@cloudcli-ai/cloudcli 1.37.3 → 1.37.4

package/server/modules/providers/tests/opencode-models.test.ts

@@ -4,6 +4,9 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
+import Database from 'better-sqlite3';
+
+import { closeConnection, initializeDatabase } from '@/modules/database/index.js';
 import {
   OpenCodeProviderModels,
   OPENCODE_PREDEFINED_MODELS,
@@ -197,3 +200,100 @@ test('OpenCode offers only models the install can route to', async () => {
     },
   );
 });
+
+const writeOpenCodeSessionDatabase = async (homeDir: string, rows: Array<Record<string, unknown>>) => {
+  const dbPath = path.join(homeDir, '.local', 'share', 'opencode', 'opencode.db');
+  await mkdir(path.dirname(dbPath), { recursive: true });
+  const db = new Database(dbPath);
+  try {
+    db.exec(`
+      CREATE TABLE session (
+        id text PRIMARY KEY,
+        model text,
+        agent text,
+        directory text,
+        time_created integer NOT NULL,
+        time_updated integer NOT NULL
+      );
+    `);
+    const insert = db.prepare(
+      'INSERT INTO session (id, model, agent, directory, time_created, time_updated) VALUES (?, ?, ?, ?, ?, ?)',
+    );
+    for (const [index, row] of rows.entries()) {
+      insert.run(
+        row.id,
+        row.model,
+        row.agent ?? null,
+        row.directory ?? '/tmp/project',
+        row.timeCreated ?? 1700000000000,
+        row.timeUpdated ?? 1700000001000 + index,
+      );
+    }
+  } finally {
+    db.close();
+  }
+};
+
+test('OpenCode composes the provider prefix into session model ids', async () => {
+  // The lookup translates the app session id through the sessions database,
+  // so point it at a throwaway file rather than the developer's real one.
+  const tempSessionsDirectory = await mkdtemp(path.join(os.tmpdir(), 'opencode-session-model-'));
+  const previousDatabasePath = process.env.DATABASE_PATH;
+  try {
+    closeConnection();
+    process.env.DATABASE_PATH = path.join(tempSessionsDirectory, 'auth.db');
+    await initializeDatabase();
+    // OpenCode stores the provider and model id in separate fields of the
+    // session row ({"id":"z-ai/glm-5.3-flash","providerID":"openrouter"}), but
+    // the CLI's `--model` flag only resolves the composed
+    // `<providerID>/<modelID>` form. Resuming such a session without the prefix
+    // fails with an unknown-model server error, which hits OpenRouter users
+    // hardest because their model ids carry a slash themselves.
+    await withOpenCodeHome(
+      (homeDir) => writeOpenCodeSessionDatabase(homeDir, [
+        {
+          id: 'ses_openrouter',
+          model: JSON.stringify({
+            id: 'z-ai/glm-5.3-flash',
+            providerID: 'openrouter',
+            variant: 'default',
+          }),
+        },
+        {
+          id: 'ses_qualified',
+          // An id that already carries the provider prefix must survive as-is.
+          model: JSON.stringify({
+            id: 'openrouter/z-ai/glm-5.3-flash',
+            providerID: 'openrouter',
+          }),
+        },
+        {
+          id: 'ses_plain_string',
+          model: 'opencode/gpt-5.6-terra',
+        },
+      ]),
+      async (adapter) => {
+        assert.equal(
+          (await adapter.getCurrentActiveModel('ses_openrouter')).model,
+          'openrouter/z-ai/glm-5.3-flash',
+        );
+        assert.equal(
+          (await adapter.getCurrentActiveModel('ses_qualified')).model,
+          'openrouter/z-ai/glm-5.3-flash',
+        );
+        assert.equal(
+          (await adapter.getCurrentActiveModel('ses_plain_string')).model,
+          'opencode/gpt-5.6-terra',
+        );
+      },
+    );
+  } finally {
+    closeConnection();
+    if (previousDatabasePath === undefined) {
+      delete process.env.DATABASE_PATH;
+    } else {
+      process.env.DATABASE_PATH = previousDatabasePath;
+    }
+    await rm(tempSessionsDirectory, { recursive: true, force: true });
+  }
+});

