Fix TypeScript compilation errors in security module by Copilot · Pull Request #491 · objectstack-ai/objectstack

Copilot · 2026-02-02T09:50:00Z

CI build failing with 26 TypeScript errors in packages/core/src/security/. Root causes: interface/class name collision, Zod 4.x API changes, incorrect logger signatures, and Node.js environment type checks.

Changes

Duplicate export resolution: Renamed PluginConfigValidator interface to IPluginConfigValidator in plugin-loader.ts (class with same name exported from security/)
Zod 4.x compatibility: Changed ZodError.errors → ZodError.issues, added type parameter ZodError<any> for property access
Logger signature fix: Updated logger.error(message, metadata) → logger.error(message, undefined, metadata) to match 3-parameter signature (message, error?, meta?)
Environment type guards: Changed typeof window → typeof (globalThis as any).window to avoid Node.js compilation errors
Test fixtures:
- Fixed relative import paths in security/ subdirectory tests
- Changed unsupported log level 'silent' → 'error'
- Added required certified: false field to PluginCapability test objects
- Fixed getService mock to use generic type parameter

// Before
logger.error(errorMessage, { plugin: plugin.name, errors });

// After  
logger.error(errorMessage, undefined, { plugin: plugin.name, errors });

// Before
return error.errors.map(e => ({ ... }));

// After
return error.issues.map((e: z.ZodIssue) => ({ ... }));

Original prompt

引用: https://github.com/objectstack-ai/spec/actions/runs/21584866296/job/62190969307#step:8:1

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

vercel · 2026-02-02T09:50:05Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Feb 2, 2026 10:01am

- Rename PluginConfigValidator interface to IPluginConfigValidator to avoid conflict - Fix import paths in test files (security/ subfolder) - Fix logger.error calls to use correct signature (message, error?, meta?) - Fix globalThis.window checks using type assertions - Add missing 'certified: false' field to all PluginCapability test objects - Add type annotation for ZodIssue in formatZodErrors - Cast configSchema to any for partial() method call Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

… silent to error log level - Fix ZodError.errors to ZodError.issues for Zod 4.x compatibility - Change test log level from 'silent' to 'error' (silent not supported) - Fix getService mock type signature with generic parameter Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Copilot

Pull request overview

This pull request fixes 26 TypeScript compilation errors in the packages/core/src/security/ module by addressing four main categories of issues: interface/class name collisions, Zod 4.x API changes, logger signature updates, and environment type guards.

Changes:

Renamed PluginConfigValidator interface to IPluginConfigValidator to resolve naming conflict with the class of the same name
Updated Zod error handling from deprecated .errors property to .issues for Zod 4.x compatibility
Modified logger.error() calls to use the 3-parameter signature (message, error?, meta?) instead of the 2-parameter signature
Changed environment detection from typeof window to typeof (globalThis as any).window to fix Node.js TypeScript compilation errors
Fixed test imports, log levels, and test fixture data to match current API requirements

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/core/src/security/plugin-signature-verifier.ts	Updated environment checks to use globalThis and logger calls to 3-parameter signature
packages/core/src/security/plugin-permission-enforcer.test.ts	Fixed relative imports, changed log level from 'silent' to 'error', added required `certified` field, fixed getService mock typing
packages/core/src/security/plugin-config-validator.ts	Updated Zod error handling from `.errors` to `.issues`, added type parameter to ZodError, fixed logger signature, added casting for partial() method
packages/core/src/security/plugin-config-validator.test.ts	Fixed relative imports and changed log level from 'silent' to 'error'
packages/core/src/plugin-loader.ts	Renamed interface from `PluginConfigValidator` to `IPluginConfigValidator` to avoid name collision, added deprecation notice

Copilot · 2026-02-02T10:09:28Z

      if (!isValid) {
        const error = `Signature verification failed for plugin: ${plugin.name}`;
-        this.logger.error(error, { plugin: plugin.name, publisherId });
+        this.logger.error(error, undefined, { plugin: plugin.name, publisherId });


Inconsistent logger.error usage within this file. This call uses the 3-parameter signature with undefined as the second parameter, but other calls in the same file (lines 152, 304, 330) use the 2-parameter signature when there's no Error object. For consistency, when logging without an Error object, use the 2-parameter signature: this.logger.error(error, { plugin: plugin.name, publisherId }) instead of this.logger.error(error, undefined, { plugin: plugin.name, publisherId }).

Suggested change

this.logger.error(error, undefined, { plugin: plugin.name, publisherId });

this.logger.error(error, { plugin: plugin.name, publisherId });

Copilot · 2026-02-02T10:09:28Z

    if (this.config.strictMode) {
      const error = `Plugin missing signature (strict mode): ${plugin.name}`;
-      this.logger.error(error, { plugin: plugin.name });
+      this.logger.error(error, undefined, { plugin: plugin.name });


Inconsistent logger.error usage within this file. This call uses the 3-parameter signature with undefined as the second parameter, but other calls in the same file (lines 152, 304, 330) use the 2-parameter signature when there's no Error object. For consistency, when logging without an Error object, use the 2-parameter signature: this.logger.error(error, { plugin: plugin.name }) instead of this.logger.error(error, undefined, { plugin: plugin.name }).

Suggested change

this.logger.error(error, undefined, { plugin: plugin.name });

this.logger.error(error, { plugin: plugin.name });

Copilot · 2026-02-02T10:09:29Z

        ].join('\n');

-        this.logger.error(errorMessage, {
+        this.logger.error(errorMessage, undefined, {


Inconsistent logger.error usage within this file. This call uses the 3-parameter signature with undefined as the second parameter, but other calls in the same file (lines 152, 304, 330) use the 2-parameter signature when there's no Error object. For consistency, when logging without an Error object, use the 2-parameter signature: this.logger.error(errorMessage, { plugin: plugin.name, errors: formattedErrors }) instead of the 3-parameter version with undefined.

Suggested change

this.logger.error(errorMessage, undefined, {

this.logger.error(errorMessage, {

Copilot · 2026-02-02T10:09:29Z

 // Conditionally import crypto for Node.js environments
 let cryptoModule: typeof import('crypto') | null = null;
-if (typeof window === 'undefined') {
+if (typeof (globalThis as any).window === 'undefined') {


The approach using typeof (globalThis as any).window is a workaround for TypeScript compilation in Node.js environments. A more idiomatic approach would be to check for Node.js using typeof process !== 'undefined' && process.versions?.node !== undefined (as used in logger.ts:27) rather than checking for the absence of window. This is more explicit about detecting the Node.js environment and avoids the type assertion.

Suggested change

if (typeof (globalThis as any).window === 'undefined') {

if (typeof process !== 'undefined' && process.versions?.node !== undefined) {

Copilot · 2026-02-02T10:09:29Z

  private computePluginHash(plugin: PluginMetadata): string {
    // In browser environment, use SubtleCrypto
-    if (typeof window !== 'undefined') {
+    if (typeof (globalThis as any).window !== 'undefined') {


The approach using typeof (globalThis as any).window is inconsistent with the codebase pattern for environment detection. A more idiomatic approach would be to check for Node.js using typeof process !== 'undefined' && process.versions?.node !== undefined (as used in logger.ts:27) rather than checking for the absence of window. This is more explicit about detecting the Node.js environment and avoids the type assertion.

Copilot · 2026-02-02T10:09:29Z

  ): Promise<boolean> {
    // In browser environment, use SubtleCrypto
-    if (typeof window !== 'undefined') {
+    if (typeof (globalThis as any).window !== 'undefined') {


The approach using typeof (globalThis as any).window is inconsistent with the codebase pattern for environment detection. A more idiomatic approach would be to check for Node.js using typeof process !== 'undefined' && process.versions?.node !== undefined (as used in logger.ts:27) rather than checking for the absence of window. This is more explicit about detecting the Node.js environment and avoids the type assertion.

Initial plan

e95455a

Copilot AI assigned Copilot and hotlong Feb 2, 2026

Copilot started work on behalf of hotlong February 2, 2026 09:50 View session

vercel Bot deployed to Preview February 2, 2026 09:59 View deployment

vercel Bot deployed to Preview February 2, 2026 10:01 View deployment

Copilot AI changed the title ~~[WIP] Update action step logic in workflow~~ Fix TypeScript compilation errors in security module Feb 2, 2026

Copilot AI requested a review from hotlong February 2, 2026 10:03

Copilot finished work on behalf of hotlong February 2, 2026 10:03

hotlong marked this pull request as ready for review February 2, 2026 10:04

Copilot AI review requested due to automatic review settings February 2, 2026 10:04

Copilot started reviewing on behalf of hotlong February 2, 2026 10:05 View session

hotlong merged commit 6448fd0 into copilot/scan-kernel-code-against-spec Feb 2, 2026
6 checks passed

Copilot AI reviewed Feb 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix TypeScript compilation errors in security module#491

Fix TypeScript compilation errors in security module#491
hotlong merged 3 commits into
copilot/scan-kernel-code-against-specfrom
copilot/update-action-step-logic

Copilot AI commented Feb 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	this.logger.error(error, undefined, { plugin: plugin.name, publisherId });
	this.logger.error(error, { plugin: plugin.name, publisherId });

	this.logger.error(errorMessage, undefined, {
	this.logger.error(errorMessage, {

	if (typeof (globalThis as any).window === 'undefined') {
	if (typeof process !== 'undefined' && process.versions?.node !== undefined) {

Uh oh!

Conversation

Copilot AI commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

vercel Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 2, 2026 •

edited

Loading

vercel Bot commented Feb 2, 2026 •

edited

Loading