test: raise internal-package coverage to 99.8%

Cover the remaining gaps across server, tokens, and tui:

- server: Connect attach-not-ready and port-allocation errors, spawn
  start failure, Stop's kill fallback for SIGINT-ignoring children
  (extracts the hardcoded 8s kill wait into a stopTimeout var, mirroring
  readyTimeout), splitTokenURL's unparseable-URL return, legacyToken's
  probe error, and freePort under fd starvation (unix-only test)
- tokens: concurrent Set/Get/Delete smoke test under -race
- tui: shortenHome arms, welcome cwd line, resource glyphs, /stats
  conditional arms, esc/^R/^O keys, error-event fallback, disconnect
  log-path hint, thinking-enabled submit, step-glyph dedup/cap,
  fetchModels cmd, relayout-not-ready, syncAC query reuse and 6-file
  trim, elapsed minutes, multibyte capThinking, ctxGauge clamps,
  gaugeColor bands, acPopup cmd mode/narrow floor, footer gap floor

The three remaining uncovered blocks are verified-unreachable defensive
branches (json.MarshalIndent of map[string]string, glamour Render with
its fixed config, and a pad guard that cannot fire by construction).

Also gitignore the coverage.out written by `make cover`.

Author: jkyberneees

.gitignore

@@ -1,6 +1,7 @@
 # Build artifacts
 /bin/
 /bodek
+/coverage.out
 
 # Editor / OS noise
 .DS_Store

internal/server/server.go

@@ -24,6 +24,10 @@ const wsTokenCookie = "odek_ws_token"
 // variable so tests can shorten it.
 var readyTimeout = 30 * time.Second
 
+// stopTimeout bounds how long Stop waits for the spawned server's graceful
+// shutdown before killing it. It is a variable so tests can shorten it.
+var stopTimeout = 8 * time.Second
+
 // Conn holds everything needed to talk to an odek serve instance.
 type Conn struct {
 	BaseURL string // http://127.0.0.1:port
@@ -162,7 +166,7 @@ func (c *Conn) Stop() {
 	go func() { _ = c.proc.Wait(); close(done) }()
 	select {
 	case <-done:
-	case <-time.After(8 * time.Second):
+	case <-time.After(stopTimeout):
 		_ = c.proc.Process.Kill()
 	}
 }

internal/server/server_internal_test.go

@@ -63,6 +63,64 @@ func TestSpawnDefaultBinMissing(t *testing.T) {
 	}
 }
 
+func TestConnectURLNotReady(t *testing.T) {
+	// Attaching to a URL whose server never answers must fail after the ready
+	// timeout instead of hanging.
+	old := readyTimeout
+	readyTimeout = 250 * time.Millisecond
+	defer func() { readyTimeout = old }()
+
+	if _, err := Connect(Options{URL: "http://127.0.0.1:1"}); err == nil {
+		t.Error("expected Connect to fail when the attached server is not ready")
+	}
+}
+
+func TestSpawnStartError(t *testing.T) {
+	// A binary that passes LookPath but cannot be exec'd (its shebang points
+	// at a nonexistent interpreter) must surface the cmd.Start error.
+	bin := filepath.Join(t.TempDir(), "odek-fake")
+	if err := os.WriteFile(bin, []byte("#!/nonexistent-interpreter-xyz\n"), 0o755); err != nil {
+		t.Fatalf("write fake odek: %v", err)
+	}
+	c := &Conn{}
+	if err := c.spawn(Options{Bin: bin}, "127.0.0.1:0"); err == nil {
+		t.Error("expected spawn to fail when the binary cannot be started")
+	}
+}
+
+func TestStopKillsLingeringProcess(t *testing.T) {
+	// A server that ignores SIGINT must be force-killed once stopTimeout
+	// elapses. `exec` preserves the ignored-signal disposition, so the sleep
+	// itself ignores SIGINT and Stop falls back to Kill.
+	sh, err := exec.LookPath("sh")
+	if err != nil {
+		t.Skip("no 'sh' binary available")
+	}
+	old := stopTimeout
+	stopTimeout = 200 * time.Millisecond
+	defer func() { stopTimeout = old }()
+
+	// The "ready" line guarantees the trap is installed before SIGINT is sent.
+	c := &Conn{proc: exec.Command(sh, "-c", "trap '' INT; echo ready; exec sleep 30")}
+	stdout, err := c.proc.StdoutPipe()
+	if err != nil {
+		t.Fatalf("stdout pipe: %v", err)
+	}
+	if err := c.proc.Start(); err != nil {
+		t.Fatalf("start: %v", err)
+	}
+	if _, err := io.ReadFull(stdout, make([]byte, len("ready\n"))); err != nil {
+		t.Fatalf("read readiness line: %v", err)
+	}
+	done := make(chan struct{})
+	go func() { c.Stop(); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Stop did not fall back to Kill for a lingering process")
+	}
+}
+
 func TestConnectSpawnNotReady(t *testing.T) {
 	bin, err := exec.LookPath("sleep")
 	if err != nil {

