@app-vitals/agent-admin 0.0.1 → 0.1.1

package/src/agent-cron-run-stats.smoke.test.ts

@@ -0,0 +1,953 @@
+/**
+ * admin/src/agent-cron-run-stats.smoke.test.ts
+ * Smoke tests for GET /agents/all/cron-runs/stats.
+ *
+ * Uses app.request() — no real server, no real DB.
+ * AgentCronRunStatsService is injected as an in-memory mock.
+ */
+
+import { beforeAll, describe, expect, it } from "bun:test";
+import { sign } from "hono/jwt";
+import type {
+  AgentCronRunStatsService,
+  CronRunOutcomes,
+} from "./agent-cron-run-stats.ts";
+import type { AdminDeps } from "./agents-api.ts";
+import { createAdminApp, parseAdminApiKeys } from "./agents-api.ts";
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const AGENT_ID = "agent-test-123";
+const ADMIN_API_KEY = "admin-stats-key-for-tests";
+const VALID_BEARER_TOKEN = "valid-bearer-token-value";
+
+async function makeSessionCookie(secret = SESSION_SECRET): Promise<string> {
+  return sign(
+    {
+      isAdmin: true,
+      userId: "user-123",
+      email: "admin@example.com",
+      name: "Admin User",
+      iat: Math.floor(Date.now() / 1000),
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    },
+    secret,
+    "HS256",
+  );
+}
+
+// Minimal mock stats response matching CronRunTokenStats shape
+const MOCK_STATS = {
+  totals: {
+    input: 600,
+    output: 300,
+    cacheRead: 60,
+    cacheCreation: 30,
+    total: 990,
+    costUsd: 0.006,
+  },
+  byAgent: [
+    {
+      key: "agent-1",
+      input: 400,
+      output: 200,
+      cacheRead: 40,
+      cacheCreation: 20,
+      total: 660,
+      costUsd: 0.004,
+    },
+    {
+      key: "agent-2",
+      input: 200,
+      output: 100,
+      cacheRead: 20,
+      cacheCreation: 10,
+      total: 330,
+      costUsd: 0.002,
+    },
+  ],
+  byCron: [
+    {
+      key1: "agent-1",
+      key2: "cron-alpha",
+      input: 400,
+      output: 200,
+      cacheRead: 40,
+      cacheCreation: 20,
+      total: 660,
+      costUsd: 0.004,
+    },
+    {
+      key1: "agent-2",
+      key2: "cron-beta",
+      input: 200,
+      output: 100,
+      cacheRead: 20,
+      cacheCreation: 10,
+      total: 330,
+      costUsd: 0.002,
+    },
+  ],
+  byModel: [
+    {
+      key1: "agent-1",
+      key2: "claude-sonnet-4-5",
+      input: 400,
+      output: 200,
+      cacheRead: 40,
+      cacheCreation: 20,
+      total: 660,
+      costUsd: 0.004,
+    },
+    {
+      key1: "agent-2",
+      key2: "claude-opus-4-5",
+      input: 200,
+      output: 100,
+      cacheRead: 20,
+      cacheCreation: 10,
+      total: 330,
+      costUsd: 0.002,
+    },
+  ],
+  daily: [
+    {
+      period: "2026-01-10",
+      input: 100,
+      output: 50,
+      cacheRead: 10,
+      cacheCreation: 5,
+      total: 165,
+      costUsd: 0.001,
+    },
+    {
+      period: "2026-01-11",
+      input: 200,
+      output: 100,
+      cacheRead: 20,
+      cacheCreation: 10,
+      total: 330,
+      costUsd: 0.002,
+    },
+    {
+      period: "2026-01-12",
+      input: 300,
+      output: 150,
+      cacheRead: 30,
+      cacheCreation: 15,
+      total: 495,
+      costUsd: 0.003,
+    },
+  ],
+  byCronModel: [],
+  byPhase: [
+    {
+      key: "dev-task",
+      input: 400,
+      output: 200,
+      cacheRead: 40,
+      cacheCreation: 20,
+      total: 660,
+      costUsd: 0.004,
+    },
+    {
+      key: "review",
+      input: 200,
+      output: 100,
+      cacheRead: 20,
+      cacheCreation: 10,
+      total: 330,
+      costUsd: 0.002,
+    },
+  ],
+  bySkill: [
+    {
+      kind: "skill",
+      name: "shipwright:dev-task",
+      runs: 2,
+      invocations: 3,
+      turns: 10,
+      input: 100,
+      output: 50,
+      cacheRead: 10,
+      cacheCreation: 5,
+      avgInvokeContextDelta: 1200,
+    },
+  ],
+  baselines: [
+    {
+      contextFingerprint: "fp-1",
+      baselineModel: "claude-sonnet-5-5",
+      phase: "dev-task",
+      runs: 3,
+      avgContextTokens: 24000,
+      minContextTokens: 23000,
+      maxContextTokens: 25000,
+      avgTurns: 30,
+      avgToolCalls: null,
+      firstSeen: "2026-01-10T09:00:00.000Z",
+      lastSeen: "2026-01-12T09:00:00.000Z",
+    },
+  ],
+};
