Best possible solution:

Land the typed-error dispatch after the normal maintainer and CI gates, keeping the existing string fallbacks for opaque third-party or transport errors.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: current main only classifies these auto-reply failures from strings, while the PR adds typed error objects and focused tests for the affected auth paths. I did not run local tests because this review is read-only.

Is this the best way to solve the issue?

Yes. Passing structured auth errors into the existing failure presenter is the maintainable owner-boundary fix, and the PR keeps string fallback classifiers for opaque external failures.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 65a805ac2878.

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is maintainer-labeled and authored by a repository MEMBER, so the external contributor real-behavior-proof gate does not apply.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: This is a normal-priority agent/auth failure-copy fix with limited blast radius and focused coverage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is maintainer-labeled and authored by a repository MEMBER, so the external contributor real-behavior-proof gate does not apply.

PR surface:

Source +88, Tests +102. Total +190 across 13 files.

What I checked:

• Current main behavior: Current main builds auto-reply failure text from a message string, so typed auth/failover metadata is not available to the classifier path. (src/auto-reply/reply/agent-runner-execution.ts:770, 65a805ac2878)
• Typed dispatch path: The PR changes buildExternalRunFailureReply to accept the original error object, check auth-profile failover metadata, typed missing-auth errors, and typed OAuth refresh errors before generic fallback copy. (src/auto-reply/reply/agent-runner-execution.ts:792, 35eb8d9e0f56)
• Typed auth source: MissingProviderAuthError now extends ProviderAuthError with source metadata, and requireApiKey throws it while preserving the existing missing-api-key code. (src/agents/model-auth-runtime-shared.ts:29, 35eb8d9e0f56)
• Auth-profile metadata source: The embedded auth controller adds authProfileFailure metadata when wrapping auth-profile failover in FailoverError, preserving the existing message/cause flow. (src/agents/embedded-agent-runner/run/auth-controller.ts:348, 35eb8d9e0f56)
• Previous blocker fixed: The refreshed branch adds isMissingProviderAuthError to the full model-auth.js mock that the previous ClawSweeper review flagged. (src/auto-reply/reply/agent-runner.misc.runreplyagent.test.ts:101, 35eb8d9e0f56)
• Regression coverage: The PR adds focused auto-reply tests for typed OAuth refresh, typed missing provider auth, and typed auth-profile FailoverError metadata. (src/auto-reply/reply/agent-runner-execution.test.ts:5602, 35eb8d9e0f56)

Likely related people:

• RomneyDa: Auth-profile failure-copy was introduced in merged commit 64a946a and this PR is the direct typed-dispatch follow-up to that work. (role: feature owner; confidence: high; commits: 64a946ac21d1, 35eb8d9e0f56; files: src/agents/auth-profiles/failure-copy.ts, src/agents/embedded-agent-runner/run/auth-controller.ts, src/auto-reply/reply/agent-runner-execution.ts)
• Mariano: History for the OAuth reauth failure copy path includes b77db8c, which surfaced OAuth reauth failures in the auto-reply path this PR extends. (role: introduced sibling behavior; confidence: medium; commits: b77db8c0b610; files: src/auto-reply/reply/agent-runner-execution.ts, src/agents/auth-profiles/oauth-refresh-failure.ts)
• Shakker: History for missing-key reply handling includes 4ad9f16, an adjacent missing-auth reply sanitization change in the same classifier family. (role: adjacent owner; confidence: medium; commits: 4ad9f166e214; files: src/auto-reply/reply/agent-runner-execution.ts)
• Vincent Koc: Current-main blame for the surrounding auto-reply classifier and model-auth helper lines points to the grafted current source snapshot; this is a weaker routing signal than the targeted feature commits. (role: recent area contributor; confidence: low; commits: 0b9187c780cc; files: src/auto-reply/reply/agent-runner-execution.ts, src/agents/model-auth-runtime-shared.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.