create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/workflow-agent-runtime.test.mjs

@@ -0,0 +1,324 @@
+import { after, before, describe, it } from 'node:test';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { createServer } from '../server.mjs';
+import { SessionRegistry } from '../session-registry.mjs';
+import { readTerminalRange } from '../terminal-store.mjs';
+import { registerPtyProcess, unregisterPtyProcess } from '../ws-terminal.mjs';
+import { executeNodeAction } from '../workflow-node-runtime.mjs';
+
+function tempProjectRoot() {
+  const id = crypto.randomBytes(4).toString('hex');
+  const dir = path.join(process.cwd(), `.tmp-agent-runtime-${id}`);
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a', 'component-nodes'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'component-nodes', 'index.json'), JSON.stringify({ schemaVersion: 1, nodes: [] }));
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'workflow-map.json'), JSON.stringify({
+    schemaVersion: 1,
+    version: 1,
+    nodes: [],
+    edges: [],
+    positions: {},
+    undoStack: [],
+    redoStack: [],
+    deletedNodes: [],
+  }));
+  return dir;
+}
+
+function cleanup(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+}
+
+function readGraph(root) {
+  return JSON.parse(fs.readFileSync(path.join(root, 'Harness', 'a2a', 'workflow-map.json'), 'utf8'));
+}
+
+function writeGraph(root, graph) {
+  fs.writeFileSync(path.join(root, 'Harness', 'a2a', 'workflow-map.json'), `${JSON.stringify(graph, null, 2)}\n`);
+}
+
+function jsonRequest(url, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method, headers: { 'content-type': 'application/json' } }, (res) => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(data) }); }
+        catch { resolve({ status: res.statusCode, body: data }); }
+      });
+    });
+    req.on('error', reject);
+    if (body !== undefined) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+function wait(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
+}
+
+async function waitFor(fn, { timeout = 5000, step = 25 } = {}) {
+  const deadline = Date.now() + timeout
+  let last
+  while (Date.now() < deadline) {
+    last = await fn()
+    if (last) return last
+    await new Promise(resolve => setTimeout(resolve, step))
+  }
+  throw new Error(`waitFor timed out; last=${JSON.stringify(last)}`)
+}
+
+describe('canonical workflow agent runtime', () => {
+  let root;
+  let registry;
+  let server;
+  let baseUrl;
+  let session;
+  const graphNodeId = 'agent-runtime-01';
+  const writes = [];
+  let killed = false;
+
+  before(async () => {
+    root = tempProjectRoot();
+    registry = new SessionRegistry();
+    session = registry.create({
+      runtime: 'codex',
+      agentKind: 'main',
+      role: 'main',
+      objective: 'agent runtime test',
+      projectRoot: root,
+      cwd: root,
+      graphNodeId,
+    });
+    registry.update(session.sessionId, { status: 'running', graphNodeId });
+    session = registry.get(session.sessionId);
+    writeGraph(root, {
+      ...readGraph(root),
+      nodes: [{
+        nodeId: graphNodeId,
+        sessionId: session.sessionId,
+        kind: 'terminal-session',
+        agentKind: 'main',
+        runtime: 'codex',
+        status: 'running',
+        cwd: root,
+        position: { x: 120, y: 90 },
+      }],
+      positions: { [graphNodeId]: { x: 120, y: 90 } },
+    });
+    registerPtyProcess(session.sessionId, {
+      write(data) { writes.push(String(data)); },
+      kill() { killed = true; },
+    });
+    server = createServer({ projectRoot: root, sessionRegistry: registry, token: '' });
+    await new Promise(resolve => server.listen(0, resolve));
+    baseUrl = `http://127.0.0.1:${server.address().port}`;
+  });
+
+  after(() => {
+    unregisterPtyProcess(session?.sessionId);
+    if (server) server.close();
+    cleanup(root);
+  });
+
+  it('lists agent nodes and resolves canonical context endpoint for an agent', async () => {
+    const list = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    assert.equal(list.status, 200);
+    assert.ok(list.body.nodes.some(node => node.kind === 'agent' && node.nodeId === graphNodeId));
+
+    const context = await jsonRequest(`${baseUrl}/api/workflow/context/${graphNodeId}`);
+    assert.equal(context.status, 200);
+    assert.equal(context.body.node.nodeId, graphNodeId);
+    assert.equal(context.body.context.sessionId, session.sessionId);
+  });
+
+  it('accepts session ids in canonical edges and stores graph node ids', async () => {
+    const md = await jsonRequest(`${baseUrl}/api/workflow/nodes`, {
+      method: 'POST',
+      body: { type: 'markdown', title: 'Agent Context' },
+    });
+    assert.equal(md.status, 201);
+
+    const edge = await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+      method: 'POST',
+      body: { from: md.body.node.nodeId, to: session.sessionId, sourceHandle: 'markdown', targetHandle: 'context' },
+    });
+    assert.equal(edge.status, 201);
+    assert.equal(edge.body.edge.from, md.body.node.nodeId);
+    assert.equal(edge.body.edge.to, graphNodeId);
+  });
+
+  it('agent.sendInput writes PTY input and records terminal stdin through the canonical action', async () => {
+    writes.length = 0;
+    const input = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.sendInput`, {
+      method: 'POST',
+      body: { text: 'hello from workflow\n' },
+    });
+    assert.equal(input.status, 200);
+    assert.deepEqual(writes, ['hello from workflow\n']);
+
+    const transcript = readTerminalRange(root, { sessionId: session.sessionId, tail: 20 });
+    assert.ok(transcript.entries.some(entry => entry.stream === 'stdin' && entry.data.includes('hello from workflow')));
+  });
+
+  it('W26-AGENT-SENDINPUT submit mode separates prompt text from Enter through canonical API', async () => {
+    writes.length = 0;
+    const input = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.sendInput`, {
+      method: 'POST',
+      body: { data: 'W26_PROMPT_SUBMIT\r', submit: true },
+    });
+    assert.equal(input.status, 200);
+    assert.equal(writes[0], 'W', 'the submit body must start typing synchronously');
+    await waitFor(() => (writes.join('') === 'W26_PROMPT_SUBMIT\r' ? writes : null));
+    assert.equal(writes.join(''), 'W26_PROMPT_SUBMIT\r', 'the typed body must join to the exact text + \\r');
+    assert.equal(writes[writes.length - 1], '\r', 'the typed body must end with a single \\r');
+    assert.equal(writes.join('').includes('\n'), false, 'no \\n may be injected');
+    assert.equal(writes.filter(w => w === '\r').length, 1, 'exactly one \\r (0x0D)');
+  });
+
+  it('W25-AGENT-SENDINPUT prefers payload.data over text for submitted PTY input', async () => {
+    writes.length = 0;
+    const result = await executeNodeAction(root, graphNodeId, 'agent.sendInput', {
+      text: 'W25_UNSUBMITTED_TEXT',
+      data: 'W25_SUBMITTED_DATA\r',
+    });
+
+    assert.equal(result.ok, true);
+    assert.equal(result.result.sessionId, session.sessionId);
+    assert.deepEqual(writes, ['W25_SUBMITTED_DATA\r']);
+  });
+
+  it('W26-AGENT-SENDINPUT submit mode separates prompt text from Enter through direct action runtime', async () => {
+    writes.length = 0;
+    const result = await executeNodeAction(root, graphNodeId, 'agent.sendInput', {
+      data: 'W26_DIRECT_SUBMIT\r',
+      submit: true,
+    });
+
+    assert.equal(result.ok, true);
+    assert.equal(result.result.sessionId, session.sessionId);
+    assert.equal(writes[0], 'W', 'the direct submit body must start typing synchronously');
+    await waitFor(() => (writes.join('') === 'W26_DIRECT_SUBMIT\r' ? writes : null));
+    assert.equal(writes.join(''), 'W26_DIRECT_SUBMIT\r', 'the typed body must join to the exact text + \\r');
+    assert.equal(writes[writes.length - 1], '\r', 'the typed body must end with a single \\r');
+    assert.equal(writes.join('').includes('\n'), false, 'no \\n may be injected');
+    assert.equal(writes.filter(w => w === '\r').length, 1, 'exactly one \\r (0x0D)');
+  });
+
+  it('agent.stop updates graph status and agent.delete removes the stopped graph node', async () => {
+    const stop = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.stop`, {
+      method: 'POST',
+      body: {},
+    });
+    assert.equal(stop.status, 200);
+    assert.equal(killed, true);
+    assert.equal(readGraph(root).nodes.find(node => node.nodeId === graphNodeId)?.status, 'stopped');
+
+    const deleted = await jsonRequest(`${baseUrl}/api/workflow/nodes/${graphNodeId}/actions/agent.delete`, {
+      method: 'POST',
+      body: {},
+    });
+    assert.equal(deleted.status, 200);
+    assert.ok(!readGraph(root).nodes.some(node => node.nodeId === graphNodeId));
+  });
+});
+
+describe('wf-ui created agent session graph binding', () => {
+  it('W23-AGENT-GRAPH-BINDING binds POST /api/sessions agents as graph endpoints', async () => {
+    const root = tempProjectRoot();
+    const registry = new SessionRegistry();
+    const server = createServer({ projectRoot: root, sessionRegistry: registry, token: '' });
+    await new Promise(resolve => server.listen(0, resolve));
+    const baseUrl = `http://127.0.0.1:${server.address().port}`;
+    try {
+      const main = await jsonRequest(`${baseUrl}/api/sessions`, {
+        method: 'POST',
+        body: {
+          runtime: 'codex',
+          agentKind: 'main',
+          role: 'Main Agent',
+          objective: 'W23 main agent',
+          deferPtySpawn: true,
+        },
+      });
+      assert.equal(main.status, 201, JSON.stringify(main.body));
+      assert.ok(main.body.graphNodeId, 'main session should return graphNodeId');
+
+      const worker = await jsonRequest(`${baseUrl}/api/sessions`, {
+        method: 'POST',
+        body: {
+          runtime: 'codex',
+          agentKind: 'subagent',
+          role: 'Implementer',
+          objective: 'W23 worker agent',
+          parentNodeId: main.body.graphNodeId,
+          parentAgentId: main.body.sessionId,
+          deferPtySpawn: true,
+        },
+      });
+      assert.equal(worker.status, 201, JSON.stringify(worker.body));
+      assert.ok(worker.body.graphNodeId, 'worker session should return graphNodeId');
+
+      const graph = readGraph(root);
+      const workerNode = graph.nodes.find(node => node.nodeId === worker.body.graphNodeId);
+      assert.ok(workerNode, 'worker session should be persisted as a graph node');
+      assert.equal(workerNode.kind, 'terminal-session');
+      assert.equal(workerNode.sessionId, worker.body.sessionId);
+      assert.equal(workerNode.agentKind, 'subagent');
+      assert.equal(workerNode.runtime, 'codex');
+      assert.equal(workerNode.status, 'blocked');
+      assert.equal(workerNode.role, 'Implementer');
+      assert.equal(workerNode.parentNodeId, main.body.graphNodeId);
+      assert.equal(workerNode.parentAgentId, main.body.sessionId);
+      assert.ok(Number.isFinite(workerNode.position?.x));
+      assert.ok(Number.isFinite(workerNode.position?.y));
+
+      const md = await jsonRequest(`${baseUrl}/api/workflow/nodes`, {
+        method: 'POST',
+        body: { type: 'markdown', title: 'W23 Agent Note' },
+      });
+      assert.equal(md.status, 201, JSON.stringify(md.body));
+
+      const resourceEdge = await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+        method: 'POST',
+        body: {
+          from: worker.body.graphNodeId,
+          to: md.body.node.nodeId,
+          relation: 'context',
+        },
+      });
+      assert.equal(resourceEdge.status, 201, JSON.stringify(resourceEdge.body));
+      assert.equal(resourceEdge.body.edge.from, worker.body.graphNodeId);
+      assert.equal(resourceEdge.body.edge.to, md.body.node.nodeId);
+
+      const workerContext = await jsonRequest(`${baseUrl}/api/workflow/context/${worker.body.graphNodeId}`);
+      assert.equal(workerContext.status, 200, JSON.stringify(workerContext.body));
+      assert.ok(workerContext.body.context.connectedResourceRefs.some(ref => ref.nodeId === md.body.node.nodeId && ref.type === 'markdown'));
+
+      const delegationEdge = await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+        method: 'POST',
+        body: {
+          from: main.body.graphNodeId,
+          to: worker.body.graphNodeId,
+          relation: 'delegation',
+        },
+      });
+      assert.equal(delegationEdge.status, 201, JSON.stringify(delegationEdge.body));
+
