/**
 * Exhaustive HTTP API Integration Tests
 *
 * Spawns the actual HTTP server with a temporary SQLite database
 * and tests every API endpoint for correct behavior.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { randomUUID } from "node:crypto";
import { unlink } from "node:fs/promises";
import type { Subprocess } from "bun";
import { Webhook } from "svix";

const TEST_PORT = 19876;
const TEST_DB_PATH = `/tmp/test-http-integration-${Date.now()}.sqlite`;
const BASE = `http://localhost:${TEST_PORT}`;
const TEST_API_KEY = "test-http-integration-key";

let serverProc: Subprocess;

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

async function api(
  method: string,
  path: string,
  opts: { body?: unknown; agentId?: string; headers?: Record<string, string> } = {},
): Promise<{ status: number; body: any; ok: boolean }> {
  const headers: Record<string, string> = {
    "Content-Type": "application/json",
    Authorization: `Bearer ${TEST_API_KEY}`,
    ...opts.headers,
  };
  if (opts.agentId) headers["x-agent-id"] = opts.agentId;

  const res = await fetch(`${BASE}${path}`, {
    method,
    headers,
    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
  });

  const text = await res.text();
  let body: any;
  try {
    body = JSON.parse(text);
  } catch {
    body = text;
  }
  return { status: res.status, body, ok: res.ok };
}

const get = (p: string, o?: Parameters<typeof api>[2]) => api("GET", p, o);
const post = (p: string, o?: Parameters<typeof api>[2]) => api("POST", p, o);
const put = (p: string, o?: Parameters<typeof api>[2]) => api("PUT", p, o);
const patch = (p: string, o?: Parameters<typeof api>[2]) => api("PATCH", p, o);
const del = (p: string, o?: Parameters<typeof api>[2]) => api("DELETE", p, o);

async function waitForServer(url: string, timeoutMs = 15000) {
  const start = Date.now();
  while (Date.now() - start < timeoutMs) {
    try {
      const r = await fetch(url);
      if (r.ok) return;
    } catch {
      // not ready yet
    }
    await Bun.sleep(50);
  }
  throw new Error(`Server did not start within ${timeoutMs}ms`);
}

// ---------------------------------------------------------------------------
// Shared state — IDs created during tests for cross-test references
// ---------------------------------------------------------------------------
const ids = {
  leadAgent: randomUUID(),
  workerAgent: randomUUID(),
  workerAgent2: randomUUID(),
  task: "",
  task2: "",

  config: "",
  repo: "",
  session: "",
};

// ---------------------------------------------------------------------------
// Server lifecycle
// ---------------------------------------------------------------------------

beforeAll(async () => {
  // Clean up any leftover test DB
  try {
    await unlink(TEST_DB_PATH);
  } catch {}
  try {
    await unlink(`${TEST_DB_PATH}-wal`);
  } catch {}
  try {
    await unlink(`${TEST_DB_PATH}-shm`);
  } catch {}

  serverProc = Bun.spawn(["bun", "src/http.ts"], {
    cwd: `${import.meta.dir}/../..`,
    env: {
      ...process.env,
      PORT: String(TEST_PORT),
      DATABASE_PATH: TEST_DB_PATH,
      API_KEY: TEST_API_KEY,
      CAPABILITIES: "core,task-pool,messaging,profiles,services,scheduling,memory",
      // Disable optional integrations
      SLACK_BOT_TOKEN: "",
      GITHUB_WEBHOOK_SECRET: "",
      AGENTMAIL_API_KEY: "",
    },
    stdout: "ignore",
    stderr: "ignore",
  });

  await waitForServer(`${BASE}/health`);
}, 20000);

afterAll(async () => {
  if (serverProc) {
    serverProc.kill();
    // Wait for process to exit
    try {
      await serverProc.exited;
    } catch {}
  }
  await Bun.sleep(50);
  try {
    await unlink(TEST_DB_PATH);
  } catch {}
  try {
    await unlink(`${TEST_DB_PATH}-wal`);
  } catch {}
  try {
    await unlink(`${TEST_DB_PATH}-shm`);
  } catch {}
});

