lastlight 0.1.15 → 0.2.1

package/dist/admin/routes.test.js

@@ -1,12 +1,18 @@
-import { describe, it, expect, vi } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Hono } from "hono";
 import { createAdminRoutes } from "./routes.js";
+import { mountAdmin } from "./index.js";
+import { BuildAssetStore } from "../state/build-assets.js";
 // Mock docker so tests don't need a running daemon
 vi.mock("./docker.js", () => ({
     listRunningContainers: vi.fn(async () => []),
     killContainer: vi.fn(async () => { }),
     getContainerStats: vi.fn(async () => []),
 }));
-// Mock arctic so we control OAuth flow without hitting Slack
+// Mock arctic so we control OAuth flow without hitting Slack or GitHub
 vi.mock("arctic", () => {
     class Slack {
         createAuthorizationURL(_state, _scopes) {
@@ -16,21 +22,33 @@ vi.mock("arctic", () => {
             return { accessToken: () => "mock-slack-access-token" };
         }
     }
-    return { Slack };
+    class GitHub {
+        createAuthorizationURL(_state, _scopes) {
+            return new URL("https://github.com/login/oauth/authorize?mocked=1");
+        }
+        async validateAuthorizationCode(_code) {
+            return { accessToken: () => "mock-github-access-token" };
+        }
+    }
+    return { Slack, GitHub };
 });
 // Minimal mocks
 const mockDb = {
-    executionStats: vi.fn(() => ({ total: 0, running: 0, success: 0, failed: 0 })),
-    dailyStats: vi.fn(() => []),
-    hourlyStats: vi.fn(() => []),
-    getRateLimits: vi.fn(() => []),
-    listSystemStatus: vi.fn(() => []),
-    allExecutions: vi.fn(() => []),
-    listWorkflowRuns: vi.fn(() => ({ runs: [], total: 0 })),
-    distinctWorkflowNames: vi.fn(() => []),
-    getWorkflowRun: vi.fn(() => null),
-    listPendingApprovals: vi.fn(() => []),
-    runningExecutions: vi.fn(() => []),
+    executions: {
+        executionStats: vi.fn(() => ({ total: 0, running: 0, success: 0, failed: 0 })),
+        dailyStats: vi.fn(() => []),
+        hourlyStats: vi.fn(() => []),
+        allExecutions: vi.fn(() => []),
+        runningExecutions: vi.fn(() => []),
+    },
+    runs: {
+        list: vi.fn(() => ({ runs: [], total: 0 })),
+        distinctNames: vi.fn(() => []),
+        getRun: vi.fn(() => null),
+    },
+    approvals: {
+        listPending: vi.fn(() => []),
+    },
 };
 const mockSessions = {
     listSessionIds: vi.fn(() => []),
@@ -38,6 +56,7 @@ const mockSessions = {
     exists: vi.fn(() => false),
     read: vi.fn(async () => []),
     getFilePath: vi.fn(() => null),
+    normalizeRawLine: vi.fn((raw) => [raw]),
 };
 function makeConfig(overrides = {}) {
     return {
@@ -182,6 +201,226 @@ describe("GET /oauth/slack/callback", () => {
         global.fetch = originalFetch;
     });
 });
+describe("GET /auth-required (GitHub OAuth)", () => {
+    it("returns githubOAuth: false when not configured", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig());
+        const res = await request(app, "/auth-required");
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.githubOAuth).toBe(false);
+    });
+    it("returns githubOAuth: true when client ID, secret, and allowed org are configured", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubAllowedOrg: "acme",
+        }));
+        const res = await request(app, "/auth-required");
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.githubOAuth).toBe(true);
+    });
+    it("returns githubOAuth: true when allowed org is \"*\" (allow any user)", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubAllowedOrg: "*",
+        }));
+        const res = await request(app, "/auth-required");
+        const body = await res.json();
+        expect(body.githubOAuth).toBe(true);
+    });
+    it("returns githubOAuth: false when only clientId is set (secret missing)", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+        }));
+        const res = await request(app, "/auth-required");
+        const body = await res.json();
+        expect(body.githubOAuth).toBe(false);
+    });
+    it("returns githubOAuth: false when id+secret set but allowed org is missing", async () => {
+        const errSpy = vi.spyOn(console, "error").mockImplementation(() => { });
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+        }));
+        const res = await request(app, "/auth-required");
+        const body = await res.json();
+        expect(body.githubOAuth).toBe(false);
+        expect(errSpy).toHaveBeenCalled();
+        errSpy.mockRestore();
+    });
+});
+describe("GET /oauth/github/authorize", () => {
+    it("returns 404 when GitHub OAuth not configured", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig());
+        const res = await request(app, "/oauth/github/authorize");
+        expect(res.status).toBe(404);
+    });
+    it("returns 404 when id+secret set but allowed org is missing", async () => {
+        const errSpy = vi.spyOn(console, "error").mockImplementation(() => { });
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+        }));
+        const res = await request(app, "/oauth/github/authorize");
+        expect(res.status).toBe(404);
+        errSpy.mockRestore();
+    });
+    it("redirects to GitHub when configured with an allowed org", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        const res = await request(app, "/oauth/github/authorize");
+        expect(res.status).toBe(302);
+        const location = res.headers.get("location") ?? "";
+        expect(location).toContain("github.com");
+    });
+    it("sets github_oauth_state cookie when configured", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        const res = await request(app, "/oauth/github/authorize");
+        const setCookie = res.headers.get("set-cookie") ?? "";
+        expect(setCookie).toContain("github_oauth_state=");
+        expect(setCookie).toContain("HttpOnly");
+        expect(setCookie).toContain("SameSite=Lax");
+        expect(setCookie).toContain("Path=/");
+    });
+});
+/** Helper: mock global.fetch routing /user and /orgs/... to different responses */
+function mockGithubFetch({ userLogin, orgStatus }) {
+    return vi.fn(async (url) => {
+        const urlStr = typeof url === "string" ? url : url instanceof URL ? url.href : url.url;
+        if (urlStr.includes("/orgs/")) {
+            return new Response(null, { status: orgStatus ?? 204 });
+        }
+        // Default: /user
+        return new Response(JSON.stringify({ login: userLogin }), { headers: { "Content-Type": "application/json" } });
+    });
+}
+describe("GET /oauth/github/callback", () => {
+    it("returns 404 when GitHub OAuth not configured", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig());
+        const res = await request(app, "/oauth/github/callback?code=abc&state=xyz");
+        expect(res.status).toBe(404);
+    });
+    it("returns 400 when state is missing or mismatched", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        // No cookie set → state mismatch
+        const res = await request(app, "/oauth/github/callback?code=abc&state=bad-state");
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toBe("/admin/?error=oauth_state");
+    });
+    it("redirects to /admin/?error=oauth_code when code is missing", async () => {
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubAllowedOrg: "acme",
+        }));
+        const state = "teststate000";
+        const req = new Request(`http://localhost/oauth/github/callback?state=${state}`, {
+            headers: { Cookie: `github_oauth_state=${state}` },
+        });
+        const res = await app.fetch(req);
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toBe("/admin/?error=oauth_code");
+    });
+    it("redirects with token and skips org fetch when allowlist is \"*\"", async () => {
+        const originalFetch = global.fetch;
+        const fetchMock = mockGithubFetch({ userLogin: "alice" });
+        global.fetch = fetchMock;
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "*",
+        }));
+        const state = "teststate111";
+        const req = new Request(`http://localhost/oauth/github/callback?code=abc&state=${state}`, {
+            headers: { Cookie: `github_oauth_state=${state}` },
+        });
+        const res = await app.fetch(req);
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toContain("/admin/?token=");
