onbuzz 4.0.2 → 4.2.0

package/src/core/messageProcessor.js

@@ -467,9 +467,22 @@ class MessageProcessor {
           // Pass truncation info to tool for partial execution handling.
           // Re-derive projectDir from directoryAccess in case a previous tool
           // (e.g. terminal change-directory) updated the working directory.
+          //
+          // toolConfig is this tool's slice of the agent's per-tool config
+          // (from agent.toolConfig[toolId]) — null when the agent didn't
+          // override anything for this tool, in which case the tool uses
+          // its global defaults. Tools that want to support per-agent
+          // config read `context.toolConfig` and merge it with their own
+          // defaults; tools that ignore it get the same behaviour as
+          // before.
+          const perToolConfig = (context.agentToolConfig && command.toolId)
+            ? context.agentToolConfig[command.toolId] || null
+            : null;
+
           const toolContext = {
             ...context,
             projectDir: context.directoryAccess?.workingDirectory || context.projectDir,
+            toolConfig: perToolConfig,
             wasRepaired: command.wasRepaired || false,
             wasTruncated: command.wasTruncated || false
           };
@@ -823,7 +836,7 @@ class MessageProcessor {
       
       // Get agent to include its directoryAccess configuration
       const agent = await this.agentPool.getAgent(agentId);
-      
+
       // Execute tools with agent context including sessionId and directoryAccess
       const toolContext = {
         ...context,
@@ -831,6 +844,11 @@ class MessageProcessor {
         sessionId: context.sessionId, // Ensure sessionId is explicitly available for tools
         directoryAccess: agent?.directoryAccess, // Include agent's directory access configuration
         projectDir: agent?.directoryAccess?.workingDirectory || agent?.projectDir || context.projectDir, // Extract project directory from directoryAccess
+        // Per-agent tool configuration — keyed by tool id. Tools can read
+        // their own slice via `context.toolConfig` (injected per-tool in
+        // executeTools below) or inspect the full map here if they need
+        // cross-tool state. See agentPool.js for the schema contract.
+        agentToolConfig: (agent && agent.toolConfig) ? agent.toolConfig : {},
         agentPool: this.agentPool,
         contextManager: this.contextManager,
         aiService: this.aiService,

package/src/interfaces/__tests__/galleryRoutes.test.js

@@ -0,0 +1,311 @@
+/**
+ * Tests for GET /api/images (list) and DELETE /api/images (delete).
+ * Mirrors the imageServing.test.js mini-app pattern — we mount only the
+ * routes under test to avoid booting the whole webServer + orchestrator.
+ *
+ * Covers:
+ *  - list returns empty when no agents / no images
+ *  - list enumerates image files from each agent's `images/` folder
+ *  - list dedupes overlapping workingDir/projectDir
+ *  - list filters by agentId query
+ *  - list sorts newest-first
+ *  - delete rejects path traversal + bad extensions
+ *  - delete removes the file and returns success
+ *  - delete returns 404 when the file is already gone
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from '@jest/globals';
+import express from 'express';
+import path from 'path';
+import fs from 'fs/promises';
+import os from 'os';
+import request from 'supertest';
+
+const HTTP_STATUS = {
+  OK: 200,
+  BAD_REQUEST: 400,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  SERVICE_UNAVAILABLE: 503,
+  INTERNAL_SERVER_ERROR: 500,
+};
+
+function buildApp({ sessions, orchestrator, logger }) {
+  const app = express();
+  app.use(express.json());
+
+  // ── GET /api/images ─────────────────────────────────────────────
+  app.get('/api/images', async (req, res) => {
+    try {
+      if (!orchestrator?.agentPool) {
+        return res.json({ success: true, images: [] });
+      }
+      const requestedAgentId = req.query.agentId || null;
+      const agents = await orchestrator.agentPool.getAllAgents();
+      const results = [];
+      const seen = new Set();
+      const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+
+      for (const agent of (agents instanceof Map ? Array.from(agents.values()) : agents)) {
+        if (requestedAgentId && agent.id !== requestedAgentId) continue;
+        const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+        if (!workDir) continue;
+        const imagesDir = path.join(workDir, 'images');
+        let entries;
+        try { entries = await fs.readdir(imagesDir); } catch { continue; }
+        for (const name of entries) {
+          const ext = path.extname(name).toLowerCase();
+          if (!IMAGE_EXTS.has(ext)) continue;
+          const abs = path.join(imagesDir, name);
+          if (seen.has(abs)) continue;
+          seen.add(abs);
+          let stat;
+          try { stat = await fs.stat(abs); } catch { continue; }
+          if (!stat.isFile()) continue;
+          const anySession = Array.from(sessions.values())[0];
+          const sessionId = agent.sessionId || anySession?.sessionId || 'web-session';
+          results.push({
+            filename: name,
+            agentId: agent.id,
+            agentName: agent.name,
+            projectDir: workDir,
+            mtime: stat.mtime.toISOString(),
+            size: stat.size,
+            url: `/api/images/${encodeURIComponent(sessionId)}/${encodeURIComponent(name)}`,
+          });
+        }
+      }
+      results.sort((a, b) => b.mtime.localeCompare(a.mtime));
+      res.json({ success: true, images: results });
+    } catch (error) {
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  // ── DELETE /api/images ──────────────────────────────────────────
+  app.delete('/api/images', async (req, res) => {
+    try {
+      const { agentId, filename } = req.query;
+      if (!agentId || !filename) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'agentId and filename are required' });
+      }
+      const normalized = path.basename(filename);
+      if (normalized !== filename || filename.includes('..')) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+      }
+      const ext = path.extname(normalized).toLowerCase();
+      if (!['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(ext)) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported file extension for gallery delete' });
+      }
+      if (!orchestrator?.agentPool) {
+        return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({ success: false, error: 'Agent pool not available' });
+      }
+      const agent = await orchestrator.agentPool.getAgent(agentId);
+      if (!agent) {
+        return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Agent not found' });
+      }
+      const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+      if (!workDir) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Agent has no working directory' });
+      }
+      const target = path.join(workDir, 'images', normalized);
+      await fs.unlink(target);
+      res.json({ success: true });
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Image not found' });
+      }
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  return app;
+}
+
+// ── Fixtures ───────────────────────────────────────────────────────
+let tmpDir;
+let agentADir;
+let agentBDir;
+
+beforeAll(async () => {
+  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gallery-tests-'));
+  agentADir = path.join(tmpDir, 'agentA');
+  agentBDir = path.join(tmpDir, 'agentB');
+  await fs.mkdir(path.join(agentADir, 'images'), { recursive: true });
+  await fs.mkdir(path.join(agentBDir, 'images'), { recursive: true });
+});
