claude-code-session-manager 0.37.1 → 0.37.2

package/src/main/__tests__/docEdit.test.cjs

@@ -6,10 +6,27 @@
 
 'use strict';
 
-import { test, expect, describe } from 'vitest';
-const { parseDocEdit } = require('../docEdit.cjs');
+import { test, expect, describe, beforeEach, vi } from 'vitest';
+
+// docEdit.cjs requires chatRunner.cjs at module scope and calls `chatRunner.run(...)`
+// as a property access, so patching `run` on the already-required (cached) module
+// object — before docEdit.cjs's own require resolves to the same singleton — is
+// enough to intercept it, mirroring the exchanges.cjs patch pattern in chatRunner.spec.ts.
+const chatRunnerModule = require('../chatRunner.cjs');
+const runCalls = [];
+beforeEach(() => { runCalls.length = 0; });
+chatRunnerModule.run = (opts) => { runCalls.push(opts); };
+
+const { parseDocEdit, editPrompt, truncateDocumentText, MAX_DOC_CONTEXT, docEditViaSession, attachWindow } = require('../docEdit.cjs');
 const { duplicateNameFor } = require('../files.cjs');
 
+const broadcasts = [];
+attachWindow({
+  isDestroyed: () => false,
+  webContents: { isDestroyed: () => false, send: (channel, payload) => broadcasts.push({ channel, payload }) },
+});
+beforeEach(() => { broadcasts.length = 0; });
+
 describe('parseDocEdit', () => {
   test('valid JSON', () => {
     const result = parseDocEdit('{"after":"rewritten text"}');
@@ -57,6 +74,151 @@ describe('parseDocEdit', () => {
   });
 });
 
