fix(decopilot): sanitize non-Error stream errors instead of leaking raw JSON

[pedrofrxncx]

Summary

Production logs surfaced a decopilot run failing on an upstream 504 Upstream idle timeout exceeded. Tracing the handling turned up two defects in how non-Error stream errors are processed. Gateway/provider errors frequently arrive as plain objects ({ code, message, metadata }), not Error instances, and both code paths assumed instanceof Error:

1. Raw JSON leaked to the client. sanitizeStreamError only sanitized Error instances; everything else fell through to JSON.stringify. So the message persisted to the thread and shown to the user became the literal {"code":504,"message":"Upstream idle timeout exceeded","metadata":{"error_type":"timeout"}} blob, and the provider-URL/branding stripping was skipped entirely.
2. Useless log line. stringifyProviderError did `${error}` for object errors, so the [runAgentLoop:...] Error line logged [object Object] and hid the real cause.

Changes

• stream-error.ts: add extractErrorParts(error) that pulls a string message and a numeric statusCode (falling back to a numeric code) out of object errors. sanitizeStreamError now runs both Error and object errors through the same credits-detection + URL/branding-strip logic.
• native-agent-loop-core.ts: stringifyProviderError now prefers a string message field on object errors, falling back to JSON.
• Add stream-error.test.ts covering the 504-object path for both sanitizeStreamError and classifyStreamError, plus the credits/opaque-object branches.

Scope / not included

This does not change retry/recovery behavior. The underlying resilience gap — a mid-stream idle timeout has no auto-retry or resume, since the SDK's maxRetries only covers the initial request — is intentionally left out as a separate design discussion.

Testing

• bun test packages/harness/src/decopilot/stream-error.test.ts native-agent-loop-core.test.ts — pass
• tsc --noEmit on packages/harness — clean
• bun run fmt — applied

---

Summary by cubic

Sanitizes non-Error stream errors so users see clean messages instead of raw JSON. Also fixes provider error logging to show real messages from object errors.

• Bug Fixes
  • Unified error handling for Error and object errors: extract message + statusCode/code, strip provider URLs/branding, and tag credit issues with [CREDITS].
  • Improved logs: prefer object message in stringifyProviderError; fall back to JSON to avoid [object Object].
  • Tests added for 504 idle-timeout objects, credit detection, opaque objects, and error classification.

^{Written for commit 4669007. Summary will update on new commits.}