@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/src/api.smoke.test.ts

@@ -0,0 +1,1225 @@
+/**
+ * agent/src/api.smoke.test.ts
+ * Smoke tests for the Hono runtime API — GET /:id/config and GET /:id/crons.
+ * Routes are registered without the /agents prefix because the sub-app is
+ * mounted via root.route("/agents", runtimeApp) — Hono v4 strips the prefix
+ * before dispatching, so root-level paths are /agents/:id/config etc.
+ * Uses injected mocks — no real DB or encryption needed.
+ *
+ * Auth: routes are now protected by the same admin-key/per-agent-token/cookie
+ * auth as the CRUD routes (SHIPWRIGHT_INTERNAL_API_KEY removed, UNI-1.2).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { Hono } from "hono";
+import type { AgentCronJob } from "./agent-cron-jobs.ts";
+import type { AgentEnvBundle } from "./agent-envs.ts";
+import { NoopAgentProvisioner } from "./agent-provisioner.ts";
+import { createAdminApp, parseAdminApiKeys } from "./agents-api.ts";
+import { createAgentRuntimeApp } from "./api.ts";
+
+// ─── Mock types ───────────────────────────────────────────────────────────────
+
+interface MockPlugin {
+  id: string;
+  agentId: string;
+  name: string;
+  version: string | null;
+  enabled: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+interface MockAgent {
+  id: string;
+  name: string;
+  repos: string[];
+  reviewAuthorAllowlist: string[];
+  patchAuthorAllowlist: string[];
+  restrictSlackToMembers: boolean;
+  memberEmails: string[];
+  accountStatus?: string | null;
+  selfHosted?: boolean;
+  // APM-1.5: the 6 agent-policy fields passed through by GET /:id/config.
+  autoPostReviews: boolean;
+  allowSelfReview: boolean;
+  minConfidence: number;
+  maxFindings: number;
+  cleanupMergedWorktrees: boolean;
+  cleanupAfterDays: number;
+}
+
+// ─── Mock factories ───────────────────────────────────────────────────────────
+
+function makeMockAgentEnvService(bundles: Map<string, AgentEnvBundle | null>): {
+  getConfigBundle: (id: string) => Promise<AgentEnvBundle | null>;
+} {
+  return {
+    async getConfigBundle(id: string): Promise<AgentEnvBundle | null> {
+      if (!bundles.has(id)) return null;
+      return bundles.get(id) ?? null;
+    },
+  };
+}
+
+function makeMockAgentCronJobService(crons: Map<string, AgentCronJob[]>): {
+  list: (id: string) => Promise<AgentCronJob[]>;
+  listWithRunSummary: (
+    id: string,
+  ) => Promise<(AgentCronJob & { lastRun: null; runCountToday: number })[]>;
+} {
+  return {
+    async list(id: string): Promise<AgentCronJob[]> {
+      return crons.get(id) ?? [];
+    },
+    async listWithRunSummary(
+      id: string,
+    ): Promise<(AgentCronJob & { lastRun: null; runCountToday: number })[]> {
+      const items = crons.get(id) ?? [];
+      return items.map((item) => ({
+        ...item,
+        lastRun: null,
+        runCountToday: 0,
+      }));
+    },
+  };
+}
+
+function makeMockAgentService(agents: Map<string, MockAgent>): {
+  getById: (agentId: string) => Promise<{
+    id: string;
+    repos: string[];
+    reviewAuthorAllowlist: string[];
+    patchAuthorAllowlist: string[];
+    restrictSlackToMembers: boolean;
+    memberEmails: string[];
+    accountStatus?: string | null;
+    selfHosted?: boolean;
+    autoPostReviews: boolean;
+    allowSelfReview: boolean;
+    minConfidence: number;
+    maxFindings: number;
+    cleanupMergedWorktrees: boolean;
+    cleanupAfterDays: number;
+  } | null>;
+} {
+  return {
+    async getById(agentId: string): Promise<{
+      id: string;
+      repos: string[];
+      reviewAuthorAllowlist: string[];
+      patchAuthorAllowlist: string[];
+      restrictSlackToMembers: boolean;
+      memberEmails: string[];
+      accountStatus?: string | null;
+      selfHosted?: boolean;
+      autoPostReviews: boolean;
+      allowSelfReview: boolean;
+      minConfidence: number;
+      maxFindings: number;
+      cleanupMergedWorktrees: boolean;
+      cleanupAfterDays: number;
+    } | null> {
+      const agent = agents.get(agentId);
+      return agent
+        ? {
+            id: agent.id,
+            repos: agent.repos,
+            reviewAuthorAllowlist: agent.reviewAuthorAllowlist,
+            patchAuthorAllowlist: agent.patchAuthorAllowlist,
+            restrictSlackToMembers: agent.restrictSlackToMembers,
+            memberEmails: agent.memberEmails,
+            accountStatus: agent.accountStatus,
+            selfHosted: agent.selfHosted,
+            autoPostReviews: agent.autoPostReviews,
+            allowSelfReview: agent.allowSelfReview,
+            minConfidence: agent.minConfidence,
+            maxFindings: agent.maxFindings,
+            cleanupMergedWorktrees: agent.cleanupMergedWorktrees,
+            cleanupAfterDays: agent.cleanupAfterDays,
+          }
+        : null;
+    },
+  };
+}
+
+function makeMockAgentPluginService(plugins: Map<string, MockPlugin[]>): {
+  listEnabled: (agentId: string) => Promise<MockPlugin[]>;
+} {
+  return {
+    async listEnabled(agentId: string): Promise<MockPlugin[]> {
+      return (plugins.get(agentId) ?? []).filter((p) => p.enabled);
+    },
+  };
+}
+
+interface MockPhaseMethodology {
+  phase: string;
+  subagentType: string | null;
+}
+
+function makeMockAgentPhaseMethodologyService(
+  overrides: Map<string, MockPhaseMethodology[]>,
+): {
+  list: (agentId: string) => Promise<MockPhaseMethodology[]>;
+} {
+  return {
+    async list(agentId: string): Promise<MockPhaseMethodology[]> {
+      return overrides.get(agentId) ?? [];
+    },
+  };
+}
+
+// ─── Test data helpers ────────────────────────────────────────────────────────
+
+const KNOWN_AGENT_ID = "agent-123";
+const UNKNOWN_AGENT_ID = "agent-999";
+const VALID_ADMIN_KEY = "test-admin-key";
+const SESSION_SECRET = "test-session-secret-32bytes!!!!";
+
+function makeDate(offset = 0): Date {
+  return new Date(Date.now() + offset);
+}
+
+function makePlugin(agentId: string, name: string): MockPlugin {
+  return {
+    id: `plugin-${name}`,
+    agentId,
+    name,
+    version: null,
+    enabled: true,
+    createdAt: makeDate(),
+    updatedAt: makeDate(),
+  };
+}
+
+function makeCron(agentId: string, id: string): AgentCronJob {
+  return {
+    id,
+    agentId,
+    schedule: "0 9 * * *",
+    prompt: "Good morning",
+    channel: "C123",
+    user: null,
+    silent: false,
+    enabled: true,
+    preCheck: null,
+    name: null,
+    system: false,
+    parentCronId: null,
+    lockdownDisabledAt: null,
+    createdAt: makeDate(),
+    updatedAt: makeDate(),
+  };
+}
+
+// ─── Shared setup ─────────────────────────────────────────────────────────────
+
+function buildApp(opts?: {
+  hasAgent?: boolean;
+  bundleOrNull?: AgentEnvBundle | null;
+  plugins?: MockPlugin[];
+  crons?: AgentCronJob[];
+  repos?: string[];
+  reviewAuthorAllowlist?: string[];
+  patchAuthorAllowlist?: string[];
+  restrictSlackToMembers?: boolean;
+  memberEmails?: string[];
+  accountStatus?: string | null;
+  selfHosted?: boolean;
+  anthropicFederationEnabled?: boolean;
+  phaseMethodology?: MockPhaseMethodology[];
+  omitPhaseMethodologyService?: boolean;
+  autoPostReviews?: boolean;
+  allowSelfReview?: boolean;
+  minConfidence?: number;
+  maxFindings?: number;
+  cleanupMergedWorktrees?: boolean;
+  cleanupAfterDays?: number;
+}) {
+  const hasAgent = opts?.hasAgent ?? true;
+  const bundle: AgentEnvBundle | null =
+    opts?.bundleOrNull !== undefined
+      ? opts.bundleOrNull
+      : {
+          agentId: KNOWN_AGENT_ID,
+          env: { SLACK_BOT_TOKEN: "xoxb-secret", ANTHROPIC_API_KEY: "sk-ant" },
+          allowedTools: ["Read", "Write", "Bash"],
+        };
+  const plugins = opts?.plugins ?? [
+    makePlugin(KNOWN_AGENT_ID, "shipwright@shipwright"),
+  ];
+  const crons = opts?.crons ?? [makeCron(KNOWN_AGENT_ID, "cron-1")];
+  const repos = opts?.repos ?? ["org/repo1", "org/repo2"];
+  const reviewAuthorAllowlist = opts?.reviewAuthorAllowlist ?? [];
+  const patchAuthorAllowlist = opts?.patchAuthorAllowlist ?? [];
+  const restrictSlackToMembers = opts?.restrictSlackToMembers ?? false;
+  const memberEmails = opts?.memberEmails ?? [];
+  const phaseMethodology = opts?.phaseMethodology ?? [];
+  const autoPostReviews = opts?.autoPostReviews ?? true;
+  const allowSelfReview = opts?.allowSelfReview ?? false;
+  const minConfidence = opts?.minConfidence ?? 75;
+  const maxFindings = opts?.maxFindings ?? 5;
+  const cleanupMergedWorktrees = opts?.cleanupMergedWorktrees ?? true;
+  const cleanupAfterDays = opts?.cleanupAfterDays ?? 14;
+
+  const agents = new Map<string, MockAgent>();
+  const bundles = new Map<string, AgentEnvBundle | null>();
+  const pluginMap = new Map<string, MockPlugin[]>();
+  const cronMap = new Map<string, AgentCronJob[]>();
+  const phaseMethodologyMap = new Map<string, MockPhaseMethodology[]>();
+
+  if (hasAgent) {
+    agents.set(KNOWN_AGENT_ID, {
+      id: KNOWN_AGENT_ID,
+      name: "Test Agent",
+      repos,
+      reviewAuthorAllowlist,
+      patchAuthorAllowlist,
+      restrictSlackToMembers,
+      memberEmails,
+      accountStatus: opts?.accountStatus,
+      selfHosted: opts?.selfHosted,
+      autoPostReviews,
+      allowSelfReview,
+      minConfidence,
+      maxFindings,
+      cleanupMergedWorktrees,
+      cleanupAfterDays,
+    });
+    bundles.set(KNOWN_AGENT_ID, bundle);
+    pluginMap.set(KNOWN_AGENT_ID, plugins);
+    cronMap.set(KNOWN_AGENT_ID, crons);
+    phaseMethodologyMap.set(KNOWN_AGENT_ID, phaseMethodology);
+  }
+
+  return createAgentRuntimeApp({
+    agentEnvService: makeMockAgentEnvService(bundles),
+    agentCronJobService: makeMockAgentCronJobService(cronMap),
+    agentService: makeMockAgentService(agents),
+    agentPluginService: makeMockAgentPluginService(pluginMap),
+    ...(opts?.omitPhaseMethodologyService
+      ? {}
+      : {
+          agentPhaseMethodologyService:
+            makeMockAgentPhaseMethodologyService(phaseMethodologyMap),
+        }),
+    adminApiKeys: parseAdminApiKeys(`admin:${VALID_ADMIN_KEY}:*`),
+    agentTokenService: { validate: async () => null },
+    sessionSecret: SESSION_SECRET,
+    anthropicFederationEnabled: opts?.anthropicFederationEnabled,
+  });
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("GET /:id/config with no phase-methodology service (platform only)", () => {
+  test("200 and omits phaseMethodology", async () => {
+    const app = buildApp({ omitPhaseMethodologyService: true });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect("phaseMethodology" in body).toBe(false);
+    expect(body.repos).toEqual(["org/repo1", "org/repo2"]);
+  });
+});
+
+describe("GET /:id/config (mounted as GET /agents/:id/config from root)", () => {
+  test("200 with full bundle when agent exists with env vars, tools, plugins", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.env).toEqual({
+      SLACK_BOT_TOKEN: "xoxb-secret",
+      ANTHROPIC_API_KEY: "sk-ant",
+    });
+    expect(body.allowedTools).toEqual(["Read", "Write", "Bash"]);
+    expect(body.plugins).toEqual([
+      { marketplace: "shipwright", plugin: "shipwright" },
+    ]);
+    expect(body.repos).toEqual(["org/repo1", "org/repo2"]);
+    expect(body.phaseMethodology).toEqual({
+      prd: null,
+      "plan-session": null,
+      review: null,
+      patch: null,
+      deploy: null,
+      "dev-task": null,
+    });
+    // APM-1.5: additive fields, default values — no behavior change for
+    // existing consumers of this route.
