@app-vitals/agent-admin 0.0.1 → 0.1.1

package/src/agents-api.integration.test.ts

@@ -0,0 +1,705 @@
+/**
+ * agent/src/agents-api.integration.test.ts
+ * Integration tests for the admin CRUD API against a real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ *
+ * Key assertions:
+ * - POST /agents/:id/envs encrypts values at rest
+ * - POST /agents/:id/tokens stores hash not raw token
+ * - GET /tokens shows hash metadata only (no rawToken)
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { sign } from "hono/jwt";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentChatTokenService } from "./agent-chat-tokens.ts";
+import { AgentCronJobService } from "./agent-cron-jobs.ts";
+import { AgentCronRunStatsService } from "./agent-cron-run-stats.ts";
+import { AgentCronRunService } from "./agent-cron-runs.ts";
+import { AgentEnvService } from "./agent-envs.ts";
+import { AgentGitHubInstallationsService } from "./agent-github-installations.ts";
+import { AgentMemberService } from "./agent-members.ts";
+import { AgentPluginService } from "./agent-plugins.ts";
+import type { AgentProvisioner } from "./agent-provisioner.ts";
+import { NoopAgentProvisioner } from "./agent-provisioner.ts";
+import { AgentTokenService } from "./agent-tokens.ts";
+import { AgentToolService } from "./agent-tools.ts";
+import type { SpecialtyManifestResolver } from "./specialty-manifest-loader.ts";
+import type { SpecialtyManifest } from "./specialty-registry.ts";
+import { AgentService } from "./agents.ts";
+import type { AdminDeps } from "./agents-api.ts";
+import { createAdminApp } from "./agents-api.ts";
+import { NoopChatServiceProvisioningClient } from "./chat-service-provisioning-client.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+import { makeTokenCrypto } from "./token-crypto.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+const SESSION_SECRET = "test-admin-session-secret-32-bytes!";
+const REAL_KEY =
+  "0000000000000000000000000000000000000000000000000000000000000001";
+
+async function makeSessionCookie(): Promise<string> {
+  return sign(
+    {
+      isAdmin: true,
+      userId: "user-123",
+      email: "admin@example.com",
+      name: "Admin User",
+      iat: Math.floor(Date.now() / 1000),
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    },
+    SESSION_SECRET,
+    "HS256",
+  );
+}
+
+function makePrisma(): PrismaClient {
+  // TEST_DB is guaranteed set — the describe block is skipped otherwise.
+  return createAdminPrismaClient(TEST_DB as string);
+}
+
+async function createAgent(
+  prisma: PrismaClient,
+  name = "Test Agent",
+): Promise<string> {
+  const agent = await prisma.agent.create({ data: { name } });
+  return agent.id;
+}
+
+/** A minimal valid "coding" manifest used to drive seeding assertions below. */
+const CODING_MANIFEST: SpecialtyManifest = {
+  apiVersion: "shipwright.dev/v1alpha1",
+  kind: "Specialty",
+  metadata: {
+    name: "coding",
+    displayName: "Coding Agent",
+    description: "test manifest",
+    version: "1.0.0",
+    skills: [],
+  },
+  identity: { templatesDir: "workspace/" },
+  crons: [],
+  plugins: ["shipwright"],
+  tools: [
+    "Read",
+    "Write",
+    "Edit",
+    "Glob",
+    "Grep",
+    "Bash",
+    "WebSearch",
+    "WebFetch",
+    "Skill",
+    "Agent",
+  ],
+  env: { required: [], optional: [] },
+  members: [],
+  repos: [],
+  chat: true,
+  voice: true,
+};
+
+/**
+ * Fake SpecialtyManifestResolver — resolves a fixed map of manifests by
+ * typeName. tryGetManifest() returns undefined (no fallback) for anything
+ * not in the map, mirroring SpecialtyRegistry's real contract.
+ */
+function fakeSpecialtyRegistry(
+  byType: Record<string, SpecialtyManifest> = { coding: CODING_MANIFEST },
+): SpecialtyManifestResolver {
+  return {
+    getManifest(typeName: string): SpecialtyManifest {
+      return byType[typeName] ?? (byType.coding as SpecialtyManifest);
+    },
+    tryGetManifest(typeName: string): SpecialtyManifest | undefined {
+      return byType[typeName];
+    },
+    listTypes() {
+      return Object.entries(byType).map(([name, manifest]) => ({
+        name,
+        displayName: manifest.metadata.displayName,
+      }));
+    },
+  };
+}
+
+function makeDeps(
+  prisma: PrismaClient,
+  provisioner: AgentProvisioner = new NoopAgentProvisioner(),
+  specialtyRegistry: SpecialtyManifestResolver = fakeSpecialtyRegistry(),
+): AdminDeps {
+  const savedKey = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  process.env.SHIPWRIGHT_ENCRYPTION_KEY = REAL_KEY;
+  const crypto = makeTokenCrypto();
+  if (savedKey === undefined) {
+    delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+  } else {
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = savedKey;
+  }
+
+  return {
+    agentService: new AgentService(prisma),
+    agentEnvService: new AgentEnvService(prisma, crypto),
+    agentCronJobService: new AgentCronJobService(prisma),
+    agentCronRunService: new AgentCronRunService(prisma),
+    agentCronRunStatsService: new AgentCronRunStatsService(prisma),
+    agentToolService: new AgentToolService(prisma),
+    agentTokenService: new AgentTokenService(prisma),
+    agentPluginService: new AgentPluginService(prisma),
+    agentMemberService: new AgentMemberService(prisma),
+    specialtyRegistry,
+    agentChatTokenService: new AgentChatTokenService(prisma),
+    agentGitHubInstallationsService: new AgentGitHubInstallationsService(
+      prisma,
+    ),
+    prisma,
+    provisioner,
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: new NoopChatServiceProvisioningClient(),
+    slack: {
+      deleteApp: async () => {},
+    },
+    decrypt: (value: string) => crypto.decrypt(value),
+    sessionSecret: SESSION_SECRET,
+  };
+}
+
+describeOrSkip("admin CRUD API (integration)", () => {
+  let prisma: PrismaClient;
+  let agentId: string;
+  let cookie: string;
+  let app: ReturnType<typeof createAdminApp>;
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+
+    // Clean all tables in FK dependency order
+    await prisma.agentWorkQueueSnapshot.deleteMany();
+    await prisma.agentPlugin.deleteMany();
+    await prisma.agentPhaseMethodology.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agentMember.deleteMany();
+    await prisma.agent.deleteMany();
+
+    agentId = await createAgent(prisma);
+    cookie = await makeSessionCookie();
+
+    app = createAdminApp(makeDeps(prisma));
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  // ─── Env var encryption ───────────────────────────────────────────────────────
+
+  it("POST /envs encrypts values at rest — raw DB value differs from input", async () => {
+    const savedKey = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = REAL_KEY;
+
+    try {
+      const res = await app.request(`/agents/${agentId}/envs`, {
+        method: "POST",
+        body: JSON.stringify({ SECRET: "my-api-key" }),
+        headers: {
+          "Content-Type": "application/json",
+          Cookie: `admin_session=${cookie}`,
+        },
+      });
+      expect(res.status).toBe(201);
+
+      // Raw DB value should be encrypted (not plain text)
+      const raw = await prisma.agentEnv.findFirst({
+        where: { agentId, key: "SECRET" },
+      });
+      expect(raw?.value).not.toBe("my-api-key");
+      expect(raw?.value).toContain(":"); // iv:ciphertext:authTag format
+    } finally {
+      if (savedKey === undefined) {
+        delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+      } else {
+        process.env.SHIPWRIGHT_ENCRYPTION_KEY = savedKey;
+      }
+    }
+  });
+
+  it("GET /envs returns decrypted values", async () => {
+    const savedKey = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = REAL_KEY;
+
+    try {
+      // First write via POST
+      await app.request(`/agents/${agentId}/envs`, {
+        method: "POST",
+        body: JSON.stringify({ SECRET: "my-api-key" }),
+        headers: {
+          "Content-Type": "application/json",
+          Cookie: `admin_session=${cookie}`,
+        },
+      });
+
+      // Then read via GET
+      const res = await app.request(`/agents/${agentId}/envs`, {
+        headers: { Cookie: `admin_session=${cookie}` },
+      });
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.env.SECRET).toBe("my-api-key");
+    } finally {
+      if (savedKey === undefined) {
+        delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+      } else {
+        process.env.SHIPWRIGHT_ENCRYPTION_KEY = savedKey;
+      }
+    }
+  });
+
+  // ─── Token hash storage ───────────────────────────────────────────────────────
+
+  it("POST /tokens stores hash not raw token; GET /tokens shows hash metadata only", async () => {
+    const res = await app.request(`/agents/${agentId}/tokens`, {
+      method: "POST",
+      body: JSON.stringify({ label: "ci-token" }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(res.status).toBe(201);
+
+    const createBody = await res.json();
+    const rawToken: string = createBody.rawToken;
+    expect(typeof rawToken).toBe("string");
+    expect(rawToken.length).toBeGreaterThan(0);
+
+    // Verify the stored token is a hash, not the raw token
+    const dbRecord = await prisma.agentToken.findFirst({
+      where: { agentId },
+    });
+    expect(dbRecord).not.toBeNull();
+    expect(dbRecord?.token).not.toBe(rawToken);
+    // SHA-256 hash is 64 hex chars
+    expect(dbRecord?.token).toHaveLength(64);
+
+    // GET /tokens should not expose rawToken
+    const listRes = await app.request(`/agents/${agentId}/tokens`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(listRes.status).toBe(200);
+    const listBody = await listRes.json();
+    expect(Array.isArray(listBody.tokens)).toBe(true);
+    expect(listBody.tokens).toHaveLength(1);
+    // rawToken must NOT be present in the list response
+    const listedToken = listBody.tokens[0];
+    expect(listedToken.rawToken).toBeUndefined();
+    // The stored hash value should also not be exposed
+    expect(listedToken.token).toBeUndefined();
+    expect(listedToken.id).toBe(dbRecord?.id);
+  });
+
+  // ─── typeName field ─────────────────────────────────────────────────────────
+
+  it("GET /agents includes typeName:'coding' for an agent created before typeName existed", async () => {
+    const res = await app.request("/agents", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    const entry = body.find((a: { id: string }) => a.id === agentId);
+    expect(entry).toBeDefined();
+    expect(entry.typeName).toBe("coding");
+  });
+
+  it("GET /agents/:id includes typeName:'coding' by default", async () => {
+    const res = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.typeName).toBe("coding");
+  });
+
+  // ─── Migration backfill read-back (pre-existing rows + child rows) ────────────
+  //
+  // Simulates the exact scenario the 20260724000000_add_agent_type_name
+  // migration must handle: rows that existed *before* the typeName column was
+  // added (never received an explicit value) must read back typeName="coding"
+  // via the column DEFAULT, and every child row (cron/plugin/tool/env/member)
+  // must be completely untouched — same count, same updatedAt — since the
+  // migration only ALTERs the Agent table.
+
+  it("migration backfill: pre-existing agent rows read back typeName='coding' and child rows (cron/plugin/tool/env/member) are untouched", async () => {
+    // Seed a second "pre-existing" agent with one row in every child table,
+    // simulating data that existed prior to the typeName migration landing.
+    const preExisting = await prisma.agent.create({
+      data: { name: "Pre-Existing Agent" },
+    });
+
+    const cron = await prisma.agentCronJob.create({
+      data: {
+        agentId: preExisting.id,
+        schedule: "0 9 * * 1-5",
+        prompt: "daily standup",
+        channel: "C123",
+      },
+    });
+    const plugin = await prisma.agentPlugin.create({
+      data: { agentId: preExisting.id, name: "shipwright@shipwright" },
+    });
+    const tool = await prisma.agentTool.create({
+      data: { agentId: preExisting.id, pattern: "Read" },
+    });
+    const env = await prisma.agentEnv.create({
+      data: { agentId: preExisting.id, key: "FOO", value: "encrypted-value" },
+    });
+    const member = await prisma.agentMember.create({
+      data: { agentId: preExisting.id, email: "member@example.com" },
+    });
+
+    // Re-running `prisma migrate deploy` against an already-migrated schema
+    // (which is exactly the state this test DB is in — beforeEach only
+    // truncates rows, it never re-runs migrations) is the idempotency
+    // scenario: the additive ALTER TABLE ... ADD COLUMN has already been
+    // applied once when the schema was first provisioned, and asserting the
+    // column's default here — without any application-layer backfill code —
+    // is the black-box proof that a second `migrate deploy` is a no-op that
+    // still leaves every row readable with the column default intact.
+
+    // Read back via the raw Agent row (bypasses the API layer entirely) —
+    // this is the direct DB-level assertion that the column DEFAULT applies
+    // to a row that never set typeName explicitly.
+    const rawAgent = await prisma.agent.findUniqueOrThrow({
+      where: { id: preExisting.id },
+    });
+    expect(rawAgent.typeName).toBe("coding");
+
+    // Read back via the HTTP API too — end-to-end confirmation.
+    const res = await app.request(`/agents/${preExisting.id}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.typeName).toBe("coding");
+
+    // Child row counts are unchanged — exactly one of each, still linked to
+    // the same agent.
+    expect(
+      await prisma.agentCronJob.count({ where: { agentId: preExisting.id } }),
+    ).toBe(1);
+    expect(
+      await prisma.agentPlugin.count({ where: { agentId: preExisting.id } }),
+    ).toBe(1);
+    expect(
+      await prisma.agentTool.count({ where: { agentId: preExisting.id } }),
+    ).toBe(1);
+    expect(
+      await prisma.agentEnv.count({ where: { agentId: preExisting.id } }),
+    ).toBe(1);
+    expect(
+      await prisma.agentMember.count({ where: { agentId: preExisting.id } }),
+    ).toBe(1);
+
+    // Child row updatedAt values are unchanged — the typeName column only
+    // touches the Agent table, so nothing here should have been rewritten.
+    const cronAfter = await prisma.agentCronJob.findUniqueOrThrow({
+      where: { id: cron.id },
+    });
+    const pluginAfter = await prisma.agentPlugin.findUniqueOrThrow({
+      where: { id: plugin.id },
+    });
+    const toolAfter = await prisma.agentTool.findUniqueOrThrow({
+      where: { id: tool.id },
+    });
+    const envAfter = await prisma.agentEnv.findUniqueOrThrow({
+      where: { id: env.id },
+    });
+    const memberAfter = await prisma.agentMember.findUniqueOrThrow({
+      where: { id: member.id },
+    });
+
+    expect(cronAfter.updatedAt.getTime()).toBe(cron.updatedAt.getTime());
+    expect(pluginAfter.updatedAt.getTime()).toBe(plugin.updatedAt.getTime());
+    expect(envAfter.updatedAt.getTime()).toBe(env.updatedAt.getTime());
+    // AgentTool and AgentMember have no updatedAt column — createdAt stands
+    // in as the "untouched" signal for those two models.
+    expect(toolAfter.createdAt.getTime()).toBe(tool.createdAt.getTime());
+    expect(memberAfter.createdAt.getTime()).toBe(member.createdAt.getTime());
+  });
+
+  it("prisma migrate deploy is idempotent — running it twice does not error or duplicate the typeName column", async () => {
+    // The migration has already been applied once (this test DB was
+    // provisioned via `prisma migrate deploy` before the suite ran). Re-run
+    // deploy here and confirm the column is still readable with a single,
+    // unambiguous default — a duplicate-column error would surface as a
+    // thrown exception from execSync, and a broken default would surface as
+    // a failed read-back.
+    const { execSync } = await import("node:child_process");
+    execSync("bunx prisma migrate deploy --schema=prisma/schema", {
+      cwd: new URL("..", import.meta.url).pathname,
+      env: { ...process.env, DATABASE_URL_SHIPWRIGHT_ADMIN: TEST_DB },
+      stdio: "pipe",
+    });
+
+    const rawAgent = await prisma.agent.findUniqueOrThrow({
+      where: { id: agentId },
+    });
+    expect(rawAgent.typeName).toBe("coding");
+  });
+
+  // ─── repos field round-trip ───────────────────────────────────────────────────
+
+  it("PATCH /agents/:id with repos sets the field; GET /agents/:id returns it", async () => {
+    // PATCH to set repos
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ repos: ["my-org/my-repo"] }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(patchBody.repos).toEqual(["my-org/my-repo"]);
+
+    // GET to confirm persisted value
+    const getRes = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(getRes.status).toBe(200);
+    const getBody = await getRes.json();
+    expect(getBody.repos).toEqual(["my-org/my-repo"]);
+  });
+
+  it("POST then DELETE /agents/:id/repos persists the expected set and preserves order", async () => {
+    const hdr = {
+      "Content-Type": "application/json",
+      Cookie: `admin_session=${cookie}`,
+    };
+    const setRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ repos: ["org/alpha", "org/beta"] }),
+      headers: hdr,
+    });
+    expect(setRes.status).toBe(200);
+
+    const addRes = await app.request(`/agents/${agentId}/repos`, {
+      method: "POST",
+      body: JSON.stringify({ repos: ["org/gamma", "org/alpha"] }),
+      headers: hdr,
+    });
+    expect(addRes.status).toBe(200);
+
+    const delRes = await app.request(`/agents/${agentId}/repos/org/beta`, {
+      method: "DELETE",
+      headers: hdr,
+    });
+    expect(delRes.status).toBe(200);
+
+    const row = await prisma.agent.findUniqueOrThrow({
+      where: { id: agentId },
+    });
+    expect(row.repos).toEqual(["org/alpha", "org/gamma"]);
+  });
+
+  // ─── reviewAuthorAllowlist field round-trip ────────────────────────────────
+
+  it("PATCH /agents/:id with reviewAuthorAllowlist sets the field; GET /agents/:id returns it", async () => {
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ reviewAuthorAllowlist: ["octocat"] }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(patchBody.reviewAuthorAllowlist).toEqual(["octocat"]);
+
+    // GET to confirm persisted value
+    const getRes = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(getRes.status).toBe(200);
+    const getBody = await getRes.json();
+    expect(getBody.reviewAuthorAllowlist).toEqual(["octocat"]);
+
+    const rawAgent = await prisma.agent.findUniqueOrThrow({
+      where: { id: agentId },
+    });
+    expect(rawAgent.reviewAuthorAllowlist).toEqual(["octocat"]);
+  });
+
+  // DBR-2.4 regression: the legacy authorAllowlist column is gone for good.
+  it("GET /agents/:id response does not include the removed authorAllowlist field", async () => {
+    const getRes = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(getRes.status).toBe(200);
+    const getBody = await getRes.json();
+    expect(getBody).not.toHaveProperty("authorAllowlist");
+  });
+
+  // ─── restrictSlackToMembers field round-trip ───────────────────────────────────
+
+  it("PATCH /agents/:id with restrictSlackToMembers:true sets the field; GET /agents/:id returns it", async () => {
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ restrictSlackToMembers: true }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(patchBody.restrictSlackToMembers).toBe(true);
+
+    const getRes = await app.request(`/agents/${agentId}`, {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(getRes.status).toBe(200);
+    const getBody = await getRes.json();
+    expect(getBody.restrictSlackToMembers).toBe(true);
+  });
+
+  it("PATCH /agents/:id omitting restrictSlackToMembers leaves the existing value unchanged", async () => {
+    // First set it to true.
+    await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ restrictSlackToMembers: true }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+
+    // A subsequent PATCH that omits the field entirely must not reset it.
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ selfHosted: false }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(patchBody.restrictSlackToMembers).toBe(true);
+  });
+
+  // ─── restrictSlackToMembers zero-members warning ───────────────────────────────
+
+  it("PATCH /agents/:id to restrictSlackToMembers:true with zero AgentMember rows returns a warning; with members present returns no warning", async () => {
+    // No members on this agent — expect a warning.
+    const patchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ restrictSlackToMembers: true }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(patchRes.status).toBe(200);
+    const patchBody = await patchRes.json();
+    expect(typeof patchBody.warning).toBe("string");
+
+    // Reset, add a member, then flip the flag again — expect no warning.
+    await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ restrictSlackToMembers: false }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    await prisma.agentMember.create({
+      data: { agentId, email: "member@example.com" },
+    });
+
+    const secondPatchRes = await app.request(`/agents/${agentId}`, {
+      method: "PATCH",
+      body: JSON.stringify({ restrictSlackToMembers: true }),
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `admin_session=${cookie}`,
+      },
+    });
+    expect(secondPatchRes.status).toBe(200);
+    const secondPatchBody = await secondPatchRes.json();
+    expect(secondPatchBody.warning).toBeUndefined();
+  });
+
+  it("GET /agents/:id/chat-tokens/daily/stats is scoped to the caller's own agent", async () => {
+    const otherId = await createAgent(prisma);
+    const chatTokens = new AgentChatTokenService(prisma);
+    const usage = (n: number) => ({
+      inputTokens: n,
+      outputTokens: n,
+      cacheReadTokens: 0,
+      cacheCreationTokens: 0,
+      costUsd: 0,
+    });
+    await chatTokens.upsertDailyByModel(
+      agentId,
+      "2026-01-10",
+      "model-a",
+      usage(10),
+    );
+    await chatTokens.upsertDailyByModel(
+      otherId,
+      "2026-01-10",
+      "model-b",
+      usage(500),
+    );
+    const { rawToken: tokenA } = await new AgentTokenService(prisma).create(
+      agentId,
+    );
+    const own = await app.request(
+      `/agents/${agentId}/chat-tokens/daily/stats`,
+      {
+        headers: { Authorization: `Bearer ${tokenA}` },
+      },
+    );
+    expect(own.status).toBe(200);
+    const body = await own.json();
+    expect(body.totals.input).toBe(10);
+    expect(body.byAgent.map((r: { key: string }) => r.key)).toEqual([agentId]);
+    expect(
+      body.byModel.map((r: { key1: string; key2: string }) => [r.key1, r.key2]),
+    ).toEqual([[agentId, "model-a"]]);
+    expect(body.daily).toHaveLength(1);
+    expect(body.daily[0].input).toBe(10);
+
+    const cross = await app.request(
+      `/agents/${otherId}/chat-tokens/daily/stats`,
+      { headers: { Authorization: `Bearer ${tokenA}` } },
+    );
+    expect(cross.status).toBe(403);
+
+    const anon = await app.request(
+      `/agents/${agentId}/chat-tokens/daily/stats`,
+    );
+    expect(anon.status).toBe(401);
+
+    // Fleet-wide admin route is unchanged: sees both agents.
+    const fleet = await app.request("/agents/chat-tokens/daily/stats", {
+      headers: { Cookie: `admin_session=${cookie}` },
+    });
+    expect(fleet.status).toBe(200);
+    expect((await fleet.json()).totals.input).toBe(510);
+  });
+});