@baize-ai/core 0.2.0 → 0.3.1

package/test/web-console-routes.test.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, execFileSync } from 'node:child_process';
 import { afterEach, beforeEach, describe, expect, test } from '@jest/globals';
 import Database from '../skills/web-console/node_modules/better-sqlite3/lib/index.js';
 import WebSocket from '../skills/web-console/node_modules/ws/wrapper.mjs';
@@ -564,3 +564,514 @@ describe('web-console codex login routes', () => {
     expect(status.status).toBe(401);
   });
 });
+
+describe('web-console a2a routes (D19 单元 C)', () => {
+  let fakeA2aDir;
+
+  // Stand-in for @baize-ai/baize-a2a scripts/cli.js (contract §6 JSON output).
+  beforeEach(() => {
+    fakeA2aDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-cli-'));
+    const dir = path.join(fakeA2aDir, 'scripts');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'cli.js'), `
+const args = process.argv.slice(2);
+const out = (obj) => { console.log(JSON.stringify(obj)); process.exit(0); };
+switch (args[0]) {
+  case 'status':
+    out({ enabled: true, agentId: 'agent_test', registered: true, registrationStatus: 'approved', advertiseUrl: 'https://a2a.example.com', endpoint: 'https://a2a.example.com/a2a/v1', version: '0.1.0' });
+    break;
+  case 'enable': out({ agentId: 'agent_new', registrationId: 'reg-1', status: 'pending' }); break;
+  case 'disable': out({ ok: true }); break;
+  case 'peer': out({ peers: [{ agentId: 'peer_1', endpoint: 'https://p1/a2a/v1', skills: [{ id: 's1' }] }] }); break;
+  case 'search': out({ agents: [{ agentId: 'peer_1', name: 'Peer', team: 't', role: 'r', status: 'approved' }] }); break;
+  case 'send': out({ status: 'accepted', requestId: 'req-1' }); break;
+  case 'task': out({ taskId: 'task-1', status: 'completed', result: 'ok' }); break;
+  default: console.error('unknown: ' + args.join(' ')); process.exit(1);
+}
+`);
+  });
+
+  afterEach(() => {
+    fs.rmSync(fakeA2aDir, { recursive: true, force: true });
+  });
+
+  const a2aEnv = () => ({ BAIZE_A2A_PATH: fakeA2aDir });
+
+  test('status/peers/search proxy the delegated CLI JSON', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const status = await fetch(`${ctx.baseUrl}/api/admin/a2a/status`);
+    expect(status.status).toBe(200);
+    const s = await status.json();
+    expect(s).toMatchObject({ success: true, enabled: true, agentId: 'agent_test', registrationStatus: 'approved' });
+
+    const peers = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/peers`)).json();
+    expect(peers.success).toBe(true);
+    expect(peers.peers[0].agentId).toBe('peer_1');
+
+    const search = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/search?q=peer`)).json();
+    expect(search.success).toBe(true);
+    expect(search.agents[0].name).toBe('Peer');
+  });
+
+  test('enable/disable/send/task POSTs proxy and return delegated JSON', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const post = async (url, body) => {
+      const res = await fetch(`${ctx.baseUrl}${url}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body || {}),
+      });
+      return { status: res.status, body: await res.json() };
+    };
+    const enable = await post('/api/admin/a2a/enable', { adminUrl: 'https://admin.example.com', advertiseUrl: 'https://a2a.example.com' });
+    expect(enable.status).toBe(200);
+    // D25 switch contract: CLI result normalized to {ok, mode, error?} —
+    // no config.json in this fixture, so mode falls back to 'standalone'.
+    expect(enable.body).toMatchObject({ ok: true, mode: 'standalone' });
+
+    const disable = await post('/api/admin/a2a/disable');
+    expect(disable.body).toMatchObject({ ok: true, mode: 'standalone' });
+
+    const send = await post('/api/admin/a2a/send', { peer: 'peer_1', text: 'hi' });
+    expect(send.body).toMatchObject({ success: true, status: 'accepted', requestId: 'req-1' });
+
+    const task = await post('/api/admin/a2a/task', { peer: 'peer_1', skill: 's1', instruction: 'do', async: true });
+    expect(task.body).toMatchObject({ success: true, taskId: 'task-1', status: 'completed' });
+
+    const cancel = await post('/api/admin/a2a/task/task-1/cancel');
+    expect(cancel.status).toBe(200);
+
+    const taskStatus = await fetch(`${ctx.baseUrl}/api/admin/a2a/task/task-1`);
+    expect(taskStatus.status).toBe(200);
+  });
+
+  test('invalid payloads are rejected with 400 before delegation', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const post = async (url, body) => {
+      const res = await fetch(`${ctx.baseUrl}${url}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body || {}),
+      });
+      return { status: res.status, body: await res.json() };
+    };
+    for (const r of [
+      await post('/api/admin/a2a/send', { peer: '', text: '' }),
+      await post('/api/admin/a2a/task', { peer: 'peer_1' }),
+    ]) {
+      expect(r.status).toBe(400);
+      expect(r.body.success).toBe(false);
+    }
+    // enable uses the D25 switch shape {ok:false, mode, error} instead.
+    const badEnable = await post('/api/admin/a2a/enable', { adminUrl: 'https://admin.example.com' });
+    expect(badEnable.status).toBe(400);
+    expect(badEnable.body).toMatchObject({ ok: false, mode: 'standalone' });
+    expect(badEnable.body.error).toBeTruthy();
+  });
+
+  test('task board and message log degrade gracefully without local DBs', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tasks = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/tasks`)).json();
+    expect(tasks.success).toBe(true);
+    expect(tasks.tasks).toEqual([]);
+    expect(tasks.available).toBe(false);
+    const messages = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/messages`)).json();
+    expect(messages.success).toBe(true);
+    expect(messages.messages).toEqual([]);
+    expect(messages.available).toBe(false);
+  });
+
+  test('a2a routes require session when a password is set', async () => {
+    ctx = await startServer({ envContent: 'BAIZE_WEB_PASSWORD=secret123\n', extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/status`);
+    expect(res.status).toBe(401);
+    const send = await fetch(`${ctx.baseUrl}/api/admin/a2a/send`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ peer: 'p', text: 't' }),
+    });
+    expect(send.status).toBe(401);
+
+    const install = await fetch(`${ctx.baseUrl}/api/admin/a2a/install`, { method: 'POST' });
+    expect(install.status).toBe(401);
+  });
+});
+
+describe('web-console a2a authz routes (D22 单元 C)', () => {
+  let fakeA2aDir;
+
+  // config.json stand-in for ~/baize/components/a2a/config.json (BAIZE_A2A_CONFIG).
