@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/routes/__tests__/home-feed-routes.test.ts

@@ -77,6 +77,7 @@ mock.module("../../../home/home-content-refresh.js", () => ({
 const {
   computeGreeting,
   formatRelativeTime,
+  handleBulkSetFeedItemStatus: _handleBulkSetFeedItemStatus,
   handleGetHomeFeed: _handleGetHomeFeed,
   handleListHomeFeed,
   handlePatchFeedItem: _handlePatchFeedItem,
@@ -308,11 +309,12 @@ describe("formatRelativeTime", () => {
 // ─── Route registration ────────────────────────────────────────────────────
 
 describe("homeFeedRouteDefinitions", () => {
-  test("registers GET /v1/home/feed, PATCH /v1/home/feed/:id, and POST /v1/home/feed/:id/actions/:actionId", () => {
+  test("registers GET /v1/home/feed, PATCH /v1/home/feed/:id, POST /v1/home/feed/mark-all, and POST /v1/home/feed/:id/actions/:actionId", () => {
     const routes = homeFeedRouteDefinitions();
     const endpoints = routes.map((r) => `${r.method} ${r.endpoint}`);
     expect(endpoints).toContain("GET home/feed");
     expect(endpoints).toContain("PATCH home/feed/:id");
+    expect(endpoints).toContain("POST home/feed/mark-all");
     expect(endpoints).toContain("POST home/feed/:id/actions/:actionId");
   });
 });
@@ -788,3 +790,142 @@ describe("handleListHomeFeed", () => {
     expect(result.items.map((i) => i.id)).toEqual(["alive"]);
   });
 });
+
+// ─── handleBulkSetFeedItemStatus ───────────────────────────────────────────
+
+describe("handleBulkSetFeedItemStatus", () => {
+  type BulkResult = { updatedCount: number; updatedAt: string };
+
+  test("200 with count and updatedAt when items are flipped", async () => {
+    await appendFeedItem(makeItem({ id: "n1", status: "new" }) as never);
+    await appendFeedItem(
+      makeItem({
+        id: "n2",
+        status: "new",
+        createdAt: "2026-04-14T12:00:01.000Z",
+      }) as never,
+    );
+    await appendFeedItem(
+      makeItem({
+        id: "s1",
+        status: "seen",
+        createdAt: "2026-04-14T12:00:02.000Z",
+      }) as never,
+    );
+
+    const result = (await _handleBulkSetFeedItemStatus({
+      body: { from: ["new"], to: "seen" },
+    })) as BulkResult;
+
+    expect(result.updatedCount).toBe(2);
+    expect(typeof result.updatedAt).toBe("string");
+    expect(Number.isNaN(Date.parse(result.updatedAt))).toBe(false);
+  });
+
+  test("200 with updatedCount 0 when nothing matches", async () => {
+    await appendFeedItem(makeItem({ id: "s1", status: "seen" }) as never);
+    await appendFeedItem(
+      makeItem({
+        id: "s2",
+        status: "seen",
+        createdAt: "2026-04-14T12:00:01.000Z",
+      }) as never,
+    );
+
+    const result = (await _handleBulkSetFeedItemStatus({
+      body: { from: ["new"], to: "seen" },
+    })) as BulkResult;
+
+    expect(result.updatedCount).toBe(0);
+  });
+
+  test("ids scope limits update to specified items only", async () => {
+    await appendFeedItem(makeItem({ id: "n1", status: "new" }) as never);
+    await appendFeedItem(
+      makeItem({
+        id: "n2",
+        status: "new",
+        createdAt: "2026-04-14T12:00:01.000Z",
+      }) as never,
+    );
+
+    const result = (await _handleBulkSetFeedItemStatus({
+      body: { from: ["new"], to: "seen", ids: ["n1"] },
+    })) as BulkResult;
+
+    expect(result.updatedCount).toBe(1);
+  });
+
+  test("400 on empty from array", async () => {
+    let caught: unknown;
+    try {
+      await _handleBulkSetFeedItemStatus({
+        body: { from: [], to: "seen" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(400);
+  });
+
+  test("400 on invalid to value", async () => {
+    let caught: unknown;
+    try {
+      await _handleBulkSetFeedItemStatus({
+        body: { from: ["new"], to: "bogus" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(400);
+  });
+
+  test("400 on missing body fields", async () => {
+    let caught: unknown;
+    try {
+      await _handleBulkSetFeedItemStatus({
+        body: { from: ["new"] },
+      });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(400);
+  });
+
+  test("500 when the underlying write fails", async () => {
+    const feedPath = getHomeFeedPath();
+    writeFeedFile([makeItem({ id: "n1", status: "new" })]);
+
+    const fs = await import("node:fs");
+    const originalWrite = fs.writeFileSync;
+    mock.module("node:fs", () => ({
+      ...fs,
+      writeFileSync: mock(
+        (
+          path: string,
+          data: string | NodeJS.ArrayBufferView,
+          options?: import("node:fs").WriteFileOptions,
+        ) => {
+          if (typeof path === "string" && path === feedPath) {
+            throw new Error("Simulated write failure");
+          }
+          return originalWrite(path, data, options);
+        },
+      ),
+    }));
+
+    let caught: unknown;
+    try {
+      await _handleBulkSetFeedItemStatus({
+        body: { from: ["new"], to: "seen" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(RouteError);
+    expect((caught as { statusCode: number }).statusCode).toBe(500);
+  });
+});

