[quality] approve.github_review refusal paths in src/plugins/approveReview.ts are unit-covered but never driven through dist/index.js #285

Finding

src/plugins/approveReview.ts (added in #263, merged 2026-10-03) is fully unit-tested but the end-to-end suite only reaches its happy path. The refusal and short-circuit paths of syncApprovalReview and the GET /user failure path of tokenIdentity are never exercised through the shipped dist/index.js:

• createReview answered 422 "not permitted to approve pull requests" → notPermittedWarning (L203–206)
• createReview answered any other 403 → forbiddenWarning (L208–210)
• createReview answered 422 "approve your own pull request" → self-approval warning (L203–205)
• createReview answered any other error → could not submit the approval review, run fails (L212–214)
• token is a user who authored the PR → warning, no review attempted (L185–186)
• draft PR → no review submitted (L173)
• own review already on the head → nothing submitted (L164–165)
• dismissReview refused on /approve cancel → could not dismiss the approval review <id>, run fails (L181–182)
• GET /user answers neither 2xx nor 403/404 → could not identify the token for approve.github_review, run fails (L42)

docs/commands.md ("Mirroring approved as a GitHub review") promises each of these behaviours to users; none is verified against the bundle.

Evidence

• Unit: npx vitest run --coverage on main @ 3fc21f2 (Node v26.10.0, vitest 5.0.1): approveReview.ts 100 % stmts / 100 % branch / 100 % funcs / 100 % lines (1648 tests).
• End-to-end: npm run test:coverage:e2e on main @ 3fc21f2 (the config test(coverage): add test:coverage:e2e to report the bundle suite's coverage of src/ #274 added; 142 tests in __tests__/bundle): approveReview.ts 64.19 % stmts / 52 % branch / 78.57 % funcs / 65.38 % lines; uncovered lines 42, 101, 111, 156–157, 164–165, 173, 181–182, 185–186, 189–190, 203–216, 222, 230 (from the run's lcov.info).
• The two figures are reported separately on purpose (see [quality] the bundle e2e suite's coverage of src/ is never captured — runBundle.ts drops NODE_V8_COVERAGE and dist/ has no source map #235: the vite and tsc+webpack statement maps do not line-merge); the per-line list above is the e2e one.

Recommendation

• Add a bundle suite that drives /approve and /approve cancel through dist/index.js with approve.github_review: true against the fake GitHub, routing POST …/pulls/1/reviews, PUT …/dismissals and GET /user to each refusal above, and asserting the warning / ::error:: text, the exit status and that the approved label write still happens first.

Priority

• Impact: medium (covered by unit tests, not end-to-end; feature merged today — regression risk)
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3fc21f2

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88