fix(cli): align commands/ error messages with 4-ingredient strategy

[John-David Dalton (jdalton)]

Summary

PR 2 of a multi-PR series that rewrites socket-cli error messages to follow the four-ingredient strategy added in #1254 (What / Where / Saw vs. wanted / Fix).

This PR covers packages/cli/src/commands/. ~20 error messages, 14 source files, 11 test files.

What's fixed

Grouped by the kind of error:

Flag validation (numeric) — same treatment across all:

• cmd-scan-create.mts — --pull-request, --reach-analysis-memory-limit, --reach-analysis-timeout, --reach-concurrency
• cmd-scan-reach.mts — --reach-analysis-memory-limit, --reach-analysis-timeout, --reach-concurrency
• cmd-scan-list.mts — --page, --per-page
• cmd-organization-dependencies.mts — --limit, --offset
• cmd-audit-log.mts — --page, --per-page
• cmd-threat-feed.mts — --per-page

Before: Invalid number value for --pull-request: foo
After: --pull-request must be a non-negative integer (saw: "foo"); pass a number like --pull-request=42

Flag validation (enum) — --ecosystems / --reach-ecosystems:

Before: Invalid ecosystem: "foo". Valid values are: npm, pypi, ...
After: --reach-ecosystems must be one of: npm, pypi, ... (saw: "foo"); pass a supported ecosystem like --reach-ecosystems=npm

Missing positional:

• cmd-ask.mts — QUERY argument
• handle-config-set.mts — VALUE argument

Interactive TTY required:

• cmd-login.mts — clarified what "non-interactive" means and pointed at SOCKET_CLI_API_TOKEN

IO / system failures:

• add-socket-wrapper.mts — fs.appendFile failure now names the file and surfaces the underlying error
• postinstall-wrapper.mts — names both rc files that were attempted

Invariant / internal:

• convert-gradle-to-maven.mts — "spawn returned no output" with the binary name
• coana-fix.mts — find-vulnerabilities non-array JSON names the actual type received

Error type changes

A bunch of these were throw new Error(...) for what are clearly input-validation failures. Converted to throw new InputError(...) to match the codebase convention called out in CLAUDE.md.

Tests

11 test files updated — switched to regex matching on the new phrasing. Also added a missing InputError export to one vi.mock() in postinstall-wrapper.test.mts.

All 218 test files / 2812 tests in test/unit/commands/ pass.

What I didn't touch (noted for later)

• cmd-fix.mts uses logger.fail(...) + process.exitCode = 1; return instead of throwing InputError. CLAUDE.md calls this pattern out as discouraged ("doesn't set exit code properly" is actually fine here since process.exitCode works, but throwing is cleaner). Not in scope for this PR — just message phrasing.
• oops/cmd-oops.mts intentionally throws a vague error — that's the command's purpose.

Test plan

• CI green
• Sanity: socket scan create --pull-request foo . prints the new message
• Sanity: socket scan list --page -1 prints the new message
• Sanity: socket ask (no args) prints the new message

---

Note

Low Risk
Low risk: changes are limited to user-facing CLI validation/error messages and switching some throws to InputError/FileSystemError, with minor tightening of numeric integer checks that could reject previously-accepted invalid values.

Overview
Improves Socket CLI command error handling to follow a consistent what/where/saw vs wanted/fix format, replacing several generic Error/logger messages with clearer InputError (and FileSystemError for wrapper setup) across commands like ask, scan, audit-log, threat-feed, organization dependencies, and config set.

Tightens validation for several numeric and enum flags (e.g. requiring positive/non-negative integers and clearer --reach-ecosystems/--ecosystems choices), and updates unit/integration tests to assert on the new phrasing. Also improves a couple of internal/system failure messages (gradle spawn output missing, coana JSON shape) and adds a small lockfile metadata tweak.

^{Reviewed by Cursor Bugbot for commit 2269113. Configure here.}

[John-David Dalton (jdalton)]

bugbot run

[John-David Dalton (jdalton)]

bugbot run

[John-David Dalton (jdalton)]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2269113. Configure here.}