test: close ≥90% per-file coverage gaps for mid-session auth

The mid-session auth work passed `validate`/CI but failed the local-only
`npm run test:coverage` per-file gate (≥90% lines/statements/functions/
branches) on 12 files. Add targeted unit/integration tests so every changed
file clears the gate; annotate provably-dead defensive branches with justified
`/* v8 ignore */` comments rather than relaxing the gate.

Files brought to ≥90 on all four dimensions:
- core/auth: mcpAuth, oauthUx, utils, challenge, node/runner-interactive-oauth
- core/mcp: oauthManager, inspectorClient, node/authChallengeFetch,
  remote/remoteClientTransport, remote/node/{remote-session,server}
- clients/web/src/utils: oauthResume, browserTabVisibility

`npm run test:coverage` now passes (3575 tests, 0 threshold failures);
`npm run validate` green across all four clients.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DZyeWManYTvcXxjcrhxSQc

clients/web/src/utils/browserTabVisibility.test.ts

@@ -41,4 +41,83 @@ describe("browserTabVisibility", () => {
     handler!();
     expect(callback).toHaveBeenCalledOnce();
   });
+
+  it("returned unsubscribe removes the visibilitychange listener", () => {
+    let handler: (() => void) | undefined;
+    vi.mocked(document.addEventListener).mockImplementation((_event, fn) => {
+      handler = fn as () => void;
+    });
+
+    const callback = vi.fn();
+    const unsubscribe = onBrowserTabVisible(callback);
+    expect(handler).toBeDefined();
+
+    unsubscribe();
+    expect(document.removeEventListener).toHaveBeenCalledWith(
+      "visibilitychange",
+      handler,
+    );
+
+    // After unsubscribing the stored handler must no longer fire the callback
+    // through the (now removed) listener path.
+    vi.mocked(document.addEventListener).mockClear();
+    expect(document.addEventListener).not.toHaveBeenCalled();
+  });
+
+  it("integrates with a real document: dispatch, hidden/visible, and unsubscribe", () => {
+    vi.unstubAllGlobals();
+    const original = Object.getOwnPropertyDescriptor(
+      Document.prototype,
+      "visibilityState",
+    );
+    const setVisibility = (value: string): void => {
+      Object.defineProperty(document, "visibilityState", {
+        configurable: true,
+        get: () => value,
+      });
+    };
+
+    try {
+      setVisibility("visible");
+      expect(isBrowserTabVisible()).toBe(true);
+
+      const callback = vi.fn();
+      const unsubscribe = onBrowserTabVisible(callback);
+
+      // Hidden branch: listener fires but callback is not invoked.
+      setVisibility("hidden");
+      document.dispatchEvent(new Event("visibilitychange"));
+      expect(callback).not.toHaveBeenCalled();
+      expect(isBrowserTabVisible()).toBe(false);
+
+      // Visible branch: callback invoked.
+      setVisibility("visible");
+      document.dispatchEvent(new Event("visibilitychange"));
+      expect(callback).toHaveBeenCalledOnce();
+
+      // Unsubscribe: further events must not re-invoke the callback.
+      unsubscribe();
+      document.dispatchEvent(new Event("visibilitychange"));
+      expect(callback).toHaveBeenCalledOnce();
+    } finally {
+      if (original) {
+        Object.defineProperty(document, "visibilityState", original);
+      } else {
+        delete (document as { visibilityState?: string }).visibilityState;
+      }
+    }
+  });
+
+  it("no-ops safely when document is undefined (SSR guard)", () => {
+    vi.stubGlobal("document", undefined);
+
+    expect(isBrowserTabVisible()).toBe(false);
+
+    const callback = vi.fn();
+    const unsubscribe = onBrowserTabVisible(callback);
+    expect(typeof unsubscribe).toBe("function");
+    // The returned no-op must be callable without throwing.
+    expect(() => unsubscribe()).not.toThrow();
+    expect(callback).not.toHaveBeenCalled();
+  });
 });

