Repository navigation
Extend runtime response validation to the remaining typed response shapes #277
Description
Follow-up to #266 (merged), which established the validation policy (looseObject + openWireLiteral + evidence-based nullish/optional — see the merge comment there) and wired it into the 7 run-path shapes.
Remaining work: bring the other typed response shapes onto the same schema layer incrementally — CliTest, CliTestCode, CliCreateTestResponse, CliProject, MeResponse (schema already stubbed as ME_IDENTITY_SCHEMA, currently unwired), UsageResponse, CliFailureSummary, and the rest of the as T casts in src/lib/http.ts helpers.
Guidelines:
- Follow feat(http): validate API responses at runtime with valibot instead of blind casts #266's policy exactly; no fail-closed on fields the server may legitimately add or omit.
- One PR per coherent group of shapes is fine (reads vs writes vs account surfaces) — no need for a single mega-PR.
- Each schema needs the same fixture-evidence discipline feat(http): validate API responses at runtime with valibot instead of blind casts #266 used (cite the test fixture that proves a field is optional vs nullable).
Good structured task for anyone who wants it — comment /assign to claim.
Activity
Davidson3556 commentedon Jul 24, 2026
/assign
testsprite-hob commentedon Jul 24, 2026
Assigned to @Davidson3556. Thanks for taking this on. (2 more slots available.)
Your open assigned issues (1/3):
(none)
Davidson3556 commentedon Jul 26, 2026
Started on this. PR #291 covers the account surfaces group:
ME_RESPONSE_SCHEMA+USAGE_RESPONSE_SCHEMA, and it wires the stubbedME_IDENTITY_SCHEMAintodoctor(whose localMeIdentityhad already drifted — it carriedv3Enabled, the schema didn't).The one that actually bites:
whoamicallsm.scopes.join(', ')unguarded, so a/mebody withoutscopesthrows a raw TypeError in text mode and, under--output json, exits 0 with a partial identity. Before/after is in the PR.Next up, unless you'd rather have them ordered differently: the read shapes (
CliTest,CliTestCode,CliProject), thenCliCreateTestResponse+CliFailureSummaryand the remainingas Tcasts in thehttp.tshelpers.jerrybate-sketch commentedon Sep 6, 2026
/assign
testsprite-hob commentedon Sep 6, 2026
Assigned to @jerrybate-sketch. Thanks for taking this on. (2 more slots available.)
Your open assigned issues (1/3):
(none)
zeshi-du commentedon Sep 16, 2026
Umbrella status.
Tracked internally as DEV-879 — runtime response validation is missing for
CliTest/CliTestCode/CliCreateTestResponse/CliProject/CliFailureSummary, which trust the wire unchecked. This is confirmed and wanted; it isn't a speculative hardening request.Two notes for the people working under this umbrella:
/meand usage shapes) is approved. It now needs a rebase onto currentmain, details on the PR. The delay in merging it is ours.Part of #277has been fixed and the fix reaches this repo with the next release. Don't restructure the PR;Part of #277will clear the gate as written.Leaving this open as the umbrella until every shape in DEV-879 is covered.
feat(http): validate the /me and usage response shapes at runtime (#291)
Davidson3556 commentedon Oct 16, 2026
/unassign
testsprite-hob commentedon Oct 16, 2026
Unassigned @Davidson3556. Thanks for the update — freeing this up for someone else.
fix(cli): validate project and test-code responses with shared schemas
fix: validate project and test-code responses before use (#725)