+describe('editPrompt', () => {
+  test('omits the document block when documentText is absent', () => {
+    const prompt = editPrompt('selected text', 'make it concise');
+    expect(prompt).not.toMatch(/<document_/);
+  });
+
+  test('includes a nonce-tagged document block when documentText is provided', () => {
+    const prompt = editPrompt('selected text', 'make it concise', 'the whole document');
+    expect(prompt).toMatch(/<document_[0-9a-f]+>/);
+    expect(prompt).toContain('the whole document');
+  });
+
+  test('truncates an oversized documentText before embedding it', () => {
+    const huge = 'x'.repeat(MAX_DOC_CONTEXT + 5000);
+    const prompt = editPrompt('selected text', 'make it concise', huge);
+    expect(prompt).toContain('[...document truncated for length...]');
+    expect(prompt.length).toBeLessThan(huge.length + 2000);
+  });
+});
+
+describe('truncateDocumentText', () => {
+  test('passes short text through unchanged', () => {
+    expect(truncateDocumentText('short')).toBe('short');
+  });
+
+  test('truncates to the documented head+tail scheme rather than dropping or erroring', () => {
+    const head = 'H'.repeat(40000);
+    const tail = 'T'.repeat(20000);
+    const middle = 'M'.repeat(10000);
+    const result = truncateDocumentText(head + middle + tail);
+    expect(result).toBe(`${head}\n\n[...document truncated for length...]\n\n${tail}`);
+    expect(result).not.toContain('M');
+  });
+});
+
+describe('docEditViaSession', () => {
+  test('builds its prompt via the shared editPrompt and calls chatRunner.run with resume+silent', () => {
+    docEditViaSession({
+      tabId: 'tab-1',
+      sessionId: 'chat-session-1',
+      cwd: '/home/user/project',
+      before: 'old text',
+      instruction: 'make it punchier',
+      documentText: 'the whole document',
+      requestId: 'req-1',
+    });
+
+    expect(runCalls).toHaveLength(1);
+    const call = runCalls[0];
+    expect(call.tabId).toBe('tab-1');
+    expect(call.sessionId).toBe('chat-session-1');
+    expect(call.cwd).toBe('/home/user/project');
+    expect(call.resume).toBe(true);
+    expect(call.silent).toBe(true);
+    expect(typeof call.onSilentResult).toBe('function');
+
+    // The prompt is the shared editPrompt's output (nonce-tagged, so compare
+    // structurally rather than byte-for-byte) prefixed with the anti-injection
+    // system framing — not a second, forked prompt builder.
+    expect(call.prompt).toContain('Rewrite the SELECTION below per the INSTRUCTION');
+    expect(call.prompt).toMatch(/<selection_[0-9a-f]+>\nold text\n<\/selection_[0-9a-f]+>/);
+    expect(call.prompt).toContain('deterministic document-rewrite assistant');
+  });
+
+  test('onSilentResult parses the reply and broadcasts docedit:session-result', () => {
+    docEditViaSession({
+      tabId: 'tab-2',
+      sessionId: 'chat-session-2',
+      cwd: '/home/user/project',
+      before: 'old text',
+      instruction: 'shorten it',
+      requestId: 'req-2',
+    });
+
+    const { onSilentResult } = runCalls[runCalls.length - 1];
+    onSilentResult('{"after":"new text"}');
+    expect(broadcasts).toHaveLength(1);
+    expect(broadcasts[0]).toEqual({
+      channel: 'docedit:session-result',
+      payload: { tabId: 'tab-2', requestId: 'req-2', ok: true, after: 'new text' },
+    });
+  });
+
+  test('onSilentResult reports a parse failure as ok:false', () => {
+    docEditViaSession({
+      tabId: 'tab-3',
+      sessionId: 'chat-session-3',
+      cwd: '/home/user/project',
+      before: 'old text',
+      instruction: 'shorten it',
+      requestId: 'req-3',
+    });
+
+    const { onSilentResult } = runCalls[runCalls.length - 1];
+    onSilentResult('not json at all');
+    expect(broadcasts).toHaveLength(1);
+    expect(broadcasts[0].payload.ok).toBe(false);
+    expect(broadcasts[0].payload.error).toBeTruthy();
+  });
+
+  test('splits off the stop-signal protocol and reports it as a clarification request', () => {
+    docEditViaSession({
+      tabId: 'tab-4',
+      sessionId: 'chat-session-4',
+      cwd: '/home/user/project',
+      before: 'old text',
+      instruction: 'shorten it',
+      requestId: 'req-4',
+    });
+
+    const { onSilentResult } = runCalls[runCalls.length - 1];
+    onSilentResult('<<<SM_NEEDS_INPUT>>>\n{"questions":["which section?"]}');
+    expect(broadcasts).toHaveLength(1);
+    expect(broadcasts[0].payload.ok).toBe(false);
+    expect(broadcasts[0].payload.error).toContain('which section?');
+  });
+
+  test('times out and broadcasts a failure if chatRunner never calls onSilentResult (error/timeout/cancel/collision on the silent lane)', () => {
+    vi.useFakeTimers();
+    try {
+      docEditViaSession({
+        tabId: 'tab-5',
+        sessionId: 'chat-session-5',
+        cwd: '/home/user/project',
+        before: 'old text',
+        instruction: 'shorten it',
+        requestId: 'req-5',
+      });
+
+      // chatRunner.run() is a no-op stub in this test (never invokes
+      // onSilentResult) — nothing should broadcast until the bound elapses.
+      expect(broadcasts).toHaveLength(0);
+
+      vi.advanceTimersByTime(120_000);
+      expect(broadcasts).toHaveLength(1);
+      expect(broadcasts[0]).toEqual({
+        channel: 'docedit:session-result',
+        payload: { tabId: 'tab-5', requestId: 'req-5', ok: false, error: 'timed out waiting on the background session' },
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
 describe('duplicateNameFor', () => {
   test('fresh name — no collision', () => {
     const result = duplicateNameFor('/tmp/dir', 'notes.txt', () => false);

package/src/main/__tests__/prdCreate.test.cjs

@@ -1,40 +1,48 @@
 /**
  * prdCreate.test.cjs — unit tests for the create-PRD body builder (PRD 549,
- * gh-issue-6). Pure-function tests only; the HTTP route + auth/cwd-boundary
- * behavior is covered by adminServer.test.cjs.
+ * gh-issue-6) and, since PRD 689, its registerAdminRoute create-prd HTTP
+ * route (moved verbatim out of the former standalone admin HTTP server
+ * module's handleRequest).
  *
- * Run: timeout 120 node --test src/main/__tests__/prdCreate.test.cjs
+ * Run: timeout 120 npx vitest run src/main/__tests__/prdCreate.test.cjs
  */
 
 'use strict';
 
-const { test } = require('node:test');
-const assert = require('node:assert/strict');
+import { test, expect } from 'vitest';
 const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
 const {
   deriveSlugFromTitle,
   buildPrdBody,
   readStandards,
+  STANDARDS_PATH,
   PRD_CREATE_SLUG_RE,
+  registerAdminRoute,
 } = require('../lib/prdCreate.cjs');
+const { createAdminHttp } = require('../lib/localAdminHttp.cjs');
+const config = require('../config.cjs');
+const prdParser = require('../scheduler/prdParser.cjs');
 
 test('deriveSlugFromTitle lowercases, kebab-cases, and strips non-alnum runs', () => {
-  assert.strictEqual(deriveSlugFromTitle('Add Foo Bar!! Baz'), 'add-foo-bar-baz');
-  assert.strictEqual(deriveSlugFromTitle('  leading/trailing  '), 'leading-trailing');
+  expect(deriveSlugFromTitle('Add Foo Bar!! Baz')).toBe('add-foo-bar-baz');
+  expect(deriveSlugFromTitle('  leading/trailing  ')).toBe('leading-trailing');
 });
 
 test('deriveSlugFromTitle output always satisfies PRD_CREATE_SLUG_RE', () => {
   const slug = deriveSlugFromTitle('Some Title 123');
-  assert.ok(PRD_CREATE_SLUG_RE.test(slug));
+  expect(PRD_CREATE_SLUG_RE.test(slug)).toBeTruthy();
 });
 
 test('readStandards reads the real standards.md and returns non-empty text', async () => {
   const text = await readStandards();
-  assert.ok(text.includes('Execution discipline'));
+  expect(text.includes('Execution discipline')).toBeTruthy();
 });
 
 test('buildPrdBody emits required frontmatter keys and body sections in order', async () => {
-  const standards = await readStandards();
   const body = buildPrdBody({
     title: 'Do the thing',
     cwd: '~/Projects/session-manager',
@@ -43,40 +51,272 @@ test('buildPrdBody emits required frontmatter keys and body sections in order',
     acceptanceCriteria: ['thing exists', 'tests pass'],
     implementationNotes: 'See file.cjs:10.',
     outOfScope: ['not this'],
-  }, standards);
+  });
 
-  assert.ok(body.startsWith('---\n'));
-  assert.match(body, /title: Do the thing/);
-  assert.match(body, /cwd: ~\/Projects\/session-manager/);
-  assert.match(body, /estimateMinutes: 15/);
+  expect(body.startsWith('---\n')).toBeTruthy();
+  expect(body).toMatch(/title: Do the thing/);
+  expect(body).toMatch(/cwd: ~\/Projects\/session-manager/);
+  expect(body).toMatch(/estimateMinutes: 15/);
 
   const goalIdx = body.indexOf('# Goal');
   const acIdx = body.indexOf('# Acceptance criteria');
   const implIdx = body.indexOf('# Implementation notes');
   const oosIdx = body.indexOf('# Out of scope');
   const standardsIdx = body.indexOf('## Engineering standards');
-  assert.ok(goalIdx > 0 && goalIdx < acIdx && acIdx < implIdx && implIdx < oosIdx && oosIdx < standardsIdx,
-    'sections must appear in Goal -> AC -> Implementation notes -> Out of scope -> Engineering standards order');
+  // sections must appear in Goal -> AC -> Implementation notes -> Out of scope -> Engineering standards order
+  expect(goalIdx > 0 && goalIdx < acIdx && acIdx < implIdx && implIdx < oosIdx && oosIdx < standardsIdx).toBeTruthy();
 
-  assert.match(body, /- \[ \] thing exists/);
-  assert.match(body, /- \[ \] tests pass/);
-  assert.match(body, /- not this/);
-  assert.ok(body.includes('Execution discipline'), 'must inline the standards.md content verbatim');
+  expect(body).toMatch(/- \[ \] thing exists/);
+  expect(body).toMatch(/- \[ \] tests pass/);
+  expect(body).toMatch(/- not this/);
+  // must point at STANDARDS_PATH rather than inline the standards.md content
+  expect(body.includes(STANDARDS_PATH)).toBeTruthy();
+  expect(body).toMatch(/Before writing any code, read/);
+  // the pointer block mentions "Execution discipline" by name, but must not
+  // inline the full standards.md prose (e.g. its Performance-section rules)
+  expect(body.includes('Lay out hot data contiguously')).toBeFalsy();
 });
 
 test('buildPrdBody omits parallelGroup frontmatter key when not supplied', () => {
   const body = buildPrdBody({
     title: 't', cwd: '~/x', estimateMinutes: 5, goal: 'g',
     acceptanceCriteria: ['a'], implementationNotes: 'n',
-  }, 'standards text');
-  assert.ok(!/parallelGroup:/.test(body));
+  });
+  expect(!/parallelGroup:/.test(body)).toBeTruthy();
 });
 
 test('readStandards result is byte-identical to the on-disk file (single source of truth)', async () => {
-  const path = require('node:path');
   const onDisk = fs.readFileSync(
     path.join(__dirname, '..', '..', '..', 'plugins', 'session-manager-dev', 'skills', 'develop', 'standards.md'),
     'utf8',
   );
-  assert.strictEqual(await readStandards(), onDisk);
+  expect(await readStandards()).toBe(onDisk);
+});
+
+// ──────────────────────────────────────────── create-prd admin route
+
+function request(port, { method = 'GET', path: reqPath, token, body }) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (token !== undefined) headers.Authorization = `Bearer ${token}`;
+    let payload;
+    if (body !== undefined) {
+      payload = JSON.stringify(body);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* leave null for non-JSON bodies */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+// config.cjs's validateWrite only allows writes under a registered non-home
+// allowedRoot's `.claude/` subtree (mirrors the real ROOT layout, which is
+// $HOME/.claude/session-manager/...) — so the temp prdsDir must live under
+// `<root>/.claude/...`, not directly under the temp root itself.
+async function mkTmpPrdsDir() {
+  const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-admin-create-prd-'));
+  config.addAllowedRoot(root);
+  const prdsDir = path.join(root, '.claude', 'prds');
+  await fsp.mkdir(prdsDir, { recursive: true });
+  return prdsDir;
+}
+
+// Mirrors scheduler.cjs's real `remote.allocateParallelGroup` / `remote.writePrd`
+// (same underlying prdParser.allocateParallelGroup + config.writeTextAtomic
+// calls) but pointed at a throwaway temp dir instead of the user's real
+// scheduled-plans/prds — so these tests never touch $HOME/.claude.
+function makeFakeRemoteWithPrdsDir(prdsDir) {
+  return {
+    async allocateParallelGroup() {
+      return prdParser.allocateParallelGroup(prdsDir);
+    },
+    async readPrd(slug) {
+      try {
+        const text = await fsp.readFile(path.join(prdsDir, `${slug}.md`), 'utf8');
+        return { ok: true, text };
+      } catch (e) {
+        return { ok: false, error: e?.message };
+      }
+    },
+    async writePrd(slug, body) {
+      try {
+        const filePath = path.join(prdsDir, `${slug}.md`);
+        await config.writeTextAtomic(filePath, body);
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, error: e?.message };
+      }
+    },
+  };
+}
+
+function validCreateBody(overrides = {}) {
+  return {
+    title: 'Add widget frobnication',
+    cwd: os.homedir(),
+    estimateMinutes: 15,
+    goal: 'Add frobnication to the widget subsystem.',
+    acceptanceCriteria: ['widget frobnicates on click', 'timeout 300 npm run typecheck passes'],
+    implementationNotes: 'See src/widget.cjs:10.',
+    outOfScope: ['not touching gadgets'],
+    ...overrides,
+  };
+}
+
+async function startWithRemote(remote) {
+  const admin = createAdminHttp();
+  registerAdminRoute(admin, remote);
+  const { port, token } = await admin.start();
+  return { admin, port, token };
+}
+
+test('POST /admin/scheduler/create-prd without token returns 401', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', body: validCreateBody(),
+    });
+    expect(res.status).toBe(401);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd with a valid payload writes a file with frontmatter + standards appended, returns {nn, filename, status}', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token, body: validCreateBody(),
+    });
+    expect(res.status).toBe(200);
+    expect(res.json.status).toBe('queued');
+    expect(typeof res.json.nn).toBe('number');
+    expect(res.json.filename).toMatch(/^\d+-add-widget-frobnication\.md$/);
+
+    const written = await fsp.readFile(path.join(prdsDir, res.json.filename), 'utf8');
+    expect(written).toMatch(/^---\n/);
+    expect(written).toMatch(/title: Add widget frobnication/);
+    expect(written).toMatch(/cwd: .+/);
+    expect(written).toMatch(/estimateMinutes: 15/);
+    expect(written).toMatch(/# Goal/);
+    expect(written).toMatch(/# Acceptance criteria/);
+    expect(written).toMatch(/- \[ \] widget frobnicates on click/);
+    expect(written).toMatch(/# Implementation notes/);
+    expect(written).toMatch(/# Out of scope/);
+    expect(written).toMatch(/## Engineering standards/);
+    // must point at STANDARDS_PATH rather than inline standards.md
+    expect(written.includes(STANDARDS_PATH)).toBeTruthy();
+    expect(written.includes('Lay out hot data contiguously')).toBeFalsy();
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd with malformed frontmatter (missing acceptanceCriteria) is rejected and writes no file', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const body = validCreateBody();
+    delete body.acceptanceCriteria;
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token, body,
+    });
+    expect(res.status).toBe(400);
+    expect(res.json.ok).toBe(false);
+    const entries = await fsp.readdir(prdsDir);
+    expect(entries.filter((f) => f.endsWith('.md')).length).toBe(0);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd with cwd outside allowed roots is rejected and writes no file', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token,
+      body: validCreateBody({ cwd: '/etc/passwd-adjacent-outside-home' }),
+    });
+    expect(res.status).toBe(400);
+    expect(res.json.ok).toBe(false);
+    const entries = await fsp.readdir(prdsDir);
+    expect(entries.filter((f) => f.endsWith('.md')).length).toBe(0);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd rejects a title containing a newline (frontmatter-injection guard) and writes no file', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token,
+      body: validCreateBody({ title: 'Legit title\n---\nEvil: injected' }),
+    });
+    expect(res.status).toBe(400);
+    expect(res.json.ok).toBe(false);
+    const entries = await fsp.readdir(prdsDir);
+    expect(entries.filter((f) => f.endsWith('.md')).length).toBe(0);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd with an explicit parallelGroup+slug that already exists on disk returns 409 and does not clobber the file', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    await fsp.writeFile(path.join(prdsDir, '777-my-explicit-slug.md'), 'ORIGINAL CONTENT\n');
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token,
+      body: validCreateBody({ slug: 'my-explicit-slug', parallelGroup: 777 }),
+    });
+    expect(res.status).toBe(409);
+    expect(res.json.ok).toBe(false);
+    const stillThere = await fsp.readFile(path.join(prdsDir, '777-my-explicit-slug.md'), 'utf8');
+    // existing PRD file must not be overwritten
+    expect(stillThere).toBe('ORIGINAL CONTENT\n');
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/create-prd honors an explicit slug + parallelGroup instead of deriving/allocating', async () => {
+  const prdsDir = await mkTmpPrdsDir();
+  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/create-prd', token,
+      body: validCreateBody({ slug: 'my-explicit-slug', parallelGroup: 777 }),
+    });
+    expect(res.status).toBe(200);
+    expect(res.json.nn).toBe(777);
+    expect(res.json.filename).toBe('777-my-explicit-slug.md');
+    expect(fs.existsSync(path.join(prdsDir, '777-my-explicit-slug.md'))).toBeTruthy();
+  } finally {
+    await admin.stop();
+  }
 });

package/src/main/__tests__/scheduler-admin-routes.test.cjs

@@ -0,0 +1,150 @@
+/**
+ * scheduler-admin-routes.test.cjs — unit tests for scheduler.cjs's
+ * registerAdminRoutes (PRD 689 — moved out of the former standalone admin
+ * HTTP server module's handleRequest, no behavior change). Exercises the
+ * two job-management admin
+ * HTTP routes against a fake `remote` object, wired through the real
+ * localAdminHttp.cjs transport.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-admin-routes.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+const http = require('node:http');
+const { createAdminHttp } = require('../lib/localAdminHttp.cjs');
+const { registerAdminRoutes } = require('../scheduler.cjs');
+
+function request(port, { method = 'GET', path: reqPath, token, body }) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (token !== undefined) headers.Authorization = `Bearer ${token}`;
+    let payload;
+    if (body !== undefined) {
+      payload = JSON.stringify(body);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* leave null for non-JSON bodies */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+function makeFakeRemote({ jobs = [] } = {}) {
+  return {
+    async listJobs() {
+      return jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
+    },
+    async resetJob(slug) {
+      const job = jobs.find((j) => j.slug === slug);
+      if (!job) return { ok: false, error: 'not found' };
+      job.status = 'pending';
+      job.runId = null;
+      job.startedAt = null;
+      job.finishedAt = null;
+      job.exitCode = null;
+      job.error = null;
+      delete job.runtime;
+      delete job.verifierVerdict;
+      return { ok: true, slug, status: 'pending' };
+    },
+  };
+}
+
+async function startWithRemote(remote) {
+  const admin = createAdminHttp();
+  registerAdminRoutes(admin, remote);
+  const { port, token } = await admin.start();
+  return { admin, port, token };
+}
+
+test('GET /admin/scheduler/jobs with correct token returns 200 + array', async () => {
+  const remote = makeFakeRemote({
+    jobs: [{ slug: '10-foo', title: 'Foo', status: 'completed', cwd: '/tmp/foo' }],
+  });
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, { path: '/admin/scheduler/jobs', token });
+    expect(res.status).toBe(200);
+    expect(Array.isArray(res.json)).toBeTruthy();
+    expect(res.json.length).toBe(1);
+    expect(res.json[0].slug).toBe('10-foo');
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/reset-job with unknown slug returns ok:false', async () => {
+  const remote = makeFakeRemote({ jobs: [] });
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: 'does-not-exist' },
+    });
+    expect(res.status).toBe(200);
+    expect(res.json.ok).toBe(false);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/reset-job without slug returns 400', async () => {
+  const remote = makeFakeRemote({ jobs: [] });
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/reset-job', token, body: {},
+    });
+    expect(res.status).toBe(400);
+    expect(res.json.ok).toBe(false);
+  } finally {
+    await admin.stop();
+  }
+});
+
+test('POST /admin/scheduler/reset-job with known slug flips job to pending and clears run fields', async () => {
+  const job = {
+    slug: '10-foo',
+    title: 'Foo',
+    status: 'completed',
+    cwd: '/tmp/foo',
+    runId: 'run-1',
+    startedAt: 100,
+    finishedAt: 200,
+    exitCode: 0,
+    error: null,
+    runtime: { pid: 1234 },
+    verifierVerdict: 'PASS',
+  };
+  const remote = makeFakeRemote({ jobs: [job] });
+  const { admin, port, token } = await startWithRemote(remote);
+  try {
+    const res = await request(port, {
+      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: '10-foo' },
+    });
+    expect(res.status).toBe(200);
+    expect(res.json).toEqual({ ok: true, slug: '10-foo', status: 'pending' });
+    expect(job.status).toBe('pending');
+    expect(job.runId).toBe(null);
+    expect(job.startedAt).toBe(null);
+    expect(job.finishedAt).toBe(null);
+    expect(job.exitCode).toBe(null);
+    expect(job.error).toBe(null);
+    expect('runtime' in job).toBe(false);
+    expect('verifierVerdict' in job).toBe(false);
+  } finally {
+    await admin.stop();
+  }
+});