Rust CLI: match Node's API-error stderr shape; scope x402 hints to payments

[poiley]

Summary

Two behavioral divergences found by a live Node-vs-Rust differential against staging (same API key through both CLIs, byte-compared output; 12/17 read-only commands were already identical):

1. API-error stderr shape. On any 4xx/5xx, the Node CLI unwraps the response envelope and prints the inner error object ({"code": ..., "message": ...}, see extractErrorPayload/formatErrorPayload in api-command.ts); the Rust port printed the raw envelope ({"error": {...}, "success": false}). Scripts that parse stderr and read .code break when switching CLIs. The parity fixtures never caught it because every 4xx/5xx case asserted contains substrings, which both shapes satisfy.
2. Misleading x402 hint. The Rust port mapped the feature_disabled error code to the "x402 payments are not enabled" hint globally, so e.g. wake schedules list on a non-wake org got a payments hint. The Node CLI scopes that hint table to payments commands (payments-shared.ts).

What changed

• client.rs::error_message_for_status now unwraps a non-null error field before pretty-printing, matching Node.
• The x402 hint table moved behind a new error_for_status_with_payment_hints, used only by the three payments.rs call sites. All other friendly commands keep the generic (unauthorized) hint only.
• Exception, matching Node: the payments path deliberately prints the whole envelope (Node's payments-shared.ts documents the envelope as the most useful payload for x402 flows), so the payments variant uses the unflattened form.
• Four unit tests pin the flatten, the non-envelope passthrough, the hint scoping, and the unauthorized hint.
• Three new parity fixtures assert the exact error shapes: generated-command flatten and wake-without-hint run with full Node↔Rust cross-compare; the payments case pins envelope+hint per-runner (compare: false only because Node preserves server key order while serde_json sorts keys, and the trailing hint line keeps the stream from being JSON-normalized).

Note for a possible follow-up

The key-order difference above is the last obstacle to byte-identical error output: enabling serde_json's preserve_order feature would make Rust emit fields in server order like Node everywhere. Left out of this PR since it changes output ordering globally.

Validation

• make rust-cli-check (fmt, clippy -D warnings, all tests)
• make cli-parity: 456/456 cases green including the three new exact-shape cases
• Live re-check against staging: wake schedules list, emails:get-email (bad id), and invalid-key errors now byte-match Node's stderr; payments envelope+hint retained

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The payment error shape matches the documented Node behavior.
• The x402 hint path is limited to payment command helpers.

Important Files Changed

Filename	Overview
cli-rust/src/client.rs	Splits generic and payment error formatting so generic errors flatten while payment errors keep the envelope.
cli-rust/src/payments.rs	Routes payment HTTP error handling through the payment-specific formatter.
test-fixtures/cli-parity/cases.json	Adds parity coverage for flattened generic errors, wake errors without x402 hints, and payment errors with the x402 hint.
cli-rust/tests/api_commands.rs	Adds bounded blocking reads to the generated API test server helper.
cli-rust/tests/config.rs	Adds bounded blocking reads to the OAuth refresh test server helper.
cli-rust/tests/functions_commands.rs	Adds bounded blocking reads to the functions command test server helper.
cli-rust/tests/payloads_auth.rs	Adds bounded blocking reads to the payload auth test server helper.

_{Reviews (5): Last reviewed commit: "Merge updated rust-cli-port base" | Re-trigger Greptile}