@sleep2agi/commhub-server 0.9.0-preview.3 → 0.9.0-preview.30

package/src/task-lifecycle-watcher.test.ts

@@ -0,0 +1,200 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import { db, logTaskEvent } from "./db.js";
+import { TASK_EVENT_REST_COLUMNS } from "./rest-projections.js";
+import { recordDeliveredStaleEvents } from "./task-lifecycle-watcher.js";
+
+const NOW = new Date("2026-08-10T00:01:01.000Z");
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let token = "";
+let networkId = "";
+
+function insertTask(taskId: string, status: string, deliveredAt: string | null, network = networkId) {
+  db.run(
+    `INSERT INTO tasks
+       (task_id, from_name, to_name, status, content, delivered_at, network_id)
+     VALUES (?1, 'sender', 'target', ?2, 'watcher fixture', ?3, ?4)`,
+    [taskId, status, deliveredAt, network],
+  );
+}
+
+function sqliteUtcTimestamp(date: Date): string {
+  return date.toISOString().slice(0, 19).replace("T", " ");
+}
+
+beforeAll(async () => {
+  const { register } = await import("./auth.js");
+  const auth = register(`watcher_owner_${Date.now()}`, "WatcherOwner-Strong-1!", undefined, "watcher");
+  expect(auth.ok).toBe(true);
+  token = auth.token!;
+  networkId = auth.network_id!;
+
+  insertTask("stale-29", "delivered", "2026-08-10 00:00:32");
+  insertTask("stale-30", "delivered", "2026-08-10 00:00:31");
+  insertTask("stale-60", "delivered", "2026-08-10 00:00:01");
+  insertTask("stale-acked", "acked", "2026-08-10 00:00:00");
+  insertTask("stale-no-delivery", "delivered", null);
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+});
+
+/**
+ * 轮询到 `ready()` 为真,或到期抛错。
+ *
+ * 定长 sleep 的问题不是「慢」,是**报错报在错的层**:超时之后测试红在
+ * 「事件没写」这条断言上,读的人会去查 watcher,而真实原因可能是子进程
+ * 还没起来。这里到期时把那句话直接说出来。
+ */
+async function waitUntil(ready: () => boolean, timeoutMs: number, what: string | null): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    if (ready()) return;
+    if (Date.now() >= deadline) {
+      // what === null:到期本身就是期望结果(调用方随后自己断言),不抛。
+      if (what === null) return;
+      throw new Error(`timed out after ${timeoutMs}ms: ${what}`);
+    }
+    await Bun.sleep(25);
+  }
+}
+
+describe("#167 Hub delivered-stale lifecycle watcher", () => {
+  test("30s/60s thresholds are exact and non-delivered tasks stay silent", () => {
+    const first = recordDeliveredStaleEvents(NOW);
+    expect(first.inserted).toBe(3);
+    expect(first.by_threshold_seconds).toEqual({ 30: 2, 60: 1 });
+
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM task_events WHERE task_id = 'stale-29'")!.count).toBe(0);
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM task_events WHERE task_id = 'stale-30'")!.count).toBe(1);
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM task_events WHERE task_id = 'stale-60'")!.count).toBe(2);
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM task_events WHERE task_id = 'stale-acked'")!.count).toBe(0);
+    expect(db.get<{ count: number }>("SELECT COUNT(*) AS count FROM task_events WHERE task_id = 'stale-no-delivery'")!.count).toBe(0);
+
+    const sixty = db.all<any>("SELECT * FROM task_events WHERE task_id = 'stale-60' ORDER BY event_type");
+    expect(sixty.map((row) => row.event_type)).toEqual([
+      "task.warning.delivered_stale_30s",
+      "task.warning.delivered_stale_60s",
+    ]);
+    expect(sixty.map((row) => row.event_key)).toEqual(sixty.map((row) => row.event_type));
+    expect(sixty.every((row) => row.from_status === "delivered" && row.to_status === "delivered")).toBe(true);
+    expect(sixty.every((row) => row.actor === "patrol")).toBe(true);
+    expect(sixty.every((row) => row.network_id === networkId)).toBe(true);
+  });
+
+  test("a second patrol is write-once for each task and threshold", () => {
+    const second = recordDeliveredStaleEvents(NOW);
+    expect(second.inserted).toBe(0);
+    expect(second.by_threshold_seconds).toEqual({ 30: 0, 60: 0 });
+    expect(db.get<{ count: number }>(
+      "SELECT COUNT(*) AS count FROM task_events WHERE event_type LIKE 'task.warning.delivered_stale_%'",
+    )!.count).toBe(3);
+  });
+
+  test("ordinary lifecycle events get standard event names without a dedupe key", () => {
+    logTaskEvent("stale-30", null, "delivered", "target");
+    logTaskEvent("stale-30", "delivered", "acked", "target");
+    logTaskEvent("stale-30", "acked", "running", "target");
+    logTaskEvent("stale-30", "running", "replied", "target");
+    logTaskEvent("stale-30", "running", "failed", "target");
+    logTaskEvent("stale-30", "delivered", "expired", "target");
+    const rows = db.all<any>(
+      "SELECT event_type, event_key FROM task_events WHERE task_id = 'stale-30' AND actor = 'target' ORDER BY id",
+    );
+    expect(rows).toEqual([
+      { event_type: "task.send.delivered", event_key: null },
+      { event_type: "task.ack", event_key: null },
+      { event_type: "task.started", event_key: null },
+      { event_type: "task.replied", event_key: null },
+      { event_type: "task.failed", event_key: null },
+      { event_type: "task.expired", event_key: null },
+    ]);
+  });
+
+  test("REST exposes event_type but keeps the internal idempotency key private", async () => {
+    expect(TASK_EVENT_REST_COLUMNS).toContain("event_type");
+    expect(TASK_EVENT_REST_COLUMNS).not.toContain("event_key" as any);
+    const response = await fetch(
+      `${base}/api/task_events?network_id=${encodeURIComponent(networkId)}&task_id=stale-60`,
+      { headers: { Authorization: `Bearer ${token}` } },
+    );
+    expect(response.status).toBe(200);
+    const body = await response.json() as any;
+    expect(body.events).toHaveLength(2);
+    expect(body.events.every((event: any) => typeof event.event_type === "string")).toBe(true);
+    expect(body.events.every((event: any) => event.event_key === undefined)).toBe(true);
+  });
+
+  test("startHub owns a live watcher timer instead of relying on import side effects", async () => {
+    const childDbPath = `/tmp/test683-live-${process.pid}-${Date.now()}.db`;
+    const init = Bun.spawnSync(["bun", "-e", "await import('./server/src/db.js')"], {
+      cwd: process.cwd(),
+      env: { ...process.env, COMMHUB_DB: childDbPath },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(init.exitCode).toBe(0);
+
+    const child = Bun.spawn(["bun", "run", "server/src/index.ts"], {
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        COMMHUB_DB: childDbPath,
+        COMMHUB_DELIVERED_STALE_PATROL_MS: "25",
+        PORT: "0",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    // 这里**不**等「hub 就绪」——因为没有一个只有 hub 起来了才成立的廉价判据:
+    // db 文件在上面那步 init 里就已经存在了,拿它当条件的话这个等待恒真,等于没等。
+    // 真正需要「hub 起来了」的是下面那条断言,而它已经改成轮询到目标状态,
+    // hub 起得慢只是让它多等几轮。
+    //
+    // 这一步保留的是原来那条断言的原意:**子进程没有立刻崩**。所以只给它一个
+    // 短窗口,并且如果它在窗口内退出就立刻停下来报错,不用把 800ms 睡满。
+    await waitUntil(() => child.exitCode !== null, 800, null);
+    expect(child.exitCode).toBeNull();
+
+    const taskId = "stale-live-wiring";
+    const childDb = new Database(childDbPath);
+    try {
+      // startHub may still be finishing its startup migration transaction even
+      // though the process has stayed alive. Wait for that short-lived writer
+      // instead of turning scheduler timing into an immediate SQLITE_BUSY.
