fix(claude): record why a native passthrough failed, without upstream message text

[lidge-jun]

Summary

Carries #6295 by @sh940701 with a maintainer privacy rework. A failed native Claude passthrough used to leave its request-log row without any reason. The row now records one.

The original PR copied the free-form upstream error message into upstreamError. Review showed that text can echo account identifiers or request content, and secret redaction does not remove either, so both reached /api/logs and usage.jsonl. The stored reason is now built only from closed data: the HTTP status plus an allowlisted Anthropic error type (invalid_request_error, authentication_error, permission_error, not_found_error, rate_limit_error, api_error, overloaded_error, request_too_large). Unknown or malformed errors get a status-only diagnostic, and fetch failures store a fixed reason. The response relayed to the client is unchanged.

Supersedes #6295.

Co-authored-by: sh940701 visioner2168@gmail.com

Verification

• New regressions assert that a synthetic account identifier and echoed request content in the upstream message are absent from both the log row and the usage record. They fail against the original PR (0 pass / 2 fail) and pass with this change.
• bun test tests/claude-integration/claude-native-passthrough.test.ts tests/test-layout.test.ts tests/ci-workflows/file-size-ratchet.test.ts: 68 pass / 0 fail on current dev; bun x tsc --noEmit passes. The rework lane also passed the related messages endpoint, request-log and core-lab boundary tests (234 pass / 0 fail) plus privacy:scan and structure:check.
• Full local suite not run by maintainer instruction; Cross-platform CI runs once on the final dev tip after this landing batch.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T15:08:55.729014Z	ff2dc75	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md, dev-only exception) by @lidge-jun. Carries #6295 with a privacy rework and a Co-authored-by trailer; evidence is in the description. Security/privacy review: PASS for the reworked version, since stored reasons come only from the status code and a closed error-type list. Cross-platform CI for this head was cancelled per the maintainer's single-final-run instruction and runs once on the final dev tip. scripts/ci/assert-mergeable-review.sh --maintainer-integration OK at this head.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7d8be421-c4a1-49b0-953b-dd3fe0e1d47e

📥 Commits

Reviewing files that changed from the base of the PR and between 6c32c4d and ff2dc75.

📒 Files selected for processing (3)

• src/server/claude-messages.ts
• structure/clients/claude-desktop.md
• tests/claude-integration/claude-native-passthrough.test.ts

 _________________________________________________________________
< Granted, I'm not human, but I still know when your code is bad. >
 -----------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff2dc75b23

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Classify pre-header aborts as client cancellations

When the client disconnects while the upstream request is still waiting for headers, req.signal aborts the fetch and fetchWithHeaderDeadline returns kind: "error" because its catch only distinguishes expiration from other rejections. This branch consequently records the new fixed diagnostic as an upstream connection failure with status 502, even though the cause is a client cancellation; check req.signal.aborted here and use the existing 499/client_cancel representation before assigning the connection-error reason.

Useful? React with 👍 / 👎.