package/server/modules/providers/tests/opencode-sessions.test.ts

@@ -151,6 +151,30 @@ const createOpenCodeDatabase = async (homeDir: string, workspacePath: string): P
       3,
       2,
     );
+    db.prepare(`
+      INSERT INTO session (
+        id, project_id, parent_id, slug, directory, title, version, time_created, time_updated,
+        time_archived, tokens_input, tokens_output, tokens_reasoning, tokens_cache_read,
+        tokens_cache_write
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      'open-child-session-1',
+      'project-1',
+      'open-session-1',
+      'open-child-session-1',
+      workspacePath,
+      'OpenCode child session',
+      '0.0.0',
+      1_700_000_002_000,
+      1_700_000_005_000,
+      null,
+      5,
+      10,
+      2,
+      1,
+      1,
+    );
 
     const userMessageData = JSON.stringify({
       role: 'user',
@@ -255,16 +279,29 @@ test('OpenCode session synchronizer indexes sqlite sessions without deletable tr
   try {
     await createOpenCodeDatabase(tempRoot, workspacePath);
     await withIsolatedDatabase(() => {
+      sessionsDb.createAppSession('app-child-session-1', 'opencode', workspacePath);
+      sessionsDb.assignProviderSessionId('app-child-session-1', 'open-child-session-1');
+
       const synchronizer = new OpenCodeSessionSynchronizer();
       const processed = synchronizer.synchronize();
 
-      return Promise.resolve(processed).then((count) => {
+      return Promise.resolve(processed).then(async (count) => {
         assert.equal(count, 1);
         const indexed = sessionsDb.getSessionById('open-session-1');
         assert.equal(indexed?.provider, 'opencode');
         assert.equal(indexed?.project_path, workspacePath);
         assert.equal(indexed?.custom_name, 'OpenCode indexed title');
         assert.equal(indexed?.jsonl_path, null);
+        assert.equal(sessionsDb.getSessionById('app-child-session-1'), null);
+        assert.equal(sessionsDb.getSessionByProviderSessionId('open-child-session-1'), null);
+
+        sessionsDb.createAppSession('app-child-session-2', 'opencode', workspacePath);
+        sessionsDb.assignProviderSessionId('app-child-session-2', 'open-child-session-1');
+        await synchronizer.synchronize(new Date(1_700_000_004_500));
+        assert.equal(
+          sessionsDb.getSessionById('app-child-session-2')?.provider_session_id,
+          'open-child-session-1',
+        );
       });
     });
   } finally {
@@ -290,6 +327,7 @@ test('OpenCode session synchronizer returns the app session id once provider map
         assert.equal(sessionId, 'app-session-1');
         assert.equal(sessionsDb.getAllSessions().length, 1);
         assert.equal(sessionsDb.getSessionById('app-session-1')?.provider_session_id, 'open-session-1');
+        assert.equal(sessionsDb.getSessionById('open-child-session-1'), null);
       });
     });
   } finally {
@@ -438,6 +476,7 @@ const seedOpenCodeSession = async (
       CREATE TABLE session (
         id TEXT PRIMARY KEY,
         project_id TEXT,
+        parent_id TEXT,
         directory TEXT,
         title TEXT,
         time_created INTEGER,

package/server/modules/providers/tests/provider-capabilities.service.test.ts

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { CLAUDE_PREDEFINED_MODELS } from '@/modules/providers/list/claude/claude-models.provider.js';
+import { CODEX_PREDEFINED_MODELS } from '@/modules/providers/list/codex/codex-models.provider.js';
+import { CURSOR_PREDEFINED_MODELS } from '@/modules/providers/list/cursor/cursor-models.provider.js';
+import { OPENCODE_PREDEFINED_MODELS } from '@/modules/providers/list/opencode/opencode-models.provider.js';
+import { providerCapabilitiesService } from '@/modules/providers/services/provider-capabilities.service.js';
+import type { LLMProvider, ProviderModelsDefinition } from '@/shared/types.js';
+
+/**
+ * The full curated catalogs, before OpenCode narrows its list to the upstream
+ * providers a machine has connected.
+ */
+const CURATED_CATALOGS: Record<LLMProvider, ProviderModelsDefinition> = {
+  claude: CLAUDE_PREDEFINED_MODELS,
+  codex: CODEX_PREDEFINED_MODELS,
+  cursor: CURSOR_PREDEFINED_MODELS,
+  opencode: OPENCODE_PREDEFINED_MODELS,
+};
+
+test('capability effort levels cover every level a curated model declares', () => {
+  // Custom models may declare only these levels, so a level added to a curated
+  // model has to be added here too, or users could not give it to their own.
+  for (const [provider, catalog] of Object.entries(CURATED_CATALOGS) as Array<[LLMProvider, ProviderModelsDefinition]>) {
+    const { effortLevels, supportsEffort } = providerCapabilitiesService.getProviderCapabilities(provider);
+
+    assert.equal(supportsEffort, effortLevels.length > 0, `${provider}: supportsEffort disagrees with effortLevels`);
+    assert.equal(new Set(effortLevels).size, effortLevels.length, `${provider}: effortLevels lists a level twice`);
+
+    const declaredLevels = new Set(
+      catalog.OPTIONS.flatMap((option) => option.effort?.values.map((level) => level.value) ?? []),
+    );
+    const missingLevels = [...declaredLevels].filter((level) => !effortLevels.includes(level));
+    assert.deepEqual(missingLevels, [], `${provider}: effortLevels misses curated levels`);
+  }
+});