// ===========================================================================
// 1. Health & Core
// ===========================================================================

describe("Health & Core", () => {
  test("GET /health returns ok", async () => {
    const { status, body } = await get("/health");
    expect(status).toBe(200);
    expect(body.status).toBe("ok");
    expect(body.version).toBeDefined();
  });

  test("OPTIONS returns 204 (CORS preflight)", async () => {
    const res = await fetch(`${BASE}/api/agents`, { method: "OPTIONS" });
    expect(res.status).toBe(204);
    expect(res.headers.get("access-control-allow-origin")).toBe("*");
  });

  test("GET /me without agent ID returns 400", async () => {
    const { status, body } = await get("/me");
    expect(status).toBe(400);
    expect(body.error).toContain("Missing X-Agent-ID");
  });

  test("GET /me with non-existent agent returns 404", async () => {
    const { status } = await get("/me", { agentId: randomUUID() });
    expect(status).toBe(404);
  });

  test("POST /ping without agent ID returns 400", async () => {
    const { status } = await post("/ping");
    expect(status).toBe(400);
  });

  test("POST /close without agent ID returns 400", async () => {
    const { status } = await post("/close");
    expect(status).toBe(400);
  });

  test("unknown route returns 404", async () => {
    const { status } = await get("/api/nonexistent");
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 2. Agents
// ===========================================================================

describe("Agents", () => {
  test("POST /api/agents — missing name returns 400", async () => {
    const { status, body } = await post("/api/agents", { body: {} });
    expect(status).toBe(400);
    expect(body.error).toContain("name");
  });

  test("POST /api/agents — create lead agent", async () => {
    const { status, body } = await post("/api/agents", {
      agentId: ids.leadAgent,
      body: {
        name: "TestLead",
        isLead: true,
        description: "Lead agent for tests",
        role: "lead",
        capabilities: ["core", "messaging"],
        maxTasks: 3,
      },
    });
    expect(status).toBe(201);
    expect(body.id).toBe(ids.leadAgent);
    expect(body.name).toBe("TestLead");
    expect(body.isLead).toBeTruthy();
  });

  test("POST /api/agents — create worker agent", async () => {
    const { status, body } = await post("/api/agents", {
      agentId: ids.workerAgent,
      body: { name: "TestWorker", role: "worker", maxTasks: 2 },
    });
    expect(status).toBe(201);
    expect(body.id).toBe(ids.workerAgent);
    expect(body.name).toBe("TestWorker");
  });

  test("POST /api/agents — create second worker", async () => {
    const { status, body } = await post("/api/agents", {
      agentId: ids.workerAgent2,
      body: { name: "TestWorker2" },
    });
    expect(status).toBe(201);
    expect(body.id).toBe(ids.workerAgent2);
  });

  test("POST /api/agents — re-register existing agent returns 200", async () => {
    const { status, body } = await post("/api/agents", {
      agentId: ids.workerAgent,
      body: { name: "TestWorker" },
    });
    expect(status).toBe(200);
    expect(body.id).toBe(ids.workerAgent);
  });

  test("GET /api/agents — list all agents", async () => {
    const { status, body } = await get("/api/agents");
    expect(status).toBe(200);
    expect(body.agents).toBeDefined();
    expect(Array.isArray(body.agents)).toBe(true);
    expect(body.agents.length).toBeGreaterThanOrEqual(3);
  });

  test("GET /api/agents/:id — get specific agent", async () => {
    const { status, body } = await get(`/api/agents/${ids.workerAgent}`);
    expect(status).toBe(200);
    expect(body.id).toBe(ids.workerAgent);
    expect(body.name).toBe("TestWorker");
    // Should include capacity info
    expect(body.capacity).toBeDefined();
  });

  test("GET /api/agents/:id — non-existent returns 404", async () => {
    const { status } = await get(`/api/agents/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("PUT /api/agents/:id/name — rename agent", async () => {
    const { status, body } = await put(`/api/agents/${ids.workerAgent}/name`, {
      body: { name: "RenamedWorker" },
    });
    expect(status).toBe(200);
    expect(body.name).toBe("RenamedWorker");
  });

  test("PUT /api/agents/:id/name — missing name returns 400", async () => {
    const { status } = await put(`/api/agents/${ids.workerAgent}/name`, { body: {} });
    expect(status).toBe(400);
  });

  test("PUT /api/agents/:id/profile — update profile", async () => {
    const { status, body } = await put(`/api/agents/${ids.workerAgent}/profile`, {
      body: {
        description: "Updated description",
        role: "senior-worker",
        capabilities: ["typescript", "testing"],
      },
    });
    expect(status).toBe(200);
    expect(body.description).toBe("Updated description");
    expect(body.role).toBe("senior-worker");
  });

  test("PUT /api/agents/:id/profile — non-existent returns 404", async () => {
    const { status } = await put(`/api/agents/${randomUUID()}/profile`, {
      body: { role: "ghost" },
    });
    expect(status).toBe(404);
  });

  test("PUT /api/agents/:id/activity — update activity timestamp", async () => {
    const { status } = await put(`/api/agents/${ids.workerAgent}/activity`);
    expect(status).toBe(204);
  });

  test("PUT /api/agents/:id/activity — non-existent still returns 204 (fire-and-forget)", async () => {
    // Activity endpoint doesn't validate agent existence; it just runs an UPDATE
    const { status } = await put(`/api/agents/${randomUUID()}/activity`);
    expect(status).toBe(204);
  });

  test("GET /api/agents/:id/setup-script — returns setup script", async () => {
    const { status, body } = await get(`/api/agents/${ids.workerAgent}/setup-script`);
    expect(status).toBe(200);
    expect(body).toBeDefined();
  });

  test("GET /api/agents/:id/setup-script — non-existent returns 404", async () => {
    const { status } = await get(`/api/agents/${randomUUID()}/setup-script`);
    expect(status).toBe(404);
  });

  test("GET /me — returns agent info", async () => {
    const { status, body } = await get("/me", { agentId: ids.workerAgent });
    expect(status).toBe(200);
    expect(body.id).toBe(ids.workerAgent);
  });

  test("POST /ping — heartbeat updates agent", async () => {
    const { status } = await post("/ping", { agentId: ids.workerAgent });
    expect(status).toBe(204);
  });

  test("POST /ping — non-existent agent returns 404", async () => {
    const { status } = await post("/ping", { agentId: randomUUID() });
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 3. Tasks
// ===========================================================================

describe("Tasks", () => {
  test("POST /api/tasks — missing task field returns 400", async () => {
    const { status, body } = await post("/api/tasks", { body: {} });
    expect(status).toBe(400);
    expect(body.error).toContain("task");
  });

  test("POST /api/tasks — create unassigned task", async () => {
    const { status, body } = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: {
        task: "Integration test task 1",
        taskType: "test",
        tags: ["automated"],
        priority: 75,
      },
    });
    expect(status).toBe(201);
    expect(body.id).toBeDefined();
    expect(body.task).toBe("Integration test task 1");
    ids.task = body.id;
  });

  test("POST /api/tasks — create assigned task", async () => {
    const { status, body } = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: {
        task: "Integration test task 2",
        agentId: ids.workerAgent,
      },
    });
    expect(status).toBe(201);
    expect(body.agentId).toBe(ids.workerAgent);
    ids.task2 = body.id;
  });

  test("GET /api/tasks — list all tasks", async () => {
    const { status, body } = await get("/api/tasks");
    expect(status).toBe(200);
    expect(body.tasks).toBeDefined();
    expect(Array.isArray(body.tasks)).toBe(true);
    expect(body.total).toBeGreaterThanOrEqual(2);
  });

  test("GET /api/tasks?status=pending — filter by status", async () => {
    const { status, body } = await get("/api/tasks?status=pending");
    expect(status).toBe(200);
    for (const t of body.tasks) {
      expect(t.status).toBe("pending");
    }
  });

  test("GET /api/tasks?agentId=... — filter by agent", async () => {
    const { status, body } = await get(`/api/tasks?agentId=${ids.workerAgent}`);
    expect(status).toBe(200);
    for (const t of body.tasks) {
      expect(t.agentId).toBe(ids.workerAgent);
    }
  });

  test("GET /api/tasks?search=... — search tasks", async () => {
    const { status, body } = await get("/api/tasks?search=Integration+test");
    expect(status).toBe(200);
    expect(body.tasks.length).toBeGreaterThanOrEqual(1);
  });

  test("GET /api/tasks?limit=1 — pagination", async () => {
    const { status, body } = await get("/api/tasks?limit=1");
    expect(status).toBe(200);
    expect(body.tasks.length).toBe(1);
    expect(body.total).toBeGreaterThanOrEqual(2);
  });

  test("GET /api/tasks/:id — get specific task", async () => {
    const { status, body } = await get(`/api/tasks/${ids.task}`);
    expect(status).toBe(200);
    expect(body.id).toBe(ids.task);
    expect(body.task).toBe("Integration test task 1");
  });

