@thaut/claude-ide 0.0.0-stage → 1.0.0

package/server/http-channel-push.test.ts

@@ -0,0 +1,364 @@
+import { test, after, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { channelFixture, until } from "./http-channel-test-fixture.ts";
+
+const fixture = await channelFixture();
+afterEach(() => fixture.reset());
+after(() => fixture.close());
+
+test("complete text blocks push once with IDs, even when API message IDs match; deltas/thinking/subagents do not", async () => {
+  const posts: Record<string, any>[] = [];
+  const endpoint = await fixture.http(async (request, response) => {
+    assert.equal(request.method, "POST");
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    posts.push(JSON.parse(body));
+    response.end("ok");
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "push", url: endpoint.url });
+  const binding = fixture.store.createBinding(session, source.id, "push");
+  manager.activate(binding.id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const query = fixture.queryFor(session)!;
+  const first = fixture.text(fixture.id(), "first");
+  query.push({ type: "stream_event", parent_tool_use_id: null, event: { type: "message_start", message: { id: "api-message" } } });
+  query.push({ type: "stream_event", parent_tool_use_id: null, event: { type: "content_block_delta", index: 0, delta: { type: "text_delta", text: "delta must not push" } } });
+  query.push(first);
+  query.push(first);
+  query.push(fixture.text(fixture.id(), "second"));
+  query.push({ ...fixture.text(fixture.id(), "subagent"), parent_tool_use_id: "agent-tool" });
+  query.push({ ...fixture.text(fixture.id(), "thinking"), message: { id: "thinking", model: "mock", content: [{ type: "thinking", thinking: "hidden" }] } });
+  await until(() => posts.length === 2 && manager.info(session).bindings[0]!.stats!.delivered === 2);
+  assert.deepEqual(posts.map((post) => post.text), ["first", "second"]);
+  assert.ok(posts.every((post) => post.kind === "text" && post.sessionId === session && typeof post.id === "string"));
+  assert.notEqual(posts[0]!.id, posts[1]!.id);
+  assert.equal(manager.info(session).bindings[0]!.stats!.duplicates, 1);
+});
+
+test("a stalled receiver does not block SDK output, and each registration preserves order", async () => {
+  const texts: string[] = [];
+  let release: (() => void) | undefined;
+  const endpoint = await fixture.http(async (request, response) => {
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    texts.push(JSON.parse(body).text);
+    if (texts.length === 1) release = () => response.end();
+    else response.end();
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "slow", url: endpoint.url });
+  manager.activate(fixture.store.createBinding(session, source.id, "push").id);
+  const live = await fixture.sessions.getOrCreate(session, fixture.tmp);
+  await live.wake();
+  const query = fixture.queryFor(session)!;
+  query.push(fixture.text(fixture.id(), "one"));
+  await until(() => !!release);
+  query.push(fixture.text(fixture.id(), "two"));
+  await until(() => live.events.filter((event) => event.ev.k === "sdk" && event.ev.m.type === "assistant").length === 2);
+  assert.deepEqual(texts, ["one"]);
+  release!();
+  await until(() => texts.length === 2);
+  assert.deepEqual(texts, ["one", "two"]);
+});
+
+test("push failures are counted without retries", async () => {
+  let posts = 0;
+  const endpoint = await fixture.http((_request, response) => { posts++; response.statusCode = 500; response.end(); });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "failed", url: endpoint.url });
+  manager.activate(fixture.store.createBinding(session, source.id, "push").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  fixture.queryFor(session)!.push(fixture.text(fixture.id(), "try once"));
+  await until(() => manager.info(session).bindings[0]!.stats!.dropped === 1);
+  await new Promise((resolve) => setTimeout(resolve, 50));
+  assert.equal(posts, 1);
+  assert.equal(manager.info(session).bindings[0]!.stats!.lastError, "HTTP 500");
+});
+
+test("source rename retains queued pushes and frame-ID deduplication", async () => {
+  const posts: string[] = [];
+  let release: (() => void) | undefined;
+  const endpoint = await fixture.http(async (request, response) => {
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    posts.push(JSON.parse(body).text);
+    if (posts.length === 1) release = () => response.end();
+    else response.end();
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "before", url: endpoint.url });
+  manager.activate(fixture.store.createBinding(session, source.id, "push").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const query = fixture.queryFor(session)!;
+  const first = fixture.text(fixture.id(), "one");
+  query.push(first);
+  await until(() => !!release);
+  query.push(fixture.text(fixture.id(), "two"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 2);
+  fixture.store.saveSource({ name: "after", url: endpoint.url }, source.id);
+  manager.sourceChanged(source.id);
+  assert.equal(manager.info(session).bindings[0]!.stats!.pending, 2);
+  query.push(first);
+  await until(() => manager.info(session).bindings[0]!.stats!.duplicates === 1);
+  release!();
+  await until(() => manager.info(session).bindings[0]!.stats!.delivered === 2);
+  assert.deepEqual(posts, ["one", "two"]);
+});
+
+test("push Content-Type is always a single application/json, including legacy configured headers", async () => {
+  let contentType: string | undefined;
+  const endpoint = await fixture.http((request, response) => {
+    contentType = request.headers["content-type"];
+    response.end();
+  });
+  const source = fixture.store.saveSource({ name: "JSON", url: endpoint.url, headers: { "cOnTeNt-TyPe": "text/plain", Authorization: "Bearer test" } });
+  assert.equal(new Headers(JSON.parse(source.headers_json)).has("content-type"), false);
+  // Old persisted configurations must not bypass the fixed protocol header either.
+  fixture.db.prepare("UPDATE http_sources SET headers_json=? WHERE id=?").run(JSON.stringify({ "Content-Type": "text/plain", Authorization: "Bearer test" }), source.id);
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  manager.activate(fixture.store.createBinding(session, source.id, "push").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  fixture.queryFor(session)!.push(fixture.text(fixture.id(), "JSON body"));
+  await until(() => contentType !== undefined);
+  assert.equal(contentType, "application/json");
+});
+
+test("per-source extra body merges KOOK fields and substitutes escaped text without changing protocol fields", async () => {
+  const posts: Record<string, any>[] = [];
+  const endpoint = await fixture.http(async (request, response) => {
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    assert.equal(request.headers["content-type"], "application/json");
+    posts.push(JSON.parse(body));
+    response.end();
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const plain = fixture.store.saveSource({ name: "plain", url: endpoint.url });
+  const custom = fixture.store.saveSource({ name: "KOOK", url: endpoint.url, extraBody: {
+    type: 9, target_id: "channel-id", content: "{{text}}", nonce: "{{id}}",
+    nested: { session: "{{sessionId}}", items: [true, 42, null, "prefix: {{text}}"] },
+  } });
+  for (const source of [plain, custom]) manager.activate(fixture.store.createBinding(session, source.id, "push").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const text = 'quotes " and newline\nbackslash \\ literal {{id}} 中文';
+  fixture.queryFor(session)!.push(fixture.text(fixture.id(), text));
+  await until(() => posts.length === 2 && manager.info(session).bindings.every((binding) => binding.stats!.delivered === 1));
+  const plainPost = posts.find((post) => !post.target_id)!;
+  const kook = posts.find((post) => post.target_id)!;
+  assert.equal(kook.type, 9);
+  assert.equal(kook.target_id, "channel-id");
+  assert.equal(kook.content, text);
+  assert.equal(kook.nonce, plainPost.id);
+  assert.deepEqual(kook.nested, { session, items: [true, 42, null, `prefix: ${text}`] });
+  assert.deepEqual({ kind: kook.kind, id: kook.id, text: kook.text, sessionId: kook.sessionId }, plainPost);
+});
+
+test("editing extra body applies to new messages and bounds template expansion", async () => {
+  const posts: Record<string, any>[] = [];
+  const endpoint = await fixture.http(async (request, response) => {
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    posts.push(JSON.parse(body));
+    response.end();
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "extra", url: endpoint.url, extraBody: { target_id: "before", content: "{{text}}" } });
+  const binding = fixture.store.createBinding(session, source.id, "push");
+  manager.activate(binding.id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const query = fixture.queryFor(session)!;
+  query.push(fixture.text(fixture.id(), "first"));
+  await until(() => manager.info(session).bindings[0]!.stats!.delivered === 1);
+  fixture.store.saveSource({ name: source.name, url: source.url, extraBody: { target_id: "after", content: "{{text}}" } }, source.id);
+  manager.sourceChanged(source.id);
+  query.push(fixture.text(fixture.id(), "second"));
+  await until(() => manager.info(session).bindings[0]!.stats!.delivered === 2);
+  assert.deepEqual(posts.map((post) => post.target_id), ["before", "after"]);
+  fixture.store.saveSource({ name: source.name, url: source.url, extraBody: { content: "{{text}}".repeat(100) } }, source.id);
+  manager.sourceChanged(source.id);
+  query.push(fixture.text(fixture.id(), "x".repeat(64 * 1024)));
+  await until(() => manager.info(session).bindings[0]!.stats!.dropped === 1);
+  assert.match(manager.info(session).bindings[0]!.stats!.lastError!, /256KB/);
+  assert.equal(posts.length, 2);
+});
+
+test("queued brain-api pushes keep matching destinations, credentials, brain IDs and voices across config edits", async () => {
+  const posts: { server: string; authorization?: string; voice: string | string[] | undefined; body: unknown }[] = [];