+
+const MOCK_OUTCOMES: CronRunOutcomes = {
+  series: [
+    {
+      phase: "dev-task",
+      contextFingerprint: "abc123def456",
+      runs: 5,
+      completed: 3,
+      failed: 1,
+      skipped: 1,
+      skipReasons: { "no-ready-task": 1 },
+      avgDurationMs: 120000,
+      p50DurationMs: 90000,
+      avgTurns: 40,
+      avgToolCalls: 55,
+      avgContextTokens: 21000,
+    },
+    {
+      phase: null,
+      contextFingerprint: null,
+      runs: 1,
+      completed: 0,
+      failed: 0,
+      skipped: 1,
+      skipReasons: { unknown: 1 },
+      avgDurationMs: null,
+      p50DurationMs: null,
+      avgTurns: null,
+      avgToolCalls: null,
+      avgContextTokens: null,
+    },
+  ],
+};
+
+function makeMockStatsService(): Pick<
+  AgentCronRunStatsService,
+  "query" | "outcomes"
+> {
+  return {
+    query: async (_from?: string, _to?: string, _agentId?: string) =>
+      MOCK_STATS,
+    outcomes: async () => MOCK_OUTCOMES,
+  };
+}
+
+function makeMockDeps(): AdminDeps {
+  return {
+    agentService: {
+      create: async () => {
+        throw new Error("not implemented");
+      },
+      delete: async () => {},
+      list: async () => [],
+      getSummary: async () => null,
+      getDetail: async () => null,
+      exists: async () => false,
+      updateSelfHosted: async () => {
+        throw new Error("not implemented");
+      },
+      updateFields: async () => {
+        throw new Error("not implemented");
+      },
+      runTransaction: async (fn) => fn(undefined as never),
+    },
+    agentEnvService: {
+      upsert: async () => {},
+      patch: async () => {},
+      getByAgentId: async () => ({ env: {}, secretKeys: [] }),
+      deleteKey: async () => {},
+    },
+    agentCronJobService: {
+      list: async () => [],
+      listWithRunSummary: async () => [],
+      create: async () => ({
+        id: "cron-id",
+        agentId: AGENT_ID,
+        schedule: "0 9 * * *",
+        prompt: "test",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date("2024-01-01"),
+        updatedAt: new Date("2024-01-01"),
+      }),
+      update: async () => ({
+        id: "cron-id",
+        agentId: AGENT_ID,
+        schedule: "0 9 * * *",
+        prompt: "test",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date("2024-01-01"),
+        updatedAt: new Date("2024-01-01"),
+      }),
+      delete: async () => {},
+      get: async () => ({
+        id: "cron-id",
+        agentId: AGENT_ID,
+        schedule: "0 9 * * *",
+        prompt: "test",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date("2024-01-01"),
+        updatedAt: new Date("2024-01-01"),
+      }),
+      setEnabled: async (_agentId, _cronId, enabled) => ({
+        id: "cron-id",
+        agentId: AGENT_ID,
+        schedule: "0 9 * * *",
+        prompt: "test",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled,
+        preCheck: null,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date("2024-01-01"),
+        updatedAt: new Date("2024-01-01"),
+      }),
+      updatePreCheck: async (_agentId, _cronId, preCheck) => ({
+        id: "cron-id",
+        agentId: AGENT_ID,
+        schedule: "0 9 * * *",
+        prompt: "test",
+        channel: null,
+        user: null,
+        silent: false,
+        enabled: true,
+        preCheck,
+        name: null,
+        system: false,
+        parentCronId: null,
+        lockdownDisabledAt: null,
+        createdAt: new Date("2024-01-01"),
+        updatedAt: new Date("2024-01-01"),
+      }),
+      reconcileSystemCrons: async () => ({
+        created: 0,
+        updated: 0,
+        deleted: 0,
+      }),
+    },
+    agentToolService: {
+      list: async () => [],
+      add: async () => ({
+        id: "tool-id",
+        agentId: AGENT_ID,
+        pattern: "Read",
+        enabled: true,
+        createdAt: new Date(),
+      }),
+      toggle: async () => ({
+        id: "tool-id",
+        agentId: AGENT_ID,
+        pattern: "Read",
+        enabled: false,
+        createdAt: new Date(),
+      }),
+      remove: async () => {},
+    },
+    agentTokenService: {
+      create: async () => ({
+        token: {