  test("GET /api/tasks/:id — non-existent returns 404", async () => {
    const { status } = await get(`/api/tasks/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("PUT /api/tasks/:id/session — update session ID", async () => {
    const sessionId = randomUUID();
    const { status, body } = await put(`/api/tasks/${ids.task2}/session`, {
      agentId: ids.workerAgent,
      body: { claudeSessionId: sessionId },
    });
    expect(status).toBe(200);
    expect(body.claudeSessionId).toBe(sessionId);
  });

  test("PUT /api/tasks/:id/session — missing fields returns 400", async () => {
    const { status } = await put(`/api/tasks/${ids.task2}/session`, {
      body: {},
    });
    expect(status).toBe(400);
  });

  test("POST /api/tasks/:id/finish — missing agent ID returns 400", async () => {
    const { status } = await post(`/api/tasks/${ids.task2}/finish`, {
      body: { status: "completed" },
    });
    expect(status).toBe(400);
  });

  test("POST /api/tasks/:id/finish — invalid status returns 400", async () => {
    const { status } = await post(`/api/tasks/${ids.task2}/finish`, {
      agentId: ids.workerAgent,
      body: { status: "invalid" },
    });
    expect(status).toBe(400);
  });

  test("POST /api/tasks/:id/finish — pending task returns alreadyFinished", async () => {
    // Task is in 'pending' status (not in_progress), so finish returns success with alreadyFinished flag
    const { status, body } = await post(`/api/tasks/${ids.task2}/finish`, {
      agentId: ids.workerAgent,
      body: { status: "completed", output: "Test output" },
    });
    expect(status).toBe(200);
    expect(body.success).toBe(true);
    expect(body.alreadyFinished).toBe(true);
  });

  test("POST /api/tasks/:id/finish — wrong agent returns 403", async () => {
    // Create a task for worker, try to finish as worker2
    const createRes = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: { task: "Forbidden finish test", agentId: ids.workerAgent },
    });
    const taskId = createRes.body.id;
    const { status } = await post(`/api/tasks/${taskId}/finish`, {
      agentId: ids.workerAgent2,
      body: { status: "completed" },
    });
    expect(status).toBe(403);
  });

  test("POST /api/tasks/:id/finish — non-existent task returns 404", async () => {
    const { status } = await post(`/api/tasks/${randomUUID()}/finish`, {
      agentId: ids.workerAgent,
      body: { status: "failed", failureReason: "Not found" },
    });
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 4. Task Pause / Resume
// ===========================================================================

describe("Task Pause & Resume", () => {
  let pauseTaskId: string;

  test("create a task to pause", async () => {
    const { body } = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: { task: "Pause test task", agentId: ids.workerAgent2 },
    });
    pauseTaskId = body.id;
  });

  test("POST /api/tasks/:id/pause — missing agent ID returns 400", async () => {
    const { status } = await post(`/api/tasks/${pauseTaskId}/pause`);
    expect(status).toBe(400);
  });

  test("POST /api/tasks/:id/pause — pause the task", async () => {
    const { status } = await post(`/api/tasks/${pauseTaskId}/pause`, {
      agentId: ids.workerAgent2,
    });
    // Pausing a pending task may succeed or fail depending on implementation
    expect([200, 400, 403]).toContain(status);
  });

  test("GET /api/paused-tasks — requires agent ID", async () => {
    const { status } = await get("/api/paused-tasks");
    expect(status).toBe(400);
  });

  test("GET /api/paused-tasks — returns paused tasks for agent", async () => {
    const { status } = await get("/api/paused-tasks", { agentId: ids.workerAgent2 });
    expect(status).toBe(200);
  });

  test("POST /api/tasks/:id/resume — non-existent returns 404", async () => {
    const { status } = await post(`/api/tasks/${randomUUID()}/resume`, {
      agentId: ids.workerAgent,
    });
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 4b. Task Cancel
// ===========================================================================

describe("Task Cancel", () => {
  let cancelTaskId: string;

  test("POST /api/tasks/:id/cancel — cancel pending task with reason", async () => {
    const { body: t } = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: { task: "Cancel test - pending task" },
    });
    cancelTaskId = t.id;

    const { status, body } = await post(`/api/tasks/${cancelTaskId}/cancel`, {
      body: { reason: "test cancellation" },
    });
    expect(status).toBe(200);
    expect(body.success).toBe(true);
    expect(body.task).toBeDefined();
    expect(body.task.status).toBe("cancelled");
    expect(body.task.failureReason).toContain("test cancellation");
  });

