The serve rework was sitting untracked: a /proc-based port guard, the
start-or-defer decision, and a stale-bundle rebuild. It had no tests, and it
changed cmd_serve(_config, state) to cmd_serve(argv) without updating the one
test that called it, so the suite was red and coverage was 251 lines short.
Tests, all against fakes:
- _fake_proc builds a synthetic /proc. _NET_TCP is derived from _PROC at
import time, so patch_proc redirects both; patching _PROC alone would have
had these tests parse the host's real process table.
- _serve_guard is split across two test files to stay under the 250-line cap.
os is replaced wholesale in every termination test, so no signal can reach a
real process even if the guard's self-protection were removed.
- _web_build mocks subprocess entirely and redirects every path constant into
tmp_path. _no_subprocess now blocks _web_build.subprocess.run too: an
unguarded test would fire a real `npm run build`, rewriting web/dist and
perturbing frontend_is_stale() for every later test in the run.
Source changes, both required rather than incidental:
- _serve_guard's wildcard match was a `# noqa: S104` on a "0.0.0.0" literal,
which the no-noqa hook rejects outright. It is now the all-zero hex column
/proc actually prints, so the dotted-quad literal never appears.
- main/__init__.py's serve dispatch arm was itself uncovered; it now has a
test asserting the raw argv passes through unparsed.
Also drops the document.hidden guard from useBudgetPoll: it skipped the very
first load, so the budget panel sat on "Reading budget state…" forever in a
background tab, which is every tab under browser automation.
Verified: 1712 python tests, 100% branch coverage; 128 vitest, 100%. The
guard's /proc parser was checked read-only against a real listener on :8000
and resolved the same pid as `ss`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKFzwzwRU1JD7SFLHtQBsz
