From b7033369a66b975f1bccd34eca5f6e7ca8a99fe7 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 8 May 2026 15:21:00 +0100
Subject: [PATCH] test: tighten non-live object guards

---
 extensions/memory-wiki/src/tool.test.ts |  3 ++-
 src/gateway/server.talk-config.test.ts  |  7 +++++--
 src/infra/net/fetch-guard.ssrf.test.ts  |  3 +--
 test/cli-json-stdout.e2e.test.ts        |  7 ++++++-
 ui/src/ui/storage.node.test.ts          | 11 +++++++----
 5 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/extensions/memory-wiki/src/tool.test.ts b/extensions/memory-wiki/src/tool.test.ts
index e6469b964d9..9fd0acf780e 100644
--- a/extensions/memory-wiki/src/tool.test.ts
+++ b/extensions/memory-wiki/src/tool.test.ts
@@ -3,8 +3,9 @@ import type { ResolvedMemoryWikiConfig } from "./config.js";
 import { createWikiApplyTool } from "./tool.js";
 
 function asSchemaObject(value: unknown): Record<string, unknown> {
-  expect(value).toBeTypeOf("object");
+  expect(typeof value).toBe("object");
   expect(value).not.toBeNull();
+  expect(Array.isArray(value)).toBe(false);
   return value as Record<string, unknown>;
 }
 
diff --git a/src/gateway/server.talk-config.test.ts b/src/gateway/server.talk-config.test.ts
index f85342f74c7..dcae34484ec 100644
--- a/src/gateway/server.talk-config.test.ts
+++ b/src/gateway/server.talk-config.test.ts
@@ -383,8 +383,11 @@ describe("gateway talk.config", () => {
             // the UI keeps the SecretRef context, but every field becomes the
             // sentinel so no credential material leaks to read-scope callers.
             const redactedApiKey = talk?.providers?.[GENERIC_TALK_PROVIDER_ID]?.apiKey;
-            expect(redactedApiKey).toBeTypeOf("object");
-            expect((redactedApiKey as SecretRef).id).toBe("__OPENCLAW_REDACTED__");
+            expect(redactedApiKey).toEqual({
+              id: "__OPENCLAW_REDACTED__",
+              provider: "__OPENCLAW_REDACTED__",
+              source: "__OPENCLAW_REDACTED__",
+            });
             expect(talk?.resolved?.config?.apiKey).toEqual(redactedApiKey);
           });
 
diff --git a/src/infra/net/fetch-guard.ssrf.test.ts b/src/infra/net/fetch-guard.ssrf.test.ts
index 1246142abf2..684d0ab43fe 100644
--- a/src/infra/net/fetch-guard.ssrf.test.ts
+++ b/src/infra/net/fetch-guard.ssrf.test.ts
@@ -74,8 +74,7 @@ function getDispatcherClassName(value: unknown): string | null {
 }
 
 function expectDispatcherAttached(value: unknown): void {
-  expect(value).toBeTypeOf("object");
-  expect(value).not.toBeNull();
+  expect(getDispatcherClassName(value)).toMatch(/^(Agent|Mock)$/u);
 }
 
 function getSecondRequestHeaders(fetchImpl: ReturnType<typeof vi.fn>): Headers {
diff --git a/test/cli-json-stdout.e2e.test.ts b/test/cli-json-stdout.e2e.test.ts
index 61d5905028a..f47d3678d16 100644
--- a/test/cli-json-stdout.e2e.test.ts
+++ b/test/cli-json-stdout.e2e.test.ts
@@ -34,9 +34,14 @@ describe("cli json stdout contract", () => {
         const stdout = result.stdout.trim();
         expect(stdout.length).toBeGreaterThan(0);
         const parsed = JSON.parse(stdout) as unknown;
-        expect(parsed).toBeTypeOf("object");
+        expect(typeof parsed).toBe("object");
         expect(parsed).not.toBeNull();
         expect(Array.isArray(parsed)).toBe(false);
+        expect(Object.keys(parsed as Record<string, unknown>).sort()).toEqual([
+          "availability",
+          "channel",
+          "update",
+        ]);
         expect(stdout).not.toContain("Doctor warnings");
         expect(stdout).not.toContain("Doctor changes");
         expect(stdout).not.toContain("Config invalid");
diff --git a/ui/src/ui/storage.node.test.ts b/ui/src/ui/storage.node.test.ts
index 3cc9979433e..31c8a4a48b3 100644
--- a/ui/src/ui/storage.node.test.ts
+++ b/ui/src/ui/storage.node.test.ts
@@ -571,9 +571,12 @@ describe("loadSettings default gateway URL derivation", () => {
 
     const persisted = JSON.parse(localStorage.getItem(scopedKey) ?? "{}");
 
-    expect(persisted.sessionsByGateway).toBeTypeOf("object");
-    expect(persisted.sessionsByGateway).not.toBeNull();
-    const scopes = Object.keys(persisted.sessionsByGateway);
+    const sessionsByGateway = persisted.sessionsByGateway as unknown;
+    expect(typeof sessionsByGateway).toBe("object");
+    expect(sessionsByGateway).not.toBeNull();
+    expect(Array.isArray(sessionsByGateway)).toBe(false);
+    const scopedSessions = sessionsByGateway as Record<string, unknown>;
+    const scopes = Object.keys(scopedSessions);
     expect(scopes).toHaveLength(10);
     // oldest stale entries should be evicted
     expect(scopes).not.toContain("wss://stale-0.example:8443");
@@ -581,7 +584,7 @@ describe("loadSettings default gateway URL derivation", () => {
     // newest stale entries and the current gateway should be retained
     expect(scopes).toContain("wss://stale-10.example:8443");
     expect(scopes).toContain("wss://gateway.example:8443");
-    expect(persisted.sessionsByGateway["wss://gateway.example:8443"]).toEqual({
+    expect(scopedSessions["wss://gateway.example:8443"]).toEqual({
       sessionKey: "agent:current:main",
       lastActiveSessionKey: "agent:current:main",
     });