tulingcode 0.1.0

package/test/server/session-task-route.test.ts

@@ -0,0 +1,165 @@
+import { afterEach, describe, expect, test } from "bun:test"
+import { Effect } from "effect"
+import { Instance } from "../../src/project/instance"
+import { Server } from "../../src/server/server"
+import { Session as SessionNs } from "../../src/session"
+import { Todo } from "../../src/session/todo"
+import { TaskRegistry } from "../../src/task/registry"
+import type { Task } from "../../src/task/schema"
+import type { SessionID } from "../../src/session/schema"
+import { Log } from "../../src/util"
+import { tmpdir } from "../fixture/fixture"
+
+void Log.init({ print: false })
+
+function runSession<A, E>(fx: Effect.Effect<A, E, SessionNs.Service>) {
+  return Effect.runPromise(fx.pipe(Effect.provide(SessionNs.defaultLayer)))
+}
+
+function runTask<A, E>(fx: Effect.Effect<A, E, TaskRegistry.Service>) {
+  return Effect.runPromise(fx.pipe(Effect.provide(TaskRegistry.defaultLayer)))
+}
+
+function runTodo<A, E>(fx: Effect.Effect<A, E, Todo.Service>) {
+  return Effect.runPromise(fx.pipe(Effect.provide(Todo.defaultLayer)))
+}
+
+const createSession = () => runSession(SessionNs.Service.use((svc) => svc.create({})))
+
+afterEach(async () => {
+  await Instance.disposeAll()
+})
+
+async function withoutWatcher<T>(fn: () => Promise<T>) {
+  if (process.platform !== "win32") return fn()
+  const prev = process.env.tulingcode_EXPERIMENTAL_DISABLE_FILEWATCHER
+  process.env.tulingcode_EXPERIMENTAL_DISABLE_FILEWATCHER = "true"
+  try {
+    return await fn()
+  } finally {
+    if (prev === undefined) delete process.env.tulingcode_EXPERIMENTAL_DISABLE_FILEWATCHER
+    else process.env.tulingcode_EXPERIMENTAL_DISABLE_FILEWATCHER = prev
+  }
+}
+
+describe("session task route", () => {
+  test("GET /:sid/task returns [] for a fresh session, then created tasks", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await withoutWatcher(() =>
+      Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const session = await createSession()
+          const app = Server.Default().app
+
+          const empty = await app.request(`/session/${session.id}/task`)
+          expect(empty.status).toBe(200)
+          expect(await empty.json()).toEqual([])
+
+          await runTask(TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "first" })))
+          await runTask(TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "second" })))
+
+          const res = await app.request(`/session/${session.id}/task`)
+          expect(res.status).toBe(200)
+          const body = (await res.json()) as Task[]
+          expect(body.map((t) => t.id)).toEqual(["T1", "T2"])
+          expect(body.map((t) => t.summary)).toEqual(["first", "second"])
+          expect(body.map((t) => t.status)).toEqual(["open", "open"])
+        },
+      }),
+    )
+  })
+
+  test("GET /:sid/task 404s for a missing session", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await withoutWatcher(() =>
+      Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const app = Server.Default().app
+          const res = await app.request(`/session/ses_missing/task`)
+          expect(res.status).toBe(404)
+        },
+      }),
+    )
+  })
+
+  test("GET /:sid/todo projects task data with status mapping when tasks exist", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await withoutWatcher(() =>
+      Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const session = await createSession()
+
+          const open = await runTask(
+            TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "still open" })),
+          )
+          const running = await runTask(
+            TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "running" })),
+          )
+          await runTask(TaskRegistry.Service.use((reg) => reg.start({ session_id: session.id, id: running.id })))
+          const finished = await runTask(
+            TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "finished" })),
+          )
+          await runTask(TaskRegistry.Service.use((reg) => reg.done({ session_id: session.id, id: finished.id })))
+          // open + then blocked -> projects to "pending"
+          const blocked = await runTask(
+            TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "blocked" })),
+          )
+          await runTask(TaskRegistry.Service.use((reg) => reg.block({ session_id: session.id, id: blocked.id })))
