farm.ts real entitlement probe (API-key network call) and --canary entrypoint have no test coverage
Severity: medium | Confidence: 0.75 | Effort: M
Where:
plugins/ca/tools/farm.ts:1594-1612
plugins/ca/tools/farm.ts:1617-1667
Evidence: makeEntitlementProbe (farm.ts:1594-1612) constructs the outbound request — Authorization: Bearer ${apiKey} header, POST body, AbortController-bound fetch — and maps network/abort failures to status 0 vs a real HTTP status. It is not exported and does not appear in farm.unit.test.ts's import list; screenEntitlements is imported and tested with an injected fake probe, but makeEntitlementProbe itself never is. runCanary (farm.ts:1617-1667), the --canary CLI entrypoint that calls makeEntitlementProbe with the real apiKey/apiBaseUrl, has zero references in either farm.test.ts or farm.unit.test.ts.
Impact: The only test coverage for entitlement screening exercises the pure decision logic (screenEntitlements) with a stubbed probe; the code that actually builds the Bearer-auth header, times out via AbortController, and interprets a real 401 vs. network error is unverified. A bug here would surface only in production canary runs against the live FARM_API_KEY-gated endpoint — the trust boundary inventory.md ranks #2.
Recommendation: Export makeEntitlementProbe (or an equivalent seam) and add a unit test using a mocked global fetch to assert: the Authorization header carries the configured apiKey, a 401 response is distinguishable from a network throw, and the AbortController actually fires at timeoutMs. Add a thin integration-style test for runCanary's argument validation (missing FARM_CANDIDATE_MODELS, missing FARM_API_KEY exit paths).
Acceptance criteria:
- A test mocks fetch and asserts makeEntitlementProbe sends the Bearer apiKey header and correct body shape
- A test asserts the AbortController-driven timeout actually fires and maps to status 0
- runCanary's early-exit validation paths (no candidate models / no API key) are covered by at least one test
farm.ts real entitlement probe (API-key network call) and --canary entrypoint have no test coverage
Severity: medium | Confidence: 0.75 | Effort: M
Where:
plugins/ca/tools/farm.ts:1594-1612
plugins/ca/tools/farm.ts:1617-1667
Evidence: makeEntitlementProbe (farm.ts:1594-1612) constructs the outbound request —
Authorization: Bearer ${apiKey}header, POST body, AbortController-bound fetch — and maps network/abort failures to status 0 vs a real HTTP status. It is not exported and does not appear in farm.unit.test.ts's import list; screenEntitlements is imported and tested with an injected fake probe, but makeEntitlementProbe itself never is. runCanary (farm.ts:1617-1667), the --canary CLI entrypoint that calls makeEntitlementProbe with the real apiKey/apiBaseUrl, has zero references in either farm.test.ts or farm.unit.test.ts.Impact: The only test coverage for entitlement screening exercises the pure decision logic (screenEntitlements) with a stubbed probe; the code that actually builds the Bearer-auth header, times out via AbortController, and interprets a real 401 vs. network error is unverified. A bug here would surface only in production canary runs against the live FARM_API_KEY-gated endpoint — the trust boundary inventory.md ranks #2.
Recommendation: Export makeEntitlementProbe (or an equivalent seam) and add a unit test using a mocked global fetch to assert: the Authorization header carries the configured apiKey, a 401 response is distinguishable from a network throw, and the AbortController actually fires at timeoutMs. Add a thin integration-style test for runCanary's argument validation (missing FARM_CANDIDATE_MODELS, missing FARM_API_KEY exit paths).
Acceptance criteria: