ci: add test coverage reporting with Vitest

[kannupriyakalra]

Summary

• Installs @vitest/coverage-v8 as a dev dependency
• Configures coverage in vitest.config.ts with text, json, and html reporters
• Adds npm run test:coverage script to package.json
• Updates .github/workflows/ci.yml to generate coverage on every CI run and upload the HTML report as a downloadable artifact (Node 20.x, retained 7 days)

Closes #35

Coverage output (local run)

-------------------|---------|----------|---------|---------|
File               | % Stmts | % Branch | % Funcs | % Lines |
-------------------|---------|----------|---------|---------|
All files          |   40.1  |   35.34  |   37.97 |  42.85  |
 claude-sessions   |   90.82 |   78.57  |    100  |  96.8   |
 cli-tokens.tsx    |   21.62 |   36.58  |   4.54  |  19.67  |
 search.ts         |   84.84 |   66.66  |   90.9  |  91.86  |
 sessions.ts       |    0.2  |     0    |     0   |   0.24  |
 token-usage.ts    |   55.4  |   46.78  |   53.84 |  57.21  |
 vscode-sessions   |   45.53 |   46.03  |   37.5  |  48.22  |
-------------------|---------|----------|---------|---------|

This immediately surfaces gaps — notably sessions.ts at 0.2% coverage — giving contributors clear targets for future test improvements.

Test plan

• npm run test:coverage runs locally — 7 files, 114 tests, coverage report generated in coverage/
• CI generates coverage report and uploads artifact on this PR

🤖 Generated with Claude Code

[kannupriyakalra]

Verification Report

Verdict: ✅ PASS

Method: Ran npm run test:coverage locally, inspected CI logs and artifact via gh.

Steps

1. ✅ Diff is correct — 4 files changed: ci.yml (new), package.json (+1 script, +1 dep), vitest.config.ts (+5 lines coverage block), package-lock.json. No unexpected changes.
2. ✅ npm run test:coverage locally — 7 files, 114 tests pass, text coverage table printed, coverage/ directory generated with index.html, per-file .html reports, and coverage-final.json.
3. 🔍 npm test does not generate coverage — ran npm test after deleting coverage/, confirmed the directory was not recreated. The two commands are correctly independent.
4. ✅ coverage/ is gitignored — confirmed in .gitignore. The generated report will never be accidentally committed.
5. ✅ CI passed on both Node 20.x and 22.x — both matrix jobs show SUCCESS, completed in ~18s.
6. ✅ Coverage artifact uploaded — coverage-report artifact (124 KB) confirmed in the CI run, uploaded by the Node 20.x job only (as intended by the if: matrix.node-version == '20.x' condition).

Coverage output (local)

-------------------|---------|----------|---------|---------|-------------------
File               | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s
-------------------|---------|----------|---------|---------|-------------------
All files          |    40.1 |    35.34 |   37.97 |   42.85 |
 claude-sessions   |   90.82 |    78.57 |    100  |   96.8  | 113,124,367,378
 cli-tokens.tsx    |   21.62 |    36.58 |   4.54  |   19.67 | 10-167,212-225
 search.ts         |   84.84 |    66.66 |   90.9  |   91.86 | 40,45,105,184-189
 sessions.ts       |    0.2  |     0    |    0    |    0.24 | 64-157,163-909
 token-usage.ts    |   55.4  |    46.78 |   53.84 |   57.21 | 267-374,444-474
 vscode-sessions   |   45.53 |    46.03 |   37.5  |   48.22 | 238-322,341-417
-------------------|---------|----------|---------|---------|-------------------

sessions.ts at 0.2% is immediately visible — validates the goal of surfacing untested modules.

Finding

⚠️ Node.js 20 actions deprecation warning in CI — GitHub is deprecating Node.js 20-based actions and will force Node.js 24 starting June 16, 2026. The warning hits actions/checkout@v4, actions/setup-node@v4, and actions/upload-artifact@v4. Setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true in the workflow or bumping to the latest @v4 patch would silence this before it becomes a hard failure. Not a blocker for this PR but worth a follow-up.

[pavanvamsi3]

Conflicts

[kannupriyakalra]

@pavanvamsi3 The merge conflicts have been resolved — rebased onto main, keeping the permissions: contents: read block and the coverage steps together. PR is clean and mergeable now. Could you take another look?