fix(inference): treat Codex 404s as expired credentials

Author: TheGreatAxios

src/inference-error-message.ts

@@ -146,14 +146,21 @@ export function terminalProviderFailureMessage(
     ? diagnostic
     : `${diagnostic}.`;
   const guidance = terminalProviderFailureGuidance(error, category);
-  return `${label} Provider failed (${category}): ${diagnosticSentence} ${guidance}`;
+  const tail = guidance.length > 0 ? ` ${guidance}` : "";
+  return `${label} Provider failed (${category}): ${diagnosticSentence}${tail}`;
 }
 
 function terminalProviderFailureGuidance(
   error: InferenceErrorLike,
   category: string,
 ): string {
-  if (category === "credential_failure") return CREDENTIAL_FAILURE_USER_MESSAGE;
+  if (category === "credential_failure") {
+    // Normalized credential failures already carry the re-login hint in the
+    // diagnostic (e.g. Codex profile copy); repeating it reads as a stutter.
+    return /log in again|sign in again/i.test(error.message ?? "")
+      ? ""
+      : CREDENTIAL_FAILURE_USER_MESSAGE;
+  }
   if (category === "context_overflow") return "Try /clear to start fresh.";
   // A 429 that survived the harness's paced retries is a wait-it-out rate
   // limit, not a generic flake: say so instead of the bare "Try again."
@@ -180,7 +187,9 @@ function terminalProviderFailureSummary(
 ): string {
   const label = terminalProviderFailureLabel(providerId, displayLabel);
   const category = terminalProviderFailureCategory(error);
-  return `${label} Provider failed (${category}). ${terminalProviderFailureGuidance(error, category)}`;
+  const guidance = terminalProviderFailureGuidance(error, category);
+  const tail = guidance.length > 0 ? ` ${guidance}` : "";
+  return `${label} Provider failed (${category}).${tail}`;
 }
 
 export type ResolvedProviderFailureError = Error & {

src/inference-gateway-error.ts

@@ -519,13 +519,61 @@ function normalizeCodexUsageLimitError(
   };
 }
 
+/**
+ * Body/message markers that mean a Codex 404 names an unknown model rather
+ * than rejecting the credential. The regex below covers the same phrasing
+ * when a model name sits between "model" and "does not exist".
+ */
+const CODEX_UNKNOWN_MODEL_MARKERS = [
+  "model_not_found",
+  "unknown model",
+] as const;
+
+function hasCodexUnknownModelMarker(error: InferenceErrorLike): boolean {
+  const parts = [error.message ?? "", stringFromRaw(error.raw)];
+  if (combinedTextIncludesMarker(parts, CODEX_UNKNOWN_MODEL_MARKERS))
+    return true;
+  return parts.some((part) =>
+    /model\b[^.!?]{0,60}\b(?:does not exist|not found)\b/i.test(part),
+  );
+}
+
+/**
+ * Codex answers unauthenticated requests with 426/404, so a fatal 404 in a
+ * known-Codex context is an expired, invalid, or missing credential — not a
+ * bad model name. The re-login copy matches the CodexAuthError shape so the
+ * TUI names the affected profile through its existing auth matchers. Only an
+ * explicit unknown-model marker keeps the fatal switch-models path.
+ */
+function normalizeCodexCredential404Error(
+  error: InferenceErrorWithGoContext,
+): InferenceError {
+  if (error.category !== "fatal") return error;
+  if (error.statusCode !== 404) return error;
+  const providerId = error.providerId;
+  if (providerId === undefined || !isCodexProviderName(providerId))
+    return error;
+  if (hasCodexUnknownModelMarker(error)) return error;
+  const profile = codexProfileFromProviderName(providerId) ?? providerId;
+  return {
+    category: "credential_failure",
+    message: `Codex profile "${profile}" is not authorized. Log in again.`,
+    statusCode: 404,
+    ...(error.raw !== undefined ? { raw: error.raw } : {}),
+    ...(error.retryAfterMs !== undefined
+      ? { retryAfterMs: error.retryAfterMs }
+      : {}),
+  };
+}
+
 /**
  * Reclassify gateway overload errors so the default retry policy treats them as
  * transient instead of aborting on protocol_mismatch. Also normalizes OpenCode
  * Go quota/rate-limit shapes (including HTTP 400 mis-status), known-xAI short
  * 429s, attributable xAI capacity protocol_mismatch, Codex usage limits
- * (nested detail.error with resets_in_seconds), and known-Codex short 429s that
- * are not usage_limit_reached.
+ * (nested detail.error with resets_in_seconds), known-Codex short 429s that
+ * are not usage_limit_reached, and known-Codex credential 404s that do not
+ * name an unknown model.
  */
 export function normalizeInferenceErrorForRetry(
   error: InferenceErrorWithGoContext,
@@ -545,6 +593,9 @@ export function normalizeInferenceErrorForRetry(
   const codexRateLimit = normalizeCodexRateLimitError(error);
   if (codexRateLimit !== error) return codexRateLimit;
 
+  const codexCredential = normalizeCodexCredential404Error(error);
+  if (codexCredential !== error) return codexCredential;
+
   if (!isGatewayOverloadInferenceError(error)) return error;
   if (error.category === "retryable" || error.category === "timeout")
     return error;