create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/task-group-tag.test.mjs

@@ -0,0 +1,264 @@
+import test, { after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { renderGroupsMd, scanTaskGroups } from '../../../Harness/scripts/task-group-index.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(HERE, '..', '..', '..');
+const TASK_STATE = path.join(ROOT, 'Harness', 'scripts', 'task-state.mjs');
+const TASK_GROUP_INDEX = path.join(ROOT, 'Harness', 'scripts', 'task-group-index.mjs');
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const HOUR_MS = 60 * 60 * 1000;
+const tempRoots = [];
+
+function makeProject() {
+  const root = makeHarnessTempRoot('task-group-tag-');
+  tempRoots.push(root);
+  const project = path.join(root, 'app');
+  fs.mkdirSync(path.join(project, 'Harness', 'tasks'), { recursive: true });
+  return project;
+}
+
+after(() => {
+  for (const root of tempRoots) fs.rmSync(root, { recursive: true, force: true });
+});
+
+function runTaskState(project, args) {
+  return spawnSync(process.execPath, [TASK_STATE, ...args], { cwd: project, encoding: 'utf8' });
+}
+
+function jsonResult(result) {
+  assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+  assert.equal(result.stderr, '', result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+function readState(project, taskId) {
+  const file = path.join(project, 'Harness', 'tasks', taskId, 'STATE.json');
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function writeFixtureState(tasksRoot, taskId, state) {
+  const dir = path.join(tasksRoot, taskId);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'STATE.json'), JSON.stringify(state, null, 2) + '\n');
+}
+
+function archivedTaskExists(project, taskId) {
+  const archiveRoot = path.join(project, 'Harness', 'tasks', '_archive');
+  if (!fs.existsSync(archiveRoot)) return false;
+  for (const year of fs.readdirSync(archiveRoot, { withFileTypes: true })) {
+    if (!year.isDirectory() || !/^\d{4}$/.test(year.name)) continue;
+    for (const month of fs.readdirSync(path.join(archiveRoot, year.name), { withFileTypes: true })) {
+      if (!month.isDirectory()) continue;
+      for (const day of fs.readdirSync(path.join(archiveRoot, year.name, month.name), { withFileTypes: true })) {
+        if (!day.isDirectory()) continue;
+        if (fs.existsSync(path.join(archiveRoot, year.name, month.name, day.name, taskId))) return true;
+      }
+    }
+  }
+  return false;
+}
+
+test('G1: record --group writes the tag; missing group renders as default at list time', () => {
+  const project = makeProject();
+
+  // create with --group
+  let result = runTaskState(project, [
+    'record', 'task-group-alpha', '--create', '--group', 'release-0819-formal',
+    '--text', 'alpha task', '--apply', '--json',
+  ]);
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(readState(project, 'task-group-alpha').group, 'release-0819-formal');
+
+  // update branch: re-tag the same task
+  result = runTaskState(project, ['record', 'task-group-alpha', '--group', 'migration', '--apply', '--json']);
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(readState(project, 'task-group-alpha').group, 'migration');
+
+  // no group -> 'default' at list time (no data migration)
+  result = runTaskState(project, ['record', 'task-group-beta', '--create', '--text', 'beta task', '--apply', '--json']);
+  assert.equal(result.status, 0, result.stderr);
+
+  const payload = jsonResult(runTaskState(project, ['list', '--json']));
+  const alpha = payload.tasks.find(task => task.id === 'task-group-alpha');
+  const beta = payload.tasks.find(task => task.id === 'task-group-beta');
+  assert.equal(alpha.group, 'migration');
+  assert.equal(beta.group, 'default');
+  assert.equal(payload.groupFilter, null);
+});
+
+test('G2: list --group filter and --by-group grouping output', () => {
+  const project = makeProject();
+  const setups = [
+    ['task-group-alpha', 'release-0819-formal'],
+    ['task-group-beta', 'release-0819-formal'],
