Clarify provider availability states

apps/desktop-tauri/src-tauri/src/commands/bridge.rs

@@ -194,6 +194,8 @@ pub struct ProviderUsageSnapshot {
     pub updated_at: String,
     #[serde(default)]
     pub error: Option<String>,
+    #[serde(default = "default_error_state")]
+    pub error_state: codexbar::core::ProviderStateKind,
     #[serde(default)]
     pub pace: Option<PaceSnapshot>,
     #[serde(default)]
@@ -216,6 +218,10 @@ fn default_source_label() -> String {
     "seed".to_string()
 }
 
+fn default_error_state() -> codexbar::core::ProviderStateKind {
+    codexbar::core::ProviderStateKind::Unknown
+}
+
 /// Provider payload after applying settings-driven cross-surface presentation.
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -380,6 +386,7 @@ impl ProviderUsageSnapshot {
             source_label: result.source_label.clone(),
             updated_at: usage.updated_at.to_rfc3339(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace,
             account_organization: usage.account_organization.clone(),
             tray_status_label: None,
@@ -389,7 +396,12 @@ impl ProviderUsageSnapshot {
         }
     }
 
-    pub(super) fn from_error(id: ProviderId, metadata: &ProviderMetadata, error: String) -> Self {
+    pub(super) fn from_error(
+        id: ProviderId,
+        metadata: &ProviderMetadata,
+        error: String,
+        state_kind: codexbar::core::ProviderStateKind,
+    ) -> Self {
         let error = friendly_provider_error(id, &error);
         Self {
             provider_id: id.cli_name().to_string(),
@@ -420,6 +432,7 @@ impl ProviderUsageSnapshot {
             source_label: String::new(),
             updated_at: chrono::Utc::now().to_rfc3339(),
             error: Some(error),
+            error_state: state_kind,
             pace: None,
             account_organization: None,
             tray_status_label: None,

apps/desktop-tauri/src-tauri/src/commands/provider_detail.rs

@@ -31,6 +31,8 @@ pub struct ProviderDetail {
 
     // Error / state.
     pub last_error: Option<String>,
+    /// Backend-classified availability state for the latest refresh.
+    pub error_state: Option<codexbar::core::ProviderStateKind>,
 
     // URLs for quick-actions (button visibility).
     pub dashboard_url: Option<String>,
@@ -87,6 +89,7 @@ pub(crate) fn build_provider_detail(provider_id: &str) -> Result<ProviderDetail,
         cost: None,
         pace: None,
         last_error: None,
+        error_state: None,
         dashboard_url: dashboard_url.clone(),
         status_page_url: metadata.status_page_url.map(|s| s.to_string()),
         // Buy-credits currently mirrors the dashboard URL for providers that
@@ -142,6 +145,7 @@ pub fn get_provider_detail(
             detail.pace = snapshot.pace.clone();
         }
         detail.last_error = snapshot.error.clone();
+        detail.error_state = Some(snapshot.error_state);
         detail.has_snapshot = true;
     }
 

apps/desktop-tauri/src-tauri/src/commands/providers.rs

@@ -635,9 +635,15 @@ async fn fetch_provider_snapshot(
             Ok(Err(e)) => ProviderUsageSnapshot::from_error(
                 id,
                 &metadata,
-                codexbar::logging::safe_error_message(e),
+                codexbar::logging::safe_error_message(&e),
+                provider.error_state_kind(&e),
+            ),
+            Err(_) => ProviderUsageSnapshot::from_error(
+                id,
+                &metadata,
+                "Timeout".to_string(),
+                codexbar::core::ProviderStateKind::Unknown,
             ),
-            Err(_) => ProviderUsageSnapshot::from_error(id, &metadata, "Timeout".to_string()),
         };
 
     record_provider_fetch_duration(id, &mut snapshot, started);
@@ -1057,7 +1063,12 @@ mod predictive_warning_tests {
         let metadata = codexbar::core::instantiate_provider(ProviderId::Claude)
             .metadata()
             .clone();
-        ProviderUsageSnapshot::from_error(ProviderId::Claude, &metadata, "unused".to_string())
+        ProviderUsageSnapshot::from_error(
+            ProviderId::Claude,
+            &metadata,
+            "unused".to_string(),
+            codexbar::core::ProviderStateKind::Unknown,
+        )
     }
 
     #[test]
@@ -1163,6 +1174,7 @@ mod reset_backfill_tests {
             source_label: String::new(),
             updated_at: "2026-01-01T00:00:00Z".into(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace: None,
             account_organization: None,
             tray_status_label: None,

apps/desktop-tauri/src-tauri/src/commands/tests.rs

@@ -952,6 +952,7 @@ fn claude_transient_auth_failure_preserves_first_last_good_snapshot() {
         ProviderId::Claude,
         &metadata,
         "Unauthorized".to_string(),
+        codexbar::core::ProviderStateKind::NeedsAuthentication,
     );
     let mut state = crate::state::AppState::new();
     state.provider_cache.push(good.clone());
@@ -981,6 +982,7 @@ fn claude_repeated_auth_failure_surfaces_error() {
         ProviderId::Claude,
         &metadata,
         "Unauthorized".to_string(),
+        codexbar::core::ProviderStateKind::NeedsAuthentication,
     );
     let second_error = first_error.clone();
     let mut state = crate::state::AppState::new();
@@ -1015,6 +1017,7 @@ fn claude_cli_parse_failure_keeps_last_good_every_time() {
         ProviderId::Claude,
         &metadata,
         "Parse error: Empty output from Claude CLI".to_string(),
+        codexbar::core::ProviderStateKind::Unknown,
     );
     let mut state = crate::state::AppState::new();
     state.provider_cache.push(good.clone());
@@ -1050,13 +1053,19 @@ fn claude_hard_credentials_missing_does_not_preserve_stale() {
         &metadata,
         "OAuth error: Claude OAuth credentials not found. Run `claude` to authenticate."
             .to_string(),
+        codexbar::core::ProviderStateKind::NeedsAuthentication,
     );
     let mut state = crate::state::AppState::new();
     state.provider_cache.push(good);
 
     let out =
         super::providers::preserve_last_good_transient_failure(&mut state, ProviderId::Claude, err);
     assert!(out.error.is_some());
+    assert_eq!(
+        out.error_state,
+        codexbar::core::ProviderStateKind::NeedsAuthentication,
+        "hard auth failure must carry its classification on the snapshot"
+    );
 }
 
 #[test]

apps/desktop-tauri/src-tauri/src/powertoys.rs

@@ -201,6 +201,7 @@ mod tests {
             source_label: "web".to_string(),
             updated_at: "2026-07-09T00:00:00Z".to_string(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace: None,
             account_organization: Some("Example Org".to_string()),
             tray_status_label: None,
@@ -246,6 +247,7 @@ mod tests {
             source_label: "web".to_string(),
             updated_at: "2026-07-09T00:00:00Z".to_string(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace: None,
             account_organization: None,
             tray_status_label: None,

apps/desktop-tauri/src-tauri/src/tray_bridge.rs

@@ -1082,6 +1082,7 @@ mod tests {
             source_label: String::new(),
             updated_at: "2025-01-01T00:00:00Z".into(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace: None,
             account_organization: None,
             tray_status_label: None,

apps/desktop-tauri/src-tauri/src/usage_metric.rs

@@ -213,6 +213,7 @@ mod tests {
             source_label: "test".to_string(),
             updated_at: "2026-08-16T00:00:00Z".to_string(),
             error: None,
+            error_state: codexbar::core::ProviderStateKind::Ready,
             pace: None,
             account_organization: None,
             tray_status_label: None,

apps/desktop-tauri/src/components/MenuCard.test.tsx

@@ -71,6 +71,7 @@ function provider(
     sourceLabel: "oauth",
     updatedAt: "2026-05-24T00:00:00Z",
     error,
+    errorState: "unknown",
     pace: null,
     accountOrganization: null,
     trayStatusLabel: null,

apps/desktop-tauri/src/components/providerGridUtils.test.ts

@@ -44,6 +44,7 @@ function provider(id: string): ProviderUsageSnapshot {
     sourceLabel: "oauth",
     updatedAt: "2026-07-31T00:00:00Z",
     error: null,
+    errorState: "ready",
     pace: null,
     accountOrganization: null,
     trayStatusLabel: null,

apps/desktop-tauri/src/floatbar/FloatBar.css

@@ -103,6 +103,14 @@ body.floatbar-window #root {
 .floatbar__empty * {
   pointer-events: none;
 }
+
+.floatbar__cost-estimate {
+  color: rgba(24, 42, 54, 0.72);
+  font-size: calc(8px * var(--floatbar-scale, 1));
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+}
 .floatbar__provider-icon {
   display: inline-flex;
   align-items: center;

apps/desktop-tauri/src/floatbar/FloatBar.test.tsx

@@ -73,6 +73,7 @@ function snapshot(
   opts: {
     exhausted?: boolean;
     error?: string | null;
+    errorState?: ProviderUsageSnapshot["errorState"];
     resetsAt?: string | null;
     resetDescription?: string | null;
     informational?: boolean;
@@ -117,6 +118,7 @@ function snapshot(
     sourceLabel: "auto",
     updatedAt: "2026-05-15T00:00:00Z",
     error: opts.error ?? null,
+    errorState: opts.errorState ?? "ready",
     pace: null,
     accountOrganization: null,
     trayStatusLabel: null,
@@ -221,6 +223,11 @@ describe("FloatBar", () => {
         TrayResetsDueNow: "Resetting",
         PanelToday: "Today",
         PanelUsedSuffix: "used",
+        OverviewSpendEstimate: "Estimate",
+        ProviderIssueAuthRequired: "Sign-in required",
+        ProviderIssueSessionExpired: "Session expired",
+        ProviderIssueLocalRuntimeOffline: "Local runtime offline",
+        ProviderIssueUnknown: "Usage unavailable",
         FloatBarThirtyDayShort: "30d",
         FloatBarNoProviders: "No providers",
         FloatBarRemainingSuffix: "remaining",
@@ -393,6 +400,31 @@ describe("FloatBar", () => {
     expect(tauriMocks.getProviderChartData).not.toHaveBeenCalled();
   });
 
+  it("marks displayed local cost as an estimate", async () => {
+    tauriMocks.getCachedProviders.mockResolvedValue([snapshot("codex", "Codex", 75)]);
+    tauriMocks.getSettingsSnapshot.mockResolvedValue(settings({ floatBarShowCost: true }));
+    tauriMocks.getProviderLocalUsageSummary.mockResolvedValue({
+      todayCost: 1.25,
+      thirtyDayCost: 12.5,
+      thirtyDayTokens: 1000,
+      latestTokens: 200,
+      topModel: "gpt-5",
+      estimateNote: "Estimated from local logs",
+      tokenCostUpdatedAtMs: 1234,
+    });
+
+    const { container } = renderFloatBar(bootstrap({ floatBarShowCost: true }));
+
+    await waitFor(() => {
+      expect(container.querySelector(".floatbar__cost-estimate")?.textContent).toBe(
+        "Estimate",
+      );
+    });
+    expect(container.querySelector(".floatbar__cost-pill")?.getAttribute("title")).toContain(
+      "(Estimate)",
+    );
+  });
+
   it("does not scan local costs by default", async () => {
     tauriMocks.getCachedProviders.mockResolvedValue([
       snapshot("codex", "Codex", 75),
@@ -405,6 +437,44 @@ describe("FloatBar", () => {
       expect(tauriMocks.getCachedProviders).toHaveBeenCalled();
     });
     expect(tauriMocks.getProviderLocalUsageSummary).not.toHaveBeenCalled();
+    expect(document.querySelector(".floatbar__cost-pill")).toBeNull();
+  });
+
+  it("uses a safe state label instead of a raw provider error", async () => {
+    const raw = "legacy telemetry failed for https://private.example.test; cookie=super-secret";
+    tauriMocks.getCachedProviders.mockResolvedValue([
+      snapshot("gemini", "Gemini", 12, { error: raw, errorState: "unknown" }),
+    ]);
+    tauriMocks.getSettingsSnapshot.mockResolvedValue(settings({ enabledProviders: ["gemini"] }));
+
+    const { container } = renderFloatBar(bootstrap({ enabledProviders: ["gemini"] }));
+
+    await waitFor(() => {
+      const pill = container.querySelector(".floatbar__pill");
+      expect(pill?.textContent).toContain("Usage unavailable");
+      expect(pill?.getAttribute("title")).toBe("Gemini: Usage unavailable");
+      expect(pill?.textContent).not.toContain("super-secret");
+      expect(pill?.getAttribute("title")).not.toContain("private.example.test");
+    });
+  });
+
+  it("renders the sign-in label when the backend classifies needsAuthentication", async () => {
+    tauriMocks.getCachedProviders.mockResolvedValue([
+      snapshot("copilot", "GitHub Copilot", 12, {
+        error: "GitHub Copilot token not found. Sign in with GitHub.",
+        errorState: "needsAuthentication",
+      }),
+    ]);
+    tauriMocks.getSettingsSnapshot.mockResolvedValue(settings({ enabledProviders: ["copilot"] }));
+
+    const { container } = renderFloatBar(bootstrap({ enabledProviders: ["copilot"] }));
+
+    await waitFor(() => {
+      const pill = container.querySelector(".floatbar__pill");
+      expect(pill?.textContent).toContain("Sign-in required");
+      expect(pill?.textContent).not.toContain("12%");
+      expect(pill?.getAttribute("title")).toBe("GitHub Copilot: Sign-in required");
+    });
   });
 
   it("can show remaining percentages when configured", async () => {