@openparachute/agent 0.1.2 → 0.2.2

package/src/container-runtime.test.ts

@@ -1,269 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-// Mock log
-vi.mock('./log.js', () => ({
-  log: {
-    debug: vi.fn(),
-    info: vi.fn(),
-    warn: vi.fn(),
-    error: vi.fn(),
-    fatal: vi.fn(),
-  },
-}));
-
-// Mock child_process — store the mock fn so tests can configure it
-const mockExecSync = vi.fn();
-vi.mock('child_process', () => ({
-  execSync: (...args: unknown[]) => mockExecSync(...args),
-}));
-
-import {
-  CONTAINER_RUNTIME_BIN,
-  readonlyMountArgs,
-  stopContainer,
-  ensureContainerRuntimeRunning,
-  ensureContainerImage,
-  cleanupOrphans,
-} from './container-runtime.js';
-import { CONTAINER_IMAGE, CONTAINER_INSTALL_LABEL, LEGACY_PARACLAW_INSTALL_LABEL } from './config.js';
-import { log } from './log.js';
-
-beforeEach(() => {
-  vi.clearAllMocks();
-});
-
-// --- Pure functions ---
-
-describe('readonlyMountArgs', () => {
-  it('returns -v flag with :ro suffix', () => {
-    const args = readonlyMountArgs('/host/path', '/container/path');
-    expect(args).toEqual(['-v', '/host/path:/container/path:ro']);
-  });
-});
-
-describe('stopContainer', () => {
-  it('calls docker stop for valid container names', () => {
-    stopContainer('parachute-agent-test-123');
-    expect(mockExecSync).toHaveBeenCalledWith(`${CONTAINER_RUNTIME_BIN} stop -t 1 parachute-agent-test-123`, {
-      stdio: 'pipe',
-    });
-  });
-
-  it('rejects names with shell metacharacters', () => {
-    expect(() => stopContainer('foo; rm -rf /')).toThrow('Invalid container name');
-    expect(() => stopContainer('foo$(whoami)')).toThrow('Invalid container name');
-    expect(() => stopContainer('foo`id`')).toThrow('Invalid container name');
-    expect(mockExecSync).not.toHaveBeenCalled();
-  });
-});
-
-// --- ensureContainerRuntimeRunning ---
-
-describe('ensureContainerRuntimeRunning', () => {
-  it('does nothing when runtime is already running', () => {
-    mockExecSync.mockReturnValueOnce('');
-
-    ensureContainerRuntimeRunning();
-
-    expect(mockExecSync).toHaveBeenCalledTimes(1);
-    expect(mockExecSync).toHaveBeenCalledWith(`${CONTAINER_RUNTIME_BIN} info`, {
-      stdio: 'pipe',
-      timeout: 10000,
-    });
-    expect(log.debug).toHaveBeenCalledWith('Container runtime already running');
-  });
-
-  it('throws when docker info fails', () => {
-    mockExecSync.mockImplementationOnce(() => {
-      throw new Error('Cannot connect to the Docker daemon');
-    });
-
-    expect(() => ensureContainerRuntimeRunning()).toThrow('Container runtime is required but failed to start');
-    expect(log.error).toHaveBeenCalled();
-  });
-});
-
-// --- ensureContainerImage ---
-
-describe('ensureContainerImage', () => {
-  // Each test enumerates its own queue rather than going through a helper —
-  // throwing scenarios skip the retag call, so a generic helper would queue
-  // a `mockReturnValueOnce` that never gets consumed and leaks into the next
-  // test (vi.clearAllMocks doesn't drain the response queue).
-  const inspectFailed = () => {
-    mockExecSync.mockImplementationOnce(() => {
-      throw new Error('No such image');
-    });
-  };
-
-  it('no-ops when the expected image is already present', () => {
-    mockExecSync.mockReturnValueOnce('{}'); // inspect — image exists
-
-    ensureContainerImage();
-
-    expect(mockExecSync).toHaveBeenCalledTimes(1);
-    expect(mockExecSync).toHaveBeenCalledWith(
-      `${CONTAINER_RUNTIME_BIN} image inspect ${CONTAINER_IMAGE}`,
-      expect.objectContaining({ stdio: 'pipe' }),
-    );
-    expect(log.warn).not.toHaveBeenCalled();
-  });
-
-  it('retags from a current-prefix peer when the expected image is missing', () => {
-    // Operator dir-rename case: the previously-built image carries the old
-    // INSTALL_SLUG (cafef00d); the daemon now boots under a new slug.
