fix(test): the sweep's two integration reds — one real, one my own guard

[LMPrado-DZ23]

The first full-CI verdict this release line has ever produced came back red. Unit ×4 and vitest green; both integration shards failed. Both were worth having.

Real — a live call to a third party on every run

tests/integration/api-routes-critical.test.ts was making a live HTTPS request to aihorde.net (3 attempts, counting the retry). GET /api/v1/models refreshes the AI Horde image catalog whenever aihorde is active — and it is active by default, because a no-auth provider has no connection row to switch off.

aiHordeImageCatalog exposes setFetch for exactly this case; the test now injects a stub. The route's own catch keeps the last good snapshot, so an empty worker list changes none of the assertions.

False positive — and it was mine

tests/integration/api-keys.test.ts sets CLOUD_URL to http://cloud.example on purpose, so the cloud-sync branch is taken and fails. cloud.example is reserved by RFC 2606 / RFC 6761: there is no delegation for it anywhere, so it cannot reach a host. The guard I added in #56 counted it as "the suite reached the network" and failed a file that never left the machine.

My first fix for that was wrong, and three existing guard tests caught it. I exempted reserved names from being blocked, which let the connection through to a real DNS lookup — more network activity, not less.

Blocking and counting are two decisions. A reserved name is now still refused, and only the counting changes. The log line says which case it was, so nobody later mistakes one for the other.

This is not a hole: the exemption is not "hosts a test asked for", it is "names that by standard resolve to nothing" — a provider smuggled in under .test would be just as unreachable. A test asserts the exemption does not reach aihorde.net, api.openai.com, example.com, or a literal IP.

Also: the shards now upload their gate logs

Without _artifacts/release-green/, a red shard reports only its first failure line and the assertion dies with the runner. That is why both of these had to be reproduced locally before they could be read at all.

Check	Result
api-keys + api-routes-critical	25/25, 0 guard violations
block-network-guard + block-network-wiring	20/20
before	15 attempts to cloud.example:80, 3 to aihorde.net:443
after	0 counted, 0 to aihorde.net

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5b331d32-ae5e-4a43-bc3f-c5521581cb0a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}