fix: preserve core authentication and quota guidance

Author: ivanmilevtues

README.md

@@ -222,9 +222,10 @@ Every run reports what it resolved, so the answer never has to be inferred from
   with an error annotation saying which, and in review mode the failure comment says it too.
   No partial analysis is published.
 
-When your free CodeBoarding quota is exhausted, the failure reason links to
+When your CodeBoarding quota is exhausted, the failure reason links to
 [buy a CodeBoarding license](https://codeboarding.org/pricing) or suggests waiting for your
-weekly reset. Provider quota failures retain their provider billing guidance.
+weekly reset. If CodeBoarding's hosted provider runs out of quota, the failure reason identifies
+a CodeBoarding service issue. Own-provider quota failures retain their provider billing guidance.
 
 ## Model selection
 

scripts/analyze_repository.py

@@ -13,8 +13,10 @@
 from threading import Thread
 
 PROG = "codeboarding"
+# Shared with CodeBoarding/codeboarding_cli/main.py; keep the prefix in sync.
+ENGINE_ERROR_PREFIX = "CodeBoarding: "
 
-# The engine's exit codes for an LLM refusal the user has to fix, and what to tell them.
+# Fallback guidance for engine refusals without a recovery message.
 ENGINE_REFUSALS = {
     2: "The LLM provider rejected the API key. Check the key's secret and re-run.",
     3: "The LLM provider's token or credit quota is exhausted. Add credits or raise the quota, then re-run.",
@@ -109,11 +111,10 @@ def forward_stderr() -> None:
     stdout = "".join(stdout_lines)
     if return_code != 0:
         reason = ENGINE_REFUSALS.get(return_code)
-        if return_code == 3:
-            # Keep Core's quota-specific recovery guidance instead of replacing it with provider billing advice.
+        if return_code in ENGINE_REFUSALS:
             for line in reversed(stderr_lines):
-                if "CodeBoarding: " in line:
-                    reason = line.partition("CodeBoarding: ")[2].strip()
+                if ENGINE_ERROR_PREFIX in line:
+                    reason = line.partition(ENGINE_ERROR_PREFIX)[2].strip() or reason
                     break
         if reason:
             # Written straight to the step's outputs: the shell never sees this script's stdout on failure.

tests/test_analyze_repository.py

@@ -89,20 +89,38 @@ def test_run_command_names_an_exhausted_quota(self) -> None:
             self.assertIn("quota is exhausted", str(error))
             self.assertEqual(outputs.read_text(encoding="utf-8"), f"failure_reason={error}\n")
 
-    def test_quota_failure_preserves_cores_recovery_message(self) -> None:
+    def test_engine_refusals_preserve_cores_recovery_message(self) -> None:
         messages = (
-            "Your free CodeBoarding quota is exhausted. Buy a CodeBoarding license at "
-            "https://codeboarding.org/pricing, or wait for your weekly reset.",
-            "The LLM provider's token or credit quota is exhausted. "
-            "Add credits or raise the quota for this provider, then re-run.",
+            (
+                3,
+                "Your CodeBoarding quota is exhausted. Buy a CodeBoarding license at "
+                "https://codeboarding.org/pricing, or wait for your weekly reset.",
+            ),
+            (
+                3,
+                "The LLM provider's token or credit quota is exhausted. "
+                "Add credits or raise the quota for this provider, then re-run.",
+            ),
+            (
+                3,
+                "The hosted LLM provider's quota is exhausted. "
+                "This is a CodeBoarding service issue. Please try again later or contact CodeBoarding support.",
+            ),
+            (2, "Your openai API key was rejected (HTTP 401). Verify the key ending in '…a8dd' and try again."),
+            (
+                2,
+                "CodeBoarding's hosted openrouter credentials were rejected (HTTP 401). This run used no key of "
+                "yours: check that the workflow grants `id-token: write`, then re-run.",
+            ),
         )
-        for message in messages:
-            with self.subTest(message=message), tempfile.TemporaryDirectory() as tmp:
+        for exit_code, message in messages:
+            with self.subTest(exit_code=exit_code, message=message), tempfile.TemporaryDirectory() as tmp:
                 outputs = Path(tmp) / "github_output"
                 program = (
                     "import sys; "
                     f"print('ERROR [codeboarding_cli.main:140] CodeBoarding: ' + {message!r}, file=sys.stderr); "
-                    "sys.exit(3)"
+                    "print('Additional unprefixed guidance', file=sys.stderr); "
+                    f"sys.exit({exit_code})"
                 )
                 with patch.dict("os.environ", {"GITHUB_OUTPUT": str(outputs)}), patch("sys.stderr", io.StringIO()):
                     with self.assertRaises(ar.AnalysisError) as caught: