Skip to content

fix: Keep the failed request reachable from Seam API errors - #1010

Open
razor-x wants to merge 4 commits into
mainfrom
claude/js-sdk-audit-6x115l-m11c-error-fidelity
Open

fix: Keep the failed request reachable from Seam API errors#1010
razor-x wants to merge 4 commits into
mainfrom
claude/js-sdk-audit-6x115l-m11c-error-fidelity

Conversation

@razor-x

@razor-x razor-x commented Aug 24, 2026

Copy link
Copy Markdown
Member

Problem

SDK audit finding M11c (medium), three related error-surface gaps:

  • SeamHttpApiError dropped the underlying AxiosError on the floor — status headers, request config, and the raw body were unrecoverable from a caught error.
  • The 401 branch short-circuited before parsing the response, discarding the server's diagnostic in favor of a synthesized Unauthorized message.
  • validation_errors lived in a truly private field reachable only via getValidationErrorMessages(name) — callers had to guess parameter names, and nested validation errors were unreachable.

Fix

  • Every Seam API error now carries the AxiosError as its standard cause (error.cause.response, .config, etc.).
  • The 401 branch parses the API error envelope when present: the server's message and data survive, code/statusCode stay pinned to unauthorized/401, with the generic message as fallback for non-JSON 401s.
  • SeamHttpInvalidInputError gains validationErrors (the raw object, nested paths included) and validationErrorParamNames getters; getValidationErrorMessages unchanged.

All constructor changes are backward-compatible (new optional parameters).

Tests

  • 404 error exposes cause as the AxiosError with response and config (fails on reverted source)
  • 401 with a JSON error envelope surfaces the server's message + requestId + cause; plain-text 401 falls back to Unauthorized
  • invalid input exposes validationErrorParamNames and nested validationErrors

Full suite (128 tests), lint, typecheck green.

Part of applying the rev-3 SDK audit (one PR per finding). Related: #1002#1009.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2


Generated by Claude Code

SeamHttpApiError discarded the underlying AxiosError, so the response
headers, request config, and raw body were unrecoverable from a caught
error. The 401 branch threw before parsing the response body, replacing
the server diagnostic with a generic Unauthorized message. Validation
errors were readable only by guessing a parameter name against a
private field.

Pass the AxiosError as the standard error cause on every Seam API
error, parse the 401 response envelope when present and keep its
message and data, and expose validationErrors and
validationErrorParamNames on SeamHttpInvalidInputError so the failing
parameters are enumerable, including nested validation errors.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants