test(coverage): raise vitest gates 90→100 for shared-types and desktop

[seonghobae]

Summary

Raise the vitest coverage gate from 90 → 100 in the two gated workspaces (packages/shared-types, apps/desktop). Both workspaces' coverage.include files already had genuine 100% line/branch/function/statement coverage under the existing suites — the thresholds were simply set conservatively at 90. This enforces the org 100% standard and prevents regression. No production code or tests changed; only the two thresholds blocks.

Verification

• npm run test --workspace @bandscope/shared-types → 717/717 S, 643/643 B, 59/59 F, 693/693 L — exit 0 at threshold 100.
• npm run test --workspace @bandscope/desktop → 469/469 S, 357/357 B, 105/105 F, 454/454 L — exit 0 at threshold 100.
• ./scripts/harness/quickcheck.sh — not run in this environment; this change is threshold-config-only (no lint/typecheck/build/runtime surface), and the two affected coverage gates were verified directly above.

Security Notes

Attack surface

• None. The change is limited to two vitest thresholds config blocks (test-time coverage enforcement); no runtime, IPC, or data-flow surface is touched.

Trust boundary

• Unchanged.

Mitigations

• N/A — no behavior change.

Test points

• packages/shared-types/vitest.config.ts, apps/desktop/vite.config.ts.

Dependency and Supply Chain

• No new direct dependency was added
• runtime / dev / build / test classification is recorded (none added)
• known security issues were checked (n/a — no dependency change)
• transitive footprint impact was considered (none)
• SBOM or supplemental inventory impact was recorded (none)

i18n impact

None — no user-visible strings changed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SEAGtwNR96cia2djq7XFCo

---

Generated by Claude Code

Summary by CodeRabbit

• 테스트

  • 코드 커버리지 기준을 강화해 주요 기능에 대한 테스트 검증 수준을 높였습니다.
  • 라인, 함수, 분기, 구문 커버리지 모두 100% 기준을 적용합니다.

• 품질 개선

  • 빌드 및 검증 환경의 일관성과 안정성을 향상했습니다.
  • 변경 사항으로 인해 테스트 품질 기준이 더욱 엄격해졌습니다.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• services/analysis-engine/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f13d7805-ea2a-4377-b75b-7ee15ab156a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Vitest의 lines, functions, branches, statements 커버리지 임계값을 두 설정에서 90%에서 100%로 변경하고, brace-expansion과 postcss의 오버라이드 버전을 추가했습니다.

Changes

도구 설정 갱신

Layer / File(s)	Summary
커버리지 기준 상향 apps/desktop/vite.config.ts, packages/shared-types/vitest.config.ts	두 Vitest 설정의 네 가지 커버리지 임계값을 각각 100으로 상향했습니다.
패키지 오버라이드 추가 package.json	brace-expansion을 ^5.0.8, postcss를 ^8.5.18로 강제하는 overrides 설정을 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목이 shared-types와 desktop의 Vitest 커버리지 임계값을 90에서 100으로 올린 핵심 변경을 정확히 요약합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/contextualwisdomlab-audit-governance-5gowdn

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

trivy-fs: yt-dlp HIGH fixed here; setuptools MEDIUM needs a base-branch torch bump

trivy-fs lists two pre-existing advisories in services/analysis-engine/uv.lock (both predate this PR and hit every bandscope PR):

• HIGH — CVE-2026-55404 (yt-dlp) — fixed in b4aff1d via a surgical uv lock --upgrade-package yt-dlp → 2026.7.4. Only yt-dlp's pin changes; nothing else is touched.
• MEDIUM — CVE-2026-59890 (setuptools, transitive/build-only) — its patched line is 83.0.0, but forcing setuptools>=83.0.0 while pinning torch==2.12.1 is unsatisfiable (demucs → torch chain). Fixing setuptools therefore transitively requires torch 2.12.1 → 2.13.0 (plus cuda-toolkit 13.0.2 → 13.0.3.0).

A torch minor bump changes the numeric core of the audio-analysis engine, whose suite enforces 100% coverage and numeric reproducibility. I'm not bumping torch unilaterally inside a coverage-threshold PR, and I can't validate the engine's numeric behaviour under torch 2.13 in this sandbox. That belongs in a deliberate, separately-verified base-branch dependency bump (raise torch + setuptools together on develop and re-run the engine suite); every open PR then inherits the fix — matching trivy's own "remediate at the shared base branch" guidance. I did not weaken the gate or add a .trivyignore (the finding is real, not a false positive).

The PR's actual change (both vitest coverage gates 90 → 100) plus the clean CVE fixes (postcss, brace-expansion, yt-dlp) are green.

---

Generated by Claude Code

[seonghobae]

Closing as closed-obsolete in product-completion loop. Not green/merge-ready; unique commercial value for this cycle is consolidated in #727. Re-open or re-cut from develop if still needed after #727 lands.

[seonghobae]

closed-obsolete → see #727 cycle