clients/web/src/utils/oauthResume.test.ts

@@ -7,6 +7,7 @@ import {
   oauthResumeInsufficientScopeMessage,
   oauthResumeToastMessage,
   OAUTH_PENDING_SERVER_KEY,
+  OAUTH_RESUME_KEY,
   readOAuthResumeSnapshot,
   restoreTabUiFromSnapshot,
   writeOAuthResumeSnapshot,
@@ -222,4 +223,273 @@ describe("oauthResume", () => {
     expect(clearGetPromptState).toHaveBeenCalledOnce();
     expect(clearReadResourceState).toHaveBeenCalledOnce();
   });
+
+  it("readOAuthResumeSnapshot returns undefined for a non-JSON string", () => {
+    storage.set(OAUTH_RESUME_KEY, "not-json{");
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot returns undefined when parsed JSON is null", () => {
+    storage.set(OAUTH_RESUME_KEY, "null");
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot rejects a wrong version", () => {
+    storage.set(
+      OAUTH_RESUME_KEY,
+      JSON.stringify({
+        version: 2,
+        serverId: "srv-1",
+        activeTab: "Tools",
+        authKind: "reauth",
+        tabUi: {},
+      }),
+    );
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot rejects a non-string serverId", () => {
+    storage.set(
+      OAUTH_RESUME_KEY,
+      JSON.stringify({
+        version: 1,
+        serverId: 42,
+        activeTab: "Tools",
+        authKind: "reauth",
+        tabUi: {},
+      }),
+    );
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot rejects an unknown authKind", () => {
+    storage.set(
+      OAUTH_RESUME_KEY,
+      JSON.stringify({
+        version: 1,
+        serverId: "srv-1",
+        activeTab: "Tools",
+        authKind: "bogus",
+        tabUi: {},
+      }),
+    );
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot rejects a non-string activeTab", () => {
+    storage.set(
+      OAUTH_RESUME_KEY,
+      JSON.stringify({
+        version: 1,
+        serverId: "srv-1",
+        activeTab: 7,
+        authKind: "reauth",
+        tabUi: {},
+      }),
+    );
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot accepts a snapshot with tabUi absent", () => {
+    storage.set(
+      OAUTH_RESUME_KEY,
+      JSON.stringify({
+        version: 1,
+        serverId: "srv-1",
+        activeTab: "Tools",
+        authKind: "reauth",
+      }),
+    );
+    const snapshot = readOAuthResumeSnapshot();
+    expect(snapshot?.serverId).toBe("srv-1");
+    expect(snapshot?.tabUi).toBeUndefined();
+  });
+
+  it("readOAuthResumeSnapshot rejects non-object tabUi (string, array, null)", () => {
+    for (const tabUi of ['"nope"', "[]", "null"]) {
+      storage.set(
+        OAUTH_RESUME_KEY,
+        `{"version":1,"serverId":"srv-1","activeTab":"Tools","authKind":"reauth","tabUi":${tabUi}}`,
+      );
+      expect(readOAuthResumeSnapshot()).toBeUndefined();
+    }
+  });
+
+  it("writeOAuthResumeSnapshot swallows setItem failures", () => {
+    vi.stubGlobal("sessionStorage", {
+      getItem: () => null,
+      setItem: () => {
+        throw new Error("quota exceeded");
+      },
+      removeItem: () => {},
+    });
+    expect(() =>
+      writeOAuthResumeSnapshot({
+        version: 1,
+        serverId: "srv-1",
+        activeTab: "Tools",
+        authKind: "reauth",
+        tabUi: {},
+      }),
+    ).not.toThrow();
+  });
+
+  it("clearOAuthResumeSnapshot swallows removeItem failures", () => {
+    vi.stubGlobal("sessionStorage", {
+      getItem: () => null,
+      setItem: () => {},
+      removeItem: () => {
+        throw new Error("blocked");
+      },
+    });
+    expect(() => clearOAuthResumeSnapshot()).not.toThrow();
+  });
+
+  it("legacy fallback returns undefined when the pending-key read throws", () => {
+    vi.stubGlobal("sessionStorage", {
+      getItem: (key: string) => {
+        if (key === OAUTH_PENDING_SERVER_KEY) {
+          throw new Error("blocked");
+        }
+        return null;
+      },
+      setItem: () => {},
+      removeItem: () => {},
+    });
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  it("legacy fallback returns undefined when no pending server is stored", () => {
+    expect(readOAuthResumeSnapshot()).toBeUndefined();
+  });
+
+  describe("without a window global", () => {
+    beforeEach(() => {
