fix(anthropic): reveal real auth-rejection reason; match Claude Code OAuth shape

A 401/403 from the Messages API was flattened to a generic "credential
rejected / regenerate your API key" message that hid Anthropic's actual
reason and wrongly assumed an API key even on the OAuth subscription path.

- callAnthropic now keeps the HTTP status and Anthropic's own message on the
  thrown error, so categorizeError classifies by status (not keyword-guessing)
  and the real reason can surface.
- errors.js surfaces the provider's reason for auth failures instead of the
  canned line; output-tab's hint now covers both subscription sign-in and API
  keys.
- Send the OAuth system prompt as the structured Claude Code identity block
  the real CLI uses, so subscription tokens are more likely to be honored.

Adds tests covering the surfaced-reason and bare-status auth cases.

Author: New1Direction

src/background.js

@@ -1829,7 +1829,10 @@ async function callAnthropic(model = 'claude-sonnet-4-6', prompt) {
     messages: [{ role: 'user', content: prompt }],
   };
   if (oauth) {
-    body.system = "You are Claude Code, Anthropic's official CLI for Claude.";
+    // Claude's OAuth (subscription) tokens are only honored when the request looks
+    // like the real CLI: the system prompt must lead with the exact Claude Code
+    // identity, sent as a structured text-block array (the form the CLI itself uses).
+    body.system = [{ type: 'text', text: "You are Claude Code, Anthropic's official CLI for Claude." }];
   }
 
   const res = await fetchWithTimeout(
@@ -1844,7 +1847,13 @@ async function callAnthropic(model = 'claude-sonnet-4-6', prompt) {
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
     if (oauth && (res.status === 401 || res.status === 403)) await clearAnthropicOAuthTokens();
-    throw new Error(err.error?.message ?? `Anthropic API error ${res.status}`);
+    // Keep both the HTTP status and Anthropic's own reason: the status lets
+    // categorizeError classify reliably (not by keyword-guessing the text), and the
+    // reason is what actually explains an OAuth token refused at inference time.
+    const detail = err.error?.message || `Anthropic API error ${res.status}`;
+    const e = new Error(detail);
+    e.status = res.status;
+    throw e;
   }
   const data = await res.json();
   const text = data.content?.[0]?.text;

src/errors.js

@@ -37,8 +37,17 @@ function humanize(kind, provider, fallback) {
   switch (kind) {
     case 'none':
       return 'No AI provider connected — open Settings to add a key.';
-    case 'auth':
-      return `${who}’s credential was rejected — check or reconnect it in Settings.`;
+    case 'auth': {
+      // Surface the provider's actual reason when we have one — the generic line
+      // hides *why* (e.g. an OAuth subscription token refused at inference time,
+      // which reads very differently from a mistyped API key).
+      const detail = (fallback || '').trim();
+      const showDetail =
+        detail && !/credential was rejected/i.test(detail) && !/^[\w ]+ API error \d+$/i.test(detail);
+      return showDetail
+        ? `${who}’s credential was rejected: ${detail}. Reconnect it in Settings.`
+        : `${who}’s credential was rejected — check or reconnect it in Settings.`;
+    }
     case 'rate_limit':
       return `${who} is rate-limited — wait a moment, or route this part to another provider.`;
     case 'not_found':

src/output-tab.js

@@ -654,7 +654,7 @@ async function init() {
     const actions = errorActions(kind, canRetry);
     const HINTS = {
       none: 'Add an API key in Settings → it only takes 30 seconds.',
-      auth: "Your API key was rejected. Regenerate it from the provider's console, then paste it in Settings.",
+      auth: "The provider rejected your credential. For a Claude/ChatGPT subscription sign-in, reconnect it in Settings; for an API key, regenerate it from the provider's console.",
       rate_limit:
         "You've hit the rate limit. Wait a minute and retry — or switch to a different provider in Settings.",
       not_found: 'The model name is unrecognised. Open Settings and pick a valid model from the dropdown.',

tests/errors.test.js

@@ -14,6 +14,21 @@ describe('categorizeError', () => {
     expect(categorizeError({ status: 401 }).kind).toBe('auth');
     expect(categorizeError('invalid x-api-key').kind).toBe('auth');
   });
+  it('surfaces the provider’s real reason for auth failures instead of a generic line', () => {
+    // Mirrors how callAnthropic throws: a clean reason string plus the HTTP status.
+    const r = categorizeError(
+      Object.assign(new Error('OAuth authentication is currently not supported'), { status: 401 }),
+      'Anthropic'
+    );
+    expect(r.kind).toBe('auth');
+    expect(r.userMessage).toMatch(/OAuth authentication is currently not supported/);
+  });
+  it('keeps the generic auth line when there is no specific reason (bare status)', () => {
+    const r = categorizeError({ status: 401 }, 'Anthropic');
+    expect(r.kind).toBe('auth');
+    expect(r.userMessage).toMatch(/reconnect it in Settings/i);
+    expect(r.userMessage).not.toMatch(/API error/i);
+  });
   it('classifies rate limits as retryable', () => {
     expect(categorizeError(new Error('429 Too Many Requests')).kind).toBe('rate_limit');
     expect(categorizeError('rate limit exceeded').retryable).toBe(true);