npm - agent-nuvira - Versions diffs - 2.7.0 → 2.7.2 - Mend

agent-nuvira 2.7.0 → 2.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (114) hide show

package/dist/agents/orchestrator.d.ts.map +1 -1
package/dist/agents/orchestrator.js +17 -3
package/dist/agents/orchestrator.js.map +1 -1
package/dist/app.js +26 -0
package/dist/cli/chat.d.ts.map +1 -1
package/dist/cli/chat.js +108 -2
package/dist/cli/chat.js.map +1 -1
package/dist/config/auth.js +18 -0
package/dist/config/jwt.js +24 -0
package/dist/config/keys.js +14 -0
package/dist/gateway/chat-store.d.ts +32 -5
package/dist/gateway/chat-store.d.ts.map +1 -1
package/dist/gateway/chat-store.js +52 -6
package/dist/gateway/chat-store.js.map +1 -1
package/dist/gateway/registry.d.ts.map +1 -1
package/dist/gateway/registry.js +54 -10
package/dist/gateway/registry.js.map +1 -1
package/dist/inference/model-validator.d.ts.map +1 -1
package/dist/inference/model-validator.js +11 -1
package/dist/inference/model-validator.js.map +1 -1
package/dist/inference/tool-call-utils.d.ts +31 -0
package/dist/inference/tool-call-utils.d.ts.map +1 -1
package/dist/inference/tool-call-utils.js +41 -0
package/dist/inference/tool-call-utils.js.map +1 -1
package/dist/learning/reasoning-trace.d.ts +5 -3
package/dist/learning/reasoning-trace.d.ts.map +1 -1
package/dist/learning/reasoning-trace.js +2 -2
package/dist/learning/reasoning-trace.js.map +1 -1
package/dist/middleware/auth.js +30 -0
package/dist/nlu/conversation-gate.js +1 -1
package/dist/nlu/conversation-gate.js.map +1 -1
package/dist/nlu/entities.d.ts.map +1 -1
package/dist/nlu/entities.js +12 -0
package/dist/nlu/entities.js.map +1 -1
package/dist/nlu/intent.d.ts.map +1 -1
package/dist/nlu/intent.js +83 -15
package/dist/nlu/intent.js.map +1 -1
package/dist/passport.js +34 -0
package/dist/routes/auth.js +42 -0
package/dist/routes/user.js +31 -0
package/dist/server.js +17 -0
package/dist/tools/pipeline-tool.d.ts.map +1 -1
package/dist/tools/pipeline-tool.js +14 -0
package/dist/tools/pipeline-tool.js.map +1 -1
package/dist/tools/release-sync.d.ts +52 -16
package/dist/tools/release-sync.d.ts.map +1 -1
package/dist/tools/release-sync.js +143 -79
package/dist/tools/release-sync.js.map +1 -1
package/dist/web-dashboard/src/App.js +85 -0
package/dist/web-dashboard/src/admin-auth.test.js +186 -0
package/dist/web-dashboard/src/ansi.js +23 -0
package/dist/web-dashboard/src/ansi.test.js +31 -0
package/dist/web-dashboard/src/api-admin-auth.test.js +172 -0
package/dist/web-dashboard/src/api-admin.test.js +65 -0
package/dist/web-dashboard/src/api-hub.test.js +117 -0
package/dist/web-dashboard/src/api.js +1421 -0
package/dist/web-dashboard/src/api.test.js +51 -0
package/dist/web-dashboard/src/artifacts.js +128 -0
package/dist/web-dashboard/src/artifacts.test.js +139 -0
package/dist/web-dashboard/src/components/AdminPanel.js +567 -0
package/dist/web-dashboard/src/components/AdminPanel.test.js +288 -0
package/dist/web-dashboard/src/components/AgentHub.js +1580 -0
package/dist/web-dashboard/src/components/AgentHub.test.js +343 -0
package/dist/web-dashboard/src/components/BedrockOnboarding.js +320 -0
package/dist/web-dashboard/src/components/BenchmarkCharts.js +228 -0
package/dist/web-dashboard/src/components/ChatPage.js +1586 -0
package/dist/web-dashboard/src/components/ChatPage.test.js +899 -0
package/dist/web-dashboard/src/components/ContactsPage.js +141 -0
package/dist/web-dashboard/src/components/CostDashboard.js +105 -0
package/dist/web-dashboard/src/components/DAGView.js +477 -0
package/dist/web-dashboard/src/components/DAGView.test.js +147 -0
package/dist/web-dashboard/src/components/EnvVarEditor.js +138 -0
package/dist/web-dashboard/src/components/EvalsPage.js +73 -0
package/dist/web-dashboard/src/components/EvalsPage.test.js +120 -0
package/dist/web-dashboard/src/components/ExecutionHistory.js +201 -0
package/dist/web-dashboard/src/components/GatewayPage.js +40 -0
package/dist/web-dashboard/src/components/GatewayPage.test.js +74 -0
package/dist/web-dashboard/src/components/HealthPanel.js +68 -0
package/dist/web-dashboard/src/components/HistoryBrowser.js +34 -0
package/dist/web-dashboard/src/components/Layout.js +50 -0
package/dist/web-dashboard/src/components/Markdown.js +152 -0
package/dist/web-dashboard/src/components/Markdown.test.js +126 -0
package/dist/web-dashboard/src/components/MarkdownZeroDep.js +237 -0
package/dist/web-dashboard/src/components/MemoryPanel.js +81 -0
package/dist/web-dashboard/src/components/ModelTimeline.js +298 -0
package/dist/web-dashboard/src/components/ModelsPanel.js +1484 -0
package/dist/web-dashboard/src/components/ModelsPanel.test.js +460 -0
package/dist/web-dashboard/src/components/Overview.js +123 -0
package/dist/web-dashboard/src/components/PhaseTimeline.js +359 -0
package/dist/web-dashboard/src/components/PhaseTimeline.test.js +234 -0
package/dist/web-dashboard/src/components/PlatformConfigSection.js +384 -0
package/dist/web-dashboard/src/components/PlatformConfigSection.test.js +106 -0
package/dist/web-dashboard/src/components/PlatformsPage.js +250 -0
package/dist/web-dashboard/src/components/QuotaPanel.js +159 -0
package/dist/web-dashboard/src/components/QuotaPanel.test.js +85 -0
package/dist/web-dashboard/src/components/RequestsPanel.js +229 -0
package/dist/web-dashboard/src/components/RequestsPanel.test.js +103 -0
package/dist/web-dashboard/src/components/RoutingInsightsPanel.js +938 -0
package/dist/web-dashboard/src/components/RoutingInsightsPanel.test.js +339 -0
package/dist/web-dashboard/src/components/RoutingWalkthrough.js +408 -0
package/dist/web-dashboard/src/components/RoutingWalkthrough.test.js +209 -0
package/dist/web-dashboard/src/components/TaskConsole.js +119 -0
package/dist/web-dashboard/src/components/TaskConsole.test.js +123 -0
package/dist/web-dashboard/src/components/TasksPage.js +256 -0
package/dist/web-dashboard/src/components/TasksPage.test.js +103 -0
package/dist/web-dashboard/src/components/TracePanel.js +306 -0
package/dist/web-dashboard/src/components/WhatsAppPanel.js +195 -0
package/dist/web-dashboard/src/components/WhatsAppPanel.test.js +122 -0
package/dist/web-dashboard/src/jsonOrNull.js +37 -0
package/dist/web-dashboard/src/main.js +15 -0
package/dist/web-dashboard/src/mask.js +11 -0
package/dist/web-dashboard/vite.config.js +23 -0
package/dist/web-dashboard/vitest.config.js +15 -0
package/package.json +5 -3

package/dist/web-dashboard/src/api-admin-auth.test.js ADDED Viewed

@@ -0,0 +1,172 @@
+"use strict";
+// @vitest-environment jsdom
+// (token persistence uses localStorage — jsdom; the file-extension default is node)
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Admin write-surface API tests (Session 18).
