[EugeneTheDev]

Result

When a thread continues on another provider, the client now shows what went wrong instead of the raw provider JSON:

The current provider can't read this thread's earlier reasoning, which another provider or account encrypted. This happens after the provider changes in a thread. Switch back to the previous provider or start a new thread.

Before, Air showed the whole gateway error body: {"error":{"message":"Provider returned error","code":400,"metadata":{"raw":"{\n \"error\": {...\"code\": \"invalid_encrypted_content\"....

Cause

Codex sends requests with store: false and resends the encrypted reasoning of earlier turns with every request. Only the provider (and account) that encrypted it can read it. After providers/set moves a thread to another route, the new route rejects the history with invalid_encrypted_content, and a retry fails the same way.

This is Codex behavior, not an adapter bug: codex exec resume <id> -c model_provider=<other> sends the other provider's encrypted reasoning too. Codex has no option to drop it, so the adapter only makes the error readable and does not rewrite the history.

Changes

• readableServiceErrorMessage recognizes invalid_encrypted_content in three forms: the plain provider error {error: {code}}, the Codex service envelope {type: "error", status, error}, and a gateway error that carries it in metadata.provider_error_code or in the JSON of metadata.raw.
• Other error text stays unchanged.
• The function is already used for every path a provider error reaches the client, so ACP v1 (agent message and Air typed failure) and ACP v2 (agent message and idle error) all get the message.

Verification

• New unit tests in ServiceErrorMessage.test.ts, and snapshot tests for ACP v1 (legacy text and typed failure) and ACP v2. All 7 fail without the change.
• npm run typecheck passes. npm test: 1877 passed, 36 skipped.
• End to end with real Codex and two local OpenAI-compatible gateways on ACP v1 and v2: two prompts on gateway A, providers/set to gateway B, which returns the gateway error above; the client gets the readable message.