@vellumai/assistant 0.8.2 → 0.8.4

package/src/__tests__/host-app-control-proxy.test.ts

@@ -42,6 +42,7 @@ mock.module("../runtime/pending-interactions.js", () => ({
 const {
   HostAppControlProxy,
   _getActiveAppControlSession,
+  _getConfirmedAppControlSession,
   _resetActiveAppControlSession,
   _setActiveAppControlSession,
 } = await import("../daemon/host-app-control-proxy.js");
@@ -826,6 +827,246 @@ describe("HostAppControlProxy", () => {
       proxy.dispose();
     });
 
+    test("both-succeed older-arrives-last does not overwrite newer confirmed session", async () => {
+      // Two same-conversation starts both succeed, but the older one's
+      // `running` response arrives AFTER the newer one's. With a
+      // conversation-only ownership guard, the older response would
+      // overwrite the newer confirmed session — a latent bug that surfaces
+      // on a subsequent rollback. Verify the confirmed pointer stays on the
+      // newer session (C), and that a later rollback restores to C, not A.
+      const proxy = new HostAppControlProxy("conv-1");
+      const ctrl = new AbortController();
+
+      const pA = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.a" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdA = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+
+      sentMessages.length = 0;
+      const pC = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.c" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdC = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      // C succeeds first → active = C, confirmed = C.
+      proxy.resolve(reqIdC, payload({ pngBase64: PNG_A }));
+      await pC;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.c");
+
+      // A succeeds second (older arrives last). The conversation-ownership
+      // check passes for A, but A is no longer the live optimistic write
+      // and a session is already confirmed — must NOT overwrite confirmed.
+      proxy.resolve(reqIdA, payload({ pngBase64: PNG_B }));
+      await pA;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.c");
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      // A later restart D that fails must roll back to C (the true
+      // confirmed), not to A — guards against the latent-bug case.
+      sentMessages.length = 0;
+      const pD = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.d" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdD = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      proxy.resolve(reqIdD, payload({ state: "missing" }));
+      await pD;
+
+      const session = _getActiveAppControlSession();
+      expect(session?.conversationId).toBe("conv-1");
+      expect(session?.app).toBe("com.example.c");
+
+      proxy.dispose();
+    });
+
+    test("rollback after confirmed-A,dispatch-B,dispatch-C,B-confirms,C-fails restores B (Codex P2)", async () => {
+      // A is confirmed, then B and C are dispatched. B's `running` arrives
+      // while C is the live write; under the dispatch-counter rule that
+      // confirmation must promote because B is newer than A. A subsequent
+      // failure of C must then roll back to B, not back to A.
+      const proxy = new HostAppControlProxy("conv-1");
+      const ctrl = new AbortController();
+
+      const pA = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.a" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdA = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      proxy.resolve(reqIdA, payload({ pngBase64: PNG_A }));
+      await pA;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.a");
+
+      sentMessages.length = 0;
+      const pB = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.b" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdB = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+
+      sentMessages.length = 0;
+      const pC = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.c" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdC = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      // B confirms (newer than A): confirmed should move to B even though
+      // C is the live optimistic write.
+      proxy.resolve(reqIdB, payload({ pngBase64: PNG_B }));
+      await pB;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.b");
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      // C fails → rollback restores to confirmed (B), not A.
+      proxy.resolve(reqIdC, payload({ state: "missing" }));
+      await pC;
+      const session = _getActiveAppControlSession();
+      expect(session?.conversationId).toBe("conv-1");
+      expect(session?.app).toBe("com.example.b");
+
+      proxy.dispose();
+    });
+
+    test("three-overlapping-starts A-confirms,B-confirms,C-fails restores B (Devin P2)", async () => {
+      // A, B, C dispatched in order with no prior confirmed session.
+      // A confirms first (confirmed = A), B confirms second (confirmed
+      // must move forward to B because B is newer), C fails → rollback
+      // restores to B, not A.
+      const proxy = new HostAppControlProxy("conv-1");
+      const ctrl = new AbortController();
+
+      const pA = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.a" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdA = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+
+      sentMessages.length = 0;
+      const pB = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.b" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdB = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+
+      sentMessages.length = 0;
+      const pC = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.c" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdC = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      proxy.resolve(reqIdA, payload({ pngBase64: PNG_A }));
+      await pA;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.a");
+
+      proxy.resolve(reqIdB, payload({ pngBase64: PNG_B }));
+      await pB;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.b");
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      proxy.resolve(reqIdC, payload({ state: "missing" }));
+      await pC;
+      const session = _getActiveAppControlSession();
+      expect(session?.conversationId).toBe("conv-1");
+      expect(session?.app).toBe("com.example.b");
+
+      proxy.dispose();
+    });
+
+    test("confirmed-A,dispatch-B,dispatch-C,C-fails-first,B-confirms syncs active to B", async () => {
+      // A confirmed, B and C dispatched, C returns `missing` first →
+      // rollback restores active to A. Then B returns `running` →
+      // confirmed advances to B; active must advance alongside it,
+      // otherwise the tool reports B started while
+      // app_control_observe/actions for B target A.
+      const proxy = new HostAppControlProxy("conv-1");
+      const ctrl = new AbortController();
+
+      const pA = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.a" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdA = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      proxy.resolve(reqIdA, payload({ pngBase64: PNG_A }));
+      await pA;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.a");
+
+      sentMessages.length = 0;
+      const pB = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.b" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdB = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+
+      sentMessages.length = 0;
+      const pC = proxy.request(
+        "app_control_start",
+        { tool: "start", app: "com.example.c" },
+        "conv-1",
+        ctrl.signal,
+      );
+      const reqIdC = (sentMessages[0] as Record<string, unknown>)
+        .requestId as string;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.c");
+
+      // C fails first → rollback restores active to confirmed (A).
+      proxy.resolve(reqIdC, payload({ state: "missing" }));
+      await pC;
+      expect(_getActiveAppControlSession()?.app).toBe("com.example.a");
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.a");
+
+      // B confirms after C's rollback. Confirmed advances to B AND active
+      // must advance to B too — otherwise non-start tool calls against B
+      // would be rejected because active still targets A.
+      proxy.resolve(reqIdB, payload({ pngBase64: PNG_B }));
+      await pB;
+      expect(_getConfirmedAppControlSession()?.app).toBe("com.example.b");
+      const session = _getActiveAppControlSession();
+      expect(session?.conversationId).toBe("conv-1");
+      expect(session?.app).toBe("com.example.b");
+
+      proxy.dispose();
+    });
+
     test("first-start failure releases the lock (no prior session to restore)", async () => {
       const proxy = new HostAppControlProxy("conv-1");
       const ctrl = new AbortController();

