fix(cli): Report the refresh request host on connection errors

Use the actual request origin in network and TLS diagnostics so self-hosted refresh failures identify the instance that failed.

Co-Authored-By: OpenAI gpt-6-sol <noreply@openai.com>

Author: BYK

packages/cli/src/lib/oauth.ts

@@ -215,11 +215,12 @@ async function fetchWithConnectionError(
     if (!(error instanceof Error)) {
       throw error;
     }
+    const targetOrigin = new URL(url).origin;
 
     // TLS certificate errors — give actionable guidance
     if (isTlsCertError(error)) {
       throw new ApiError(
-        `TLS certificate error connecting to ${getSentryUrl()}`,
+        `TLS certificate error connecting to ${targetOrigin}`,
         0,
         buildTlsErrorDetail(error)
       );
@@ -232,7 +233,7 @@ async function fetchWithConnectionError(
 
     if (isConnectionError) {
       throw new ApiError(
-        `Cannot connect to Sentry at ${getSentryUrl()}`,
+        `Cannot connect to Sentry at ${targetOrigin}`,
         0,
         "Check your network connection and SENTRY_URL configuration"
       );

packages/cli/test/lib/security/refresh-token-poison.test.ts

@@ -87,4 +87,26 @@ describe("CVE defense-in-depth: refresh token", () => {
     expect(fetchCalls).toHaveLength(1);
     expect(fetchCalls[0]).toBe("https://sentry.example.com/oauth/token/");
   });
+
+  test.each([
+    ["network", new Error("fetch failed"), "Cannot connect to Sentry at"],
+    [
+      "TLS",
+      new Error("unable to verify the first certificate"),
+      "TLS certificate error connecting to",
+    ],
+  ])("%s refresh failure names the credential host", async (_, failure, prefix) => {
+    delete process.env.SENTRY_HOST;
+    delete process.env.SENTRY_URL;
+    const credentialHost = "https://sentry.example.com:8443";
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      fetchCalls.push(extractFetchUrl(input));
+      throw failure;
+    }) as typeof fetch;
+
+    await expect(
+      refreshAccessToken("fake-refresh-token", { credentialHost })
+    ).rejects.toThrow(`${prefix} ${credentialHost}`);
+    expect(fetchCalls).toEqual([`${credentialHost}/oauth/token/`]);
+  });
 });