Greptile Summary

This PR adds an admin-configurable policy for how upstream provider errors are exposed to API users: pass through (default), hide with a generic message, or replace with a custom message. The pipeline layer tags upstream errors with a sentinel UpstreamError wrapper, and the API layer applies the masking policy before serialising the response.

• New UpstreamError sentinel type (llm/pipeline/upstream_error.go) replaces the previous fragile string-matching approach with a proper struct-based classifier; WrapUpstreamError is idempotent.
• transformOrchestratorError helper consolidates quota wrapping + policy application + inbound transform into one call, and is now applied uniformly to the chat, video, and Doubao handlers.
• upstreamErrorStream wrapper intercepts Err() on the SSE stream so mid-stream provider errors are also subject to the policy, not just pre-stream errors.

Confidence Score: 5/5

Safe to merge. The core masking logic is well-guarded: quota errors are excluded at two levels, non-upstream errors are skipped via the UpstreamError sentinel, and all three API handler paths now consistently apply the policy.

The implementation correctly replaced the previous string-based error classification with a struct-based sentinel. Video and Doubao handlers now go through transformOrchestratorError. No data integrity, auth, or correctness regressions are introduced. The only finding is a minor redundant policy read in the streaming error path.

No files require special attention beyond the minor style note on upstream_error_policy.go.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    REQ[Incoming API Request] --> ORCH[Orchestrator]
    ORCH -->|error| TE[transformOrchestratorError]
    TE --> WQ[wrapQuotaExhaustedAsResponseError]
    WQ --> AUP[applyUpstreamErrorPolicy]
    AUP -->|IsUpstreamError? NO| PASS1[Pass through unchanged]
    AUP -->|IsUpstreamError? YES| MASK[Replace message]
    MASK --> TFE[Inbound.TransformError]
    PASS1 --> TFE
    TFE --> RESP[JSON response]
    ORCH -->|stream| UES[upstreamErrorStream wrapper]
    UES --> ERR[Err called after stream]
    ERR -->|nil| OK[No error]
    ERR -->|non-nil| WAUP[WrapUpstreamError + applyUpstreamErrorPolicy]
    WAUP -->|quota err| PASSQ[Quota: always pass through]
    WAUP -->|hidden/custom| MASKSM[Replace message]
    WAUP -->|passthrough| PASS2[Pass through unchanged]

_{Reviews (3): Last reviewed commit: "fix" | Re-trigger Greptile}