fix(cli): guard secrets plan JSON.parse against malformed input (#109721)

krissding · claude · steipete · web-flow · commit af469c85cf6c · 2026-07-17T10:00:35.000+01:00
* fix(cli): guard secrets plan JSON.parse against malformed input

readPlanFile reads a user-specified file and parses it with JSON.parse
without a try-catch. A malformed or corrupted plan file produces a raw
SyntaxError that is not user-actionable.

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;

* test: tighten malformed secrets plan proof

Co-authored-by: 丁宇婷0668001435 &lt;ding.yuting@xydigit.com&gt;

---------

Co-authored-by: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/src/cli/secrets-cli.test.ts b/src/cli/secrets-cli.test.ts
@@ -125,12 +125,15 @@ function createSecretsApplyResult(options?: {
   };
 }
 
-async function withPlanFile(run: (planPath: string) => Promise<void>) {
+async function withPlanFile(
+  run: (planPath: string) => Promise<void>,
+  contents = `${JSON.stringify(createManualSecretsPlan())}\n`,
+) {
   const planPath = path.join(
     os.tmpdir(),
     `openclaw-secrets-cli-test-${Date.now()}-${Math.random().toString(16).slice(2)}.json`,
   );
-  await fs.writeFile(planPath, `${JSON.stringify(createManualSecretsPlan())}\n`, "utf8");
+  await fs.writeFile(planPath, contents, "utf8");
   try {
     await run(planPath);
   } finally {
@@ -385,6 +388,17 @@ describe("secrets CLI", () => {
     });
   });
 
+  it("shows a user-friendly error when the secrets plan file is malformed JSON", async () => {
+    await withPlanFile(async (planPath) => {
+      await expect(
+        createProgram().parseAsync(["secrets", "apply", "--from", planPath], { from: "user" }),
+      ).rejects.toThrow("__exit__:1");
+
+      expect(runtimeErrors.at(-1)).toContain(`Malformed JSON in secrets plan file: ${planPath}`);
+      expect(runSecretsApply).not.toHaveBeenCalled();
+    }, "{invalid json");
+  });
+
   it("does not print skipped-exec note when apply dry-run skippedExecRefs is zero", async () => {
     await withPlanFile(async (planPath) => {
       runSecretsApply.mockResolvedValue(createSecretsApplyResult({ resolvabilityComplete: false }));
diff --git a/src/cli/secrets-cli.ts b/src/cli/secrets-cli.ts
@@ -53,7 +53,12 @@ async function readPlanFile(pathname: string): Promise<SecretsApplyPlan> {
     import("../secrets/plan.js"),
   ]);
   const raw = readFileSync(pathname, "utf8");
-  const parsed = JSON.parse(raw) as unknown;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Malformed JSON in secrets plan file: ${pathname}`, { cause: err });
+  }
   if (!isSecretsApplyPlan(parsed)) {
     throw new Error(
       `Invalid secrets plan file: ${pathname}. Generate a fresh plan with ${formatCliCommand("openclaw secrets configure --plan-out <path>")}.`,
