@syengup/friday-channel-next 0.1.30 → 0.1.36

package/src/agent/media-bridge.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const saveMediaBuffer = vi.fn();
+vi.mock("openclaw/plugin-sdk/media-store", () => ({
+  saveMediaBuffer: (...args: unknown[]) => saveMediaBuffer(...args),
+}));
+
+const IMAGE_MAX = 6 * 1024 * 1024;
+const DOCUMENT_MAX = 100 * 1024 * 1024;
+vi.mock("openclaw/plugin-sdk/media-runtime", () => ({
+  mediaKindFromMime: (mime?: string) => (mime?.startsWith("image/") ? "image" : "document"),
+  maxBytesForKind: (kind: string) => (kind === "image" ? IMAGE_MAX : DOCUMENT_MAX),
+}));
+
+import { saveInboundMediaBuffer } from "./media-bridge.js";
+
+describe("saveInboundMediaBuffer", () => {
+  beforeEach(() => {
+    saveMediaBuffer.mockReset();
+  });
+
+  it("forwards the original filename so core preserves name+extension", async () => {
+    // Without the filename, core's media-store saves inbound media as a bare uuid
+    // (no extension) and the agent sees `[media attached: file://.../inbound/<uuid>]`
+    // with zero file-format signal. Passing originalFilename (5th arg) restores it.
+    saveMediaBuffer.mockResolvedValue({
+      id: "report---uuid.pdf",
+      path: "/m/inbound/report---uuid.pdf",
+    });
+
+    const out = await saveInboundMediaBuffer(Buffer.from("x"), "application/pdf", "report.pdf");
+
+    expect(saveMediaBuffer).toHaveBeenCalledWith(
+      expect.any(Buffer),
+      "application/pdf",
+      "inbound",
+      DOCUMENT_MAX,
+      "report.pdf",
+    );
+    expect(out.path).toContain(".pdf");
+  });
+
+  it("uses openclaw's per-kind byte cap instead of the 5MB save default", async () => {
+    saveMediaBuffer.mockResolvedValue({ id: "uuid.png", path: "/m/inbound/uuid.png" });
+
+    await saveInboundMediaBuffer(Buffer.from("x"), "image/png", "photo.png");
+
+    expect(saveMediaBuffer).toHaveBeenCalledWith(
+      expect.any(Buffer),
+      "image/png",
+      "inbound",
+      IMAGE_MAX,
+      "photo.png",
+    );
+  });
+
+  it("works without a filename (still applies the per-kind cap)", async () => {
+    saveMediaBuffer.mockResolvedValue({ id: "uuid", path: "/m/inbound/uuid" });
+
+    const out = await saveInboundMediaBuffer(Buffer.from("x"), "image/png");
+
+    expect(saveMediaBuffer).toHaveBeenCalledWith(
+      expect.any(Buffer),
+      "image/png",
+      "inbound",
+      IMAGE_MAX,
+      undefined,
+    );
+    expect(out.id).toBe("uuid");
+  });
+});

package/src/agent/media-bridge.ts

@@ -3,13 +3,35 @@ import os from "node:os";
 import path from "node:path";
 import crypto from "node:crypto";
 
+/**
+ * openclaw's own per-kind byte cap for a mime type (image 6MB / audio·video 16MB /
+ * document 100MB). Unknown mimes fall back to the most permissive ("document") cap.
+ * Returns undefined if the media runtime isn't importable (tests / stripped runtime),
+ * letting `saveMediaBuffer` apply its built-in default.
+ */
+export async function resolveMediaMaxBytes(mimeType: string): Promise<number | undefined> {
+  try {
+    const { maxBytesForKind, mediaKindFromMime } = await import("openclaw/plugin-sdk/media-runtime");
+    return maxBytesForKind(mediaKindFromMime(mimeType) ?? "document");
+  } catch {
+    return undefined;
+  }
+}
+
 export async function saveInboundMediaBuffer(
   buffer: Buffer,
   mimeType: string,
+  originalFilename?: string,
 ): Promise<{ id: string; path: string }> {
   try {
     const sdk = await import("openclaw/plugin-sdk/media-store");
-    const saved = await sdk.saveMediaBuffer(buffer, mimeType, "inbound");
+    // Accept whatever openclaw itself supports for this media kind instead of
+    // saveMediaBuffer's conservative 5MB default.
+    const maxBytes = await resolveMediaMaxBytes(mimeType);
+    // Pass the original filename (5th arg) so core's media-store preserves the
+    // name+extension instead of saving a bare uuid. Otherwise the agent receives
+    // `[media attached: file://.../inbound/<uuid>]` with no file-format signal.
+    const saved = await sdk.saveMediaBuffer(buffer, mimeType, "inbound", maxBytes, originalFilename);
     if (saved?.id && saved?.path) return { id: saved.id, path: saved.path };
   } catch {
     // fallback for tests or stripped runtime

