[codex] Sanitize text generation CLI errors

[juliusmarminge]

Summary

• keep arbitrary CLI failure text in the underlying cause
• use the stable operation fallback as the public structured detail
• cover the behavior with a secret-bearing CLI error regression test

Root cause

Generic CLI errors were copied into TextGenerationError.detail, so provider output and credentials embedded in a process error could surface in public error messages even though the original error was already retained as the cause.

Validation

• vp test apps/server/src/textGeneration/TextGenerationPrompts.test.ts (14 tests)
• vp check
• vp run typecheck

---

Note

Medium Risk
Touches error surfacing for text generation; reduces information leakage but may hide CLI failure text from default user-visible messages (still available via cause).

Overview
Stops leaking raw CLI stderr/process errors into user-facing text generation failures.

normalizeCliError no longer appends the underlying Error.message to TextGenerationError.detail for generic CLI failures. The public detail (and derived message) now uses only the stable operation fallback, while the original error remains on cause. Missing-CLI-on-PATH handling is unchanged.

A regression test asserts that a Codex-style error containing access_token=secret-token does not appear in the public message.

^{Reviewed by Cursor Bugbot for commit 8be620d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sanitize normalizeCliError output to exclude sensitive CLI error details

In TextGenerationUtils.ts, normalizeCliError previously appended the original error message to the fallback string when constructing a TextGenerationError for non-ENOENT errors. This exposed internal CLI failure details in the public detail field. The fix sets detail to the fallback string only, dropping the original error message entirely.

^{Macroscope summarized 8be620d.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 6700e7c5-6aee-4f06-9d1e-4709bf2afddd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/sanitize-text-generation-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This is a small security improvement that prevents sensitive data from CLI errors (like access tokens) from being exposed in user-facing error messages. The change is minimal, well-tested, and reduces risk.

^{You can customize Macroscope's approvability policy. Learn more.}