@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/src/chat.smoke.test.ts

@@ -0,0 +1,1875 @@
+/**
+ * admin/src/chat.smoke.test.ts
+ * Smoke tests for the Admin Chat UI routes.
+ *
+ * Uses app.request() — no real server, no real network calls.
+ * ChatClient is injected as an in-memory test double.
+ */
+
+import { beforeAll, describe, expect, it } from "bun:test";
+import { sign } from "hono/jwt";
+import type {
+  AdminUIDeps,
+  AdminUIGithubAppClient,
+  AdminUISlackClient,
+} from "./admin-ui.ts";
+import { createAdminUIApp } from "./admin-ui.ts";
+import type {
+  GoogleAuthClient,
+  GoogleTokenResponse,
+  GoogleUserInfo,
+} from "./google-auth-client.ts";
+import type {
+  ChatClient,
+  ChatMessage,
+  ChatThread,
+  ThreadStats,
+} from "./http-chat-client.ts";
+import type { PushService } from "./push-service.ts";
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const GOOGLE_CLIENT_ID = "test-google-client-id";
+const GOOGLE_CLIENT_SECRET = "test-google-client-secret";
+const ADMIN_ALLOWED_EMAILS = ["admin@example.com"];
+const AGENT_ID = "agent-test-chat-123";
+const THREAD_ID = "thread-test-456";
+
+// ─── Fixtures ─────────────────────────────────────────────────────────────────
+
+const MOCK_THREAD: ChatThread = {
+  id: THREAD_ID,
+  agentId: AGENT_ID,
+  title: "Test Thread",
+  memberId: null,
+  createdAt: "2024-01-01T00:00:00.000Z",
+  updatedAt: "2024-01-01T00:00:00.000Z",
+};
+
+const MOCK_MESSAGE: ChatMessage = {
+  id: "msg-test-789",
+  threadId: THREAD_ID,
+  role: "user",
+  body: "Hello, agent!",
+  createdAt: "2024-01-01T00:00:00.000Z",
+  claimedBy: null,
+  repliedAt: null,
+  tokens: null,
+  costUsd: null,
+  errorKind: null,
+  attachmentFilename: null,
+  attachmentSize: null,
+};
+
+const MOCK_ASSISTANT_MESSAGE: ChatMessage = {
+  id: "msg-test-asst-101",
+  threadId: THREAD_ID,
+  role: "assistant",
+  body: "Here is **bold text** and `inline code`.",
+  createdAt: "2024-01-01T00:01:00.000Z",
+  claimedBy: null,
+  repliedAt: "2024-01-01T00:01:05.000Z",
+  tokens: {
+    input_tokens: 50,
+    output_tokens: 30,
+    cache_read_input_tokens: 0,
+    cache_creation_input_tokens: 0,
+  },
+  costUsd: 0.0005,
+  errorKind: null,
+  attachmentFilename: null,
+  attachmentSize: null,
+};
+
+const MOCK_ERROR_MESSAGE: ChatMessage = {
+  id: "msg-test-err-202",
+  threadId: THREAD_ID,
+  role: "assistant",
+  body: "",
+  createdAt: "2024-01-01T00:02:00.000Z",
+  claimedBy: null,
+  repliedAt: null,
+  tokens: null,
+  costUsd: null,
+  errorKind: "rate-limited",
+  attachmentFilename: null,
+  attachmentSize: null,
+};
+
+// ─── JWT helper ───────────────────────────────────────────────────────────────
+
+async function makeSessionCookie(
+  secret = SESSION_SECRET,
+  userId = "google-sub-123",
+  email = "admin@example.com",
+  isAdmin = true,
+): Promise<string> {
+  return sign(
+    {
+      userId,
+      email,
+      isAdmin,
+      iat: Math.floor(Date.now() / 1000),
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    },
+    secret,
+    "HS256",
+  );
+}
+
+// ─── Mock ChatClient ──────────────────────────────────────────────────────────
+
+const MOCK_THREAD_STATS: ThreadStats = {
+  messageCount: 1,
+  totalInputTokens: 0,
+  totalOutputTokens: 0,
+  totalCostUsd: 0,
+};
+
+function makeMockChatClient(overrides?: Partial<ChatClient>): ChatClient {
+  return {
+    listThreads: async () => ({
+      threads: [MOCK_THREAD],
+      total: 1,
+      limit: 50,
+      offset: 0,
+    }),
+    getThread: async () => MOCK_THREAD,
+    createThread: async () => MOCK_THREAD,
+    updateThread: async (_id: string, data: { title?: string }) => ({
+      ...MOCK_THREAD,
+      title: data.title ?? MOCK_THREAD.title,
+    }),
+    deleteThread: async () => {},
+    listMessages: async () => ({
+      messages: [MOCK_MESSAGE],
+      total: 1,
+      limit: 50,
+      offset: 0,
+    }),
+    createMessage: async () => MOCK_MESSAGE,
+    getThreadStats: async () => MOCK_THREAD_STATS,
+    getAttachment: async () => null,
+    ...overrides,
+  };
+}
+
+// ─── Mock Google client ───────────────────────────────────────────────────────
+
+function makeGoogleClient(): GoogleAuthClient {
+  return {
+    exchangeCode: () =>
+      Promise.resolve({
+        accessToken: "test-access-token",
+        refreshToken: "test-refresh-token",
+        expiresIn: 3600,
+      } as GoogleTokenResponse),
+    getUserInfo: () =>
+      Promise.resolve({
+        sub: "google-sub-123",
+        email: "admin@example.com",
+        email_verified: true,
+        name: "Admin User",
+      } as GoogleUserInfo),
+  };
+}
+
+const MOCK_CRON = {
+  id: "cron-1",
+  agentId: AGENT_ID,
+  schedule: "0 * * * *",
+  prompt: "check",
+  channel: null,
+  user: null,
+  enabled: true,
+  name: null,
+  system: false,
+  parentCronId: null,
+  lockdownDisabledAt: null,
+  silent: false,
+  preCheck: null,
+  createdAt: new Date("2024-01-01"),
+  updatedAt: new Date("2024-01-01"),
+};
+
+const MOCK_TOOL = {
+  id: "tool-1",
+  agentId: AGENT_ID,
+  pattern: "Bash(git:*)",
+  enabled: true,
+  createdAt: new Date("2024-01-01"),
+  updatedAt: new Date("2024-01-01"),
+};
+
+const MOCK_TOKEN = {
+  id: "token-1",
+  agentId: AGENT_ID,
+  token: "hashed",
+  label: "CI",
+  createdAt: new Date("2024-01-01"),
+  revokedAt: null,
+};
+
+// ─── Shared base deps factory ─────────────────────────────────────────────────
+
+const BASE_SLACK_CLIENT: AdminUISlackClient = {
+  createAppManifest: async () => ({
+    appId: "A123",
+    oauthRedirectUrl: "https://slack.com/oauth",
+    clientId: "cid",
+    clientSecret: "csecret",
+    signingSecret: "ssecret",
+  }),
+  updateAppManifest: async () => {},
+  exchangeOAuthCode: async () => ({ botToken: "xoxb-mock" }),
