onbuzz 4.4.0 → 4.6.0

package/src/tools/__tests__/platformControlAgentTeamPermissions.test.js

@@ -0,0 +1,253 @@
+/**
+ * Permission tests for the AGENTS and TEAMS slices of platformcontrol.
+ * Covers:
+ *   - getAgentAccessLevel / getMaxAgentsCreated / getTeamScope
+ *   - checkAgentMutationAccess (every level × every hard rule)
+ *   - filterMutableAgents
+ *   - clampToolConfigForChild — privilege escalation prevention
+ *   - checkTeamAccess + filterAccessibleTeams
+ */
+import { describe, test, expect } from '@jest/globals';
+import {
+  AGENT_ACCESS_LEVELS,
+  getAgentAccessLevel,
+  getMaxAgentsCreated,
+  checkAgentMutationAccess,
+  filterMutableAgents,
+  clampToolConfigForChild,
+  getTeamScope,
+  isTeamAccessDisabled,
+  checkTeamAccess,
+  filterAccessibleTeams,
+} from '../platformControl/permissions.js';
+
+const { DISABLED, SELF_CREATED, ALL } = AGENT_ACCESS_LEVELS;
+
+describe('getAgentAccessLevel', () => {
+  test('default + unknown values → "disabled"', () => {
+    expect(getAgentAccessLevel(undefined)).toBe('disabled');
+    expect(getAgentAccessLevel({})).toBe('disabled');
+    expect(getAgentAccessLevel({ agents: 'gibberish' })).toBe('disabled');
+  });
+  test('valid values pass through', () => {
+    expect(getAgentAccessLevel({ agents: 'self-created' })).toBe('self-created');
+    expect(getAgentAccessLevel({ agents: 'all' })).toBe('all');
+  });
+});
+
+describe('getMaxAgentsCreated', () => {
+  test('null/undefined/missing → null (unlimited)', () => {
+    expect(getMaxAgentsCreated(undefined)).toBe(null);
+    expect(getMaxAgentsCreated({})).toBe(null);
+    expect(getMaxAgentsCreated({ maxAgentsCreated: null })).toBe(null);
+  });
+  test('positive integer passes through', () => {
+    expect(getMaxAgentsCreated({ maxAgentsCreated: 5 })).toBe(5);
+    expect(getMaxAgentsCreated({ maxAgentsCreated: 0 })).toBe(0);   // hard zero is allowed
+  });
+  test('garbage / negative / Infinity → null (treated as unlimited; UI should validate)', () => {
+    expect(getMaxAgentsCreated({ maxAgentsCreated: -1 })).toBe(null);
+    expect(getMaxAgentsCreated({ maxAgentsCreated: Infinity })).toBe(null);
+    expect(getMaxAgentsCreated({ maxAgentsCreated: 'lots' })).toBe(null);
+  });
+  test('floors fractional', () => {
+    expect(getMaxAgentsCreated({ maxAgentsCreated: 3.7 })).toBe(3);
+  });
+});
+
+describe('checkAgentMutationAccess', () => {
+  const target = (over) => ({ id: 't', createdBy: null, ...over });
+
+  test('disabled → never', () => {
+    const r = checkAgentMutationAccess(DISABLED, 'caller', target());
+    expect(r.allow).toBe(false);
+  });
+
+  test('hard rule: self → denied at every level', () => {
+    for (const level of [SELF_CREATED, ALL]) {
+      const r = checkAgentMutationAccess(level, 'caller', target({ id: 'caller' }));
+      expect(r.allow).toBe(false);
+      expect(r.reason).toMatch(/itself/);
+    }
+  });
+
+  test('hard rule: ancestor → denied at every level (when isProtectedFromCaller says so)', () => {
+    const isProtectedFromCaller = (callerId, targetId) =>
+      callerId === 'child' && targetId === 'parent';
+    const r = checkAgentMutationAccess(
+      ALL, 'child', target({ id: 'parent' }),
+      { isProtectedFromCaller }
+    );
+    expect(r.allow).toBe(false);
+    expect(r.reason).toMatch(/descendants/);
+  });
+
+  test('self-created mode: passes only when target.createdBy === caller', () => {
+    expect(
+      checkAgentMutationAccess(SELF_CREATED, 'caller', target({ createdBy: 'caller' })).allow
+    ).toBe(true);
+    expect(
+      checkAgentMutationAccess(SELF_CREATED, 'caller', target({ createdBy: 'someone-else' })).allow
+    ).toBe(false);
+    expect(
+      checkAgentMutationAccess(SELF_CREATED, 'caller', target({ createdBy: null })).allow
+    ).toBe(false);     // unowned (UI-created) agents are unreachable in self-created mode
+  });
+
+  test('all mode: any non-self, non-ancestor target', () => {
+    expect(checkAgentMutationAccess(ALL, 'caller', target({ id: 'x' })).allow).toBe(true);
+    expect(checkAgentMutationAccess(ALL, 'caller', target({ id: 'y', createdBy: 'someone' })).allow).toBe(true);
+  });
+});
+
+describe('filterMutableAgents', () => {
+  test('keeps only agents the caller may mutate', () => {
+    const caller = 'me';
+    const agents = [
+      { id: 'me' },                                 // self → out (hard)
+      { id: 'ancestor' },                           // ancestor → out (hard, via isProtectedFromCaller)
+      { id: 'mine', createdBy: 'me' },              // self-created → in
+      { id: 'theirs', createdBy: 'someone-else' },  // someone else's → out at self-created
+    ];
+    const isProtectedFromCaller = (c, t) =>
+      c === caller && t === 'ancestor' || c === t;
+    const out = filterMutableAgents(SELF_CREATED, caller, agents, { isProtectedFromCaller });
+    expect(out.map(a => a.id)).toEqual(['mine']);
+  });
+});
+
+describe('clampToolConfigForChild — privilege escalation prevention', () => {
+  test('child cannot get a higher scheduledTasks level than caller', () => {
+    const caller = { scheduledTasks: 'own' };
+    const desired = { scheduledTasks: 'all' };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.scheduledTasks).toBe('own');
+    expect(clamps).toContainEqual(
+      expect.objectContaining({ key: 'scheduledTasks', requested: 'all', clampedTo: 'own' })
+    );
+  });
+
+  test('child cannot get a higher agents level than caller', () => {
+    const caller = { agents: 'self-created' };
+    const desired = { agents: 'all' };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.agents).toBe('self-created');
+    expect(clamps[0]).toMatchObject({ key: 'agents', clampedTo: 'self-created' });
+  });
+
+  test('child can request a LOWER level — no clamp', () => {
+    const caller = { scheduledTasks: 'all', agents: 'all' };
+    const desired = { scheduledTasks: 'own', agents: 'self-created' };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.scheduledTasks).toBe('own');
+    expect(config.agents).toBe('self-created');
+    expect(clamps).toEqual([]);
+  });
+
+  test('maxAgentsCreated: child unlimited blocked when caller has a quota', () => {
+    const caller = { maxAgentsCreated: 5 };
+    const desired = { maxAgentsCreated: null };           // unlimited
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.maxAgentsCreated).toBe(5);
+    expect(clamps[0]).toMatchObject({ key: 'maxAgentsCreated', clampedTo: 5 });
+  });
+
+  test('maxAgentsCreated: child quota over caller quota → clamped down', () => {
+    const caller = { maxAgentsCreated: 5 };
+    const desired = { maxAgentsCreated: 100 };
+    const { config } = clampToolConfigForChild(caller, desired);
+    expect(config.maxAgentsCreated).toBe(5);
+  });
+
+  test('maxAgentsCreated: caller unlimited → child can be anything', () => {
+    const caller = {};   // unlimited
+    const desired = { maxAgentsCreated: 1000 };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.maxAgentsCreated).toBe(1000);
+    expect(clamps).toEqual([]);
+  });
+
+  test('teams: child cannot have flags caller lacks', () => {
+    const caller  = { teams: { member: true, ownedByMe: false, all: false } };
+    const desired = { teams: { member: true, ownedByMe: true,  all: true } };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.teams).toEqual({ member: true, ownedByMe: false, all: false });
+    expect(clamps[0]).toMatchObject({ key: 'teams' });
+  });
+
+  test('fields not in desired are NOT added to the output (clamp only inspects what caller is setting)', () => {
+    // Caller can grant agents:'self-created' (caller is at 'all').
+    // Desired only mentions agents — scheduledTasks isn't in the picture.
+    // Output should mirror desired's keys exactly: no scheduledTasks added.
+    const caller = { scheduledTasks: 'own', agents: 'all' };
+    const desired = { agents: 'self-created' };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config).toEqual({ agents: 'self-created' });
+    expect(config.scheduledTasks).toBeUndefined();
+    expect(clamps).toEqual([]);
+  });
+
+  test('caller missing a key entirely → that key is treated as the floor (disabled)', () => {
+    // Caller has no `agents` key configured. Default = 'disabled'. So if
+    // the caller tries to grant any agents level, clamp lowers to disabled.
+    const caller = { scheduledTasks: 'own' };           // no agents key
+    const desired = { agents: 'self-created' };
+    const { config, clamps } = clampToolConfigForChild(caller, desired);
+    expect(config.agents).toBe('disabled');
+    expect(clamps[0]).toMatchObject({ key: 'agents', clampedTo: 'disabled' });
+  });
+});
+
+describe('Team scope (multi-select)', () => {
+  test('default scope = all-false', () => {
+    expect(getTeamScope(undefined)).toEqual({ member: false, ownedByMe: false, all: false });
+  });
+
+  test('isTeamAccessDisabled: empty scope → true', () => {
+    expect(isTeamAccessDisabled({ teams: { member: false, ownedByMe: false, all: false } })).toBe(true);
+    expect(isTeamAccessDisabled({})).toBe(true);
+  });
+  test('isTeamAccessDisabled: any flag set → false', () => {
+    expect(isTeamAccessDisabled({ teams: { member: true } })).toBe(false);
+  });
+
+  test('checkTeamAccess: "all" beats everything', () => {
+    const team = { id: 't', memberAgentIds: [], createdBy: 'someone' };
+    expect(checkTeamAccess({ all: true }, 'me', team).allow).toBe(true);
+  });
+  test('checkTeamAccess: member flag matches when caller is in members', () => {
+    const team = { id: 't', memberAgentIds: ['me', 'other'], createdBy: 'someone' };
+    expect(checkTeamAccess({ member: true }, 'me', team).allow).toBe(true);
+  });
+  test('checkTeamAccess: ownedByMe matches createdBy', () => {
+    const team = { id: 't', memberAgentIds: [], createdBy: 'me' };
+    expect(checkTeamAccess({ ownedByMe: true }, 'me', team).allow).toBe(true);
+  });
+  test('checkTeamAccess: no flag matches → denied', () => {
+    const team = { id: 't', memberAgentIds: [], createdBy: 'someone' };
+    const r = checkTeamAccess({ member: true, ownedByMe: true }, 'me', team);
+    expect(r.allow).toBe(false);
+  });
+
+  test('filterAccessibleTeams: empty scope → empty list', () => {
+    const teams = [{ id: 't', memberAgentIds: ['me'] }];
+    expect(filterAccessibleTeams({ all: false, member: false, ownedByMe: false }, 'me', teams)).toEqual([]);
+  });
+  test('filterAccessibleTeams: member-only keeps only teams with caller in members', () => {
+    const teams = [
+      { id: 'mine', memberAgentIds: ['me'], createdBy: 'someone' },
+      { id: 'theirs', memberAgentIds: ['other'], createdBy: 'someone' },
+    ];
+    const out = filterAccessibleTeams({ member: true }, 'me', teams);
+    expect(out.map(t => t.id)).toEqual(['mine']);
+  });
+  test('filterAccessibleTeams: union of member + ownedByMe', () => {
+    const teams = [
+      { id: 'a', memberAgentIds: ['me'], createdBy: 'x' },             // member
+      { id: 'b', memberAgentIds: ['other'], createdBy: 'me' },         // owned
+      { id: 'c', memberAgentIds: ['other'], createdBy: 'x' },          // neither
+    ];
+    const out = filterAccessibleTeams({ member: true, ownedByMe: true }, 'me', teams);
+    expect(out.map(t => t.id).sort()).toEqual(['a', 'b']);
+  });
+});

package/src/tools/__tests__/platformControlAncestry.test.js

@@ -0,0 +1,131 @@
+/**
+ * Tests for the ancestry walker.
+ *
+ * Pure module — no I/O, no async. Pin every edge case so a future
+ * refactor of the walk can't quietly let descendants modify their
+ * ancestors.
