fix(health_check): catch transport errors from the job-token fallback

[zereight]

Why

CodeRabbit flagged on #825 that health_check does not catch transport errors from the job-token fallback. When GET /user returns 401/403 and a job token is configured, authenticateWithJobTokenFallbackAsync calls GET /job. If that request fails at the transport level (ECONNREFUSED, DNS, TLS, timeout), health_check rejects and the client gets a JSON-RPC -32603 fetch failed error instead of the structured result introduced in #811.

What changed

• index.ts: wrap the job-token fallback call in health_check with the same try/catch used for GET /user, returning healthCheckTransportErrorResult(error) (status: "error", error.kind/code/message, URL credentials redacted by the existing shared helper).
• test/test-health-check.ts: new test — job token + GET /user 401 + GET /job connection refused → structured status: "error" result with ECONNREFUSED, no secret in the output.

No other tools or auth behavior change.

User impact

health_check with a job token now returns a status: "error" result instead of a JSON-RPC error when the /job fallback cannot connect. This changes the error shape users see, so it needs maintainer confirmation before merge.

Tests

• npm run build, tsc --noEmit, npm run check:skill-sync: pass
• test/test-health-check.ts: 17/17 pass
• npm run test:mock: pass
• E2E (built server over stdio, fake job token, local ports only):
  • /user 401 then /job refused: before (main) -32603 fetch failed → after status:"error", kind:"network", code:"ECONNREFUSED"
  • closed port with user:pass@ in URL: status:"error", credentials shown as [REDACTED] (unchanged)
  • no token/password leaked to stdout/stderr

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9f8520d5-dd21-4096-b6d1-8185d9c1d919

---

📥 Commits

Reviewing files that changed from the base of the PR and between bedf858 and 89efdc7.

---

📒 Files selected for processing (2)

• index.ts
• test/test-health-check.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (9)

• GitHub Check: integration-test
• GitHub Check: docs-build
• GitHub Check: test
• GitHub Check: code-quality
• GitHub Check: schema-tests
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (ruby)
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (javascript-typescript)

---

🧰 Additional context used

🪛 ast-grep (0.45.3)

test/test-health-check.ts

[warning] 162-175: Use https protocol over http
Context: http.createServer((req, res) => {
const pathOnly = (req.url ?? "").split("?")[0];
if (pathOnly.endsWith("/user")) {
server.close();
res.writeHead(401, {
"content-type": "application/json",
connection: "close",
});
res.end(JSON.stringify({ message: "401 Unauthorized" }));
return;
}
res.writeHead(500, { connection: "close" });
res.end();
})
Note: [CWE-319] Cleartext Transmission of Sensitive Information. Security best practice.

(https-protocol-missing-typescript)

---

🔇 Additional comments (4)

test/test-health-check.ts (3)

5-5: LGTM!

---

157-197: LGTM!

---

453-489: LGTM!

---

index.ts (1)

15073-15078: LGTM!

---

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Health checks now return a structured transport error when the Job Token authentication fallback encounters a connection failure, rather than letting the error propagate.
• Tests
  • Added coverage for connection failures during Job Token fallback, including checks that the token is not exposed in the response.

Walkthrough

The health-check handler now returns a transport-error result when job-token fallback authentication fails. A test triggers a refused fallback connection and checks the structured response, authentication status, API URL, server version, and token handling.

Changes

Health-check fallback error handling

Layer / File(s)	Summary
Catch and verify fallback transport errors index.ts, test/test-health-check.ts	The handler catches errors from job-token fallback authentication and returns a transport-error result. A test uses a local HTTP server to trigger a refused fallback connection and checks the response fields and token absence.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: devtronaut

---

Merge Risk: ⚪ Minimal · up to 89efd

The fallback now returns a structured error when its connection fails. No actionable merge-blocking risk remains after normal checks.

Pre-merge checks | 4 | 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: catching transport errors from the job-token fallback in health checks.
Description check		The description directly explains the transport-error handling change, the affected fallback path, the new test, and the reported validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 too large.)

---

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

✨ Simplify code

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[zereight]

Cursor CLI review (gitlab-mcp-maintainer, 89efdc7): no serious issues. The catch only covers transport throws from the GET /job fallback (HTTP 401/403 still flow through jobResponse.ok), reuses the existing redacted healthCheckTransportErrorResult, and does not change readonly/permission exposure. VERDICT: APPROVE