package/src/agent-forward-runtime.ts

@@ -16,6 +16,15 @@ export type FridayAgentForwardRuntime = {
   }) => Promise<Record<string, unknown> | null>;
   /** Resolves an agent's workspace dir — used to read IDENTITY.md for the name fallback. */
   resolveAgentWorkspaceDir?: (cfg: unknown, agentId: string) => string;
+  /**
+   * Resolves the thinking-level options + default for a provider/model pair, driven by the running
+   * gateway's provider plugins + model catalog (so the option set varies per model). Optional: older
+   * gateways don't expose it, in which case callers fall back to the base five levels.
+   */
+  resolveThinkingPolicy?: (params: { provider?: string | null; model?: string | null }) => {
+    levels: Array<{ id: string; label: string }>;
+    defaultLevel?: string | null;
+  };
   getConfig: () => unknown;
 };
 
@@ -30,6 +39,8 @@ export function setFridayAgentForwardRuntime(api: OpenClawPluginApi): void {
       .updateSessionStoreEntry as FridayAgentForwardRuntime["updateSessionStoreEntry"],
     resolveAgentWorkspaceDir: (api.runtime.agent as Record<string, unknown>)
       .resolveAgentWorkspaceDir as FridayAgentForwardRuntime["resolveAgentWorkspaceDir"],
+    resolveThinkingPolicy: (api.runtime.agent as Record<string, unknown>)
+      .resolveThinkingPolicy as FridayAgentForwardRuntime["resolveThinkingPolicy"],
     getConfig: () => api.runtime.config.current(),
   };
 }

package/src/agent-id.ts

@@ -0,0 +1,24 @@
+/**
+ * Agent id normalization shared across handlers.
+ *
+ * Mirror of OpenClaw's `normalizeAgentId` (src/routing/session-key.ts): trim,
+ * lowercase, keep path/shell-safe. Empty → "main".
+ */
+
+export const DEFAULT_AGENT_ID = "main";
+
+/** Agent ids already in path/shell-safe form skip the slug rewrite below. */
+const SAFE_AGENT_ID = /^[a-z0-9][a-z0-9_-]*$/;
+
+export function normalizeAgentId(value: unknown): string {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed) return DEFAULT_AGENT_ID;
+  const lowered = trimmed.toLowerCase();
+  if (SAFE_AGENT_ID.test(lowered)) return lowered;
+  return (
+    lowered
+      .replace(/[^a-z0-9_-]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 64) || DEFAULT_AGENT_ID
+  );
+}

package/src/channel-actions.test.ts

@@ -163,6 +163,53 @@ describe("channel-actions handleSend sessionKey routing", () => {
     expect(media?.data.sessionKey).toBe(appSession);
   });
 
+  it("send with a multi-file mediaUrls[] emits one op:media per file (same runId)", async () => {
+    // The agent's `message` tool call with a structured `attachments[]` array is flattened by the
+    // OpenClaw core into `params.mediaUrls` (with `media` set to the first entry for back-compat).
+    // handleSend must emit one outbound op:media per file, not just the first.
+    const deviceId = "DEV-ACT-MULTI";
+    const runId = "run-act-multi";
+    const appSession = "agent:operator:friday:direct:dev-act-multi:1780561609";
+    registerRunRoute({ runId, deviceId, sessionKey: appSession });
+    sseEmitter.trackDeviceForRun(deviceId, runId);
+    const res = connect(deviceId);
+
+    const files = ["A.swift", "B.swift", "C.swift"].map((name) => {
+      const p = path.join(historyDir, name);
+      fs.writeFileSync(p, `// ${name}`);
+      return p;
+    });
+
+    const result = await handleMessageAction({
+      action: "send",
+      params: {
+        to: deviceId,
+        message: "三个文件发给你",
+        media: files[0], // core sets `media` to the first entry
+        mediaUrls: files, // ...and the full list here
+      },
+      sessionKey: "agent:operator:main",
+    });
+
+    expect((result as { ok?: boolean }).ok).toBe(true);
+    const mediaFrames = parseOutboundFrames(res).filter(
+      (f) => f.type === "outbound" && f.data.op === "media",
+    );
+    expect(mediaFrames).toHaveLength(3);
+    // All media events share the send's runId so the app groups them into one assistant message.
+    const runIds = new Set(mediaFrames.map((f) => f.data.runId));
+    expect(runIds.size).toBe(1);
+    // Original filenames preserved (one per file, no duplicates, no drops).
+    const names = mediaFrames
+      .map((f) => (f.data.ctx as { originalMediaUrl?: string })?.originalMediaUrl)
+      .map((p) => (p ? path.basename(p) : ""));
+    expect(new Set(names)).toEqual(new Set(["A.swift", "B.swift", "C.swift"]));
+    for (const f of mediaFrames) {
+      expect(String(f.data.mediaUrl)).toMatch(/^\/friday-next\/files\//);
+      expect(f.data.sessionKey).toBe(appSession);
+    }
+  });
+
   it("falls back to ctx.sessionKey when the device has no active run-route", async () => {
     const deviceId = "DEV-ACT-2";
     const res = connect(deviceId);

package/src/channel-actions.ts

@@ -36,6 +36,21 @@ function pickString(params: Record<string, unknown>, keys: string[]): string {
   return "";
 }
 
+function pickStringArray(params: Record<string, unknown>, key: string): string[] {
+  const v = params[key];
+  if (!Array.isArray(v)) return [];
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of v) {
+    if (typeof entry !== "string") continue;
+    const trimmed = entry.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+
 async function readMediaFile(
   mediaPath: string,
   ctx: MessageActionCtx,
@@ -101,26 +116,35 @@ async function handleSend(ctx: MessageActionCtx): Promise<unknown> {
     );
   }
 
-  // Resolve media from an inline base64 buffer or a path/url reference. (`attachments[]` arrays are
-  // normalized by the OpenClaw core and arrive via outbound.sendMedia, so they're not handled here.)
-  let media: { buffer: Buffer; mimeType: string } | null = null;
-  let originalMediaUrl = "";
-  if (inlineBase64) {
-    media = decodeBase64Media(
+  // Resolve the media to send. A `message` tool call with a structured `attachments[]` array is
+  // flattened by the OpenClaw core into `params.mediaUrls` (with `media` set to the first entry for
+  // back-compat), so prefer the full list; fall back to a single inline base64 buffer or a
+  // path/url reference for the single-attachment / direct-link / buffer cases.
+  const mediaSources: { buffer: Buffer; mimeType: string; originalMediaUrl: string }[] = [];
+  const mediaUrls = pickStringArray(ctx.params, "mediaUrls");
+  if (mediaUrls.length > 0) {
+    for (const ref of mediaUrls) {
+      const loaded = await readMediaFile(ref, ctx);
+      if (loaded) mediaSources.push({ ...loaded, originalMediaUrl: ref });
+    }
+  } else if (inlineBase64) {
+    const loaded = decodeBase64Media(
       inlineBase64,
       mediaMimeHint || (filename ? guessMimeType(filename) : ""),
     );
-    originalMediaUrl = filename || "inline-buffer";
+    if (loaded) mediaSources.push({ ...loaded, originalMediaUrl: filename || "inline-buffer" });
   } else if (mediaPath) {
-    media = await readMediaFile(mediaPath, ctx);
-    originalMediaUrl = mediaPath;
+    const loaded = await readMediaFile(mediaPath, ctx);
+    if (loaded) mediaSources.push({ ...loaded, originalMediaUrl: mediaPath });
   }
 
