fix(openai-native): keep provider error text out of the abort-race telemetry capture

The abort-race capture put the SDK's own message into ApiProviderError, and
PostHogTelemetryClient forwards error.message to PostHog, so a 400 body that echoes
request content (an address, a prompt fragment) could reach the telemetry backend.
Report a fixed message plus the numeric status in errorCode instead - the client
already turns errorCode into a structured property - and add a regression test whose
provider error carries sensitive text.

The propagated object is unchanged, so retry, backoff and the UI still read the
provider's own error, and the capture still happens exactly once before the throw.

Author: easonLiangWorldedtech

src/api/providers/__tests__/openai-native.spec.ts

@@ -1542,6 +1542,53 @@ describe("OpenAiNativeHandler", () => {
 				expect(mockCaptureException.mock.calls[0]?.[0]).toMatchObject({ operation: "createMessage" })
 			})
 
+			it("keeps the provider's own error text out of the abort-race telemetry capture", async () => {
+				// A 400 body can echo request content — an address, a prompt fragment — and the
+				// telemetry client forwards error.message to PostHog, so an abort-raced failure
+				// must be reported as fixed text plus the numeric status, never as its own text.
+				const mockFetch = vitest.fn()
+				global.fetch = mockFetch as typeof fetch
+				const controller = new AbortController()
+				const sensitiveText = "400 Invalid request: someone@example.com sent 120000 tokens"
+				const leaky = Object.assign(new Error(sensitiveText), { status: 400 })
+				mockResponsesCreate.mockImplementation((_body: unknown, options: { signal?: AbortSignal }) => {
+					return new Promise((_resolve, reject) => {
+						if (options?.signal?.aborted) {
+							reject(leaky)
+							return
+						}
+						options?.signal?.addEventListener("abort", () => reject(leaky), { once: true })
+					})
+				})
+
+				const collected = collectStream(
+					handler.createMessage(
+						systemPrompt,
+						messages,
+						makeCreateMessageMetadata({ abortSignal: controller.signal }),
+					),
+				)
+				await tick()
+				controller.abort()
+
+				const error = await collected.then(
+					() => undefined,
+					(e: unknown) => e,
+				)
+				// The caller still receives the provider's own object, provider text included.
+				expect(error).toBe(leaky)
+				expect(mockFetch).not.toHaveBeenCalled()
+				expect(mockCaptureException).toHaveBeenCalledTimes(1)
+				const [captured] = mockCaptureException.mock.calls[0] ?? []
+				const capturedError = captured instanceof ApiProviderError ? captured : undefined
+				expect(capturedError).toBeDefined()
+				expect(capturedError?.message).toBe(
+					"OpenAI Native createMessage request failed with a status-bearing error after the caller aborted",
+				)
+				expect(capturedError?.message).not.toContain("someone@example.com")
+				expect(capturedError?.errorCode).toBe(400)
+			})
+
 			it("should keep a streaming request's controller when completePrompt uses its own signal", async () => {
 				// completePrompt is a request-local signal path: it must not take over or clear the
 				// controller owned by an in-flight createMessage on the same handler, and aborting

src/api/providers/openai-native.ts

@@ -36,7 +36,7 @@ import { isMcpTool } from "../../utils/mcp-name"
 import { sanitizeOpenAiCallId } from "../../utils/tool-id"
 import { createAbortError, isRequestAborted, mergeAbortSignalAndTimeout } from "./utils/abort-signal"
 import { createTimeoutError, getRequestTimeoutMs } from "./utils/request-timeout"
-import { hasNumericHttpStatus } from "./utils/error-handler"
+import { getNumericHttpStatus, hasNumericHttpStatus } from "./utils/error-handler"
 
 export type OpenAiNativeModel = ReturnType<OpenAiNativeHandler["getModel"]>
 
@@ -581,12 +581,18 @@ export class OpenAiNativeHandler extends BaseProvider implements SingleCompletio
 					// visible in provider telemetry, and capturing must not rewrite or
 					// replace the propagated error.
 					const failedModel = this.getModel()
+					// The provider's own error text stays out of telemetry: a 400 body can echo
+					// request content (an email address, a prompt fragment), and the telemetry
+					// client sends error.message straight to PostHog, so this path reports a fixed
+					// message plus the numeric status in errorCode, which the client turns into a
+					// structured property. The propagated object still carries the provider text.
 					TelemetryService.instance.captureException(
 						new ApiProviderError(
-							sdkErr instanceof Error ? sdkErr.message : String(sdkErr),
+							`${this.providerName} createMessage request failed with a status-bearing error after the caller aborted`,
 							this.providerName,
 							failedModel.id,
 							"createMessage",
+							getNumericHttpStatus(sdkErr),
 						),
 					)
 					throw sdkErr

src/api/providers/utils/error-handler.ts

@@ -54,6 +54,21 @@ export function hasNumericHttpStatus(error: unknown): boolean {
 	return false
 }
 
+/**
+ * The numeric HTTP status carried by an error, or `undefined` when it carries none.
+ * Same field order as hasNumericHttpStatus — `status` (most SDKs expose it that way)
+ * before `statusCode` (the AI SDK's APICallError shape) — and only finite numbers,
+ * so a null or stringy status never becomes a retry header or a telemetry property.
+ */
+export function getNumericHttpStatus(error: unknown): number | undefined {
+	if (!error || typeof error !== "object") return undefined
+	const candidate = error as { status?: unknown; statusCode?: unknown }
+	// Number.isFinite does not coerce, so the value it accepted has to be handed back
+	// with a cast: there is no narrower form for an already-validated unknown number.
+	if (Number.isFinite(candidate.status)) return candidate.status as number
+	return Number.isFinite(candidate.statusCode) ? (candidate.statusCode as number) : undefined
+}
+
 export function handleProviderError(
 	error: unknown,
 	providerName: string,