API calls intermittently fail with Bad credentials - https://docs.github.com/rest once the shared auth token expires/is revoked, and the extension keeps reusing the stale token instead of prompting re-auth (unlike e.g. the GitHub Actions extension). Users currently have to sign out, fully restart VS Code, and sign back in.

Changes

• Centralized auth-error detection (loggingOctokit.ts): New isAuthError(e) recognizes 401 status, Bad credentials REST messages, and 401 Unauthorized GraphQL/network errors. RateLogger now takes an optional auth-error callback and invokes it from the existing logApiError path, which is already wired into LoggingOctokit.call, LoggingApolloClient.query, and LoggingApolloClient.mutate — so every REST and GraphQL call is covered without touching call sites.

• Re-auth trigger (credentials.ts): New CredentialStore.handleAuthError(authProviderId) forces a new session for the affected provider only (via initialize(authProviderId, { forceNewSession: { detail: reason } })) with a localized prompt. It deliberately bypasses recreate()/doCreate() so that when both GitHub.com and Enterprise are configured, only the provider that returned the auth error is re-prompted. It:

  • Skips when the provider isn't currently considered authenticated (the regular sign-in flow handles that).
  • Dedupes concurrent failures via an in-flight promise map so a burst of failing requests produces a single prompt.
  • Applies a 60s cooldown after a recreate so stragglers issued with the old token don't immediately re-prompt.
  • Treats dotcom and Enterprise independently.

• Wiring (createHub): Constructs RateLogger with a handler bound to the appropriate AuthProvider.

• Tests: src/test/github/loggingOctokit.test.ts covers isAuthError shapes (REST 401, message-based, GraphQL networkError, unrelated errors) and verifies RateLogger.logApiError invokes — and tolerates exceptions from — the handler.

Sketch

// loggingOctokit.ts — single chokepoint for every API call
public logApiError(info, apiResult) {
    apiResult.catch(e => {
        this.telemetry.sendTelemetryErrorEvent('pr.apiCallFailed', ...);
        if (this.authErrorHandler && isAuthError(e)) {
            try { this.authErrorHandler(e); } catch { /* ignore */ }
        }
    });
}

// credentials.ts — deduped + cooldown'd, provider-scoped re-auth
public async handleAuthError(authProviderId: AuthProvider) {
    if (!this.isAuthenticated(authProviderId)) return { canceled: true };
    const inFlight = this._handlingAuthError.get(authProviderId);
    if (inFlight) return inFlight;
    if (withinCooldown(authProviderId)) return { canceled: true };
    // ... initialize(authProviderId, { forceNewSession: { detail: reason } }), record timestamp on completion
}

The previous ad-hoc handlers (categoryNode.ts "Bad credentials" branch, githubRepository.query 401 branch) remain as-is; this layer catches the cases they miss (REST calls extension-wide, GraphQL mutations, and any other call site).