-  // Send media via SSE outbound
-  if (media) {
+  // Send each media via its own SSE outbound event. They all share this send's `runId` so the app
+  // groups them into a single assistant message (first → attachment, rest → extra attachments).
+  if (mediaSources.length > 0) {
     const { saveMediaBuffer } = await import("openclaw/plugin-sdk/media-store");
-    const saved = await saveMediaBuffer(media.buffer, media.mimeType, "inbound");
-    if (saved.id) {
+    for (const source of mediaSources) {
+      const saved = await saveMediaBuffer(source.buffer, source.mimeType, "inbound");
+      if (!saved.id) continue;
       const publicUrl = `/friday-next/files/${encodeURIComponent(saved.id)}`;
       sseEmitter.broadcast(
         {
@@ -134,7 +158,7 @@ async function handleSend(ctx: MessageActionCtx): Promise<unknown> {
             audioAsVoice: false,
             caption: caption || text,
             mediaUrl: publicUrl,
-            ctx: { to, text: caption || text, originalMediaUrl },
+            ctx: { to, text: caption || text, originalMediaUrl: source.originalMediaUrl },
           },
         },
         to,

package/src/channel.lifecycle.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { fridayNextChannelPlugin } from "./channel.js";
+
+/**
+ * friday-next is a passive HTTP+SSE channel whose routes live on the shared gateway server.
+ * It still MUST keep its account lifecycle pending (running:true) so the core health-monitor
+ * does not poll it as "stopped" and restart it every few minutes. A stopped account drops out
+ * of the deliverable-channel registry, so an agent `message` send landing in that window fails
+ * with `Unknown channel: friday-next`. See gateway.startAccount keep-alive in channel.ts.
+ */
+describe("friday-next channel gateway lifecycle", () => {
+  it("exposes a startAccount keep-alive that stays pending until abort", async () => {
+    const gateway = (fridayNextChannelPlugin as { gateway?: { startAccount?: unknown } }).gateway;
+    expect(gateway?.startAccount).toBeTypeOf("function");
+
+    const startAccount = gateway!.startAccount as (ctx: {
+      accountId: string;
+      abortSignal: AbortSignal;
+    }) => Promise<unknown>;
+
+    const controller = new AbortController();
+    const started = startAccount({ accountId: "default", abortSignal: controller.signal });
+
+    // Must stay pending while the account is alive (so the core keeps running:true).
+    let settled = false;
+    void started.then(
+      () => {
+        settled = true;
+      },
+      () => {
+        settled = true;
+      },
+    );
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(settled).toBe(false);
+
+    // Aborting (reload / shutdown) resolves it cleanly.
+    controller.abort();
+    await expect(started).resolves.toBeUndefined();
+  });
+});

package/src/channel.ts

@@ -9,6 +9,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/core";
+import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { createFridayNextLogger } from "./logging.js";
 import type { ChannelAccountSnapshot } from "openclaw/plugin-sdk/status-helpers";
 import { saveMediaBuffer } from "openclaw/plugin-sdk/media-store";
@@ -16,6 +17,7 @@ import { sseEmitter } from "./sse/emitter.js";
 import { describeMessageActions, handleMessageAction } from "./channel-actions.js";
 import { guessMimeType, resolveMediaAttachment } from "./http/handlers/files.js";
 import { downloadRemoteMedia, isHttpUrl } from "./media-fetch.js";
+import { resolveMediaMaxBytes } from "./agent/media-bridge.js";
 import {
   resolveFridayDeviceIdForOutbound,
   resolveHistorySessionKeyForFridayDevice,
@@ -100,6 +102,22 @@ const fridayLifecycle = {
   },
 };
 
+/**
+ * friday-next is a passive HTTP+SSE channel: its routes live on the shared gateway server and
+ * SSE clients connect on demand, so there is no per-account socket or polling loop to maintain.
+ * But the core health-monitor reads the account's lifecycle `running` flag — which the framework
+ * flips to `false` the moment `startAccount` resolves/rejects. Without a long-lived startAccount
+ * the account is permanently seen as "stopped" and restarted every health poll (~5 min). A stopped
+ * account drops out of the deliverable-channel registry, so an agent `message` send landing in that
+ * window fails with `Unknown channel: friday-next`. Hold the account lifecycle open until abort
+ * (reload/shutdown) so the channel stays `running:true` and continuously deliverable.
+ */
+const fridayGateway = {
+  startAccount: async (ctx: { abortSignal: AbortSignal }): Promise<void> => {
+    await waitUntilAbort(ctx.abortSignal);
+  },
+};
+
 const fridayStatus = {
   buildAccountSnapshot: async (params: {
     account: { accountId?: string; name?: string; enabled?: boolean };
@@ -139,6 +157,7 @@ export const fridayNextChannelPlugin = createChatChannelPlugin({
     },
     config: fridayConfigAdapter,
     lifecycle: fridayLifecycle,
+    gateway: fridayGateway,
     status: fridayStatus,
     bindings: {
       compileConfiguredBinding: () => null,
@@ -275,7 +294,10 @@ export const fridayNextChannelPlugin = createChatChannelPlugin({
 
         if (buffer) {
           const mimeType = downloadedMimeType ?? guessMimeType(mediaUrl);
-          const saved = await saveMediaBuffer(buffer, mimeType, "inbound");
+          // Match what openclaw itself supports for this media kind rather than
+          // saveMediaBuffer's 5MB default.
+          const maxBytes = await resolveMediaMaxBytes(mimeType);
+          const saved = await saveMediaBuffer(buffer, mimeType, "inbound", maxBytes);
           if (saved.id) {
             const fileUrl = `/friday-next/files/${encodeURIComponent(saved.id)}`;
             const resolved = resolveMediaAttachment(fileUrl);

package/src/http/handlers/agent-config.test.ts

@@ -0,0 +1,205 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { EventEmitter } from "node:events";
+import { Readable } from "node:stream";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { handleAgentConfig } from "./agent-config.js";
+import { setMockRuntime } from "../../test-support/mock-runtime.js";
+import {
+  setFridayAgentForwardRuntime,
+  resetFridayAgentForwardRuntimeForTest,
+} from "../../agent-forward-runtime.js";
+import { setUpgradeRuntime, resetUpgradeRuntimeForTest } from "../../upgrade-runtime.js";
+
+class MockRes extends EventEmitter {
+  statusCode = 0;
+  headers: Record<string, string> = {};
+  body = "";
+  setHeader(name: string, value: string): void {
+    this.headers[name.toLowerCase()] = value;
+  }
+  end(body?: string): void {
+    if (body) this.body += body;
+  }
+}
+
+const AUTH = { authorization: "Bearer test-token" };
+
+function makeReq(headers: Record<string, string> = {}, method = "GET", body?: unknown): any {
+  const stream = Readable.from(body === undefined ? [] : [Buffer.from(JSON.stringify(body))]);
+  return Object.assign(stream, { method, url: "/friday-next/agents/main/config", headers });
+}
+
+/** Wire both runtimes around a single mutable `config`; mutateConfigFile edits it in place. */
+function setRuntimes(config: Record<string, unknown>, workspace?: string): void {
+  setFridayAgentForwardRuntime({
+    runtime: {
+      agent: {
+        session: { resolveStorePath: () => "", loadSessionStore: () => ({}) },
+        ...(workspace ? { resolveAgentWorkspaceDir: () => workspace } : {}),
+      },
+      config: { current: () => config },
+    },
+  } as any);
+  setUpgradeRuntime({
+    runtime: {
+      system: {},
+      config: {
+        current: () => config,
+        mutateConfigFile: async ({ mutate }: { mutate: (draft: unknown) => unknown | void }) => {
+          mutate(config);
+          return config;
+        },
+      },
+    },
+    source: "/dev/path",
+  } as any);
+}
+
+describe("handleAgentConfig", () => {
+  beforeEach(() => setMockRuntime());
+  afterEach(() => {
+    resetFridayAgentForwardRuntimeForTest();
+    resetUpgradeRuntimeForTest();
+  });
+
+  it("rejects unsupported methods with 405", async () => {
+    setRuntimes({});
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "POST"), res as any, "main");
+    expect(res.statusCode).toBe(405);
+  });
+
+  it("rejects missing token with 401", async () => {
+    setRuntimes({});
+    const res = new MockRes();
+    await handleAgentConfig(makeReq({}, "GET"), res as any, "main");
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("GET returns the configured agent's editable fields", async () => {
+    setRuntimes({
+      agents: {
+        list: [
+          {
+            id: "Research Bot",
+            model: { primary: "anthropic/claude", fallbacks: ["openai/gpt-4"] },
+            thinkingDefault: "high",
+            tools: { profile: "default", deny: ["bash"], allow: ["read", "edit"] },
+            skills: ["deep-research", "verify"],
+          },
+        ],
+      },
+    });
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH), res as any, "research-bot");
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.ok).toBe(true);
+    expect(body.exists).toBe(true);
+    expect(body.model).toEqual({ primary: "anthropic/claude", fallbacks: ["openai/gpt-4"] });
+    expect(body.thinkingDefault).toBe("high");
+    expect(body.tools).toEqual({ profile: "default", allow: ["read", "edit"], deny: ["bash"] });
+    expect(body.skills).toEqual(["deep-research", "verify"]);
+  });
+
+  it("GET reports exists:false and inherited (undefined) fields for an implicit agent", async () => {
+    setRuntimes({ agents: { defaults: {} } });
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH), res as any, "main");
+    const body = JSON.parse(res.body);
+    expect(body.exists).toBe(false);
+    expect(body.model).toBeUndefined();
+    expect(body.skills).toBeUndefined();
+    expect(body.availableSkills).toEqual([]);
+  });
+
+  it("GET distinguishes [] (all skills disabled) from absent (inherit)", async () => {
+    setRuntimes({ agents: { list: [{ id: "main", skills: [] }] } });
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH), res as any, "main");
+    expect(JSON.parse(res.body).skills).toEqual([]);
+  });
+
+  it("PUT sets the model on an existing entry", async () => {
+    const config: Record<string, unknown> = { agents: { list: [{ id: "main", model: "old/model" }] } };
+    setRuntimes(config);
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { model: "openai/gpt-5" }), res as any, "main");
+    expect(res.statusCode).toBe(200);
+    const entry = (config.agents as any).list[0];
+    expect(entry.model).toBe("openai/gpt-5");
+  });
+
+  it("PUT model:null deletes the field so it inherits defaults", async () => {
+    const config: Record<string, unknown> = { agents: { list: [{ id: "main", model: "old/model" }] } };
+    setRuntimes(config);
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { model: null }), res as any, "main");
+    expect(res.statusCode).toBe(200);
+    expect("model" in (config.agents as any).list[0]).toBe(false);
+  });
+
+  it("PUT skills:[] disables all; skills:null clears the field", async () => {
+    const config: Record<string, unknown> = { agents: { list: [{ id: "main", skills: ["a"] }] } };
+    setRuntimes(config);
+
+    let res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { skills: [] }), res as any, "main");
+    expect((config.agents as any).list[0].skills).toEqual([]);
+
+    res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { skills: null }), res as any, "main");
+    expect("skills" in (config.agents as any).list[0]).toBe(false);
+  });
+
+  it("PUT creates a bare list entry for an implicit agent, never marking it default", async () => {
+    const config: Record<string, unknown> = { agents: { defaults: {} } };
+    setRuntimes(config);
+    const res = new MockRes();
+    await handleAgentConfig(
+      makeReq(AUTH, "PUT", { tools: { profile: "restricted" } }),
+      res as any,
+      "main",
+    );
+    expect(res.statusCode).toBe(200);
+    const list = (config.agents as any).list;
+    expect(list).toHaveLength(1);
+    expect(list[0].id).toBe("main");
+    expect(list[0].tools).toEqual({ profile: "restricted" });
+    expect("default" in list[0]).toBe(false);
+  });
+
+  it("PUT rejects a body with no editable fields", async () => {
+    setRuntimes({ agents: { list: [{ id: "main" }] } });
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { unrelated: 1 }), res as any, "main");
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("PUT rejects a non-array, non-null skills value", async () => {
+    setRuntimes({ agents: { list: [{ id: "main" }] } });
+    const res = new MockRes();
+    await handleAgentConfig(makeReq(AUTH, "PUT", { skills: "deep-research" }), res as any, "main");
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("GET lists skills discovered in the workspace skills/ dir (SKILL.md dirs only)", async () => {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "friday-skills-"));
+    for (const id of ["deep-research", "verify"]) {
+      fs.mkdirSync(path.join(workspace, "skills", id), { recursive: true });
+      fs.writeFileSync(path.join(workspace, "skills", id, "SKILL.md"), "# " + id);
+    }
+    // No SKILL.md → not a skill; must be ignored.
+    fs.mkdirSync(path.join(workspace, "skills", "not-a-skill"), { recursive: true });
+    try {
+      setRuntimes({ agents: { list: [{ id: "main" }] } }, workspace);
+      const res = new MockRes();
+      await handleAgentConfig(makeReq(AUTH), res as any, "main");
+      expect(JSON.parse(res.body).availableSkills.map((s: { id: string }) => s.id)).toEqual(["deep-research", "verify"]);
+    } finally {
+      fs.rmSync(workspace, { recursive: true, force: true });
+    }
+  });
+});