@danieltmn/tamnora 0.21.2 → 0.23.0

package/harness/packages/server/test/security.test.js

@@ -28,7 +28,7 @@ async function startServer(overrides = {}) {
     ...overrides,
   });
   const info = await instance.listen({ port: 0 });
-  return { instance, base: info.url, cwd, home: cwd };
+  return { instance, base: info.url, port: info.port, cwd, home: cwd };
 }
 
 /** Deja un bridge.json apuntando a un supervisor vivo (este proceso). */
@@ -64,8 +64,6 @@ test('localOk exige loopback en remoteAddress y sin tunel activo', async () => {
   try {
     // Con tunel activo, hasta una conexion loopback deja de ser local.
     await fakeTunnel();
-    // El cache de tunnelState vive 1 s.
-    await new Promise((r) => setTimeout(r, 1100));
     assert.ok(!localOk({ socket: { remoteAddress: '127.0.0.1' } }));
     assert.equal(home, path.dirname(bridgeStatePath()));
   } finally {
@@ -81,7 +79,6 @@ test('un bridge de tailscale no degrada localOk (red privada por loopback)', asy
       bridgeStatePath(),
       `${JSON.stringify({ pid: process.pid, url: 'https://pc.tailnet.ts.net', provider: 'tailscale', port: 4517 })}\n`
     );
-    await new Promise((r) => setTimeout(r, 1100));
     assert.ok(localOk({ socket: { remoteAddress: '127.0.0.1' } }), 'loopback sigue siendo local con tailscale');
   } finally {
     await clearTunnel();
@@ -105,7 +102,6 @@ test('POST /api/shell responde 403 mientras el tunel esta activo', async () => {
     assert.match(String(body.output), /tamnora-ok/);
 
     await fakeTunnel();
-    await new Promise((r) => setTimeout(r, 1100));
     const blocked = await shell();
     assert.equal(blocked.status, 403);
 
@@ -131,7 +127,6 @@ test('GET /api/files: sin tunel acepta ?root; con tunel y sin auth responde 403'
     assert.equal(escape.status, 400);
 
     await fakeTunnel();
-    await new Promise((r) => setTimeout(r, 1100));
     const viaTunnel = await fetch(`${base}/api/files`);
     assert.equal(viaTunnel.status, 403);
   } finally {
@@ -166,7 +161,6 @@ test('con auth, git/files quedan usables por el tunel y confinados al workspace'
     const { csrf } = await login.json();
 
     await fakeTunnel();
-    await new Promise((r) => setTimeout(r, 1100));
 
     const files = await fetch(`${base}/api/files`, { headers: { cookie } });
     assert.equal(files.status, 200);
@@ -217,7 +211,7 @@ test('el lockout de login no se esquiva falsificando X-Forwarded-For', async ()
     const lockedSpoof = await attempt('198.51.100.7');
     assert.equal(lockedSpoof.status, 429, 'XFF falsificado no resetea el contador');
   } finally {
-    loginClear({ socket: { remoteAddress: '127.0.0.1' } }, 'locktest');
+    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
     await instance.close();
   }
 });
@@ -238,7 +232,6 @@ test('la cookie va con Secure cuando hay tunel y el Host es publico', async () =
   const info = await instance.listen({ port: 0 });
   try {
     await fakeTunnel();
-    await new Promise((r) => setTimeout(r, 1100));
 
