Files
codex/codex-rs
smurching-oai fa4c0607d4 Surface refresh-token rejection errors during workspace routing (#57304)
## Why

When workspace discovery receives a 401 and token refresh is permanently rejected, the generic discovery error hides the guidance to sign in again.

## What changed

Propagate cached permanent refresh-token failures for the current credentials through workspace routing and model-provider resolution as `CodexErr::RefreshTokenFailed`. Preserve account-change checks and only surface the cached rejection when external authentication is absent and the auth generation is unchanged.

## Testing

Add an app-server regression test that simulates `refresh_token_reused` during workspace discovery and verifies that the turn fails with `Unauthorized` and tells the user to sign in again.

GitOrigin-RevId: cf89c71fd6a2103e56d637838b0cb34d58b3cc32
2026-10-26 23:21:18 +00:00
..
…
…
…