From 35af6cc49cef7ddd431ef8c8eed99d681b799787 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Mon, 6 Apr 2026 13:41:13 +0100
Subject: [PATCH] fix(status): keep plain json off security audit path

---
 src/commands/status.command.ts |  3 ++-
 src/commands/status.test.ts    | 14 ++++++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/commands/status.command.ts b/src/commands/status.command.ts
index 14bd1f86332..ec6e6137cb1 100644
--- a/src/commands/status.command.ts
+++ b/src/commands/status.command.ts
@@ -105,8 +105,9 @@ export async function statusCommand(
     await runStatusJsonCommand({
       opts,
       runtime,
-      includeSecurityAudit: true,
+      includeSecurityAudit: opts.all === true,
       includePluginCompatibility: true,
+      suppressHealthErrors: true,
       scanStatusJsonFast: async (scanOpts, runtimeForScan) =>
         await loadStatusScanFastJsonModule().then(({ scanStatusJsonFast }) =>
           scanStatusJsonFast(scanOpts, runtimeForScan),
diff --git a/src/commands/status.test.ts b/src/commands/status.test.ts
index 7f6f1b93087..4f4629ba143 100644
--- a/src/commands/status.test.ts
+++ b/src/commands/status.test.ts
@@ -721,8 +721,7 @@ describe("statusCommand", () => {
     expect(payload.sessions.recent[0].totalTokensFresh).toBe(true);
     expect(payload.sessions.recent[0].remainingTokens).toBe(5000);
     expect(payload.sessions.recent[0].flags).toContain("verbose:on");
-    expect(payload.securityAudit.summary.critical).toBe(1);
-    expect(payload.securityAudit.summary.warn).toBe(1);
+    expect(payload.securityAudit).toBeUndefined();
     expect(payload.gatewayService.label).toBe("LaunchAgent");
     expect(payload.nodeService.label).toBe("LaunchAgent");
     expect(payload.pluginCompatibility).toEqual({
@@ -736,6 +735,17 @@ describe("statusCommand", () => {
         byStatus: expect.objectContaining({ queued: 0, running: 0 }),
       }),
     );
+    expect(mocks.runSecurityAudit).not.toHaveBeenCalled();
+  });
+
+  it("includes security audit in JSON when all is requested", async () => {
+    mocks.hasPotentialConfiguredChannels.mockReturnValue(false);
+
+    await statusCommand({ json: true, all: true }, runtime as never);
+
+    const payload = JSON.parse(String(runtimeLogMock.mock.calls[0]?.[0]));
+    expect(payload.securityAudit.summary.critical).toBe(1);
+    expect(payload.securityAudit.summary.warn).toBe(1);
     expect(mocks.runSecurityAudit).toHaveBeenCalledWith(
       expect.objectContaining({
         includeFilesystem: true,