+ *
+ * Covers the auth gate + provider write methods on DashboardAPI: auth-status
+ * parsing, login/setup persisting the Bearer token, save/delete/test provider
+ * sending the token + parsing the (possibly masked) refreshed row, 401 error
+ * propagation (the session-expired signal the panel needs), and the same
+ * stale-server HTML-200 degradation every other dashboard fetch has.
+ */
+const vitest_1 = require("vitest");
+const api_1 = require("./api");
+const jsonResponse = (data, status = 200) => new Response(JSON.stringify(data), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+});
+const htmlResponse = () => new Response('<!DOCTYPE html><html><body>SPA fallback</body></html>', {
+    status: 200,
+    headers: { 'Content-Type': 'text/html' },
+});
+const AUTHED = { configured: true, authenticated: true, user: 'admin', role: 'admin' };
+const USERS = [
+    { user: 'admin', role: 'admin', createdAt: 100 },
+    { user: 'view', role: 'viewer', createdAt: 200 },
+];
+const ROW = { type: 'groq', configured: true, keySource: 'config', keyMasked: 'gsk_…abcd', model: 'm1', baseUrl: 'https://api.groq.com' };
+(0, vitest_1.describe)('DashboardAPI admin auth surface', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+        (0, api_1.setAdminToken)(null);
+    });
+    (0, vitest_1.it)('parses /api/admin/auth-status (configured + authenticated)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(AUTHED));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchAdminAuthStatus()).toEqual(AUTHED);
+    });
+    (0, vitest_1.it)('returns null for a stale server answering HTML — no crash', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(htmlResponse());
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchAdminAuthStatus()).toBeNull();
+    });
+    (0, vitest_1.it)('login persists the token and clears it on logout', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, user: 'admin', token: 'tok-1' }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.adminLogin('admin', 'secret-pass');
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        (0, vitest_1.expect)((0, api_1.getAdminToken)()).toBe('tok-1');
+        await api.adminLogout();
+        (0, vitest_1.expect)((0, api_1.getAdminToken)()).toBeNull();
+    });
+    (0, vitest_1.it)('login surfaces the 401 error message (wrong password) without persisting a token', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: 'Invalid username or password.' }, 401));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.adminLogin('admin', 'wrong');
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.unauthorized).toBe(true);
+        (0, vitest_1.expect)(r.error).toContain('Invalid');
+        (0, vitest_1.expect)((0, api_1.getAdminToken)()).toBeNull();
+    });
+    (0, vitest_1.it)('setup persists the token on success', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, user: 'admin', token: 'tok-setup' }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.adminSetup('admin', 'long-enough-pass');
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        (0, vitest_1.expect)((0, api_1.getAdminToken)()).toBe('tok-setup');
+    });
+});
+(0, vitest_1.describe)('DashboardAPI provider write surface', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+        (0, api_1.setAdminToken)(null);
+    });
+    const expectAuthHeader = (input, init) => {
+        (0, vitest_1.expect)(String(input)).toContain('/api/admin/providers/groq');
+        (0, vitest_1.expect)(init?.headers).toMatchObject({ Authorization: 'Bearer tok-auth' });
+    };
+    (0, vitest_1.it)('saveProvider sends the token and returns the refreshed masked row', async () => {
+        (0, api_1.setAdminToken)('tok-auth');
+        const spy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, provider: ROW }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.saveProvider('groq', { apiKey: 'gsk_new', baseUrl: 'https://api.groq.com' });
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        (0, vitest_1.expect)(r.provider?.keyMasked).toBe('gsk_…abcd');
+        (0, vitest_1.expect)(spy).toHaveBeenCalledTimes(1);
+        const [input, init] = spy.mock.calls[0];
+        expectAuthHeader(input, init);
+        (0, vitest_1.expect)(JSON.parse(init.body)).toMatchObject({ apiKey: 'gsk_new' });
+    });
