test(core): stableStringify has no unit tests despite being security-critical

[AdamyaSingh7]

What happened?

packages/core/src/policy/stable-stringify.ts is a security-critical utility used for policy rule matching with no dedicated unit tests.
The function handles complex edge cases (circular references, toJSON, sorted keys, undefined/function coercion) that are only indirectly tested via policy-engine.test.ts.

What did you expect to happen?

A dedicated test file covering all documented behaviors of stableStringify, including primitives, sorted keys, arrays, circular references, and toJSON support.

Client information

Not Applicable

Login information

No response

Anything else we need to know?

The JSDoc already documents all expected behaviors with examples, making this straightforward to test directly.

[AdamyaSingh7]

/assign

[gemini-cli]

👋 @AdamyaSingh7, thanks for your interest in this issue! We're reserving self-assignment for issues that have been marked with the help wanted label. Feel free to check out our list of issues that need attention.

[mvanhorn]

I've submitted a fix for this in PR #21950. Adds 28 dedicated unit tests covering sorted keys, circular references, toJSON, type coercion, and edge cases.

[gemini-cli]

This issue points out the lack of unit tests for a security-critical utility function.

Effort Analysis:
The file packages/core/src/policy/stable-stringify.ts lacks dedicated unit tests. This utility is pure and handles data structures like circular references and sorted keys. Adding tests for this does not require debugging complex cross-component flows or UI states; it is a straightforward task of writing standard unit tests, aligning with effort/small.