fix(api): guard response.text() in error paths and label chars

Addresses Cursor bugbot feedback on PR #1233.

1. `result.text?.()` in the `!result.ok` branches of `queryApiSafeText`
   and `sendApiRequest` was unguarded. If `text()` threw, the exception
   propagated past the clean `{ ok: false, ... }` return and broke the
   error-handling contract. Wrap both call sites in a shared
   `tryReadResponseText` helper that swallows the failure and returns
   `undefined`.

2. The truncation suffix reported `body.length` as "bytes", but
   `String.prototype.length` / `String.prototype.slice` count UTF-16
   code units, not bytes. For non-ASCII response bodies the label was
   misleading. Rename to "chars" so the counter matches the actual
   measurement.

Author: jdalton

packages/cli/src/utils/debug.mts

@@ -129,9 +129,12 @@ function buildApiDebugDetails(
   }
   if (requestInfo.responseBody !== undefined) {
     const body = requestInfo.responseBody
+    // `.length` / `.slice` operate on UTF-16 code units, not bytes, so
+    // the counter and truncation are both reported in "chars" to stay
+    // consistent with what we actually measured.
     details['responseBody'] =
       body.length > RESPONSE_BODY_TRUNCATE_LENGTH
-        ? `${body.slice(0, RESPONSE_BODY_TRUNCATE_LENGTH)}… (truncated, ${body.length} bytes)`
+        ? `${body.slice(0, RESPONSE_BODY_TRUNCATE_LENGTH)}… (truncated, ${body.length} chars)`
         : body
   }
   return details

packages/cli/src/utils/socket/api.mts

@@ -82,6 +82,18 @@ export async function socketHttpRequest(
   return await httpRequest(url, options)
 }
 
+// Safe wrapper for `response.text()` in error-handling code paths.
+// `text()` can throw (e.g. already consumed, malformed body), which
+// would blow past the `ok: false` CResult return and break the
+// error-handling contract of callers like `queryApiSafeText`.
+function tryReadResponseText(result: HttpResponse): string | undefined {
+  try {
+    return result.text?.()
+  } catch {
+    return undefined
+  }
+}
+
 export type CommandRequirements = {
   permissions?: string[] | undefined
   quota?: number | undefined
@@ -485,7 +497,7 @@ export async function queryApiSafeText(
       requestedAt,
       headers: { Authorization: '[REDACTED]' },
       responseHeaders: result.headers,
-      responseBody: result.text?.(),
+      responseBody: tryReadResponseText(result),
     })
     // Log required permissions for 403 errors when in a command context.
     if (commandPath && status === 403) {
@@ -674,7 +686,7 @@ export async function sendApiRequest<T>(
         'Content-Type': 'application/json',
       },
       responseHeaders: result.headers,
-      responseBody: result.text?.(),
+      responseBody: tryReadResponseText(result),
     })
     // Log required permissions for 403 errors when in a command context.
     if (commandPath && status === 403) {

packages/cli/test/unit/utils/debug.test.mts

@@ -258,7 +258,7 @@ describe('debug utilities', () => {
       debugApiResponse('/api/big', 500, undefined, requestInfo)
 
       const calledWith = mockDebugDir.mock.calls[0]?.[0]
-      expect(calledWith.responseBody).toMatch(/… \(truncated, 5000 bytes\)$/)
+      expect(calledWith.responseBody).toMatch(/… \(truncated, 5000 chars\)$/)
       expect((calledWith.responseBody as string).length).toBeLessThan(
         bigBody.length,
       )