+      const mainContext = await jsonRequest(`${baseUrl}/api/workflow/context/${main.body.graphNodeId}`);
+      assert.equal(mainContext.status, 200, JSON.stringify(mainContext.body));
+      const workerRef = mainContext.body.context.connectedAgentRefs.find(ref => ref.nodeId === worker.body.graphNodeId);
+      assert.ok(workerRef, 'connected main agent context should expose worker agent refs');
+      assert.equal(workerRef.relation, 'delegation');
+      assert.equal(workerRef.delegation.sendAction, 'agent.sendInput');
+      assert.equal(workerRef.delegation.canReadContext, true);
+    } finally {
+      await new Promise(resolve => server.close(resolve));
+      cleanup(root);
+    }
+  });
+});

package/src/wf-ui-server/__tests__/workflow-api-integration.test.mjs

@@ -0,0 +1,263 @@
+import { describe, it, before, after } from 'node:test';
+import assert from 'node:assert';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+// ── Dynamic import of server module ──
+let createServer;
+let sessionMock;
+
+function tempProjectRoot() {
+  const id = crypto.randomBytes(4).toString('hex');
+  const dir = path.join(process.cwd(), '.tmp-wf-api-test-' + id);
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a', 'component-nodes'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'component-nodes', 'index.json'), JSON.stringify({ schemaVersion: 1, nodes: [] }));
+  fs.mkdirSync(path.join(dir, 'Harness', 'a2a'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'Harness', 'a2a', 'workflow-map.json'), JSON.stringify({ schemaVersion: 1, version: 1, nodes: [], edges: [], positions: {}, undoStack: [], redoStack: [], deletedNodes: [] }));
+  // Settings file
+  try { fs.mkdirSync(path.join(dir, 'Harness', 'settings.json').replace('settings.json', ''), { recursive: true }); } catch {}
+  try { fs.writeFileSync(path.join(dir, 'Harness', 'settings.json'), '{}'); } catch {}
+  return dir;
+}
+
+function cleanup(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
+}
+
+function jsonRequest(url, { method = 'GET', body } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method, headers: { 'content-type': 'application/json' } }, (res) => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try { resolve({ status: res.statusCode, body: JSON.parse(data) }); }
+        catch { resolve({ status: res.statusCode, body: data }); }
+      });
+    });
+    req.on('error', reject);
+    if (body) req.write(JSON.stringify(body));
+    req.end();
+  });
+}
+
+// ── Suite ──
+describe('Workflow API Integration', () => {
+  let root;
+  let server;
+  let baseUrl;
+
+  before(async () => {
+    root = tempProjectRoot();
+    // Dynamic import
+    const mod = await import('../server.mjs');
+    createServer = mod.createServer;
+    sessionMock = { getAll: () => [], get: () => null, create: () => {}, stop: () => null, update: () => {}, remove: () => {}, withLock: (_key, fn) => Promise.resolve().then(fn) };
+    const raw = createServer({ projectRoot: root, sessionRegistry: sessionMock, token: '' });
+    await new Promise(resolve => raw.listen(0, () => resolve()));
+    const addr = raw.address();
+    baseUrl = `http://127.0.0.1:${addr.port}`;
+    server = raw;
+  });
+
+  after(() => {
+    if (server) server.close();
+    cleanup(root);
+  });
+
+  // ── AC-NR-001: /api/workflow/nodes returns real JSON, not {} ──
+  it('AC-NR-001 GET /api/workflow/nodes returns { ok, nodes } not empty object', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    assert.equal(res.status, 200);
+    assert.ok(res.body && typeof res.body === 'object', `expected object, got ${typeof res.body}: ${JSON.stringify(res.body)}`);
+    assert.ok(res.body.ok !== undefined || res.body.nodes !== undefined, `missing ok/nodes: ${JSON.stringify(res.body)}`);
+    // If bug #1 exists, res.body will be {} (Promise stringified)
+    assert.notDeepStrictEqual(res.body, {}, 'BUG: async route returns {} — Promise not awaited');
+  });
+
+  // ── AC-NR-002: POST /api/workflow/nodes creates a node ──
+  it('AC-NR-002 POST /api/workflow/nodes creates markdown node and returns snapshot', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes`, {
+      method: 'POST',
