[hetaoBackend]

Change

Clears the open CodeQL alert js/stack-trace-exposure on main (packages/local-runtime/src/api/host-helpers.ts json() sink). Stack-shaped and Error-derived payloads could reach HTTP clients through that helper and through TaskError.details.

• json() uses a replacer that drops stack keys and turns Error values into { name, message }.
• normalizeTaskError no longer embeds error.stack in details (TaskError is returned over HTTP).
• Feishu questionnaire failure responses return a stable QUESTIONNAIRE_SUBMIT_FAILED code; the user-facing toast was already generic.
• Agent create and cron 5xx responses return a generic client message; short single-line 4xx validation text is kept.
• Cron schedule assertion wraps unknown scheduler failures as Invalid cron schedule and logs the detail server-side.

Validation

• pnpm typecheck PASS on this branch (Node 24.22.2).
• Manual check: JSON.stringify with the new replacer omits details.stack and serializes nested Error without frames.
• NOT RUN yet on GitHub: CodeQL re-analysis on this PR head (expected to close alert 94 once it runs).

Publication and contribution checks

• No credentials or private material.
• Behaviour change is limited to HTTP error payload shape for failure paths; success paths unchanged.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}