+ */
+import { describe, test, expect } from '@jest/globals';
+import {
+  CHAIN_MAX, isAncestor, isProtectedFromCaller, makeAgentLookup,
+} from '../platformControl/ancestry.js';
+
+const lookup = (rows) => makeAgentLookup(rows);
+
+describe('isAncestor', () => {
+  test('direct parent → true', () => {
+    const get = lookup([{ id: 'p' }, { id: 'c', createdBy: 'p' }]);
+    expect(isAncestor('c', 'p', get)).toBe(true);
+  });
+
+  test('grandparent → true', () => {
+    const get = lookup([
+      { id: 'gp' },
+      { id: 'p', createdBy: 'gp' },
+      { id: 'c', createdBy: 'p' },
+    ]);
+    expect(isAncestor('c', 'gp', get)).toBe(true);
+  });
+
+  test('sibling → false (no common path)', () => {
+    const get = lookup([
+      { id: 'p' },
+      { id: 'a', createdBy: 'p' },
+      { id: 'b', createdBy: 'p' },
+    ]);
+    expect(isAncestor('a', 'b', get)).toBe(false);
+  });
+
+  test('descendant → false (we don\'t reverse-walk)', () => {
+    const get = lookup([{ id: 'p' }, { id: 'c', createdBy: 'p' }]);
+    expect(isAncestor('p', 'c', get)).toBe(false);
+  });
+
+  test('self → false (handled by separate self-modify check)', () => {
+    const get = lookup([{ id: 'a' }]);
+    expect(isAncestor('a', 'a', get)).toBe(false);
+  });
+
+  test('createdBy=null → no parent → false', () => {
+    const get = lookup([{ id: 'a', createdBy: null }, { id: 'b' }]);
+    expect(isAncestor('a', 'b', get)).toBe(false);
+  });
+
+  test('missing intermediate agent stops the walk cleanly (no throw)', () => {
+    const get = lookup([{ id: 'c', createdBy: 'missing-parent' }]);
+    expect(isAncestor('c', 'gp', get)).toBe(false);
+  });
+
+  test('cycle in the chain (defensive) → false, no infinite loop', () => {
+    const get = lookup([
+      { id: 'a', createdBy: 'b' },
+      { id: 'b', createdBy: 'a' },     // a→b→a cycle
+    ]);
+    expect(isAncestor('a', 'someone-else', get)).toBe(false);
+  });
+
+  test('deep chain stops at CHAIN_MAX (no infinite walk)', () => {
+    // Build a chain length CHAIN_MAX + 5; walking should stop at MAX
+    // and not find the deepest ancestor.
+    const rows = [];
+    for (let i = 0; i <= CHAIN_MAX + 5; i++) {
+      rows.push({ id: `n${i}`, createdBy: i === 0 ? null : `n${i - 1}` });
+    }
+    const get = lookup(rows);
+    expect(isAncestor(`n${CHAIN_MAX + 5}`, `n0`, get)).toBe(false);
+    // But a closer ancestor IS found
+    expect(isAncestor(`n${CHAIN_MAX + 5}`, `n${CHAIN_MAX + 4}`, get)).toBe(true);
+  });
+
+  test('null/undefined inputs return false (defensive)', () => {
+    const get = lookup([{ id: 'a' }]);
+    expect(isAncestor(null, 'a', get)).toBe(false);
+    expect(isAncestor('a', null, get)).toBe(false);
+    expect(isAncestor('a', 'b', null)).toBe(false);
+  });
+});
+
+describe('isProtectedFromCaller', () => {
+  test('self → true (no-self-modify combined here for caller convenience)', () => {
+    const get = lookup([{ id: 'a' }]);
+    expect(isProtectedFromCaller('a', 'a', get)).toBe(true);
+  });
+
+  test('parent of caller → true', () => {
+    const get = lookup([{ id: 'p' }, { id: 'c', createdBy: 'p' }]);
+    expect(isProtectedFromCaller('c', 'p', get)).toBe(true);
+  });
+
+  test('child of caller → false (caller can modify their own descendants)', () => {
+    const get = lookup([{ id: 'p' }, { id: 'c', createdBy: 'p' }]);
+    expect(isProtectedFromCaller('p', 'c', get)).toBe(false);
+  });
+
+  test('unrelated → false', () => {
+    const get = lookup([{ id: 'a' }, { id: 'b' }]);
+    expect(isProtectedFromCaller('a', 'b', get)).toBe(false);
+  });
+});
+
+describe('makeAgentLookup', () => {
+  test('accepts a Map', () => {
+    const m = new Map([['a', { id: 'a', createdBy: null }]]);
+    const get = makeAgentLookup(m);
+    expect(get('a').id).toBe('a');
+    expect(get('missing')).toBe(null);
+  });
+  test('accepts an array', () => {
+    const get = makeAgentLookup([{ id: 'x' }]);
+    expect(get('x').id).toBe('x');
+    expect(get('y')).toBe(null);
+  });
+  test('accepts a plain object id→agent', () => {
+    const get = makeAgentLookup({ x: { id: 'x' } });
+    expect(get('x').id).toBe('x');
+    expect(get('y')).toBe(null);
+  });
+  test('null/undefined → always-null lookup', () => {
+    expect(makeAgentLookup(null)('x')).toBe(null);
+    expect(makeAgentLookup(undefined)('x')).toBe(null);
+  });
+});

package/src/tools/__tests__/platformControlCascade.test.js

@@ -0,0 +1,177 @@
+/**
+ * Cascade-on-delete tests. The service is modular: every external
+ * dependency is injected so the tests can pin "step ran / step failed
+ * doesn't abort later steps / strict mode aborts on first failure /
+ * report shape is stable".
