Cover run_script and the log stream to restore coverage headroom

[and3rn3t]

Why

The coverage gate is fail_under = 40 and main sits at exactly 40.00%. That is a knife edge: any change adding statements without tests tips it under, and run-to-run variation alone can decide it.

Dependabot #15 hit this. It touches only web/ files, yet its Python job failed:

193 passed
FAIL Required test coverage of 40.0% not reached. Total coverage: 39.95%

The cause is mine: the log-stream rewrite and the secret-key resolver in #17 added statements to api/server.py without adding tests for them.

Lowering the gate would hide that. This covers the two pieces that had none instead.

What is covered

run_script is the subprocess wrapper behind every management endpoint and had no direct coverage, because endpoints that call it mock it out wholesale. The not-found path, the exception path and the timeout handling were never exercised. The timeout matters most: it is what stops a real-sized backup being reported as a failure.

The WebSocket log stream had none either. These tests pin the behaviour the rewrite exists for:

• one follower process no matter how many clients subscribe
• every line fanned out to every subscriber, in order
• blank lines dropped
• the follower stops when the last client leaves
• the child process is reaped on the way out
• a clear error rather than a crash when Docker is absent
• disconnect uses discard, not remove, because a disconnect can arrive for an already-dropped session and must not raise

Result

	before	after
coverage	40.00%	41.98%
tests	193	221

Nearly two points of headroom, from real tests rather than a threshold change.

Note

test_performance.py::test_status_endpoint_performance is timing-based and wobbles under -n auto, passing 3/3 in isolation but occasionally exceeding its 300ms budget under parallel load. Pre-existing, not addressed here.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes are test-only and appear consistent with the current api/server.py behavior while directly addressing the described coverage regression risk.

Review effort: Lite
Findings: None

What changed in this PR

This pull request adds direct unit tests for two previously untested Python components in api/server.py—the run_script subprocess wrapper and the WebSocket-based log streaming follower—to restore and increase overall Python coverage headroom above the 40% gate.

Changes:

• Add a dedicated test suite for run_script, covering not-found, timeout, exception, argument forwarding, and working-directory behavior.
• Add a dedicated test suite for the WebSocket log stream utilities, covering tail retrieval, single-follower behavior, fan-out semantics, blank-line dropping, Docker-missing handling, and safe disconnect cleanup.

File	Description
tests/​api/​test_run_script.py	Adds coverage for run_script timeout/error/argv/cwd behavior.
tests/​api/​test_log_streaming.py	Adds coverage for the SocketIO log tail + shared follower fan-out and disconnect semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.