feat(ai): upgrade to Opus 4.8 and Claude Agent SDK 0.3.163 (#353)

apps/worker/src/ai/message-handlers.ts

@@ -164,6 +164,33 @@ function handleStructuredError(errorType: SDKAssistantMessageError, content: str
           true, // Retryable - may succeed with different content
         ),
       };
+    case 'overloaded':
+      return {
+        detected: true,
+        shouldThrow: new PentestError(
+          `Anthropic API overloaded (structured): ${content.slice(0, 100)}`,
+          'network',
+          true, // Retryable with backoff
+        ),
+      };
+    case 'model_not_found':
+      return {
+        detected: true,
+        shouldThrow: new PentestError(
+          `Model not found: ${content.slice(0, 100)}`,
+          'config',
+          false, // Not retryable - model ID is misconfigured
+        ),
+      };
+    case 'oauth_org_not_allowed':
+      return {
+        detected: true,
+        shouldThrow: new PentestError(
+          `Organization not allowed for this credential: ${content.slice(0, 100)}`,
+          'config',
+          false, // Not retryable - needs credential/org fix
+        ),
+      };
     default:
       return { detected: true };
   }

apps/worker/src/ai/models.ts

@@ -21,7 +21,7 @@ export type ModelTier = 'small' | 'medium' | 'large';
 const DEFAULT_MODELS: Readonly<Record<ModelTier, string>> = {
   small: 'claude-haiku-4-5-20251001',
   medium: 'claude-sonnet-4-6',
-  large: 'claude-opus-4-7',
+  large: 'claude-opus-4-8',
 };
 
 /** Resolve a model tier to a concrete model ID. */
@@ -36,7 +36,7 @@ export function resolveModel(tier: ModelTier = 'medium'): string {
   }
 }
 
-/** Whether a model supports adaptive thinking. Opus 4.6 and 4.7 only. */
+/** Whether a model supports adaptive thinking. Opus 4.6, 4.7, and 4.8 only. */
 export function supportsAdaptiveThinking(model: string): boolean {
-  return /opus-4-[67]/.test(model);
+  return /opus-4-[678]/.test(model);
 }

apps/worker/src/services/preflight.ts

@@ -280,6 +280,32 @@ function classifySdkError(sdkError: SDKAssistantMessageError, authType: string):
           sdkError,
         }),
       );
+    case 'overloaded':
+      return err(
+        new PentestError(`Anthropic API is overloaded. Wait a few moments and try again.`, 'network', true, {
+          authType,
+          sdkError,
+        }),
+      );
+    case 'model_not_found':
+      return err(
+        new PentestError(
+          `Configured model is not available for this account. Check ANTHROPIC_*_MODEL in .env.`,
+          'config',
+          false,
+          { authType, sdkError },
+        ),
+      );
+    case 'oauth_org_not_allowed':
+      return err(
+        new PentestError(
+          `This credential's organization is not allowed. Check your ${authType} in .env.`,
+          'config',
+          false,
+          { authType, sdkError },
+          ErrorCode.AUTH_FAILED,
+        ),
+      );
     default:
       return err(
         new PentestError(