+    (0, vitest_1.it)('saveProvider without a token reports unauthorized (401) so the panel shows login', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: 'Not authenticated — log in first.' }, 401));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.saveProvider('groq', { apiKey: 'x' });
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.unauthorized).toBe(true);
+    });
+    (0, vitest_1.it)('deleteProvider returns ok + the cleared row', async () => {
+        (0, api_1.setAdminToken)('tok-auth');
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, cleared: true, provider: { ...ROW, configured: false, keySource: 'none', keyMasked: null } }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.deleteProvider('groq');
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        (0, vitest_1.expect)(r.cleared).toBe(true);
+    });
+    (0, vitest_1.it)('testProvider parses the model list on success and the error message on failure', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, models: ['llama-3.3-70b', 'mixtral'] }));
+        const api = new api_1.DashboardAPI('http://test');
+        const ok = await api.testProvider('groq');
+        (0, vitest_1.expect)(ok.ok).toBe(true);
+        (0, vitest_1.expect)(ok.models).toHaveLength(2);
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: '401 invalid key' }));
+        const bad = await api.testProvider('nim');
+        (0, vitest_1.expect)(bad.ok).toBe(false);
+        (0, vitest_1.expect)(bad.error).toContain('401');
+    });
+    (0, vitest_1.it)('degrades to a network-failure message (never throws)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockRejectedValue(new TypeError('Failed to fetch'));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.saveProvider('groq', { apiKey: 'x' });
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.error).toMatch(/reach/i);
+    });
+});
+(0, vitest_1.describe)('DashboardAPI user management (role.manage)', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+        (0, api_1.setAdminToken)(null);
+    });
+    (0, vitest_1.it)('fetchAdminUsers parses the user list with the token attached', async () => {
+        (0, api_1.setAdminToken)('tok-auth');
+        const spy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, users: USERS }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.fetchAdminUsers();
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        (0, vitest_1.expect)(r.users).toHaveLength(2);
+        (0, vitest_1.expect)(r.users[0]).toMatchObject({ user: 'admin', role: 'admin' });
+        const [input, init] = spy.mock.calls[0];
+        (0, vitest_1.expect)(String(input)).toContain('/api/admin/users');
+        (0, vitest_1.expect)(init?.headers).toMatchObject({ Authorization: 'Bearer tok-auth' });
+    });
+    (0, vitest_1.it)('addAdminUser POSTs user/password/role and clears the form state on success', async () => {
+        (0, api_1.setAdminToken)('tok-auth');
+        const spy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.addAdminUser('view', 'viewer-pass-12', 'viewer');
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        const [input, init] = spy.mock.calls[0];
+        (0, vitest_1.expect)(String(input)).toContain('/api/admin/users');
+        (0, vitest_1.expect)(JSON.parse(init.body)).toEqual({ user: 'view', password: 'viewer-pass-12', role: 'viewer' });
+    });
+    (0, vitest_1.it)('reports forbidden (403) when the role may not manage users', async () => {
+        (0, api_1.setAdminToken)('tok-viewer');
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: "Access denied — role 'viewer' cannot manage users (requires admin)." }, 403));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.fetchAdminUsers();
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.forbidden).toBe(true);
+        (0, vitest_1.expect)(r.error).toContain('Access denied');
+    });
+    (0, vitest_1.it)('removeAdminUser DELETEs by name', async () => {
+        (0, api_1.setAdminToken)('tok-auth');
+        const spy = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, removed: true }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.removeAdminUser('view');
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        const [input, init] = spy.mock.calls[0];
+        (0, vitest_1.expect)(String(input)).toContain('/api/admin/users/view');
+        (0, vitest_1.expect)(init?.method).toBe('DELETE');
+    });
+});

package/dist/web-dashboard/src/api-admin.test.js ADDED Viewed

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Admin command-runner fetch tests (Session 17).