+  authTest: async () => ({ userId: "U0AALR8M69X" }),
+};
+
+const BASE_GITHUB_APP_CLIENT: AdminUIGithubAppClient = {
+  exchangeManifestCode: async () => ({
+    appId: "999111",
+    slug: "test-shipwright-agent",
+    pem: "-----BEGIN RSA PRIVATE KEY-----\nmock\n-----END RSA PRIVATE KEY-----",
+    clientId: "gh-app-client-id",
+    clientSecret: "gh-app-client-secret",
+  }),
+};
+
+function makeBaseDeps(overrides?: Partial<AdminUIDeps>): AdminUIDeps {
+  return {
+    prisma: {
+      agent: {
+        findMany: async () => [
+          {
+            id: AGENT_ID,
+            name: "Test Agent",
+            slackId: null,
+            createdAt: new Date("2024-01-01"),
+          },
+        ],
+        findUnique: async () => ({
+          id: AGENT_ID,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          createdAt: new Date("2024-01-01"),
+          updatedAt: new Date("2024-01-01"),
+          repos: [],
+        }),
+        create: async () => ({
+          id: AGENT_ID,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          createdAt: new Date("2024-01-01"),
+          updatedAt: new Date("2024-01-01"),
+          repos: [],
+        }),
+        update: async () => ({
+          id: AGENT_ID,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          createdAt: new Date("2024-01-01"),
+          updatedAt: new Date("2024-01-01"),
+          repos: [],
+        }),
+        delete: async () => ({
+          id: AGENT_ID,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          createdAt: new Date("2024-01-01"),
+          updatedAt: new Date("2024-01-01"),
+          repos: [],
+        }),
+      },
+      agentEnv: { findMany: async () => [] },
+      agentPlugin: { findMany: async () => [] },
+      agentMember: {
+        findMany: async () => [],
+        findUnique: async () => null,
+        create: async () => ({ id: "m1", agentId: AGENT_ID, email: "x@x.com" }),
+        deleteMany: async () => ({ count: 0 }),
+      },
+    },
+    agentEnvService: {
+      getByAgentId: async () => ({ env: {}, secretKeys: [] }),
+      upsert: async () => {},
+      patch: async () => {},
+      deleteKey: async () => {},
+      getConfigBundle: async () => null,
+    },
+    agentCronJobService: {
+      list: async () => [MOCK_CRON],
+      listWithRunSummary: async () => [
+        { ...MOCK_CRON, lastRun: null, runCountToday: 0 },
+      ],
+      get: async () => MOCK_CRON,
+      create: async () => MOCK_CRON,
+      setEnabled: async () => MOCK_CRON,
+      update: async () => MOCK_CRON,
+      delete: async () => {},
+      reconcileSystemCrons: async () => ({
+        created: 0,
+        updated: 0,
+        deleted: 0,
+      }),
+    },
+    agentToolService: {
+      list: async () => [MOCK_TOOL],
+      add: async () => MOCK_TOOL,
+      toggle: async () => MOCK_TOOL,
+      remove: async () => {},
+    },
+    agentTokenService: {
+      listForAgent: async () => [MOCK_TOKEN],
+      create: async () => ({ token: MOCK_TOKEN, rawToken: "sw_raw123" }),
+      revoke: async () => MOCK_TOKEN,
+    },
+    agentPluginService: {
+      list: async () => [],
+      add: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    agentMemberService: {
+      listByEmail: async () => [],
+      exists: async () => false,
+      add: async (agentId: string, email: string) => ({
+        id: "m1",
+        agentId,
+        email,
+        createdAt: new Date(),
+      }),
+      remove: async () => {},
+      listByAgentId: async () => [],
+    },
+    agentService: {
+      listAll: async () => [],
+      listByIds: async () => [],
+      searchByName: async () => [],
+      listOptions: async () => [{ id: AGENT_ID, name: "Test Agent" }],
+      create: async () => {
+        throw new Error("not implemented");
+      },
+      delete: async () => {},
+      getDetail: async () => null,
+      updateFields: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    provisioner: {
+      canProvision: false,
+      provision: async () => ({
+        resourceName: "r",
+        secretName: "s",
+        deploymentName: "d",
+      }),
+      deprovision: async () => {},
+      reconcile: async () => ({
+        recreated: [],
+        migrated: [],
+        noOwner: [],
+        dryRun: false,
+        orphans: [],
+        failed: [],
+        updated: [],
+      }),
+    },
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: {
+      listTokensForAgent: async () => [],
+      revokeToken: async () => {},
+      deleteThreadsForAgent: async () => ({ deleted: 0 }),
+    },
+    slack: {
+      deleteApp: async () => {},
+    },
+    decrypt: (value: string) => value,
+    sessionSecret: SESSION_SECRET,
+    googleClientId: GOOGLE_CLIENT_ID,
+    googleClientSecret: GOOGLE_CLIENT_SECRET,
+    adminAllowedEmails: ADMIN_ALLOWED_EMAILS,
+    googleClient: makeGoogleClient(),
+    slackClient: BASE_SLACK_CLIENT,
+    githubAppClient: BASE_GITHUB_APP_CLIENT,
+    appBaseUrl: "http://localhost:3001",
+    ...overrides,
+  };
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("GET /admin/chat — auth gate", () => {
+  it("returns 302 redirect to login without session cookie", async () => {
+    const app = createAdminUIApp(makeBaseDeps());
+    const res = await app.request("/admin/chat");
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+});
+
+describe("GET /admin/chat — degraded mode (no chatClient)", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 200 with agent selector and degraded notice when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request("/admin/chat", {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should show agent selector / chat page shell
+    expect(html).toContain("Chat");
+    // Should show a degraded notice
