test: cover assistant stream deployment failures

tests/e2e/test_assistant_web_api.py

@@ -7,12 +7,14 @@ import urllib.error
 import urllib.request
 from collections.abc import Callable
 from http.server import ThreadingHTTPServer
+from unittest.mock import patch
 
 from cognitive_agent.application.codex_assistant import (
     ActiveCodexTurn,
     CodexAssistantService,
 )
 from cognitive_agent.auth import AuthConfig, AuthRuntime
+from cognitive_agent.infrastructure.codex.app_server import CodexAppServerError
 from cognitive_agent.server import SeatDemoHandler, VehicleDisplaySync
 
 COOLING_INSTRUCTION = "打开空调，将全车温度设置为23度，风量设置为2档"
@@ -498,6 +500,37 @@ class TestCodexAssistantWebApi:
         assert not AssistantApiHandler.service.calls
         assert not FAKE_CODEX.bridge_results
 
+    def test_model_auth_failure_is_a_safe_terminal_ndjson_event(self) -> None:
+        secret = "deployment-secret-must-never-reach-the-browser"
+        provider_error = CodexAppServerError(
+            f"provider rejected Authorization: Bearer {secret}"
+        )
+
+        with patch.object(FAKE_CODEX, "start_thread", side_effect=provider_error):
+            events = self.post_assistant(
+                {
+                    "message": "解释一下 CAN FD",
+                    "conversation_id": "conv-api-provider-auth-failure",
+                    "history": [],
+                }
+            )
+
+        assert [event["type"] for event in events] == [
+            "message.accepted",
+            "work.started",
+            "error",
+        ]
+        assert events[-1] == {
+            "type": "error",
+            "error": "assistant_model_failed",
+            "message": "Codex AI 助手暂时没有响应，请稍后再试。",
+        }
+        serialized = json.dumps(events, ensure_ascii=False)
+        assert secret not in serialized
+        assert "Bearer" not in serialized
+        assert not AssistantApiHandler.service.calls
+        assert not FAKE_CODEX.bridge_results
+
     def test_hot_cabin_uses_internal_bridge_and_explicit_trusted_cooling_instruction(self) -> None:
         events = self.post_assistant(
             {