fix(test): defuse the suite's landmines, and cover the dossier's untested modules

[glennmichael123]

Three commits of test-suite health, all off the dossier's shortlist — the third one forced by the second stepping on the very landmine the first defuses.

Commit 1 — the three landmines

The node:fs mock that outlives its suite. test/dependency-file-parser.test.ts calls mock.module('node:fs', …) with bare mock functions. mock.module is process-global and permanent, so every file that runs afterwards inherits the mocks — and once afterEach resets them, existsSync returns undefined everywhere. That is precisely how #1434's decline test failed on CI while passing alone. The replacement functions now delegate to the real fs except while the suite has explicitly armed them.

The dead working directory. A suite that chdirs into a temp dir and deletes it leaves process.cwd() pointing at nothing; the next filesystem-touching suite fails with an ENOENT that looks like its own bug. test/preload.ts now carries the net: a global beforeEach that repairs cwd to the repo root only when it is dead.

The 0-byte test file. test/composer-constraint-updates.test.ts ran, passed, and asserted nothing. It now holds the suite its name promises: ^/~/exact constraints keep their shape, >=6.0,<7.0 moves only its floor, require-dev follows the same rules, an unknown package leaves the file untouched.

Commits 2+3 — the untested modules, and the README gap

src/utils/lock-file.ts — 188 lines, publicly re-exported, zero direct tests. Pure parts asserted directly; regenerateLockFile through its non-fatal contract: a machine without the manager gets a result object naming the failure, not an unhandled rejection (node fires error, Bun closes with a negative code — the test pins the contract, not the channel).

src/ai/providers/anthropic.ts — the gaps in its coverage are closed inside test/ai-provider.test.ts, at the fetch layer, through the real SDK: the remaining stop reasons (stop_sequence, max_tokens, unknown → other), schema-constrained JSON parsing and its malformed-JSON AiProviderError, and the wire shape (system, tools mapped to input_schema, output_config, the 16000 max_tokens default) captured from the request body. The first attempt was a separate file owning its own mock.module('@anthropic-ai/sdk') — process-global, so under CI's file order it clobbered the existing fetch-stubbed tests, which began receiving the fake's canned response. Same landmine class commit 1 defuses; commit 3 removes it in favour of stubbing at the seam this suite already owns.

README — bun install is a hard prerequisite on a fresh clone (bun test otherwise fails with a hundred-plus phantom Cannot find package errors), and the git hooks declared in package.json do not install themselves — bunx bun-git-hooks activates them.

Tests

bun test: 2213 pass / 0 fail (up 19 net). The leak-order pair (dependency-file-parser → cli-surface) run explicitly to confirm the delegation holds. Typecheck, pickier, check-docs green.

🤖 Generated with Claude Code