hackbrowser/session: content-filter (cybersecurity risk) errors crash the session and abort healthy crawls — surface actionable guidance instead

[badchars]

Summary

When an AI provider's server-side content filter rejects a request as a "possible cybersecurity risk", CyberStrike surfaces the raw provider error and the running session dies. If a hackbrowser crawl is in progress, it is aborted as collateral. The user is left with a confusing crash and no guidance.

This is not an auth bug (that is #107, now fixed on stage — token exchange works, zero 403s). This is a distinct content-policy limitation.

Repro

• Default model set to an OpenAI model served via GitHub Copilot (e.g. a gpt-5.x family model).
• Run a pentest turn against any target; the crawler works fine (login, page planning, form execution all succeed).
• The main agent's methodology system prompt (mentions injectable params, credentials, exploitation, etc.) trips the provider's moderation on a /responses call.

Observed error:

AI_APICallError: This content was flagged for possible cybersecurity risk.
If this seems wrong, try rephrasing your request. To get authorized for
security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

Sequence: provider moderation error → session.processor error → session cancel → stopHackbrowser abort → healthy crawl killed.

Root cause

• The moderation filter is server-side on the model provider (this specific one is OpenAI's cyber filter, which also applies to OpenAI models proxied through GitHub Copilot). CyberStrike cannot disable it.
• provider/error.ts parseAPICallError has no branch for content-moderation rejections, so the raw message is surfaced as a generic api_error and treated as a hard failure.
• Secondary: SessionPrompt.cancel calls stopHackbrowser unconditionally on loop exit; when the main loop exits early due to this error, an otherwise-healthy background crawl is aborted (the cancel/ingest path has documented edge cases — INTEGRATION.md §13.7 — so decoupling is out of scope here).

Proposed fix (graceful handling)

Primary (this issue): detect the content-moderation signature in parseAPICallError and surface a clear, actionable, non-retryable message instead of the raw crash — telling the user this is a provider-side policy that CyberStrike can't disable, and to use an API-key model (Anthropic/OpenAI direct) for offensive-security work. Preserve the provider's original text (incl. any enrollment link).

Secondary (follow-up, not in this issue): consider not aborting a healthy independent crawl when the main loop exits on a provider error — requires care around the documented cancel/ingest edge cases.

Notes

• No way to make the provider filter accept offensive-security prompts from an automated agent; the informal "add 'for security research'" workaround does not apply to a fixed system prompt.
• Recommendation to users stands: use an API-key provider as the default model for hackbrowser/pentest runs.

[badchars]

Fixed on stage (commit 5a23d0b87) — primary/graceful-handling part.

provider/error.ts parseAPICallError now detects the content-moderation signature and returns a clear, non-retryable message instead of the raw crash: it explains this is a server-side provider policy CyberStrike cannot disable, tells the user to use an API-key model (Anthropic/OpenAI direct) for offensive-security work, and preserves the provider's original text (including the enrollment link). Marking it non-retryable also stops retry-spam.

Note: the moderation filter in this report is OpenAI's cyber filter (enrollment at https://chatgpt.com/cyber), which also fires on OpenAI models proxied through GitHub Copilot — not a GitHub-specific gate.

Shipping in canary 1.1.17-canary.4 for verification. Leaving this issue open until confirmed on the canary build.

Still open (secondary, out of scope here): a healthy background crawl is still aborted when the main loop exits early on this error (SessionPrompt.cancel → stopHackbrowser). Decoupling touches the documented cancel/ingest edge cases (INTEGRATION.md §13.7) and is tracked as a follow-up.