app/comments.test.js

@@ -104,21 +104,21 @@ describe('formatFindingsStats', () => {
     { level: 'custom', is_new: true },
   ];
 
-  it('formats old and new findings by severity', () => {
+  it('formats old and new findings by severity with an unclassified column', () => {
     const stats = formatFindingsStats(statsFindings);
 
     assert.equal(stats, [
-      '| 類型 | 🔴 嚴重 | 🟡 警告 | 🔵 建議 |',
-      '| --- | --- | --- | --- |',
-      '| 舊問題 | 1 筆 | 0 筆 | 0 筆 |',
-      '| 新問題 | 0 筆 | 1 筆 | 1 筆 |',
+      '| 類型 | 🔴 嚴重 | 🟡 警告 | 🔵 建議 | ⚪ 無法標示 |',
+      '| --- | --- | --- | --- | --- |',
+      '| 新問題 | 0 筆 | 1 筆 | 1 筆 | 1 筆 |',
+      '| 舊問題 | 1 筆 | 0 筆 | 0 筆 | 0 筆 |',
     ].join('\n'));
   });
 
   it('formats compact one-line stats for action logs', () => {
     assert.equal(
       formatFindingsStatsLine(statsFindings),
-      '舊: 嚴重1 / 警告0 / 建議0；新: 嚴重0 / 警告1 / 建議1',
+      '新: 嚴重0 / 警告1 / 建議1 / 無法標示1；舊: 嚴重1 / 警告0 / 建議0 / 無法標示0',
     );
   });
 });

app/resolve.test.js

@@ -86,6 +86,13 @@ describe('codeWindow', () => {
   it('returns empty string for empty content', () => {
     assert.equal(codeWindow('', 10), '');
   });
+
+  it('handles out-of-range line numbers without throwing', () => {
+    const content = Array.from({ length: 10 }, (_, i) => `line${i + 1}`).join('\n');
+    assert.doesNotThrow(() => codeWindow(content, -5, 2));
+    assert.equal(codeWindow(content, 0, 1), '1: line1\n2: line2'); // 非正數行號 → 從開頭取窗
+    assert.equal(codeWindow(content, 9999, 2), ''); // 超過檔尾 → 空字串，不丟錯
+  });
 });
 
 describe('judgeConversationsResolved', () => {

app/usage.test.js

@@ -100,11 +100,11 @@ describe('fetchAccountQuota', () => {
     }
   });
 
-  it('accepts a real openrouter subdomain', async () => {
-    const get = async () => ({ data: { data: { usage: 1, limit: 10, limit_remaining: 9 } } });
-    const q = await fetchAccountQuota('openai', { apiKeys: ['k'], baseURL: 'https://api.openrouter.ai/api/v1' }, { get });
-    assert.equal(q.available, true);
-    assert.equal(q.source, 'openrouter');
+  it('only accepts the exact openrouter.ai apex host (subdomains are not OpenRouter)', async () => {
+    const get = async () => { throw new Error('should not be called for non-apex host'); };
+    const q = await fetchAccountQuota('openai', { apiKeys: ['sk-secret'], baseURL: 'https://api.openrouter.ai/api/v1' }, { get });
+    assert.equal(q.available, false);
+    assert.match(q.reason, /API key 無法取得/);
   });
 
   it('reports 不適用 for local platforms', async () => {