+          id: "token-id",
+          agentId: AGENT_ID,
+          token: "sha256hash",
+          label: null,
+          createdAt: new Date(),
+          revokedAt: null,
+        },
+        rawToken:
+          "raw-hex-token-64chars-placeholder-pad-pad-pad-pad-pad-pad-pad",
+      }),
+      listForAgent: async () => [],
+      revoke: async () => ({
+        id: "token-id",
+        agentId: AGENT_ID,
+        token: "sha256hash",
+        label: null,
+        createdAt: new Date(),
+        revokedAt: new Date(),
+      }),
+      validate: async () => null,
+    },
+    agentPluginService: {
+      list: async () => [],
+      add: async () => ({
+        id: "plugin-id",
+        agentId: AGENT_ID,
+        name: "test",
+        version: "1.0.0",
+        enabled: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      remove: async () => {},
+      removeByName: async () => {},
+    },
+    agentMemberService: {
+      exists: async () => false,
+      listByEmail: async () => [],
+      add: async (agentId: string, email: string) => ({
+        id: "member-1",
+        agentId,
+        email,
+        createdAt: new Date(),
+      }),
+      listByAgentId: async () => [],
+    },
+    specialtyRegistry: {
+      getManifest: () => {
+        throw new Error("not implemented");
+      },
+      tryGetManifest: () => undefined,
+      listTypes: () => [],
+    },
+    agentChatTokenService: {
+      upsertDailyByModel: async (
+        agentId: string,
+        date: string,
+        model: string,
+      ) => ({
+        id: "daily-id",
+        agentId,
+        date,
+        model,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+        costUsd: 0,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      }),
+      queryStats: async () => ({
+        totals: {
+          input: 0,
+          output: 0,
+          cacheRead: 0,
+          cacheCreation: 0,
+          total: 0,
+        },
+        byAgent: [],
+        byModel: [],
+        daily: [],
+      }),
+    },
+    agentGitHubInstallationsService: {
+      push: async () => {
+        throw new Error("not implemented");
+      },
+      get: async () => null,
+    },
+    agentCronRunService: {
+      create: async () => ({
+        id: "run-id",
+        cronId: "cron-id",
+        agentId: AGENT_ID,
+        startedAt: new Date(),
+        completedAt: null,
+        skipped: false,
+        skipReason: null,
+        outcome: null,
+        error: null,
+        phase: null,
+        itemType: null,
+        itemId: null,
+        commandVariant: null,
+        sessionId: null,
+        lastHeartbeatAt: null,
+        baselineModel: null,
+        baselineContextTokens: null,
+        baselineInputTokens: null,
+        baselineCacheCreationTokens: null,
+        baselineCacheReadTokens: null,
+        turns: null,
+        toolCalls: null,
+        contextFingerprint: null,
+        pluginVersion: null,
+        claudeCodeVersion: null,
+        phaseId: null,
+        inputTokens: null,
+        outputTokens: null,
+        cacheReadTokens: null,
+        cacheCreationTokens: null,
+        costUsd: null,
+        model: null,
+        createdAt: new Date(),
+      }),
+      list: async () => ({ items: [], total: 0, limit: 20, offset: 0 }),
+      patch: async () => ({
+        id: "run-id",
+        cronId: "cron-id",
+        agentId: AGENT_ID,
+        startedAt: new Date(),
+        completedAt: null,
+        skipped: false,
+        skipReason: null,
+        outcome: null,
+        error: null,
+        phase: null,
+        itemType: null,
+        itemId: null,
+        commandVariant: null,
+        sessionId: null,
+        lastHeartbeatAt: null,
+        baselineModel: null,
+        baselineContextTokens: null,
+        baselineInputTokens: null,
+        baselineCacheCreationTokens: null,
+        baselineCacheReadTokens: null,
+        turns: null,
+        toolCalls: null,
+        contextFingerprint: null,
+        pluginVersion: null,
+        claudeCodeVersion: null,
+        phaseId: null,
+        inputTokens: null,
+        outputTokens: null,
+        cacheReadTokens: null,
+        cacheCreationTokens: null,
+        costUsd: null,
+        model: null,
+        createdAt: new Date(),
+        modelBreakdown: [],
+      }),
+    },
+    agentCronRunStatsService: makeMockStatsService(),
+    prisma: {
+      agent: {
+        create: async (args: {
+          data: { name: string; slackId: string | null; selfHosted?: boolean };
+        }) => ({
+          id: "agent-new-id",
+          name: args.data.name,
+          slackId: args.data.slackId,
+          selfHosted: args.data.selfHosted ?? false,
+          createdAt: new Date("2024-01-01"),
+          updatedAt: new Date("2024-01-01"),
+        }),
+        findUnique: async (args: { where: { id: string } }) =>
+          args.where.id === AGENT_ID
+            ? {
+                id: AGENT_ID,
+                name: "Test Agent",
+                slackId: null,
+                selfHosted: false,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+              }
+            : null,
+        findMany: async () => [],
+        delete: async (args: { where: { id: string } }) => ({
+          id: args.where.id,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        }),
+        update: async (args: { where: { id: string }; data: unknown }) => ({
+          id: args.where.id,
+          name: "Test Agent",
+          slackId: null,
+          selfHosted: false,
+          repos: [],
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        }),
+      },
+    } as unknown as AdminDeps["prisma"],
+    provisioner: {
+      canProvision: false,
+      provision: async (agentId) => ({
+        resourceName: agentId,
+        secretName: `${agentId}-token`,
+        deploymentName: agentId,
+      }),
+      deprovision: async () => {},
+      reconcile: async () => ({
+        recreated: [],
+        migrated: [],
+        noOwner: [],
+        dryRun: false,
+        updated: [],
+        orphans: [],
+        failed: [],
+      }),
+    },
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: {
+      listTokensForAgent: async () => [],
+      revokeToken: async () => {},
+      deleteThreadsForAgent: async () => ({ deleted: 0 }),
+    },
+    slack: {
+      deleteApp: async () => {},
+    },
+    decrypt: (value: string) => value,
+    sessionSecret: SESSION_SECRET,
+  };
+}
+
+// ─── Stats route smoke tests ─────────────────────────────────────────────────
+
+describe("admin API — GET /agents/all/cron-runs/stats", () => {
+  let cookie: string;
+
+  beforeAll(async () => {
+    cookie = await makeSessionCookie();
+  });
+
+  it("returns 200 with correct CronRunTokenStats shape (session auth)", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+
+    // Check all dimensions are present, including byPhase
+    expect(body.totals).toBeDefined();
+    expect(body.byAgent).toBeDefined();
+    expect(body.byCron).toBeDefined();
+    expect(body.byModel).toBeDefined();
+    expect(body.daily).toBeDefined();
+    expect(body.byPhase).toBeDefined();
+
+    // Verify totals shape
+    expect(typeof body.totals.input).toBe("number");
+    expect(typeof body.totals.output).toBe("number");
+    expect(typeof body.totals.cacheRead).toBe("number");
+    expect(typeof body.totals.cacheCreation).toBe("number");
+    expect(typeof body.totals.total).toBe("number");
+
+    // Verify arrays
+    expect(Array.isArray(body.byAgent)).toBe(true);
+    expect(Array.isArray(body.byCron)).toBe(true);
+    expect(Array.isArray(body.byModel)).toBe(true);
+    expect(Array.isArray(body.daily)).toBe(true);
+
+    // Verify keyed shapes
+    if (body.byAgent.length > 0) {
+      expect(body.byAgent[0].key).toBeDefined();
+      expect(typeof body.byAgent[0].input).toBe("number");
+    }
+    if (body.byCron.length > 0) {
+      expect(body.byCron[0].key1).toBeDefined();
+      expect(body.byCron[0].key2).toBeDefined();
+    }
+    if (body.byModel.length > 0) {
+      expect(body.byModel[0].key1).toBeDefined();
+      expect(body.byModel[0].key2).toBeDefined();
+    }
+    if (body.daily.length > 0) {
+      expect(body.daily[0].period).toBeDefined();
+      expect(typeof body.daily[0].input).toBe("number");
+    }
+    expect(Array.isArray(body.byPhase)).toBe(true);
+    if (body.byPhase.length > 0) {
+      expect(body.byPhase[0].key).toBeDefined();
+      expect(typeof body.byPhase[0].input).toBe("number");
+    }
+  });
+
+  it("returns correct mock data values", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+
+    expect(body.totals.input).toBe(600);
+    expect(body.totals.total).toBe(990);
+    expect(body.byAgent).toHaveLength(2);
+    expect(body.byCron).toHaveLength(2);
+    expect(body.byModel).toHaveLength(2);
+    expect(body.daily).toHaveLength(3);
+    expect(body.byPhase).toHaveLength(2);
+    expect(body.byPhase[0].key).toBe("dev-task");
+  });
+
+  it("returns bySkill and baselines with the documented shape", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+
+    expect(body.bySkill).toHaveLength(1);
+    expect(body.bySkill[0].kind).toBe("skill");
+    expect(body.bySkill[0].name).toBe("shipwright:dev-task");
+    expect(body.bySkill[0].invocations).toBe(3);
+    expect(body.bySkill[0].avgInvokeContextDelta).toBe(1200);
+
+    expect(body.baselines).toHaveLength(1);
+    expect(body.baselines[0].contextFingerprint).toBe("fp-1");
+    expect(body.baselines[0].baselineModel).toBe("claude-sonnet-5-5");
+    expect(body.baselines[0].phase).toBe("dev-task");
+    expect(body.baselines[0].avgContextTokens).toBe(24000);
+    expect(body.baselines[0].avgToolCalls).toBeNull();
+    expect(typeof body.baselines[0].firstSeen).toBe("string");
+  });
+
+  it("accepts from/to query params without error", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request(
+      "/agents/all/cron-runs/stats?from=2026-01-01T00:00:00Z&to=2026-01-31T00:00:00Z",
+      { headers: { Cookie: `admin_session=${cookie}` } },
+    );
+    expect(res.status).toBe(200);
+  });
+
+  it("returns 200 with admin bearer token", async () => {
+    const deps: AdminDeps = {
+      ...makeMockDeps(),
+      adminApiKeys: parseAdminApiKeys(`admin:${ADMIN_API_KEY}:*`),
+    };
+    const app = createAdminApp(deps);
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Authorization: `Bearer ${ADMIN_API_KEY}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it("unauthenticated request returns 401", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/stats");
+    expect(res.status).toBe(401);
+  });
+
+  it("agent-scoped bearer token returns 403", async () => {
+    const deps: AdminDeps = {
+      ...makeMockDeps(),
+      agentTokenService: {
+        ...makeMockDeps().agentTokenService,
+        // Returns a per-agent token (not admin)
+        validate: async () => ({ agentId: AGENT_ID }),
+      },
+    };
+    const app = createAdminApp(deps);
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+  });
+});
+
+describe("admin API — GET /agents/:id/cron-runs/stats", () => {
+  function depsWithAgentToken(calls: Array<string | undefined>): AdminDeps {
+    const base = makeMockDeps();
+    return {
+      ...base,
+      agentCronRunStatsService: {
+        ...base.agentCronRunStatsService,
+        query: async (_from?: string, _to?: string, agentId?: string) => {
+          calls.push(agentId);
+          return MOCK_STATS;
+        },
+      },
+      agentTokenService: {
+        ...base.agentTokenService,
+        validate: async () => ({ agentId: AGENT_ID }),
+      },
+    };
+  }
+
+  it("agent's own bearer token gets 200 and the query is scoped to that agent", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request(`/agents/${AGENT_ID}/cron-runs/stats`, {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(200);
+    expect(calls).toEqual([AGENT_ID]);
+  });
+
+  it("another agent's bearer token returns 403 without querying", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request("/agents/other-agent/cron-runs/stats", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+    expect(calls).toEqual([]);
+  });
+
+  it("unauthenticated request returns 401", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request(`/agents/${AGENT_ID}/cron-runs/stats`);
+    expect(res.status).toBe(401);
+  });
+
+  it("does not swallow the static /agents/all/cron-runs/stats admin route", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request("/agents/all/cron-runs/stats", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+    expect(calls).toEqual([]);
+  });
+});
+
+describe("admin API — GET /agents/:id/cron-runs/outcomes", () => {
+  function depsWithAgentToken(calls: Array<string | undefined>): AdminDeps {
+    const base = makeMockDeps();
+    return {
+      ...base,
+      agentCronRunStatsService: {
+        ...base.agentCronRunStatsService,
+        outcomes: async (_from?: string, _to?: string, agentId?: string) => {
+          calls.push(agentId);
+          return MOCK_OUTCOMES;
+        },
+      },
+      agentTokenService: {
+        ...base.agentTokenService,
+        validate: async () => ({ agentId: AGENT_ID }),
+      },
+    };
+  }
+
+  it("agent's own bearer token gets 200 and outcomes are scoped to that agent", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request(`/agents/${AGENT_ID}/cron-runs/outcomes`, {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(200);
+    expect(calls).toEqual([AGENT_ID]);
+  });
+
+  it("another agent's bearer token returns 403 without querying", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request("/agents/other-agent/cron-runs/outcomes", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+    expect(calls).toEqual([]);
+  });
+
+  it("unauthenticated request returns 401", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request(`/agents/${AGENT_ID}/cron-runs/outcomes`);
+    expect(res.status).toBe(401);
+  });
+
+  it("does not swallow the static /agents/all/cron-runs/outcomes admin route", async () => {
+    const calls: Array<string | undefined> = [];
+    const app = createAdminApp(depsWithAgentToken(calls));
+    const res = await app.request("/agents/all/cron-runs/outcomes", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+    expect(calls).toEqual([]);
+  });
+});
+
+describe("admin API — GET /agents/all/cron-runs/outcomes", () => {
+  let cookie: string;
+
+  beforeAll(async () => {
+    cookie = await makeSessionCookie();
+  });
+
+  it("returns 200 with the per-(phase, contextFingerprint) series shape", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/outcomes", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.series).toHaveLength(2);
+    expect(body.series[0]).toEqual(MOCK_OUTCOMES.series[0]);
+    expect(body.series[1].phase).toBeNull();
+    expect(body.series[1].avgDurationMs).toBeNull();
+  });
+
+  it("passes from/to through to the service", async () => {
+    const calls: Array<[string | undefined, string | undefined]> = [];
+    const deps = makeMockDeps();
+    deps.agentCronRunStatsService = {
+      ...makeMockStatsService(),
+      outcomes: async (from?: string, to?: string) => {
+        calls.push([from, to]);
+        return MOCK_OUTCOMES;
+      },
+    };
+    const app = createAdminApp(deps);
+    const res = await app.request(
+      "/agents/all/cron-runs/outcomes?from=2026-01-01T00:00:00Z&to=2026-01-31T00:00:00Z",
+      { headers: { Cookie: `admin_session=${cookie}` } },
+    );
+    expect(res.status).toBe(200);
+    expect(calls).toEqual([["2026-01-01T00:00:00Z", "2026-01-31T00:00:00Z"]]);
+  });
+
+  it("returns 200 with admin bearer token", async () => {
+    const app = createAdminApp({
+      ...makeMockDeps(),
+      adminApiKeys: parseAdminApiKeys(`admin:${ADMIN_API_KEY}:*`),
+    });
+    const res = await app.request("/agents/all/cron-runs/outcomes", {
+      headers: { Authorization: `Bearer ${ADMIN_API_KEY}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it("unauthenticated request returns 401", async () => {
+    const app = createAdminApp(makeMockDeps());
+    const res = await app.request("/agents/all/cron-runs/outcomes");
+    expect(res.status).toBe(401);
+  });
+
+  it("agent-scoped bearer token returns 403", async () => {
+    const deps: AdminDeps = {
+      ...makeMockDeps(),
+      agentTokenService: {
+        ...makeMockDeps().agentTokenService,
+        validate: async () => ({ agentId: AGENT_ID }),
+      },
+    };
+    const app = createAdminApp(deps);
+    const res = await app.request("/agents/all/cron-runs/outcomes", {
+      headers: { Authorization: `Bearer ${VALID_BEARER_TOKEN}` },
+    });
+    expect(res.status).toBe(403);
+  });
+});