Review fixes: archive id var, JSON validation, locations whitespace

- archive.go: use validated 'id' variable instead of raw args[0]
- client.go: validate response is JSON (guard against HTML 200s);
  use bytes.TrimSpace before first-byte check in Locations
- root.go: revert os.Exit(2) (no-arg help path); drop unreachable
  UsageError that was printing spurious JSON to stderr

Author: ilyazub

pkg/api/client.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -78,6 +79,12 @@ func (c *Client) doGet(endpoint string, params map[string]string) ([]byte, error
 		}
 	}
 
+	// Validate response is JSON (guard against HTML error pages with 200 status).
+	trimmed := bytes.TrimSpace(body)
+	if len(trimmed) == 0 || (trimmed[0] != '{' && trimmed[0] != '[') {
+		return nil, &clierrors.ApiError{Message: "Unexpected non-JSON response from server"}
+	}
+
 	return body, nil
 }
 
@@ -133,7 +140,7 @@ func (c *Client) Locations(params map[string]string) (json.RawMessage, error) {
 		return nil, err
 	}
 	// Locations returns a JSON array; check for an error object.
-	if len(body) > 0 && body[0] == '{' {
+	if trimmed := bytes.TrimSpace(body); len(trimmed) > 0 && trimmed[0] == '{' {
 		if err := checkAPIError(body); err != nil {
 			return nil, err
 		}

pkg/cmd/archive.go

@@ -36,7 +36,7 @@ func runArchive(cmd *cobra.Command, args []string) error {
 	sp := newSpinner("Fetching archive...")
 	sp.Start()
 	client := api.New(apiKey)
-	result, err := client.Archive(args[0])
+	result, err := client.Archive(id)
 	sp.Stop()
 	if err != nil {
 		return err

pkg/cmd/root.go

@@ -29,7 +29,7 @@ var rootCmd = &cobra.Command{
 	SilenceUsage:  true,
 	SilenceErrors: true,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		cmd.Help()
+		_ = cmd.Help()
 		os.Exit(2)
 		return nil
 	},