New table-driven tests raise branch coverage on
SplitTrailingProviderToolNamePrefix and the JSON and plain function
tool-call leak-index helpers, covering empty content, no-alnum tails,
prefix-hold versus pass-through and regex no-match paths. Test-only.
New table-driven tests raise branch coverage on ContextWindowTokens,
extractModelName, isDigits, rateLimitInfo, normalizeOpenAICompatibleChatURL,
stop-reason normalization and the OpenAI, Anthropic and Gemini tool-choice
converters, covering date-suffix stripping, malformed URLs and default arms.
Test-only, no source changes.
New table-driven tests raise branch coverage on the timeout, curl/wget,
env and recovery-point canonicalization helpers in internal/ai/tools,
exercising previously uncovered flag-parsing arms, mutation-method
detection and numeric-detail type cases. Test-only, no source changes.
New white-box table tests over the pure resource-resolution helpers in
internal/ai/tools/current_resource.go, taking canonicalQueryTypeForResolvedResource,
canonicalQueryIDForResolvedResource and resolvedResourceKindMatchesLocation from
partial to full branch coverage. Every kind switch arm, the provider-uid then
resource-id then alias fallback chain, and the nil guards are pinned to exact
output.
One file, tests only, no source changes. Gates green with go test, gofmt and go
vet, plus an adversarial GLM review scoring three KEEP and zero reject.
New white-box table tests over the pure error classifiers in
internal/ai/patrol_runtime_failure.go, taking ClassifyProviderConnectionFailure
from 18 percent to full coverage and closing the residual branches in
patrolRuntimeFailureFromError and summarizePatrolRuntimeFailureDetail. Every
reachable switch arm is pinned to its exact diagnostic output, and the four
grouped causes that only preflight and readiness state can set are documented
as out of reach from a plain error input rather than faked.
One file, tests only, no source changes. Gates green with go test, gofmt and
go vet, plus an adversarial GLM review scoring two KEEP, one WEAK and zero
reject.
New white-box table tests over the pure validators, predicates and readme
renderer in internal/ai/qualification/contribution.go, covering
ValidateContributionChallenge, validateContributionIdentity,
everyRunChallengeBound, observationsPassedOrEmpty, reportPhasePassed,
ContributionBundle.Validate and renderContributionReadme.
One file, tests only, no source changes. Gates green with go test, gofmt
and go vet, plus an adversarial GLM review scoring seven KEEP and zero
reject.
New white-box table tests over previously-untested pure functions in
internal/ai (patrol run recency, patrol findings JSON validation),
internal/ai/tools (read-only violation hints, VM config parsing, node
target matching), internal/ai/qualification (compare predicate,
percentile and model summary, runner helpers), internal/ai/chat
(investigation run error, session compaction formatting) and
internal/agentcapabilities (path parameter substitution, markdown
helpers).
Twelve files, tests only, no source changes. All gates green with go
test, gofmt and go vet, plus an adversarial GLM review scoring twelve
KEEP and zero reject.
Fleets on networks numbered from nominally public IP space (issue
#1522: an AD estate on 192.20.0.0/16) cannot pass the agent's
local-network plaintext heuristic, and the only workaround was pointing
a .internal DNS alias at the server, which bypasses the same control
less visibly than a flag would. --allow-plaintext-http
(PULSE_AGENT_ALLOW_PLAINTEXT_HTTP) records process-wide consent once at
agent startup before any module validates a URL, covers every agent
transport including the websocket command channel, warns at startup
that the API token travels in cleartext, defaults closed, and is never
emitted by generated install commands or settable by the server.