+
+afterAll(async () => {
+  await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+});
+
+function makeAgents() {
+  const agentA = {
+    id: 'agentA', name: 'Alice', sessionId: 'sessA',
+    directoryAccess: { workingDirectory: agentADir },
+  };
+  const agentB = {
+    id: 'agentB', name: 'Bob', sessionId: 'sessB',
+    projectDir: agentBDir, // uses projectDir fallback
+  };
+  const byId = new Map([[agentA.id, agentA], [agentB.id, agentB]]);
+  return {
+    agentA, agentB,
+    orchestrator: {
+      agentPool: {
+        getAllAgents: async () => byId,
+        getAgent: async (id) => byId.get(id) || null,
+      },
+    },
+  };
+}
+
+function makeSessions() {
+  return new Map([['sessA', { sessionId: 'sessA', projectDir: agentADir }]]);
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+describe('GET /api/images', () => {
+  beforeEach(async () => {
+    // Clean + reset fixtures
+    const aDir = path.join(agentADir, 'images');
+    const bDir = path.join(agentBDir, 'images');
+    for (const d of [aDir, bDir]) {
+      const files = await fs.readdir(d).catch(() => []);
+      await Promise.all(files.map(f => fs.unlink(path.join(d, f))));
+    }
+  });
+
+  it('returns empty list when agentPool has no agents', async () => {
+    const app = buildApp({
+      sessions: new Map(),
+      orchestrator: { agentPool: { getAllAgents: async () => [], getAgent: async () => null } },
+      logger: console,
+    });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ success: true, images: [] });
+  });
+
+  it('returns empty list when agentPool is not wired', async () => {
+    const app = buildApp({ sessions: new Map(), orchestrator: {}, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    expect(res.body.images).toEqual([]);
+  });
+
+  it('enumerates images from each agent', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'a1.png'), 'a1');
+    await fs.writeFile(path.join(agentBDir, 'images', 'b1.jpg'), 'b1');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    const names = res.body.images.map(i => i.filename).sort();
+    expect(names).toEqual(['a1.png', 'b1.jpg']);
+  });
+
+  it('ignores non-image files in the images/ folder', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'ok.png'), 'ok');
+    await fs.writeFile(path.join(agentADir, 'images', 'readme.md'), '# hi');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images.map(i => i.filename)).toEqual(['ok.png']);
+  });
+
+  it('filters by agentId query', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'a.png'), 'a');
+    await fs.writeFile(path.join(agentBDir, 'images', 'b.png'), 'b');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images?agentId=agentB');
+    expect(res.body.images).toHaveLength(1);
+    expect(res.body.images[0].filename).toBe('b.png');
+  });
+
+  it('returns url pointing to /api/images/:sessionId/:filename', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'u.png'), 'u');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images[0].url).toBe('/api/images/sessA/u.png');
+  });
+
+  it('sorts newest-first by mtime', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'old.png'), 'x');
+    // Delay then write newer so mtime is distinguishable.
+    await new Promise(r => setTimeout(r, 15));
+    await fs.writeFile(path.join(agentADir, 'images', 'new.png'), 'x');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images.map(i => i.filename)).toEqual(['new.png', 'old.png']);
+  });
+});
+
+describe('DELETE /api/images', () => {
+  beforeEach(async () => {
+    // Reset state for each test
+    const aDir = path.join(agentADir, 'images');
+    const files = await fs.readdir(aDir).catch(() => []);
+    await Promise.all(files.map(f => fs.unlink(path.join(aDir, f))));
+  });
+
+  it('rejects missing params', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/required/);
+  });
+
+  it('rejects path traversal in filename', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=..%2Fetc%2Fpasswd');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/Invalid filename/);
+  });
+
+  it('rejects non-image extension', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=secret.txt');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/Unsupported file extension/);
+  });
+
+  it('returns 404 when agent is unknown', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=nobody&filename=x.png');
+    expect(res.status).toBe(404);
+  });
+
+  it('returns 404 when the file does not exist', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=missing.png');
+    expect(res.status).toBe(404);
+  });
+
+  it('deletes an existing image', async () => {
+    const target = path.join(agentADir, 'images', 'gone.png');
+    await fs.writeFile(target, 'data');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=gone.png');
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    // File is actually gone
+    await expect(fs.access(target)).rejects.toBeTruthy();
+  });
+
+  it('returns 503 when agentPool is not wired', async () => {
+    const app = buildApp({ sessions: new Map(), orchestrator: {}, logger: console });
+    const res = await request(app).delete('/api/images?agentId=x&filename=y.png');
+    expect(res.status).toBe(503);
+  });
+});

