test: handle non-deterministic AES-256-CBC decryption in crypto test

[keithwillcode]

What does this PR do?

Fixes flaky unit test failures that started appearing after the Vitest 4.0 upgrade (PR #26351). The symmetricDecrypt test was expecting decryption with a wrong key to always throw an error, but AES-256-CBC doesn't guarantee this behavior.

Root cause: AES-256-CBC is not authenticated encryption. When decrypting with a wrong key, whether it throws depends on whether the decrypted bytes happen to have valid PKCS#7 padding. Sometimes the random garbage bytes coincidentally look like valid padding, so decipher.final() succeeds without throwing.

The fix: Updated the test to accept either behavior - the decryption either throws OR returns a value different from the original plaintext. Both outcomes correctly indicate that wrong-key decryption doesn't produce the original data.

Note: The "Closing rpc while fetch was pending" error seen in CI was a secondary symptom - when this test failed, it caused Vitest workers to tear down while other modules were still loading.

Requested by: [email protected] (@keithwillcode)
Link to Devin run: https://app.devin.ai/sessions/5c48f4259a5f439a8aec25fe84d2baba

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - test-only change.
• I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

1. Run TZ=UTC yarn test packages/lib/crypto.test.ts - all tests should pass
2. Run the full test suite multiple times to verify no flakiness: TZ=UTC yarn test
3. CI should pass without the "Closing rpc while fetch was pending" error

Checklist

• I have read the contributing guide
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have checked if my changes generate no new warnings

Human Review Checklist

• Verify the test logic threwError || decryptedWithWrongKey !== testText correctly handles both cases
• Confirm this is a test-only change with no modifications to production crypto code
• Consider if future work should upgrade to authenticated encryption (AES-GCM) for better security guarantees (out of scope for this PR)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[cubic-dev-ai]

No issues found across 1 file