provider: a 403 from Factory says it serves a subscription only to Droid, not to sign in again (#242) — the same account's Opus 5.5, GPT-5.5 and GLM answered Droid through magpie every time and refused Grok Build (and Claude Code) every time, on the same models and efforts, with the same headers magpie builds; the old message sent people to check droid and sign in again, which changes nothing. Now it says Factory takes a subscription's requests only from Droid, other agents are refused, and the org's model policy or the plan is what's left when Droid is refused too. TestFactoryForbiddenWithoutOrg fails without the change.

internal/provider/factory.go

@@ -482,9 +482,14 @@ func factoryMendOrg(ctx context.Context, user string, status int, body []byte) b
 }
 
 // factoryExplain is what the user can do about a 403 Factory still answers
-// once magpie has sent what droid sends: whether Factory lets the account
-// use the model is Factory's to say (an org's model policy, a plan without
-// it), so droid itself is the test.
+// once magpie has sent what droid sends. Factory takes a subscription's
+// model requests only from Droid: in #242 the same account's Claude, GPT and
+// GLM models answered droid through magpie every time, with magpie's
+// headers, and refused Grok Build's and Claude Code's every time, on the
+// same models and efforts, a request's body (droid's system prompt opens
+// with its own "You are Droid…") the only difference. So the first thing to
+// say is to use the models from Droid; an org's model policy or the plan is
+// what is left when Droid is refused too.
 func factoryExplain(status int, body []byte) string {
 	if status != http.StatusForbidden {
 		return ""
@@ -492,7 +497,7 @@ func factoryExplain(status int, body []byte) string {
 	if factoryOrgRefused(status, body) {
 		return "the Factory account's organization changed; remove the account in magpie and sign in to it again"
 	}
-	return "Factory refused this account the request; check that `droid`, signed in to the same account and organization, can use this model (an organization's model policy or the plan may not allow it), and if it can, remove the Factory account in magpie and sign in to it again"
+	return "Factory takes a Factory subscription's requests only from Droid itself: other agents' (Claude Code, Grok Build…) are refused even on models Droid runs through magpie, so use the Factory models from Droid; if Droid is refused too, the organization's model policy or the plan doesn't allow this model"
 }
 
 // factoryFirstOrg is the first WorkOS org /api/cli/org says the account is

internal/provider/factory_test.go

@@ -702,9 +702,12 @@ func TestFactoryForbiddenWithoutOrg(t *testing.T) {
 		t.Errorf("prem request went to %s", got)
 	}
 
-	// a 403 still answered says what to do; others pass as they are
+	// a 403 still answered says what to do: Factory refuses every agent
+	// but Droid (#242: Claude Code on Opus 5.5, Grok Build on any model),
+	// which signing in again doesn't change; others pass as they are
 	msg := p.Explain("Factory: Forbidden", 403, []byte(forbidden))
-	if !strings.HasPrefix(msg, "Factory: Forbidden — ") || !strings.Contains(msg, "`droid`") || !strings.Contains(msg, "sign in to it again") {
+	if !strings.HasPrefix(msg, "Factory: Forbidden — ") || !strings.Contains(msg, "only from Droid") || !strings.Contains(msg, "Claude Code") ||
+		strings.Contains(msg, "sign in to it again") {
 		t.Errorf("explained: %s", msg)
 	}
 	if got := p.Explain("Factory: overloaded", 529, nil); got != "Factory: overloaded" {