package/src/interfaces/webServer.js

@@ -185,7 +185,30 @@ const SCHEDULER_VIEWER_HTML = `<!doctype html>
     if (!e || !e.count) return '<span class="muted">—</span>';
     const elapsedMs = Date.now() - new Date(e.firstAt).getTime();
     const cls = e.count >= 5 ? 'bad' : e.count >= 3 ? 'warn' : 'neutral';
-    return '<span class="chip ' + cls + '" title="first at ' + esc(new Date(e.firstAt).toISOString()) + '">' + e.count + 'x / ' + fmtMs(elapsedMs) + '</span>';
+    const samples = Array.isArray(e.samples) ? e.samples : [];
+    const lastSample = samples[samples.length - 1];
+    // Chip shows count/elapsed; subline shows the best-guess root-cause hint
+    // from the last sample; hover the subline for a per-sample breakdown
+    // (finish_reason, has tool calls, has reasoning, model).
+    const chip = '<span class="chip ' + cls + '" title="first at ' + esc(new Date(e.firstAt).toISOString()) + '">' + e.count + 'x / ' + fmtMs(elapsedMs) + '</span>';
+    if (!lastSample) return chip;
+    // NB: the newline in .join below is double-escaped on purpose. This
+    // whole block is inside a JS template literal (SCHEDULER_VIEWER_HTML),
+    // so a single-escaped newline sequence would be processed at server
+    // load time, yielding a literal newline inside a single-quoted string
+    // in the served JS — which the browser rejects. Same trick in
+    // fmtModeCell below.
+    const sampleDetail = samples.map(s =>
+      s.at + ': content=' + s.contentType + '(' + s.contentLength + ') ' +
+      'tools=' + (s.hasToolCalls ? s.toolCallCount : 0) + ' ' +
+      'reasoning=' + (s.hasReasoning ? 'yes' : 'no') + ' ' +
+      'finish=' + (s.finishReason || '—') + ' ' +
+      'model=' + (s.model || '—')
+    ).join('\\n');
+    return chip +
+      '<div class="tasks-line" title="' + esc(sampleDetail) + '">' +
+        esc(lastSample.hint || '(empty response — cause unknown)') +
+      '</div>';
   }
 
   function chipDelay(a) {
@@ -196,6 +219,33 @@ const SCHEDULER_VIEWER_HTML = `<!doctype html>
     return '<span class="chip warn" title="' + esc(a.delayEndTime) + '">' + fmtMs(ms) + '</span>';
   }
 
+  // "Mode" cell: current mode + a subline showing the last CHAT↔AGENT flip
+  // with a human-readable reason (sourced from scheduler's _modeTransitionHistory).
+  // Hover the subline to see the full history of recent transitions.
+  function fmtModeCell(a) {
+    const current = esc(a.mode || '');
+    const history = Array.isArray(a.modeTransitions) ? a.modeTransitions : [];
+    if (history.length === 0) return current;
+    const last = history[history.length - 1];
+    const age = Date.now() - new Date(last.at).getTime();
+    // Build a title tooltip with the last ~5 transitions as a plain-text list.
+    // See note above (chipEmpty): double-escape in the .join is intentional
+    // — the outer template literal would otherwise process a single-escape
+    // newline into a real newline at load time.
+    const historyTip = history.slice(-5).reverse().map(t => {
+      const ageT = Date.now() - new Date(t.at).getTime();
+      return fmtMs(ageT) + ' ago: ' + t.from + ' → ' + t.to + ' — ' + t.humanReason;
+    }).join('\\n');
+    const direction = last.from + ' → ' + last.to;
+    return current +
+      '<div class="tasks-line" title="' + esc(historyTip) + '">' +
+        '<span class="muted">' + esc(direction) + ' · ' + fmtMs(age) + ' ago</span>' +
+      '</div>' +
+      '<div class="tasks-line" title="' + esc(last.humanReason) + '">' +
+        esc(last.humanReason) +
+      '</div>';
+  }
+
   function rowClass(a) {
     if (a.lockHeld && (a.lockHeldMs ?? 0) > 60000) return 'row-wedged';
     const aiMs = a.activeAIRequest?.durationMs ?? 0;
@@ -219,7 +269,7 @@ const SCHEDULER_VIEWER_HTML = `<!doctype html>
       const t = a.tasks || {};
       return '<tr class="' + rowClass(a) + '">' +
         '<td title="' + esc(a.id) + '">' + esc(a.name || a.id) + '</td>' +
-        '<td>' + esc(a.mode || '') + '</td>' +
+        '<td>' + fmtModeCell(a) + '</td>' +
         '<td>' + esc(a.status || '') + '</td>' +
         '<td>' + chipActive(a) + '</td>' +
         '<td class="reason" title="' + esc(a.activity?.details || '') + '">' + esc(a.activity?.reason || '') + '</td>' +
@@ -2653,6 +2703,137 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
+    // Gallery: list generated images across all agent working directories.
+    // Scans each agent's `{workingDirectory}/images/` folder for image files
+    // (the convention set by imageTool.js which always saves under `images/`).
+    // Returns { images: [{ filename, agentId, agentName, projectDir, mtime,
+    // size, url }] } sorted newest-first. Deliberately light on metadata —
+    // prompts/model info aren't persisted as sidecar data today; that would
+    // be a separate feature requiring imageTool to write a .json next to each
+    // output. For now the filename carries the timestamp.
+    this.app.get('/api/images', async (req, res) => {
+      try {
+        if (!this.orchestrator?.agentPool) {
+          return res.json({ success: true, images: [] });
+        }
+        const requestedAgentId = req.query.agentId || null;
+        const agents = await this.orchestrator.agentPool.getAllAgents();
+        const results = [];
+        const seen = new Set(); // dedupe by absolute path
+        const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+
+        for (const agent of (agents instanceof Map ? Array.from(agents.values()) : agents)) {
+          if (requestedAgentId && agent.id !== requestedAgentId) continue;
+          const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+          if (!workDir) continue;
+          const imagesDir = path.join(workDir, 'images');
+          let entries;
+          try {
+            entries = await fs.readdir(imagesDir);
+          } catch {
+            continue; // no images/ dir
+          }
+          for (const name of entries) {
+            const ext = path.extname(name).toLowerCase();
+            if (!IMAGE_EXTS.has(ext)) continue;
+            const abs = path.join(imagesDir, name);
+            if (seen.has(abs)) continue;
+            seen.add(abs);
+            let stat;
+            try { stat = await fs.stat(abs); } catch { continue; }
+            if (!stat.isFile()) continue;
+            // Pick a session id for the URL builder — prefer the agent's
+            // current session, otherwise any active session.
+            const anySession = Array.from(this.sessions.values())[0];
+            const sessionId = agent.sessionId || anySession?.sessionId || 'web-session';
+            results.push({
+              filename: name,
+              agentId: agent.id,
+              agentName: agent.name,
+              projectDir: workDir,
+              mtime: stat.mtime.toISOString(),
+              size: stat.size,
+              url: `/api/images/${encodeURIComponent(sessionId)}/${encodeURIComponent(name)}`,
+            });
+          }
+        }
+        results.sort((a, b) => b.mtime.localeCompare(a.mtime));
+        res.json({ success: true, images: results });
+      } catch (error) {
+        this.logger.error('Gallery list failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
+          success: false,
+          error: error.message,
+        });
+      }
+    });
+
+    // Delete a generated image. Identified by (agentId, filename) — we look
+    // up the agent's working directory and unlink the file there. Refuses
+    // path-traversal attempts and only deletes files matching an image
+    // extension from an `images/` folder we expect.
+    this.app.delete('/api/images', async (req, res) => {
+      try {
+        const { agentId, filename } = req.query;
+        if (!agentId || !filename) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({
+            success: false,
+            error: 'agentId and filename are required',
+          });
+        }
+        const normalized = path.basename(filename);
+        if (normalized !== filename || filename.includes('..')) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({
+            success: false,
+            error: 'Invalid filename',
+          });
+        }
+        const ext = path.extname(normalized).toLowerCase();
+        if (!['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(ext)) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({
+            success: false,
+            error: 'Unsupported file extension for gallery delete',
+          });
+        }
+        if (!this.orchestrator?.agentPool) {
+          return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({
+            success: false,
+            error: 'Agent pool not available',
+          });
+        }
+        const agent = await this.orchestrator.agentPool.getAgent(agentId);
+        if (!agent) {
+          return res.status(HTTP_STATUS.NOT_FOUND).json({
+            success: false,
+            error: 'Agent not found',
+          });
+        }
+        const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+        if (!workDir) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({
+            success: false,
+            error: 'Agent has no working directory',
+          });
+        }
+        const target = path.join(workDir, 'images', normalized);
+        await fs.unlink(target);
+        this.logger.info('Gallery image deleted', { agentId, filename: normalized });
+        res.json({ success: true });
+      } catch (error) {
+        if (error.code === 'ENOENT') {
+          return res.status(HTTP_STATUS.NOT_FOUND).json({
+            success: false,
+            error: 'Image not found',
+          });
+        }
+        this.logger.error('Gallery delete failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
+          success: false,
+          error: error.message,
+        });
+      }
+    });
+
     // Video serving endpoint for generated videos
     this.app.get('/api/videos/:sessionId/:filename', async (req, res) => {
       try {

