test: add coverage tests for local store, schemas, logger, SSE, remote store, and auth

Fills coverage gaps across all targeted files:
- local-store: close(), searchItems with status/includeArchived branches, removeDependency non-existent
- schemas: validate() success and error paths including empty-path fallback
- logger: info/warn/error/debug/trace writes, inode detection, rotation, fstatSync error catches, writeSync error catch
- sse: cleanup when slug no longer in clients map (optional chaining branch)
- remote-store: 409/404 body field fallbacks, searchItems/listItems with includeArchived=false, json() catch on non-ok
- auth: loadApiKeys when file missing or has invalid JSON, migrate-and-continue path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: chapterjason

packages/api/src/__tests__/auth.test.js

@@ -79,6 +79,34 @@ describe("checkRateLimit()", () => {
   });
 });
 
+// ---- loadApiKeys ----
+describe("loadApiKeys()", () => {
+  beforeEach(() => { vi.resetModules(); });
+  afterEach(() => { vi.restoreAllMocks(); });
+
+  it("returns {} when keys file does not exist", async () => {
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      return { ...real, existsSync: () => false };
+    });
+    const { loadApiKeys } = await import("../auth/auth.js");
+    expect(loadApiKeys()).toEqual({});
+  });
+
+  it("returns {} when keys file has invalid JSON", async () => {
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      return {
+        ...real,
+        existsSync: () => true,
+        readFileSync: () => "not-json{{{",
+      };
+    });
+    const { loadApiKeys } = await import("../auth/auth.js");
+    expect(loadApiKeys()).toEqual({});
+  });
+});
+
 // ---- authenticate ----
 describe("authenticate()", () => {
   beforeEach(() => {
@@ -127,6 +155,34 @@ describe("authenticate()", () => {
     expect(slug).toBe("my-project");
   });
 
+  it("migrates a non-matching plaintext key and continues searching", async () => {
+    const writeMock = vi.fn();
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      const otherPlaintextKey = "sk-proj-otherkey";
+      const targetKey = "sk-proj-targetkey";
+      const { createHash } = await import("crypto");
+      const targetHash = createHash("sha256").update(targetKey).digest("hex");
+      // Two entries: one plaintext non-matching, one already-hashed matching
+      const keys = {
+        [otherPlaintextKey]: { slug: "other-project", created: "2024-01-01" },
+        [targetHash]: { slug: "target-project", created: "2024-01-01" },
+      };
+      return {
+        ...real,
+        existsSync: () => true,
+        readFileSync: () => JSON.stringify(keys),
+        mkdirSync: vi.fn(),
+        writeFileSync: writeMock,
+      };
+    });
+    const { authenticate } = await import("../auth/auth.js");
+    const slug = authenticate({ headers: { authorization: "Bearer sk-proj-targetkey" } });
+    expect(slug).toBe("target-project");
+    // writeFileSync should have been called due to migration of otherPlaintextKey
+    expect(writeMock).toHaveBeenCalled();
+  });
+
   it("auto-migrates plaintext key and returns slug", async () => {
     const writeMock = vi.fn();
     vi.doMock("fs", async (importOriginal) => {

packages/core/src/__tests__/local-store.test.js

@@ -169,6 +169,50 @@ describe("LocalStore — comments", () => {
   });
 });
 
+describe("LocalStore — close()", () => {
+  it("closes the database without error", () => {
+    const store = makeStore();
+    expect(() => store.close()).not.toThrow();
+  });
+});
+
+describe("LocalStore — searchItems includeArchived", () => {
+  it("returns archived items when includeArchived=true (default)", () => {
+    const store = makeStore();
+    const item = store.createItem({ title: "Alpha thing" });
+    // Soft-archive by setting status to 'archived' (MCP soft-delete)
+    store.updateItem(item.id, { version: 1, status: "archived" });
+    const results = store.searchItems("thing", null, { includeArchived: true });
+    expect(results.length).toBe(1);
+  });
+
+  it("excludes archived items when includeArchived=false", () => {
+    const store = makeStore();
+    const item = store.createItem({ title: "Beta thing" });
+    store.updateItem(item.id, { version: 1, status: "archived" });
+    const results = store.searchItems("thing", null, { includeArchived: false });
+    expect(results.length).toBe(0);
+  });
+
+  it("filters by status when status is provided", () => {
+    const store = makeStore();
+    store.createItem({ title: "Gamma thing" });
+    const results = store.searchItems("thing", "open");
+    expect(results.length).toBe(1);
+    expect(results[0].status).toBe("open");
+  });
+});
+
+describe("LocalStore — removeDependency nonexistent", () => {
+  it("throws when dependency does not exist", () => {
+    const store = makeStore();
+    const a = store.createItem({ title: "A" });
+    const b = store.createItem({ title: "B" });
+    expect(() => store.removeDependency(b.id, { version: 1, depends_on_id: a.id }))
+      .toThrow(/does not exist/);
+  });
+});
+
 describe("LocalStore — E2E: create → checklist → dependency → conflict → retry", () => {
   it("full workflow", () => {
     const store = makeStore();

