Coverage audit: 39 bug fixes + test extension to 98.2% line coverage

[Mikola Lysenko (mikolalysenko)]

Summary

Full audit of CLI test coverage at d5e1815, executed as a multi-agent pipeline: measure → audit every uncovered range → fix confirmed bugs → implement test plans → adversarial review → targeted mop-up.

Coverage (host, default features): 94.18% → 98.47% lines (94.73% → 98.26% regions; 6,441 → 2,138 missed lines). Tests: 5,220 → 6,762 (full workspace, green, also green under instrumentation). Baseline was cross-checked against CI's merged docker-e2e lcov for the same commit (docker legs added only 18 lines beyond host coverage, so host numbers are authoritative).

Commit 1 — fix: 39 adversarially-confirmed bugs (0b7714b)

120 bugs were claimed by per-file auditors over never-executed code; 39 survived 3-reviewer refutation panels, and every fix landed with a failing repro test first. Classes:

• Orphaned vendor-artifact husks on failure paths (npm, composer, pnpm-legacy, gem, + bun/pnpm-v9 twins found in review) — missing done_failure_unstage
• keep_artifact / --preserve-state contract violations (bun, gem, pnpm-legacy): empty-wiring refusals fired despite documented skip; legacy revert helpers missed already-converged liveness checks
• Missing drift-keep gates in the pypi revert family — vendored wheel dirs deleted while a drift-skipped lock still referenced them
• Wired-rebuild safety: gem/nuget/composer/pypi rebuild failures deleted the live artifact dir the wired lock still points at; pypi in-sync rebuild now honors the wired sha256/wheel-path pin (fail-closed on unreadable state.json)
• NuGet packageSourceMapping: nuget.org seed suppressed by a whole-file substring probe → socket-only exclusive mapping (NU1100 for every other package); insert_nuget_source could drop the source while mapping+ledger were still recorded; open-tag/single-quote tolerance now consistent between the redirect and nuget_feed twins
• scan --prune: RevertOutcome::kept_artifact was ignored (drift-kept entries pruned, artifacts destroyed); corrupt vendor ledger silently defeated every vendored prune safeguard; apply output now reports keptVendoredEntries + remediation hint (CLI_CONTRACT.md updated; dry preview documented as drift-blind)
• CLI envelopes: get --json printed two JSON documents on engine hard errors; apply --silent exited 1 with zero output when patch sources were unavailable; rollback --ecosystems replayed other ecosystems' leftover hosted edits; scan hosted --dry-run previewed against vendored wiring; repair --vendor pre-delete destroyed healthy soft-reconstructed artifacts
• Parsers/safety: zip-entry cap gated on declared size (unbounded read_to_end); registry_fetch 128MB cap enforced only after full read; pnpm-workspace flow-sequence packages: [a, b] parsed to zero members (pre-existing RED tests un-ignored); cargo config inline-table crates-io invisible to remove/read; uv dependency-groups/empty-overrides/direct-URL defects; takeover alias-collision edits stranded or mis-claimed (now scope-aware)

Commit 2 — test: coverage extension + review findings (4a29cc1)

• ~1,100 new tests: inline #[cfg(test)] additions plus 30 new per-module covgap_* integration suites
• A 46-reviewer adversarial pass over the full diff confirmed 42 findings (3-vote panels), all applied: fix residuals (uv convergence carve-outs, fail-open pin guard, golang gate strengthening, multi-line flow sequences, fetch-stage silent-mode envelope), the bun/pnpm-v9 twins above, and test hygiene (root guards on all chmod tests, SOCKET_*/VIRTUAL_ENV scrubs, telemetry disabled in spawned-CLI suites — one suite was POSTing to production, hermetic Gemfile.lock fixtures, cfg gates, vacuous tests repaired or deleted)

Commit 3 — test: final mop-up (9e45492)

165 targeted tests over the 14 worst remaining files (fresh post-fix line numbers); 129 remaining ranges formally classified untestable with per-range reasons (match-exhaustiveness arms proven dead by construction, assertion-failure format args inside test modules, interactive-only/platform-gated paths). Two prior skips overturned where a stable approach existed.

Known residuals (flagged, deliberately not fixed here)

• vendor/maven_repo.rs wired-leg rebuild failure has the same remove-live-feed-dir shape fixed for gem/nuget/composer — needs its own pass
• requirements.txt extras (pkg[extra]==v) line matching is a recorded TS-parity residual; this PR adds the entry-not-found warning only (same shape as PR fix(hosted): never redirect bundled npm entries; warn on misses #189 for npm)
• NuGet config output bytes change for previously-broken configs — if the TS implementation shares the seed/insert defects it needs the matching fix for byte parity
• scan --prune dry preview remains drift-blind (backends return before wiring replay on dry runs); documented in CLI_CONTRACT.md rather than half-mirrored

Note on CI: hosted-e2e, e2e (windows, safety_cargo), and release-readiness are red on main (traitobject unpublish + npm wrapper lock, PR #234 territory) — failures there are pre-existing and unrelated.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes affect prune/GC, rollback hosted replay, vendor repair, and lockfile migration paths where incorrect behavior can delete or orphan committed patch/vendor state; mitigated by extensive new tests and fail-closed guards.

Overview
This PR tightens socket-patch-cli behavior around garbage collection, diagnostics, and vendor/hosted migrations, and adds a large unit/integration test expansion (the diff is mostly tests pinning contracts).

scan --prune / GC now surfaces drift-kept vendored entries as keptVendoredEntries in apply JSON (plus a human remediation line), documents the preview vs wet difference in CLI_CONTRACT.md, and aborts manifest prune/blob sweep when the manifest is missing or corrupt instead of treating it as empty. Corrupt vendor ledgers no longer drop vendored packages from discovery: scan falls back to manifest + live .socket/vendor/<eco>/<uuid> dirs so prune cannot delete still-vendored state.

User-visible CLI fixes: fetch/apply staging prints hard errors under --silent (only --json suppresses stderr); get --json avoids emitting a second JSON document when the download engine already returned an error envelope; rollback with --ecosystems no longer replays record-less hosted redirect edits for other ecosystems; hosted scan --dry-run previews vendored→hosted takeover through the same revert path and counts those purls as redirected instead of failing against still-vendored locks; repair --vendor moves aside uuid dirs before rebuild and restores them when dispatch fails (instead of leaving ENOENT on wired locks).

Smaller changes: format_patch_option for interactive get selection; overlay_dir copy fallback when hardlink fails (cross-filesystem temps).

^{Reviewed by Cursor Bugbot for commit 9e45492. Configure here.}