Note

Medium Risk
Touches auth HTTP 500 and logging paths around sessions and cookies, but behavior changes are limited to diagnostics, interruption propagation, and narrower error catching—not credential validation itself.

Overview
Auth HTTP internal failures now avoid logging or encoding full Cause/error payloads, replacing them with bounded fields (failureTag, reason/failure/defect/interrupt counts) while still attaching the original failure on a new EnvironmentHttpInternalError (public JSON stays the same EnvironmentInternalError shape).

failEnvironmentInternal is required to receive a cause, re-propagates nested interrupt-only failures instead of turning them into synthetic 500s, and request finalizers skip warning logs for pure interruptions. Browser session cookie handling only maps CookieError to browser_session_cookie_failed via catchTags instead of a broad catch.

Adds http.test.ts coverage for redacted logging, request finalizer behavior, and interruption propagation.

^{Reviewed by Cursor Bugbot for commit 15a2898. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Preserve auth HTTP failure diagnostics by summarizing causes instead of serializing them

• Replaces raw cause/error serialization in auth HTTP logs with bounded diagnostics: a trimmed failureTag and counts of failures, defects, and interruptions via a new failureLogAttributes helper.
• Adds findInterruptCause to detect nested interruption causes and re-propagate them directly, avoiding conversion into synthetic internal errors and suppressing redundant logs.
• Introduces EnvironmentHttpInternalError with a bounded failureTag field and preserved original cause as a defect, replacing the generic internal error type.
• Limits annotateEnvironmentRequest finalizer so it skips logging entirely when the exit cause contains only interrupts.
• Narrows the browserSession cookie error catch to only handle CookieError, letting other errors fall through to upstream handling.

^{Macroscope summarized 15a2898.}