+    ['task-group-gamma', null],
+  ];
+  for (const [id, group] of setups) {
+    const args = ['record', id, '--create'];
+    if (group) args.push('--group', group);
+    args.push('--text', id, '--apply', '--json');
+    const result = runTaskState(project, args);
+    assert.equal(result.status, 0, result.stderr);
+  }
+
+  // --group filter
+  const filtered = jsonResult(runTaskState(project, ['list', '--group', 'release-0819-formal', '--json']));
+  assert.equal(filtered.taskCount, 2);
+  assert.equal(filtered.groupFilter, 'release-0819-formal');
+  assert.ok(filtered.tasks.every(task => task.group === 'release-0819-formal'));
+  assert.deepEqual(filtered.tasks.map(task => task.id).sort(), ['task-group-alpha', 'task-group-beta']);
+
+  // --by-group: non-default groups alphabetical, default last
+  const grouped = jsonResult(runTaskState(project, ['list', '--by-group', '--json']));
+  assert.equal(grouped.taskCount, 3);
+  assert.deepEqual(grouped.groups.map(group => group.group), ['release-0819-formal', 'default']);
+  assert.equal(grouped.groups[0].tasks.length, 2);
+  assert.equal(grouped.groups[1].tasks.length, 1);
+});
+
+test('G3: archive --group archives the whole group as a confirmation-less batch op', () => {
+  const project = makeProject();
+
+  // archivable (verified status)
+  let result = runTaskState(project, [
+    'record', 'task-group-alpha', '--create', '--group', 'release-0819-formal',
+    '--status', 'verified', '--text', 'a', '--apply', '--json',
+  ]);
+  assert.equal(result.status, 0, result.stderr);
+
+  // in the same group but active -> must be skipped, not archived
+  result = runTaskState(project, [
+    'record', 'task-group-beta', '--create', '--group', 'release-0819-formal',
+    '--status', 'active', '--text', 'b', '--apply', '--json',
+  ]);
+  assert.equal(result.status, 0, result.stderr);
+
+  // different group (default) -> untouched
+  result = runTaskState(project, ['record', 'task-group-gamma', '--create', '--text', 'c', '--apply', '--json']);
+  assert.equal(result.status, 0, result.stderr);
+
+  // no --apply passed: --group implies apply and reports what it did
+  const payload = jsonResult(runTaskState(project, ['archive', '--group', 'release-0819-formal', '--json']));
+  assert.equal(payload.ok, true, JSON.stringify(payload));
+  assert.equal(payload.dryRun, false);
+  assert.equal(payload.group, 'release-0819-formal');
+  assert.equal(payload.scanned, 2);
+  assert.equal(payload.toArchive, 1);
+  assert.equal(payload.skipped, 1);
+
+  assert.ok(!fs.existsSync(path.join(project, 'Harness', 'tasks', 'task-group-alpha')), 'alpha should be archived');
+  assert.ok(archivedTaskExists(project, 'task-group-alpha'));
+  assert.ok(fs.existsSync(path.join(project, 'Harness', 'tasks', 'task-group-beta')), 'beta stays (active)');
+  assert.ok(fs.existsSync(path.join(project, 'Harness', 'tasks', 'task-group-gamma')), 'gamma stays (other group)');
+});
+
+test('G4: task-group-index scan + render produce correct sections and stale flags', () => {
+  const project = makeProject();
+  const tasksRoot = path.join(project, 'Harness', 'tasks');
+  const now = new Date('2026-08-13T12:00:00.000Z');
+
+  // fresh active task in a named group
+  writeFixtureState(tasksRoot, 'task-group-alpha', {
+    schemaVersion: 1, taskId: 'task-group-alpha', status: 'active', phase: 'implement',
+    group: 'release-0819-formal', updatedAt: new Date(now.getTime() - HOUR_MS).toISOString(),
+  });
+  // completed 12 days ago -> needs archive
+  writeFixtureState(tasksRoot, 'task-group-beta', {
+    schemaVersion: 1, taskId: 'task-group-beta', status: 'verified', phase: 'verified',
+    group: 'release-0819-formal', updatedAt: new Date(now.getTime() - (12 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+  // active with no heartbeat for 8 days
+  writeFixtureState(tasksRoot, 'task-group-gamma', {
+    schemaVersion: 1, taskId: 'task-group-gamma', status: 'active', phase: 'implement',
+    updatedAt: new Date(now.getTime() - (8 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+  // completed but fresh (2 days) -> not stale at the default threshold
+  writeFixtureState(tasksRoot, 'task-group-delta', {
+    schemaVersion: 1, taskId: 'task-group-delta', status: 'complete', phase: 'verified',
+    group: 'release-0819-formal', updatedAt: new Date(now.getTime() - (2 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+
+  const model = scanTaskGroups({ tasksRoot, now });
+
+  // group order: non-default alphabetical, default last
+  assert.deepEqual(model.groups.map(group => group.name), ['release-0819-formal', 'default']);
+  assert.equal(model.groups[0].tasks.length, 3);
+  assert.equal(model.groups[1].tasks.length, 1);
+
+  // stale entries: completed kind first, then active kind, each by id
+  assert.deepEqual(model.stale.map(entry => entry.id), ['task-group-beta', 'task-group-gamma']);
+  assert.equal(model.stale[0].kind, 'completed');
+  assert.equal(model.stale[0].days, 12);
+  assert.equal(model.stale[1].kind, 'active');
+  assert.equal(model.stale[1].days, 8);
+
+  const md = renderGroupsMd(model);
+  assert.match(md, /## release-0819-formal \(3 tasks\)/);
+  assert.match(md, /## default \(1 task\)/);
+  assert.match(md, /\| `task-group-beta` \| verified \| verified \| 2026-08-01 \|/);
+  assert.match(md, /## Needs Archive \(stale\)/);
+  assert.match(md, /- task-group-beta: completed 12d ago, not archived/);
+  assert.match(md, /- task-group-gamma: no heartbeat 8d \(active\)/);
+});
+
+test('G4b: stale thresholds are env-overridable', () => {
+  const project = makeProject();
+  const tasksRoot = path.join(project, 'Harness', 'tasks');
+  const now = new Date('2026-08-13T12:00:00.000Z');
+
+  // completed 2 days ago: below the default 3-day threshold
+  writeFixtureState(tasksRoot, 'task-group-epsilon', {
+    schemaVersion: 1, taskId: 'task-group-epsilon', status: 'complete', phase: 'verified',
+    updatedAt: new Date(now.getTime() - (2 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+
+  assert.equal(scanTaskGroups({ tasksRoot, now }).stale.length, 0, 'default 3-day threshold should not flag 2 days');
+
+  const before = process.env.TASK_STALE_COMPLETED_DAYS;
+  try {
+    process.env.TASK_STALE_COMPLETED_DAYS = '1';
+    const model = scanTaskGroups({ tasksRoot, now });
+    assert.equal(model.stale.length, 1);
+    assert.equal(model.stale[0].id, 'task-group-epsilon');
+    assert.equal(model.stale[0].days, 2);
+  } finally {
+    if (before === undefined) delete process.env.TASK_STALE_COMPLETED_DAYS;
+    else process.env.TASK_STALE_COMPLETED_DAYS = before;
+  }
+});
+
+test('G5: CLI writes GROUPS.md with Needs Archive entries for both stale kinds', () => {
+  const project = makeProject();
+  const tasksRoot = path.join(project, 'Harness', 'tasks');
+  const nowMs = Date.now();
+
+  writeFixtureState(tasksRoot, 'task-group-alpha', {
+    schemaVersion: 1, taskId: 'task-group-alpha', status: 'verified', phase: 'verified',
+    group: 'release-0819-formal', updatedAt: new Date(nowMs - (12 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+  writeFixtureState(tasksRoot, 'task-group-beta', {
+    schemaVersion: 1, taskId: 'task-group-beta', status: 'active', phase: 'implement',
+    updatedAt: new Date(nowMs - (8 * DAY_MS + HOUR_MS)).toISOString(),
+  });
+
+  const result = spawnSync(process.execPath, [TASK_GROUP_INDEX, '--project', project], {
+    cwd: ROOT,
+    encoding: 'utf8',
+  });
+  assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+  const md = fs.readFileSync(path.join(tasksRoot, 'GROUPS.md'), 'utf8');
+  assert.match(md, /^# Task Groups \(generated\)/);
+  assert.match(md, /## release-0819-formal \(1 task\)/);
+  assert.match(md, /## default \(1 task\)/);
+  assert.match(md, /## Needs Archive \(stale\)/);
+  assert.match(md, /- task-group-alpha: completed \d+d ago, not archived/);
+  assert.match(md, /- task-group-beta: no heartbeat \d+d \(active\)/);
+});

