diff --git a/packages/ai-credentials/src/CredentialProvider.ts b/packages/ai-credentials/src/CredentialProvider.ts
index d875781..156988e 100644
--- a/packages/ai-credentials/src/CredentialProvider.ts
+++ b/packages/ai-credentials/src/CredentialProvider.ts
@@ -18,11 +18,40 @@ export type AuthenticationChallenge =
 			attemptId: string;
 			authorizationUrl: string;
 			expiresIn: number;
+	  }
+	| {
+			/**
+			 * An external process (e.g. a spawned CLI such as `gcloud`) owns the
+			 * browser flow. `url` is omitted when the process opens the browser
+			 * itself and no URL is known up front.
+			 */
+			kind: "external-browser";
+			attemptId: string;
+			url?: string;
+			instructions: string;
+			expiresIn: number;
 	  };
 
 export type AuthenticationStartResult =
 	| { status: "started"; challenge: AuthenticationChallenge }
-	| { status: "already-in-progress" };
+	| { status: "already-in-progress" }
+	| {
+			/**
+			 * The refresh completed synchronously (e.g. a silent token refresh
+			 * that needed no browser interaction). No attempt was created;
+			 * callers should refetch auth status and models.
+			 */
+			status: "completed";
+	  }
+	| {
+			/**
+			 * No attempt was created — the provider cannot be authenticated in
+			 * this environment (e.g. required CLI missing, no SSO profile
+			 * configured). Callers should fall back to a configuration UI.
+			 */
+			status: "unavailable";
+			reason: string;
+	  };
 
 /** Strict semantic inputs accepted by the store-backed credential controller. */
 export type CredentialSourceInput =
diff --git a/packages/ai-provider-bridge/src/types.ts b/packages/ai-provider-bridge/src/types.ts
index 54543f0..2025e45 100644
--- a/packages/ai-provider-bridge/src/types.ts
+++ b/packages/ai-provider-bridge/src/types.ts
@@ -289,6 +289,14 @@ export const NOTIFICATION_ACTIONS = {
 	 * Handler should open the Posit AI setup page
 	 */
 	POSIT_AI_COMPLETE_SETUP: "posit-ai-complete-setup",
+
+	/**
+	 * Reconnect a provider whose credentials expired - triggered instead of
+	 * REFRESH_MODELS on hosts with a graphical configuration overlay.
+	 * Handler should open the configuration overlay and start an in-app
+	 * credential refresh for the notification's providerId.
+	 */
+	RECONNECT_PROVIDER: "reconnect-provider",
 } as const;
 
 /**