package/src/runtime/routes/__tests__/invite-relay-routes.test.ts

@@ -3,9 +3,8 @@
  *
  * Three CLI invite handlers (list/create/revoke) are thin relays to the gateway
  * IPC methods via `ipcCallPersistent`. These tests assert each relays with the
- * correct method + params, returns the parsed gateway response, never writes the
- * assistant invite store directly, and surfaces a relayed IpcCallError with its
- * statusCode. `invites_redeem` and `invites_trigger_call` stay daemon-local: the
+ * correct method + params, returns the parsed gateway response, and surfaces a
+ * relayed IpcCallError with its statusCode. `invites_redeem` and `invites_trigger_call` stay daemon-local: the
  * gateway delegates the actual provider call to the daemon-local handler, so
  * relaying it back would loop gateway→assistant→gateway.
  */
@@ -43,27 +42,28 @@ mock.module("../../../ipc/gateway-client.js", () => ({
   ipcCallPersistent: ipcCallPersistentMock,
 }));
 
-// Guard: fail loudly if any relayed handler still writes the assistant invite
-// store directly. The relayed CLI paths must go through the gateway only, so we
-// spy on the store's write functions and assert they are never invoked.
-const actualInviteStore = await import("../../../persistence/invite-store.js");
-
-const inviteStoreCall = mock(() => {
-  throw new Error("invite-store write must not happen on relayed CLI paths");
-});
-
-mock.module("../../../persistence/invite-store.js", () => ({
-  ...actualInviteStore,
-  createInvite: inviteStoreCall,
-  listInvites: inviteStoreCall,
-  revokeInvite: inviteStoreCall,
-}));
-
 // `invites_trigger_call` is daemon-local: the handler invokes the local
 // `triggerInviteCall` provider logic directly (never `ipcCallPersistent`).
 let triggerInviteCallResult: unknown = { ok: true, data: { callSid: "CA000" } };
 const triggerInviteCallMock = mock(
-  async (_id: string) => triggerInviteCallResult,
+  async (_params: Record<string, unknown>) => triggerInviteCallResult,
+);
+
+// Presentation composition is daemon-owned: the create relay invokes it
+// exactly once on the gateway's raw mint payload. Passthrough by default so
+// the relay-shape tests observe the gateway payload unchanged.
+let composeInvitePresentationResult:
+  | ((params: { invite: Record<string, unknown> }) => Record<string, unknown>)
+  | undefined;
+const composeInvitePresentationMock = mock(
+  async (params: {
+    contactId?: string;
+    invite: Record<string, unknown>;
+    rawToken?: string;
+  }) =>
+    composeInvitePresentationResult
+      ? composeInvitePresentationResult(params)
+      : params.invite,
 );
 