+        // Must not have called the /orgs/ membership endpoint under "*"
+        const calls = fetchMock.mock.calls.map((c) => {
+            const u = c[0];
+            return typeof u === "string" ? u : u instanceof URL ? u.href : u.url;
+        });
+        expect(calls.some((u) => u.includes("/orgs/"))).toBe(false);
+        global.fetch = originalFetch;
+    });
+    it("redirects with token when org membership returns 204", async () => {
+        const originalFetch = global.fetch;
+        global.fetch = mockGithubFetch({ userLogin: "alice", orgStatus: 204 });
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        const state = "teststate222";
+        const req = new Request(`http://localhost/oauth/github/callback?code=abc&state=${state}`, {
+            headers: { Cookie: `github_oauth_state=${state}` },
+        });
+        const res = await app.fetch(req);
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toContain("/admin/?token=");
+        global.fetch = originalFetch;
+    });
+    it("redirects to /admin/?error=github_org when membership returns 404 (not a member)", async () => {
+        const originalFetch = global.fetch;
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        global.fetch = mockGithubFetch({ userLogin: "alice", orgStatus: 404 });
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        const state = "teststate333";
+        const req = new Request(`http://localhost/oauth/github/callback?code=abc&state=${state}`, {
+            headers: { Cookie: `github_oauth_state=${state}` },
+        });
+        const res = await app.fetch(req);
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toBe("/admin/?error=github_org");
+        global.fetch = originalFetch;
+        warnSpy.mockRestore();
+    });
+    it("redirects to /admin/?error=github_org when membership returns 302 (insufficient visibility)", async () => {
+        const originalFetch = global.fetch;
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        global.fetch = mockGithubFetch({ userLogin: "alice", orgStatus: 302 });
+        const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
+            githubOAuthClientId: "GH_CLIENT",
+            githubOAuthClientSecret: "GH_SECRET",
+            githubOAuthRedirectUri: "http://localhost/callback",
+            githubAllowedOrg: "acme",
+        }));
+        const state = "teststate444";
+        const req = new Request(`http://localhost/oauth/github/callback?code=abc&state=${state}`, {
+            headers: { Cookie: `github_oauth_state=${state}` },
+        });
+        const res = await app.fetch(req);
+        expect(res.status).toBe(302);
+        expect(res.headers.get("location")).toBe("/admin/?error=github_org");
+        global.fetch = originalFetch;
+        warnSpy.mockRestore();
+    });
+});
 describe("POST /login (password)", () => {
     it("still works with correct password", async () => {
         const app = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({
@@ -208,4 +447,431 @@ describe("POST /login (password)", () => {
         expect(res.status).toBe(401);
     });
 });
+describe("POST /workflow-runs/:id/cancel", () => {
+    // Helper to make a cancel-test db that returns a single run and
+    // records calls to the mutating methods we care about.
+    function makeCancelDb(opts) {
+        const finishes = [];
+        const cancels = [];
+        const db = {
+            ...mockDb,
+            runs: {
+                ...(mockDb.runs),
+                getRun: vi.fn(() => opts.run.status === "cancelled" ? null : {
+                    id: opts.run.id,
+                    workflowName: "pr-review",
+                    triggerId: opts.run.triggerId,
+                    currentPhase: "review",
+                    phaseHistory: [],
+                    status: opts.run.status,
+                    context: opts.run.taskId ? { taskId: opts.run.taskId } : {},
+                    startedAt: "",
+                    updatedAt: "",
+                }),
+                cancelRun: vi.fn((id) => { cancels.push(id); }),
+            },
+            executions: {
+                ...(mockDb.executions),
+                runningExecutions: vi.fn(() => opts.runningExecutions ?? []),
+                recordFinish: vi.fn((id, res) => { finishes.push({ id, error: res.error }); }),
+            },
+        };
+        return { db, finishes, cancels };
+    }
+    it("returns 404 when run not found", async () => {
+        const db = {
+            ...mockDb,
+            runs: {
+                ...(mockDb.runs),
+                getRun: vi.fn(() => null),
+            },
+        };
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/run-abc/cancel", { method: "POST" });
+        expect(res.status).toBe(404);
+    });
+    it("returns 400 when run already in a terminal state", async () => {
+        const { db } = makeCancelDb({ run: { id: "r1", status: "succeeded", triggerId: "t1" } });
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/r1/cancel", { method: "POST" });
+        expect(res.status).toBe(400);
+    });
+    it("cancels and kills containers matching the run's taskId prefix", async () => {
+        const dockerMod = await import("./docker.js");
+        const listMock = vi.mocked(dockerMod.listRunningContainers);
+        const killMock = vi.mocked(dockerMod.killContainer);
+        listMock.mockResolvedValueOnce([
+            { id: "c1", name: "lastlight-sandbox-task-xyz-aaaaaaaa", taskId: "task-xyz", status: "running", created: "", image: "" },
+            { id: "c2", name: "lastlight-sandbox-task-xyz-review-bbbbbbbb", taskId: "task-xyz-review", status: "running", created: "", image: "" },
+            { id: "c3", name: "lastlight-sandbox-other-cccccccc", taskId: "other", status: "running", created: "", image: "" },
+        ]);
+        const { db, finishes, cancels } = makeCancelDb({
+            run: { id: "r1", status: "running", triggerId: "t1", taskId: "task-xyz" },
+            runningExecutions: [
+                { id: "e1", workflowRunId: "r1", triggerId: "t1" },
+                { id: "e2", workflowRunId: "r1", triggerId: "t1" },
+            ],
+        });
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/r1/cancel", { method: "POST" });
+        expect(res.status).toBe(200);
+        expect(cancels).toEqual(["r1"]);
+        expect(killMock).toHaveBeenCalledTimes(2);
+        expect(killMock).toHaveBeenCalledWith("lastlight-sandbox-task-xyz-aaaaaaaa");
+        expect(killMock).toHaveBeenCalledWith("lastlight-sandbox-task-xyz-review-bbbbbbbb");
+        expect(killMock).not.toHaveBeenCalledWith("lastlight-sandbox-other-cccccccc");
+        expect(finishes.map((f) => f.id).sort()).toEqual(["e1", "e2"]);
+        expect(finishes.every((f) => f.error === "cancelled via admin dashboard")).toBe(true);
+    });
+    it("does NOT mark sibling-run executions as failed when cancelling a run with a shared triggerId", async () => {
+        // Regression for the PR #38 review: matching by triggerId clobbered
+        // execution rows belonging to a concurrent run on the same trigger.
+        // Matching by workflowRunId must only finish rows for THIS run.
+        const dockerMod = await import("./docker.js");
+        vi.mocked(dockerMod.listRunningContainers).mockResolvedValueOnce([]);
+        const { db, finishes } = makeCancelDb({
+            run: { id: "r1", status: "running", triggerId: "shared-trigger", taskId: "task-r1" },
+            runningExecutions: [
+                { id: "e1", workflowRunId: "r1", triggerId: "shared-trigger" },
+                { id: "e2", workflowRunId: "r2", triggerId: "shared-trigger" },
+                { id: "e3", workflowRunId: undefined, triggerId: "shared-trigger" },
+            ],
+        });
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/r1/cancel", { method: "POST" });
+        expect(res.status).toBe(200);
+        expect(finishes.map((f) => f.id)).toEqual(["e1"]);
+    });
+});
+describe("GET /workflow-runs/:id/approvals", () => {
+    function makeApprovalsDb(run, approvals) {
+        const listForWorkflow = vi.fn(() => approvals);
+        const db = {
+            ...mockDb,
+            runs: {
+                ...(mockDb.runs),
+                getRun: vi.fn(() => run),
+            },
+            approvals: {
+                ...(mockDb.approvals),