package/server/modules/providers/tests/provider-models.service.test.ts

@@ -69,6 +69,7 @@ const createCatalogStore = () => {
         modelId: input.id,
         model: input.model,
         sortOrder: readRows(provider).length,
+        effort: input.effort ?? null,
       };
       rows.set(provider, [...readRows(provider), record]);
       return record;
@@ -82,7 +83,13 @@ const createCatalogStore = () => {
       if (!existing) {
         return null;
       }
-      const updated = { ...existing, modelId: input.id, model: input.model };
+      const updated = {
+        ...existing,
+        modelId: input.id,
+        model: input.model,
+        // Mirrors the repository: an omitted effort keeps the stored levels.
+        effort: input.effort === undefined ? existing.effort : input.effort,
+      };
       rows.set(provider, readRows(provider).map((record) => (
         record.recordId === recordId ? updated : record
       )));
@@ -165,6 +172,97 @@ test('custom models can be created, edited, and deleted', async () => {
   assert.equal(removed.models.OPTIONS.some((option) => option.recordId === recordId), false);
 });
 
+test('custom models carry declared effort levels into the merged catalog', async () => {
+  const { service } = createTestService();
+
+  const created = await service.createCustomModel('claude', {
+    model: 'My Custom Model',
+    id: 'my-custom-model',
+    effort: { values: ['low', 'max'], default: 'max' },
+  });
+  const expectedEffort = { default: 'max', values: [{ value: 'low' }, { value: 'max' }] };
+  assert.deepEqual(created.model.effort, expectedEffort);
+
+  const catalog = await service.getProviderModels('claude');
+  const merged = catalog.OPTIONS.find((option) => option.value === 'my-custom-model');
+  assert.deepEqual(merged?.effort, expectedEffort);
+
+  // A rename that does not mention effort (an older client) keeps the levels.
+  const renamed = await service.updateCustomModel('claude', created.model.recordId as number, {
+    model: 'Renamed',
+    id: 'my-custom-model',
+  });
+  assert.deepEqual(renamed.model.effort, expectedEffort);
+
+  const cleared = await service.updateCustomModel('claude', created.model.recordId as number, {
+    model: 'Renamed',
+    id: 'my-custom-model',
+    effort: null,
+  });
+  assert.equal('effort' in cleared.model, false);
+});
+
+test('custom models without declared effort levels expose no effort', async () => {
+  const { service } = createTestService();
+
+  const created = await service.createCustomModel('codex', { model: 'Plain', id: 'plain-model' });
+
+  assert.equal('effort' in created.model, false);
+});
+
+test('custom effort levels must be levels the provider supports', async () => {
+  const { service } = createTestService();
+
+  await assert.rejects(
+    () => service.createCustomModel('codex', {
+      model: 'Unknown level',
+      id: 'unknown-level',
+      effort: { values: ['low', 'turbo'] },
+    }),
+    (error) => error instanceof AppError
+      && error.code === 'INVALID_MODEL_EFFORT'
+      && error.statusCode === 400,
+  );
+
+  await assert.rejects(
+    () => service.createCustomModel('cursor', {
+      model: 'Cursor effort',
+      id: 'cursor-effort',
+      effort: { values: ['low'] },
+    }),
+    (error) => error instanceof AppError
+      && error.code === 'MODEL_EFFORT_NOT_SUPPORTED'
+      && error.statusCode === 400,
+  );
+});
+
+test('allowed effort levels come from the provider, not from the built-in models this machine sees', async () => {
+  // The fake adapters' built-in models declare no effort at all, which is what
+  // the real OpenCode adapter returns once it narrows its catalog to OpenCode
+  // Zen, Anthropic, or OpenAI: only its OpenCode Go models declare effort.
+  const { service } = createTestService();
+
+  const created = await service.createCustomModel('opencode', {
+    model: 'Router model',
+    id: 'openrouter/router-model',
+    effort: { values: ['none', 'high'] },
+  });
+  assert.deepEqual(created.model.effort, { values: [{ value: 'none' }, { value: 'high' }] });
+
+  // Every merged catalog carries the provider's levels for the model library,
+  // weakest first, and an empty list where effort is unsupported.
+  const expectedLevels: Record<LLMProvider, string[]> = {
+    claude: ['low', 'medium', 'high', 'xhigh', 'max', 'ultracode'],
+    codex: ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'],
+    cursor: [],
+    opencode: ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'thinking'],
+  };
+  for (const [provider, levels] of Object.entries(expectedLevels) as Array<[LLMProvider, string[]]>) {
+    assert.deepEqual((await service.getProviderModels(provider)).EFFORT_LEVELS, levels, provider);
+  }
+  assert.deepEqual(created.models.EFFORT_LEVELS, expectedLevels.opencode);
+});
+
 test('duplicate model ids are rejected within one provider', async () => {
   const { service } = createTestService();
   await service.createCustomModel('cursor', { model: 'First', id: 'custom-id' });

