@retasc/cli 1.4.0 → 1.5.0

package/dist/api.js

@@ -33,11 +33,49 @@ function client() {
         c.setAuth(cfg.token);
     return c;
 }
+/**
+ * Read a caught backend error into the parts a command wants to show (RTSC-261).
+ *
+ * `code` is machine-readable, so a command branches on `code === "EXPIRED"`
+ * instead of regex-matching prose that any copy edit would break. `hint` is the
+ * next step, kept separate so callers can dim or indent it.
+ *
+ * Both are optional because the sweep is incremental: a backend site still
+ * throwing a plain Error (or an OLD deployment this CLI is pointed at) yields
+ * `{message}` alone via the same first-line/strip-prefix cleanup used before.
+ * Callers must therefore keep any existing string fallback rather than assuming
+ * `code` is present.
+ */
+export function formatError(e) {
+    const data = e?.data;
+    if (data && typeof data === "object" && typeof data.message === "string") {
+        // Type-guard EVERY field, not just `message`: a foreign error carrying
+        // `{message: "x", code: {…}}` would otherwise print `✗ [object Object]: x`.
+        // And strip control characters — these strings go to `console.error`, so a
+        // future converted site that interpolates user data (issue ids, org names)
+        // must not be able to smuggle ANSI escapes into the terminal. Mirrors
+        // `sanitize` in convex/lib/userError.ts; the two are one wire contract.
+        const clean = (v) => 
+        // eslint-disable-next-line no-control-regex
+        typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]/g, " ").trim() : undefined;
+        return { code: clean(data.code), message: clean(data.message), hint: clean(data.hint) };
+    }
+    const message = String(e?.message ?? e)
+        .split("\n")[0]
+        .replace(/^.*?Uncaught Error:\s*/, "")
+        .trim();
+    return { message };
+}
 // Does this error mean "the access token is missing/expired", i.e. a refresh
 // might fix it? The access-token JWT lives ~1h, so any long-lived login trips
 // this. Two shapes surface: our server functions throw `UNAUTHENTICATED …`
 // (requireUser), and the Convex platform rejects a stale JWT with "Could not
 // verify OIDC token"/"Unauthenticated". Match either, case-insensitively.
+// RTSC-261 deliberately does NOT touch this. It gates the refresh-and-retry
+// loop, no site converted here throws an auth code, and `formatError` truncates
+// to the first line — so routing it through there would add real risk (a missed
+// match means a spurious device-flow re-login) for no gain today. It gets a
+// `code === "UNAUTHENTICATED"` fast path in the PR that converts lib/auth.ts.
 export function isAuthError(e) {
     const msg = String(e?.message ?? e);
     return /unauthenticated|could not verify oidc|oidc token/i.test(msg);

package/dist/commands/billing.js

@@ -68,7 +68,7 @@ export async function billingAction(opts) {
     const c = charges;
     console.log(`\nBilling — ${orgLabel}\n`);
     console.log("SUBSCRIPTION");
-    row("Status", s.billingExempt ? "comp — not billed" : `${s.status}${s.gated ? " (gated)" : ""}`);
+    row("Status", `${s.status}${s.gated ? " (gated)" : ""}`);
     row("Subscription", s.subscriptionId ?? "none yet");
     if (s.spendingCapUsd != null) {
         row("Budget", `${usd(s.spendingCapUsd)}${s.capPeriod ? ` / ${s.capPeriod.replace("per_", "")}` : ""}`);

package/dist/index.js

@@ -14,7 +14,7 @@ import { readLocalBinding, resolveBinding } from "./lib/binding.js";
 import { tidyAction, doneAction } from "./commands/tidy.js";
 import { runProxy } from "./proxy.js";
 import { deviceLogin } from "./auth.js";
-import { api } from "./api.js";
+import { api, formatError } from "./api.js";
 // Single source of truth for the version: read package.json at runtime from the
 // compiled file's location (dist/index.js -> ../package.json). A JSON import won't
 // work here — tsconfig has rootDir "src", so importing ../package.json is outside
@@ -31,9 +31,15 @@ function requireLogin() {
         process.exit(1);
     }
 }
+// RTSC-261: prefer the structured payload, and print `hint` on its own dimmed
+// line — the whole reason it's a separate field is that the fix shouldn't be
+// buried in the middle of the diagnosis. `formatError` falls back to the old
+// string cleanup, so unconverted backend sites print exactly as they did.
 function fail(e) {
-    const msg = String(e?.message ?? e).split("\n")[0].replace(/^.*?Uncaught Error:\s*/, "");
-    console.error(`✗ ${msg}`);
+    const { code, message, hint } = formatError(e);
+    console.error(`✗ ${code ? `${code}: ` : ""}${message}`);
+    if (hint)
+        console.error(`  → ${hint}`);
     process.exit(1);
 }
 // --- auth ------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Retasc CLI — sign in with GitHub, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {