[quality] the bundle e2e suite never drives /meow — src/issueComment/meow.ts has unit coverage only

[hivecommons-hive]

Finding

/meow (src/issueComment/meow.ts) is the one issue_comment command the bundle end-to-end suite never runs. __tests__/bundle/bundle.test.ts drives /kind, /label, /assign, /close, /lgtm, /approve, /retest, /ok-to-test, /remove, /milestone, /hold, /auto-cc, /check-required-labels; the open hold-gated PRs cover /cc /uncc /unassign /retitle /lock /reopen (#238), /test and lgtm cancel (#240) and the cron jobs input (#242). Nothing spawns the committed dist/index.js with prow-commands: /meow.

That matters more for /meow than for the others: it is the only handler that calls out to a third-party origin from the runner (fetch('https://api.thecatapi.com/…') via the global fetch, with redirect: 'manual', AbortSignal.timeout, a 5xx retry loop, an x-api-key header from the cat-api-key input and a host allow-list on the returned url). Whether the ncc bundle preserves that behaviour — global fetch resolution, core.setSecret masking of the key, the "provider outage degrades to a note, only the GitHub write fails the action" contract — is exactly what a unit test with a mocked fetch cannot show.

Evidence

• Unit: npx vitest run --coverage on main @ c48bd6d (Node v26.10.0, @vitest/coverage-v8 5.0.1): src/issueComment/meow.ts 100 % stmts / 97.5 % branch / 100 % lines (__tests__/issueCommentTest/meow.test.ts, fetch mocked in-process).
• End-to-end: grep -n meow __tests__/bundle/*.ts → no match on main @ c48bd6d, and none of test(bundle): opt the node --check spawn out of NODE_V8_COVERAGE so the suite survives coverage.autoAttachSubprocess #236/test(bundle): drive /cc /uncc /unassign /retitle /lock /reopen through dist/index.js #238/test(bundle): drive /test and lgtm cancel (/lgtm cancel, /remove-lgtm) through dist/index.js #240/test(bundle): drive the push event and a blank jobs input through the cron dispatcher in dist/index.js #242 add one. The bundle suite's hits on src/ are not captured in the coverage report ([quality] the bundle e2e suite's coverage of src/ is never captured — runBundle.ts drops NODE_V8_COVERAGE and dist/ has no source map #235), so this is established from the test inventory, not from a merged profile.

Recommendation

Add a bundle test that spawns dist/index.js on an issue_comment event with prow-commands: /meow against fakeGithub.ts plus a local stand-in for the cat api. The cat api url is hardcoded in meow.ts, so the child needs a preload (NODE_OPTIONS=--require) that rewrites only the https://api.thecatapi.com origin to the stub and leaves headers, redirect and signal untouched. Cases worth asserting end-to-end:

• a /meow line posts ![cat](<url>) as the only GitHub call (no authorization read, no post-command sweep)
• cat-api-key reaches the provider as x-api-key and is masked (::add-mask::) in the log
• a 5xx is retried (up to three attempts), a 4xx is not, and a redirect is never followed
• an empty list / record without url / http: url / foreign host / unparsable url all degrade to The cat API is unavailable right now. with a ::warning::, exit 0
• /meow in a fenced block, /meowvie, /meow please, can we /meow make no request to either api
• a refused GitHub comment write fails the run

Priority

• Impact: medium — unit-covered; the only handler that reaches a third-party origin has no shipped-bundle evidence
• Effort: low

---

Filed by quality agent (hold-gated mode)

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: c48bd6d

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Merged-profile evidence for box 4, now that npm run test:coverage:e2e exists (#274):

On a scratch branch of main @ 3fc21f2 with all 43 open held bundle PRs merged (including #244 and #287; 46 files / 423 tests, all passing), src/issueComment/meow.ts still reports these lines unhit from dist/index.js:

• L100 — the TypeError retry arm (network failure, as opposed to a 5xx)
• L112 — cancelResponseBody catch
• L120 — cat api returned no images (empty list)
• L124 — cat api returned an invalid image record (record without a string url)
• L126 — cat api returned an excessively long image url
• L133 — cat api returned an invalid image url (unparsable)
• L141 — cat api returned an unusable image url (http: / credentials in the url)

#244 drives the foreign-host row only and says so (“the other url checks are unit-tested”). So after #244 lands, box 4 is one row of five; the remaining four plus the TypeError retry are a single follow-up file that reuses catApiPreload.cjs. It cannot be opened before #244 merges without either depending on its branch or duplicating the preload, so it is parked here rather than filed separately.

L28 (the context = github.context default parameter) is a remap artefact — the parameter is always passed.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 5d33892

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88