+      body: { type: 'markdown', title: 'API Test MD' },
+    });
+    assert.equal(res.status, 201);
+    assert.ok(res.body.ok);
+    assert.ok(res.body.node, `no node in response: ${JSON.stringify(res.body)}`);
+    assert.equal(res.body.node.kind, 'markdown');
+    assert.ok(res.body.node.nodeId);
+    assert.ok(res.body.state);
+  });
+
+  // ── AC-NR-003: GET /api/workflow/nodes lists created nodes with connections ──
+  it('AC-NR-003 GET /api/workflow/nodes after create returns nodes with connections field', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    assert.equal(res.status, 200);
+    assert.ok(Array.isArray(res.body.nodes), 'nodes must be an array');
+    assert.ok(res.body.nodes.length >= 1, 'at least one node');
+    const node = res.body.nodes[0];
+    assert.ok(node.graph, 'node must have graph');
+    assert.ok(Array.isArray(node.graph.connections), 'graph.connections must be array');
+    // Bug #4: connections will be [] because snapshot doesn't load from graph
+    // We assert the field exists; later we'll assert it's populated after connect
+  });
+
+  // ── AC-NR-004: GET /api/workflow/nodes/:id returns single node ──
+  it('AC-NR-004 GET /api/workflow/nodes/:id returns node with state', async () => {
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const nodeId = all.body.nodes[0].nodeId;
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${encodeURIComponent(nodeId)}`);
+    assert.equal(res.status, 200);
+    assert.ok(res.body.node);
+    assert.equal(res.body.node.nodeId, nodeId);
+    assert.ok(res.body.state, 'must return state');
+  });
+
+  // ── AC-NR-005: PATCH state updates markdown ──
+  it('AC-NR-005 PATCH /api/workflow/nodes/:id/state updates markdown content', async () => {
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const md = all.body.nodes.find(n => n.kind === 'markdown');
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${encodeURIComponent(md.nodeId)}/state`, {
+      method: 'PATCH',
+      body: { revision: md.version, markdown: '# API Test Content' },
+    });
+    assert.equal(res.status, 200);
+    assert.ok(res.body.ok);
+    assert.ok(res.body.state.markdown.includes('API Test Content'));
+  });
+
+  // ── AC-NR-006: PATCH settings updates editor mode ──
+  it('AC-NR-006 PATCH /api/workflow/nodes/:id/settings updates settings', async () => {
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const md = all.body.nodes.find(n => n.kind === 'markdown');
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${encodeURIComponent(md.nodeId)}/settings`, {
+      method: 'PATCH',
+      body: { editorMode: 'source' },
+    });
+    assert.equal(res.status, 200);
+    assert.ok(res.body.settings);
+    assert.ok(res.body.settings.values);
+    assert.equal(res.body.settings.values.editorMode, 'source');
+  });
+
+  // ── AC-NR-007: POST action executes markdown.read ──
+  it('AC-NR-007 POST /api/workflow/nodes/:id/actions/markdown.read returns markdown', async () => {
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const md = all.body.nodes.find(n => n.kind === 'markdown');
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes/${encodeURIComponent(md.nodeId)}/actions/markdown.read`, {
+      method: 'POST',
+      body: {},
+    });
+    assert.equal(res.status, 200);
+    assert.ok(res.body.ok);
+    assert.equal(res.body.action, 'markdown.read');
+    assert.ok(typeof res.body.result.markdown === 'string');
+  });
+
+  // ── AC-NR-008: POST edges connects two nodes ──
+  it('AC-NR-008 POST /api/workflow/edges creates edge between two nodes', async () => {
+    // Create second node
+    await jsonRequest(`${baseUrl}/api/workflow/nodes`, {
+      method: 'POST',
+      body: { type: 'excalidraw', title: 'API Test Draw' },
+    });
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const a = all.body.nodes[0];
+    const b = all.body.nodes[1];
+    const res = await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+      method: 'POST',
+      body: { from: a.nodeId, to: b.nodeId, relation: 'wf-bridge' },
+    });
+    assert.equal(res.status, 201);
+    assert.ok(res.body.ok);
+    assert.ok(res.body.edge);
+    assert.equal(res.body.edge.from, a.nodeId);
+    assert.equal(res.body.edge.to, b.nodeId);
+  });
+
+  // ── AC-NR-009: After edge, listNodes shows connections ──
+  it('AC-NR-009 after connect, listNodes returns populated graph.connections', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const nodes = res.body.nodes;
+    const connected = nodes.filter(n => n.graph && n.graph.connections && n.graph.connections.length > 0);
+    assert.ok(connected.length > 0, 'BUG #4: no nodes have connections after edge creation');
+  });
+
+  // ── AC-NR-010: GET context returns connected peers ──
+  it('AC-NR-010 GET /api/workflow/context/:id returns connected peers', async () => {
+    const all = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const first = all.body.nodes[0];
+    const res = await jsonRequest(`${baseUrl}/api/workflow/context/${encodeURIComponent(first.nodeId)}`);
+    assert.equal(res.status, 200);
+    assert.ok(res.body.node);
+    assert.ok(res.body.context);
+    assert.ok(Array.isArray(res.body.context.connectedPeers) || Array.isArray(res.body.node.graph.connections));
+  });
+
+  // ── AC-NR-011: DELETE edge removes edge ──
+  it('AC-NR-011 DELETE /api/workflow/edges/:id removes edge', async () => {
+    const snapshot = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    // We need the edge id — read graph snapshot
+    const graphRes = await jsonRequest(`${baseUrl}/api/a2a/graph-map`);
+    const edges = graphRes.body.edges || [];
+    if (edges.length === 0) {
+      // No edges to delete — this is a pre-existing state issue
+      console.log('AC-NR-011 SKIP: no edges in graph-map');
+      return;
+    }
+    const edgeId = edges[0].id;
+    const res = await jsonRequest(`${baseUrl}/api/workflow/edges/${encodeURIComponent(edgeId)}`, { method: 'DELETE' });
+    assert.equal(res.status, 200);
+    assert.ok(res.body.ok);
+  });
+
+  // ── AC-NR-012: DELETE node cleans up graph ──
+  it('AC-NR-012 DELETE node removes from graph-map (no dangling edges)', async () => {
+    // Create a node specifically for deletion test
+    await jsonRequest(`${baseUrl}/api/workflow/nodes`, {
+      method: 'POST',
+      body: { type: 'file', title: 'Delete Test', file: { source: 'workspace', path: 'test.txt', name: 'test.txt', mime: 'text/plain', size: 0 } },
+    });
+    const before = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    const fileNode = before.body.nodes.find(n => n.kind === 'file');
+    assert.ok(fileNode, 'file node must exist');
+
+    // Connect to another node
+    const md = before.body.nodes.find(n => n.kind === 'markdown');
+    if (md) {
+      await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+        method: 'POST',
+        body: { from: md.nodeId, to: fileNode.nodeId, relation: 'wf-bridge' },
+      });
+    }
+
+    // Delete the file node
+    const delRes = await jsonRequest(`${baseUrl}/api/workflow/nodes/${encodeURIComponent(fileNode.nodeId)}/actions/node.delete`, {
+      method: 'POST',
+      body: {},
+    });
+
+    // Verify cleanup: node gone from list
+    const after = await jsonRequest(`${baseUrl}/api/workflow/nodes`);
+    assert.ok(!after.body.nodes.some(n => n.nodeId === fileNode.nodeId), 'node should be removed from list');
+
+    // Verify graph-map has no dangling edges referencing deleted node
+    const graphAfter = await jsonRequest(`${baseUrl}/api/a2a/graph-map`);
+    const danglingEdges = (graphAfter.body.edges || []).filter(
+      e => e.from === fileNode.nodeId || e.to === fileNode.nodeId
+    );
+    assert.equal(danglingEdges.length, 0, `BUG #2: ${danglingEdges.length} dangling edges remain after delete`);
+  });
+
+  // ── AC-NR-013: connectNodes rejects nonexistent endpoints ──
+  it('AC-NR-013 connectNodes rejects nonexistent node endpoints', async () => {
+    const res = await jsonRequest(`${baseUrl}/api/workflow/edges`, {
+      method: 'POST',
+      body: { from: 'component-nonexistent-ffffffff', to: 'component-fake-deadbeef', relation: 'wf-bridge' },
+    });
+    assert.ok(res.status >= 400, `BUG #3: expected 4xx for fake nodes, got ${res.status}`);
+  });
+});
+
+console.log('OK: workflow-api-integration.test.mjs');