internal/server/server_test.go

@@ -63,6 +63,14 @@ func TestFetchTokenRequestError(t *testing.T) {
 	}
 }
 
+func TestLegacyTokenProbeError(t *testing.T) {
+	// Unreachable server: the cookie fetch fails and the auth-enforcement
+	// probe fails too, so legacyToken returns a hard error.
+	if _, err := legacyToken("http://127.0.0.1:1"); err == nil {
+		t.Error("expected legacyToken probe error to unreachable host")
+	}
+}
+
 func TestConnectViaURL(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.SetCookie(w, &http.Cookie{Name: wsTokenCookie, Value: "tok"})
@@ -171,6 +179,7 @@ func TestSplitTokenURL(t *testing.T) {
 		{"http://127.0.0.1:8080/?token=abc", "http://127.0.0.1:8080/", "abc"},
 		{"http://127.0.0.1:8080", "http://127.0.0.1:8080", ""},
 		{"http://127.0.0.1:8080/?token=a%20b", "http://127.0.0.1:8080/", "a b"},
+		{"\x7f", "\x7f", ""}, // unparseable URL is returned as-is, without a token
 	}
 	for _, tc := range cases {
 		base, token := splitTokenURL(tc.raw)

internal/server/server_unix_test.go

@@ -0,0 +1,55 @@
+//go:build unix
+
+package server
+
+import (
+	"net"
+	"strings"
+	"syscall"
+	"testing"
+)
+
+// TestFreePortFdStarvation exercises the freePort error path — and Connect's
+// "allocate port" branch on top of it — by temporarily clamping RLIMIT_NOFILE
+// so that no new file descriptor can be opened. The soft limit is lowered and
+// then raised back before the test returns, so no other test is affected.
+func TestFreePortFdStarvation(t *testing.T) {
+	// Force netpoller initialization before clamping: it needs a kqueue/epoll
+	// descriptor of its own, and creating one under the clamp is a fatal
+	// runtime error instead of a clean Listen error.
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("warmup listen: %v", err)
+	}
+	_ = l.Close()
+
+	// New descriptors are always allocated at the lowest free number, and
+	// RLIMIT_NOFILE caps exactly that number — clamping the soft limit to the
+	// lowest free descriptor makes every subsequent open fail with EMFILE.
+	lowest := 0
+	var st syscall.Stat_t
+	for lowest < 4096 && syscall.Fstat(lowest, &st) == nil {
+		lowest++
+	}
+	var lim syscall.Rlimit
+	if err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &lim); err != nil {
+		t.Fatalf("getrlimit: %v", err)
+	}
+	restore := lim
+	lim.Cur = uint64(lowest)
+	if err := syscall.Setrlimit(syscall.RLIMIT_NOFILE, &lim); err != nil {
+		t.Fatalf("setrlimit: %v", err)
+	}
+	defer func() {
+		if err := syscall.Setrlimit(syscall.RLIMIT_NOFILE, &restore); err != nil {
+			t.Errorf("restore rlimit: %v", err)
+		}
+	}()
+
+	if _, err := freePort(); err == nil {
+		t.Error("expected freePort to fail with no descriptors available")
+	}
+	if _, err := Connect(Options{}); err == nil || !strings.Contains(err.Error(), "allocate port") {
+		t.Errorf("Connect = %v, want allocate-port error", err)
+	}
+}

internal/tokens/tokens_test.go

@@ -131,6 +131,26 @@ func TestPersistWriteAndRenameErrors(t *testing.T) {
 	s2.Set("k", "v") // WriteFile ok, Rename onto a directory fails
 }
 
+func TestConcurrentAccess(t *testing.T) {
+	// Smoke test for the Store's locking: run with -race to catch data races.
+	s := &Store{m: map[string]string{}}
+	done := make(chan struct{})
+	for i := 0; i < 4; i++ {
+		go func(i int) {
+			defer func() { done <- struct{}{} }()
+			id := string(rune('a' + i))
+			for j := 0; j < 50; j++ {
+				s.Set(id, "tok")
+				_ = s.Get(id)
+				s.Delete(id)
+			}
+		}(i)
+	}
+	for i := 0; i < 4; i++ {
+		<-done
+	}
+}
+
 func TestOpenWithCorruptFile(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("HOME", dir)