[CLAUDE ROUTINE]: Test-coverage enhancement — add unit tests for src/auth/ and src/relay/ modules #155

Summary

The newly-added cloud platform client (login / logout / token-store + relay daemon + queue + pid) currently has no files under __tests__/. Adding focused unit tests for these modules catches regressions early and lets us evolve the cloud path confidently.

Where

Source with no direct unit tests:

• src/auth/login.ts (104 lines) — device-code flow, polling loop, browser open
• src/auth/logout.ts (50 lines) — clears tokens, stops relay
• src/auth/token-store.ts (64 lines) — atomic token write, read, delete
• src/relay/daemon.ts (362 lines) — WebSocket connect, reconnect, batch send
• src/relay/queue.ts (225 lines) — sanitize, append, claim, ack
• src/relay/pid.ts (77 lines) — PID read/write, liveness probe

Existing __tests__/hooks/ is well-covered; the gap is entirely on the cloud side.

Why this helps

• The OAuth device flow has a handful of branches (no browser, timeout, network failure, wrong code) that are easy to cover and hard to reason about without tests.
• token-store.ts already does atomic writes correctly — a unit test pins that behaviour so a future refactor doesn't regress it.
• queue.ts has the most user-visible correctness surface (sanitization, queue size caps, claim/ack) and ships with zero coverage today.
• Relay daemon tests let us exercise reconnect / backoff / ack paths without running a real server — well worth the small test harness investment.

Proposed scope

Create these test files (all using the existing vitest harness):

• __tests__/auth/token-store.test.ts
  • atomic write + read roundtrip
  • writeTokens with existing file (atomic replace, not clobber)
  • clearTokens deletes file; readTokens on missing file returns null
  • file mode is 0o600 on POSIX
• __tests__/auth/login.test.ts
  • polling loop: pending → slow_down → success
  • polling loop: timeout
  • browser open failure still prints URL
• __tests__/auth/logout.test.ts
  • clears tokens + stops relay
• __tests__/relay/queue.test.ts
  • sanitize() strips toolInput, hashes cwd, runs redactReason
  • appendToServerQueue is no-op when not logged in
  • claim() / ack() transitions file state correctly
  • queue is capped at MAX_QUEUE_BYTES
• __tests__/relay/pid.test.ts
  • write / read roundtrip
  • isProcessAlive(currentPid) === true
  • isProcessAlive(nonExistentPid) === false
  • EPERM treated as alive
• __tests__/relay/daemon.test.ts
  • stubbed WebSocket: send → ack → claim next batch
  • reconnect on close with backoff
  • graceful shutdown clears pid

Acceptance criteria

• CI test:run target picks up all new files.
• Coverage for src/auth/* and src/relay/* rises to ≥ 80% lines / branches.
• No external network or real OAuth server is hit — everything is stubbed.