+      childDb.exec("PRAGMA busy_timeout = 5000");
+      childDb.run(
+        `INSERT INTO tasks
+           (task_id, from_name, to_name, status, content, delivered_at, network_id)
+         VALUES (?1, 'sender', 'target', 'delivered', 'live watcher fixture', ?2, ?3)`,
+        [taskId, sqliteUtcTimestamp(new Date(Date.now() - 28_000)), networkId],
+      );
+      expect(childDb.query<{ count: number }, [string]>(
+        "SELECT COUNT(*) AS count FROM task_events WHERE task_id = ?1",
+      ).get(taskId)!.count).toBe(0);
+      // 巡检周期是 COMMHUB_DELIVERED_STALE_PATROL_MS=25ms —— 事件在插入后
+      // 几十毫秒内就该出现。原来这里是定长 sleep(3_200),纯粹是余量:
+      // 4.0s 的 sleep 装在 bun 默认的 5.0s 单测预算里,只剩 1s 给两次进程启动。
+      // 实测在 CI 上被这一条打红过(#798 让这个文件第一次进 CI 才暴露)。
+      // 改成「轮询到目标状态,或到期报错」:常态下快 ~60 倍,慢的时候等得起。
+      const countStale = () => childDb.query<{ count: number }, [string]>(
+        "SELECT COUNT(*) AS count FROM task_events WHERE task_id = ?1 AND event_type = 'task.warning.delivered_stale_30s'",
+      ).get(taskId)!.count;
+      await waitUntil(() => countStale() === 1, 20_000,
+        "watcher did not write the delivered_stale_30s event");
+      expect(countStale()).toBe(1);
+    } finally {
+      childDb.close();
+      try { child.kill("SIGTERM"); } catch {}
+      await child.exited;
+    }
+    // 🔴 显式超时:这一条要起两个真 bun 进程,bun 默认的 5s 对它不成立。
+    // 上面两处已改成轮询,常态用不到这个上限;它只保证「慢」不会被报成「坏」。
+  }, 30_000);
+});

package/src/task-lifecycle-watcher.ts

@@ -0,0 +1,49 @@
+import { db } from "./db.js";
+
+export const DELIVERED_STALE_THRESHOLDS = [30, 60] as const;
+
+export type DeliveredStalePatrolResult = {
+  inserted: number;
+  by_threshold_seconds: Record<(typeof DELIVERED_STALE_THRESHOLDS)[number], number>;
+};
+
+function sqliteUtcTimestamp(date: Date): string {
+  return date.toISOString().slice(0, 19).replace("T", " ");
+}
+
+/**
+ * Persist Hub-authoritative warnings for tasks which are still delivered.
+ *
+ * The task row, not an agent-local timer, is the source of truth. event_key is
+ * equal to the stable event name and protected by a unique index, so every
+ * threshold is write-once across restarts, patrols, and multiple Hub workers.
+ */
+export function recordDeliveredStaleEvents(now = new Date()): DeliveredStalePatrolResult {
+  if (!Number.isFinite(now.getTime())) throw new Error("invalid lifecycle patrol time");
+
+  const byThreshold = { 30: 0, 60: 0 };
+  let inserted = 0;
+
+  for (const thresholdSeconds of DELIVERED_STALE_THRESHOLDS) {
+    const eventType = `task.warning.delivered_stale_${thresholdSeconds}s`;
+    const cutoff = sqliteUtcTimestamp(new Date(now.getTime() - thresholdSeconds * 1000));
+    const detail = thresholdSeconds === 30
+      ? "still delivered after 30s; target has not started"
+      : "still delivered after 60s; target may be offline or not consuming";
+    const result = db.run(
+      `INSERT INTO task_events
+         (task_id, from_status, to_status, event_type, event_key, actor, detail, network_id)
+       SELECT task_id, 'delivered', 'delivered', ?1, ?1, 'patrol', ?2, network_id
+       FROM tasks
+       WHERE status = 'delivered'
+         AND delivered_at IS NOT NULL
+         AND delivered_at <= ?3
+       ON CONFLICT(task_id, event_key) DO NOTHING`,
+      [eventType, detail, cutoff],
+    );
+    byThreshold[thresholdSeconds] = result.changes;
+    inserted += result.changes;
+  }
+
+  return { inserted, by_threshold_seconds: byThreshold };
+}

package/src/task-network-resolution-http.test.ts

@@ -0,0 +1,137 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-task-network-resolution-"));
+let server: any;
+let base = "";
+
+type Principal = { token: string; userId: string; networkId: string; target: string };
+let adminSingle: Principal;
+let userSingle: Principal;
+let adminMulti: Principal;
+let adminZero: Principal;
+
+function registerPrincipal(label: string, admin: boolean): Principal {
+  const username = `task_net_${label}_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+  const registered = register(username, "TaskNetwork123!", undefined, "seed");
+  expect(registered.ok).toBe(true);
+  const userId = db.get<{ user_id: string }>(
+    "SELECT user_id FROM users WHERE username = ?1",
+    [username],
+  )!.user_id;
+  if (admin) db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [userId]);
+  return {
+    token: registered.token!,
+    userId,
+    networkId: registered.network_id!,
+    target: `task-net-${label}-${process.pid}`,
+  };
+}
+
+function seedTarget(principal: Principal): void {
+  const nodeId = `node_${principal.target}`;
+  db.run(
+    `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+     VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+    [`resume_${principal.target}`, principal.target, nodeId, principal.networkId],
+  );
+  db.run(
