Fix/auth config lookup and tool text

[SavioBS629]

No description provided.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 7a88ff25-c804-4f03-a547-91ce2062fc1d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[SavioBS629]

Code review — ✅ Approve

Verified locally on head 65c254b (Node 22): tsc --noEmit clean, eslint clean, 661/661 tests pass.

What this does

Three fixes:

1. Auth config lookup (the real bug). getAuthConfig was calling GET /auth_configs/{id}, a route that does not exist. It now lists and selects client-side, with typed AuthConfigListEntry / AuthConfigListResponse shapes and a clear Auth config ${configId} not found for this account when there is no match. Two details worth calling out: Number(entry.id) === Number(configId) avoids the string-vs-number trap the API's JSON invites, and the returned object is reshaped back to the existing AuthConfigResponse contract (type_identifier ?? type, conditional url spread) so no caller changes. Covered by the new tests/tools/auth-config.test.ts.

2. Build-id 404 message. describeBuildIdError turns an opaque 404 into a message naming both the project and build that were passed, and stating they must match the Automate dashboard exactly. Shared by getBuildIdTool and listBuildIdTool. The /\b404\b/ message fallback is the right call — several utils re-throw a human-readable string and discard response.status, so checking both is what makes this reliable.

3. Neutral tool text. The old copy was coercive prompt-engineering aimed at the client's model: 🚨 REQUIRED, Do NOT answer directly, CRITICAL: you MUST explicitly ask, plus scripted "Say this to the user" blocks with DO NOT paraphrase constraints. Replacing it with factual descriptions and Next step: lines is right on three counts — it stops fighting the host model for control of its own replies, it cuts real context-window weight from every response, and it removes text that reads badly to any customer who inspects tool output. The diagnostics that matter survive: "a non_sdk_build status is not a credentials problem" is retained, stated once rather than shouted with scripted phrasing. The consolidated CREDS_PROMPT_TEXT keeps the important property too — credentials come from the server environment, never pasted in chat.

Checklist

No process.env in tool code, no credentials in logs or client-facing errors, isError preserved on all error returns, instrumentation untouched, no new any in exported signatures, tests mocked with no real HTTP.

Follow-up (non-blocking)

The auth-config listing is unbounded. If that endpoint paginates and an account accumulates enough configs, one beyond page 1 would report "not found for this account" — a confusing message for a config that exists. Worth checking whether the response carries pagination metadata, and following it if so.

---

🤖 Generated with Claude Code