test(ci): reconcile release/v3.8.30 baseline + test drift (#4276)

Reconcile baseline + test drift on release/v3.8.30 (complexity, opaque surface, search count, tproxy addon). Round-robin left as a canary for the undici-dispatcher issue.

tests/integration/integration-wiring.test.ts

@@ -284,7 +284,11 @@ describe("API Routes — dashboard and tool consumers", () => {
     assert.match(globals, /--color-card:\s+#ffffff/);
     assert.match(globals, /--color-card:\s+#161b22/);
     assert.match(globals, /--color-card:\s+var\(--color-card\)/);
-    assert.match(requestLogger, /bg-black\/5 dark:bg-black\/20/);
+    // #4233 ("opaque tables D9") replaced the bg-black/5 tint — which lost to
+    // bg-surface via tailwind-merge — with the opaque bg-surface theme color.
+    // The intent here (request log surface stays opaque over theme colors) is now
+    // expressed by bg-surface itself.
+    assert.match(requestLogger, /bg-surface/);
     assert.doesNotMatch(requestLogger, /\/api\/logs\/active/);
   });
 

tests/integration/search-providers-catalog.test.ts

@@ -2,7 +2,7 @@
  * Integration tests for GET /api/search/providers — extended catalog (F4).
  *
  * Tests:
- * - Returns 15 items total (12 search + 3 fetch providers).
+ * - Returns 16 items total (13 search + 3 fetch providers).
  * - Each item carries the correct `kind` field.
  * - Status reflects actual DB credential state:
  *   - "configured"  when an active, non-rate-limited connection exists.
@@ -50,7 +50,10 @@ const route = await import("../../src/app/api/search/providers/route.ts");
 // Constants
 // ---------------------------------------------------------------------------
 
-const EXPECTED_SEARCH_COUNT = 12;
+// 13 search-kind providers: serper, brave, perplexity, exa, tavily, google-pse,
+// linkup, searchapi, youcom, searxng, ollama, zai + duckduckgo-free (added in the
+// v3.8.27 cycle, registry open-sse/config/searchRegistry.ts).
+const EXPECTED_SEARCH_COUNT = 13;
 const EXPECTED_FETCH_COUNT = 3;
 const EXPECTED_TOTAL = EXPECTED_SEARCH_COUNT + EXPECTED_FETCH_COUNT;
 
@@ -137,7 +140,7 @@ test("search-providers-catalog: returns 401 for unauthenticated requests when au
   assert.ok(!bodyStr.includes(" at /"), "error body must not contain stack trace");
 });
 
-test("search-providers-catalog: returns 15 providers (12 search + 3 fetch)", async () => {
+test("search-providers-catalog: returns 16 providers (13 search + 3 fetch)", async () => {
   const req = await buildAuthRequest();
   const res = await route.GET(req);
 

tests/unit/tproxy-transparent-socket.test.ts

@@ -113,15 +113,28 @@ test("loadTransparentAddon loads the addon from the cwd-relative standalone path
   assert.equal(addon, fake);
 });
 
-test("isTransparentSocketAvailable returns a boolean (false in CI — addon not built)", () => {
+// The native addon is built CONDITIONALLY (prebuilds — #4236), so its presence is
+// environment-dependent: absent on a JS-only install, present on runners where the
+// prebuilt .node loads (e.g. the Node-compat CI jobs). These tests must hold in both
+// states: when absent, the helpers throw the actionable "not available" guard; when
+// present, the call reaches the OS and throws a runtime error (no CAP_NET_ADMIN /
+// TPROXY privileges in CI) — still throwing, just not the guard message.
+test("isTransparentSocketAvailable returns a boolean (addon presence is environment-dependent)", () => {
   assert.equal(typeof isTransparentSocketAvailable(), "boolean");
-  assert.equal(isTransparentSocketAvailable(), false);
 });
 
-test("createTransparentListenerFd throws a clear, actionable error when unavailable", () => {
-  assert.throws(() => createTransparentListenerFd("0.0.0.0", 8443), /not available|Linux|build/i);
+test("createTransparentListenerFd throws when unavailable (guard) or when present without privileges (OS error)", () => {
+  if (isTransparentSocketAvailable()) {
+    assert.throws(() => createTransparentListenerFd("0.0.0.0", 8443));
+  } else {
+    assert.throws(() => createTransparentListenerFd("0.0.0.0", 8443), /not available|Linux|build/i);
+  }
 });
 
-test("setSocketMark throws when the addon is unavailable", () => {
-  assert.throws(() => setSocketMark(7, 0x539), /not available/i);
+test("setSocketMark throws when unavailable (guard) or when present without privileges (OS error)", () => {
+  if (isTransparentSocketAvailable()) {
+    assert.throws(() => setSocketMark(7, 0x539));
+  } else {
+    assert.throws(() => setSocketMark(7, 0x539), /not available/i);
+  }
 });