package/src/wf-ui-server/__tests__/task-parser.test.mjs

@@ -2,14 +2,14 @@ import test, { describe, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
-import os from 'node:os';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
 import { parseArchivedTasks, parseTaskCapsule, parseTaskList } from '../task-parser.mjs';
 
 describe('task-parser', () => {
   let baseDir;
 
   before(() => {
-    baseDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tp-test-'));
+    baseDir = makeHarnessTempRoot('tp-test-');
 
     // task-alpha — fully populated, latest updatedAt
     const dirA = path.join(baseDir, 'task-alpha');
@@ -30,6 +30,12 @@ describe('task-parser', () => {
     }));
     fs.writeFileSync(path.join(dirA, 'PLAN.md'), '# Plan A');
     fs.writeFileSync(path.join(dirA, 'PROGRESS.md'), '# Progress A');
+    const alphaClaude = path.join(dirA, 'sessions', 'session-claude');
+    const alphaCodex = path.join(dirA, 'sessions', 'session-codex');
+    fs.mkdirSync(alphaClaude, { recursive: true });
+    fs.mkdirSync(alphaCodex, { recursive: true });
+    fs.writeFileSync(path.join(alphaClaude, 'STATE.json'), JSON.stringify({ sessionId: 'session-claude', runtime: 'claude', status: 'saved' }));
+    fs.writeFileSync(path.join(alphaCodex, 'STATE.json'), JSON.stringify({ sessionId: 'session-codex', runtime: 'codex', status: 'saved' }));
 
     // task-beta — completed, no plan/progress files
     const dirB = path.join(baseDir, 'task-beta');
@@ -45,7 +51,7 @@ describe('task-parser', () => {
       updatedAt: '2026-07-28T12:00:00.000Z',
       activeQuestion: null,
       nextAction: null,
-      acceptance: [],
+      acceptance: ['AC-TRACKED'],
       links: { dependsOn: [], blocks: ['task-alpha'], related: [] }
     }));
 
@@ -99,6 +105,10 @@ test('parseTaskCapsule parses a valid task capsule directory with STATE.json', (
   assert.equal(result.status, 'active');
   assert.equal(result.phase, 'wave-1-synthesis');
   assert.equal(result.gate, 'E-GATE');
+  assert.equal(result.project, 'default');
+  assert.deepEqual(result.tags, []);
+  assert.equal(result.wfManaged, true);
+  assert.equal(result.resumeRequired, true);
   assert.equal(result.updatedAt, '2026-07-29T08:00:00.000Z');
   assert.equal(result.activeQuestion, null);
   assert.ok(Array.isArray(result.acceptance));
@@ -109,6 +119,41 @@ test('parseTaskCapsule parses a valid task capsule directory with STATE.json', (
   assert.deepEqual(result.blocks, []);
   assert.equal(result.hasPlan, true);
   assert.equal(result.hasProgress, true);
+  assert.deepEqual(result.runtimeHistory, ['claude', 'codex']);
+});
+
+test('AC-004 parser exposes canonical project/date/task lifecycle metadata without a second store', () => {
+  const dir = path.join(baseDir, 'task-project-metadata');
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'STATE.json'), JSON.stringify({
+      schemaVersion: 1,
+      taskId: 'task-project-metadata',
+      status: 'blocked',
+      mode: 'wf-max',
+      project: 'release-platform',
+      group: 'legacy-release-platform',
+      tags: ['release', 'platform'],
+      createdAt: '2026-09-08T07:00:00.000Z',
+      startedAt: '2026-09-08T07:01:00.000Z',
+      updatedAt: '2026-09-08T07:02:00.000Z',
+      closedAt: null,
+      phase: 'implement',
+      links: { dependsOn: [], blocks: [], related: [] },
+    }));
+
+    const result = parseTaskCapsule(dir);
+    assert.equal(result.project, 'release-platform');
+    assert.equal(result.group, 'legacy-release-platform');
+    assert.deepEqual(result.tags, ['release', 'platform']);
+    assert.equal(result.createdAt, '2026-09-08T07:00:00.000Z');
+    assert.equal(result.startedAt, '2026-09-08T07:01:00.000Z');
+    assert.equal(result.closedAt, null);
+    assert.equal(result.wfManaged, true);
+    assert.equal(result.resumeRequired, true);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
 });
 
