fix(cli): surface cloud-exec stream failures instead of silent success

[DorianZheng]

What

Cloud exec streams stdout/stderr over a WebSocket. When that attach fails
(e.g. a 401 on the upgrade), the client recovered the exit code via a status
probe and reported a silent exit 0 with no output — indistinguishable from a
command that genuinely produced none.

Changes

• emit_or_fallback now carries the disconnect cause in ExecResult.error_message
  (was None); it is only reached when the output stream failed.
• StreamManager::start() surfaces a non-empty error_message as an error
  (exit 1 + message) instead of dropping it.
• REST 401/403 mapping reads unauthorized (HTTP 401) / forbidden (HTTP 403)
  instead of a bare auth: <body>.
• Adds debug!/trace! to the previously-uninstrumented WS attach path
  (connect, per-frame, stdout/stderr, exit-frame, status-probe fallback).

Verification

• Real cloud exec: before = silent exit 0, empty; after = exit 1 + clear cause.
• Unit reproducer terminal::tests::stream_manager_surfaces_exec_error_message_as_error verified RED→GREEN.
• 4 WS attach unit tests still pass.

Summary by CodeRabbit

• Bug Fixes

  • Distinguished error messages for authentication (HTTP 401) versus authorization (HTTP 403) failures
  • Improved error reporting when process execution streaming is interrupted

• Chores

  • Enhanced diagnostic logging for WebSocket connection handling

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 34f65b26-5909-4f38-83d5-965e24df9926

📥 Commits

Reviewing files that changed from the base of the PR and between 075f6a6 and 6558c6c.

📒 Files selected for processing (3)

• src/boxlite/src/rest/error.rs
• src/boxlite/src/rest/litebox.rs
• src/cli/src/terminal/mod.rs

---

📝 Walkthrough

Walkthrough

map_http_status gains separate 401 and 403 error messages. In litebox.rs, emit_or_fallback now sets ExecResult.error_message = Some(cause) (previously None) when the status probe recovers a terminal exit code after a WS disconnect; additional tracing is added throughout the WS pump. StreamManager::start in the CLI then checks error_message post-loop and returns Err via anyhow::bail!, with a regression test validating this path.

Changes

WS Disconnect Error Propagation

Layer / File(s)	Summary
Specific 401/403 auth error messages src/boxlite/src/rest/error.rs	map_http_status splits the combined 401 | 403 arm into two separate arms with distinct messages that include the HTTP status code (unauthorized (HTTP 401) vs forbidden (HTTP 403)).
WS fallback: emit cause in ExecResult and tracing src/boxlite/src/rest/litebox.rs	emit_or_fallback changes error_message from None to Some(cause) for terminal-status fallbacks while preserving exit_code. attach_ws and the WS frame pump gain trace!/debug! logs at connect, per-frame receipt, exit-frame, and disconnect-fallback points.
CLI error propagation and regression test src/cli/src/terminal/mod.rs	StreamManager::start borrows exit_status with as_ref() before the loop exits, then inspects error_message after the loop and calls anyhow::bail! when set. A new async test stubs ExecResult with error_message set, drops I/O channels, and asserts the returned Err contains "401 Unauthorized".

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 A status code walked in — was it 401 or 403?
The rabbit split them cleanly, for better clarity!
When websockets drop mid-stream, the cause now travels far,
No silent None to hide the truth of what the errors are.
The CLI now bails with flair, the test confirms it's right —
Hop hop, the error chain is bright! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(cli): surface cloud-exec stream failures instead of silent success' directly and specifically summarizes the main change: preventing cloud exec commands from silently succeeding when WebSocket stream attachment fails.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cloud-exec-error-surfacing

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[G4614]

can