+      vi.stubGlobal("window", undefined);
+    });
+
+    it("writeOAuthResumeSnapshot is a no-op", () => {
+      expect(() =>
+        writeOAuthResumeSnapshot({
+          version: 1,
+          serverId: "srv-1",
+          activeTab: "Tools",
+          authKind: "reauth",
+          tabUi: {},
+        }),
+      ).not.toThrow();
+      expect(storage.size).toBe(0);
+    });
+
+    it("readOAuthResumeSnapshot returns undefined", () => {
+      expect(readOAuthResumeSnapshot()).toBeUndefined();
+    });
+
+    it("clearOAuthResumeSnapshot is a no-op", () => {
+      expect(() => clearOAuthResumeSnapshot()).not.toThrow();
+    });
+  });
+
+  it("restoreTabUiFromSnapshot returns early when tabUi is undefined", () => {
+    const setToolsUi = vi.fn();
+    restoreTabUiFromSnapshot(undefined, {
+      setToolsUi,
+      setPromptsUi: vi.fn(),
+      setResourcesUi: vi.fn(),
+      setAppsUi: vi.fn(),
+      setTasksUi: vi.fn(),
+      setLogsUi: vi.fn(),
+      setHistoryUi: vi.fn(),
+      setNetworkUi: vi.fn(),
+    });
+    expect(setToolsUi).not.toHaveBeenCalled();
+  });
+
+  it("restoreTabUiFromSnapshot skips keys that are not inspector tabs", () => {
+    const setters = {
+      setToolsUi: vi.fn(),
+      setPromptsUi: vi.fn(),
+      setResourcesUi: vi.fn(),
+      setAppsUi: vi.fn(),
+      setTasksUi: vi.fn(),
+      setLogsUi: vi.fn(),
+      setHistoryUi: vi.fn(),
+      setNetworkUi: vi.fn(),
+    };
+    restoreTabUiFromSnapshot(
+      { NotATab: {} } as Record<string, unknown>,
+      setters,
+    );
+    for (const setter of Object.values(setters)) {
+      expect(setter).not.toHaveBeenCalled();
+    }
+  });
+
+  it("restoreTabUiFromSnapshot restores every tab with a present value", () => {
+    const setters = {
+      setToolsUi: vi.fn(),
+      setPromptsUi: vi.fn(),
+      setResourcesUi: vi.fn(),
+      setAppsUi: vi.fn(),
+      setTasksUi: vi.fn(),
+      setLogsUi: vi.fn(),
+      setHistoryUi: vi.fn(),
+      setNetworkUi: vi.fn(),
+    };
+    restoreTabUiFromSnapshot(
+      {
+        Tools: EMPTY_TOOLS_UI,
+        Prompts: EMPTY_PROMPTS_UI,
+        Resources: EMPTY_RESOURCES_UI,
+        Apps: EMPTY_APPS_UI,
+        Tasks: EMPTY_TASKS_UI,
+        Logs: EMPTY_LOGS_UI,
+        History: EMPTY_HISTORY_UI,
+        Network: EMPTY_NETWORK_UI,
+      },
+      setters,
+    );
+    expect(setters.setToolsUi).toHaveBeenCalledWith(EMPTY_TOOLS_UI);
+    expect(setters.setPromptsUi).toHaveBeenCalledWith(EMPTY_PROMPTS_UI);
+    expect(setters.setResourcesUi).toHaveBeenCalledWith(EMPTY_RESOURCES_UI);
+    expect(setters.setAppsUi).toHaveBeenCalledWith(EMPTY_APPS_UI);
+    expect(setters.setTasksUi).toHaveBeenCalledWith(EMPTY_TASKS_UI);
+    expect(setters.setLogsUi).toHaveBeenCalledWith(EMPTY_LOGS_UI);
+    expect(setters.setHistoryUi).toHaveBeenCalledWith(EMPTY_HISTORY_UI);
+    expect(setters.setNetworkUi).toHaveBeenCalledWith(EMPTY_NETWORK_UI);
+  });
+
+  it("restoreTabUiFromSnapshot falls back to EMPTY state for undefined tab values", () => {
+    const setters = {
+      setToolsUi: vi.fn(),
+      setPromptsUi: vi.fn(),
+      setResourcesUi: vi.fn(),
+      setAppsUi: vi.fn(),
+      setTasksUi: vi.fn(),
+      setLogsUi: vi.fn(),
+      setHistoryUi: vi.fn(),
+      setNetworkUi: vi.fn(),
+    };
+    restoreTabUiFromSnapshot(
+      {
+        Tools: undefined,
+        Prompts: undefined,
+        Resources: undefined,
+        Apps: undefined,
+        Tasks: undefined,
+        Logs: undefined,
+        History: undefined,
+        Network: undefined,
+      },
+      setters,
+    );
+    expect(setters.setToolsUi).toHaveBeenCalledWith(EMPTY_TOOLS_UI);
+    expect(setters.setPromptsUi).toHaveBeenCalledWith(EMPTY_PROMPTS_UI);
+    expect(setters.setResourcesUi).toHaveBeenCalledWith(EMPTY_RESOURCES_UI);
+    expect(setters.setAppsUi).toHaveBeenCalledWith(EMPTY_APPS_UI);
+    expect(setters.setTasksUi).toHaveBeenCalledWith(EMPTY_TASKS_UI);
+    expect(setters.setLogsUi).toHaveBeenCalledWith(EMPTY_LOGS_UI);
+    expect(setters.setHistoryUi).toHaveBeenCalledWith(EMPTY_HISTORY_UI);
+    expect(setters.setNetworkUi).toHaveBeenCalledWith(EMPTY_NETWORK_UI);
+  });
 });