diff --git a/src/commands/send.test.ts b/src/commands/send.test.ts
index f4ee08f2a..158575f91 100644
--- a/src/commands/send.test.ts
+++ b/src/commands/send.test.ts
@@ -91,7 +91,7 @@ describe("sendCommand", () => {
 		);
 		expect(deps.sendMessageWeb).toHaveBeenCalled();
 		expect(runtime.log).toHaveBeenCalledWith(
-			expect.stringContaining("\"provider\": \"web\""),
+			expect.stringContaining('"provider": "web"'),
 		);
 	});
 
@@ -139,7 +139,7 @@ describe("sendCommand", () => {
 		});
 		expect(deps.waitForFinalStatus).not.toHaveBeenCalled();
 		expect(runtime.log).toHaveBeenCalledWith(
-			expect.stringContaining("\"provider\": \"twilio\""),
+			expect.stringContaining('"provider": "twilio"'),
 		);
 	});
 });
diff --git a/src/commands/status.test.ts b/src/commands/status.test.ts
index 088d88d03..4d5450ac1 100644
--- a/src/commands/status.test.ts
+++ b/src/commands/status.test.ts
@@ -5,7 +5,7 @@ import type { RuntimeEnv } from "../runtime.js";
 import { statusCommand } from "./status.js";
 
 vi.mock("../twilio/messages.js", () => ({
-	formatMessageLine: (m: any) => `LINE:${m.sid}`,
+	formatMessageLine: (m: { sid: string }) => `LINE:${m.sid}`,
 }));
 
 const runtime: RuntimeEnv = {
@@ -31,7 +31,7 @@ describe("statusCommand", () => {
 	});
 
 	it("prints JSON when requested", async () => {
-		(deps.listRecentMessages as any).mockResolvedValue([{ sid: "1" }]);
+		(deps.listRecentMessages as jest.Mock).mockResolvedValue([{ sid: "1" }]);
 		await statusCommand(
 			{ limit: "5", lookback: "10", json: true },
 			deps,
@@ -43,7 +43,7 @@ describe("statusCommand", () => {
 	});
 
 	it("prints formatted lines otherwise", async () => {
-		(deps.listRecentMessages as any).mockResolvedValue([{ sid: "123" }]);
+		(deps.listRecentMessages as jest.Mock).mockResolvedValue([{ sid: "123" }]);
 		await statusCommand({ limit: "1", lookback: "5" }, deps, runtime);
 		expect(runtime.log).toHaveBeenCalledWith("LINE:123");
 	});
diff --git a/src/commands/webhook.test.ts b/src/commands/webhook.test.ts
index 8105c4f69..2458f08df 100644
--- a/src/commands/webhook.test.ts
+++ b/src/commands/webhook.test.ts
@@ -28,7 +28,7 @@ describe("webhookCommand", () => {
 	it("logs dry run instead of starting server", async () => {
 		runtime.log.mockClear();
 		const res = await webhookCommand(
-			{ port: "42873", path: "/hook", reply: "dry-run" },
+			{ port: "42873", path: "/hook", reply: "dry-run", ingress: "none" },
 			deps,
 			runtime,
 		);
@@ -40,7 +40,13 @@ describe("webhookCommand", () => {
 
 	it("starts webhook when valid", async () => {
 		const res = await webhookCommand(
-			{ port: "42873", path: "/hook", reply: "ok", verbose: true },
+			{
+				port: "42873",
+				path: "/hook",
+				reply: "ok",
+				verbose: true,
+				ingress: "none",
+			},
 			deps,
 			runtime,
 		);
diff --git a/src/env.test.ts b/src/env.test.ts
index ad4f60f09..d70d66d44 100644
--- a/src/env.test.ts
+++ b/src/env.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { ensureTwilioEnv, readEnv } from "./env.js";
 import type { RuntimeEnv } from "./runtime.js";
@@ -17,8 +17,17 @@ describe("env helpers", () => {
 		}),
 	};
 
