kandev/docs/plans/github-cli-account-stderr/plan.md

spec, created, status

spec	created	status
docs/specs/integrations/requirements/github-authentication.md	2026-08-07	done

Implementation Plan: GitHub CLI account stderr fallback

Overview

Update the host gh account command runner so a successful command with an empty stdout can return its stderr report to the existing legacy account parser. Keep non-empty stdout authoritative, preserving JSON account discovery and token resolution behavior. Add a regression test at the real subprocess boundary.

Backend

Successful command output selection

• apps/backend/internal/github/gh_accounts.go, systemGHAccountRunner.Run: on a successful gh command, return stdout when it contains non-whitespace; if stdout is empty, return stderr. Preserve existing cancellation, timeout, and non-zero exit handling.

Tests

• What: A legacy gh auth status command that exits successfully and emits its report only on stderr is parsed into the expected GHAccount. File: apps/backend/internal/github/gh_accounts_test.go. How: Use a temporary executable named gh on PATH, make structured status fail with an unsupported-flag exit, emit legacy status on stderr, and call listGHAccounts with systemGHAccountRunner.
• What: Existing JSON, legacy stdout, token, and environment-sanitization behaviors remain green. File: existing tests in apps/backend/internal/github/gh_accounts_test.go. How: run the focused package test selection and the package's full test suite.

Verification Results

• RED: rtk go test ./internal/github -run TestSystemGHAccountRunnerUsesStderrWhenStdoutEmpty -count=1 failed with unsupported gh auth status output before the production change.
• GREEN: the same regression test passed after the fallback was added.
• Focused: rtk go test ./internal/github -run 'Test(ListGHAccounts|ResolveGHAccountToken|GitHubCLIEnvironment|SystemGHAccountRunner)' -count=1 passed 12 tests.
• Full package: rtk go test ./internal/github -count=1 passed 1,092 tests.
• rtk git diff --check passed.

Implementation Waves And Parallel Candidates

Wave 1 (sequential):

• task-01-gh-account-stderr

No parallel-safe tasks: the production runner and its regression test share one behavioral boundary.

Open Questions

None.