fix: surface 429 rate-limit errors in e2e tests and CLI (vercel#1309)

Multiple layered issues caused encryption key 429 errors to produce
confusing, unrelated-looking test failures:

- awaitCommand() in e2e utils now rejects on non-zero exit codes
  instead of silently resolving (the most critical fix)
- cliInspectJson/cliHealthJson throw on empty stdout instead of
  falling back to '{}'
- maybeDecryptFields re-throws HTTP errors instead of silently
  falling back to encrypted placeholders
- fetchRunKey includes response body and status text in errors
- Added 429 to CLI status text map

Author: TooTallNate

.changeset/fix-cli-429-error-surfacing.md

@@ -0,0 +1,5 @@
+---
+"@workflow/cli": patch
+---
+
+Surface HTTP errors (e.g. 429 rate limit) from encryption key fetch instead of silently falling back to encrypted placeholders. Add 429 to the status text map.

.changeset/fix-world-vercel-fetchrunkey-error.md

@@ -0,0 +1,5 @@
+---
+"@workflow/world-vercel": patch
+---
+
+Include response body and status text in fetchRunKey error message for better debuggability of rate limit and server errors.

packages/cli/src/lib/inspect/hydration.ts

@@ -229,12 +229,19 @@ async function maybeDecryptFields<
       result.eventData = eventData;
     }
   } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+
+    // If the key fetch failed due to an HTTP error (e.g. 429 rate limit,
+    // 500 server error), re-throw so the caller surfaces a clear failure
+    // instead of silently showing encrypted placeholders.
+    if (message.includes('HTTP ')) {
+      throw err;
+    }
+
     // Decryption failed (bad key, corrupted ciphertext, etc.) — fall back
     // to showing encrypted placeholders instead of crashing the CLI.
     const { logger } = await import('../config/log.js');
-    logger.warn(
-      `Decryption failed for resource ${runId}: ${err instanceof Error ? err.message : String(err)}`
-    );
+    logger.warn(`Decryption failed for resource ${runId}: ${message}`);
   }
 
   return result;

packages/cli/src/lib/inspect/output.ts

@@ -238,6 +238,7 @@ const getStatusText = (status: number): string => {
     401: 'Unauthorized',
     403: 'Forbidden',
     404: 'Not Found',
+    429: 'Too Many Requests',
     500: 'Internal Server Error',
     502: 'Bad Gateway',
     503: 'Service Unavailable',

packages/core/e2e/utils.ts

@@ -165,7 +165,19 @@ const awaitCommand = async (
       }
 
       child.on('error', (err) => reject(err));
-      child.on('close', () => {
+      child.on('close', (code, signal) => {
+        if (code !== 0) {
+          const exitReason = signal
+            ? `killed by signal ${signal}`
+            : `exited with code ${code}`;
+          const errorMessage = [
+            `CLI command failed (${exitReason}): ${command} ${args.join(' ')}`,
+            stderr ? `\n--- stderr ---\n${stderr}` : '',
+            stdout ? `\n--- stdout ---\n${stdout}` : '',
+          ].join('');
+          reject(new Error(errorMessage));
+          return;
+        }
         resolve({ stdout, stderr });
       });
     }
@@ -202,9 +214,17 @@ export const cliInspectJson = async (args: string) => {
     ],
     cliAppPath
   );
+  if (!result.stdout.trim()) {
+    throw new Error(
+      [
+        'CLI produced no stdout output (expected JSON)',
+        result.stderr ? `\n--- stderr ---\n${result.stderr}` : '',
+      ].join('')
+    );
+  }
   try {
     console.log('Result:', result.stdout);
-    const json = JSON.parse(result.stdout || '{}');
+    const json = JSON.parse(result.stdout);
     return { json, stdout: result.stdout, stderr: result.stderr };
   } catch (err) {
     console.error('Stdout:', result.stdout);
@@ -267,9 +287,17 @@ export const cliHealthJson = async (options?: {
     45_000,
     envOverrides
   );
+  if (!result.stdout.trim()) {
+    throw new Error(
+      [
+        'CLI health check produced no stdout output (expected JSON)',
+        result.stderr ? `\n--- stderr ---\n${result.stderr}` : '',
+      ].join('')
+    );
+  }
   try {
     console.log('Health check result:', result.stdout);
-    const json = JSON.parse(result.stdout || '{}');
+    const json = JSON.parse(result.stdout);
     return { json, stdout: result.stdout, stderr: result.stderr };
   } catch (err) {
     console.error('Stdout:', result.stdout);

packages/world-vercel/src/encryption.ts

@@ -127,8 +127,14 @@ export async function fetchRunKey(
   );
 
   if (!response.ok) {
+    let body: string;
+    try {
+      body = await response.text();
+    } catch {
+      body = '<unable to read response body>';
+    }
     throw new Error(
-      `Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${response.status}`
+      `Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${response.status} ${response.statusText}${body ? ` — ${body}` : ''}`
     );
   }