[github-actions]

Test Coverage Improvement: getOrLaunchWithConfig

Function Analyzed

• Package: internal/launcher
• Function: getOrLaunchWithConfig (plus closed-launcher guards in GetOrLaunch / GetOrLaunchForSession)
• Previous Coverage: 86.2%
• New Coverage: 89.2%
• Complexity: High (singleflight, locking, HTTP/stdio branches, OIDC, shutdown races)

Why This Function?

Most functions were already well covered; this was among the most complex with uncovered branches: the early ErrLauncherClosed return on a closed launcher.

Tests Added

• ✅ Table-driven TestGetOrLaunchWithConfig_ClosedLauncher covering HTTP and stdio backends via getOrLaunchWithConfig, GetOrLaunch, and GetOrLaunchForSession
• ✅ Verifies ErrLauncherClosed is returned, no connection is returned, and no connections are cached

Test Execution

go test ./internal/launcher/ passes; go vet and gofmt clean.

Remaining uncovered lines are races (launcher closed mid-launch) and the OIDC-missing-provider path.

---

Generated by Test Coverage Improver

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

• example.com
• nonexistent.local
• slow.example.com
• thishostdoesnotexist12345.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "nonexistent.local"
    - "slow.example.com"
    - "thishostdoesnotexist12345.com"

See Network Configuration for more information.

Generated by Test Coverage Improver · copilot · auto · ~56 AIC · ⊞ 10.7K · ◷

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 write tools absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	reads	data	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked through mcpg. Part A/C reads succeeded via both the GitHub MCP tools and the proxied github CLI (list_issues, list_pull_requests, get_file_contents, list_commits). Part B is INCONCLUSIVE because gh-aw's tools.github: wrapper always sets GITHUB_READ_ONLY=1, so none of the 6 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) appear in the 23-tool catalog — this proves backend config, not independent gateway-level DIFC/guard enforcement. Parts D/E are INCONCLUSIVE because the gh CLI has no GH_TOKEN configured in this job, so the token-scope boundary could not be exercised (calls failed with an auth-setup error, not a 403/404/422 from GitHub).

No reaction, star, issue, comment, branch, file, or PR was created.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🟢 Approval recommended

The focused test-only change has no blocking issues; the remaining failure-attribution issue is non-blocking.

No open issues 🎉

What changed in this PR

Adds regression tests for the launcher's closed-state behavior without changing production code.

Changes:

• Exercises getOrLaunchWithConfig and public launch entry points with HTTP and stdio configurations.
• Verifies ErrLauncherClosed, nil returned connections, and an empty connection cache.

File	Description
internal/​launcher/​closed_launcher_test.go	Adds table-driven tests for calls made after launcher shutdown.

_{Review effort: Max}