@mrpatronz/nexusflow 2.8.1 → 2.10.0

package/dist/server.test.js

@@ -1,1697 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
-import { execa } from 'execa';
-import { AgentTurnGate, app, canOfferClaudeDesktopTransfer, dispatchAgentInput, isAllowedUpdateUrl } from './server.js';
-import * as workspace from './core/workspace.js';
-import * as config from './core/config.js';
-import * as analyzers from './analyzers/index.js';
-import * as generators from './generators/index.js';
-import * as workflows from './utils/workflows.js';
-import * as skillsCatalog from './utils/skills-catalog.js';
-import * as agentsCatalog from './resources/agents-catalog.js';
-import * as resourceService from './resources/service.js';
-import * as detectAi from './utils/detect-ai.js';
-import * as newRepo from './core/new-repo.js';
-import * as orchestration from './orchestration/index.js';
-import * as sessionFinder from './utils/session-finder.js';
-import { ProviderRegistry } from './agent/ProviderRegistry.js';
-// Mock dependencies
-vi.mock('node:fs/promises');
-vi.mock('execa');
-vi.mock('./core/workspace.js');
-vi.mock('./core/config.js');
-vi.mock('./utils/system-scanner.js');
-vi.mock('./utils/update-check.js');
-vi.mock('./analyzers/index.js');
-vi.mock('./generators/index.js');
-vi.mock('./utils/workflows.js');
-vi.mock('./utils/skills-catalog.js');
-vi.mock('./resources/agents-catalog.js');
-vi.mock('./resources/service.js', async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        withResourceAdministrationLock: vi.fn((operation) => operation()),
-        validateResourceSelections: vi.fn().mockResolvedValue(undefined),
-    };
-});
-vi.mock('./utils/detect-ai.js', () => ({
-    detectAIAssistants: vi.fn().mockResolvedValue([])
-}));
-vi.mock('./utils/terminal-launch.js', async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        launchWorkspaceTerminal: vi.fn().mockResolvedValue({
-            success: true,
-            command: 'claude --resume 0199a213-81c0-7800-8aa1-bbab2a035a54',
-        }),
-    };
-});
-vi.mock('./core/new-repo.js', async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        createNewRepo: vi.fn(),
-    };
-});
-vi.mock('./orchestration/index.js');
-describe('Server API Endpoints Unit Tests', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-    });
-    it('rejects an invalid transcript session id at the HTTP boundary', async () => {
-        const response = await app.request('/api/session/codex/53/transcript');
-        expect(response.status).toBe(400);
-        await expect(response.json()).resolves.toEqual({ error: 'Invalid session UUID format.' });
-    });
-    describe('embedded turn admission', () => {
-        it('rejects overlapping input until the active turn settles', () => {
-            const gate = new AgentTurnGate();
-            expect(gate.tryBegin()).toBe(true);
-            expect(gate.isActive()).toBe(true);
-            expect(gate.tryBegin()).toBe(false);
-            gate.settle();
-            expect(gate.isActive()).toBe(false);
-            expect(gate.tryBegin()).toBe(true);
-        });
-    });
-    describe('CLI adapter status probes', () => {
-        it('keeps the legacy GET endpoint side-effect-free', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status', {
-                headers: { Origin: 'https://evil.example' },
-            });
-            expect(response.status).toBe(405);
-            expect(status).not.toHaveBeenCalled();
-            status.mockRestore();
-        });
-        it('rejects a hostile initial status POST before running CLI detectors', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'https://evil.example' },
-                body: '{}',
-            });
-            expect(response.status).toBe(403);
-            expect(status).not.toHaveBeenCalled();
-            status.mockRestore();
-        });
-        it('allows a local-origin initial status POST', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'http://localhost:4173' },
-                body: '{}',
-            });
-            expect(response.status).toBe(200);
-            expect(response.headers.get('access-control-allow-origin')).toBe('http://localhost:4173');
-            expect(status).toHaveBeenCalledWith();
-            status.mockRestore();
-        });
-        it('rejects a hostile browser origin before refreshing a CLI detector', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status/refresh', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'https://evil.example' },
-                body: JSON.stringify({ providerId: 'claude-cli' }),
-            });
-            expect(response.status).toBe(403);
-            expect(status).not.toHaveBeenCalled();
-            status.mockRestore();
-        });
-        it('refreshes an allowlisted harness provider for a same-origin request', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status/refresh', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'http://localhost:4173' },
-                body: JSON.stringify({ providerId: 'codex-cli' }),
-            });
-            expect(response.status).toBe(200);
-            expect(response.headers.get('access-control-allow-origin')).toBe('http://localhost:4173');
-            expect(status).toHaveBeenCalledWith({ refreshProviderId: 'codex-cli' });
-            status.mockRestore();
-        });
-        it('refreshes an allowlisted first-party SDK status', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status/refresh', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'http://localhost:4173' },
-                body: JSON.stringify({ providerId: 'codex-sdk' }),
-            });
-            expect(response.status).toBe(200);
-            expect(status).toHaveBeenCalledWith({ refreshProviderId: 'codex-sdk' });
-            status.mockRestore();
-        });
-        it('rejects attempts to refresh other providers', async () => {
-            const status = vi.spyOn(ProviderRegistry, 'getAllStatus').mockReturnValue([]);
-            const response = await app.request('/api/adapters/status/refresh', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Origin: 'http://127.0.0.1:4173' },
-                body: JSON.stringify({ providerId: 'copilot-cli' }),
-            });
-            expect(response.status).toBe(400);
-            expect(status).not.toHaveBeenCalled();
-            status.mockRestore();
-        });
-    });
-    describe('embedded turn execution profiles', () => {
-        const provider = {
-            id: 'profiled-test',
-            name: 'Profiled test',
-            capabilities: { transport: 'cli-print', sessionIdentity: 'none', workspaceAccess: 'harness-managed' },
-            executionProfiles: [
-                { id: 'review', label: 'Review only', description: 'Read-only.' },
-                { id: 'workspace-write', label: 'Edit workspace', description: 'May edit.' },
-            ],
-            defaultExecutionProfile: 'review',
-            isConfigured: () => true,
-            getStatusMessage: () => undefined,
-            createInstance: () => harness(),
-        };
-        function harness() {
-            return {
-                start: vi.fn(),
-                send: vi.fn().mockResolvedValue(undefined),
-                stop: vi.fn(),
-                on: vi.fn().mockReturnThis(),
-                off: vi.fn().mockReturnThis(),
-            };
-        }
-        it.each([undefined, 'danger-full-access', false])('rejects a missing or unsupported profile %j before harness send', (executionProfile) => {
-            const agent = harness();
-            expect(dispatchAgentInput(agent, provider, { input: 'Do work', executionProfile }))
-                .toMatch(/supported execution profile/i);
-            expect(agent.send).not.toHaveBeenCalled();
-        });
-        it('passes a validated profile to the harness', () => {
-            const agent = harness();
-            expect(dispatchAgentInput(agent, provider, {
-                input: 'Inspect only',
-                executionProfile: 'review',
-            })).toBeNull();
-            expect(agent.send).toHaveBeenCalledWith('Inspect only', 'review');
-        });
-    });
-    describe('POST /api/open-editor', () => {
-        const workspacesDir = path.resolve('mock-workspaces');
-        const workspacePath = path.join(workspacesDir, 'test-workspace');
-        it('rejects cross-origin requests to open-editor', async () => {
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Origin: 'http://malicious-site.example.com',
-                },
-                body: JSON.stringify({ workspacePath, command: 'code' }),
-            });
-            expect(response.status).toBe(403);
-            await expect(response.json()).resolves.toEqual({ error: 'Forbidden cross-origin request.' });
-        });
-        it('should return 400 for forbidden editor commands', async () => {
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspacePath: '/mock/workspace/path',
-                    command: 'rm -rf /'
-                })
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toBe('Forbidden editor command');
-        });
-        it('explicitly rejects legacy interactive terminal editors', async () => {