+                listForWorkflow,
+            },
+        };
+        return { db, listForWorkflow };
+    }
+    it("returns 404 when the run is not found", async () => {
+        const { db } = makeApprovalsDb(null, []);
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/missing/approvals");
+        expect(res.status).toBe(404);
+    });
+    it("returns every approval (all statuses) for the run, looked up by run id", async () => {
+        const run = { id: "run-1", triggerId: "t1", workflowName: "build" };
+        const approvals = [
+            { id: "a1", workflowRunId: "run-1", gate: "post_architect", status: "approved", respondedBy: "alice", createdAt: "2026-01-01T00:00:00Z" },
+            { id: "a2", workflowRunId: "run-1", gate: "pre_fix", status: "pending", createdAt: "2026-01-01T01:00:00Z" },
+        ];
+        const { db, listForWorkflow } = makeApprovalsDb(run, approvals);
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const res = await request(app, "/workflow-runs/run-1/approvals");
+        expect(res.status).toBe(200);
+        const body = await res.json();
+        expect(body.approvals).toEqual(approvals);
+        expect(listForWorkflow).toHaveBeenCalledWith("run-1");
+    });
+});
+describe("GET /sessions — content filter + liveness", () => {
+    const now = Date.now() / 1000;
+    const meta = (over) => ({
+        id: "x", source: "agent", sessionType: "agent", model: "m",
+        started_at: now, last_message_at: now, message_count: 5,
+        tool_call_count: 0, conversation_message_count: 5,
+        last_assistant_content: null, agentIds: [], ...over,
+    });
+    function appWith(metas) {
+        const sessions = {
+            ...mockSessions,
+            listSessionIds: vi.fn(() => metas.map((m) => m.id)),
+            getSessionMeta: vi.fn(async (id) => metas.find((m) => m.id === id) ?? null),
+        };
+        return createAdminRoutes(mockDb, sessions, mockSessions, makeConfig({ adminPassword: "" }));
+    }
+    it("omits zero-message sessions (empty/aborted runs left behind)", async () => {
+        const dockerMod = await import("./docker.js");
+        vi.mocked(dockerMod.listRunningContainers).mockResolvedValueOnce([]);
+        const app = appWith([
+            meta({ id: "real", message_count: 3 }),
+            meta({ id: "exec-drizzle-553-pr-review-e34282db", message_count: 0 }),
+        ]);
+        const res = await request(app, "/sessions");
+        const body = await res.json();
+        expect(body.sessions.map((s) => s.id)).toEqual(["real"]);
+    });
+    it("marks an exec-<taskId> session live only when its container is running", async () => {
+        const dockerMod = await import("./docker.js");
+        vi.mocked(dockerMod.listRunningContainers).mockResolvedValueOnce([
+            { id: "c1", name: "lastlight-sandbox-task-xyz-aaaaaaaa", taskId: "task-xyz", status: "running", created: "", image: "" },
+        ]);
+        const app = appWith([
+            meta({ id: "exec-task-xyz", message_count: 2 }), // matches running container
+            meta({ id: "exec-task-other", message_count: 2 }), // no matching container
+        ]);
+        const res = await request(app, "/sessions");
+        const body = await res.json();
+        const byId = Object.fromEntries(body.sessions.map((s) => [s.id, s.live]));
+        expect(byId["exec-task-xyz"]).toBe(true);
+        expect(byId["exec-task-other"]).toBe(false);
+    });
+});
+describe("POST /approvals/:id/respond", () => {
+    // Build a db whose approval/run sub-stores record the lifecycle mutations
+    // the approval route can issue, so a test can assert which ones fired.
+    function makeApprovalDb(over = {}) {
+        const calls = {
+            respond: [],
+            resolveGateAndResume: [],
+            resolveGateAndFail: [],
+        };
+        const approval = "approval" in over ? over.approval : { id: "appr-1", status: "pending", workflowRunId: "run-1" };
+        const run = "run" in over ? over.run : { id: "run-1", workflowName: "build", triggerId: "o/r#3", issueNumber: 3 };
+        // respond() returns the compare-and-set row count; default 1 (won the CAS).
+        const respondChanges = over.respondChanges ?? 1;
+        const db = {
+            ...mockDb,
+            approvals: {
+                ...(mockDb.approvals),
+                getById: vi.fn(() => approval),
+                respond: vi.fn((...args) => { calls.respond.push(args); return respondChanges; }),
+            },
+            runs: {
+                ...(mockDb.runs),
+                getRun: vi.fn(() => run),
+                resolveGateAndResume: vi.fn((...args) => { calls.resolveGateAndResume.push(args); return run; }),
+                resolveGateAndFail: vi.fn((...args) => { calls.resolveGateAndFail.push(args); return run; }),
+            },
+        };
+        return { db, calls };
+    }
+    async function respond(db, id, payload, cfg = {}) {
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "", ...cfg }));
+        return request(app, `/approvals/${id}/respond`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload),
+        });
+    }
+    it("404s when the approval is missing", async () => {
+        const { db } = makeApprovalDb({ approval: null });
+        const res = await respond(db, "nope", { decision: "approved" });
+        expect(res.status).toBe(404);
+    });
+    it("400s when the approval is already resolved", async () => {
+        const { db } = makeApprovalDb({ approval: { id: "appr-1", status: "approved", workflowRunId: "run-1" } });
+        const res = await respond(db, "appr-1", { decision: "approved" });
+        expect(res.status).toBe(400);
+    });
+    it("approves and dispatches a resume when resumeWorkflow is wired", async () => {
+        const { db, calls } = makeApprovalDb();
+        const resumeWorkflow = vi.fn(async () => { });
+        const res = await respond(db, "appr-1", { decision: "approved" }, { resumeWorkflow });
+        expect(res.status).toBe(200);
+        // The approval is recorded and the resume helper is handed the run...
+        expect(calls.respond).toEqual([["appr-1", "approved", "admin", undefined]]);
+        expect(resumeWorkflow).toHaveBeenCalledWith(expect.objectContaining({ id: "run-1" }), "admin");
+        // ...and the route does NOT pre-flip the run to running via the atomic op —
+        // resumeWorkflow owns the status flip so it only happens with a dispatch.
+        expect(calls.resolveGateAndResume).toEqual([]);
+    });
+    it("records the approval WITHOUT flipping the run to running when no resume can be dispatched", async () => {
+        // Regression (PR #105 review): the atomic approve+resume flipped the run to
+        // `running` even when no worker would be dispatched (no resumeWorkflow
+        // wired, App down, or a non-issue trigger), orphaning the row. The approval
+        // must be recorded, but the run must NOT become `running`.
+        const { db, calls } = makeApprovalDb();
+        const res = await respond(db, "appr-1", { decision: "approved" }); // no resumeWorkflow
+        expect(res.status).toBe(200);
+        expect(calls.respond).toEqual([["appr-1", "approved", "admin", undefined]]);
+        expect(calls.resolveGateAndResume).toEqual([]);
+    });
+    it("409s and does NOT resume when the approval CAS loses a race", async () => {
+        // The status check above is a TOCTOU read; if a concurrent responder wins,
+        // respond() changes 0 rows. The loser must 409 and never hand the run to
+        // resumeWorkflow for a second dispatch.
+        const { db, calls } = makeApprovalDb({ respondChanges: 0 });
+        const resumeWorkflow = vi.fn(async () => { });
+        const res = await respond(db, "appr-1", { decision: "approved" }, { resumeWorkflow });
+        expect(res.status).toBe(409);
+        expect(resumeWorkflow).not.toHaveBeenCalled();
+        expect(calls.resolveGateAndResume).toEqual([]);
+    });
+    it("rejects by failing the run atomically", async () => {
+        const { db, calls } = makeApprovalDb();
+        const res = await respond(db, "appr-1", { decision: "rejected", reason: "too risky" });
+        expect(res.status).toBe(200);
+        expect(calls.resolveGateAndFail).toEqual([["appr-1", "admin", "too risky"]]);
+        expect(calls.respond).toEqual([]);
+    });
+});
+describe("GET /approvals/:id (focused approval enrichment)", () => {
+    function makeDb(approval, run) {
+        return {
+            ...mockDb,
+            approvals: {
+                ...(mockDb.approvals),
+                getById: vi.fn(() => approval),
+            },
+            runs: {
+                ...(mockDb.runs),
+                getRun: vi.fn(() => run),
+            },
+        };
+    }
+    async function getApproval(db, id, cfg = {}) {
+        const app = createAdminRoutes(db, mockSessions, mockSessions, makeConfig({ adminPassword: "", ...cfg }));
+        return request(app, `/approvals/${id}`);
+    }
+    // Production shape: workflow_runs.repo is the BARE name; owner lives in
+    // context (matching src/workflows/simple.ts). The Slack-invoked build flow
+    // uses the same createRun path, so this also covers it.
+    const run = {
+        id: "run-1",
+        workflowName: "build",
+        triggerId: "acme/widget#3",
+        repo: "widget",
+        issueNumber: 3,
+        context: { owner: "acme", branch: "lastlight/issue-3", issueDir: ".lastlight/issue-3" },
+    };
+    it("404s when the approval is missing", async () => {
+        const res = await getApproval(makeDb(null, run), "nope");
+        expect(res.status).toBe(404);
+    });
+    it("returns a server-mode artifactRef (editable store doc)", async () => {
+        const approval = { id: "a1", status: "pending", workflowRunId: "run-1", artifact: "architect-plan.md" };
+        const res = await getApproval(makeDb(approval, run), "a1", { buildAssets: "server" });
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.artifactRef).toMatchObject({
+            mode: "server",
+            owner: "acme",
+            repo: "widget",
+            issueKey: "issue-3",
+            doc: "architect-plan.md",
+        });
+        expect(body.artifactRef.githubUrl).toBeUndefined();
+    });
+    it("returns a repo-mode artifactRef with a GitHub blob URL", async () => {
+        const approval = { id: "a1", status: "pending", workflowRunId: "run-1", artifact: "architect-plan.md" };
+        const res = await getApproval(makeDb(approval, run), "a1", { buildAssets: "repo" });
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.artifactRef.mode).toBe("repo");
+        expect(body.artifactRef.githubUrl).toBe("https://github.com/acme/widget/blob/lastlight%2Fissue-3/.lastlight/issue-3/architect-plan.md");
+    });
+    it("returns artifactRef: null when the gate carries no artifact", async () => {
+        const approval = { id: "a1", status: "pending", workflowRunId: "run-1" };
+        const res = await getApproval(makeDb(approval, run), "a1", { buildAssets: "server" });
+        const body = await res.json();
+        expect(res.status).toBe(200);
+        expect(body.artifactRef).toBeNull();
+    });
+});
+describe("artifacts endpoints (server-mode build assets)", () => {
+    let dir;
+    // Auth disabled (empty password) so the round-trip test doesn't need a token.
+    const app = () => createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({ adminPassword: "", buildAssetsDir: dir }));
+    beforeEach(() => { dir = mkdtempSync(join(tmpdir(), "ll-routes-assets-")); });
+    afterEach(() => { rmSync(dir, { recursive: true, force: true }); });
+    it("PUT then GET round-trips a doc and lists keys/files", async () => {
+        const a = app();
+        const put = await request(a, "/artifacts/acme/widget/issue-42/architect-plan.md", {
+            method: "PUT",
+            headers: { "Content-Type": "text/plain" },
+            body: "# Plan\n",
+        });
+        expect(put.status).toBe(200);
+        expect(await put.json()).toEqual({ ok: true });
+        const keys = await request(a, "/artifacts?repo=acme/widget");
+        expect(await keys.json()).toEqual({ keys: ["issue-42"] });
+        const files = await request(a, "/artifacts/acme/widget/issue-42");
+        expect(await files.json()).toEqual({ files: ["architect-plan.md"] });
+        const doc = await request(a, "/artifacts/acme/widget/issue-42/architect-plan.md");
+        expect(doc.status).toBe(200);
+        expect(await doc.text()).toBe("# Plan\n");
+    });
+    it("400s on a traversal attempt in the doc name", async () => {
+        const res = await request(app(), "/artifacts/acme/widget/issue-42/..%2f..%2fsecret", {
+            method: "PUT",
+            body: "x",
+        });
+        expect(res.status).toBe(400);
+    });
+    it("404 on an unknown doc; empty lists for an unknown repo", async () => {
+        const a = app();
+        const missing = await request(a, "/artifacts/acme/widget/issue-1/nope.md");
+        expect(missing.status).toBe(404);
+        const keys = await request(a, "/artifacts?repo=nobody/nothing");
+        expect(await keys.json()).toEqual({ keys: [] });
+    });
+    it("reports empty when no store dir is configured", async () => {
+        const a = createAdminRoutes(mockDb, mockSessions, mockSessions, makeConfig({ adminPassword: "" }));
+        const keys = await request(a, "/artifacts?repo=acme/widget");
+        expect(await keys.json()).toEqual({ keys: [] });
+    });
+});
+describe("public artifact image route (mountAdmin carve-out)", () => {
+    let dir;
+    // Auth ENABLED — the public image route must still be reachable without a
+    // token (it's registered on the parent app, before the auth-guarded
+    // /admin/api sub-app), while the auth-gated route is not.