     const rawLogin = (host) =>
       new Promise((resolve, reject) => {
@@ -265,3 +258,113 @@ test('la cookie va con Secure cuando hay tunel y el Host es publico', async () =
     await instance.close();
   }
 });
+
+/** Request crudo para poder fijar headers que `fetch` no deja (Host, Origin). */
+function rawRequest({ port, path: reqPath, method = 'GET', headers = {}, body = '' }) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port,
+        path: reqPath,
+        method,
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), ...headers },
+      },
+      (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => resolve({ status: res.statusCode, body: out }));
+      }
+    );
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+
+test('las mutaciones rechazan un Origin ajeno, con o sin auth (CSRF drive-by)', async () => {
+  const { instance, port } = await startServer();
+  try {
+    const shell = (headers) =>
+      rawRequest({
+        port,
+        path: '/api/shell',
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ command: 'echo pwned' }),
+      });
+
+    // Una web maliciosa: simple request con Origin ajeno no ejecuta nada.
+    const driveBy = await shell({ Origin: 'https://evil.example' });
+    assert.equal(driveBy.status, 403, 'Origin ajeno bloqueado');
+
+    const nullOrigin = await shell({ Origin: 'null' });
+    assert.equal(nullOrigin.status, 403, 'Origin: null bloqueado');
+
+    // Mismo origen (la consola) y clientes sin navegador (CLI) siguen pasando.
+    const sameOrigin = await shell({ Origin: `http://127.0.0.1:${port}` });
+    assert.equal(sameOrigin.status, 200, 'mismo origen permitido');
+    assert.match(sameOrigin.body, /pwned/);
+
+    const noOrigin = await shell({});
+    assert.equal(noOrigin.status, 200, 'cliente sin Origin (no navegador) permitido');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('el Host de un dominio ajeno se rechaza (DNS rebinding)', async () => {
+  const { instance, port } = await startServer();
+  try {
+    const health = (host) => rawRequest({ port, path: '/api/health', headers: { Host: host } });
+
+    const rebinding = await health('evil.example:8080');
+    assert.equal(rebinding.status, 403, 'Host de un dominio ajeno bloqueado');
+
+    const local = await health('127.0.0.1');
+    assert.equal(local.status, 200, 'IP literal permitida');
+
+    const named = await health('mi-pc.tailnet.ts.net');
+    assert.equal(named.status, 200, 'dominio de tailscale permitido');
+
+    const viaTunnelHost = await health('abc.tunnelmole.net');
+    assert.equal(viaTunnelHost.status, 200, 'dominio del tunel permitido');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('el lockout de login no se esquiva rotando el username', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-sec-lock2-'));
+  setHome(cwd);
+  const app = ensureApp();
+  app.user = makeUser('locktest2', 'secreto123');
+  writeApp(app);
+
+  const instance = await createTamnoraServer({
+    cwd,
+    dbPath: path.join(cwd, 'tamnora.db'),
+    loadMcp: false,
+    resolveProvider: () => ({ provider: fakeProvider, config: {} }),
+  });
+  const info = await instance.listen({ port: 0 });
+  const base = info.url;
+  try {
+    const attempt = (username) =>
+      fetch(`${base}/api/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password: 'mala' }),
+      });
+
+    // Cada intento con un nombre distinto: el contador es por IP, no por usuario.
+    for (let i = 0; i < 5; i++) {
+      const res = await attempt(`intruso${i}`);
+      assert.equal(res.status, 401, `intento ${i} sin bloquear todavia`);
+    }
+    const locked = await attempt('locktest2');
+    assert.equal(locked.status, 429, 'tras 5 fallos el bloqueo aplica a toda la IP');
+  } finally {
+    loginClear({ socket: { remoteAddress: '127.0.0.1' } });
+    await instance.close();
+  }
+});

package/harness/packages/server/test/sessions.test.js

@@ -0,0 +1,437 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, readFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { startServer } from './helpers.js';
+
+test('creates, lists, reads and deletes sessions', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Prueba', model: 'm' }),
+      })
+    ).json();
+    assert.ok(created.session.id);
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(list.sessions.length, 1);
+    assert.equal(list.sessions[0].title, 'Prueba');
+
+    const detail = await (await fetch(`${base}/api/sessions/${created.session.id}`)).json();
+    assert.deepEqual(detail.messages, []);
+
+    const deleted = await fetch(`${base}/api/sessions/${created.session.id}`, { method: 'DELETE' });
+    assert.equal(deleted.status, 200);
+    const afterList = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(afterList.sessions.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('lists and deletes sessions grouped by project (cwd)', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-proj-'));
+  const dirA = path.join(cwd, 'a');
+  const dirB = path.join(cwd, 'b');
+  await mkdir(dirA);
+  await mkdir(dirB);
+  const { instance, base } = await startServer({ cwd });
+  const create = (body) =>
+    fetch(`${base}/api/sessions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+  try {
+    await create({ title: 'a1', model: 'm', cwd: dirA });
+    await create({ title: 'a2', model: 'm', cwd: dirA });
+    await create({ title: 'b1', model: 'm', cwd: dirB });
+
+    const projects = await (await fetch(`${base}/api/projects`)).json();
+    assert.equal(projects.projects.find((p) => p.cwd === dirA).sessions, 2);
+    assert.equal(projects.projects.find((p) => p.cwd === dirB).sessions, 1);
+
+    const removed = await (
+      await fetch(`${base}/api/projects?cwd=${encodeURIComponent(dirA)}`, { method: 'DELETE' })
+    ).json();
+    assert.equal(removed.sessions, 2);
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    assert.equal(list.sessions.length, 1);
+    assert.equal(list.sessions[0].cwd, dirB);
+
+    const missing = await fetch(`${base}/api/projects`, { method: 'DELETE' });
+    assert.equal(missing.status, 400);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('cada sesión recuerda su propio tipo de agente (proveedor/modelo/modo)', async () => {
+  const calls = [];
+  const provider = {
+    id: 'recorder',
+    async streamChat(_config, { model }) {
+      calls.push(model);
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  const create = (body) =>
+    fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify(body) }).then((r) => r.json());
+  const chat = (sessionId, body = {}) =>
+    fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', sessionId, ...body }),
+    }).then((r) => r.text());
+  try {
+    const a = await create({ title: 'A', provider: 'openrouter', model: 'modelo-a', mode: 'plan' });
+    const b = await create({ title: 'B', provider: 'openai', model: 'modelo-b' });
+    assert.equal(a.session.mode, 'plan');
+
+    // Aunque el cuerpo no manda modelo, cada sesión corre con el suyo.
+    await chat(a.session.id);
+    await chat(b.session.id);
+    assert.deepEqual(calls, ['modelo-a', 'modelo-b']);
+
+    // El tipo de agente se puede fijar sin correr (PUT) y se persiste.
+    const updated = await (
+      await fetch(`${base}/api/sessions/${b.session.id}`, {
+        method: 'PUT',
+        headers: json,
+        body: JSON.stringify({ provider: 'openrouter', model: 'modelo-c', mode: 'agent' }),
+      })
+    ).json();
+    assert.equal(updated.session.model, 'modelo-c');
+    assert.equal(updated.session.mode, 'agent');
+
+    await chat(b.session.id);
+    assert.equal(calls.at(-1), 'modelo-c');
+
+    // El default global no se toca por cambiar el de una sesión.
+    const settings = await (await fetch(`${base}/api/settings`)).json();
+    assert.notEqual(settings.settings.model, 'modelo-c');
+  } finally {
+    await instance.close();
+  }
+});
+
+
+test('rewind restores files and truncates the turn', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-rewind-'));
+  await writeFile(path.join(cwd, 'tamnora.json'), JSON.stringify({ permissions: { write: 'allow' } }));
+  await writeFile(path.join(cwd, 'nota.txt'), 'original');
+  const provider = {
+    id: 'rw',
+    async streamChat(_config, { messages }) {
+      if (messages.some((m) => m.role === 'tool' && m.name === 'write')) {
+        return { content: 'listo', reasoning: '', toolCalls: [] };
+      }
+      return {
+        content: '',
+        reasoning: '',
+        toolCalls: [
+          {
+            id: 'w1',
+            type: 'function',
+            function: { name: 'write', arguments: JSON.stringify({ path: 'nota.txt', content: 'cambiado' }) },
+          },
+        ],
+      };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 't', model: 'm', cwd }) })
+    ).json();
+    const sid = created.session.id;
+    await (
+      await fetch(`${base}/api/chat`, {
+        method: 'POST',
+        headers: json,
+        body: JSON.stringify({ sessionId: sid, model: 'm', input: 'cambiá la nota' }),
+      })
+    ).text();
+    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'cambiado');
+
+    const detail = await (await fetch(`${base}/api/sessions/${sid}`)).json();
+    const userMsg = detail.messages.find((m) => m.role === 'user');
+    assert.ok(userMsg, 'no se persistió el mensaje del usuario');
+
+    const cps = await (await fetch(`${base}/api/sessions/${sid}/checkpoints`)).json();
+    assert.ok(cps.turns.includes(userMsg.id), 'no se registró el checkpoint del turno');
+
+    const res = await fetch(`${base}/api/sessions/${sid}/rewind`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ turn: userMsg.id }),
+    });
+    assert.equal(res.status, 200);
+    const out = await res.json();
+    assert.equal(out.restored, 1);
+    assert.equal(await readFile(path.join(cwd, 'nota.txt'), 'utf8'), 'original');
+
+    const after = await (await fetch(`${base}/api/sessions/${sid}`)).json();
+    assert.equal(after.messages.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('stores and injects the session goal', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-goal-'));
+  let captured = null;
+  const provider = {
+    id: 'goal',
+    async streamChat(_config, opts) {
+      captured = opts.messages;
+      return { content: 'ok', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'G' }) })
+    ).json();
+    const id = created.session.id;
+    const updated = await (
+      await fetch(`${base}/api/sessions/${id}`, {
+        method: 'PUT',
+        headers: json,
+        body: JSON.stringify({ goal: 'migrar a ESM' }),
+      })
+    ).json();
+    assert.equal(updated.session.goal, 'migrar a ESM');
+
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+    assert.ok(captured.some((m) => m.content === 'Objetivo de la sesión: migrar a ESM'));
+  } finally {
+    await instance.close();
+  }
+});
+
+test('compact summarizes and keeps the history with a marker', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-compact-'));
+  let compacting = false;
+  const provider = {
+    id: 'sum',
+    async streamChat(_config, opts) {
+      const system = opts.messages.find((m) => m.role === 'system')?.content ?? '';
+      if (system.includes('Resumí la conversación')) compacting = true;
+      return { content: compacting ? 'RESUMEN FINAL' : 'hola', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'C' }) })
+    ).json();
+    const id = created.session.id;
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+
+    const compact = await (
+      await fetch(`${base}/api/sessions/${id}/compact`, { method: 'POST', headers: json })
+    ).json();
+    assert.equal(compact.summary, 'RESUMEN FINAL');
+    assert.ok(compact.cursor, 'debe devolver el cursor de compactación');
+
+    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
+    const marker = detail.messages.find((m) => m.name === 'compact');
+    assert.ok(marker, 'debe dejar una marca de compactación');
+    assert.equal(marker.content, 'RESUMEN FINAL');
+    assert.ok(detail.messages.length > 1, 'no borra el historial');
+    assert.equal(detail.session.hasSummary, true);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('the summary endpoint returns a summary without clearing the messages', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-summary-'));
+  const provider = {
+    id: 'sum',
+    async streamChat(_config, opts) {
+      const system = opts.messages.find((m) => m.role === 'system')?.content ?? '';
+      return { content: system.includes('Resumí la conversación') ? 'RESUMEN FINAL' : 'hola', reasoning: '', toolCalls: [] };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'S' }) })
+    ).json();
+    const id = created.session.id;
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+
+    const summary = await (
+      await fetch(`${base}/api/sessions/${id}/summary`, { method: 'POST', headers: json })
+    ).json();
+    assert.equal(summary.summary, 'RESUMEN FINAL');
+
+    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
+    assert.ok(detail.messages.length > 0, 'no borra el historial');
+  } finally {
+    await instance.close();
+  }
+});
+
+test('aggregates the token usage of a session', async () => {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'tamnora-tokens-'));
+  const provider = {
+    id: 'tok',
+    async streamChat() {
+      return {
+        content: 'ok',
+        reasoning: '',
+        toolCalls: [],
+        usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+      };
+    },
+  };
+  const { instance, base } = await startServer({ cwd, resolveProvider: () => ({ provider, config: {} }) });
+  const json = { 'Content-Type': 'application/json' };
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, { method: 'POST', headers: json, body: JSON.stringify({ title: 'T' }) })
+    ).json();
+    const id = created.session.id;
+    await (await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: json,
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId: id }),
+    })).text();
+    const detail = await (await fetch(`${base}/api/sessions/${id}`)).json();
+    assert.deepEqual(detail.tokens, { in: 10, out: 5 });
+  } finally {
+    await instance.close();
+  }
+});
+
+test('sessions and chat accept a workspace cwd', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'tamnora-cwd-'));
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Con carpeta', model: 'm', cwd: root }),
+      })
+    ).json();
+    assert.equal(created.session.cwd, path.resolve(root));
+
+    const bad = await fetch(`${base}/api/sessions`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ title: 'Mala', cwd: path.join(root, 'nope') }),
+    });
+    assert.equal(bad.status, 400);
+
+    const res = await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm', cwd: root }),
+    });
+    const text = await res.text();
+    assert.match(text, /event: start/);
+    assert.ok(text.includes(`"cwd":${JSON.stringify(path.resolve(root))}`));
+
+    const list = await (await fetch(`${base}/api/sessions`)).json();
+    const fromChat = list.sessions.find((s) => s.cwd === path.resolve(root) && s.title !== 'Con carpeta');
+    assert.ok(fromChat);
+  } finally {
+    await instance.close();
+  }
+});
+
+test('searches sessions and messages', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'Busqueda pepita' }),
+      })
+    ).json();
+    const sessionId = created.session.id;
+
+    await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'contenido único zanahoria', model: 'm', sessionId }),
+    });
+
+    const bySession = await (await fetch(`${base}/api/search?q=pepita`)).json();
+    assert.ok(bySession.sessions.some((s) => s.id === sessionId));
+
+    const byMessage = await (await fetch(`${base}/api/search?q=zanahoria`)).json();
+    assert.ok(byMessage.messages.some((m) => m.sessionId === sessionId));
+
+    const tooShort = await (await fetch(`${base}/api/search?q=p`)).json();
+    assert.deepEqual(tooShort, { sessions: [], messages: [] });
+  } finally {
+    await instance.close();
+  }
+});
+
+test('truncates a session from a message id', async () => {
+  const { instance, base } = await startServer();
+  try {
+    const created = await (
+      await fetch(`${base}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ title: 'T' }),
+      })
+    ).json();
+    const sessionId = created.session.id;
+
+    await fetch(`${base}/api/chat`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'hola', model: 'm', sessionId }),
+    });
+
+    let detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
+    assert.ok(detail.messages.length >= 2);
+    const firstId = detail.messages[0].id;
+    assert.ok(firstId);
+
+    const res = await fetch(`${base}/api/sessions/${sessionId}/truncate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ fromId: firstId }),
+    });
+    assert.equal(res.status, 200);
+
+    detail = await (await fetch(`${base}/api/sessions/${sessionId}`)).json();
+    assert.equal(detail.messages.length, 0);
+  } finally {
+    await instance.close();
+  }
+});
+