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ workspacePath, command: 'nvim' }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Forbidden editor command' });
-        });
-        it('should return 400 if workspace path does not exist', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.spyOn(fs, 'stat').mockRejectedValue(new Error('File not found'));
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspacePath,
-                    command: 'code-insiders'
-                })
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toBe('Workspace path does not exist');
-        });
-        it('should return 400 if workspace path is not a directory', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.spyOn(fs, 'stat').mockResolvedValue({
-                isDirectory: () => false
-            });
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspacePath,
-                    command: 'code-insiders'
-                })
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toBe('Workspace path is not a directory');
-        });
-        it('should launch a detected editor through the server-owned target', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.spyOn(fs, 'stat').mockResolvedValue({
-                isDirectory: () => true
-            });
-            vi.spyOn(fs, 'access').mockRejectedValue(new Error('No generated workspace file'));
-            vi.spyOn(fs, 'realpath').mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.spyOn(workspace, 'loadWorkspaceManifest').mockResolvedValue({
-                id: 'test-workspace',
-                workspacePath,
-            });
-            vi.mocked(execa).mockImplementation((async (command, args) => ({
-                exitCode: args?.[0] === '--version' && command === 'code-insiders' ? 0 : 1,
-            })));
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspacePath,
-                    command: 'code-insiders'
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(execa).toHaveBeenCalledWith('code-insiders', [process.platform === 'win32' ? `"${workspacePath}"` : workspacePath], {
-                stdio: 'ignore',
-                shell: process.platform === 'win32',
-            });
-        });
-        it('rejects an existing directory outside the configured workspace root', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            const response = await app.request('/api/open-editor', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspacePath: path.resolve('outside-workspace'),
-                    command: 'code',
-                }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Invalid workspace path' });
-        });
-    });
-    describe('workspace launch targets', () => {
-        const workspacesDir = path.resolve('launch-workspaces');
-        const workspacePath = path.join(workspacesDir, 'safe-workspace');
-        beforeEach(() => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.spyOn(fs, 'realpath').mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.spyOn(workspace, 'loadWorkspaceManifest').mockResolvedValue({
-                id: 'safe-workspace',
-                description: 'Improve the local Desktop handoff',
-                repos: [],
-                workspacePath,
-            });
-        });
-        it('returns stable ids and never exposes executable commands', async () => {
-            vi.mocked(execa).mockResolvedValue({ exitCode: 1 });
-            const response = await app.request('/api/workspace-launch-targets');
-            const targets = await response.json();
-            expect(response.status).toBe(200);
-            expect(targets.map((target) => target.id)).toContain('codex-desktop');
-            expect(targets.map((target) => target.id)).toContain('vscode-insiders');
-            expect(targets.every((target) => !('command' in target) && !('uri' in target))).toBe(true);
-        });
-        it('rejects a client-supplied target outside the closed catalog', async () => {
-            vi.mocked(execa).mockResolvedValue({ exitCode: 1 });
-            const response = await app.request('/api/workspace/safe-workspace/launch', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ targetId: 'editor:../../calc.exe' }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Unknown workspace launch target.' });
-        });
-        it('rejects a workspace whose canonical path escapes through a symlink', async () => {
-            const outsidePath = path.resolve('outside-launch-workspace');
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)) === workspacePath
-                ? outsidePath
-                : path.resolve(String(candidate)));
-            const response = await app.request('/api/workspace/safe-workspace/launch', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ targetId: 'codex-desktop' }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Invalid workspace path' });
-            expect(execa).not.toHaveBeenCalled();
-        });
-        it('rejects a child path that only inherits a parent workspace manifest', async () => {
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue(null);
-            vi.mocked(workspace.loadFeatureConfig).mockResolvedValue({
-                id: 'parent-workspace',
-                workspacePath: workspacesDir,
-            });
-            const response = await app.request('/api/workspace/safe-workspace/launch', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ targetId: 'codex-desktop' }),
-            });
-            expect(response.status).toBe(404);
-            await expect(response.json()).resolves.toEqual({ error: 'Workspace configuration not found.' });
-            expect(execa).not.toHaveBeenCalled();
-        });
-        it('returns a conflict when the selected app is unavailable', async () => {
-            vi.mocked(execa).mockResolvedValue({ exitCode: 1 });
-            const response = await app.request('/api/workspace/safe-workspace/launch', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ targetId: 'codex-desktop' }),
-            });
-            expect(response.status).toBe(409);
-            expect((await response.json()).error).toMatch(/not installed|unavailable|supported/i);
-        });
-        it('launches Codex with a once-encoded validated workspace path', async () => {
-            const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
-            vi.mocked(execa).mockImplementation((async (command) => ({
-                exitCode: command === 'reg.exe' || command === 'cmd.exe' ? 0 : 1,
-            })));
-            try {
-                const response = await app.request('/api/workspace/safe-workspace/launch', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ targetId: 'codex-desktop' }),
-                });
-                expect(response.status).toBe(200);
-                const prompt = 'Read the workspace instructions and implementation plan, inspect the repository state, then begin the task described for this workspace. Ask before making a decision that materially changes scope.\n\nWorkspace task: Improve the local Desktop handoff';
-                expect(execa).toHaveBeenCalledWith('cmd.exe', ['/d', '/v:off', '/s', '/c', 'start "" "%NEXUSFLOW_DESKTOP_URI%"'], {
-                    env: {
-                        NEXUSFLOW_DESKTOP_URI: `codex://threads/new?path=${encodeURIComponent(workspacePath)}&prompt=${encodeURIComponent(prompt)}`,
-                    },
-                    shell: false,
-                    windowsHide: true,
-                    windowsVerbatimArguments: true,
-                });
-            }
-            finally {
-                platform.mockRestore();
-            }
-        });
-        it('opens only a Codex thread recorded for the selected workspace', async () => {
-            const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
-            const sessionId = '0199a213-81c0-7800-8aa1-bbab2a035a53';
-            const authorizeSession = vi.spyOn(sessionFinder, 'canOpenCodexSessionInWorkspace')
-                .mockResolvedValue(true);
-            vi.mocked(execa).mockResolvedValue({ exitCode: 0 });
-            try {
-                const response = await app.request('/api/workspace/safe-workspace/launch', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ targetId: 'codex-desktop', action: 'resume', sessionId }),
-                });
-                expect(response.status).toBe(200);
-                expect(execa).toHaveBeenCalledWith('cmd.exe', ['/d', '/v:off', '/s', '/c', 'start "" "%NEXUSFLOW_DESKTOP_URI%"'], {
-                    env: { NEXUSFLOW_DESKTOP_URI: `codex://threads/${sessionId}` },
-                    shell: false,
-                    windowsHide: true,
-                    windowsVerbatimArguments: true,
-                });
-            }
-            finally {
-                authorizeSession.mockRestore();
-                platform.mockRestore();
-            }
-        });
-        it('does not open a Codex thread owned by another workspace', async () => {
-            const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
-            const authorizeSession = vi.spyOn(sessionFinder, 'canOpenCodexSessionInWorkspace')
-                .mockResolvedValue(false);
