preserve diagnostic context on API, WebSocket, and auth failure paths

[baseberry-uat]

Generated by Polylane Autofix after coreplanelabs/cli was connected.

Where this came from. Every step below links to the record behind it.

Step	Where to look
1. The repository was connected	coreplanelabs/cli
2. Connecting the repository kicked off an autofix, and it succeeded	Autofix fix_fd392c…
3. This pull request opened it for review	this PR

Four critical CLI paths were silently swallowing diagnostic context that an operator needs during an incident: API responses that aren't JSON, WebSocket closures, OAuth token refresh failures, and the credential resolver's fallback after a failed refresh. Each failure produced an error message stripped of the server's reason, the endpoint URL, or the WebSocket close code — leaving an operator to reproduce the failure manually with curl or network traces to learn what the server actually said.

Before / After

Before: When an API request returned a non-JSON body (e.g., a gateway HTML error page or a misconfigured domain), the error only said Invalid JSON response from server (status 502) with no URL, method, or body. When an OAuth token refresh failed, the error said Token refresh failed: 401 with no server reason. When a WebSocket stream closed before a reply, the error said WebSocket closed before reply with no close code. And when a token refresh failed silently inside the credential resolver, an operator running with --verbose saw only Not authenticated — no trace that refresh was even attempted or why it failed. A missed-message incident or a stale-token auth loop had no diagnostic trail to point at the root cause; every failure required reproducing with manual curl or network traces to learn what the server actually said. After running --verbose, the refresh failure is now printed to stderr: Token refresh failed: Token refresh failed: 401 {invalid_grant}, telling the operator that a refresh was attempted and why it failed. Similarly, the API request error now prints the HTTP method, the endpoint URL, the status code, and the first 500 bytes of the response body; a

What changed

• src/client/http.ts: requestJson catch block now reads body as text first, then JSON.parses; error includes HTTP method, endpoint URL, status, and first 500 chars of response body (matching the body-snippet pattern from thread-chat.ts:216). Added hint: Check --domain=${config.domain} and your network.

Validation

• npm run typecheck — passed

Root cause, safety reasoning, and scoping notes

Root cause

All four changes are surgical, additive, and mirror existing patterns in the codebase. No new dependencies, no schema changes, no config changes, no deploy-ordering concerns.

Why it's safe

All changes are additive: they preserve the existing error shape (CLIError with the same ExitCode) and only append new context. The requestJson change reads the body as text first and JSON.parses it, matching the pattern already in thread-chat.ts:216 — no new dependencies, no schema changes, no deploy ordering concerns. The resolveCredential verbose log goes to stderr only when --verbose is set, preserving the non-verbose UX.

Out of scope / follow-ups

Skipped: src/client/thread-chat.ts:201-203 (parseSseChunks catch block silently drops malformed SSE chunks) — lower priority since valid chunks still finalize. Skipped: src/auth/oauth.ts callback server logging — interactive browser flow, already surfaces errors via CLIError.

4 files changed (+21/-8)

• src/auth/refresh.ts: modified, +2/-1
• src/auth/resolver.ts: modified, +6/-2
• src/client/http.ts: modified, +7/-3
• src/client/thread-chat.ts: modified, +6/-2

---

Generated by Polylane.

[baseberry-uat]

Warning

Polylane could not verify the production impact of this pull request.

Checked all four error-path changes; this is a locally-installed CLI, not a deployed service, and every change is additive (same exit codes, same flow, more context in messages). No production resource runs this code.

View the full analysis →

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed 6658464 for production impact.}