+    expect(body.autoPostReviews).toBe(true);
+    expect(body.allowSelfReview).toBe(false);
+    expect(body.minConfidence).toBe(75);
+    expect(body.maxFindings).toBe(5);
+    expect(body.cleanupMergedWorktrees).toBe(true);
+    expect(body.cleanupAfterDays).toBe(14);
+  });
+
+  test("200 returns the 6 agent-policy fields exactly as stored on the agent (APM-1.5)", async () => {
+    const app = buildApp({
+      autoPostReviews: false,
+      allowSelfReview: true,
+      minConfidence: 90,
+      maxFindings: 12,
+      cleanupMergedWorktrees: false,
+      cleanupAfterDays: 30,
+    });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.autoPostReviews).toBe(false);
+    expect(body.allowSelfReview).toBe(true);
+    expect(body.minConfidence).toBe(90);
+    expect(body.maxFindings).toBe(12);
+    expect(body.cleanupMergedWorktrees).toBe(false);
+    expect(body.cleanupAfterDays).toBe(30);
+  });
+
+  test("200 returns accountStatus null when the agent has no account", async () => {
+    const app = buildApp({});
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+    expect(res.status).toBe(200);
+    expect((await res.json()).accountStatus).toBeNull();
+  });
+
+  test("200 returns accountStatus exactly as stored on the owning account", async () => {
+    const app = buildApp({ accountStatus: "suspended" });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+    expect(res.status).toBe(200);
+    expect((await res.json()).accountStatus).toBe("suspended");
+  });
+
+  test("200 phaseMethodology defaults all six phases to null when the agent has no overrides", async () => {
+    const app = buildApp({ phaseMethodology: [] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.phaseMethodology).toEqual({
+      prd: null,
+      "plan-session": null,
+      review: null,
+      patch: null,
+      deploy: null,
+      "dev-task": null,
+    });
+  });
+
+  test("200 phaseMethodology reflects an override while leaving other phases null", async () => {
+    const app = buildApp({
+      phaseMethodology: [
+        { phase: "review", subagentType: "shipwright:code-reviewer" },
+      ],
+    });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.phaseMethodology).toEqual({
+      prd: null,
+      "plan-session": null,
+      review: "shipwright:code-reviewer",
+      patch: null,
+      deploy: null,
+      "dev-task": null,
+    });
+  });
+
+  test("200 returns repos exactly as stored on the agent, including empty", async () => {
+    const app = buildApp({ repos: [] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.repos).toEqual([]);
+  });
+
+  test("200 returns reviewAuthorAllowlist exactly as stored on the agent", async () => {
+    const app = buildApp({ reviewAuthorAllowlist: ["octocat", "hubot"] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.reviewAuthorAllowlist).toEqual(["octocat", "hubot"]);
+  });
+
+  test("200 returns reviewAuthorAllowlist as an empty array when the agent has none", async () => {
+    const app = buildApp({ reviewAuthorAllowlist: [] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.reviewAuthorAllowlist).toEqual([]);
+  });
+
+  // DBR-2.4 regression: the legacy field must be gone for good.
+  test("200 config bundle does not include the removed authorAllowlist field", async () => {
+    const app = buildApp({ reviewAuthorAllowlist: ["octocat"] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).not.toHaveProperty("authorAllowlist");
+  });
+
+  test("200 returns restrictSlackToMembers and memberEmails exactly as stored on the agent", async () => {
+    const app = buildApp({
+      restrictSlackToMembers: true,
+      memberEmails: ["dev@example.com", "ops@example.com"],
+    });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.restrictSlackToMembers).toBe(true);
+    expect(body.memberEmails).toEqual(["dev@example.com", "ops@example.com"]);
+  });
+
+  test("200 returns restrictSlackToMembers false and memberEmails empty when the agent has no members", async () => {
+    const app = buildApp({ restrictSlackToMembers: false, memberEmails: [] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.restrictSlackToMembers).toBe(false);
+    expect(body.memberEmails).toEqual([]);
+  });
+
+  test("parses the canonical plugin@marketplace spec, defaulting bare names to shipwright", async () => {
+    const app = buildApp({
+      plugins: [
+        makePlugin(KNOWN_AGENT_ID, "time-tracker@acme"),
+        makePlugin(KNOWN_AGENT_ID, "shipwright@shipwright"),
+        makePlugin(KNOWN_AGENT_ID, "unscoped-plugin"),
+        makePlugin(KNOWN_AGENT_ID, "my-plugin@org/my-marketplace"),
+      ],
+    });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.plugins).toEqual([
+      { marketplace: "acme", plugin: "time-tracker" },
+      { marketplace: "shipwright", plugin: "shipwright" },
+      { marketplace: "shipwright", plugin: "unscoped-plugin" },
+      // Splits on the first "@" so a marketplace can itself contain a "/".