+    `INSERT INTO nodes (node_id, node_name, alias, network_id, created_at, updated_at, lifecycle_state)
+     VALUES (?1, ?2, ?2, ?3, datetime('now'), datetime('now'), 'active')`,
+    [nodeId, principal.target, principal.networkId],
+  );
+}
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB = process.env.COMMHUB_DB || join(PRIVATE_DB_DIR, "hub.db");
+  adminSingle = registerPrincipal("admin_single", true);
+  userSingle = registerPrincipal("user_single", false);
+  adminMulti = registerPrincipal("admin_multi", true);
+  adminZero = registerPrincipal("admin_zero", true);
+  seedTarget(adminSingle);
+  seedTarget(userSingle);
+  seedTarget(adminMulti);
+
+  const secondNetwork = `net_task_second_${process.pid}`;
+  db.run(
+    "INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, 'second', ?2, datetime('now'))",
+    [secondNetwork, adminMulti.userId],
+  );
+  db.run(
+    "INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))",
+    [adminMulti.userId, secondNetwork],
+  );
+  db.run("DELETE FROM network_members WHERE user_id = ?1", [adminZero.userId]);
+
+  const mod: any = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop?.(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function post(principal: Principal, marker: string, networkId?: string) {
+  const response = await fetch(`${base}/api/task`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${principal.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({
+      alias: principal.target,
+      from: "api",
+      task: marker,
+      priority: "high",
+      ...(networkId ? { network_id: networkId } : {}),
+    }),
+  });
+  return { response, body: await response.json() as any };
+}
+
+describe("POST /api/task single-network resolution (#448)", () => {
+  test("admin with exactly one membership may omit network_id", async () => {
+    const marker = `x448-admin-single-${Date.now()}`;
+    const { response, body } = await post(adminSingle, marker);
+    expect([200, 202]).toContain(response.status);
+    expect(body.ok).toBe(true);
+    expect(db.get<{ network_id: string }>("SELECT network_id FROM tasks WHERE content = ?1", [marker])?.network_id)
+      .toBe(adminSingle.networkId);
+  });
+
+  test("ordinary single-network user behavior remains unchanged", async () => {
+    const marker = `x448-user-single-${Date.now()}`;
+    const { response, body } = await post(userSingle, marker);
+    expect([200, 202]).toContain(response.status);
+    expect(body.ok).toBe(true);
+    expect(db.get<{ network_id: string }>("SELECT network_id FROM tasks WHERE content = ?1", [marker])?.network_id)
+      .toBe(userSingle.networkId);
+  });
+
+  test("multi-network admin must select a network explicitly", async () => {
+    const { response, body } = await post(adminMulti, `x448-admin-multi-${Date.now()}`);
+    expect(response.status).toBe(400);
+    expect(body).toEqual({
+      ok: false,
+      error: "network_id_required",
+      message: "network_id is required when the user token has zero or multiple network memberships",
+    });
+  });
+
+  test("zero-membership admin gets the same accurate error", async () => {
+    const { response, body } = await post(adminZero, `x448-admin-zero-${Date.now()}`);
+    expect(response.status).toBe(400);
+    expect(body.error).toBe("network_id_required");
+    expect(body.message).toContain("zero or multiple network memberships");
+  });
+
+  test("multi-network admin can still select an explicit member network", async () => {
+    const marker = `x448-admin-explicit-${Date.now()}`;
+    const { response, body } = await post(adminMulti, marker, adminMulti.networkId);
+    expect([200, 202]).toContain(response.status);
+    expect(body.ok).toBe(true);
+  });
+});

package/src/tasks-pagination-http.test.ts

@@ -0,0 +1,137 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-task-pagination-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let db: typeof import("./db.js").db;
+let register: typeof import("./auth.js").register;
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let tokenA = "";
+let networkA = "";
+let networkB = "";
+
+function seedTask(
+  taskId: string,
+  networkId: string,
+  toName: string,
+  createdAt: string,
+): void {
+  db.run(
+    `INSERT INTO tasks
+       (task_id, from_name, to_name, priority, status, content, network_id, created_at)
+     VALUES (?1, 'sender', ?2, 'normal', 'delivered', ?1, ?3, ?4)`,
+    [taskId, toName, networkId, createdAt],
+  );
+}
+
+beforeAll(async () => {
+  ({ db } = await import("./db.js"));
+  ({ register } = await import("./auth.js"));
+  const b = register(`page_b_${Date.now()}`, "PageTest-B-Strong!", undefined, "seed-b");
+  // The first registered user is the instance admin and may read all
+  // networks. Register the foreign fixture first so tokenA exercises the
+  // ordinary member-scoped path rather than the admin bypass.