+          const abandoned = await runTask(
+            TaskRegistry.Service.use((reg) => reg.create({ session_id: session.id, summary: "abandoned" })),
+          )
+          await runTask(TaskRegistry.Service.use((reg) => reg.abandon({ session_id: session.id, id: abandoned.id })))
+
+          void open
+
+          const app = Server.Default().app
+          const res = await app.request(`/session/${session.id}/todo`)
+          expect(res.status).toBe(200)
+          const body = (await res.json()) as { content: string; status: string }[]
+          expect(body).toEqual([
+            { content: "still open", status: "pending" },
+            { content: "running", status: "in_progress" },
+            { content: "finished", status: "completed" },
+            { content: "blocked", status: "pending" },
+            { content: "abandoned", status: "cancelled" },
+          ])
+        },
+      }),
+    )
+  })
+
+  test("GET /:sid/todo falls back to the todo table when no tasks exist", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await withoutWatcher(() =>
+      Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const session = await createSession()
+          await runTodo(
+            Todo.Service.use((svc) =>
+              svc.update({
+                sessionID: session.id,
+                todos: [
+                  { content: "legacy todo a", status: "pending" },
+                  { content: "legacy todo b", status: "completed" },
+                ],
+              }),
+            ),
+          )
+
+          const app = Server.Default().app
+          const res = await app.request(`/session/${session.id}/todo`)
+          expect(res.status).toBe(200)
+          const body = (await res.json()) as { content: string; status: string }[]
+          expect(body).toEqual([
+            { content: "legacy todo a", status: "pending" },
+            { content: "legacy todo b", status: "completed" },
+          ])
+        },
+      }),
+    )
+  })
+})

package/test/server/summarize-route-main-slice.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect } from "bun:test"
+import { Effect, Layer } from "effect"
+import { Bus } from "../../src/bus"
+import { Config } from "../../src/config"
+import { Plugin } from "../../src/plugin"
+import { Agent } from "../../src/agent/agent"
+import { Session as SessionNs } from "../../src/session"
+import { MessageID, PartID } from "../../src/session/schema"
+import { ProviderID, ModelID } from "../../src/provider/schema"
+import { ProviderTest } from "../fake/provider"
+import { Log } from "../../src/util"
+import { testEffect } from "../lib/effect"
+import { provideTmpdirInstance } from "../fixture/fixture"
+import * as CrossSpawnSpawner from "../../src/effect/cross-spawn-spawner"
+import { resolveCurrentAgent } from "../../src/server/routes/instance/session"
+
+void Log.init({ print: false })
+
+const ref = { providerID: ProviderID.make("test"), modelID: ModelID.make("test-model") }
+
+// Session.create needs ChildProcessSpawner; mirror prune-main-slice/checkpoint-main-slice
+// layer wiring so the harness path is identical — only the scenario differs.
+const deps = Layer.mergeAll(
+  ProviderTest.fake().layer,
+  Agent.defaultLayer,
+  Plugin.defaultLayer,
+  Bus.layer,
+  Config.defaultLayer,
+)
+
+const env = Layer.mergeAll(
+  SessionNs.defaultLayer,
+  CrossSpawnSpawner.defaultLayer,
+  deps,
+)
+
+const it = testEffect(env)
+
+// Regression for the summarize HTTP route's currentAgent lookup. The handler
+// previously walked the unfiltered message stream newest-first to pick the
+// agent identity that drives compact.create. With subagents on the same
+// sessionID, a checkpoint-writer's task user message at the tail flips
+// currentAgent to the subagent — the server-side compaction then runs against
+// the wrong prompt/tools. The fix pins the lookup to the main slice via the
+// resolveCurrentAgent helper.
+describe("summarize route — currentAgent lookup uses main slice", () => {
+  it.live(
+    "ignores trailing subagent user messages when picking currentAgent",
+    provideTmpdirInstance(() =>
+      Effect.gen(function* () {
+        const ssn = yield* SessionNs.Service
+        const info = yield* ssn.create({})
+
+        // Main user message: agent="build". This is the identity the
+        // summarize route should resolve to.
+        const mainID = MessageID.ascending()
+        yield* ssn.updateMessage({
+          id: mainID,
+          role: "user" as const,
+          sessionID: info.id,
+          agent: "build",
+          model: ref,
+          time: { created: Date.now() },
+        })
+        yield* ssn.updatePart({
+          id: PartID.ascending(),
+          messageID: mainID,
+          sessionID: info.id,
+          type: "text",
+          text: "user prompt",
+        })
+
+        // Subagent user message at the tail. Without the main-slice pin,
+        // newest-first iteration picks this row up and currentAgent becomes
+        // "checkpoint-writer".
+        const subID = MessageID.ascending()
+        yield* ssn.updateMessage({
+          id: subID,
+          role: "user" as const,
+          sessionID: info.id,
+          agentID: "checkpoint-writer-1",
+          agent: "checkpoint-writer",
+          model: ref,
+          time: { created: Date.now() + 1 },
+        })
+        yield* ssn.updatePart({
+          id: PartID.ascending(),
+          messageID: subID,
+          sessionID: info.id,
+          type: "text",
+          text: "checkpoint task body",
+        })
+
+        const got = yield* resolveCurrentAgent(info.id, "build")
+        expect(got).toBe("build")
+      }),
+    ),
+  )
+})

package/test/server/trace-attributes.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, test } from "bun:test"
+import { paramToAttributeKey, requestAttributes } from "../../src/server/routes/instance/trace"
+
+function fakeContext(method: string, url: string, params: Record<string, string>) {
+  return {
+    req: {
+      method,
+      url,
+      param: () => params,
+    },
+  }
+}
+
+describe("paramToAttributeKey", () => {
+  test("converts fooID to foo.id", () => {
+    expect(paramToAttributeKey("sessionID")).toBe("session.id")
+    expect(paramToAttributeKey("messageID")).toBe("message.id")
+    expect(paramToAttributeKey("partID")).toBe("part.id")
+    expect(paramToAttributeKey("projectID")).toBe("project.id")
+    expect(paramToAttributeKey("providerID")).toBe("provider.id")
+    expect(paramToAttributeKey("ptyID")).toBe("pty.id")
+    expect(paramToAttributeKey("permissionID")).toBe("permission.id")
+    expect(paramToAttributeKey("requestID")).toBe("request.id")
+    expect(paramToAttributeKey("workspaceID")).toBe("workspace.id")
+  })
+
+  test("namespaces non-ID params under opencode.", () => {
+    expect(paramToAttributeKey("name")).toBe("opencode.name")
+    expect(paramToAttributeKey("slug")).toBe("opencode.slug")
+  })
+})
+
+describe("requestAttributes", () => {
+  test("includes http method and path", () => {
+    const attrs = requestAttributes(fakeContext("GET", "http://localhost/session", {}))
+    expect(attrs["http.method"]).toBe("GET")
+    expect(attrs["http.path"]).toBe("/session")
+  })
+
+  test("strips query string from path", () => {
+    const attrs = requestAttributes(fakeContext("GET", "http://localhost/file/search?query=foo&limit=10", {}))
+    expect(attrs["http.path"]).toBe("/file/search")
+  })
+
+  test("emits OTel-style <domain>.id for ID-shaped route params", () => {
+    const attrs = requestAttributes(
+      fakeContext("GET", "http://localhost/session/ses_abc/message/msg_def/part/prt_ghi", {
+        sessionID: "ses_abc",
+        messageID: "msg_def",
+        partID: "prt_ghi",
+      }),
+    )
+    expect(attrs["session.id"]).toBe("ses_abc")
+    expect(attrs["message.id"]).toBe("msg_def")
+    expect(attrs["part.id"]).toBe("prt_ghi")
+    // No camelCase leftovers:
+    expect(attrs["opencode.sessionID"]).toBeUndefined()
+    expect(attrs["opencode.messageID"]).toBeUndefined()
+    expect(attrs["opencode.partID"]).toBeUndefined()
+  })
+
+  test("produces no param attributes when no params are matched", () => {
+    const attrs = requestAttributes(fakeContext("POST", "http://localhost/config", {}))
+    expect(Object.keys(attrs).filter((k) => k !== "http.method" && k !== "http.path")).toEqual([])
+  })
+
+  test("namespaces non-ID params under opencode. (e.g. mcp :name)", () => {
+    const attrs = requestAttributes(
+      fakeContext("POST", "http://localhost/mcp/exa/connect", {
+        name: "exa",
+      }),
+    )
+    expect(attrs["opencode.name"]).toBe("exa")
