fix(providers): stop persisting a bucketed 500 and bound error cause

A streamed error arrives on a 200 response, so the local 500 default used
for classification is not an observed status; report StatusCode only when
the payload code maps to a known status. Cap the persisted cause at 8 KiB
(rune-safe, with a truncation marker) since provider bodies read up to 64 KiB.

Author: Svector-anu

internal/providers/openai/provider.go

@@ -298,27 +298,31 @@ func (provider *Provider) emitPayload(ctx context.Context, data string, state *t
 	if chunk.Error != nil {
 		state.flushContent(ctx, events)
 		state.closeOpen(ctx, events)
+		// statusCode buckets the error for classification only. The HTTP response
+		// was 200, so observedStatus stays 0 unless the payload's code maps to a
+		// known status; a bucket default must not be persisted as a real status.
 		statusCode := http.StatusInternalServerError
+		observedStatus := 0
 		if chunk.Error.Code != nil {
 			switch c := chunk.Error.Code.(type) {
 			case string:
 				if code, ok := openAIStreamErrorStatusByCode[c]; ok {
-					statusCode = code
+					statusCode, observedStatus = code, code
 				}
 			case float64:
 				if code, ok := openAIStreamErrorStatusByCode[strconv.Itoa(int(c))]; ok {
-					statusCode = code
+					statusCode, observedStatus = code, code
 				}
 			case int:
 				if code, ok := openAIStreamErrorStatusByCode[strconv.Itoa(c)]; ok {
-					statusCode = code
+					statusCode, observedStatus = code, code
 				}
 			}
 		}
 		sendEvent(ctx, events, zeroruntime.StreamEvent{
 			Type:       zeroruntime.StreamEventError,
 			Error:      provider.classifiedError(statusCode, chunk.Error.Message),
-			StatusCode: statusCode,
+			StatusCode: observedStatus,
 			Cause:      provider.redact(chunk.Error.Message),
 		})
 		state.done = true

internal/providers/openai/provider_test.go

@@ -647,6 +647,25 @@ func TestStreamCompletionStreamedErrorCarriesStatusCodeAndCause(t *testing.T) {
 	}
 }
 
+// An error inside a 200 OK SSE payload whose code is not a known status was
+// never an observed HTTP status, so none must be reported (#674 review).
+func TestStreamCompletionStreamedErrorWithUnknownCodeReportsNoStatus(t *testing.T) {
+	provider := newTestProvider(t, func(w http.ResponseWriter, r *http.Request) {
+		writeSSE(w, `{"error":{"message":"model overloaded","code":"server_error"}}`)
+	})
+
+	events := collectProviderEvents(t, provider)
+	if len(events) != 1 || events[0].Type != zeroruntime.StreamEventError {
+		t.Fatalf("events = %#v, want one error", events)
+	}
+	if events[0].StatusCode != 0 {
+		t.Fatalf("StatusCode = %d, want 0 (no HTTP status was observed)", events[0].StatusCode)
+	}
+	if !strings.Contains(events[0].Cause, "model overloaded") {
+		t.Fatalf("Cause = %q, want the upstream detail", events[0].Cause)
+	}
+}
+
 func TestStreamCompletionEmitsErrorForMalformedJSON(t *testing.T) {
 	provider := newTestProvider(t, func(w http.ResponseWriter, r *http.Request) {
 		writeSSE(w, `{"choices":`)

internal/sessions/error_payload.go

@@ -6,6 +6,13 @@ import (
 	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
+// maxErrorCauseBytes bounds the persisted cause. Provider error bodies are read
+// up to 64 KiB, which is far more than a diagnostic needs and would otherwise be
+// copied whole into every error event in events.jsonl.
+const maxErrorCauseBytes = 8 << 10
+
+const errorCauseTruncationMarker = "… [truncated]"
+
 // ErrorEventPayload builds the payload for an EventError session event. It
 // always includes the flattened message (unchanged, for backward
 // compatibility with existing consumers of events.jsonl), and additionally
@@ -15,7 +22,8 @@ import (
 // call failed from the CLI or its logs — only the generic top-level message
 // was ever recorded (#674). Cause has already been redacted for secrets by
 // the provider before reaching here (see zeroruntime.StreamEvent.Cause) — it
-// is never re-scrubbed or stored raw at this layer.
+// is never re-scrubbed or stored raw at this layer. Cause is cut to
+// maxErrorCauseBytes (on a rune boundary) with a truncation marker appended.
 func ErrorEventPayload(err error) map[string]any {
 	payload := map[string]any{"message": err.Error()}
 	var streamErr *zeroruntime.StreamError
@@ -24,8 +32,15 @@ func ErrorEventPayload(err error) map[string]any {
 			payload["statusCode"] = streamErr.StatusCode
 		}
 		if streamErr.Cause != "" {
-			payload["cause"] = streamErr.Cause
+			payload["cause"] = boundErrorCause(streamErr.Cause)
 		}
 	}
 	return payload
 }
+
+func boundErrorCause(cause string) string {
+	if len(cause) <= maxErrorCauseBytes {
+		return cause
+	}
+	return truncateUTF8(cause, maxErrorCauseBytes) + errorCauseTruncationMarker
+}

internal/sessions/error_payload_test.go

@@ -4,7 +4,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"testing"
+	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
@@ -125,3 +127,33 @@ func TestStoreAppendEventPersistsErrorEventStatusCodeAndCause(t *testing.T) {
 		t.Fatalf("persisted cause = %v, want %v", got, want)
 	}
 }
+
+func TestErrorEventPayloadBoundsCause(t *testing.T) {
+	// "é" is two bytes; an odd cap boundary must not split it.
+	cause := strings.Repeat("é", maxErrorCauseBytes)
+	payload := ErrorEventPayload(&zeroruntime.StreamError{Message: "m", StatusCode: 500, Cause: cause})
+
+	got, ok := payload["cause"].(string)
+	if !ok {
+		t.Fatalf("cause = %#v, want string", payload["cause"])
+	}
+	if !strings.HasSuffix(got, errorCauseTruncationMarker) {
+		t.Fatalf("cause missing truncation marker: ...%q", got[len(got)-20:])
+	}
+	body := strings.TrimSuffix(got, errorCauseTruncationMarker)
+	if len(body) > maxErrorCauseBytes {
+		t.Fatalf("bounded cause body is %d bytes, want <= %d", len(body), maxErrorCauseBytes)
+	}
+	if !utf8.ValidString(got) {
+		t.Fatal("bounded cause is not valid UTF-8")
+	}
+}
+
+func TestErrorEventPayloadKeepsCauseAtCap(t *testing.T) {
+	cause := strings.Repeat("a", maxErrorCauseBytes)
+	payload := ErrorEventPayload(&zeroruntime.StreamError{Message: "m", Cause: cause})
+
+	if got := payload["cause"]; got != cause {
+		t.Fatalf("cause at exactly the cap was altered (len %d)", len(got.(string)))
+	}
+}