[blue4209211]

Follow-up to #122 from a failure-mode review of Nubi's workspace path (nudgebee/nudgebee-enterprise#40463). Scripts often drop stderr, so a cut-off, partial or failed result could read as the whole answer.

Changes

• logs query -o json has one shape: always {logs, series, truncated, partial, total, total_relation, series_note, suggestion}. Keys the api-server didn't send are left out. A script that drops stderr still sees whether the result is complete. Breaking for scripts that parsed the bare log array; no release has shipped that array since v0.0.3.
• Fewer flags: --query-type leaves --help for logs query and metrics query; use --param query_type=kql|ppl|dsl. It still works as a deprecated alias (stderr note), because about 1 in 12 nbctl calls Nubi made on dev used it. The workspace proxy already defaults Elasticsearch to DSL.
• Flag errors list the valid flags: an unknown flag now prints the command's own flags (unknown flag: --metric / flags for nbctl metrics list-label-values: --account-id, --label). Set once on the root, so every command gets it; Nubi guessed --metric there 4 times on dev.
• --limit: defaults to 1000 (llm-server's logs default) and must be at least 1. With no limit, or 0, the api-server would fall back to each provider's default (10 to 5,000 lines), and a cut-off result couldn't be detected. The warning now names the limit: Returned N lines = --limit N; results may be cut off.
• partial: logs query now selects it and warns on stderr when the provider didn't finish.
• metrics query: exits non-zero when a query in the result failed, after printing its output (text or JSON). A failure no longer looks like "no data".
• 401:
  • prints the server's message when it explains the failure (e.g. an expired workspace execution token);
  • keeps the "create a new API token" advice for a bare Unauthorized, a one-word code such as the app gateway's not_authenticated, or an empty body.

Not changed

A DSL "size" can return more lines than --limit. That's Elasticsearch's own knob and stays as it is.

Testing

• make build passes (lint, go test -race ./..., build).
• New tests cover:
  • the single -o json object, and --query-type hidden from --help but still working as a deprecated alias;
  • completeness keys on the series object;
  • the partial warning;
  • the metrics exit code in JSON and text, plus the success case;
  • 401 messages for each body format, bare codes, and an empty body.
• Live on dev:
  • Elasticsearch lines give truncated: true, total: 10000 gte, partial: false; counts give 116 series with an exact total; --param query_type=kql works for logs, and query_type=dsl for metrics;
  • Loki gives the same object shape;
  • a failed PromQL query exits 1 with the JSON printed, and a good one exits 0;
  • a bad key through the app gateway still gets the API-key hint.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces several enhancements to the CLI, including a new --envelope flag for logs queries to output completeness metadata (such as truncation and partial results) in JSON format, and updates metrics queries to exit with a non-zero status upon failure. Additionally, the HTTP client now extracts and displays detailed server-side error messages for 401 Unauthorized responses. Feedback suggests using strings.Fields in isBareUnauthorized to more robustly check if an error message consists of a single word.