Tracker: CLI P2 quality (test coverage gaps, MCP schema consistency, maker parallel exec, shared helpers)

[rafeegnash]

Tracker — CLI quality polish

Collected P2 findings from the clanker CLI audit.

Test coverage gaps

• internal/hermes has zero tests despite being the only Python bridge — test the JSON-RPC protocol (request/response round-trip, error envelope, notifications) with a fake stdin/stdout pipe
• internal/iam (security analysis), internal/cloudflare, internal/sre, internal/digitalocean, internal/gcp, internal/hetzner, internal/openclaw all have zero tests
• internal/maker has 7 tests for 46 source files — prioritise handleAWSFailure + classifyAWSFailure with golden AWS error strings

MCP / schema consistency

• Mixed WithInputSchema[T]() (reflection-based) vs WithString/WithBoolean (explicit) across mcp_*.go files. The comment in mcp_linear.go:17-18 says reflection is broken — but mcp_sentry.go:62, mcp_notion.go:23 still use the broken path. Pin a known-good mcp-go version + add an integration test that tools/list schemas are correctly populated

Maker

• Maker ExecutePlan is fully serial (internal/maker/exec.go:406) — add opt-in concurrency via DependsOn graph + topological levels + errgroup. Default stays serial; gate behind ExecOptions.MaxParallel. Big win for 25+ step plans

Hermes

• isHermesDir only checks .venv/bin/python exists (internal/hermes/runner.go:76-79) — partial install lands here and bridge dies on first import pydantic_ai. Also check pyproject.toml / bridge.py / .venv/.installed marker; suggest make setup-hermes on bridge exit with ModuleNotFoundError

Convention

• cmd/notion.go:85-94 derives history key from workspaceName which is only known after the first API call — if GatherAccountStatus fails, history splits across "default" and the real workspace name. Key on Notion bot user ID instead (cached in ~/.clanker/notion-workspace-map.json)
• cmd/config.go:52 TODO — service_keywords removed from default config but routing still expects them. Decide: keep with sensible defaults, or remove the consumer in internal/agent/semantic. Close the TODO

Quality

• resolveAIKeyForProfile + containsAny duplicated across cmd/sentry.go:311-341, cmd/notion.go, cmd/linear.go, cmd/cf.go. Move to internal/ai.ResolveKeyForProfile and internal/util.ContainsAny
• Data race in deploy.intelligence parallel phase-1 (internal/deploy/intelligence.go:295-366) — three goroutines write to deep, deepErr, infraSnap etc. without locking. Convert to errgroup.WithContext with locals captured by closure

Acceptance criteria

Each checkbox = small PR. Close when all are checked.