+      { marketplace: "org/my-marketplace", plugin: "my-plugin" },
+    ]);
+  });
+
+  test("200 with empty env and tools when agent has no env vars set", async () => {
+    const app = buildApp({ bundleOrNull: null });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.env).toEqual({});
+    expect(body.allowedTools).toEqual([]);
+    // plugins still returned (the agent has them)
+    expect(body.plugins).toEqual([
+      { marketplace: "shipwright", plugin: "shipwright" },
+    ]);
+  });
+
+  test("401 when no Authorization header", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`);
+
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("401 when wrong API key", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: "Bearer wrong-key" },
+    });
+
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("404 for unknown agent ID", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${UNKNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(404);
+    const body = await res.json();
+    expect(body.error).toBe("Not found");
+  });
+});
+
+describe("GET /:id/crons (mounted as GET /agents/:id/crons from root)", () => {
+  test("200 with cron list for known agent", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/crons`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(Array.isArray(body)).toBe(true);
+    expect(body).toHaveLength(1);
+    expect(body[0].id).toBe("cron-1");
+    expect(body[0].agentId).toBe(KNOWN_AGENT_ID);
+    expect(body[0].schedule).toBe("0 9 * * *");
+  });
+
+  test("401 when no Authorization header", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/crons`);
+
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("401 when wrong API key", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${KNOWN_AGENT_ID}/crons`, {
+      headers: { Authorization: "Bearer wrong-key" },
+    });
+
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("404 for unknown agent ID", async () => {
+    const app = buildApp();
+    const res = await app.request(`/${UNKNOWN_AGENT_ID}/crons`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(404);
+    const body = await res.json();
+    expect(body.error).toBe("Not found");
+  });
+
+  test("response includes parentCronId — null for a top-level cron, set for a parented one (this is the real payload syncCrons() consumes)", async () => {
+    const topLevel = makeCron(KNOWN_AGENT_ID, "cron-top");
+    const parented = {
+      ...makeCron(KNOWN_AGENT_ID, "cron-child"),
+      name: "shipwright-dev-task",
+      parentCronId: "cron-top",
+    };
+    const app = buildApp({ crons: [topLevel, parented] });
+    const res = await app.request(`/${KNOWN_AGENT_ID}/crons`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    const top = body.find((c: { id: string }) => c.id === "cron-top");
+    const child = body.find((c: { id: string }) => c.id === "cron-child");
+    expect(top.parentCronId).toBeNull();
+    expect(child.parentCronId).toBe("cron-top");
+  });
+});
+
+// ─── Combined-server mount tests ──────────────────────────────────────────────
+//
+// Verifies that the runtimeApp's internal key middleware does NOT intercept
+// admin CRUD requests when both apps are mounted on root as in main.ts.
+// This is the regression guard for the auth middleware defect fixed in this PR:
+//   root.route("/agents", runtimeApp) + root.route("/", adminApiApp)
+// Before the fix, runtimeApp.use("*") was hoisted as a /agents/* guard in root,
+// causing all admin CRUD requests to 401 before reaching adminApiApp handlers.
+
+const COMBINED_ADMIN_KEY = "combined-test-admin-key";
+const COMBINED_SESSION_SECRET = "combined-test-session-secret-32b!";
+const COMBINED_AGENT_ID = "combined-agent-123";
+
+function buildCombinedApp() {
+  const runtimeApp = createAgentRuntimeApp({
+    agentEnvService: {
+      async getConfigBundle() {
+        return { agentId: COMBINED_AGENT_ID, env: {}, allowedTools: [] };
+      },
+    },
+    agentCronJobService: {
+      async list() {
+        return [];
+      },
+      async listWithRunSummary() {
+        return [];
+      },
+    },
+    agentService: {
+      async getById() {
+        return {
+          id: COMBINED_AGENT_ID,
+          repos: [],
+          reviewAuthorAllowlist: [],
+          patchAuthorAllowlist: [],
+          restrictSlackToMembers: false,
+          memberEmails: [],
+          // APM-1.5: required by AgentConfigResponseSchema.