+ *
+ * fetchAdminChecks() drives the dashboard's /api/admin/checks endpoint — the
+ * on-demand execution of ALL state commands (doctor system + enterprise
+ * checks + masked provider summary). Regression coverage for the same
+ * parseJsonOrNull contract every other dashboard fetch uses: a stale server
+ * answering HTML must degrade to null, never crash.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const api_1 = require("./api");
+const jsonResponse = (data) => new Response(JSON.stringify(data), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+});
+const htmlResponse = () => new Response('<!DOCTYPE html><html><body>SPA fallback</body></html>', {
+    status: 200,
+    headers: { 'Content-Type': 'text/html' },
+});
+const VALID_PAYLOAD = {
+    system: [{ name: 'Config Directory', status: 'pass', message: '~/.nuvira/ exists' }],
+    enterprise: [{ name: 'Secrets Backend', status: 'warn', message: 'keys in config' }],
+    providers: [{ type: 'groq', configured: true, keySource: 'env', keyMasked: 'gsk_…abcd' }],
+    serverTime: 123,
+};
+(0, vitest_1.describe)('DashboardAPI.fetchAdminChecks', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)('parses a real /api/admin/checks response', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(VALID_PAYLOAD));
+        const api = new api_1.DashboardAPI('http://test');
+        const data = await api.fetchAdminChecks();
+        (0, vitest_1.expect)(data).toMatchObject({ serverTime: 123 });
+        (0, vitest_1.expect)(data.system[0].status).toBe('pass');
+        (0, vitest_1.expect)(data.providers[0].keySource).toBe('env');
+    });
+    (0, vitest_1.it)('returns null when the server answers HTML (stale server) — no crash', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(htmlResponse());
+        const api = new api_1.DashboardAPI('http://test');
+        const data = await api.fetchAdminChecks();
+        (0, vitest_1.expect)(data).toBeNull();
+    });
+    (0, vitest_1.it)('returns null when the payload lacks the checks arrays', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ serverTime: 1 }));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchAdminChecks()).toBeNull();
+    });
+    (0, vitest_1.it)('returns null when the payload lacks the providers array (panel would crash on .length)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({
+            system: [],
+            enterprise: [],
+            serverTime: 1,
+        }));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchAdminChecks()).toBeNull();
+    });
+    (0, vitest_1.it)('returns null on network failure', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('down'));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchAdminChecks()).toBeNull();
+    });
+});

package/dist/web-dashboard/src/api-hub.test.js ADDED Viewed

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Agent Hub API client tests (I4 + I5).
+ *
+ * fetchHub() — the aggregated read the 4-tab panel polls. setToolsetEnabled()
+ * — the admin-gated write (PUT /api/admin/hub/toolsets/<name>) that persists
+ * the toggle to buffconfig. Both follow the same stale-server contract as the
+ * other dashboard fetches: HTML-200 / malformed / network failure degrade to
+ * null or { ok:false }, never a crash.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const api_1 = require("./api");
+const jsonResponse = (data, status = 200) => new Response(JSON.stringify(data), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+});
+const htmlResponse = () => new Response('<!DOCTYPE html><html><body>SPA fallback</body></html>', {
+    status: 200,
+    headers: { 'Content-Type': 'text/html' },
+});
+const HUB_PAYLOAD = {
+    toolsets: {
+        toolsets: [
+            { name: 'core', label: 'Core', description: 'Pipeline actions', enabled: true, tools: ['build'], toolCount: 1 },
+            { name: 'web', label: 'Web research', description: 'Search + read', enabled: true, tools: ['web_search'], toolCount: 1 },
+        ],
+        enabled: 2,
+        disabled: 0,
+        totalTools: 2,
+    },
+    channels: {
+        delivery: { total: 1, pending: 1, sent: 0, failed: 0, recent: [] },
+        aliases: [],
+        reachable: [],
+        platforms: [
+            { platform: 'email', label: 'Email (SMTP)', configured: false, envVars: ['BUFF_SMTP_HOST', 'BUFF_SMTP_USER'] },
+            { platform: 'signal', label: 'Signal (signal-cli-rest-api)', configured: true, envVars: ['BUFF_SIGNAL_ACCOUNT'] },
+        ],
+        policies: {},
+        contacts: [],
+        statusRecipients: [],
+        statusRecipientDisplay: {},
+        inbox: { total: 0, pipeline: 0, chat: 0, help: 0, refused: 0, recent: [] },
+    },
+    artifacts: { totalSessions: 0, totalArtifacts: 0, sessions: [] },
+    skills: { compiled: [], hub: [], total: 0 },
+    adminConfigured: false,
+    serverTime: 123,
+};
+(0, vitest_1.describe)('DashboardAPI.fetchHub', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)('parses a real /api/hub response', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(HUB_PAYLOAD));
+        const api = new api_1.DashboardAPI('http://test');
+        const data = await api.fetchHub();
+        (0, vitest_1.expect)(data).not.toBeNull();
+        (0, vitest_1.expect)(data.toolsets.toolsets).toHaveLength(2);
+        (0, vitest_1.expect)(data.adminConfigured).toBe(false);
+    });
+    (0, vitest_1.it)('returns null when the payload lacks the toolsets array (stale server shape)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ serverTime: 1 }));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchHub()).toBeNull();
+    });
+    (0, vitest_1.it)('returns null on an HTML answer (stale server) — no crash', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(htmlResponse());
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchHub()).toBeNull();
+    });
+    (0, vitest_1.it)('returns null on network failure', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('down'));
+        const api = new api_1.DashboardAPI('http://test');
+        (0, vitest_1.expect)(await api.fetchHub()).toBeNull();
+    });
+});
+(0, vitest_1.describe)('DashboardAPI.setToolsetEnabled', () => {
+    (0, vitest_1.afterEach)(() => {
+        vitest_1.vi.restoreAllMocks();
+        (0, api_1.setAdminToken)(null);
+    });
+    (0, vitest_1.it)('PUTs { enabled } to the admin route with the bearer token', async () => {
+        (0, api_1.setAdminToken)('tok-123');
+        const fetchMock = vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: true, toolset: 'web', enabled: false }));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.setToolsetEnabled('web', false);
+        (0, vitest_1.expect)(r.ok).toBe(true);
+        const [url, init] = fetchMock.mock.calls[0];
+        (0, vitest_1.expect)(String(url)).toBe('http://test/api/admin/hub/toolsets/web');
+        (0, vitest_1.expect)(init?.method).toBe('PUT');
+        (0, vitest_1.expect)(JSON.parse(String(init?.body))).toEqual({ enabled: false });
+        (0, vitest_1.expect)((init?.headers).Authorization).toBe('Bearer tok-123');
+    });
+    (0, vitest_1.it)('surfaces 401 as unauthorized (session expired)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: 'Not authenticated' }, 401));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.setToolsetEnabled('web', true);
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.unauthorized).toBe(true);
+    });
+    (0, vitest_1.it)('surfaces 403 as forbidden (role cannot change capabilities)', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ ok: false, error: 'Access denied' }, 403));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.setToolsetEnabled('web', true);
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.forbidden).toBe(true);
+    });
+    (0, vitest_1.it)('returns a friendly error on network failure', async () => {
+        vitest_1.vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('down'));
+        const api = new api_1.DashboardAPI('http://test');
+        const r = await api.setToolsetEnabled('web', true);
+        (0, vitest_1.expect)(r.ok).toBe(false);
+        (0, vitest_1.expect)(r.error).toContain('Could not reach');
+    });
+});