fix(cli): fail gracefully on invalid scope:team format

The `/team/:scopeTeam/users` endpoint was letting validation errors from `validateScopeTeam` bubble up
as an unhandled 500 response with an unhandled rejection logged to the console. Now it catches and
returns a proper 400 with a helpful message, and logs the full error.

Author: serhalp

cli/package.json

@@ -36,6 +36,7 @@
     "consola": "^3.4.2",
     "defu": "^6.1.4",
     "h3-next": "npm:h3@^2.0.1-rc.11",
+    "obug": "^2.1.1",
     "ofetch": "^1.5.1",
     "picocolors": "^1.1.1",
     "srvx": "^0.10.1",

cli/src/logger.ts

@@ -1,5 +1,6 @@
 import * as p from '@clack/prompts'
 import pc from 'picocolors'
+import { createDebug } from 'obug'
 
 let isInitialized = false
 
@@ -47,6 +48,11 @@ export function logInfo(message: string): void {
   p.log.info(message)
 }
 
+/**
+ * Log a debug message with `obug` (minimal fork of `debug`)
+ */
+export const logDebug = createDebug('npmx-connector')
+
 /**
  * Log a message (generic)
  */

cli/src/server.ts

@@ -3,6 +3,7 @@ import { H3, HTTPError, handleCors, type H3Event } from 'h3-next'
 import type { CorsOptions } from 'h3-next'
 
 import type { ConnectorState, PendingOperation, OperationType, ApiResponse } from './types.ts'
+import { logDebug, logError } from './logger.ts'
 import {
   getNpmUser,
   orgAddUser,
@@ -20,6 +21,7 @@ import {
   ownerAdd,
   ownerRemove,
   packageInit,
+  validateScopeTeam,
   type NpmExecResult,
 } from './npm-client.ts'
 
@@ -447,6 +449,17 @@ export function createConnectorApp(expectedToken: string) {
     // Decode the team name (handles encoded colons like nuxt%3Adevelopers)
     const scopeTeam = decodeURIComponent(scopeTeamRaw)
 
+    try {
+      validateScopeTeam(scopeTeam)
+    } catch (err) {
+      logError('scope:team validation failed')
+      logDebug(err, { scopeTeamRaw, scopeTeam })
+      throw new HTTPError({
+        statusCode: 400,
+        message: `Invalid scope:team format: ${scopeTeam}. Expected @scope:team`,
+      })
+    }
+
     const result = await teamListUsers(scopeTeam)
     if (result.exitCode !== 0) {
       return {

pnpm-lock.yaml

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { createConnectorApp } from '../../cli/src/server.ts'
+
+const TEST_TOKEN = 'test-token-123'
+
+describe('connector server', () => {
+  describe('GET /team/:scopeTeam/users', () => {
+    it('returns 400 for invalid scope:team format (missing @ prefix)', async () => {
+      const app = createConnectorApp(TEST_TOKEN)
+
+      const response = await app.fetch(
+        new Request('http://localhost/team/netlify%3Adevelopers/users', {
+          headers: { Authorization: `Bearer ${TEST_TOKEN}` },
+        }),
+      )
+
+      expect(response.status).toBe(400)
+      const body = await response.json()
+      expect(body.message).toContain('Invalid scope:team format')
+    })
+
+    it('returns 401 without auth token', async () => {
+      const app = createConnectorApp(TEST_TOKEN)
+
+      const response = await app.fetch(
+        new Request('http://localhost/team/@netlify%3Adevelopers/users'),
+      )
+
+      expect(response.status).toBe(401)
+    })
+  })
+})