From 8e383f5c02b32b813b84c048d5075a2be576f748 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:04:29 -0300
Subject: [PATCH] test(ci): static body in codex e2e mock route bridge (CodeQL
 #737) (#7559)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeQL js/stack-trace-exposure flags ANY error-derived value returned in
the mock route bridge's 500 path, not just error.stack — swapping .stack
for error.message (in #7354, alert #736) left sibling alert #737 open on
the same line. Replace the body with a static string; the test only
asserts status===200, so the 500 body is never inspected. Clears the last
open CodeQL alert repo-wide, unblocking the Quality Ratchet on every PR.

Companion to the release/v3.8.49 PR (merge-gates §8 — gate/CI-touching fix
lands on main in the same session).
---
 tests/integration/codex-chat-reasoning-http-e2e.test.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/integration/codex-chat-reasoning-http-e2e.test.ts b/tests/integration/codex-chat-reasoning-http-e2e.test.ts
index e5a03749ff..b7172b2bb1 100644
--- a/tests/integration/codex-chat-reasoning-http-e2e.test.ts
+++ b/tests/integration/codex-chat-reasoning-http-e2e.test.ts
@@ -178,10 +178,12 @@ async function startRouteServer() {
         body,
       });
       await bridgeRouteResponse(await chatRoute.POST(request), outgoing);
-    } catch (error) {
-      // Mock route bridge: surface the message, never the raw stack (js/stack-trace-exposure).
+    } catch {
+      // Mock route bridge: static body only — CodeQL flags ANY error-derived value here,
+      // including error.message / String(error) (js/stack-trace-exposure #736/#737). The test
+      // only asserts status===200, so the 500 body is never inspected.
       outgoing.writeHead(500, { "content-type": "text/plain" });
-      outgoing.end(error instanceof Error ? error.message : String(error));
+      outgoing.end("internal test route error");
     }
   });