[cloudsmith-iduffy]

Description

Sometimes the API host answers with an HTML page and status 200. This happens with a TLS-intercepting proxy login page, a captive portal, or an --api-host that points to a website. The REST client accepted any 2xx body. The SDK then turned the HTML into empty models, and each command failed somewhere different with an unexpected error that also went to Sentry.

The REST client now rejects a 2xx response with a text/html content type. It raises the same status-0 API error that connection failures use, so every command goes through its normal error handling. The v2 client (metadata list, workspace domains) uses the same REST client, so it gets the fix too.

Before:

$ cloudsmith entitlements list my-org/my-repo
Getting list of entitlements for the my-repo repository ... OK
Error: TypeError: '<' not supported between instances of 'NoneType' and 'NoneType'

$ cloudsmith check service
The service version is:  1.0 Error: ValueError: 1.0 is not valid SemVer string

After:

$ cloudsmith entitlements list my-org/my-repo
Getting list of entitlements for the my-repo repository ... ERROR
Failed to get list of entitlements! (status: 0 - Unknown Status)

Detail: The API host returned an HTML page, not an API response. Check the API host and your proxy settings.

I checked these commands against a local server that returns an HTML page. Each one now prints its "Failed to ..." or "Could not ..." message, exits with code 1, and sends no error report: entitlements list, list distros, metrics entitlements, metrics packages, check rates, check service, tokens list, whoami --verbose, list dependencies, tags list, metadata list, and quota history.

Fixes Sentry issues CLOUDSMITH-CLI-D, -F, -N, -W, -V, -A, -T, -S, -Q, -P, and -R.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• The check looks only at text/html. A JSON API never sends that type, so no endpoint that works today can break. A portal that sends HTML as text/plain or with no content type still gets through. A check for "not JSON" would cover that, but it is a larger change in a shared client.
• fix(no-ticket): set a default timeout on each API request #538 also edits RestClient.request. This change adds one call after the status check and a new helper at the end of the file, so the two PRs do not touch the same lines.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Non-UTF-8 HTML bodies can raise a decoding exception before validation, bypassing the intended API error handling.

1 open issue

• Check response status and HTML before decoding non-UTF-8 bodies · New

What changed in this PR

This PR adds HTML-response validation to the shared REST client so API commands report normal API errors when a proxy, captive portal, or incorrect API host returns an HTML page.

Changes:

• Reject successful text/html responses with a status-0 API error.
• Add REST-client and entitlements CLI regression tests.
• Document the corrected error behavior in the changelog.

File	Description
cloudsmith_cli/​core/​tests/​test_rest.py	Tests rejection of a successful HTML response.
cloudsmith_cli/​core/​rest.py	Adds shared HTML content-type validation.
cloudsmith_cli/​cli/​tests/​commands/​test_entitlements.py	Tests normal CLI error handling for HTML responses.
CHANGELOG.md	Documents the HTML-response handling fix.

_{Review effort: Balanced}