package/server/modules/providers/tests/provider.routes.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { once } from 'node:events';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import type { AddressInfo } from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
@@ -10,6 +10,9 @@ import express, { type NextFunction, type Request, type Response } from 'express
 
 import { closeConnection, initializeDatabase, sessionsDb } from '@/modules/database/index.js';
 import providerRouter from '@/modules/providers/provider.routes.js';
+import { providerRegistry } from '@/modules/providers/provider.registry.js';
+import type { IProvider } from '@/shared/interfaces.js';
+import type { BackgroundTaskSummary, WorkflowAgentActivity } from '@/shared/types.js';
 import { AppError } from '@/shared/utils.js';
 
 async function withProviderServer(
@@ -242,3 +245,229 @@ test('model routes expose immutable defaults and full custom model CRUD', async
     );
   });
 });
+
+test('custom model routes accept, validate, and return reasoning-effort levels', async () => {
+  await withProviderServer(async (baseUrl) => {
+    const postModel = async (provider: string, body: unknown) => {
+      const response = await fetch(`${baseUrl}/api/providers/${provider}/models`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      return {
+        status: response.status,
+        payload: await response.json() as {
+          data?: {
+            model: { recordId: number; effort?: unknown };
+            models: { OPTIONS: Array<{ value: string; effort?: unknown }> };
+          };
+          error?: { code: string; message?: string };
+        },
+      };
+    };
+
+    const created = await postModel('claude', {
+      model: 'My Custom Model',
+      id: 'my-custom-model',
+      effort: { values: [' low ', 'high'], default: 'high' },
+    });
+    const expectedEffort = { default: 'high', values: [{ value: 'low' }, { value: 'high' }] };
+    assert.equal(created.status, 201);
+    assert.deepEqual(created.payload.data?.model.effort, expectedEffort);
+
+    const catalogResponse = await fetch(`${baseUrl}/api/providers/claude/models`);
+    const catalogPayload = await catalogResponse.json() as {
+      data: { models: { OPTIONS: Array<{ value: string; effort?: unknown }>; EFFORT_LEVELS?: string[] } };
+    };
+    assert.deepEqual(
+      catalogPayload.data.models.OPTIONS.find((option) => option.value === 'my-custom-model')?.effort,
+      expectedEffort,
+    );
+    // The model library's toggles come from here, not from the built-in models.
+    assert.deepEqual(
+      catalogPayload.data.models.EFFORT_LEVELS,
+      ['low', 'medium', 'high', 'xhigh', 'max', 'ultracode'],
+    );
+
+    // OpenCode's allowed levels do not depend on which upstream providers the
+    // machine running the tests has connected.
+    const openCodeModel = await postModel('opencode', {
+      model: 'Router model',
+      id: 'openrouter/router-model',
+      effort: { values: ['none', 'high'] },
+    });
+    assert.equal(openCodeModel.status, 201, JSON.stringify(openCodeModel.payload));
+    assert.deepEqual(openCodeModel.payload.data?.model.effort, { values: [{ value: 'none' }, { value: 'high' }] });
+
+    // A PATCH from a client that predates effort metadata keeps the levels.
+    const renameResponse = await fetch(
+      `${baseUrl}/api/providers/claude/models/${created.payload.data?.model.recordId}`,
+      {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ model: 'Renamed', id: 'my-custom-model' }),
+      },
+    );
