feat: route profiled ops runs through Glas

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

rein_aharness/llm_connect_client.py

@@ -28,6 +28,8 @@ _SAFE_RESPONSE_METADATA_KEYS = frozenset(
         "created_at",
     }
 )
+_SAFE_ERROR_KEYS = ("error", "provider_status", "provider", "model")
+_MAX_ERROR_MESSAGE_CHARS = 400
 
 
 class LLMConnectError(RuntimeError):
@@ -60,9 +62,10 @@ class LLMConnectClient:
                 json=payload,
                 timeout=self.timeout_seconds,
             )
-            resp.raise_for_status()
         except httpx.HTTPError as exc:
             raise LLMConnectError(f"llm-connect request failed: {exc}") from exc
+        if resp.status_code >= 400:
+            raise LLMConnectError(_llm_connect_error_text(resp))
         try:
             data = resp.json()
         except ValueError as exc:
@@ -74,6 +77,27 @@ class LLMConnectClient:
         return content
 
 
+def _llm_connect_error_text(resp: httpx.Response) -> str:
+    """Keep llm-connect's safe cause without copying an upstream response blob."""
+    base = f"llm-connect returned HTTP {resp.status_code}"
+    try:
+        body = resp.json()
+    except ValueError:
+        return base
+    if not isinstance(body, dict):
+        return base
+
+    parts = [
+        f"{key}={body[key]}"
+        for key in _SAFE_ERROR_KEYS
+        if body.get(key) not in (None, "")
+    ]
+    message = body.get("message")
+    if isinstance(message, str) and message.strip():
+        parts.append(f"message={message.strip()[:_MAX_ERROR_MESSAGE_CHARS]}")
+    return f"{base}: " + "; ".join(parts) if parts else base
+
+
 def get_llm_connect_client() -> LLMConnectClient:
     base_url = os.environ.get("LLM_CONNECT_URL", "").strip()
     if not base_url: