From 92e9530adbfe5948c47b0a7b2f9b4933630dbf2c Mon Sep 17 00:00:00 2001
From: Rolando Santamaria Maso <kyberneees@gmail.com>
Date: Wed, 28 Oct 2026 16:53:09 +0100
Subject: [PATCH 1/4] Raise test coverage from 74% to 97% of lines

New tests for the server (http, index, main, git, settings, watch, update,
pty, files, browser) and the client (api, util, palette, menu, auth, updates,
icons, git, highlight, terminal, boxdraw). Client DOM modules run against a
small dependency-free fake DOM in test/helpers/fakedom.ts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/boxdraw.test.ts            | 141 +++++
 test/browser.coverage.test.ts   | 152 ++++++
 test/client.api.test.ts         |  99 ++++
 test/client.auth.test.ts        |  67 +++
 test/client.git.test.ts         |  99 ++++
 test/client.icons.test.ts       |  42 ++
 test/client.menu.test.ts        | 130 +++++
 test/client.palette.test.ts     | 326 +++++++++++
 test/client.updates.test.ts     | 250 +++++++++
 test/client.util.test.ts        | 219 ++++++++
 test/files.coverage.test.ts     |  26 +
 test/helpers/fakedom.ts         | 350 ++++++++++++
 test/highlight.coverage.test.ts | 234 ++++++++
 test/http.coverage.test.ts      | 477 ++++++++++++++++
 test/index.coverage.test.ts     | 140 +++++
 test/main.test.ts               | 358 ++++++++++++
 test/pty.coverage.test.ts       | 196 +++++++
 test/servergit.coverage.test.ts | 248 +++++++++
 test/settings.coverage.test.ts  |  73 +++
 test/terminal.coverage.test.ts  | 937 ++++++++++++++++++++++++++++++++
 test/update.coverage.test.ts    | 271 +++++++++
 test/watch.coverage.test.ts     |  83 +++
 22 files changed, 4918 insertions(+)
 create mode 100644 test/boxdraw.test.ts
 create mode 100644 test/browser.coverage.test.ts
 create mode 100644 test/client.api.test.ts
 create mode 100644 test/client.auth.test.ts
 create mode 100644 test/client.git.test.ts
 create mode 100644 test/client.icons.test.ts
 create mode 100644 test/client.menu.test.ts
 create mode 100644 test/client.palette.test.ts
 create mode 100644 test/client.updates.test.ts
 create mode 100644 test/client.util.test.ts
 create mode 100644 test/files.coverage.test.ts
 create mode 100644 test/helpers/fakedom.ts
 create mode 100644 test/highlight.coverage.test.ts
 create mode 100644 test/http.coverage.test.ts
 create mode 100644 test/index.coverage.test.ts
 create mode 100644 test/main.test.ts
 create mode 100644 test/pty.coverage.test.ts
 create mode 100644 test/servergit.coverage.test.ts
 create mode 100644 test/settings.coverage.test.ts
 create mode 100644 test/terminal.coverage.test.ts
 create mode 100644 test/update.coverage.test.ts
 create mode 100644 test/watch.coverage.test.ts

diff --git a/test/boxdraw.test.ts b/test/boxdraw.test.ts
new file mode 100644
index 0000000..3c5bc15
--- /dev/null
+++ b/test/boxdraw.test.ts
@@ -0,0 +1,141 @@
+import { describe, expect, test } from "bun:test";
+import { drawProcedural, isProcedural } from "../src/client/term/boxdraw.ts";
+
+type Op = [string, ...number[]];
+
+function fakeCtx() {
+  const ops: Op[] = [];
+  const stack: number[] = [];
+  const ctx = {
+    fillStyle: "#fff",
+    strokeStyle: "",
+    lineWidth: 0,
+    globalAlpha: 1,
+    save: () => (stack.push(ctx.globalAlpha), ops.push(["save"])),
+    restore: () => (ctx.globalAlpha = stack.pop()!, ops.push(["restore"])),
+    beginPath: () => ops.push(["begin"]),
+    stroke: () => ops.push(["stroke"]),
+    moveTo: (x: number, y: number) => ops.push(["moveTo", x, y]),
+    lineTo: (x: number, y: number) => ops.push(["lineTo", x, y]),
+    arcTo: (...a: number[]) => ops.push(["arcTo", ...a]),
+    fillRect: (x: number, y: number, w: number, h: number) => ops.push(["rect", x, y, w, h]),
+  };
+  return { ctx: ctx as unknown as CanvasRenderingContext2D, raw: ctx, ops };
+}
+
+const draw = (cp: number, w = 10, h = 20, dpr = 1) => {
+  const f = fakeCtx();
+  drawProcedural(f.ctx, cp, 0, 0, w, h, dpr);
+  return f;
+};
+
+describe("boxdraw: isProcedural", () => {
+  test("covers lines and blocks, excludes dashed/diagonals and other ranges", () => {
+    expect(isProcedural(0x2500)).toBe(true); // ─
+    expect(isProcedural(0x254c)).toBe(false); // dashed
+    expect(isProcedural(0x2571)).toBe(false); // diagonal
+    expect(isProcedural(0x256d)).toBe(true); // rounded
+    expect(isProcedural(0x2580)).toBe(true);
+    expect(isProcedural(0x259f)).toBe(true);
+    expect(isProcedural(0x25a0)).toBe(false);
+    expect(isProcedural(0x41)).toBe(false);
+  });
+});
+
+describe("boxdraw: lines", () => {
+  test("light horizontal is two arms overlapping at the center, spanning the cell", () => {
+    expect(draw(0x2500).ops).toEqual([["rect", 0, 9, 5, 1], ["rect", 4, 9, 6, 1]]);
+  });
+
+  test("light vertical", () => {
+    expect(draw(0x2502).ops).toEqual([["rect", 4, 0, 1, 10], ["rect", 4, 9, 1, 11]]);
+  });
+
+  test("heavy line is twice as thick", () => {
+    expect(draw(0x2501).ops).toEqual([["rect", 0, 9, 5, 2], ["rect", 4, 9, 6, 2]]);
+  });
+
+  test("dpr scales thickness", () => {
+    const { ops } = draw(0x2502, 10, 20, 2);
+    expect(ops[0]![3]).toBe(2);
+  });
+
+  test("corner draws two segments that meet", () => {
+    expect(draw(0x250c).ops).toEqual([["rect", 4, 9, 1, 11], ["rect", 4, 9, 6, 1]]); // ┌
+  });
+
+  test("cross draws four segments", () => {
+    expect(draw(0x253c).ops.length).toBe(4);
+  });
+
+  test("double lines draw two parallel rects per arm", () => {
+    expect(draw(0x2550).ops).toEqual([["rect", 0, 8, 6, 1], ["rect", 0, 10, 6, 1], ["rect", 3, 8, 7, 1], ["rect", 3, 10, 7, 1]]);
+    expect(draw(0x2551).ops.length).toBe(4);
+  });
+
+  test("mixed heavy/light and half lines", () => {
+    expect(draw(0x257a).ops).toEqual([["rect", 4, 9, 6, 2]]); // heavy right
+    expect(draw(0x2574).ops.length).toBe(1); // light left
+    expect(draw(0x2578).ops.length).toBe(1); // heavy left
+    expect(draw(0x257c).ops).toEqual([["rect", 0, 9, 5, 1], ["rect", 4, 9, 6, 2]]); // light left, heavy right
+  });
+
+  test("rounded corners stroke an arc with the foreground color", () => {
+    for (const cp of [0x256d, 0x256e, 0x256f, 0x2570]) {
+      const { ops, raw } = draw(cp);
+      expect(ops[0]![0]).toBe("save");
+      expect(ops.some((o) => o[0] === "arcTo")).toBe(true);
+      expect(ops.some((o) => o[0] === "stroke")).toBe(true);
+      expect(ops.at(-1)![0]).toBe("restore");
+      expect(raw.strokeStyle).toBe("#fff");
+    }
+  });
+});
+
+describe("boxdraw: blocks", () => {
+  test("half blocks", () => {
+    expect(draw(0x2580).ops).toEqual([["rect", 0, 0, 10, 10]]);
+    expect(draw(0x2584).ops).toEqual([["rect", 0, 10, 10, 10]]);
+    expect(draw(0x258c).ops).toEqual([["rect", 0, 0, 5, 20]]);
+    expect(draw(0x2590).ops).toEqual([["rect", 5, 0, 5, 20]]);
+  });
+
+  test("full block and eighths", () => {
+    expect(draw(0x2588).ops).toEqual([["rect", 0, 0, 10, 20]]);
+    const low = draw(0x2581, 8, 16).ops[0]!;
+    expect(low.slice(1)).toEqual([0, 14, 8, 2]);
+    const left = draw(0x258f, 8, 16).ops[0]!;
+    expect(left.slice(1)).toEqual([0, 0, 1, 16]);
+  });
+
+  test("shades use alpha and restore it", () => {
+    const f = fakeCtx();
+    const alphas: number[] = [];
+    const orig = f.raw.fillRect;
+    f.raw.fillRect = (...a: [number, number, number, number]) => {
+      alphas.push(f.raw.globalAlpha);
+      orig(...a);
+    };
+    for (const cp of [0x2591, 0x2592, 0x2593]) drawProcedural(f.ctx, cp, 0, 0, 10, 20, 1);
+    expect(alphas).toEqual([0.25, 0.5, 0.75]);
+    expect(f.raw.globalAlpha).toBe(1);
+  });
+
+  test("upper and right eighths", () => {
+    expect(draw(0x2594, 8, 16).ops[0]!.slice(1)).toEqual([0, 0, 8, 2]);
+    expect(draw(0x2595, 8, 16).ops[0]!.slice(1)).toEqual([7, 0, 1, 16]);
+  });
+
+  test("quadrants", () => {
+    expect(draw(0x2596).ops).toEqual([["rect", 0, 10, 5, 10]]); // lower left
+    expect(draw(0x2597).ops).toEqual([["rect", 5, 10, 5, 10]]); // lower right
+    expect(draw(0x2598).ops).toEqual([["rect", 0, 0, 5, 10]]); // upper left
+    expect(draw(0x259b).ops.length).toBe(3); // UL+UR+LL
+    expect(draw(0x259f).ops.length).toBe(3); // UR+LL+LR
+    expect(draw(0x259a).ops.length).toBe(2); // UL+LR
+    expect(draw(0x259e).ops.length).toBe(2); // UR+LL
+    expect(draw(0x259c).ops.length).toBe(3);
+    expect(draw(0x2599).ops.length).toBe(3);
+    expect(draw(0x259d).ops).toEqual([["rect", 5, 0, 5, 10]]);
+  });
+});
diff --git a/test/browser.coverage.test.ts b/test/browser.coverage.test.ts
new file mode 100644
index 0000000..774b50b
--- /dev/null
+++ b/test/browser.coverage.test.ts
@@ -0,0 +1,152 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { chmod, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { appWindowArgs, bootPage, closeAppWindow, findAppBrowser, findMacApp, pickFolder, runAppWindow } from "../src/server/browser.ts";
+
+let tmp = "";
+const env = { PATH: process.env.PATH, B: process.env.CODEVIEWER_BROWSER };
+beforeEach(async () => {
+  tmp = await mkdtemp(path.join(tmpdir(), "cv-browser-"));
+});
+afterEach(async () => {
+  process.env.PATH = env.PATH;
+  if (env.B === undefined) delete process.env.CODEVIEWER_BROWSER;
+  else process.env.CODEVIEWER_BROWSER = env.B;
+  await rm(tmp, { recursive: true, force: true });
+});
+
+async function script(name: string, body: string) {
+  const p = path.join(tmp, name);
+  await writeFile(p, `#!/bin/sh\n${body}\n`);
+  await chmod(p, 0o755);
+  return p;
+}
+
+test("appWindowArgs isolates the window: own profile, dead proxy, no resolver", () => {
+  const a = appWindowArgs("file:///x.html", "/tmp/prof");
+  expect(a).toContain("--app=file:///x.html");
+  expect(a).toContain("--user-data-dir=/tmp/prof");
+  expect(a).toContain("--proxy-server=127.0.0.1:9");
+  expect(a.some((x) => x.startsWith("--host-resolver-rules=MAP * ~NOTFOUND"))).toBe(true);
+  expect(a).toContain("--disable-extensions");
+  expect(a.every((x) => x.startsWith("--"))).toBe(true);
+  expect(a).not.toContain("--no-sandbox");
+});
+
+test("bootPage writes a private redirect page, strips unsafe chars, and cleans up once", async () => {
+  const url = 'http://127.0.0.1:1234/?t=abc"><script>alert(1)</script>#x';
+  const b = await bootPage(url);
+  const file = fileURLToPath(b.fileUrl);
+  expect(existsSync(file)).toBe(true);
+  const html = await readFile(file, "utf8");
+  expect(html).toContain('http-equiv="refresh"');
+  expect(html).not.toContain("<script>");
+  expect(html.match(/content="0;url=([^"]*)"/)![1]).toBe("http://127.0.0.1:1234/?t=abcscriptalert1/script#x");
+  expect(html).toContain("http://127.0.0.1:1234/?t=abc");
+  if (process.platform !== "win32") {
+    expect((await stat(file)).mode & 0o777).toBe(0o600);
+    expect((await stat(path.dirname(file))).mode & 0o777).toBe(0o700);
+  }
+  await b.cleanup();
+  expect(existsSync(path.dirname(file))).toBe(false);
+  await b.cleanup(); // idempotent
+});
+
+test("findAppBrowser prefers $CODEVIEWER_BROWSER when it exists", async () => {
+  const fake = await script("mybrowser", "exit 0");
+  process.env.CODEVIEWER_BROWSER = fake;
+  expect(findAppBrowser()).toEqual({ path: fake, bundled: false });
+});
+
+test("findAppBrowser ignores a missing $CODEVIEWER_BROWSER", () => {
+  process.env.CODEVIEWER_BROWSER = path.join(tmp, "nope");
+  const r = findAppBrowser();
+  if (r) expect(r.path).not.toBe(path.join(tmp, "nope"));
+});
+
+test.skipIf(process.platform === "darwin")("findAppBrowser finds a Chromium-family browser on PATH (Linux)", async () => {
+  delete process.env.CODEVIEWER_BROWSER;
+  const exeDir = path.dirname(process.execPath);
+  if (existsSync(path.join(exeDir, "chromium", "chrome"))) return; // bundled copy wins
+  const fake = await script("chromium", "exit 0");
+  process.env.PATH = tmp;
+  expect(findAppBrowser()).toEqual({ path: fake, bundled: false });
+});
+
+test.skipIf(process.platform === "darwin")("findAppBrowser returns null with nothing installed (Linux)", () => {
+  delete process.env.CODEVIEWER_BROWSER;
+  if (existsSync(path.join(path.dirname(process.execPath), "chromium", "chrome"))) return;
+  process.env.PATH = tmp;
+  expect(findAppBrowser()).toBeNull();
+});
+
+test("findMacApp is null off macOS and a .app path (or null) on macOS", () => {
+  const r = findMacApp();
+  if (process.platform !== "darwin") expect(r).toBeNull();
+  else if (r) expect(r.endsWith(".app")).toBe(true);
+});
+
+test("runAppWindow resolves 'closed' when the browser exits cleanly, and removes its temp profile", async () => {
+  const log = path.join(tmp, "args.txt");
+  const fake = await script("ok", `printf '%s\\n' "$@" > '${log}'\nexit 0`);
+  expect(await runAppWindow(fake, "http://127.0.0.1:9999/?t=secret")).toBe("closed");
+  const args = (await readFile(log, "utf8")).split("\n");
+  // The token-bearing URL must never reach argv; a boot page is used instead.
+  expect(args.join(" ")).not.toContain("secret");
+  const app = args.find((a) => a.startsWith("--app="))!;
+  expect(app.startsWith("--app=file://")).toBe(true);
+  const profile = args.find((a) => a.startsWith("--user-data-dir="))!.slice("--user-data-dir=".length);
+  expect(existsSync(profile)).toBe(false);
+  expect(existsSync(fileURLToPath(app.slice("--app=".length)))).toBe(false);
+});
+
+test("runAppWindow resolves 'failed' on a quick non-zero exit and explains sandbox errors", async () => {
+  const fake = await script("sandboxfail", `echo "No usable sandbox!" >&2\nexit 1`);
+  const errs: string[] = [];
+  const orig = console.error;
+  console.error = (...a: unknown[]) => void errs.push(a.join(" "));
+  try {
+    expect(await runAppWindow(fake, "http://127.0.0.1:1/")).toBe("failed");
+  } finally {
+    console.error = orig;
+  }
+  expect(errs.join("\n")).toContain("sandbox");
+});
+
+test("runAppWindow echoes the browser's stderr tail for other quick failures", async () => {
+  const fake = await script("otherfail", `echo "boom" >&2\nexit 2`);
+  const errs: string[] = [];
+  const orig = console.error;
+  console.error = (...a: unknown[]) => void errs.push(a.join(" "));
+  try {
+    expect(await runAppWindow(fake, "http://127.0.0.1:1/")).toBe("failed");
+  } finally {
+    console.error = orig;
+  }
+  expect(errs.join("\n")).toContain("boom");
+});
+
+test("closeAppWindow kills the running window so runAppWindow resolves", async () => {
+  const fake = await script("sleeper", "sleep 30");
+  const p = runAppWindow(fake, "http://127.0.0.1:1/");
+  await Bun.sleep(300);
+  closeAppWindow();
+  const r = await Promise.race([p, Bun.sleep(8000).then(() => "timeout")]);
+  expect(r === "closed" || r === "failed").toBe(true);
+  closeAppWindow(); // nothing running: no-op
+});
+
+test.skipIf(process.platform === "darwin")("pickFolder uses zenity, then kdialog, then falls back to home (Linux)", async () => {
+  process.env.PATH = tmp;
+  const home = (await import("node:os")).homedir();
+  expect(await pickFolder()).toBe(home);
+  await script("kdialog", `echo /picked/kde`);
+  expect(await pickFolder()).toBe("/picked/kde");
+  await script("zenity", `echo /picked/gtk`);
+  expect(await pickFolder()).toBe("/picked/gtk");
+  await script("zenity", `exit 1`); // cancel
+  expect(await pickFolder()).toBeNull();
+});
diff --git a/test/client.api.test.ts b/test/client.api.test.ts
new file mode 100644
index 0000000..a1b97f0
--- /dev/null
+++ b/test/client.api.test.ts
@@ -0,0 +1,99 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mockFetch } from "./helpers/fakedom.ts";
+import { api } from "../src/client/api.ts";
+
+let restore = () => {};
+afterEach(() => restore());
+const use = (h: Parameters<typeof mockFetch>[0]) => {
+  const m = mockFetch(h);
+  restore = m.restore;
+  return m.calls;
+};
+
+describe("api", () => {
+  test("info / list / gitStatus hit the right URLs (path is encoded)", async () => {
+    const calls = use((url) => Response.json(url.startsWith("/api/list") ? [{ name: "a b", type: "file" }] : { ok: 1 }));
+    expect(await api.info()).toEqual({ ok: 1 } as never);
+    expect(await api.list("src/a b&c/")).toEqual([{ name: "a b", type: "file" }]);
+    await api.gitStatus();
+    expect(calls.map((c) => c.url)).toEqual(["/api/info", "/api/list?path=src%2Fa%20b%26c%2F", "/api/git/status"]);
+  });
+
+  test("errors use the JSON error body, else the status text", async () => {
+    use(() => Response.json({ error: "nope" }, { status: 403 }));
+    await expect(api.info()).rejects.toThrow("nope");
+    restore();
+    use(() => new Response("not json", { status: 500, statusText: "Boom" }));
+    await expect(api.list("x")).rejects.toThrow("Boom");
+  });
+
+  test("index splits lines; empty body means no files", async () => {
+    use(() => new Response("a.ts\nb/c.ts"));
+    expect(await api.index()).toEqual(["a.ts", "b/c.ts"]);
+    restore();
+    use(() => new Response(""));
+    expect(await api.index()).toEqual([]);
+  });
+
+  test("file parses x-cv-* headers and defaults", async () => {
+    const calls = use(() => new Response("hello", { headers: { "x-cv-kind": "image", "x-cv-size": "42", "x-cv-mtime": "1700", "x-cv-truncated": "1", "x-cv-encoding": "UTF-16LE" } }));
+    expect(await api.file("a/b.ts", true)).toEqual({ kind: "image", size: 42, mtime: 1700, truncated: true, encoding: "UTF-16LE", text: "hello" });
+    expect(calls[0]!.url).toBe("/api/file?path=a%2Fb.ts&text=1");
+    restore();
+    const c2 = use(() => new Response("x"));
+    const f = await api.file("p");
+    expect(c2[0]!.url).toBe("/api/file?path=p");
+    expect(f).toMatchObject({ kind: "text", truncated: false, encoding: "UTF-8", text: "x" });
+    expect(f.size).toBe(0);
+  });
+
+  test("stat returns the type or null", async () => {
+    use(() => Response.json({ type: "dir" }));
+    expect(await api.stat("d")).toBe("dir");
+    restore();
+    use(() => new Response("", { status: 404 }));
+    expect(await api.stat("d")).toBeNull();
+  });
+
+  test("gitBase / gitBlame return null on failure", async () => {
+    const calls = use((url) => (url.includes("base") ? new Response("HEAD text") : Response.json({ hash: "abc" })));
+    expect(await api.gitBase("f")).toBe("HEAD text");
+    expect(await api.gitBlame("f", 7)).toEqual({ hash: "abc" } as never);
+    expect(calls.map((c) => c.url)).toEqual(["/api/git/base?path=f", "/api/git/blame?path=f&line=7"]);
+    restore();
+    use(() => new Response("", { status: 404 }));
+    expect(await api.gitBase("f")).toBeNull();
+    expect(await api.gitBlame("f", 1)).toBeNull();
+  });
+
+  test("update / install / relaunch", async () => {
+    const calls = use(() => Response.json({ current: "1.0.0" }));
+    await api.update();
+    await api.update(true);
+    await api.updateInstall();
+    await api.updateRelaunch();
+    expect(calls.map((c) => c.url)).toEqual(["/api/update", "/api/update?check=1", "/api/update/install", "/api/update/relaunch"]);
+    expect(calls[2]!.init).toMatchObject({ method: "POST", body: "{}" });
+    expect(calls[3]!.init?.method).toBe("POST");
+    restore();
+    use(() => Response.json({ error: "locked" }, { status: 409 }));
+    await expect(api.updateInstall()).rejects.toThrow("locked");
+  });
+
+  test("external posts the url as JSON", async () => {
+    const calls = use(() => new Response("{}"));
+    await api.external("https://example.com/x");
+    expect(calls[0]!.url).toBe("/api/external");
+    expect(calls[0]!.init?.method).toBe("POST");
+    expect(JSON.parse(calls[0]!.init!.body as string)).toEqual({ url: "https://example.com/x" });
+  });
+
+  test("rawBlobUrl and head", async () => {
+    const calls = use(() => new Response(new Uint8Array([1, 2, 3])));
+    const url = await api.rawBlobUrl("img.png");
+    expect(url.startsWith("blob:")).toBe(true);
+    URL.revokeObjectURL(url);
+    expect([...(await api.head("img.png", 3))]).toEqual([1, 2, 3]);
+    expect(calls.map((c) => c.url)).toEqual(["/api/raw?path=img.png", "/api/raw?path=img.png&limit=3"]);
+  });
+});
diff --git a/test/client.auth.test.ts b/test/client.auth.test.ts
new file mode 100644
index 0000000..16fdbdc
--- /dev/null
+++ b/test/client.auth.test.ts
@@ -0,0 +1,67 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { installDom, uninstallDom } from "./helpers/fakedom.ts";
+
+afterAll(() => uninstallDom());
+
+describe("auth token", () => {
+  test("takes the token from the fragment, stores it, cleans the URL and wraps fetch", async () => {
+    const dom = installDom({ hash: "#t=abc-123_X" });
+    const seen: { input: unknown; init?: RequestInit }[] = [];
+    dom.window.fetch = async (input: unknown, init?: RequestInit) => {
+      seen.push({ input, init });
+      return new Response("ok");
+    };
+    const a = await import("../src/client/auth.ts?frag");
+    expect(a.token).toBe("abc-123_X");
+    expect(dom.sessionStorage.getItem("cv:token")).toBe("abc-123_X");
+    expect(dom.history.calls).toEqual([[null, "", "/"]]);
+
+    const f = dom.window.fetch as typeof fetch;
+    await f("/api/info", { headers: { "x-other": "1" }, method: "POST" });
+    await f("https://elsewhere.test/x");
+    await f("relative/no-slash");
+    const h0 = new Headers(seen[0]!.init!.headers);
+    expect(h0.get("x-cv-token")).toBe("abc-123_X");
+    expect(h0.get("x-other")).toBe("1");
+    expect(seen[0]!.init!.method).toBe("POST");
+    expect(seen[1]!.init).toEqual({});
+    expect(seen[2]!.init).toEqual({});
+    expect(typeof (f as unknown as { preconnect: unknown }).preconnect).toBe("function");
+
+    // ws url carries the token as a query parameter and switches scheme
+    expect(a.wsUrl("/ws/term?id=1")).toBe("ws://127.0.0.1:4000/ws/term?id=1&t=abc-123_X");
+  });
+
+  test("falls back to sessionStorage when the fragment has no token", async () => {
+    const dom = installDom({ hash: "#other=1" });
+    dom.sessionStorage.setItem("cv:token", "saved");
+    const orig = (dom.window.fetch = async () => new Response(""));
+    const a = await import("../src/client/auth.ts?stored");
+    expect(a.token).toBe("saved");
+    expect(dom.history.calls).toEqual([]);
+    expect(dom.window.fetch).not.toBe(orig);
+  });
+
+  test("no token anywhere: fetch left alone, wsUrl sends empty t, https gives wss", async () => {
+    const dom = installDom({ hash: "", protocol: "https:", href: "https://host.test/app" });
+    const orig = (dom.window.fetch = async () => new Response(""));
+    const a = await import("../src/client/auth.ts?none");
+    expect(a.token).toBeNull();
+    expect(dom.window.fetch).toBe(orig);
+    expect(a.wsUrl("/events")).toBe("wss://host.test/events?t=");
+  });
+
+  test("storage failures are tolerated", async () => {
+    const dom = installDom({ hash: "#t=zzz" });
+    dom.sessionStorage.throws = true;
+    dom.window.fetch = async () => new Response("");
+    const a = await import("../src/client/auth.ts?throws");
+    expect(a.token).toBe("zzz");
+
+    const dom2 = installDom({ hash: "" });
+    dom2.sessionStorage.throws = true;
+    dom2.window.fetch = async () => new Response("");
+    const b = await import("../src/client/auth.ts?throws2");
+    expect(b.token).toBeNull();
+  });
+});
diff --git a/test/client.git.test.ts b/test/client.git.test.ts
new file mode 100644
index 0000000..b10898d
--- /dev/null
+++ b/test/client.git.test.ts
@@ -0,0 +1,99 @@
+import { afterEach, beforeAll, describe, expect, setSystemTime, test } from "bun:test";
+import { GitState, relativeTime, type GitStatus } from "../src/client/git.ts";
+
+const st = (files: Record<string, string>, repo = true): GitStatus => ({ repo, branch: "main", detached: false, oid: null, upstream: null, ahead: 0, behind: 0, state: null, stash: 0, files, head: null });
+
+describe("GitState", () => {
+  test("describes status codes", () => {
+    const g = new GitState();
+    g.set(st({ "a.ts": ".M", "b.ts": "M.", "c.ts": "AM", "d.ts": ".D", "A.ts": "A.", "e.ts": "R.", "f.ts": "UU", "g.ts": "??", "h.ts": "!!", "i.ts": ".T" }));
+    expect(g.repo).toBe(true);
+    expect(g.file("a.ts")).toEqual({ letter: "M", label: "Modified", xy: ".M" });
+    expect(g.file("b.ts")).toMatchObject({ letter: "M", label: "Modified (staged)" });
+    expect(g.file("c.ts")).toMatchObject({ letter: "M", label: "Added (staged), modified" });
+    expect(g.file("d.ts")?.letter).toBe("D");
+    expect(g.file("A.ts")?.letter).toBe("A");
+    expect(g.file("e.ts")).toMatchObject({ letter: "R", label: "Renamed (staged)" });
+    expect(g.file("f.ts")).toMatchObject({ letter: "C", label: "Conflict" });
+    expect(g.file("g.ts")).toMatchObject({ letter: "U", label: "Untracked" });
+    expect(g.file("h.ts")).toMatchObject({ letter: "I", label: "Ignored" });
+    expect(g.file("i.ts")).toMatchObject({ letter: "M", label: "Type changed" });
+    expect(g.file("none.ts")).toBeNull();
+  });
+
+  test("counts exclude ignored; staged counts index entries only", () => {
+    const g = new GitState();
+    g.set(st({ "a": ".M", "b": "M.", "c": "AM", "d": "??", "e": "!!", "f": "UU" }));
+    expect(g.counts).toEqual({ changed: 3, staged: 2, untracked: 1, conflicts: 1 });
+  });
+
+  test("directories take the strongest status inside; prefixes cover descendants", () => {
+    const g = new GitState();
+    g.set(st({ "src/a/x.ts": ".M", "src/a/y.ts": "??", "src/b/z.ts": "UU", "build/": "!!", "tmp/": "??" }));
+    expect(g.dir("src/a")).toBe("M");
+    expect(g.dir("src")).toBe("C");
+    expect(g.dir("src/b")).toBe("C");
+    expect(g.dir("build")).toBe("I");
+    expect(g.dir("build/deep/inner")).toBe("I");
+    expect(g.dir("tmp")).toBe("U");
+    expect(g.dir("other")).toBeNull();
+    expect(g.file("build/out.js")?.letter).toBe("I");
+    expect(g.file("tmp/a/b.txt")?.letter).toBe("U");
+    expect(g.file("src/a/x.ts")?.letter).toBe("M");
+    expect(g.file("builder/x")).toBeNull();
+  });
+
+  test("changedFiles sorted by priority then path, ignored excluded, prefixes keep trailing slash", () => {
+    const g = new GitState();
+    g.set(st({ "z.ts": ".M", "a.ts": ".M", "c.ts": "UU", "new/": "??", "ign/": "!!", "d.ts": ".D" }));
+    expect(g.changedFiles().map((f) => f.path)).toEqual(["c.ts", "d.ts", "a.ts", "z.ts", "new/"]);
+  });
+
+  test("NFD paths match NFC status entries", () => {
+    const g = new GitState();
+    g.set(st({ "café.ts": ".M" }));
+    expect(g.file("café.ts")?.letter).toBe("M");
+  });
+
+  test("cleared: changed -> clean/ignored", () => {
+    const g = new GitState();
+    g.set(st({ "a.ts": ".M", "b.ts": ".M", "dir/": "??" }));
+    g.set(st({ "b.ts": ".M" }));
+    expect(g.cleared("a.ts")).toBe(true);
+    expect(g.cleared("b.ts")).toBe(false);
+    expect(g.cleared("dir/f.txt")).toBe(true);
+    expect(g.cleared("never.ts")).toBe(false);
+    g.set(st({ "b.ts": ".M" }));
+    expect(g.cleared("a.ts")).toBe(false);
+  });
+
+  test("onChange fires on set; missing files map tolerated", () => {
+    const g = new GitState();
+    let n = 0;
+    g.onChange(() => n++);
+    g.set(st({}));
+    g.set({ repo: false } as GitStatus);
+    expect(n).toBe(2);
+    expect(g.repo).toBe(false);
+    expect(g.changedFiles()).toEqual([]);
+  });
+});
+
+describe("relativeTime", () => {
+  const NOW = 1_700_000_000_000;
+  beforeAll(() => setSystemTime(new Date(NOW)));
+  afterEach(() => setSystemTime(new Date(NOW)));
+  test("buckets", () => {
+    const ago = (s: number) => relativeTime(NOW - s * 1000);
+    expect(ago(5)).toBe("just now");
+    expect(ago(60)).toBe("1 minute ago");
+    expect(ago(150)).toBe("3 minutes ago");
+    expect(ago(3600)).toBe("1 hour ago");
+    expect(ago(5 * 3600)).toBe("5 hours ago");
+    expect(ago(86400)).toBe("1 day ago");
+    expect(ago(3 * 86400)).toBe("3 days ago");
+    expect(ago(14 * 86400)).toBe("2 weeks ago");
+    expect(ago(90 * 86400)).toBe("3 months ago");
+    expect(ago(800 * 86400)).toBe("2 years ago");
+  });
+});
diff --git a/test/client.icons.test.ts b/test/client.icons.test.ts
new file mode 100644
index 0000000..4eeac66
--- /dev/null
+++ b/test/client.icons.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, test } from "bun:test";
+import { chevron, fileColor, fileIcon, folderIcon, icons } from "../src/client/icons.ts";
+
+describe("icons", () => {
+  test("fileColor: by extension, case-insensitive", () => {
+    expect(fileColor("a.ts")).toBe("#4b8fe0");
+    expect(fileColor("A.TS")).toBe("#4b8fe0");
+    expect(fileColor("x.tar.gz")).toBe("#a8a5a0");
+  });
+  test("fileColor: named files beat extensions", () => {
+    expect(fileColor("package.json")).toBe("#7cc36a");
+    expect(fileColor("Dockerfile")).toBe("#4f9fe0");
+    expect(fileColor("sub.json")).toBe("#d9a54a");
+  });
+  test("fileColor: unknown extension / no extension fall back to the CSS var", () => {
+    expect(fileColor("a.unknownext")).toBe("var(--icon-file)");
+    expect(fileColor("noext")).toBe("var(--icon-file)");
+  });
+  test("fileIcon embeds the tint", () => {
+    const s = fileIcon("main.rs");
+    expect(s).toContain('class="ico"');
+    expect(s).toContain('stroke="#de7a4f"');
+    expect(s).toContain('fill="#de7a4f"');
+  });
+  test("folderIcon open vs closed differ and use the folder var", () => {
+    const o = folderIcon(true);
+    const c = folderIcon(false);
+    expect(o).not.toBe(c);
+    expect(o).toContain("var(--icon-folder)");
+    expect(c).toContain("var(--icon-folder)");
+    expect(o.match(/<path/g)!.length).toBe(2);
+    expect(c.match(/<path/g)!.length).toBe(1);
+  });
+  test("static icons are svg strings", () => {
+    expect(chevron).toContain('class="chev"');
+    for (const [k, v] of Object.entries(icons)) {
+      expect(v.startsWith("<svg"), k).toBe(true);
+      expect(v.endsWith("</svg>"), k).toBe(true);
+    }
+    expect(icons.logo).toContain("linearGradient");
+  });
+});
diff --git a/test/client.menu.test.ts b/test/client.menu.test.ts
new file mode 100644
index 0000000..4303cf5
--- /dev/null
+++ b/test/client.menu.test.ts
@@ -0,0 +1,130 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { FakeEvent, installDom, uninstallDom, type Dom, type FakeElement } from "./helpers/fakedom.ts";
+
+let dom: Dom;
+let m: typeof import("../src/client/menu.ts");
+beforeAll(async () => {
+  dom = installDom();
+  m = await import("../src/client/menu.ts");
+});
+afterAll(() => uninstallDom());
+beforeEach(() => {
+  m.closeContextMenu();
+  dom.document.body.replaceChildren();
+  dom.window.listeners.clear();
+  dom.document.activeElement = dom.document.body;
+});
+
+const mouse = (x: number, y: number) => new FakeEvent("contextmenu", { clientX: x, clientY: y }) as unknown as MouseEvent;
+const key = (k: string) => new FakeEvent("keydown", { key: k });
+const press = (k: string) => {
+  const e = key(k);
+  dom.window.dispatchEvent(e);
+  return e;
+};
+const menuEl = () => dom.document.body.querySelector<FakeElement>(".ctx-menu");
+const items = () => dom.document.body.querySelectorAll<FakeElement>(".ctx-item");
+
+describe("context menu", () => {
+  test("renders items, prevents default, positions on screen and focuses the first", () => {
+    const e = mouse(30, 40);
+    m.showContextMenu(e, [{ label: "Open", run() {} }, { label: "Delete", run() {} }]);
+    expect(e.defaultPrevented).toBe(true);
+    expect(m.isContextMenuOpen()).toBe(true);
+    expect(menuEl()!.getAttribute("role")).toBe("menu");
+    expect(items().map((i) => i.textContent)).toEqual(["Open", "Delete"]);
+    expect(items()[0]!.getAttribute("role")).toBe("menuitem");
+    expect(menuEl()!.style).toMatchObject({ left: "30px", top: "40px" });
+    expect(items()[0]!.focused).toBe(true);
+  });
+
+  test("clamps near the right/bottom edge and left/top edge", () => {
+    m.showContextMenu(mouse(990, 790), [{ label: "a", run() {} }]);
+    expect(menuEl()!.style).toMatchObject({ left: "896px", top: "756px" }); // 1000-100-4, 800-40-4
+    m.showContextMenu(mouse(-5, 0), [{ label: "a", run() {} }]);
+    expect(menuEl()!.style).toMatchObject({ left: "4px", top: "4px" });
+  });
+
+  test("clicking an item closes the menu then runs it", () => {
+    let openDuringRun: boolean | null = null;
+    m.showContextMenu(mouse(0, 0), [{ label: "Go", run: () => (openDuringRun = m.isContextMenuOpen()) }]);
+    items()[0]!.dispatchEvent(new FakeEvent("click") as unknown as Event);
+    expect(openDuringRun).toBe(false);
+    expect(menuEl()).toBeNull();
+    expect(dom.window.listenerCount("keydown")).toBe(0);
+  });
+
+  test("opening a second menu replaces the first", () => {
+    m.showContextMenu(mouse(0, 0), [{ label: "one", run() {} }]);
+    m.showContextMenu(mouse(0, 0), [{ label: "two", run() {} }]);
+    expect(dom.document.body.querySelectorAll(".ctx-menu").length).toBe(1);
+    expect(items()[0]!.textContent).toBe("two");
+  });
+
+  test("arrow keys cycle focus with wraparound and stop propagation", () => {
+    m.showContextMenu(mouse(0, 0), ["a", "b", "c"].map((label) => ({ label, run() {} })));
+    const [a, b, c] = items();
+    const e = press("ArrowDown");
+    expect(e.defaultPrevented).toBe(true);
+    expect(e.propagationStopped).toBe(true);
+    expect(b!.focused).toBe(true);
+    press("ArrowDown");
+    expect(c!.focused).toBe(true);
+    press("ArrowDown");
+    expect(a!.focused).toBe(true);
+    press("ArrowUp");
+    expect(c!.focused).toBe(true);
+    expect(m.isContextMenuOpen()).toBe(true);
+  });
+
+  test("modifier keys are ignored; Enter inside the menu is left to the button; other keys close", () => {
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    for (const k of ["Shift", "Control", "Alt", "Meta"]) press(k);
+    expect(m.isContextMenuOpen()).toBe(true);
+    const enter = press("Enter");
+    expect(enter.defaultPrevented).toBe(false);
+    expect(m.isContextMenuOpen()).toBe(true);
+    press("x");
+    expect(m.isContextMenuOpen()).toBe(false);
+  });
+
+  test("Enter with focus outside the menu is swallowed without closing", () => {
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    dom.document.body.focus();
+    const e = press(" ");
+    expect(e.defaultPrevented).toBe(true);
+    expect(m.isContextMenuOpen()).toBe(true);
+  });
+
+  test("Escape and outside mousedown close; inside mousedown does not", () => {
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    dom.window.dispatchEvent(new FakeEvent("mousedown", { target: items()[0] }));
+    expect(m.isContextMenuOpen()).toBe(true);
+    dom.window.dispatchEvent(new FakeEvent("mousedown", { target: dom.document.body }));
+    expect(m.isContextMenuOpen()).toBe(false);
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    press("Escape");
+    expect(m.isContextMenuOpen()).toBe(false);
+  });
+
+  test("window blur / resize close it (transient)", () => {
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    dom.window.dispatchEvent(new FakeEvent("blur"));
+    expect(m.isContextMenuOpen()).toBe(false);
+  });
+
+  test("focus returns to the previously focused element on close", () => {
+    const btn = dom.document.createElement("button");
+    dom.document.body.append(btn);
+    btn.focus();
+    m.showContextMenu(mouse(0, 0), [{ label: "a", run() {} }]);
+    expect(btn.focused).toBe(false);
+    m.closeContextMenu();
+    expect(dom.document.activeElement).toBe(btn);
+  });
+
+  test("closeContextMenu is a no-op when nothing is open", () => {
+    m.closeContextMenu();
+    expect(m.isContextMenuOpen()).toBe(false);
+  });
+});
diff --git a/test/client.palette.test.ts b/test/client.palette.test.ts
new file mode 100644
index 0000000..ca39847
--- /dev/null
+++ b/test/client.palette.test.ts
@@ -0,0 +1,326 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { FakeEvent, installDom, mockFetch, uninstallDom, type Dom, type FakeElement } from "./helpers/fakedom.ts";
+
+let dom: Dom;
+let P: typeof import("../src/client/palette.ts");
+beforeAll(async () => {
+  dom = installDom();
+  P = await import("../src/client/palette.ts");
+});
+afterAll(() => uninstallDom());
+
+describe("fuzzy", () => {
+  test("non-subsequence is null; empty query matches", () => {
+    expect(P.fuzzy("xyz", "abc")).toBeNull();
+    expect(P.fuzzy("ba", "ab")).toBeNull();
+    expect(P.fuzzy("", "abc")!.pos).toEqual([]);
+  });
+  test("positions are of the matched characters", () => {
+    expect(P.fuzzy("ac", "abc")!.pos).toEqual([0, 2]);
+  });
+  test("prefers word-boundary hits over mid-word hits", () => {
+    const a = P.fuzzy("fb", "foo-bar")!;
+    const b = P.fuzzy("fb", "fabulous")!;
+    expect(a.pos).toEqual([0, 4]);
+    expect(a.score).toBeGreaterThan(b.score);
+  });
+  test("contiguous runs beat scattered; camelCase humps count as boundaries", () => {
+    expect(P.fuzzy("abc", "abcxx")!.score).toBeGreaterThan(P.fuzzy("abc", "axbxc")!.score);
+    expect(P.fuzzy("gs", "getState")!.pos).toEqual([0, 3]);
+  });
+  test("case-exact match gets a small bonus", () => {
+    expect(P.fuzzy("A", "A")!.score).toBeGreaterThan(P.fuzzy("a", "A")!.score);
+  });
+  test("spaces in the query are skipped; longer strings are penalised slightly", () => {
+    expect(P.fuzzy("a b", "a-b")!.pos).toEqual([0, 2]);
+    expect(P.fuzzy("a", "a")!.score).toBeGreaterThan(P.fuzzy("a", "a" + "z".repeat(50))!.score);
+  });
+});
+
+describe("scorePath / searchPaths", () => {
+  test("basename matches outrank directory matches; exact-length basename gets a bonus", () => {
+    const base = P.scorePath("app", "src/app.ts")!;
+    const dir = P.scorePath("app", "app/src/x.ts")!;
+    expect(base.score).toBeGreaterThan(dir.score);
+    expect(P.scorePath("app", "src/app")!.score).toBeGreaterThan(P.scorePath("app", "src/apple")!.score);
+    expect(P.scorePath("zzz", "src/app.ts")).toBeNull();
+  });
+
+  const files = ["src/app.ts", "src/client/palette.ts", "src/server/apps.ts", "README.md", "test/palette.test.ts"];
+  const lower = files.map((f) => f.toLowerCase());
+  test("returns ranked matches and all hit indices", () => {
+    const r = P.searchPaths("pal", files, lower, null);
+    expect(r.best.map((b) => b.p)).toEqual(["test/palette.test.ts", "src/client/palette.ts"]); // equal basename scores, shorter path wins
+    expect([...r.hits]).toEqual([1, 4]);
+  });
+  test("a previous hit set narrows the scan", () => {
+    const r1 = P.searchPaths("a", files, lower, null);
+    const r2 = P.searchPaths("ap", files, lower, r1.hits);
+    expect(r2.best.map((b) => b.p).sort()).toEqual(["src/app.ts", "src/server/apps.ts"]);
+    // narrowing with a hit set that excludes a file means it is not considered
+    const r3 = P.searchPaths("ap", files, lower, Int32Array.from([0]));
+    expect(r3.best.map((b) => b.p)).toEqual(["src/app.ts"]);
+  });
+  test("caps results at 80 and keeps the best", () => {
+    const many = Array.from({ length: 200 }, (_, i) => `d/file${i}.ts`).concat(["zzz.ts"]);
+    const r = P.searchPaths("zzz", many, many.map((f) => f.toLowerCase()), null);
+    expect(r.best.length).toBe(1);
+    const r2 = P.searchPaths("file", many, many.map((f) => f.toLowerCase()), null);
+    expect(r2.best.length).toBe(80);
+    expect(r2.hits.length).toBe(200);
+  });
+});
+
+describe("Palette", () => {
+  let restore = () => {};
+  afterEach(() => restore());
+
+  const make = async (index: string[] = ["src/a.ts", "src/b.ts", "docs/readme.md"]) => {
+    const m = mockFetch(() => new Response(index.join("\n")));
+    restore = m.restore;
+    const p = new P.Palette();
+    const input = p.el.querySelector<FakeElement>(".palette-input")!;
+    const list = p.el.querySelector<FakeElement>(".palette-list")!;
+    const type = (v: string) => {
+      input.value = v;
+      input.dispatchEvent(new FakeEvent("input"));
+    };
+    const key = (k: string, o: Record<string, unknown> = {}) => {
+      const e = new FakeEvent("keydown", { key: k, ...o });
+      input.dispatchEvent(e);
+      return e;
+    };
+    const rows = () => [...list.innerHTML.matchAll(/<div class="pal-item( sel)?" data-i="(\d+)"/g)].map((r) => ({ sel: !!r[1], i: +r[2]! }));
+    const flush = () => new Promise((r) => setTimeout(r, 0));
+    return { p, input, list, type, key, rows, flush, calls: m.calls };
+  };
+
+  test("starts hidden; open shows, focuses and loads the index once", async () => {
+    const t = await make();
+    expect(t.p.isOpen).toBe(false);
+    t.p.open();
+    expect(t.p.isOpen).toBe(true);
+    expect(t.input.focused).toBe(true);
+    // open() renders before the fetch starts, so only typing while loading shows the message
+    t.type("a");
+    expect(t.list.innerHTML).toContain("Indexing files");
+    t.type("");
+    await t.flush();
+    expect(t.rows().length).toBe(3);
+    expect(t.list.innerHTML).toContain("a.ts");
+    t.p.close();
+    t.p.open();
+    await t.flush();
+    expect(t.calls.length).toBe(1);
+    t.p.invalidate();
+    t.p.open();
+    await t.flush();
+    expect(t.calls.length).toBe(2);
+  });
+
+  test("recent files come first and unknown ones are dropped", async () => {
+    const t = await make();
+    t.p.recent = ["docs/readme.md", "gone.ts"];
+    t.p.open();
+    await t.flush();
+    const html = t.list.innerHTML;
+    expect(html.indexOf("readme.md")).toBeLessThan(html.indexOf("a.ts"));
+    expect(html).not.toContain("gone.ts");
+  });
+
+  test("typing filters, highlights matches, and Enter opens the selection", async () => {
+    const t = await make();
+    t.p.open();
+    await t.flush();
+    const opened: [string, number | undefined][] = [];
+    t.p.onOpenFile = (p, l) => opened.push([p, l]);
+    t.type("rdm");
+    expect(t.rows().length).toBe(1);
+    expect(t.list.innerHTML).toContain("<b>r</b>");
+    t.key("Enter");
+    expect(opened).toEqual([["docs/readme.md", undefined]]);
+    expect(t.p.isOpen).toBe(false);
+  });
+
+  test("path:line opens at the line; no match shows a message", async () => {
+    const t = await make();
+    t.p.open();
+    await t.flush();
+    const opened: [string, number | undefined][] = [];
+    t.p.onOpenFile = (p, l) => opened.push([p, l]);
+    t.type("b.ts:42");
+    t.key("Enter");
+    expect(opened).toEqual([["src/b.ts", 42]]);
+    t.p.open();
+    t.type("qqqq");
+    expect(t.list.innerHTML).toContain("No matching files");
+  });
+
+  test("incremental typing reuses narrowed hits and still gives correct results", async () => {
+    const t = await make(["src/alpha.ts", "src/beta.ts", "src/alphabet.ts"]);
+    t.p.open();
+    await t.flush();
+    t.type("al");
+    expect(t.rows().length).toBe(2);
+    t.type("alpha");
+    expect(t.rows().length).toBe(2);
+    t.type("alphab");
+    expect(t.rows().length).toBe(1);
+    t.type("a"); // shorter: not a prefix extension of the last query
+    expect(t.rows().length).toBe(3);
+  });
+
+  test("arrow keys and ctrl+n/p move the selection with wraparound; handled keys are prevented", async () => {
+    const t = await make(["a.ts", "b.ts", "c.ts"]);
+    t.p.open();
+    await t.flush();
+    const opened: string[] = [];
+    t.p.onOpenFile = (p) => opened.push(p);
+    const pick = () => {
+      t.key("Enter");
+      t.p.open();
+      return opened.at(-1);
+    };
+    expect(t.key("ArrowUp").defaultPrevented).toBe(true); // wraps to the last
+    expect(pick()).toBe("c.ts");
+    await t.flush();
+    t.key("n", { ctrlKey: true });
+    t.key("n", { ctrlKey: true });
+    t.key("ArrowDown"); // 0 -> 1 -> 2 -> 0
+    expect(pick()).toBe("a.ts");
+    await t.flush();
+    t.key("p", { ctrlKey: true });
+    expect(pick()).toBe("c.ts");
+  });
+
+  test("selection index maps to the item run on Enter", async () => {
+    const t = await make(["a.ts", "b.ts", "c.ts"]);
+    t.p.open();
+    await t.flush();
+    const got: string[] = [];
+    t.p.onOpenFile = (p) => got.push(p);
+    t.key("ArrowDown");
+    t.key("Enter");
+    expect(got).toEqual(["b.ts"]);
+  });
+
+  test("Escape closes; unknown keys are not prevented; backdrop mousedown closes", async () => {
+    const t = await make();
+    t.p.open();
+    expect(t.key("x").defaultPrevented).toBe(false);
+    t.key("Escape");
+    expect(t.p.isOpen).toBe(false);
+    t.p.open();
+    t.p.el.dispatchEvent(new FakeEvent("mousedown"));
+    expect(t.p.isOpen).toBe(false);
+    t.p.open();
+    t.p.el.children[0]!.dispatchEvent(new FakeEvent("mousedown")); // inside the box: target is not el
+    expect(t.p.isOpen).toBe(true);
+  });
+
+  test("close restores focus to the previously focused element", async () => {
+    const t = await make();
+    const btn = dom.document.createElement("button");
+    dom.document.body.append(btn);
+    btn.focus();
+    t.p.open();
+    expect(btn.focused).toBe(false);
+    t.p.close();
+    expect(dom.document.activeElement).toBe(btn);
+  });
+
+  test("clicking a row (mousedown) accepts it", async () => {
+    const t = await make(["a.ts", "b.ts"]);
+    t.p.open();
+    await t.flush();
+    const got: string[] = [];
+    t.p.onOpenFile = (p) => got.push(p);
+    const row = dom.document.createElement("div");
+    row.className = "pal-item";
+    row.setAttribute("data-i", "1");
+    t.list.append(row);
+    const e = new FakeEvent("mousedown", { target: row });
+    t.list.dispatchEvent(e);
+    expect(e.defaultPrevented).toBe(true);
+    expect(got).toEqual(["b.ts"]);
+    // a mousedown that is not on a row does nothing
+    const e2 = new FakeEvent("mousedown", { target: t.list });
+    t.list.dispatchEvent(e2);
+    expect(e2.defaultPrevented).toBe(false);
+  });
+
+  test("'>' lists commands, filters by fuzzy label, and runs the selected one", async () => {
+    const t = await make();
+    const ran: string[] = [];
+    t.p.commands = [
+      { id: "a", label: "Toggle Sidebar", keys: "⌘B", run: () => ran.push("a") },
+      { id: "b", label: "Open Terminal", run: () => ran.push("b") },
+      { id: "c", label: "Search <files>", run: () => ran.push("c") },
+    ];
+    t.p.open(">");
+    expect(t.rows().length).toBe(3);
+    expect(t.list.innerHTML).toContain("<kbd>⌘B</kbd>");
+    expect(t.list.innerHTML).toContain("Search &lt;files&gt;");
+    t.type(">term");
+    expect(t.rows().length).toBe(1);
+    t.key("Enter");
+    expect(ran).toEqual(["b"]);
+    t.p.open(">tgs");
+    expect(t.list.innerHTML).toContain("<b>T</b>o<b>g</b>gle <b>S</b>idebar");
+  });
+
+  test("':' go-to-line", async () => {
+    const t = await make();
+    const lines: number[] = [];
+    t.p.onGoToLine = (n) => lines.push(n);
+    t.p.open(":");
+    expect(t.list.innerHTML).toContain("Type a line number");
+    t.key("Enter");
+    expect(lines).toEqual([]);
+    t.p.open(":120");
+    expect(t.list.innerHTML).toContain("Go to line <b>120</b>");
+    t.key("Enter");
+    expect(lines).toEqual([120]);
+  });
+
+  test("openList: filterable change list with badges, empty-state messages and placeholder reset", async () => {
+    const t = await make();
+    const opened: string[] = [];
+    t.p.onOpenFile = (p) => opened.push(p);
+    t.p.openList(
+      [
+        { path: "src/a.ts", badge: "M", cls: "g-M", detail: "Modified" },
+        { path: "new/", badge: "U", cls: "g-U", detail: "Untracked" },
+      ],
+      "Changed files",
+    );
+    expect(t.input.placeholder).toBe("Changed files");
+    expect(t.rows().length).toBe(2);
+    expect(t.list.innerHTML).toContain('<span class="gbadge g-M">M</span>');
+    expect(t.list.innerHTML).toContain("Modified · src");
+    t.type("new");
+    expect(t.rows().length).toBe(1);
+    t.key("Enter");
+    expect(opened).toEqual(["new"]); // trailing slash stripped
+    expect(t.input.placeholder).toBe("");
+
+    t.p.openList([{ path: "x.ts", badge: "M", cls: "c", detail: "d" }], "p");
+    t.type("zzz");
+    expect(t.list.innerHTML).toContain("No matching changes");
+    t.p.close();
+    t.p.openList([], "p");
+    expect(t.list.innerHTML).toContain("No changes: the working tree is clean");
+    // closing leaves custom mode
+    t.p.close();
+    t.p.open();
+    await t.flush();
+    expect(t.list.innerHTML).toContain("a.ts");
+  });
+
+  test("empty index shows 'No files'", async () => {
+    const t = await make([]);
+    t.p.open();
+    await t.flush();
+    expect(t.list.innerHTML).toContain("No files");
+  });
+});
diff --git a/test/client.updates.test.ts b/test/client.updates.test.ts
new file mode 100644
index 0000000..95e20f7
--- /dev/null
+++ b/test/client.updates.test.ts
@@ -0,0 +1,250 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { FakeEvent, installDom, mockFetch, uninstallDom, type Dom, type FakeElement } from "./helpers/fakedom.ts";
+import type { UpdateInfo } from "../src/client/api.ts";
+
+let dom: Dom;
+let U: typeof import("../src/client/updates.ts");
+beforeAll(async () => {
+  dom = installDom();
+  U = await import("../src/client/updates.ts");
+});
+afterAll(() => uninstallDom());
+
+const info = (o: Partial<UpdateInfo> = {}): UpdateInfo => ({ current: "1.0.0", latest: "1.1.0", available: true, kind: "macos-app", canInstall: true, checkedAt: 1, ...o });
+let restore = () => {};
+afterEach(() => restore());
+
+const setup = (handler: Parameters<typeof mockFetch>[0] = () => Response.json(info())) => {
+  const m = mockFetch(handler);
+  restore = m.restore;
+  const u = new U.Updates();
+  const box = u.el.querySelector<FakeElement>(".upd")!;
+  const btn = (label: string) => box.querySelectorAll<FakeElement>("button").find((b) => b.textContent === label);
+  const click = (label: string) => btn(label)!.dispatchEvent(new FakeEvent("click"));
+  const states = () => box.querySelectorAll<FakeElement>("li").map((l) => l.getAttribute("data-state"));
+  return { u, box, btn, click, states, calls: m.calls, flush: () => new Promise((r) => setTimeout(r, 0)) };
+};
+
+describe("Updates", () => {
+  test("starts hidden with dialog semantics", () => {
+    const { u, box } = setup();
+    expect(u.el.hidden).toBe(true);
+    expect(box.getAttribute("role")).toBe("dialog");
+    expect(box.getAttribute("aria-modal")).toBe("true");
+  });
+
+  test("load stores the info and notifies onInfo; failures are silent", async () => {
+    const t = setup(() => Response.json(info({ latest: "2.0.0" })));
+    const got: UpdateInfo[] = [];
+    t.u.onInfo = (i) => got.push(i);
+    await t.u.load();
+    expect(got.map((i) => i.latest)).toEqual(["2.0.0"]);
+    expect(t.calls[0]!.url).toBe("/api/update");
+    restore();
+    const t2 = setup(() => new Response("", { status: 500 }));
+    await t2.u.load();
+    expect(t2.u.info).toBeNull();
+  });
+
+  test("open with no info shows nothing yet; with info renders the available dialog", async () => {
+    const t = setup(() => Response.json(info({ notes: "  Fixed things  " })));
+    t.u.open();
+    expect(t.u.el.hidden).toBe(false);
+    expect(t.box.children.length).toBe(0);
+    await t.u.load();
+    t.u.open();
+    expect(t.box.textContent).toContain("Codeviewer 1.1.0 is available");
+    expect(t.box.textContent).toContain("You have 1.0.0");
+    expect(t.box.querySelector(".upd-notes")!.textContent).toBe("Fixed things");
+    expect(t.box.querySelectorAll("li").length).toBe(4);
+    expect(t.box.querySelector("ol")!.hidden).toBe(true);
+    expect(t.btn("Install and restart")).toBeTruthy();
+    expect(t.btn("Later")).toBeTruthy();
+  });
+
+  test("cli kind labels the install button differently", async () => {
+    const t = setup(() => Response.json(info({ kind: "cli" })));
+    await t.u.load();
+    t.u.open();
+    expect(t.btn("Install update")).toBeTruthy();
+  });
+
+  test("not installable: shows the reason and a single OK", async () => {
+    const t = setup(() => Response.json(info({ canInstall: false, reason: "Installed from source" })));
+    await t.u.load();
+    t.u.open();
+    expect(t.box.querySelector(".upd-reason")!.textContent).toBe("Installed from source");
+    expect(t.btn("Install and restart")).toBeUndefined();
+    t.click("OK");
+    expect(t.u.el.hidden).toBe(true);
+    restore();
+    const t2 = setup(() => Response.json(info({ canInstall: false })));
+    await t2.u.load();
+    t2.u.open();
+    expect(t2.box.querySelector(".upd-reason")!.textContent).toBe("This update can't be installed automatically.");
+  });
+
+  test("Release notes opens the url externally", async () => {
+    const t = setup(() => Response.json(info({ url: "https://example.com/rel" })));
+    await t.u.load();
+    t.u.open();
+    t.click("Release notes");
+    expect(t.calls.at(-1)!.url).toBe("/api/external");
+    expect(JSON.parse(t.calls.at(-1)!.init!.body as string)).toEqual({ url: "https://example.com/rel" });
+  });
+
+  test("checkNow: checking state, then up-to-date message", async () => {
+    const t = setup(() => Response.json(info({ available: false })));
+    const p = t.u.checkNow();
+    expect(t.u.el.hidden).toBe(false);
+    expect(t.box.textContent).toContain("Checking for updates…");
+    await p;
+    expect(t.calls[0]!.url).toBe("/api/update?check=1");
+    expect(t.box.textContent).toContain("You're up to date");
+    expect(t.box.textContent).toContain("Codeviewer 1.0.0 is the latest version.");
+    t.click("OK");
+    expect(t.u.el.hidden).toBe(true);
+  });
+
+  test("checkNow failure renders an error with Try again", async () => {
+    let n = 0;
+    const t = setup(() => (n++ === 0 ? Response.json({ error: "rate limited" }, { status: 429 }) : Response.json(info())));
+    await t.u.checkNow();
+    expect(t.box.textContent).toContain("Update failed");
+    expect(t.box.textContent).toContain("rate limited");
+    t.click("Try again");
+    await t.flush();
+    await t.flush();
+    expect(t.box.textContent).toContain("is available");
+    expect(n).toBe(2);
+  });
+
+  test("closing: overlay mousedown and Escape close; ignored while installing", async () => {
+    const t = setup();
+    await t.u.load();
+    t.u.open();
+    t.u.el.dispatchEvent(new FakeEvent("mousedown", { target: t.box }));
+    expect(t.u.el.hidden).toBe(false);
+    t.u.el.dispatchEvent(new FakeEvent("mousedown", { target: t.u.el }));
+    expect(t.u.el.hidden).toBe(true);
+    t.u.open();
+    dom.window.dispatchEvent(new FakeEvent("keydown", { key: "Escape" }));
+    expect(t.u.el.hidden).toBe(true);
+
+    t.u.open();
+    t.click("Install and restart");
+    await t.flush();
+    t.u.el.dispatchEvent(new FakeEvent("mousedown", { target: t.u.el }));
+    dom.window.dispatchEvent(new FakeEvent("keydown", { key: "Escape" }));
+    t.box.querySelector<FakeElement>(".icon-btn")!.dispatchEvent(new FakeEvent("click"));
+    expect(t.u.el.hidden).toBe(false);
+  });
+
+  test("install posts, shows the steps, disables buttons and drops the notes", async () => {
+    const t = setup(() => Response.json(info({ notes: "n" })));
+    await t.u.load();
+    t.u.open();
+    const install = t.btn("Install and restart")!;
+    t.click("Install and restart");
+    await t.flush();
+    const post = t.calls.at(-1)!;
+    expect(post.url).toBe("/api/update/install");
+    expect(post.init?.method).toBe("POST");
+    expect(t.box.querySelector("ol")!.hidden).toBe(false);
+    expect(install.disabled).toBe(true);
+    expect(install.textContent).toBe("Installing…");
+    expect(t.btn("Release notes")!.disabled).toBe(true);
+    expect(t.box.querySelector(".upd-notes")).toBeNull();
+  });
+
+  test("install failure goes back to an error view", async () => {
+    const t = setup((url) => (url === "/api/update/install" ? Response.json({ error: "disk full" }, { status: 500 }) : Response.json(info())));
+    await t.u.load();
+    t.u.open();
+    t.click("Install and restart");
+    await t.flush();
+    await t.flush();
+    expect(t.box.textContent).toContain("Update failed");
+    expect(t.box.textContent).toContain("disk full");
+    t.click("Close");
+    expect(t.u.el.hidden).toBe(true);
+  });
+
+  test("progress events drive the step states and download detail", async () => {
+    const t = setup();
+    await t.u.load();
+    t.u.open();
+    t.u.onEvent("signature");
+    expect(t.states()).toEqual(["active", "todo", "todo", "todo"]);
+    t.u.onEvent("download", "12 MB");
+    // visual order: signature, download, checksum, install
+    expect(t.states()).toEqual(["done", "active", "todo", "todo"]);
+    expect(t.box.querySelectorAll<FakeElement>(".upd-detail")[1]!.textContent).toBe("12 MB");
+    t.u.onEvent("checksum");
+    expect(t.states()).toEqual(["done", "done", "active", "todo"]);
+    expect(t.box.querySelectorAll<FakeElement>(".upd-detail")[1]!.textContent).toBe("12 MB");
+    t.u.onEvent("install");
+    expect(t.states()).toEqual(["done", "done", "done", "active"]);
+    t.u.onEvent("done");
+    expect(t.states()).toEqual(["done", "done", "done", "done"]);
+  });
+
+  test("error event reopens the dialog with the message (default text when none)", async () => {
+    const t = setup();
+    t.u.onEvent("error", "bad signature");
+    expect(t.u.el.hidden).toBe(false);
+    expect(t.box.textContent).toContain("bad signature");
+    t.u.onEvent("error");
+    expect(t.box.textContent).toContain("Unknown error");
+  });
+
+  test("installed (native): clears availability, announces restart, calls nativeRelaunch after a delay", async () => {
+    const t = setup();
+    const infos: UpdateInfo[] = [];
+    t.u.onInfo = (i) => infos.push(i);
+    await t.u.load();
+    t.u.open();
+    let relaunched = 0;
+    t.u.nativeRelaunch = () => relaunched++;
+    t.u.onEvent("installed", "1.1.0", "native");
+    expect(infos.at(-1)).toMatchObject({ available: false, current: "1.1.0" });
+    expect(t.box.querySelector(".upd-ok")!.textContent).toBe("Codeviewer 1.1.0 installed. Restarting…");
+    expect(relaunched).toBe(0);
+    await new Promise((r) => setTimeout(r, 700));
+    expect(relaunched).toBe(1);
+  });
+
+  test("installed (server): asks the server to relaunch", async () => {
+    const t = setup();
+    await t.u.load();
+    t.u.open();
+    t.u.onEvent("installed", "1.1.0", "server");
+    expect(t.box.querySelector(".upd-ok")!.textContent).toBe("Codeviewer 1.1.0 installed. Restarting…");
+    expect(t.calls.at(-1)!.url).toBe("/api/update/relaunch");
+    await t.flush();
+  });
+
+  test("installed (manual, or native without a handler): tells the user to restart", async () => {
+    const t = setup();
+    await t.u.load();
+    t.u.open();
+    t.u.onEvent("installed", "1.1.0", "manual");
+    expect(t.box.querySelector(".upd-ok")!.textContent).toBe("Codeviewer 1.1.0 installed. Restart codeviewer to use it.");
+    t.click("OK");
+    expect(t.u.el.hidden).toBe(true);
+    const t2 = setup();
+    await t2.u.load();
+    t2.u.open();
+    t2.u.onEvent("installed", "1.1.0", "native");
+    expect(t2.box.querySelector(".upd-ok")!.textContent).toContain("Restart codeviewer");
+  });
+
+  test("unknown phases are ignored", async () => {
+    const t = setup();
+    await t.u.load();
+    t.u.open();
+    const before = t.box.innerHTML;
+    t.u.onEvent("mystery");
+    expect(t.box.innerHTML).toBe(before);
+  });
+});
diff --git a/test/client.util.test.ts b/test/client.util.test.ts
new file mode 100644
index 0000000..ef3b277
--- /dev/null
+++ b/test/client.util.test.ts
@@ -0,0 +1,219 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { FakeEvent, installDom, mockFetch, uninstallDom, type Dom } from "./helpers/fakedom.ts";
+
+let dom: Dom;
+let u: typeof import("../src/client/util.ts");
+let umac: typeof import("../src/client/util.ts");
+
+beforeAll(async () => {
+  dom = installDom({ platform: "Linux x86_64" });
+  u = await import("../src/client/util.ts?linux");
+  uninstallDom();
+  dom = installDom({ platform: "MacIntel" });
+  umac = await import("../src/client/util.ts?mac");
+  dom = installDom({ platform: "Linux x86_64" });
+});
+afterAll(() => uninstallDom());
+
+describe("platform", () => {
+  test("MOD / IS_MAC follow navigator.platform at load", () => {
+    expect(u.IS_MAC).toBe(false);
+    expect(u.MOD).toBe("Ctrl+");
+    expect(umac.IS_MAC).toBe(true);
+    expect(umac.MOD).toBe("⌘");
+  });
+});
+
+describe("h", () => {
+  test("builds element with class, attributes, boolean attrs and children", () => {
+    const child = u.h("i", null, "x");
+    const el = u.h("div", { class: "a b", id: "z", hidden: true, off: false, nul: null, undef: undefined, n: 5 }, "t", child, null, false, [u.h("b"), "s"]);
+    expect(el.className).toBe("a b");
+    expect(el.getAttribute("id")).toBe("z");
+    expect(el.getAttribute("hidden")).toBe("");
+    expect(el.getAttribute("off")).toBeNull();
+    expect(el.getAttribute("nul")).toBeNull();
+    expect(el.getAttribute("n")).toBe("5");
+    expect(el.innerHTML).toBe('t<i>x</i><b></b>s');
+  });
+  test("html prop and on* handlers", () => {
+    let hit = 0;
+    const el = u.h("button", { html: "<svg/>", onclick: () => hit++ });
+    expect(el.innerHTML).toBe("<svg/>");
+    el.dispatchEvent(new FakeEvent("click") as unknown as Event);
+    expect(hit).toBe(1);
+  });
+});
+
+describe("string helpers", () => {
+  test("esc escapes & < > \"", () => {
+    expect(u.esc(`<a href="x">&</a>`)).toBe("&lt;a href=&quot;x&quot;&gt;&amp;&lt;/a&gt;");
+    expect(u.esc("plain")).toBe("plain");
+  });
+  test("basename / dirname", () => {
+    expect(u.basename("a/b/c.ts")).toBe("c.ts");
+    expect(u.basename("c.ts")).toBe("c.ts");
+    expect(u.dirname("a/b/c.ts")).toBe("a/b");
+    expect(u.dirname("c.ts")).toBe("");
+  });
+  test("formatBytes", () => {
+    expect(u.formatBytes(0)).toBe("0 B");
+    expect(u.formatBytes(1023)).toBe("1023 B");
+    expect(u.formatBytes(1024)).toBe("1.0 KB");
+    expect(u.formatBytes(1536)).toBe("1.5 KB");
+    expect(u.formatBytes(20 * 1024)).toBe("20 KB");
+    expect(u.formatBytes(5 * 1024 * 1024)).toBe("5.0 MB");
+    expect(u.formatBytes(3 * 1024 ** 3)).toBe("3.0 GB");
+    expect(u.formatBytes(5000 * 1024 ** 4)).toBe("5000 TB");
+  });
+});
+
+describe("store", () => {
+  let restore = () => {};
+  afterEach(() => restore());
+
+  test("init loads settings from the server, get falls back to default, set debounces a PUT", async () => {
+    const m = mockFetch((url) => (url === "/api/settings" ? Response.json({ theme: "dark" }) : new Response("{}")));
+    restore = m.restore;
+    await u.store.init();
+    expect(dom.window.listenerCount("pagehide")).toBe(1);
+    expect(u.store.get("theme", "light")).toBe("dark");
+    expect(u.store.get("missing", 7)).toBe(7);
+    u.store.set("a", 1);
+    u.store.set("b", 2);
+    expect(m.calls.length).toBe(1); // only the GET so far
+    await new Promise((r) => setTimeout(r, 400));
+    expect(m.calls.length).toBe(2);
+    const put = m.calls[1]!;
+    expect(put.url).toBe("/api/settings");
+    expect(put.init?.method).toBe("PUT");
+    expect(JSON.parse(put.init!.body as string)).toEqual({ theme: "dark", a: 1, b: 2 });
+    expect(u.store.get("a", 0)).toBe(1);
+  });
+
+  test("pagehide saves immediately with keepalive and cancels the pending timer", async () => {
+    const m = mockFetch(() => Response.json({}));
+    restore = m.restore;
+    dom.window.listeners.clear(); // drop pagehide handlers added by earlier init() calls
+    await u.store.init();
+    u.store.set("k", "v");
+    dom.window.dispatchEvent(new FakeEvent("pagehide") as unknown as Event);
+    expect(m.calls.length).toBe(2);
+    expect(m.calls[1]!.init?.keepalive).toBe(true);
+    await new Promise((r) => setTimeout(r, 400));
+    expect(m.calls.length).toBe(2);
+  });
+
+  test("init survives a failing server and a failing save", async () => {
+    const m = mockFetch(() => {
+      throw new Error("offline");
+    });
+    restore = m.restore;
+    await u.store.init();
+    expect(u.store.get("theme", "x")).toBe("x");
+    dom.window.dispatchEvent(new FakeEvent("pagehide") as unknown as Event);
+    await Promise.resolve();
+  });
+});
+
+describe("local", () => {
+  test("round-trips JSON under the cv: prefix", () => {
+    u.local.set("x", { a: [1, 2] });
+    expect(dom.localStorage.getItem("cv:x")).toBe('{"a":[1,2]}');
+    expect(u.local.get("x", null)).toEqual({ a: [1, 2] });
+    expect(u.local.get("nope", "d")).toBe("d");
+  });
+  test("tolerates corrupt data and storage that throws", () => {
+    dom.localStorage.setItem("cv:bad", "{oops");
+    expect(u.local.get("bad", 3)).toBe(3);
+    dom.localStorage.throws = true;
+    expect(u.local.get("x", 9)).toBe(9);
+    u.local.set("x", 1); // must not throw
+    dom.localStorage.throws = false;
+  });
+});
+
+describe("debounce", () => {
+  test("collapses calls, uses the last arguments", async () => {
+    const seen: number[] = [];
+    const d = u.debounce((n: number) => seen.push(n), 20);
+    d(1);
+    d(2);
+    d(3);
+    expect(seen).toEqual([]);
+    await new Promise((r) => setTimeout(r, 60));
+    expect(seen).toEqual([3]);
+  });
+});
+
+describe("dragSplitter", () => {
+  const ev = (type: string, o: Record<string, unknown> = {}) => new FakeEvent(type, o) as unknown as Event;
+  for (const axis of ["x", "y"] as const) {
+    test(`axis ${axis}: reports start and deltas, then cleans up`, () => {
+      const handle = u.h("div");
+      const moves: [number, number][] = [];
+      u.dragSplitter(handle, axis, () => 100, (s, d) => moves.push([s, d]));
+      const down = ev("pointerdown", { clientX: 10, clientY: 20, pointerId: 1 });
+      handle.dispatchEvent(down);
+      expect(down.defaultPrevented).toBe(true);
+      expect(dom.document.body.classList.contains(`resizing-${axis}`)).toBe(true);
+      expect(handle.classList.contains("active")).toBe(true);
+      handle.dispatchEvent(ev("pointermove", { clientX: 15, clientY: 50 }));
+      expect(moves).toEqual([[100, axis === "x" ? 5 : 30]]);
+      handle.dispatchEvent(ev("pointerup"));
+      expect(dom.document.body.classList.contains(`resizing-${axis}`)).toBe(false);
+      expect(handle.classList.contains("active")).toBe(false);
+      handle.dispatchEvent(ev("pointermove", { clientX: 99, clientY: 99 }));
+      expect(moves.length).toBe(1);
+      expect(handle.listenerCount("pointermove")).toBe(0);
+    });
+  }
+});
+
+describe("dismissable", () => {
+  const ev = (type: string, o: Record<string, unknown> = {}) => new FakeEvent(type, o) as unknown as Event;
+  test("closes on outside mousedown and Escape, not inside; off() detaches", () => {
+    const el = u.h("div", null, u.h("span"));
+    const outside = u.h("p");
+    let closed = 0;
+    const off = u.dismissable(el, () => closed++);
+    dom.window.dispatchEvent(ev("mousedown", { target: el.children[0] }));
+    expect(closed).toBe(0);
+    dom.window.dispatchEvent(ev("mousedown", { target: outside }));
+    expect(closed).toBe(1);
+    dom.window.dispatchEvent(ev("keydown", { key: "a" }));
+    expect(closed).toBe(1);
+    dom.window.dispatchEvent(ev("keydown", { key: "Escape" }));
+    expect(closed).toBe(2);
+    off();
+    dom.window.dispatchEvent(ev("keydown", { key: "Escape" }));
+    expect(closed).toBe(2);
+    expect(dom.window.listenerCount("mousedown")).toBe(0);
+  });
+  test("keep() exempts targets; custom key handler replaces Escape", () => {
+    const el = u.h("div");
+    const anchor = u.h("a");
+    const keys: string[] = [];
+    let closed = 0;
+    const off = u.dismissable(el, () => closed++, { keep: (t) => t === anchor, key: (e) => keys.push(e.key) });
+    dom.window.dispatchEvent(ev("mousedown", { target: anchor }));
+    expect(closed).toBe(0);
+    dom.window.dispatchEvent(ev("keydown", { key: "Escape" }));
+    expect(closed).toBe(0);
+    expect(keys).toEqual(["Escape"]);
+    off();
+  });
+  test("transient also closes on blur/resize/wheel and cleans those up", () => {
+    const el = u.h("div");
+    let closed = 0;
+    const off = u.dismissable(el, () => closed++, { transient: true });
+    for (const t of ["blur", "resize", "wheel"]) dom.window.dispatchEvent(ev(t));
+    expect(closed).toBe(3);
+    off();
+    for (const t of ["blur", "resize", "wheel"]) {
+      dom.window.dispatchEvent(ev(t));
+      expect(dom.window.listenerCount(t)).toBe(0);
+    }
+    expect(closed).toBe(3);
+  });
+});
diff --git a/test/files.coverage.test.ts b/test/files.coverage.test.ts
new file mode 100644
index 0000000..4a402a5
--- /dev/null
+++ b/test/files.coverage.test.ts
@@ -0,0 +1,26 @@
+import { afterAll, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { readForView } from "../src/server/files.ts";
+
+const dirs: string[] = [];
+afterAll(async () => {
+  for (const d of dirs) await rm(d, { recursive: true, force: true });
+});
+
+test("UTF-16 BE is transcoded and UTF-8 BOM is stripped", async () => {
+  const d = await mkdtemp(path.join(tmpdir(), "cv-filec-"));
+  dirs.push(d);
+  const be = path.join(d, "be.txt");
+  await writeFile(be, Buffer.from([0xfe, 0xff, 0x00, 0x68, 0x00, 0x69]));
+  const r1 = await readForView(be);
+  expect(r1.meta.encoding).toBe("UTF-16 BE");
+  expect(new TextDecoder().decode(r1.body)).toBe("hi");
+
+  const bom = path.join(d, "bom.txt");
+  await writeFile(bom, Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from("héllo")]));
+  const r2 = await readForView(bom);
+  expect(r2.meta.encoding).toBe("UTF-8 with BOM");
+  expect(new TextDecoder().decode(r2.body)).toBe("héllo");
+});
diff --git a/test/helpers/fakedom.ts b/test/helpers/fakedom.ts
new file mode 100644
index 0000000..7202877
--- /dev/null
+++ b/test/helpers/fakedom.ts
@@ -0,0 +1,350 @@
+// Minimal fake DOM for testing browser-side modules without any dependency.
+// Implements only what src/client modules use. Install with installDom(), undo with uninstallDom().
+
+type Listener = (e: FakeEvent) => void;
+
+export class FakeEvent {
+  defaultPrevented = false;
+  propagationStopped = false;
+  target: unknown = null;
+  [k: string]: unknown;
+  constructor(public type: string, init: Record<string, unknown> = {}) {
+    Object.assign(this, init);
+  }
+  preventDefault() {
+    this.defaultPrevented = true;
+  }
+  stopPropagation() {
+    this.propagationStopped = true;
+  }
+}
+
+class Target {
+  listeners = new Map<string, Set<Listener>>();
+  addEventListener(type: string, fn: Listener, _opts?: unknown) {
+    if (!this.listeners.has(type)) this.listeners.set(type, new Set());
+    this.listeners.get(type)!.add(fn);
+  }
+  removeEventListener(type: string, fn: Listener, _opts?: unknown) {
+    this.listeners.get(type)?.delete(fn);
+  }
+  listenerCount(type: string) {
+    return this.listeners.get(type)?.size ?? 0;
+  }
+  protected fire(e: FakeEvent) {
+    for (const fn of [...(this.listeners.get(e.type) ?? [])]) fn(e);
+  }
+  dispatchEvent(e: FakeEvent) {
+    if (!e.target) e.target = this;
+    this.fire(e);
+    return !e.defaultPrevented;
+  }
+}
+
+const esc = (s: string) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+export class FakeText {
+  parent: FakeElement | null = null;
+  constructor(public data: string) {}
+  get textContent() {
+    return this.data;
+  }
+}
+
+type Sel = { tag?: string; classes: string[]; attr?: string };
+function parseSel(s: string): Sel {
+  const m = /^([a-z0-9]*)((?:\.[\w-]+)*)(?:\[([\w-]+)\])?$/i.exec(s.trim());
+  if (!m) throw new Error("fakedom: unsupported selector " + s);
+  return { tag: m[1] || undefined, classes: m[2] ? m[2].split(".").slice(1) : [], attr: m[3] };
+}
+
+export class FakeElement extends Target {
+  parent: FakeElement | null = null;
+  children: (FakeElement | FakeText)[] = [];
+  attrs = new Map<string, string>();
+  style: Record<string, string> = {};
+  tagName: string;
+  value = "";
+  placeholder = "";
+  disabled = false;
+  title = "";
+  private _html: string | null = null;
+  focused = false;
+  scrolled = 0;
+  rect = { width: 100, height: 40, left: 0, top: 0 };
+
+  constructor(public tag: string, private doc: FakeDocument) {
+    super();
+    this.tagName = tag.toUpperCase();
+  }
+
+  get className() {
+    return this.attrs.get("class") ?? "";
+  }
+  set className(v: string) {
+    this.attrs.set("class", v);
+  }
+  get classList() {
+    const get = () => this.className.split(/\s+/).filter(Boolean);
+    const set = (a: string[]) => (this.className = a.join(" "));
+    return {
+      add: (...c: string[]) => set([...new Set([...get(), ...c])]),
+      remove: (...c: string[]) => set(get().filter((x) => !c.includes(x))),
+      contains: (c: string) => get().includes(c),
+      toggle: (c: string, force?: boolean) => {
+        const on = force ?? !get().includes(c);
+        if (on) this.classList.add(c);
+        else this.classList.remove(c);
+        return on;
+      },
+    };
+  }
+  get hidden() {
+    return this.attrs.has("hidden");
+  }
+  set hidden(v: boolean) {
+    if (v) this.attrs.set("hidden", "");
+    else this.attrs.delete("hidden");
+  }
+  get id() {
+    return this.attrs.get("id") ?? "";
+  }
+  get dataset() {
+    const out: Record<string, string> = {};
+    for (const [k, v] of this.attrs) if (k.startsWith("data-")) out[k.slice(5)] = v;
+    return out;
+  }
+  get isConnected(): boolean {
+    let n: FakeElement | null = this;
+    while (n) {
+      if (n === this.doc.documentElement) return true;
+      n = n.parent;
+    }
+    return false;
+  }
+  setAttribute(k: string, v: string) {
+    this.attrs.set(k, String(v));
+    if (k === "title") this.title = String(v);
+  }
+  getAttribute(k: string) {
+    return this.attrs.get(k) ?? null;
+  }
+  hasAttribute(k: string) {
+    return this.attrs.has(k);
+  }
+  removeAttribute(k: string) {
+    this.attrs.delete(k);
+  }
+
+  private adopt(c: FakeElement | FakeText | string) {
+    const n = typeof c === "string" ? new FakeText(c) : c;
+    if (n.parent) n.parent.children = n.parent.children.filter((x) => x !== n);
+    n.parent = this;
+    return n;
+  }
+  append(...cs: (FakeElement | FakeText | string)[]) {
+    this._html = null;
+    for (const c of cs) this.children.push(this.adopt(c));
+  }
+  appendChild<T extends FakeElement>(c: T) {
+    this.append(c);
+    return c;
+  }
+  replaceChildren(...cs: (FakeElement | FakeText | string)[]) {
+    this._html = null;
+    for (const c of this.children) c.parent = null;
+    this.children = [];
+    this.append(...cs);
+  }
+  remove() {
+    // Like a browser: removing the focused element (or its ancestor) drops focus to <body>.
+    if (this.contains(this.doc.activeElement)) {
+      this.doc.activeElement!.focused = false;
+      this.doc.activeElement = this.doc.body;
+    }
+    if (this.parent) this.parent.children = this.parent.children.filter((x) => x !== this);
+    this.parent = null;
+  }
+  contains(n: unknown): boolean {
+    for (let x = n as FakeElement | null; x; x = x.parent) if (x === this) return true;
+    return false;
+  }
+
+  get textContent(): string {
+    if (this._html !== null) return this._html.replace(/<[^>]*>/g, "");
+    return this.children.map((c) => c.textContent).join("");
+  }
+  set textContent(v: string) {
+    this.replaceChildren(v);
+  }
+  /** Serialises children; a raw string assigned to innerHTML is returned verbatim. */
+  get innerHTML(): string {
+    if (this._html !== null) return this._html;
+    return this.children.map((c) => (c instanceof FakeText ? esc(c.data) : c.outerHTML)).join("");
+  }
+  set innerHTML(v: string) {
+    for (const c of this.children) c.parent = null;
+    this.children = [];
+    this._html = String(v);
+  }
+  get outerHTML(): string {
+    const a = [...this.attrs].map(([k, v]) => (v === "" ? ` ${k}` : ` ${k}="${v.replace(/"/g, "&quot;")}"`)).join("");
+    return `<${this.tag}${a}>${this.innerHTML}</${this.tag}>`;
+  }
+
+  private matches(s: Sel) {
+    return (!s.tag || s.tag === this.tag) && s.classes.every((c) => this.classList.contains(c)) && (!s.attr || this.attrs.has(s.attr));
+  }
+  querySelectorAll<T = FakeElement>(sel: string): T[] {
+    const parts = sel.split(",").map(parseSel);
+    const out: FakeElement[] = [];
+    const walk = (e: FakeElement) => {
+      for (const c of e.children) {
+        if (c instanceof FakeText) continue;
+        if (parts.some((p) => c.matches(p))) out.push(c);
+        walk(c);
+      }
+    };
+    walk(this);
+    return out as unknown as T[];
+  }
+  querySelector<T = FakeElement>(sel: string): T | null {
+    return this.querySelectorAll<T>(sel)[0] ?? null;
+  }
+  closest<T = FakeElement>(sel: string): T | null {
+    const p = parseSel(sel);
+    for (let n: FakeElement | null = this; n; n = n.parent) if (n.matches(p)) return n as unknown as T;
+    return null;
+  }
+
+  focus(_o?: unknown) {
+    const prev = this.doc.activeElement;
+    if (prev && prev !== this) prev.focused = false;
+    this.focused = true;
+    this.doc.activeElement = this;
+  }
+  getBoundingClientRect() {
+    return this.rect;
+  }
+  scrollIntoView(_o?: unknown) {
+    this.scrolled++;
+  }
+  setPointerCapture(_id: number) {}
+
+  dispatchEvent(e: FakeEvent) {
+    if (!e.target) e.target = this;
+    for (let n: FakeElement | null = this; n && !e.propagationStopped; n = n.parent) n.fire(e);
+    return !e.defaultPrevented;
+  }
+}
+
+export class FakeDocument extends Target {
+  documentElement = new FakeElement("html", this);
+  body = new FakeElement("body", this);
+  activeElement: FakeElement | null = this.body;
+  constructor() {
+    super();
+    this.documentElement.append(this.body);
+  }
+  createElement(tag: string) {
+    return new FakeElement(tag, this);
+  }
+}
+
+export class FakeStorage {
+  private m = new Map<string, string>();
+  throws = false;
+  getItem(k: string) {
+    if (this.throws) throw new Error("denied");
+    return this.m.get(k) ?? null;
+  }
+  setItem(k: string, v: string) {
+    if (this.throws) throw new Error("denied");
+    this.m.set(k, String(v));
+  }
+  removeItem(k: string) {
+    this.m.delete(k);
+  }
+  clear() {
+    this.m.clear();
+  }
+}
+
+export class FakeWindow extends Target {
+  innerWidth = 1000;
+  innerHeight = 800;
+  fetch: unknown = undefined;
+  setTimeout = globalThis.setTimeout.bind(globalThis);
+  clearTimeout = globalThis.clearTimeout.bind(globalThis);
+}
+
+export interface Dom {
+  document: FakeDocument;
+  window: FakeWindow;
+  location: { hash: string; pathname: string; search: string; href: string; protocol: string };
+  history: { calls: unknown[][]; replaceState(...a: unknown[]): void };
+  localStorage: FakeStorage;
+  sessionStorage: FakeStorage;
+  navigator: { platform: string };
+}
+
+const KEYS = ["document", "window", "location", "history", "localStorage", "sessionStorage", "navigator", "innerWidth", "innerHeight"] as const;
+let saved: Map<string, PropertyDescriptor | undefined> | null = null;
+
+/** Installs fresh fake globals. Call uninstallDom() in afterAll to restore the originals. */
+export function installDom(opts: { platform?: string; hash?: string; href?: string; protocol?: string } = {}): Dom {
+  const g = globalThis as Record<string, unknown>;
+  if (!saved) {
+    saved = new Map();
+    for (const k of KEYS) saved.set(k, Object.getOwnPropertyDescriptor(globalThis, k));
+  }
+  const window = new FakeWindow();
+  const history = { calls: [] as unknown[][], replaceState(...a: unknown[]) { history.calls.push(a); } };
+  const dom: Dom = {
+    document: new FakeDocument(),
+    window,
+    location: {
+      hash: opts.hash ?? "",
+      pathname: "/",
+      search: "",
+      href: opts.href ?? "http://127.0.0.1:4000/",
+      protocol: opts.protocol ?? "http:",
+    },
+    history,
+    localStorage: new FakeStorage(),
+    sessionStorage: new FakeStorage(),
+    navigator: { platform: opts.platform ?? "Linux x86_64" },
+  };
+  for (const k of KEYS) {
+    const v = k === "innerWidth" ? window.innerWidth : k === "innerHeight" ? window.innerHeight : dom[k as keyof Dom];
+    Object.defineProperty(globalThis, k, { value: v, configurable: true, writable: true });
+  }
+  void g;
+  return dom;
+}
+
+export function uninstallDom() {
+  if (!saved) return;
+  for (const [k, d] of saved) {
+    if (d) Object.defineProperty(globalThis, k, d);
+    else delete (globalThis as Record<string, unknown>)[k];
+  }
+  saved = null;
+}
+
+/** Replace globalThis.fetch with a recording mock; returns the calls and a restore function. */
+export type Call = { url: string; init?: RequestInit };
+const realFetch = globalThis.fetch; // captured once, so nested mocks always restore the true original
+export function mockFetch(handler: (url: string, init?: RequestInit) => Response | Promise<Response>) {
+  const orig = realFetch;
+  const calls: Call[] = [];
+  globalThis.fetch = Object.assign(
+    async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      calls.push({ url, init });
+      return handler(url, init);
+    },
+    { preconnect: () => {} },
+  ) as typeof fetch;
+  return { calls, restore: () => (globalThis.fetch = orig) };
+}
diff --git a/test/highlight.coverage.test.ts b/test/highlight.coverage.test.ts
new file mode 100644
index 0000000..08ecb78
--- /dev/null
+++ b/test/highlight.coverage.test.ts
@@ -0,0 +1,234 @@
+import { describe, expect, test } from "bun:test";
+import { Highlighter, languageFor, languageName, lexLine, type Span } from "../src/client/highlight.ts";
+
+const toks = (lang: string, src: string, line = 0) => {
+  const lines = src.split("\n");
+  const hl = new Highlighter(lang, lines);
+  return hl.line(line).map(([s, e, t]) => `${t}:${lines[line]!.slice(s, e)}`);
+};
+
+describe("highlight: languages and names", () => {
+  test("languageName", () => {
+    expect(languageName("js")).toBeTruthy();
+    expect(languageName("nope")).toBe("Plain Text");
+    expect(languageName("text")).toBe("Plain Text");
+  });
+
+  test("languageFor by name and prefix", () => {
+    expect(languageFor("Dockerfile.dev")).toBe("docker");
+    expect(languageFor("x/y/CMakeLists.txt")).toBe("make");
+    expect(languageFor("a.json")).toBe("json");
+    expect(languageFor("noext")).toBe("text");
+  });
+
+  test("text language yields no tokens", () => {
+    expect(new Highlighter("text", ["anything 1 2"]).line(0)).toEqual([]);
+    expect(lexLine("nope", "x", 0, [])).toBe(0);
+  });
+
+  test("very long lines are skipped", () => {
+    const long = "a".repeat(10_001);
+    const hl = new Highlighter("js", [long, "const x"]);
+    expect(hl.line(0)).toEqual([]);
+    expect(hl.line(1).map((s) => s[2])).toEqual(["k"]);
+  });
+});
+
+describe("highlight: css", () => {
+  test("properties, colors, at-rules, functions, variables", () => {
+    expect(toks("css", "a { color: #fff; margin: 0 auto; }")).toEqual(["p:color", "n:#fff", "p:margin", "n:0"]);
+    expect(toks("css", "@media screen { x: y; }")).toEqual(["k:@media", "p:x"]);
+    expect(toks("css", "  --brand: red;")).toEqual(["p:--brand"]);
+    expect(toks("css", "  width: calc(1px + var(--brand));")).toEqual(["p:width", "f:calc", "n:1px", "f:var", "v:--brand"]);
+    expect(toks("css", "x { color: red !important; }")).toEqual(["p:color", "k:!important"]);
+  });
+
+  test("pseudo-class selectors are not properties", () => {
+    expect(toks("css", "a:hover {")).not.toContain("p:a");
+  });
+
+  test("lone @ or ! is skipped", () => {
+    expect(toks("css", "@ x")).toEqual([]);
+  });
+});
+
+describe("highlight: shell, php, ruby-like variables and at-sigils", () => {
+  test("shell $variables", () => {
+    expect(toks("sh", 'echo $HOME ${USER} $(pwd) $? "x"')).toEqual(["k:echo", "v:$HOME", "v:${USER}", "v:$(", "v:$?", 's:"x"']);
+  });
+
+  test("lone $ is not a var", () => {
+    expect(toks("sh", "echo $ x")).toEqual(["k:echo"]);
+  });
+
+  test("decorators / annotations", () => {
+    expect(toks("js", "@Component() class A {}")).toEqual(["m:@Component", "k:class"]);
+    expect(toks("py", "@app.route")).toEqual(["m:@app.route"]);
+    expect(toks("js", "a @ b")).toEqual([]);
+  });
+
+  test("C preprocessor", () => {
+    expect(toks("c", "#include <stdio.h>")).toEqual(["m:#include"]);
+    expect(toks("c", "int main() { return 0; }")).toContain("f:main");
+  });
+});
+
+describe("highlight: config formats", () => {
+  test("json keys vs values", () => {
+    expect(toks("json", '{"a": "b", "n": 12, "t": true}')).toEqual(["p:\"a\"", 's:"b"', 'p:"n"', "n:12", 'p:"t"', "o:true"]);
+  });
+
+  test("yaml keys and values", () => {
+    expect(toks("yaml", "name: hello # c")).toEqual(["p:name", "c:# c"]);
+    expect(toks("yaml", '  - "quoted": 1')).toEqual(['p:"quoted"', "n:1"]);
+    expect(toks("yaml", "key: 'x'")).toEqual(["p:key", "s:'x'"]);
+  });
+
+  test("toml sections and keys", () => {
+    expect(toks("toml", "[package]")).toEqual(["h:[package]"]);
+    expect(toks("toml", "[[bin]]")).toEqual(["h:[[bin]]"]);
+    expect(toks("toml", 'name = "x"')).toEqual(["p:name", 's:"x"']);
+    expect(toks("toml", "a.b = 3")).toEqual(["p:a.b", "n:3"]);
+  });
+
+  test("toml multiline strings span lines", () => {
+    const src = 'x = """a\nb\nc""" # t';
+    expect(toks("toml", src, 1)).toEqual(["s:b"]);
+    expect(toks("toml", src, 2)).toEqual(['s:c"""', "c:# t"]);
+  });
+
+  test("multi-line string continuing past end without close", () => {
+    expect(toks("py", 'x = """a\nb\nc', 2)).toEqual(["s:c"]);
+  });
+
+  test("yaml-like text after a multi-line string closes", () => {
+    expect(toks("toml", "k = '''a\nb''' x", 1)).toEqual(["s:b'''"]);
+  });
+});
+
+describe("highlight: js specifics", () => {
+  test("regex literals", () => {
+    expect(toks("js", "x = /ab+c/gi.test(y)")).toEqual(["s:/ab+c/gi", "f:test"]);
+    expect(toks("js", "x = /[/]\\//")).toEqual(["s:/[/]\\//"]);
+    expect(toks("js", "return /a/")).toEqual(["k:return", "s:/a/"]);
+  });
+
+  test("division is not regex", () => {
+    expect(toks("js", "a / b / c")).toEqual([]);
+    expect(toks("js", "x = (a) / 2 / 3")).toEqual(["n:2", "n:3"]);
+    expect(toks("js", "x = a /")).toEqual([]);
+    expect(toks("js", "x = /unterminated")).toEqual([]);
+  });
+
+  test("numbers", () => {
+    expect(toks("js", "x = 0xFF + 0b101 + 1_000 + 1.5e3 + .5 + 10n")).toEqual(["n:0xFF", "n:0b101", "n:1_000", "n:1.5e3", "n:.5", "n:10n"]);
+    expect(toks("js", "abc1 = a2")).toEqual([]);
+  });
+
+  test("constants, types, member keywords", () => {
+    expect(toks("js", "x = null; MAX_SIZE; Foo.bar; a.class")).toEqual(["o:null", "o:MAX_SIZE", "t:Foo"]);
+  });
+
+  test("block comment inside a line then code", () => {
+    expect(toks("js", "a /* c */ b /* open")).toEqual(["c:/* c */", "c:/* open"]);
+  });
+
+  test("template literal spans lines", () => {
+    const src = "x = `a\nb`;";
+    expect(toks("js", src, 0)).toEqual(["s:`a"]);
+    expect(toks("js", src, 1)).toEqual(["s:b`"]);
+  });
+
+  test("unterminated single-line string ends at EOL", () => {
+    expect(toks("js", 'x = "abc')).toEqual(['s:"abc']);
+  });
+
+  test("rust macros", () => {
+    expect(toks("rs", 'println!("x");')).toEqual(["f:println!", 's:"x"']);
+  });
+
+  test("sql identifiers are not treated as types", () => {
+    expect(toks("sql", "SELECT Name FROM t")).not.toContain("t:Name");
+  });
+
+  test("case-insensitive keywords", () => {
+    expect(toks("sql", "select * from t").slice(0, 1)).toEqual(["k:select"]);
+  });
+});
+
+describe("highlight: markup", () => {
+  test("tags, attributes, strings", () => {
+    expect(toks("markup", '<a href="x" b>t</a>')).toEqual(["x:<a", "a:href", 's:"x"', "a:b", "x:>", "x:</a", "x:>"]);
+    expect(toks("markup", "<br/>")).toEqual(["x:<br", "x:/>"]);
+    expect(toks("markup", "<?xml version='1.0'?>")).toEqual(["x:<?xml", "a:version", "s:'1.0'", "x:?>"]);
+    expect(toks("markup", "<!DOCTYPE html>")).toEqual(["x:<!DOCTYPE", "a:html", "x:>"]);
+  });
+
+  test("comments, single and multi-line", () => {
+    expect(toks("markup", "a <!-- c --> b")).toEqual(["c:<!-- c -->"]);
+    const src = "<!-- start\nmid\nend --> <p>";
+    expect(toks("markup", src, 0)).toEqual(["c:<!-- start"]);
+    expect(toks("markup", src, 1)).toEqual(["c:mid"]);
+    expect(toks("markup", src, 2)).toEqual(["c:end -->", "x:<p", "x:>"]);
+  });
+
+  test("tag spanning lines", () => {
+    const src = '<div\n  class="a"\n>';
+    expect(toks("markup", src, 0)).toEqual(["x:<div"]);
+    expect(toks("markup", src, 1)).toEqual(["a:class", 's:"a"']);
+    expect(toks("markup", src, 2)).toEqual(["x:>"]);
+  });
+
+  test("unterminated attr string and stray <", () => {
+    expect(toks("markup", '<a b="oops')).toEqual(["x:<a", "a:b", 's:"oops']);
+    expect(toks("markup", "1 < 2")).toEqual([]);
+    expect(toks("markup", "<a =>")).toEqual(["x:<a", "x:>"]);
+  });
+});
+
+describe("highlight: markdown", () => {
+  test("headings, quotes, lists", () => {
+    expect(toks("md", "## Title")).toEqual(["h:## Title"]);
+    expect(toks("md", "> quote")).toEqual(["c:> quote"]);
+    expect(toks("md", "- item `code`")).toEqual(["k:- ", "s:`code`"]);
+    expect(toks("md", "1. one")).toEqual(["k:1. "]);
+  });
+
+  test("inline emphasis, links", () => {
+    expect(toks("md", "a **b** and *c* and [l](u) <https://x.y>")).toEqual(["b:**b**", "i:*c*", "l:[l](u)", "l:<https://x.y>"]);
+    expect(toks("md", "__b__ _i_ ![img](p)")).toEqual(["b:__b__", "i:_i_", "l:![img](p)"]);
+  });
+
+  test("fenced code blocks", () => {
+    const src = "```js\nconst x\n```\nafter **b**";
+    expect(toks("md", src, 0)).toEqual(["s:```js"]);
+    expect(toks("md", src, 1)).toEqual(["s:const x"]);
+    expect(toks("md", src, 2)).toEqual(["s:```"]);
+    expect(toks("md", src, 3)).toEqual(["b:**b**"]);
+    const tilde = "~~~\nx\n~~~";
+    expect(toks("md", tilde, 1)).toEqual(["s:x"]);
+  });
+});
+
+describe("highlight: Highlighter caching", () => {
+  test("jumping to a later line computes earlier state; re-query is stable", () => {
+    const lines = ["/* a", "b", "c */ x", "d"];
+    const hl = new Highlighter("js", lines);
+    expect(hl.line(3)).toEqual([]);
+    expect(hl.line(1)).toEqual([[0, 1, "c"]]);
+    expect(hl.line(2).map((s) => s[2])).toEqual(["c"]);
+  });
+
+  test("lexLine returns state for open block comment", () => {
+    const out: Span[] = [];
+    expect(lexLine("js", "/* open", 0, out)).toBe(1);
+    expect(lexLine("js", "still", 1, (out.length = 0, out))).toBe(1);
+    expect(lexLine("js", "end */", 1, (out.length = 0, out))).toBe(0);
+  });
+});
+
+describe("highlight: string escapes", () => {
+  test("escaped quote does not end the string", () => {
+    expect(toks("js", 'x = "a\\"b" + 1')).toEqual(['s:"a\\"b"', "n:1"]);
+  });
+});
diff --git a/test/http.coverage.test.ts b/test/http.coverage.test.ts
new file mode 100644
index 0000000..90e7ee6
--- /dev/null
+++ b/test/http.coverage.test.ts
@@ -0,0 +1,477 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile, mkdir, realpath, symlink, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { startServer, VERSION } from "../src/server/http.ts";
+
+// Captured at load: other test files may swap globalThis.fetch/WebSocket for mocks.
+const fetch = globalThis.fetch.bind(globalThis) as typeof globalThis.fetch;
+const WebSocket = globalThis.WebSocket;
+const token = "C".repeat(43);
+const auth = { "x-cv-token": token };
+const json = { ...auth, "content-type": "application/json" };
+
+let dir = "";
+let cfg = "";
+let outside = "";
+let app: ReturnType<typeof startServer>;
+let base = "";
+let port = 0;
+const opened: string[] = [];
+let relaunched = 0;
+let relaunchOk = false;
+const saved: Record<string, string | undefined> = {};
+
+type Fake = { install: { kind: string }; installing: boolean; check(force?: boolean): Promise<unknown>; apply(cb: (p: string, d?: string) => void): Promise<unknown> };
+let fake: Fake;
+let checkMode: "ok" | "throw" = "ok";
+let applyMode: "ok" | "throw" = "ok";
+
+const git = (...a: string[]) => Bun.spawnSync(["git", ...a], { cwd: dir, env: { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t" } });
+
+const get = (p: string, h: Record<string, string> = auth) => fetch(`${base}${p}`, { headers: h });
+
+beforeAll(async () => {
+  for (const k of ["XDG_CONFIG_HOME", "CODEVIEWER_NO_UPDATE_CHECK"]) saved[k] = process.env[k];
+  cfg = await realpath(await mkdtemp(path.join(tmpdir(), "cv-cfg-")));
+  process.env.XDG_CONFIG_HOME = cfg;
+  process.env.CODEVIEWER_NO_UPDATE_CHECK = "1";
+  dir = await realpath(await mkdtemp(path.join(tmpdir(), "cv-httpcov-")));
+  outside = await realpath(await mkdtemp(path.join(tmpdir(), "cv-out-")));
+  await writeFile(path.join(outside, "secret.txt"), "secret");
+  await mkdir(path.join(dir, "sub"));
+  await writeFile(path.join(dir, "a.txt"), "line1\nline2\nline3\n");
+  await writeFile(path.join(dir, "sub", "b.ts"), "export const b = 1;\n");
+  await writeFile(path.join(dir, "bin.dat"), new Uint8Array([0, 1, 2, 3, 0, 0, 255]));
+  await writeFile(path.join(dir, "pic.svg"), "<svg xmlns='http://www.w3.org/2000/svg'/>");
+  await writeFile(path.join(dir, "doc.pdf"), "%PDF-1.4 fake");
+  await writeFile(path.join(dir, "noext"), "x".repeat(1000));
+  await symlink(path.join(outside, "secret.txt"), path.join(dir, "escape"));
+  git("init", "-q");
+  git("add", ".");
+  git("commit", "-q", "-m", "init");
+  await writeFile(path.join(dir, "a.txt"), "line1\nCHANGED\nline3\n");
+
+  fake = {
+    install: { kind: "cli" },
+    installing: false,
+    async check() {
+      if (checkMode === "throw") throw new Error("offline");
+      return { current: VERSION, latest: "9.9.9", available: true, kind: "cli", canInstall: true, checkedAt: 1 };
+    },
+    async apply(cb) {
+      cb("download", "x");
+      if (applyMode === "throw") throw new Error("boom");
+      return { version: "9.9.9", kind: "cli", target: "/x" };
+    },
+  };
+  app = startServer({
+    root: dir, port: 0, host: "127.0.0.1", shell: "/bin/sh", token,
+    openExternal: (u) => void opened.push(u),
+    relaunch: { available: () => relaunchOk, run: () => void relaunched++ },
+    updater: fake as never,
+  });
+  port = app.server.port!;
+  base = `http://127.0.0.1:${port}`;
+});
+
+afterAll(async () => {
+  app.stop();
+  for (const [k, v] of Object.entries(saved)) {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  }
+  await rm(dir, { recursive: true, force: true });
+  await rm(cfg, { recursive: true, force: true });
+  await rm(outside, { recursive: true, force: true });
+});
+
+/** Opens an events socket and collects messages. */
+async function events() {
+  const msgs: any[] = [];
+  const ws = new WebSocket(`ws://127.0.0.1:${port}/ws/events?t=${token}`, { headers: { origin: base } } as never);
+  ws.onmessage = (e) => msgs.push(JSON.parse(String(e.data)));
+  await new Promise<void>((res, rej) => {
+    ws.onopen = () => res();
+    ws.onerror = () => rej(new Error("ws failed"));
+  });
+  const waitFor = async (pred: (m: any) => boolean, ms = 4000) => {
+    const t0 = Date.now();
+    while (Date.now() - t0 < ms) {
+      const m = msgs.find(pred);
+      if (m) return m;
+      await Bun.sleep(20);
+    }
+    throw new Error("timeout waiting for message; got " + JSON.stringify(msgs));
+  };
+  return { ws, msgs, waitFor };
+}
+
+test("asset serving: security headers, CSP, etag 304, gzip", async () => {
+  const r = await fetch(`${base}/`, { headers: { "accept-encoding": "identity" } });
+  expect(r.status).toBe(200);
+  expect(r.headers.get("x-frame-options")).toBe("DENY");
+  expect(r.headers.get("x-content-type-options")).toBe("nosniff");
+  expect(r.headers.get("content-security-policy")).toContain(`ws://127.0.0.1:${port}`);
+  expect(r.headers.get("content-type")).toContain("text/html");
+  const etag = r.headers.get("etag")!;
+  expect(etag).toBeTruthy();
+  const r304 = await fetch(`${base}/`, { headers: { "if-none-match": etag } });
+  expect(r304.status).toBe(304);
+  const gz = await fetch(`${base}/app.js`, { headers: { "accept-encoding": "gzip" }, decompress: false } as never);
+  expect(gz.status).toBe(200);
+  if (gz.headers.get("content-encoding")) expect(gz.headers.get("content-encoding")).toBe("gzip");
+});
+
+test("fonts are public, immutable and served as woff2", async () => {
+  const r = await fetch(`${base}/fonts/InterVariable.woff2`);
+  expect(r.status).toBe(200);
+  expect(r.headers.get("content-type")).toBe("font/woff2");
+  expect(r.headers.get("cache-control")).toContain("immutable");
+  expect((await r.arrayBuffer()).byteLength).toBeGreaterThan(1000);
+});
+
+test("/api/info reports root, version, shell", async () => {
+  const j = await (await get("/api/info")).json();
+  expect(j.root).toBe(dir);
+  expect(j.version).toBe(VERSION);
+  expect(j.shell).toBe("sh");
+  expect(j.name).toBe(path.basename(dir));
+  expect(j.maxText).toBeGreaterThan(0);
+});
+
+test("/api/list lists a directory, 404 for escapes and missing paths", async () => {
+  const root = await (await get("/api/list")).json();
+  expect(root.map((e: any) => e.name)).toContain("sub");
+  const sub = await (await get("/api/list?path=sub")).json();
+  expect(sub.map((e: any) => e.name)).toEqual(["b.ts"]);
+  expect((await get("/api/list?path=nope")).status).toBe(404);
+  expect((await get("/api/list?path=../")).status).toBe(404);
+  expect((await get("/api/list?path=escape")).status).toBe(404);
+  // A file is not a directory.
+  expect((await get("/api/list?path=a.txt")).status).toBe(400);
+});
+
+test("/api/stat distinguishes files and dirs", async () => {
+  expect(await (await get("/api/stat?path=sub")).json()).toMatchObject({ type: "dir" });
+  const f = await (await get("/api/stat?path=a.txt")).json();
+  expect(f).toMatchObject({ type: "file", size: 20 });
+  expect(f.mtime).toBeGreaterThan(0);
+  expect((await get("/api/stat?path=missing")).status).toBe(404);
+  expect((await get("/api/stat?path=escape")).status).toBe(404);
+});
+
+test("/api/file returns content with metadata headers, honours ?text", async () => {
+  const r = await get("/api/file?path=a.txt");
+  expect(r.status).toBe(200);
+  expect(r.headers.get("cache-control")).toBe("no-store");
+  expect(r.headers.get("x-cv-truncated")).toBe("0");
+  expect(r.headers.get("x-cv-size")).toBe("20");
+  expect(await r.text()).toBe("line1\nCHANGED\nline3\n");
+  const b = await get("/api/file?path=bin.dat");
+  expect(b.status).toBe(200);
+  expect(b.headers.get("x-cv-kind")).not.toBe("text");
+  expect((await get("/api/file?path=pic.svg")).headers.get("x-cv-kind")).toBe("image");
+  const forced = await get("/api/file?path=pic.svg&text=1");
+  expect(forced.headers.get("x-cv-kind")).toBe("text");
+  expect(await forced.text()).toContain("<svg");
+  await writeFile(path.join(dir, "u16.txt"), Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from("hi", "utf16le")]));
+  const u16 = await get("/api/file?path=u16.txt");
+  expect(u16.headers.get("x-cv-encoding")).toBe("UTF-16 LE");
+  expect(await u16.text()).toBe("hi");
+  expect((await get("/api/file?path=missing")).status).toBe(404);
+  expect((await get("/api/file?path=sub")).headers.get("x-cv-kind")).toBe("dir");
+  expect((await get("/api/file?path=escape")).status).toBe(404);
+});
+
+test("/api/raw: mime types, CSP sandbox, content-length, ?limit, errors", async () => {
+  const svg = await get("/api/raw?path=pic.svg");
+  expect(svg.headers.get("content-type")).toBe("image/svg+xml");
+  expect(svg.headers.get("content-security-policy")).toContain("sandbox");
+  expect((await svg.text()).startsWith("<svg")).toBe(true);
+  const pdf = await get("/api/raw?path=doc.pdf");
+  expect(pdf.headers.get("content-type")).toBe("application/pdf");
+  expect((await pdf.text()).length).toBe(13);
+  const none = await get("/api/raw?path=noext");
+  expect(none.headers.get("content-type")).toBe("application/octet-stream");
+  expect((await none.text()).length).toBe(1000);
+  const lim = await get("/api/raw?path=noext&limit=10");
+  expect(await lim.text()).toBe("x".repeat(10));
+  const big = await get("/api/raw?path=noext&limit=999999");
+  expect((await big.text()).length).toBe(1000);
+  expect((await get("/api/raw?path=missing")).status).toBe(404);
+  expect((await get("/api/raw?path=sub")).status).toBe(400);
+  expect((await get("/api/raw?path=escape")).status).toBe(404);
+});
+
+test("/api/raw streams files larger than one chunk and supports cancel", async () => {
+  const big = path.join(dir, "big.bin");
+  const data = new Uint8Array(600 * 1024).map((_, i) => i % 251);
+  await writeFile(big, data);
+  const r = await get("/api/raw?path=big.bin");
+  const buf = new Uint8Array(await r.arrayBuffer());
+  expect(buf.length).toBe(data.length);
+  expect(buf[300000]).toBe(data[300000]!);
+  // Abort mid-stream: the server must stay healthy.
+  const r2 = await get("/api/raw?path=big.bin");
+  await r2.body!.cancel();
+  expect((await get("/api/info")).status).toBe(200);
+});
+
+test("/api/index lists files, skipping heavy dirs", async () => {
+  const txt = await (await get("/api/index")).text();
+  const lines = txt.split("\n");
+  expect(lines).toContain("a.txt");
+  expect(lines).toContain("sub/b.ts");
+  expect(lines.some((l) => l.startsWith(".git/"))).toBe(false);
+});
+
+test("git endpoints: status, base, blame", async () => {
+  const st = await (await get("/api/git/status")).json();
+  expect(st.repo).toBe(true);
+  const base1 = await get("/api/git/base?path=a.txt");
+  expect(base1.status).toBe(200);
+  expect(await base1.text()).toBe("line1\nline2\nline3\n");
+  expect((await get("/api/git/base?path=nope.txt")).status).toBe(404);
+  expect((await get("/api/git/base?path=escape")).status).toBe(404);
+  expect((await get("/api/git/base?path=bin.dat")).status).toBe(415);
+  const bl = await get("/api/git/blame?path=a.txt&line=1");
+  expect(bl.status).toBe(200);
+  expect((await get("/api/git/blame?path=a.txt&line=0")).status).toBe(404);
+  expect((await get("/api/git/blame?path=a.txt&line=abc")).status).toBe(404);
+  expect((await get("/api/git/blame?path=a.txt&line=1.5")).status).toBe(404);
+  expect((await get("/api/git/blame?path=escape&line=1")).status).toBe(404);
+});
+
+test("/api/update: status (auto-check disabled), forced check, check failure", async () => {
+  const s = await (await get("/api/update")).json();
+  expect(s).toMatchObject({ current: VERSION, latest: null, available: false, canInstall: false, kind: "cli" });
+  const c = await (await get("/api/update?check=1")).json();
+  expect(c).toMatchObject({ latest: "9.9.9", available: true });
+  checkMode = "throw";
+  try {
+    const r = await get("/api/update?check=1");
+    expect(r.status).toBe(502);
+    expect((await r.json()).error).toBe("offline");
+  } finally {
+    checkMode = "ok";
+  }
+});
+
+test("/api/update/install: method, busy, success and failure are broadcast", async () => {
+  const post = () => fetch(`${base}/api/update/install`, { method: "POST", headers: json, body: "{}" });
+  fake.installing = true;
+  expect((await post()).status).toBe(409);
+  fake.installing = false;
+
+  const ev = await events();
+  try {
+    expect(await (await post()).json()).toEqual({ ok: true });
+    await ev.waitFor((m) => m.t === "update" && m.phase === "download");
+    const done = await ev.waitFor((m) => m.t === "update" && m.phase === "installed");
+    expect(done.detail).toBe("9.9.9");
+    expect(done.relaunch).toBe("manual");
+    relaunchOk = true;
+    ev.msgs.length = 0;
+    await post();
+    expect((await ev.waitFor((m) => m.phase === "installed")).relaunch).toBe("server");
+    relaunchOk = false;
+    ev.msgs.length = 0;
+    applyMode = "throw";
+    await post();
+    const err = await ev.waitFor((m) => m.phase === "error");
+    expect(err.detail).toBe("boom");
+    // macOS app installs restart natively.
+    applyMode = "ok";
+    fake.apply = async () => ({ version: "9.9.9", kind: "macos-app", target: "/x" });
+    ev.msgs.length = 0;
+    await post();
+    expect((await ev.waitFor((m) => m.phase === "installed")).relaunch).toBe("native");
+  } finally {
+    applyMode = "ok";
+    ev.ws.close();
+  }
+});
+
+test("/api/update/relaunch: only POST, only when available", async () => {
+  const post = () => fetch(`${base}/api/update/relaunch`, { method: "POST", headers: json, body: "{}" });
+  expect((await post()).status).toBe(409);
+  relaunchOk = true;
+  try {
+    expect(await (await post()).json()).toEqual({ ok: true });
+    await Bun.sleep(400);
+    expect(relaunched).toBe(1);
+  } finally {
+    relaunchOk = false;
+  }
+  // Non-POST with a JSON content type hits the 405 branch (GET is exempt from the content-type check).
+  expect((await get("/api/update/relaunch")).status).toBe(405);
+  expect((await get("/api/update/install")).status).toBe(405);
+});
+
+test("/api/settings: round-trip, validation, size limit, method check", async () => {
+  expect(await (await get("/api/settings")).json()).toEqual({});
+  const put = (body: string) => fetch(`${base}/api/settings`, { method: "PUT", headers: json, body });
+  expect((await put(JSON.stringify({ theme: "dark" }))).status).toBe(200);
+  expect(await (await get("/api/settings")).json()).toEqual({ theme: "dark" });
+  expect(JSON.parse(await readFile(path.join(cfg, "codeviewer", "settings.json"), "utf8"))).toEqual({ theme: "dark" });
+  expect((await put("not json")).status).toBe(400);
+  expect((await put("[1,2]")).status).toBe(400);
+  expect((await put(JSON.stringify({ x: "y".repeat(300 * 1024) }))).status).toBe(413);
+  expect(await (await get("/api/settings")).json()).toEqual({ theme: "dark" });
+  const del = await fetch(`${base}/api/settings`, { method: "DELETE", headers: json });
+  expect(del.status).toBe(405);
+});
+
+test("/api/external opens only http(s) URLs", async () => {
+  const post = (body: string) => fetch(`${base}/api/external`, { method: "POST", headers: json, body });
+  expect((await post(JSON.stringify({ url: "https://example.com/x?y=1" }))).status).toBe(200);
+  expect(opened).toEqual(["https://example.com/x?y=1"]);
+  expect((await post(JSON.stringify({ url: "file:///etc/passwd" }))).status).toBe(400);
+  expect((await post(JSON.stringify({ url: "javascript:alert(1)" }))).status).toBe(400);
+  expect((await post(JSON.stringify({ url: "not a url" }))).status).toBe(400);
+  expect((await post("garbage")).status).toBe(400);
+  expect((await post("{}")).status).toBe(400);
+  expect(opened.length).toBe(1);
+  expect((await get("/api/external")).status).toBe(405);
+});
+
+test("/api/open validates the path and broadcasts to event sockets", async () => {
+  const post = (body: unknown) => fetch(`${base}/api/open`, { method: "POST", headers: json, body: typeof body === "string" ? body : JSON.stringify(body) });
+  expect((await get("/api/open")).status).toBe(405);
+  expect((await post("garbage")).status).toBe(400);
+  expect((await post({})).status).toBe(400);
+  expect((await post({ path: path.join(outside, "secret.txt") })).status).toBe(404);
+  expect((await post({ path: "missing.txt" })).status).toBe(404);
+  expect((await post({ path: "escape" })).status).toBe(404);
+
+  expect(await (await post({ path: "a.txt" })).json()).toEqual({ ok: true, clients: 0 });
+  const ev = await events();
+  try {
+    expect(await (await post({ path: path.join(dir, "sub", "b.ts"), line: 7 })).json()).toEqual({ ok: true, clients: 1 });
+    const m = await ev.waitFor((m) => m.t === "open");
+    expect(m).toEqual({ t: "open", path: "sub/b.ts", line: 7 });
+    ev.msgs.length = 0;
+    await post({ path: "a.txt" });
+    expect((await ev.waitFor((m) => m.t === "open")).line).toBe(0);
+  } finally {
+    ev.ws.close();
+  }
+});
+
+test("unknown API paths and unknown websocket paths are 404", async () => {
+  expect((await get("/api/nope")).status).toBe(404);
+  expect((await get("/ws/other")).status).toBe(404);
+  expect((await get("/ws/events", {})).status).toBe(401);
+});
+
+test("/ws/pty validates the id; /ws/events upgrade over plain HTTP fails", async () => {
+  expect((await get(`/ws/pty?id=x&t=${token}`)).status).toBe(400);
+  expect((await get(`/ws/pty?id=abcdef123&t=${token}`)).status).toBe(400); // valid id but not an upgrade
+  expect((await get(`/ws/events?t=${token}`)).status).toBe(400);
+});
+
+test("pty websocket runs a shell with CODEVIEWER_* env and closes cleanly", async () => {
+  const ws = new WebSocket(`ws://127.0.0.1:${port}/ws/pty?t=${token}&id=term-cov-1&cols=100&rows=30`, { headers: { origin: base } } as never);
+  ws.binaryType = "arraybuffer";
+  let out = "";
+  const dec = new TextDecoder();
+  ws.onmessage = (e) => {
+    out += typeof e.data === "string" ? e.data : dec.decode(e.data as ArrayBuffer);
+  };
+  await new Promise<void>((res, rej) => {
+    ws.onopen = () => res();
+    ws.onerror = () => rej(new Error("pty ws failed"));
+  });
+  ws.send(JSON.stringify({ t: "resize", cols: 120, rows: 40 }));
+  ws.send(new TextEncoder().encode('echo "URL=$CODEVIEWER_URL" "TP=$TERM_PROGRAM"\n'));
+  const t0 = Date.now();
+  while (!out.includes(`URL=${base}`) && Date.now() - t0 < 6000) await Bun.sleep(30);
+  expect(out).toContain(`URL=${base}`);
+  expect(out).toContain("TP=codeviewer");
+  ws.send(JSON.stringify({ t: "kill" }));
+  await Bun.sleep(100);
+  ws.close();
+});
+
+test("file changes are broadcast on the events socket", async () => {
+  const ev = await events();
+  try {
+    await Bun.sleep(200);
+    await writeFile(path.join(dir, "new-file.txt"), "hi");
+    const m = await ev.waitFor((m) => m.t === "changed" && m.paths.includes("new-file.txt"), 8000);
+    expect(m.structural).toBe(true);
+    expect((await (await get("/api/index")).text()).split("\n")).toContain("new-file.txt");
+  } finally {
+    ev.ws.close();
+  }
+});
+
+test("non-loopback host disables the Host check and rewrites wildcard URLs", async () => {
+  const other = startServer({ root: dir, port: 0, host: "0.0.0.0", shell: "/bin/sh", token, openExternal: () => {}, updater: fake as never });
+  try {
+    expect(other.url).toBe(`http://127.0.0.1:${other.server.port}/#t=${token}`);
+    const r = await fetch(`http://127.0.0.1:${other.server.port}/api/info`, { headers: { ...auth, host: "anything.example" } });
+    expect(r.status).toBe(200);
+  } finally {
+    other.stop();
+  }
+  const v6 = startServer({ root: dir, port: 0, host: "::1", shell: "/bin/sh", token, openExternal: () => {}, updater: fake as never });
+  try {
+    expect(v6.url).toBe(`http://[::1]:${v6.server.port}/#t=${token}`);
+  } finally {
+    v6.stop();
+  }
+});
+
+test("background auto-update check is skipped when disabled via settings", async () => {
+  // With the env var unset and updates.auto=false in settings, no check is made and status is the default.
+  const prev = process.env.CODEVIEWER_NO_UPDATE_CHECK;
+  delete process.env.CODEVIEWER_NO_UPDATE_CHECK;
+  await fetch(`${base}/api/settings`, { method: "PUT", headers: json, body: JSON.stringify({ updates: { auto: false } }) });
+  let checks = 0;
+  const counting = { ...fake, check: async () => (checks++, fake.check()) };
+  const s = startServer({ root: dir, port: 0, host: "127.0.0.1", shell: "/bin/sh", token, openExternal: () => {}, updater: counting as never });
+  try {
+    const j = await (await fetch(`http://127.0.0.1:${s.server.port}/api/update`, { headers: auth })).json();
+    expect(j.available).toBe(false);
+    expect(checks).toBe(0);
+  } finally {
+    s.stop();
+    if (prev !== undefined) process.env.CODEVIEWER_NO_UPDATE_CHECK = prev;
+    else process.env.CODEVIEWER_NO_UPDATE_CHECK = "1";
+  }
+});
+
+test("a non-git directory reports repo:false and 404s base/blame", async () => {
+  const plain = await realpath(await mkdtemp(path.join(tmpdir(), "cv-plain-")));
+  await writeFile(path.join(plain, "f.txt"), "x");
+  const s = startServer({ root: plain, port: 0, host: "127.0.0.1", shell: "/bin/sh", token, openExternal: () => {}, updater: fake as never });
+  try {
+    const b = `http://127.0.0.1:${s.server.port}`;
+    expect(await (await fetch(`${b}/api/git/status`, { headers: auth })).json()).toEqual({ repo: false });
+    expect((await fetch(`${b}/api/git/base?path=f.txt`, { headers: auth })).status).toBe(404);
+    expect((await fetch(`${b}/api/git/blame?path=f.txt&line=1`, { headers: auth })).status).toBe(404);
+  } finally {
+    s.stop();
+    await rm(plain, { recursive: true, force: true });
+  }
+});
+
+test("background auto-update check runs once per launch and feeds /api/update", async () => {
+  const prev = process.env.CODEVIEWER_NO_UPDATE_CHECK;
+  delete process.env.CODEVIEWER_NO_UPDATE_CHECK;
+  await fetch(`${base}/api/settings`, { method: "PUT", headers: json, body: "{}" });
+  let checks = 0;
+  const counting = { ...fake, check: async () => (checks++, fake.check()) };
+  const s = startServer({ root: dir, port: 0, host: "127.0.0.1", shell: "/bin/sh", token, openExternal: () => {}, updater: counting as never });
+  try {
+    // The status request waits for the delayed background check.
+    const j = await (await fetch(`http://127.0.0.1:${s.server.port}/api/update`, { headers: auth })).json();
+    expect(checks).toBe(1);
+    expect(j).toMatchObject({ latest: "9.9.9", available: true });
+  } finally {
+    s.stop();
+    process.env.CODEVIEWER_NO_UPDATE_CHECK = prev ?? "1";
+  }
+}, 10000);
diff --git a/test/index.coverage.test.ts b/test/index.coverage.test.ts
new file mode 100644
index 0000000..0fae1a7
--- /dev/null
+++ b/test/index.coverage.test.ts
@@ -0,0 +1,140 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile, mkdir, realpath, chmod } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { FileIndex, HEAVY_DIRS } from "../src/server/index.ts";
+
+let root = "";
+beforeEach(async () => {
+  root = await realpath(await mkdtemp(path.join(tmpdir(), "cv-index-")));
+  await mkdir(path.join(root, "src", "deep"), { recursive: true });
+  await mkdir(path.join(root, "node_modules", "x"), { recursive: true });
+  await mkdir(path.join(root, ".git"), { recursive: true });
+  await writeFile(path.join(root, "top.txt"), "");
+  await writeFile(path.join(root, "src", "a.ts"), "");
+  await writeFile(path.join(root, "src", "deep", "b.ts"), "");
+  await writeFile(path.join(root, "node_modules", "x", "i.js"), "");
+  await writeFile(path.join(root, ".git", "HEAD"), "");
+});
+afterEach(async () => {
+  await chmod(path.join(root, "src"), 0o755).catch(() => {});
+  await rm(root, { recursive: true, force: true });
+});
+
+const list = async (ix: FileIndex) => (await ix.get()).split("\n").filter(Boolean).sort();
+
+test("HEAVY_DIRS covers the usual suspects", () => {
+  for (const d of [".git", "node_modules", "target", "__pycache__"]) expect(HEAVY_DIRS.has(d)).toBe(true);
+});
+
+test("get() walks the tree, skipping heavy dirs, and caches the text", async () => {
+  const ix = new FileIndex(root);
+  expect(await list(ix)).toEqual(["src/a.ts", "src/deep/b.ts", "top.txt"]);
+  expect(await ix.get()).toBe(await ix.get());
+});
+
+test("concurrent get() calls share one build", async () => {
+  const ix = new FileIndex(root);
+  const [a, b] = await Promise.all([ix.get(), ix.get()]);
+  expect(a).toBe(b);
+});
+
+test("an empty root yields an empty index; a missing root does not throw", async () => {
+  const empty = await mkdtemp(path.join(tmpdir(), "cv-index-empty-"));
+  try {
+    expect(await new FileIndex(empty).get()).toBe("");
+  } finally {
+    await rm(empty, { recursive: true, force: true });
+  }
+  expect(await new FileIndex(path.join(root, "does-not-exist")).get()).toBe("");
+});
+
+test("breadth-first order puts shallow files first", async () => {
+  const ix = new FileIndex(root);
+  const lines = (await ix.get()).split("\n");
+  expect(lines.indexOf("top.txt")).toBeLessThan(lines.indexOf("src/deep/b.ts"));
+  expect(lines.indexOf("src/a.ts")).toBeLessThan(lines.indexOf("src/deep/b.ts"));
+});
+
+test("unreadable directories are skipped", async () => {
+  if (process.getuid?.() === 0) return; // root ignores permissions
+  await chmod(path.join(root, "src"), 0o000);
+  const ix = new FileIndex(root);
+  expect(await list(ix)).toEqual(["top.txt"]);
+});
+
+test("apply() before the first build asks for a rebuild (returns true)", async () => {
+  expect(await new FileIndex(root).apply(["top.txt"])).toBe(true);
+});
+
+test("apply(): content edits are not structural; creates and deletes are", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  expect(await ix.apply(["top.txt"])).toBe(false);
+
+  await writeFile(path.join(root, "src", "new.ts"), "");
+  expect(await ix.apply(["src/new.ts"])).toBe(true);
+  expect(await list(ix)).toContain("src/new.ts");
+
+  await rm(path.join(root, "src", "new.ts"));
+  expect(await ix.apply(["src/new.ts"])).toBe(true);
+  expect(await list(ix)).not.toContain("src/new.ts");
+
+  // Deleting something that was never indexed is not a change.
+  expect(await ix.apply(["ghost.txt"])).toBe(false);
+});
+
+test("apply(): heavy dirs are ignored", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  await writeFile(path.join(root, "node_modules", "x", "j.js"), "");
+  expect(await ix.apply(["node_modules/x/j.js"])).toBe(false);
+  expect(await list(ix)).not.toContain("node_modules/x/j.js");
+});
+
+test("apply(): events for known directories are churn; new directories trigger a rescan", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  expect(await ix.apply(["src", "src/deep"])).toBe(false);
+
+  await mkdir(path.join(root, "fresh"));
+  await writeFile(path.join(root, "fresh", "f.txt"), "");
+  expect(await ix.apply(["fresh"])).toBe(true);
+  // The rescan happens lazily on the next get().
+  expect(await list(ix)).toContain("fresh/f.txt");
+});
+
+test("apply(): a deleted directory drops everything beneath it", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  await rm(path.join(root, "src"), { recursive: true });
+  expect(await ix.apply(["src"])).toBe(true);
+  expect(await list(ix)).toEqual(["top.txt"]);
+});
+
+test("apply(): huge bursts invalidate and rebuild from disk", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  await writeFile(path.join(root, "late.txt"), "");
+  const paths = Array.from({ length: 2001 }, (_, i) => `p${i}`);
+  expect(await ix.apply(paths)).toBe(true);
+  expect(await list(ix)).toContain("late.txt");
+});
+
+test("invalidate() forces a rebuild", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  await writeFile(path.join(root, "added.txt"), "");
+  expect(await list(ix)).not.toContain("added.txt");
+  ix.invalidate();
+  expect(await list(ix)).toContain("added.txt");
+});
+
+test("a new file in a freshly added directory is found after dirs cache refresh", async () => {
+  const ix = new FileIndex(root);
+  await ix.get();
+  // Adding a file resets the known-dirs cache so later directory events are judged correctly.
+  await writeFile(path.join(root, "src", "c.ts"), "");
+  await ix.apply(["src/c.ts"]);
+  expect(await ix.apply(["src/deep"])).toBe(false);
+});
diff --git a/test/main.test.ts b/test/main.test.ts
new file mode 100644
index 0000000..3fa4f33
--- /dev/null
+++ b/test/main.test.ts
@@ -0,0 +1,358 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile, realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { VERSION } from "../src/server/http.ts";
+
+// Captured at load: other test files may swap globalThis.fetch/WebSocket for mocks.
+const fetch = globalThis.fetch.bind(globalThis) as typeof globalThis.fetch;
+const WebSocket = globalThis.WebSocket;
+const MAIN = path.resolve(import.meta.dir, "../src/server/main.ts");
+let dir = "";
+let cfg = "";
+
+beforeAll(async () => {
+  dir = await realpath(await mkdtemp(path.join(tmpdir(), "cv-main-")));
+  cfg = await realpath(await mkdtemp(path.join(tmpdir(), "cv-main-cfg-")));
+  await writeFile(path.join(dir, "file.txt"), "x");
+});
+afterAll(async () => {
+  await rm(dir, { recursive: true, force: true });
+  await rm(cfg, { recursive: true, force: true });
+});
+
+const env = (extra: Record<string, string> = {}) => {
+  const e: Record<string, string> = {};
+  for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !k.startsWith("CODEVIEWER_")) e[k] = v;
+  return { ...e, XDG_CONFIG_HOME: cfg, CODEVIEWER_NO_UPDATE_CHECK: "1", ...extra };
+};
+
+async function run(args: string[], extra: Record<string, string> = {}) {
+  const p = Bun.spawn(["bun", MAIN, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore", env: env(extra), cwd: dir });
+  const [out, err, code] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text(), p.exited]);
+  return { out, err, code };
+}
+
+/** Starts the server and resolves once `ready` matches stdout. */
+async function serve(args: string[], ready: RegExp, extra: Record<string, string> = {}) {
+  const p = Bun.spawn(["bun", MAIN, ...args], { stdout: "pipe", stderr: "pipe", stdin: "ignore", env: env(extra), cwd: dir });
+  let out = "";
+  const reader = p.stdout.getReader();
+  const dec = new TextDecoder();
+  const deadline = Date.now() + 15000;
+  while (!ready.test(out) && Date.now() < deadline) {
+    const r = await Promise.race([reader.read(), Bun.sleep(200).then(() => null)]);
+    if (r === null) continue;
+    if (r.done) break;
+    out += dec.decode(r.value);
+  }
+  return { p, out, reader };
+}
+
+test("--version and -v print the version", async () => {
+  for (const f of ["--version", "-v"]) {
+    const r = await run([f]);
+    expect(r.code).toBe(0);
+    expect(r.out.trim()).toBe(VERSION);
+  }
+});
+
+test("--help and -h print usage", async () => {
+  for (const f of ["--help", "-h"]) {
+    const r = await run([f]);
+    expect(r.code).toBe(0);
+    expect(r.out).toContain(`codeviewer ${VERSION}`);
+    expect(r.out).toContain("--no-open");
+    expect(r.out).toContain("codeviewer open <file[:line]>");
+  }
+});
+
+test("unknown option exits 1 with usage on stderr", async () => {
+  const r = await run(["--bogus"]);
+  expect(r.code).toBe(1);
+  expect(r.err).toContain("unknown option --bogus");
+  expect(r.err).toContain("Usage:");
+});
+
+test("options that need a value complain when it is missing", async () => {
+  for (const f of ["--port", "-p", "--host", "--shell"]) {
+    const r = await run([f]);
+    expect(r.code).toBe(1);
+    expect(r.err).toContain(`${f} needs a value`);
+  }
+});
+
+test("invalid ports are rejected", async () => {
+  for (const v of ["abc", "-1", "70000", "1.5"]) {
+    const r = await run(["--port", v, "--no-open", dir]);
+    expect(r.code).toBe(1);
+    expect(r.err).toContain("invalid port");
+  }
+});
+
+test("missing directories and plain files are rejected", async () => {
+  const missing = await run(["--no-open", path.join(dir, "nope")]);
+  expect(missing.code).toBe(1);
+  expect(missing.err).toContain("cannot open");
+  const file = await run(["--no-open", path.join(dir, "file.txt")]);
+  expect(file.code).toBe(1);
+  expect(file.err).toContain("is not a directory");
+});
+
+test("--machine prints a single JSON line with url and root, and the server answers", async () => {
+  const { p, out } = await serve(["--machine", "--no-open", "--shell", "/bin/sh", dir], /\}\s*$/m);
+  try {
+    const j = JSON.parse(out.trim().split("\n")[0]!);
+    expect(j.root).toBe(dir);
+    const u = new URL(j.url);
+    expect(u.hostname).toBe("127.0.0.1");
+    const token = u.hash.replace("#t=", "");
+    expect(token.length).toBeGreaterThanOrEqual(43);
+    const info = await (await fetch(`${u.origin}/api/info`, { headers: { "x-cv-token": token } })).json();
+    expect(info.root).toBe(dir);
+    expect(info.shell).toBe("sh");
+    expect((await fetch(`${u.origin}/api/info`)).status).toBe(401);
+  } finally {
+    p.kill("SIGTERM");
+    expect(await p.exited).toBe(0);
+  }
+});
+
+test("--no-open prints the banner with root and URL; -p picks the port; SIGINT quits cleanly", async () => {
+  // Find a free port, release it, and ask main.ts to take it.
+  const probe = Bun.serve({ port: 0, fetch: () => new Response("") });
+  const port = probe.port!;
+  probe.stop(true);
+  const { p, out } = await serve(["-p", String(port), "--no-open", dir], /Ctrl\+C to quit/);
+  try {
+    expect(out).toContain("codeviewer");
+    expect(out).toContain(dir);
+    expect(out).toContain(`http://127.0.0.1:${port}/#t=`);
+    expect(out).not.toContain("Listening on");
+    expect((await fetch(`http://127.0.0.1:${port}/`)).status).toBe(200);
+  } finally {
+    p.kill("SIGINT");
+    expect(await p.exited).toBe(0);
+  }
+});
+
+test("a non-loopback --host prints a warning", async () => {
+  const { p, out } = await serve(["--host", "0.0.0.0", "--no-open", dir], /Ctrl\+C to quit/);
+  try {
+    expect(out).toContain("Listening on 0.0.0.0");
+  } finally {
+    p.kill("SIGTERM");
+    await p.exited;
+  }
+});
+
+test("--exit-with-parent keeps running while the parent lives", async () => {
+  const { p, out } = await serve(["--exit-with-parent", "--machine", "--no-open", dir], /\}\s*$/m);
+  try {
+    expect(JSON.parse(out.trim().split("\n")[0]!).root).toBe(dir);
+    await Bun.sleep(1300);
+    expect(p.exitCode).toBeNull();
+  } finally {
+    p.kill("SIGHUP");
+    expect(await p.exited).toBe(0);
+  }
+});
+
+// --- `codeviewer open` ---
+
+test("open: usage and environment errors", async () => {
+  const noArg = await run(["open"]);
+  expect(noArg.code).toBe(1);
+  expect(noArg.err).toContain("usage: codeviewer open");
+  const noEnv = await run(["open", "file.txt"]);
+  expect(noEnv.code).toBe(1);
+  expect(noEnv.err).toContain("not inside a codeviewer terminal");
+  const unreachable = await run(["open", "file.txt"], { CODEVIEWER_URL: "http://127.0.0.1:1", CODEVIEWER_TOKEN: "t" });
+  expect(unreachable.code).toBe(1);
+  expect(unreachable.err).toContain("cannot reach viewer");
+});
+
+test("open: posts the resolved absolute path and line with the token", async () => {
+  const seen: { path: string; body: any; token: string | null }[] = [];
+  const srv = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(req) {
+      const u = new URL(req.url);
+      const body = await req.json();
+      seen.push({ path: u.pathname, body, token: req.headers.get("x-cv-token") });
+      if (body.path.endsWith("denied.txt")) return Response.json({ error: "path is outside the viewed directory" }, { status: 404 });
+      if (body.path.endsWith("broken.txt")) return new Response("nope", { status: 500, statusText: "Server Error" });
+      return Response.json({ ok: true });
+    },
+  });
+  try {
+    const envv = { CODEVIEWER_URL: `http://127.0.0.1:${srv.port}`, CODEVIEWER_TOKEN: "tok" };
+    const ok = await run(["open", "file.txt:42:7"], envv);
+    expect(ok.code).toBe(0);
+    expect(seen[0]).toEqual({ path: "/api/open", body: { path: path.join(dir, "file.txt"), line: 42 }, token: "tok" });
+
+    const noLine = await run(["open", "file.txt"], envv);
+    expect(noLine.code).toBe(0);
+    expect(seen[1]!.body).toEqual({ path: path.join(dir, "file.txt"), line: 0 });
+
+    const abs = await run(["open", `${path.join(dir, "file.txt")}:3`], envv);
+    expect(abs.code).toBe(0);
+    expect(seen[2]!.body).toEqual({ path: path.join(dir, "file.txt"), line: 3 });
+
+    const denied = await run(["open", "denied.txt"], envv);
+    expect(denied.code).toBe(1);
+    expect(denied.err).toContain("path is outside the viewed directory");
+
+    const broken = await run(["open", "broken.txt"], envv);
+    expect(broken.code).toBe(1);
+    expect(broken.err).toContain("Server Error");
+  } finally {
+    srv.stop(true);
+  }
+});
+
+test("open: end-to-end against a real codeviewer server", async () => {
+  const { p, out } = await serve(["--machine", "--no-open", dir], /\}\s*$/m);
+  try {
+    const u = new URL(JSON.parse(out.trim().split("\n")[0]!).url);
+    const token = u.hash.replace("#t=", "");
+    const ok = await run(["open", "file.txt:5"], { CODEVIEWER_URL: u.origin, CODEVIEWER_TOKEN: token });
+    expect(ok.code).toBe(0);
+    const bad = await run(["open", "/etc/hosts"], { CODEVIEWER_URL: u.origin, CODEVIEWER_TOKEN: token });
+    expect(bad.code).toBe(1);
+    expect(bad.err).toContain("outside the viewed directory");
+  } finally {
+    p.kill("SIGTERM");
+    await p.exited;
+  }
+});
+
+// --- in-process runs (so the module is attributed in coverage reports) ---
+
+class Exit extends Error {
+  constructor(public code: number | undefined) {
+    super(`exit ${code}`);
+  }
+}
+
+/** Imports a fresh copy of main.ts with the given argv, capturing console output and exit. */
+async function inProcess(args: string[], envv: Record<string, string> = {}) {
+  const origArgv = process.argv;
+  const origExit = process.exit;
+  const origLog = console.log;
+  const origErr = console.error;
+  const saved: Record<string, string | undefined> = {};
+  const out: string[] = [];
+  const err: string[] = [];
+  let exit: number | undefined;
+  process.argv = [origArgv[0]!, MAIN, ...args];
+  (process as any).exit = (c?: number) => {
+    throw new Exit(c);
+  };
+  console.log = (...a: unknown[]) => void out.push(a.join(" "));
+  console.error = (...a: unknown[]) => void err.push(a.join(" "));
+  for (const [k, v] of Object.entries(envv)) {
+    saved[k] = process.env[k];
+    process.env[k] = v;
+  }
+  try {
+    await import(`${MAIN}?run=${Math.random()}`);
+  } catch (e) {
+    if (e instanceof Exit) exit = e.code;
+    else throw e;
+  } finally {
+    process.argv = origArgv;
+    (process as any).exit = origExit;
+    console.log = origLog;
+    console.error = origErr;
+    for (const [k, v] of Object.entries(saved)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+  }
+  return { out: out.join("\n"), err: err.join("\n"), exit };
+}
+
+test("in-process: version, help, and argument errors", async () => {
+  expect((await inProcess(["--version"])).out).toBe(VERSION);
+  expect((await inProcess(["-h"])).out).toContain("Usage:");
+  const bad = await inProcess(["--nope"]);
+  expect(bad.exit).toBe(1);
+  expect(bad.err).toContain("unknown option --nope");
+  expect((await inProcess(["--port"])).err).toContain("--port needs a value");
+  expect((await inProcess(["--port", "99999", dir])).err).toContain("invalid port");
+  expect((await inProcess(["--no-open", path.join(dir, "missing")])).err).toContain("cannot open");
+  expect((await inProcess(["--no-open", path.join(dir, "file.txt")])).err).toContain("is not a directory");
+  expect((await inProcess(["open"])).err).toContain("usage: codeviewer open");
+  expect((await inProcess(["open", "x"], { CODEVIEWER_URL: "", CODEVIEWER_TOKEN: "" })).err).toContain("not inside a codeviewer terminal");
+});
+
+test("in-process: open posts to the viewer", async () => {
+  let body: any;
+  const srv = Bun.serve({ port: 0, hostname: "127.0.0.1", async fetch(req) { body = await req.json(); return Response.json({ ok: true }); } });
+  try {
+    const r = await inProcess(["open", "file.txt:9"], { CODEVIEWER_URL: `http://127.0.0.1:${srv.port}`, CODEVIEWER_TOKEN: "t" });
+    expect(r.exit).toBeUndefined();
+    expect(body).toEqual({ path: path.join(process.cwd(), "file.txt"), line: 9 });
+    const down = await inProcess(["open", "f"], { CODEVIEWER_URL: "http://127.0.0.1:1", CODEVIEWER_TOKEN: "t" });
+    expect(down.exit).toBe(1);
+    expect(down.err).toContain("cannot reach viewer");
+  } finally {
+    srv.stop(true);
+  }
+});
+
+test("in-process: server start-up paths (machine JSON, banner, host warning, SIGTERM quits)", async () => {
+  const sigs = ["SIGINT", "SIGTERM", "SIGHUP"] as const;
+  const before = Object.fromEntries(sigs.map((s) => [s, new Set(process.listeners(s))]));
+  const stopAll = () => {
+    const realExit = process.exit;
+    (process as any).exit = (c?: number) => {
+      throw new Exit(c);
+    };
+    try {
+      stopListeners();
+    } finally {
+      (process as any).exit = realExit;
+    }
+  };
+  const stopListeners = () => {
+    for (const s of sigs) {
+      for (const l of process.listeners(s)) if (!before[s]!.has(l as never)) {
+        try {
+          (l as () => void)();
+        } catch (e) {
+          if (!(e instanceof Exit)) throw e;
+        }
+        process.off(s, l as never);
+      }
+    }
+  };
+  const savedEnv: Record<string, string | undefined> = {};
+  for (const [k, v] of Object.entries({ XDG_CONFIG_HOME: cfg, CODEVIEWER_NO_UPDATE_CHECK: "1" })) {
+    savedEnv[k] = process.env[k];
+    process.env[k] = v;
+  }
+  try {
+    const m = await inProcess(["--machine", "--no-open", "--exit-with-parent", "--shell", "/bin/sh", dir]);
+    const j = JSON.parse(m.out);
+    expect(j.root).toBe(dir);
+    expect((await fetch(`${new URL(j.url).origin}/`)).status).toBe(200);
+    stopAll();
+    await Bun.sleep(50);
+    await expect(fetch(`${new URL(j.url).origin}/`)).rejects.toBeDefined();
+
+    const b = await inProcess(["--no-open", "--host", "0.0.0.0", dir]);
+    expect(b.out).toContain("Listening on 0.0.0.0");
+    expect(b.out).toContain("Press Ctrl+C to quit.");
+    expect(b.out).toContain(dir);
+    stopAll();
+  } finally {
+    stopAll();
+    for (const [k, v] of Object.entries(savedEnv)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+  }
+});
diff --git a/test/pty.coverage.test.ts b/test/pty.coverage.test.ts
new file mode 100644
index 0000000..4ffafda
--- /dev/null
+++ b/test/pty.coverage.test.ts
@@ -0,0 +1,196 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdtemp, rm, realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { PtyManager, type PtySocketData } from "../src/server/pty.ts";
+
+/** A minimal fake ServerWebSocket recording everything the session sends. */
+function fakeWs(id: string, cols = 80, rows = 24) {
+  const ws = {
+    data: { kind: "pty", id, cols, rows } as PtySocketData,
+    texts: [] as string[],
+    bins: [] as Uint8Array[],
+    closed: null as null | [number, string],
+    buffered: 0,
+    send(s: string) { this.texts.push(s); },
+    sendBinary(b: Uint8Array) { this.bins.push(b); },
+    close(code: number, reason: string) { this.closed = [code, reason]; },
+    getBufferedAmount() { return this.buffered; },
+    output() { return new TextDecoder().decode(Buffer.concat(this.bins)); },
+  };
+  return ws;
+}
+type FWs = ReturnType<typeof fakeWs>;
+const asWs = (w: FWs) => w as unknown as Parameters<PtyManager["open"]>[0];
+
+async function until(cond: () => boolean, ms = 10000) {
+  const t = Date.now();
+  while (!cond()) {
+    if (Date.now() - t > ms) throw new Error("timeout");
+    await Bun.sleep(20);
+  }
+}
+
+let cwd = "";
+let mgr: PtyManager | null = null;
+afterEach(async () => {
+  mgr?.killAll();
+  mgr = null;
+  if (cwd) await rm(cwd, { recursive: true, force: true });
+  cwd = "";
+});
+async function manager() {
+  cwd = await realpath(await mkdtemp(path.join(tmpdir(), "cv-ptyc-")));
+  mgr = new PtyManager({ shell: "/bin/sh", cwd, env: { PATH: process.env.PATH ?? "/usr/bin:/bin", TERM: "xterm-256color", PS1: "$ " } });
+  return mgr;
+}
+
+test("a session runs a shell in cwd, echoes input, and survives detach with replay on reattach", async () => {
+  const m = await manager();
+  const a = fakeWs("s1");
+  m.open(asWs(a));
+  m.message(asWs(a), Buffer.from("pwd; echo MARK$((20+22))\n"));
+  await until(() => a.output().includes("MARK42"));
+  expect(a.output()).toContain(cwd);
+
+  m.close(asWs(a)); // page reload: session keeps running
+  const b = fakeWs("s1");
+  m.open(asWs(b));
+  expect(b.texts).toContain(JSON.stringify({ t: "replay" }));
+  expect(b.output()).toContain("MARK42");
+  m.message(asWs(b), Buffer.from("echo AFTER$((1+1))\n"));
+  await until(() => b.output().includes("AFTER2"));
+});
+
+test("a second client replaces the first (closed with 4000)", async () => {
+  const m = await manager();
+  const a = fakeWs("s2");
+  const b = fakeWs("s2");
+  m.open(asWs(a));
+  m.open(asWs(b));
+  expect(a.closed).toEqual([4000, "replaced"]);
+  expect(b.closed).toBeNull();
+});
+
+test("resize control messages are clamped and applied; bad messages are ignored", async () => {
+  const m = await manager();
+  const a = fakeWs("s3");
+  m.open(asWs(a));
+  m.message(asWs(a), JSON.stringify({ t: "resize", cols: 5000, rows: 0.5 }));
+  expect(a.data.cols).toBe(1000);
+  expect(a.data.rows).toBe(1);
+  m.message(asWs(a), JSON.stringify({ t: "resize", cols: 1, rows: 9999 }));
+  expect(a.data.cols).toBe(2);
+  expect(a.data.rows).toBe(500);
+  m.message(asWs(a), JSON.stringify({ t: "resize", cols: 100, rows: 30 }));
+  m.message(asWs(a), "{not json");
+  m.message(asWs(a), JSON.stringify({ t: "resize" })); // missing dims: ignored
+  m.message(asWs(a), JSON.stringify({ t: "nonsense" }));
+  expect(a.data).toMatchObject({ cols: 100, rows: 30 });
+  m.message(asWs(a), Buffer.from("stty size\n"));
+  await until(() => a.output().includes("30 100"));
+});
+
+test("messages for unknown sessions are dropped", async () => {
+  const m = await manager();
+  const ghost = fakeWs("nobody");
+  expect(() => {
+    m.message(asWs(ghost), "hello");
+    m.message(asWs(ghost), Buffer.from("x"));
+    m.drain(asWs(ghost));
+    m.close(asWs(ghost));
+  }).not.toThrow();
+});
+
+test("shell exit sends the exit notice, closes the socket and forgets the session", async () => {
+  const m = await manager();
+  const a = fakeWs("s4");
+  m.open(asWs(a));
+  m.message(asWs(a), Buffer.from("echo BYE; exit 3\n"));
+  await until(() => a.closed !== null);
+  expect(a.closed).toEqual([1000, "exited"]);
+  expect(a.texts).toContain(JSON.stringify({ t: "exit", code: 3 }));
+  expect(a.output()).toContain("BYE");
+  // a new connection with the same id starts a fresh shell
+  const b = fakeWs("s4");
+  m.open(asWs(b));
+  m.message(asWs(b), Buffer.from("echo FRESH\n"));
+  await until(() => b.output().includes("FRESH"));
+  expect(b.texts.some((t) => t.includes('"exit"'))).toBe(false);
+});
+
+test("kill control message hangs the shell up", async () => {
+  const m = await manager();
+  const a = fakeWs("s5");
+  m.open(asWs(a));
+  m.message(asWs(a), Buffer.from("echo READY\n"));
+  await until(() => a.output().includes("READY"));
+  m.message(asWs(a), JSON.stringify({ t: "kill" }));
+  await until(() => a.closed !== null);
+  expect(a.texts.some((t) => t.includes('"exit"'))).toBe(true);
+  // input after exit is ignored, not thrown
+  expect(() => m.message(asWs(a), Buffer.from("x"))).not.toThrow();
+});
+
+test("private modes are restored ahead of the replay (alt screen, bracketed paste)", async () => {
+  const m = await manager();
+  const a = fakeWs("s6");
+  m.open(asWs(a));
+  m.message(asWs(a), Buffer.from("printf '\\033[?1049h\\033[?2004h\\033[?25lDONE1\\n'\n"));
+  await until(() => a.output().includes("DONE1"));
+  m.close(asWs(a));
+  const b = fakeWs("s6");
+  m.open(asWs(b));
+  // the replay stream begins with whichever modes were active at the start of the retained
+  // output; after leaving the alt screen the prefix must follow the toggles
+  m.message(asWs(b), Buffer.from("printf '\\033[?1049l\\033[?2004lDONE2\\n'\n"));
+  await until(() => b.output().includes("DONE2"));
+  m.close(asWs(b));
+  const c = fakeWs("s6");
+  m.open(asWs(c));
+  const out = c.output();
+  expect(out).toContain("DONE1");
+  expect(out).toContain("DONE2");
+});
+
+test("large output is coalesced into frames and bounded by the replay ring", async () => {
+  const m = await manager();
+  const a = fakeWs("s7");
+  m.open(asWs(a));
+  // ~2 MB of numbered lines
+  m.message(asWs(a), Buffer.from("i=0; while [ $i -lt 40000 ]; do echo \"line-$i-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\"; i=$((i+1)); done; echo ENDMARK$((7*6))\n"));
+  await until(() => a.output().includes("ENDMARK42"), 30000);
+  expect(a.bins.length).toBeGreaterThan(1);
+  m.close(asWs(a));
+  const b = fakeWs("s7");
+  m.open(asWs(b));
+  const total = b.bins.reduce((n, x) => n + x.length, 0);
+  expect(total).toBeLessThanOrEqual(512 * 1024 + 4096);
+  expect(total).toBeGreaterThan(256 * 1024);
+  const text = b.output();
+  expect(text).toContain("ENDMARK42");
+  expect(text.startsWith("line-0-")).toBe(false); // oldest output was trimmed
+  // trimmed replay starts on a line boundary
+  expect(/^(\x1b\[\?\d+h)*line-\d+-/.test(text)).toBe(true);
+});
+
+test("a lagging client stops receiving live data and is resynced once its socket drains", async () => {
+  const m = await manager();
+  const a = fakeWs("s8");
+  m.open(asWs(a));
+  a.buffered = 9 * 1024 * 1024; // above HIGH_WATER after the next flush
+  m.message(asWs(a), Buffer.from("echo FIRST\n"));
+  await until(() => a.output().includes("FIRST"));
+  const framesWhenLagging = a.bins.length;
+  m.message(asWs(a), Buffer.from("echo SECOND\n"));
+  await Bun.sleep(300);
+  expect(a.bins.length).toBe(framesWhenLagging); // live stream paused
+  m.drain(asWs(a)); // still above the low-water mark: nothing happens
+  expect(a.bins.length).toBe(framesWhenLagging);
+  a.buffered = 0;
+  m.drain(asWs(a));
+  expect(a.texts.filter((t) => t.includes("replay")).length).toBe(1); // resync (nothing to replay on the first attach)
+  expect(a.output()).toContain("SECOND");
+  m.drain(asWs(a)); // not lagging anymore: no-op
+  expect(a.texts.filter((t) => t.includes("replay")).length).toBe(1);
+});
diff --git a/test/servergit.coverage.test.ts b/test/servergit.coverage.test.ts
new file mode 100644
index 0000000..df0dbe1
--- /dev/null
+++ b/test/servergit.coverage.test.ts
@@ -0,0 +1,248 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { mkdtemp, mkdir, realpath, rm, writeFile, rename } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { Git, type GitStatus } from "../src/server/git.ts";
+
+let dir = "";
+let repo = "";
+const open: Git[] = [];
+
+const sh = (cmd: string[], cwd = repo) => {
+  const r = Bun.spawnSync(["git", ...cmd], { cwd, stderr: "pipe", env: { ...process.env, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null" } });
+  if (r.exitCode !== 0) throw new Error(`git ${cmd.join(" ")}: ${r.stderr}`);
+  return r.stdout.toString();
+};
+const commit = (msg: string) => sh(["-c", "user.name=Tester", "-c", "user.email=t@example.com", "commit", "-qm", msg]);
+async function until(cond: () => boolean, ms = 10000) {
+  const t = Date.now();
+  while (!cond()) {
+    if (Date.now() - t > ms) throw new Error("timeout");
+    await Bun.sleep(30);
+  }
+}
+async function git(root = repo) {
+  const g = (await Git.open(root))!;
+  open.push(g);
+  return g;
+}
+
+beforeAll(async () => {
+  dir = await realpath(await mkdtemp(path.join(tmpdir(), "cv-gitcov-")));
+  repo = path.join(dir, "repo");
+  await mkdir(repo);
+  sh(["init", "-q", "-b", "main"]);
+  sh(["config", "user.email", "t@example.com"]);
+  sh(["config", "user.name", "Tester"]);
+  await writeFile(path.join(repo, "a.txt"), "one\ntwo\nthree\n");
+  await mkdir(path.join(repo, "sub"));
+  await writeFile(path.join(repo, "sub", "s.txt"), "s\n");
+  await writeFile(path.join(repo, "old name.txt"), "rename me, I am long enough to be detected as a rename\nline2\nline3\n");
+  sh(["add", "."]);
+  commit("init");
+});
+afterAll(async () => {
+  for (const g of open) g.stop();
+  await rm(dir, { recursive: true, force: true });
+});
+
+test("open returns null outside a repository", async () => {
+  const plain = await mkdtemp(path.join(tmpdir(), "cv-nogit-"));
+  try {
+    // an ancestor that is itself a repo would make this non-null; the OS tmpdir is not one
+    expect(await Git.open(plain)).toBeNull();
+  } finally {
+    await rm(plain, { recursive: true, force: true });
+  }
+});
+
+test("status: clean tree, head info and branch", async () => {
+  const s = await (await git()).status();
+  expect(s).toMatchObject({ repo: true, branch: "main", detached: false, upstream: null, ahead: 0, behind: 0, state: null, stash: 0, files: {} });
+  expect(s.head).toMatchObject({ subject: "init", author: "Tester" });
+  expect(s.head!.hash).toMatch(/^[0-9a-f]{40,64}$/);
+  expect(s.oid).toBe(s.head!.hash);
+  expect(s.head!.time).toBeGreaterThan(1.6e12);
+});
+
+test("status: modified, staged, untracked, renamed (with spaces), ignored", async () => {
+  await writeFile(path.join(repo, "a.txt"), "one\nTWO\nthree\n");
+  await writeFile(path.join(repo, "new file.txt"), "x");
+  await writeFile(path.join(repo, ".gitignore"), "ignored.log\n");
+  await writeFile(path.join(repo, "ignored.log"), "x");
+  sh(["add", ".gitignore"]);
+  sh(["mv", "old name.txt", "renamed name.txt"]);
+  const s = await (await git()).status();
+  expect(s.files["a.txt"]).toBe(".M");
+  expect(s.files["new file.txt"]).toBe("??");
+  expect(s.files["ignored.log"]).toBe("!!");
+  expect(s.files[".gitignore"]).toBe("A.");
+  expect(s.files["renamed name.txt"]).toBe("R."); // type-2 record, original path skipped
+  expect(Object.keys(s.files).some((k) => k.includes("old name"))).toBe(false);
+  sh(["reset", "-q", "--hard"]);
+  sh(["clean", "-qfdx"]);
+});
+
+test("status from a subdirectory root is prefix-relative and excludes outside paths", async () => {
+  await writeFile(path.join(repo, "sub", "s.txt"), "changed\n");
+  await writeFile(path.join(repo, "a.txt"), "outside change\n");
+  const s = await (await git(path.join(repo, "sub"))).status();
+  expect(s.files).toEqual({ "s.txt": ".M" });
+  sh(["checkout", "--", "."]);
+});
+
+test("status: stash count, detached HEAD, upstream ahead/behind", async () => {
+  const g = await git();
+  await writeFile(path.join(repo, "a.txt"), "stash me\n");
+  sh(["stash", "-q"]);
+  expect((await g.status()).stash).toBe(1);
+
+  // a bare "remote" to get an upstream with ahead/behind
+  const remote = path.join(dir, "remote.git");
+  sh(["init", "-q", "--bare", "-b", "main", remote], dir);
+  sh(["remote", "add", "origin", remote]);
+  sh(["push", "-q", "-u", "origin", "main"]);
+  await writeFile(path.join(repo, "sub", "ahead.txt"), "1");
+  sh(["add", "."]);
+  commit("ahead 1");
+  let s = await g.status();
+  expect(s).toMatchObject({ upstream: "origin/main", ahead: 1, behind: 0 });
+  sh(["reset", "-q", "--hard", "HEAD~1"]);
+  sh(["branch", "-f", "behind-marker", "origin/main"]);
+  s = await g.status();
+  expect(s).toMatchObject({ ahead: 0, behind: 0 });
+
+  const head = sh(["rev-parse", "HEAD"]).trim();
+  sh(["checkout", "-q", "--detach", head]);
+  s = await g.status();
+  expect(s).toMatchObject({ detached: true, branch: null });
+  sh(["checkout", "-q", "main"]);
+});
+
+test("status reports in-progress operations (merge conflict -> UU, merging)", async () => {
+  const g = await git();
+  sh(["checkout", "-q", "-b", "other"]);
+  await writeFile(path.join(repo, "a.txt"), "other side\n");
+  sh(["commit", "-qam", "other", "--author=T <t@example.com>"]);
+  sh(["checkout", "-q", "main"]);
+  await writeFile(path.join(repo, "a.txt"), "main side\n");
+  sh(["commit", "-qam", "main"]);
+  Bun.spawnSync(["git", "merge", "other"], { cwd: repo, stdout: "ignore", stderr: "ignore" });
+  const s = await g.status();
+  expect(s.state).toBe("merging");
+  expect(s.files["a.txt"]).toBe("UU");
+  sh(["merge", "--abort"]);
+  expect((await g.status()).state).toBeNull();
+});
+
+test("status reports other operation states from marker files", async () => {
+  const g = await git();
+  const gd = path.join(repo, ".git");
+  for (const [file, state] of [["CHERRY_PICK_HEAD", "cherry-picking"], ["REVERT_HEAD", "reverting"], ["BISECT_LOG", "bisecting"]] as const) {
+    await writeFile(path.join(gd, file), "x");
+    expect((await g.status()).state).toBe(state);
+    await rm(path.join(gd, file));
+  }
+  await mkdir(path.join(gd, "rebase-merge"));
+  expect((await g.status()).state).toBe("rebasing");
+  await rm(path.join(gd, "rebase-merge"), { recursive: true });
+  expect((await g.status()).state).toBeNull();
+});
+
+test("concurrent status calls share a run and a re-run is flagged", async () => {
+  const g = await git();
+  const [a, b] = await Promise.all([g.status(), g.status()]);
+  expect(b).toBe(a);
+});
+
+test("base() returns HEAD content or null", async () => {
+  const g = await git();
+  await writeFile(path.join(repo, "a.txt"), "dirty\n");
+  expect(new TextDecoder().decode((await g.base("a.txt", 1 << 20))!)).toBe("main side\n"); // HEAD content, not the dirty worktree
+  expect(await g.base("does-not-exist.txt", 1 << 20)).toBeNull();
+  expect(await g.base("a.txt", 3)).toBeNull(); // truncated => treated as unavailable
+  const sub = await git(path.join(repo, "sub"));
+  expect(new TextDecoder().decode((await sub.base("s.txt", 1 << 20))!)).toBe("s\n");
+  sh(["checkout", "--", "."]);
+});
+
+test("blame: committed line, uncommitted line, and failures", async () => {
+  const g = await git();
+  const b = (await g.blame("sub/s.txt", 1))!;
+  expect(b).toMatchObject({ author: "Tester", mail: "t@example.com", summary: "init", uncommitted: false, you: true });
+  expect(b.time).toBeGreaterThan(1.6e12);
+  await writeFile(path.join(repo, "sub", "s.txt"), "s\nnew line\n");
+  const u = (await g.blame("sub/s.txt", 2))!;
+  expect(u).toMatchObject({ uncommitted: true, you: true });
+  expect(await g.blame("nope.txt", 1)).toBeNull();
+  expect(await g.blame("sub/s.txt", 99)).toBeNull();
+  sh(["checkout", "--", "."]);
+});
+
+test("blame: someone else's commit is not 'you'", async () => {
+  const g = await git();
+  await writeFile(path.join(repo, "theirs.txt"), "x\n");
+  sh(["add", "theirs.txt"]);
+  sh(["-c", "user.name=Other", "-c", "user.email=other@example.com", "commit", "-qm", "theirs"]);
+  const b = (await g.blame("theirs.txt", 1))!;
+  expect(b).toMatchObject({ author: "Other", mail: "other@example.com", you: false, uncommitted: false });
+});
+
+test("watch/poke: reports status changes once, debounced, and stops", async () => {
+  const g = await git();
+  const seen: GitStatus[] = [];
+  g.watch((s) => seen.push(s));
+  g.poke(); // baseline
+  await until(() => seen.length >= 1);
+  const n = seen.length;
+  g.poke();
+  g.poke();
+  await Bun.sleep(700);
+  expect(seen.length).toBe(n); // identical status: no new notification
+
+  await writeFile(path.join(repo, "watched.txt"), "x");
+  g.poke();
+  await until(() => seen.some((s) => s.files["watched.txt"] === "??"));
+  await rm(path.join(repo, "watched.txt"));
+});
+
+test("watch: .git changes (index/HEAD) trigger a refresh, lock files and config handled", async () => {
+  const g = await git();
+  const seen: GitStatus[] = [];
+  g.watch((s) => seen.push(s));
+  await Bun.sleep(150);
+  await writeFile(path.join(repo, "viaindex.txt"), "x");
+  sh(["add", "viaindex.txt"]); // writes .git/index (and index.lock, which is ignored)
+  await until(() => seen.some((s) => s.files["viaindex.txt"] === "A."));
+  const before = seen.length;
+  sh(["config", "core.abbrev", "9"]); // config change resets the cached overrides and re-polls
+  await Bun.sleep(900);
+  expect(seen.length).toBeGreaterThanOrEqual(before);
+  sh(["reset", "-q", "--hard"]);
+  sh(["clean", "-qfd"]);
+});
+
+test("filter/diff/merge drivers from config are neutralized without breaking status", async () => {
+  sh(["config", "filter.x.clean", "false"]);
+  sh(["config", "diff.y.textconv", "false"]);
+  sh(["config", "merge.z.driver", "false"]);
+  const s = await (await git()).status();
+  expect(s.repo).toBe(true);
+  sh(["config", "--remove-section", "filter.x"]);
+  sh(["config", "--remove-section", "diff.y"]);
+  sh(["config", "--remove-section", "merge.z"]);
+});
+
+test("a corrupt repo yields a status with no file entries rather than throwing", async () => {
+  const g = await git();
+  const gd = path.join(repo, ".git");
+  await rename(path.join(gd, "HEAD"), path.join(gd, "HEAD.bak"));
+  try {
+    const s = await g.status();
+    expect(s.repo).toBe(true);
+    expect(s.files).toEqual({});
+    expect(s.head).toBeNull();
+  } finally {
+    await rename(path.join(gd, "HEAD.bak"), path.join(gd, "HEAD"));
+  }
+});
diff --git a/test/settings.coverage.test.ts b/test/settings.coverage.test.ts
new file mode 100644
index 0000000..1059d0b
--- /dev/null
+++ b/test/settings.coverage.test.ts
@@ -0,0 +1,73 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtemp, readdir, readFile, rm, stat, writeFile, mkdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { configDir, Settings } from "../src/server/settings.ts";
+
+let tmp = "";
+let saved: string | undefined;
+beforeEach(async () => {
+  tmp = await mkdtemp(path.join(tmpdir(), "cv-settings-"));
+  saved = process.env.XDG_CONFIG_HOME;
+  process.env.XDG_CONFIG_HOME = tmp;
+});
+afterEach(async () => {
+  if (saved === undefined) delete process.env.XDG_CONFIG_HOME;
+  else process.env.XDG_CONFIG_HOME = saved;
+  await rm(tmp, { recursive: true, force: true });
+});
+
+test("configDir honours XDG_CONFIG_HOME and otherwise falls back per platform", () => {
+  expect(configDir()).toBe(path.join(tmp, "codeviewer"));
+  delete process.env.XDG_CONFIG_HOME;
+  const d = configDir();
+  expect(d.endsWith(path.join("codeviewer"))).toBe(true);
+  if (process.platform === "darwin") expect(d).toContain(path.join("Library", "Application Support"));
+  else expect(d).toContain(path.join(".config", "codeviewer"));
+});
+
+test("read returns {} for missing, corrupt, array and scalar files", async () => {
+  const s = new Settings();
+  expect(await s.read()).toEqual({});
+  const dir = configDir();
+  await mkdir(dir, { recursive: true });
+  const f = path.join(dir, "settings.json");
+  for (const bad of ["{nope", "[1,2]", "42", "null"]) {
+    await writeFile(f, bad);
+    expect(await s.read()).toEqual({});
+  }
+});
+
+test("write persists atomically with private permissions and round-trips", async () => {
+  const s = new Settings();
+  await s.write({ theme: "dark", n: 1 });
+  expect(await s.read()).toEqual({ theme: "dark", n: 1 });
+  const dir = configDir();
+  expect(await readdir(dir)).toEqual(["settings.json"]); // no tmp leftovers
+  if (process.platform !== "win32") {
+    expect((await stat(path.join(dir, "settings.json"))).mode & 0o777).toBe(0o600);
+    expect((await stat(dir)).mode & 0o777).toBe(0o700);
+  }
+  expect(JSON.parse(await readFile(path.join(dir, "settings.json"), "utf8")).theme).toBe("dark");
+});
+
+test("write rejects non-objects", async () => {
+  const s = new Settings();
+  for (const bad of [null, undefined, 1, "x", [1]]) await expect(s.write(bad)).rejects.toThrow("object expected");
+});
+
+test("concurrent writes are serialized: the last one wins and the file is never torn", async () => {
+  const s = new Settings();
+  await Promise.all(Array.from({ length: 20 }, (_, i) => s.write({ i })));
+  expect(await s.read()).toEqual({ i: 19 });
+});
+
+test("a failed write does not poison later writes", async () => {
+  const s = new Settings();
+  // Make the config dir path a file so mkdir fails.
+  await writeFile(path.join(tmp, "codeviewer"), "block");
+  await expect(s.write({ a: 1 })).rejects.toBeTruthy();
+  await rm(path.join(tmp, "codeviewer"));
+  await s.write({ a: 2 });
+  expect(await s.read()).toEqual({ a: 2 });
+});
diff --git a/test/terminal.coverage.test.ts b/test/terminal.coverage.test.ts
new file mode 100644
index 0000000..4d7e024
--- /dev/null
+++ b/test/terminal.coverage.test.ts
@@ -0,0 +1,937 @@
+import { describe, expect, test } from "bun:test";
+import { Terminal, Line, BOLD, DIM, ITALIC, UNDERLINE, BLINK, INVERSE, HIDDEN, STRIKE, WIDE, RGB_FLAG, DEFAULT, MAX_SCROLLBACK } from "../src/client/term/terminal.ts";
+
+const ESC = "\x1b";
+
+function mk(cols = 20, rows = 5, extra: Record<string, unknown> = {}) {
+  const replies: string[] = [];
+  const events: Record<string, unknown[]> = { title: [], bell: [], clip: [], cwd: [] };
+  const t = new Terminal(cols, rows, {
+    reply: (d) => replies.push(d),
+    title: (s) => events.title!.push(s),
+    bell: () => events.bell!.push(1),
+    clipboard: (s) => events.clip!.push(s),
+    cwd: (s) => events.cwd!.push(s),
+    colors: () => ({ fg: "#c0c0c0", bg: "#101112", cursor: "#ffffff", palette: ["#000000", "#ff0000"] }),
+    ...extra,
+  });
+  return { t, replies, events, row: (y: number) => t.lines[y]!.toString() };
+}
+
+describe("Line", () => {
+  test("resize wider and narrower, narrowing through a wide char blanks it", () => {
+    const l = new Line(4);
+    l.text[2] = "W";
+    l.fl[2] = WIDE;
+    l.text[3] = "";
+    l.resize(6);
+    expect(l.cols).toBe(6);
+    expect(l.fg.length).toBe(6);
+    expect(l.fg[5]).toBe(DEFAULT);
+    l.resize(3);
+    expect(l.cols).toBe(3);
+    expect(l.text[2]).toBe(" ");
+    expect(l.fl[2]).toBe(0);
+    l.resize(3); // no-op
+    expect(l.cols).toBe(3);
+  });
+
+  test("clear expands to cover both halves of a wide character", () => {
+    const l = new Line(6);
+    l.text[1] = "漢";
+    l.fl[1] = WIDE;
+    l.text[2] = "";
+    l.clear(2, 3, DEFAULT); // starts on the continuation cell
+    expect(l.text[1]).toBe(" ");
+    expect(l.fl[1]).toBe(0);
+    const m = new Line(6);
+    m.text[1] = "漢";
+    m.fl[1] = WIDE;
+    m.text[2] = "";
+    m.clear(0, 2, DEFAULT); // ends on the wide lead
+    expect(m.text[2]).toBe(" ");
+  });
+
+  test("clear with a background raises the high-water mark; compactCopy keeps the prefix", () => {
+    const l = new Line(8);
+    expect(l.usedWidth()).toBe(0);
+    l.clear(0, 5, 4);
+    expect(l.usedWidth()).toBe(5);
+    expect(l.bg[3]).toBe(4);
+    l.text[0] = "a";
+    const c = l.compactCopy(3);
+    expect(c.cols).toBe(3);
+    expect(c.toString()).toBe("a");
+    l.recycle(5, DEFAULT);
+    expect(l.usedWidth()).toBe(0);
+    expect(l.bg[3]).toBe(DEFAULT);
+    l.recycle(1, 2);
+    expect(l.usedWidth()).toBe(8);
+    expect(l.bg[7]).toBe(2);
+    expect(new Line(3, 1).usedWidth()).toBe(3);
+  });
+});
+
+describe("controls and C1", () => {
+  test("bell, backspace, tabs", () => {
+    const { t, events } = mk();
+    t.write("\x07ab\bc");
+    expect(events.bell!.length).toBe(1);
+    expect(t.lines[0]!.toString()).toBe("ac");
+    t.write("\r\t");
+    expect(t.cur.x).toBe(8);
+    t.write("\t\t\t");
+    expect(t.cur.x).toBe(19);
+  });
+
+  test("backspace drops pending wrap and moves left", () => {
+    const { t } = mk(5, 2);
+    t.write("abcde\b");
+    expect(t.cur.x).toBe(3);
+    expect(t.cur.wrapPending).toBe(false);
+  });
+
+  test("LF/VT/FF and newline mode", () => {
+    const { t } = mk();
+    t.write("ab\x0bc\x0cd");
+    expect([t.cur.x, t.cur.y]).toEqual([4, 2]);
+    t.write(`${ESC}[20h\nx`);
+    expect([t.cur.x, t.cur.y]).toEqual([1, 3]);
+    t.write(`${ESC}[20l\ny`);
+    expect([t.cur.x, t.cur.y]).toEqual([2, 4]);
+  });
+
+  test("shift out/in with DEC graphics designated in G1", () => {
+    const { t, row } = mk();
+    t.write(`${ESC})0\x0elqk\x0fq`);
+    expect(row(0)).toBe("┌─┐q");
+    t.write(`\r${ESC}(0lqk${ESC}(Bq`);
+    expect(row(0)).toBe("┌─┐q");
+  });
+
+  test("C1 controls: IND, NEL, HTS, RI, CSI, OSC", () => {
+    const { t, events, row } = mk(20, 3);
+    t.write("ab\u0084c"); // IND
+    expect([t.cur.x, t.cur.y]).toEqual([3, 1]);
+    t.write("\u0085d"); // NEL
+    expect([t.cur.x, t.cur.y]).toEqual([1, 2]);
+    t.write("\u008d\u008d"); // RI x2
+    expect(t.cur.y).toBe(0);
+    t.write("\r\u0088\u009b1C\u009b2D\u009d2;T\u009c"); // HTS at 0, CSI, OSC with ST
+    expect(events.title).toEqual(["T"]);
+    expect(row(0).startsWith("ab")).toBe(true);
+    t.write("\u0090junk\u009cx\u0098s\u009c\u009eP\u009c\u009f\u009c");
+    expect(row(0).includes("x")).toBe(true);
+  });
+
+  test("DEL and stray C1 in ground are ignored; CAN/SUB abort sequences", () => {
+    const { t, row } = mk();
+    t.write("a\x7fb\u0081c");
+    expect(row(0)).toBe("abc");
+    t.write(`\r\n${ESC}[31\x18x`); // CAN cancels CSI
+    expect(t.lines[1]!.toString()).toBe("x");
+    t.write(`\r\n${ESC}]0;abc\x1ay`); // SUB cancels OSC
+    expect(t.lines[2]!.toString()).toBe("y");
+    expect(t.title).toBe("");
+  });
+});
+
+describe("escape sequences", () => {
+  test("save/restore cursor via ESC 7/8 and CSI s/u keeps attributes", () => {
+    const { t } = mk();
+    t.write(`${ESC}[1;31m${ESC}[3;5H${ESC}7${ESC}[0m${ESC}[H${ESC}8`);
+    expect([t.cur.x, t.cur.y]).toEqual([4, 2]);
+    expect(t.cur.fg).toBe(1);
+    expect(t.cur.fl & BOLD).toBe(BOLD);
+    t.write(`${ESC}[2;2H${ESC}[s${ESC}[H${ESC}[u`);
+    expect([t.cur.x, t.cur.y]).toEqual([1, 1]);
+  });
+
+  test("restore without save homes the cursor", () => {
+    const { t } = mk();
+    t.write(`abc${ESC}8`);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 0]);
+  });
+
+  test("DECALN fills the screen with E", () => {
+    const { t, row } = mk(4, 2);
+    t.write(`${ESC}#8`);
+    expect(row(0)).toBe("EEEE");
+    expect(row(1)).toBe("EEEE");
+    t.write(`${ESC}#3`); // other # sequences ignored
+    expect(row(0)).toBe("EEEE");
+  });
+
+  test("unknown intermediate escapes are ignored, keypad modes", () => {
+    const { t } = mk();
+    t.write(`${ESC} Fx${ESC}=`);
+    expect(t.modes.appKeypad).toBe(true);
+    t.write(`${ESC}>`);
+    expect(t.modes.appKeypad).toBe(false);
+    expect(t.lines[0]!.toString()).toBe("x");
+  });
+
+  test("ESC c full reset", () => {
+    const { t } = mk();
+    t.write(`abc${ESC}[?1h${ESC}[2;3r${ESC}[1m${ESC}[?1049hx${ESC}c`);
+    expect(t.alt).toBe(false);
+    expect(t.modes.appCursor).toBe(false);
+    expect([t.top, t.bottom]).toEqual([0, 4]);
+    expect(t.cur.fl).toBe(0);
+    expect(t.lines[0]!.toString()).toBe("");
+  });
+
+  test("ESC inside OSC/DCS starts a new sequence unless ST", () => {
+    const { t, events } = mk();
+    t.write(`${ESC}]0;abc${ESC}\\`);
+    expect(events.title).toEqual(["abc"]);
+    t.write(`${ESC}]0;lost${ESC}[1mA`); // abandoned OSC, ESC [ starts CSI
+    expect(events.title).toEqual(["abc"]);
+    expect(t.cur.fl & BOLD).toBe(BOLD);
+    expect(t.lines[0]!.toString()).toBe("A");
+    t.write(`\r${ESC}[0m${ESC}Pdata${ESC}\\B`); // DCS terminated by ST
+    expect(t.lines[0]!.toString()).toBe("B");
+    t.write(`${ESC}_apc\x07C`); // APC terminated by BEL
+    expect(t.lines[0]!.toString()).toBe("BC");
+    t.write(`${ESC}^pm${ESC}[1mD`); // PM interrupted by ESC [
+    expect(t.lines[0]!.toString()).toBe("BCD");
+    t.write(`${ESC}Xsos\x18E`);
+    expect(t.lines[0]!.toString()).toBe("BCDE");
+  });
+});
+
+describe("cursor movement and edits", () => {
+  test("CUU/CUD respect scroll region margins", () => {
+    const { t } = mk(10, 8);
+    t.write(`${ESC}[3;6r`);
+    t.write(`${ESC}[4;1H${ESC}[9A`);
+    expect(t.cur.y).toBe(2);
+    t.write(`${ESC}[9B`);
+    expect(t.cur.y).toBe(5);
+    t.write(`${ESC}[8;1H${ESC}[2A`); // from below the region, CUU stops at the region top at most
+    expect(t.cur.y).toBe(5);
+    t.write(`${ESC}[8;1H${ESC}[2B`); // below the region: free down to the last row
+    expect(t.cur.y).toBe(7);
+  });
+
+  test("CNL, CPL, CHA, HPA, HPR, CUF/CUB clamp", () => {
+    const { t } = mk(10, 6);
+    t.write(`${ESC}[3;5H${ESC}[2E`);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 4]);
+    t.write(`${ESC}[3F`);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 1]);
+    t.write(`${ESC}[7G`);
+    expect(t.cur.x).toBe(6);
+    t.write(`${ESC}[99\``);
+    expect(t.cur.x).toBe(9);
+    t.write(`${ESC}[99D`);
+    expect(t.cur.x).toBe(0);
+    t.write(`${ESC}[3a`);
+    expect(t.cur.x).toBe(3);
+    t.write(`${ESC}[99C`);
+    expect(t.cur.x).toBe(9);
+  });
+
+  test("VPA and VPR", () => {
+    const { t } = mk(10, 6);
+    t.write(`${ESC}[2;4H${ESC}[5d`);
+    expect([t.cur.x, t.cur.y]).toEqual([3, 4]);
+    t.write(`${ESC}[1e`);
+    expect(t.cur.y).toBe(5);
+    t.write(`${ESC}[99d`);
+    expect(t.cur.y).toBe(5);
+  });
+
+  test("CHT / CBT tab stops, HTS, TBC", () => {
+    const { t } = mk(30, 2);
+    t.write(`${ESC}[2I`);
+    expect(t.cur.x).toBe(16);
+    t.write(`${ESC}[Z`);
+    expect(t.cur.x).toBe(8);
+    t.write(`${ESC}[99Z`);
+    expect(t.cur.x).toBe(0);
+    t.write(`${ESC}[1;4H${ESC}H${ESC}[1;1H\t`);
+    expect(t.cur.x).toBe(3);
+    t.write(`${ESC}[g\t`); // clear stop at current column 3
+    t.write(`${ESC}[1;1H\t`);
+    expect(t.cur.x).toBe(8);
+    t.write(`${ESC}[3g${ESC}[1;1H\t`);
+    expect(t.cur.x).toBe(29);
+  });
+
+  test("ICH, DCH, ECH", () => {
+    const { t, row } = mk(10, 2);
+    t.write(`abcdef${ESC}[1;3H${ESC}[2@`);
+    expect(row(0)).toBe("ab  cdef");
+    t.write(`${ESC}[3P`);
+    expect(row(0)).toBe("abdef");
+    t.write(`${ESC}[1;2H${ESC}[2X`);
+    expect(row(0)).toBe("a  ef");
+    t.write(`${ESC}[99X`);
+    expect(row(0)).toBe("a");
+  });
+
+  test("IL / DL inside and outside the scroll region", () => {
+    const { t, row } = mk(5, 5);
+    t.write("1\r\n2\r\n3\r\n4\r\n5");
+    t.write(`${ESC}[2;4r${ESC}[2;1H${ESC}[L`);
+    expect([row(0), row(1), row(2), row(3), row(4)]).toEqual(["1", "", "2", "3", "5"]);
+    t.write(`${ESC}[2M`);
+    expect([row(0), row(1), row(2), row(3), row(4)]).toEqual(["1", "3", "", "", "5"]);
+    t.write(`${ESC}[1;1H${ESC}[L${ESC}[M`); // outside region: ignored
+    expect(row(0)).toBe("1");
+  });
+
+  test("SU / SD scroll, SD ignores the xterm mouse-tracking form", () => {
+    const { t, row } = mk(5, 3);
+    t.write("a\r\nb\r\nc");
+    t.write(`${ESC}[S`);
+    expect([row(0), row(1), row(2)]).toEqual(["b", "c", ""]);
+    expect(t.scrollback.length).toBe(1);
+    t.write(`${ESC}[T`);
+    expect([row(0), row(1), row(2)]).toEqual(["", "b", "c"]);
+    t.write(`${ESC}[1;2;3;4;5T`);
+    expect(row(0)).toBe("");
+  });
+
+  test("alt screen scrolling does not feed scrollback; region scroll neither", () => {
+    const { t } = mk(5, 3);
+    t.write(`${ESC}[2;3r${ESC}[3;1H\n\n`);
+    expect(t.scrollback.length).toBe(0);
+    t.write(`${ESC}[?1049h\n\n\n\n`);
+    expect(t.scrollback.length).toBe(0);
+  });
+
+  test("REP repeats the last char; no-op without one", () => {
+    const { t, row } = mk();
+    t.write(`${ESC}[3b`);
+    expect(row(0)).toBe("");
+    t.write(`x${ESC}[3b`);
+    expect(row(0)).toBe("xxxx");
+  });
+
+  test("insert mode shifts text", () => {
+    const { t, row } = mk();
+    t.write(`abc${ESC}[1;1H${ESC}[4hXY`);
+    expect(row(0)).toBe("XYabc");
+    t.write(`${ESC}[4l${ESC}[1;1HZ`);
+    expect(row(0)).toBe("ZYabc");
+  });
+
+  test("scroll region validation", () => {
+    const { t } = mk(10, 6);
+    t.write(`${ESC}[3;99r`);
+    expect([t.top, t.bottom]).toEqual([2, 5]);
+    t.write(`${ESC}[4;2r`); // invalid: ignored
+    expect([t.top, t.bottom]).toEqual([2, 5]);
+    t.write(`${ESC}[r`);
+    expect([t.top, t.bottom]).toEqual([0, 5]);
+  });
+
+  test("origin mode confines the cursor and positions relative to the region", () => {
+    const { t, replies } = mk(10, 8);
+    t.write(`${ESC}[3;6r${ESC}[?6h`);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 2]);
+    t.write(`${ESC}[2;3H`);
+    expect([t.cur.x, t.cur.y]).toEqual([2, 3]);
+    t.write(`${ESC}[99;1H`);
+    expect(t.cur.y).toBe(5);
+    t.write(`${ESC}[6n`);
+    expect(replies.at(-1)).toBe(`${ESC}[4;1R`);
+    t.write(`${ESC}[?6n`);
+    expect(replies.at(-1)).toBe(`${ESC}[?4;1R`);
+    t.write(`${ESC}[1e`);
+    expect(t.cur.y).toBe(5);
+    t.write(`${ESC}[?6l`);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 0]);
+  });
+});
+
+describe("erase", () => {
+  function filled() {
+    const m = mk(5, 3);
+    m.t.write("aaaaa\r\nbbbbb\r\nccccc");
+    return m;
+  }
+
+  test("ED 0/1/2/3", () => {
+    let m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[J`);
+    expect([m.row(0), m.row(1), m.row(2)]).toEqual(["aaaaa", "bb", ""]);
+    m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[1J`);
+    expect([m.row(0), m.row(1), m.row(2)]).toEqual(["", "   bb", "ccccc"]);
+    m = filled();
+    m.t.write(`${ESC}[2J`);
+    expect([m.row(0), m.row(1), m.row(2)]).toEqual(["", "", ""]);
+    m = mk(5, 2);
+    m.t.write("1\r\n2\r\n3");
+    expect(m.t.scrollback.length).toBe(1);
+    m.t.write(`${ESC}[3J`);
+    expect(m.t.scrollback.length).toBe(0);
+    expect(m.t.trimmed).toBe(1);
+  });
+
+  test("EL 0/1/2, including DEC selective ?J ?K forms", () => {
+    let m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[K`);
+    expect(m.row(1)).toBe("bb");
+    m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[1K`);
+    expect(m.row(1)).toBe("   bb");
+    m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[2K`);
+    expect(m.row(1)).toBe("");
+    m = filled();
+    m.t.write(`${ESC}[2;3H${ESC}[?K`);
+    expect(m.row(1)).toBe("bb");
+    m.t.write(`${ESC}[?2J`);
+    expect(m.row(0)).toBe("");
+  });
+
+  test("erase uses the current background (BCE)", () => {
+    const { t } = mk(4, 2);
+    t.write(`${ESC}[44m${ESC}[2J${ESC}[1;1H${ESC}[K`);
+    expect(t.lines[0]!.bg[0]).toBe(4);
+    expect(t.lines[1]!.bg[3]).toBe(4);
+    t.write(`${ESC}[41m${ESC}[S`);
+    expect(t.lines[1]!.bg[0]).toBe(1);
+  });
+
+  test("erasing clears pending wrap", () => {
+    const { t } = mk(3, 2);
+    t.write(`abc${ESC}[K`);
+    expect(t.cur.wrapPending).toBe(false);
+  });
+});
+
+describe("modes", () => {
+  test("private modes toggle state", () => {
+    const { t } = mk();
+    const on = (n: number) => t.write(`${ESC}[?${n}h`);
+    const off = (n: number) => t.write(`${ESC}[?${n}l`);
+    on(1); expect(t.modes.appCursor).toBe(true); off(1); expect(t.modes.appCursor).toBe(false);
+    on(5); expect(t.modes.reverseVideo).toBe(true); off(5); expect(t.modes.reverseVideo).toBe(false);
+    off(7); expect(t.modes.autowrap).toBe(false); on(7); expect(t.modes.autowrap).toBe(true);
+    off(12); expect(t.modes.cursorBlink).toBe(false); on(12); expect(t.modes.cursorBlink).toBe(true);
+    off(25); expect(t.modes.cursorVisible).toBe(false); on(25); expect(t.modes.cursorVisible).toBe(true);
+    on(66); expect(t.modes.appKeypad).toBe(true); off(66);
+    on(9); expect(t.modes.mouse).toBe(1000);
+    on(1002); expect(t.modes.mouse).toBe(1002);
+    on(1003); expect(t.modes.mouse).toBe(1003);
+    off(1003); expect(t.modes.mouse).toBe(0);
+    on(1004); expect(t.modes.focusEvents).toBe(true);
+    on(1006); expect(t.modes.mouseSgr).toBe(true);
+    off(1007); expect(t.modes.altScroll).toBe(false);
+    on(2004); expect(t.modes.bracketedPaste).toBe(true);
+    on(2026); expect(t.modes.synchronized).toBe(true);
+    t.allDirty = false;
+    off(2026); expect(t.modes.synchronized).toBe(false);
+    expect(t.allDirty).toBe(true);
+    t.write(`${ESC}[?1;7;25l`);
+    expect(t.modes.appCursor).toBe(false);
+    expect(t.modes.autowrap).toBe(false);
+    expect(t.modes.cursorVisible).toBe(false);
+  });
+
+  test("no-wrap mode overwrites the last column", () => {
+    const { t, row } = mk(4, 2);
+    t.write(`${ESC}[?7labcdef`);
+    expect(row(0)).toBe("abcf");
+    expect(t.cur.x).toBe(3);
+    expect(t.cur.wrapPending).toBe(false);
+    t.write(`\r\n界界界`);
+    expect(row(1).length).toBeGreaterThan(0);
+  });
+
+  test("DECSCUSR cursor styles", () => {
+    const { t } = mk();
+    const q = (n: number) => t.write(`${ESC}[${n} q`);
+    q(0); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["block", true]);
+    q(2); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["block", false]);
+    q(3); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["underline", true]);
+    q(4); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["underline", false]);
+    q(5); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["bar", true]);
+    q(6); expect([t.modes.cursorShape, t.modes.cursorBlink]).toEqual(["bar", false]);
+  });
+
+  test("DECSTR soft reset keeps mouse/paste/etc. but resets the rest", () => {
+    const { t } = mk();
+    t.write(`${ESC}[?1000h${ESC}[?2004h${ESC}[?1h${ESC}[?7l${ESC}[1;31m${ESC}[2;3r${ESC}[?6h${ESC}[!p`);
+    expect(t.modes.mouse).toBe(1000);
+    expect(t.modes.bracketedPaste).toBe(true);
+    expect(t.modes.appCursor).toBe(false);
+    expect(t.modes.autowrap).toBe(true);
+    expect(t.cur.fl).toBe(0);
+    expect(t.cur.fg).toBe(DEFAULT);
+    expect(t.cur.originMode).toBe(false);
+    expect([t.top, t.bottom]).toEqual([0, 4]);
+  });
+
+  test("alternate screen 47 / 1047 / 1048 / 1049", () => {
+    const { t, row } = mk(10, 3);
+    t.write("prim");
+    t.write(`${ESC}[?1049h`);
+    expect(t.alt).toBe(true);
+    expect(row(0)).toBe("");
+    t.write("alt");
+    t.write(`${ESC}[?1049h`); // idempotent
+    t.write(`${ESC}[?1049l`);
+    expect(t.alt).toBe(false);
+    expect(row(0)).toBe("prim");
+    expect(t.cur.x).toBe(4);
+    t.write(`${ESC}[?1049l`); // already primary
+    t.write(`${ESC}[?47h`);
+    t.write("zzz");
+    t.write(`${ESC}[?47l`);
+    t.write(`${ESC}[?47h`);
+    expect(t.alt).toBe(true);
+  });
+
+  test("1047 clears the alt buffer on entry; 1048 saves and restores the cursor", () => {
+    const { t, row } = mk(10, 3);
+    t.write(`${ESC}[?1047hx${ESC}[?1047l`);
+    t.write(`${ESC}[?1047h`);
+    expect(row(0)).toBe("");
+    t.write(`${ESC}[?1047l${ESC}[2;3H${ESC}[?1048h${ESC}[H${ESC}[?1048l`);
+    expect([t.cur.x, t.cur.y]).toEqual([2, 1]);
+  });
+});
+
+describe("queries and reports", () => {
+  test("DA1, DA2, XTVERSION, DSR 5/6, window ops", () => {
+    const { t, replies } = mk(10, 4);
+    t.write(`${ESC}[c`);
+    expect(replies.at(-1)).toBe(`${ESC}[?62;22c`);
+    t.write(`${ESC}[1c`);
+    expect(replies.length).toBe(1);
+    t.write(`${ESC}[>c`);
+    expect(replies.at(-1)).toBe(`${ESC}[>0;10;1c`);
+    t.write(`${ESC}[>q`);
+    expect(replies.at(-1)).toBe(`${ESC}P>|codeviewer 1.0${ESC}\\`);
+    t.write(`${ESC}[5n`);
+    expect(replies.at(-1)).toBe(`${ESC}[0n`);
+    t.write(`${ESC}[2;5H${ESC}[6n`);
+    expect(replies.at(-1)).toBe(`${ESC}[2;5R`);
+    t.write(`${ESC}[18t`);
+    expect(replies.at(-1)).toBe(`${ESC}[8;4;10t`);
+    const n = replies.length;
+    t.write(`${ESC}[14t${ESC}[16t`);
+    expect(replies.length).toBe(n); // no pixel size known
+    t.cellPx = { w: 8, h: 16 };
+    t.write(`${ESC}[14t`);
+    expect(replies.at(-1)).toBe(`${ESC}[4;64;80t`);
+    t.write(`${ESC}[16t`);
+    expect(replies.at(-1)).toBe(`${ESC}[6;16;8t`);
+    t.write(`${ESC}[=c${ESC}[<c${ESC}[?u`); // unknown prefixes: silent
+    expect(replies.length).toBe(n + 2);
+  });
+
+  test("DECRQM for ANSI and private modes", () => {
+    const { t, replies } = mk();
+    t.write(`${ESC}[4$p`);
+    expect(replies.at(-1)).toBe(`${ESC}[4;2$y`);
+    t.write(`${ESC}[4h${ESC}[4$p`);
+    expect(replies.at(-1)).toBe(`${ESC}[4;1$y`);
+    t.write(`${ESC}[99$p`);
+    expect(replies.at(-1)).toBe(`${ESC}[99;0$y`);
+    const q = (m: number) => {
+      t.write(`${ESC}[?${m}$p`);
+      return replies.at(-1);
+    };
+    expect(q(1)).toBe(`${ESC}[?1;2$y`);
+    t.write(`${ESC}[?1h`);
+    expect(q(1)).toBe(`${ESC}[?1;1$y`);
+    expect(q(6)).toBe(`${ESC}[?6;2$y`);
+    expect(q(7)).toBe(`${ESC}[?7;1$y`);
+    expect(q(12)).toBe(`${ESC}[?12;1$y`);
+    expect(q(25)).toBe(`${ESC}[?25;1$y`);
+    t.write(`${ESC}[?1002h`);
+    expect(q(1002)).toBe(`${ESC}[?1002;1$y`);
+    expect(q(1000)).toBe(`${ESC}[?1000;2$y`);
+    expect(q(1003)).toBe(`${ESC}[?1003;2$y`);
+    expect(q(1004)).toBe(`${ESC}[?1004;2$y`);
+    expect(q(1006)).toBe(`${ESC}[?1006;2$y`);
+    expect(q(1007)).toBe(`${ESC}[?1007;1$y`);
+    expect(q(1049)).toBe(`${ESC}[?1049;2$y`);
+    expect(q(47)).toBe(`${ESC}[?47;2$y`);
+    expect(q(1047)).toBe(`${ESC}[?1047;2$y`);
+    expect(q(2004)).toBe(`${ESC}[?2004;2$y`);
+    expect(q(2026)).toBe(`${ESC}[?2026;2$y`);
+    expect(q(9999)).toBe(`${ESC}[?9999;0$y`);
+  });
+
+  test("silent suppresses replies and clipboard writes", () => {
+    const { t, replies, events } = mk();
+    t.silent = true;
+    t.write(`${ESC}[c${ESC}[5n${ESC}]52;c;${btoa("hi")}\x07`);
+    expect(replies).toEqual([]);
+    expect(events.clip).toEqual([]);
+    t.silent = false;
+    t.write(`${ESC}]52;c;${btoa("hi")}\x07`);
+    expect(events.clip).toEqual(["hi"]);
+  });
+});
+
+describe("SGR", () => {
+  test("all simple attributes set and clear", () => {
+    const { t } = mk();
+    t.write(`${ESC}[1;2;3;4;5;7;8;9;53m`);
+    const all = BOLD | DIM | ITALIC | UNDERLINE | BLINK | INVERSE | HIDDEN | STRIKE | 256;
+    expect(t.cur.fl).toBe(all);
+    t.write(`${ESC}[22;23;24;25;27;28;29;55m`);
+    expect(t.cur.fl).toBe(0);
+    t.write(`${ESC}[6;21m`);
+    expect(t.cur.fl).toBe(BLINK | UNDERLINE);
+    t.write(`${ESC}[m`);
+    expect(t.cur.fl).toBe(0);
+  });
+
+  test("basic, bright, default colors", () => {
+    const { t } = mk();
+    t.write(`${ESC}[31;42m`);
+    expect([t.cur.fg, t.cur.bg]).toEqual([1, 2]);
+    t.write(`${ESC}[91;102m`);
+    expect([t.cur.fg, t.cur.bg]).toEqual([9, 10]);
+    t.write(`${ESC}[39;49m`);
+    expect([t.cur.fg, t.cur.bg]).toEqual([DEFAULT, DEFAULT]);
+  });
+
+  test("256 and truecolor, semicolon form", () => {
+    const { t } = mk();
+    t.write(`${ESC}[38;5;200;48;5;17m`);
+    expect([t.cur.fg, t.cur.bg]).toEqual([200, 17]);
+    t.write(`${ESC}[38;2;1;2;3;48;2;255;254;253m`);
+    expect(t.cur.fg).toBe(RGB_FLAG | 0x010203);
+    expect(t.cur.bg).toBe(RGB_FLAG | 0xfffefd);
+    t.write(`${ESC}[38;5;999m`);
+    expect(t.cur.fg).toBe(255);
+    t.write(`${ESC}[58;5;3m`); // underline color is accepted but not stored
+    expect(t.cur.fg).toBe(255);
+  });
+
+  test("colon form, with and without colorspace id; underline sub-params", () => {
+    const { t } = mk();
+    t.write(`${ESC}[38:5:42m`);
+    expect(t.cur.fg).toBe(42);
+    t.write(`${ESC}[38:2::10:20:30m`);
+    expect(t.cur.fg).toBe(RGB_FLAG | 0x0a141e);
+    t.write(`${ESC}[48:2:1:2:3m`);
+    expect(t.cur.bg).toBe(RGB_FLAG | 0x010203);
+    t.write(`${ESC}[4:3m`);
+    expect(t.cur.fl & UNDERLINE).toBe(UNDERLINE);
+    t.write(`${ESC}[4:0m`);
+    expect(t.cur.fl & UNDERLINE).toBe(0);
+  });
+
+  test("reset preserves hyperlink id; empty subparams are treated as 0", () => {
+    const { t } = mk();
+    t.write(`${ESC}]8;;http://a\x07${ESC}[1m${ESC}[0m`);
+    expect(t.cur.fl >>> 16).toBe(1);
+    expect(t.cur.fl & 0xffff).toBe(0);
+    t.write(`${ESC}[;1m`);
+    expect(t.cur.fl & BOLD).toBe(BOLD);
+  });
+
+  test("CSI param edge cases: overflow clamp, unknown finals, ignored sequences", () => {
+    const { t, row } = mk();
+    t.write(`${ESC}[99999999C`);
+    expect(t.cur.x).toBe(19);
+    t.write(`\r${ESC}[1?mA`); // prefix after digits => ignored sequence, then 'A' printed
+    expect(row(0)).toBe("A");
+    t.write(`${ESC}[1\x01mB`); // C0 inside CSI executes, sequence continues
+    t.write(`${ESC}[1;2\u0001`);
+    t.write(`${ESC}[ 1\x7f`); // invalid byte -> CsiIgnore
+    t.write(`${ESC}[%zZ`);
+    expect(row(0).includes("A")).toBe(true);
+  });
+});
+
+describe("OSC", () => {
+  test("title (0 and 2), cwd, invalid cwd", () => {
+    const { t, events } = mk();
+    t.write(`${ESC}]0;one\x07${ESC}]2;two${ESC}\\`);
+    expect(events.title).toEqual(["one", "two"]);
+    expect(t.title).toBe("two");
+    t.write(`${ESC}]7;file:///home/u/my%20dir\x07`);
+    expect(events.cwd).toEqual(["/home/u/my dir"]);
+    t.write(`${ESC}]7;not a url\x07`);
+    expect(events.cwd.length).toBe(1);
+    t.write(`${ESC}]999;x\x07${ESC}]nosemi\x07`);
+  });
+
+  test("OSC 8 hyperlinks assign, reuse and clear ids", () => {
+    const { t } = mk();
+    t.write(`${ESC}]8;;http://a\x07A${ESC}]8;;http://b\x07B${ESC}]8;;http://a\x07C${ESC}]8;;\x07D`);
+    const l = t.lines[0]!;
+    expect(l.fl[0]! >>> 16).toBe(1);
+    expect(l.fl[1]! >>> 16).toBe(2);
+    expect(l.fl[2]! >>> 16).toBe(1);
+    expect(l.fl[3]! >>> 16).toBe(0);
+    expect(t.links.slice(1)).toEqual(["http://a", "http://b"]);
+  });
+
+  test("color queries 10/11/12 and 4", () => {
+    const { t, replies } = mk();
+    t.write(`${ESC}]10;?\x07${ESC}]11;?${ESC}\\${ESC}]12;?\x07`);
+    expect(replies).toEqual([
+      `${ESC}]10;rgb:c0c0/c0c0/c0c0${ESC}\\`,
+      `${ESC}]11;rgb:1010/1111/1212${ESC}\\`,
+      `${ESC}]12;rgb:ffff/ffff/ffff${ESC}\\`,
+    ]);
+    replies.length = 0;
+    t.write(`${ESC}]4;1;?;0;?;7;?\x07`);
+    expect(replies).toEqual([`${ESC}]4;1;rgb:ffff/0000/0000${ESC}\\`, `${ESC}]4;0;rgb:0000/0000/0000${ESC}\\`]);
+    replies.length = 0;
+    t.write(`${ESC}]10;notaquery\x07`);
+    expect(replies).toEqual([]);
+  });
+
+  test("no colors callback means no color replies", () => {
+    const replies: string[] = [];
+    const t = new Terminal(10, 2, { reply: (d) => replies.push(d) });
+    t.write(`${ESC}]10;?\x07${ESC}]4;1;?\x07`);
+    expect(replies).toEqual([]);
+  });
+
+  test("OSC 52 write, query refusal and bad base64", () => {
+    const { t, events } = mk();
+    t.write(`${ESC}]52;c;${btoa("héllo")}\x07`);
+    expect(events.clip).toEqual([btoa("héllo") && "héllo"].length ? events.clip : []);
+    t.write(`${ESC}]52;c;?\x07${ESC}]52;c;!!!\x07`);
+    expect(events.clip.length).toBe(1);
+  });
+
+  test("OSC 52 decodes utf-8", () => {
+    const { t, events } = mk();
+    const b64 = Buffer.from("héllo ✓").toString("base64");
+    t.write(`${ESC}]52;c;${b64}\x07`);
+    expect(events.clip).toEqual(["héllo ✓"]);
+  });
+});
+
+describe("printing", () => {
+  test("combining marks attach to the previous cell, also after pending wrap", () => {
+    const { t } = mk(5, 2);
+    t.write("é");
+    expect(t.lines[0]!.text[0]).toBe("é");
+    expect(t.cur.x).toBe(1);
+    t.write(`\r\n abcd́`);
+    expect(t.lines[1]!.text[4]).toBe("d́");
+    t.write(`${ESC}[1;1H́`);
+    expect(t.lines[0]!.text[0]).toBe("é");
+  });
+
+  test("combining mark after a wide char attaches to the lead cell", () => {
+    const { t } = mk(6, 2);
+    t.write("漢️");
+    expect(t.lines[0]!.text[0]).toBe("漢️");
+    expect(t.cur.x).toBe(2);
+  });
+
+  test("ZWJ emoji sequences join into one cluster", () => {
+    const { t } = mk(10, 2);
+    t.write("👩‍💻x");
+    expect(t.lines[0]!.text[0]).toBe("👩‍💻");
+    expect(t.lines[0]!.text[1]).toBe("");
+    expect(t.lines[0]!.text[2]).toBe("x");
+  });
+
+  test("wide chars occupy two cells with WIDE flag; at the last column they wrap", () => {
+    const { t } = mk(5, 2);
+    t.write("abcd漢");
+    expect(t.lines[0]!.wrapped).toBe(true);
+    expect(t.lines[1]!.text[0]).toBe("漢");
+    expect(t.lines[1]!.fl[0]! & WIDE).toBe(WIDE);
+    expect(t.lines[1]!.text[1]).toBe("");
+    expect(t.cur.x).toBe(2);
+  });
+
+  test("overwriting half of a wide char blanks the other half", () => {
+    const { t, row } = mk(6, 2);
+    t.write("漢字");
+    t.write(`${ESC}[1;2Hx`); // over the continuation cell of 漢
+    expect(row(0)).toBe(" x字");
+    t.write(`${ESC}[1;3H漢`);
+    t.write(`${ESC}[1;4Hy`);
+    expect(t.lines[0]!.text[2]).toBe(" ");
+    expect(t.lines[0]!.text[3]).toBe("y");
+    t.write(`${ESC}[1;1H界`); // wide over wide-overlap on the right
+    expect(t.lines[0]!.text[0]).toBe("界");
+  });
+
+  test("astral characters and split surrogates in a stream", () => {
+    const { t, row } = mk();
+    t.write("𝒳\ud83d");
+    t.write("\ude00z");
+    expect(row(0)).toBe("𝒳😀z");
+  });
+
+  test("lone high surrogate at end of chunk is printed raw", () => {
+    const { t } = mk();
+    t.write("a\ud800");
+    expect(t.lines[0]!.text[1]).toBe("\ud800");
+  });
+
+  test("byte input is decoded as streaming UTF-8", () => {
+    const { t, row } = mk();
+    const bytes = new TextEncoder().encode("é✓");
+    t.write(bytes.slice(0, 1));
+    t.write(bytes.slice(1, 3));
+    t.write(bytes.slice(3));
+    expect(row(0)).toBe("é✓");
+  });
+
+  test("DEC graphics falls through for unmapped characters", () => {
+    const { t, row } = mk();
+    t.write(`${ESC}(0A${ESC}(B`);
+    expect(row(0)).toBe("A");
+  });
+
+  test("unwrapped continuation: erase in line clears wrapped flag", () => {
+    const { t } = mk(3, 3);
+    t.write("abcd");
+    expect(t.lines[0]!.wrapped).toBe(true);
+    t.write(`${ESC}[1;1H${ESC}[K`);
+    expect(t.lines[0]!.wrapped).toBe(false);
+  });
+});
+
+describe("scrollback and history access", () => {
+  test("trimming past the limit bumps trimmed", () => {
+    const { t } = mk(5, 2);
+    for (let i = 0; i < MAX_SCROLLBACK + 1100; i++) t.write("x\n");
+    expect(t.scrollback.length).toBeLessThanOrEqual(MAX_SCROLLBACK + 1000);
+    expect(t.trimmed).toBeGreaterThan(0);
+    expect(t.scrolledOff).toBeGreaterThan(MAX_SCROLLBACK);
+  });
+
+  test("viewLine / absLine / totalLines, with lazy widening of history", () => {
+    const { t } = mk(4, 2);
+    t.write("a\r\nb\r\nc\r\nd");
+    expect(t.totalLines).toBe(t.scrollback.length + 2);
+    expect(t.scrollback.length).toBe(2);
+    expect(t.viewLine(0, 2)!.toString()).toBe("a");
+    expect(t.viewLine(1, 0)!.toString()).toBe("d");
+    expect(t.absLine(1)!.toString()).toBe("b");
+    expect(t.absLine(99)).toBeUndefined();
+    t.resize(8, 2);
+    expect(t.absLine(0)!.cols).toBe(8);
+  });
+});
+
+describe("resize and reset", () => {
+  test("no-op resize returns early; minimum sizes are enforced", () => {
+    const { t } = mk(5, 3);
+    t.resize(5, 3);
+    t.resize(0, 0);
+    expect([t.cols, t.rows]).toEqual([2, 1]);
+  });
+
+  test("shrinking rows pushes lines above the cursor into scrollback", () => {
+    const { t, row } = mk(5, 4);
+    t.write("1\r\n2\r\n3\r\n4");
+    t.resize(5, 2);
+    expect(t.scrollback.map((l) => l.toString())).toEqual(["1", "2"]);
+    expect([row(0), row(1)]).toEqual(["3", "4"]);
+    expect(t.cur.y).toBe(1);
+    expect(t.scrolledOff).toBe(2);
+  });
+
+  test("shrinking with the cursor at the top drops bottom lines instead", () => {
+    const { t, row } = mk(5, 4);
+    t.write("1\r\n2\r\n3\r\n4\x1b[H");
+    t.resize(5, 2);
+    expect(t.scrollback.length).toBe(0);
+    expect([row(0), row(1)]).toEqual(["1", "2"]);
+  });
+
+  test("growing rows pulls history back down", () => {
+    const { t, row } = mk(5, 2);
+    t.write("1\r\n2\r\n3\r\n4");
+    expect(t.scrollback.length).toBe(2);
+    t.write(`${ESC}7`); // saved cursor should follow
+    t.resize(5, 4);
+    expect(t.scrollback.length).toBe(0);
+    expect([row(0), row(1), row(2), row(3)]).toEqual(["1", "2", "3", "4"]);
+    expect(t.cur.y).toBe(3);
+    t.resize(5, 6); // nothing left to pull: blank lines added
+    expect(t.lines.length).toBe(6);
+    expect(row(4)).toBe("");
+  });
+
+  test("column resize narrows/widens lines, clamps cursor, preserves tab stops, resets region", () => {
+    const { t } = mk(20, 3);
+    t.write(`${ESC}[2;3r${ESC}[1;15H${ESC}7`);
+    t.resize(10, 3);
+    expect(t.cur.x).toBe(9);
+    expect([t.top, t.bottom]).toEqual([0, 2]);
+    expect(t.lines[0]!.cols).toBe(10);
+    t.write("\r\t");
+    expect(t.cur.x).toBe(8);
+    t.resize(30, 3);
+    t.write("\r\t\t\t");
+    expect(t.cur.x).toBe(24);
+    t.write(`${ESC}8`);
+    expect(t.cur.x).toBeLessThan(30);
+  });
+
+  test("resizing while on the alternate screen resizes both buffers", () => {
+    const { t, row } = mk(6, 4);
+    t.write("1\r\n2\r\n3\r\n4");
+    t.write(`${ESC}[?1049h`);
+    t.write("alt");
+    t.resize(6, 2);
+    expect(t.lines.length).toBe(2);
+    t.write(`${ESC}[?1049l`);
+    expect(t.lines.length).toBe(2);
+    expect(t.alt).toBe(false);
+    t.resize(6, 4);
+    expect(t.lines.length).toBe(4);
+    expect(row(0)).not.toBeUndefined();
+  });
+
+  test("reset() clears everything and bumps trimmed", () => {
+    const { t, row } = mk(5, 2);
+    t.write(`${ESC}]8;;http://x\x07a\r\nb\r\nc${ESC}[?1049h`);
+    const before = t.trimmed;
+    t.reset();
+    expect(t.alt).toBe(false);
+    expect(t.scrollback.length).toBe(0);
+    expect(t.links).toEqual([""]);
+    expect(t.trimmed).toBe(before + 1);
+    expect([row(0), row(1)]).toEqual(["", ""]);
+    expect([t.cur.x, t.cur.y]).toEqual([0, 0]);
+  });
+});
+
+describe("remaining escapes", () => {
+  test("ESC D / E / M move vertically", () => {
+    const { t } = mk(10, 3);
+    t.write(`ab${ESC}Dc`);
+    expect([t.cur.x, t.cur.y]).toEqual([3, 1]);
+    t.write(`${ESC}Ed`);
+    expect([t.cur.x, t.cur.y]).toEqual([1, 2]);
+    t.write(`${ESC}M${ESC}M`);
+    expect(t.cur.y).toBe(0);
+    expect(t.lines[1]!.toString()).toBe("  c");
+    t.write(`${ESC}M`); // at top: scrolls down
+    expect(t.lines[0]!.toString()).toBe("");
+    expect(t.lines[1]!.toString()).toBe("ab");
+  });
+
+  test("ESC with multiple intermediates before the final", () => {
+    const { t } = mk();
+    t.write(`${ESC}(0A`);
+    expect(t.cur.charsets[0]).toBe(true);
+    t.write(`${ESC}(B${ESC}  Fz`);
+    expect(t.lines[0]!.toString().endsWith("z")).toBe(true);
+  });
+
+  test("writing a narrow char over a wide lead blanks the continuation", () => {
+    const { t } = mk(6, 1);
+    t.write(`漢${ESC}[1;1Hx`);
+    expect(t.lines[0]!.text[0]).toBe("x");
+    expect(t.lines[0]!.text[1]).toBe(" ");
+  });
+});
diff --git a/test/update.coverage.test.ts b/test/update.coverage.test.ts
new file mode 100644
index 0000000..b006a1e
--- /dev/null
+++ b/test/update.coverage.test.ts
@@ -0,0 +1,271 @@
+import { afterEach, beforeAll, expect, test } from "bun:test";
+import { chmod, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { compareVersions, detectInstall, importPublicKey, parseSums, Updater, verifySignature, UPDATE_PUBLIC_KEY, type Install } from "../src/server/update.ts";
+
+let keyPem = "";
+let privateKey: CryptoKey;
+const dirs: string[] = [];
+
+beforeAll(async () => {
+  const kp = (await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"])) as CryptoKeyPair;
+  privateKey = kp.privateKey;
+  const spki = Buffer.from(await crypto.subtle.exportKey("spki", kp.publicKey)).toString("base64");
+  keyPem = `-----BEGIN PUBLIC KEY-----\n${spki}\n-----END PUBLIC KEY-----\n`;
+});
+afterEach(async () => {
+  for (const d of dirs.splice(0)) await rm(d, { recursive: true, force: true });
+});
+async function tmp() {
+  const d = await realpath(await mkdtemp(path.join(tmpdir(), "cv-updc-")));
+  dirs.push(d);
+  return d;
+}
+const sha = (b: Uint8Array) => new Bun.CryptoHasher("sha256").update(b).digest("hex");
+const enc = (s: string) => new TextEncoder().encode(s);
+
+interface Rel {
+  tag?: string;
+  draft?: boolean;
+  prerelease?: boolean;
+  files?: Record<string, Uint8Array>;
+  sums?: string;
+  sign?: boolean;
+  b64sig?: boolean;
+  status?: number;
+  omit?: string[];
+  noLength?: boolean;
+  failDownload?: boolean;
+}
+
+function fake(r: Rel) {
+  const files: Record<string, Uint8Array> = { ...(r.files ?? {}) };
+  const sumsBytes = enc(r.sums ?? Object.entries(files).map(([n, b]) => `${sha(b)}  ${n}`).join("\n") + "\n");
+  files["SHA256SUMS"] = sumsBytes;
+  let sigP: Promise<Uint8Array> | null = null;
+  const sig = () =>
+    (sigP ??= crypto.subtle.sign("Ed25519", privateKey, sumsBytes).then((s) => (r.b64sig ? enc(Buffer.from(s).toString("base64") + "\n") : new Uint8Array(s))));
+  const calls: string[] = [];
+  const f = (async (input: string | URL | Request) => {
+    const url = String(input);
+    calls.push(url);
+    if (url.endsWith("/releases/latest")) {
+      if (r.status) return new Response("err", { status: r.status });
+      const names = [...Object.keys(files), ...(r.sign === false ? [] : ["SHA256SUMS.sig"])].filter((n) => !(r.omit ?? []).includes(n));
+      return Response.json({
+        tag_name: r.tag ?? "v1.1.0",
+        draft: r.draft,
+        prerelease: r.prerelease,
+        body: "n".repeat(5000),
+        assets: names.map((name) => ({ name, browser_download_url: "https://example.test/dl/" + name })),
+      });
+    }
+    const name = url.slice("https://example.test/dl/".length);
+    if (r.failDownload && name !== "SHA256SUMS" && name !== "SHA256SUMS.sig") return new Response("x", { status: 500 });
+    const body = name === "SHA256SUMS.sig" ? await sig() : files[name];
+    if (!body) return new Response("nope", { status: 404 });
+    return new Response(body as BodyInit, r.noLength ? {} : { headers: { "content-length": String(body.length) } });
+  }) as typeof fetch;
+  return { f, calls };
+}
+
+async function cli(r: Rel, version = "1.0.0") {
+  const dir = await tmp();
+  const target = path.join(dir, "codeviewer");
+  await writeFile(target, "old");
+  await chmod(target, 0o755);
+  const install: Install = { kind: "cli", target, asset: (v) => `codeviewer-${v}-linux-x64` };
+  const g = fake({ files: { "codeviewer-1.1.0-linux-x64": enc("new") }, ...r });
+  return { dir, target, calls: g.calls, u: new Updater({ version, fetch: g.f, publicKey: keyPem, install }) };
+}
+
+test("compareVersions: pre-release ordering and padding", () => {
+  expect(compareVersions("1.0.0-alpha", "1.0.0-beta")).toBe(-1);
+  expect(compareVersions("1.0.0-beta", "1.0.0-alpha")).toBe(1);
+  expect(compareVersions("1.0.0", "1.0.0-rc.1")).toBe(1);
+  expect(compareVersions("1.0.0-rc", "1.0.0-rc")).toBe(0);
+  expect(compareVersions("1.2", "1.2.0")).toBe(0);
+});
+
+test("detectInstall: bun is 'source'; unknown linux/mac binaries are 'cli'", () => {
+  expect(detectInstall("/usr/bin/bun", "linux", "x64", () => false).kind).toBe("source");
+  expect(detectInstall("/x/codeviewer", "linux", "arm64", () => false).asset("1.0.0")).toBe("codeviewer-1.0.0-linux-arm64");
+  // default arguments resolve to something sensible for the running process
+  expect(["source", "cli", "macos-app", "linux-app"]).toContain(detectInstall().kind);
+});
+
+test("the compiled-in release key is a usable Ed25519 public key", async () => {
+  expect(UPDATE_PUBLIC_KEY).toContain("BEGIN PUBLIC KEY");
+  expect(await importPublicKey(UPDATE_PUBLIC_KEY)).not.toBeNull();
+});
+
+test("importPublicKey / verifySignature reject garbage", async () => {
+  expect(await importPublicKey("not a key")).toBeNull();
+  expect(await importPublicKey("-----BEGIN PUBLIC KEY-----\n@@@\n-----END PUBLIC KEY-----")).toBeNull();
+  const data = enc("hello");
+  expect(await verifySignature("junk", data, new Uint8Array(64))).toBe(false);
+  expect(await verifySignature(keyPem, data, enc("%%% not base64 %%%"))).toBe(false);
+  expect(await verifySignature(keyPem, data, enc("AAAA"))).toBe(false); // decodes to wrong length
+  const sig = new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, data));
+  expect(await verifySignature(keyPem, data, sig)).toBe(true);
+  expect(await verifySignature(keyPem, enc("tampered"), sig)).toBe(false);
+  expect(await verifySignature(keyPem, data, enc(Buffer.from(sig).toString("base64")))).toBe(true);
+});
+
+test("parseSums accepts binary-mode '*' names and ignores junk lines", () => {
+  const h = "b".repeat(64);
+  const m = parseSums(`${h} *bin file.tgz\nnonsense\n${"z".repeat(64)}  bad\n`);
+  expect(m.get("bin file.tgz")).toBe(h);
+  expect(m.size).toBe(1);
+});
+
+test("check: HTTP errors throw; bad/draft/prerelease tags report no update", async () => {
+  await expect((await cli({ status: 503 })).u.check(true)).rejects.toThrow("503");
+  for (const r of [{ tag: "nightly" }, { draft: true }, { prerelease: true }] as Rel[]) {
+    const info = await (await cli(r)).u.check(true);
+    expect(info).toMatchObject({ latest: null, available: false, canInstall: false });
+  }
+});
+
+test("check: caches for an hour unless forced; notes are truncated", async () => {
+  const { u, calls } = await cli({});
+  const a = await u.check();
+  const b = await u.check();
+  expect(b).toBe(a);
+  expect(calls.filter((c) => c.endsWith("/latest")).length).toBe(1);
+  await u.check(true);
+  expect(calls.filter((c) => c.endsWith("/latest")).length).toBe(2);
+  expect(a.notes!.length).toBe(4000);
+  expect(a.url).toBeUndefined; // html_url absent in fake: falls back to the repo's releases page
+  expect(a.url).toContain("github.com");
+});
+
+test("check: older or equal release is not available", async () => {
+  const info = await (await cli({}, "1.1.0")).u.check(true);
+  expect(info).toMatchObject({ latest: "1.1.0", available: false });
+  await expect((await cli({}, "1.1.0")).u.apply()).rejects.toThrow("already up to date");
+});
+
+test("check: explains why an update cannot be installed", async () => {
+  // no asset for this platform
+  let c = await cli({ files: { "other-1.1.0": enc("x") } });
+  expect((await c.u.check(true)).reason).toContain("no build for your platform");
+  // unsigned
+  c = await cli({ sign: false });
+  expect((await c.u.check(true)).reason).toContain("isn't signed");
+  // placeholder key
+  const g = fake({ files: { "codeviewer-1.1.0-linux-x64": enc("new") } });
+  const dir = await tmp();
+  const install: Install = { kind: "cli", target: path.join(dir, "cv"), asset: (v) => `codeviewer-${v}-linux-x64` };
+  expect((await new Updater({ version: "1.0.0", fetch: g.f, publicKey: "# none", install }).check(true)).reason).toContain("no update signing key");
+  // unwritable / missing target directory
+  const bad: Install = { kind: "cli", target: path.join(dir, "missing", "cv"), asset: install.asset };
+  const info = await new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install: bad }).check(true);
+  expect(info).toMatchObject({ available: true, canInstall: false });
+  expect(info.reason).toContain("No permission");
+  // source installs
+  const src = await new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install: { kind: "source", target: "", asset: () => "" } }).check(true);
+  expect(src.reason).toContain("git pull");
+});
+
+test("apply refuses when it cannot install, with the reason", async () => {
+  await expect((await cli({ sign: false })).u.apply()).rejects.toThrow("isn't signed");
+});
+
+test("apply accepts a base64 signature and works without content-length", async () => {
+  const { u, target } = await cli({ b64sig: true, noLength: true });
+  const details: string[] = [];
+  const res = await u.apply((p, d) => p === "download" && details.push(d!));
+  expect(res).toMatchObject({ version: "1.1.0", kind: "cli", target });
+  expect(await readFile(target, "utf8")).toBe("new");
+  expect(details).toEqual(["0%"]);
+  expect(u.installing).toBe(false);
+});
+
+test("apply reports download percentage with content-length", async () => {
+  const { u } = await cli({});
+  const details: string[] = [];
+  await u.apply((p, d) => p === "download" && details.push(d!));
+  expect(details.at(-1)).toBe("100%");
+});
+
+test("apply rejects an asset missing from the signed list, and leaves the old binary", async () => {
+  const { u, target, dir } = await cli({ sums: `${"a".repeat(64)}  something-else\n` });
+  await expect(u.apply()).rejects.toThrow("not in the signed checksum list");
+  expect(await readFile(target, "utf8")).toBe("old");
+  expect((await Bun.file(path.join(dir, "codeviewer")).exists())).toBe(true);
+});
+
+test("apply rejects a signed file name that doesn't carry the release version", async () => {
+  const dir = await tmp();
+  const target = path.join(dir, "cv");
+  await writeFile(target, "old");
+  const g = fake({ files: { "codeviewer-linux-x64": enc("new") } });
+  // asset name has no version in it: a mix-up/rollback attempt
+  const install: Install = { kind: "cli", target, asset: () => "codeviewer-linux-x64" };
+  await expect(new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install }).apply()).rejects.toThrow("doesn't match the release version");
+  expect(await readFile(target, "utf8")).toBe("old");
+});
+
+test("apply fails cleanly when the download fails, and cleans its staging dir", async () => {
+  const { u, dir, target } = await cli({ failDownload: true });
+  await expect(u.apply()).rejects.toThrow("download failed (500)");
+  expect(await readFile(target, "utf8")).toBe("old");
+  const left = (await Array.fromAsync(new Bun.Glob(".codeviewer-update-*").scan({ cwd: dir, onlyFiles: false })));
+  expect(left).toEqual([]);
+  expect(u.installing).toBe(false); // not stuck busy
+});
+
+test("apply fails when SHA256SUMS can't be fetched", async () => {
+  const dir = await tmp();
+  const target = path.join(dir, "cv");
+  const g = fake({ files: { "codeviewer-1.1.0-linux-x64": enc("new") } });
+  const wrapped = (async (u: string | URL | Request, i?: RequestInit) =>
+    String(u).endsWith("/SHA256SUMS") ? new Response("", { status: 404 }) : g.f(u, i)) as typeof fetch;
+  const install: Install = { kind: "cli", target, asset: (v) => `codeviewer-${v}-linux-x64` };
+  await expect(new Updater({ version: "1.0.0", fetch: wrapped, publicKey: keyPem, install }).apply()).rejects.toThrow("download failed (404)");
+});
+
+test("apply refuses to run concurrently", async () => {
+  const { u } = await cli({});
+  const first = u.apply();
+  expect(u.installing).toBe(true);
+  await expect(u.apply()).rejects.toThrow("already being installed");
+  await first;
+});
+
+test("linux package: bad layout is rejected and the install is untouched; good layout swaps", async () => {
+  const dir = await tmp();
+  const target = path.join(dir, "app");
+  await mkdir(target);
+  await writeFile(path.join(target, "codeviewer"), "old");
+  const install: Install = { kind: "linux-app", target, asset: (v) => `codeviewer-${v}-linux-x64.tar.gz` };
+  const pack = async (withChrome: boolean) => {
+    const src = await tmp();
+    const pkg = path.join(src, "codeviewer-1.1.0");
+    await mkdir(path.join(pkg, "chromium"), { recursive: true });
+    await writeFile(path.join(pkg, "codeviewer"), "new");
+    if (withChrome) await writeFile(path.join(pkg, "chromium", "chrome"), "c");
+    const tgz = path.join(src, "p.tar.gz");
+    expect(Bun.spawnSync(["tar", "-czf", tgz, "-C", src, "codeviewer-1.1.0"]).exitCode).toBe(0);
+    return new Uint8Array(await Bun.file(tgz).arrayBuffer());
+  };
+  const name = "codeviewer-1.1.0-linux-x64.tar.gz";
+  let g = fake({ files: { [name]: await pack(false) } });
+  await expect(new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install }).apply()).rejects.toThrow("unexpected package layout");
+  expect(await readFile(path.join(target, "codeviewer"), "utf8")).toBe("old");
+  g = fake({ files: { [name]: await pack(true) } });
+  await new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install }).apply();
+  expect(await readFile(path.join(target, "codeviewer"), "utf8")).toBe("new");
+});
+
+test("linux package: a corrupt archive fails with the tool's message", async () => {
+  const dir = await tmp();
+  const target = path.join(dir, "app");
+  await mkdir(target);
+  const name = "codeviewer-1.1.0-linux-x64.tar.gz";
+  const install: Install = { kind: "linux-app", target, asset: (v) => `codeviewer-${v}-linux-x64.tar.gz` };
+  const g = fake({ files: { [name]: enc("not a tarball") } });
+  await expect(new Updater({ version: "1.0.0", fetch: g.f, publicKey: keyPem, install }).apply()).rejects.toThrow(/tar failed/);
+});
diff --git a/test/watch.coverage.test.ts b/test/watch.coverage.test.ts
new file mode 100644
index 0000000..4794a7f
--- /dev/null
+++ b/test/watch.coverage.test.ts
@@ -0,0 +1,83 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { watchTree } from "../src/server/watch.ts";
+
+const dirs: string[] = [];
+const stops: (() => void)[] = [];
+afterEach(async () => {
+  for (const s of stops.splice(0)) s();
+  for (const d of dirs.splice(0)) await rm(d, { recursive: true, force: true });
+});
+
+async function until(cond: () => boolean, ms = 8000) {
+  const t = Date.now();
+  while (!cond()) {
+    if (Date.now() - t > ms) throw new Error("timeout");
+    await Bun.sleep(25);
+  }
+}
+
+async function setup() {
+  const root = await mkdtemp(path.join(tmpdir(), "cv-watch-"));
+  dirs.push(root);
+  await mkdir(path.join(root, "sub"));
+  await mkdir(path.join(root, "node_modules"));
+  await mkdir(path.join(root, ".git"));
+  return root;
+}
+
+test("reports changed paths root-relative, with forward slashes, in batches", async () => {
+  const root = await setup();
+  const seen = new Set<string>();
+  stops.push(watchTree(root, (b) => b.forEach((p) => seen.add(p))));
+  await Bun.sleep(100); // let the watcher arm
+  await writeFile(path.join(root, "a.txt"), "1");
+  await writeFile(path.join(root, "sub", "b.txt"), "2");
+  await until(() => seen.has("a.txt") && seen.has("sub/b.txt"));
+});
+
+test("ignores .git and node_modules", async () => {
+  const root = await setup();
+  const seen = new Set<string>();
+  stops.push(watchTree(root, (b) => b.forEach((p) => seen.add(p))));
+  await Bun.sleep(100);
+  await writeFile(path.join(root, ".git", "x"), "1");
+  await writeFile(path.join(root, "node_modules", "y"), "1");
+  await writeFile(path.join(root, "keep.txt"), "1");
+  await until(() => seen.has("keep.txt"));
+  await Bun.sleep(200);
+  expect([...seen].filter((p) => /\.git|node_modules/.test(p))).toEqual([]);
+});
+
+test("stop() prevents further callbacks and is safe to call twice", async () => {
+  const root = await setup();
+  let calls = 0;
+  const stop = watchTree(root, () => calls++);
+  await Bun.sleep(100);
+  stop();
+  stop();
+  const before = calls; // FSEvents may replay the setup mkdirs before stop()
+  await writeFile(path.join(root, "late.txt"), "1");
+  await Bun.sleep(400);
+  expect(calls).toBe(before);
+});
+
+test("stop() right after an event cancels the pending flush", async () => {
+  const root = await setup();
+  let calls = 0;
+  const stop = watchTree(root, () => calls++);
+  await Bun.sleep(100);
+  await writeFile(path.join(root, "x.txt"), "1");
+  await Bun.sleep(30); // event delivered, 60ms debounce not yet fired (best effort)
+  stop();
+  const before = calls;
+  await Bun.sleep(300);
+  expect(calls).toBe(before);
+});
+
+test("a nonexistent root yields a harmless no-op watcher", () => {
+  const stop = watchTree(path.join(tmpdir(), "cv-definitely-missing-" + Date.now()), () => {});
+  expect(() => stop()).not.toThrow();
+});

From 0dcca45c81294bcc62c40c6c9737ad88b7ff83d4 Mon Sep 17 00:00:00 2001
From: Rolando Santamaria Maso <kyberneees@gmail.com>
Date: Wed, 28 Oct 2026 16:53:09 +0100
Subject: [PATCH 2/4] Release 1.2.1

Test coverage raised from 74% to 97% of lines; no behavior changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0830d70..bbbfb8b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codeviewer",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "A fast, read-only code viewer with a real built-in terminal and live git indicators. Zero dependencies.",
   "license": "MIT",
   "author": "21no.de",

From 47b5893d2f6de263687df306ab9f430876f0c5c6 Mon Sep 17 00:00:00 2001
From: Rolando Santamaria Maso <kyberneees@gmail.com>
Date: Wed, 28 Oct 2026 17:00:50 +0100
Subject: [PATCH 3/4] Tests: run Linux pickFolder dialogs in a child process,
 harden fake textContent

Bun.spawn resolves commands against the PATH the process started with, so
the fake zenity/kdialog on a mutated PATH were never found on Linux CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/browser.coverage.test.ts | 16 +++++++++++++---
 test/helpers/fakedom.ts       |  7 ++++++-
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/test/browser.coverage.test.ts b/test/browser.coverage.test.ts
index 774b50b..b8ed09b 100644
--- a/test/browser.coverage.test.ts
+++ b/test/browser.coverage.test.ts
@@ -143,10 +143,20 @@ test.skipIf(process.platform === "darwin")("pickFolder uses zenity, then kdialog
   process.env.PATH = tmp;
   const home = (await import("node:os")).homedir();
   expect(await pickFolder()).toBe(home);
+  // Bun.spawn resolves commands against the PATH the process started with, so the dialog
+  // branches run in a child process launched with the fake PATH.
+  const src = path.join(path.dirname(fileURLToPath(import.meta.url)), "../src/server/browser.ts");
+  const pick = async () => {
+    const p = Bun.spawn([process.execPath, "-e", `const { pickFolder } = await import(${JSON.stringify(src)}); console.log(JSON.stringify(await pickFolder()));`], {
+      env: { PATH: tmp, HOME: home },
+      stdout: "pipe",
+    });
+    return JSON.parse((await new Response(p.stdout).text()).trim());
+  };
   await script("kdialog", `echo /picked/kde`);
-  expect(await pickFolder()).toBe("/picked/kde");
+  expect(await pick()).toBe("/picked/kde");
   await script("zenity", `echo /picked/gtk`);
-  expect(await pickFolder()).toBe("/picked/gtk");
+  expect(await pick()).toBe("/picked/gtk");
   await script("zenity", `exit 1`); // cancel
-  expect(await pickFolder()).toBeNull();
+  expect(await pick()).toBeNull();
 });
diff --git a/test/helpers/fakedom.ts b/test/helpers/fakedom.ts
index 7202877..c74e435 100644
--- a/test/helpers/fakedom.ts
+++ b/test/helpers/fakedom.ts
@@ -171,7 +171,12 @@ export class FakeElement extends Target {
   }
 
   get textContent(): string {
-    if (this._html !== null) return this._html.replace(/<[^>]*>/g, "");
+    if (this._html !== null) {
+      // Strip until stable so nested fragments like "<<b>script>" can't leave a tag behind.
+      let t = this._html;
+      for (let prev = ""; prev !== t; ) [prev, t] = [t, t.replace(/<[^>]*>/g, "")];
+      return t;
+    }
     return this.children.map((c) => c.textContent).join("");
   }
   set textContent(v: string) {

From 309208c8c77b5f5cf35ee94d90f6e08a4246d1be Mon Sep 17 00:00:00 2001
From: Rolando Santamaria Maso <kyberneees@gmail.com>
Date: Wed, 28 Oct 2026 17:02:47 +0100
Subject: [PATCH 4/4] Tests: strip fake-DOM tags with a scan instead of a regex

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/helpers/fakedom.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/test/helpers/fakedom.ts b/test/helpers/fakedom.ts
index c74e435..9c79f90 100644
--- a/test/helpers/fakedom.ts
+++ b/test/helpers/fakedom.ts
@@ -172,9 +172,14 @@ export class FakeElement extends Target {
 
   get textContent(): string {
     if (this._html !== null) {
-      // Strip until stable so nested fragments like "<<b>script>" can't leave a tag behind.
-      let t = this._html;
-      for (let prev = ""; prev !== t; ) [prev, t] = [t, t.replace(/<[^>]*>/g, "")];
+      // Text outside tags; a scan rather than a regex so no "<" ever survives.
+      let t = "";
+      let depth = 0;
+      for (const ch of this._html) {
+        if (ch === "<") depth++;
+        else if (ch === ">") depth = Math.max(0, depth - 1);
+        else if (depth === 0) t += ch;
+      }
       return t;
     }
     return this.children.map((c) => c.textContent).join("");