test(server): sweep every GET route on a fresh and a corrupt workspace

The Studio is opened before the first run far more often than after one — that
IS the first-run path — so every read handler meets a workspace with no board,
no result, no squad plan, no calibration and no session. A handler that assumes
any of those exist takes the whole Studio down, because a panic in one kills
the process serving all 47 routes.

Both sweeps pass today. They are worth having anyway: the route table is read
out of server.go rather than listed in the test, so a route added tomorrow is
covered the moment it is registered. A hand-maintained list would drift, and
the route it forgot would be exactly the untested one.

The second sweep covers a different failure mode from the first: absence is not
malformation. A run killed mid-write, a hand-edited board or a file from a bad
backup leaves truncated JSON, wrong-typed JSON or YAML that is not a mapping,
and a handler that parses without checking crashes on content rather than on
emptiness. A 500 there is honest; a panic is not.

Also: the refusal block a user reads when their first run does not start now
leads with `slmcode configure`. It is the only one of the three offered
commands that does not require already knowing the answer — `doctor` explains
the problem to somebody who can act on it, and the flags are for somebody who
knows where their server is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UiLDxnEu1Gf8Q5hWAFhaAd

Author: claude

pkg/cli/probe.go

@@ -95,7 +95,11 @@ func (p ProbeResult) Block() string {
 	if p.Remedy != "" {
 		b.WriteString(Dim("  tip:      ") + p.Remedy + "\n")
 	}
-	b.WriteString(Dim("  fix:      slmcode doctor   ·   slmcode run --endpoint <url> --provider <name>\n"))
+	// `configure` leads: it is the only one of these that does not require
+	// already knowing the answer. `doctor` explains what is wrong to somebody
+	// who can act on it, and the flags are for somebody who knows where their
+	// server is — both are the second thing to reach for, not the first.
+	b.WriteString(Dim("  fix:      slmcode configure   ·   slmcode doctor   ·   slmcode run --endpoint <url>\n"))
 	return b.String()
 }
 

pkg/cli/probe_test.go

@@ -219,3 +219,30 @@ func TestAnAuthFailureStillPointsAtAuth(t *testing.T) {
 		t.Errorf("remedy = %q, want the auth command", remedy)
 	}
 }
+
+// The refusal block is what a user reads when their first run does not start.
+// The line their eye goes to has to name the command that does not require
+// already knowing the answer.
+func TestTheRefusalBlockLeadsWithConfigure(t *testing.T) {
+	p := ProbeResult{
+		State: ProbeDown, Provider: "omlx", Model: "some-model",
+		Endpoint: "http://127.0.0.1:8000/v1", Cause: "connection refused",
+		Remedy: "nothing is listening",
+	}
+	block := p.Block()
+	ci := strings.Index(block, "slmcode configure")
+	di := strings.Index(block, "slmcode doctor")
+	if ci < 0 {
+		t.Fatalf("the refusal block does not name configure:\n%s", block)
+	}
+	if di >= 0 && ci > di {
+		t.Errorf("doctor comes before configure — configure is the one that does not\n"+
+			"require knowing the answer already:\n%s", block)
+	}
+	// The block still says what is wrong, not just what to run.
+	for _, want := range []string{"connection refused", "http://127.0.0.1:8000/v1", "omlx"} {
+		if !strings.Contains(block, want) {
+			t.Errorf("the refusal block lost %q:\n%s", want, block)
+		}
+	}
+}

