Remove surface gate; fix Anthropic/OpenAI capability, AgentTask retry/budget, FetchUrl error leak

.claude/CLAUDE.md

@@ -243,8 +243,11 @@ The rest are controls a batch host needs: `toolConcurrency` (opt-in; a round hol
 put to a person still runs one at a time, and results return in the order asked),
 `maxRoundRetries` (default 2, for a `RetryableJobError`, waiting as the provider's
 retry-after says within 1–60 s), `roundTimeoutMs` (a provider can accept a request and never answer;
-past it the round is abandoned as a retryable failure, so the retries cover it), and budgets — `maxInputTokens`, `maxCostUsd` (refused
-without a price card, since a budget it cannot measure never stops anything),
+past it the round is abandoned as a retryable failure, so the retries cover it; a round's text is
+forwarded only once the attempt settles, since a failed attempt's partial cannot be taken back
+from the accumulated text port), and budgets — `maxInputTokens`, `maxCostUsd` (refused
+without a price card, since a budget it cannot measure never stops anything, and failing closed
+for a round that reports no usage: it cannot be priced, so the turn ends `"budget"` after it),
 `maxDurationMs` — each ending the turn `"budget"`, never between a `tool_use` and its result.
 Every round leaves an `AgentStep` on `steps` (timings, attempts, each tool's outcome and
 size, usage, cost) and rides on the `snapshot` beside `messages`; `costUsd` totals them when

packages/ai/src/task/AgentTask.ts

@@ -188,7 +188,7 @@ export const AgentInputSchema = {
       type: "number",
       title: "Max Cost (USD)",
       description:
-        "Estimated spend after which the turn stops with stopReason budget. Needs a price card for the model",
+        "Estimated spend after which the turn stops with stopReason budget. Needs a price card for the model. Fails closed: a round whose usage the provider did not report cannot be priced, so the turn stops with stopReason budget after that round",
       exclusiveMinimum: 0,
       "x-ui-group": "Configuration",
     },
@@ -546,6 +546,10 @@ export class AgentTask extends Task<AgentTaskInput, AgentTaskOutput, AgentTaskCo
     let spentTokens = 0;
     let spentUsd = 0;
     let costKnown = true;
+    // A round that reported no usage cannot be priced, and adding nothing for it
+    // would let a capped turn run every round for free. With maxCostUsd set it
+    // counts as spending the cap: the turn stops after that round.
+    let unmeteredRound = false;
     let reminders = 0;
 
     const messages: ChatMessage[] = [...(input.messages ?? []), promptToUserMessage(input.prompt)];
@@ -583,7 +587,7 @@ export class AgentTask extends Task<AgentTaskInput, AgentTaskOutput, AgentTaskCo
     });
     const overBudget = (): boolean =>
       (input.maxInputTokens !== undefined && spentTokens >= input.maxInputTokens) ||
-      (input.maxCostUsd !== undefined && spentUsd >= input.maxCostUsd);
+      (input.maxCostUsd !== undefined && (unmeteredRound || spentUsd >= input.maxCostUsd));
     yield transcript();
 
     for (let round = 0; round < maxRounds; round++) {
@@ -644,8 +648,10 @@ export class AgentTask extends Task<AgentTaskInput, AgentTaskOutput, AgentTaskCo
           costUsd,
         });
         spentTokens += promptTokens(usage);
-        if (costUsd === undefined) costKnown = false;
-        else spentUsd += costUsd;
+        if (costUsd === undefined) {
+          costKnown = false;
+          unmeteredRound = true;
+        } else spentUsd += costUsd;
       };
 
       const calls = uniquifyToolCallIds(
@@ -880,8 +886,14 @@ export class AgentTask extends Task<AgentTaskInput, AgentTaskOutput, AgentTaskCo
     // unhandled; it is re-thrown below, once the events already produced have
     // reached the caller.
     run.catch(() => {});
-    for await (const event of queue.iterable) yield event;
+    // Held until the attempt settles: the stream accumulates every delta it is
+    // handed into the task's text port and offers no way to take one back, so
+    // text forwarded from an attempt that then fails and is retried would be
+    // joined to the retry's. A failed attempt throws here and its text is dropped.
+    const held: StreamEvent<AgentTaskOutput>[] = [];
+    for await (const event of queue.iterable) held.push(event);
     await run;
+    for (const event of held) yield event;
   }
 
