Tests Phase 1: pure unit coverage + CI workflow

[schneik80]

Summary

First of three planned phases bringing this repo from a single layout test (ui/layout_test.go) to a real test suite. Phase 1 covers the L1 layer per the test plan: pure functions, no I/O, no goroutines, no HTTP. Future phases add httptest-mocked integration (Phase 2) and TUI flow tests (Phase 3).

Coverage by package

Package	Coverage	What's covered
config	90.6%	Load precedence (env → file → ldflags), Dir/Path, error paths
auth	27.6%	PKCE verifier/challenge incl. RFC 7636 vector, buildAuthURL shape, TokenData.Valid boundaries, token round-trip + corrupt-file recovery
api	13.2%	SetRegion, navItemFromTypename, parseTime, apiUser.fullName, sanitizeFilename
fusion	27.9%	NormalizeProjectID, validFileID security regression, buildInsertScript JSON round-trip, parseToolErrorText, extractSSEData, OpenDocument/InsertDocument input validation tripwire
ui	24.5%	formatSize boundaries; existing layout_test.go retained
total	23.9%	Phase 2 will lift auth/api/fusion significantly via httptest mocks

Security regression coverage

Three Phase 1 tests deliberately encode the security fixes from the prior PR so a future refactor can't silently undo them:

• TestValidFileID rejects newlines, quotes, slashes, unicode (M2)
• TestOpenDocument_ValidatesInput uses a tripwire endpoint to prove validation runs before dial (M2)
• TestBuildInsertScript_JSONEscaping round-trips the encoded value through json.Unmarshal (M2)

H1 and H2 regression tests live in Phase 2 since they need httptest.Server.

CI

New .github/workflows/test.yml runs go vet, go test -race -count=1 -coverprofile, and prints a coverage summary on every PR and push to main. Makefile check target now matches CI by adding -race.

All tests run in under 4s locally with the race detector on.

Test plan

• make check (vet + race + tests) passes locally
• Manual review of each agent-written file for correctness vs. plan
• Coverage report verified per-package
• Confirm test.yml workflow runs green on this PR

🤖 Generated with Claude Code