 test('parseTaskCapsule returns null for directory without STATE.json', () => {
@@ -165,6 +210,7 @@ test('parseTaskList handles completed capsule without PLAN.md or PROGRESS.md', (
   assert.equal(beta.phase, 'closed');
   assert.equal(beta.hasPlan, false);
   assert.equal(beta.hasProgress, false);
+  assert.deepEqual(beta.acceptance, [{ id: 'AC-TRACKED', text: '', status: 'tracked' }]);
 });
 
 test('parseTaskList includes capsule with activeQuestion as string', () => {

package/src/wf-ui-server/__tests__/terminal-context-hardening.test.mjs

@@ -0,0 +1,122 @@
+import test, { afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { startServer, stopServer } from '../server.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+import { registerPtyProcess, unregisterPtyProcess } from '../ws-terminal.mjs';
+
+const cleanup = [];
+
+afterEach(async () => {
+  while (cleanup.length) {
+    const item = cleanup.pop();
+    if (item.sessionIds) {
+      for (const sessionId of item.sessionIds) unregisterPtyProcess(sessionId);
+    }
+    if (item.server) await stopServer(item.server);
+    if (item.root) fs.rmSync(item.root, { recursive: true, force: true });
+    if (item.outsideRoot) fs.rmSync(item.outsideRoot, { recursive: true, force: true });
+  }
+});
+
+async function makeServer() {
+  const root = makeHarnessTempRoot('wf-terminal-context-hardening-');
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks'), { recursive: true });
+  const registry = new SessionRegistry();
+  const started = await startServer({ projectRoot: root, host: '127.0.0.1', port: 0, sessionRegistry: registry });
+  cleanup.push({ root, server: started.server, sessionIds: [] });
+  return { ...started, root, registry, baseUrl: `http://127.0.0.1:${started.port}` };
+}
+
+function postJson(baseUrl, token, route, payload) {
+  const url = new URL(route, baseUrl);
+  const body = JSON.stringify(payload);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname + url.search,
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      },
+    }, (res) => {
+      let responseBody = '';
+      res.on('data', chunk => { responseBody += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(responseBody) }); }
+        catch { resolve({ status: res.statusCode, body: responseBody }); }
+      });
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+
+function createRunningSession(root, registry, runtime = 'codex') {
+  const session = registry.create({ runtime, agentKind: 'main', projectRoot: root, cwd: root });
+  registry.update(session.sessionId, { status: 'running' });
+  cleanup.at(-1).sessionIds.push(session.sessionId);
+  return session;
+}
+
+function createEscapeDirectoryLink(t, projectRoot) {
+  const outsideRoot = makeHarnessTempRoot('wf-terminal-context-outside-');
+  fs.writeFileSync(path.join(outsideRoot, 'secret.txt'), 'outside-secret', 'utf8');
+  const linkPath = path.join(projectRoot, 'linked-outside');
+  try {
+    fs.symlinkSync(outsideRoot, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+  } catch (err) {
+    fs.rmSync(outsideRoot, { recursive: true, force: true });
+    t.skip(`Symlink/junction creation unavailable on this platform: ${err.message}`);
+    return null;
+  }
+  cleanup.at(-1).outsideRoot = outsideRoot;
+  return { outsideRoot, linkPath };
+}
+
+test('AC-004 hardening context-input API rejects symlink or junction escaped files before PTY write', async (t) => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  const fixture = createEscapeDirectoryLink(t, root);
+  if (!fixture) return;
+  const session = createRunningSession(root, registry, 'codex');
+  const written = [];
+  registerPtyProcess(session.sessionId, { write: data => written.push(data) });
+
+  const result = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'drawer-terminal',
+    items: [{ kind: 'workspace-file', path: 'linked-outside/secret.txt', format: 'tag' }],
+  });
+
+  assert.equal(result.status, 400);
+  assert.equal(result.body.error.code, 'BAD_REQUEST');
+  assert.match(result.body.error.message, /symlink|junction|outside workspace|escape/i);
+  assert.deepEqual(written, []);
+  assert.equal(registry.get(session.sessionId).inputOwnerId, '');
+});
+
+test('AC-004 hardening context-input persists owner and logs before PTY write on disk failure', async () => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  fs.writeFileSync(path.join(root, 'README.md'), '# readme\n', 'utf8');
+  const session = createRunningSession(root, registry, 'claude');
+  const written = [];
+  registerPtyProcess(session.sessionId, { write: data => written.push(data) });
+
+  const sessionsRoot = path.join(root, 'Harness', 'a2a', 'sessions');
+  fs.rmSync(sessionsRoot, { recursive: true, force: true });
+  fs.writeFileSync(sessionsRoot, 'not-a-directory', 'utf8');
+
+  const result = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'embedded-terminal',
+    items: [{ kind: 'workspace-file', path: 'README.md', format: 'tag' }],
+  });
+
+  assert.ok(result.status >= 400, `expected persistence failure, got ${result.status}: ${JSON.stringify(result.body)}`);
+  assert.deepEqual(written, [], 'PTY input must not be written if owner/session persistence fails');
+  assert.equal(registry.get(session.sessionId).inputOwnerId, '', 'memory owner should not advance when durable state fails');
+});

package/src/wf-ui-server/__tests__/terminal-context.test.mjs

@@ -0,0 +1,164 @@
+import test, { afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { startServer, stopServer } from '../server.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+import { registerPtyProcess, unregisterPtyProcess } from '../ws-terminal.mjs';
+
+const cleanup = [];
+
+afterEach(async () => {
+  while (cleanup.length) {
+    const item = cleanup.pop();
+    if (item.sessionIds) {
+      for (const sessionId of item.sessionIds) unregisterPtyProcess(sessionId);
+    }
+    if (item.server) await stopServer(item.server);
+    if (item.root) fs.rmSync(item.root, { recursive: true, force: true });
+  }
+});
+
+async function makeServer() {
+  const root = makeHarnessTempRoot('wf-terminal-context-');
+  fs.mkdirSync(path.join(root, 'Harness', 'tasks'), { recursive: true });
+  const registry = new SessionRegistry();
+  const started = await startServer({ projectRoot: root, host: '127.0.0.1', port: 0, sessionRegistry: registry });
+  cleanup.push({ root, server: started.server, sessionIds: [] });
+  return { ...started, root, registry, baseUrl: `http://127.0.0.1:${started.port}` };
+}
+
+function postJson(baseUrl, token, route, payload) {
+  const url = new URL(route, baseUrl);
+  const body = JSON.stringify(payload);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname + url.search,
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      },
+    }, (res) => {
+      let responseBody = '';
+      res.on('data', chunk => { responseBody += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(responseBody) }); }
+        catch { resolve({ status: res.statusCode, body: responseBody }); }
+      });
+    });
+    req.on('error', reject);
+    req.end(body);
+  });
+}
+
+test('AC-003 AC-004 context-input inserts workspace file/folder tags and acquires active input owner', async () => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  fs.mkdirSync(path.join(root, 'src', 'feature'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'src', 'feature', 'index.ts'), 'export const ok = true;\n');
+  const session = registry.create({ runtime: 'codex', agentKind: 'main', projectRoot: root, cwd: root });
+  registry.update(session.sessionId, { status: 'running' });
+  cleanup.at(-1).sessionIds.push(session.sessionId);
+  const written = [];
+  registerPtyProcess(session.sessionId, { write: data => written.push(data) });
+
+  const result = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'drawer-terminal',
+    items: [
+      { kind: 'workspace-file', path: 'src/feature/index.ts', format: 'tag' },
+      { kind: 'workspace-folder', path: 'src/feature', format: 'tag' },
+    ],
+  });
+
+  assert.equal(result.status, 200);
+  assert.equal(result.body.ok, true);
+  assert.equal(result.body.inputOwnerId, 'drawer-terminal');
+  assert.equal(result.body.ptySessionId, session.sessionId);
+  assert.equal(result.body.terminalInput, '@file(src/feature/index.ts) @folder(src/feature)');
+  assert.deepEqual(written, ['@file(src/feature/index.ts) @folder(src/feature)']);
+  assert.equal(registry.get(session.sessionId).inputOwnerId, 'drawer-terminal');
+  assert.equal(registry.get(session.sessionId).ptySessionId, session.sessionId);
+});
+
+test('AC-003 AC-004 context-input supports Shift/absolute-path format for workspace and user files', async () => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'src', 'a.ts'), 'export {};\n');