package/src/services/__tests__/agentActivityService.test.js

@@ -315,5 +315,88 @@ describe('agentActivityService', () => {
       expect(result.skip).toBe(false);
       expect(result.reason).toBeNull();
     });
+
+    // Belt-and-suspenders: inbound work always beats delay/pause. The
+    // primary fix lives in agentPool._wakeAgentForMessage — this is the
+    // second line of defence against any path that bypasses it.
+    test('delayed agent with queued user message does NOT skip', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [{ content: 'hi' }], interAgentMessages: [], toolResults: [] },
+      });
+      expect(shouldSkipIteration(agent).skip).toBe(false);
+    });
+
+    test('delayed agent with queued inter-agent message does NOT skip', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [], interAgentMessages: [{ content: 'ping' }], toolResults: [] },
+      });
+      expect(shouldSkipIteration(agent).skip).toBe(false);
+    });
+
+    test('delayed agent with queued tool result does NOT skip', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [], interAgentMessages: [], toolResults: [{ toolId: 'x', status: 'completed' }] },
+      });
+      expect(shouldSkipIteration(agent).skip).toBe(false);
+    });
+
+    test('paused-until agent with queued message does NOT skip', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        pausedUntil: future,
+        messageQueues: { userMessages: [{ content: 'hi' }], interAgentMessages: [], toolResults: [] },
+      });
+      expect(shouldSkipIteration(agent).skip).toBe(false);
+    });
+  });
+
+  describe('shouldAgentBeActive — inbound work overrides delay/pause', () => {
+    test('delayed agent with user message → active', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [{ content: 'hi' }], interAgentMessages: [], toolResults: [] },
+        taskList: { tasks: [{ status: 'pending' }] },
+      });
+      expect(shouldAgentBeActive(agent).active).toBe(true);
+    });
+
+    test('delayed agent with inter-agent message → active', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [], interAgentMessages: [{ content: 'ping' }], toolResults: [] },
+        taskList: { tasks: [{ status: 'pending' }] },
+      });
+      expect(shouldAgentBeActive(agent).active).toBe(true);
+    });
+
+    test('pausedUntil agent (status=active) with queued work → active', () => {
+      // Unusual but defensive: status still ACTIVE but pausedUntil set
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        pausedUntil: future,
+        messageQueues: { userMessages: [], interAgentMessages: [{ content: 'ping' }], toolResults: [] },
+        taskList: { tasks: [{ status: 'pending' }] },
+      });
+      expect(shouldAgentBeActive(agent).active).toBe(true);
+    });
+
+    test('delayed agent WITHOUT queued work → still inactive (delay honoured)', () => {
+      const future = new Date(Date.now() + 60_000).toISOString();
+      const agent = makeAgent({
+        delayEndTime: future,
+        messageQueues: { userMessages: [], interAgentMessages: [], toolResults: [] },
+      });
+      const r = shouldAgentBeActive(agent);
+      expect(r.active).toBe(false);
+      expect(r.reason).toBe('agent-delayed');
+    });
   });
 });