create-workframe 0.1.0

package/workframe-api/tests/test_profile_create.py

@@ -0,0 +1,72 @@
+import unittest
+from unittest.mock import patch
+
+import server
+
+
+class ProfileCreateTest(unittest.TestCase):
+    @patch.object(server, "_gateway_exec", return_value=(0, "created"))
+    @patch.object(server, "_patch_profile_gateway_run_script", return_value=(True, "ok"))
+    @patch.object(server, "_configure_profile_api", return_value=(True, "ok", 19001))
+    @patch.object(server, "_profile_dir")
+    def test_new_profile_uses_slug_not_route_validation(
+        self,
+        profile_dir,
+        configure_api,
+        patch_run,
+        gateway_exec,
+    ) -> None:
+        profile_dir.return_value.exists.return_value = False
+        with patch.object(server, "resolve_validated_profile", return_value="workframe-agent") as resolve, patch.object(
+            server, "_ensure_workspace_agent_profile_row", return_value="agent-id"
+        ), patch.object(server, "_upsert_agent_registry_row"), patch.object(
+            server, "_assign_agent_avatar", return_value={"avatar_id": "a1"}
+        ), patch.object(server, "_strip_forbidden_child_skills", return_value=[]), patch.object(
+            server, "_install_child_base_artifacts", return_value=False
+        ), patch.object(
+            server, "profile_gateway_lifecycle", return_value={"state": "running"}
+        ):
+            result = server.profile_create("architect", description="Systems design")
+            resolve.assert_called()
+        self.assertEqual(result["profile"], "architect")
+        gateway_exec.assert_called_once()
+        prof, cmd = gateway_exec.call_args[0]
+        self.assertEqual(prof, server._primary_profile())
+        self.assertEqual(cmd[:3], ["profile", "create", "--clone-from"])
+        self.assertEqual(cmd[-1], "architect")
+
+    @patch.object(server, "_gateway_exec", return_value=(0, "created"))
+    @patch.object(server, "_patch_profile_gateway_run_script", return_value=(True, "ok"))
+    @patch.object(server, "_configure_profile_api", return_value=(True, "ok", 19001))
+    @patch.object(server, "_profile_dir")
+    @patch.object(server, "bootstrap_agent_dm_lane", return_value={"ok": True, "runtime": "u-user-architect"})
+    def test_new_profile_registers_route_before_bootstrap(
+        self,
+        bootstrap,
+        profile_dir,
+        configure_api,
+        patch_run,
+        gateway_exec,
+    ) -> None:
+        profile_dir.return_value.exists.return_value = False
+        with patch.object(server, "resolve_validated_profile", return_value="workframe-agent"), patch.object(
+            server, "_register_profile_route", return_value=True
+        ) as register, patch.object(
+            server, "_ensure_workspace_agent_profile_row", return_value="agent-id"
+        ), patch.object(server, "_upsert_agent_registry_row"), patch.object(
+            server, "_assign_agent_avatar", return_value={"avatar_id": "a1"}
+        ), patch.object(server, "_strip_forbidden_child_skills", return_value=[]), patch.object(
+            server, "_install_child_base_artifacts", return_value=False
+        ), patch.object(server, "profile_gateway_lifecycle", return_value={"state": "running"}):
+            server.profile_create(
+                "elvis",
+                description="Custom agent",
+                user_id="user-1",
+                workspace_id="ws-1",
+            )
+        register.assert_called_once()
+        bootstrap.assert_called_once()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_profile_identity_overlay.py

@@ -0,0 +1,61 @@
+"""User identity overlays concatenate onto base SOUL — never replace it."""
