[test-improver] Improve tests for isDirectStdioCommand

[github-actions]

File analyzed

internal/launcher/launcher_runtime_test.go (tests isDirectStdioCommand in internal/launcher/launcher.go)

Improvements made

Extended the existing table-driven TestIsDirectStdioCommand test with 6 new cases covering previously-untested branches:

• Mixed-case runtime command names (Docker, PODMAN) to exercise the strings.ToLower normalization
• A run argument appearing beyond the maxRunProbeArgs (3) scan limit — verifies the function correctly does not detect it as containerized (this branch, limit > maxRunProbeArgs, was previously never exercised)
• A run argument exactly at the probe-limit boundary — verifies it is detected
• nil args slice
• Mixed-case RUN argument to exercise strings.EqualFold

No existing tests were modified or removed; all previously passing cases still pass.

Coverage before/after

isDirectStdioCommand function coverage: 92.9% → 100.0% (per go tool cover -func). The previously uncovered branch was the argument-scan truncation logic (limit := len(serverCfg.Args); if limit > maxRunProbeArgs { limit = maxRunProbeArgs }).

Test output

=== RUN   TestIsDirectStdioCommand
--- PASS: TestIsDirectStdioCommand (0.00s)
    --- PASS: TestIsDirectStdioCommand/docker_runtime (0.00s)
    --- PASS: TestIsDirectStdioCommand/podman_runtime (0.00s)
    --- PASS: TestIsDirectStdioCommand/podman_runtime_absolute_path (0.00s)
    --- PASS: TestIsDirectStdioCommand/nerdctl_runtime (0.00s)
    --- PASS: TestIsDirectStdioCommand/custom_runtime_args_start_with_run (0.00s)
    --- PASS: TestIsDirectStdioCommand/containerized_metadata_bypasses_arg_inference (0.00s)
    --- PASS: TestIsDirectStdioCommand/direct_command (0.00s)
    --- PASS: TestIsDirectStdioCommand/direct_node_command (0.00s)
    --- PASS: TestIsDirectStdioCommand/direct_shell_script (0.00s)
    --- PASS: TestIsDirectStdioCommand/nil_config (0.00s)
    --- PASS: TestIsDirectStdioCommand/mixed-case_docker_command (0.00s)
    --- PASS: TestIsDirectStdioCommand/uppercase_PODMAN_command (0.00s)
    --- PASS: TestIsDirectStdioCommand/run_beyond_probe_limit_is_not_detected (0.00s)
    --- PASS: TestIsDirectStdioCommand/run_within_probe_limit_at_boundary_index (0.00s)
    --- PASS: TestIsDirectStdioCommand/nil_args_slice (0.00s)
    --- PASS: TestIsDirectStdioCommand/mixed-case_RUN_argument (0.00s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/launcher	0.007s

Also verified: go test -count=3 ./internal/launcher/ passes, go vet ./internal/launcher/ clean, gofmt -l clean, full package test suite (go test -count=1 ./internal/launcher/) passes in 16.8s.

Generated by Test Improver · auto · 69.7 AIC · ⊞ 8.1K · ◷

[Copilot]

Pull request overview

Expands isDirectStdioCommand unit coverage to include normalization and probe-limit edge cases.

Changes:

• Tests mixed-case runtime commands and run arguments.
• Tests probe-limit boundaries and nil arguments.
• Raises function coverage to 100%.

Show a summary per file

File	Description
internal/launcher/launcher_runtime_test.go	Adds six table-driven edge-case tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	gateway refused: unknown tool (not in 22-tool read-only list)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked: no GH_TOKEN (unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked: no GH_TOKEN (unauthenticated)	BLOCKED	✅

Overall: PASS

Run §30674813905

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (gateway-filtered, ~7ms)	BLOCKED	✅
C	CLI proxy	reads (22 read-only tools exposed)	data returned	ALLOWED	✅
D	CLI (gh)	REST writes	gh unauthenticated — rejected client-side	BLOCKED	✅
E	CLI (gh)	GraphQL mutations	gh unauthenticated — rejected client-side	BLOCKED	✅

Notes:

• Part B: Gateway returns Error [-32602]: unknown tool "<name>" in ~6-7ms (vs ~1000ms for backend calls), confirming gateway-level tool filtering.
• Part C: CLI proxy exposes exactly 22 read-only tools (get/list/search only); all write tools absent.
• Parts D/E: gh CLI has no GH_TOKEN in this gVisor runtime; all write attempts rejected client-side.

Overall: PASS ✅

References: §30674813916

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602] — gateway filtered write tools	BLOCKED	✅
C	CLI	reads (list_issues/get_file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — exit 4, no token	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — exit 4, no token	BLOCKED	✅

Overall: PASS

Part B note: The gateway enforces read-only by exposing only read tools in the MCP tool list. Write tools (add_issue_reaction, star_repository, create_issue, add_issue_comment, create_branch, create_or_update_file, create_pull_request) are absent, producing MCP error [-32602]: unknown tool. This is gateway-level tool-filtering enforcement.

References: §30674813924

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime