@build-astron-co/nimbus 0.4.2 → 0.4.3

package/src/__tests__/runbook.test.ts

@@ -1,219 +0,0 @@
-/**
- * Runbook Command Tests — G15
- *
- * Tests the YAML parser, runbookCommand('list'), and step prompt building.
- * runbookCreate involves interactive readline so we test source-level
- * assertions for that path.
- *
- * Note: process.chdir is not supported in vitest workers. The runbook list
- * test isolates the homedir via vi.mock('node:os') and mocks fs operations
- * to control which directories are seen.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import * as fs from 'node:fs';
-
-// ---------------------------------------------------------------------------
-// Inline reproduction of parseRunbookYaml (matches source implementation)
-// ---------------------------------------------------------------------------
-
-interface RunbookDef {
-  name: string;
-  description?: string;
-  context?: string;
-  steps: string[];
-}
-
-function parseRunbookYaml(content: string): RunbookDef {
-  const lines = content.split('\n');
-  const def: RunbookDef = { name: '', steps: [] };
-  let inSteps = false;
-
-  for (const raw of lines) {
-    const line = raw.trimEnd();
-    if (line.startsWith('#') || !line.trim()) continue;
-
-    if (line.startsWith('name:')) {
-      def.name = line.slice(5).trim().replace(/^['"]|['"]$/g, '');
-      inSteps = false;
-    } else if (line.startsWith('description:')) {
-      def.description = line.slice(12).trim().replace(/^['"]|['"]$/g, '');
-      inSteps = false;
-    } else if (line.startsWith('context:')) {
-      def.context = line.slice(8).trim().replace(/^['"]|['"]$/g, '');
-      inSteps = false;
-    } else if (line.trim() === 'steps:') {
-      inSteps = true;
-    } else if (inSteps && /^\s*-\s/.test(line)) {
-      def.steps.push(line.replace(/^\s*-\s*/, '').trim().replace(/^['"]|['"]$/g, ''));
-    } else {
-      inSteps = false;
-    }
-  }
-
-  return def;
-}
-
-// ---------------------------------------------------------------------------
-// Inline reproduction of buildRunbookPrompt
-// ---------------------------------------------------------------------------
-
-function buildRunbookPrompt(def: RunbookDef): string {
-  const parts = [`# Runbook: ${def.name}`];
-  if (def.description) parts.push(`\n${def.description}`);
-  if (def.context) parts.push(`\nContext/profile: ${def.context}`);
-  parts.push('\n## Steps to execute in order:');
-  def.steps.forEach((step, i) => parts.push(`${i + 1}. ${step}`));
-  parts.push('\nExecute each step in sequence. Check for errors after each step before proceeding. Report progress clearly.');
-  return parts.join('\n');
-}
-
-// ---------------------------------------------------------------------------
-// YAML parser tests
-// ---------------------------------------------------------------------------
-
-describe('parseRunbookYaml (G15)', () => {
-  const SAMPLE = [
-    'name: rotate-certs',
-    'description: Rotate TLS certs in prod namespace',
-    'context: prod',
-    'steps:',
-    '  - Check for expiring certs in all namespaces',
-    '  - Rotate each cert using cert-manager annotate',
-    '  - Verify new certs are valid and pods restarted',
-  ].join('\n');
-
-  it('parses name field correctly', () => {
-    const def = parseRunbookYaml(SAMPLE);
-    expect(def.name).toBe('rotate-certs');
-  });
-
-  it('parses description field', () => {
-    const def = parseRunbookYaml(SAMPLE);
-    expect(def.description).toBe('Rotate TLS certs in prod namespace');
-  });
-
-  it('parses context field', () => {
-    const def = parseRunbookYaml(SAMPLE);
-    expect(def.context).toBe('prod');
-  });
-
-  it('parses steps array with correct count', () => {
-    const def = parseRunbookYaml(SAMPLE);
-    expect(def.steps).toHaveLength(3);
-  });
-
-  it('parses step content correctly', () => {
-    const def = parseRunbookYaml(SAMPLE);
-    expect(def.steps[0]).toBe('Check for expiring certs in all namespaces');
-    expect(def.steps[2]).toBe('Verify new certs are valid and pods restarted');
-  });
-
-  it('ignores comment lines', () => {
-    const withComments = [
-      'name: test-runbook',
-      '# this is a comment',
-      'description: desc',
-      'steps:',
-      '  - step one',
-    ].join('\n');
-    const def = parseRunbookYaml(withComments);
-    expect(def.name).toBe('test-runbook');
-    expect(def.steps).toHaveLength(1);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// buildRunbookPrompt tests
-// ---------------------------------------------------------------------------
-
-describe('buildRunbookPrompt step composition (G15)', () => {
-  it('builds a multi-step numbered prompt', () => {
-    const def: RunbookDef = {
-      name: 'deploy-rollback',
-      description: 'Rollback a failed deployment',
-      steps: ['Check rollout status', 'Run helm rollback', 'Verify pods are healthy'],
-    };
-    const prompt = buildRunbookPrompt(def);
-    expect(prompt).toContain('# Runbook: deploy-rollback');
-    expect(prompt).toContain('1. Check rollout status');
-    expect(prompt).toContain('2. Run helm rollback');
-    expect(prompt).toContain('3. Verify pods are healthy');
-  });
-
-  it('includes description in prompt when set', () => {
-    const def: RunbookDef = { name: 'my-rb', description: 'My description', steps: ['step 1'] };
-    const prompt = buildRunbookPrompt(def);
-    expect(prompt).toContain('My description');
-  });
-
-  it('includes context/profile when set', () => {
-    const def: RunbookDef = { name: 'rb', context: 'staging', steps: ['step 1'] };
-    const prompt = buildRunbookPrompt(def);
-    expect(prompt).toContain('Context/profile: staging');
-  });
-
-  it('includes execution instructions', () => {
-    const def: RunbookDef = { name: 'rb', steps: ['step 1'] };
-    const prompt = buildRunbookPrompt(def);
-    expect(prompt).toContain('Execute each step in sequence');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// runbookCommand list — isolate via mocking node:os and node:fs
-// ---------------------------------------------------------------------------
-
-describe('runbookCommand list with no runbooks (G15)', () => {
-  let tmpDir: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-runbook-test-'));
-    vi.resetModules();
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('prints "No runbooks found" when no runbooks directory exists', async () => {
-    // Mock node:os so homedir() returns our tmp dir (which has no runbooks/ subdir)
-    vi.doMock('node:os', async () => {
-      const actual = await vi.importActual<typeof os>('node:os');
-      return { ...actual, homedir: () => tmpDir };
-    });
-
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { runbookCommand } = await import('../commands/runbook');
-    await runbookCommand('list', []);
-
-    const allOutput = logs.join('\n');
-    expect(allOutput).toContain('No runbooks found');
-  });
-
-  it('shows usage for unknown subcommand', async () => {
-    vi.doMock('node:os', async () => {
-      const actual = await vi.importActual<typeof os>('node:os');
-      return { ...actual, homedir: () => tmpDir };
-    });
-
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { runbookCommand } = await import('../commands/runbook');
-    await runbookCommand('unknown-subcmd', []);
-
-    const allOutput = logs.join('\n');
-    expect(allOutput).toContain('Usage: nimbus runbook');
-  });
-});

package/src/__tests__/schedule.test.ts

@@ -1,206 +0,0 @@
-/**
- * Schedule Command Tests — G13
- *
- * Tests schedule list, add, remove, invalid cron rejection, and
- * crontab activation hint output.
- *
- * File I/O is isolated by mocking node:os.homedir to point to a temp dir.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-
-// We need to control where schedules.json is written.
-// Approach: mock node:os homedir to our temp dir, then resetModules
-// so the schedule module re-evaluates SCHEDULE_FILE with the new homedir.
-
-let tmpDir: string;
-
-vi.mock('node:os', async () => {
-  const actual = await vi.importActual<typeof os>('node:os');
-  return {
-    ...actual,
-    homedir: () => tmpDir ?? actual.homedir(),
-  };
-});
-
-async function getScheduleModule() {
-  vi.resetModules();
-  return await import('../commands/schedule');
-}
-
-describe('scheduleCommand list (G13)', () => {
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-schedule-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('prints "No schedules configured" when schedules.json does not exist', async () => {
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { scheduleCommand } = await getScheduleModule();
-    await scheduleCommand('list', []);
-
-    const output = logs.join('\n');
-    expect(output).toContain('No schedules configured');
-  });
-});
-
-describe('scheduleCommand add (G13)', () => {
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-schedule-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('saves a schedule entry when given a valid cron and prompt', async () => {
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { scheduleCommand } = await getScheduleModule();
-    await scheduleCommand('add', ['0 8 * * *', 'check drift']);
-
-    // Verify the schedule file was written
-    const scheduleFile = path.join(tmpDir, '.nimbus', 'schedules.json');
-    expect(fs.existsSync(scheduleFile)).toBe(true);
-
-    const data = JSON.parse(fs.readFileSync(scheduleFile, 'utf-8')) as Array<{
-      id: string; name: string; cron: string; prompt: string;
-    }>;
-    expect(data).toHaveLength(1);
-    expect(data[0].cron).toBe('0 8 * * *');
-    expect(data[0].prompt).toBe('check drift');
-  });
-
-  it('prints crontab activation hint after adding a schedule', async () => {
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { scheduleCommand } = await getScheduleModule();
-    await scheduleCommand('add', ['0 9 * * 1', 'weekly cost report']);
-
-    const output = logs.join('\n');
-    expect(output).toContain('crontab');
-  });
-});
-
-describe('scheduleCommand invalid cron rejection (G13)', () => {
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-schedule-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('rejects a cron with fewer than 5 fields', async () => {
-    const errors: string[] = [];
-    vi.spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
-      errors.push(args.join(' '));
-    });
-
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
-      throw new Error('process.exit called');
-    }) as never);
-
-    const { scheduleCommand } = await getScheduleModule();
-
-    await expect(scheduleCommand('add', ['* * *', 'bad cron'])).rejects.toThrow('process.exit');
-
-    expect(errors.join('\n')).toContain('Invalid cron expression');
-    exitSpy.mockRestore();
-  });
-});
-
-describe('scheduleCommand remove (G13)', () => {
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-schedule-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('removes an existing schedule by id', async () => {
-    // Seed the schedule file directly
-    const nimbusDir = path.join(tmpDir, '.nimbus');
-    fs.mkdirSync(nimbusDir, { recursive: true });
-    const entry = { id: 'abc123', name: 'my-schedule', cron: '0 8 * * *', prompt: 'drift check', createdAt: new Date().toISOString() };
-    fs.writeFileSync(path.join(nimbusDir, 'schedules.json'), JSON.stringify([entry]), 'utf-8');
-
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { scheduleCommand } = await getScheduleModule();
-    await scheduleCommand('remove', ['abc123']);
-
-    const data = JSON.parse(fs.readFileSync(path.join(nimbusDir, 'schedules.json'), 'utf-8')) as unknown[];
-    expect(data).toHaveLength(0);
-    expect(logs.join('\n')).toContain('Removed schedule');
-  });
-
-  it('shows usage when no id is provided to remove', async () => {
-    const errors: string[] = [];
-    vi.spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
-      errors.push(args.join(' '));
-    });
-
-    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
-      throw new Error('process.exit called');
-    }) as never);
-
-    const { scheduleCommand } = await getScheduleModule();
-    await expect(scheduleCommand('remove', [])).rejects.toThrow('process.exit');
-
-    expect(errors.join('\n')).toContain('Usage');
-    exitSpy.mockRestore();
-  });
-});
-
-describe('scheduleCommand default/unknown subcommand (G13)', () => {
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'nimbus-schedule-test-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-    vi.restoreAllMocks();
-    vi.resetModules();
-  });
-
-  it('prints usage for unknown subcommand', async () => {
-    const logs: string[] = [];
-    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
-      logs.push(args.join(' '));
-    });
-
-    const { scheduleCommand } = await getScheduleModule();
-    await scheduleCommand('unknown', []);
-
-    expect(logs.join('\n')).toContain('Usage: nimbus schedule');
-  });
-});

package/src/__tests__/serve.test.ts

@@ -1,275 +0,0 @@
-/**
- * Tests for nimbus serve — Headless API
- *
- * Covers:
- *   - OpenAPI specification structure and completeness
- *   - HTTP Basic Auth middleware behavior (allow/deny/skip)
- *
- * Integration tests that start the actual HTTP server are intentionally
- * excluded here; they belong in the e2e test suite to avoid port conflicts
- * in parallel test runs.
- */
-
-import { describe, it, expect } from 'vitest';
-import { getOpenAPISpec } from '../cli/openapi-spec';
-import { createAuthMiddleware } from '../cli/serve-auth';
-
-// ---------------------------------------------------------------------------
-// OpenAPI Spec
-// ---------------------------------------------------------------------------
-
-describe('OpenAPI Spec', () => {
-  const spec = getOpenAPISpec();
-
-  it('should return a valid OpenAPI 3.1 document', () => {
-    expect(spec.openapi).toBe('3.1.0');
-    expect((spec as any).info.title).toBe('Nimbus API');
-    expect((spec as any).info.version).toBe('0.2.0');
-  });
-
-  it('should define all required endpoint paths', () => {
-    const paths = spec.paths as Record<string, unknown>;
-    expect(paths['/api/health']).toBeDefined();
-    expect(paths['/api/chat']).toBeDefined();
-    expect(paths['/api/run']).toBeDefined();
-    expect(paths['/api/sessions']).toBeDefined();
-    expect(paths['/api/session/{id}']).toBeDefined();
-  });
-
-  it('should define GET and POST for session/:id', () => {
-    const paths = spec.paths as any;
-    const sessionPath = paths['/api/session/{id}'];
-    expect(sessionPath.get).toBeDefined();
-    expect(sessionPath.get.operationId).toBe('getSession');
-    expect(sessionPath.post).toBeDefined();
-    expect(sessionPath.post.operationId).toBe('continueSession');
-  });
-
-  it('should define the chat endpoint with SSE response and required message field', () => {
-    const paths = spec.paths as any;
-    const chatPost = paths['/api/chat'].post;
-    expect(chatPost.operationId).toBe('chat');
-    expect(chatPost.requestBody.required).toBe(true);
-
-    const schema = chatPost.requestBody.content['application/json'].schema;
-    expect(schema.required).toContain('message');
-    expect(schema.properties.message.type).toBe('string');
-    expect(schema.properties.sessionId).toBeDefined();
-    expect(schema.properties.model).toBeDefined();
-    expect(schema.properties.mode.enum).toEqual(['plan', 'build', 'deploy']);
-  });
-
-  it('should define the run endpoint with JSON response schema', () => {
-    const paths = spec.paths as any;
-    const runPost = paths['/api/run'].post;
-    expect(runPost.operationId).toBe('run');
-    expect(runPost.requestBody.required).toBe(true);
-
-    const requestSchema = runPost.requestBody.content['application/json'].schema;
-    expect(requestSchema.required).toContain('prompt');
-
-    const responseSchema = runPost.responses['200'].content['application/json'].schema;
-    expect(responseSchema.properties.sessionId).toBeDefined();
-    expect(responseSchema.properties.response).toBeDefined();
-    expect(responseSchema.properties.turns).toBeDefined();
-    expect(responseSchema.properties.cost).toBeDefined();
-    expect(responseSchema.properties.usage).toBeDefined();
-  });
-
-  it('should define the sessions list endpoint', () => {
-    const paths = spec.paths as any;
-    const sessionsGet = paths['/api/sessions'].get;
-    expect(sessionsGet.operationId).toBe('listSessions');
-
-    const responseSchema = sessionsGet.responses['200'].content['application/json'].schema;
-    expect(responseSchema.properties.sessions.type).toBe('array');
-  });
-
-  it('should define the health endpoint with expected properties', () => {
-    const paths = spec.paths as any;
-    const healthGet = paths['/api/health'].get;
-    expect(healthGet.operationId).toBe('getHealth');
-
-    const schema = healthGet.responses['200'].content['application/json'].schema;
-    expect(schema.properties.status.enum).toEqual(['ok']);
-    expect(schema.properties.uptime.type).toBe('number');
-    expect(schema.properties.db.type).toBe('boolean');
-    expect(schema.properties.llm.type).toBe('boolean');
-  });
-
-  it('should define Session schema in components', () => {
-    const components = spec.components as any;
-    const sessionSchema = components.schemas.Session;
-    expect(sessionSchema).toBeDefined();
-    expect(sessionSchema.type).toBe('object');
-    expect(sessionSchema.properties.id).toBeDefined();
-    expect(sessionSchema.properties.name).toBeDefined();
-    expect(sessionSchema.properties.status.enum).toContain('active');
-    expect(sessionSchema.properties.status.enum).toContain('suspended');
-    expect(sessionSchema.properties.status.enum).toContain('completed');
-    expect(sessionSchema.properties.mode.enum).toContain('plan');
-    expect(sessionSchema.properties.mode.enum).toContain('build');
-    expect(sessionSchema.properties.mode.enum).toContain('deploy');
-  });
-
-  it('should define Usage schema in components', () => {
-    const components = spec.components as any;
-    const usageSchema = components.schemas.Usage;
-    expect(usageSchema).toBeDefined();
-    expect(usageSchema.properties.promptTokens.type).toBe('integer');
-    expect(usageSchema.properties.completionTokens.type).toBe('integer');
-    expect(usageSchema.properties.totalTokens.type).toBe('integer');
-  });
-
-  it('should define Error schema in components', () => {
-    const components = spec.components as any;
-    const errorSchema = components.schemas.Error;
-    expect(errorSchema).toBeDefined();
-    expect(errorSchema.properties.error.type).toBe('string');
-    expect(errorSchema.required).toContain('error');
-  });
-
-  it('should define basicAuth security scheme', () => {
-    const components = spec.components as any;
-    expect(components.securitySchemes.basicAuth).toBeDefined();
-    expect(components.securitySchemes.basicAuth.type).toBe('http');
-    expect(components.securitySchemes.basicAuth.scheme).toBe('basic');
-  });
-
-  it('should include server definitions', () => {
-    const servers = spec.servers as any[];
-    expect(servers.length).toBeGreaterThan(0);
-    expect(servers[0].url).toBe('http://localhost:4200');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Auth Middleware
-// ---------------------------------------------------------------------------
-
-describe('Auth Middleware', () => {
-  const middleware = createAuthMiddleware({
-    username: 'admin',
-    password: 'secret',
-  });
-
-  /**
-   * Helper to invoke the middleware with a given URL and optional headers.
-   */
-  function invokeMiddleware(
-    url: string,
-    method = 'POST',
-    headers: Record<string, string> = {}
-  ): { result: { error: string } | undefined; set: any } {
-    const request = new Request(url, { method, headers });
-    const set: any = {};
-    const result = middleware({ request, set });
-    return { result, set };
-  }
-
-  // -- Public endpoints bypass auth --
-
-  it('should skip auth for GET /api/health', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/health', 'GET');
-    expect(result).toBeUndefined();
-  });
-
-  it('should skip auth for GET /api/openapi.json', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/openapi.json', 'GET');
-    expect(result).toBeUndefined();
-  });
-
-  it('should skip auth for CORS OPTIONS preflight', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/chat', 'OPTIONS');
-    expect(result).toBeUndefined();
-  });
-
-  // -- Protected endpoints require auth --
-
-  it('should reject requests without Authorization header', () => {
-    const { result, set } = invokeMiddleware('http://localhost:4200/api/chat');
-    expect(set.status).toBe(401);
-    expect(result).toEqual({ error: 'Authentication required' });
-    expect(set.headers['WWW-Authenticate']).toBe('Basic realm="Nimbus API"');
-  });
-
-  it('should reject requests with invalid credentials', () => {
-    const { result, set } = invokeMiddleware('http://localhost:4200/api/chat', 'POST', {
-      Authorization: `Basic ${btoa('wrong:creds')}`,
-    });
-    expect(set.status).toBe(401);
-    expect(result).toEqual({ error: 'Invalid credentials' });
-  });
-
-  it('should reject requests with malformed Authorization header', () => {
-    const { result, set } = invokeMiddleware('http://localhost:4200/api/chat', 'POST', {
-      Authorization: 'Bearer some-token',
-    });
-    expect(set.status).toBe(401);
-    expect(result).toEqual({ error: 'Invalid credentials' });
-  });
-
-  it('should allow requests with valid credentials', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/chat', 'POST', {
-      Authorization: `Basic ${btoa('admin:secret')}`,
-    });
-    expect(result).toBeUndefined();
-  });
-
-  it('should allow valid credentials for session endpoints', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/session/abc-123', 'GET', {
-      Authorization: `Basic ${btoa('admin:secret')}`,
-    });
-    expect(result).toBeUndefined();
-  });
-
-  it('should allow valid credentials for the run endpoint', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/run', 'POST', {
-      Authorization: `Basic ${btoa('admin:secret')}`,
-    });
-    expect(result).toBeUndefined();
-  });
-
-  it('should allow valid credentials for the sessions list endpoint', () => {
-    const { result } = invokeMiddleware('http://localhost:4200/api/sessions', 'GET', {
-      Authorization: `Basic ${btoa('admin:secret')}`,
-    });
-    expect(result).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Additional edge cases
-// ---------------------------------------------------------------------------
-
-describe('Auth Middleware — edge cases', () => {
-  it('should work with passwords containing colons', () => {
-    const mw = createAuthMiddleware({
-      username: 'user',
-      password: 'pass:with:colons',
-    });
-
-    const request = new Request('http://localhost:4200/api/chat', {
-      method: 'POST',
-      headers: { Authorization: `Basic ${btoa('user:pass:with:colons')}` },
-    });
-    const set: any = {};
-    const result = mw({ request, set });
-    expect(result).toBeUndefined();
-  });
-
-  it('should reject empty Authorization header', () => {
-    const mw = createAuthMiddleware({
-      username: 'admin',
-      password: 'secret',
-    });
-
-    const request = new Request('http://localhost:4200/api/chat', {
-      method: 'POST',
-      headers: { Authorization: '' },
-    });
-    const set: any = {};
-    const _result = mw({ request, set });
-    expect(set.status).toBe(401);
-  });
-});