-    const peer = 'parachute-agent-image-cafef00d:latest';
-    inspectFailed();
-    mockExecSync.mockReturnValueOnce(`${peer}\nnode:24-bookworm-slim\n`); // list
-    mockExecSync.mockReturnValueOnce(''); // tag
-
-    ensureContainerImage();
-
-    expect(mockExecSync).toHaveBeenCalledTimes(3);
-    expect(mockExecSync).toHaveBeenNthCalledWith(
-      3,
-      `${CONTAINER_RUNTIME_BIN} tag ${peer} ${CONTAINER_IMAGE}`,
-      expect.objectContaining({ stdio: 'pipe' }),
-    );
-    expect(log.warn).toHaveBeenCalledWith(
-      'Container image missing for current install slug — retagging from peer',
-      expect.objectContaining({ expected: CONTAINER_IMAGE, peer }),
-    );
-  });
-
-  it('retags from a pre-0.1.0 paraclaw-agent peer (one cycle of back-compat)', () => {
-    // Operator upgrades a pre-0.1.0 install: their on-disk image is named
-    // `paraclaw-agent-<slug>:latest`. Auto-retag rather than forcing a
-    // 5-minute rebuild they didn't ask for.
-    const legacyPeer = 'paraclaw-agent-cafef00d:latest';
-    inspectFailed();
-    mockExecSync.mockReturnValueOnce(legacyPeer);
-    mockExecSync.mockReturnValueOnce('');
-
-    ensureContainerImage();
-
-    expect(mockExecSync).toHaveBeenNthCalledWith(
-      3,
-      `${CONTAINER_RUNTIME_BIN} tag ${legacyPeer} ${CONTAINER_IMAGE}`,
-      expect.objectContaining({ stdio: 'pipe' }),
-    );
-  });
-
-  it('throws an actionable error when no peer exists (fresh install, no build yet)', () => {
-    // No matching prefix on disk: only unrelated base images. Better to fail
-    // visibly at startup than crashloop code=125 on every container spawn.
-    inspectFailed();
-    mockExecSync.mockReturnValueOnce('node:24-bookworm-slim\nubuntu:22.04\n');
-
-    expect(() => ensureContainerImage()).toThrow(/build\.sh/);
-    expect(mockExecSync).toHaveBeenCalledTimes(2); // inspect + list, no tag
-  });
-
-  it('skips the (missing) expected name when picking a peer from the listing', () => {
-    // Belt-and-suspenders: the inspect already confirmed the expected name
-    // is absent, but the peer-search guard against picking it back up keeps
-    // the function safe if a future caller pre-checks a different way.
-    inspectFailed();
-    mockExecSync.mockReturnValueOnce(`${CONTAINER_IMAGE}\nparachute-agent-image-cafef00d:latest\n`);
-    mockExecSync.mockReturnValueOnce('');
-
-    ensureContainerImage();
-
-    const tagCall = mockExecSync.mock.calls.find((call) => String(call[0]).startsWith(`${CONTAINER_RUNTIME_BIN} tag`));
-    expect(tagCall).toBeDefined();
-    expect(String(tagCall![0])).toContain('parachute-agent-image-cafef00d:latest');
-  });
-
-  it('ignores arbitrary non-matching tags (e.g. base images, unrelated projects)', () => {
-    inspectFailed();
-    mockExecSync.mockReturnValueOnce('node:24-bookworm-slim\nparachute-vault:latest\nrandomthing:v2\n');
-
-    expect(() => ensureContainerImage()).toThrow(/build\.sh/);
-  });
-});
-
-// --- cleanupOrphans ---
-
-describe('cleanupOrphans', () => {
-  it('filters ps by both the new and legacy install labels so peers are not reaped', () => {
-    mockExecSync.mockReturnValue('');
-
-    cleanupOrphans();
-
-    expect(mockExecSync).toHaveBeenNthCalledWith(
-      1,
-      `${CONTAINER_RUNTIME_BIN} ps --filter label=${CONTAINER_INSTALL_LABEL} --format '{{.Names}}'`,
-      expect.any(Object),
-    );
-    expect(mockExecSync).toHaveBeenNthCalledWith(
-      2,
-      `${CONTAINER_RUNTIME_BIN} ps --filter label=${LEGACY_PARACLAW_INSTALL_LABEL} --format '{{.Names}}'`,
-      expect.any(Object),
-    );
-  });
-
-  it('stops orphaned containers from both labels and de-dupes', () => {
-    // First ps (new label) returns one container; second ps (legacy label) returns two —
-    // one duplicates the first, simulating a container that carries both labels during
-    // upgrade.
-    mockExecSync.mockReturnValueOnce('parachute-agent-group1-111\n');
-    mockExecSync.mockReturnValueOnce('parachute-agent-group1-111\nparaclaw-group2-222\n');
-    mockExecSync.mockReturnValue('');
-
-    cleanupOrphans();
-
-    // 2 ps + 2 unique stop calls
-    expect(mockExecSync).toHaveBeenCalledTimes(4);
-    expect(mockExecSync).toHaveBeenNthCalledWith(3, `${CONTAINER_RUNTIME_BIN} stop -t 1 parachute-agent-group1-111`, {
-      stdio: 'pipe',
-    });
-    expect(mockExecSync).toHaveBeenNthCalledWith(4, `${CONTAINER_RUNTIME_BIN} stop -t 1 paraclaw-group2-222`, {
-      stdio: 'pipe',
-    });
-    expect(log.info).toHaveBeenCalledWith('Stopped orphaned containers', {
-      count: 2,
-      names: ['parachute-agent-group1-111', 'paraclaw-group2-222'],
-    });
-  });
-
-  it('does nothing when no orphans exist on either label', () => {
-    mockExecSync.mockReturnValue('');
-
-    cleanupOrphans();
-
-    expect(mockExecSync).toHaveBeenCalledTimes(2); // both label queries
-    expect(log.info).not.toHaveBeenCalled();
-  });
-
-  it('warns and continues when ps fails', () => {
-    mockExecSync.mockImplementationOnce(() => {
-      throw new Error('docker not available');
-    });
-
-    cleanupOrphans(); // should not throw
-
-    expect(log.warn).toHaveBeenCalledWith(
-      'Failed to clean up orphaned containers',
-      expect.objectContaining({ err: expect.any(Error) }),
-    );
-  });
-
-  it('continues stopping remaining containers when one stop fails', () => {
-    mockExecSync.mockReturnValueOnce('parachute-agent-a-1\nparachute-agent-b-2\n');
-    mockExecSync.mockReturnValueOnce(''); // legacy label query empty
-    // First stop fails
-    mockExecSync.mockImplementationOnce(() => {
-      throw new Error('already stopped');
-    });
-    // Second stop succeeds
-    mockExecSync.mockReturnValueOnce('');
-
-    cleanupOrphans(); // should not throw
-
-    expect(mockExecSync).toHaveBeenCalledTimes(4);
-    expect(log.info).toHaveBeenCalledWith('Stopped orphaned containers', {
-      count: 2,
-      names: ['parachute-agent-a-1', 'parachute-agent-b-2'],
-    });
-  });
-});

package/src/container-runtime.ts

@@ -1,167 +0,0 @@
-/**
- * Container runtime abstraction for parachute-agent.
- * All runtime-specific logic lives here so swapping runtimes means changing one file.
- */
-import { execSync } from 'child_process';
-import os from 'os';
-
-import { CONTAINER_IMAGE, CONTAINER_INSTALL_LABEL, LEGACY_PARACLAW_INSTALL_LABEL } from './config.js';
-import { log } from './log.js';
-
-// Per-install image tag schemas:
-//   - 0.1.0+:    `parachute-agent-image-<8-hex-slug>:latest`
-//   - pre-0.1.0: `paraclaw-agent-<8-hex-slug>:latest` (kept for one cycle of
-//                back-compat so an operator who upgrades into a 0.1.x checkout
-//                without rebuilding the image still gets a working spawn;
-//                drop in 0.2.0 — same lifecycle as LEGACY_PARACLAW_INSTALL_LABEL).
-// Both prefixes are stable + content-equivalent — Dockerfile baseline
-// matches across slugs — so a `docker tag` of any peer is safe.
-const PEER_IMAGE_PATTERN = /^(parachute-agent-image|paraclaw-agent)-[0-9a-f]{8}:latest$/;
-
-/** The container runtime binary name. */
-export const CONTAINER_RUNTIME_BIN = 'docker';
-
-/** CLI args needed for the container to resolve the host gateway. */
-export function hostGatewayArgs(): string[] {
-  // On Linux, host.docker.internal isn't built-in — add it explicitly
-  if (os.platform() === 'linux') {
-    return ['--add-host=host.docker.internal:host-gateway'];
-  }
-  return [];
-}
-
-/** Returns CLI args for a readonly bind mount. */
-export function readonlyMountArgs(hostPath: string, containerPath: string): string[] {
-  return ['-v', `${hostPath}:${containerPath}:ro`];
-}
-
-/** Stop a container by name. Uses execFileSync to avoid shell injection. */
-export function stopContainer(name: string): void {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name)) {
-    throw new Error(`Invalid container name: ${name}`);
-  }
-  execSync(`${CONTAINER_RUNTIME_BIN} stop -t 1 ${name}`, { stdio: 'pipe' });
-}
-
-/** Ensure the container runtime is running, starting it if needed. */
-export function ensureContainerRuntimeRunning(): void {
-  try {
-    execSync(`${CONTAINER_RUNTIME_BIN} info`, {
-      stdio: 'pipe',
-      timeout: 10000,
-    });
-    log.debug('Container runtime already running');
-  } catch (err) {
-    log.error('Failed to reach container runtime', { err });
-    console.error('\n╔════════════════════════════════════════════════════════════════╗');
-    console.error('║  FATAL: Container runtime failed to start                      ║');
-    console.error('║                                                                ║');
-    console.error('║  Agents cannot run without a container runtime. To fix:        ║');
-    console.error('║  1. Ensure Docker is installed and running                     ║');
-    console.error('║  2. Run: docker info                                           ║');
-    console.error('║  3. Restart parachute-agent                                    ║');
-    console.error('╚════════════════════════════════════════════════════════════════╝\n');
-    throw new Error('Container runtime is required but failed to start', {
-      cause: err,
-    });
-  }
-}
-
-/**
- * Ensure the per-install container image is reachable before we start
- * spawning sessions.
- *
- * INSTALL_SLUG = sha1(process.cwd())[:8], so an operator dir-rename
- * (paraclaw#114) flips the slug. The previously-built image carries the
- * OLD slug; the daemon goes to spawn against the NEW slug; `docker run`
- * returns code=125 ("image not found") and every container spawn
- * crashloops silently.
- *
- * Resolution path, ordered fail-fast → cheap → loud:
- *   1. Expected tag present → no-op.
- *   2. Any peer image (`parachute-agent-image-*` or pre-0.1.0
- *      `paraclaw-agent-*`) present → `docker tag` it to the expected
- *      name. Safe because the Dockerfile baseline doesn't fork per slug.
- *   3. No peer found → throw with an actionable hint. The daemon was
- *      going to crashloop anyway; failing visibly at startup is strictly
- *      better than silent code=125 on every Telegram message.
- */
-export function ensureContainerImage(): void {
-  if (imageExists(CONTAINER_IMAGE)) {
-    log.debug('Container image present', { image: CONTAINER_IMAGE });
-    return;
-  }
-  const peer = findPeerImage(CONTAINER_IMAGE);
-  if (peer) {
-    // The dir-rename / upgrade case. Loud-warn so the operator can see in
-    // the log what happened — silent retags become folklore.
-    log.warn('Container image missing for current install slug — retagging from peer', {
-      expected: CONTAINER_IMAGE,
-      peer,
-      hint: 'Operator dir-rename or upgrade likely changed INSTALL_SLUG. Auto-retagging is safe; rebuild via ./container/build.sh next time you want to refresh dependencies.',
-    });
-    execSync(`${CONTAINER_RUNTIME_BIN} tag ${peer} ${CONTAINER_IMAGE}`, { stdio: 'pipe' });
-    return;
-  }
-  throw new Error(
-    `No parachute-agent container image found. Build one with: ./container/build.sh\n` +
-      `Expected image: ${CONTAINER_IMAGE}`,
-  );
-}
-
-function imageExists(ref: string): boolean {
-  try {
-    execSync(`${CONTAINER_RUNTIME_BIN} image inspect ${ref}`, { stdio: 'pipe' });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function findPeerImage(exclude: string): string | null {
-  const output = execSync(`${CONTAINER_RUNTIME_BIN} images --format '{{.Repository}}:{{.Tag}}'`, {
-    stdio: ['pipe', 'pipe', 'pipe'],
-    encoding: 'utf-8',
-  });
-  // `docker images` lists newest-created first by default. Take the first
-  // matching peer so a recent rebuild wins over a stale legacy tag.
-  for (const ref of output.trim().split('\n').filter(Boolean)) {
-    if (ref === exclude) continue;
-    if (PEER_IMAGE_PATTERN.test(ref)) return ref;
-  }
-  return null;
-}
-
-/**
- * Kill orphaned parachute-agent containers from THIS install's previous runs.
- *
- * Scoped by the `parachute-agent-install=<slug>` label (and the pre-0.1.0
- * `paraclaw-install=<slug>` label for one upgrade cycle) so a crash-looping
- * peer install cannot reap our containers, and we cannot reap theirs. The
- * label is stamped onto every container at spawn time — see
- * container-runner.ts. Old-label compat reap is queued to drop in 0.2.0.
- */
-export function cleanupOrphans(): void {
-  try {
-    const namesByLabel = [CONTAINER_INSTALL_LABEL, LEGACY_PARACLAW_INSTALL_LABEL].flatMap((label) => {
-      const output = execSync(`${CONTAINER_RUNTIME_BIN} ps --filter label=${label} --format '{{.Names}}'`, {
-        stdio: ['pipe', 'pipe', 'pipe'],
-        encoding: 'utf-8',
-      });
-      return output.trim().split('\n').filter(Boolean);
-    });
-    const orphans = Array.from(new Set(namesByLabel));
-    for (const name of orphans) {
-      try {
-        stopContainer(name);
-      } catch {
-        /* already stopped */
-      }
-    }
-    if (orphans.length > 0) {
-      log.info('Stopped orphaned containers', { count: orphans.length, names: orphans });
-    }
-  } catch (err) {
-    log.warn('Failed to clean up orphaned containers', { err });
-  }
-}

package/src/db/_bun-sqlite-shim.ts

@@ -1,88 +0,0 @@
-/**
- * Test-only shim that re-exports the `bun:sqlite` surface backed by
- * `better-sqlite3`. Wired in via vitest's `resolve.alias` so the host code
- * (which imports `bun:sqlite`) can be exercised under Node + vitest without
- * a real bun runtime.
- *
- * Production code runs under Bun and sees the real `bun:sqlite` module —
- * never this shim. Symmetric inverse of the wrapper in connection.ts:
- * connection.ts prefixes object keys with `@` for bun's binder; this shim
- * strips that prefix so better-sqlite3's binder is happy.
- */
-import BetterSqlite3 from 'better-sqlite3';
-
-type Bindable = unknown;
-
-function stripPrefix(key: string): string {
-  return key.startsWith('@') || key.startsWith('$') || key.startsWith(':') ? key.slice(1) : key;
-}
-
-function adaptArgs(args: Bindable[]): Bindable[] {
-  return args.map((a) => {
-    if (a == null) return a;
-    if (Array.isArray(a)) return a;
-    if (typeof a !== 'object') return a;
-    const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(a as Record<string, unknown>)) {
-      out[stripPrefix(k)] = v;
-    }
-    return out;
-  });
-}
-
-class ShimStatement {
-  constructor(private readonly stmt: BetterSqlite3.Statement) {}
-  run(...args: Bindable[]): { changes: number; lastInsertRowid: number | bigint } {
-    const r = this.stmt.run(...(adaptArgs(args) as never[]));
-    return { changes: r.changes, lastInsertRowid: r.lastInsertRowid };
-  }
-  get<T = unknown>(...args: Bindable[]): T | null {
-    const r = this.stmt.get(...(adaptArgs(args) as never[]));
-    return (r ?? null) as T | null;
-  }
-  all<T = unknown>(...args: Bindable[]): T[] {
-    return this.stmt.all(...(adaptArgs(args) as never[])) as T[];
-  }
-  values(...args: Bindable[]): unknown[][] {
-    return this.stmt.raw().all(...(adaptArgs(args) as never[])) as unknown[][];
-  }
-  iterate<T = unknown>(...args: Bindable[]): IterableIterator<T> {
-    return this.stmt.iterate(...(adaptArgs(args) as never[])) as IterableIterator<T>;
-  }
-  finalize(): void {
-    /* no-op — better-sqlite3 finalizes on GC */
-  }
-  toString(): string {
-    return this.stmt.source;
-  }
-}
-
-export class Database {
-  public readonly raw: BetterSqlite3.Database;
-  constructor(path: string, opts?: { readonly?: boolean }) {
-    this.raw = new BetterSqlite3(path, opts);
-  }
-  prepare(sql: string): ShimStatement {
-    return new ShimStatement(this.raw.prepare(sql));
-  }
-  exec(sql: string): void {
-    this.raw.exec(sql);
-  }
-  query(sql: string): ShimStatement {
-    return this.prepare(sql);
-  }
-  run(sql: string): void {
-    this.raw.exec(sql);
-  }
-  transaction<F extends (...a: never[]) => unknown>(fn: F): F {
-    return this.raw.transaction(fn) as unknown as F;
-  }
-  close(): void {
-    this.raw.close();
-  }
-  get filename(): string {
-    return this.raw.name;
-  }
-}
-
-export type Statement = ShimStatement;

package/src/db/agent-activity.test.ts

@@ -1,155 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import { createAgentGroup, createSession, closeDb, getDb, initTestDb, runMigrations } from './index.js';
-import {
-  getActivitySyncedSeq,
-  listActivityByAgentGroup,
-  listActivityBySession,
-  mergeActivityBatch,
-} from './agent-activity.js';
-import type { OutboundActivityRow } from './session-db.js';
-
-function now(): string {
-  return new Date().toISOString();
-}
-
-function seedAgentAndSession(): { agentGroupId: string; sessionId: string } {
-  createAgentGroup({
-    id: 'ag-1',
-    name: 'Test Agent',
-    folder: 'test-agent',
-    agent_provider: null,
-    created_at: now(),
-  });
-  createSession({
-    id: 'sess-1',
-    agent_group_id: 'ag-1',
-    messaging_group_id: null,
-    thread_id: null,
-    agent_provider: null,
-    status: 'active',
-    container_status: 'running',
-    last_active: now(),
-    created_at: now(),
-  });
-  return { agentGroupId: 'ag-1', sessionId: 'sess-1' };
-}
-
-function row(seq: number, kind: string, target: string | null, summary: string | null = null): OutboundActivityRow {
-  return { seq, ts: new Date(2026, 0, seq).toISOString(), kind, target, summary };
-}
-
-beforeEach(() => {
-  const db = initTestDb();
-  runMigrations(db);
-});
-
-afterEach(() => {
-  closeDb();
-});
-
-describe('agent_activity merge', () => {
-  it('initial cursor is 0 and merging a batch advances it', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    expect(getActivitySyncedSeq(sessionId)).toBe(0);
-
-    const newCursor = mergeActivityBatch(agentGroupId, sessionId, [
-      row(1, 'tool_call', 'Read'),
-      row(2, 'cmd_exec', 'Bash'),
-      row(3, 'mcp_call', 'mcp__parachute_agent__schedule_task'),
-    ]);
-    expect(newCursor).toBe(3);
-    expect(getActivitySyncedSeq(sessionId)).toBe(3);
-
-    const rows = listActivityBySession(sessionId);
-    expect(rows).toHaveLength(3);
-    expect(rows.map((r) => r.kind).sort()).toEqual(['cmd_exec', 'mcp_call', 'tool_call']);
-  });
-
-  it('empty batch is a no-op and returns the existing cursor', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    mergeActivityBatch(agentGroupId, sessionId, [row(1, 'tool_call', 'Read')]);
-    expect(getActivitySyncedSeq(sessionId)).toBe(1);
-
-    const c = mergeActivityBatch(agentGroupId, sessionId, []);
-    expect(c).toBe(1);
-    expect(listActivityBySession(sessionId)).toHaveLength(1);
-  });
-
-  it('cursor advance is monotonic — re-merging an older batch leaves it unchanged', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    mergeActivityBatch(agentGroupId, sessionId, [row(5, 'tool_call', 'Read'), row(6, 'tool_call', 'Glob')]);
-    expect(getActivitySyncedSeq(sessionId)).toBe(6);
-
-    // The delivery loop guards against this with `seq > cursor`, but if a
-    // caller passes older rows, the cursor should NOT regress.
-    mergeActivityBatch(agentGroupId, sessionId, [row(2, 'tool_call', 'Read')]);
-    expect(getActivitySyncedSeq(sessionId)).toBe(6);
-  });
-
-  it('listActivityByAgentGroup returns rows for a single group, newest first', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    createAgentGroup({
-      id: 'ag-2',
-      name: 'Other',
-      folder: 'other',
-      agent_provider: null,
-      created_at: now(),
-    });
-    createSession({
-      id: 'sess-2',
-      agent_group_id: 'ag-2',
-      messaging_group_id: null,
-      thread_id: null,
-      agent_provider: null,
-      status: 'active',
-      container_status: 'running',
-      last_active: now(),
-      created_at: now(),
-    });
-
-    mergeActivityBatch(agentGroupId, sessionId, [row(1, 'tool_call', 'Read'), row(2, 'cmd_exec', 'Bash')]);
-    mergeActivityBatch('ag-2', 'sess-2', [row(1, 'tool_call', 'Glob')]);
-
-    const ag1 = listActivityByAgentGroup(agentGroupId);
-    expect(ag1).toHaveLength(2);
-    expect(ag1.every((r) => r.agent_group_id === agentGroupId)).toBe(true);
-    // DESC by created_at — row(2) was minted later (Jan 2 > Jan 1).
-    expect(ag1[0].target).toBe('Bash');
-    expect(ag1[1].target).toBe('Read');
-
-    const ag2 = listActivityByAgentGroup('ag-2');
-    expect(ag2).toHaveLength(1);
-    expect(ag2[0].target).toBe('Glob');
-  });
-
-  it('honors `since` and `limit`', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    mergeActivityBatch(agentGroupId, sessionId, [
-      row(1, 'tool_call', 'A'),
-      row(2, 'tool_call', 'B'),
-      row(3, 'tool_call', 'C'),
-      row(4, 'tool_call', 'D'),
-    ]);
-
-    const limited = listActivityBySession(sessionId, { limit: 2 });
-    expect(limited).toHaveLength(2);
-    expect(limited[0].target).toBe('D'); // newest first
-    expect(limited[1].target).toBe('C');
-
-    // since = ts of seq=2 (Jan 2). Should include C (Jan 3) and D (Jan 4).
-    const since = new Date(2026, 0, 2).toISOString();
-    const sinceRows = listActivityBySession(sessionId, { since });
-    expect(sinceRows.map((r) => r.target)).toEqual(['D', 'C']);
-  });
-
-  it('cascades on session delete', () => {
-    const { agentGroupId, sessionId } = seedAgentAndSession();
-    mergeActivityBatch(agentGroupId, sessionId, [row(1, 'tool_call', 'Read')]);
-    expect(listActivityBySession(sessionId)).toHaveLength(1);
-
-    getDb().prepare('DELETE FROM sessions WHERE id = ?').run(sessionId);
-    expect(listActivityBySession(sessionId)).toHaveLength(0);
-    expect(listActivityByAgentGroup(agentGroupId)).toHaveLength(0);
-  });
-});