Test npipe URL parsing and discovery health

TestParseNamedPipeURL covers the success case plus every
rejection branch (missing scheme, wrong scheme, empty name,
forward slash, backslash, ".."). A non-Windows guard test
asserts CheckHealth("npipe://...") surfaces a clear "Windows"
error rather than a misleading dial syscall failure.

The Windows-only health_windows_test.go spins up a winio
listener with an http.Server.Serve goroutine and asserts
CheckHealth("npipe://<name>", expectedNonce) succeeds with a
matching nonce, plus a not-found case that expects "health
check failed". An atomic counter disambiguates parallel pipe
names, since the Windows pipe namespace is global.

Author: samuv

pkg/server/discovery/health_test.go

@@ -10,6 +10,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -44,6 +45,49 @@ func TestParseUnixSocketPath_Empty(t *testing.T) {
 	assert.Contains(t, err.Error(), "empty")
 }
 
+func TestParseNamedPipeURL(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		raw       string
+		expect    string
+		wantErr   bool
+		errSubstr string
+	}{
+		{name: "valid", raw: "npipe://thv-api", expect: `\\.\pipe\thv-api`},
+		{name: "valid with hyphen and digits", raw: "npipe://thv-api-1", expect: `\\.\pipe\thv-api-1`},
+		{name: "missing scheme", raw: "thv-api", wantErr: true, errSubstr: "must start with npipe://"},
+		{name: "wrong scheme", raw: "unix://thv-api", wantErr: true, errSubstr: "must start with npipe://"},
+		{name: "empty name", raw: "npipe://", wantErr: true, errSubstr: "empty"},
+		{name: "forward slash", raw: "npipe://thv/api", wantErr: true, errSubstr: "path separators"},
+		{name: "backslash", raw: `npipe://thv\api`, wantErr: true, errSubstr: "path separators"},
+		{name: "dot dot", raw: "npipe://..thv", wantErr: true, errSubstr: "'..'"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := ParseNamedPipeURL(tt.raw)
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errSubstr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.expect, got)
+		})
+	}
+}
+
+func TestCheckHealth_NamedPipe_Unsupported_OnNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("non-Windows guard test")
+	}
+	t.Parallel()
+	err := CheckHealth(context.Background(), "npipe://thv-api", "")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "Windows")
+}
+
 func TestCheckHealth_TCP_Success(t *testing.T) {
 	t.Parallel()
 	expectedNonce := "test-nonce-123"

pkg/server/discovery/health_windows_test.go

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: Copyright 2025 Stacklok, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build windows
+
+package discovery
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"github.com/Microsoft/go-winio"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// pipeNameSeq disambiguates concurrent test pipes so parallel runs don't
+// collide on the global pipe namespace.
+var pipeNameSeq atomic.Uint64
+
+func TestCheckHealth_NamedPipe_Success(t *testing.T) {
+	t.Parallel()
+
+	pipeName := fmt.Sprintf("thv-test-%d", pipeNameSeq.Add(1))
+	pipePath := `\\.\pipe\` + pipeName
+
+	listener, err := winio.ListenPipe(pipePath, &winio.PipeConfig{})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	expectedNonce := "pipe-nonce"
+	mux := http.NewServeMux()
+	mux.HandleFunc("/health", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set(NonceHeader, expectedNonce)
+		w.WriteHeader(http.StatusNoContent)
+	})
+	srv := &http.Server{Handler: mux} //nolint:gosec // test server, ReadHeaderTimeout not relevant
+	go func() { _ = srv.Serve(listener) }()
+	t.Cleanup(func() { _ = srv.Close() })
+
+	err = CheckHealth(context.Background(), "npipe://"+pipeName, expectedNonce)
+	require.NoError(t, err)
+}
+
+func TestCheckHealth_NamedPipe_NotFound(t *testing.T) {
+	t.Parallel()
+	err := CheckHealth(context.Background(), "npipe://nonexistent-pipe-thv-test", "")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "health check failed")
+}