test-infra: gate clients/web/src/lib/** under the vitest coverage include globs

[cliffhall]

Background

Surfaced during the Wave-1 smoke/audit pass (PRs #1586, #1588, #1592). The web coverage gate does not measure clients/web/src/lib/**.

clients/web/vite.config.ts sets coverage.include to:

src/components/**, src/utils/**, clients/web/server/**, core/**

src/lib/** is not in that list. So the per-file ≥90 gate (npm run test:coverage) silently does not apply to library modules under src/lib, including:

• downloadFile.ts (web: downloadFile.ts enhancements (downloadBlob, fileNameFromUri, isHttpUrl) #1560/feat(web): downloadFile.ts enhancements (downloadBlob, fileNameFromUri, isHttpUrl) #1586) — actual coverage 100/92.3/100/100, but not gate-enforced; its dead ?? "" branch (line ~47) is also unannotated.
• sandbox-csp.ts (web: sandbox CSP builder library (lib/sandbox-csp.ts) #1558/feat(web): add sandbox CSP builder library (closes #1558) #1588) — feat(web): add sandbox CSP builder library (closes #1558) #1588 worked around this by adding only that one file to the include by name, which is why it is gated while its siblings are not.
• environmentFactory.ts, remoteOAuthStorage.ts (Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548/Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1592) — wiring files, currently ungated.

Net: new src/lib code can regress below the four-dimension floor without CI noticing.

Scope

1. Add src/lib/** (or clients/web/src/lib/** matching the existing entries' form) to the coverage.include array in clients/web/vite.config.ts.
2. Fold the file-specific sandbox-csp.{ts,tsx} entry added in feat(web): add sandbox CSP builder library (closes #1558) #1588 back into the glob (remove the now-redundant single-file include).
3. Bring every existing src/lib file up to ≥90 on all four dimensions once gated — add tests where thin, and annotate genuinely-unreachable branches with a justified /* v8 ignore … -- <reason> */ (e.g. downloadFile.ts's String.split(...).pop() ?? "" defensive fallback).
4. Confirm npm run test:coverage (web) stays green with the broadened include.

Acceptance

• src/lib/** is covered by the coverage include; the redundant single-file sandbox-csp entry is gone.
• All current src/lib files clear ≥90 on lines/statements/functions/branches, or carry a justified v8 ignore for provably-dead branches.
• CI's web test:coverage passes with the broadened gate.

Refs: #1560, #1586, #1558, #1588, #1548, #1592, tracking #1579.

[cliffhall]

Smoke test & AGENTS.md audit — PR #1599

Independent verification on a detached checkout of origin/1594-gate-src-lib (base 1579-wave-1), fresh npm install at the repo root, Node v25.9.0.

1. Include change confirmed

git diff origin/1579-wave-1...HEAD -- clients/web/vite.config.ts:

       include: [
         'src/components/**/*.{ts,tsx}',
         'src/utils/**/*.{ts,tsx}',
-        // Pure, fully-tested sandbox CSP builder library. Listed by file (not a
-        // `src/lib/**` glob) so the untested legacy siblings in src/lib are not
-        // pulled under the gate before they have tests of their own.
-        'src/lib/sandbox-csp.{ts,tsx}',
+        'src/lib/**/*.{ts,tsx}',
         'clients/web/server/**/*.{ts,tsx}',

The narrow by-file sandbox-csp entry is replaced by the src/lib/**/*.{ts,tsx} glob. No thresholds were lowered and no exclude entries were added (verified against the same diff).

2. npm run test:coverage — exit 0, all src/lib files at 100%

Per-file coverage rows (all four dims ≥ 90; every one is 100):

File               | % Stmts | % Branch | % Funcs | % Lines |
 clients/web/src/lib|     100 |      100 |     100 |     100 |
  downloadFile.ts   |     100 |      100 |     100 |     100 |
  environmentFactory.ts |  100 |      100 |     100 |     100 |
  remoteOAuthStorage.ts |  100 |      100 |     100 |     100 |
  sandbox-csp.ts    |     100 |      100 |     100 |     100 |
 src/lib/types      |     100 |      100 |     100 |     100 |
  customHeaders.ts  |     100 |      100 |     100 |     100 |

3. Gate is now load-bearing (the point of this PR)

To prove the glob actually catches src/lib regressions (which the old by-file entry would have silently ignored), I temporarily added an untested exported function with many dead branches to src/lib/downloadFile.ts and re-ran the coverage gate.

Before (temporary uncovered branch present): gate FAILS, exit 1

  downloadFile.ts  |    52.5 |    37.93 |   85.71 |   66.66 | 48-57
ERROR: Coverage for lines (66.66%) does not meet global threshold (90%) for src/lib/downloadFile.ts
ERROR: Coverage for functions (85.71%) does not meet global threshold (90%) for src/lib/downloadFile.ts
ERROR: Coverage for statements (52.5%) does not meet global threshold (90%) for src/lib/downloadFile.ts
ERROR: Coverage for branches (37.93%) does not meet global threshold (90%) for src/lib/downloadFile.ts

After (temporary edit reverted): gate PASSES, exit 0, downloadFile.ts back to 100 | 100 | 100 | 100, zero ERROR: Coverage lines.

This demonstrates the include is genuinely enforcing src/lib now — a per-file failure that would previously have gone unmeasured is now caught. The probe was reverted; working tree is clean, no commits.

4. AGENTS.md compliance

• Mantine: N/A — this PR is a vitest config change plus two non-React test files; no components.
• TypeScript: no any types, no eslint-disable / @ts-ignore / @ts-expect-error in the new tests. (The only "any" text is the word inside a customHeaders.test.ts describe-title, not a type.)
• v8 ignore in downloadFile.ts: the single ignore carries a justified one-line reason and is genuinely unreachable — uri.split(/[\\/]/) always returns a non-empty array (even "".split(...) yields [""]), so .pop() is never undefined and the ?? "" fallback cannot execute.
• Real assertions, not padding: environmentFactory.test.ts threads/asserts baseUrl + authToken into all three remote factories, exercises the fetch wrapper's global-receiver delegation, and asserts the BrowserNavigation + OAuth wiring. customHeaders.test.ts asserts concrete input/output for every exported helper (create/bearer/enabled-filter/record round-trip/legacy migration), including trimming and blank-drop edge cases.
• No thresholds lowered, no files excluded to pass — the diff touches only the include list.

Verdict: PASS

The gate demonstrably enforces src/lib now: coverage is 100% across all five files, and an injected uncovered branch flips the gate to a hard per-file failure (exit 1) that the pre-PR by-file include would have missed.

Load-bearing probe (temporary, not committed)

Appended to clients/web/src/lib/downloadFile.ts, ran npm run test:coverage, then reverted with git checkout HEAD -- src/lib/downloadFile.ts:

// TEMPORARY load-bearing-gate probe - untested exported fn. Revert after test.
export function temporaryUncovered(n: number): string {
  if (n === 1) return "a";
  if (n === 2) return "b";
  if (n === 3) return "c";
  if (n === 4) return "d";
  if (n === 5) return "e";
  if (n === 6) return "f";
  if (n === 7) return "g";
  if (n === 8) return "h";
  if (n === 9) return "i";
  return "z";
}

[cliffhall]

🔗 Implemented by PR #1599, merged into the Wave 1 rollup branch 1579-wave-1. GitHub's Development panel doesn't show this link because #1599 targeted a non-default branch. Rollup: #1600 / #1601.