+    expect(attrs["name"]).toBeUndefined()
+  })
+})

package/test/server/workflows-route.test.ts

@@ -0,0 +1,279 @@
+import { afterEach, describe, expect, test } from "bun:test"
+import { Effect, Exit, Cause } from "effect"
+import { Log } from "../../src/util"
+import { Instance } from "../../src/project/instance"
+import { Server } from "../../src/server/server"
+import { Session } from "../../src/session"
+import { WorkflowPersistence } from "../../src/workflow/persistence"
+import { WorkflowRuntime } from "../../src/workflow/runtime"
+import { workflowRef } from "../../src/workflow/runtime-ref"
+import { provideTmpdirServer, tmpdir } from "../fixture/fixture"
+import { testEffect } from "../lib/effect"
+import { makeLayer, ref, providerCfg } from "../workflow/lib"
+
+void Log.init({ print: false })
+
+afterEach(async () => {
+  workflowRef.current = undefined
+  await Instance.disposeAll()
+})
+
+describe("workflows routes", () => {
+  test("GET /workflows returns [] when the workflow runtime is not running", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        // #given the workflow runtime layer is not running (late-bound ref unset)
+        workflowRef.current = undefined
+
+        // #when — a valid session-shaped sessionID (now REQUIRED) is supplied
+        const app = Server.Default().app
+        const response = await app.request("/workflows?sessionID=ses_16ec185f2ffexEGkbWeMqWSucv", { method: "GET" })
+
+        // #then — runtime absent short-circuits to [] (the session passes validation)
+        expect(response.status).toBe(200)
+        expect(await response.json()).toEqual([])
+      },
+    })
+  })
+
+  test("POST /workflows/:runID/resume returns { resumed: false } when the runtime is not running", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        // #given the workflow runtime layer is not running
+        workflowRef.current = undefined
+
+        // #when — a real minted-shape runID (wf_ + 26 base62) with no persisted run
+        const app = Server.Default().app
+        const response = await app.request("/workflows/wf_16ec185f2ffexEGkbWeMqWSucv/resume", { method: "POST" })
+
+        // #then
+        expect(response.status).toBe(200)
+        expect(await response.json()).toEqual({ runID: "wf_16ec185f2ffexEGkbWeMqWSucv", resumed: false })
+      },
+    })
+  })
+
+  // ── P0 (MR104 #3): path traversal via unvalidated runID ──────────────────
+  // resume(runID) → readScript(runID) → scriptPath = join(scriptDir, runID + ".js").
+  // A traversal runID escapes scriptDir, so the route MUST reject any runID that
+  // is not exactly `wf_` + base62. The proof is that the request is REFUSED at the
+  // route's param validator (400) — it never reaches the runtime/launch, so no file
+  // outside scriptDir is ever opened.
+  for (const evil of [
+    "../../../etc/passwd",
+    "../../foo",
+    "/etc/passwd",
+    "wf_../../../etc/passwd", // defeats a prefix-only (startsWith "wf") check
+    "wf_..", // bare dot-dot after a legit prefix
+  ]) {
+    test(`POST /workflows/:runID/resume REJECTS traversal runID ${JSON.stringify(evil)}`, async () => {
+      await using tmp = await tmpdir({ git: true })
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          // #given the runtime is absent — so if validation let this through it would
+          // hit the early `{ resumed: false }`; the only way to a 400 is param rejection.
+          workflowRef.current = undefined
+
+          // #when
+          const app = Server.Default().app
+          const response = await app.request(`/workflows/${encodeURIComponent(evil)}/resume`, { method: "POST" })
+
+          // #then — rejected by the param validator before any path.join / file read.
+          expect(response.status).toBe(400)
+        },
+      })
+    })
+  }
+
+  // ── P0 (MR104 #3): GET /workflows must NOT leak all-session runs ──────────
+  test("GET /workflows with NO sessionID returns 400 (does not list all runs)", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        // #given a live-enough runtime is irrelevant: the missing required query param
+        // is rejected at the validator. (Keep it unset so a regression that drops the
+        // requirement would surface as a 200 [] rather than passing by accident.)
+        workflowRef.current = undefined
+
+        // #when — omit sessionID entirely
+        const app = Server.Default().app
+        const response = await app.request("/workflows", { method: "GET" })
+
+        // #then — rejected, NOT a 200 with the unfiltered all-runs branch.
+        expect(response.status).toBe(400)
+      },
+    })
+  })
+
+  test("GET /workflows with a non-session-shaped sessionID returns 400", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        workflowRef.current = undefined
+        const app = Server.Default().app
+        const response = await app.request("/workflows?sessionID=not-a-session", { method: "GET" })
+        expect(response.status).toBe(400)
+      },
+    })
+  })
+
+  // ── P0 (MR104 #3): defense-in-depth at the persistence layer ──────────────
+  // readScript / journal IO are reachable from the tool + TUI, not only the HTTP
+  // route, so the persistence path functions must themselves refuse a traversal
+  // runID. A direct readScript("../../../etc/passwd") must FAIL (the guard throws,
+  // surfacing as an Effect defect) rather than open a file outside scriptDir.
+  test("WorkflowPersistence.readScript fails safely on a traversal runID (no out-of-dir read)", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        const exit = await Effect.runPromiseExit(WorkflowPersistence.readScript("../../../etc/passwd"))
+        // #then — the GUARD must reject it. Asserting only Exit.isFailure would
+        // also pass against unguarded code (ENOENT on `…/etc/passwd.js`), so assert
+        // the failure carries the guard's message — this fails closed if safeRunID
+        // is ever removed.
+        expect(Exit.isFailure(exit)).toBe(true)
+        if (Exit.isFailure(exit)) {
+          expect(Cause.pretty(exit.cause)).toContain("invalid workflow runID")
+        }
+      },
+    })
+  })
+
+  test("WorkflowPersistence.readScript still reads a legit wf_ runID", async () => {
+    await using tmp = await tmpdir({ git: true })
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        // #given a normally-minted runID with a persisted script
+        const runID = "wf_16ec185f2ffexEGkbWeMqWSucv"
+        await Effect.runPromise(WorkflowPersistence.writeScript(runID, "export const meta = {}\n"))
+        // #then — the guard does NOT break the legit path
+        const body = await Effect.runPromise(WorkflowPersistence.readScript(runID))
+        expect(body).toContain("export const meta")
+      },
+    })
+  })
+})
+
+// The LIVE path the TUI /workflows dialog consumes: the route returns REAL run
+// data (not the degenerate []). These run under the workflow test layer
+// (makeLayer) so WorkflowRuntime.layer is live and populates the module-global
+// `workflowRef` that the route reads through. Crucially the data path is the
+// process-global `:memory:` DB (test/preload sets tulingcode_DB=:memory:, and the
+// storage Client is a per-process singleton): the run writes its WorkflowRunTable
+// row there, and the route's handler — run via AppRuntime, NOT this layer — reads
+// the SAME DB. So `Server.Default().app.request("/workflows")` genuinely
+// exercises the HTTP route end-to-end against a real run. The
+// `x-tulingcode-directory` header makes InstanceMiddleware re-enter the SAME cached
+// tmpdir Instance the run used (one entry per directory in Instance's cache), so
+// resume's re-launch spawns in the run's own session context. We filter list by
+// sessionID to stay robust against any residue in the shared in-memory DB.
+const it = testEffect(makeLayer())
+
+// Test ORDER is deliberate: the sandbox-free resume test runs FIRST and the
+// agent-spawning list test runs LAST. An agent() run forks a quickjs sandbox
+// (evalScript) whose teardown is CPU-sensitive — under load the 1ms pump interval
+// can starve, leaving the forked fiber uninterruptible at scope close (the
+// pre-existing quickjs-under-Bun condition; see runtime.test.ts). Keeping the only
+// sandbox-bearing test last means its residue has no following evalScript test to
+// destabilize. Verified 0 flakes across 16 process runs UNDER heavy CPU contention
+// in this order; the reverse order flakes ~30%+.
