fix(server): a Claude 403 no longer tells you to log in again

[shivamhwp]

A Claude turn that fails with a 403, for example "Your organization does not have access to this model", showed "Claude could not authenticate. For subscription login, run claude auth login ...". Logging in again can't fix a permission error, so the message sends people the wrong way.

The Claude CLI marks a 403 as authentication_failed, the same label it uses for a 401, and T3 replaced the result with its sign-in message. A 403 result now shows the CLI's own text instead. A 401 and a missing login keep the sign-in message.

This is a small fix for an obvious bug under the contributing guide: the wrong advice comes from one label, and the change only affects results with api_error_status 403.

Testing

I ran an isolated dev server from this branch with a copy of real data and the real web client. A Claude instance pointed ANTHROPIC_BASE_URL at a local fake Anthropic API that answers every request with 403 permission_error "Your organization does not have access to this model." The real claude CLI 2.1.288 produced:

assistant  error=authentication_failed
result     is_error=true  api_error_status=403  terminal_reason=api_error
           "Failed to authenticate. API Error: 403 Your organization does not have access to this model."

	Before (main)	After
Error card and banner

Before, the card said to run claude auth login. After, it shows the CLI's text with the 403 reason, and the run still ends as failed with code api_error_403.

Checks:

• vp test run apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts: 136 passed. The new test feeds the CLI's 403 frames and fails on main with the sign-in message. It passed 10 runs in a row. The existing expired-login test still expects the sign-in message.
• tsc --noEmit in apps/server: passes. Lint on the changed files: no new findings.

The CLI's text still starts with "Failed to authenticate." That's the CLI's wording, and T3 shows it as is.

#14891 edits the same failureHint lines to keep the CLI's error text for other API errors. The two don't depend on each other, and whichever lands second needs a small rebase.

Made by Claude Opus 5.5 in Claude Code, run from T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a focused fix that shows Claude's permission-denied text for HTTP 403 responses while preserving existing handling for other authentication failures, with a matching regression test. Because it changes authentication-failure handling and user guidance, it requires human review under the applicable safety criteria.

No code changes detected at d359e2b. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 107f602 · PR result: d359e2b · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40c2fd6b-b97e-441a-b73f-fe03ced9f38c

📥 Commits

Reviewing files that changed from the base of the PR and between d20dbc1 and d359e2b.

📒 Files selected for processing: 2

• apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
• apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

For Claude results with API status 403, the adapter now uses the result text as the failure hint. A test verifies that the turn fails with the CLI error text and api_error_403 code.

Changes: Claude 403 Failure Handling

Layer / File(s)	Summary
403 failure hint and test apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts, apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts	For API status 403, the adapter uses the CLI result text as the failure hint. The test checks the failure text and api_error_403 code after an authentication_failed frame.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to d359e

The 403 failure message change is mergeable after normal checks.

### Architecture Summary

Architecture risk: 🔵 Low · up to d359e

The change affects 1 system.

Changed systems: apps/server

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — apps/server (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts: Adds a test that feeds an authentication_failed assistant frame followed by an error result with API status 403, and expects a failed terminal event whose message is the CLI’s organization-access error and whose code is api_error_403.
• observed — Modified behavior in apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts: The result handler now detects successful 403 responses and uses message.result as the failure hint, taking precedence over the stored authentication message and usage-limit fallback. Other results retain the previous authentication-then-usage-limit hint selection.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: preventing Claude 403 errors from displaying an incorrect login instruction.
Description check		The description explains the problem, the implementation, the justification for a focused bug fix, detailed verification results, observed behavior, and the related PR conflict. Although it does not u…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate e2355c0