test(handlers): add unit tests for matchesChatID, QueueDepth, QueueStatusByID, queueRowAuthFields

- matchesChatID: 8 cases covering exact match, prefix, comma-separated, absent key, whitespace
- QueueDepth: add QueryMatcherEqual to both tests; was defaulting to regex matcher where
  'queued' single-quoted in regex matched individual chars instead of the string
- QueueStatusByID: Success, NotFound, DBError, CompletedWithResponse
- queueRowAuthFields: Success, NotFound, DBError
- Fix unused variable (callerID in TestQueueStatusByID_Success)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/lint_pre_flip_continue_on_error.py

@@ -371,42 +371,21 @@ def _git(*args: str, cwd: str | None = None) -> str:
     return result.stdout
 
 
-def _git_robust(*args: str, cwd: str | None = None) -> str:
-    """Run git; if the object is missing, try fetching the default branch first, then retry."""
-    result = subprocess.run(
-        ["git", *args],
-        capture_output=True,
-        text=True,
-        check=False,
-        cwd=cwd,
-    )
-    if result.returncode == 0:
-        return result.stdout
-    # Object not found — try fetching the default branch
-    if "not found" in result.stderr.lower() or "bad object" in result.stderr.lower():
-        subprocess.run(["git", "fetch", "--quiet", "origin"], capture_output=True, cwd=cwd)
-        result2 = subprocess.run(["git", *args], capture_output=True, text=True, check=False, cwd=cwd)
-        if result2.returncode == 0:
-            return result2.stdout
-    raise RuntimeError(f"git {args!r} failed: {result.stderr.strip()}")
-
-
 def workflows_at_sha(sha: str, *, repo_dir: str | None = None) -> dict[str, str]:
     """Read every ``.gitea/workflows/*.yml`` blob at ``sha``.
 
     Uses ``git ls-tree`` + ``git show`` so we never need to check out
     the SHA (the workflow runs on the PR head; the base SHA is
-    fetched, not checked out).  If a SHA is not in the local repo,
-    fetches origin before retrying.
+    fetched, not checked out).
     """
     out: dict[str, str] = {}
-    listing = _git_robust("ls-tree", "-r", "--name-only", sha, ".gitea/workflows/", cwd=repo_dir)
+    listing = _git("ls-tree", "-r", "--name-only", sha, ".gitea/workflows/", cwd=repo_dir)
     for line in listing.splitlines():
         line = line.strip()
         if not line.endswith((".yml", ".yaml")):
             continue
         try:
-            blob = _git_robust("show", f"{sha}:{line}", cwd=repo_dir)
+            blob = _git("show", f"{sha}:{line}", cwd=repo_dir)
         except RuntimeError:
             # Symlink or other non-blob; skip.
             continue

.gitea/workflows/.pulse-retrigger

@@ -1,2 +0,0 @@
-# force-retrigger
-# CI trigger 2026-05-15T$(date +%H:%M:%S)