-            vi.mocked(execa).mockResolvedValue({ exitCode: 0 });
-            try {
-                const response = await app.request('/api/workspace/safe-workspace/launch', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        targetId: 'codex-desktop',
-                        action: 'resume',
-                        sessionId: '0199a213-81c0-7800-8aa1-bbab2a035a53',
-                    }),
-                });
-                expect(response.status).toBe(404);
-                await expect(response.json()).resolves.toEqual({
-                    error: 'Codex session not found in this workspace.',
-                });
-                expect(execa).not.toHaveBeenCalledWith('cmd.exe', expect.anything(), expect.anything());
-            }
-            finally {
-                authorizeSession.mockRestore();
-                platform.mockRestore();
-            }
-        });
-        it('launches a terminal for a valid workspace', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({
-                id: 'safe-workspace',
-                repos: [path.join(workspacePath, 'repo')],
-                workspacePath,
-            });
-            const response = await app.request('/api/workspace/safe-workspace/terminal', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    assistant: 'claude',
-                    sessionId: '0199a213-81c0-7800-8aa1-bbab2a035a54',
-                }),
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.command).toBe('claude --resume 0199a213-81c0-7800-8aa1-bbab2a035a54');
-        });
-        it('rejects cross-origin requests to terminal launch', async () => {
-            const response = await app.request('/api/workspace/safe-workspace/terminal', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Origin: 'http://malicious-site.example.com',
-                },
-                body: JSON.stringify({
-                    assistant: 'claude',
-                }),
-            });
-            expect(response.status).toBe(403);
-            const data = await response.json();
-            expect(data.error).toBe('Forbidden cross-origin request.');
-        });
-        it('rejects cross-origin requests to workspace launch', async () => {
-            const response = await app.request('/api/workspace/safe-workspace/launch', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Origin: 'http://malicious-site.example.com',
-                },
-                body: JSON.stringify({ targetId: 'codex-desktop' }),
-            });
-            expect(response.status).toBe(403);
-            await expect(response.json()).resolves.toEqual({ error: 'Forbidden cross-origin request.' });
-        });
-        it('rejects invalid assistant and malformed session UUID', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({
-                id: 'safe-workspace',
-                repos: [path.join(workspacePath, 'repo')],
-                workspacePath,
-            });
-            const invalidAssistantRes = await app.request('/api/workspace/safe-workspace/terminal', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    assistant: 'unknown-harness-name',
-                }),
-            });
-            expect(invalidAssistantRes.status).toBe(400);
-            const invalidUuidRes = await app.request('/api/workspace/safe-workspace/terminal', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    assistant: 'claude',
-                    sessionId: 'not-a-valid-uuid',
-                }),
-            });
-            expect(invalidUuidRes.status).toBe(400);
-            const invalidTitleRes = await app.request('/api/workspace/safe-workspace/terminal', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    assistant: 'claude',
-                    title: 12345,
-                }),
-            });
-            expect(invalidTitleRes.status).toBe(400);
-            await expect(invalidTitleRes.json()).resolves.toEqual({ error: 'Title must be a string.' });
-        });
-    });
-    describe('workspace recent session handoffs', () => {
-        const workspacesDir = path.resolve('session-workspaces');
-        const workspacePath = path.join(workspacesDir, 'safe-workspace');
-        const codexId = '0199a213-81c0-7800-8aa1-bbab2a035a53';
-        const claudeId = '0199a213-81c0-7800-8aa1-bbab2a035a54';
-        const unauthorizedCodexId = '0199a213-81c0-7800-8aa1-bbab2a035a55';
-        it('returns only server-authorized Desktop handoff capabilities', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({
-                id: 'safe-workspace',
-                repos: [path.join(workspacePath, 'repo')],
-                workspacePath,
-            });
-            const find = vi.spyOn(sessionFinder, 'findSessions').mockResolvedValue([
-                {
-                    id: 'copilot-session', assistant: 'copilot', title: 'Newer Copilot task',
-                    createdAt: '2026-08-16T03:00:00.000Z', updatedAt: '2026-08-16T03:00:00.000Z',
-                    messageCount: 2, workspacePath,
-                },
-                {
-                    id: 'antigravity-session', assistant: 'antigravity', title: 'Newer Antigravity task',
-                    createdAt: '2026-08-16T02:00:00.000Z', updatedAt: '2026-08-16T02:00:00.000Z',
-                    messageCount: 2, workspacePath,
-                },
-                {
-                    id: unauthorizedCodexId, assistant: 'codex', title: 'Fuzzy Codex task',
-                    createdAt: '2026-08-16T01:00:00.000Z', updatedAt: '2026-08-16T01:00:00.000Z',
-                    messageCount: 2, workspacePath,
-                },
-                {
-                    id: codexId, assistant: 'codex', title: 'Codex task',
-                    createdAt: '2026-08-15T00:00:00.000Z', updatedAt: '2026-08-16T00:00:00.000Z',
-                    messageCount: 4, workspacePath,
-                },
-                {
-                    id: claudeId, assistant: 'claude', title: 'Claude task',
-                    createdAt: '2026-08-14T00:00:00.000Z', updatedAt: '2026-08-15T00:00:00.000Z',
-                    messageCount: 2, workspacePath,
-                },
-            ]);
-            const codexAuth = vi.spyOn(sessionFinder, 'canOpenCodexSessionInWorkspace')
-                .mockImplementation(async (_workspace, _repos, sessionId) => sessionId === codexId);
-            const claudeAuth = vi.spyOn(sessionFinder, 'canTransferClaudeSessionInWorkspace').mockResolvedValue(true);
-            const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
-            const architecture = vi.spyOn(process, 'arch', 'get').mockReturnValue('x64');
-            vi.stubEnv('ANTHROPIC_API_KEY', '');
-            vi.stubEnv('ANTHROPIC_AUTH_TOKEN', '');
-            vi.stubEnv('CLAUDE_CODE_USE_BEDROCK', '');
-            vi.stubEnv('CLAUDE_CODE_USE_VERTEX', '');
-            vi.stubEnv('CLAUDE_CODE_USE_FOUNDRY', '');
-            const provider = vi.spyOn(ProviderRegistry, 'getProvider').mockReturnValue({
-                isConfigured: () => true,
-            });
-            try {
-                const response = await app.request('/api/workspace/safe-workspace/sessions?limit=2&desktopHandoffOnly=true');
-                const body = await response.json();
-                expect(response.status).toBe(200);
-                expect(body.sessions).toHaveLength(2);
-                expect(body.sessions[0].desktopHandoff).toEqual({ targetId: 'codex-desktop', method: 'direct' });
-                expect(body.sessions[1].desktopHandoff).toEqual({ targetId: 'claude-desktop', method: 'guided' });
-                expect(codexAuth).toHaveBeenCalledWith(workspacePath, [path.join(workspacePath, 'repo')], codexId);
-                expect(claudeAuth).toHaveBeenCalledWith(workspacePath, [path.join(workspacePath, 'repo')], claudeId);
-            }
-            finally {
-                find.mockRestore();
-                codexAuth.mockRestore();
-                claudeAuth.mockRestore();
-                provider.mockRestore();
-                platform.mockRestore();
-                architecture.mockRestore();
-                vi.unstubAllEnvs();
-            }
-        });
-        it('omits a discovered session when strong authorization fails', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({
-                id: 'safe-workspace', repos: [], workspacePath,
-            });
-            const find = vi.spyOn(sessionFinder, 'findSessions').mockResolvedValue([{
-                    id: codexId, assistant: 'codex', title: 'Fuzzy match only',
-                    createdAt: '2026-08-15T00:00:00.000Z', updatedAt: '2026-08-16T00:00:00.000Z',
-                    messageCount: 2, workspacePath,
-                }]);
-            const codexAuth = vi.spyOn(sessionFinder, 'canOpenCodexSessionInWorkspace').mockResolvedValue(false);
-            try {
-                const response = await app.request('/api/workspace/safe-workspace/sessions?limit=3&desktopHandoffOnly=true');
-                expect(response.status).toBe(200);
-                await expect(response.json()).resolves.toEqual({ sessions: [] });
-            }
-            finally {
-                find.mockRestore();
-                codexAuth.mockRestore();
-            }
-        });
-        it('rejects an excessive recent-session limit', async () => {
-            const response = await app.request('/api/workspace/safe-workspace/sessions?limit=200');
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Session limit must be an integer from 1 to 20.' });
-        });
-        it('gates Claude Desktop transfer to supported subscription CLI environments', () => {
-            const configured = () => true;
-            expect(canOfferClaudeDesktopTransfer('win32', 'x64', {}, configured)).toBe(true);
-            expect(canOfferClaudeDesktopTransfer('darwin', 'arm64', {}, configured)).toBe(true);
-            expect(canOfferClaudeDesktopTransfer('linux', 'x64', {}, configured)).toBe(false);
-            expect(canOfferClaudeDesktopTransfer('win32', 'arm64', {}, configured)).toBe(false);
-            expect(canOfferClaudeDesktopTransfer('win32', 'x64', { ANTHROPIC_API_KEY: 'configured' }, configured)).toBe(false);
-            expect(canOfferClaudeDesktopTransfer('win32', 'x64', {}, () => false)).toBe(false);
-        });
-        it('falls back gracefully when ProviderRegistry has no claude-cli', () => {
-            const getProvider = vi.spyOn(ProviderRegistry, 'getProvider').mockReturnValue(undefined);
-            try {
-                expect(canOfferClaudeDesktopTransfer('win32', 'x64', {})).toBe(false);
-            }
-            finally {
-                getProvider.mockRestore();
-            }
-        });
-    });
-    describe('POST /api/workspace/:id/resume', () => {
-        it('rejects cross-origin requests to resume', async () => {
-            const response = await app.request('/api/workspace/test-ws/resume', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Origin: 'http://malicious-site.example.com',
-                },
-                body: JSON.stringify({ assistant: 'antigravity' }),
-            });
-            expect(response.status).toBe(403);
-            await expect(response.json()).resolves.toEqual({ error: 'Forbidden cross-origin request.' });
-        });
-        it('rejects invalid sessionId UUID on resume', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir: '/mock/workspaces' });
-            vi.spyOn(workspace, 'loadFeatureConfig').mockResolvedValue({
-                id: 'test-ws',
-                repos: [],
-                assistants: ['antigravity'],
-            });
-            const response = await app.request('/api/workspace/test-ws/resume', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    assistant: 'antigravity',
-                    sessionId: 'malicious-uuid-attempt',
-                }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'Invalid session UUID format.' });
-        });
-        it('should fail with 400 if command is forbidden', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                workspacesDir: '/mock/workspaces'
-            });
-            vi.spyOn(workspace, 'loadFeatureConfig').mockResolvedValue({
-                id: 'test-ws',
-                repos: [],
-                assistants: ['antigravity']
-            });
-            const response = await app.request('/api/workspace/test-ws/resume', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    command: 'malicious-editor',
-                    assistant: 'antigravity'
-                })
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toBe('Forbidden editor command');
-        });
-        it('should spawn the editor with proper options when resuming', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                workspacesDir: '/mock/workspaces'
-            });
-            vi.spyOn(workspace, 'loadFeatureConfig').mockResolvedValue({
-                id: 'test-ws',
-                repos: [],
-                assistants: ['antigravity']
-            });
-            const dummyChild = {
-                unref: vi.fn(),
-                catch: vi.fn().mockReturnThis()
-            };
-            vi.mocked(execa).mockReturnValue(dummyChild);
-            const response = await app.request('/api/workspace/test-ws/resume', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    command: 'code',
-                    assistant: 'antigravity'
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            const isWin = process.platform === 'win32';
-            expect(execa).toHaveBeenCalledWith('code', [expect.any(String)], {
-                stdio: 'ignore',
-                shell: isWin,
-            });
-        });
-    });
-    describe('GET /api/config', () => {
-        it('should load configuration successfully', async () => {
-            vi.spyOn(config, 'getConfigDir').mockReturnValue('/mock/config-dir');
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                devDir: '/mock/dev',
-                scanDepth: 2
-            });
-            vi.spyOn(fs, 'access').mockResolvedValue();
-            const response = await app.request('/api/config');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.config.devDir).toBe('/mock/dev');
-            expect(data.exists).toBe(true);
-        });
-    });
-    describe('GET /api/adapters', () => {
-        it('should return all registered storage adapters with meta', async () => {
-            const response = await app.request('/api/adapters');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.adapters).toBeDefined();
-            expect(Array.isArray(data.adapters)).toBe(true);
-            // `local` is the only built-in backend: a backend that relocates the
-            // generated files out of the workspace cannot work, since assistants read
-            // AGENTS.md and CLAUDE.md from the root. Plugins may still register more.
-            const names = data.adapters.map((a) => a.name);
-            expect(names).toContain('local');
-            expect(names).not.toContain('central-vault');
-        });
-    });
-    describe('GET /api/repos/branches', () => {
-        it('should return 400 when the path parameter is missing', async () => {
-            const response = await app.request('/api/repos/branches');
-            expect(response.status).toBe(400);
-        });
-        it('should return 400 when the path escapes devDir', async () => {
-            vi.mocked(config.loadConfig).mockResolvedValue({ devDir: '/mock/dev' });
-            const response = await app.request(`/api/repos/branches?path=${encodeURIComponent('/mock/dev/../../etc')}`);
-            expect(response.status).toBe(400);
-        });
-        it('should list local and origin branches for a repo inside devDir', async () => {
-            vi.mocked(config.loadConfig).mockResolvedValue({ devDir: '/mock/dev' });
-            vi.mocked(execa).mockResolvedValue({
-                stdout: 'main\nfeature/x\norigin/HEAD\norigin/main\norigin/remote-only',
-            });
-            const response = await app.request(`/api/repos/branches?path=${encodeURIComponent('/mock/dev/repo1')}`);
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.local).toEqual(['main', 'feature/x']);
-            expect(data.remote).toEqual(['main', 'remote-only']);
-        });
-    });
-    describe('POST /api/repos/new', () => {
-        it('should return 400 when the name is missing', async () => {
-            const response = await app.request('/api/repos/new', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({}),
-            });
-            expect(response.status).toBe(400);
-        });
-        it('should scaffold a repo in devDir and return it', async () => {
-            vi.mocked(config.loadConfig).mockResolvedValue({ devDir: '/mock/dev' });
-            const repo = { name: 'newproj', path: '/mock/dev/newproj', defaultBranch: 'main' };
-            vi.mocked(newRepo.createNewRepo).mockResolvedValue(repo);
-            const response = await app.request('/api/repos/new', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ name: 'newproj' }),
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.repo).toEqual(repo);
-            expect(newRepo.createNewRepo).toHaveBeenCalledWith('/mock/dev', 'newproj');
-        });
-    });
-    describe('GET and PUT /api/workspace/:id/knowledge', () => {
-        it('should get workspace knowledge content', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                workspacesDir: '/mock/workspaces'
-            });
-            vi.spyOn(fs, 'readFile').mockResolvedValue('# Mock Knowledge File content');
-            const response = await app.request('/api/workspace/test-ws/knowledge');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.content).toBe('# Mock Knowledge File content');
-        });
-        it('should write workspace knowledge content', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                workspacesDir: '/mock/workspaces'
-            });
-            vi.spyOn(fs, 'writeFile').mockResolvedValue();
-            const response = await app.request('/api/workspace/test-ws/knowledge', {
-                method: 'PUT',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ content: '# Updated Content' })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-        });
-        it('returns a compatibility-friendly 400 when a structured entry omits its required title', async () => {