packages/core/src/__tests__/logger.test.js

@@ -0,0 +1,226 @@
+import { describe, it, expect, beforeAll, afterAll, vi } from "vitest";
+import { mkdtempSync, readFileSync, existsSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { rmSync } from "fs";
+
+let logDir;
+let logger;
+
+describe("logger — basic writes", () => {
+  beforeAll(async () => {
+    logDir = mkdtempSync(join(tmpdir(), "backlog-logger-test-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = logDir;
+    process.env.LOG_LEVEL = "trace";
+    ({ logger } = await import("../logger.js"));
+  });
+
+  afterAll(() => {
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    try { rmSync(logDir, { recursive: true, force: true }); } catch (_) {}
+  });
+
+  it("logger.info writes a JSON line to the log file", () => {
+    logger.info("test-info-message", { key: "value" });
+    const logFile = join(logDir, "agent-backlog.log");
+    expect(existsSync(logFile)).toBe(true);
+    const content = readFileSync(logFile, "utf8");
+    expect(content).toContain("test-info-message");
+    expect(content).toContain('"level":"info"');
+  });
+
+  it("logger.warn writes a JSON line", () => {
+    logger.warn("test-warn-message");
+    const content = readFileSync(join(logDir, "agent-backlog.log"), "utf8");
+    expect(content).toContain("test-warn-message");
+  });
+
+  it("logger.error writes a JSON line", () => {
+    logger.error("test-error-message");
+    const content = readFileSync(join(logDir, "agent-backlog.log"), "utf8");
+    expect(content).toContain("test-error-message");
+  });
+
+  it("logger.debug writes a JSON line (level=trace allows it)", () => {
+    logger.debug("test-debug-message");
+    const content = readFileSync(join(logDir, "agent-backlog.log"), "utf8");
+    expect(content).toContain("test-debug-message");
+  });
+
+  it("logger.trace writes a JSON line (level=trace allows it)", () => {
+    logger.trace("test-trace-message");
+    const content = readFileSync(join(logDir, "agent-backlog.log"), "utf8");
+    expect(content).toContain("test-trace-message");
+  });
+});
+
+describe("logger — inode detection (checkInode)", () => {
+  it("reopens log file when inode changes (external rotation simulation)", async () => {
+    const inodeDir = mkdtempSync(join(tmpdir(), "backlog-logger-inode-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = inodeDir;
+    process.env.LOG_LEVEL = "info";
+
+    const { logger: inodeLogger } = await import("../logger.js");
+
+    const logFile = join(inodeDir, "agent-backlog.log");
+    inodeLogger.info("before-rotation");
+    expect(existsSync(logFile)).toBe(true);
+
+    // Simulate external rotation: rename the current log file
+    const { renameSync } = await import("fs");
+    renameSync(logFile, `${logFile}.old`);
+
+    // Next write should detect inode mismatch and reopen (creates new file)
+    inodeLogger.info("after-rotation");
+    expect(existsSync(logFile)).toBe(true);
+
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    try { rmSync(inodeDir, { recursive: true, force: true }); } catch (_) {}
+  });
+});
+
+describe("logger — rotation (rotate)", () => {
+  it("rotates log file when it exceeds LOG_MAX_FILE_BYTES", async () => {
+    const rotDir = mkdtempSync(join(tmpdir(), "backlog-logger-rotate-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = rotDir;
+    process.env.LOG_LEVEL = "info";
+
+    // Mock config to set a 1-byte max so rotation triggers immediately
+    vi.doMock("../config/config.js", async (importOriginal) => {
+      const real = await importOriginal();
+      return { ...real, LOG_MAX_FILE_BYTES: 1 };
+    });
+
+    const { logger: rotLogger } = await import("../logger.js");
+    const logFile = join(rotDir, "agent-backlog.log");
+
+    rotLogger.info("first-write-opens-file");
+    expect(existsSync(logFile)).toBe(true);
+
+    // Second write: file is now >= 1 byte, so rotation triggers
+    rotLogger.info("second-write-triggers-rotation");
+
+    expect(existsSync(`${logFile}.1`)).toBe(true);
+
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    vi.restoreAllMocks();
