test: cover GitOps delete, CCM paired filters, and shrinkwrap validation

[cursor]

Description

Daily regression-test coverage run targeting recently merged high-risk paths on main (3.2.13).

Risky behavior now covered

• GitOps delete paramsSchema — gitops_agent.delete requires agent_id (not resource_id); account-scoped deletes omit org/project query params; gitops_application.delete cascade validation comes from bodyBuilder, not paramsSchema
• harness_delete → agent_id mapping — resource_id is forwarded to agent_id for gitops_agent deletes (tool-handler layer, not just registry dispatch)
• CCM paired-filter guard — cost_recommendation_count and cost_recommendation_stats omit costCategoryDTOs when only cost_category is provided without cost_buckets (prevents silent partial filtering)
• CCM count extractor — dispatch surfaces _error when API returns non-number data instead of silently returning { count: 0 }
• npm-shrinkwrap CI check (fix: secure adm-zip for npm consumers (CVE-2026-39244) #670) — extracted validateNpmShrinkwrapMetadata with tests for version drift, dependency mismatch, and insecure/missing hoisted adm-zip

Test files added/updated

• tests/registry/gitops.test.ts
• tests/registry/registry.test.ts
• tests/tools/tool-handlers.test.ts
• tests/scripts/adm-zip-security-lib.test.ts

Why these tests materially reduce regression risk

These paths sit on destructive operations (GitOps agent delete), financial data scoping (CCM cost category filters), and a CVE security gate (adm-zip shrinkwrap validation). A regression in any of them would either delete the wrong resource, return misleading cost counts, or ship a vulnerable npm consumer install — all without obvious runtime errors.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other — test coverage

Checklist

• pnpm test passes (398 tests in touched files)
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes
• pnpm docs:check passes

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}