package/src/__tests__/host-bash-proxy.test.ts

@@ -31,6 +31,12 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
     _conversationId?: string,
     options?: unknown,
   ) => {
+    // `interaction_resolved` envelopes are emitted by the pending-interactions
+    // tracker for every resolution. They are orthogonal to the host-proxy
+    // wire messages these tests assert on, so swallow them here.
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
     sentMessages.push(msg);
     sentMessageOptions.push(options);
   },

package/src/__tests__/host-browser-proxy.test.ts

@@ -31,6 +31,13 @@ let mockClients: MockClient[] = [];
 mock.module("../runtime/assistant-event-hub.js", () => ({
   assistantEventHub: {
     publish: async (event: unknown, _options?: unknown) => {
+      // `interaction_resolved` envelopes are emitted by the
+      // pending-interactions tracker for every resolution. They are
+      // orthogonal to the host-browser wire messages these tests assert
+      // on, so swallow them here.
+      if ((event as { type?: string } | null)?.type === "interaction_resolved") {
+        return;
+      }
       publishedEvents.push(event);
     },
     getMostRecentClientByCapability: (cap: string) =>
@@ -41,6 +48,9 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
       mockClients.find((c) => c.clientId === clientId)?.actorPrincipalId,
   },
   broadcastMessage: (msg: unknown) => {
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
     publishedEvents.push(msg);
   },
 }));

package/src/__tests__/host-cu-proxy.test.ts

@@ -10,7 +10,14 @@ type MockClient = {
 let mockClients: MockClient[] = [];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: unknown) => sentMessages.push(msg),
+  broadcastMessage: (msg: unknown) => {
+    // Skip `interaction_resolved` envelopes — pending-interactions emits one
+    // on every resolve and these tests assert on host-proxy wire messages.
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
+    sentMessages.push(msg);
+  },
   assistantEventHub: {
     getMostRecentClientByCapability: (cap: string) =>
       cap === "host_cu" && mockHasClient ? { id: "mock-client" } : null,

package/src/__tests__/host-file-proxy.test.ts

@@ -12,7 +12,14 @@ interface MockClient {
 let mockClients: MockClient[] = [];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: unknown) => sentMessages.push(msg),
+  broadcastMessage: (msg: unknown) => {
+    // Skip `interaction_resolved` envelopes — pending-interactions emits one
+    // on every resolve and these tests assert on host-proxy wire messages.
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
+    sentMessages.push(msg);
+  },
   assistantEventHub: {
     getMostRecentClientByCapability: (cap: string) => {
       if (mockClients.length > 0) {

package/src/__tests__/host-proxy-preactivation.test.ts

@@ -1,12 +1,16 @@
 /**
- * Tests for `preactivateHostProxySkills` and `shouldAttachHostProxyForCapability`
- * in `host-proxy-preactivation.ts`.
+ * Tests for `evaluateHostProxyAttachment`, `preactivateHostProxySkills`, and
+ * `shouldAttachHostProxyForCapability` in `host-proxy-preactivation.ts`.
  *
  * Covers:
  *  - Source interface natively supports capability → preactivate (regression)
  *  - Source interface doesn't support but capable client connected → preactivate
  *  - Source interface doesn't support and no capable client → don't preactivate
  *  - chrome-extension source + capable client connected → don't preactivate (security boundary)
+ *  - `evaluateHostProxyAttachment` returns the correct `reason` for each branch
+ *  - `preactivateHostProxySkills` emits one structured log line per call with
+ *    conversationId, sourceInterface, per-capability decisions, and final
+ *    preactivatedSkillIds (used by ATL-609-class silent-gate diagnosis)
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -26,31 +30,74 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
   broadcastMessage: () => {},
 }));
 
+// ---------------------------------------------------------------------------
+// Mock the logger so we can assert on the structured info call.
+// `info` calls are pushed into `loggedInfoCalls` for inspection.
+// `child()` is exposed for callers that wrap the logger that way.
+// ---------------------------------------------------------------------------
+
+interface LoggedCall {
+  fields: Record<string, unknown>;
+  message: string;
+}
+const loggedInfoCalls: LoggedCall[] = [];
+function captureInfo(fields: unknown, message: unknown) {
+  loggedInfoCalls.push({
+    fields: fields as Record<string, unknown>,
+    message: message as string,
+  });
+}
+
 mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+  getLogger: () => ({
+    info: captureInfo,
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+    trace: () => {},
+    fatal: () => {},
+    child: () => ({
+      info: captureInfo,
+      warn: () => {},
+      error: () => {},
+      debug: () => {},
+      trace: () => {},
+      fatal: () => {},
+    }),
+  }),
 }));
 
 // ---------------------------------------------------------------------------
-// Imports under test (after mocks are registered)
+// Imports under test
+//
+// Type-only imports are erased at runtime and safe to hoist. The value import
+// of `host-proxy-preactivation` must be dynamic (`await import`) so it
+// resolves AFTER the `mock.module(...)` calls above — otherwise ES module
+// hoisting loads the real logger before the mock registers, the production
+// `const log = getLogger(...)` binds to real pino, and assertions against
+// `loggedInfoCalls` see an empty array. Same pattern as
+// `secret-prompt-log-hygiene.test.ts`.
 // ---------------------------------------------------------------------------
 
 import type { HostProxyCapability } from "../channels/types.js";
-import {
-  type HostProxyPreactivationTarget,
+import type { HostProxyPreactivationTarget } from "../daemon/host-proxy-preactivation.js";
+
+const {
+  evaluateHostProxyAttachment,
   preactivateHostProxySkills,
   shouldAttachHostProxyForCapability,
-} from "../daemon/host-proxy-preactivation.js";
+} = await import("../daemon/host-proxy-preactivation.js");
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
-function makeTarget(): HostProxyPreactivationTarget & {
-  preactivatedSkillIds: string[];
-} {
+function makeTarget(
+  conversationId = "conv-test",
+): HostProxyPreactivationTarget & { preactivatedSkillIds: string[] } {
   const preactivatedSkillIds: string[] = [];
   return {
+    conversationId,
     preactivatedSkillIds,
     addPreactivatedSkillId(id: string) {
       preactivatedSkillIds.push(id);
@@ -73,6 +120,7 @@ function setCapableClient(
 
 beforeEach(() => {
   mockClientsByCapability = new Map();
+  loggedInfoCalls.length = 0;
 });
 
 // ---------------------------------------------------------------------------
@@ -143,7 +191,10 @@ describe("shouldAttachHostProxyForCapability", () => {
     test("returns false for chrome-extension source even when a capable client is connected", () => {
       setCapableClient("host_app_control", true);
       expect(
-        shouldAttachHostProxyForCapability("host_app_control", "chrome-extension"),
+        shouldAttachHostProxyForCapability(
+          "host_app_control",
+          "chrome-extension",
+        ),
       ).toBe(false);
     });
   });
@@ -154,7 +205,7 @@ describe("shouldAttachHostProxyForCapability", () => {
 // ---------------------------------------------------------------------------
 
 describe("preactivateHostProxySkills", () => {
-  test("no-ops when sourceInterface is undefined", () => {
+  test("preactivates no skills when sourceInterface is undefined", () => {
     const target = makeTarget();
     preactivateHostProxySkills(target, undefined);
     expect(target.preactivatedSkillIds).toEqual([]);
@@ -209,3 +260,139 @@ describe("preactivateHostProxySkills", () => {
     expect(target.preactivatedSkillIds).toEqual([]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// evaluateHostProxyAttachment — reason coverage
+// ---------------------------------------------------------------------------
+
+describe("evaluateHostProxyAttachment", () => {
+  test("returns denied_no_interface when sourceInterface is undefined", () => {
+    expect(evaluateHostProxyAttachment("host_cu", undefined)).toEqual({
+      shouldAttach: false,
+      reason: "denied_no_interface",
+    });
+  });
+
+  test("returns native_support for macos + host_cu", () => {
+    expect(evaluateHostProxyAttachment("host_cu", "macos")).toEqual({
+      shouldAttach: true,
+      reason: "native_support",
+    });
+  });
+
+  test("returns denied_chrome_extension for chrome-extension source even when capable clients exist", () => {
+    setCapableClient("host_cu", true);
+    expect(evaluateHostProxyAttachment("host_cu", "chrome-extension")).toEqual({
+      shouldAttach: false,
+      reason: "denied_chrome_extension",
+    });
+  });
+
+  test("returns cross_client with clientCount when a capable client is connected", () => {
+    setCapableClient("host_cu", true);
+    expect(evaluateHostProxyAttachment("host_cu", "web")).toEqual({
+      shouldAttach: true,
+      reason: "cross_client",
+      clientCount: 1,
+    });
+  });
+
+  test("returns denied_no_clients with clientCount 0 when no capable client is connected", () => {
+    setCapableClient("host_cu", false);
+    expect(evaluateHostProxyAttachment("host_cu", "web")).toEqual({
+      shouldAttach: false,
+      reason: "denied_no_clients",
+      clientCount: 0,
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// preactivateHostProxySkills — structured logging
+// ---------------------------------------------------------------------------
+
+describe("preactivateHostProxySkills logging", () => {
+  test("emits exactly one info log per call", () => {
+    const target = makeTarget();
+    preactivateHostProxySkills(target, "macos");
+    expect(loggedInfoCalls).toHaveLength(1);
+    expect(loggedInfoCalls[0].message).toBe(
+      "host-proxy preactivation decision",
+    );
+  });
+
+  test("log includes conversationId, sourceInterface, per-capability decisions, and preactivatedSkillIds for macos", () => {
+    const target = makeTarget("conv-macos-123");
+    preactivateHostProxySkills(target, "macos");
+
+    expect(loggedInfoCalls).toHaveLength(1);
+    const { fields } = loggedInfoCalls[0];
+    expect(fields.conversationId).toBe("conv-macos-123");
+    expect(fields.sourceInterface).toBe("macos");
+    expect(fields.decisions).toEqual({
+      host_cu: { shouldAttach: true, reason: "native_support" },
+      host_app_control: { shouldAttach: true, reason: "native_support" },
+    });
+    expect(fields.preactivatedSkillIds).toEqual([
+      "computer-use",
+      "app-control",
+    ]);
+  });
+
+  test("log captures denied_no_interface for undefined sourceInterface (silent-gate diagnostic)", () => {
+    const target = makeTarget("conv-no-interface");
+    preactivateHostProxySkills(target, undefined);
+
+    expect(loggedInfoCalls).toHaveLength(1);
+    const { fields } = loggedInfoCalls[0];
+    expect(fields.conversationId).toBe("conv-no-interface");
+    expect(fields.sourceInterface).toBeUndefined();
+    expect(fields.decisions).toEqual({
+      host_cu: { shouldAttach: false, reason: "denied_no_interface" },
+      host_app_control: { shouldAttach: false, reason: "denied_no_interface" },
+    });
+    expect(fields.preactivatedSkillIds).toEqual([]);
+  });
+
+  test("log captures cross_client + clientCount when a web source has a connected host_cu client", () => {
+    setCapableClient("host_cu", true);
+    const target = makeTarget();
+    preactivateHostProxySkills(target, "web");
+
+    expect(loggedInfoCalls).toHaveLength(1);
+    const decisions = loggedInfoCalls[0].fields.decisions as Record<
+      string,
+      unknown
+    >;
+    expect(decisions.host_cu).toEqual({
+      shouldAttach: true,
+      reason: "cross_client",
+      clientCount: 1,
+    });
+    expect(decisions.host_app_control).toEqual({
+      shouldAttach: false,
+      reason: "denied_no_clients",
+      clientCount: 0,
+    });
+    expect(loggedInfoCalls[0].fields.preactivatedSkillIds).toEqual([
+      "computer-use",
+    ]);
+  });
+
+  test("log captures denied_chrome_extension reason for chrome-extension source", () => {
+    setCapableClient("host_cu", true);
+    const target = makeTarget();
+    preactivateHostProxySkills(target, "chrome-extension");
+
+    expect(loggedInfoCalls).toHaveLength(1);
+    const decisions = loggedInfoCalls[0].fields.decisions as Record<
+      string,
+      unknown
+    >;
+    expect(decisions.host_cu).toEqual({
+      shouldAttach: false,
+      reason: "denied_chrome_extension",
+    });
+    expect(loggedInfoCalls[0].fields.preactivatedSkillIds).toEqual([]);
+  });
+});