-            const response = await app.request('/api/workspace/test-ws/knowledge/entry', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ type: 'decision', message: 'Use explicit titles.' }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toEqual({ error: 'A short knowledge title is required.' });
-        });
-        it('rejects a base-knowledge repo traversal at the HTTP boundary', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir: '/mock/workspaces' });
-            vi.mocked(workspace.loadFeatureConfig).mockResolvedValue({
-                id: 'test-ws',
-                repos: ['/mock/workspaces/test-ws/api'],
-            });
-            const response = await app.request('/api/workspace/test-ws/knowledge/entry', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    type: 'gotcha', title: 'Traversal', message: 'must stay contained', repo: '../outside',
-                }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toMatchObject({ error: expect.stringMatching(/Invalid repository name/) });
-        });
-    });
-    describe('GET /api/workspace/:id/plan', () => {
-        it('should get workspace plan content', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                workspacesDir: '/mock/workspaces'
-            });
-            vi.spyOn(fs, 'readFile').mockResolvedValue('# Mock Plan content');
-            const response = await app.request('/api/workspace/test-ws/plan');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.content).toBe('# Mock Plan content');
-        });
-    });
-    describe('POST /api/updates/install', () => {
-        it('should fail if tool not found', async () => {
-            const response = await app.request('/api/updates/install', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ toolId: 'invalid-tool' })
-            });
-            expect(response.status).toBe(404);
-            const data = await response.json();
-            expect(data.error).toBe('Tool not found');
-        });
-        it('should install tool successfully if execa exits with 0', async () => {
-            vi.mocked(execa).mockResolvedValue({ exitCode: 0, stdout: 'Successfully updated' });
-            const response = await app.request('/api/updates/install', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ toolId: 'nexusflow' })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.output).toBe('Successfully updated');
-            expect(execa).toHaveBeenCalledWith('npm', ['install', '-g', '@mrpatronz/nexusflow'], expect.any(Object));
-        });
-    });
-    describe('POST /api/workspace', () => {
-        it('should complete workspace creation successfully', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                devDir: '/mock',
-                workspacesDir: '/mock/workspaces',
-                storageProvider: 'local'
-            });
-            vi.spyOn(workspace, 'createWorkspace').mockResolvedValue('/mock/workspaces/test-ws-creation-no-pack');
-            vi.spyOn(analyzers, 'analyzeAllRepos').mockResolvedValue(new Map());
-            vi.spyOn(generators, 'generateContextFiles').mockResolvedValue(undefined);
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    branchName: 'test-ws-creation-no-pack',
-                    description: 'A test workspace',
-                    repos: [{ name: 'repo-1', path: '/mock/repo-1' }],
-                    assistants: ['antigravity']
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.jobId).toBe('test-ws-creation-no-pack');
-            // Wait a brief tick for the background job to execute
-            await new Promise((resolve) => setTimeout(resolve, 50));
-            expect(workspace.createWorkspace).toHaveBeenCalled();
-            expect(analyzers.analyzeAllRepos).toHaveBeenCalled();
-            expect(generators.generateContextFiles).toHaveBeenCalled();
-            // Read status via SSE stream route
-            const streamResponse = await app.request('/api/workspace/create-stream/test-ws-creation-no-pack');
-            expect(streamResponse.status).toBe(200);
-            const text = await streamResponse.text();
-            expect(text).toContain('"status":"completed"');
-            expect(text).toContain('"progress":100');
-        });
-        it('saves enabledSkills and enabledAgents during workspace creation', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                devDir: '/mock',
-                workspacesDir: '/mock/workspaces',
-                storageProvider: 'local'
-            });
-            vi.spyOn(workspace, 'createWorkspace').mockResolvedValue('/mock/workspaces/skills-ws');
-            vi.spyOn(analyzers, 'analyzeAllRepos').mockResolvedValue(new Map());
-            vi.spyOn(generators, 'generateContextFiles').mockResolvedValue(undefined);
-            vi.spyOn(skillsCatalog, 'saveWorkspaceSkillsConfig').mockResolvedValue(undefined);
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    branchName: 'skills-ws',
-                    description: 'Skills workspace',
-                    repos: [{ name: 'repo-1', path: '/mock/repo-1' }],
-                    assistants: ['antigravity'],
-                    enabledSkills: ['pr-review-toolkit', 'unit-test-coverage'],
-                    enabledAgents: ['my-agent'],
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            await new Promise((resolve) => setTimeout(resolve, 50));
-            expect(skillsCatalog.saveWorkspaceSkillsConfig).toHaveBeenCalledWith(expect.stringContaining('skills-ws'), {
-                enabledSkills: ['pr-review-toolkit', 'unit-test-coverage'],
-                enabledAgents: ['my-agent'],
-                enabledCategories: [],
-            });
-        });
-        it('rejects workspace creation when repo path escapes devDir', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                devDir: '/mock/dev',
-                workspacesDir: '/mock/workspaces',
-                storageProvider: 'local',
-            });
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    branchName: 'escaped-ws',
-                    description: 'Path escape test',
-                    repos: [{ name: 'repo-1', path: '/etc/shadow' }],
-                    assistants: ['antigravity'],
-                }),
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toBe('Invalid workspace path');
-        });
-        // XML context packing tests removed.
-        it('rejects in-place creation without a name', async () => {
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    mode: 'in-place',
-                    description: 'nameless',
-                    repos: [{ name: 'repo-1', path: '/mock/repo-1' }],
-                    assistants: ['claude']
-                })
-            });
-            expect(response.status).toBe(400);
-            expect((await response.json()).error).toContain('name');
-        });
-        it('rejects worktree creation without a branch name', async () => {
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    description: 'branchless',
-                    repos: [{ name: 'repo-1', path: '/mock/repo-1' }],
-                    assistants: ['claude']
-                })
-            });
-            expect(response.status).toBe(400);
-            expect((await response.json()).error).toContain('branchName');
-        });
-        it('creates an in-place workspace against the source repos (no worktree remap)', async () => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                devDir: '/mock',
-                workspacesDir: '/mock/workspaces',
-                storageProvider: 'local'
-            });
-            vi.spyOn(workspace, 'createWorkspace').mockResolvedValue('/mock/workspaces/my-quick-fix');
-            vi.spyOn(analyzers, 'analyzeAllRepos').mockResolvedValue(new Map());
-            vi.spyOn(generators, 'generateContextFiles').mockResolvedValue(undefined);
-            const response = await app.request('/api/workspace', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    mode: 'in-place',
-                    name: 'My Quick Fix',
-                    projectId: 'billing',
-                    description: 'in-place workspace',
-                    repos: [{ name: 'repo-1', path: '/mock/repo-1', defaultBranch: 'main' }],
-                    assistants: ['claude']
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            // The name is slugified into the job/workspace id.
-            expect(data.jobId).toBe('my-quick-fix');
-            await new Promise((resolve) => setTimeout(resolve, 50));
-            const feature = vi.mocked(workspace.createWorkspace).mock.calls[0][0];
-            expect(feature.mode).toBe('in-place');
-            expect(feature.id).toBe('my-quick-fix');
-            expect(feature.projectId).toBe('billing');
-            // Repos stay at their source paths — no join(workspacePath, name) remap.
-            expect(feature.repos).toEqual(['/mock/repo-1']);
-            // Analysis also runs against the source repos.
-            const analyzed = vi.mocked(analyzers.analyzeAllRepos).mock.calls[0][0];
-            expect(analyzed[0].path).toBe('/mock/repo-1');
-            // The SSE stream reports the in-place step set.