+    expect(html.toLowerCase()).toMatch(/not configured|unavailable|degraded/);
+  });
+});
+
+// ─── Thread stats: token/cost display ────────────────────────────────────────
+
+describe("GET /admin/chat/:agentId/threads/:threadId — token/cost display", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("shows per-message token/cost info on assistant messages that have token data", async () => {
+    const tokenRichMessage: ChatMessage = {
+      id: "msg-token-rich",
+      threadId: THREAD_ID,
+      role: "assistant",
+      body: "Here is my response.",
+      createdAt: "2024-01-01T00:01:00.000Z",
+      claimedBy: null,
+      repliedAt: "2024-01-01T00:01:05.000Z",
+      tokens: {
+        input_tokens: 512,
+        output_tokens: 234,
+        cache_read_input_tokens: 0,
+        cache_creation_input_tokens: 0,
+      },
+      costUsd: 0.0005,
+      errorKind: null,
+      attachmentFilename: null,
+      attachmentSize: null,
+    };
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [tokenRichMessage],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+      getThreadStats: async () => ({
+        messageCount: 1,
+        totalInputTokens: 512,
+        totalOutputTokens: 234,
+        totalCostUsd: 0.0005,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Per-message token info: "512 in / 234 out"
+    expect(html).toContain("512");
+    expect(html).toContain("234");
+    // Cost info
+    expect(html).toContain("0.0005");
+  });
+
+  it("shows nothing extra on messages with null tokens/costUsd", async () => {
+    const noTokenMessage: ChatMessage = {
+      id: "msg-no-token",
+      threadId: THREAD_ID,
+      role: "assistant",
+      body: "No token data.",
+      createdAt: "2024-01-01T00:01:00.000Z",
+      claimedBy: null,
+      repliedAt: "2024-01-01T00:01:05.000Z",
+      tokens: null,
+      costUsd: null,
+      errorKind: null,
+      attachmentFilename: null,
+      attachmentSize: null,
+    };
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [noTokenMessage],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+      getThreadStats: async () => ({
+        messageCount: 1,
+        totalInputTokens: 0,
+        totalOutputTokens: 0,
+        totalCostUsd: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should not show token badge content for null token messages
+    expect(html).not.toContain("in / ");
+  });
+
+  it("shows thread-level total token/cost stats in the header", async () => {
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [MOCK_ASSISTANT_MESSAGE],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+      getThreadStats: async () => ({
+        messageCount: 1,
+        totalInputTokens: 1200,
+        totalOutputTokens: 567,
+        totalCostUsd: 0.0032,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Thread-level stats should appear in the header
+    expect(html).toContain("1.2k");
+    expect(html).toContain("0.0032");
+  });
+});
+
+describe("GET /admin/chat?agentId=X — with chatClient", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 200 with thread list for selected agent", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat?agentId=${AGENT_ID}`, {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain(THREAD_ID);
+    expect(html).toContain("Test Thread");
+  });
+
+  it("shows agent selector with the agent pre-selected", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat?agentId=${AGENT_ID}`, {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain(AGENT_ID);
+  });
+
+  it("shows empty state when no agentId selected", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request("/admin/chat", {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("Chat");
+    // No thread table when no agent selected
+    expect(html).not.toContain(THREAD_ID);
+  });
+});
+
+describe("GET /admin/chat/:agentId/threads/:threadId — thread detail", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 401 without session cookie", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+
+  it("returns 200 with messages when chatClient present", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("Hello, agent!");
+    expect(html).toContain("user");
+  });
+
+  it("returns degraded mode when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html.toLowerCase()).toMatch(/not configured|unavailable|degraded/);
+  });
+});
+
+describe("POST /admin/chat/:agentId/threads — create thread", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 to thread detail on success", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat/${AGENT_ID}/threads`, {
+      method: "POST",
+      headers: {
+        Cookie: `admin_session=${sessionCookie}`,
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: "title=My+New+Thread",
+    });
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain(THREAD_ID);
+  });
+});
+
+describe("POST /admin/chat/:agentId/threads/:threadId/messages — create message", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 back to thread detail on success", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "body=Hello+from+admin",
+      },
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain(THREAD_ID);
+  });
+});
+
+describe("Toolbar", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("includes Chat nav link in the toolbar", async () => {
+    const app = createAdminUIApp(makeBaseDeps());
+    const res = await app.request("/admin/agents", {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("/admin/chat");
+    expect(html).toContain(">Chat<");
+  });
+});
+
+describe("POST /admin/chat/:agentId/threads/:threadId/rename — rename thread", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 redirect back to the thread page on success", async () => {
+    let updatedTitle: string | undefined;
+    const chatClient = makeMockChatClient({
