auth: surface contexts read errors; cleaner not-logged-in UX

Address two review comments:

- ResolveControlPlaneTarget already failed loud on a contexts.json
  read/parse error; make `auth status` (resolveStatusTarget) symmetric —
  surface a genuine load error instead of swallowing it into the legacy
  fallback. A missing file still reads as "no contexts" (not an error), so
  this only fires on real corruption/IO failure, which the user must see
  before a control-plane mutation acts as a stale identity.

- providerSource.BearerAuth no longer prefixes the active-context error.
  NewRefreshingLoginProvider already returns a tailored message naming the
  context, its login server, and the exact re-login command; surface it
  verbatim. The bare ErrNotLoggedIn sentinel (static fallback path) still
  gets the standard 'entire login' hint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: 52317c4f2e8f

Author: toothbrush

cmd/entire/cli/auth.go

@@ -167,7 +167,10 @@ func newAuthStatusCmd() *cobra.Command {
 			if err := requireSecureBaseURL(insecureHTTPAuth); err != nil {
 				return err
 			}
-			target := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, api.AuthBaseURL())
+			target, err := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, api.AuthBaseURL())
+			if err != nil {
+				return err
+			}
 			// We send the session token to target.coreURL; enforce TLS on it
 			// too (it may differ from AuthBaseURL when a context is active).
 			if !insecureHTTPAuth {
@@ -220,25 +223,31 @@ type statusTarget struct {
 // active contexts.json context wins (so `auth use` retargets status onto that
 // login server); otherwise it falls back to the legacy keyring entry keyed by
 // the configured auth host.
-func resolveStatusTarget(store tokenStore, listContexts contextsProvider, fallbackBaseURL string) statusTarget {
+//
+// A genuine contexts.json read/parse error is surfaced, not swallowed — a
+// missing file reads as "no contexts" (no error), so an error here means the
+// file is corrupt or unreadable, which the user must see. This keeps status
+// symmetric with the control-plane commands (auth.ResolveControlPlaneTarget),
+// which fail the same way rather than silently degrading to a stale identity.
+func resolveStatusTarget(store tokenStore, listContexts contextsProvider, fallbackBaseURL string) (statusTarget, error) {
 	all, current, err := listContexts()
-	total := 0
-	if err == nil {
-		total = len(all)
-		for _, c := range all {
-			if c.Name != current || c.CoreURL == "" {
-				continue
-			}
-			if tok, terr := auth.LoginTokenForContext(c); terr == nil && tok != "" {
-				return statusTarget{coreURL: c.CoreURL, token: tok, activeContext: c.Name, totalContexts: total}
-			}
+	if err != nil {
+		return statusTarget{}, fmt.Errorf("load contexts: %w", err)
+	}
+	total := len(all)
+	for _, c := range all {
+		if c.Name != current || c.CoreURL == "" {
+			continue
+		}
+		if tok, terr := auth.LoginTokenForContext(c); terr == nil && tok != "" {
+			return statusTarget{coreURL: c.CoreURL, token: tok, activeContext: c.Name, totalContexts: total}, nil
 		}
 	}
 	tok, gerr := store.GetToken(fallbackBaseURL)
 	if gerr != nil {
 		tok = "" // best-effort: a keyring read failure just reads as "no token"
 	}
-	return statusTarget{coreURL: fallbackBaseURL, token: tok, totalContexts: total}
+	return statusTarget{coreURL: fallbackBaseURL, token: tok, totalContexts: total}, nil
 }
 
 // defaultFetchProfile fetches a user's profile from coreURL's GET /me with the

cmd/entire/cli/auth/control_plane_test.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"
 	"time"
@@ -81,6 +82,20 @@ func TestResolveControlPlaneTarget_ActiveContextWins(t *testing.T) {
 	}
 }
 
+// A genuine contexts.json read/parse error must fail loud — not silently fall
+// back to a stale legacy identity for a control-plane mutation.
+func TestResolveControlPlaneTarget_CorruptContextsErrors(t *testing.T) {
+	configDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", configDir)
+	t.Setenv(api.AuthBaseURLEnvVar, "")
+	if err := os.WriteFile(filepath.Join(configDir, "contexts.json"), []byte("{ not valid json"), 0o600); err != nil {
+		t.Fatalf("write corrupt contexts.json: %v", err)
+	}
+	if _, err := ResolveControlPlaneTarget(); err == nil {
+		t.Fatal("want an error when contexts.json is corrupt, got nil")
+	}
+}
+
 // With no active context, the target falls back to the configured auth origin
 // — the default when ENTIRE_AUTH_BASE_URL is unset, or the env value when set
 // (the env var is the fallback host).

cmd/entire/cli/auth_context_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/base64"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -28,7 +29,10 @@ func TestResolveStatusTarget_PrefersActiveContext(t *testing.T) {
 		t.Fatalf("record context: %v", err)
 	}
 
