fix: harden client JSON parsing and non-blocking campaign bootstrap

client/src/hooks/use-auth.test.ts

@@ -81,6 +81,27 @@ describe("useAuth", () => {
     expect(result.current.error?.message).toContain("500");
   });
 
+  it("exposes isError when response body is not valid JSON", async () => {
+    server.use(
+      http.get("/api/auth/user", () =>
+        new HttpResponse("not-json", {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        })
+      )
+    );
+
+    const { result } = renderHook(() => useAuth(), {
+      wrapper: createWrapper(),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.isError).toBe(true);
+    expect(result.current.error?.message).toContain("Unexpected response format from server");
+    expect(result.current.user).toBeUndefined();
+    expect(result.current.isAuthenticated).toBe(false);
+  });
+
   it("exposes logout function", async () => {
     const { result } = renderHook(() => useAuth(), {
       wrapper: createWrapper(),

client/src/hooks/use-auth.ts

@@ -14,7 +14,9 @@ async function fetchUser(): Promise<User | null> {
     throw new Error(`${response.status}: ${response.statusText}`);
   }
 
-  return response.json();
+  return response.json().catch(() => {
+    throw new Error("Unexpected response format from server");
+  });
 }
 
 async function logout(): Promise<void> {

server/index.ts

@@ -240,14 +240,20 @@ process.env.PLAYWRIGHT_BROWSERS_PATH = '/nix/store';
       if (campaignConfigsReady) {
         const { bootstrapWelcomeCampaign } = await import("./services/automatedCampaigns");
         const campaignPromise = bootstrapWelcomeCampaign();
-        // Attach a no-op .catch() so the underlying promise doesn't become an
-        // unhandled rejection if the timeout fires first and the campaign later fails.
-        campaignPromise.catch(() => {});
+        let timedOut = false;
+        // Log outcome if the underlying promise fails after timeout fires.
+        campaignPromise.catch((err) => {
+          if (!timedOut) return; // Already handled by outer catch
+          console.warn("[Bootstrap] Welcome campaign failed after timeout:", err instanceof Error ? err.message : String(err));
+        });
         let timer: ReturnType<typeof setTimeout>;
         await Promise.race([
           campaignPromise,
           new Promise<never>((_, reject) => {
-            timer = setTimeout(() => reject(new Error("Welcome campaign bootstrap timed out")), BOOTSTRAP_TIMEOUT_MS);
+            timer = setTimeout(() => {
+              timedOut = true;
+              reject(new Error("Welcome campaign bootstrap timed out"));
+            }, BOOTSTRAP_TIMEOUT_MS);
           }),
         ]).finally(() => clearTimeout(timer!));
       } else {

server/routes.ts

@@ -2928,4 +2928,4 @@ export async function registerRoutes(
   });
 
   return { httpServer, campaignConfigsReady };
-}
+}