+  fs.mkdirSync(path.join(root, 'Harness', 'user-files', 'images'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'Harness', 'user-files', 'images', 'shot.png'), 'png');
+  const session = registry.create({ runtime: 'claude', agentKind: 'subagent', projectRoot: root, cwd: root });
+  registry.update(session.sessionId, { status: 'running' });
+  cleanup.at(-1).sessionIds.push(session.sessionId);
+  const written = [];
+  registerPtyProcess(session.sessionId, { write: data => written.push(data) });
+
+  const result = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'embedded-terminal',
+    shiftKey: true,
+    items: [
+      { kind: 'workspace-file', path: 'src/a.ts' },
+      { kind: 'user-file', path: 'Harness/user-files/images/shot.png' },
+    ],
+  });
+
+  const expected = [
+    path.join(root, 'src', 'a.ts'),
+    path.join(root, 'Harness', 'user-files', 'images', 'shot.png'),
+  ].join(' ');
+  assert.equal(result.status, 200);
+  assert.equal(result.body.terminalInput, expected);
+  assert.deepEqual(written, [expected]);
+  assert.equal(registry.get(session.sessionId).inputOwnerId, 'embedded-terminal');
+});
+
+test('AC-003 AC-004 context-input rejects paths escaping the workspace and missing files', async () => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  const session = registry.create({ runtime: 'codex', agentKind: 'main', projectRoot: root, cwd: root });
+  registry.update(session.sessionId, { status: 'running' });
+
+  const traversal = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'drawer-terminal',
+    items: [{ kind: 'workspace-file', path: '../secret.txt', format: 'tag' }],
+  });
+  const missing = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'drawer-terminal',
+    items: [{ kind: 'workspace-file', path: 'src/missing.ts', format: 'tag' }],
+  });
+
+  assert.equal(traversal.status, 400);
+  assert.equal(traversal.body.error.code, 'BAD_REQUEST');
+  assert.equal(missing.status, 404);
+  assert.equal(missing.body.error.code, 'NOT_FOUND');
+});
+
+test('AC-004 multiple terminal views share one PTY session while focus changes the input owner', async () => {
+  const { root, baseUrl, token, registry } = await makeServer();
+  fs.writeFileSync(path.join(root, 'README.md'), '# readme\n');
+  const session = registry.create({ runtime: 'opencode', agentKind: 'main', projectRoot: root, cwd: root });
+  registry.update(session.sessionId, { status: 'running', ptySessionId: session.sessionId });
+  cleanup.at(-1).sessionIds.push(session.sessionId);
+  const written = [];
+  registerPtyProcess(session.sessionId, { write: data => written.push(data) });
+
+  const drawer = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'drawer-view',
+    items: [{ kind: 'workspace-file', path: 'README.md', format: 'tag' }],
+  });
+  const embedded = await postJson(baseUrl, token, `/api/sessions/${session.sessionId}/context-input`, {
+    inputOwnerId: 'embedded-view',
+    items: [{ kind: 'workspace-file', path: 'README.md', format: 'relative-path' }],
+  });
+
+  assert.equal(drawer.status, 200);
+  assert.equal(embedded.status, 200);
+  assert.equal(drawer.body.ptySessionId, session.sessionId);
+  assert.equal(embedded.body.ptySessionId, session.sessionId);
+  assert.equal(registry.get(session.sessionId).inputOwnerId, 'embedded-view');
+  assert.deepEqual(written, ['@file(README.md)', 'README.md']);
+  assert.equal(registry.getAll().filter(item => item.sessionId === session.sessionId).length, 1);
+});