Keep classified credential errors from being rewritten

sendFailureText rematched the #710 credential_failure line against
raw-provider auth patterns and replaced it with the generic other
copy. #711 tests still expected the pre-#710 session-expired string.

Author: TheGreatAxios

src/inference-error-message.ts

@@ -20,9 +20,11 @@ import {
   type InferenceErrorLike,
 } from "./inference-gateway-error.js";
 
+/** Committed auth death — do not claim a refresh is in flight. */
+export const CREDENTIAL_FAILURE_USER_MESSAGE = "Authentication failed — log in again.";
+
 const FRIENDLY_BY_CATEGORY: Record<string, string> = {
-  // Committed auth death — do not claim a refresh is in flight.
-  credential_failure: "Authentication failed — log in again.",
+  credential_failure: CREDENTIAL_FAILURE_USER_MESSAGE,
   quota_exhausted: "Quota exhausted — usage limit reached.",
   context_overflow:
     "Context window full — compaction could not keep up. Try /clear to start fresh.",

src/tui/runtime-bridge.test.ts

@@ -1024,7 +1024,7 @@ describe("same-turn failover after inference.error", () => {
 
           const text = shell.streamLog.map((r) => r.text).join("\n");
           expect(text).toContain("next prompt");
-          expect(errorRows(shell)).toContain("Session expired — re-authenticating…");
+          expect(errorRows(shell)).toContain("Authentication failed — log in again.");
         } finally {
           bridge.dispose();
           shell.dispose();
@@ -1096,7 +1096,7 @@ describe("same-turn failover after inference.error", () => {
           const text = shell.streamLog.map((r) => r.text).join("\n");
           expect(text).toContain("restart from here");
           expect(text).toContain("stop — restarting from your message");
-          expect(errorRows(shell)).toContain("Session expired — re-authenticating…");
+          expect(errorRows(shell)).toContain("Authentication failed — log in again.");
         } finally {
           bridge.dispose();
           shell.dispose();
@@ -1129,7 +1129,7 @@ describe("same-turn failover after inference.error", () => {
             bridge.handle(event);
           }
 
-          expect(errorRows(shell)).toContain("Session expired — re-authenticating…");
+          expect(errorRows(shell)).toContain("Authentication failed — log in again.");
         } finally {
           bridge.dispose();
           shell.dispose();

src/tui/session-chrome.test.ts

@@ -261,6 +261,12 @@ describe("sendFailureText", () => {
       authProvider: null,
     });
   });
+
+  test("a classified credential_failure line is not rewritten as generic other", () => {
+    expect(sendFailureText("Authentication failed — log in again.")).toBe(
+      "Authentication failed — log in again.",
+    );
+  });
 });
 
 describe("fleet state in the top-level indicator", () => {

src/tui/session-chrome.ts

@@ -5,6 +5,7 @@
  * duplicating the state machine that produces it.
  */
 
+import { CREDENTIAL_FAILURE_USER_MESSAGE } from "../inference-error-message.js";
 import type { Telemetry } from "../telemetry/index.js";
 import type { FleetProgress } from "./agent-progress.js";
 import type { RampPhase } from "./ramp.js";
@@ -204,6 +205,10 @@ const AUTH_FAILURE_TEXT: Record<AuthProviderId, string> = {
  * the only detail the operator has.
  */
 export function sendFailureText(message: string): string {
+  // Classified inference.error lines are already operator-facing. Rematching
+  // them against raw-provider auth patterns rewrites intentional copy
+  // (e.g. "Authentication failed — log in again." → generic other).
+  if (message === CREDENTIAL_FAILURE_USER_MESSAGE) return message;
   const failure = classifySendFailureMessage(message);
   if (failure.kind === "auth" && failure.authProvider !== null) {
     return AUTH_FAILURE_TEXT[failure.authProvider];