+  let release: (() => void) | undefined;
+  const receiver = (server: string) => async (request: import("node:http").IncomingMessage, response: import("node:http").ServerResponse) => {
+    let raw = "";
+    for await (const chunk of request) raw += chunk;
+    if (request.url === "/agent-to-brain") {
+      posts.push({ server, authorization: request.headers.authorization, voice: request.headers["x-brain-voice"], body: JSON.parse(raw) });
+      if (posts.length === 1) { release = () => response.end('{"kind":"empty"}'); return; }
+    }
+    response.end('{"kind":"empty"}');
+  };
+  const before = await fixture.http(receiver("before"));
+  const after = await fixture.http(receiver("after"));
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ kind: "brain-api", brainId: "old-brain", brainVoice: "old-voice", url: before.url, headers: { Authorization: "Bearer old" } });
+  manager.activate(fixture.store.createBinding(session, source.id, "subscribe").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const query = fixture.queryFor(session)!;
+  query.push(fixture.text(fixture.id(), "in flight"));
+  await until(() => !!release);
+  query.push(fixture.text(fixture.id(), "queued"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 2);
+  fixture.store.saveSource({ name: source.name, kind: "brain-api", brainId: "new-brain", brainVoice: "new-voice", url: after.url, headers: { Authorization: "Bearer new" } }, source.id);
+  manager.sourceChanged(source.id);
+  query.push(fixture.text(fixture.id(), "new config"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 3);
+  release!();
+  await until(() => manager.info(session).bindings[0]!.stats!.pushed === 3);
+  assert.deepEqual(posts, [
+    { server: "before", authorization: "Bearer old", voice: "old-voice", body: { brain_id: "old-brain", text: "in flight" } },
+    { server: "before", authorization: "Bearer old", voice: "old-voice", body: { brain_id: "old-brain", text: "queued" } },
+    { server: "after", authorization: "Bearer new", voice: "new-voice", body: { brain_id: "new-brain", text: "new config" } },
+  ]);
+});
+
+test("voice-only edits preserve the held poll and queued push headers, with generic headers as fallback", async () => {
+  const posts: { text: string; voice: string | string[] | undefined }[] = [];
+  let pollHeld = false;
+  let pollCancelled = false;
+  let release: (() => void) | undefined;
+  const endpoint = await fixture.http(async (request, response) => {
+    assert.equal(request.headers["content-type"], "application/json");
+    assert.equal(request.headers.authorization, "Bearer unchanged");
+    let raw = "";
+    for await (const chunk of request) raw += chunk;
+    const body = JSON.parse(raw);
+    if (request.url === "/brain-to-agent") {
+      assert.deepEqual(body, { brain_id: "test-brain" });
+      assert.equal(request.headers["x-brain-voice"], "generic-voice");
+      pollHeld = true;
+      response.on("close", () => { pollCancelled = true; });
+      return;
+    }
+    assert.equal(request.url, "/agent-to-brain");
+    assert.deepEqual(Object.keys(body).sort(), ["brain_id", "text"]);
+    posts.push({ text: body.text, voice: request.headers["x-brain-voice"] });
+    if (posts.length === 1) release = () => response.end();
+    else response.end();
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ kind: "brain-api", brainId: "test-brain", brainVoice: "voice-before", url: endpoint.url, headers: { Authorization: "Bearer unchanged", "X-Brain-Voice": "generic-voice" } });
+  manager.activate(fixture.store.createBinding(session, source.id, "subscribe").id);
+  await (await fixture.sessions.getOrCreate(session, fixture.tmp)).wake();
+  const query = fixture.queryFor(session)!;
+  query.push(fixture.text(fixture.id(), "in flight"));
+  await until(() => pollHeld && !!release);
+  query.push(fixture.text(fixture.id(), "queued before edit"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 2);
+  fixture.store.saveSource({ name: source.name, url: source.url, brainVoice: "voice-after" }, source.id);