+	beforeEach(() => {
+		vi.clearAllMocks();
+		process.env = {};
+	});
+
 	function setEnv(vars: Record<string, string | undefined>) {
-		Object.assign(process.env, vars);
+		process.env = {};
+		for (const [k, v] of Object.entries(vars)) {
+			if (v === undefined) delete process.env[k];
+			else process.env[k] = v;
+		}
 	}
 
 	it("reads env with auth token", () => {
@@ -31,7 +40,11 @@ describe("env helpers", () => {
 		const cfg = readEnv(runtime);
 		expect(cfg.accountSid).toBe("AC123");
 		expect(cfg.whatsappFrom).toBe("whatsapp:+1555");
-		expect("authToken" in cfg.auth && cfg.auth.authToken).toBe("token");
+		if ("authToken" in cfg.auth) {
+			expect(cfg.auth.authToken).toBe("token");
+		} else {
+			throw new Error("Expected auth token");
+		}
 	});
 
 	it("reads env with API key/secret", () => {
@@ -42,8 +55,12 @@ describe("env helpers", () => {
 			TWILIO_API_SECRET: "secret",
 		});
 		const cfg = readEnv(runtime);
-		expect("apiKey" in cfg.auth && cfg.auth.apiKey).toBe("key");
-		expect("apiSecret" in cfg.auth && cfg.auth.apiSecret).toBe("secret");
+		if ("apiKey" in cfg.auth && "apiSecret" in cfg.auth) {
+			expect(cfg.auth.apiKey).toBe("key");
+			expect(cfg.auth.apiSecret).toBe("secret");
+		} else {
+			throw new Error("Expected API key/secret");
+		}
 	});
 
 	it("fails fast on invalid env", () => {
diff --git a/src/provider-web.ts b/src/provider-web.ts
index 818977fcf..47e5c2df2 100644
--- a/src/provider-web.ts
+++ b/src/provider-web.ts
@@ -65,7 +65,9 @@ export async function createWaSocket(printQr: boolean, verbose: boolean) {
 			if (connection === "close") {
 				const status = getStatusCode(lastDisconnect?.error);
 				if (status === DisconnectReason.loggedOut) {
-					console.error(danger("WhatsApp session logged out. Run: warelay login"));
+					console.error(
+						danger("WhatsApp session logged out. Run: warelay login"),
+					);
 				}
 			}
 			if (connection === "open" && verbose) {
diff --git a/src/providers/web/index.ts b/src/providers/web/index.ts
index 44aaba6d2..0b824568b 100644
--- a/src/providers/web/index.ts
+++ b/src/providers/web/index.ts
@@ -1,12 +1,13 @@
+/* istanbul ignore file */
 export {
 	createWaSocket,
-	waitForWaConnection,
-	sendMessageWeb,
 	loginWeb,
+	logWebSelfId,
 	monitorWebInbox,
 	monitorWebProvider,
-	webAuthExists,
-	logWebSelfId,
 	pickProvider,
+	sendMessageWeb,
 	WA_WEB_AUTH_DIR,
+	waitForWaConnection,
+	webAuthExists,
 } from "../../provider-web.js";
diff --git a/src/webhook/server.ts b/src/webhook/server.ts
index 11d9adf8c..5cd0a31fa 100644
--- a/src/webhook/server.ts
+++ b/src/webhook/server.ts
@@ -1,3 +1,4 @@
+/* istanbul ignore file */
 import { startWebhook } from "../twilio/webhook.js";
 
 // Thin wrapper to keep webhook server co-located with other webhook helpers.
diff --git a/src/webhook/update.ts b/src/webhook/update.ts
index 0935ed949..59911ab17 100644
--- a/src/webhook/update.ts
+++ b/src/webhook/update.ts
@@ -1,3 +1,4 @@
+/* istanbul ignore file */
 export {
 	findIncomingNumberSid,
 	findMessagingServiceSid,