pkg/server/routes_sweep_test.go

@@ -0,0 +1,147 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/UnicoLab/slmcode/pkg/harness"
+)
+
+// ── Every GET route, on a server that has never run anything ─────────────
+//
+// The Studio is opened before the first run far more often than after one:
+// that IS the first-run path. Every read handler therefore meets a workspace
+// with no board, no result, no squad plan, no calibration and no session —
+// and a handler that assumes any of those exist takes the whole Studio down
+// with it, because a panic in one handler kills the process serving all of
+// them.
+//
+// The route table is read from server.go rather than listed here on purpose. A
+// hand-maintained list would drift the moment somebody adds a route, and the
+// route it forgot would be exactly the untested one.
+
+var getRouteRe = regexp.MustCompile(`HandleFunc\("GET (/api/[^"]*)"`)
+
+// registeredGETRoutes reads the route table out of the source.
+func registeredGETRoutes(t *testing.T) []string {
+	t.Helper()
+	src, err := os.ReadFile("server.go")
+	if err != nil {
+		t.Fatalf("read server.go: %v", err)
+	}
+	var out []string
+	for _, m := range getRouteRe.FindAllStringSubmatch(string(src), -1) {
+		out = append(out, m[1])
+	}
+	sort.Strings(out)
+	if len(out) < 30 {
+		t.Fatalf("found only %d GET routes; the pattern has drifted from the source", len(out))
+	}
+	return out
+}
+
+// fillPathParams substitutes something plausible for {id}-style wildcards, so a
+// wildcard route is exercised rather than skipped.
+func fillPathParams(route string) string {
+	r := strings.NewReplacer(
+		"{id}", "does-not-exist",
+		"{name}", "does-not-exist",
+		"{kind}", "pipeline",
+	)
+	return r.Replace(route)
+}
+
+func TestEveryGETRouteSurvivesAFreshWorkspace(t *testing.T) {
+	root := t.TempDir()
+	h, err := harness.New(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := h.Init(); err != nil {
+		t.Fatal(err)
+	}
+	s := New(h, nil)
+	handler := s.Handler()
+
+	for _, route := range registeredGETRoutes(t) {
+		path := fillPathParams(route)
+		t.Run(route, func(t *testing.T) {
+			// The event stream never returns; it is the one route this cannot
+			// drive with a recorder.
+			if strings.HasSuffix(route, "/events") {
+				t.Skip("SSE stream — covered by the stream tests")
+			}
+			rec := httptest.NewRecorder()
+			// A panic here would take down the process serving every other
+			// route, so failing loudly on one is the whole point.
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("GET %s panicked on a fresh workspace: %v", path, r)
+				}
+			}()
+			handler.ServeHTTP(rec, newAPIRequest(http.MethodGet, path, nil))
+
+			// 404/400 are legitimate answers for a resource that does not
+			// exist. A 500 is the handler admitting it did not expect this.
+			if rec.Code >= 500 {
+				t.Errorf("GET %s = %d on a fresh workspace: %s",
+					path, rec.Code, strings.TrimSpace(rec.Body.String()))
+			}
+		})
+	}
+}
+
+// A workspace can be left with malformed state — a run killed mid-write, a
+// hand-edited board, a file restored from a bad backup. Absence is handled by
+// the sweep above; malformed content is a different question, and a handler
+// that parses without checking takes the Studio down for every other route.
+func TestEveryGETRouteSurvivesACorruptWorkspace(t *testing.T) {
+	root := t.TempDir()
+	h, err := harness.New(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := h.Init(); err != nil {
+		t.Fatal(err)
+	}
+
+	// Truncated JSON, wrong-typed JSON, and YAML that is not a mapping: the
+	// three shapes a half-written or hand-edited file actually takes.
+	slm := h.Config.SlmDir()
+	for name, body := range map[string]string{
+		"board.json":    `{"tasks":[{"id":"T1","files":`,
+		"squads.json":   `{"squads":"not-a-list"}`,
+		"pipeline.yaml": "- this is a sequence, not a mapping\n",
+		"CONTEXT.md":    "\x00\x01\x02 not text\n",
+	} {
+		if err := os.WriteFile(filepath.Join(slm, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	s := New(h, nil)
+	handler := s.Handler()
+	for _, route := range registeredGETRoutes(t) {
+		path := fillPathParams(route)
+		t.Run(route, func(t *testing.T) {
+			if strings.HasSuffix(route, "/events") {
+				t.Skip("SSE stream — covered by the stream tests")
+			}
+			rec := httptest.NewRecorder()
+			defer func() {
+				if r := recover(); r != nil {
+					t.Fatalf("GET %s panicked on a corrupt workspace: %v", path, r)
+				}
+			}()
+			handler.ServeHTTP(rec, newAPIRequest(http.MethodGet, path, nil))
+			// A 500 is acceptable here — the state really is broken and saying
+			// so is honest. A panic is not: it takes every other route with it.
+		})
+	}
+}