Follow-up to #174 / PR #179. Deliberately not fixed there to keep that PR reviewable.
Summary
Four test files build their own Hono app with an onError handler that is a verbatim copy of the line #174 just removed from production:
const code = (err as Error & { code?: string }).code ?? "INTERNAL_ERROR";
src/api/tests/unit/exec-batch.test.ts:33
src/api/tests/unit/exec-batch.perscript.test.ts:51
src/api/tests/integration/multi-tenant.integration.test.ts:78
src/api/tests/integration/writefiles-atomicity.integration.test.ts:63
Why it matters
No user-facing leak — this is test-only code. The problem is that these apps no longer have production's error shape. A future regression that reintroduces raw-code leakage would still pass every test built on this scaffolding, and any assertion written against these apps encodes the pre-fix contract as if it were current.
src/api/server.ts now routes through clientSafeErrorCode(err) (added in PR #179, src/api/errors.ts). The scaffolding should call the same helper so the test apps and production cannot drift.
Suggested fix
Replace the four hand-rolled handlers with clientSafeErrorCode(err), or better, export a shared test-app factory so there is one definition of the error contract to keep in sync.
Provenance
Found by the #174 implementation agent while auditing call sites for the leaked-code fix.
Follow-up to #174 / PR #179. Deliberately not fixed there to keep that PR reviewable.
Summary
Four test files build their own Hono app with an
onErrorhandler that is a verbatim copy of the line #174 just removed from production:src/api/tests/unit/exec-batch.test.ts:33src/api/tests/unit/exec-batch.perscript.test.ts:51src/api/tests/integration/multi-tenant.integration.test.ts:78src/api/tests/integration/writefiles-atomicity.integration.test.ts:63Why it matters
No user-facing leak — this is test-only code. The problem is that these apps no longer have production's error shape. A future regression that reintroduces raw-code leakage would still pass every test built on this scaffolding, and any assertion written against these apps encodes the pre-fix contract as if it were current.
src/api/server.tsnow routes throughclientSafeErrorCode(err)(added in PR #179,src/api/errors.ts). The scaffolding should call the same helper so the test apps and production cannot drift.Suggested fix
Replace the four hand-rolled handlers with
clientSafeErrorCode(err), or better, export a shared test-app factory so there is one definition of the error contract to keep in sync.Provenance
Found by the #174 implementation agent while auditing call sites for the leaked-code fix.