smurching-oai fa4c0607d4 Surface refresh-token rejection errors during workspace routing (#57304) ...

## Why

When workspace discovery receives a 401 and token refresh is permanently rejected, the generic discovery error hides the guidance to sign in again.

## What changed

Propagate cached permanent refresh-token failures for the current credentials through workspace routing and model-provider resolution as `CodexErr::RefreshTokenFailed`. Preserve account-change checks and only surface the cached rejection when external authentication is absent and the auth generation is unchanged.

## Testing

Add an app-server regression test that simulates `refresh_token_reused` during workspace discovery and verifies that the turn fails with `Unauthorized` and tells the user to sign in again.

GitOrigin-RevId: cf89c71fd6a2103e56d637838b0cb34d58b3cc32

2026-10-26 23:21:18 +00:00

..

common

Make login token-refresh tests wait for auth publication (#57248)

2026-10-26 20:53:10 +00:00

suite

Surface refresh-token rejection errors during workspace routing (#57304)

2026-10-26 23:21:18 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

prompt_prefix.rs

Add an app-server prompt prefix compatibility test (#51857)

2026-10-07 22:21:33 +00:00