fix(ai): keep provider headers redacted

[xianjianlf2]

Fixes #6525

Summary

• keep OpenAI provider-specific redacted header names in scope while request effects and AI error mapping run
• preserve redaction for transformed OpenAI and OpenAI-compatible HTTP clients
• add regression coverage for AI error contexts containing organization and project headers

Tests

• pnpm test packages/ai/openai/test/OpenAiClient.test.ts packages/ai/openai-compat/test/OpenAiClient.test.ts
• pnpm lint-fix
• pnpm check

Summary by CodeRabbit

• Bug Fixes
  • OpenAI-specific request headers are now consistently redacted in AI error contexts.
  • Improved protection for authorization, organization, and project headers across standard and compatibility clients.
• Tests
  • Added coverage confirming sensitive headers remain hidden for network and transport-related errors.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0fa4795

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
@effect/ai-openai	Patch
@effect/ai-openai-compat	Patch
effect	Patch
@effect/opentelemetry	Patch
@effect/platform-browser	Patch
@effect/platform-bun	Patch
@effect/platform-node-shared	Patch
@effect/platform-node	Patch
@effect/vitest	Patch
@effect/ai-anthropic	Patch
@effect/ai-openrouter	Patch
@effect/atom-react	Patch
@effect/atom-solid	Patch
@effect/atom-vue	Patch
@effect/sql-clickhouse	Patch
@effect/sql-d1	Patch
@effect/sql-libsql	Patch
@effect/sql-mssql	Patch
@effect/sql-mysql2	Patch
@effect/sql-pg	Patch
@effect/sql-pglite	Patch
@effect/sql-sqlite-bun	Patch
@effect/sql-sqlite-do	Patch
@effect/sql-sqlite-node	Patch
@effect/sql-sqlite-react-native	Patch
@effect/sql-sqlite-wasm	Patch
@effect/openapi-generator	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

📝 Walkthrough

Walkthrough

OpenAI and OpenAI-compatible clients now apply provider-specific header redaction during HTTP request execution, including transformed clients. Error-mapping tests verify authorization, organization, and project headers are redacted.

Changes

OpenAI header redaction

Layer / File(s)	Summary
Redaction client wiring packages/ai/openai/src/OpenAiClient.ts, packages/ai/openai/src/OpenAiClientGenerated.ts, packages/ai/openai-compat/src/OpenAiClient.ts	Provider header names are centralized and redaction wrappers are applied to configured and transformed HTTP clients.
Request execution redaction packages/ai/openai/src/OpenAiClient.ts, packages/ai/openai-compat/src/OpenAiClient.ts	Response, streaming, and embedding request effects activate header redaction during HTTP execution and error mapping.
Redaction validation and release metadata packages/ai/openai/test/OpenAiClient.test.ts, packages/ai/openai-compat/test/OpenAiClient.test.ts, .changeset/fix-ai-redacted-provider-headers.md	Tests verify redacted provider headers in network errors, and patch release metadata is added for both packages.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: bug

Suggested reviewers: tim-smart

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR keeps OpenAI redaction names in scope during request execution and error mapping, matching the bug fix and regression tests in #6525.
Out of Scope Changes check	✅ Passed	All code changes support the redaction fix and tests; the changeset is the only ancillary addition.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/ai/openai/src/OpenAiClient.ts (1)

290-306: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Apply redaction to the socket streaming path too.

Line 293 returns OpenAiSocket.createResponseStream before withRedactedOpenAiHeaders is applied. Socket-generated NetworkError contexts retain request.headers, so organization/project values can leak when socket mode is enabled. Wrap the entire socket/non-socket dispatch (and socket stream execution as needed) in the redaction context.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/ai/openai/src/OpenAiClient.ts` around lines 290 - 306, The
createResponseStream socket branch bypasses withRedactedOpenAiHeaders, allowing
sensitive request headers to remain in socket-generated NetworkError contexts.
Update createResponseStream so the entire socket/non-socket dispatch is executed
within the withRedactedOpenAiHeaders redaction context, preserving the existing
socket delegation and HTTP client error mapping.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@packages/ai/openai/src/OpenAiClient.ts`:
- Around line 290-306: The createResponseStream socket branch bypasses
withRedactedOpenAiHeaders, allowing sensitive request headers to remain in
socket-generated NetworkError contexts. Update createResponseStream so the
entire socket/non-socket dispatch is executed within the
withRedactedOpenAiHeaders redaction context, preserving the existing socket
delegation and HTTP client error mapping.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3f41532f-2191-4f77-930e-c0213d021162

📥 Commits

Reviewing files that changed from the base of the PR and between 4e0be58 and 0fa4795.

📒 Files selected for processing (6)

• .changeset/fix-ai-redacted-provider-headers.md
• packages/ai/openai-compat/src/OpenAiClient.ts
• packages/ai/openai-compat/test/OpenAiClient.test.ts
• packages/ai/openai/src/OpenAiClient.ts
• packages/ai/openai/src/OpenAiClientGenerated.ts
• packages/ai/openai/test/OpenAiClient.test.ts