecords = createFleetRecords();
+      const fleetRecords = createFleetMailbox(sessions);
       const deps = {
         ...runParams(cwd),
         getWorkdirBase: () => join(cwd, ".ctx"),

src/tui/runner.ts

@@ -217,6 +217,7 @@ import {
 } from "./session-chrome.js";
 import { ingestOperatorPrompt } from "./prompt-attachments.js";
 import {
+  CREDENTIAL_FAILURE_USER_MESSAGE,
   isResolvedProviderFailureError,
   terminalProviderFailureMessage,
 } from "../inference-error-message.js";
@@ -619,11 +620,10 @@ export function tuiSendFailureMessage(
   providerFailureObserved: boolean,
   attempt: InferenceAttemptIdentity,
 ): string {
-  if (
-    failureKind !== "auth" &&
-    !providerFailureObserved &&
-    !isResolvedProviderFailureError(error)
-  ) {
+  if (failureKind === "auth") {
+    return CREDENTIAL_FAILURE_USER_MESSAGE;
+  }
+  if (!providerFailureObserved && !isResolvedProviderFailureError(error)) {
     return error instanceof Error ? error.message : String(error);
   }
   const providerId = isResolvedProviderFailureError(error) ? error.providerId : attempt.providerId;

tests/unit/exec/runner.test.ts

@@ -58,9 +58,7 @@ describe("selected provider refresh failures", () => {
     } catch (err) {
       expect(formatCaughtError(err)).toBe(rawDiagnostic);
       const userMessage = execUserFailureMessage(config, err, false);
-      expect(userMessage).toBe(
-        'Codex Provider failed. Try again or switch with "/model" and select another.',
-      );
+      expect(userMessage).toBe("Authentication failed — log in again.");
       expect(userMessage).not.toContain(rawDiagnostic);
     }
   });

tests/unit/tui/runner.test.ts

@@ -58,6 +58,15 @@ test("TUI send failures retain the in-flight provider identity across model swit
   ).toBe('Codex Provider failed. Try again or switch with "/model" and select another.');
 });
 
+test("TUI auth failures tell the user to log in again instead of switching models", () => {
+  expect(
+    tuiSendFailureMessage(new Error("401 refresh token rejected"), "auth", false, {
+      providerId: "codex/work",
+      displayLabel: "Codex",
+    }),
+  ).toBe("Authentication failed — log in again.");
+});
+
 test("loadLocalSettingsWriteBase distinguishes absent from unreadable", async () => {
   // Absent → empty base (safe to write a single key).
   expect(await loadLocalSettingsWriteBase("/nope", async () => null)).toEqual({});