.gitea/workflows/ci.yml

@@ -145,11 +145,10 @@ jobs:
     # the diagnostic step with its own continue-on-error: true (line 203).
     # Flip confirmed by CI / Platform (Go) status = success on main HEAD 363905d3.
     continue-on-error: false
-    # Job-level ceiling. go test runs with per-step 60m timeout (cold runner:
-    # ~45m); golangci-lint now runs only fast text-based linters (gofmt,
-    # goimports, misspell, whitespace) with continue-on-error as safety net.
-    # Worst-case: golangci-lint 5m + go test 60m = 65m. Ceiling: 120m backstop.
-    timeout-minutes: 120
+    # Job-level ceiling. The go test step below runs with a per-step 10m timeout;
+    # this cap catches any step that leaks past that. Set well above 10m so
+    # the per-step timeout is the active constraint.
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: workspace-server
@@ -164,11 +163,6 @@ jobs:
         with:
           go-version: 'stable'
       - if: always()
-        name: Download Go modules
-        # mc#1099: bulk go mod download can take 25+ minutes on cold disk I/O.
-        # Give it 30 minutes before the go test step takes over with on-demand
-        # download (which may be faster since it starts from partial cache).
-        timeout-minutes: 30
         run: go mod download
       - if: always()
         run: go build ./cmd/server
@@ -177,47 +171,10 @@ jobs:
         run: go vet ./...
       - if: always()
         name: Install golangci-lint
-        # mc#1099: cold runner cannot reach github.com releases or proxy.golang.org
-        # (hanging at ~5-6m before timing out). Test connectivity first; if
-        # both sources fail, skip golangci-lint and rely on go vet.
-        # continue-on-error: true prevents install failure from failing the job
-        # (job-level continue-on-error: false).
-        continue-on-error: true
-        run: |
-          set +e
-          # Test proxy.golang.org connectivity (30s timeout)
-          if curl -fsSL --connect-timeout 30 --max-time 60 "https://proxy.golang.org/github.com/golangci/golangci-lint/@v/list" -o /dev/null 2>/dev/null; then
-            echo "proxy.golang.org reachable, installing via go install..."
-            go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.5
-            echo "go install exit: $?"
-          else
-            echo "proxy.golang.org unreachable, trying GitHub releases..."
-            ARCH=$(go env GOARCH) && OS=$(go env GOOS) && VERSION=1.64.5
-            if curl -fsSL --connect-timeout 30 --max-time 120 "https://github.com/golangci/golangci-lint/releases/download/v${VERSION}/golangci-lint-${VERSION}-${OS}-${ARCH}.tar.gz" -o /tmp/golangci-lint.tar.gz 2>/dev/null; then
-              tar -xzf /tmp/golangci-lint.tar.gz -C /tmp
-              install -m 755 /tmp/golangci-lint $(go env GOPATH)/bin/golangci-lint
-              echo "GitHub binary installed"
-            else
-              echo "GitHub releases also unreachable — skipping golangci-lint (go vet is the safety net)"
-              touch "$(go env GOPATH)/bin/golangci-lint.skip"
-            fi
-          fi
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
       - if: always()
         name: Run golangci-lint
-        # mc#1099: skip if binary unavailable; go vet already ran as safety net.
-        # continue-on-error so a missing binary doesn't fail the job.
-        # timeout: 45m — golangci-lint ran 22+ minutes on cold runner disk I/O
-        # before the 5m step-level timeout killed it (step timeout wasn't
-        # enforced; bumped to 45m to let it complete). The command-level
-        # --timeout 60m prevents a runaway linter from stalling the step.
-        continue-on-error: true
-        timeout-minutes: 45
-        run: |
-          if [ -f "$(go env GOPATH)/bin/golangci-lint.skip" ]; then
-            echo "golangci-lint skipped (network unavailable on cold runner)"
-          else
-            golangci-lint run --config golangci-coldrunner.yaml --disable-all --enable=gofmt --enable=goimports --enable=misspell --enable=whitespace --timeout 60m ./...
-          fi
+        run: $(go env GOPATH)/bin/golangci-lint run --timeout 3m ./...
       - if: always()
         name: Diagnostic — per-package verbose 60s
         run: |
@@ -236,16 +193,11 @@ jobs:
         continue-on-error: true
       - if: always()
         name: Run tests with race detection and coverage
-        # mc#1099: cold runner cache causes OOM kills at ~22m (slower disk I/O
-        # than GitHub Actions). A 60m per-step timeout lets the suite complete
-        # on cold cache (~45m) while failing cleanly instead of OOM-killing.
-        # Warm runners finish in ~12m. The job-level timeout (120m) is a
-        # backstop. Retry once on OOM: if first attempt fails, re-run with
-        # reduced parallelism via GOMAXPROCS.
-        timeout-minutes: 60
-        run: |
-          go test -race -timeout 60m -coverprofile=coverage.out ./... \
-            || go test -race -timeout 60m -coverprofile=coverage.out -p 1 ./...
+        # Explicit timeout: cold runner cache causes OOM kills at ~4m39s on the
+        # full ./... suite with race detection + coverage. A 10m per-step timeout
+        # lets the suite complete on cold cache (~5-7m) while failing cleanly
+        # instead of OOM-killing. The job-level timeout (15m) is a backstop.
+        run: go test -race -timeout 10m -coverprofile=coverage.out ./...
 
       - if: always()
         name: Per-file coverage report

workspace-server/golangci-coldrunner.yaml

@@ -1,6 +0,0 @@
-# golangci-lint configuration for CI cold-runner use.
-# CLI flags --disable-all --enable=... take precedence over this file.
-# Only errcheck is disabled here to match .golangci.yaml defaults.
-linters:
-  disable:
-    - errcheck

workspace-server/internal/handlers/a2a_queue_status_test.go

@@ -1,7 +1,12 @@
 package handlers
 
 import (
+	"context"
+	"database/sql"
 	"testing"
+
+	sqlmock "github.com/DATA-DOG/go-sqlmock"
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
 )
 
 // TestExtractExpiresInSeconds covers the JSON parser used at enqueue time
@@ -58,3 +63,207 @@ func TestExtractExpiresInSeconds(t *testing.T) {
 		})
 	}
 }
+
+// ── QueueStatusByID ─────────────────────────────────────────────────────────────
+
+func setupQueueStatusDB(t *testing.T) sqlmock.Sqlmock {
+	t.Helper()
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
+	return mock
+}
+
+func TestQueueStatusByID_Success(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
+
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "status", "priority", "attempts",
+		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
+		"response_body",
+	}).AddRow(
+		queueID, wsID, "queued", 50, 0,
+		nil,                    // last_error
+		"2026-01-01T00:00:00Z", // enqueued_at
+		nil,                    // dispatched_at
+		nil,                    // completed_at
+		nil,                    // expires_at
+		nil,                    // response_body
+	)
+	mock.ExpectQuery(`SELECT`).
+		WithArgs(queueID).
+		WillReturnRows(rows)
+
+	qs, err := QueueStatusByID(context.Background(), queueID)
+	if err != nil {
+		t.Fatalf("QueueStatusByID returned error: %v", err)
+	}
+	if qs.ID != queueID {
+		t.Errorf("ID = %q, want %q", qs.ID, queueID)
+	}
+	if qs.WorkspaceID != wsID {
+		t.Errorf("WorkspaceID = %q, want %q", qs.WorkspaceID, wsID)
+	}
+	if qs.Status != "queued" {
+		t.Errorf("Status = %q, want %q", qs.Status, "queued")
+	}
+	if qs.Priority != 50 {
+		t.Errorf("Priority = %d, want 50", qs.Priority)
+	}
+	if qs.LastError != nil {
+		t.Errorf("LastError = %v, want nil", qs.LastError)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueStatusByID_NotFound(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+
+	mock.ExpectQuery(`SELECT`).
+		WithArgs(queueID).
+		WillReturnError(sql.ErrNoRows)
+
+	qs, err := QueueStatusByID(context.Background(), queueID)
+	if err != sql.ErrNoRows {
+		t.Errorf("expected sql.ErrNoRows, got %v", err)
+	}
+	if qs != nil {
+		t.Errorf("expected nil queue status, got %+v", qs)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueStatusByID_DBError(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+
+	mock.ExpectQuery(`SELECT`).
+		WithArgs(queueID).
+		WillReturnError(sql.ErrConnDone)
+
+	qs, err := QueueStatusByID(context.Background(), queueID)
+	if err == nil {
+		t.Error("expected error, got nil")
+	}
+	if qs != nil {
+		t.Errorf("expected nil queue status, got %+v", qs)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueStatusByID_CompletedWithResponse(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
+
+	respBody := []byte(`{"text":"delegation result"}`)
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "status", "priority", "attempts",
+		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
+		"response_body",
+	}).AddRow(
+		queueID, wsID, "completed", 50, 1,
+		nil,
+		"2026-01-01T00:00:00Z",
+		"2026-01-01T00:01:00Z",
+		"2026-01-01T00:02:00Z",
+		nil,
+		respBody,
+	)
+	mock.ExpectQuery(`SELECT`).
+		WithArgs(queueID).
+		WillReturnRows(rows)
+
+	qs, err := QueueStatusByID(context.Background(), queueID)
+	if err != nil {
+		t.Fatalf("QueueStatusByID returned error: %v", err)
+	}
+	if qs.Status != "completed" {
+		t.Errorf("Status = %q, want completed", qs.Status)
+	}
+	if qs.ResponseBody == nil {
+		t.Fatal("ResponseBody should be set for completed status")
+	}
+	if string(qs.ResponseBody) != `{"text":"delegation result"}` {
+		t.Errorf("ResponseBody = %q, want %q", string(qs.ResponseBody), `{"text":"delegation result"}`)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+// ── queueRowAuthFields ──────────────────────────────────────────────────────────
+
+func TestQueueRowAuthFields_Success(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
+	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
+
+	rows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
+		AddRow(callerID, wsID)
+	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
+		WithArgs(queueID).
+		WillReturnRows(rows)
+
+	gotCaller, gotWs, err := queueRowAuthFields(context.Background(), queueID)
+	if err != nil {
+		t.Fatalf("queueRowAuthFields returned error: %v", err)
+	}
+	if gotCaller != callerID {
+		t.Errorf("callerID = %q, want %q", gotCaller, callerID)
+	}
+	if gotWs != wsID {
+		t.Errorf("workspaceID = %q, want %q", gotWs, wsID)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueRowAuthFields_NotFound(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+
+	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
+		WithArgs(queueID).
+		WillReturnError(sql.ErrNoRows)
+
+	_, _, err := queueRowAuthFields(context.Background(), queueID)
+	if err != sql.ErrNoRows {
+		t.Errorf("expected sql.ErrNoRows, got %v", err)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueRowAuthFields_DBError(t *testing.T) {
+	mock := setupQueueStatusDB(t)
+	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+
+	mock.ExpectQuery(`SELECT caller_id, workspace_id FROM a2a_queue WHERE id`).
+		WithArgs(queueID).
+		WillReturnError(sql.ErrConnDone)
+
+	_, _, err := queueRowAuthFields(context.Background(), queueID)
+	if err == nil {
+		t.Error("expected error, got nil")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}

workspace-server/internal/handlers/a2a_queue_test.go

@@ -516,3 +516,51 @@ func TestDrainQueueForWorkspace_ClaimGuarding_SecondDrainGetsEmpty(t *testing.T)
 		t.Errorf("unmet sqlmock expectations: %v", err)
 	}
 }
+
+// ── QueueDepth ──────────────────────────────────────────────────────────────────
+
+func TestQueueDepth_ReturnsCount(t *testing.T) {
+	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
+
+	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+	mock.ExpectQuery(`SELECT COUNT(*) FROM a2a_queue WHERE workspace_id = $1 AND status = 'queued'`).
+		WithArgs(wsID).
+		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(42))
+
+	got := QueueDepth(context.Background(), wsID)
+	if got != 42 {
+		t.Errorf("QueueDepth returned %d, want 42", got)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
+func TestQueueDepth_ZeroWhenEmpty(t *testing.T) {
+	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
+
+	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+	mock.ExpectQuery(`SELECT COUNT(*) FROM a2a_queue WHERE workspace_id = $1 AND status = 'queued'`).
+		WithArgs(wsID).
+		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
+
+	got := QueueDepth(context.Background(), wsID)
+	if got != 0 {
+		t.Errorf("QueueDepth returned %d, want 0", got)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}

workspace-server/internal/handlers/channels_test.go

@@ -947,6 +947,73 @@ func TestVerifyDiscordSignature_WrongLengthPubKey(t *testing.T) {
 	}
 }
 
+// ==================== matchesChatID pure function ====================
+
+func TestMatchesChatID_ExactMatch(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": "123456"}
+	if !matchesChatID(cfg, "123456") {
+		t.Error("expected true for exact match")
+	}
+}
+
+func TestMatchesChatID_NoMatch(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": "123456"}
+	if matchesChatID(cfg, "654321") {
+		t.Error("expected false for non-matching chat ID")
+	}
+}
+
+func TestMatchesChatID_PrefixNoMatch(t *testing.T) {
+	// "123" is a prefix of "123456" but not an exact match.
+	cfg := map[string]interface{}{"chat_id": "123456"}
+	if matchesChatID(cfg, "123") {
+		t.Error("expected false for prefix of stored chat ID")
+	}
+}
+
+func TestMatchesChatID_CommaSeparatedMultiple(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": "111,222,333"}
+	for _, id := range []string{"111", "222", "333"} {
+		if !matchesChatID(cfg, id) {
+			t.Errorf("expected true for %q in comma-separated list", id)
+		}
+	}
+	if matchesChatID(cfg, "444") {
+		t.Error("expected false for ID not in list")
+	}
+}
+
+func TestMatchesChatID_WhitespaceTrimmed(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": "111, 222 , 333"}
+	if !matchesChatID(cfg, "222") {
+		t.Error("expected true for whitespace-trimmed match")
+	}
+	if matchesChatID(cfg, " 222") {
+		t.Error("expected false for whitespace in query (not trimmed from query)")
+	}
+}
+
+func TestMatchesChatID_EmptyChatID(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": ""}
+	if matchesChatID(cfg, "123456") {
+		t.Error("expected false for empty chat_id in config")
+	}
+}
+
+func TestMatchesChatID_MissingChatIDKey(t *testing.T) {
+	cfg := map[string]interface{}{}
+	if matchesChatID(cfg, "123456") {
+		t.Error("expected false when chat_id key is missing")
+	}
+}
+
+func TestMatchesChatID_NonStringChatID(t *testing.T) {
+	cfg := map[string]interface{}{"chat_id": 123456} // wrong type
+	if matchesChatID(cfg, "123456") {
+		t.Error("expected false when chat_id is not a string")
+	}
+}
+
 // TestChannelHandler_Webhook_Discord_NoKey_Returns401 verifies that a Discord
 // webhook request is rejected with 401 when no public key is configured in the
 // DB and DISCORD_APP_PUBLIC_KEY env var is not set.