diff --git a/workspace-server/internal/bundle/importer_test.go b/workspace-server/internal/bundle/importer_test.go
index 51c1c8f4e..a999aa380 100644
--- a/workspace-server/internal/bundle/importer_test.go
+++ b/workspace-server/internal/bundle/importer_test.go
@@ -76,6 +76,7 @@ func TestBuildBundleConfigFiles_Skills(t *testing.T) {
 			},
 		},
 	}
+	files := buildBundleConfigFiles(b)
 	// 2 skills × 1 file each = 2 files
 	if n := len(files); n != 2 {
 		t.Fatalf("skills: want 2 files, got %d", n)
diff --git a/workspace-server/internal/handlers/org_external.go b/workspace-server/internal/handlers/org_external.go
index c964782df..0bebe73c4 100644
--- a/workspace-server/internal/handlers/org_external.go
+++ b/workspace-server/internal/handlers/org_external.go
@@ -346,7 +346,7 @@ func (g *gitFetcher) Fetch(ctx context.Context, rootDir, host, repoPath, ref str
 	// MkdirTemp creates the dir; git clone refuses to clone into a
 	// non-empty dir. Remove + recreate empty.
 	os.RemoveAll(tmpDir)
-	cloneAndConfig := append(gitArgs("clone", "--quiet", "--depth=1", "-b", ref, cloneURL, tmpDir))
+	cloneAndConfig := gitArgs("clone", "--quiet", "--depth=1", "-b", ref, cloneURL, tmpDir)
 	cmd := exec.CommandContext(ctx, "git", cloneAndConfig...)
 	cmd.Env = append(os.Environ(), "GIT_TERMINAL_PROMPT=0")
 	if out, err := cmd.CombinedOutput(); err != nil {
diff --git a/workspace-server/internal/provisioner/localbuild_test.go b/workspace-server/internal/provisioner/localbuild_test.go
index 6bb717b1a..7882cfc13 100644
--- a/workspace-server/internal/provisioner/localbuild_test.go
+++ b/workspace-server/internal/provisioner/localbuild_test.go
@@ -24,7 +24,7 @@ func makeTestOpts(t *testing.T) *LocalBuildOptions {
 		RepoPrefix: "https://git.test/molecule-ai/molecule-ai-workspace-template-",
 		Platform:   "linux/amd64",
 		HTTPClient: &http.Client{},
-		preflightLocalBuild: func() error {
+		checkShellDeps: func() error {
 			return nil // tests bypass the real PATH check
 		},
 		remoteHeadSha: func(ctx context.Context, opts *LocalBuildOptions, runtime string) (string, error) {
@@ -46,10 +46,7 @@ func makeTestOpts(t *testing.T) *LocalBuildOptions {
 		dockerTag: func(ctx context.Context, src, dst string) error {
 			return nil
 		},
-		// Stub the shell-dep pre-flight so tests run without docker/git on PATH.
-		checkShellDeps: func() error {
-			return nil
-		},
+
 	}
 }
 
@@ -677,10 +674,10 @@ func TestProvisionerStartUsesLocalBuild_LocalMode(t *testing.T) {
 	// caught by this test.
 }
 
-// TestEnsureLocalImage_Hooks preflightLocalBuild — when preflight fails,
+// TestEnsureLocalImage_Hooks checkShellDeps — when preflight fails,
 func TestEnsureLocalImage_PreflightFailsIfDockerMissing(t *testing.T) {
 	opts := makeTestOpts(t)
-	opts.preflightLocalBuild = func() error {
+	opts.checkShellDeps = func() error {
 		return fmt.Errorf(
 			"local-build mode requires `docker` and `git` on PATH in the platform container; " +
 				"found: docker=<missing>, git=<missing>. " +
@@ -702,7 +699,7 @@ func TestEnsureLocalImage_PreflightFailsIfDockerMissing(t *testing.T) {
 // nil, execution proceeds normally.
 func TestEnsureLocalImage_PreflightOKPassesThrough(t *testing.T) {
 	opts := makeTestOpts(t)
-	opts.preflightLocalBuild = func() error { return nil }
+	opts.checkShellDeps = func() error { return nil }
 	tag, err := ensureLocalImageWithOpts(context.Background(), "claude-code", opts)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)