+ */
+import { describe, test, expect, jest } from '@jest/globals';
+import { cascadeDeleteAgent, cascadeDeleteTeam } from '../platformControl/cascadeService.js';
+
+function makeServices(overrides = {}) {
+  const scheduleService = {
+    listSchedules: jest.fn(() => [
+      { id: 's1', targetType: 'agent',  targetId: 'victim' },
+      { id: 's2', targetType: 'agent',  targetId: 'someone-else' },
+      { id: 's3', targetType: 'flow',   targetId: 'victim' },     // flow-target with same id — must not delete
+    ]),
+    deleteSchedule: jest.fn(async () => undefined),
+    ...overrides.scheduleService,
+  };
+  const memoryService = {
+    deleteMemoryFile: jest.fn(async () => true),
+    ...overrides.memoryService,
+  };
+  const stateManager = {
+    getAllTeams: jest.fn(async () => [
+      { id: 'team-a', memberAgentIds: ['victim', 'other'] },
+      { id: 'team-b', memberAgentIds: ['other'] },
+    ]),
+    removeAgentFromTeam: jest.fn(async () => undefined),
+    deleteTeam: jest.fn(async () => true),
+    ...overrides.stateManager,
+  };
+  const agentPool = {
+    deleteAgent: jest.fn(async () => ({ success: true })),
+    ...overrides.agentPool,
+  };
+  return { scheduleService, memoryService, stateManager, agentPool };
+}
+
+describe('cascadeDeleteAgent — happy path', () => {
+  test('runs all four steps in order and reports counts', async () => {
+    const svcs = makeServices();
+    const report = await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+
+    // schedules: only the agent-target ones for THIS agent
+    expect(svcs.scheduleService.deleteSchedule).toHaveBeenCalledTimes(1);
+    expect(svcs.scheduleService.deleteSchedule).toHaveBeenCalledWith('s1');
+    expect(report.schedulesDeleted).toBe(1);
+
+    // memories
+    expect(svcs.memoryService.deleteMemoryFile).toHaveBeenCalledWith('victim');
+    expect(report.memoriesCleaned).toBe(true);
+
+    // teams: only the one containing 'victim'
+    expect(svcs.stateManager.removeAgentFromTeam).toHaveBeenCalledTimes(1);
+    expect(svcs.stateManager.removeAgentFromTeam).toHaveBeenCalledWith('team-a', 'victim');
+    expect(report.teamsLeft).toEqual(['team-a']);
+
+    // agentPool last
+    expect(svcs.agentPool.deleteAgent).toHaveBeenCalledWith('victim');
+    expect(report.agentDeleted).toBe(true);
+    expect(report.errors).toEqual([]);
+  });
+
+  test('flow-target schedules with the same id are NOT deleted', async () => {
+    const svcs = makeServices();
+    await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+    const calls = svcs.scheduleService.deleteSchedule.mock.calls.map(c => c[0]);
+    expect(calls).toEqual(['s1']);   // not s3 (flow)
+  });
+});
+
+describe('cascadeDeleteAgent — failure isolation (default = non-strict)', () => {
+  test('schedule-delete failure does not block memories / teams / agent', async () => {
+    const svcs = makeServices({
+      scheduleService: {
+        listSchedules: jest.fn(() => [{ id: 's1', targetType: 'agent', targetId: 'victim' }]),
+        deleteSchedule: jest.fn(async () => { throw new Error('schedule boom'); }),
+      },
+    });
+    const report = await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+    expect(report.errors).toEqual([{ step: 'schedules', error: 'schedule boom' }]);
+    // Later steps still ran
+    expect(svcs.memoryService.deleteMemoryFile).toHaveBeenCalled();
+    expect(svcs.stateManager.removeAgentFromTeam).toHaveBeenCalled();
+    expect(svcs.agentPool.deleteAgent).toHaveBeenCalled();
+    expect(report.agentDeleted).toBe(true);
+  });
+
+  test('memory failure isolated', async () => {
+    const svcs = makeServices({