-	got := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, "https://fallback.example.com")
+	got, err := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, "https://fallback.example.com")
+	if err != nil {
+		t.Fatalf("resolveStatusTarget: %v", err)
+	}
 	if got.coreURL != "https://eu.auth.entire.io" {
 		t.Errorf("coreURL = %q, want the active context's CoreURL", got.coreURL)
 	}
@@ -40,6 +44,23 @@ func TestResolveStatusTarget_PrefersActiveContext(t *testing.T) {
 	}
 }
 
+// A genuine contexts.json read/parse error is surfaced by resolveStatusTarget,
+// symmetric with the control-plane commands — not swallowed into the legacy
+// fallback. (A missing file reads as "no contexts" and is not an error.)
+func TestResolveStatusTarget_CorruptContextsErrors(t *testing.T) {
+	cfgDir := t.TempDir()
+	t.Setenv("ENTIRE_CONFIG_DIR", cfgDir)
+	restore := tokenstore.UseFileBackendForTesting(filepath.Join(t.TempDir(), "tokens.json"))
+	t.Cleanup(restore)
+
+	if err := os.WriteFile(filepath.Join(cfgDir, "contexts.json"), []byte("{ not valid json"), 0o600); err != nil {
+		t.Fatalf("write corrupt contexts.json: %v", err)
+	}
+	if _, err := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, "https://fallback.example.com"); err == nil {
+		t.Fatal("want an error when contexts.json is corrupt, got nil")
+	}
+}
+
 // makeContextJWT builds a JWT-shaped token (non-"none" alg) carrying the
 // given claims, which is all RecordLoginContext needs.
 func makeContextJWT(t *testing.T, payloadJSON string) string {

cmd/entire/cli/logout.go

@@ -74,7 +74,10 @@ func newLogoutCmd() *cobra.Command {
 
 			// Revoke against the active context's core (matching what
 			// `auth status` lists), not a static AuthBaseURL.
-			target := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, api.AuthBaseURL())
+			target, err := resolveStatusTarget(auth.NewContextStore(), auth.Contexts, api.AuthBaseURL())
+			if err != nil {
+				return err
+			}
 			if !insecureHTTPAuth {
 				if err := api.RequireSecureURL(target.coreURL); err != nil {
 					return fmt.Errorf("context login server URL check: %w", err)

internal/coreapi/client.go

@@ -84,14 +84,17 @@ type providerSource struct {
 func (p *providerSource) BearerAuth(ctx context.Context, _ OperationName) (BearerAuth, error) {
 	token, err := p.provide(ctx)
 	if err != nil {
-		// Only suggest login when the user genuinely isn't logged in.
-		// Other failures (STS rejection, refresh-expired, network) already
-		// carry descriptive messages and must surface verbatim rather than
-		// be masked by a login hint.
+		// The static fallback path returns a bare ErrNotLoggedIn sentinel with
+		// no helpful text, so add the standard login hint. The active-context
+		// path (NewRefreshingLoginProvider) instead returns a tailored message
+		// that already names the context, its login server, and the exact
+		// re-login command — surface that verbatim rather than burying it under
+		// a generic prefix. Other failures (STS rejection, network) are
+		// likewise self-descriptive.
 		if errors.Is(err, auth.ErrNotLoggedIn) {
 			return BearerAuth{}, fmt.Errorf("not logged in — run 'entire login': %w", err)
 		}
-		return BearerAuth{}, fmt.Errorf("resolve control-plane token: %w", err)
+		return BearerAuth{}, err
 	}
 	return BearerAuth{Token: token}, nil
 }

internal/coreapi/client_test.go

@@ -108,16 +108,16 @@ func TestProviderSource_BearerAuth(t *testing.T) {
 		}
 	})
 
-	t.Run("other errors surface without the login hint", func(t *testing.T) {
+	t.Run("other errors surface verbatim", func(t *testing.T) {
 		t.Parallel()
-		sentinel := errors.New("STS rejected the exchange")
+		// The active-context provider returns an already-tailored message; it
+		// must reach the user unprefixed (no generic "resolve control-plane
+		// token" wrapper burying it) and without the login hint.
+		sentinel := errors.New(`no usable login for "ctx" (https://core.example); run ENTIRE_AUTH_BASE_URL=https://core.example entire login`)
 		src := &providerSource{provide: func(context.Context) (string, error) { return "", sentinel }}
 		_, err := src.BearerAuth(context.Background(), "")
-		if err == nil || !errors.Is(err, sentinel) {
-			t.Fatalf("error = %v, want it to wrap the sentinel", err)
-		}
-		if strings.Contains(err.Error(), "entire login") {
-			t.Fatalf("non-auth error must not carry a login hint: %v", err)
+		if err == nil || err.Error() != sentinel.Error() {
+			t.Fatalf("error = %v, want the provider message surfaced verbatim", err)
 		}
 	})
 }