[alerizzo]

Summary

• Credentials: pin the AES-GCM auth tag to 16 bytes. decryptToken called createDecipheriv without authTagLength, so Node accepted a truncated tag (down to 4 bytes) and a prefix of a valid tag still verified (Semgrep gcm-no-tag-length). It now rejects any tag that isn't exactly 16 bytes. encryptToken has always written 16-byte tags, so existing ~/.codacy/credentials files keep working. A new test checks that a truncated tag is rejected.
• Safe ESLint autofixes from tuning the repo's Codacy config: removed unused imports (IgnoreSRMItemBody, colorByGate, File), used ?? / ?. / ??= where the left side is nullish rather than falsy, typed a catch param as unknown, and marked promise-returning helpers async. These don't change behavior. Unsafe suggestions were rejected: any→unknown, removing ?. on generated API types, and ||→?? on display strings where "" must fall through.
• .codacy.yaml (new): excludes test files, src/test-support.ts and .changeset/** from ESLint 9, and generated or boilerplate Markdown from markdownlint. The .changeset/** exclusion fixes a Cloud ESLint failure: it couldn't parse .changeset/changelog.test.ts with parserOptions.project, because tsconfig.json doesn't include dot-folders. That's probably why Cloud ESLint has been reporting 0 issues. Codacy only reads this file from the default branch.
• Removes the legacy .codacy/codacy.yaml (old Codacy CLI v1 tool pins), which is now replaced by the Cloud/local config. Also wraps the URL in AGENTS.md in <> to satisfy markdownlint MD034.

Test plan

• npx tsc --noEmit
• npm test (824 passing, including the new should reject a truncated auth tag)
• After merge, reanalyze on Codacy (codacy repository --reanalyze) and confirm ESLint 9 no longer reports the .changeset/changelog.test.ts parse error

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics -4 complexity · 0 duplication

Metric	Results
Complexity	-4
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking findings were identified.

Codacy also found:

• No new static-analysis or duplication issues.
• Two issues were fixed.
• Diff coverage was not reported because coverage requirements were missing.

Test suggestions

• Decrypting a credential with a truncated authentication tag is rejected.
• A newly encrypted token uses a full 16-byte tag and round-trips through decryption.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. A newly encrypted token uses a full 16-byte tag and round-trips through decryption.

Make this review better

_{TIP Add a ticket key to the branch or title so the reviewer can check the PR against it. Or tell us which ticket tracker you use here.}

_{TIP How was this review? Give us feedback}

[alerizzo]

Addressed the Codacy review's missing test suggestion: added should write a full 16-byte auth tag that decryption accepts in src/utils/credentials.test.ts. The truncated-tag rejection case was already covered.

_{🤖 Generated by /pr-fixup command}