fix bedrock authentication refresh

crates/galaxy_agent_rig/src/stream.rs

@@ -512,6 +512,11 @@ fn text_indicates_authentication_failure(text: &str) -> bool {
         "unrecognized client",
         "security token included in the request is invalid",
         "unable to locate credentials",
+        "unauthorizedexception",
+        "session token not found or invalid",
+        "sso session has expired",
+        "failed to load aws credentials",
+        "bedrock credentials not configured",
         "credential should be scoped to a valid region",
     ]
     .iter()

crates/galaxy_agent_rig/src/stream_unit_tests.rs

@@ -105,6 +105,10 @@ fn flattened_bedrock_credential_errors_are_authentication_failures() {
         r#"{"__type":"ExpiredTokenException","message":"The security token included in the request is expired"}"#,
         "UnrecognizedClientException: The security token included in the request is invalid",
         "AccessDeniedException: not authorized to perform bedrock:ConverseStream",
+        "UnauthorizedException: Session token not found or invalid",
+        "SSO session has expired or is otherwise invalid",
+        "Failed to load AWS credentials: credentials were not loaded",
+        "Bedrock credentials not configured",
     ] {
         let mapped = map_completion_error(CompletionError::ProviderError(message.to_string()));
         assert_eq!(mapped.kind, AgentErrorKind::Authentication);
@@ -112,3 +116,15 @@ fn flattened_bedrock_credential_errors_are_authentication_failures() {
         assert!(mapped.user_message.is_some());
     }
 }
+
+#[test]
+fn unrelated_provider_failures_do_not_become_authentication_failures() {
+    for message in [
+        "HTTP client error: connection reset",
+        "ProviderError: temporarily unavailable",
+        "ValidationException: invalid model",
+    ] {
+        let mapped = map_completion_error(CompletionError::ProviderError(message.to_owned()));
+        assert_ne!(mapped.kind, AgentErrorKind::Authentication);
+    }
+}