Add comprehensive test suite

[Quiterion]

Summary

Adds a comprehensive automated test suite across the entire backend, achieving 87.66% statement and 78.92% branch coverage. This provides a regression safety net for future future changes.

• 2,469 tests across 56 test files, all passing
• No source code modifications — all tests are characterization tests capturing existing behavior
• CI workflow added to run tests with coverage reporting on every PR

What's covered

Area	Stmts	Branches	Highlights
Config	98.6%	93.8%	loader, model-loader, site-config-loader
Database	89.3%	75.5%	index.ts (5400 lines), all sub-stores, compaction, migration
Middleware	100%	100%	auth
Routes	82.4%	76.1%	All 18 route files tested
Services	93.1%	85.1%	All 5 AI providers (93-99%), inference, enhanced-inference, context manager
WebSocket	94.5%	80.0%	handler, room-manager

Test plan

• All 2,469 backend tests pass
• Frontend store tests pass (129 tests)
• Coverage targets met (75%+ stmts and branches)

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds a comprehensive test suite achieving 87.66% statement and 78.92% branch coverage across 2,469 tests in 56 test files. The tests are characterization tests that capture existing behavior without modifying any source code.

Major additions:

• CI workflow (.github/workflows/test.yml) runs tests with coverage on every PR
• Complete backend test coverage across all routes, services, database operations, and WebSocket functionality
• Frontend store tests with proper mocking of external dependencies
• Shared type validation tests ensuring Zod schema correctness
• Test infrastructure using Vitest with isolated database setup via temporary directories and process.chdir
• Documentation in CLAUDE.md for testing commands and workflows

Test quality highlights:

• Proper test isolation using temp directories and cleanup
• Comprehensive mocking of external services (AI providers, sharp, AWS SDK)
• Integration tests using real database instances with supertest for HTTP testing
• Edge case coverage including security scenarios (tampered JWT tokens, invalid inputs)
• Large test files indicate thorough coverage (e.g., 5453 lines for WebSocket handler, 2158 for Anthropic service)

Coverage areas:

• Config loaders: 98.6% statements
• Database operations: 89.3% statements including the massive 5400-line index.ts
• All 18 route files tested with realistic scenarios
• All 5 AI provider services at 93-99% coverage
• WebSocket streaming and room management: 94.5% statements

Confidence Score: 5/5

• This PR is safe to merge with very high confidence - it only adds tests and CI configuration without modifying any production code
• Score of 5/5 because: (1) Zero production code changes - all additions are test files, test configuration, and documentation, (2) Tests follow best practices with proper isolation, mocking, and cleanup, (3) CI workflow is well-configured with appropriate Node version pinning and coverage reporting, (4) Test infrastructure uses established patterns (Vitest, supertest, temp directories for isolation), (5) Comprehensive coverage across all critical systems reduces regression risk for future changes
• No files require special attention - all test infrastructure and configuration files are well-implemented

Important Files Changed

Filename	Overview
.github/workflows/test.yml	Adds CI workflow to run tests with coverage reporting on PRs - well-configured with proper workspace builds and coverage thresholds
deprecated-claude-app/backend/src/routes/test-helpers.ts	Test infrastructure with isolated database setup using temp directories and process.chdir for complete isolation
deprecated-claude-app/backend/src/services/anthropic.test.ts	Extensive Anthropic service tests (2158 lines) with proper mocking and comprehensive coverage of message formatting and attachments
deprecated-claude-app/backend/src/services/inference.test.ts	Large inference orchestration test suite (2038 lines) testing multi-provider routing and context management
deprecated-claude-app/backend/src/websocket/handler.test.ts	Massive WebSocket handler test suite (5453 lines) covering streaming, room management, and message routing
deprecated-claude-app/frontend/src/store/index.test.ts	Frontend store tests (1882 lines) with proper mocking of localStorage, API, and WebSocket services
CLAUDE.md	New documentation file providing comprehensive guidance for working with the codebase including testing commands

[Meganeuridae]

Read through this carefully and wanted to share findings + a recommendation. Short version: the test suite is genuinely good and worth merging, with one realistic caveat — it was authored against a Feb 2026 snapshot of main and a chunk of the assertions now capture previous behavior that intentional changes have since superseded.

What's solid

• Vitest + @vitest/coverage-v8 — right tool for an ESM TS monorepo. Per-workspace config plus a root project config that aggregates is the clean shape.
• test-helpers.ts design — createTestApp() spins up a real Database backed by a per-test temp dir, mounts the actual routers, exposes a supertest agent. That means tests catch real persistence + wiring bugs, not just mock-shape regressions. cleanupTestApp properly restores cwd and removes the temp dir.
• CI workflow runs on PRs with coverage targets (75% stmts + branches) and a markdown summary. The targets are visible in the GitHub Actions summary tab on every PR — much better than coverage-as-vibes.
• Coverage breadth — middleware 100%, services 93–99% per-provider, routes 82.4%. Test types are characterization-style (lock down observed behavior) which is the right call for a codebase without prior tests: it gives a regression net first, leaves spec-style "tests as documented intent" as a separate later effort.
• No source modifications — the PR description's claim holds; the test suite is purely additive against src/.
• CLAUDE.md is also a nice add — an accurate architectural overview that helps any Claude instance working on the repo orient quickly.

Merge state

I rebased onto current main in a local sandbox to assess. Conflicts:

• backend/package.json — Quiterion's branch removes express-rate-limit and import:claude-archive (those landed later in main). The resolution is mechanical: keep main's deps + script, add Quiterion's test deps + scripts.
• package-lock.json — derived; resolved by npm install after fixing package.json.

The other 69 files apply clean — no source-code conflicts at all.

What the test suite catches: 45 failures, 2402 passes

After merging onto current main and running JWT_SECRET=… NODE_ENV=test npx vitest run:

Test Files  11 failed | 45 passed (56)
Tests       45 failed | 2402 passed | 22 skipped (2469)

97.3% of the suite still captures valid behavior. Every failure I recognized traces to a PR that landed after this branch was cut:

Failing test cluster	Caused by	Resolution
services/anthropic.test.ts, bedrock.test.ts, context-strategies.test.ts — "does NOT recognize gif as image"	PR #90 (uniform GIF support across providers)	Update assertions: gif IS now recognized
database/collaboration.test.ts, shares.test.ts — token shape/length asserts	PR #92 (token entropy bumped 48-bit → 128-bit)	Update length expectations
services/enhanced-inference.test.ts, gemini.test.ts — usage shape, NaN-defaults	PR #104 (four-channel cost tracking)	Update usage-shape fixtures
utils/encryption.test.ts — "uses a default key when JWT_SECRET is unset"	PR #91 (JWT_SECRET strict)	Test the new throw-on-unset behavior
routes/auth.test.ts — Grant Mint/Send, Forgot/Resend/Verify, Registration	Multiple auth-flow PRs	Re-snapshot against current responses
routes/conversations.test.ts — non-owner permission rejections, admin compact	Permission changes since	Re-snapshot rejection paths
websocket/handler.test.ts — handles join_room, broadcasts typing event	handler.ts churn	Investigate (could be intentional, could be a regression)

The pattern is what characterization tests are supposed to do: surface behavior changes between snapshots. None of the failures I traced look like regressions — they look like "main legitimately moved and the snapshot needs refreshing," with the possible exception of the websocket handler ones, which I'd want to look at individually before assuming intentional.

One small concern in test-helpers.ts

createTestApp() uses process.chdir() to position Database init against the per-test temp dir. That's a process-global side effect — if two tests' createTestApp() calls interleave (vitest can parallelize), they'll race on cwd and one Database may end up rooted in the wrong temp dir. Easy fix would be passing a base path into Database directly (one-line API change), or restricting test-file concurrency with a vitest config option. Not blocking; flagging because it's the kind of thing that would produce flaky failures rather than consistent ones.

Suggested path forward

Three options ranging from most-Quiterion-effort to most-already-done:

1. Rebase + Quiterion refreshes the 45 failing tests. Cleanest, preserves their authorship.
2. Rebase + I do the test refresh as a follow-up commit on this branch. Faster to merge; I have direct context on most of the changes that broke each test (several were my PRs). I'd push and Quiterion + Antra would review.
3. Merge as-is, fix failures in a follow-up PR. Worst — would let CI ship in a state where the test job is red on every PR until One-on-one chats switch model names for past messages when model is switched #2 lands, defeating the point.

My instinct is (2) — I introduced or shipped many of the post-Feb changes that broke the tests, so I can both rebase and update the assertions with high confidence about whether each new behavior is intentional vs a regression worth flagging. I'd then post a per-test summary on the rebase commit so Quiterion + Antra can sanity-check the intent calls. Happy to defer to either of you if you'd rather a different shape.

Either way: thanks for building this. It's a lot of careful work and the design is the right shape for the codebase.

[Meganeuridae]

Followed through on Option 2 from the earlier review: rebased onto current main and refreshed the 45 assertions broken by intentional behavior changes since the Feb 2026 snapshot. All 3057 tests pass (backend 2468 + frontend 322 + shared 267, 100% green).

New PR: #112

Each refresh commit there carries per-test intent-tagging — which PR changed the assertion, whether the new behavior is intentional, and why the test update is the right move. Full Co-Authored-By attribution to @Quiterion preserved on every commit (the framework, design, and 2,469 tests are all yours).

Once #112 lands, #69 can close.