fix(cli): preserve a 401 on the final request attempt (#1370)

When two transient errors are followed by a 401, the CLI refreshes its
OAuth token even though no request attempts remain, then throws
`Exhausted all retry attempts`. Return the original 401 and response
body instead so callers retain the authentication error.

Extracts the 401 fix from #1367. Earlier 401 recovery and the retry
budget stay unchanged. One regression test reuses the existing API/OAuth
fixture to cover `503 → 503 → 401` and verify that no unused token
refresh occurs.

Co-authored-by: GPT-6 <noreply@openai.com>

Author: betegon

packages/cli/src/lib/sentry-client.ts

@@ -315,13 +315,14 @@ type AttemptResult =
 /**
  * Decide what to do with a successful HTTP response.
  * Returns 'done' for final responses, 'retry' for retryable errors and 401s.
+ * Only refresh credentials when another attempt can use them.
  */
 async function handleResponse(
   response: Response,
   headers: Headers,
   isLastAttempt: boolean
 ): Promise<AttemptResult> {
-  if (response.status === 401) {
+  if (response.status === 401 && !isLastAttempt) {
     const refreshed = await handleUnauthorized(headers);
     return refreshed ? { action: "retry" } : { action: "done", response };
   }

packages/cli/test/lib/api-client.test.ts

@@ -225,6 +225,21 @@ describe("401 retry behavior", () => {
     expect(oauthRequests).toHaveLength(1);
   });
 
+  test("preserves a final-attempt 401 without refreshing the token", async () => {
+    const requests: RequestLog[] = [];
+    const body = { detail: "Unauthorized" };
+    globalThis.fetch = createMockFetch(requests, (_req, requestCount) =>
+      Response.json(body, { status: requestCount < 3 ? 503 : 401 })
+    );
+
+    const result = await rawApiRequest("/test-endpoint/");
+
+    expect(result.status).toBe(401);
+    expect(result.body).toEqual(body);
+    expect(requests).toHaveLength(3);
+    expect(requests.filter((r) => r.url.includes("/oauth/token/"))).toEqual([]);
+  });
+
   test("does not retry for manual API tokens (no refresh token)", async () => {
     // Manual API tokens have no expiry and no refresh token
     await setAuthToken("manual-api-token"); // No expiry, no refresh token