Skip to content

fix(typecheck): type secure storage command output#1524

Merged
kevincodex1 merged 2 commits into
Gitlawb:mainfrom
chioarub:fix/typecheck-secure-storage
Jun 9, 2026
Merged

fix(typecheck): type secure storage command output#1524
kevincodex1 merged 2 commits into
Gitlawb:mainfrom
chioarub:fix/typecheck-secure-storage

Conversation

@chioarub

@chioarub chioarub commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Part of #1486.

Summary

  • Normalize Windows PowerShell stdout/stderr from execaSync before trimming or JSON parsing.
  • Type the secure-storage execaSync test mock and centralize command argument assertions.
  • Add non-happy-path coverage for DPAPI byte stdout parsing and byte stderr failure warnings.

Validation

  • bun test src/utils/secureStorage/platformStorage.test.ts (17 pass)
  • bun test src/utils/secureStorage/platformStorage.test.ts src/utils/codexCredentials.test.ts src/utils/githubModelsCredentials.test.ts src/utils/githubModelsCredentials.hydrate.test.ts src/utils/githubModelsCredentials.refresh.test.ts src/utils/geminiCredentials.test.ts src/services/api/providerConfig.codexSecureStorage.test.ts src/services/api/providerConfig.runtimeCodexCredentials.test.ts (52 pass)
  • env -u OPENAI_API_KEY -u OPENAI_BASE_URL -u OPENAI_MODEL -u CLAUDE_CODE_USE_OPENAI -u CLAUDE_CODE_USE_GEMINI -u CLAUDE_CODE_USE_MISTRAL -u CLAUDE_CODE_USE_GITHUB -u CLAUDE_CODE_USE_BEDROCK -u CLAUDE_CODE_USE_VERTEX -u CLAUDE_CODE_USE_FOUNDRY -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GITHUB_TOKEN -u ANTHROPIC_MODEL -u ANTHROPIC_SMALL_FAST_MODEL bun run check (3435 pass)
  • bun run test:provider (650 pass)
  • env -u OPENAI_API_KEY -u OPENAI_BASE_URL -u OPENAI_MODEL -u CLAUDE_CODE_USE_OPENAI -u CLAUDE_CODE_USE_GEMINI -u CLAUDE_CODE_USE_MISTRAL -u CLAUDE_CODE_USE_GITHUB -u CLAUDE_CODE_USE_BEDROCK -u CLAUDE_CODE_USE_VERTEX -u CLAUDE_CODE_USE_FOUNDRY -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GITHUB_TOKEN -u ANTHROPIC_MODEL -u ANTHROPIC_SMALL_FAST_MODEL npm run test:provider-recommendation (79 pass)
  • bun install --cwd web --frozen-lockfile && bun run web:typecheck
  • bun run typecheck still exits 2 on the repo-wide baseline, but reports no diagnostics under src/utils/secureStorage after this change.
  • git diff --check

Summary by CodeRabbit

  • Refactor

    • Improved internal command output handling to robustly normalize different data formats, reducing edge-case parsing errors.
  • Tests

    • Centralized test helpers and expanded coverage, adding assertions for varied stdout/stderr formats and platform-specific edge cases.

@coderabbitai

coderabbitai Bot commented Jun 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c262bf65-3c9d-46df-96dc-a3a29cb9c326

📥 Commits

Reviewing files that changed from the base of the PR and between 2651287 and db22d5a.

📒 Files selected for processing (1)
  • src/utils/secureStorage/platformStorage.test.ts
📜 Recent review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*

⚙️ CodeRabbit configuration file

**/*: Apply the OpenClaude maintainer review rubric from AGENTS.md. Review the current diff, not stale discussion context. Separate real blockers from suggestions. Do not request changes for vague style churn. Treat approval as merge-ready from CodeRabbit's side, pending required human review and GitHub Checks. If checks are failing or unavailable, say so clearly instead of implying the PR is fully ready.

Files:

  • src/utils/secureStorage/platformStorage.test.ts
{src/**/*.test.ts,src/**/*.test.tsx,tests/**,scripts/**/*.test.ts,vscode-extension/**/*.test.js}

⚙️ CodeRabbit configuration file

{src/**/*.test.ts,src/**/*.test.tsx,tests/**,scripts/**/*.test.ts,vscode-extension/**/*.test.js}: Review tests for meaningful coverage of the changed behavior, isolation of global/env/config state, async cleanup, fake timers, provider profile leaks, and Windows-compatible assumptions. Block when risky runtime changes lack focused regression coverage or tests assert implementation details while missing the user-visible behavior.

Files:

  • src/utils/secureStorage/platformStorage.test.ts
🔇 Additional comments (2)
src/utils/secureStorage/platformStorage.test.ts (2)

248-257: LGTM!

Also applies to: 275-289


248-289: CI readiness should be stated explicitly before merge.

No blockers in these changed tests, but PR notes indicate bun run typecheck still exits 2 due to repo baseline. Please ensure required GitHub Checks are green before merge.


📝 Walkthrough

Walkthrough

Adds command output normalization in Windows credential storage and introduces centralized execaSync test helpers; refactors platform tests to use those helpers and adds DPAPI byte-array handling tests and stderr/string-array warning coverage.

Changes

Secure Storage Robustness

Layer / File(s) Summary
Output normalization in implementation
src/utils/secureStorage/windowsCredentialStorage.ts
commandOutputToString coerces stdout/stderr across string, Uint8Array, and string[]; getFailureWarning, PasswordVault read, and DPAPI read paths use the normalizer before parsing.
Test mock inspection helpers
src/utils/secureStorage/platformStorage.test.ts
Introduces typed mock helpers and accessors plus execaResult() factory; default mockExecaSync now returns the standardized factory shape.
Windows PowerShell test refactoring
src/utils/secureStorage/platformStorage.test.ts
Windows assertions refactored to extract PowerShell script and stdin via helpers; tests check $-expansion prevention and proper quote/backtick escaping.
Windows PasswordVault and deletion tests
src/utils/secureStorage/platformStorage.test.ts
Delete and PasswordVault fallback/failure tests updated to use execaResult and script extraction to assert legacy assembly presence/absence and fallback behavior.
DPAPI byte-handling test cases
src/utils/secureStorage/platformStorage.test.ts
New tests verify DPAPI read parses byte stdout and string-array stdout into credentials; update() warns correctly from byte stderr and string-array stderr.
Linux secret-tool test refactoring
src/utils/secureStorage/platformStorage.test.ts
Linux secret-tool stdin/stdout assertions now use getSecretToolArgs() / getCommandInput() and execaResult for mocked outputs.

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested Reviewers

  • jatmn
  • kevincodex1
🚥 Pre-merge checks | ✅ 4 | ❌ 3

❌ Failed checks (1 warning, 2 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Risk Surface Disclosed ❓ Inconclusive Repository clone failed, so this custom check could not run with code access. Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Hidden Policy Change ❓ Inconclusive Repository clone failed, so this custom check could not run with code access. Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed Title is concise and scoped, but does not fully capture the main change. While typecheck fixes are mentioned, the PR also adds significant test coverage and refactoring of test utilities, which are equally important parts of the changeset.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.


Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/utils/secureStorage/platformStorage.test.ts`:
- Around line 237-262: Add a regression test that covers the branch where execa
returns stdout/stderr as string[]: mock mockExecaSync/execaResult to return
stdout: ["...", "..."] for read() and assert windowsCredentialStorage.read()
joins and parses the array into testData; also add a test where execa returns
exitCode: 1 with stderr: ["dpapi failed",""] for update() and assert
windowsCredentialStorage.update(testData) returns { success: false, warning:
"dpapi failed" } (this ensures the string[] normalization code path for read()
and update() is exercised).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ec89acad-86a5-480d-8acd-42763a6bae81

📥 Commits

Reviewing files that changed from the base of the PR and between e357d59 and 2651287.

