[test] Add tests for cmd.newCompletionCmd

[github-actions]

Test Coverage Improvement: newCompletionCmd

Function Analyzed

• Package: internal/cmd
• Function: newCompletionCmd
• File: internal/cmd/completion.go
• Previous Coverage: 0% (no test file existed)
• New Coverage: ~100% (all branches covered)
• Complexity: Medium — multi-case switch, Args validator, PersistentPreRunE override

Why This Function?

newCompletionCmd had zero test coverage despite being a user-facing CLI command. It contains:

• A 4-way switch (bash / zsh / fish / powershell) where each case calls a different cobra generator
• A default defensive error path that cobra's OnlyValidArgs normally prevents from being reached
• A PersistentPreRunE override that intentionally skips the root command's config-file validation — a critical correctness property with no regression test

Previous agent runs (tracked in cache memory) had improved coverage for cmd.detectGuardWasm, oidc.extractJWTExpiry, and config.AllowOnlyPolicy, leaving this function as the next high-priority target.

Tests Added

• ✅ Structure test — Use, Short, Long, DisableFlagsInUseLine, and ValidArgs metadata
• ✅ PersistentPreRunE override — always returns nil (no args or with args)
• ✅ Args validation — table-driven: all 4 valid shells pass; empty, unknown shell, and 2-arg cases fail
• ✅ Bash completion output — non-empty, contains shell-specific tokens
• ✅ Zsh completion output — non-empty
• ✅ Fish completion output — non-empty
• ✅ PowerShell completion output — non-empty
• ✅ Default branch fallback — calls RunE directly with unknown shell to exercise the defensive default case
• ✅ All shells produce distinct output — regression guard preventing handler mix-ups
• ✅ Parent PersistentPreRunE override — regression guard: completion succeeds even when root's PersistentPreRunE would fail (no config file)

Coverage Report

Before: 0% (no tests)
After:  ~100% (all branches covered, including defensive default)

Test Infrastructure

Tests use an isolated root command (newTestRootWithCompletion) to avoid triggering the real rootCmd's config-validation PersistentPreRunE. Output is captured via captureStdoutDuring, which uses os.Pipe() with immediate os.Stdout restoration (plus a t.Cleanup safety net) — safe for sequential calls within a single test.

---

Generated by Test Coverage Improver
Next candidates: internal/server/response_writer.go, validateCustomServerConfig, resolveGuardPolicyOverride

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• proxy.golang.org
• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Generated by Test Coverage Improver · ● 3.8M · ◷

[Copilot]

Pull request overview

Adds unit tests for the internal/cmd.newCompletionCmd Cobra subcommand to raise coverage from 0% to near-complete, including validation behavior and shell-specific completion generation.

Changes:

• Introduces internal/cmd/completion_test.go covering command metadata, args validation, and PersistentPreRunE override behavior.
• Executes completion for bash/zsh/fish/powershell and asserts non-empty output.
• Directly exercises the defensive default branch in RunE for coverage.

Show a summary per file

File	Description
internal/cmd/completion_test.go	Adds comprehensive tests for the completion command, including output generation and pre-run override regression coverage.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

captureStdoutDuring writes to an os.Pipe() and only starts reading from the pipe after fn() returns. If the completion generator writes more than the pipe buffer (common risk for shell completion scripts as the CLI grows), the write can block and the test can deadlock/hang. Consider draining r concurrently (start a goroutine to io.Copy into a buffer before calling fn()), and use defer to close w/restore os.Stdout so resources are cleaned up even if fn() panics.

[lpcox]

@copilot address the review feedback #4082 (review)