Merge pull request #544 from ndycode/claude/audit-26-isrecord-fix

fix(runtime): reject array helper-status files; dedupe isRecord

Author: ndycode

lib/runtime/runtime-current-account.ts

@@ -6,6 +6,7 @@ import type { AppBindRouterStatus } from "./app-bind.js";
 import { APP_RUNTIME_HELPER_STATUS_FILE } from "../runtime-constants.js";
 import { getCodexMultiAuthDir } from "../runtime-paths.js";
 import type { AccountStorageV3 } from "../storage.js";
+import { isRecord } from "../utils.js";
 
 export type RuntimeCurrentAccountSource =
 	| "runtime-observability"
@@ -97,10 +98,6 @@ function normalizeTimestamp(signal: RuntimeAccountSignal): number | null {
 	return timestamps.length > 0 ? Math.max(...timestamps) : null;
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null;
-}
-
 function readOptionalNumber(record: Record<string, unknown>, key: string): number | null {
 	const value = record[key];
 	return typeof value === "number" && Number.isFinite(value) ? value : null;

test/runtime-current-account.test.ts

@@ -535,23 +535,10 @@ describe("readAppRuntimeHelperStatus", () => {
 		});
 	});
 
-	it("treats a JSON array as a record and yields an all-null status", async () => {
-		// Pins current behavior: isRecord() accepts arrays, so `[]` produces a
-		// fully-null status object instead of null. Downstream
-		// appRuntimeHelperStatusToSignal still rejects it via the kind check.
+	it("rejects a JSON array status file as not-a-record", async () => {
+		// isRecord() excludes arrays: an `[]` helper-status file is malformed
+		// content, not an all-null status object.
 		await writeStatusFile("[]");
-		const status = readAppRuntimeHelperStatus();
-		expect(status).toEqual({
-			kind: null,
-			state: null,
-			pid: null,
-			lastAccountIndex: null,
-			lastAccountLabel: null,
-			lastAccountEmail: null,
-			lastAccountId: null,
-			lastAccountUpdatedAt: null,
-			updatedAt: null,
-		});
-		expect(appRuntimeHelperStatusToSignal(status)).toBeNull();
+		expect(readAppRuntimeHelperStatus()).toBeNull();
 	});
 });

test/snapshot-inspectors.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from "vitest";
 import { describeAccountsWalSnapshot } from "../lib/storage/snapshot-inspectors.js";
 import type { SnapshotStats } from "../lib/storage/backup-metadata.js";
+import { isRecord } from "../lib/utils.js";
 
 type WalDeps = Parameters<typeof describeAccountsWalSnapshot>[1];
 
@@ -36,7 +37,7 @@ function createDeps(overrides: Partial<WalDeps> = {}): WalDeps {
 		readFile: vi.fn(async () =>
 			makeJournalEntry(makeInnerStorage()),
 		) as unknown as WalDeps["readFile"],
-		isRecord: (value: unknown) => typeof value === "object" && value !== null,
+		isRecord,
 		computeSha256: fakeSha256,
 		parseAndNormalizeStorage: vi.fn((data: unknown) => ({
 			normalized: { accounts: (data as { accounts: unknown[] }).accounts },