[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

Related issue

No linked issue; internal Roomote provider-validation work.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

The real inference SDK marks HTTP401/403 credential rejections as non-retryable. The shared classifier returned generic provider_error before reaching its credential classification, so the pre-save guard allowed a provider key that had just been rejected. Existing structured-status tests omitted the SDK's retry flag.

What changed

Preserve invalid_credentials for structured401/403 before the generic non-retryable fallback, so Models/setup rejects a known-bad key. Reuse the existing classification branch, retaining content-filter/credits precedence and excluding detected HTML gateway403 responses. Other explicit no-retry behavior, model failures and credits warnings remain as before. No UI, schema or dependency changes.

Added realistic flagged-error regressions and an opt-in native-helper regression for the actual static-provider pre-save guard. Known auth failures also retain their existing terminal handling rather than being mistaken for generic rejections eligible for a fresh-session retry.

How it was tested

• On develop 57aa1a2e, both new401/403 classifier cases fail, and both native pre-save guard cases resolve null instead of rejecting. The402 credits control passes.
• On the proposed change, the full shared non-task suite passes 125/125. Provider validation/save suites plus the opted-in native cases pass 74/74. Two focused orchestration cases preserve auth terminal handling and ordinary generic-rejection retry behavior; existing mock-catalog warnings remain in that focused suite.
• Native regression uses the actual pinned managed OpenCode process, SDK HTTP transport and application pre-save guard against a local Anthropic-protocol fixture:401/403 each reject with invalid_credentials, exactly one POST /messages;402 returns the existing non-blocking credits warning. Run with ROOMOTE_TEST_OPENCODE_PROVIDER_VALIDATION=1 pnpm exec dotenvx run --quiet -f .env.test -- pnpm --filter @roomote/web exec vitest run --project server src/trpc/commands/task-models/provider-validation.native.test.ts.
• Affected package fast types and normal commit/pre-push formatting, Judgement, oxlint, web/worker ESLint, repository-wide fast types and Knip pass.

Proof limits: native-helper cases are explicitly opt-in and skipped in ordinary CI. The fixture uses synthetic credentials and controlled local HTTP failures; it does not persist keys, execute a browser save, or establish live-provider parity. No paid inference, production changes or external messages. Browser proof is not applicable to this backend classification change.

The classifier boundary is separate from the safety-lifecycle refactor in #3659, which touches the same file but leaves this error classification unchanged.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally — normal fast lint/types/Knip gates passed instead
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset — not run for this bounded validation repair

[roomote-community]

No code issues found. See session

Reviewed all three changed files, classifier precedence, the pre-save guard, and retry callers. Lint, type checks, Knip, CodeQL, and the app build passed for this commit; the CI test job is still running. The native-helper regression is opt-in and skipped in ordinary CI; repository suites were not rerun during this review.

_{Reviewed 2c07caa}