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import server
+
+
+class ProfileIdentityOverlayTests(unittest.TestCase):
+    def test_user_soul_concatenates_on_base(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            prof_dir = root / "profiles" / "elvis"
+            prof_dir.mkdir(parents=True)
+            (prof_dir / "SOUL.md").write_text(
+                "# Elvis\n\nBase Workframe child agent.\n" + ("operate hermes. " * 20),
+                encoding="utf-8",
+            )
+            agents = root / "workframe" / "agents.json"
+            agents.parent.mkdir(parents=True)
+            agents.write_text(
+                '{"version":1,"agents":{"elvis":{"profile":"elvis","user_soul":"Always cite sources.","display_name":"Elvis","role":"Rock legend"}}}',
+                encoding="utf-8",
+            )
+            with mock.patch.object(server, "_profile_dir", side_effect=lambda p: root / "profiles" / p), mock.patch.object(
+                server, "AGENTS_JSON", agents
+            ), mock.patch.object(server, "_is_runtime_profile_slug", return_value=False):
+                text = server._profile_soul_text("elvis")
+            self.assertIn("Base Workframe child agent", text)
+            self.assertIn("## User identity", text)
+            self.assertIn("**Name:** Elvis", text)
+            self.assertIn("## Additional instructions", text)
+            self.assertIn("Always cite sources.", text)
+
+    def test_profile_soul_set_stores_child_overlay(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            prof_dir = root / "profiles" / "dev"
+            prof_dir.mkdir(parents=True)
+            (prof_dir / "SOUL.md").write_text("# Dev\n\n" + ("x" * 80), encoding="utf-8")
+            agents = root / "workframe" / "agents.json"
+            agents.parent.mkdir(parents=True)
+            agents.write_text('{"version":1,"agents":{}}', encoding="utf-8")
+            with mock.patch.object(server, "_profile_dir", side_effect=lambda p: root / "profiles" / p), mock.patch.object(
+                server, "AGENTS_JSON", agents
+            ), mock.patch.object(server, "ROUTES_JSON", root / "workframe" / "routes.json"), mock.patch.object(
+                server, "load_routes",
+                return_value={"routes": [{"profile": "dev"}]},
+            ), mock.patch.object(server, "profile_exists", return_value=True), mock.patch.object(
+                server, "_is_native_profile", return_value=False
+            ), mock.patch.object(server, "_is_runtime_profile_slug", return_value=False):
+                out = server.profile_soul_set("dev", "Ship small diffs.")
+            self.assertEqual(out.get("target"), "user_soul_overlay")
+            data = agents.read_text(encoding="utf-8")
+            self.assertIn("Ship small diffs.", data)
+            self.assertIn("# Dev", (prof_dir / "SOUL.md").read_text(encoding="utf-8"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_profile_install_health.py

@@ -0,0 +1,45 @@
+"""Install-time profile gateway health policy — cold u-* start must not flake finish-setup."""
+import importlib.util
+import inspect
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+API = ROOT / "workframe-api" / "server.py"
+
+
+def _load_api():
+    spec = importlib.util.spec_from_file_location("workframe_api", API)
+    mod = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class ProfileInstallHealthPolicyTest(unittest.TestCase):
+    def test_wait_default_covers_cold_runtime_start(self) -> None:
+        api = _load_api()
+        sig = inspect.signature(api._wait_profile_api_healthy)
+        self.assertEqual(sig.parameters["attempts"].default, 60)
+        self.assertGreaterEqual(sig.parameters["delay"].default * 60, 30.0)
+
+    def test_profile_health_uses_gateway_dns_not_container_exec(self) -> None:
+        api = _load_api()
+        src = inspect.getsource(api._profile_api_healthy)
+        self.assertIn("http://gateway:", src)
+        self.assertNotIn("_gateway_container_exec", src)
+
+    def test_wait_does_not_short_circuit_primary_without_probe(self) -> None:
+        api = _load_api()
+        src = inspect.getsource(api._wait_profile_api_healthy)
+        self.assertNotIn("_primary_profile() or _profile_api_healthy", src)
+
+    def test_bootstrap_lane_retries_gateway_start(self) -> None:
+        api = _load_api()
+        src = inspect.getsource(api.bootstrap_agent_dm_lane)
+        self.assertIn("for attempt in range(3)", src)
+        self.assertIn("ensure_profile_api(runtime", src)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_profile_secret_policy.py

@@ -0,0 +1,57 @@
+import unittest
+
+from profile_secret_policy import (
+    exec_blocked_for_profile,
+    is_secret_read_attempt,
+    touches_foreign_profile_secrets,
+)
+
+
+class ProfileSecretPolicyTests(unittest.TestCase):
+    def test_blocks_direct_secret_paths(self) -> None:
+        self.assertTrue(is_secret_read_attempt(["cat", "profiles/u-alice-dev/.env"]))
+        self.assertTrue(is_secret_read_attempt(["cat", "profiles/u-alice-dev/auth.json"]))
+
+    def test_blocks_wildcard_and_bypass_patterns(self) -> None:
+        self.assertTrue(is_secret_read_attempt("cat profiles/u-alice-dev/*"))
+        self.assertTrue(is_secret_read_attempt("cd profiles/u-x && cat .env"))
+        self.assertTrue(is_secret_read_attempt("cat profiles/u-x/.e''nv"))
+        self.assertTrue(is_secret_read_attempt("find profiles/u-x -exec cat {} +"))
+        self.assertTrue(is_secret_read_attempt("base64 profiles/u-x/.env"))
+        self.assertTrue(is_secret_read_attempt("tar -cf - profiles/u-x"))
+
+    def test_blocks_head_python_and_absolute_paths(self) -> None:
+        self.assertTrue(is_secret_read_attempt("cd /opt/data/profiles/u-bob && head .env"))
+        self.assertTrue(is_secret_read_attempt("cd profiles/u-x && python3 -c \"print(open('.env').read())\""))
+        self.assertTrue(is_secret_read_attempt("grep wf_rt_ /opt/data/profiles/u-bob/.env"))
+
+    def test_foreign_profile_touch_blocked_for_actor(self) -> None:
+        self.assertTrue(
+            touches_foreign_profile_secrets("cd profiles/u-bob && head .env", "u-alice-dev"),
+        )
+        self.assertFalse(
+            touches_foreign_profile_secrets("hermes -p u-alice-dev gateway status", "u-alice-dev"),
+        )
+
+    def test_exec_blocked_for_profile_combines_checks(self) -> None:
+        self.assertTrue(exec_blocked_for_profile("cd profiles/u-bob && head .env", "u-alice-dev"))
+        self.assertFalse(exec_blocked_for_profile(["hermes", "-p", "workframe-agent", "gateway", "status"], "workframe-agent"))
+
+    def test_allows_legitimate_gateway_commands(self) -> None:
+        self.assertFalse(is_secret_read_attempt(["hermes", "-p", "dev", "gateway", "run"]))
+        self.assertFalse(is_secret_read_attempt(["hermes", "-p", "workframe-agent", "gateway", "status"]))
+
+    def test_blocks_shell_variable_indirection(self) -> None:
+        self.assertTrue(is_secret_read_attempt("P=/opt/data/profiles/u-bob; cat $P/.env"))
+        self.assertTrue(is_secret_read_attempt("P=/opt/data/profiles/u-bob; dd if=$P/.env"))
+        self.assertTrue(exec_blocked_for_profile("P=/opt/data/profiles/u-bob; cat $P/.env", "u-alice-dev"))
+
+    def test_known_concat_ceiling_documented(self) -> None:
+        # ponytail: documented ceiling — regex cannot see through python string concat.
+        self.assertFalse(
+            is_secret_read_attempt("python3 -c \"p='/opt/data/pro'+'files/u-bob/.env';print(open(p).read())\"")
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_profile_workspace_cwd.py

@@ -0,0 +1,34 @@
+"""Profile terminal.cwd and workspace identity file helpers."""
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import server
+
+
+class ProfileWorkspaceCwdTests(unittest.TestCase):
+    def test_ensure_profile_terminal_cwd_patches_config(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            prof_dir = Path(tmp) / "profiles" / "u-user-dev"
+            prof_dir.mkdir(parents=True)
+            cfg = prof_dir / "config.yaml"
+            cfg.write_text("terminal:\n  backend: local\n  cwd: .\n", encoding="utf-8")
+            with mock.patch.object(server, "_profile_gateway_config_path", return_value=cfg):
+                server._ensure_profile_terminal_cwd("u-user-dev")
+            self.assertIn("cwd: /workspace", cfg.read_text(encoding="utf-8"))
+
+    def test_copy_text_without_bom_strips_bom(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            src = root / "AGENTS.md"
+            dst = root / "out.md"
+            src.write_bytes(b"\xef\xbb\xbf# hello\n")
+            server._copy_text_without_bom(src, dst)
+            self.assertEqual(dst.read_bytes(), b"# hello\n")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_provider_bootstrap.py

@@ -0,0 +1,75 @@
+import importlib.util
+import json
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+API = Path(__file__).resolve().parents[1] / "server.py"
+spec = importlib.util.spec_from_file_location("server", API)
+server = importlib.util.module_from_spec(spec)
+assert spec and spec.loader
+spec.loader.exec_module(server)
+
+
+class ProviderBootstrapTest(unittest.TestCase):
+    def test_seeds_specialist_auth_from_user_env_only(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            user_home = root / "profiles" / "user-new"
+            architect = root / "profiles" / "architect"
+            user_home.mkdir(parents=True)
+            architect.mkdir(parents=True)
+            (architect / "config.yaml").write_text(
+                "model:\n  default: openrouter/owl-alpha\n  provider: openrouter\n",
+                encoding="utf-8",
+            )
+            (architect / "auth.json").write_text(
+                json.dumps({"version": 1, "credential_pool": {"openrouter": []}}),
+                encoding="utf-8",
+            )
+            (user_home / ".env").write_text("OPENROUTER_API_KEY=sk-test-user\n", encoding="utf-8")
+            with patch.object(server, "HERMES_DATA", root), patch.object(
+                server, "NATIVE_PROFILE", "workframe-agent"
+            ), patch.object(server, "_primary_profile", return_value="workframe-agent"), patch.object(
+                server, "resolve_hermes_profile", side_effect=lambda p: p
+            ), patch.object(server, "resolve_validated_profile", side_effect=lambda p: p):
+                server._bootstrap_profile_providers("architect", "user-new", "ws-1")
+                auth = json.loads((architect / "auth.json").read_text(encoding="utf-8"))
+                entries = auth["credential_pool"]["openrouter"]
+                self.assertEqual(len(entries), 1)
+                self.assertEqual(entries[0]["source"], "env:OPENROUTER_API_KEY")
+                env = (architect / ".env").read_text(encoding="utf-8")
+                self.assertIn("OPENROUTER_API_KEY=sk-test-user", env)
+
+    def test_does_not_seed_without_user_credentials(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            primary = root / "profiles" / "workframe-agent"
+            architect = root / "profiles" / "architect"
+            primary.mkdir(parents=True)
+            architect.mkdir(parents=True)
+            (primary / ".env").write_text("OPENROUTER_API_KEY=sk-stack\n", encoding="utf-8")
+            (architect / "config.yaml").write_text(
+                "model:\n  default: openrouter/owl-alpha\n  provider: openrouter\n",
+                encoding="utf-8",
+            )
+            (architect / "auth.json").write_text(
+                json.dumps({"version": 1, "credential_pool": {"openrouter": []}}),
+                encoding="utf-8",
+            )
+            (architect / ".env").write_text("OPENROUTER_API_KEY=sk-stack\n", encoding="utf-8")
+            with patch.object(server, "HERMES_DATA", root), patch.object(
+                server, "NATIVE_PROFILE", "workframe-agent"
+            ), patch.object(server, "_primary_profile", return_value="workframe-agent"), patch.object(
+                server, "resolve_hermes_profile", side_effect=lambda p: p
+            ), patch.object(server, "resolve_validated_profile", side_effect=lambda p: p):
+                changed = server._bootstrap_profile_providers("architect", "user-no-keys", "ws-1")
+                self.assertTrue(changed)
+                auth = json.loads((architect / "auth.json").read_text(encoding="utf-8"))
+                self.assertEqual(auth["credential_pool"]["openrouter"], [])
+                self.assertNotIn("OPENROUTER_API_KEY", (architect / ".env").read_text(encoding="utf-8"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/workframe-api/tests/test_provider_connect.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+import importlib.util
+import tempfile
+from pathlib import Path
+
+import pytest
+
+SERVER_PATH = Path(__file__).resolve().parents[1] / "server.py"
+spec = importlib.util.spec_from_file_location("workframe_server", SERVER_PATH)
+server = importlib.util.module_from_spec(spec)
+assert spec.loader is not None
+spec.loader.exec_module(server)
+
+
+@pytest.fixture()
+def user_env(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> str:
+    monkeypatch.setattr(server, "HERMES_DATA", tmp_path)
+    user_id = "user-test-1"
+    return user_id
+
+
+def test_read_env_keys_ignores_empty_values(user_env: str) -> None:
+    env_path = server._user_hermes_env_path(user_env)
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    env_path.write_text("OPENROUTER_API_KEY=sk-test\nEMPTY_KEY=\n# comment\n", encoding="utf-8")
+
+    keys = server._read_env_keys(env_path)
+
+    assert keys == {"OPENROUTER_API_KEY"}
+
+
+def test_list_user_providers_marks_connected_from_env(user_env: str) -> None:
+    env_path = server._user_hermes_env_path(user_env)
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    env_path.write_text("OPENROUTER_API_KEY=sk-test\n", encoding="utf-8")
+
+    payload = server.list_user_providers(user_env)
+    openrouter = next(row for row in payload["providers"] if row["id"] == "openrouter")
+
+    assert openrouter["connected"] is True
+    assert openrouter["env_var"] == "OPENROUTER_API_KEY"
+
+
+def test_disconnect_user_provider_removes_env_secret(user_env: str) -> None:
+    env_path = server._user_hermes_env_path(user_env)
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    env_path.write_text("DISCORD_BOT_TOKEN=abc\nOTHER=1\n", encoding="utf-8")
+
+    result = server.disconnect_user_provider(user_env, "discord")
+
+    assert result["ok"] is True
+    assert "DISCORD_BOT_TOKEN" not in server._read_env_keys(env_path)
+    assert "OTHER" in server._read_env_keys(env_path)

package/workframe-api/tests/test_room_crud.py

@@ -0,0 +1,192 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+import server
+from db_setup import ensure_workframe_schemas
+
+
+class RoomCrudTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self._old_data_dir = server.DATA_DIR
+        self._old_auth_db_path = server.AUTH_DB_PATH
+        server.DATA_DIR = Path(self._tmp.name)
+        server.AUTH_DB_PATH = Path(self._tmp.name) / "auth.db"
+        ensure_workframe_schemas()
+        self.workspace_id = "workspace-a"
+        self.user_id = "user-a"
+        self.agent_profile_id = "agent-a"
+
+        conn = server._workframe_db()
+        try:
+            now = "1"
+            conn.execute(
+                """
+                INSERT INTO users (id, display_name, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?)
+                """,
+                (self.user_id, "User A", "member", "active", now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO workspaces (id, slug, display_name, owner_id, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                (self.workspace_id, "workspace-a", "Workspace A", self.user_id, "active", now, now),
+            )
+            conn.execute(
+                """
+                INSERT INTO agent_profiles (
+                    id, workspace_id, slug, display_name, status, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                (self.agent_profile_id, self.workspace_id, "agent-a", "Agent A", "available", now, now),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+    def tearDown(self) -> None:
+        server.DATA_DIR = self._old_data_dir
+        server.AUTH_DB_PATH = self._old_auth_db_path
+
+    def test_create_lists_and_gets_room(self) -> None:
+        status, payload = server._create_room(
+            self.workspace_id,
+            {
+                "name": "General Chat",
+                "slug": "general",
+                "topic": "Default channel",
+                "room_type": "channel",
+                "platform_ids": {"discord": "channel-1"},
+            },
+            self.user_id,
+        )
+
+        self.assertEqual(status, 201)
+        room = payload["room"]
+        self.assertEqual(room["workspace_id"], self.workspace_id)
+        self.assertEqual(room["name"], "General Chat")
+        self.assertEqual(room["slug"], "general")
+        self.assertEqual(room["topic"], "Default channel")
+        self.assertEqual(room["room_type"], "channel")
