Hide internal backend errors from API responses

apps/web/src/app/api/__tests__/agents-route.test.ts

@@ -115,7 +115,9 @@ describe('POST /api/agents/dispatch', () => {
     });
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse('boom', false, 500)));
     const res = await dispatchPOST(dispatchReq({ events: [] }));
+    const body = await res.json();
     expect(res.status).toBe(502);
+    expect(body).toEqual({ error: 'Failed to dispatch agents' });
   });
 });
 
@@ -148,4 +150,15 @@ describe('GET /api/agents/status', () => {
       expect.anything(),
     );
   });
+
+  it('does not expose backend errors', async () => {
+    setBackend('http://backend');
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('internal backend hostname')));
+
+    const res = await statusGET(new Request('http://localhost/api/agents/status?agentId=a1'));
+    const body = await res.json();
+
+    expect(res.status).toBe(502);
+    expect(body).toEqual({ error: 'Failed to get agent status' });
+  });
 });

apps/web/src/app/api/agents/dispatch/route.ts

@@ -83,7 +83,7 @@ export async function POST(request: Request) {
   } catch (error) {
     console.error('Agent dispatch error:', error);
     return NextResponse.json(
-      { error: 'Failed to dispatch agents', details: String(error) },
+      { error: 'Failed to dispatch agents' },
       { status: 502 },
     );
   }

apps/web/src/app/api/agents/status/route.ts

@@ -36,7 +36,7 @@ export async function GET(request: Request) {
   } catch (error) {
     console.error('Agent status error:', error);
     return NextResponse.json(
-      { error: 'Failed to get agent status', details: String(error) },
+      { error: 'Failed to get agent status' },
       { status: 502 },
     );
   }

apps/web/src/app/api/extract-events/route.ts

@@ -255,10 +255,9 @@ Respond with ONLY valid JSON matching the required structure.`;
     return NextResponse.json({ success: true, provider, data: parsed });
   } catch (error) {
     console.error('Event extraction error:', error);
-    // SECURITY: Prevent information disclosure by masking the raw error message
     return NextResponse.json({
       success: false,
-      error: 'Internal server error',
+      error: 'Event extraction failed',
       data: { events: [], actions: [], summary: '', topics: [] },
     }, { status: 500 });
   }

apps/web/src/app/api/training/status/route.ts

@@ -39,7 +39,7 @@ export async function GET() {
   } catch (error) {
     console.error('Training status error:', error);
     return NextResponse.json(
-      { error: 'Failed to read training status', details: String(error) },
+      { error: 'Failed to read training status' },
       { status: 500 },
     );
   }

apps/web/src/app/api/training/trigger/route.ts

@@ -232,7 +232,6 @@ export async function POST(request: Request) {
       } catch (uploadError) {
         return NextResponse.json({
           error: 'Upload/trigger failed',
-          details: String(uploadError),
           fallback: {
             message: 'Run manually:',
             commands: [
@@ -249,7 +248,7 @@ export async function POST(request: Request) {
   } catch (error) {
     console.error('Training trigger error:', error);
     return NextResponse.json(
-      { error: 'Failed to process training request', details: String(error) },
+      { error: 'Failed to process training request' },
       { status: 500 },
     );
   }

apps/web/src/app/api/video/search/route.ts

@@ -53,7 +53,7 @@ export async function GET(request: Request) {
   } catch (error: any) {
     console.error('Video Search Error:', error);
     return NextResponse.json(
-      { error: error.message || 'Internal server error during vector search' },
+      { error: 'Internal server error during vector search' },
       { status: 500 }
     );
   }