+    const mount = (buildAssetsDir) => {
+        const app = new Hono();
+        mountAdmin(app, mockDb, makeConfig({ adminPassword: "secret", buildAssetsDir }));
+        return app;
+    };
+    const get = (app, path) => app.fetch(new Request(`http://localhost${path}`));
+    beforeEach(() => {
+        dir = mkdtempSync(join(tmpdir(), "ll-public-assets-"));
+        new BuildAssetStore(dir).write({ owner: "acme", repo: "widget", issueKey: "issue-1" }, "home.png", "PNG-BYTES");
+        new BuildAssetStore(dir).write({ owner: "acme", repo: "widget", issueKey: "issue-1" }, "plan.md", "# secret plan\n");
+    });
+    afterEach(() => rmSync(dir, { recursive: true, force: true }));
+    it("serves a PNG as image/png with NO auth token", async () => {
+        const res = await get(mount(dir), "/admin/api/public/artifacts/acme/widget/issue-1/home.png");
+        expect(res.status).toBe(200);
+        expect(res.headers.get("Content-Type")).toBe("image/png");
+        expect(await res.text()).toBe("PNG-BYTES");
+    });
+    it("serves an mp4 as video/mp4 with Range support and NO auth token", async () => {
+        new BuildAssetStore(dir).write({ owner: "acme", repo: "widget", issueKey: "issue-1" }, "demo.mp4", "MP4-BYTES-0123456789");
+        const app = mount(dir);
+        const full = await get(app, "/admin/api/public/artifacts/acme/widget/issue-1/demo.mp4");
+        expect(full.status).toBe(200);
+        expect(full.headers.get("Content-Type")).toBe("video/mp4");
+        expect(full.headers.get("Accept-Ranges")).toBe("bytes");
+        // A Range request (what a <video> element / GitHub player sends) must
+        // return 206 Partial Content with a Content-Range so seeking works.
+        const ranged = await app.fetch(new Request("http://localhost/admin/api/public/artifacts/acme/widget/issue-1/demo.mp4", {
+            headers: { Range: "bytes=0-3" },
+        }));
+        expect(ranged.status).toBe(206);
+        expect(ranged.headers.get("Content-Range")).toBe("bytes 0-3/20");
+        expect(await ranged.text()).toBe("MP4-");
+    });
+    it("404s on a non-media doc (media-only gate keeps text docs private)", async () => {
+        const res = await get(mount(dir), "/admin/api/public/artifacts/acme/widget/issue-1/plan.md");
+        expect(res.status).toBe(404);
+    });
+    it("404s for a missing image", async () => {
+        const res = await get(mount(dir), "/admin/api/public/artifacts/acme/widget/issue-1/nope.png");
+        expect(res.status).toBe(404);
+    });
+    it("404s when the build-assets store is not configured", async () => {
+        const res = await get(mount(undefined), "/admin/api/public/artifacts/acme/widget/issue-1/home.png");
+        expect(res.status).toBe(404);
+    });
+    it("the auth-gated artifacts route still requires a token (contrast)", async () => {
+        const res = await get(mount(dir), "/admin/api/artifacts/acme/widget/issue-1/plan.md");
+        expect(res.status).toBe(401);
+    });
+});
 //# sourceMappingURL=routes.test.js.map