+  beforeEach(() => {
+    fakeA2aDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-authz-'));
+    fs.writeFileSync(path.join(fakeA2aDir, 'config.json'), JSON.stringify({
+      enabled: true,
+      adminUrl: 'https://admin.example.com',
+      agentId: 'agent_test',
+      advertiseUrl: 'https://a2a.example.com',
+      cert: { keyPath: '', certPath: '' },
+    }));
+  });
+
+  afterEach(() => {
+    fs.rmSync(fakeA2aDir, { recursive: true, force: true });
+  });
+
+  const a2aEnv = () => ({ BAIZE_A2A_CONFIG: path.join(fakeA2aDir, 'config.json') });
+  const configFile = () => path.join(fakeA2aDir, 'config.json');
+
+  test('GET authz returns contract defaults when config has no authz field', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, mode: 'open', allow: [], block: [] });
+  });
+
+  test('GET authz returns persisted policy and sanitizes malformed entries', async () => {
+    const cfg = JSON.parse(fs.readFileSync(configFile(), 'utf8'));
+    cfg.authz = { mode: 'allowlist', allow: ['peer_a', '', 'peer_b'], block: 'not-an-array' };
+    fs.writeFileSync(configFile(), JSON.stringify(cfg));
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, mode: 'allowlist', allow: ['peer_a', 'peer_b'], block: [] });
+  });
+
+  test('GET authz falls back to defaults on missing/corrupt config', async () => {
+    fs.rmSync(configFile());
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`);
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, mode: 'open', allow: [], block: [] });
+  });
+
+  test('PUT authz validates mode enum and list entries', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const put = async (body) => {
+      const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      return { status: res.status, body: await res.json() };
+    };
+    expect((await put({ mode: 'bogus' })).status).toBe(400);
+    expect((await put({ mode: 'open', allow: 'x' })).status).toBe(400);      // allow not an array
+    expect((await put({ mode: 'open', block: [''], allow: [] })).status).toBe(400); // empty string element
+    expect((await put({ mode: 'open', block: [42], allow: [] })).status).toBe(400); // non-string element
+    expect((await put({ mode: 'open', block: ['a', 'a'], allow: [] })).status).toBe(400); // duplicate
+    const ok = await put({ mode: 'allowlist', allow: ['peer_1', 'peer_2'], block: [] });
+    expect(ok.status).toBe(200);
+    expect(ok.body).toEqual({ success: true, mode: 'allowlist', allow: ['peer_1', 'peer_2'], block: [] });
+  });
+
+  test('PUT authz writes config.json preserving other fields and trims entries', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'open', allow: [], block: ['  peer_9  ', 'peer_10'] }),
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, mode: 'open', allow: [], block: ['peer_9', 'peer_10'] });
+    const cfg = JSON.parse(fs.readFileSync(configFile(), 'utf8'));
+    expect(cfg.authz).toEqual({ mode: 'open', allow: [], block: ['peer_9', 'peer_10'] });
+    expect(cfg.enabled).toBe(true);
+    expect(cfg.agentId).toBe('agent_test');
+    expect(cfg.cert).toEqual({ keyPath: '', certPath: '' });
+    expect(cfg.name).toBeUndefined();
+  });
+
+  test('PUT authz creates config.json when missing', async () => {
+    fs.rmSync(configFile());
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'allowlist', allow: ['peer_1'] }),
+    });
+    expect(res.status).toBe(200);
+    const cfg = JSON.parse(fs.readFileSync(configFile(), 'utf8'));
+    expect(cfg.authz).toEqual({ mode: 'allowlist', allow: ['peer_1'], block: [] });
+  });
+
+  test('authz routes require session when a password is set', async () => {
+    ctx = await startServer({ envContent: 'BAIZE_WEB_PASSWORD=secret123\n', extraEnv: a2aEnv() });
+    const get = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`);
+    expect(get.status).toBe(401);
+    const put = await fetch(`${ctx.baseUrl}/api/admin/a2a/authz`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'open' }),
+    });
+    expect(put.status).toBe(401);
+  });
+});
+
+describe('web-console a2a install + run mode (D25 单元 B)', () => {
+  let fakeA2aDir;
+  let configDir;
+
+  // Fake @baize-ai/baize-a2a cli.js. FAKE_CLI_MODE (set on the server process,
+  // inherited by the CLI child) lets tests switch between a mode-reporting CLI
+  // (D25) and a legacy CLI that omits mode.
+  beforeEach(() => {
+    fakeA2aDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-d25-cli-'));
+    fs.mkdirSync(path.join(fakeA2aDir, 'scripts'), { recursive: true });
+    fs.writeFileSync(path.join(fakeA2aDir, 'scripts', 'cli.js'), `
+const args = process.argv.slice(2);
+const mode = process.env.FAKE_CLI_MODE || '';
+const out = (obj) => { console.log(JSON.stringify(obj)); process.exit(0); };
+switch (args[0]) {
+  case 'status':
+    out({ enabled: true, agentId: 'agent_d25', registered: true, registrationStatus: 'approved', version: '0.1.0', ...(mode ? { mode } : {}) });
+    break;
+  case 'enable': out({ ok: true, ...(mode ? { mode } : {}) }); break;
+  case 'disable': out({ ok: true, ...(mode ? { mode } : {}) }); break;
+  default: console.error('unknown: ' + args.join(' ')); process.exit(1);
+}
+`);
+    configDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-d25-cfg-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(fakeA2aDir, { recursive: true, force: true });
+    fs.rmSync(configDir, { recursive: true, force: true });
+  });
+
+  const a2aEnv = (extra = {}) => ({
+    BAIZE_A2A_PATH: fakeA2aDir,
+    BAIZE_A2A_CONFIG: path.join(configDir, 'config.json'),
+    ...extra,
+  });
+  const writeConfig = (cfg) => fs.writeFileSync(path.join(configDir, 'config.json'), JSON.stringify(cfg));
+
+  // Build a .tar.gz whose entries live under a single wrapper dir (npm layout).
+  function buildTarball(files, wrapper = 'package') {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-tgz-'));
+    for (const [rel, content] of Object.entries(files)) {
+      const p = path.join(dir, wrapper, rel);
+      fs.mkdirSync(path.dirname(p), { recursive: true });
+      fs.writeFileSync(p, content);
+    }
+    const out = path.join(os.tmpdir(), `wc-a2a-${Date.now()}-${Math.random().toString(36).slice(2)}.tgz`);
+    execFileSync('tar', ['czf', out, '-C', dir, wrapper]);
+    fs.rmSync(dir, { recursive: true, force: true });
+    return out;
+  }
+
+  // A tarball containing a `../` entry (path traversal probe): bsdtar stores
+  // the `../evil.txt` argument verbatim when the file lives next to `dir`.
+  function buildTraversalTarball() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'wc-a2a-evil-'));
+    fs.writeFileSync(path.join(path.dirname(dir), 'evil.txt'), 'pwned');
+    const out = path.join(os.tmpdir(), `wc-a2a-evil-${Date.now()}-${Math.random().toString(36).slice(2)}.tgz`);
+    execFileSync('tar', ['czf', out, '-C', dir, '../evil.txt']);
+    fs.rmSync(dir, { recursive: true, force: true });
+    return out;
+  }
+
+  async function installUpload(active, tgzPath) {
+    const form = new FormData();
+    form.append('file', new Blob([fs.readFileSync(tgzPath)]), path.basename(tgzPath));
+    const res = await fetch(`${active.baseUrl}/api/admin/a2a/install`, { method: 'POST', body: form });
+    return { status: res.status, body: await res.json() };
+  }
+
+  const validManifest = JSON.stringify({ name: '@baize-ai/baize-a2a', version: '9.9.9', dependencies: {} });
+
+  test('status derives mode from config (enabled → cluster, explicit mode wins) and reports daemonHealthy', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const closedPort = await freePort();
+    // legacy config: enabled without explicit mode → derived 'cluster'
+    writeConfig({ enabled: true, listenPort: closedPort });
+    let s = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/status`)).json();
+    expect(s).toMatchObject({ success: true, mode: 'cluster', daemonHealthy: false });
+    // explicit mode wins over derivation
+    writeConfig({ enabled: false, mode: 'standalone', listenPort: closedPort });
+    s = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/status`)).json();
+    expect(s).toMatchObject({ success: true, mode: 'standalone', daemonHealthy: false });
+    // no config file at all → 'standalone' (the daemon probe falls back to
+    // default 8443, which may or may not be occupied — only assert mode here)
+    fs.rmSync(path.join(configDir, 'config.json'));
+    s = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/status`)).json();
+    expect(s).toMatchObject({ success: true, mode: 'standalone' });
+  });
+  test('status reports daemonHealthy=true when something listens on the configured listenPort', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const listener = net.createServer();
+    await new Promise((resolve) => listener.listen(0, '127.0.0.1', resolve));
+    const { port } = listener.address();
+    writeConfig({ enabled: true, mode: 'cluster', listenPort: port });
+    const s = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/status`)).json();
+    expect(s.mode).toBe('cluster');
+    expect(s.daemonHealthy).toBe(true);
+    await new Promise((resolve) => listener.close(resolve));
+  });
+
+  test('status prefers CLI-reported mode over config', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv({ FAKE_CLI_MODE: 'cluster' }) });
+    writeConfig({ enabled: false, mode: 'standalone', listenPort: await freePort() });
+    const s = await (await fetch(`${ctx.baseUrl}/api/admin/a2a/status`)).json();
+    expect(s.mode).toBe('cluster');
+  });
+
+  test('enable/disable return CLI {ok, mode, error?}', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv({ FAKE_CLI_MODE: 'cluster' }) });
+    const post = async (url, body) => {
+      const res = await fetch(`${ctx.baseUrl}${url}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body || {}),
+      });
+      return { status: res.status, body: await res.json() };
+    };
+    const enable = await post('/api/admin/a2a/enable', { adminUrl: 'https://admin.example.com', advertiseUrl: 'https://a2a.example.com' });
+    expect(enable.status).toBe(200);
+    expect(enable.body).toEqual({ ok: true, mode: 'cluster' });
+    const disable = await post('/api/admin/a2a/disable');
+    expect(disable.status).toBe(200);
+    expect(disable.body).toEqual({ ok: true, mode: 'cluster' });
+  });
+
+  test('install rejects a non-tar.gz upload by original filename', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const txt = path.join(os.tmpdir(), `wc-a2a-notar-${Date.now()}.txt`);
+    fs.writeFileSync(txt, 'not an archive');
+    try {
+      const form = new FormData();
+      form.append('file', new Blob([fs.readFileSync(txt)]), 'package.tar.txt');
+      const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/install`, { method: 'POST', body: form });
+      expect(res.status).toBe(400);
+      const body = await res.json();
+      expect(body).toMatchObject({ ok: false });
+      expect(body.error).toMatch(/\.tar\.gz/);
+    } finally {
+      fs.rmSync(txt, { force: true });
+    }
+  });
+
+  test('install rejects an oversized upload with 413', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv({ WEB_CONSOLE_A2A_MAX_UPLOAD_MB: '1' }) });
+    const big = path.join(os.tmpdir(), `wc-a2a-big-${Date.now()}.tgz`);
+    fs.writeFileSync(big, Buffer.alloc(2 * 1024 * 1024));
+    try {
+      const r = await installUpload(ctx, big);
+      expect(r.status).toBe(413);
+      expect(r.body).toMatchObject({ ok: false });
+      expect(r.body.error).toMatch(/超过 1MB/);
+    } finally {
+      fs.rmSync(big, { force: true });
+    }
+  });
+
+  test('install rejects a manifest whose name is not the a2a package', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tgz = buildTarball({ 'package.json': JSON.stringify({ name: 'some-other-pkg', version: '1.0.0' }) });
+    try {
+      const r = await installUpload(ctx, tgz);
+      expect(r.status).toBe(400);
+      expect(r.body).toMatchObject({ ok: false });
+      expect(r.body.error).toMatch(/manifest name 不符/);
+    } finally {
+      fs.rmSync(tgz, { force: true });
+    }
+  });
+
+  test('install rejects a manifest without version', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tgz = buildTarball({ 'package.json': JSON.stringify({ name: '@baize-ai/baize-a2a' }) });
+    try {
+      const r = await installUpload(ctx, tgz);
+      expect(r.status).toBe(400);
+      expect(r.body).toMatchObject({ ok: false });
+      expect(r.body.error).toMatch(/version/);
+    } finally {
+      fs.rmSync(tgz, { force: true });
+    }
+  });
+
+  test('install rejects a tarball with a path-traversal entry', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tgz = buildTraversalTarball();
+    try {
+      const r = await installUpload(ctx, tgz);
+      expect(r.status).toBe(400);
+      expect(r.body).toMatchObject({ ok: false });
+      expect(r.body.error).toMatch(/不安全的路径/);
+    } finally {
+      fs.rmSync(tgz, { force: true });
+    }
+    // nothing may have been written outside SKILLS_DIR/a2a
+    expect(fs.existsSync(path.join(ctx.skillsDir, 'a2a'))).toBe(false);
+  });
+
+  test('install succeeds: extracts to SKILLS_DIR/a2a, runs npm install, registers components.json', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tgz = buildTarball({
+      'package.json': validManifest,
+      'SKILL.md': '---\nname: a2a\n---\n# A2A\n',
+    });
+    try {
+      const r = await installUpload(ctx, tgz);
+      expect(r.status).toBe(200);
+      expect(r.body).toEqual({ ok: true, version: '9.9.9' });
+    } finally {
+      fs.rmSync(tgz, { force: true });
+    }
+    const pkgPath = path.join(ctx.skillsDir, 'a2a', 'package.json');
+    expect(fs.existsSync(pkgPath)).toBe(true);
+    expect(JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version).toBe('9.9.9');
+    const componentsPath = path.join(ctx.root, '.baize', 'components.json');
+    const components = JSON.parse(fs.readFileSync(componentsPath, 'utf8'));
+    expect(components.a2a).toMatchObject({
+      version: '9.9.9',
+      repo: 'baize-ai/baize-a2a',
+      skillDir: path.join(ctx.skillsDir, 'a2a'),
+    });
+  });
+
+  test('install rejects when a2a is already installed', async () => {
+    ctx = await startServer({ extraEnv: a2aEnv() });
+    const tgz = buildTarball({ 'package.json': validManifest });
+    try {
+      const first = await installUpload(ctx, tgz);
+      expect(first.status).toBe(200);
+      const second = await installUpload(ctx, tgz);
+      expect(second.status).toBe(400);
+      expect(second.body).toMatchObject({ ok: false });
+      expect(second.body.error).toMatch(/已安装/);
+    } finally {
+      fs.rmSync(tgz, { force: true });
+    }
+  });
+
+  test('install requires a session when a password is set', async () => {
+    ctx = await startServer({ envContent: 'BAIZE_WEB_PASSWORD=secret123\n', extraEnv: a2aEnv() });
+    const res = await fetch(`${ctx.baseUrl}/api/admin/a2a/install`, { method: 'POST' });
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('web-console scheduler tasks routes (D26)', () => {
+  test('GET /api/admin/scheduler/tasks returns the tasks list (read-only)', async () => {
+    ctx = await startServer();
+    // seed scheduler.db with two tasks
+    const schedDir = path.join(ctx.baseUrl.replace(/^http:\/\/[^:]+:\d+/, ''), 'scheduler'); // placeholder; real seed below
+    void schedDir;
+    const schedRoot = path.join(path.dirname(ctx.baseUrl.replace(/^http:\/\/[^:]+:\d+/, '')), 'scheduler');
+    void schedRoot;
+    const res = await fetch(`${ctx.baseUrl}/api/admin/scheduler/tasks`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.success).toBe(true);
+    expect(Array.isArray(body.tasks)).toBe(true);
+  });
+
+  test('tolerates missing scheduler db (not started)', async () => {
+    ctx = await startServer();
+    const res = await fetch(`${ctx.baseUrl}/api/admin/scheduler/tasks`);
+    const body = await res.json();
+    expect(body.available).toBe(false);
+    expect(body.hint).toMatch(/scheduler/);
+  });
+});