+          autoPostReviews: true,
+          allowSelfReview: false,
+          minConfidence: 75,
+          maxFindings: 5,
+          cleanupMergedWorktrees: true,
+          cleanupAfterDays: 14,
+        };
+      },
+    },
+    agentPluginService: {
+      async listEnabled() {
+        return [];
+      },
+    },
+    agentPhaseMethodologyService: {
+      async list() {
+        return [];
+      },
+    },
+    adminApiKeys: parseAdminApiKeys(`admin:${COMBINED_ADMIN_KEY}:*`),
+    agentTokenService: { validate: async () => null },
+    sessionSecret: COMBINED_SESSION_SECRET,
+  });
+
+  const adminApp = createAdminApp({
+    agentService: {
+      create: async () => ({
+        id: "a1",
+        name: "",
+        slackId: null,
+        selfHosted: false,
+        repos: [],
+        reviewAuthorAllowlist: [],
+        patchAuthorAllowlist: [],
+        restrictSlackToMembers: false,
+        typeName: "coding",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        missingRequiredEnv: [],
+      }),
+      delete: async () => {},
+      list: async () => [],
+      getSummary: async () => null,
+      getDetail: async () => null,
+      exists: async () => false,
+      updateSelfHosted: async () => ({
+        id: "a1",
+        name: "",
+        slackId: null,
+        selfHosted: false,
+        repos: [],
+        reviewAuthorAllowlist: [],
+        patchAuthorAllowlist: [],
+        restrictSlackToMembers: false,
+        typeName: "coding",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        missingRequiredEnv: [],
+      }),
+      updateFields: async () => {
+        throw new Error("not implemented");
+      },
+      runTransaction: async (fn) => fn(undefined as never),
+    },
+    specialtyRegistry: {
+      getManifest: () => {
+        throw new Error("not implemented");
+      },
+      tryGetManifest: () => undefined,
+      listTypes: () => [],
+    },
+    agentEnvService: {
+      upsert: async () => {},
+      patch: async () => {},
+      getByAgentId: async () => ({ env: {}, secretKeys: [] }),
+      deleteKey: async () => {},
+    },
+    agentCronJobService: {
+      list: async () => [],
+      listWithRunSummary: async () => [],
+      create: async () => ({
+        id: "c1",
+        agentId: COMBINED_AGENT_ID,
+        schedule: "",
+        prompt: "",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      update: async () => ({
+        id: "c1",
+        agentId: COMBINED_AGENT_ID,
+        schedule: "",
+        prompt: "",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      delete: async () => {},
+      setEnabled: async (_agentId, _cronId, enabled) => ({
+        id: "c1",
+        agentId: COMBINED_AGENT_ID,
+        schedule: "",
+        prompt: "",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      updatePreCheck: async (_agentId, _cronId, preCheck) => ({
+        id: "c1",
+        agentId: COMBINED_AGENT_ID,
+        schedule: "",
+        prompt: "",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      reconcileSystemCrons: async () => ({
+        created: 0,
+        updated: 0,
+        deleted: 0,
+      }),
+      get: async () => ({
+        id: "c1",
+        agentId: COMBINED_AGENT_ID,
+        schedule: "",
+        prompt: "",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+    },
+    agentCronRunService: {
+      create: async () => ({
+        id: "run-1",
+        cronId: "c1",
+        agentId: COMBINED_AGENT_ID,
+        startedAt: new Date(),
+        completedAt: null,
+        skipped: false,
+        skipReason: null,
+        outcome: null,
+        error: null,
+        phase: null,
+        itemType: null,
+        itemId: null,
+        commandVariant: null,
+        sessionId: null,
+        lastHeartbeatAt: null,
+        baselineModel: null,
+        baselineContextTokens: null,
+        baselineInputTokens: null,
+        baselineCacheCreationTokens: null,
+        baselineCacheReadTokens: null,
+        turns: null,
+        toolCalls: null,
+        contextFingerprint: null,
+        pluginVersion: null,
+        claudeCodeVersion: null,
+        phaseId: null,
+        inputTokens: null,
+        outputTokens: null,
+        cacheReadTokens: null,
+        cacheCreationTokens: null,
+        costUsd: null,
+        model: null,
+        createdAt: new Date(),
+      }),
+      list: async () => ({
+        items: [],
+        total: 0,
+        limit: 20,
+        offset: 0,
+      }),
+      patch: async () => ({
+        id: "run-1",
+        cronId: "c1",
+        agentId: COMBINED_AGENT_ID,
+        startedAt: new Date(),
+        completedAt: null,
+        skipped: false,
+        skipReason: null,
+        outcome: null,
+        error: null,
+        phase: null,
+        itemType: null,
+        itemId: null,
+        commandVariant: null,
+        sessionId: null,
+        lastHeartbeatAt: null,
+        baselineModel: null,
+        baselineContextTokens: null,
+        baselineInputTokens: null,
+        baselineCacheCreationTokens: null,
+        baselineCacheReadTokens: null,
