@vellumai/assistant 0.8.4 → 0.8.6

package/src/runtime/routes/__tests__/surface-content-routes.test.ts

@@ -0,0 +1,294 @@
+/**
+ * Tests for the surface-content route handler.
+ *
+ * Focus is the rehydrate-on-miss path: after daemon restart or LRU
+ * eviction, the in-memory conversation map is empty even though the
+ * surface still persists as a `ui_surface` content block in the
+ * messages table. The handler must fall back to a DB scan via the
+ * shared `resolveSurfaceConversation` helper, which calls
+ * `getOrCreateConversation` to rehydrate the conversation. The
+ * rehydration runs `restoreSurfaceStateFromHistory()` in production,
+ * which is what repopulates the surfaceState the handler then reads
+ * from — in tests we simulate the rehydrated conversation by stubbing
+ * `getOrCreateConversation`'s return value with pre-populated
+ * `surfaceState`.
+ *
+ * Strategy mirrors `surface-action-routes.test.ts`: mock the
+ * `conversation-store` and `raw-query` modules at their boundary so
+ * the resolver code path executes against the test doubles, import
+ * ROUTES afterwards, and dispatch by operationId.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+interface StoredSurface {
+  surfaceType: string;
+  title: string | null;
+  data: Record<string, unknown>;
+}
+
+interface StubConversation {
+  id: string;
+  surfaceState: Map<string, StoredSurface>;
+  currentTurnSurfaces?: Array<{
+    surfaceId: string;
+    surfaceType: string;
+    title?: string | null;
+    data: Record<string, unknown>;
+  }>;
+}
+
+let memoryById: StubConversation | null = null;
+let rehydrated: StubConversation | null = null;
+let rawGetReturn: { conversation_id: string } | null = null;
+
+const findConvCalls: string[] = [];
+const findBySurfaceCalls: string[] = [];
+const getOrCreateCalls: string[] = [];
+const rawGetCalls: Array<{ sql: string; params: unknown[] }> = [];
+
+mock.module("../../../daemon/conversation-store.js", () => ({
+  findConversation: (id: string) => {
+    findConvCalls.push(id);
+    return memoryById ?? undefined;
+  },
+  findConversationBySurfaceId: (surfaceId: string) => {
+    findBySurfaceCalls.push(surfaceId);
+    return undefined;
+  },
+  getOrCreateConversation: async (id: string) => {
+    getOrCreateCalls.push(id);
+    if (!rehydrated) {
+      throw new Error(
+        `getOrCreateConversation(${id}) called but no rehydrated stub configured`,
+      );
+    }
+    return rehydrated;
+  },
+}));
+
+mock.module("../../../memory/raw-query.js", () => ({
+  rawGet: (sql: string, ...params: unknown[]) => {
+    rawGetCalls.push({ sql, params });
+    return rawGetReturn;
+  },
+}));
+
+// Defer route import until after mocks are installed.
+const { ROUTES } = await import("../surface-content-routes.js");
+const { BadRequestError, NotFoundError } = await import("../errors.js");
+import type { RouteDefinition } from "../types.js";
+
+function findHandler(operationId: string): RouteDefinition["handler"] {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route.handler;
+}
+
+function makeStub(id: string): StubConversation {
+  return { id, surfaceState: new Map() };
+}
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  memoryById = null;
+  rehydrated = null;
+  rawGetReturn = null;
+  findConvCalls.length = 0;
+  findBySurfaceCalls.length = 0;
+  getOrCreateCalls.length = 0;
+  rawGetCalls.length = 0;
+});
+
+// ---------------------------------------------------------------------------
+// surfaces_get_content
+// ---------------------------------------------------------------------------
+
+describe("surfaces_get_content handler", () => {
+  test("serves surface from in-memory surfaceState", async () => {
+    const conv = makeStub("conv-active");
+    conv.surfaceState.set("surf-1", {
+      surfaceType: "card",
+      title: "T",
+      data: { foo: "bar" },
+    });
+    memoryById = conv;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-1" },
+      queryParams: { conversationId: "conv-active" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-1",
+      surfaceType: "card",
+      title: "T",
+      data: { foo: "bar" },
+    });
+    expect(findConvCalls).toEqual(["conv-active"]);
+    // Fast path — never touched the DB or rehydration helpers.
+    expect(rawGetCalls).toEqual([]);
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("falls back to currentTurnSurfaces when surfaceState misses", async () => {
