Problem

API error messages (e.g. 401 User not found) were being sent directly to users' WhatsApp/Telegram channels instead of being kept internal.

Changes

1. Heartbeat error suppression (agent-runner-execution.ts): When a heartbeat run fails, return an empty payload instead of forwarding the error text to the user channel. Errors are still logged via defaultRuntime.error().

2. Auth error sanitization (errors.ts):

   • formatRawAssistantErrorForUi: HTTP 401/403 errors now return a generic "Authentication error" message instead of the raw error body
   • formatAssistantErrorText: Added early auth error detection before the generic fallback

Fixes #18937

Greptile Summary

This PR prevents API error messages from leaking to user channels by sanitizing authentication errors and suppressing heartbeat failures.

Changes:

• formatRawAssistantErrorForUi now returns a generic "Authentication error" message for HTTP 401/403 errors instead of exposing raw error bodies like "401 User not found"
• formatAssistantErrorText adds early auth error detection before the generic fallback
• Heartbeat runs that fail now return empty payload instead of forwarding error text to user channel (errors still logged via defaultRuntime.error())

The implementation correctly addresses the security issue by catching auth errors in multiple places and preventing sensitive API error details from reaching end users.

Confidence Score: 5/5

• This PR is safe to merge with no identified issues
• The changes are focused security improvements that prevent API error leakage. The implementation leverages existing error detection patterns (isAuthErrorMessage already includes 401/403 patterns), adds appropriate sanitization in two key locations, and maintains backward compatibility by only affecting error display logic without changing error handling behavior. Errors are still logged internally for debugging.
• No files require special attention

_{Last reviewed commit: 3774c38}