test(bundle): drive /meow through dist/index.js against a stubbed cat api

[hivecommons-hive]

Test Improvement

New files only — __tests__/bundle/meow.test.ts and __tests__/bundle/catApiPreload.cjs. No production code, no workflow change, no edit to any existing test file.

Drives the committed dist/index.js on an issue_comment event with prow-commands: /meow (src/issueComment/meow.ts) against fakeGithub.ts plus a local stand-in for api.thecatapi.com. The cat api url is hardcoded in meow.ts, so the child is started with NODE_OPTIONS=--require catApiPreload.cjs: the preload wraps globalThis.fetch and rewrites only the https://api.thecatapi.com origin to CAT_API_URL, passing headers, redirect: 'manual' and the timeout signal through unchanged. The bundle's own retry loop, redirect refusal, core.setSecret masking and url validation are what run.

17 cases:

• /meow → POST issues/1/comments ![cat](<https://cdn2.thecatapi.com/…>) is the only GitHub call: no membership/collaborator read, no post-command sweep; the provider sees accept: application/json and no x-api-key
• cat-api-key: live_secret → reaches the provider as x-api-key and the log carries ::add-mask::live_secret
• 503 then 200 → two provider calls, image posted, no warning
• 500 ×3 → three calls, ::warning::Could not fetch a cat image: Error: cat api responded with 500, comment The cat API is unavailable right now., exit 0
• 429 → one call (no retry on 4xx), same fallback
• 302 with a Location on the stub → exactly one request, the redirect is never followed, fallback
• https://evil.example image url → ::warning::… unexpected host, fallback, exit 0 (one row; the other url checks are unit-tested in meow.test.ts)
• /meow in a fenced block → zero requests to either api, exit 0 (one row; the matcher is unit-tested)
• GitHub answers the comment write with 500 → exit 1, ::error:: error handling issue comment

Verified on main @ c48bd6d, Node v26.10.0:

• npx vitest run __tests__/bundle/meow.test.ts → 9 passed, also from a checkout path containing a space (/tmp/pga q)
• npx eslint __tests__/bundle/meow.test.ts __tests__/bundle/catApiPreload.cjs → clean; npx tsc --noEmit → clean
• unit coverage unchanged (All files 99.83 | 98.35 | 100 | 99.82); e2e hits are not captured in the report ([quality] the bundle e2e suite's coverage of src/ is never captured — runBundle.ts drops NODE_V8_COVERAGE and dist/ has no source map #235)

Disjoint from every open hold-gated PR (#217, #219, #221, #223, #225, #227, #229, #230, #232, #234, #236, #238, #240, #242): #236 edits one line of bundle.test.ts; #238, #240, #242 each add their own new bundle file (collaborationCommands, triggerTestAndLgtmCancel, cronJobsInput); none touch /meow or add a preload.

catApiPreload.cjs fails closed: a cat-api request with CAT_API_URL unset throws instead of reaching the real api. The --require path is quoted in NODE_OPTIONS.

Related Issue

Closes #243

---

Filed by quality agent (hold-gated mode). Human review required.

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

The stubbing approach works and makes no network calls (I verified this in an isolated network namespace). Three things:

1. Quote the path: NODE_OPTIONS: `--require "${preload}"` . Unquoted, it fails with Cannot find module when the checkout path contains a space, and all 17 tests fail.
2. Make catApiPreload.cjs fail closed: throw on a cat-API request when CAT_API_URL is unset, instead of sending it to the real API.
3. Cut the URL-validation (5), not-a-command (4) and s3 cases down to one each; meow.test.ts already covers these pure functions. Keep the retry, 4xx, redirect, key/mask and write-failure cases.

[hivecommons-hive]

Addressed all three: NODE_OPTIONS now carries --require "${preload}" (verified the suite passes from a checkout path with a space); catApiPreload.cjs throws on a cat-api request when CAT_API_URL is unset; the url-validation and not-a-command groups are one case each and the s3 case is gone (pure functions already unit-tested in meow.test.ts). 17 → 9 tests, retry/4xx/redirect/key-mask/write-failure kept. Rebased on main @ a270568.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 13b3917

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

Your three earlier fixes are in: the quoted --require path works from a path containing a space, and the preload fails closed. Two things left:

1. Import repo, token and comment from ./helpers, and get calls from helpersFor(() => gh), instead of the local copies at meow.test.ts L13–14, L56–60 and L93–95.
2. In the write-failure test (L205), check for the cause, errors.some(e => e.includes('could not add comment')), instead of the /error handling issue comment/ prefix.

[hivecommons-hive]

Addressed both: meow.test.ts imports repo, token and comment from ./helpers and takes calls from helpersFor(() => gh) (local copies removed); the write-failure case now asserts the cause, errors.some(e => e.includes('could not add comment')). Rebased on main @ ec76a3b; npx eslint clean, npx vitest run __tests__/bundle/meow.test.ts → 9 pass.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

CI triage for the red build-test on 98a1a04 (run 37149344123): all 80 files / 1608 tests passed; the failure is one unhandled error from the unit __tests__/issueCommentTest/meow.test.ts — assert(err.code !== "ERR_TLS_CERT_ALTNAME_INVALID") inside undici's onHttpSocketError. That file is untouched here; the stray TLS socket comes from msw 3's interceptor passing undici's reconnect through to the real api.thecatapi.com, and it reproduces on main locally. It is a race on whether the error lands before the worker exits, which is why the sibling runs minutes apart were green. Details, repro and proposed fix are in #284.

The bundle /meow suite in this PR runs its own stub and makes no network calls (your namespace check, plus the fail-closed preload). I have merged origin/main (3fc21f2) into the branch since it was behind; no other change.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 22cb375

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

Your asks are addressed and it passes on main. Optional: postedComments() (L82–84) is the same as comments() in triggerTestAndLgtmCancel.test.ts, so it could move into helpersFor.

[jeefy]

/kind cleanup
/lgtm
/approve
/hold cancel

[hivecommons-hive]

🔒 Hold-gate integrity: branch changed while hold-gated — fresh review required

This PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was 0d745536e607, but the branch now sits at 22cb3753b2d3. The diff a reviewer saw under the hold is no longer the diff that would merge, so auto-merge is blocked and the hold label has been re-applied.

Commits not present in the hold-time snapshot (3):

• 88c5c5897ed0 by quality — test(bundle): drive /meow through dist/index.js against a stubbed cat api
• 98a1a0448737 by quality — test(bundle): share repo, token, comment and calls from helpers in the /meow suite
• 22cb3753b2d3 by quality — Merge remote-tracking branch 'origin/main' into quality/test-bundle-meow

A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes.

[jeefy]

/lgtm