| "auth_scope"

| "auth_refresh"

| "auth_html_403"

| "upstream_html"

| "proxy"

| "rate_limit"

| "dns"

const SANDBOX_BLOCKED_RE =

/\bapproval is required\b|\bapproval timed out\b|\bapproval was denied\b|\bblocked by sandbox\b|\bsandbox\b.*\b(?:blocked|denied|forbidden|disabled|not allowed)\b/i;

function stripErrorPrefix(raw: string): string {

return raw.replace(/^error:\s*/i, "").trim();

}

function inferSignalStatus(signal: FailoverSignal): number | undefined {

if (typeof signal.status === "number" && Number.isFinite(signal.status)) {

return signal.status;

}

return extractLeadingHttpStatus(signal.message?.trim() ?? "")?.code;

return extractLeadingHttpStatus(stripErrorPrefix(signal.message?.trim() ?? ""))?.code;

}

function isHtmlErrorResponse(raw: string, status?: number): boolean {

const trimmed = raw.trim();

if (!trimmed) {

return false;

}

const candidate = extractLeadingHttpStatus(trimmed) ? trimmed : stripErrorPrefix(trimmed);

const inferred =

typeof status === "number" && Number.isFinite(status)

? status

: extractLeadingHttpStatus(trimmed)?.code;

: extractLeadingHttpStatus(candidate)?.code;

if (typeof inferred !== "number" || inferred < 400) {

return false;

}

const rest = extractLeadingHttpStatus(trimmed)?.rest ?? trimmed;

const rest = extractLeadingHttpStatus(candidate)?.rest ?? candidate;

return HTML_BODY_RE.test(rest) && HTML_CLOSE_RE.test(rest);

}

function isTransportHtmlErrorStatus(status: number | undefined): boolean {

return status !== 401 && status !== 403 && status !== 407;

}

function isOpenAICodexScopeContext(raw: string, provider?: string): boolean {

const normalizedProvider = normalizeLowercaseStringOrEmpty(provider);

return (

}

function isExactUnknownNoDetailsError(raw: string): boolean {

return normalizeOptionalLowercaseString(raw)?.trim() === "unknown error (no error details in response)";

return (

normalizeOptionalLowercaseString(raw)?.trim() === "unknown error (no error details in response)"

);

}

function classifyFailoverClassificationFromMessage(

export function classifyFailoverSignal(signal: FailoverSignal): FailoverClassification | null {

const inferredStatus = inferSignalStatus(signal);

if (

signal.message &&

isTransportHtmlErrorStatus(inferredStatus) &&

isHtmlErrorResponse(signal.message, inferredStatus)

) {

return toReasonClassification("timeout");

}

const messageClassification = signal.message

? classifyFailoverClassificationFromMessage(signal.message, signal.provider)

: null;

if (message && isAuthScopeErrorMessage(message, status, normalizedSignal.provider)) {

return "auth_scope";

}

if (message && status === 403 && isHtmlErrorResponse(message, status)) {

return "auth_html_403";

}

if (message && isProxyErrorMessage(message, status)) {

return "proxy";

}

if (message && isHtmlErrorResponse(message, status)) {

return status === 403 ? "auth_html_403" : "upstream_html";

}

const failoverClassification = classifyFailoverSignal({

...normalizedSignal,

status,

);

}

if (providerRuntimeFailureKind === "upstream_html") {

return (

"The provider returned an HTML error page instead of an API response. " +

"This usually means a CDN or gateway (e.g. Cloudflare) blocked the request. " +

"Retry in a moment or check provider status."

);

}

if (providerRuntimeFailureKind === "proxy") {

return "LLM request failed: proxy or tunnel configuration blocked the provider request.";

}