[chrarnoldus]

Problem

For BYOK 401/402/403/429 responses the gateway replaces the upstream error with a fixed, status-based message and drops what the provider actually said. A user with an expired OpenCode Go key saw:

[BYOK] Your API key is invalid or has been revoked. Please check your API key configuration.

while the upstream response was:

{"error":{"type":"authentication_error","code":"api_key_expired","message":"This API key has expired. Create a new API key in OpenCode Console and replace it in your client or secret store. Signing in again will not renew this key."}}

"Invalid or revoked" was misleading here, and the provider's own fix-it instructions were lost. Found via request 25bhr-1792418280888-96a15ecf80d4 (api_request_log 15130364).

Change

• Specific BYOK messages (401, 402, 403 including the OpenCode Go variant, 429) now append the upstream provider text when present: <our message> Provider message: <provider message>.
• Provider text is extracted with the same schema and sanitization as the existing generic 4xx BYOK path: error.message or message, control characters stripped, capped at 300 chars.
• The status-based message stays as the prefix, so existing substring matching keeps working (Code Reviewer byok_invalid_key classification and the code-review unretryable-message check both use includes).
• The Responding with … warning still logs only our fixed message, so the line stays stable to search on. The upstream body was already logged by captureProxyError before this change.
• Precedence is unchanged: specific BYOK mappings still win over context-overflow and provider-not-allowed detection.

Verification

• jest packages/web-shared/src/lib/ai-gateway/llm-proxy-helpers.test.ts apps/web/src/lib/code-reviews/action-required.test.ts: 189 passed
• pnpm --filter @kilocode/web-shared typecheck
• oxlint + oxfmt on changed files

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit only rewords the BYOK warning comment; the new wording accurately reflects that captureProxyError already logs the upstream body while this line logs only the fixed message.

Files Reviewed (1 file)

• packages/web-shared/src/lib/ai-gateway/llm-proxy-helpers.ts

Previous Review Summary (commit af9ada6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit af9ada6)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Fix these issues in Kilo Cloud

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
packages/web-shared/src/lib/ai-gateway/llm-proxy-helpers.ts	441	The new comment says provider text is kept out of logs, but captureProxyError already logs the first 4 KB of every upstream error body and logUnrewrittenResponse persists the body, so provider text can still reach logs.

Files Reviewed (2 files)

• packages/web-shared/src/lib/ai-gateway/llm-proxy-helpers.ts - 1 issue
• packages/web-shared/src/lib/ai-gateway/llm-proxy-helpers.test.ts - 0 issues

The functional change itself looks sound: the specific 401/402/403/429 messages keep their fixed prefix, upstream text goes through the existing schema plus control-character stripping and 300-char cap, precedence over provider-not-allowed and context-overflow detection is unchanged, and the added tests cover the OpenCode Go 403, 401, and sanitization paths.

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 28.9K · Output: 1.9K · Cached: 197.4K}

_{Review guidance: REVIEW.md from base branch main}