+//
+// NOTE on resume coverage: we assert the resume route over a LIVE runtime returns
+// the real { resumed: false } for an unknown run — this proves the route reaches
+// the live `runtime.resume()` (distinct from the degenerate case above, where the
+// runtime is absent and the route short-circuits before calling resume). We do NOT
+// add an HTTP test for the positive { resumed: true } re-launch: a successful
+// resume forks a fresh evalScript whose teardown deadlocks under CI CPU load
+// regardless of how it is driven (HTTP or the service directly) — a runtime/sandbox
+// limitation we cannot fix from a test. The re-launch semantics (resumed: true,
+// cached replay, zero-spawn resume) are covered in the warmed-up
+// test/workflow/runtime.test.ts suite.
+describe("workflows routes — live runtime", () => {
+  it.live("POST /workflows/:runID/resume reaches the LIVE runtime (resumed: false for an unknown run)", () =>
+    provideTmpdirServer(
+      Effect.fnUntraced(function* ({ dir }) {
+        // #given the workflow runtime IS live (the layer set the late-bound ref) —
+        // this is what distinguishes this from the degenerate test above, where the
+        // ref is undefined and the route returns early without calling resume().
+        expect(workflowRef.current).toBeDefined()
+
+        // #when — POST resume over the REAL route for a runID with no persisted run.
+        // Use a valid minted-shape runID (wf_ + 26 base62) so it passes the param
+        // validator and genuinely reaches the live runtime.resume(), which loads no
+        // row and returns { resumed: false }. (async wrapper normalizes Hono's
+        // `Promise<Response> | Response` overload for Effect.promise.)
+        const response = yield* Effect.promise(async () =>
+          Server.Default().app.request(`/workflows/wf_00000000000000000000000000/resume`, {
+            method: "POST",
+            headers: { "x-tulingcode-directory": dir },
+          }),
+        )
+
+        // #then — the live runtime's real verdict flows back through the HTTP route.
+        expect(response.status).toBe(200)
+        expect(yield* Effect.promise(() => response.json())).toEqual({
+          runID: "wf_00000000000000000000000000",
+          resumed: false,
+        })
+      }),
+      { git: true, config: providerCfg },
+    ),
+  )
+
+  it.live("GET /workflows returns a live run with real status + counters", () =>
+    provideTmpdirServer(
+      Effect.fnUntraced(function* ({ dir, llm }) {
+        const runtime = yield* WorkflowRuntime.Service
+        const session = yield* Session.Service
+        const parent = yield* session.create({
+          title: "wf route live",
+          permission: [{ permission: "*", pattern: "*", action: "allow" }],
+        })
+        yield* llm.text("done") // one reply for the single agent() spawn
+        const script = [`export const meta = { name: "t", description: "d" }`, `return await agent("x")`].join("\n")
+        const { runID } = yield* runtime.start({ script, sessionID: parent.id, parentActorID: "main", model: ref })
+        const outcome = yield* runtime.wait({ runID, timeoutMs: 8000 })
+        expect(outcome.status).toBe("completed")
+
+        // #when — drive the REAL HTTP route the TUI list reads. The directory header
+        // makes InstanceMiddleware re-enter the same cached tmpdir Instance the run
+        // used; sessionID scopes to this run. app.request's Hono overload is
+        // `Promise<Response> | Response`, so the async wrapper normalizes it to a
+        // Promise for Effect.promise.
+        const response = yield* Effect.promise(async () =>
+          Server.Default().app.request(`/workflows?sessionID=${parent.id}`, {
+            method: "GET",
+            headers: { "x-tulingcode-directory": dir },
+          }),
+        )
+        expect(response.status).toBe(200)
+        const rows = (yield* Effect.promise(() => response.json())) as Array<{
+          runID: string
+          status: string
+          succeeded: number
+        }>
+
+        // #then — the live run is visible over HTTP with its real fields: this is
+        // the exact data path the TUI /workflows list reads (counter from a real spawn).
+        const row = rows.find((r) => r.runID === runID)
+        expect(row).toBeDefined()
+        expect(row!.status).toBe("completed")
+        expect(row!.succeeded).toBeGreaterThanOrEqual(1)
+      }),
+      { git: true, config: providerCfg },
+    ),
+    // Headroom over the default 5s: this exercises a full Instance bootstrap +
+    // a real runtime run + an HTTP round-trip, and runs alongside the heavy
+    // live workflow/server suites where CI load can push past 5s.
+    15000,
+  )
+})