+      updateThread: async (_id: string, data: { title?: string }) => {
+        updatedTitle = data.title;
+        return { ...MOCK_THREAD, title: data.title ?? MOCK_THREAD.title };
+      },
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/rename`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "title=Renamed+Thread",
+      },
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain(THREAD_ID);
+    expect(updatedTitle).toBe("Renamed Thread");
+  });
+
+  it("returns 302 to chat list when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/rename`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "title=Whatever",
+      },
+    );
+    expect(res.status).toBe(302);
+  });
+
+  it("skips updateThread and redirects back when title is empty", async () => {
+    let updateCalled = false;
+    const chatClient = makeMockChatClient({
+      updateThread: async (_id: string, data: { title?: string }) => {
+        updateCalled = true;
+        return { ...MOCK_THREAD, title: data.title ?? MOCK_THREAD.title };
+      },
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/rename`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "title=",
+      },
+    );
+    expect(res.status).toBe(302);
+    expect(updateCalled).toBe(false);
+  });
+});
+
+describe("POST /admin/chat/:agentId/threads/:threadId/delete — delete thread", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 redirect to /admin/chat?agentId=X on success", async () => {
+    let deletedId: string | undefined;
+    const chatClient = makeMockChatClient({
+      deleteThread: async (id: string) => {
+        deletedId = id;
+      },
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/delete`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "",
+      },
+    );
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location") ?? "";
+    expect(location).toContain("/admin/chat");
+    expect(location).toContain(AGENT_ID);
+    expect(deletedId).toBe(THREAD_ID);
+  });
+
+  it("returns 302 when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/delete`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "",
+      },
+    );
+    expect(res.status).toBe(302);
+  });
+
+  it("swallows deleteThread errors and still redirects to the agent thread list", async () => {
+    const chatClient = makeMockChatClient({
+      deleteThread: async () => {
+        throw new Error("chat service unavailable");
+      },
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/delete`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "",
+      },
+    );
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location") ?? "";
+    expect(location).toContain("/admin/chat");
+    expect(location).toContain(AGENT_ID);
+    // Must NOT redirect to the thread detail page
+    expect(location).not.toContain(THREAD_ID);
+  });
+});
+
+describe("GET /admin/chat?agentId=X&q=foo — search/filter threads", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns only threads matching the search query", async () => {
+    const SECOND_THREAD: ChatThread = {
+      id: "thread-other-999",
+      agentId: AGENT_ID,
+      title: "Unrelated topic",
+      memberId: null,
+      createdAt: "2024-01-02T00:00:00.000Z",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    };
+    const chatClient = makeMockChatClient({
+      listThreads: async () => ({
+        threads: [MOCK_THREAD, SECOND_THREAD],
+        total: 2,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat?agentId=${AGENT_ID}&q=Test`, {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should show matching thread
+    expect(html).toContain("Test Thread");
+    // Should not show non-matching thread
+    expect(html).not.toContain("Unrelated topic");
+  });
+
+  it("shows search input on the chat page", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat?agentId=${AGENT_ID}`, {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should have a search input with name "q"
+    expect(html).toContain('name="q"');
+  });
+
+  it("returns all threads when q is empty", async () => {
+    const SECOND_THREAD: ChatThread = {
+      id: "thread-other-999",
+      agentId: AGENT_ID,
+      title: "Unrelated topic",
+      memberId: null,
+      createdAt: "2024-01-02T00:00:00.000Z",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    };
+    const chatClient = makeMockChatClient({
+      listThreads: async () => ({
+        threads: [MOCK_THREAD, SECOND_THREAD],
+        total: 2,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(`/admin/chat?agentId=${AGENT_ID}&q=`, {
+      headers: { Cookie: `admin_session=${sessionCookie}` },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("Test Thread");
+    expect(html).toContain("Unrelated topic");
+  });
+});
+
+describe("GET /admin/chat/:agentId/threads/:threadId — thread list pane on detail page", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("renders thread list links in the sidebar pane", async () => {
+    const SECOND_THREAD: ChatThread = {
+      id: "thread-other-999",
+      agentId: AGENT_ID,
+      title: "Second Thread",
+      memberId: null,
+      createdAt: "2024-01-02T00:00:00.000Z",
+      updatedAt: "2024-01-02T00:00:00.000Z",
+    };
+    const chatClient = makeMockChatClient({
+      listThreads: async () => ({
+        threads: [MOCK_THREAD, SECOND_THREAD],
+        total: 2,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // The thread detail page should include links to other threads (sidebar pane)
+    expect(html).toContain("thread-other-999");
+    expect(html).toContain("Second Thread");
+  });
+
+  it("renders rename form on the thread detail page", async () => {
+    const chatClient = makeMockChatClient({
+      updateThread: async (_id: string, data: { title?: string }) => ({
