CDP-5980: replace nyc with c8 for code coverage

[senechko]

Stacked on #207 — merge that first.

Summary

• Replace nyc with c8 for code coverage — c8 uses V8's native coverage engine instead of Istanbul instrumentation
• Keep ts-node (not switching to tsx) — tsx/esbuild injects helper functions (__name, __export, __copyProps, etc.) that create phantom uncovered branches in V8 coverage, dropping branch coverage to 93% on identical tests
• One c8 ignore pragma on an empty catch body that V8 cannot instrument (the catch is executed by tests, but V8 has no statements to mark as covered)
• New test exercising the redirect-with-unparseable-URL catch path

What changed

File	Change
package.json	nyc → c8 in devDeps and test script; "nyc" config → "c8" config with all: true, src: ["lib"]
lib/request.ts	/* c8 ignore next 2 */ on empty catch block; dropped unused err binding
test/request.ts	Added test for redirect with malformed Location URL

Why not tsx?

The original plan was to pair c8+tsx (replacing nyc+ts-node). Testing showed tsx is the root cause of the phantom branches reported during the TS6 upgrade attempt:

Setup	Branches	Lines	Functions
nyc + ts-node	100%	100%	100%
c8 + tsx	93.4%	99.8%	99.2%
c8 + ts-node	100%	100%	100%

tsx uses esbuild to transpile, which injects runtime helpers and compiles enums to IIFEs with different branch structure than tsc. V8 coverage counts those as uncovered branches.

Test plan

• npm test — 163 tests pass, 100% coverage (statements, branches, functions, lines)
• npm run lint — clean
• CI passes

🤖 Generated with Claude Code

---

Note

Low Risk
Dev-only coverage tooling and a test plus empty-catch annotation; redirect auth-stripping behavior is unchanged.

Overview
Swaps nyc for c8 (V8-native coverage) while keeping ts-node for tests so coverage stays at 100% branches. The test script runs c8 ava; package.json adds a c8 block (all, lib as source) and drops nyc. Lockfile churn reflects removing Istanbul/nyc’s dependency tree and adding c8; an overrides entry bumps yargs for transitive CLI deps.

In lib/request.ts, redirect header handling is unchanged except the malformed-URL path uses an empty catch {} with a c8 ignore comment (V8 can’t mark an empty catch as covered). A new test asserts a redirect with a relative Location rejects with TypeError.

^{Reviewed by Cursor Bugbot for commit cd569af. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	c8@​11.0.0

View full report