fix(claude): allowlist public string errors

Author: steipete

src/provider.test.ts

@@ -1064,16 +1064,18 @@ describe("Claude provider helpers", () => {
     throw new Error("expected Claude provider failure");
   });
 
-  it("does not preview arbitrary string Claude errors", () => {
-    try {
-      extractClaudeStructuredOutput(JSON.stringify({ error: "SOURCE CONTEXT SECRET" }));
-    } catch (err) {
-      expect(err).toBeInstanceOf(ClawpatchError);
-      expect((err as ClawpatchError).message).toBe("claude provider error: provider-error");
-      expect((err as ClawpatchError).message).not.toContain("SOURCE CONTEXT SECRET");
-      return;
+  it("does not preview arbitrary or token-shaped string Claude errors", () => {
+    for (const secret of ["SOURCE CONTEXT SECRET", "sk-ant-secret-shaped-value"]) {
+      try {
+        extractClaudeStructuredOutput(JSON.stringify({ error: secret }));
+      } catch (err) {
+        expect(err).toBeInstanceOf(ClawpatchError);
+        expect((err as ClawpatchError).message).toBe("claude provider error: provider-error");
+        expect((err as ClawpatchError).message).not.toContain(secret);
+        continue;
+      }
+      throw new Error("expected Claude provider failure");
     }
-    throw new Error("expected Claude provider failure");
   });
 
   it("does not include stdout or prompt previews in Claude failure messages", () => {

src/providers/claude.ts

@@ -28,6 +28,7 @@ const CLAUDE_DEFAULT_TIMEOUT_MS = 180_000;
 const CLAUDE_READ_ONLY_TOOLS = "Read,Grep,Glob";
 const CLAUDE_WRITE_TOOLS = "default";
 const CLAUDE_SAFE_MODE_MIN_VERSION: [number, number, number] = [2, 1, 169];
+const CLAUDE_PUBLIC_STRING_ERROR_CODES = new Set(["authentication_failed"]);
 const CLAUDE_AUTH_SMOKE_SCHEMA = {
   type: "object",
   properties: { ok: { type: "boolean", const: true } },
@@ -373,7 +374,7 @@ function claudeStructuredOutput(value: unknown): { found: boolean; value: unknow
 function claudeEnvelopeErrorCode(error: unknown): string | null {
   if (typeof error === "string") {
     const trimmed = error.trim();
-    return /^[a-z][a-z0-9_.:-]{0,79}$/iu.test(trimmed) ? safeProviderPreview(trimmed) : null;
+    return CLAUDE_PUBLIC_STRING_ERROR_CODES.has(trimmed) ? trimmed : null;
   }
   if (typeof error !== "object" || error === null) {
     return null;