fix(claude-local): classify an unrefreshable OAuth session as auth required

The Claude CLI reports a dead OAuth session as

    Failed to authenticate: OAuth session expired and could not be refreshed

which matches none of the branches in `CLAUDE_AUTH_REQUIRED_RE` — not
`unauthorized`, not `authentication required` (the CLI says "Failed to
authenticate"), and it is an OAuth session rather than an API key. With
`detectClaudeLoginRequired` returning false and neither the transient-upstream
nor the provider-quota pattern matching either, the run ends up unclassified
and fails hard instead of surfacing `claude_auth_required` and its login path.

On one host's run-log corpus this was the single largest error bucket: 2811 of
8179 failed runs, spread over every one of the 11 agents in a continuous ~79h
window — a shared host credential expiring, not a per-agent problem. Because
nothing classified it, all 11 agents kept being woken and kept burning runs for
the entire window.

Match the CLI's whole failure sentence rather than `OAuth session expired`
alone. `detectClaudeLoginRequired` reads the run's own `result` text, and agents
that *report on* an outage quote that phrase back; counter-checking both forms
over the same corpus, the short form newly matched 5 successful runs while the
anchored form matched none.

Author: juancarlosrial

packages/adapters/claude-local/src/server/parse.test.ts

@@ -33,6 +33,36 @@ describe("detectClaudeLoginRequired", () => {
       }).requiresLogin,
     ).toBe(false);
   });
+
+  it("classifies an unrefreshable OAuth session as auth required", () => {
+    expect(
+      detectClaudeLoginRequired({
+        parsed: {
+          result:
+            "Failed to authenticate: OAuth session expired and could not be refreshed",
+          is_error: true,
+        },
+        stdout: "",
+        stderr: "",
+      }).requiresLogin,
+    ).toBe(true);
+  });
+
+  it("does not classify a run that merely reports on an OAuth outage", () => {
+    expect(
+      detectClaudeLoginRequired({
+        parsed: {
+          result: [
+            "## Finding: the host was down for ~3.3 days",
+            "997 of 997 runs in the window died on an expired OAuth session,",
+            "so the credential — not the agents — was at fault.",
+          ].join("\n"),
+        },
+        stdout: "",
+        stderr: "",
+      }).requiresLogin,
+    ).toBe(false);
+  });
 });
 
 describe("isClaudeModelNotFoundError", () => {

packages/adapters/claude-local/src/server/parse.ts

@@ -6,7 +6,12 @@ import {
   parseJson,
 } from "@paperclipai/adapter-utils/server-utils";
 
-const CLAUDE_AUTH_REQUIRED_RE = /(?:not\s+logged\s+in|please\s+log\s+in|please\s+run\s+(?:`?claude\s+login`?|\/login)|login\s+required|requires\s+login|unauthorized|authentication\s+required|invalid\s+api\s+key[\s\S]{0,120}(?:\/login|claude\s+login|log\s+in))/i;
+// The OAuth branch is deliberately matched as the CLI's whole failure sentence
+// rather than on `OAuth session expired` alone: agents routinely quote that
+// phrase back when they *report on* an outage, and `detectClaudeLoginRequired`
+// reads the run's own result text, so the short form misreads those successful
+// reports as an auth failure.
+const CLAUDE_AUTH_REQUIRED_RE = /(?:not\s+logged\s+in|please\s+log\s+in|please\s+run\s+(?:`?claude\s+login`?|\/login)|login\s+required|requires\s+login|unauthorized|authentication\s+required|failed\s+to\s+authenticate[\s\S]{0,40}oauth\s+session\s+expired\s+and\s+could\s+not\s+be\s+refreshed|invalid\s+api\s+key[\s\S]{0,120}(?:\/login|claude\s+login|log\s+in))/i;
 const URL_RE = /(https?:\/\/[^\s'"`<>()[\]{};,!?]+[^\s'"`<>()[\]{};,!.?:]+)/gi;
 
 const CLAUDE_TRANSIENT_UPSTREAM_RE =