+        ...MOCK_THREAD,
+        title: data.title ?? null,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should have a rename form pointing to the rename endpoint
+    expect(html).toContain("/rename");
+    // rename input must have required so empty submissions are blocked client-side
+    expect(html).toContain('name="title"');
+    expect(html).toMatch(/name="title"[^>]*required|required[^>]*name="title"/);
+  });
+
+  it("renders delete button on the thread detail page", async () => {
+    const chatClient = makeMockChatClient({
+      deleteThread: async () => {},
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Should have a delete form pointing to the delete endpoint
+    expect(html).toContain("/delete");
+  });
+});
+
+// ─── JSON API: GET messages.json ──────────────────────────────────────────────
+
+describe("GET /admin/chat/:agentId/threads/:threadId/messages.json", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 to login without session cookie", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+
+  it("returns 200 JSON with messages array when chatClient present", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("application/json");
+    const body = (await res.json()) as { messages: ChatMessage[] };
+    expect(Array.isArray(body.messages)).toBe(true);
+    expect(body.messages[0].id).toBe(MOCK_MESSAGE.id);
+  });
+
+  it("returns 200 with empty messages array when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { messages: ChatMessage[] };
+    expect(body.messages).toEqual([]);
+  });
+
+  // CFB-2.3: each message carries server-rendered bubbleHtml so polled bubbles
+  // are byte-identical to a full page reload's server-rendered bubble.
+  it("attaches bubbleHtml to each message", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const body = (await res.json()) as {
+      messages: (ChatMessage & { bubbleHtml: string })[];
+    };
+    expect(typeof body.messages[0].bubbleHtml).toBe("string");
+    expect(body.messages[0].bubbleHtml).toContain(
+      `data-message-id="${MOCK_MESSAGE.id}"`,
+    );
+  });
+
+  // The chat service once leaked the raw `attachmentBytes` column into its
+  // message list; passing that straight through turned every poll into a
+  // ~36 MB response and OOM-killed this service. messages.json must emit an
+  // explicit field set, so an upstream leak can never reach the browser.
+  it("emits only the known message fields, never an upstream attachmentBytes", async () => {
+    const leaked = {
+      ...MOCK_ASSISTANT_MESSAGE,
+      attachmentFilename: "response.wav",
+      attachmentSize: 3,
+      attachmentBytes: { 0: 7, 1: 8, 2: 9 },
+    } as ChatMessage;
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [leaked],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { messages: Record<string, unknown>[] };
+    expect(body.messages).toHaveLength(1);
+    const m = body.messages[0];
+    expect(m).not.toHaveProperty("attachmentBytes");
+    expect(m.id).toBe(MOCK_ASSISTANT_MESSAGE.id);
+    expect(m.role).toBe("assistant");
+    expect(m.createdAt).toBe(MOCK_ASSISTANT_MESSAGE.createdAt);
+    expect(m.repliedAt).toBe(MOCK_ASSISTANT_MESSAGE.repliedAt);
+    expect(m.attachmentFilename).toBe("response.wav");
+    expect(m.attachmentSize).toBe(3);
+    expect(typeof m.bubbleHtml).toBe("string");
+  });
+
+  // CFB-2.3: ?since=<messageId> returns only messages ordered after that id.
+  it("filters messages with ?since=<messageId>", async () => {
+    const older: ChatMessage = { ...MOCK_MESSAGE, id: "older-1" };
+    const newer: ChatMessage = { ...MOCK_MESSAGE, id: "newer-1" };
+    const chatClient = makeMockChatClient({
+      listMessages: async (_threadId, opts) => {
+        // The admin layer applies the since filter itself over the full list,
+        // so the mock ignores opts.since and returns everything ordered.
+        void opts;
+        return { messages: [older, newer], total: 2, limit: 50, offset: 0 };
+      },
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json?since=older-1`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const body = (await res.json()) as { messages: ChatMessage[] };
+    expect(body.messages.map((m) => m.id)).toEqual(["newer-1"]);
+  });
+});
+
+// ─── JSON API: POST messages.json ─────────────────────────────────────────────
+
+describe("POST /admin/chat/:agentId/threads/:threadId/messages.json", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 to login without session cookie", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ body: "test message" }),
+      },
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+
+  it("returns 200 JSON with message when chatClient present", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ body: "Hello, agent!" }),
+      },
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("application/json");
+    const body = (await res.json()) as { message: ChatMessage };
+    expect(body.message).not.toBeNull();
+    expect(body.message.id).toBe(MOCK_MESSAGE.id);
+  });
+
+  it("returns 200 with null message when chatClient absent", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ body: "Hello!" }),
+      },
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { message: null };
+    expect(body.message).toBeNull();
+  });
+});
+
+// ─── Upload API: POST messages/upload ─────────────────────────────────────────
+// This is the route the live chat UI's send box actually posts to
+// (admin-ui-pages.ts's uploadUrl) — distinct from the form POST /messages and
+// JSON POST /messages.json routes above. It was missing the watchThread()
+// call the other two have (CFB-4.4 follow-up bug: real push subscriptions
+// existed but ChatThreadWatch stayed empty, so notifyThreadReply always found
+// zero recipients).
+
+function makeFakePushService(
+  notifyThreadReply: (thread: {
+    threadId: string;
+    agentId: string;
+    title: string | null;
+    preview: string | null;
+  }) => Promise<{ delivered: number; pruned: number }> = async () => ({
+    delivered: 0,
+    pruned: 0,
+  }),
+  recordWatch: (
+    userEmail: string,
+    agentId: string,
+    threadId: string,
+  ) => Promise<void> = async () => {},
+): PushService {
+  return { notifyThreadReply, recordWatch } as unknown as PushService;
+}
+
+describe("POST /admin/chat/:agentId/threads/:threadId/messages/upload", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 to login without session cookie", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/upload`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: "body=test+message",
+      },
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+
+  it("returns 201 JSON with message when chatClient present", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/upload`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "body=Hello%2C+agent!",
+      },
+    );
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { message: ChatMessage };
+    expect(body.message.id).toBe(MOCK_MESSAGE.id);
+  });
+
+  it("returns 400 when neither body nor file is present", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/upload`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "",
+      },
+    );
+    expect(res.status).toBe(400);
+  });
+
+  it("registers a ChatThreadWatch row when push is enabled (CFB-4.4 regression)", async () => {
+    const chatClient = makeMockChatClient();
+    const base = makeBaseDeps();
+    const watchUpserts: Array<{
+      userEmail: string;
+      agentId: string;
+      threadId: string;
+    }> = [];
+    const app = createAdminUIApp({
+      ...base,
+      chatClient,
+      pushService: makeFakePushService(
+        undefined,
+        async (userEmail, agentId, threadId) => {
+          watchUpserts.push({ userEmail, agentId, threadId });
+        },
+      ),
+      vapidPublicKey: "test-vapid-public-key",
+    });
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/upload`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "body=testing+notifications",
+      },
+    );
+    expect(res.status).toBe(201);
+    expect(watchUpserts).toHaveLength(1);
+    expect(watchUpserts[0]).toEqual({
+      userEmail: "admin@example.com",
+      threadId: THREAD_ID,
+      agentId: AGENT_ID,
+    });
+  });
+
+  it("does not touch ChatThreadWatch when push is disabled", async () => {
+    const chatClient = makeMockChatClient();
+    const base = makeBaseDeps();
+    const watchUpserts: unknown[] = [];
+    const app = createAdminUIApp({
+      ...base,
+      chatClient,
+      // No pushService/vapidPublicKey — pushEnabled stays false, so
+      // recordWatch (spied below) must never be invoked.
+      pushService: makeFakePushService(undefined, async () => {
+        watchUpserts.push(true);
+      }),
+    });
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/upload`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${sessionCookie}`,
+          "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: "body=push+disabled+case",
+      },
+    );
+    expect(res.status).toBe(201);
+    expect(watchUpserts).toHaveLength(0);
+  });
+});
+
+// ─── Attachment proxy: GET messages/:messageId/attachment (VM-3.1) ────────────
+// Streams a message's attachment bytes back to the browser for inline <audio>
+// playback — the browser never holds the chat service's admin bearer token,
+// so this route fetches on its behalf via chatClient.getAttachment().
+
+describe("GET /admin/chat/:agentId/threads/:threadId/messages/:messageId/attachment", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("returns 302 to login without session cookie", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
+    );
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/login");
+  });
+
+  it("streams bytes with an audio/* Content-Type for a .webm attachment", async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4]);
+    const chatClient = makeMockChatClient({
+      getAttachment: async () => ({
+        bytes,
+        filename: "recording-123.webm",
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toBe("audio/webm");
+    const body = new Uint8Array(await res.arrayBuffer());
+    expect(Array.from(body)).toEqual(Array.from(bytes));
+  });
+
+  it("returns 404 when the chat client reports no attachment", async () => {
+    const chatClient = makeMockChatClient({ getAttachment: async () => null });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(404);
+  });
+
+  it("returns 503 when the chat service is not configured", async () => {
+    const app = createAdminUIApp(makeBaseDeps()); // no chatClient
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(503);
+  });
+});
+
+// ─── Thread detail page: conversation window ──────────────────────────────────
+
+describe("GET /admin/chat/:agentId/threads/:threadId — conversation window", () => {
+  let sessionCookie: string;
+
+  beforeAll(async () => {
+    sessionCookie = await makeSessionCookie();
+  });
+
+  it("renders message bubbles (role labels) when messages present", async () => {
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [MOCK_MESSAGE, MOCK_ASSISTANT_MESSAGE],
+        total: 2,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("Hello, agent!");
+    expect(html).toContain("Here is");
+  });
+
+  it("renders markdown for assistant messages (bold → <strong>)", async () => {
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [MOCK_ASSISTANT_MESSAGE],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const html = await res.text();
+    expect(html).toContain("<strong>bold text</strong>");
+  });
+
+  it("renders markdown for assistant messages (inline code → <code>)", async () => {
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [MOCK_ASSISTANT_MESSAGE],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const html = await res.text();
+    expect(html).toContain("<code>inline code</code>");
+  });
+
+  it("shows error state for messages with errorKind", async () => {
+    const chatClient = makeMockChatClient({
+      listMessages: async () => ({
+        messages: [MOCK_ERROR_MESSAGE],
+        total: 1,
+        limit: 50,
+        offset: 0,
+      }),
+    });
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const html = await res.text();
+    expect(html).toContain("Rate limited");
+  });
+
+  it("includes the live status bubble id in inline JS (CFB-2.3)", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const html = await res.text();
+    expect(html).toContain("live-status-bubble");
+  });
+
+  it("includes messages-container and send-btn in the page", async () => {
+    const chatClient = makeMockChatClient();
+    const app = createAdminUIApp(makeBaseDeps({ chatClient }));
+    const res = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { Cookie: `admin_session=${sessionCookie}` } },
+    );
+    const html = await res.text();
+    expect(html).toContain("messages-container");
+    expect(html).toContain("send-btn");
+  });
+});
+
+// ─── Agent-member access ──────────────────────────────────────────────────────
+
+const MEMBER_EMAIL = "member@example.com";
+const OTHER_AGENT_ID = "agent-other-789";
+
+function makeMemberDeps(
+  overrides?: Partial<AdminUIDeps>,
+  memberOf: string[] = [AGENT_ID],
+): AdminUIDeps {
+  const base = makeBaseDeps();
+  return makeBaseDeps({
+    agentMemberService: {
+      ...base.agentMemberService,
+      exists: async (agentId: string, email: string) =>
+        email === MEMBER_EMAIL && memberOf.includes(agentId),
+      listByEmail: async (email: string) =>
+        email === MEMBER_EMAIL
+          ? memberOf.map((agentId) => ({
+              id: `m-${agentId}`,
+              agentId,
+              email,
+              createdAt: new Date(),
+            }))
+          : [],
+    },
+    agentService: {
+      ...base.agentService,
+      listByIds: async (ids: string[]) =>
+        ids.map((id) => ({
+          id,
+          name: `Agent ${id}`,
+          slackId: null,
+          createdAt: new Date("2024-01-01"),
+        })) as never,
+    },
+    ...overrides,
+  });
+}
+
+describe("chat routes — agent member access", () => {
+  let memberCookie: string;
+  let strangerCookie: string;
+
+  beforeAll(async () => {
+    memberCookie = await makeSessionCookie(
+      SESSION_SECRET,
+      "sub-member",
+      MEMBER_EMAIL,
+      false,
+    );
+    strangerCookie = await makeSessionCookie(
+      SESSION_SECRET,
+      "sub-stranger",
+      "stranger@example.com",
+      false,
+    );
+  });
+
+  const get = (
+    app: ReturnType<typeof createAdminUIApp>,
+    path: string,
+    cookie: string,
+  ) => app.request(path, { headers: { Cookie: `admin_session=${cookie}` } });
+
+  it("member can open the chat page for their own agent", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await get(app, `/admin/chat?agentId=${AGENT_ID}`, memberCookie);
+    expect(res.status).toBe(200);
+  });
+
+  it("chat page lists only the agents the member belongs to", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await get(app, "/admin/chat", memberCookie);
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain(`Agent ${AGENT_ID}`);
+    expect(html).not.toContain("Test Agent");
+  });
+
+  it("member is forbidden from the chat page of an agent they don't belong to", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await get(
+      app,
+      `/admin/chat?agentId=${OTHER_AGENT_ID}`,
+      memberCookie,
+    );
+    expect(res.status).toBe(403);
+  });
+
+  it("non-member is forbidden from an agent's thread", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await get(
+      app,
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      strangerCookie,
+    );
+    expect(res.status).toBe(403);
+  });
+
+  it("member can open a thread owned by their agent", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await get(
+      app,
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      memberCookie,
+    );
+    expect(res.status).toBe(200);
+  });
+
+  it("member cannot read another agent's thread by pairing it with their own agentId", async () => {
+    const chatClient = makeMockChatClient({
+      getThread: async () => ({ ...MOCK_THREAD, agentId: OTHER_AGENT_ID }),
+    });
+    const app = createAdminUIApp(makeMemberDeps({ chatClient }));
+    for (const suffix of ["", "/messages.json"]) {
+      const res = await get(
+        app,
+        `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}${suffix}`,
+        memberCookie,
+      );
+      expect(res.status).toBe(403);
+    }
+  });
+
+  it("member cannot send to, rename, or delete another agent's thread", async () => {
+    let writes = 0;
+    const chatClient = makeMockChatClient({
+      getThread: async () => ({ ...MOCK_THREAD, agentId: OTHER_AGENT_ID }),
+      createMessage: async () => {
+        writes++;
+        return MOCK_MESSAGE;
+      },
+      updateThread: async () => {
+        writes++;
+        return MOCK_THREAD;
+      },
+      deleteThread: async () => {
+        writes++;
+      },
+    });
+    const app = createAdminUIApp(makeMemberDeps({ chatClient }));
+    const base = `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`;
+    for (const path of [
+      `${base}/messages`,
+      `${base}/messages/upload`,
+      `${base}/messages.json`,
+      `${base}/rename`,
+      `${base}/delete`,
+    ]) {
+      const res = await app.request(path, {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${memberCookie}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ body: "hi", title: "x" }),
+      });
+      expect(res.status).toBe(403);
+    }
+    expect(writes).toBe(0);
+  });
+
+  it("member can create a thread and post a message on their own agent", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const created = await app.request(`/admin/chat/${AGENT_ID}/threads`, {
+      method: "POST",
+      headers: { Cookie: `admin_session=${memberCookie}` },
+      body: new FormData(),
+    });
+    expect(created.status).toBe(302);
+    const posted = await app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+      {
+        method: "POST",
+        headers: {
+          Cookie: `admin_session=${memberCookie}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ body: "hello" }),
+      },
+    );
+    expect(posted.status).toBe(200);
+  });
+
+  it("member cannot create a thread on an agent they don't belong to", async () => {
+    const app = createAdminUIApp(
+      makeMemberDeps({ chatClient: makeMockChatClient() }),
+    );
+    const res = await app.request(`/admin/chat/${OTHER_AGENT_ID}/threads`, {
+      method: "POST",
+      headers: { Cookie: `admin_session=${memberCookie}` },
+      body: new FormData(),
+    });
+    expect(res.status).toBe(403);
+  });
+});
+
+// ─── SSP-8.4: account-status send gate ────────────────────────────────────────
+
+describe("account status gates chat message-send (SSP-8.4)", () => {
+  const ACCOUNT_ID = "acct-gate";
+  const SEND_PATHS: {
+    suffix: string;
+    init: { headers: Record<string, string>; body: BodyInit };
+  }[] = [
+    {
+      suffix: "/messages",
+      init: {
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: "body=hi",
+      },
+    },
+    {
+      suffix: "/messages.json",
+      init: {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ body: "hi" }),
+      },
+    },
+    {
+      suffix: "/messages/upload",
+      init: {
+        headers: {},
+        body: (() => {
+          const fd = new FormData();
+          fd.set("file", new File(["x"], "x.txt"));
+          return fd;
+        })(),
+      },
+    },
+  ];
+
+  function gateDeps(status: string | null, writes: { n: number }) {
+    const base = makeBaseDeps();
+    return makeBaseDeps({
+      chatClient: makeMockChatClient({
+        createMessage: async () => {
+          writes.n++;
+          return MOCK_MESSAGE;
+        },
+      }),
+      callerScopeResolver: async () => ({
+        kind: "scoped",
+        accountId: ACCOUNT_ID,
+        agentIds: [AGENT_ID],
+      }),
+      accountService: {
+        getById: async () =>
+          status ? ({ id: ACCOUNT_ID, status } as never) : null,
+        countAgents: async () => 0,
+        listAgentIds: async () => [AGENT_ID],
+      },
+      agentService: {
+        ...base.agentService,
+        getDetail: async () =>
+          ({
+            id: AGENT_ID,
+            accountId: status === "none" ? null : ACCOUNT_ID,
+          }) as never,
+      },
+    });
+  }
+
+  async function send(
+    app: ReturnType<typeof createAdminUIApp>,
+    p: (typeof SEND_PATHS)[number],
+    cookie: string,
+  ) {
+    return app.request(
+      `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}${p.suffix}`,
+      {
+        method: "POST",
+        ...p.init,
+        headers: { ...p.init.headers, Cookie: `admin_session=${cookie}` },
+      },
+    );
+  }
+
+  let userCookie: string;
+  let adminCookie: string;
+  beforeAll(async () => {
+    userCookie = await makeSessionCookie(
+      SESSION_SECRET,
+      "sub-acct-user",
+      "acct-user@example.com",
+      false,
+    );
+    adminCookie = await makeSessionCookie();
+  });
+
+  for (const status of ["suspended", "trial_expired"]) {
+    it(`rejects sends from account users when ${status}, but history still reads`, async () => {
+      const writes = { n: 0 };
+      const app = createAdminUIApp(gateDeps(status, writes));
+      for (const p of SEND_PATHS) {
+        const res = await send(app, p, userCookie);
+        expect(res.status).toBe(403);
+        expect(await res.text()).toContain(
+          status === "suspended" ? "suspended" : "trial has expired",
+        );
+      }
+      expect(writes.n).toBe(0);
+      const history = await app.request(
+        `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
+        { headers: { Cookie: `admin_session=${userCookie}` } },
+      );
+      expect(history.status).toBe(200);
+      const thread = await app.request(
+        `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+        { headers: { Cookie: `admin_session=${userCookie}` } },
+      );
+      expect(thread.status).toBe(200);
+    });
+
+    it(`allows platform admins to send when ${status}`, async () => {
+      const writes = { n: 0 };
+      const app = createAdminUIApp(gateDeps(status, writes));
+      const res = await send(app, SEND_PATHS[1], adminCookie);
+      expect(res.status).toBe(200);
+      expect(writes.n).toBe(1);
+    });
+  }
+
+  it("allows sends when the account is active", async () => {
+    const writes = { n: 0 };
+    const app = createAdminUIApp(gateDeps("active", writes));
+    const res = await send(app, SEND_PATHS[1], userCookie);
+    expect(res.status).toBe(200);
+    expect(writes.n).toBe(1);
+  });
+
+  it("is unaffected for agents with no account", async () => {
+    const writes = { n: 0 };
+    const app = createAdminUIApp(gateDeps("none", writes));
+    const res = await send(app, SEND_PATHS[1], userCookie);
+    expect(res.status).toBe(200);
+    expect(writes.n).toBe(1);
+  });
+});