+    const conv = makeStub("conv-mid-turn");
+    conv.currentTurnSurfaces = [
+      {
+        surfaceId: "surf-pending",
+        surfaceType: "list",
+        title: "Picks",
+        data: { items: [] },
+      },
+    ];
+    memoryById = conv;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-pending" },
+      queryParams: { conversationId: "conv-mid-turn" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-pending",
+      surfaceType: "list",
+      title: "Picks",
+      data: { items: [] },
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // The bug fix: rehydration on in-memory miss.
+  // -------------------------------------------------------------------------
+  test("rehydrates from DB when the conversation is not in memory", async () => {
+    // Simulate post-restart or post-eviction: nothing in memory, but the
+    // surface exists in the messages table and rehydration restores the
+    // conversation with its surfaceState repopulated from history.
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-evicted" };
+    const restored = makeStub("conv-evicted");
+    restored.surfaceState.set("surf-restored", {
+      surfaceType: "card",
+      title: "Restored",
+      data: { from: "history" },
+    });
+    rehydrated = restored;
+
+    const handler = findHandler("surfaces_get_content");
+    const result = await handler({
+      pathParams: { surfaceId: "surf-restored" },
+      queryParams: { conversationId: "conv-evicted" },
+    });
+
+    expect(result).toEqual({
+      surfaceId: "surf-restored",
+      surfaceType: "card",
+      title: "Restored",
+      data: { from: "history" },
+    });
+    // Hit the in-memory map first, missed, fell through to the DB scan,
+    // then rehydrated. The DB scan keyed on the surfaceId.
+    expect(findConvCalls).toEqual(["conv-evicted"]);
+    expect(rawGetCalls).toHaveLength(1);
+    expect(rawGetCalls[0]!.params[0]).toBe(`%"surfaceId":"surf-restored"%`);
+    expect(getOrCreateCalls).toEqual(["conv-evicted"]);
+  });
+
+  test("400s when conversationId is missing", async () => {
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-1" },
+        queryParams: {},
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(BadRequestError);
+    expect(findConvCalls).toEqual([]);
+  });
+
+  test("404s when no row in the DB matches the surfaceId (truly unknown surface)", async () => {
+    // Cold-cache miss with no DB row — the surfaceId is bogus or has
+    // never been persisted. We must 404, not rehydrate a phantom
+    // conversation for the caller-supplied conversationId.
+    memoryById = null;
+    rawGetReturn = null;
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-missing" },
+        queryParams: { conversationId: "conv-unknown" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    // Rehydration must NOT have been called — otherwise an arbitrary
+    // caller could materialize empty conversations for any UUID.
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("404s when the DB row's conversation_id mismatches the caller's", async () => {
+    // The surface lives on a different conversation than the caller
+    // claims. Refusing to rehydrate prevents cross-conversation
+    // information leakage via guessable surfaceIds.
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-actual-owner" };
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-leaked" },
+        queryParams: { conversationId: "conv-attacker" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    expect(getOrCreateCalls).toEqual([]);
+  });
+
+  test("404s when rehydration succeeds but the surface still isn't present", async () => {
+    // Adversarial sanity check: the DB scan found a row pointing at a
+    // conversation, but after rehydration the surface neither lives in
+    // surfaceState nor in currentTurnSurfaces. (Shouldn't really
+    // happen given the scan keyed on the surfaceId — defensive.)
+    memoryById = null;
+    rawGetReturn = { conversation_id: "conv-evicted" };
+    rehydrated = makeStub("conv-evicted"); // empty surfaceState
+
+    const handler = findHandler("surfaces_get_content");
+
+    let caught: unknown;
+    try {
+      await handler({
+        pathParams: { surfaceId: "surf-gone" },
+        queryParams: { conversationId: "conv-evicted" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(NotFoundError);
+    expect(getOrCreateCalls).toEqual(["conv-evicted"]);
+  });
+});

package/src/runtime/routes/__tests__/task-routes.test.ts

@@ -195,9 +195,54 @@ mock.module("../../../tools/tasks/work-item-run.js", () => ({
 }));
 
 // Also mock getWorkspaceDir so handlers don't hit the real filesystem
-mock.module("../../../util/platform.js", () => ({
-  getWorkspaceDir: () => "/mock/workspace",
-}));
+mock.module("../../../util/platform.js", () => {
+  const stub = () => "/mock/workspace";
+  return {
+    getWorkspaceDir: () => "/mock/workspace",
+    vellumRoot: stub,
+    isMacOS: () => false,
+    isLinux: () => true,
+    isWindows: () => false,
+    getPlatformName: () => "linux",
+    normalizeAssistantId: (id: string) => id,
+    getDataDir: stub,
+    getEmbeddingModelsDir: stub,
+    getSandboxRootDir: stub,
+    getSandboxWorkingDir: stub,
+    getSoundsDir: stub,
+    getAvatarDir: stub,
+    AVATAR_IMAGE_FILENAME: "avatar-image.png",
+    getAvatarImagePath: stub,
+    getXdgVellumConfigDirName: () => ".vellum",
+    getPidPath: stub,
+    getDbPath: stub,
+    getLogsDir: stub,
+    getHistoryPath: stub,
+    getProtectedDir: stub,
+    getSignalsDir: stub,
+    getDaemonStderrLogPath: stub,
+    getDaemonStartupLockPath: stub,
+    getExternalDir: stub,
+    getBinDir: stub,
+    getDotEnvPath: stub,
+    getEmbedWorkerPidPath: stub,
+    getWorkspaceDirDisplay: stub,
+    getWorkspaceConfigPath: stub,
+    getWorkspaceSkillsDir: stub,
+    getWorkspaceHooksDir: stub,
+    getWorkspacePluginsDir: stub,
+    getWorkspaceRoutesDir: stub,
+    getDeprecatedDir: stub,
+    getConversationsDir: stub,
+    getWorkspacePromptPath: stub,
+    getProfilerRootDir: stub,
+    getProfilerRunsDir: stub,
+    getProfilerRunDir: stub,
+    getSkillRuntimePath: stub,
+    getBundledBunPath: () => undefined,
+    ensureDataDir: () => {},
+  };
+});
 
 // ---------------------------------------------------------------------------
 // Import route definitions after mocking

package/src/runtime/routes/acp-routes-list.test.ts

@@ -44,6 +44,9 @@ mock.module("../../memory/db-connection.js", () => {
   builder.all = () => [];
   return {
     getDb: () => builder,
+    getSqlite: () => ({ __stub: true }),
+    getSqliteFrom: () => ({ __stub: true }),
+    resetDb: () => {},
   };
 });
 

package/src/runtime/routes/acp-routes.test.ts

@@ -4,6 +4,10 @@
  * Suites:
  *  - POST /v1/acp/spawn — the three failure paths produced by
  *    `resolveAcpAgent` (acp_disabled, unknown_agent, binary_not_found).
+ *  - POST /v1/acp/spawn (env injection) — CLAUDE_CODE_OAUTH_TOKEN is read
+ *    from the secure store under the canonical
+ *    `credential/acp/claude_oauth_token` key (built by `credentialKey()`)
+ *    and merged into `agentConfig.env` ONLY for the `claude` agent.
  *  - DELETE /v1/acp/sessions?status=completed — the bulk-clear route that
  *    wipes terminal-state rows (completed/failed/cancelled) from
  *    `acp_session_history` while leaving running/initializing rows intact.
@@ -42,10 +46,21 @@ afterAll(() => {
 });
 
 // Stub `getAcpSessionManager` so the DELETE /:id tests can drive the
-// in-memory-status check without spawning real ACP processes. Stored in
-// a mutable map so individual tests can plant arbitrary states.
+// in-memory-status check without spawning real ACP processes, and so the
+// env-injection spawn tests can capture the `agentConfig` arg without
+// launching a real subprocess. Stored in mutable state so individual tests
+// can plant arbitrary states / inspect capture.
 const inMemoryStates = new Map<string, AcpSessionState>();
 
+interface CapturedSpawn {
+  agent: string;
+  agentConfig: { env?: Record<string, string> };
+  task: string;
+  conversationId: string;
+}
+
+const capturedSpawns: CapturedSpawn[] = [];
+
 mock.module("../../acp/index.js", () => ({
   getAcpSessionManager: () => ({
     getStatus: (id?: string) => {
@@ -56,9 +71,27 @@ mock.module("../../acp/index.js", () => ({
       if (!state) throw new Error(`ACP session "${id}" not found`);
       return state;
     },
+    spawn: async (
+      agent: string,
+      agentConfig: { env?: Record<string, string> },
+      task: string,
+      _cwd: string | undefined,
+      conversationId: string,
+    ) => {
+      capturedSpawns.push({ agent, agentConfig, task, conversationId });
+      return { acpSessionId: "acp-test", protocolSessionId: "proto-test" };
+    },
   }),
 }));
 
+// Stub secure-keys so env-injection tests can plant a known token (or
+// absence). Driven via `secureKeyStore` per test in beforeEach.
+const secureKeyStore = new Map<string, string>();
+
+mock.module("../../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async (key: string) => secureKeyStore.get(key),
+}));
+
 import { eq } from "drizzle-orm";
 
 import { getDb, getSqlite } from "../../memory/db-connection.js";
@@ -79,6 +112,8 @@ function getSpawnHandler() {
 beforeEach(() => {
   config.setConfig({});
   which.setWhich((cmd) => `/usr/local/bin/${cmd}`);
+  capturedSpawns.length = 0;
+  secureKeyStore.clear();
 });
 
 // ---------------------------------------------------------------------------
@@ -146,6 +181,212 @@ describe("POST /v1/acp/spawn", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN env injection + preflight
+//
+// claude-agent-acp authenticates via CLAUDE_CODE_OAUTH_TOKEN. The route
+// accepts the token from two provisioning routes:
+//   1. Secure store under the canonical `credential/acp/claude_oauth_token`
+//      key (built by `credentialKey()`), populated by
+//      `assistant credentials set --service acp --field claude_oauth_token`.
+//   2. `acp.agents.claude.env.CLAUDE_CODE_OAUTH_TOKEN` in the user's
+//      config.json, surfaced on `resolved.agent.env` by the resolver.
+// After merging the secure-store value into `agentConfig.env`, the route
+// preflights for the token and throws `FailedDependencyError` if it is
+// still absent. The "fail-fast" behavior is symmetric with the existing
+// `binary_not_found` preflight and avoids the zombie-subprocess footgun
+// where claude-agent-acp launches, crashes on auth, and leaves the
+// caller with no useful signal.
+//
+// These tests pin both the happy paths and the throw path so a future
+// drift in the key path, the env-override route, or the preflight check
+// fails the suite loudly.
+// ---------------------------------------------------------------------------
+
+describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
+  test("injects CLAUDE_CODE_OAUTH_TOKEN from credential/acp/claude_oauth_token for the claude agent", async () => {
+    secureKeyStore.set(
+      "credential/acp/claude_oauth_token",
+      "test-token-abc123",
+    );
+
+    const handler = getSpawnHandler();
+    await handler({
+      body: {
+        agent: "claude",
+        task: "do a thing",
+        conversationId: "conv-1",
+      },
+    });
+
+    expect(capturedSpawns).toHaveLength(1);
+    expect(capturedSpawns[0]?.agent).toBe("claude");
+    expect(capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe(
+      "test-token-abc123",
+    );
+  });
+
+  test("accepts CLAUDE_CODE_OAUTH_TOKEN from acp.agents.claude.env (config.json override) without a secure-store entry", async () => {
+    // The user-supplied config.json env override is the first-priority
+    // provisioning route. resolveAcpAgent returns it on `resolved.agent.env`,
+    // which the route then preserves on `agentConfig.env`. The preflight
+    // should accept this path with no secure-store entry needed.
+    config.setConfig({
+      agents: {
+        claude: {
+          command: "claude-agent-acp",
+          args: [],
+          env: { CLAUDE_CODE_OAUTH_TOKEN: "config-token-xyz789" },
+        },
+      },
+    });
+
+    const handler = getSpawnHandler();
+    await handler({
+      body: {
+        agent: "claude",
+        task: "do a thing",
+        conversationId: "conv-1",
+      },
+    });
+
+    expect(capturedSpawns).toHaveLength(1);
+    expect(capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe(
+      "config-token-xyz789",
+    );
+  });
+
+  test("config.json env override wins over a secure-store token (precedence pin)", async () => {
+    // Codex review feedback (PR #31901 / P2): when a user explicitly sets
+    // CLAUDE_CODE_OAUTH_TOKEN under `acp.agents.<id>.env` (per-workspace,
+    // rotated, scoped credential, etc.), the secure-store value must NOT
+    // silently overwrite it. Vault is fallback, not override.
+    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-token-AAA");
+    config.setConfig({
+      agents: {
+        claude: {
+          command: "claude-agent-acp",
+          args: [],
+          env: { CLAUDE_CODE_OAUTH_TOKEN: "config-token-BBB" },
+        },
+      },
+    });
+
+    const handler = getSpawnHandler();
+    await handler({
+      body: {
+        agent: "claude",
+        task: "do a thing",
+        conversationId: "conv-1",
+      },
+    });
+
+    expect(capturedSpawns).toHaveLength(1);
+    expect(capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe(
+      "config-token-BBB",
+    );
+  });
+
+  test("injects via command match for a user-defined agent id aliased to claude-agent-acp", async () => {
+    // Codex review feedback (PR #31901 / P2): gating is keyed off the
+    // resolved command (basename), not the agent id. A custom agent id
+    // pointing at claude-agent-acp still needs CLAUDE_CODE_OAUTH_TOKEN,
+    // so injection + preflight must fire regardless of the id string.
+    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-token-zzz");
+    config.setConfig({
+      agents: {
+        "my-claude": {
+          command: "claude-agent-acp",
+          args: [],
+        },
+      },
+    });
+
+    const handler = getSpawnHandler();
+    await handler({
+      body: {
+        agent: "my-claude",
+        task: "do a thing",
+        conversationId: "conv-1",
+      },
+    });
+
+    expect(capturedSpawns).toHaveLength(1);
+    expect(capturedSpawns[0]?.agent).toBe("my-claude");
+    expect(capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe(
+      "vault-token-zzz",
+    );
+  });
+
+  test("throws FailedDependencyError when no CLAUDE_CODE_OAUTH_TOKEN is available from any source", async () => {
+    // secureKeyStore intentionally empty AND no agentConfig.env override —
+    // simulates a fresh install where the user hasn't provisioned a token
+    // via either route. Fail-fast preflight surfaces this immediately
+    // instead of letting claude-agent-acp launch, crash on auth, and leave
+    // a zombie subprocess behind.
+
+    const handler = getSpawnHandler();
+    await expect(
+      handler({
+        body: {
+          agent: "claude",
+          task: "do a thing",
+          conversationId: "conv-1",
+        },
+      }),
+    ).rejects.toThrow(/CLAUDE_CODE_OAUTH_TOKEN/);
+    expect(capturedSpawns).toHaveLength(0);
+  });
+
+  test("does NOT inject CLAUDE_CODE_OAUTH_TOKEN for agents whose command is not claude-agent-acp", async () => {
+    // Token-injection AND preflight are scoped to claude-agent-acp by
+    // command basename. A codex-acp spawn with the secure-store key set
+    // must still launch without that env var — and must not be blocked
+    // by claude's preflight.
+    secureKeyStore.set(
+      "credential/acp/claude_oauth_token",
+      "test-token-abc123",
+    );
+
+    const handler = getSpawnHandler();
+    await handler({
+      body: {
+        agent: "codex",
+        task: "do a thing",
+        conversationId: "conv-1",
+      },
+    });
+
+    expect(capturedSpawns).toHaveLength(1);
+    expect(capturedSpawns[0]?.agent).toBe("codex");
+    expect(
+      capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN,
+    ).toBeUndefined();
+  });
+
+  test("does NOT pick up a token planted at the legacy non-`credential/` key path", async () => {
+    // Regression guard: the original implementation used the raw key
+    // "acp/claude/oauth_token". The fix routes through `credentialKey()`
+    // so the CLI (`assistant credentials set --service acp --field
+    // claude_oauth_token`) is the canonical provisioning path. Pin this
+    // by planting the token ONLY under the legacy key — the preflight
+    // should fail-fast because the canonical path is empty.
+    secureKeyStore.set("acp/claude/oauth_token", "legacy-token-should-miss");
+
+    const handler = getSpawnHandler();
+    await expect(
+      handler({
+        body: {
+          agent: "claude",
+          task: "do a thing",
+          conversationId: "conv-1",
+        },
+      }),
+    ).rejects.toThrow(/CLAUDE_CODE_OAUTH_TOKEN/);
+    expect(capturedSpawns).toHaveLength(0);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // DELETE /v1/acp/sessions?status=completed — bulk-clear terminal rows
 // ---------------------------------------------------------------------------
@@ -205,7 +446,9 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
     seedHistoryRow("row-initializing", "initializing", 5000);
 
