[Repo Assist] test(cmd): cover net.Listen failure branch in setupTLSListener

[github-actions]

🤖 This is an automated PR from Repo Assist, an AI assistant for this repository.

What

Adds TestSetupTLSListener_ListenFailure in internal/cmd/startup_test.go, covering the previously-untested error branch of setupTLSListener where the underlying net.Listen("tcp", listenAddr) call fails (e.g. because the address is already in use).

Why

While looking for test-coverage gaps (Task 9), go tool cover -func showed setupTLSListener at 96.0% — the only uncovered statement was the early-return "failed to listen on %s" error path. All other branches of this function (TLS validation errors, plain HTTP listener, TLS listener, mTLS listener, and the "listener closed on TLS setup failure" path) were already exercised by existing tests.

Approach

The new test occupies a loopback address with a real listener first (mirroring the existing occupiedAddr pattern already used in internal/cmd/delegation_test.go), then calls setupTLSListener against that same address and asserts the wrapped error, nil listener, and tlsEnabled == false.

Test Status

• go build ./... — clean
• go vet ./... — clean
• gofmt -l — clean
• make agent-finished (build + lint + full unit test suite, including Rust guard tests) — all pass
• internal/cmd coverage: 91.8% → 92.0%; setupTLSListener: 96.0% → 100.0%

No production code was changed — this is a test-only addition.

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• example.com
• nonexistent.local
• slow.example.com
• thishostdoesnotexist12345.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"
    - "nonexistent.local"
    - "slow.example.com"
    - "thishostdoesnotexist12345.com"

See Network Configuration for more information.

Generated by Repo Assist · copilot · auto · 518.6 AIC · ⊞ 18.7K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Copilot review overview

🟡 Changes recommended

The test must keep the ephemeral listener open to avoid a port-reacquisition race.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Keep ephemeral listener open to prevent port races in test setup · New

What changed in this PR

Adds coverage for the net.Listen failure path in setupTLSListener.

Changes:

• Adds a test using an occupied loopback address.
• Verifies the wrapped error, nil listener, and disabled TLS state.

File	Description
internal/​cmd/​startup_test.go	Adds listener-failure coverage; address reservation is vulnerable to a race.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation, no extra-isolation runtime)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (star_repository, issue_write, add_issue_comment, create_branch)	"unknown tool" (-32602) — absent from catalog, not a gateway-specific refusal	BLOCKED	⚠️
C	CLI	reads (same ops via proxied github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	not attempted — gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• No write leaked through any surface in this run.
• Part B: the exposed github CLI catalog only lists 23 read tools (get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests, list_releases, list_repository_collaborators, list_starred_repositories, list_tags, pull_request_read, search_code, search_commits, search_issues, search_pull_requests, search_repositories). Attempted writes (star_repository, issue_write, add_issue_comment, create_branch) all returned Error [-32602]: unknown tool, confirming they were never registered by the backend (gh-aw's tools.github: always sets GITHUB_READ_ONLY=1). This proves backend/toolset configuration, not mcpg's own gateway-level DIFC/guard blocking layer — recorded as INCONCLUSIVE per the test's validation criteria.
• Parts D/E: gh auth status reported no authenticated GitHub host in this environment, so REST/GraphQL write attempts against the live API could not be exercised; recorded as INCONCLUSIVE rather than assumed PASS.
• Independent evidence of the gateway's own write-blocking (DIFC/guard) layer is covered by internal/guard and internal/difc unit tests, not by this probe.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all 6 targets absent from the 23-tool catalog exposed by the gateway (GITHUB_READ_ONLY=1 backend)	BLOCKED	⚠️
C	CLI	reads (github CLI proxy: list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated in this environment — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated in this environment — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked in any part. ⚠️ rows: (B) all 6 write tools are absent from the MCP catalog entirely (gh-aw's tools.github: always sets GITHUB_READ_ONLY=1 on the backend), so this run only confirms backend/toolset configuration, not mcpg's independent gateway-level DIFC blocking — that guarantee is separately covered by internal/guard/internal/difc unit tests. (D/E) the gh CLI was not authenticated in this workflow environment, so the GitHub-token-scope boundary could not be exercised for REST/GraphQL writes.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[lpcox]

@copilot merge main and fix failing lint checks https://github.com/github/gh-aw-mcpg/actions/runs/35870575800/job/107213267887?pr=13709

[Copilot]

@copilot merge main and fix failing lint checks https://github.com/github/gh-aw-mcpg/actions/runs/35870575800/job/107213267887?pr=13709

Merged main in 90b9af4 and fixed the gofmt lint failure in f74dfcf. Validation passed with go test ./internal/cmd -run TestSetupTLSListener -count=1, make lint, and make agent-finished.