fix: surface safe JSON command failures on stderr

[alongubkin]

Background

JSON mode writes its machine-readable failure to stdout. Automation normally captures stdout for parsing, so a non-zero command could look silent to a human or coding agent even though Alien had an actionable typed error.

Closes ALIEN-884.

Reproduction

Run an alien --output json ... command that returns an API error while capturing stdout. Before this change stderr has no error code, message, or request ID.

Root cause

The top-level CLI converted and serialized the error only through the selected JSON output renderer. Unlike human mode, there was no terminal diagnostic channel.

Fix

JSON mode still emits the canonical machine-readable external error on stdout, and now also prints a one-line safe diagnostic on stderr containing only:

• external error code
• sanitized external message
• request ID, when present

Newlines are flattened. Arbitrary error context and internal source details are deliberately excluded.

Verification

cargo test -p alien-cli json_error_diagnostic --lib -j 4

Tests prove request-ID visibility, omission of secret context, and sanitization of internal errors.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fixed and no new actionable failures remain.

Summary

This PR improves failed JSON-mode CLI commands without changing their canonical stdout document.

• Emits the externalized, machine-readable error on stdout.
• Adds a concise sanitized diagnostic on stderr.
• Preserves request IDs by extracting them before internal-error externalization.
• Replaces control characters in messages and request IDs to prevent multiline or terminal-control injection.
• Adds tests covering request-ID visibility, secret omission, internal-error sanitization, and control-character handling.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[CLI command fails in JSON mode] --> B[Extract request ID from original error]
    A --> C[Externalize error]
    C --> D[Canonical JSON error on stdout]
    B --> E[Sanitize request ID]
    C --> F[Sanitize external code and message]
    E --> G[One-line diagnostic on stderr]
    F --> G

Loading

_{Reviews (2) · Last reviewed commit: "fix: retain and sanitize JSON request ID..."}

[alongubkin]

@greptileai re-review