test/runner-redact.test.js (1)

100-117: Add regression tests for the other modified call paths.

This integration test validates run(), but this PR also changed runInteractive() and runCapture() redaction behavior. Add focused assertions for those two paths so future refactors don’t regress them.

Suggested additional tests

+  it("runInteractive() error output redacts secrets (integration)", () => {
+    const runnerPath = path.join(import.meta.dirname, "..", "bin", "lib", "runner");
+    const script = `
+      const { runInteractive } = require(${JSON.stringify(runnerPath)});
+      process.exit = () => {};
+      runInteractive("false GITHUB_TOKEN=ghp_realSecretValue123");
+    `;
+    const result = spawnSync("node", ["-e", script], {
+      cwd: path.join(import.meta.dirname, ".."),
+      encoding: "utf-8",
+      timeout: 10000,
+    });
+    expect(result.stderr).toContain("GITHUB_TOKEN=***");
+    expect(result.stderr).not.toContain("ghp_realSecretValue123");
+  });
+
+  it("runCapture() thrown error redacts message/stdout/stderr", () => {
+    const runnerPath = path.join(import.meta.dirname, "..", "bin", "lib", "runner");
+    const script = `
+      const { runCapture } = require(${JSON.stringify(runnerPath)});
+      try {
+        runCapture("bash -lc 'echo NVIDIA_API_KEY=nvapi-realSecret >&2; exit 1'");
+      } catch (err) {
+        process.stdout.write(String(err.message) + "\\n");
+        process.stdout.write(String(err.stderr || "") + "\\n");
+      }
+    `;
+    const result = spawnSync("node", ["-e", script], {
+      cwd: path.join(import.meta.dirname, ".."),
+      encoding: "utf-8",
+      timeout: 10000,
+    });
+    expect(result.stdout).toContain("NVIDIA_API_KEY=***");
+    expect(result.stdout).not.toContain("nvapi-realSecret");
+  });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/runner-redact.test.js` around lines 100 - 117, Add integration
assertions for the other changed call paths by adding tests similar to the
existing run() test that spawn a child requiring the same runner module (use the
same runnerPath) and invoke runInteractive(...) and runCapture(...) with
commands containing a secret token (e.g.,
"NVIDIA_API_KEY=nvapi-realSecretValue123"); capture the child's stderr/stdout
and assert that outputs contain the redacted form "NVIDIA_API_KEY=***" and do
not contain the raw secret "nvapi-realSecretValue123". Locate tests around the
existing "run() error output redacts secrets (integration)" test and create two
focused specs that call runInteractive and runCapture respectively, ensuring you
override process.exit in the child script as done now and keep the same
spawnSync options (cwd, encoding, timeout).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

test/runner-redact.test.js (1)

106-156: Consider extracting a helper for repeated spawnSync integration setup.

The three integration tests duplicate the same process-launch scaffolding. A local helper would reduce maintenance cost and keep assertions focused.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/runner-redact.test.js` around lines 106 - 156, The three tests duplicate
spawnSync scaffolding—extract a small helper (e.g., spawnRunnerScript or
runChildWithScript) that takes the inline script (and optional timeout/args) and
returns spawnSync(...) result; have it construct runnerPath using
path.join(import.meta.dirname, "..", "bin", "lib", "runner"), set cwd to
path.join(import.meta.dirname, ".."), encoding: "utf-8", and timeout: 10000, and
then replace the repeated spawnSync blocks in the tests that call run(),
runInteractive(), and the truncated-command case to use this helper so
assertions remain focused.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

test/runner-redact.test.js (1)

170-183: Consider adding positive assertion for err.output redaction.

The test verifies secrets are removed from err.output but doesn't assert that the redacted placeholder (GITHUB_TOKEN=***) is present. Adding a positive assertion would strengthen the test by confirming redaction actually occurred rather than just secret removal.

💡 Suggested improvement

   it("runCapture() thrown error redacts err.output array", () => {
     try {
       runCapture("bash -lc 'echo GITHUB_TOKEN=ghp_secretOutputValue >&2; exit 1'");
       throw new Error("expected runCapture to throw");
     } catch (err) {
       if (Array.isArray(err.output)) {
+        const stderrChunk = err.output[2]; // stderr is at index 2
+        if (stderrChunk != null) {
+          expect(String(stderrChunk)).toContain("GITHUB_TOKEN=***");
+        }
         for (const chunk of err.output) {
           if (chunk != null) {
             expect(String(chunk)).not.toContain("ghp_secretOutputValue");
           }
         }
       }
     }
   });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/runner-redact.test.js` around lines 170 - 183, The test should not only
assert the secret is absent but also that redaction occurred; update the
it("runCapture() thrown error redacts err.output array"...) test to check
err.output for the redacted placeholder by verifying at least one output chunk
contains the string "GITHUB_TOKEN=***" (use runCapture and err.output as shown),
e.g., iterate err.output and set a foundRedaction flag when
String(chunk).includes("GITHUB_TOKEN=***"), then assert that flag is true so the
test positively confirms redaction occurred.