Charlie Marsh 5b98eaafeb Treat access program denials as terminal errors (#60476) ...

## What changed

Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.

Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.

## Testing

Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.

GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62

2026-11-10 00:08:32 +00:00

..

common

Honor permission grant scopes in executor capability discovery (#60461)

2026-11-09 22:20:07 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Treat access program denials as terminal errors (#60476)

2026-11-10 00:08:32 +00:00

windows_sandbox

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

code_mode_tracing.rs

Add code-mode output truncation protocol contracts (#57272)

2026-10-26 21:36:35 +00:00

mcp_trace_propagation.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

responses_headers.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

windows_sandbox.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00