fix(ghcp): improve oauth failure diagnostics in device flow

tests/unit/cliproxy/oauth-process-error-parser.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'bun:test';
+import { extractLikelyAuthFailureFromStderr } from '../../../src/cliproxy/auth/oauth-process';
+
+describe('oauth-process stderr parsing', () => {
+  it('ignores non-ghcp providers', () => {
+    const stderr =
+      'time="2026-03-03T10:00:00Z" level=error msg="GitHub Copilot authentication failed: example"';
+
+    expect(extractLikelyAuthFailureFromStderr('qwen', stderr)).toBeNull();
+  });
+
+  it('extracts copilot verification failures from logrus lines', () => {
+    const stderr =
+      'time="2026-03-03T10:00:00Z" level=error msg="GitHub Copilot authentication failed: github-copilot: failed to verify Copilot access - you may not have an active Copilot subscription: 403 Forbidden"';
+
+    expect(extractLikelyAuthFailureFromStderr('ghcp', stderr)).toBe(
+      'github-copilot: failed to verify Copilot access - you may not have an active Copilot subscription: 403 Forbidden'
+    );
+  });
+
+  it('extracts generic authentication failure lines', () => {
+    const stderr = 'level=error msg="Authentication failed: state mismatch"';
+
+    expect(extractLikelyAuthFailureFromStderr('ghcp', stderr)).toBe('state mismatch');
+  });
+
+  it('caps extracted message length to prevent noisy broadcasts', () => {
+    const longSuffix = 'x'.repeat(400);
+    const stderr = `level=error msg="Authentication failed: ${longSuffix}"`;
+
+    const parsed = extractLikelyAuthFailureFromStderr('ghcp', stderr);
+    expect(parsed).not.toBeNull();
+    expect((parsed as string).length).toBe(240);
+  });
+});

tests/unit/web-server/cliproxy-auth-routes.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from 'bun:test';
-import { getStartUrlUnsupportedReason } from '../../../src/web-server/routes/cliproxy-auth-routes';
+import {
+  getStartAuthFailureMessage,
+  getStartUrlUnsupportedReason,
+} from '../../../src/web-server/routes/cliproxy-auth-routes';
 
 describe('cliproxy-auth-routes start-url guard', () => {
   it('rejects device code providers', () => {
@@ -27,3 +30,16 @@ describe('cliproxy-auth-routes start-url guard', () => {
     expect(getStartUrlUnsupportedReason('claude')).toBeNull();
   });
 });
+
+describe('cliproxy-auth-routes start failure messaging', () => {
+  it('returns ghcp-specific guidance for Copilot verification failures', () => {
+    expect(getStartAuthFailureMessage('ghcp')).toContain(
+      'GitHub Copilot verification did not complete'
+    );
+  });
+
+  it('keeps generic failure text for other providers', () => {
+    expect(getStartAuthFailureMessage('gemini')).toBe('Authentication failed or was cancelled');
+    expect(getStartAuthFailureMessage('kiro')).toBe('Authentication failed or was cancelled');
+  });
+});