test: filesystem chmod + ClickHouse env detection — credential security and driver coverage

Cover the ENOENT+chmod branch in Filesystem.write (credential file permissions on first run)
and add ClickHouse env var detection tests missing since the ClickHouse driver was added in #574.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

https://claude.ai/code/session_01E1RJQ6pYP6VF3nNmWifq9b

Author: claude

packages/opencode/test/tool/project-scan.test.ts

@@ -312,6 +312,8 @@ describe("detectEnvVars", () => {
       "PGHOST", "PGPORT", "PGDATABASE", "PGUSER", "PGPASSWORD", "DATABASE_URL",
       "MYSQL_HOST", "MYSQL_TCP_PORT", "MYSQL_DATABASE", "MYSQL_USER", "MYSQL_PASSWORD",
       "REDSHIFT_HOST", "REDSHIFT_PORT", "REDSHIFT_DATABASE", "REDSHIFT_USER", "REDSHIFT_PASSWORD",
+      "CLICKHOUSE_HOST", "CLICKHOUSE_PORT", "CLICKHOUSE_DB", "CLICKHOUSE_DATABASE",
+      "CLICKHOUSE_USER", "CLICKHOUSE_USERNAME", "CLICKHOUSE_PASSWORD", "CLICKHOUSE_URL",
     ]
     for (const v of vars) {
       delete process.env[v]
@@ -554,6 +556,63 @@ describe("detectEnvVars", () => {
       expect(conn.name).toBe(`env_${conn.type}`)
     }
   })
+
+  test("detects ClickHouse via CLICKHOUSE_HOST", async () => {
+    clearWarehouseEnvVars()
+    process.env.CLICKHOUSE_HOST = "clickhouse.example.com"
+    process.env.CLICKHOUSE_PORT = "8443"
+    process.env.CLICKHOUSE_DB = "analytics"
+    process.env.CLICKHOUSE_USER = "default"
+    process.env.CLICKHOUSE_PASSWORD = "secret"
+
+    const result = await detectEnvVars()
+    const ch = result.find((r) => r.type === "clickhouse")
+    expect(ch).toBeDefined()
+    expect(ch!.name).toBe("env_clickhouse")
+    expect(ch!.source).toBe("env-var")
+    expect(ch!.signal).toBe("CLICKHOUSE_HOST")
+    expect(ch!.config.host).toBe("clickhouse.example.com")
+    expect(ch!.config.port).toBe("8443")
+    expect(ch!.config.database).toBe("analytics")
+    expect(ch!.config.user).toBe("default")
+    expect(ch!.config.password).toBe("***")
+  })
+
+  test("detects ClickHouse via CLICKHOUSE_URL", async () => {
+    clearWarehouseEnvVars()
+    process.env.CLICKHOUSE_URL = "https://clickhouse.example.com:8443"
+
+    const result = await detectEnvVars()
+    const ch = result.find((r) => r.type === "clickhouse")
+    expect(ch).toBeDefined()
+    expect(ch!.name).toBe("env_clickhouse")
+    expect(ch!.source).toBe("env-var")
+    expect(ch!.signal).toBe("CLICKHOUSE_URL")
+    expect(ch!.config.connection_string).toBe("***")
+  })
+
+  test("detects ClickHouse via DATABASE_URL with clickhouse scheme", async () => {
+    clearWarehouseEnvVars()
+    process.env.DATABASE_URL = "clickhouse://user:pass@host:8123/db"
+
+    const result = await detectEnvVars()
+    const ch = result.find((r) => r.type === "clickhouse")
+    expect(ch).toBeDefined()
+    expect(ch!.signal).toBe("DATABASE_URL")
+    expect(ch!.config.connection_string).toBe("***")
+  })
+
+  test("detects ClickHouse via DATABASE_URL with clickhouse+https scheme", async () => {
+    clearWarehouseEnvVars()
+    process.env.DATABASE_URL = "clickhouse+https://user:pass@host:8443/db"
+
+    const result = await detectEnvVars()
+    const ch = result.find((r) => r.type === "clickhouse")
+    expect(ch).toBeDefined()
+    expect(ch!.name).toBe("env_clickhouse")
+    expect(ch!.signal).toBe("DATABASE_URL")
+    expect(ch!.config.connection_string).toBe("***")
+  })
 })
 
 // ---------------------------------------------------------------------------

packages/opencode/test/util/filesystem.test.ts

@@ -217,6 +217,20 @@ describe("filesystem", () => {
 
       expect(await fs.readFile(filepath, "utf-8")).toBe(content)
     })
+
+    test("writes with permissions when parent directory does not exist", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "new-parent", "nested", "secret.json")
+
+      await Filesystem.write(filepath, '{"key":"value"}', 0o600)
+
+      const content = await fs.readFile(filepath, "utf-8")
+      expect(content).toBe('{"key":"value"}')
+      const stats = await fs.stat(filepath)
+      if (process.platform !== "win32") {
+        expect(stats.mode & 0o777).toBe(0o600)
+      }
+    })
   })
 
   describe("writeJson()", () => {