fix(coding): recover provider context failures

tests/unit/pi-event-projector.test.ts

@@ -435,6 +435,71 @@ describe('Pi event projector', () => {
     }));
   });
 
+  it('projects a non-retryable Works user-context failure as Provider auth required', async () => {
+    const projector = new PiEventProjector({ createId: () => 'provider-error-a' });
+    let snapshot = emptySnapshot();
+    const providerFailure = {
+      role: 'assistant',
+      content: [],
+      stopReason: 'error',
+      errorMessage: '401: works square AI gateway did not return one-api user context; secret request detail',
+      timestamp: 10,
+    };
+
+    snapshot = apply(snapshot, await projector.project(snapshot, {
+      type: 'message_end',
+      message: providerFailure,
+    }));
+    snapshot = apply(snapshot, await projector.project(snapshot, {
+      type: 'agent_end',
+      messages: [providerFailure],
+      willRetry: false,
+    }));
+    snapshot = apply(snapshot, await projector.project(snapshot, { type: 'agent_settled' }));
+
+    expect(snapshot.run).toMatchObject({
+      status: 'idle',
+      terminalReason: 'failed',
+      error: {
+        code: 'CODING_PROVIDER_AUTH_REQUIRED',
+        message: '模型服务身份上下文无效，请重试；若仍失败请重新登录。',
+        recoverable: true,
+      },
+    });
+    expect(JSON.stringify(snapshot)).not.toContain('secret request detail');
+  });
+
+  it('keeps an exhausted Works user-context retry redacted and Provider-owned', async () => {
+    const projector = new PiEventProjector({ createId: () => 'provider-retry-error-a' });
+    let snapshot = emptySnapshot();
+
+    snapshot = apply(snapshot, await projector.project(snapshot, {
+      type: 'auto_retry_start',
+      attempt: 3,
+      maxAttempts: 3,
+      delayMs: 1_000,
+      errorMessage: 'sensitive earlier failure',
+    }));
+    snapshot = apply(snapshot, await projector.project(snapshot, {
+      type: 'auto_retry_end',
+      success: false,
+      attempt: 3,
+      finalError: '502: works square AI gateway did not return one-api user context; secret final detail',
+    }));
+    snapshot = apply(snapshot, await projector.project(snapshot, { type: 'agent_settled' }));
+
+    expect(snapshot.run).toMatchObject({
+      status: 'idle',
+      terminalReason: 'failed',
+      error: {
+        code: 'CODING_PROVIDER_AUTH_REQUIRED',
+        message: '模型服务身份上下文无效，请重试；若仍失败请重新登录。',
+        recoverable: true,
+      },
+    });
+    expect(JSON.stringify(snapshot)).not.toContain('secret');
+  });
+
   it('maps all summary-retry events and keeps exhausted compaction failure redacted', async () => {
     const ids = ['compaction-a', 'summary-retry-boundary-a'];
     const projector = new PiEventProjector({ createId: () => ids.shift() as string });