📒 Files selected for processing (2)
  • src/utils/secureStorage/platformStorage.test.ts
  • src/utils/secureStorage/windowsCredentialStorage.ts
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*

⚙️ CodeRabbit configuration file

**/*: Apply the OpenClaude maintainer review rubric from AGENTS.md. Review the current diff, not stale discussion context. Separate real blockers from suggestions. Do not request changes for vague style churn. Treat approval as merge-ready from CodeRabbit's side, pending required human review and GitHub Checks. If checks are failing or unavailable, say so clearly instead of implying the PR is fully ready.

Files:

  • src/utils/secureStorage/windowsCredentialStorage.ts
  • src/utils/secureStorage/platformStorage.test.ts
{src/**/*.test.ts,src/**/*.test.tsx,tests/**,scripts/**/*.test.ts,vscode-extension/**/*.test.js}

⚙️ CodeRabbit configuration file

{src/**/*.test.ts,src/**/*.test.tsx,tests/**,scripts/**/*.test.ts,vscode-extension/**/*.test.js}: Review tests for meaningful coverage of the changed behavior, isolation of global/env/config state, async cleanup, fake timers, provider profile leaks, and Windows-compatible assumptions. Block when risky runtime changes lack focused regression coverage or tests assert implementation details while missing the user-visible behavior.

Files:

  • src/utils/secureStorage/platformStorage.test.ts
🔇 Additional comments (2)
src/utils/secureStorage/windowsCredentialStorage.ts (1)

51-70: LGTM!

Also applies to: 76-76, 108-112, 159-163

src/utils/secureStorage/platformStorage.test.ts (1)

11-75: LGTM!

Also applies to: 95-95, 140-236, 269-274

Comment thread src/utils/secureStorage/platformStorage.test.ts

@jatmn jatmn left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution. I do not see any actionable issues from my review.

@kevincodex1

@kevincodex1 kevincodex1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@kevincodex1 kevincodex1 merged commit 8c2f585 into Gitlawb:main Jun 9, 2026
3 checks passed
@chioarub chioarub deleted the fix/typecheck-secure-storage branch June 9, 2026 05:51
deagwon97 pushed a commit to deagwon97/openclaude that referenced this pull request Jun 11, 2026
* fix(typecheck): type secure storage command output

* test(typecheck): cover string array secure storage output
hotmanxp added a commit to hotmanxp/openclaude that referenced this pull request Jun 12, 2026
… env var

upstream Gitlawb#1524: type secure storage command output
- Take upstream's MockExecaOptions / MockExecaArgs / MockExecaResult
  types (replaces untyped mockExecaSync tuple)
- Add execaResult() helper + getExecaCall/getCommandArgs/
  getPowerShellScript/getCommandOptions/getCommandInput helpers
- Add 4 new test cases (byte/string-array stdout + stderr)
- Drop // @ts-nocheck (no longer needed — typing is correct)

fork rebrand (per opencc rebrand pattern):
- OPENCLAUDE_ENABLE_LEGACY_WINDOWS_PASSWORDVAULT → OPENCC_*
  (matches fork's windowsCredentialStorage.ts source which already
  uses OPENCC_*; test was setting wrong env var name)
- Claude Code → Open CC in service-name test (matches source's
  getSecureStorageServiceName return value)

Pre-existing fork bugs fixed in passing:
- Test was setting OPENCLAUDE_* env var but source checks OPENCC_*,
  so legacy PasswordVault code path was never being exercised.
  9 tests were failing for this reason; all 19 now pass.
- Test was asserting 'Claude Code' substring but source returns
  'Open CC-...' (rebranded). Updated expectation.

VERIFICATION:
  typecheck: 0 errors from this file (was @ts-nocheck before)
  tests:     9 pass / 10 fail → 19 pass / 0 fail
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants