[codex] Enrich source-control errors

apps/server/src/git/GitManager.test.ts

@@ -173,6 +173,8 @@ function runGitSyncForFakeGh(cwd: string, args: readonly string[]): void {
   }
   throw new GitHubCli.GitHubCliError({
     operation: "execute",
+    command: "gh",
+    cwd,
     detail: `Failed to simulate gh checkout with git ${args.join(" ")}: ${result.stderr?.trim() || "unknown error"}`,
   });
 }
@@ -480,6 +482,8 @@ function createGitHubCliWithFakeGh(scenario: FakeGhScenario = {}): {
             ? error
             : new GitHubCli.GitHubCliError({
                 operation: "execute",
+                command: "gh",
+                cwd: input.cwd,
                 detail:
                   error instanceof Error
                     ? `Failed to simulate gh checkout: ${error.message}`
@@ -496,6 +500,8 @@ function createGitHubCliWithFakeGh(scenario: FakeGhScenario = {}): {
           return Effect.fail(
             new GitHubCli.GitHubCliError({
               operation: "execute",
+              command: "gh",
+              cwd: input.cwd,
               detail: `Unexpected repository lookup: ${repository}`,
             }),
           );
@@ -516,6 +522,8 @@ function createGitHubCliWithFakeGh(scenario: FakeGhScenario = {}): {
     return Effect.fail(
       new GitHubCli.GitHubCliError({
         operation: "execute",
+        command: "gh",
+        cwd: input.cwd,
         detail: `Unexpected gh command: ${args.join(" ")}`,
       }),
     );
@@ -595,6 +603,8 @@ function createGitHubCliWithFakeGh(scenario: FakeGhScenario = {}): {
         Effect.fail(
           new GitHubCli.GitHubCliError({
             operation: "createRepository",
+            command: "gh",
+            cwd: input.cwd,
             detail: `Unexpected repository create: ${input.repository}`,
           }),
         ),
@@ -1333,6 +1343,8 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
         ghScenario: {
           failWith: new GitHubCli.GitHubCliError({
             operation: "execute",
+            command: "gh",
+            cwd: repoDir,
             detail: "GitHub CLI (`gh`) is required but not available on PATH.",
           }),
         },
@@ -2471,6 +2483,8 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
         ghScenario: {
           failWith: new GitHubCli.GitHubCliError({
             operation: "execute",
+            command: "gh",
+            cwd: repoDir,
             detail: "GitHub CLI (`gh`) is required but not available on PATH.",
           }),
         },
@@ -2500,6 +2514,8 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
         ghScenario: {
           failWith: new GitHubCli.GitHubCliError({
             operation: "execute",
+            command: "gh",
+            cwd: repoDir,
             detail: "GitHub CLI is not authenticated. Run `gh auth login` and retry.",
           }),
         },

apps/server/src/sourceControl/AzureDevOpsCli.test.ts

@@ -5,6 +5,7 @@ import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import { ChildProcessSpawner } from "effect/unstable/process";
+import { VcsProcessExitError } from "@t3tools/contracts";
 
 import * as VcsProcess from "../vcs/VcsProcess.ts";
 import * as AzureDevOpsCli from "./AzureDevOpsCli.ts";
@@ -329,4 +330,26 @@ describe("AzureDevOpsCli.layer", () => {
       });
     }).pipe(Effect.provide(layer)),
   );
+
+  it.effect("preserves VCS causes without copying upstream details into messages", () =>
+    Effect.gen(function* () {
+      const cause = new VcsProcessExitError({
+        operation: "AzureDevOpsCli.execute",
+        command: "az repos list --organization sensitive-upstream-detail",
+        cwd: "/repo",
+        exitCode: 1,
+        detail: "sensitive-upstream-detail",
+      });
+      mockRun.mockReturnValueOnce(Effect.fail(cause));
+
+      const az = yield* AzureDevOpsCli.AzureDevOpsCli;
+      const error = yield* az.execute({ cwd: "/repo", args: ["repos", "list"] }).pipe(Effect.flip);
+
+      assert.strictEqual(error.command, "az");
+      assert.strictEqual(error.cwd, "/repo");
+      assert.strictEqual(error.detail, "Azure DevOps CLI command failed.");
+      assert.strictEqual(error.cause, cause);
+      assert.equal(error.message.includes("sensitive-upstream-detail"), false);
+    }).pipe(Effect.provide(layer)),
+  );
 });

apps/server/src/sourceControl/AzureDevOpsCli.ts

@@ -3,7 +3,6 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
-import * as SchemaIssue from "effect/SchemaIssue";
 import {
   TrimmedNonEmptyString,
   type SourceControlRepositoryVisibility,
@@ -14,7 +13,6 @@ import * as VcsProcess from "../vcs/VcsProcess.ts";
 import {
   decodeAzureDevOpsPullRequestJson,
   decodeAzureDevOpsPullRequestListJson,
-  formatAzureDevOpsJsonDecodeError,
   type NormalizedAzureDevOpsPullRequestRecord,
 } from "./azureDevOpsPullRequests.ts";
 import * as SourceControlProvider from "./SourceControlProvider.ts";
@@ -25,13 +23,66 @@ export class AzureDevOpsCliError extends Schema.TaggedErrorClass<AzureDevOpsCliE
   "AzureDevOpsCliError",
   {
     operation: Schema.String,
+    command: Schema.String,
+    cwd: Schema.String,
     detail: Schema.String,
     cause: Schema.optional(Schema.Defect()),
   },
 ) {
   override get message(): string {
     return `Azure DevOps CLI failed in ${this.operation}: ${this.detail}`;
   }
+
+  static fromVcsError(
+    context: {
+      readonly operation: "execute";
+      readonly command: "az";
+      readonly cwd: string;
+    },
+    error: VcsError | unknown,
+  ): AzureDevOpsCliError {
+    const lower = errorText(error).toLowerCase();
+
+    if (lower.includes("command not found: az") || lower.includes("enoent")) {
+      return new AzureDevOpsCliError({
+        ...context,
+        detail:
+          "Azure CLI (`az`) with the Azure DevOps extension is required but not available on PATH.",
+        cause: error,
+      });
+    }
+
+    if (
+      lower.includes("az devops login") ||
+      lower.includes("please run az login") ||
+      lower.includes("not logged in") ||
+      lower.includes("authentication failed") ||
+      lower.includes("unauthorized")
+    ) {
+      return new AzureDevOpsCliError({
+        ...context,
+        detail: "Azure DevOps CLI is not authenticated. Run `az devops login` and retry.",
+        cause: error,
+      });
+    }
+
+    if (
+      lower.includes("pull request") &&
+      (lower.includes("not found") || lower.includes("does not exist"))
+    ) {
+      return new AzureDevOpsCliError({
+        ...context,
+        detail: "Pull request not found. Check the PR number or URL and try again.",
+        cause: error,
+      });
+    }
+
+    return new AzureDevOpsCliError({
+      ...context,
+      detail: "Azure DevOps CLI command failed.",
+      cause: error,
+    });
+  }
 }
 
 export interface AzureDevOpsRepositoryCloneUrls {
@@ -106,54 +157,6 @@ function errorText(error: VcsError | unknown): string {
   return String(error);
 }
 
-function normalizeAzureDevOpsCliError(
-  operation: "execute",
-  error: VcsError | unknown,
-): AzureDevOpsCliError {
-  const text = errorText(error);
-  const lower = text.toLowerCase();
-
-  if (lower.includes("command not found: az") || lower.includes("enoent")) {
-    return new AzureDevOpsCliError({
-      operation,
-      detail:
-        "Azure CLI (`az`) with the Azure DevOps extension is required but not available on PATH.",
-      cause: error,
-    });
-  }
-
-  if (
-    lower.includes("az devops login") ||
-    lower.includes("please run az login") ||
-    lower.includes("not logged in") ||
-    lower.includes("authentication failed") ||
-    lower.includes("unauthorized")
-  ) {
-    return new AzureDevOpsCliError({
-      operation,
-      detail: "Azure DevOps CLI is not authenticated. Run `az devops login` and retry.",
-      cause: error,
-    });
-  }
-
-  if (
-    lower.includes("pull request") &&
-    (lower.includes("not found") || lower.includes("does not exist"))
-  ) {
-    return new AzureDevOpsCliError({
-      operation,
-      detail: "Pull request not found. Check the PR number or URL and try again.",
-      cause: error,
-    });
-  }
-
-  return new AzureDevOpsCliError({
-    operation,
-    detail: text,
-    cause: error,
-  });
-}
-
 function normalizeChangeRequestId(reference: string): string {
   const trimmed = reference.trim().replace(/^#/, "");
   const urlMatch = /(?:pullrequest|pull-request|pull|_pulls?)\/(\d+)(?:\D.*)?$/i.exec(trimmed);
@@ -224,13 +227,16 @@ function decodeAzureDevOpsJson<S extends Schema.Top>(
   schema: S,
   operation: "getRepositoryCloneUrls" | "getDefaultBranch" | "createRepository",
   invalidDetail: string,
+  cwd: string,
 ): Effect.Effect<S["Type"], AzureDevOpsCliError, S["DecodingServices"]> {
   return Schema.decodeEffect(Schema.fromJsonString(schema))(raw).pipe(
     Effect.mapError(
       (error) =>
         new AzureDevOpsCliError({
           operation,
-          detail: `${invalidDetail}: ${SchemaIssue.makeFormatterDefault()(error.issue)}`,
+          command: "az",
+          cwd,
+          detail: invalidDetail,
           cause: error,
         }),
     ),
@@ -249,7 +255,14 @@ export const make = Effect.gen(function* () {
         cwd: input.cwd,
         timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
       })
-      .pipe(Effect.mapError((error) => normalizeAzureDevOpsCliError("execute", error)));
+      .pipe(
+        Effect.mapError((error) =>
+          AzureDevOpsCliError.fromVcsError(
+            { operation: "execute", command: "az", cwd: input.cwd },
+            error,
+          ),
+        ),
+      );
 