+    const renamePayload = await renameResponse.json() as { data: { model: { effort?: unknown } } };
+    assert.equal(renameResponse.status, 200);
+    assert.deepEqual(renamePayload.data.model.effort, expectedEffort);
+
+    const invalidPayloads: Array<{ provider: string; effort: unknown; code: string }> = [
+      { provider: 'claude', effort: { values: ['low', 'low'] }, code: 'INVALID_MODEL_EFFORT' },
+      { provider: 'claude', effort: { values: ['low', ''] }, code: 'INVALID_MODEL_EFFORT' },
+      { provider: 'claude', effort: { values: ['low'], default: 'high' }, code: 'INVALID_MODEL_EFFORT' },
+      { provider: 'claude', effort: { values: ['turbo'] }, code: 'INVALID_MODEL_EFFORT' },
+      { provider: 'claude', effort: 'high', code: 'INVALID_MODEL_EFFORT' },
+      { provider: 'cursor', effort: { values: ['low'] }, code: 'MODEL_EFFORT_NOT_SUPPORTED' },
+    ];
+    for (const [index, invalid] of invalidPayloads.entries()) {
+      const rejected = await postModel(invalid.provider, {
+        model: `Invalid ${index}`,
+        id: `invalid-${index}`,
+        effort: invalid.effort,
+      });
+      assert.equal(rejected.status, 400, JSON.stringify(invalid));
+      assert.equal(rejected.payload.error?.code, invalid.code, JSON.stringify(invalid));
+    }
+
+    // An oversized list is refused by its length, before any entry is walked:
+    // the JSON parser accepts bodies of up to 50 MB.
+    const oversized = await postModel('claude', {
+      model: 'Oversized',
+      id: 'oversized',
+      effort: { values: Array.from({ length: 33 }, (_, index) => `level-${index}`) },
+    });
+    assert.equal(oversized.status, 400);
+    assert.equal(oversized.payload.error?.code, 'INVALID_MODEL_EFFORT');
+    assert.match(oversized.payload.error?.message ?? '', /at most 32 effort levels/);
+  });
+});
+
+test('the running-sessions route reports a session held open for background work', async () => {
+  // The client polls this route to keep every tab's activity map in step, so
+  // a session whose turn ended but whose agent is still running has to be in
+  // the payload — flagged as background work, with the tasks to show and stop.
+  const tasks: BackgroundTaskSummary[] = [{
+    taskId: 'a73dc7a6442f7c415',
+    toolUseId: 'toolu_013sUz4iWcNjN6BskVkHUCAr',
+    taskType: 'local_agent',
+    description: 'Investigate the flaky test',
+    startedAt: 1_700_000_000_000,
+  }];
+  const realListProviders = providerRegistry.listProviders;
+  providerRegistry.listProviders = () => [{
+    id: 'claude',
+    runtime: { listBackgroundWork: () => [{ sessionId: 'held-session', tasks }] },
+  } as unknown as IProvider];
+
+  try {
+    await withProviderServer(async (baseUrl) => {
+      const response = await fetch(`${baseUrl}/api/providers/sessions/running`);
+      const payload = await response.json() as { data: { sessions: unknown[] } };
+
+      assert.equal(response.status, 200);
+      assert.deepEqual(payload.data.sessions, [{
+        sessionId: 'held-session',
+        provider: 'claude',
+        startedAt: 1_700_000_000_000,
+        lastSeq: 0,
+        background: true,
+        canInterrupt: false,
+        tasks,
+      }]);
+    });
+  } finally {
+    providerRegistry.listProviders = realListProviders;
+  }
+});
+
+const WORKFLOW_SESSION_ID = 'claude-workflow-routes-session';
+const WORKFLOW_RUN_ID = 'wf_16fbf852-274';
+const FINISHED_AGENT_ID = 'aa1e064cf8bd159d6';
+const UNREPORTED_AGENT_ID = 'ab89f2cde612a51b1';
+
+/**
+ * Writes a workflow run's directory the way a real run leaves it under the
