test: cover realGitPath's null-stdout fallback and ratchet the harness coverage floors

[hivecommons-hive]

Test Improvement

tests/helpers-script-sandbox.mjs was the lowest file in the harness coverage row at 97.06% regions, with exactly one uncovered region — the ?? '' in realGitPath:

return (found.stdout ?? '').trim() || '/usr/bin/git';

Its sibling || '/usr/bin/git' is already driven: tests/helpers-script-sandbox-fallbacks.test.mjs reaches it through an empty PATH, so command -v git finds and prints nothing. ?? '' guards a different case — the one spawnSync signals with stdout: null, a process that never started — and the call passes shell: true, so reaching it inline would mean making /bin/sh unspawnable for one call and not for the rest of the file.

This splits the normalisation out as an exported gitPathFromLookup, making the arm a function of the one value spawnSync varies, and drives both fallbacks beside the inputs that skip them ('/usr/local/bin/git\n', '', ' \n', null, undefined). realGitPath keeps its behaviour, and the existing empty-PATH integration test is unchanged and still passes — so the pair is evidence the arm switched, not that the helper was rewritten around it.

The floors this unblocks

That region was load-bearing for the gate. The note in tests/coverage-gate-thresholds.test.mjs held --check-harness-file-regions at 97 "while helpers-script-sandbox.mjs sits at 97.06", and left --check-harness-regions at 97 against a measured 99.57 "until that file has been lifted". It has been, so both follow the measurement up in this same commit, as that file asks:

flag	before	after	bound by
--check-harness-file-regions	97	98	tests/tools/e2e-coverage-report.mjs at 98.57%, whose six remaining regions are the documented-unreachable #1253 fallbacks
--check-harness-regions	97	99	measured 99.63% after the lift

No workflow edit is needed: ci.yml invokes npm run test:unit:coverage:check, so the thresholds live entirely in package.json.

Verification

Measured with TZ=UTC node tests/tools/coverage-report.mjs on node v26.10.0, at 92cede9 before and with this commit after:

• tests/helpers-script-sandbox.mjs: 97.06% → 100.00% regions (lines stay 100.00%)
• harness row: 99.57% (1867/1875) → 99.63% (1870/1877), lines 5336/5336 → 5352/5352
• src row unchanged at 100.00% lines / 100.00% regions (2777/2777)

npm run test:unit:coverage:check passes at the new floors; the full unit suite is green (2376 passed, 0 failed); npx prettier --check is clean on every touched file. The raised floors were confirmed to bite rather than pass vacuously: loosening package.json back to --check-harness-file-regions 97 fails tests/coverage-gate-thresholds.test.mjs.

Related Issue

Closes #1318

---

Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

3e0ddb5

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 3e0ddb56a7c5) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.