Skip to content

docs(claude): align Error Messages with fleet doctrine#1261

Open
John-David Dalton (jdalton) wants to merge 5 commits intomainfrom
chore/error-messages-doctrine
Open

docs(claude): align Error Messages with fleet doctrine#1261
John-David Dalton (jdalton) wants to merge 5 commits intomainfrom
chore/error-messages-doctrine

Conversation

@jdalton
Copy link
Copy Markdown
Contributor

@jdalton John-David Dalton (jdalton) commented Apr 22, 2026

Summary

  • Restructure CLAUDE.md's Error Messages section to match the updated fleet doctrine from socket-repo-template: four ingredients stay, audience-based length guidance (library API terse / CLI verbose / programmatic rule-only) added, baseline rules tightened.
  • Preserve the CLI-specific InputError / AuthError examples — they're better training material than generic ones.
  • Add docs/references/error-messages.md with cross-fleet worked examples and anti-patterns so CLAUDE.md stays tight (CLAUDE.md is always loaded; we want it under the 40 KB ceiling and short enough to re-read).

Test plan

  • Verify CLAUDE.md is still < 40 KB (12.5 KB).
  • Verify new references doc is legible and self-contained.
  • Confirm the section reads at junior-dev level (short declarative rules, defined terms inline).

Note

Medium Risk
Touches many CLI error paths and bumps @socketsecurity/lib to 5.24.0, which could subtly change surfaced error/cause strings and telemetry/debug output. No core business logic changes, but behavior changes are concentrated around failure handling.

Overview
Updates CLAUDE.md’s error-message guidance (audience-based length + tightened rules) and adds docs/references/error-messages.md with worked examples/anti-patterns.

Across the CLI, standardizes caught-error handling by adopting @socketsecurity/lib/errors helpers (isError, errorMessage, errorStack, isErrnoException) instead of ad-hoc instanceof Error ? … : String(…) patterns, including command execution results, renderers, update checks, GitHub/GitLab providers, and debug/telemetry plumbing. This removes the CLI’s local isErrnoException implementation and updates the related unit test expectation.

Reviewed by Cursor Bugbot for commit 178568c. Configure here.

…s doc

Restructure the CLI-specific Error Messages section to match the
updated fleet doctrine from socket-repo-template:

- Keep the four ingredients (What / Where / Saw vs. wanted / Fix).
- Add audience-based length guidance (library API terse / CLI verbose /
  programmatic rule-only). `InputError`/`AuthError` usages are
  verbose-tier.
- Tighten baseline rules to one-liners; drop narrative phrasing.
- Preserve the CLI-specific examples (--pull-request, socket init,
  AuthError) — they earn their keep as real anti-pattern fodder.

Add `docs/references/error-messages.md` with fleet-wide worked examples
so CLAUDE.md stays tight and the rich anti-patterns live once.
Point readers at @socketsecurity/lib/arrays' list-formatting helpers
from CLAUDE.md (one-line rule) and the worked-examples references doc
(new "Formatting lists of values" section).
Fleet-wide migration to the caught-value helpers in
@socketsecurity/lib/errors.

- pnpm-workspace.yaml: catalog bump 5.21.0 → 5.24.0.
- 18 src files under packages/cli/src: replace every
  `e instanceof Error ? e.message : String(e)` and `UNKNOWN_ERROR`
  fallback with `errorMessage(e)`; replace bare `x instanceof Error`
  boolean checks with `isError(x)`; replace
  `e instanceof Error ? e.stack : undefined` with `errorStack(e)`.
- packages/cli/src/utils/error/errors.mts: drop the locally-defined
  `isErrnoException` (which accepted any `code !== undefined`) and
  re-export the library's stricter string-code variant.
- packages/cli/src/commands/manifest/convert-{gradle,sbt}-to-maven.mts:
  rename a local `const errorMessage` → `summary` to free the
  identifier for the imported helper.
- packages/cli/src/utils/telemetry/service.mts: rename two local
  `const errorMessage = …` variables to `errMsg` inside catch
  blocks for the same reason.
- docs/references/error-messages.md: pick up the new "Working with
  caught values" section from socket-repo-template.

Out of scope (intentionally left):
- Exit-code checks on child-process results (`'code' in e` where
  `code` is a number, e.g. display.mts:257). `isErrnoException`
  requires a string code and would wrongly return false.
- The local `getErrorMessage` / `getErrorMessageOr` helpers in
  errors.mts — callers outside this file still use them; a
  broader refactor to the library `errorMessage` is follow-up.

Pre-commit tests skipped (DISABLE_PRECOMMIT_TEST); `pnpm run type`
and `pnpm run lint` pass.
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 22, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​socketsecurity/​lib@​5.21.0 ⏵ 5.24.0100100100100100

View full report

@socket-security-staging
Copy link
Copy Markdown

socket-security-staging Bot commented Apr 22, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​socketsecurity/​lib@​5.21.0 ⏵ 5.24.088 -11100100100100

View full report

@jdalton
Copy link
Copy Markdown
Contributor Author

bugbot run

Comment thread packages/cli/src/utils/error/display.mts Outdated
Cursor bugbot flagged the while(currentCause) loop in displayError: it
walks the .cause chain manually but was calling errorMessage() on each
level, which itself walks the entire remaining chain via
messageWithCauses. For A → B → C, that printed "B msg: C msg" at depth
1, then "C msg" at depth 2, showing C's message twice.

Switch to reading `.message` directly (matching the pre-PR behavior
the bot pointed to) so each iteration emits only that level's text.
Fall back to `String(currentCause)` for non-Error nodes in the chain.

Drop the now-unused `errorMessage` import.

Reported on PR #1261.
…ntics

The debugApiResponse test expected errorMessage('String error') to
return the 'Unknown error' sentinel, matching the old local shim's
behavior that treated any non-Error caught value as unusable. The
catalog bump to @socketsecurity/lib 5.24 switched debug.mts to the
upstream errorMessage, which preserves non-empty primitives as-is —
only empty strings, null, undefined, and plain objects coerce to the
sentinel. Assert on 'String error' to pin the current contract.
@socket-security-staging
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @socketsecurity/lib is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/@socketsecurity/lib@5.24.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/@socketsecurity/lib@5.24.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@jdalton
Copy link
Copy Markdown
Contributor Author

bugbot run

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 178568c. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant