onbuzz 4.1.0 → 4.2.0

package/src/core/agentPool.js

@@ -161,6 +161,16 @@ class AgentPool {
       status: AGENT_STATUS.ACTIVE,
       capabilities: config.capabilities || [],
       directoryAccess: directoryAccess, // Directory access configuration
+      // Per-tool configuration — keyed by tool id (e.g., 'terminal',
+      // 'filesystem'). When a tool is instantiated for this agent, the
+      // object under toolConfig[toolId] is merged into the tool's
+      // constructor config. Previously tools were constructed from global
+      // defaults only, so there was no way to set per-agent knobs like
+      // terminal allowed-commands, filesystem size limits, web stealth
+      // level, etc. See ToolManager integration in step 2.
+      toolConfig: (config.toolConfig && typeof config.toolConfig === 'object' && !Array.isArray(config.toolConfig))
+        ? { ...config.toolConfig }
+        : {},
       conversations: {
         full: {
           messages: [],
@@ -304,6 +314,24 @@ class AgentPool {
       });
     }
 
+    // Validate per-tool config if being updated. Must be a plain object
+    // keyed by tool id; each value is an object of config overrides that
+    // will be merged into the tool's constructor config at instantiation.
+    // We don't validate individual tool schemas here — that happens at
+    // tool construction time where the tool knows its own shape.
+    if (updates.toolConfig !== undefined) {
+      if (updates.toolConfig === null
+          || typeof updates.toolConfig !== 'object'
+          || Array.isArray(updates.toolConfig)) {
+        throw new Error('Invalid toolConfig: must be a plain object keyed by tool id');
+      }
+      for (const [toolId, cfg] of Object.entries(updates.toolConfig)) {
+        if (cfg !== null && (typeof cfg !== 'object' || Array.isArray(cfg))) {
+          throw new Error(`Invalid toolConfig.${toolId}: must be an object or null`);
+        }
+      }
+    }
+
     // If originalSystemPrompt is being updated (user edited the raw prompt), store it
     // and use it as the base for enhancement. Otherwise use the existing originalSystemPrompt.
     if (updates.originalSystemPrompt !== undefined) {
@@ -592,6 +620,7 @@ class AgentPool {
       platformProvided: agent.platformProvided,
       capabilities: agent.capabilities,
       directoryAccess: agent.directoryAccess,
+      toolConfig: agent.toolConfig || {},
       lastActivity: agent.lastActivity,
       isPaused: this._isAgentPaused(agent),
       pausedUntil: agent.pausedUntil,
@@ -1297,6 +1326,69 @@ class AgentPool {
   // Now using the new messageQueues system with AgentScheduler
   // Inter-agent messages are queued via addInterAgentMessage() method
 
+  /**
+   * Wake an agent out of any paused/delayed state because a message has
+   * arrived for it. Shared by addUserMessage / addInterAgentMessage /
+   * addToolResult — every inbound path MUST route through this to avoid
+   * the "silent queue into a delayed agent" bug where the recipient never
+   * wakes up and the message sits until the scheduler back-off naturally
+   * expires.
+   *
+   * Rationale: delays/pauses are "leave this agent alone" signals set by
+   * the scheduler on error back-off or by the agentDelayTool for timed
+   * waits. Any caller going to the trouble of actually addressing the
+   * agent is an explicit "act now" signal that overrides the wait.
+   *
+   * @param {Object} agent - Agent object (already fetched)
+   * @param {string} reason - Source label for logs (e.g. 'user-message',
+   *   'inter-agent-message', 'tool-result')
+   * @returns {Promise<{wasPaused:boolean, hadDelay:boolean, hadPausedUntil:boolean}>}
+   * @private
+   */
+  async _wakeAgentForMessage(agent, reason) {
+    const info = { wasPaused: false, hadDelay: false, hadPausedUntil: false };
+    if (!agent) return info;
+
+    // Auto-resume explicitly paused agent.
+    if (agent.status === AGENT_STATUS.PAUSED) {
+      info.wasPaused = true;
+      this.logger.info(`Auto-resuming paused agent ${agent.id} due to ${reason}`);
+      await this.resumeAgent(agent.id);
+    }
+
+    // Clear scheduler-enforced delay (rate-limit back-off, api-key delay,
+    // builtin webTool delay, etc.). Only clear if actually in the future;
+    // stale past values don't matter but shouldn't trigger a broadcast.
+    if (agent.delayEndTime && new Date(agent.delayEndTime).getTime() > Date.now()) {
+      info.hadDelay = true;
+      agent.delayEndTime = null;
+      this.logger.info(`Cleared scheduler delay for agent ${agent.id} — ${reason} takes precedence`);
+    }
+
+    // Defensive: if pausedUntil is set but status isn't PAUSED (shouldn't
+    // happen but protects against state drift), clear it too.
+    if (agent.pausedUntil && new Date(agent.pausedUntil).getTime() > Date.now()) {
+      info.hadPausedUntil = true;
+      agent.pausedUntil = null;
+    }
+
+    return info;
+  }
+
+  /**
+   * Broadcast a delay-clear to the WS so the UI's delay chip disappears
+   * immediately instead of waiting for the next scheduler tick.
+   * @private
+   */
+  async _broadcastWake(agentId, reason) {
+    if (!this.scheduler?.broadcastAgentStateUpdate) return;
+    try {
+      await this.scheduler.broadcastAgentStateUpdate(agentId, reason);
+    } catch (err) {
+      this.logger.warn(`Failed to broadcast wake for ${agentId}: ${err.message}`);
+    }
+  }
+
   /**
    * Add message to agent's user message queue
    * @param {string} agentId - Agent ID
@@ -1309,25 +1401,10 @@ class AgentPool {
       throw new Error(`Agent not found: ${agentId}`);
     }
 
-    // Auto-resume paused agent when user sends a message
-    if (agent.status === AGENT_STATUS.PAUSED) {
-      this.logger.info(`Auto-resuming paused agent ${agentId} due to user message`);
-      await this.resumeAgent(agentId);
-    }
-
-    // Clear any scheduler-enforced delay when the user explicitly addresses
-    // the agent. Delays are set by the scheduler as a back-off for
-    // rate-limit / network / api-key / builtin-tool-delay situations and
-    // only make sense while the agent is left alone — a new user message is
-    // an explicit signal to act NOW, and waiting out the remaining delay
-    // would feel unresponsive. We clear the field and let the scheduler
-    // pick the agent up on its next tick. Broadcast the state update so
-    // the UI's delay chip disappears immediately.
-    const hadDelay = !!(agent.delayEndTime && new Date(agent.delayEndTime).getTime() > Date.now());
-    if (hadDelay) {
-      agent.delayEndTime = null;
-      this.logger.info(`Cleared scheduler delay for agent ${agentId} — user message takes precedence`);
-    }
+    // Any inbound message — user, inter-agent, or tool-result — takes
+    // precedence over scheduler back-off and manual pauses. See
+    // _wakeAgentForMessage for the rationale.
+    const wakeInfo = await this._wakeAgentForMessage(agent, 'user-message');
 
     const queuedMessage = {
       ...message,
@@ -1348,12 +1425,8 @@ class AgentPool {
 
     // If we cleared a delay, surface it on the WS so the delay chip in the
     // chat header disappears without waiting for the next scheduler cycle.
-    if (hadDelay && this.scheduler?.broadcastAgentStateUpdate) {
-      try {
-        await this.scheduler.broadcastAgentStateUpdate(agentId, 'user-message-clears-delay');
-      } catch (err) {
-        this.logger.warn(`Failed to broadcast delay-clear for ${agentId}: ${err.message}`);
-      }
+    if (wakeInfo.hadDelay) {
+      await this._broadcastWake(agentId, 'user-message-clears-delay');
     }
 
     this.logger.info(`User message queued for agent: ${agentId}`, {
@@ -1374,6 +1447,11 @@ class AgentPool {
       throw new Error(`Agent not found: ${agentId}`);
     }
 
+    // An inter-agent ping from another agent is an explicit "act now"
+    // signal and must override any scheduler back-off or manual pause
+    // on the recipient. See _wakeAgentForMessage.
+    const wakeInfo = await this._wakeAgentForMessage(agent, 'inter-agent-message');
+
     const queuedMessage = {
       ...message,
       id: message.id || message.messageId || `inter-agent-msg-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
@@ -1400,6 +1478,10 @@ class AgentPool {
       });
     }
 
+    if (wakeInfo.hadDelay) {
+      await this._broadcastWake(agentId, 'inter-agent-message-clears-delay');
+    }
+
     this.logger.info(`Inter-agent message queued for agent: ${agentId}`, {
       messageId: queuedMessage.id,
       sender: message.sender || message.senderName,
@@ -1420,6 +1502,13 @@ class AgentPool {
       throw new Error(`Agent not found: ${agentId}`);
     }
 
+    // Tool results are "external async work finished — continue."
+    // If the agent is delayed or paused when a result arrives (e.g. a
+    // long image/video render completes while an unrelated rate-limit
+    // back-off is still in effect) we wake it so the result can be
+    // consumed immediately instead of sitting until the back-off expires.
+    const wakeInfo = await this._wakeAgentForMessage(agent, 'tool-result');
+
     const queuedResult = {
       ...toolResult,
       id: toolResult.id || `tool-result-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`,
@@ -1430,6 +1519,10 @@ class AgentPool {
     agent.messageQueues.toolResults.push(queuedResult);
     await this.persistAgentState(agentId);
 
+    if (wakeInfo.hadDelay) {
+      await this._broadcastWake(agentId, 'tool-result-clears-delay');
+    }
+
     this.logger.debug(`Tool result queued for agent: ${agentId}`, {
       toolId: toolResult.toolId,
       status: toolResult.status,

package/src/core/agentScheduler.js

@@ -2185,8 +2185,11 @@ class AgentScheduler {
               this._broadcastFlowProgress(sessionId, agentId, flowProgress, true);
             }
 
-            // Broadcast stream completion
-            this._broadcastStreamEvent(sessionId, {
+            // Broadcast stream completion. Reasoning fields are included
+            // only when present so non-reasoning models' broadcasts stay
+            // minimal; the web-UI treats undefined/empty as "no thinking
+            // panel to render." See utilities/reasoningContext patterns.
+            const streamCompleteEvent = {
               type: 'stream_complete',
               agentId,
               messageId: streamMessageId,
@@ -2200,7 +2203,14 @@ class AgentScheduler {
                 flowRunId: flowContext.flowRunId,
                 flowNodeId: flowContext.flowNodeId
               })
-            });
+            };
+            if (typeof result.reasoning === 'string' && result.reasoning.length > 0) {
+              streamCompleteEvent.reasoning = result.reasoning;
+            }
+            if (Number.isFinite(result.reasoningTokens) && result.reasoningTokens > 0) {
+              streamCompleteEvent.reasoningTokens = result.reasoningTokens;
+            }
+            this._broadcastStreamEvent(sessionId, streamCompleteEvent);
           },
           onError: (error) => {
             // Check if this is a model-related error that should show suggestions
@@ -2864,7 +2874,15 @@ class AgentScheduler {
       });
     }
 
-    // Create response message
+    // Create response message. Reasoning fields are only attached when
+    // there's something to attach — avoids cluttering every assistant
+    // message with null fields for non-reasoning models.
+    //   - `reasoning`: chain-of-thought text, when the provider exposed it
+    //     (DeepSeek-R1, Kimi K2 thinking, xAI reasoning, Claude thinking).
+    //   - `reasoningTokens`: token count spent thinking, surfaced even
+    //     when the text is opaque (OpenAI o-series, gpt-5-reasoning).
+    // See src/services/aiService.js — `_extractReasoningTokens` + the
+    // streaming/non-streaming handlers for the capture contract.
     const responseMessage = {
       id: `ai-response-${Date.now()}`,
       agentId: agentId,
@@ -2877,6 +2895,12 @@ class AgentScheduler {
       // Mark if tools will be executed (UI can show loading indicator)
       pendingToolExecution: hasTools
     };
+    if (typeof aiResponse.reasoning === 'string' && aiResponse.reasoning.length > 0) {
+      responseMessage.reasoning = aiResponse.reasoning;
+    }
+    if (Number.isFinite(aiResponse.reasoningTokens) && aiResponse.reasoningTokens > 0) {
+      responseMessage.reasoningTokens = aiResponse.reasoningTokens;
+    }
 
     const appended = await this.addMessageToConversation(agentId, responseMessage, false);
 

package/src/core/messageProcessor.js

@@ -467,9 +467,22 @@ class MessageProcessor {
           // Pass truncation info to tool for partial execution handling.
           // Re-derive projectDir from directoryAccess in case a previous tool
           // (e.g. terminal change-directory) updated the working directory.
+          //
+          // toolConfig is this tool's slice of the agent's per-tool config
+          // (from agent.toolConfig[toolId]) — null when the agent didn't
+          // override anything for this tool, in which case the tool uses
+          // its global defaults. Tools that want to support per-agent
+          // config read `context.toolConfig` and merge it with their own
+          // defaults; tools that ignore it get the same behaviour as
+          // before.
+          const perToolConfig = (context.agentToolConfig && command.toolId)
+            ? context.agentToolConfig[command.toolId] || null
+            : null;
+
           const toolContext = {
             ...context,
             projectDir: context.directoryAccess?.workingDirectory || context.projectDir,
+            toolConfig: perToolConfig,
             wasRepaired: command.wasRepaired || false,
             wasTruncated: command.wasTruncated || false
           };
@@ -823,7 +836,7 @@ class MessageProcessor {
       
       // Get agent to include its directoryAccess configuration
       const agent = await this.agentPool.getAgent(agentId);
-      
+
       // Execute tools with agent context including sessionId and directoryAccess
       const toolContext = {
         ...context,
@@ -831,6 +844,11 @@ class MessageProcessor {
         sessionId: context.sessionId, // Ensure sessionId is explicitly available for tools
         directoryAccess: agent?.directoryAccess, // Include agent's directory access configuration
         projectDir: agent?.directoryAccess?.workingDirectory || agent?.projectDir || context.projectDir, // Extract project directory from directoryAccess
+        // Per-agent tool configuration — keyed by tool id. Tools can read
+        // their own slice via `context.toolConfig` (injected per-tool in
+        // executeTools below) or inspect the full map here if they need
+        // cross-tool state. See agentPool.js for the schema contract.
+        agentToolConfig: (agent && agent.toolConfig) ? agent.toolConfig : {},
         agentPool: this.agentPool,
         contextManager: this.contextManager,
         aiService: this.aiService,

package/src/interfaces/__tests__/galleryRoutes.test.js

@@ -0,0 +1,311 @@
+/**
+ * Tests for GET /api/images (list) and DELETE /api/images (delete).
+ * Mirrors the imageServing.test.js mini-app pattern — we mount only the
+ * routes under test to avoid booting the whole webServer + orchestrator.
+ *
+ * Covers:
+ *  - list returns empty when no agents / no images
+ *  - list enumerates image files from each agent's `images/` folder
+ *  - list dedupes overlapping workingDir/projectDir
+ *  - list filters by agentId query
+ *  - list sorts newest-first
+ *  - delete rejects path traversal + bad extensions
+ *  - delete removes the file and returns success
+ *  - delete returns 404 when the file is already gone
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from '@jest/globals';
+import express from 'express';
+import path from 'path';
+import fs from 'fs/promises';
+import os from 'os';
+import request from 'supertest';
+
+const HTTP_STATUS = {
+  OK: 200,
+  BAD_REQUEST: 400,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  SERVICE_UNAVAILABLE: 503,
+  INTERNAL_SERVER_ERROR: 500,
+};
+
+function buildApp({ sessions, orchestrator, logger }) {
+  const app = express();
+  app.use(express.json());
+
+  // ── GET /api/images ─────────────────────────────────────────────
+  app.get('/api/images', async (req, res) => {
+    try {
+      if (!orchestrator?.agentPool) {
+        return res.json({ success: true, images: [] });
+      }
+      const requestedAgentId = req.query.agentId || null;
+      const agents = await orchestrator.agentPool.getAllAgents();
+      const results = [];
+      const seen = new Set();
+      const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+
+      for (const agent of (agents instanceof Map ? Array.from(agents.values()) : agents)) {
+        if (requestedAgentId && agent.id !== requestedAgentId) continue;
+        const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+        if (!workDir) continue;
+        const imagesDir = path.join(workDir, 'images');
+        let entries;
+        try { entries = await fs.readdir(imagesDir); } catch { continue; }
+        for (const name of entries) {
+          const ext = path.extname(name).toLowerCase();
+          if (!IMAGE_EXTS.has(ext)) continue;
+          const abs = path.join(imagesDir, name);
+          if (seen.has(abs)) continue;
+          seen.add(abs);
+          let stat;
+          try { stat = await fs.stat(abs); } catch { continue; }
+          if (!stat.isFile()) continue;
+          const anySession = Array.from(sessions.values())[0];
+          const sessionId = agent.sessionId || anySession?.sessionId || 'web-session';
+          results.push({
+            filename: name,
+            agentId: agent.id,
+            agentName: agent.name,
+            projectDir: workDir,
+            mtime: stat.mtime.toISOString(),
+            size: stat.size,
+            url: `/api/images/${encodeURIComponent(sessionId)}/${encodeURIComponent(name)}`,
+          });
+        }
+      }
+      results.sort((a, b) => b.mtime.localeCompare(a.mtime));
+      res.json({ success: true, images: results });
+    } catch (error) {
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  // ── DELETE /api/images ──────────────────────────────────────────
+  app.delete('/api/images', async (req, res) => {
+    try {
+      const { agentId, filename } = req.query;
+      if (!agentId || !filename) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'agentId and filename are required' });
+      }
+      const normalized = path.basename(filename);
+      if (normalized !== filename || filename.includes('..')) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+      }
+      const ext = path.extname(normalized).toLowerCase();
+      if (!['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(ext)) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported file extension for gallery delete' });
+      }
+      if (!orchestrator?.agentPool) {
+        return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({ success: false, error: 'Agent pool not available' });
+      }
+      const agent = await orchestrator.agentPool.getAgent(agentId);
+      if (!agent) {
+        return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Agent not found' });
+      }
+      const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+      if (!workDir) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Agent has no working directory' });
+      }
+      const target = path.join(workDir, 'images', normalized);
+      await fs.unlink(target);
+      res.json({ success: true });
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Image not found' });
+      }
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  return app;
+}
+
+// ── Fixtures ───────────────────────────────────────────────────────
+let tmpDir;
+let agentADir;
+let agentBDir;
+
+beforeAll(async () => {
+  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'gallery-tests-'));
+  agentADir = path.join(tmpDir, 'agentA');
+  agentBDir = path.join(tmpDir, 'agentB');
+  await fs.mkdir(path.join(agentADir, 'images'), { recursive: true });
+  await fs.mkdir(path.join(agentBDir, 'images'), { recursive: true });
+});
+
+afterAll(async () => {
+  await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+});
+
+function makeAgents() {
+  const agentA = {
+    id: 'agentA', name: 'Alice', sessionId: 'sessA',
+    directoryAccess: { workingDirectory: agentADir },
+  };
+  const agentB = {
+    id: 'agentB', name: 'Bob', sessionId: 'sessB',
+    projectDir: agentBDir, // uses projectDir fallback
+  };
+  const byId = new Map([[agentA.id, agentA], [agentB.id, agentB]]);
+  return {
+    agentA, agentB,
+    orchestrator: {
+      agentPool: {
+        getAllAgents: async () => byId,
+        getAgent: async (id) => byId.get(id) || null,
+      },
+    },
+  };
+}
+
+function makeSessions() {
+  return new Map([['sessA', { sessionId: 'sessA', projectDir: agentADir }]]);
+}
+
+// ── Tests ──────────────────────────────────────────────────────────
+
+describe('GET /api/images', () => {
+  beforeEach(async () => {
+    // Clean + reset fixtures
+    const aDir = path.join(agentADir, 'images');
+    const bDir = path.join(agentBDir, 'images');
+    for (const d of [aDir, bDir]) {
+      const files = await fs.readdir(d).catch(() => []);
+      await Promise.all(files.map(f => fs.unlink(path.join(d, f))));
+    }
+  });
+
+  it('returns empty list when agentPool has no agents', async () => {
+    const app = buildApp({
+      sessions: new Map(),
+      orchestrator: { agentPool: { getAllAgents: async () => [], getAgent: async () => null } },
+      logger: console,
+    });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ success: true, images: [] });
+  });
+
+  it('returns empty list when agentPool is not wired', async () => {
+    const app = buildApp({ sessions: new Map(), orchestrator: {}, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    expect(res.body.images).toEqual([]);
+  });
+
+  it('enumerates images from each agent', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'a1.png'), 'a1');
+    await fs.writeFile(path.join(agentBDir, 'images', 'b1.jpg'), 'b1');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.status).toBe(200);
+    const names = res.body.images.map(i => i.filename).sort();
+    expect(names).toEqual(['a1.png', 'b1.jpg']);
+  });
+
+  it('ignores non-image files in the images/ folder', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'ok.png'), 'ok');
+    await fs.writeFile(path.join(agentADir, 'images', 'readme.md'), '# hi');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images.map(i => i.filename)).toEqual(['ok.png']);
+  });
+
+  it('filters by agentId query', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'a.png'), 'a');
+    await fs.writeFile(path.join(agentBDir, 'images', 'b.png'), 'b');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images?agentId=agentB');
+    expect(res.body.images).toHaveLength(1);
+    expect(res.body.images[0].filename).toBe('b.png');
+  });
+
+  it('returns url pointing to /api/images/:sessionId/:filename', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'u.png'), 'u');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images[0].url).toBe('/api/images/sessA/u.png');
+  });
+
+  it('sorts newest-first by mtime', async () => {
+    await fs.writeFile(path.join(agentADir, 'images', 'old.png'), 'x');
+    // Delay then write newer so mtime is distinguishable.
+    await new Promise(r => setTimeout(r, 15));
+    await fs.writeFile(path.join(agentADir, 'images', 'new.png'), 'x');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).get('/api/images');
+    expect(res.body.images.map(i => i.filename)).toEqual(['new.png', 'old.png']);
+  });
+});
+
+describe('DELETE /api/images', () => {
+  beforeEach(async () => {
+    // Reset state for each test
+    const aDir = path.join(agentADir, 'images');
+    const files = await fs.readdir(aDir).catch(() => []);
+    await Promise.all(files.map(f => fs.unlink(path.join(aDir, f))));
+  });
+
+  it('rejects missing params', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/required/);
+  });
+
+  it('rejects path traversal in filename', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=..%2Fetc%2Fpasswd');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/Invalid filename/);
+  });
+
+  it('rejects non-image extension', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=secret.txt');
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/Unsupported file extension/);
+  });
+
+  it('returns 404 when agent is unknown', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=nobody&filename=x.png');
+    expect(res.status).toBe(404);
+  });
+
+  it('returns 404 when the file does not exist', async () => {
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=missing.png');
+    expect(res.status).toBe(404);
+  });
+
+  it('deletes an existing image', async () => {
+    const target = path.join(agentADir, 'images', 'gone.png');
+    await fs.writeFile(target, 'data');
+    const { orchestrator } = makeAgents();
+    const app = buildApp({ sessions: makeSessions(), orchestrator, logger: console });
+    const res = await request(app).delete('/api/images?agentId=agentA&filename=gone.png');
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+    // File is actually gone
+    await expect(fs.access(target)).rejects.toBeTruthy();
+  });
+
+  it('returns 503 when agentPool is not wired', async () => {
+    const app = buildApp({ sessions: new Map(), orchestrator: {}, logger: console });
+    const res = await request(app).delete('/api/images?agentId=x&filename=y.png');
+    expect(res.status).toBe(503);
+  });
+});