   /**

packages/tasks/src/task/FetchUrlJobError.ts

@@ -183,23 +183,28 @@ export function createFetchUrlHttpError(
   status: number,
   statusText: string,
   retryDate?: Date,
-  body?: string
+  body?: string,
+  options?: HttpErrorDetailOptions
 ): FetchUrlJobErrorInstance {
   const code = httpStatusToFetchUrlErrorCode(status);
   const statusPart = `${status} ${statusText}`;
-  const detail = httpErrorDetailFromBody(body);
+  const detail = httpErrorDetailFromBody(body, options);
   // A body that only restates the status line (`404 Not Found` answering with
   // `Not Found`) adds nothing to the message.
   const redundant =
     detail !== undefined &&
     [statusText.trim(), statusPart.trim(), String(status)].some(
       (s) => s !== "" && s.toLowerCase() === detail.toLowerCase()
     );
-  const httpErrorMessage = redundant ? undefined : detail;
+  const httpErrorMessage = redundant ? undefined : detail?.replace(/"/g, "'");
+  // The remote's words ride inside a fixed, quoted frame so a reader (a model
+  // included) can tell them from this task's own text; `sanitizeHttpErrorDetail`
+  // guarantees the detail cannot contain the frame's delimiters or a newline.
+  const shownUrl = redactUrlForMessage(url);
   const message =
     httpErrorMessage !== undefined
-      ? `Failed to fetch ${url}: ${statusPart}: ${httpErrorMessage}`
-      : `Failed to fetch ${url}: ${statusPart}`;
+      ? `Failed to fetch ${shownUrl}: ${statusPart} [remote said: "${httpErrorMessage}"]`
+      : `Failed to fetch ${shownUrl}: ${statusPart}`;
   return createFetchUrlJobError(code, message, {
     url,
     httpStatus: status,
@@ -209,6 +214,117 @@ export function createFetchUrlHttpError(
   });
 }
 
+export interface HttpErrorDetailOptions {
+  /**
+   * Exact secret values (resolved credentials, key-like request headers) to
+   * blank out of the quoted detail wherever a server echoed them back.
+   */
+  readonly secrets?: readonly string[];
+  /**
+   * The response `Content-Type`. When given, a body that is not text, JSON or
+   * XML is never quoted raw. Omitted means unknown and does not restrict.
+   */
+  readonly contentType?: string;
+}
+
+/** A private-use placeholder, so the brackets in the final text survive the bracket neutralising. */
+const REDACTED = "\uE000";
+const REDACTED_TEXT = "[redacted]";
+
+/** Shortest secret worth scanning for; shorter ones would shred ordinary words. */
+const MIN_SECRET_CHARS = 4;
+
+const SECRET_PARAM_NAMES =
+  "api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|auth(?:orization)?|token|secret|client[_-]?secret|password|passwd|pwd|signature|sig|key";
+
+const SECRET_PATTERNS: readonly RegExp[] = [
+  // `Authorization: Bearer abc1`, `Basic dXNlcjpwdw==`; the lookahead leaves prose (`Basic authentication required`) alone
+  /\b(?:bearer|basic)\s+(?=[A-Za-z0-9._~+/=-]*[\d=])[A-Za-z0-9._~+/=-]{6,}/gi,
+  // `api_key=abc`, `"token": "abc"`, `password: abc`
+  new RegExp(`\\b(${SECRET_PARAM_NAMES})\\b(["']?\\s*[:=]\\s*["']?)[^\\s"'&,;}<>]{3,}`, "gi"),
+  // Provider-shaped keys quoted without any label (`Invalid API key: sk-ant-…`).
+  /\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g,
+  /\b(?:ghp|gho|ghu|ghs|github_pat|xox[abprs]|AKIA|AIza)[A-Za-z0-9_-]{12,}/g,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g,
+];
+
+/**
+ * Query parameter names treated as credentials, matched anywhere in the name
+ * (`x-api-key`, `keyId`, `user_token`). One definition for the URL redactor and
+ * the collector of values to blank from a response body, so they cannot disagree.
+ */
+export const SECRET_QUERY_NAME = /key|token|secret|auth|password|passwd|pwd|signature|sig/i;
+
+/**
+ * The URL as it may appear in an error message: userinfo and the value of any
+ * credential-named query parameter blanked. A key passed on the query string
+ * (`?api_key=…`) is otherwise copied into every persisted error and log line
+ * that quotes the URL.
+ */
+export function redactUrlForMessage(url: string): string {
+  try {
+    const parsed = new URL(url);
+    let changed = false;
+    if (parsed.username !== "" || parsed.password !== "") {
+      parsed.username = "";
+      parsed.password = "";
+      changed = true;
+    }
+    for (const name of [...new Set(parsed.searchParams.keys())]) {
+      if (SECRET_QUERY_NAME.test(name)) {
+        parsed.searchParams.set(name, REDACTED_TEXT);
+        changed = true;
+      }
+    }
+    return changed ? parsed.toString().replace(/%5Bredacted%5D/gi, REDACTED_TEXT) : url;
+  } catch {
+    return url;
+  }
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Makes remote text safe to store and to hand to a model: secrets blanked out,
+ * control and invisible/bidi characters dropped, markup, backticks and the
+ * message frame's own delimiters neutralised, whitespace collapsed to one line.
+ * Runs before bounding so a secret cut by the length cap is not left half-visible.
+ */
+export function sanitizeHttpErrorDetail(text: string, secrets: readonly string[] = []): string {
+  let out = text;
+  // Longest first so a secret containing another is replaced whole.
+  const known = [...new Set(secrets.filter((s) => s.length >= MIN_SECRET_CHARS))].sort(
+    (a, b) => b.length - a.length
+  );
+  for (const secret of known) {
+    out = out.replace(new RegExp(escapeRegExp(secret), "g"), REDACTED);
+  }
+  out = out.replace(SECRET_PATTERNS[0]!, REDACTED);
+  out = out.replace(
+    SECRET_PATTERNS[1]!,
+    (_m, name: string, sep: string) => `${name}${sep}${REDACTED}`
+  );
+  for (const pattern of SECRET_PATTERNS.slice(2)) out = out.replace(pattern, REDACTED);
+  out = out
+    .replace(
+      // oxlint-disable-next-line no-control-regex -- stripping control characters is the point
+      /[\u0000-\u001F\u007F-\u009F\u200B-\u200F\u202A-\u202E\u2028\u2029\u2066-\u2069\uFEFF]/g,
+      " "
+    )
+    .replace(/[<>`]/g, "")
+    .replace(/\[/g, "(")
+    .replace(/\]/g, ")");
+  return out.replaceAll(REDACTED, REDACTED_TEXT);
+}
+
+function contentTypeAllowsRawQuote(contentType: string | undefined): boolean {
+  if (contentType === undefined) return true;
+  const type = contentType.split(";")[0]!.trim().toLowerCase();
+  return type.startsWith("text/") || /(?:^|[/+])(?:json|xml)$/.test(type);
+}
+
 /** Longest detail {@link httpErrorDetailFromBody} will put into an error message. */
 export const HTTP_ERROR_DETAIL_MAX_CHARS = 300;
 
@@ -242,7 +358,18 @@ const HTTP_ERROR_JSON_MAX_DEPTH = 3;
  * {@link HTTP_ERROR_DETAIL_MAX_CHARS}, because it lands in a log line and in
  * a persisted `error` column.
  */
-export function httpErrorDetailFromBody(body: string | undefined): string | undefined {
+export function httpErrorDetailFromBody(
+  body: string | undefined,
+  options?: HttpErrorDetailOptions
+): string | undefined {
+  const raw = rawHttpErrorDetail(body, options?.contentType);
+  return raw === undefined ? undefined : boundHttpErrorDetail(raw, options?.secrets);
+}
+
+function rawHttpErrorDetail(
+  body: string | undefined,
+  contentType: string | undefined
+): string | undefined {
   if (body === undefined) return undefined;
   const trimmed = body.trim();
   if (trimmed === "") return undefined;
@@ -257,19 +384,33 @@ export function httpErrorDetailFromBody(body: string | undefined): string | unde
     }
   }
   if (isJson) {
-    const text = jsonErrorText(parsed, 0);
-    return text === undefined ? undefined : boundHttpErrorDetail(text);
+    return jsonErrorText(parsed, 0);
   }
   if (looksBinary(trimmed)) return undefined;
   if (/^<(?:!doctype|html|\?xml|head|body)/i.test(trimmed)) {
     // An HTML error page's `<title>`, or an XML error document's `<Message>`
     // (S3 and its imitators); the rest of the markup is noise.
-    const text =
-      /<title[^>]*>([^<]*)<\/title>/i.exec(trimmed)?.[1] ??
-      /<message[^>]*>([^<]*)<\/message>/i.exec(trimmed)?.[1];
-    return text === undefined ? undefined : boundHttpErrorDetail(text);
+    return elementText(trimmed, "title") ?? elementText(trimmed, "message");
   }
-  return boundHttpErrorDetail(trimmed);
+  if (!contentTypeAllowsRawQuote(contentType)) return undefined;
+  return trimmed;
+}
+
+/**
+ * The text of the first `<tag>` element when it holds no nested markup. Plain
+ * index scans rather than a pattern: the body is remote text, and a lazy or
+ * repeated group over it backtracks quadratically on a string of repeated open tags.
+ */
+function elementText(markup: string, tag: string): string | undefined {
+  const lower = markup.toLowerCase();
+  const open = lower.indexOf(`<${tag}`);
+  if (open < 0) return undefined;
+  const openEnd = lower.indexOf(">", open);
+  if (openEnd < 0) return undefined;
+  const close = lower.indexOf(`</${tag}>`, openEnd + 1);
+  if (close < 0) return undefined;
+  const inner = markup.slice(openEnd + 1, close);
+  return inner.includes("<") ? undefined : inner;
 }
 
 /**
@@ -334,8 +475,8 @@ function looksBinary(text: string): boolean {
   return /[\u0000-\u0008\u000E-\u001F\u007F\uFFFD]/.test(text);
 }
 
-function boundHttpErrorDetail(text: string): string | undefined {
-  const collapsed = text.replace(/\s+/g, " ").trim();
+function boundHttpErrorDetail(text: string, secrets?: readonly string[]): string | undefined {
+  const collapsed = sanitizeHttpErrorDetail(text, secrets).replace(/\s+/g, " ").trim();
   if (collapsed === "") return undefined;
   if (collapsed.length <= HTTP_ERROR_DETAIL_MAX_CHARS) return collapsed;
   let cut = collapsed.slice(0, HTTP_ERROR_DETAIL_MAX_CHARS - 1);
@@ -393,7 +534,7 @@ export function wrapFetchUrlNetworkError(url: string, cause: unknown): FetchUrlJ
   const detail = cause instanceof Error ? cause.message : String(cause);
   return createFetchUrlJobError(
     FetchUrlErrorCode.NETWORK_ERROR,
-    `Network error fetching ${url}: ${detail}`,
+    `Network error fetching ${redactUrlForMessage(url)}: ${detail}`,
     { url }
   );
 }

packages/tasks/src/task/FetchUrlTask.ts

@@ -42,6 +42,7 @@ import {
 import {
   createFetchUrlAbortedError,
   createFetchUrlHttpError,
+  SECRET_QUERY_NAME,
   createFetchUrlJobError,
   FetchUrlErrorCode,
   isFetchUrlJobError,
@@ -443,7 +444,41 @@ function assertMethodAllowsResponseType(
   );
 }
 
-async function buildHttpError(url: string, response: Response): Promise<Error> {
+const SECRET_HEADER_NAME = /authorization|cookie|api[-_]?key|token|secret|auth|key/i;
+
+/**
+ * Values this request sent that a server might echo into an error body: the
+ * resolved credential (already placed in a header by the time a job runs),
+ * any key-like header, and key-like query parameters. Both the whole header
+ * value and the part after an auth scheme are collected, since servers quote
+ * either.
+ */
+export function collectRequestSecrets(
+  url: string,
+  headers: Record<string, string> | undefined
+): string[] {
+  const secrets: string[] = [];
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (typeof value !== "string" || !SECRET_HEADER_NAME.test(name)) continue;
+    secrets.push(value);
+    const schemeless = /^\s*\S+\s+(\S.*)$/.exec(value)?.[1];
+    if (schemeless !== undefined) secrets.push(schemeless.trim());
+  }
+  try {
+    for (const [name, value] of new URL(url).searchParams) {
+      if (SECRET_QUERY_NAME.test(name)) secrets.push(value);
+    }
+  } catch {
+    // An unparseable URL never reaches a response.
+  }
+  return secrets;
+}
+
+async function buildHttpError(
+  url: string,
+  response: Response,
+  requestHeaders?: Record<string, string>
+): Promise<Error> {
   let retryDate: Date | undefined;
   if (response.status === 429 || response.status === 503 || response.headers.get("Retry-After")) {
     const retryAfterStr = response.headers.get("Retry-After");
@@ -469,7 +504,10 @@ async function buildHttpError(url: string, response: Response): Promise<Error> {
     }
   }
   const body = await readHttpErrorBody(response);
-  return createFetchUrlHttpError(url, response.status, response.statusText, retryDate, body);
+  return createFetchUrlHttpError(url, response.status, response.statusText, retryDate, body, {
+    secrets: collectRequestSecrets(url, requestHeaders),
+    contentType: response.headers.get("content-type") ?? "",
+  });
 }
 
 const HTTP_ERROR_BODY_MAX_BYTES = 4096;
@@ -692,7 +730,7 @@ export class FetchUrlJob<
       // released. With a body there is nothing left to cancel and the stream is
       // still reader-locked, so a second `cancel()` only raises a TypeError for
       // `discardBody` to swallow; with no body it was a no-op to begin with.
-      const error = await buildHttpError(input.url!, response);
+      const error = await buildHttpError(input.url!, response, input.headers);
       throw error;
     }