-            const streamResponse = await app.request('/api/workspace/create-stream/my-quick-fix');
-            const text = await streamResponse.text();
-            expect(text).toContain('"status":"completed"');
-            expect(text).toContain('Register Workspace');
-            expect(text).not.toContain('Create Git Worktrees');
-        });
-    });
-    describe('Workflows Templates API', () => {
-        it('GET /api/workflows/templates should return list of templates', async () => {
-            vi.spyOn(workflows, 'getWorkflowTemplates').mockResolvedValue([
-                { id: 'test-id', name: 'Test Name', description: 'Test Desc', content: 'Test Content', custom: false }
-            ]);
-            const response = await app.request('/api/workflows/templates');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data).toEqual({
-                templates: [
-                    { id: 'test-id', name: 'Test Name', description: 'Test Desc', content: 'Test Content', custom: false }
-                ]
-            });
-        });
-        it('POST /api/workflows/templates should create or update template', async () => {
-            vi.spyOn(workflows, 'saveWorkflowTemplate').mockResolvedValue({
-                id: 'test-id',
-                name: 'Test Name',
-                description: 'Test Desc',
-                content: 'Test Content',
-                custom: true
-            });
-            const response = await app.request('/api/workflows/templates', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ id: 'old-id', name: 'Test Name', content: 'Test Content' })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.template.id).toBe('test-id');
-            expect(workflows.saveWorkflowTemplate).toHaveBeenCalledWith('Test Name', 'Test Content', 'old-id');
-        });
-        it('DELETE /api/workflows/templates/:id should delete template', async () => {
-            vi.spyOn(workflows, 'getWorkflowTemplates').mockResolvedValue([
-                { id: 'test-id', name: 'Test Name', description: 'Test Desc', content: 'Test Content', custom: true }
-            ]);
-            vi.spyOn(workflows, 'deleteWorkflowTemplate').mockResolvedValue(undefined);
-            const response = await app.request('/api/workflows/templates/test-id', {
-                method: 'DELETE'
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(workflows.deleteWorkflowTemplate).toHaveBeenCalledWith('test-id');
-        });
-        it('POST /api/workflows/templates/:id/analyze should run inspection with comment', async () => {
-            vi.mocked(detectAi.detectAIAssistants).mockResolvedValue([
-                { name: 'antigravity', displayName: 'Antigravity', detected: true, command: 'agy' }
-            ]);
-            vi.mocked(execa).mockResolvedValue({
-                exitCode: 0,
-                stdout: 'Review result: Success\n=== SUGGESTED IMPROVEMENT START ===\n# Refined Strategy\n=== SUGGESTED IMPROVEMENT END ==='
-            });
-            const response = await app.request('/api/workflows/templates/test-id/analyze', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    content: 'My Strategy guidelines',
-                    assistant: 'antigravity',
-                    comment: 'Check for timeouts'
-                })
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.analysis).toContain('Review result: Success');
-            expect(data.suggestedImprovement).toBe('# Refined Strategy');
-            expect(execa).toHaveBeenCalled();
-            const calledArgs = vi.mocked(execa).mock.calls[0][1];
-            expect(JSON.stringify(calledArgs)).toContain('Check for timeouts');
-        });
-        it('uses non-interactive codex exec with the prompt on stdin', async () => {
-            vi.mocked(detectAi.detectAIAssistants).mockResolvedValue([
-                { name: 'codex', displayName: 'OpenAI Codex', detected: true, command: 'codex' }
-            ]);
-            vi.mocked(execa).mockResolvedValue({
-                exitCode: 0,
-                stdout: 'Review result'
-            });
-            const response = await app.request('/api/workflows/templates/test-id/analyze', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ content: 'Rules', assistant: 'codex' })
-            });
-            expect(response.status).toBe(200);
-            const [command, args, options] = vi.mocked(execa).mock.calls[0];
-            expect(command).toBe('codex');
-            expect(args).toEqual(['exec', '--color', 'never', '-']);
-            expect(options?.input).toContain('Rules');
-        });
-        describe('POST /api/workspace/suggest-workflow', () => {
-            it('should suggest a workflow using heuristics when local LLM is disabled', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    version: '1.0',
-                    devDir: '/dev',
-                    workspacesDir: '/dev/workspaces',
-                    defaultAssistant: null,
-                    scanDepth: 2
-                });
-                const response = await app.request('/api/workspace/suggest-workflow', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        description: 'Fix a typo in README.md and update comments',
-                        repos: [{ name: 'my-project', path: '/dev/my-project', defaultBranch: 'main' }]
-                    })
-                });
-                expect(response.status).toBe(200);
-                const data = await response.json();
-                expect(data.success).toBe(true);
-                expect(data.difficulty).toBe('simple');
-                expect(data.suggestedWorkflowId).toBe('solo-developer');
-                expect(data.customInstructions).toContain('Solo Developer');
-            });
-            it('should suggest a complex workflow when description contains complex keywords', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    version: '1.0',
-                    devDir: '/dev',
-                    workspacesDir: '/dev/workspaces',
-                    defaultAssistant: null,
-                    scanDepth: 2
-                });
-                const response = await app.request('/api/workspace/suggest-workflow', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        description: 'Refactor database schema and migrate data to postgres',
-                        repos: [{ name: 'my-project', path: '/dev/my-project', defaultBranch: 'main' }]
-                    })
-                });
-                expect(response.status).toBe(200);
-                const data = await response.json();
-                expect(data.success).toBe(true);
-                expect(data.difficulty).toBe('complex');
-                expect(data.suggestedWorkflowId).toBe('plan-implement-review');
-                expect(data.customInstructions).toContain('Plan, Implement, Review');
-            });
-            it('POST /api/workspace/:id/isolate isolates a repository', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    version: '1.0',
-                    devDir: '/dev',
-                    workspacesDir: '/dev/workspaces',
-                    defaultAssistant: null,
-                    scanDepth: 2,
-                });
-                vi.mocked(workspace.isolateWorkspaceRepo).mockResolvedValue({
-                    repoName: 'my-repo',
-                    sourcePath: '/dev/my-repo',
-                    worktreePath: '/dev/workspaces/my-ws/my-repo',
-                    branchName: 'feat/my-repo-ws',
-                    baseBranch: 'main',
-                    alreadyIsolated: false,
-                });
-                const response = await app.request('/api/workspace/my-ws/isolate', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ repo: 'my-repo', branchName: 'feat/my-repo-ws' }),
-                });
-                expect(response.status).toBe(200);
-                const data = await response.json();
-                expect(data.success).toBe(true);
-                expect(data.repoName).toBe('my-repo');
-                expect(data.branchName).toBe('feat/my-repo-ws');
-                expect(workspace.isolateWorkspaceRepo).toHaveBeenCalledWith(path.resolve('/dev/workspaces', 'my-ws'), 'my-repo', { branchName: 'feat/my-repo-ws', baseBranch: undefined });
-            });
-            it('POST /api/workspace/:id/isolate requires repo parameter', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    version: '1.0',
-                    devDir: '/dev',
-                    workspacesDir: '/dev/workspaces',
-                    defaultAssistant: null,
-                    scanDepth: 2,
-                });
-                const response = await app.request('/api/workspace/my-ws/isolate', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({}),
-                });
-                expect(response.status).toBe(400);
-                const data = await response.json();
-                expect(data.error).toContain('Missing "repo" parameter');
-            });
-            it('POST /api/workspace/:id/isolate rejects whitespace repo and path traversal ids', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    version: '1.0',
-                    devDir: '/dev',
-                    workspacesDir: '/dev/workspaces',
-                    defaultAssistant: null,
-                    scanDepth: 2,
-                });
-                const res1 = await app.request('/api/workspace/my-ws/isolate', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ repo: '   ' }),
-                });
-                expect(res1.status).toBe(400);
-                const res2 = await app.request('/api/workspace/..%2f..%2fevil/isolate', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ repo: 'my-repo' }),
-                });
-                expect(res2.status).toBe(400);
-            });
-        });
-    });
-    describe('Schedules API', () => {
-        beforeEach(() => {
-            vi.spyOn(config, 'getConfigDir').mockReturnValue('/mock/home/.nexusflow');
-            vi.spyOn(config, 'ensureConfigDir').mockResolvedValue(undefined);
-            vi.mocked(fs.mkdir).mockResolvedValue(undefined);
-            vi.mocked(fs.unlink).mockResolvedValue(undefined);
-            vi.mocked(fs.stat).mockResolvedValue({ mtimeMs: Date.now() });
-            vi.mocked(fs.open).mockResolvedValue({
-                writeFile: vi.fn().mockResolvedValue(undefined),
-                close: vi.fn().mockResolvedValue(undefined),
-            });
-            vi.mocked(fs.writeFile).mockResolvedValue(undefined);
-        });
-        it('GET /api/schedules should return jobs with a computed nextDueAt', async () => {
-            vi.mocked(fs.readFile).mockResolvedValue(JSON.stringify({
-                version: 1,
-                jobs: [{
-                        id: 'sync-ws-abc',
-                        workspacePath: '/mock/ws',
-                        task: 'sync',
-                        intervalMinutes: 60,
-                        enabled: true,
-                        createdAt: '2026-01-01T00:00:00.000Z',
-                        lastRunAt: '2026-01-02T10:00:00.000Z',
-                    }],
-            }));
-            const response = await app.request('/api/schedules');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.jobs).toHaveLength(1);
-            expect(data.jobs[0].id).toBe('sync-ws-abc');
-            expect(data.jobs[0].nextDueAt).toBe('2026-01-02T11:00:00.000Z');
-        });
-        it('POST /api/schedules should reject an unknown task', async () => {
-            const response = await app.request('/api/schedules', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ task: 'deploy', every: '2h', workspacePath: '/mock/ws' }),
-            });
-            expect(response.status).toBe(400);
-            const data = await response.json();
-            expect(data.error).toContain('task must be');
-        });
-        it('POST /api/schedules should create a job for a valid workspace', async () => {
-            vi.mocked(fs.readFile).mockRejectedValue(new Error('ENOENT')); // empty store
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir: '/mock/workspaces' });
-            vi.spyOn(workspace, 'loadFeatureConfig').mockResolvedValue({
-                id: 'ws-1',
-                branchName: 'ws-1',
-                description: '',
-                repos: [],
-                assistants: [],
-                workspacePath: '/mock/workspaces/ws-1',
-                createdAt: '2026-01-01T00:00:00.000Z',
-            });
-            const response = await app.request('/api/schedules', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ task: 'refresh', every: '2h', workspaceId: 'ws-1' }),
-            });
-            expect(response.status).toBe(201);
-            const data = await response.json();
-            expect(data.job.task).toBe('refresh');
-            expect(data.job.intervalMinutes).toBe(120);
-            expect(data.job.enabled).toBe(true);
-            expect(fs.writeFile).toHaveBeenCalled();
-        });
-        it('DELETE /api/schedules/:id should 404 for an unknown job', async () => {
-            vi.mocked(fs.readFile).mockRejectedValue(new Error('ENOENT'));
-            const response = await app.request('/api/schedules/nope', { method: 'DELETE' });
-            expect(response.status).toBe(404);
-        });
-    });
-    describe('Security hardening', () => {
-        describe('workspace path traversal (A2.2)', () => {
-            it('DELETE /api/workspace/:id rejects a traversal id without touching the filesystem', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                const deleteSpy = vi
-                    .spyOn(workspace, 'deleteWorkspace')
-                    .mockResolvedValue(undefined);
-                const response = await app.request(`/api/workspace/${encodeURIComponent('../../evil')}`, { method: 'DELETE' });
-                expect(response.status).toBe(400);
-                expect(deleteSpy).not.toHaveBeenCalled();
-            });
-            it('GET /api/workspace/:id/knowledge rejects a traversal id without reading the file', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                const readSpy = vi.spyOn(fs, 'readFile');
-                const response = await app.request(`/api/workspace/${encodeURIComponent('../../../etc/passwd')}/knowledge`);
-                expect(response.status).toBe(400);
-                expect(readSpy).not.toHaveBeenCalled();
-            });
-            it('accepts a normal workspace id', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                vi.mocked(fs.readFile).mockResolvedValue('# Knowledge');
-                const response = await app.request('/api/workspace/my-feature/knowledge');
-                expect(response.status).toBe(200);
-            });
-        });
-        describe('diff repo containment (A2.3)', () => {
-            it('rejects a sibling-prefix repo escape', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                const execSpy = vi.mocked(execa);
-                // Workspace "feat"; sibling "feat-secret" shares the name prefix.
-                const response = await app.request(`/api/workspace/feat/changes/diff?repo=${encodeURIComponent('../feat-secret/repo')}&file=x.ts`);
-                expect(response.status).toBe(400);
-                expect(execSpy).not.toHaveBeenCalled();
-            });
-        });
-        describe('CORS is restricted to localhost (A2.1)', () => {
-            it('does not echo a non-localhost Origin', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                const response = await app.request('/api/config', {
-                    headers: { Origin: 'http://evil.example.com' },
-                });
-                expect(response.headers.get('access-control-allow-origin')).not.toBe('http://evil.example.com');
-            });
-            it('allows a localhost Origin', async () => {
-                vi.spyOn(config, 'loadConfig').mockResolvedValue({
-                    workspacesDir: '/mock/workspaces',
-                });
-                const response = await app.request('/api/config', {
-                    headers: { Origin: 'http://localhost:5173' },
-                });
-                expect(response.headers.get('access-control-allow-origin')).toBe('http://localhost:5173');
-            });
-        });
-        describe('update download URL allow-list (A2.1)', () => {
-            it('accepts GitHub release hosts over HTTPS', () => {
-                expect(isAllowedUpdateUrl('https://github.com/mrpatronz/nexusflow/releases/download/v1.3.0/Setup.exe')).toBe(true);
-                expect(isAllowedUpdateUrl('https://objects.githubusercontent.com/foo/Setup.exe')).toBe(true);
-            });
-            it('rejects non-GitHub hosts and non-HTTPS schemes', () => {
-                expect(isAllowedUpdateUrl('https://evil.example.com/Setup.exe')).toBe(false);
-                expect(isAllowedUpdateUrl('http://github.com/Setup.exe')).toBe(false);
-                expect(isAllowedUpdateUrl('file:///C:/Setup.exe')).toBe(false);
-                expect(isAllowedUpdateUrl('not a url')).toBe(false);
-            });
-            it('POST /api/updates/download rejects a disallowed host', async () => {
-                const response = await app.request('/api/updates/download', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ downloadUrl: 'https://evil.example.com/Setup.exe' }),
-                });
-                expect(response.status).toBe(400);
-            });
-        });
-    });
-    describe('Services & orchestration endpoints', () => {
-        beforeEach(() => {
-            vi.spyOn(config, 'loadConfig').mockResolvedValue({ workspacesDir: '/mock/workspaces' });
-        });
-        it('POST /services/start re-detects server-side and ignores the request body', async () => {
-            vi.mocked(orchestration.detectAllServices).mockResolvedValue([
-                { name: 'api', command: 'npm', args: ['run', 'dev'], cwd: '/mock', source: 'package.json' },
-            ]);
-            vi.mocked(orchestration.startServices).mockResolvedValue(undefined);
-            const response = await app.request('/api/workspace/ws/services/start', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ services: [{ name: 'evil', command: 'rm', args: ['-rf', '/'], cwd: '/', source: 'x' }] }),
-            });
-            expect(response.status).toBe(200);
-            expect(orchestration.detectAllServices).toHaveBeenCalled();
-            // The started services are the DETECTED ones, not the client's payload.
-            const started = vi.mocked(orchestration.startServices).mock.calls[0]?.[0];
-            expect(started).toEqual([{ name: 'api', command: 'npm', args: ['run', 'dev'], cwd: '/mock', source: 'package.json' }]);
-        });
-        it('POST /services/:name/start 404s for an unknown service', async () => {
-            vi.mocked(orchestration.detectAllServices).mockResolvedValue([]);
-            const response = await app.request('/api/workspace/ws/services/ghost/start', { method: 'POST' });
-            expect(response.status).toBe(404);
-        });
-        it('POST /orchestrators/start rejects an unknown detection id', async () => {
-            vi.mocked(orchestration.detectOrchestrationTools).mockResolvedValue([]);
-            const response = await app.request('/api/workspace/ws/orchestrators/start', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ id: 'docker-compose:nope.yml' }),
-            });
-            expect(response.status).toBe(404);
-        });
-        it('GET /services/logs/:name rejects a traversal service name without reading outside the log dir', async () => {
-            const response = await app.request(`/api/workspace/ws/services/logs/${encodeURIComponent('../../secret')}`);
-            expect(response.status).toBe(400);
-        });
-    });
-    describe('Skills & Categories Endpoints', () => {
-        it('GET /api/skills/categories returns default categories', async () => {
-            vi.mocked(skillsCatalog.getSkillCategories).mockResolvedValue([
-                {
-                    id: 'pull-requests',
-                    name: 'Pull Requests & Review',
-                    description: 'PR review skills',
-                    icon: 'git-pull-request',
-                    color: '#3b82f6',
-                    custom: false,
-                    isTemplate: true,
-                },
-            ]);
-            const response = await app.request('/api/skills/categories');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.categories).toBeDefined();
-            expect(data.categories.length).toBe(1);
-            expect(data.categories[0].id).toBe('pull-requests');
-            expect(data.categories[0].isTemplate).toBe(true);
-        });
-        it('POST /api/skills/categories creates a custom category', async () => {
-            vi.mocked(skillsCatalog.saveSkillCategory).mockResolvedValue({
-                id: 'serverless-workflows',
-                name: 'Serverless Workflows',
-                description: 'AWS Lambda and Cloudflare workers',
-                icon: 'zap',
-                color: '#ec4899',
-                custom: true,
-                isTemplate: false,
-            });
-            const response = await app.request('/api/skills/categories', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    name: 'Serverless Workflows',
-                    description: 'AWS Lambda and Cloudflare workers',
-                    icon: 'zap',
-                    color: '#ec4899',
-                }),
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.category.id).toBe('serverless-workflows');
-            expect(data.category.custom).toBe(true);
-        });
-        it('GET /api/skills returns all skills', async () => {
-            vi.mocked(skillsCatalog.getAllSkills).mockResolvedValue([
-                {
-                    id: 'pr-review-toolkit',
-                    name: 'pr-review-toolkit',
-                    title: 'PR Review Toolkit',
-                    category: 'pull-requests',
-                    description: 'Review pull requests',
-                    custom: false,
-                    content: '# PR Review',
-                },
-            ]);
-            const response = await app.request('/api/skills');
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.skills).toBeDefined();
-            expect(data.skills.length).toBe(1);
-            expect(data.skills[0].id).toBe('pr-review-toolkit');
-        });
-        it('POST /api/skills creates a new skill package', async () => {
-            vi.mocked(skillsCatalog.saveSkill).mockResolvedValue({
-                id: 'graphql-linter',
-                name: 'graphql-linter',
-                title: 'GraphQL Schema Linter',
-                category: 'database-migrations',
-                description: 'Validates GraphQL schemas for deprecated fields',
-                custom: true,
-                content: '# GraphQL Schema Linter\n\nRun graphql-inspector validate.',
-            });
-            const response = await app.request('/api/skills', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    name: 'graphql-linter',
-                    title: 'GraphQL Schema Linter',
-                    category: 'database-migrations',
-                    description: 'Validates GraphQL schemas for deprecated fields',
-                    content: '# GraphQL Schema Linter\n\nRun graphql-inspector validate.',
-                }),
-            });
-            expect(response.status).toBe(200);
-            const data = await response.json();
-            expect(data.success).toBe(true);
-            expect(data.skill.id).toBe('graphql-linter');
-            expect(data.skill.custom).toBe(true);
-        });
-        it('GET and POST /api/agents administer Codex-native agents', async () => {
-            const agent = {
-                id: 'reviewer',
-                name: 'reviewer',
-                category: 'general',
-                description: 'Review a fixed diff.',
-                developerInstructions: 'Review correctness and security.',
-                sandboxMode: 'read-only',
-                custom: true,
-            };
-            vi.mocked(agentsCatalog.getAllAgents).mockResolvedValue([agent]);
-            vi.mocked(agentsCatalog.saveAgent).mockResolvedValue(agent);
-            const listResponse = await app.request('/api/agents');
-            expect(listResponse.status).toBe(200);
-            await expect(listResponse.json()).resolves.toEqual({ agents: [agent] });
-            const saveResponse = await app.request('/api/agents', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(agent),
-            });
-            expect(saveResponse.status).toBe(200);
-            expect(agentsCatalog.saveAgent).toHaveBeenCalledWith(agent);
-        });
-        it('blocks deleting resources that are still assigned to a workspace', async () => {
-            const workspacePath = path.resolve('/workspaces/example');
-            vi.mocked(config.loadConfig).mockResolvedValue({ workspacesDir: path.resolve('/workspaces') });
-            vi.mocked(workspace.listWorkspaces).mockResolvedValue([{ id: 'example', workspacePath }]);
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({ workspacePath });
-            vi.mocked(skillsCatalog.getWorkspaceSkillsConfig).mockResolvedValue({
-                schemaVersion: 1,
-                revision: 1,
-                enabledSkills: ['pr-review-toolkit'],
-                enabledAgents: ['reviewer'],
-                enabledCategories: [],
-            });
-            const skillResponse = await app.request('/api/skills/pr-review-toolkit', { method: 'DELETE' });
-            expect(skillResponse.status).toBe(409);
-            await expect(skillResponse.json()).resolves.toMatchObject({ workspaces: ['example'] });
-            expect(skillsCatalog.deleteSkill).not.toHaveBeenCalled();
-            const agentResponse = await app.request('/api/agents/reviewer', { method: 'DELETE' });
-            expect(agentResponse.status).toBe(409);
-            await expect(agentResponse.json()).resolves.toMatchObject({ workspaces: ['example'] });
-            expect(agentsCatalog.deleteAgent).not.toHaveBeenCalled();
-        });
-        it('requires an exact existing workspace before reading resource assignments', async () => {
-            vi.mocked(config.loadConfig).mockResolvedValue({ workspacesDir: '/workspaces' });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => {
-                if (String(candidate).endsWith('missing')) {
-                    throw Object.assign(new Error('missing'), { code: 'ENOENT' });
-                }
-                return String(candidate);
-            });
-            const response = await app.request('/api/skills/workspace/missing');
-            expect(response.status).toBe(404);
-            expect(skillsCatalog.getWorkspaceSkillsConfig).not.toHaveBeenCalled();
-        });
-        it('saves versioned skill and agent assignments for an exact workspace', async () => {
-            const workspacePath = path.resolve('/workspaces/example');
-            vi.mocked(config.loadConfig).mockResolvedValue({ workspacesDir: path.resolve('/workspaces') });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({ workspacePath });
-            vi.mocked(skillsCatalog.saveWorkspaceSkillsConfig).mockResolvedValue({
-                schemaVersion: 1,
-                revision: 4,
-                enabledSkills: ['pr-review-toolkit'],
-                enabledAgents: ['reviewer'],
-                enabledCategories: [],
-            });
-            const response = await app.request('/api/skills/workspace/example/assign', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    expectedRevision: 3,
-                    enabledSkills: ['pr-review-toolkit'],
-                    enabledAgents: ['reviewer'],
-                    enabledCategories: [],
-                }),
-            });
-            expect(response.status).toBe(200);
-            expect(skillsCatalog.saveWorkspaceSkillsConfig).toHaveBeenCalledWith(workspacePath, expect.objectContaining({ enabledSkills: ['pr-review-toolkit'], enabledAgents: ['reviewer'] }), 3);
-        });
-        it('rejects workspace assignments that reference missing catalog resources', async () => {
-            const workspacePath = path.resolve('/workspaces/example');
-            vi.mocked(config.loadConfig).mockResolvedValue({ workspacesDir: path.resolve('/workspaces') });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({ workspacePath });
-            vi.mocked(resourceService.validateResourceSelections).mockRejectedValueOnce(new resourceService.ResourceSelectionError(['missing-skill'], ['missing_agent']));
-            const response = await app.request('/api/skills/workspace/example/assign', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    expectedRevision: 0,
-                    enabledSkills: ['missing-skill'],
-                    enabledAgents: ['missing_agent'],
-                    enabledCategories: [],
-                }),
-            });
-            expect(response.status).toBe(400);
-            await expect(response.json()).resolves.toMatchObject({
-                missingSkills: ['missing-skill'],
-                missingAgents: ['missing_agent'],
-            });
-            expect(skillsCatalog.saveWorkspaceSkillsConfig).not.toHaveBeenCalled();
-        });
-        it('requires an assignment revision and maps stale revisions to a conflict', async () => {
-            const missingRevision = await app.request('/api/skills/workspace/example/assign', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ enabledSkills: [], enabledAgents: [] }),
-            });
-            expect(missingRevision.status).toBe(400);
-            expect(config.loadConfig).not.toHaveBeenCalled();
-            const workspacePath = path.resolve('/workspaces/example');
-            vi.mocked(config.loadConfig).mockResolvedValue({ workspacesDir: path.resolve('/workspaces') });
-            vi.mocked(fs.realpath).mockImplementation(async (candidate) => path.resolve(String(candidate)));
-            vi.mocked(workspace.loadWorkspaceManifest).mockResolvedValue({ workspacePath });
-            const revisionError = new skillsCatalog.WorkspaceResourceRevisionError(2, 3);
-            revisionError.message = 'Workspace resource configuration changed (expected revision 2, current 3).';
-            vi.mocked(skillsCatalog.saveWorkspaceSkillsConfig).mockRejectedValueOnce(revisionError);
-            const staleRevision = await app.request('/api/skills/workspace/example/assign', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ expectedRevision: 2, enabledSkills: [], enabledAgents: [] }),
-            });
-            expect(staleRevision.status).toBe(409);
-            await expect(staleRevision.json()).resolves.toMatchObject({
-                error: expect.stringContaining('expected revision 2, current 3'),
-            });
-        });
-    });
-});
-//# sourceMappingURL=server.test.js.map