fix: bound missing webhook credentials status

scripts/src/platform-infra-gitea-config.test.ts

@@ -47,4 +47,40 @@ describe("platform-infra Gitea repository GitHub credentials", () => {
     expect(jd01Manifest).not.toContain(tokenEnv);
     expect(nc01Manifest).toContain(tokenEnv);
   });
+
+  test("keeps missing selfmedia webhook status bounded and stack-free", () => {
+    const result = Bun.spawnSync({
+      cmd: [
+        "bun",
+        "scripts/cli.ts",
+        "platform-infra",
+        "gitea",
+        "mirror",
+        "webhook",
+        "status",
+        "--target",
+        "NC01",
+        "--repo",
+        "selfmedia-nc01",
+        "--full",
+      ],
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const stdout = result.stdout.toString();
+    const payload = JSON.parse(stdout);
+    const credentials = payload.data.credentials as Array<Record<string, unknown>>;
+    const selfmedia = credentials.find((item) => item.id === "github-upstream:selfmedia-nc01");
+
+    expect(payload.data.error.code).toBe("github-credential-unavailable");
+    expect(selfmedia).toMatchObject({
+      sourceRef: "pikainc-selfmedia-gh-token.txt",
+      present: false,
+      fingerprint: null,
+      valuesPrinted: false,
+    });
+    expect(selfmedia).not.toHaveProperty("sourcePath");
+    expect(stdout).not.toContain('"stack"');
+    expect(result.stderr.toString()).not.toContain("platform-infra-gitea.ts:");
+  });
 });

scripts/src/platform-infra-gitea.ts

@@ -298,6 +298,7 @@ async function mirrorWebhookCommand(config: UniDeskConfig, args: string[]): Prom
   if (action === "status") {
     const options = parseMirrorWebhookStatusOptions(args.slice(1));
     const result = await mirrorWebhookStatus(config, options);
+    if (result.credentialBlocked === true) return result;
     if (options.raw) return rawMirrorWebhookStatus(result);
     const disclosure = buildMirrorWebhookStatusDisclosure(result, options);
     return options.full ? disclosure : renderMirrorWebhookStatus(result, disclosure);
@@ -471,6 +472,22 @@ async function mirrorWebhookStatus(config: UniDeskConfig, options: MirrorWebhook
   const gitea = readGiteaConfig();
   const target = resolveCommandTarget(gitea, options.targetId);
   const repos = selectedRepositories(gitea, target, options.repoKey);
+  const credentials = credentialSummaries(gitea, repos);
+  const blockers = credentialBlockers(credentials);
+  if (blockers.length > 0) {
+    return {
+      ok: false,
+      action: "platform-infra-gitea-mirror-webhook-status",
+      mutation: false,
+      credentialBlocked: true,
+      target: targetSummary(target),
+      webhook: webhookSyncSummary(gitea, target),
+      repositories: repos.map((repo) => repositorySummary(gitea, repo)),
+      credentials,
+      error: { code: "github-credential-unavailable", blockers, valuesPrinted: false },
+      next: mirrorReadOnlyNextCommands(target.id),
+    };
+  }
   const secrets = ensureMirrorSecrets(gitea, target, repos, false, false, false);
   const result = await capture(config, target.route, ["sh"], remoteScript("mirror-webhook-status", gitea, target, "", { ...options, confirm: false, dryRun: true, wait: false }, { repos, secrets }).script);
   const parsed = parseJsonOutput(result.stdout);