 const actualInviteService = await import("../../invite-service.js");
@@ -71,6 +71,10 @@ const actualInviteService = await import("../../invite-service.js");
 mock.module("../../invite-service.js", () => ({
   ...actualInviteService,
   triggerInviteCall: triggerInviteCallMock,
+  composeInvitePresentation: composeInvitePresentationMock,
+  // Deterministic guardian label so the voice-create passthrough is assertable
+  // (the real resolver reads the guardian persona file).
+  resolveInviteGuardianName: () => "Guardian Name",
 }));
 
 const {
@@ -87,9 +91,10 @@ describe("invite relay routes", () => {
     ipcResult = {};
     ipcError = undefined;
     ipcCallPersistentMock.mockClear();
-    inviteStoreCall.mockClear();
     triggerInviteCallResult = { ok: true, data: { callSid: "CA000" } };
     triggerInviteCallMock.mockClear();
+    composeInvitePresentationResult = undefined;
+    composeInvitePresentationMock.mockClear();
   });
 
   describe("handleListInvites", () => {
@@ -108,7 +113,6 @@ describe("invite relay routes", () => {
         },
       ]);
       expect(result).toEqual({ ok: true, invites: [{ id: "i1" }] });
-      expect(inviteStoreCall).not.toHaveBeenCalled();
     });
 
     test("omits absent filters", async () => {
@@ -144,9 +148,9 @@ describe("invite relay routes", () => {
             expiresInMs: undefined,
             expectedExternalUserId: undefined,
           },
-          // The create relay uses a generous timeout (gateway invites_mint can
-          // spend ~5s in generateInviteInstruction); list/revoke use the default.
-          timeoutMs: 30_000,
+          // The gateway mint is a fast native DB write; the LLM presentation
+          // step runs daemon-side after the relay, so the default timeout fits.
+          timeoutMs: undefined,
         },
       ]);
       expect(result).toEqual({
@@ -154,7 +158,36 @@ describe("invite relay routes", () => {
         invite: { id: "i9", token: "tok-9" },
         rawToken: "tok-9",
       });
-      expect(inviteStoreCall).not.toHaveBeenCalled();
+    });
+
+    test("composes presentation daemon-side exactly once on the relayed mint payload", async () => {
+      ipcResult = { invite: { id: "i9", token: "tok-9" }, rawToken: "tok-9" };
+      composeInvitePresentationResult = (params) => ({
+        ...params.invite,
+        share: { url: "https://t.me/example_bot?start=tok-9" },
+        guardianInstruction: "Send the link to your friend.",
+      });
+
+      const result = await handleCreateInvite({
+        body: { contactId: "c1", sourceChannel: "telegram" },
+      });
+
+      expect(composeInvitePresentationMock).toHaveBeenCalledTimes(1);
+      expect(composeInvitePresentationMock.mock.calls[0][0]).toEqual({
+        contactId: "c1",
+        invite: { id: "i9", token: "tok-9" },
+        rawToken: "tok-9",
+      });
+      expect(result).toEqual({
+        ok: true,
+        invite: {
+          id: "i9",
+          token: "tok-9",
+          share: { url: "https://t.me/example_bot?start=tok-9" },
+          guardianInstruction: "Send the link to your friend.",
+        },
+        rawToken: "tok-9",
+      });
     });
 
     test("omits rawToken when the gateway returns none", async () => {
@@ -165,6 +198,35 @@ describe("invite relay routes", () => {
 
       expect(result).toEqual({ ok: true, invite: { id: "i9" } });
     });
+
+    test("supplies guardianName (voice) and sourceConversationId passthrough", async () => {
+      ipcResult = { invite: { id: "iv" } };
+      await handleCreateInvite({
+        body: {
+          contactId: "c1",
+          sourceChannel: "phone",
+          expectedExternalUserId: "+15551234567",
+          sourceConversationId: "conv-1",
+        },
+      });
+
+      expect(ipcCalls[0].params).toMatchObject({
+        contactId: "c1",
+        sourceChannel: "phone",
+        expectedExternalUserId: "+15551234567",
+        guardianName: "Guardian Name",
+        sourceConversationId: "conv-1",
+      });
+    });
+
+    test("omits guardianName for non-voice creates", async () => {
+      ipcResult = { invite: { id: "i9" } };
+      await handleCreateInvite({
+        body: { contactId: "c1", sourceChannel: "telegram" },
+      });
+
+      expect("guardianName" in (ipcCalls[0].params ?? {})).toBe(false);
+    });
   });
 
   describe("handleRevokeInvite", () => {
@@ -183,30 +245,57 @@ describe("invite relay routes", () => {
         ok: true,
         invite: { id: "i3", status: "revoked" },
       });
-      expect(inviteStoreCall).not.toHaveBeenCalled();
     });
   });
 
   describe("handleTriggerInviteCall (daemon-local carve-out)", () => {
-    test("invokes the local triggerInviteCall and does NOT relay to the gateway", async () => {
+    test("invokes the local triggerInviteCall with the gateway-supplied body fields and does NOT relay to the gateway", async () => {
       triggerInviteCallResult = { ok: true, data: { callSid: "CA123" } };
       const result = await handleTriggerInviteCall({
         pathParams: { id: "i7" },
+        body: {
+          phoneNumber: "+15551234567",
+          friendName: "Alice",
+          guardianName: "Guardian Label",
+        },
       });
 
       expect(triggerInviteCallMock).toHaveBeenCalledTimes(1);
-      expect(triggerInviteCallMock).toHaveBeenCalledWith("i7");
+      expect(triggerInviteCallMock).toHaveBeenCalledWith({
+        phoneNumber: "+15551234567",
+        friendName: "Alice",
+        guardianName: "Guardian Label",
+      });
       // Must NOT relay: relaying invites_trigger_call would loop
       // gateway→assistant→gateway (the gateway calls THIS to place the call).
       expect(ipcCalls).toEqual([]);
       expect(result).toEqual({ ok: true, callSid: "CA123" });
     });
 
+    test("route is gateway-only and stays dispatchable over the gateway's direct IPC path", () => {
+      const route = ROUTES.find(
+        (r) => r.operationId === "invites_trigger_call",
+      );
+      expect(route).toBeDefined();
+      // Gateway-only policy: the handler dials whatever number the body
+      // supplies, so it must never be reachable by actor principals (see
+      // route-policy.test.ts for the enforcement assertions).
+      expect(route!.policy!.allowedPrincipalTypes).toEqual(["svc_gateway"]);
+      expect(route!.policy!.requiredScopes).toEqual(["internal.write"]);
+      // The gateway invokes it via ipcCallAssistant("invites_trigger_call"),
+      // which dispatches shared routes that pass the IPC-eligibility filter.
+      expect(route!.requireGuardian).toBeUndefined();
+      expect(route!.isPublic).toBeUndefined();
+    });
+
     test("surfaces a failed provider call as a 400", async () => {
       triggerInviteCallResult = { ok: false, error: "Invite not eligible" };
 
       try {
-        await handleTriggerInviteCall({ pathParams: { id: "i7" } });
+        await handleTriggerInviteCall({
+          pathParams: { id: "i7" },
+          body: { phoneNumber: "+15551234567" },
+        });
         throw new Error("expected handler to throw");
       } catch (err) {
         const e = err as { statusCode?: number; message: string };

package/src/runtime/routes/__tests__/migration-import-allowed-hosts-env.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Tests for the import-only host-allowlist plumbing derived from the
+ * platform-injected `VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS` env var.
+ *
+ * Covers:
+ * - `parseMigrationImportAllowedHostsEnv`: unset / empty / whitespace-only
+ *   values yield `undefined` (strict default); single + comma-separated
+ *   lists are parsed, trimmed, and empties dropped.
+ * - `resolveImportValidatorOptions`: an explicit test override wins over the
+ *   env allowlist; otherwise the env value is used. This resolver is applied
+ *   ONLY by the import handlers — the export upload path stays strict — so it
+ *   is the seam that keeps the env allowlist from widening export SSRF.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import {
+  parseMigrationImportAllowedHostsEnv,
+  resolveImportValidatorOptions,
+} from "../migration-routes.js";
+
+describe("parseMigrationImportAllowedHostsEnv", () => {
+  test("returns undefined when unset", () => {
+    expect(parseMigrationImportAllowedHostsEnv(undefined)).toBeUndefined();
+  });
+
+  test("returns undefined for an empty string", () => {
+    expect(parseMigrationImportAllowedHostsEnv("")).toBeUndefined();
+  });
+
+  test("returns undefined for whitespace / commas only", () => {
+    expect(parseMigrationImportAllowedHostsEnv("   ")).toBeUndefined();
+    expect(parseMigrationImportAllowedHostsEnv(" , , ")).toBeUndefined();
+  });
+
+  test("parses a single host", () => {
+    expect(parseMigrationImportAllowedHostsEnv("host.docker.internal")).toEqual(
+      { allowedHosts: ["host.docker.internal"] },
+    );
+  });
+
+  test("parses and trims a comma-separated list, dropping empties", () => {
+    expect(
+      parseMigrationImportAllowedHostsEnv(
+        " host.docker.internal , ,localhost ",
+      ),
+    ).toEqual({ allowedHosts: ["host.docker.internal", "localhost"] });
+  });
+});
+
+describe("resolveImportValidatorOptions", () => {
+  test("uses the env allowlist when no test override is set", () => {
+    expect(
+      resolveImportValidatorOptions(undefined, "host.docker.internal"),
+    ).toEqual({ allowedHosts: ["host.docker.internal"] });
+  });
+
+  test("returns undefined (strict) when neither override nor env is set", () => {
+    expect(resolveImportValidatorOptions(undefined, undefined)).toBeUndefined();
+  });
+
+  test("test override takes precedence over the env allowlist", () => {
+    expect(
+      resolveImportValidatorOptions(
+        { allowedHosts: ["override.example"] },
+        "host.docker.internal",
+      ),
+    ).toEqual({ allowedHosts: ["override.example"] });
+  });
+});

package/src/runtime/routes/__tests__/monitoring-routes.test.ts

@@ -0,0 +1,194 @@
+/**
+ * Tests for the resource monitor control routes (start / stop / status).
+ *
+ * The route handlers run inside the daemon and own the monitor process. We mock
+ * monitoring-control, the config loader, and the sample ring buffer so the
+ * tests assert handler behaviour:
+ *   - start spawns as a daemon child (detached:false), enables the flag only on
+ *     success, and throws on spawn failure (flag untouched).
+ *   - stop disables the flag and signals the monitor.
+ *   - status reports the monitor process, the flag, and the latest sample.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import * as actualLoader from "../../../config/loader.js";
+import type { ResourceSample } from "../../../monitoring/resource-sampler.js";
+import { getMonitoringPidPath } from "../../../util/platform.js";
+
+class FakeSpawnError extends Error {}
+
+let spawnImpl: () => Promise<{ pid: number; alreadyRunning: boolean }>;
+let spawnArgs: Array<{ detached?: boolean; terminateOnTimeout?: boolean }> = [];
+let stopImpl: () => { status: "running" | "not_running"; pid?: number };
+/** Records the `monitoring.enabled` values written via saveRawConfig. */
+let enabledCalls: boolean[] = [];
+let monitoringProbe: { status: "running" | "not_running"; pid?: number } = {
+  status: "not_running",
+};
+let configEnabled = false;
+let latestSample: ResourceSample | null = null;
+
+mock.module("../../../monitoring/control.js", () => ({
+  MonitoringWorkerSpawnError: FakeSpawnError,
+  spawnMonitoringWorkerProcess: async (opts: {
+    detached?: boolean;
+    terminateOnTimeout?: boolean;
+  }) => {
+    spawnArgs.push(opts);
+    return spawnImpl();
+  },
+  stopMonitoringWorkerProcess: () => stopImpl(),
+  probeMonitoringWorker: () => monitoringProbe,
+}));
+
+mock.module("../../../monitoring/sample-ring-buffer.js", () => ({
+  SampleRingBuffer: class {
+    readLast() {
+      return latestSample;
+    }
+  },
+}));
+
+mock.module("../../../config/loader.js", () => ({
+  ...actualLoader,
+  getConfigReadOnly: () => ({
+    monitoring: { enabled: configEnabled, ringBufferSize: 4000 },
+  }),
+  loadRawConfig: () => ({}),
+  saveRawConfig: (cfg: { monitoring?: { enabled?: boolean } }) => {
+    enabledCalls.push(cfg.monitoring?.enabled === true);
+  },
+}));
+
+const { ROUTES } = await import("../monitoring-routes.js");
+
+function handler(operationId: string) {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`route ${operationId} not registered`);
+  return route.handler as () => Promise<Record<string, unknown>>;
+}
+
+beforeEach(() => {
+  spawnArgs = [];
+  enabledCalls = [];
+  spawnImpl = async () => ({ pid: 4242, alreadyRunning: false });
+  stopImpl = () => ({ status: "not_running" });
+  monitoringProbe = { status: "not_running" };
+  configEnabled = false;
+  latestSample = null;
+});
+
+describe("monitoring_start", () => {
+  test("spawns as a daemon child and enables the flag on success", async () => {
+    spawnImpl = async () => ({ pid: 4242, alreadyRunning: false });
+
+    const res = await handler("monitoring_start")();
+
+    expect(spawnArgs).toEqual([{ detached: false, terminateOnTimeout: true }]);
+    expect(enabledCalls).toEqual([true]);
+    expect(res).toEqual({
+      pid: 4242,
+      alreadyRunning: false,
+      monitoringEnabled: true,
+      pidPath: getMonitoringPidPath(),
+    });
+  });
+
+  test("reports an already-running monitor without re-spawning", async () => {
+    spawnImpl = async () => ({ pid: 99, alreadyRunning: true });
+
+    const res = await handler("monitoring_start")();
+
+    expect(res).toMatchObject({ pid: 99, alreadyRunning: true });
+    expect(enabledCalls).toEqual([true]);
+  });
+
+  test("throws and leaves the flag untouched when the spawn fails", async () => {
+    spawnImpl = async () => {
+      throw new FakeSpawnError("monitor exited during startup");
+    };
+
+    await expect(handler("monitoring_start")()).rejects.toThrow(
+      "monitor exited during startup",
+    );
+    expect(enabledCalls).toEqual([]);
+  });
+});
+
+describe("monitoring_stop", () => {
+  test("disables the flag and reports a signalled running monitor", async () => {
+    stopImpl = () => ({ status: "running", pid: 555 });
+
+    const res = await handler("monitoring_stop")();
+
+    expect(enabledCalls).toEqual([false]);
+    expect(res).toEqual({
+      monitoringWasRunning: true,
+      pid: 555,
+      monitoringEnabled: false,
+    });
+  });
+
+  test("disables the flag and succeeds when no monitor is running", async () => {
+    stopImpl = () => ({ status: "not_running" });
+
+    const res = await handler("monitoring_stop")();
+
+    expect(enabledCalls).toEqual([false]);
+    expect(res).toEqual({ monitoringWasRunning: false, monitoringEnabled: false });
+  });
+});
+
+describe("monitoring_status", () => {
+  test("reports a running monitor with the enabled flag and no sample yet", async () => {
+    monitoringProbe = { status: "running", pid: 321 };
+    configEnabled = true;
+    latestSample = null;
+
+    const res = await handler("monitoring_status")();
+
+    expect(res).toMatchObject({
+      status: "running",
+      pid: 321,
+      monitoringEnabled: true,
+      latestSample: null,
+    });
+  });
+
+  test("surfaces the most recent persisted sample", async () => {
+    monitoringProbe = { status: "running", pid: 321 };
+    configEnabled = true;
+    latestSample = {
+      ts: 1000,
+      memory: {
+        currentBytes: 6 * 1024 * 1024 * 1024,
+        limitBytes: 8 * 1024 * 1024 * 1024,
+        peakBytes: 7 * 1024 * 1024 * 1024,
+        ratio: 0.75,
+      },
+      events: { low: 0, high: 0, max: 2, oom: 0, oomKill: 0 },
+      disk: { path: "/workspace", usedMb: 100, totalMb: 1000, freeMb: 900 },
+    };
+
+    const res = await handler("monitoring_status")();
+
+    expect(res).toMatchObject({
+      monitoringEnabled: true,
+      latestSample: { ts: 1000, memory: { ratio: 0.75 } },
+    });
+  });
+
+  test("reports not_running with the flag off", async () => {
+    monitoringProbe = { status: "not_running" };
+    configEnabled = false;
+
+    const res = await handler("monitoring_status")();
+
+    expect(res).toMatchObject({
+      status: "not_running",
+      monitoringEnabled: false,
+    });
+    expect(res.pid).toBeUndefined();
+  });
+});