test: coverage uplift to >85% — UI routes, server, yolo refactor

Final piece of the SonarCloud coverage push. Four parallel test
sweeps, plus the long-deferred cmd/yolo.go refactor.

UI:
- ui/src/routes/SessionDetail.test.tsx — 15 tests covering tabs,
  sessionStorage persistence, attention border, every Checkpoints
  state, Meta tab. Mocks the SSE-backed children (PaneView, FeedStream,
  SubagentTree, etc.) since they have their own dedicated suites.
  Coverage: 0% → 98.95% lines / 85.5% branches.
- ui/src/components/SseProvider.test.tsx — extended from 2 → 19 tests.
  Drives the mocked fetchEventSource onmessage/onerror callbacks per
  test to cover session_new/_attached/_killed, tool_call feed (incl.
  500-row FEED_CAP trim), quota updates, attention raised/cleared,
  subagent/team invalidations, disconnect-grace timer scheduling.
  Coverage: 21.8% → 98.4% lines.
- ui/src/components/SessionListPanel.test.tsx — new, 8 tests covering
  loading skeletons, empty/populated/error/no-sessions, "Show all"
  toggle, footer link, accessibility. 0% → 100%.

Server:
- internal/serve/server_extra_test.go — 36 tests. Shutdown 0% → 100%,
  Addr/Hub 0% → 100%, rescanTailers 0% → 95%, registerRoutes 77% →
  88%, plus full coverage on ContextPct/Tokens/Attention/etc.
  adapters.
- internal/serve/server.go — extracted buildSessionMaps and
  resolveLogUUIDToName from the duplicated UUID-resolution blocks
  Sonar flagged at lines 384-401 ↔ 543-559. Both new helpers at
  100% coverage; both call sites collapsed.
- Coverage: 59% → 82.5%.

Cmd:
- cmd/yolo.go — re-attempted refactor TDD-style. Eight pure helpers
  (decideModeAction, bannerFor, eventsFor, fireLaunchEvents,
  resolveSimpleName, resolveModeTarget, tearDownForRecreate,
  printBanner) average 93% coverage. Both Sonar dup blocks
  (24-line preamble × 2, 24-line resume-or-recreate × 2) collapsed.
  Behaviour preserved across runYolo / runYoloBang / runSafe.
- cmd/yolo_helpers_test.go — 12 funcs, 28 sub-cases.

Verification:
- 830 Go tests pass across 27 packages with -tags sqlite_fts5
  (was 762).
- 155 UI tests pass (was 110).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

cmd/yolo.go

@@ -37,6 +37,131 @@ func shouldResumeExisting(sess *session.Session, requestedMode string) bool {
 	return sess != nil && sess.Mode == requestedMode
 }
 
+// modeDecision is the action a yolo/safe launch must take given the
+// state of the store at launch time.
+type modeDecision int
+
+const (
+	// decisionFresh: no stored session — create from scratch.
+	decisionFresh modeDecision = iota
+	// decisionResume: stored session matches requested mode — preflight + reattach.
+	decisionResume
+	// decisionRecreate: stored session is in a different mode — kill+delete then create.
+	decisionRecreate
+)
+
+// decideModeAction maps the (store-lookup result, requested mode) pair to
+// one of three actions. Pure function — easy to unit-test.
+func decideModeAction(sess *session.Session, getErr error, requestedMode string) modeDecision {
+	if getErr != nil {
+		return decisionFresh
+	}
+	if shouldResumeExisting(sess, requestedMode) {
+		return decisionResume
+	}
+	return decisionRecreate
+}
+
+// bannerFor returns the banner text and styling flag for a given launch mode.
+// magenta=true → out.Magenta; false → out.Success (green). Unknown modes fall
+// back to safe-style green so the screen never goes silent.
+func bannerFor(mode string) (text string, magenta bool) {
+	if mode == "yolo" {
+		return ">>> YOLO MODE", true
+	}
+	upper := ""
+	for _, r := range mode {
+		if r >= 'a' && r <= 'z' {
+			upper += string(r - 32)
+		} else {
+			upper += string(r)
+		}
+	}
+	return fmt.Sprintf(">>> %s MODE", upper), false
+}
+
+// eventsFor returns the (user-hook event, serve-hub event) pair for a mode.
+// Yolo fires "on_yolo" to both. Safe fires "on_safe" to user hooks but maps
+// to "session_attached" on the serve hub — the hub does not model a separate
+// safe-mode lifecycle, only the attach transition.
+func eventsFor(mode string) (hookEvent, serveEvent string) {
+	if mode == "yolo" {
+		return "on_yolo", "on_yolo"
+	}
+	return "on_" + mode, "session_attached"
+}
+
+// fireLaunchEvents fires both the user-defined shell hook and the serve-hub
+// event for a launch in the given mode. Failures inside fireHook /
+// fireServeEvent are already swallowed; this wrapper just composes them.
+func fireLaunchEvents(store *session.Store, name, workdir, mode string) {
+	hookEvent, serveEvent := eventsFor(mode)
+	intent := yoloIntent(store, name, workdir, mode)
+	fireHook(hookEvent, intent)
+	fireServeEvent(serveEvent, intent)
+}
+
+// resolveSimpleName returns args[0] when present, else "claude". This is the
+// name-resolution rule shared by `ctm yolo!` and `ctm safe`. (`ctm yolo` has a
+// richer rule that also handles 2-arg form and prompts for a path, so it
+// stays inline.)
+func resolveSimpleName(args []string) string {
+	if len(args) > 0 {
+		return args[0]
+	}
+	return "claude"
+}
+
+// resolveModeTarget produces the (name, workdir) pair used by `ctm yolo!` and
+// `ctm safe`. Validates the name and resolves the workdir from the store, the
+// running tmux pane, or the current working directory in that order.
+func resolveModeTarget(args []string, store *session.Store, tc *tmux.Client) (string, string, error) {
+	name := resolveSimpleName(args)
+	if err := session.ValidateName(name); err != nil {
+		return "", "", err
+	}
+	workdir, err := resolveWorkdir(name, store, tc)
+	if err != nil {
+		return "", "", err
+	}
+	return name, workdir, nil
+}
+
+// tearDownForRecreate drops the tmux session and store record so that a fresh
+// UUID can be minted. Used when the requested mode differs from the stored
+// mode, or when `ctm yolo!` forces fresh state.
+//
+// loudOnDeleteErr controls the original yolo/safe asymmetry: `ctm yolo`
+// warns on a store.Delete failure; `ctm yolo!` swallows the error (it's a
+// force-reset path). Preserved verbatim so this is a pure refactor.
+func tearDownForRecreate(name string, store *session.Store, tc *tmux.Client, out *output.Printer, loudOnDeleteErr bool) {
+	if tc.HasSession(name) {
+		if err := tc.KillSession(name); err != nil {
+			out.Warn("could not kill existing session: %v", err)
+		}
+	}
+	if err := store.Delete(name); err != nil {
+		if loudOnDeleteErr {
+			out.Warn("could not remove session from store: %v", err)
+		}
+		// Silent branch: `ctm yolo!` ignores not-found and IO errors here.
+		_ = err
+	}
+}
+
+// printBanner prints the launch banner using the appropriate color for mode.
+// We pass the text via `%s` so the banner string is never treated as a format
+// string — defensive against future refactors where the banner becomes
+// data-driven (silences `go vet` non-constant format string warnings).
+func printBanner(out *output.Printer, mode string) {
+	text, magenta := bannerFor(mode)
+	if magenta {
+		out.Magenta("%s", text)
+	} else {
+		out.Success("%s", text)
+	}
+}
+
 var yoloCmd = &cobra.Command{
 	Use:               "yolo [name] [path]",
 	Short:             "Launch or relaunch a session in YOLO (unrestricted) mode",
@@ -117,32 +242,22 @@ func runYolo(cmd *cobra.Command, args []string) error {
 		gitCheckpoint(workdir, out)
 	}
 
-	out.Magenta(">>> YOLO MODE")
-	{
-		intent := yoloIntent(store, name, workdir, "yolo")
-		fireHook("on_yolo", intent)
-		fireServeEvent("on_yolo", intent)
-	}
+	printBanner(out, "yolo")
+	fireLaunchEvents(store, name, workdir, "yolo")
 
 	// If session exists and mode matches → preflight. preflight handles both
 	// live tmux (plain reattach) and dead tmux (recreate with --resume UUID),
 	// so the session's claude history survives `claude` exiting on its own.
 	// Only kill/delete when the mode actually changes (safe → yolo) or when
 	// the user forces fresh state via `ctm yolo!` / `ctm kill`.
-	if sess, err := store.Get(name); err == nil {
-		if shouldResumeExisting(sess, "yolo") {
-			out.Debug(Verbose, "existing yolo session %q — running pre-flight", name)
-			return preflight(sess, cfg, store, tc, out)
-		}
+	sess, getErr := store.Get(name)
+	switch decideModeAction(sess, getErr, "yolo") {
+	case decisionResume:
+		out.Debug(Verbose, "existing yolo session %q — running pre-flight", name)
+		return preflight(sess, cfg, store, tc, out)
+	case decisionRecreate:
 		// Mode change: drop tmux + store record so a fresh UUID is minted.
-		if tc.HasSession(name) {
-			if err := tc.KillSession(name); err != nil {
-				out.Warn("could not kill existing session: %v", err)
-			}
-		}
-		if err := store.Delete(name); err != nil {
-			out.Warn("could not remove session from store: %v", err)
-		}
+		tearDownForRecreate(name, store, tc, out, true)
 	}
 
 	out.Debug(Verbose, "creating yolo session: %s", name)
@@ -161,16 +276,7 @@ func runYoloBang(cmd *cobra.Command, args []string) error {
 	store := session.NewStore(config.SessionsPath())
 	tc := tmux.NewClient(config.TmuxConfPath())
 
-	name := "claude"
-	if len(args) > 0 {
-		name = args[0]
-	}
-	if err := session.ValidateName(name); err != nil {
-		return err
-	}
-
-	// Get workdir from existing session or pane path
-	workdir, err := resolveWorkdir(name, store, tc)
+	name, workdir, err := resolveModeTarget(args, store, tc)
 	if err != nil {
 		return err
 	}
@@ -179,22 +285,13 @@ func runYoloBang(cmd *cobra.Command, args []string) error {
 		gitCheckpoint(workdir, out)
 	}
 
-	out.Magenta(">>> YOLO MODE")
-	{
-		intent := yoloIntent(store, name, workdir, "yolo")
-		fireHook("on_yolo", intent)
-		fireServeEvent("on_yolo", intent)
-	}
+	printBanner(out, "yolo")
+	fireLaunchEvents(store, name, workdir, "yolo")
 
-	if tc.HasSession(name) {
-		if err := tc.KillSession(name); err != nil {
-			out.Warn("could not kill existing session: %v", err)
-		}
-	}
-	if err := store.Delete(name); err != nil {
-		// ignore "not found" errors
-		_ = err
-	}
+	// `yolo!` forces fresh state unconditionally — store.Delete errors are
+	// swallowed (loud=false) because the historic behavior treated this as
+	// a best-effort reset.
+	tearDownForRecreate(name, store, tc, out, false)
 
 	return createAndAttach(name, workdir, "yolo", store, tc, out)
 }
@@ -211,47 +308,26 @@ func runSafe(cmd *cobra.Command, args []string) error {
 	store := session.NewStore(config.SessionsPath())
 	tc := tmux.NewClient(config.TmuxConfPath())
 
-	name := "claude"
-	if len(args) > 0 {
-		name = args[0]
-	}
-	if err := session.ValidateName(name); err != nil {
-		return err
-	}
-
-	// Get workdir from existing session or pane path
-	workdir, err := resolveWorkdir(name, store, tc)
+	name, workdir, err := resolveModeTarget(args, store, tc)
 	if err != nil {
 		return err
 	}
 
-	out.Success(">>> SAFE MODE")
-	{
-		intent := yoloIntent(store, name, workdir, "safe")
-		fireHook("on_safe", intent)
-		// Map "on_safe" to a serve session_attached — the hub doesn't
-		// model safe-mode separately, only the lifecycle transition.
-		fireServeEvent("session_attached", intent)
-	}
+	printBanner(out, "safe")
+	fireLaunchEvents(store, name, workdir, "safe")
 
 	// If session exists and mode matches → preflight. preflight handles both
 	// live tmux (plain reattach) and dead tmux (recreate with --resume UUID),
 	// so the session's claude history survives `claude` exiting on its own.
 	// Force-fresh escape hatches: `ctm kill <name>` / `ctm forget <name>`.
-	if sess, err := store.Get(name); err == nil {
-		if shouldResumeExisting(sess, "safe") {
-			out.Debug(Verbose, "existing safe session %q — running pre-flight", name)
-			return preflight(sess, cfg, store, tc, out)
-		}
-		// Mode change: drop tmux + store record so a fresh UUID is minted.
-		if tc.HasSession(name) {
-			if err := tc.KillSession(name); err != nil {
-				out.Warn("could not kill existing session: %v", err)
-			}
-		}
-		if err := store.Delete(name); err != nil {
-			_ = err
-		}
+	sess, getErr := store.Get(name)
+	switch decideModeAction(sess, getErr, "safe") {
+	case decisionResume:
+		out.Debug(Verbose, "existing safe session %q — running pre-flight", name)
+		return preflight(sess, cfg, store, tc, out)
+	case decisionRecreate:
+		// safe matches yolo's silent-on-delete-failure historical behavior.
+		tearDownForRecreate(name, store, tc, out, false)
 	}
 
 	return createAndAttach(name, workdir, "safe", store, tc, out)