     const handler = getBulkDeleteHandler();
-    const result = (await handler({ queryParams: { status: "completed" } })) as {
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
       deleted: number;
     };
     expect(result.deleted).toBe(3);
@@ -221,7 +464,9 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
     seedHistoryRow("row-running", "running", 1000);
 
     const handler = getBulkDeleteHandler();
-    const result = (await handler({ queryParams: { status: "completed" } })) as {
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
       deleted: number;
     };
     expect(result.deleted).toBe(0);
@@ -244,7 +489,9 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
     seedHistoryRow("row-completed", "completed", 1000);
 
     const handler = getBulkDeleteHandler();
-    expect(() => handler({ queryParams: { status: "failed" } })).toThrow("status");
+    expect(() => handler({ queryParams: { status: "failed" } })).toThrow(
+      "status",
+    );
     expect(listRows()).toHaveLength(1);
   });
 });
@@ -297,7 +544,9 @@ describe("DELETE /v1/acp/sessions/:id", () => {
     insertHistoryRow({ id: "sess-completed", status: "completed" });
 
     const handler = getDeleteSessionHandler();
-    const result = (await handler({ pathParams: { id: "sess-completed" } })) as {
+    const result = (await handler({
+      pathParams: { id: "sess-completed" },
+    })) as {
       deleted: boolean;
     };
     expect(result.deleted).toBe(true);