fix(core): log error messages for MCP OAuth and credential failures (#50767)

packages/core/src/util/error-summary.ts

@@ -6,15 +6,16 @@ const decode = Schema.decodeUnknownOption(
   Schema.Struct({
     name: Schema.optional(Schema.String),
     _tag: Schema.optional(Schema.String),
+    message: Schema.optional(Schema.String),
     code: Schema.optional(Schema.Union([Schema.String, Schema.Number])),
     errno: Schema.optional(Schema.Number),
     cause: Schema.optional(Schema.Unknown),
   }),
 )
 
-/** Error messages, stacks and SQL parameters may contain credentials. Retain only diagnostic classifications. */
+/** Stacks are omitted; each entry keeps the classification and message of one error in the cause chain. */
 export function from(error: unknown) {
-  const errors: { type: string; code?: string | number; errno?: number }[] = []
+  const errors: { type: string; message?: string; code?: string | number; errno?: number }[] = []
   const seen = new Set<unknown>()
   while (error && !seen.has(error) && errors.length < 8) {
     seen.add(error)
@@ -22,6 +23,7 @@ export function from(error: unknown) {
     if (Option.isNone(result)) break
     errors.push({
       type: result.value._tag ?? (error instanceof Error ? error.name : result.value.name) ?? "unknown",
+      message: result.value.message || undefined,
       code: result.value.code,
       errno: result.value.errno,
     })

packages/core/test/util/error-summary.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "bun:test"
+import { ErrorSummary } from "../../src/util/error-summary"
+
+describe("ErrorSummary", () => {
+  test("keeps the message and classification of each error in the cause chain", () => {
+    const root = Object.assign(new Error("connect ECONNREFUSED 127.0.0.1:443"), { code: "ECONNREFUSED", errno: -61 })
+    const error = new Error("Incompatible auth server: does not support dynamic client registration", { cause: root })
+    expect(ErrorSummary.from(error)).toEqual([
+      { type: "Error", message: "Incompatible auth server: does not support dynamic client registration" },
+      { type: "Error", message: "connect ECONNREFUSED 127.0.0.1:443", code: "ECONNREFUSED", errno: -61 },
+    ])
+  })
+
+  test("omits the stack and empty messages", () => {
+    const summary = ErrorSummary.from(new Error(""))
+    expect(summary).toEqual([{ type: "Error" }])
+    expect(JSON.stringify(summary)).not.toContain("stack")
+  })
+})