+  const a = register(`page_a_${Date.now()}`, "PageTest-A-Strong!", undefined, "seed-a");
+  expect(a.ok).toBe(true);
+  expect(b.ok).toBe(true);
+  tokenA = a.token!;
+  networkA = a.network_id!;
+  networkB = b.network_id!;
+
+  seedTask("a-new", networkA, "agent-a", "2026-01-04 00:00:00");
+  seedTask("tie-z", networkA, "agent-a", "2026-01-05 00:00:00");
+  seedTask("tie-y", networkA, "agent-a", "2026-01-05 00:00:00");
+  seedTask("tie-x", networkA, "agent-a", "2026-01-05 00:00:00");
+  seedTask("a-cursor", networkA, "agent-a", "2026-01-03 00:00:00");
+  seedTask("a-old-2", networkA, "agent-a", "2026-01-02 00:00:00");
+  seedTask("a-old-1", networkA, "agent-b", "2026-01-01 00:00:00");
+  seedTask("b-old", networkB, "agent-a", "2026-01-02 12:00:00");
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+async function list(query: string): Promise<{ response: Response; body: any }> {
+  const response = await fetch(`${base}/api/tasks?skip_stats=1&${query}`, {
+    headers: { Authorization: `Bearer ${tokenA}` },
+  });
+  return { response, body: await response.json() };
+}
+
+describe("GET /api/tasks cursor pagination", () => {
+  test("before is exclusive and remains network-scoped", async () => {
+    const { response, body } = await list("before=2026-01-03%2000%3A00%3A00&limit=20");
+    expect(response.status).toBe(200);
+    expect(body.tasks.map((row: any) => row.task_id)).toEqual(["a-old-2", "a-old-1"]);
+    expect(body.tasks.some((row: any) => row.task_id === "a-cursor")).toBe(false);
+    expect(body.tasks.some((row: any) => row.task_id === "b-old")).toBe(false);
+  });
+
+  test("ISO cursor normalizes to SQLite UTC and composes with to_name", async () => {
+    const { body } = await list("before=2026-01-03T00%3A00%3A00Z&to_name=agent-a&limit=20");
+    expect(body.tasks.map((row: any) => row.task_id)).toEqual(["a-old-2"]);
+  });
+
+  test("before_task_id preserves rows that share the cursor second", async () => {
+    const first = await list("limit=2");
+    expect(first.body.tasks.map((row: any) => row.task_id)).toEqual(["tie-z", "tie-y"]);
+    const cursor = first.body.tasks.at(-1);
+    const second = await list(
+      `before=${encodeURIComponent(cursor.created_at)}&before_task_id=${encodeURIComponent(cursor.task_id)}&limit=20`,
+    );
+    expect(second.response.status).toBe(200);
+    expect(second.body.tasks.map((row: any) => row.task_id)).toEqual([
+      "tie-x",
+      "a-new",
+      "a-cursor",
+      "a-old-2",
+      "a-old-1",
+    ]);
+  });
+
+  test("omitting before preserves the existing response shape and newest-first order", async () => {
+    const { body } = await list("limit=20");
+    expect(body.ok).toBe(true);
+    expect(body.count).toBe(7);
+    expect(body.tasks.map((row: any) => row.task_id)).toEqual([
+      "tie-z",
+      "tie-y",
+      "tie-x",
+      "a-new",
+      "a-cursor",
+      "a-old-2",
+      "a-old-1",
+    ]);
+    expect(body.stats).toBeUndefined();
+  });
+
+  test("empty, malformed, and rolled-over cursors fail closed", async () => {
+    for (const cursor of ["", "not-a-time", "2026-02-31 00:00:00"]) {
+      const { response, body } = await list(`before=${encodeURIComponent(cursor)}`);
+      expect(response.status).toBe(400);
+      expect(body).toEqual({ ok: false, error: "invalid_before" });
+    }
+  });
+
+  test("before_task_id requires a valid timestamp cursor and task id", async () => {
+    for (const query of [
+      "before_task_id=tie-y",
+      "before=2026-01-05%2000%3A00%3A00&before_task_id=",
+      `before=2026-01-05%2000%3A00%3A00&before_task_id=${"x".repeat(257)}`,
+    ]) {
+      const { response, body } = await list(query);
+      expect(response.status).toBe(400);
+      expect(body).toEqual({ ok: false, error: "invalid_before_task_id" });
+    }
+  });
+});