+        turns: null,
+        toolCalls: null,
+        contextFingerprint: null,
+        pluginVersion: null,
+        claudeCodeVersion: null,
+        phaseId: null,
+        inputTokens: null,
+        outputTokens: null,
+        cacheReadTokens: null,
+        cacheCreationTokens: null,
+        costUsd: null,
+        model: null,
+        createdAt: new Date(),
+        modelBreakdown: [],
+      }),
+    },
+    agentToolService: {
+      list: async () => [],
+      add: async () => ({
+        id: "t1",
+        agentId: COMBINED_AGENT_ID,
+        pattern: "Read",
+        enabled: true,
+        createdAt: new Date(),
+      }),
+      remove: async () => {},
+      toggle: async () => ({
+        id: "t1",
+        agentId: COMBINED_AGENT_ID,
+        pattern: "Read",
+        enabled: false,
+        createdAt: new Date(),
+      }),
+    },
+    agentTokenService: {
+      create: async () => ({
+        token: {
+          id: "tok1",
+          agentId: COMBINED_AGENT_ID,
+          token: "hash",
+          label: null,
+          createdAt: new Date(),
+          revokedAt: null,
+        },
+        rawToken: "raw",
+      }),
+      listForAgent: async () => [],
+      revoke: async () => ({
+        id: "tok1",
+        agentId: COMBINED_AGENT_ID,
+        token: "hash",
+        label: null,
+        createdAt: new Date(),
+        revokedAt: new Date(),
+      }),
+      validate: async () => null,
+    },
+    agentPluginService: {
+      list: async () => [],
+      add: async () => ({
+        id: "p1",
+        agentId: COMBINED_AGENT_ID,
+        name: "plugin",
+        version: null,
+        enabled: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      remove: async () => {},
+      removeByName: async () => {},
+    },
+    agentMemberService: {
+      exists: async () => false,
+      listByEmail: async () => [],
+      add: async (agentId: string, email: string) => ({
+        id: "member-1",
+        agentId,
+        email,
+        createdAt: new Date(),
+      }),
+      listByAgentId: async () => [],
+    },
+    agentChatTokenService: {
+      upsertDailyByModel: async (
+        _agentId: string,
+        date: string,
+        model: string,
+      ) => ({
+        id: "daily-id",
+        agentId: _agentId,
+        date,
+        model,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+        costUsd: 0,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      queryStats: async () => ({
+        totals: {
+          input: 0,
+          output: 0,
+          cacheRead: 0,
+          cacheCreation: 0,
+          total: 0,
+        },
+        byAgent: [],
+        byModel: [],
+        daily: [],
+      }),
+    },
+    agentGitHubInstallationsService: {
+      push: async () => {
+        throw new Error("not implemented");
+      },
+      get: async () => null,
+    },
+    agentCronRunStatsService: {
+      outcomes: async () => ({ series: [] }),
+      query: async () => ({
+        totals: {
+          input: 0,
+          output: 0,
+          cacheRead: 0,
+          cacheCreation: 0,
+          total: 0,
+        },
+        byAgent: [],
+        byCron: [],
+        byModel: [],
+        daily: [],
+        byCronModel: [],
+        byPhase: [],
+      }),
+    },
+    prisma: {
+      agent: {
+        create: async () => ({
+          id: "new-id",
+          name: "New",
+          slackId: null,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        }),
+      },
+    } as never,
+    provisioner: new NoopAgentProvisioner(),
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: {
+      listTokensForAgent: async () => [],
+      revokeToken: async () => {},
+      deleteThreadsForAgent: async () => ({ deleted: 0 }),
+    },
+    slack: {
+      deleteApp: async () => {},
+    },
+    decrypt: (value: string) => value,
+    sessionSecret: COMBINED_SESSION_SECRET,
+    adminApiKeys: parseAdminApiKeys(`admin:${COMBINED_ADMIN_KEY}:*`),
+  });
+
+  const root = new Hono();
+  root.get("/health", (c) => c.json({ status: "ok" }));
+  root.get("/", (c) => c.redirect("/admin/login", 302));
+  root.route("/agents", runtimeApp);
+  root.route("/", adminApp);
+  return root;
+}
+
+describe("root redirect — GET / → 302 /admin/login", () => {
+  test("GET / returns 302 with Location /admin/login", async () => {
+    const root = buildCombinedApp();
+    const res = await root.request("/");
+    expect(res.status).toBe(302);
+    expect(res.headers.get("Location")).toBe("/admin/login");
+  });
+});
+
+describe("combined server — regression guard: runtime middleware must not block admin CRUD", () => {
+  test("POST /agents/:id/envs with admin key reaches admin handler (201, not 401)", async () => {
+    const root = buildCombinedApp();
+    const res = await root.request(`/agents/${COMBINED_AGENT_ID}/envs`, {
+      method: "POST",
+      body: JSON.stringify({ FOO: "bar" }),
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${COMBINED_ADMIN_KEY}`,
+      },
+    });
+    // Both runtimeApp and adminApp use the same admin auth — admin key works for all routes.
+    expect(res.status).toBe(201);
+  });
+
+  test("runtime GET /agents/:id/config still requires auth (401 without it)", async () => {
+    const root = buildCombinedApp();
+    const res = await root.request(`/agents/${COMBINED_AGENT_ID}/config`);
+    expect(res.status).toBe(401);
+  });
+
+  test("runtime GET /agents/:id/config succeeds with admin key (200)", async () => {
+    const root = buildCombinedApp();
+    const res = await root.request(`/agents/${COMBINED_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${COMBINED_ADMIN_KEY}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.repos).toEqual([]);
+  });
+});
+
+describe("GET /:id/config — Anthropic federation credential strip (WIF-2.1)", () => {
+  const bundleWithCreds: AgentEnvBundle = {
+    agentId: KNOWN_AGENT_ID,
+    env: {
+      SLACK_BOT_TOKEN: "xoxb-secret",
+      CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat-secret",
+      ANTHROPIC_API_KEY: "sk-ant-api-secret",
+      ANTHROPIC_AUTH_TOKEN: "auth-secret",
+      ANTHROPIC_MODEL: "claude-test",
+    },
+    allowedTools: [],
+  };
+
+  async function fetchConfig(opts: {
+    selfHosted?: boolean;
+    anthropicFederationEnabled?: boolean;
+  }) {
+    const app = buildApp({ bundleOrNull: bundleWithCreds, ...opts });
+    return app.request(`/${KNOWN_AGENT_ID}/config`, {
+      headers: { Authorization: `Bearer ${VALID_ADMIN_KEY}` },
+    });
+  }
+
+  test("federation enabled + non-self-hosted: the three keys are stripped, others kept", async () => {
+    const res = await fetchConfig({
+      selfHosted: false,
+      anthropicFederationEnabled: true,
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.env).toEqual({
+      SLACK_BOT_TOKEN: "xoxb-secret",
+      ANTHROPIC_MODEL: "claude-test",
+    });
+  });
+
+  test("federation enabled + non-self-hosted: logs agent id and key names, never values", async () => {
+    const logged: string[] = [];
+    const origWarn = console.warn;
+    console.warn = (...args: unknown[]) => {
+      logged.push(args.map(String).join(" "));
+    };
+    try {
+      await fetchConfig({
+        selfHosted: false,
+        anthropicFederationEnabled: true,
+      });
+    } finally {
+      console.warn = origWarn;
+    }
+    const line = logged.join("\n");
+    expect(line).toContain(KNOWN_AGENT_ID);
+    expect(line).toContain("CLAUDE_CODE_OAUTH_TOKEN");
+    expect(line).toContain("ANTHROPIC_API_KEY");
+    expect(line).toContain("ANTHROPIC_AUTH_TOKEN");
+    expect(line).not.toContain("sk-ant-oat-secret");
+    expect(line).not.toContain("sk-ant-api-secret");
+    expect(line).not.toContain("auth-secret");
+  });
+
+  test("federation enabled + self-hosted: bundle is untouched", async () => {
+    const res = await fetchConfig({
+      selfHosted: true,
+      anthropicFederationEnabled: true,
+    });
+    const body = await res.json();
+    expect(body.env.ANTHROPIC_API_KEY).toBe("sk-ant-api-secret");
+    expect(body.env.CLAUDE_CODE_OAUTH_TOKEN).toBe("sk-ant-oat-secret");
+  });
+
+  test("federation disabled (default): bundle is untouched", async () => {
+    const res = await fetchConfig({ selfHosted: false });
+    const body = await res.json();
+    expect(body.env.ANTHROPIC_API_KEY).toBe("sk-ant-api-secret");
+    expect(body.env.ANTHROPIC_AUTH_TOKEN).toBe("auth-secret");
+  });
+});