+  manager.sourceChanged(source.id);
+  query.push(fixture.text(fixture.id(), "queued after edit"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 3);
+  fixture.store.saveSource({ name: source.name, url: source.url, brainVoice: null }, source.id);
+  manager.sourceChanged(source.id);
+  query.push(fixture.text(fixture.id(), "dedicated voice cleared"));
+  await until(() => manager.info(session).bindings[0]!.stats!.pending === 4);
+  release!();
+  await until(() => manager.info(session).bindings[0]!.stats!.pushed === 4);
+  assert.equal(pollCancelled, false);
+  assert.deepEqual(posts, [
+    { text: "in flight", voice: "voice-before" },
+    { text: "queued before edit", voice: "voice-before" },
+    { text: "queued after edit", voice: "voice-after" },
+    { text: "dedicated voice cleared", voice: "generic-voice" },
+  ]);
+});
+
+test("shared brain source keeps per-session pull IDs and push overrides isolated, including queued edits and restart", async () => {
+  const polls: { id: string; closed: boolean }[] = [];
+  const posts: { brain_id: string; text: string; voice?: string | string[] }[] = [];
+  let release: (() => void) | undefined;
+  const endpoint = await fixture.http(async (request, response) => {
+    let raw = "";
+    for await (const chunk of request) raw += chunk;
+    const body = JSON.parse(raw);
+    if (request.url === "/brain-to-agent") {
+      assert.equal(request.headers["x-brain-voice"], undefined);
+      const poll = { id: body.brain_id, closed: false };
+      polls.push(poll);
+      response.on("close", () => { poll.closed = true; });
+      return;
+    }
+    assert.equal(request.url, "/agent-to-brain");
+    posts.push({ ...body, voice: request.headers["x-brain-voice"] });
+    if (body.text === "held") release = () => response.end();
+    else response.end();
+  });
+  const manager = fixture.httpChannels;
+  const source = fixture.store.saveSource({ kind: "brain-api", brainId: "default", brainVoice: "default-voice", url: endpoint.url });
+  const first = fixture.newSession();
+  const second = fixture.newSession();
+  const inherited = fixture.store.createBinding(first, source.id, "subscribe");
+  const own = fixture.store.createBinding(second, source.id, "subscribe", { brainId: "own", brainVoice: "own-voice" });
+  manager.start();
+  manager.activate(inherited.id);
+  manager.activate(own.id);
+  await until(() => polls.length === 2);
+  assert.deepEqual(polls.map((poll) => poll.id).sort(), ["default", "own"]);
+  await (await fixture.sessions.getOrCreate(first, fixture.tmp)).wake();
+  await (await fixture.sessions.getOrCreate(second, fixture.tmp)).wake();
+  const firstQuery = fixture.queryFor(first)!;
+  const secondQuery = fixture.queryFor(second)!;
+  firstQuery.push(fixture.text(fixture.id(), "inherited"));
+  secondQuery.push(fixture.text(fixture.id(), "held"));
+  await until(() => !!release && posts.length === 2);
+  secondQuery.push(fixture.text(fixture.id(), "queued"));
+  await until(() => manager.info(second).bindings[0]!.stats!.pending === 2);
+  manager.updateBinding(own.id, { brainId: "new-own", brainVoice: "" });
+  await until(() => polls.some((poll) => poll.id === "new-own"));
+  assert.equal(polls.find((poll) => poll.id === "own")!.closed, true);
+  assert.equal(polls.find((poll) => poll.id === "default")!.closed, false);
+  secondQuery.push(fixture.text(fixture.id(), "after edit"));
+  await until(() => manager.info(second).bindings[0]!.stats!.pending === 3);
+  release!();
+  await until(() => posts.length === 4);
+  assert.deepEqual(posts.find((post) => post.text === "inherited"), { brain_id: "default", text: "inherited", voice: "default-voice" });
+  assert.deepEqual(posts.filter((post) => post.text !== "inherited"), [
+    { brain_id: "own", text: "held", voice: "own-voice" },
+    { brain_id: "own", text: "queued", voice: "own-voice" },
+    { brain_id: "new-own", text: "after edit", voice: undefined },
+  ]);
+  // Source edits do not restart an overridden poll. Inheritors move to the new ID.