   const executeJson = (input: Parameters<AzureDevOpsCli["Service"]["execute"]>[0]) =>
     execute({
@@ -286,7 +299,9 @@ export const make = Effect.gen(function* () {
                     return Effect.fail(
                       new AzureDevOpsCliError({
                         operation: "listPullRequests",
-                        detail: `Azure DevOps CLI returned invalid PR list JSON: ${formatAzureDevOpsJsonDecodeError(decoded.failure)}`,
+                        command: "az",
+                        cwd: input.cwd,
+                        detail: "Azure DevOps CLI returned invalid PR list JSON.",
                         cause: decoded.failure,
                       }),
                     );
@@ -318,7 +333,9 @@ export const make = Effect.gen(function* () {
                 return Effect.fail(
                   new AzureDevOpsCliError({
                     operation: "getPullRequest",
-                    detail: `Azure DevOps CLI returned invalid pull request JSON: ${formatAzureDevOpsJsonDecodeError(decoded.failure)}`,
+                    command: "az",
+                    cwd: input.cwd,
+                    detail: "Azure DevOps CLI returned invalid pull request JSON.",
                     cause: decoded.failure,
                   }),
                 );
@@ -341,6 +358,7 @@ export const make = Effect.gen(function* () {
             RawAzureDevOpsRepositorySchema,
             "getRepositoryCloneUrls",
             "Azure DevOps CLI returned invalid repository JSON.",
+            input.cwd,
           ),
         ),
         Effect.map(normalizeRepositoryCloneUrls),
@@ -370,6 +388,7 @@ export const make = Effect.gen(function* () {
             RawAzureDevOpsRepositorySchema,
             "createRepository",
             "Azure DevOps CLI returned invalid repository JSON.",
+            input.cwd,
           ),
         ),
         Effect.map(normalizeRepositoryCloneUrls),
@@ -407,6 +426,7 @@ export const make = Effect.gen(function* () {
             RawAzureDevOpsRepositorySchema,
             "getDefaultBranch",
             "Azure DevOps CLI returned invalid repository JSON.",
+            input.cwd,
           ),
         ),
         Effect.map((repo) => normalizeDefaultBranch(repo.defaultBranch)),

apps/server/src/sourceControl/AzureDevOpsSourceControlProvider.test.ts

@@ -46,6 +46,46 @@ it.effect("maps Azure DevOps PR summaries into provider-neutral change requests"
   }),
 );
 
+it.effect("adds change-request context while retaining Azure CLI causes", () =>
+  Effect.gen(function* () {
+    const cause = new AzureDevOpsCli.AzureDevOpsCliError({
+      operation: "execute",
+      command: "az",
+      cwd: "/repo",
+      detail: "Azure DevOps CLI command failed.",
+      cause: new Error("raw upstream detail that should remain in the cause"),
+    });
+    const provider = yield* makeProvider({
+      checkoutPullRequest: () => Effect.fail(cause),
+    });
+
+    const error = yield* provider
+      .checkoutChangeRequest({ cwd: "/repo", reference: "#42" })
+      .pipe(Effect.flip);
+
+    assert.deepStrictEqual(
+      {
+        provider: error.provider,
+        operation: error.operation,
+        command: error.command,
+        cwd: error.cwd,
+        reference: error.reference,
+        detail: error.detail,
+      },
+      {
+        provider: "azure-devops",
+        operation: "checkoutChangeRequest",
+        command: "az",
+        cwd: "/repo",
+        reference: "#42",
+        detail: "Azure DevOps CLI command failed.",
+      },
+    );
+    assert.strictEqual(error.cause, cause);
+    assert.equal(error.message.includes("raw upstream detail"), false);
+  }),
+);
+
 it.effect("creates Azure DevOps PRs through provider-neutral input names", () =>
   Effect.gen(function* () {
     let createInput: