fix: filter rate_limit_event from Claude Remote/Local chat paths

[junmo-kim]

Summary

PR #388 handled rate_limit_event display for the ACP path, but Claude Remote (SDK) and Local (JSONL scanner) paths still leak the raw JSON into the web UI chat.

This adds filtering at two layers:

• sdkToLogConverter.convert() — early return before UUID generation and sidechain bookkeeping, preventing the event from reaching the web via the remote SDK path
• isClaudeChatVisibleMessage() — marks rate_limit_event as non-visible, covering the local session scanner path and acting as a second line of defense

Test plan

• Unit: rate_limit_event returns null from converter
• Unit: dropped event does not break parent UUID chain
• Unit: isClaudeChatVisibleMessage({ type: 'rate_limit_event' }) returns false
• E2E: start a new Claude session, send a message, verify no raw JSON in chat

[github-actions]

Findings

• No findings on the added/modified lines.

Summary

• Review mode: initial
• No issues found in the current diff.
• Residual risk: the new shared/src/messages.ts branch is covered indirectly through CLI tests, but there is still no direct shared/web regression coverage for that consumer path.

Testing

• Not run (automation environment: bun was not available, so the targeted Vitest files could not be executed)

HAPI Bot

[github-actions]

Findings

• [Major] Displayable Claude rate-limit statuses are now dropped instead of converted into the event format the web already understands, so allowed_warning / rejected disappear entirely on the SDK path. Evidence cli/src/claude/utils/sdkToLogConverter.ts:93, shared/src/messages.ts:42, cli/src/agent/rateLimitParser.ts:61, web/src/chat/reducerEvents.ts:3
  Suggested fix:

  if (sdkMessage.type === 'rate_limit_event') {
      const text = formatClaudeRateLimitEvent((sdkMessage as any).rate_limit_info)
      if (!text) return null
  
      return {
          ...baseFields,
          type: 'assistant',
          message: {
              role: 'assistant',
              content: [{ type: 'text', text }]
          }
      }
  }

Summary
Review mode: follow-up after new commits

• 1 major issue found.
• The raw-JSON leak is blocked, but this implementation also removes Claude usage-limit warnings/rejections on the structured SDK path instead of translating them into the existing UI event format.

Testing

• Not run (automation environment: bun was not available, so the targeted Vitest files could not be executed)

HAPI Bot

[github-actions]

[MAJOR] This drops every rate_limit_event, including the displayable allowed_warning / rejected cases. ACP already converts those statuses into the Claude AI usage limit ... text that the web reducer turns into limit-warning / limit-reached events (cli/src/agent/rateLimitParser.ts:61, web/src/chat/reducerEvents.ts:3). Returning null here fixes the raw-JSON leak by removing the warning entirely on the SDK path.

Suggested fix:

if (sdkMessage.type === 'rate_limit_event') {
    const text = formatClaudeRateLimitEvent((sdkMessage as any).rate_limit_info)
    if (!text) return null

    return {
        ...baseFields,
        type: 'assistant',
        message: {
            role: 'assistant',
            content: [{ type: 'text', text }]
        }
    }
}

[github-actions]

Findings

• [Major] Displayable SDK rate_limit_event messages now self-parent. convertRateLimitEvent() assigns this.lastUuid = uuid before filling parentUuid, so every allowed_warning / rejected message points to its own UUID instead of the previous message. That breaks the converter's existing parent-chain invariant from cli/src/claude/utils/sdkToLogConverter.test.ts:222, and the new tests only cover parent preservation for suppressed events at cli/src/claude/utils/sdkToLogConverter.test.ts:325.
  Suggested fix:

  const parentUuid = this.lastUuid
  const uuid = randomUUID()
  const timestamp = new Date().toISOString()
  this.lastUuid = uuid
  
  return {
      parentUuid,
      ...
  }

Summary
Review mode: follow-up after new commits

• 1 major issue found.
• The latest diff fixes the earlier warning/rejected drop, but it now emits a self-referential parent link for each displayable SDK rate-limit event.

Testing

• Not run (automation environment: bun was not installed, so the targeted Vitest files could not be executed)

HAPI Bot

[github-actions]

[MAJOR] this.lastUuid has already been overwritten with uuid on the line above, so this stores the new message's own UUID in parentUuid. Every displayable allowed_warning / rejected event becomes self-parented instead of pointing at the previous message, which breaks the converter's existing parent-chain invariant (cli/src/claude/utils/sdkToLogConverter.test.ts:222). The added tests only cover the suppressed-event chain (cli/src/claude/utils/sdkToLogConverter.test.ts:325).

Suggested fix:

const parentUuid = this.lastUuid
const uuid = randomUUID()
const timestamp = new Date().toISOString()
this.lastUuid = uuid

return {
    parentUuid,
    ...
}

[github-actions]

Findings

• No actionable issues found in the latest head.

Summary
Review mode: follow-up after new commits

• No issues found in the current diff after checking the touched Claude SDK conversion, shared visibility filter, and existing web event parsing path.
• Residual risk: static review only; the targeted Vitest files were not executed because bun is not installed in this automation environment.

Testing

• Not run (automation environment: bun not installed)

HAPI Bot