fix(mcp): preserve HTTP status for non-JSON errors

[JSONbored]

Motivation

• Prevent non-JSON HTTP authorization/failure responses from being converted into statusless parse errors that enable stale private decision-pack fallbacks.

Description

• Update apiFetch to parse response text inside a try/catch and, on parse failure for non-OK responses, attach a sanitized payload ({ error: "non_json_response", body: ... }) while preserving response.status so error objects keep the HTTP status.
• Ensure apiFetch still throws an Error with error.status set when response.ok is false so authorization failures remain ineligible for cache fallback.
• Add a regression test does not use stale decision-pack cache for non-JSON authorization failures to test/unit/mcp-cli.test.ts that seeds the cache and verifies non-JSON 403 responses from both decision-pack and repo-decision endpoints reject instead of returning cached data.
• Extend the test fixture server to simulate non-JSON error bodies and content types for decision-pack and repo-decision endpoints.

Testing

• Ran the unit tests with npm run test:unit -- test/unit/mcp-cli.test.ts and the test suite passed (all tests OK, including the new regression test).
• Ran the build check with npm run build:mcp and it completed successfully.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	ee1fd6e	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:23 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#489 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.