Report which provider rejected credentials on auth failure

The auth_failure event reused error_class, which everywhere else means
the JS error constructor name. One column carrying two incompatible
meanings cannot be analysed, and it made the documented error_class
guarantee false: the value shipped was a local send-failure kind that
never passed through the classifier.

Author: TheGreatAxios

docs/TELEMETRY.md

@@ -21,7 +21,7 @@ Each event carries a small set of properties:
 | `permission_prompt` | An approval prompt is answered (or abandoned) | `decision`, `permission_kind` |
 | `compaction` | The compactor actually folds turns away | `mode`, `duration_ms`, `turns_before`, `turns_after` |
 | `crash` | A fatal error reaches the process-level handler | `kind`, `error_class` |
-| `auth_failure` | A provider rejects the stored credentials | `error_class` |
+| `auth_failure` | A provider rejects the stored credentials | `auth_provider` |
 
 `compaction` is deliberately silent on the runs where the compactor decides
 there is nothing to compact — an event that also fires on no-ops makes its own
@@ -62,7 +62,14 @@ all and `plugin_loaded` carries only `origin`, the discovery tier
 
 `error_class` is bucketed the same way: only the error types defined by the
 language are reported by name, because an error subclass defined in
-application or plugin code is as author-chosen as any other string.
+application or plugin code is as author-chosen as any other string. It appears
+on `crash` and nowhere else, so the column means one thing everywhere it is
+recorded.
+
+`auth_provider` is a separate property for that reason: it names which
+provider's sign-in was rejected (`codex`, `xai`), chosen from a fixed
+first-party set in `src/tui-opentui/session-chrome.ts`. No part of the
+provider's rejection message is sent.
 
 The mapping is `src/telemetry/classify.ts`, and the tests that feed each
 emission site a deliberately identifying name and assert it reaches no part of

src/telemetry/index.ts

@@ -101,7 +101,9 @@ const EVENT_PROPERTY_ALLOWLIST: Record<TelemetryEvent, readonly string[]> = {
   permission_prompt: ["decision", "permission_kind"],
   compaction: ["mode", "duration_ms", "turns_before", "turns_after"],
   crash: ["kind", "error_class"],
-  auth_failure: ["error_class"],
+  // Which provider rejected the credentials, not why — the rejection detail is
+  // provider-authored text and error_class means a JS constructor name.
+  auth_failure: ["auth_provider"],
 };
 
 const KNOWN_EVENTS: ReadonlySet<string> = new Set(Object.keys(EVENT_PROPERTY_ALLOWLIST));

src/tui-opentui/session-chrome.ts

@@ -5,6 +5,7 @@
  * duplicating the state machine that produces it.
  */
 
+import type { Telemetry } from "../telemetry/index.js"
 import type { RampPhase } from "./ramp.js"
 
 /** Agent lifecycle status the progress label reads (mirrors the stream state). */
@@ -137,6 +138,20 @@ export function shouldSettleUiAfterSendFailure(kind: SendFailureKind): boolean {
   return kind === "codex_auth" || kind === "xai_auth" || kind === "error"
 }
 
+// Send-failure kinds are first-party constants, so the provider each one names
+// is a fixed mapping rather than a classification over author-chosen text.
+const AUTH_FAILURE_PROVIDERS: Partial<Record<SendFailureKind, string>> = {
+  codex_auth: "codex",
+  xai_auth: "xai",
+}
+
+/** Report which provider rejected the stored credentials; silent otherwise. */
+export function captureAuthFailure(telemetry: Telemetry, kind: SendFailureKind): void {
+  const provider = AUTH_FAILURE_PROVIDERS[kind]
+  if (provider === undefined) return
+  telemetry.capture("auth_failure", { auth_provider: provider })
+}
+
 // The stream carries a failure as a bare message string, so the auth errors are
 // recognised by the profile phrase their constructors always produce
 // (`Codex profile "default" is not authorized. …`).

src/tui/runner.ts

@@ -145,6 +145,7 @@ import {
   surfaceSystemNotice,
 } from "../tui-opentui/shell.js";
 import {
+  captureAuthFailure,
   classifyAgentSendFailure,
   shouldSettleUiAfterSendFailure,
 } from "../tui-opentui/session-chrome.js";
@@ -1772,9 +1773,7 @@ export async function runTUI(initialConfig: Config): Promise<number> {
       isCodexAuthError,
       isXaiAuthError,
     );
-    if (kind === "codex_auth" || kind === "xai_auth") {
-      getTelemetry().capture("auth_failure", { error_class: kind });
-    }
+    captureAuthFailure(getTelemetry(), kind);
     if (!shouldSettleUiAfterSendFailure(kind)) return;
     recordRunError(err);
     systemNotice(err instanceof Error ? err.message : String(err));

tests/unit/telemetry-product-events.test.ts

@@ -23,6 +23,10 @@ import {
   classifyPermissionKind,
 } from "../../src/telemetry/classify.js";
 import { createTelemetry, type Telemetry } from "../../src/telemetry/index.js";
+import {
+  captureAuthFailure,
+  classifyAgentSendFailure,
+} from "../../src/tui-opentui/session-chrome.js";
 
 type BatchBody = {
   batch: { event: string; properties: Record<string, unknown> }[];
@@ -256,6 +260,41 @@ test("crash reports language error types by name and buckets everything else", a
   expect(await wire()).not.toContain("AcmeCorp");
 });
 
+// ---------------------------------------------------------------------------
+// auth_failure — the provider's rejection message names the profile
+// ---------------------------------------------------------------------------
+
+test("auth_failure names the provider and never ships the rejection message", async () => {
+  const { telemetry, wire, events } = harness();
+  const isCodexAuth = (e: unknown) => e instanceof Error && /codex profile/i.test(e.message);
+  const isXaiAuth = (e: unknown) => e instanceof Error && /xai profile/i.test(e.message);
+
+  const codexRejection = new Error('Codex profile "acmecorp-eng" is not authorized.');
+  const rejections = [
+    codexRejection,
+    new Error('xai profile "acmecorp-eng" is not authorized.'),
+    new Error("connection reset by /Users/someone/acmecorp"),
+  ];
+  for (const err of rejections) {
+    captureAuthFailure(
+      telemetry,
+      classifyAgentSendFailure(err, false, isCodexAuth, isXaiAuth),
+    );
+  }
+  // An aborted send outranks the auth match, so it must emit nothing.
+  captureAuthFailure(
+    telemetry,
+    classifyAgentSendFailure(codexRejection, true, isCodexAuth, isXaiAuth),
+  );
+
+  const captured = await events();
+  expect(captured.map((e) => e.event)).toEqual(["auth_failure", "auth_failure"]);
+  expect(captured.map((e) => e.properties.auth_provider)).toEqual(["codex", "xai"]);
+  const body = await wire();
+  expect(body).not.toContain("acmecorp");
+  expect(body).not.toContain("error_class");
+});
+
 // ---------------------------------------------------------------------------
 // compaction — must not fire when the compactor did nothing
 // ---------------------------------------------------------------------------