fix(agent-core-v2): surface provider auth errors and align agent copy with v1

[sailist]

Related Issue

No linked issue — the problems are explained below.

Problem

Three independent issues, two in agent-core-v2 (the DI × Scope engine) and one in kap-server:

1. When an OAuth-managed model returns 401, the engine forces a token refresh and retries. If the 401 persists, the account itself was rejected by the provider (plan or model unavailable) — but v2 surfaced AUTH_LOGIN_REQUIRED with a "send /login" prompt, sending users into a re-login loop that cannot fix the problem. The provider's actual rejection message was discarded, and full compaction wrapped the error as a generic COMPACTION_FAILED, hiding it further.
2. v2's repeated-tool-call reminders hard-prohibited the call ("Do not call this exact same tool again") and echoed the tool name and arguments, which proved less effective than v1's redirect-style copy (v1 fix: rewrite repeated tool call reminders to redirect instead of prohibit #1518). Separately, a dismissed AskUserQuestion was documented as answering with the recommended option, while v1 (fix(agent-core): treat dismissed AskUserQuestion as no answer, not recommended pick #1550) treats dismissal as "no answer".
3. kap-server's instance registry had a shutdown race: a heartbeat write already in flight when release() ran could complete its atomic rename after the unlink, recreating the just-removed instance file. This also made instanceRegistry.test.ts flaky in CI.

What changed

1. Surface provider rejection on post-refresh 401

• Map a 401 that survives a forced token refresh to PROVIDER_AUTH_ERROR carrying the provider's sanitized message, instead of a misleading AUTH_LOGIN_REQUIRED re-login prompt (modelImpl.ts).
• Propagate provider auth errors through full compaction instead of wrapping them as COMPACTION_FAILED (fullCompactionService.ts).
• Export sanitizeStatusErrorMessage for reuse (errors.ts).

2. Align repeat-reminder and AskUserQuestion copy with v1

• Rewrite the three repeated-tool-call reminders to redirect instead of prohibit: ask the agent to state what new information it expects, then offer falsification-check / missing-input / conclude options, and end with a text-only summary instruction (port of v1 fix: rewrite repeated tool call reminders to redirect instead of prohibit #1518).
• Simplify makeReminderText2 to take only (repeatCount), no longer echoing tool name and arguments.
• Treat a dismissed AskUserQuestion as "chose not to answer" rather than selecting the recommended option (port of v1 fix(agent-core): treat dismissed AskUserQuestion as no answer, not recommended pick #1550).
• Update toolDedupe test assertions and regenerate affected wire snapshots.

3. Drain in-flight heartbeat writes before unlinking the instance file

• Count writes that passed the released check and have release() await them before unlinking, so an atomic rename can no longer recreate the file after removal (instanceRegistry.ts).
• Harden the heartbeat test with a 1ms cadence plus a post-release re-check; verified the new test fails on the old code and passes deterministically with the fix.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1111f65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@moonshot-ai/kimi-code@1111f65

npx https://pkg.pr.new/@moonshot-ai/kimi-code@1111f65

commit: 1111f65

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9e527fa73

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Move helper rationale to the file header

For files under packages/agent-core-v2, packages/agent-core-v2/AGENTS.md requires comments to live only in the top-of-file header and “never beside functions.” This newly added helper block comment sits next to toProviderAuthError, so it violates the local convention; please move the rationale into the file header or make the helper/test names carry it.

Useful? React with 👍 / 👎.