package/src/__tests__/host-transfer-proxy.test.ts

@@ -8,7 +8,14 @@ const sentMessages: unknown[] = [];
 let mockHasClient = false;
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: unknown) => sentMessages.push(msg),
+  broadcastMessage: (msg: unknown) => {
+    // Skip `interaction_resolved` envelopes — pending-interactions emits one
+    // on every resolve and these tests assert on host-proxy wire messages.
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
+    sentMessages.push(msg);
+  },
   assistantEventHub: {
     getMostRecentClientByCapability: (cap: string) =>
       cap === "host_file" && mockHasClient ? { id: "mock-client" } : null,

package/src/__tests__/identity-routes.test.ts

@@ -24,8 +24,12 @@ mock.module("../util/logger.js", () => ({
 
 import {
   handleDetailedHealth,
+  handleReadyz,
   ROUTES,
 } from "../runtime/routes/identity-routes.js";
+import {
+  setCesClient,
+} from "../security/secure-keys.js";
 import { getWorkspaceDir } from "../util/platform.js";
 import {
   getHatchedSidecarPath,
@@ -177,6 +181,59 @@ describe("identity routes — health endpoint", () => {
       expect(body.timestamp).toBeDefined();
       expect(body.migrations).toBeDefined();
     });
+
+    test("includes ces.connected=false when no CES client is registered", async () => {
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+
+      expect(body.ces).toBeDefined();
+      expect((body.ces as Record<string, unknown>).connected).toBe(false);
+    });
+  });
+
+  describe("CES readiness", () => {
+    beforeEach(() => {
+      setCesClient(undefined);
+    });
+
+    test("readyz returns 200 and logs warning when CES is unavailable", () => {
+      const res = handleReadyz();
+      expect(res.status).toBe(200);
+    });
+
+    test("readyz returns 200 when CES is connected and ready", () => {
+      const mockClient = { isReady: () => true, close: () => {} } as unknown as import("../credential-execution/client.js").CesClient;
+      setCesClient(mockClient);
+      const res = handleReadyz();
+      expect(res.status).toBe(200);
+    });
+
+    test("readyz returns 200 when CES client exists but is not ready", () => {
+      const mockClient = { isReady: () => false, close: () => {} } as unknown as import("../credential-execution/client.js").CesClient;
+      setCesClient(mockClient);
+      const res = handleReadyz();
+      expect(res.status).toBe(200);
+    });
+
+    test("/v1/health reports ces.connected=true when CES is ready", async () => {
+      const mockClient = { isReady: () => true, close: () => {} } as unknown as import("../credential-execution/client.js").CesClient;
+      setCesClient(mockClient);
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+
+      expect(body.ces).toBeDefined();
+      expect((body.ces as Record<string, unknown>).connected).toBe(true);
+    });
+
+    test("/v1/health reports ces.connected=false when CES is not ready", async () => {
+      const mockClient = { isReady: () => false, close: () => {} } as unknown as import("../credential-execution/client.js").CesClient;
+      setCesClient(mockClient);
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+
+      expect(body.ces).toBeDefined();
+      expect((body.ces as Record<string, unknown>).connected).toBe(false);
+    });
   });
 
   describe("profiler payload (profiler enabled)", () => {