+        self.assertEqual(room["platform_ids"], {"discord": "channel-1"})
+        self.assertEqual(room["created_by"], self.user_id)
+
+        conn = server._workframe_db()
+        try:
+            self.assertTrue(server._user_can_access_room(conn, room["id"], self.user_id))
+        finally:
+            conn.close()
+
+        status, payload = server._list_rooms(self.workspace_id)
+        self.assertEqual(status, 200)
+        self.assertEqual(payload["workspace_id"], self.workspace_id)
+        self.assertEqual([room["id"] for room in payload["rooms"]], [room["id"]])
+
+        status, payload = server._get_room(room["id"])
+        self.assertEqual(status, 200)
+        self.assertEqual(payload["room"]["id"], room["id"])
+        self.assertEqual(payload["room"]["slug"], "general")
+
+    def test_create_rejects_invalid_inputs(self) -> None:
+        cases = [
+            (400, {}, "name required"),
+            (400, {"name": "Bad Type", "room_type": "bad"}, "invalid_room_type"),
+            (400, {"name": "Bad Agent", "agent_profile_id": "missing-agent"}, "agent_profile_not_found"),
+            (404, {"name": "Missing Workspace"}, "workspace_not_found"),
+        ]
+        for expected_status, body, expected_error in cases:
+            wid = self.workspace_id if expected_error != "workspace_not_found" else "missing-workspace"
+            status, payload = server._create_room(wid, body, self.user_id)
+            self.assertEqual(status, expected_status)
+            self.assertEqual(payload["error"], expected_error)
+
+    def test_slug_normalization_and_collision_handling(self) -> None:
+        status, payload = server._create_room(
+            self.workspace_id,
+            {"name": "General Chat!", "slug": "General Chat!"},
+            self.user_id,
+        )
+        self.assertEqual(status, 201)
+        self.assertEqual(payload["room"]["slug"], "general-chat")
+
+        status, payload = server._create_room(
+            self.workspace_id,
+            {"name": "General Chat Copy", "slug": "General Chat!"},
+            self.user_id,
+        )
+        self.assertEqual(status, 201)
+        self.assertEqual(payload["room"]["slug"], "general-chat-1")
+
+    def test_patch_room_updates_name_and_topic(self) -> None:
+        status, payload = server._create_room(
+            self.workspace_id,
+            {"name": "General Chat", "slug": "general", "topic": "Old topic", "room_type": "channel"},
+            self.user_id,
+        )
+        self.assertEqual(status, 201)
+        room_id = payload["room"]["id"]
+
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                """
+                INSERT INTO workspace_memberships (id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                ("wm-a", self.workspace_id, self.user_id, "owner", "active", "1", "1"),
+            )
+            conn.execute(
+                """
+                INSERT INTO room_memberships (id, room_id, user_id, role, status, joined_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                ("rm-a", room_id, self.user_id, "admin", "active", "1", "1"),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+        status, payload = server._patch_room(
+            room_id,
+            {"name": "Renamed Space", "topic": "New topic"},
+            self.user_id,
+        )
+        self.assertEqual(status, 200)
+        self.assertEqual(payload["room"]["name"], "Renamed Space")
+        self.assertEqual(payload["room"]["topic"], "New topic")
+
+    def test_create_room_accepts_hermes_slug_and_returns_hermes_profile(self) -> None:
+        status, payload = server._create_room(
+            self.workspace_id,
+            {
+                "name": "Agent DM",
+                "slug": "dm-user-agent",
+                "room_type": "direct",
+                "agent_profile_id": "agent-a",
+                "member_user_ids": [self.user_id],
+            },
+            self.user_id,
+        )
+        self.assertEqual(status, 201)
+        self.assertEqual(payload["room"]["agent_profile_id"], self.agent_profile_id)
+        self.assertEqual(payload["room"]["hermes_profile"], "agent-a")
+
+    def test_hermes_slug_from_agent_ref_maps_workspace_uuid(self) -> None:
+        conn = server._workframe_db()
+        try:
+            row = conn.execute(
+                "SELECT id FROM agent_profiles WHERE workspace_id = ? AND slug = ?",
+                (self.workspace_id, "agent-a"),
+            ).fetchone()
+        finally:
+            conn.close()
+        self.assertIsNotNone(row)
+        self.assertEqual(server._hermes_slug_from_agent_ref(str(row["id"])), "agent-a")
+
+
+if __name__ == "__main__":
+    unittest.main()