hedit 0.7.11.dev6__tar.gz → 0.7.11.dev7__tar.gz

{hedit-0.7.11.dev6/hedit.egg-info → hedit-0.7.11.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hedit
-Version: 0.7.11.dev6
+Version: 0.7.11.dev7
 Summary: Multi-agent system for HED annotation generation and validation
 Author-email: Annotation Garden Initiative <info@annotation.garden>
 License-Expression: MIT

{hedit-0.7.11.dev6 → hedit-0.7.11.dev7/hedit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hedit
-Version: 0.7.11.dev6
+Version: 0.7.11.dev7
 Summary: Multi-agent system for HED annotation generation and validation
 Author-email: Annotation Garden Initiative <info@annotation.garden>
 License-Expression: MIT

{hedit-0.7.11.dev6 → hedit-0.7.11.dev7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hedit"
-version = "0.7.11.dev6"
+version = "0.7.11.dev7"
 description = "Multi-agent system for HED annotation generation and validation"
 readme = "PKG_README.md"
 requires-python = ">=3.12"

{hedit-0.7.11.dev6 → hedit-0.7.11.dev7}/src/api/main.py

@@ -82,6 +82,11 @@ def _describe_llm_error(exc: Exception) -> tuple[int, str, str]:
     key gets a 401 pointing at their key, not a generic 500. Order matters --
     AnthropicContextOverflowError subclasses BadRequestError, and the timeout
     and rate-limit types must be checked before their parent classes.
+
+    Every message here is a fixed string. Exception text never reaches the
+    client, because a provider error can carry request details and the web app
+    renders the message as HTML. Callers log the exception, so the provider's
+    own wording stays available in the server log for whoever debugs it.
     """
     if isinstance(exc, APITimeoutError):
         return 504, "timeout", "LLM request timed out. Try again or use a faster model."
@@ -98,7 +103,11 @@ def _describe_llm_error(exc: Exception) -> tuple[int, str, str]:
     if isinstance(exc, AnthropicContextOverflowError):
         return 413, "context_overflow", "The input is too long for this model. Try shortening it."
     if isinstance(exc, anthropic.BadRequestError):
-        return 400, "bad_request", f"The LLM rejected the request: {str(exc)[:200]}"
+        return (
+            400,
+            "bad_request",
+            "The LLM rejected the request. Check the model and request parameters, then try again.",
+        )
     if isinstance(exc, anthropic.APIConnectionError):
         return 502, "upstream_unreachable", "Could not reach the LLM service. Please try again."
     return 500, "internal", "An error occurred during annotation processing."

{hedit-0.7.11.dev6 → hedit-0.7.11.dev7}/src/version.py

@@ -1,6 +1,6 @@
 """Version information for HEDit."""
 
-__version__ = "0.7.11.dev6"
+__version__ = "0.7.11.dev7"
 __version_info__ = (0, 7, 11, "dev")
 
 

{hedit-0.7.11.dev6 → hedit-0.7.11.dev7}/tests/test_api_endpoints.py

@@ -1469,3 +1469,84 @@ class TestMetricsEndpoint:
         )
         assert response.status_code == 403
         assert "server API key" in response.json()["detail"]
+
+
+class TestLLMErrorMessages:
+    """Error responses classify the failure without quoting the provider.
+
+    CodeQL flagged the streaming error path (py/stack-trace-exposure) because
+    exception text reached the client. The web app renders these messages as
+    HTML, and a provider error can echo request details, so every branch has
+    to return a fixed string.
+    """
+
+    @staticmethod
+    def _response(status: int):
+        import httpx
+
+        request = httpx.Request("POST", "https://api.anthropic.com/v1/messages")
+        return httpx.Response(status, request=request)
+
+    def test_bad_request_does_not_quote_the_provider(self):
+        import anthropic
+
+        from src.api.main import _describe_llm_error
+
+        detail = (
+            "Error code: 400 - thinking.type.enabled is not supported for this model; "
+            "workspace wrkspc_01Rayuq1JvjaMYusRvUsn6vk"
+        )
+        exc = anthropic.BadRequestError(detail, response=self._response(400), body=None)
+
+        status, error_type, message = _describe_llm_error(exc)
+
+        assert status == 400
+        assert error_type == "bad_request"
+        assert "wrkspc_01Rayuq1JvjaMYusRvUsn6vk" not in message
+        assert "thinking.type.enabled" not in message
+        assert "Error code" not in message
+
+    def test_context_overflow_still_precedes_bad_request(self):
+        from langchain_anthropic.chat_models import AnthropicContextOverflowError
+
+        from src.api.main import _describe_llm_error
+
+        exc = AnthropicContextOverflowError(
+            "prompt is too long: 250000 tokens > 200000 maximum",
+            response=self._response(400),
+            body=None,
+        )
+
+        status, error_type, _message = _describe_llm_error(exc)
+
+        assert status == 413
+        assert error_type == "context_overflow"
+
+    def test_auth_failure_points_at_the_key(self):
+        import anthropic
+
+        from src.api.main import _describe_llm_error
+
+        exc = anthropic.AuthenticationError(
+            "invalid x-api-key sk-ant-api03-secretmaterial",
+            response=self._response(401),
+            body=None,
+        )
+
+        status, error_type, message = _describe_llm_error(exc)
+
+        assert status == 401
+        assert error_type == "auth"
+        assert "sk-ant-api03-secretmaterial" not in message
+
+    def test_unknown_failure_is_generic(self):
+        from src.api.main import _describe_llm_error
+
+        status, error_type, message = _describe_llm_error(
+            RuntimeError("Traceback (most recent call last): File /srv/hedit/main.py")
+        )
+
+        assert status == 500
+        assert error_type == "internal"
+        assert "Traceback" not in message
+        assert "/srv/hedit" not in message