+ * session's transcript directory: one `agent-<id>.jsonl` per agent, in the
+ * row shape an Agent subagent's transcript has, and the journal beside them.
+ */
+async function writeWorkflowRun(projectDirectory: string): Promise<string> {
+  const sessionPath = path.join(projectDirectory, `${WORKFLOW_SESSION_ID}.jsonl`);
+  await mkdir(projectDirectory, { recursive: true });
+  await writeFile(sessionPath, `${JSON.stringify({ type: 'user', uuid: 'u1', sessionId: WORKFLOW_SESSION_ID, timestamp: '2026-08-21T10:32:10.000Z', message: { role: 'user', content: 'audit the frontend' } })}\n`, 'utf8');
+
+  const runDir = path.join(projectDirectory, WORKFLOW_SESSION_ID, 'subagents', 'workflows', WORKFLOW_RUN_ID);
+  await mkdir(runDir, { recursive: true });
+
+  const agentRows = (agentId: string) => [
+    { parentUuid: null, isSidechain: true, agentId, type: 'user', uuid: `${agentId}-u1`, timestamp: '2026-08-21T10:32:20.000Z', message: { role: 'user', content: 'You are the analysis step of a code-quality audit.' } },
+    { parentUuid: `${agentId}-u1`, isSidechain: true, agentId, type: 'assistant', uuid: `${agentId}-a1`, timestamp: '2026-08-21T10:32:25.000Z', message: { role: 'assistant', model: 'claude-opus-4-1', content: [{ type: 'tool_use', id: `toolu_${agentId}_1`, name: 'Grep', input: { pattern: 'useSidebar' } }] } },
+    { parentUuid: `${agentId}-a1`, isSidechain: true, agentId, type: 'user', uuid: `${agentId}-u2`, timestamp: '2026-08-21T10:32:26.000Z', message: { role: 'user', content: [{ type: 'tool_result', tool_use_id: `toolu_${agentId}_1`, content: 'src/modules/sidebar/useSidebar.ts' }] } },
+    { parentUuid: `${agentId}-u2`, isSidechain: true, agentId, type: 'assistant', uuid: `${agentId}-a2`, timestamp: '2026-08-21T10:32:40.000Z', message: { role: 'assistant', model: 'claude-opus-4-1', content: [{ type: 'text', text: 'One hook owns the sidebar.' }] } },
+  ];
+  for (const agentId of [FINISHED_AGENT_ID, UNREPORTED_AGENT_ID]) {
+    await writeFile(path.join(runDir, `agent-${agentId}.jsonl`), `${agentRows(agentId).map((row) => JSON.stringify(row)).join('\n')}\n`, 'utf8');
+    await writeFile(path.join(runDir, `agent-${agentId}.meta.json`), JSON.stringify({ agentType: 'workflow-subagent', spawnDepth: 1 }), 'utf8');
+  }
+  const journal = [
+    { type: 'started', key: 'v2:one', agentId: FINISHED_AGENT_ID, label: 'audit:sidebar', phase: 'Audit' },
+    { type: 'started', key: 'v2:two', agentId: UNREPORTED_AGENT_ID, label: 'synthesize', phase: 'Synthesize' },
+    { type: 'result', key: 'v2:one', agentId: FINISHED_AGENT_ID, result: { area: 'sidebar' } },
+  ];
+  await writeFile(path.join(runDir, 'journal.jsonl'), `${journal.map((row) => JSON.stringify(row)).join('\n')}\n`, 'utf8');
+
+  return sessionPath;
+}
+
+test('the workflow agent route reads an agent\'s timeline and status from its run directory', async () => {
+  await withProviderServer(async (baseUrl, workspacePath) => {
+    const sessionPath = await writeWorkflowRun(workspacePath);
+    const now = new Date().toISOString();
+    sessionsDb.createSession(WORKFLOW_SESSION_ID, 'claude', workspacePath, 'Workflow session', now, now, sessionPath);
+
+    const agentUrl = (runId: string, agentId: string) =>
+      `${baseUrl}/api/providers/sessions/${WORKFLOW_SESSION_ID}/workflows/${runId}/agents/${agentId}`;
+
+    // The SDK streams none of an agent's rows to the parent, so its transcript
+    // is the only record of what it did — read on demand, capped like an
+    // Agent card's, and settled by the journal beside it.
+    const finishedResponse = await fetch(agentUrl(WORKFLOW_RUN_ID, FINISHED_AGENT_ID));