+  const ownPoll = polls.find((poll) => poll.id === "new-own")!;
+  fixture.store.saveSource({ url: source.url, brainId: "next-default", brainVoice: "next-voice" }, source.id);
+  manager.sourceChanged(source.id);
+  await until(() => polls.some((poll) => poll.id === "next-default"));
+  assert.equal(ownPoll.closed, false);
+  manager.updateBinding(own.id, { brainId: null, brainVoice: null });
+  await until(() => polls.filter((poll) => poll.id === "next-default").length === 2);
+  secondQuery.push(fixture.text(fixture.id(), "inherit again"));
+  await until(() => posts.length === 5);
+  assert.deepEqual(posts[4], { brain_id: "next-default", text: "inherit again", voice: "next-voice" });
+  manager.updateBinding(own.id, { brainId: "restored", brainVoice: "restored-voice" });
+  manager.stop();
+  manager.start();
+  await until(() => polls.filter((poll) => poll.id === "restored").length >= 1 && polls.filter((poll) => poll.id === "next-default").length >= 3);
+  secondQuery.push(fixture.text(fixture.id(), "after restart"));
+  await until(() => posts.length === 6);
+  assert.deepEqual(posts[5], { brain_id: "restored", text: "after restart", voice: "restored-voice" });
+});

package/server/http-channel-registration.test.ts

@@ -0,0 +1,291 @@
+import { test, after, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { channelFixture, until } from "./http-channel-test-fixture.ts";
+
+const fixture = await channelFixture();
+afterEach(() => fixture.reset());
+after(() => fixture.close());
+
+test("source and registration CRUD persist configuration without returning auth headers", async () => {
+  const { app, project, newSession, httpChannels } = fixture;
+  httpChannels.start();
+  const response = await app.request("/api/http-channels/sources", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "local", url: "http://127.0.0.1:1", headers: { Authorization: "Bearer private-test-token" } }) });
+  assert.equal(response.status, 201);
+  const source = await response.json();
+  assert.equal(source.hasHeaders, true);
+  const session = newSession();
+  const body = { sourceId: source.id, direction: "push" };
+  const path = `/api/projects/${project.id}/sessions/${session}/http-bindings`;
+  const bindingResponse = await app.request(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  assert.equal(bindingResponse.status, 201);
+  const binding = await bindingResponse.json();
+  assert.equal((await app.request(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })).status, 409);
+  const listing = await (await app.request("/api/http-channels")).json();
+  assert.equal(listing.bindings[0].active, false);
+  assert.ok(!JSON.stringify(listing).includes("private-test-token"));
+  const edit = await app.request(`/api/http-channels/sources/${source.id}`, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "updated", url: source.url }) });
+  assert.equal(edit.status, 200);
+  assert.ok(fixture.store.sourceRow(source.id)!.headers_json.includes("private-test-token"));
+  const detailsResponse = await app.request(`/api/http-channels/sources/${source.id}`);
+  assert.equal(detailsResponse.status, 200);
+  assert.equal(detailsResponse.headers.get("cache-control"), "no-store");
+  assert.deepEqual((await detailsResponse.json()).headers, { authorization: "Bearer private-test-token" });
+  assert.equal((await app.request(`/api/http-channels/bindings/${binding.id}/activation`, { method: "POST", headers: { "content-type": "application/json" }, body: '{"active":true}' })).status, 200);
+  assert.equal(httpChannels.info().activeCount, 1);
+  assert.equal((await app.request(`/api/http-channels/sources/${source.id}`, { method: "DELETE" })).status, 200);
+  assert.equal(httpChannels.info().activeCount, 0);
+  assert.equal(httpChannels.info().bindings.length, 0);
+});
+
+test("editing headers reads back replacements and clears them without affecting the fixed JSON content type", async () => {
+  const { app } = fixture;
+  const source = fixture.store.saveSource({ name: "headers", url: "http://127.0.0.1:1", headers: { Authorization: "Bearer before" } });
+  const path = `/api/http-channels/sources/${source.id}`;
+  const replaced = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, headers: { Authorization: "Bearer after", "X-API-Key": "example", "Content-Type": "text/plain" } }) });
+  assert.equal(replaced.status, 200);
+  const readback = await (await app.request(path)).json();
+  assert.deepEqual(readback.headers, { authorization: "Bearer after", "x-api-key": "example" });
+  const cleared = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, headers: {} }) });
+  assert.equal(cleared.status, 200);
+  const empty = await (await app.request(path)).json();
+  assert.equal(empty.hasHeaders, false);
+  assert.deepEqual(empty.headers, {});
+});
+
+test("extra body persists, reads back, preserves omitted updates, clears and rejects invalid objects", async () => {
+  const { app } = fixture;
+  const input = { name: "extra", url: "http://127.0.0.1:1", extraBody: { target_id: "channel", content: "{{text}}", nested: { enabled: true, values: [1, null] } } };
+  const created = await app.request("/api/http-channels/sources", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(input) });
+  assert.equal(created.status, 201);
+  const source = await created.json();
+  assert.equal(source.hasExtraBody, true);
+  const path = `/api/http-channels/sources/${source.id}`;
+  assert.deepEqual((await (await app.request(path)).json()).extraBody, input.extraBody);
+  const renamed = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "renamed", url: source.url }) });
+  assert.equal(renamed.status, 200);
+  assert.deepEqual((await (await app.request(path)).json()).extraBody, input.extraBody);
+  for (const extraBody of [null, [], "text", { id: "overwrite" }, { text: "overwrite" }, { sessionId: "overwrite" }, { kind: "overwrite" }, { big: "x".repeat(16_384) }]) {
+    const invalid = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, extraBody }) });
+    assert.equal(invalid.status, 400);
+  }
+  const cleared = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, extraBody: {} }) });
+  assert.equal(cleared.status, 200);
+  const details = await (await app.request(path)).json();
+  assert.equal(details.hasExtraBody, false);
+  assert.deepEqual(details.extraBody, {});
+});
+
+test("subscription method defaults to GET, persists POST across omitted updates and validates input", async () => {
+  const { app } = fixture;
+  const source = fixture.store.saveSource({ name: "method", url: "http://127.0.0.1:1" });
+  assert.equal(source.subscribe_method, "GET");
+  const path = `/api/http-channels/sources/${source.id}`;
+  const update = (body: object) => app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, ...body }) });
+  assert.equal((await update({ subscribeMethod: "POST", extraBody: { brain_id: "genkigirl" } })).status, 200);
+  assert.equal((await (await app.request(path)).json()).subscribeMethod, "POST");
+  assert.equal((await update({ name: "renamed" })).status, 200);
+  assert.equal((await (await app.request(path)).json()).subscribeMethod, "POST");
+  for (const subscribeMethod of ["PUT", "post", "", null, 0]) assert.equal((await update({ subscribeMethod })).status, 400);
+});
+
+test("brain-api accepts optional source defaults, persists its type and registers both directions as one subscription", async () => {
+  const { app } = fixture;
+  const create = (body: object) => app.request("/api/http-channels/sources", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  for (const brainId of [42, "x".repeat(257)]) {
+    assert.equal((await create({ kind: "brain-api", brainId, brainVoice: "optional-voice", url: "http://127.0.0.1:1" })).status, 400);
+  }
+  for (const brainId of [undefined, null, "", "   "]) {
+    const response = await create({ kind: "brain-api", brainId, url: "http://127.0.0.1:1" });
+    assert.equal(response.status, 201);
+    const source = await response.json();
+    assert.equal(source.brainId, null);
+    assert.equal(source.name, "brain-api");
+  }
+  const created = await create({ kind: "brain-api", brainId: " genkigirl ", url: "http://127.0.0.1:1" });
+  assert.equal(created.status, 201);
+  const source = await created.json();
+  assert.equal(source.kind, "brain-api");
+  assert.equal(source.brainId, "genkigirl");
+  assert.equal(source.brainVoice, null);
+  assert.equal(source.subscribeMethod, "POST");
+  assert.ok(source.name.includes("genkigirl"));
+  const path = `/api/http-channels/sources/${source.id}`;
+  assert.equal((await (await app.request(path)).json()).brainId, "genkigirl");
+  const renamed = await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: "renamed", url: source.url }) });
+  assert.equal(renamed.status, 200);
+  assert.equal((await (await app.request(path)).json()).kind, "brain-api");
+  assert.equal((await (await app.request(path)).json()).brainId, "genkigirl");
+  assert.equal((await app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ kind: "http", name: "changed", url: source.url }) })).status, 400);
+  const session = fixture.newSession();
+  const registrationPath = `/api/projects/${fixture.project.id}/sessions/${session}/http-bindings`;
+  const register = (direction: string) => app.request(registrationPath, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ sourceId: source.id, direction }) });
+  assert.equal((await register("push")).status, 400);
+  assert.equal((await register("subscribe")).status, 201);
+  assert.equal((await register("subscribe")).status, 409);
+  assert.equal(fixture.httpChannels.info().bindings.length, 1);
+});
+
+test("brain binding overrides round-trip, preserve omitted updates and explicitly clear or inherit voice", async () => {
+  const source = fixture.store.saveSource({ kind: "brain-api", url: "http://127.0.0.1:1", brainId: "default", brainVoice: "default-voice" });
+  const session = fixture.newSession();
+  const path = `/api/projects/${fixture.project.id}/sessions/${session}/http-bindings`;
+  const created = await fixture.app.request(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ sourceId: source.id, direction: "subscribe", brainId: " own ", brainVoice: " own-voice " }) });
+  assert.equal(created.status, 201);
+  const { id } = await created.json();
+  const row = () => fixture.store.bindingRow(id)!;
+  const edit = (body: object) => fixture.app.request(`/api/http-channels/bindings/${id}`, { method: "PATCH", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  assert.equal(row().brain_id, "own");
+  assert.equal(row().brain_voice, "own-voice");
+  assert.equal((await edit({ brainVoice: "" })).status, 200);
+  assert.equal(row().brain_id, "own");
+  assert.equal(row().brain_voice, "");
+  const listing = fixture.httpChannels.info(session).bindings[0]!;
+  assert.equal(listing.brainId, "own");
+  assert.equal(listing.brainVoice, "");
+  for (const invalid of [{ brainId: 42 }, { brainId: "x".repeat(257) }, { brainVoice: 42 }, { brainVoice: "voice\r\ninjected" }, { brainVoice: "x".repeat(1025) }]) {
+    assert.equal((await edit(invalid)).status, 400);
+    assert.equal(row().brain_id, "own");
+    assert.equal(row().brain_voice, "");
+  }
+  assert.equal((await edit({ brainId: null, brainVoice: null })).status, 200);
+  assert.deepEqual(fixture.store.effectiveBrain(source, row()), { brainId: "default", brainVoice: "default-voice" });
+  assert.equal(fixture.store.sourceRow(source.id)!.brain_id, "default");
+  const plain = fixture.store.saveSource({ name: "plain", url: source.url });
+  assert.throws(() => fixture.store.createBinding(fixture.newSession(), plain.id, "push", { brainId: "wrong-kind" }), /只有 brain-api/);
+});
+
+test("missing effective brain_id cannot activate or evict another binding; clearing a source only deactivates inheritors", () => {
+  const manager = fixture.httpChannels;
+  manager.start();
+  const source = fixture.store.saveSource({ kind: "brain-api", url: "http://127.0.0.1:1" });
+  const inherited = fixture.store.createBinding(fixture.newSession(), source.id, "subscribe");
+  const explicit = fixture.store.createBinding(fixture.newSession(), source.id, "subscribe", { brainId: "own" });
+  assert.throws(() => manager.activate(inherited.id), /填写 brain_id/);
+  assert.equal(fixture.store.bindingRow(inherited.id)!.active, 0);
+  fixture.store.saveSource({ url: source.url, brainId: "default" }, source.id);
+  manager.sourceChanged(source.id);
+  manager.activate(inherited.id);
+  manager.activate(explicit.id);
+  fixture.store.saveSource({ url: source.url, brainId: null }, source.id);
+  manager.sourceChanged(source.id);
+  assert.equal(fixture.store.bindingRow(inherited.id)!.active, 0);
+  assert.equal(fixture.store.bindingRow(explicit.id)!.active, 1);
+  assert.throws(() => manager.updateBinding(explicit.id, { brainId: null }), /填写 brain_id/);
+  assert.equal(fixture.store.bindingRow(explicit.id)!.brain_id, "own");
+  const plain = fixture.store.saveSource({ name: "push", url: source.url });
+  for (let i = 0; i < 31; i++) manager.activate(fixture.store.createBinding(fixture.newSession(), plain.id, "push").id);
+  assert.equal(manager.info().activeCount, 32);
+  assert.throws(() => manager.activate(inherited.id), /填写 brain_id/);
+  assert.equal(manager.info().activeCount, 32);
+  assert.equal(fixture.store.bindingRow(explicit.id)!.active, 1);
+  // Restart restoration also uses the effective configuration, preserving overrides.
+  manager.stop();
+  fixture.store.setBindingActive(inherited.id, true);
+  manager.start();
+  assert.equal(fixture.store.bindingRow(inherited.id)!.active, 0);
+  assert.match(fixture.store.bindingRow(inherited.id)!.inactive_reason!, /填写 brain_id/);
+  assert.equal(fixture.store.bindingRow(explicit.id)!.brain_id, "own");
+});
+
+test("brain-api voice round-trips, preserves omitted updates, clears and validates header values", async () => {
+  const { app } = fixture;
+  const created = await app.request("/api/http-channels/sources", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ kind: "brain-api", brainId: "test-brain", brainVoice: "  voice-before  ", url: "http://127.0.0.1:1" }) });
+  assert.equal(created.status, 201);
+  const source = await created.json();
+  const path = `/api/http-channels/sources/${source.id}`;
+  const read = async () => (await app.request(path)).json();
+  const update = (body: object) => app.request(path, { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ name: source.name, url: source.url, ...body }) });
+  assert.equal(source.brainVoice, "voice-before");
+  assert.equal(fixture.store.sourceRow(source.id)!.brain_voice, "voice-before");
+  assert.equal((await read()).brainVoice, "voice-before");
+  assert.equal((await (await app.request("/api/http-channels")).json()).sources[0].brainVoice, "voice-before");
+  assert.equal((await update({ name: "renamed" })).status, 200);
+  assert.equal((await read()).brainVoice, "voice-before");
+  const longest = "v".repeat(1024);
+  assert.equal((await update({ brainVoice: longest })).status, 200);
+  assert.equal((await read()).brainVoice, longest);
+  for (const brainVoice of [42, false, {}, [], "v".repeat(1025), "voice\r\ninjected", "voice\n", "\r\n", "voice\u0000", "voice\u007f", "中文"]) {
+    assert.equal((await update({ brainVoice })).status, 400, `must reject ${JSON.stringify(brainVoice)}`);
+    assert.equal(fixture.store.sourceRow(source.id)!.brain_voice, longest);
+  }
+  assert.equal((await update({ brainVoice: " \t " })).status, 200);
+  assert.equal((await read()).brainVoice, null);
+  assert.equal((await update({ brainVoice: "voice-after" })).status, 200);
+  assert.equal((await read()).brainVoice, "voice-after");
+  assert.equal((await update({ brainVoice: null })).status, 200);
+  assert.equal((await read()).brainVoice, null);
+  assert.equal(fixture.store.sourceRow(source.id)!.brain_voice, null);
+  const plain = fixture.store.saveSource({ name: "plain", url: source.url, brainVoice: "brain-only" });
+  assert.equal(plain.brain_voice, null);
+  assert.equal(fixture.store.sourceInfo(plain).brainVoice, null);
+});
+
+test("a brain-api subscription occupies one FIFO slot and eviction cancels its long poll", async () => {
+  let held = false;
+  let cancelled = false;
+  const endpoint = await fixture.http((_request, response) => { held = true; response.on("close", () => { cancelled = true; }); });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const brain = fixture.store.saveSource({ kind: "brain-api", brainId: "test", url: endpoint.url });
+  const oldest = fixture.store.createBinding(fixture.newSession(), brain.id, "subscribe");
+  manager.activate(oldest.id);
+  await until(() => held);
+  const plain = fixture.store.saveSource({ name: "plain", url: "http://127.0.0.1:1" });
+  for (let i = 0; i < 31; i++) manager.activate(fixture.store.createBinding(fixture.newSession(), plain.id, "push").id);
+  assert.equal(manager.info().activeCount, 32);
+  assert.equal(manager.activate(fixture.store.createBinding(fixture.newSession(), plain.id, "push").id), oldest.id);
+  await until(() => cancelled);
+  assert.equal(manager.info().activeCount, 32);
+  assert.equal(manager.info().bindings.find((binding) => binding.id === oldest.id)!.active, false);
+});
+
+test("activating a 33rd registration evicts the oldest subscription, cancelling its long poll", async () => {
+  let open = false;
+  let cancelled = false;
+  const endpoint = await fixture.http((_request, response) => {
+    open = true;
+    response.on("close", () => { cancelled = true; });
+  });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const source = fixture.store.saveSource({ name: "long-poll", url: endpoint.url });
+  const oldest = fixture.store.createBinding(fixture.newSession(), source.id, "subscribe");
+  manager.activate(oldest.id);
+  await until(() => open);
+  for (let index = 0; index < 31; index++) manager.activate(fixture.store.createBinding(fixture.newSession(), source.id, "push").id);
+  const newest = fixture.store.createBinding(fixture.newSession(), source.id, "push");
+  assert.equal(manager.activate(newest.id), oldest.id);
+  assert.equal(manager.info().activeCount, 32);
+  assert.equal(fixture.store.bindingRow(oldest.id)!.active, 0);
+  assert.equal(manager.info().bindings.find((binding) => binding.id === oldest.id)!.stats, null);
+  await until(() => cancelled);
+  assert.equal(fixture.queries.length, 0);
+});
+
+test("the oldest push can also be evicted and active registrations restore after restart", () => {
+  const source = fixture.store.saveSource({ name: "push", url: "http://127.0.0.1:1" });
+  const manager = fixture.httpChannels;
+  manager.start();
+  const ids = Array.from({ length: 33 }, () => fixture.store.createBinding(fixture.newSession(), source.id, "push").id);
+  for (const id of ids.slice(0, 32)) manager.activate(id);
+  assert.equal(manager.activate(ids[32]!), ids[0]);
+  manager.stop();
+  assert.equal(manager.info().activeCount, 0);
+  manager.start();
+  assert.equal(manager.info().activeCount, 32);
+  assert.equal(manager.info().bindings.find((binding) => binding.id === ids[0])!.active, false);
+  assert.equal(fixture.queries.length, 0);
+});
+
+test("deleting a session removes both active and inactive registrations", async () => {
+  const manager = fixture.httpChannels;
+  manager.start();
+  const session = fixture.newSession();
+  const source = fixture.store.saveSource({ name: "push", url: "http://127.0.0.1:1" });
+  const active = fixture.store.createBinding(session, source.id, "push");
+  fixture.store.createBinding(session, source.id, "subscribe");
+  manager.activate(active.id);
+  await fixture.sessions.drop(session);
+  assert.equal(manager.info(session).bindings.length, 0);
+  assert.equal(manager.info().activeCount, 0);
+});