+    try { rmSync(rotDir, { recursive: true, force: true }); } catch (_) {}
+  });
+});
+
+describe("logger — checkInode fstatSync error (outer catch)", () => {
+  it("handles fstatSync throwing in checkInode", async () => {
+    const catchDir = mkdtempSync(join(tmpdir(), "backlog-logger-catch-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = catchDir;
+    process.env.LOG_LEVEL = "info";
+
+    let fstatCallCount = 0;
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      return {
+        ...real,
+        fstatSync: (...args) => {
+          fstatCallCount++;
+          // write() calls checkInode then rotate, each calls fstatSync once.
+          // First write: checkInode=call1, rotate=call2
+          // Second write: checkInode=call3 <- throw here to hit outer catch
+          if (fstatCallCount === 3) throw new Error("mock-fstat-failure");
+          return real.fstatSync(...args);
+        },
+      };
+    });
+
+    const { logger: catchLogger } = await import("../logger.js");
+    const stderrSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    catchLogger.info("first-opens-file");
+    // second write: checkInode's fstatSync will throw, triggering outer catch
+    catchLogger.info("second-triggers-inode-check");
+
+    expect(stderrSpy).toHaveBeenCalledWith("logger:inode-check-error", "mock-fstat-failure");
+
+    stderrSpy.mockRestore();
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    vi.restoreAllMocks();
+    try { rmSync(catchDir, { recursive: true, force: true }); } catch (_) {}
+  });
+});
+
+describe("logger — rotate fstatSync error (rotate catch)", () => {
+  it("handles fstatSync throwing in rotate", async () => {
+    const rotCatchDir = mkdtempSync(join(tmpdir(), "backlog-logger-rotcatch-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = rotCatchDir;
+    process.env.LOG_LEVEL = "info";
+
+    let fstatCallCount = 0;
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      return {
+        ...real,
+        fstatSync: (...args) => {
+          fstatCallCount++;
+          // write() calls checkInode then rotate, each calls fstatSync once.
+          // First write: checkInode=call1, rotate=call2
+          // Second write: checkInode=call3, rotate=call4 <- throw here
+          if (fstatCallCount === 4) throw new Error("mock-rotate-fstat-failure");
+          return real.fstatSync(...args);
+        },
+      };
+    });
+
+    const { logger: rotCatchLogger } = await import("../logger.js");
+    const stderrSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    rotCatchLogger.info("first-opens-file");
+    // second write triggers rotate, which calls fstatSync and throws
+    rotCatchLogger.info("second-triggers-rotate-error");
+
+    expect(stderrSpy).toHaveBeenCalledWith("logger:fstat-error", "mock-rotate-fstat-failure");
+
+    stderrSpy.mockRestore();
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    vi.restoreAllMocks();
+    try { rmSync(rotCatchDir, { recursive: true, force: true }); } catch (_) {}
+  });
+});
+
+describe("logger — write error catch", () => {
+  it("logs to stderr instead of throwing when writeSync fails", async () => {
+    const errDir = mkdtempSync(join(tmpdir(), "backlog-logger-err-"));
+    vi.resetModules();
+    process.env.BACKLOG_LOG_DIR = errDir;
+    process.env.LOG_LEVEL = "info";
+
+    // Mock fs to make writeSync throw
+    vi.doMock("fs", async (importOriginal) => {
+      const real = await importOriginal();
+      return {
+        ...real,
+        writeSync: () => { throw new Error("mock-write-failure"); },
+      };
+    });
+
+    const { logger: errLogger } = await import("../logger.js");
+    const stderrSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+
+    // Should not throw; error is caught and logged to stderr
+    expect(() => errLogger.info("write-will-fail")).not.toThrow();
+    expect(stderrSpy).toHaveBeenCalledWith("logger:write-error", "mock-write-failure");
+
+    stderrSpy.mockRestore();
+    delete process.env.BACKLOG_LOG_DIR;
+    delete process.env.LOG_LEVEL;
+    vi.restoreAllMocks();
+    try { rmSync(errDir, { recursive: true, force: true }); } catch (_) {}
+  });
+});