+    const finished = (await finishedResponse.json() as { data: WorkflowAgentActivity }).data;
+    assert.equal(finishedResponse.status, 200);
+    assert.deepEqual(finished.agent, { id: FINISHED_AGENT_ID, label: 'audit:sidebar', model: 'claude-opus-4-1', status: 'completed' });
+    assert.equal(finished.activityCount, 2);
+    assert.deepEqual(finished.activity.map((entry) => entry.kind), ['tool', 'text']);
+    assert.equal(finished.activity[0]?.toolName, 'Grep');
+    assert.deepEqual(finished.activity[0]?.toolInput, { pattern: 'useSidebar' });
+    assert.deepEqual(finished.activity[0]?.toolResult, { content: 'src/modules/sidebar/useSidebar.ts', isError: false });
+    assert.equal(finished.activity[1]?.content, 'One hook owns the sidebar.');
+
+    // A `started` with no `result` or `failed`, and no live run of the session
+    // to still be working in: nothing can report for it any more.
+    const unreportedResponse = await fetch(agentUrl(WORKFLOW_RUN_ID, UNREPORTED_AGENT_ID));
+    const unreported = (await unreportedResponse.json() as { data: WorkflowAgentActivity }).data;
+    assert.equal(unreportedResponse.status, 200);
+    assert.equal(unreported.agent.status, 'stopped');
+    assert.equal(unreported.agent.label, 'synthesize');
+
+    // Both ids name a file under the session directory, so neither may carry
+    // anything but the harness's own shapes — not even a well-formed
+    // directory that happens to exist.
+    for (const [runId, agentId, code] of [
+      [`${WORKFLOW_RUN_ID}%2F..`, FINISHED_AGENT_ID, 'INVALID_WORKFLOW_RUN_ID'],
+      ['subagents', FINISHED_AGENT_ID, 'INVALID_WORKFLOW_RUN_ID'],
+      [WORKFLOW_RUN_ID, '..%2Fjournal', 'INVALID_WORKFLOW_AGENT_ID'],
+      [WORKFLOW_RUN_ID, 'aa1e064cf8bd159d', 'INVALID_WORKFLOW_AGENT_ID'],
+    ] as const) {
+      const response = await fetch(agentUrl(runId, agentId));
+      const payload = await response.json() as { error: { code: string } };
+      assert.equal(response.status, 400, `${runId}/${agentId}`);
+      assert.equal(payload.error.code, code);
+    }
+
+    const missingResponse = await fetch(agentUrl(WORKFLOW_RUN_ID, 'a0000000000000000'));
+    const missing = await missingResponse.json() as { error: { code: string } };
+    assert.equal(missingResponse.status, 404);
+    assert.equal(missing.error.code, 'WORKFLOW_AGENT_NOT_FOUND');
+  });
+});

package/server/modules/providers/tests/session-history-cache.service.test.ts

@@ -141,3 +141,25 @@ test('the oldest entries are evicted over budget, but the newest survives alone'
     await rm(tempDirectory, { recursive: true, force: true });
   }
 });
+
+test('invalidating a session re-parses its unchanged transcript on the next read', async () => {
+  await withTranscriptFile(async (transcriptPath) => {
+    const cache = createSessionHistoryCache();
+    let loads = 0;
+    const loadFull = async () => {
+      loads += 1;
+      return historyResult(`load-${loads}`);
+    };
+
+    // Claude's history reader decides a background agent's status from whether
+    // the session's CLI process is up — nothing the file's stat can reflect —
+    // so the runtime drops the entry when that process starts or ends.
+    const first = await cache.getFullHistory({ sessionId: 's1', transcriptPath, loadFull });
+    cache.invalidate('s1');
+    const second = await cache.getFullHistory({ sessionId: 's1', transcriptPath, loadFull });
+
+    assert.equal(loads, 2);
+    assert.notEqual(second, first);
+    assert.equal(second?.messages[0]?.content, 'load-2');
+  });
+});