Raise repository test coverage above 70%

[robzolkos]

Summary

• add behavioral coverage for OAuth/PKCE, request authentication, refresh/logout, cookie and token login, file/keyring credential storage, and credential migration
• exercise auth, doctor, box, drafts, calendars, recordings, todo, and timetrack command paths against deterministic httptest servers
• add a documented cross-package make coverage target, concise package/function summaries, and an exact 70.8% CI statement-coverage floor

Basecamp card: https://app.basecamp.com/2914079/buckets/48521764/card_tables/cards/10222264778

Coverage

Cross-package command:

GOWORK=off go test ./... \
  -coverpkg=./... \
  -covermode=atomic \
  -coverprofile=coverage.out

Scope	Before (d4dd05c)	After
Repository	65.3% (4,732 / 7,252)	71.5% (5,184 / 7,255; exact 71.454% in CI)
Non-TUI	58.1%	69.1% (2,820 / 4,081)
internal/auth	35.9%	85.5%
internal/cmd	55.3%	65.5%
internal/config	73.2%	73.2%
internal/output	84.5%	84.9%
internal/tui	74.5%	74.5%

Small injectable adapters for the OAuth callback listener/waiter and system keyring preserve the existing defaults while allowing deterministic tests.

Behaviors covered

• OAuth code exchange and refresh request contracts, failures, cancellation, expiry, and RFC 7636 PKCE helpers
• bearer/cookie precedence, automatic and forced refresh, refresh-token rotation/preservation, logout, and failure side effects
• file and keyring credential round trips, fallback, permissions, corrupt files, multi-origin deletion, and migration success/failure
• auth login/status/token/refresh/logout and doctor output
• named, numeric, fallback, limited, and missing box execution
• draft listing, limits, --all, empty state, styled table rendering, truncation, and API failures
• calendar/recording reads, todo mutations/listing, timetrack start/current/stop/list, API errors, validation, and no-request-before-validation

Validation

• GOWORK=off make coverage — 71.468% locally; 71.454% in CI (5,184 / 7,255), floor 70.800%
• GOWORK=off make test — pass
• GOWORK=off make lint — pass
• GOWORK=off make check — pass
• GOWORK=off make race-test — pass
• GOWORK=off go test -race -count=1 ./internal/auth ./internal/cmd — pass
• git diff --check — pass
• independent adversarial review — no blocking/P2 findings; exact-floor precision P3 fixed and revalidated

Next phase

Highest-risk remaining gaps include browser-launch failure handling, habit mutations, fetchNextBoxPage, mutation metadata formatting, and remaining zero-coverage command walkers. The scheduled HTML scraper was intentionally left untouched.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/test.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Adds deterministic auth and command tests, raising repository coverage above 70% and enforcing a 70.8% CI floor.

Changes:

• Expands OAuth, credential-storage, calendar, box, todo, and timetrack tests.
• Adds injectable auth/keyring adapters for deterministic testing.
• Adds coverage reporting, enforcement, CI integration, and documentation.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/test.yml	Enforces coverage in CI.
.gitignore	Ignores coverage artifacts.
Makefile	Adds coverage and cleanup targets.
README.md	Documents coverage usage.
scripts/check-coverage.sh	Enforces the coverage floor.
scripts/coverage-summary.sh	Generates coverage summaries.
internal/auth/auth.go	Adds injectable OAuth callback dependencies.
internal/auth/auth_test.go	Expands manager and callback tests.
internal/auth/oauth_test.go	Tests OAuth requests and PKCE behavior.
internal/auth/store.go	Adds an injectable keyring abstraction.
internal/auth/store_test.go	Expands storage and migration tests.
internal/cmd/auth_commands_test.go	Tests auth and doctor commands.
internal/cmd/box_test.go	Expands box command coverage.
internal/cmd/calendar_commands_test.go	Tests calendar, todo, and timetrack commands.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.