+      memoryService: { deleteMemoryFile: jest.fn(async () => { throw new Error('disk full'); }) },
+    });
+    const report = await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+    expect(report.errors[0]).toMatchObject({ step: 'memories', error: 'disk full' });
+    expect(report.memoriesCleaned).toBe(false);
+    expect(report.agentDeleted).toBe(true);    // later steps still ran
+  });
+
+  test('team failure isolated', async () => {
+    const svcs = makeServices({
+      stateManager: {
+        getAllTeams: jest.fn(async () => [{ id: 't', memberAgentIds: ['victim'] }]),
+        removeAgentFromTeam: jest.fn(async () => { throw new Error('team boom'); }),
+      },
+    });
+    const report = await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+    expect(report.errors[0]).toMatchObject({ step: 'teams' });
+    expect(report.teamsLeft).toEqual([]);     // we got the error before pushing
+    expect(report.agentDeleted).toBe(true);
+  });
+
+  test('agentPool failure recorded; report still returned', async () => {
+    const svcs = makeServices({
+      agentPool: { deleteAgent: jest.fn(async () => { throw new Error('pool boom'); }) },
+    });
+    const report = await cascadeDeleteAgent({ agentId: 'victim', ...svcs });
+    expect(report.agentDeleted).toBe(false);
+    expect(report.errors[0]).toMatchObject({ step: 'agentPool' });
+  });
+});
+
+describe('cascadeDeleteAgent — strict mode', () => {
+  test('first failure throws and skips later steps', async () => {
+    const svcs = makeServices({
+      scheduleService: {
+        listSchedules: jest.fn(() => [{ id: 's1', targetType: 'agent', targetId: 'victim' }]),
+        deleteSchedule: jest.fn(async () => { throw new Error('boom'); }),
+      },
+    });
+    await expect(
+      cascadeDeleteAgent({ agentId: 'victim', ...svcs, strict: true })
+    ).rejects.toThrow('boom');
+    // memories / teams / agentPool NOT called
+    expect(svcs.memoryService.deleteMemoryFile).not.toHaveBeenCalled();
+    expect(svcs.stateManager.removeAgentFromTeam).not.toHaveBeenCalled();
+    expect(svcs.agentPool.deleteAgent).not.toHaveBeenCalled();
+  });
+});
+
+describe('cascadeDeleteAgent — defensive', () => {
+  test('throws if agentId is missing', async () => {
+    await expect(cascadeDeleteAgent({ agentId: '', ...makeServices() })).rejects.toThrow(/agentId is required/);
+  });
+
+  test('missing optional services → step recorded as no-op', async () => {
+    const report = await cascadeDeleteAgent({
+      agentId: 'victim',
+      scheduleService: null,
+      memoryService: null,
+      stateManager: null,
+      agentPool: { deleteAgent: jest.fn(async () => undefined) },
+    });
+    expect(report.schedulesDeleted).toBe(0);
+    expect(report.memoriesCleaned).toBe(false);
+    expect(report.teamsLeft).toEqual([]);
+    expect(report.agentDeleted).toBe(true);
+  });
+});
+
+describe('cascadeDeleteTeam', () => {
+  test('happy path — calls deleteTeam', async () => {
+    const svcs = makeServices();
+    const report = await cascadeDeleteTeam({ teamId: 'team-a', stateManager: svcs.stateManager });
+    expect(svcs.stateManager.deleteTeam).toHaveBeenCalledWith('team-a');
+    expect(report.teamDeleted).toBe(true);
+  });
+  test('rethrows on failure', async () => {
+    await expect(cascadeDeleteTeam({
+      teamId: 'team-a',
+      stateManager: { deleteTeam: async () => { throw new Error('nope'); } },
+    })).rejects.toThrow('nope');
+  });
+  test('throws if teamId missing', async () => {
+    await expect(cascadeDeleteTeam({ teamId: '', stateManager: {} })).rejects.toThrow(/teamId is required/);
+  });
+});