  test("POST /api/tasks/:id/cancel — already-cancelled task returns 400", async () => {
    // cancelTaskId was cancelled in the previous test
    const { status } = await post(`/api/tasks/${cancelTaskId}/cancel`);
    expect(status).toBe(400);
  });

  test("POST /api/tasks/:id/cancel — non-existent task returns 404", async () => {
    const { status } = await post(`/api/tasks/${randomUUID()}/cancel`);
    expect(status).toBe(404);
  });

  test("POST /api/tasks/:id/cancel — cancel without reason", async () => {
    const { body: t } = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: { task: "Cancel test - no reason" },
    });
    const { status, body } = await post(`/api/tasks/${t.id}/cancel`);
    expect(status).toBe(200);
    expect(body.success).toBe(true);
    expect(body.task.status).toBe("cancelled");
  });
});

// ===========================================================================
// 5. Cancelled Tasks
// ===========================================================================

describe("Cancelled Tasks", () => {
  test("GET /cancelled-tasks — missing agent ID returns 400", async () => {
    const { status } = await get("/cancelled-tasks");
    expect(status).toBe(400);
  });

  test("GET /cancelled-tasks — returns cancelled list for agent", async () => {
    const { status, body } = await get("/cancelled-tasks", { agentId: ids.workerAgent });
    expect(status).toBe(200);
    expect(body.cancelled).toBeDefined();
    expect(Array.isArray(body.cancelled)).toBe(true);
  });

  test("GET /cancelled-tasks?taskId=... — check specific task", async () => {
    const { status, body } = await get(`/cancelled-tasks?taskId=${ids.task}`, {
      agentId: ids.workerAgent,
    });
    expect(status).toBe(200);
    expect(body.cancelled).toBeDefined();
  });
});

// ===========================================================================
// 6. Session Logs
// ===========================================================================

describe("Session Logs", () => {
  const sessionId = randomUUID();

  test("POST /api/session-logs — missing sessionId returns 400", async () => {
    const { status, body } = await post("/api/session-logs", {
      body: { iteration: 1, lines: ["test"] },
    });
    expect(status).toBe(400);
    expect(body.error).toContain("sessionId");
  });

  test("POST /api/session-logs — missing iteration returns 400", async () => {
    const { status } = await post("/api/session-logs", {
      body: { sessionId, lines: ["test"] },
    });
    expect(status).toBe(400);
  });

  test("POST /api/session-logs — missing lines returns 400", async () => {
    const { status } = await post("/api/session-logs", {
      body: { sessionId, iteration: 1 },
    });
    expect(status).toBe(400);
  });

  test("POST /api/session-logs — store logs successfully", async () => {
    const { status, body } = await post("/api/session-logs", {
      body: {
        sessionId,
        taskId: ids.task,
        iteration: 1,
        lines: ["line 1", "line 2"],
      },
    });
    expect(status).toBe(201);
    expect(body.success).toBe(true);
    expect(body.count).toBe(2);
  });

  test("GET /api/tasks/:id/session-logs — get logs for task", async () => {
    const { status, body } = await get(`/api/tasks/${ids.task}/session-logs`);
    expect(status).toBe(200);
    expect(body.logs).toBeDefined();
  });

  test("GET /api/tasks/:id/session-logs — non-existent task returns 404", async () => {
    const { status } = await get(`/api/tasks/${randomUUID()}/session-logs`);
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 7. Session Costs
// ===========================================================================

describe("Session Costs", () => {
  const sessionId = randomUUID();

  test("POST /api/session-costs — missing sessionId returns 400", async () => {
    const { status } = await post("/api/session-costs", {
      body: { agentId: ids.workerAgent, totalCostUsd: 0.5 },
    });
    expect(status).toBe(400);
  });

  test("POST /api/session-costs — missing agentId returns 400", async () => {
    const { status } = await post("/api/session-costs", {
      body: { sessionId, totalCostUsd: 0.5 },
    });
    expect(status).toBe(400);
  });

  test("POST /api/session-costs — missing totalCostUsd returns 400", async () => {
    const { status } = await post("/api/session-costs", {
      body: { sessionId, agentId: ids.workerAgent },
    });
    expect(status).toBe(400);
  });

  test("POST /api/session-costs — store cost successfully", async () => {
    const { status, body } = await post("/api/session-costs", {
      body: {
        sessionId,
        agentId: ids.workerAgent,
        taskId: ids.task,
        totalCostUsd: 1.23,
        inputTokens: 5000,
        outputTokens: 2000,
        model: "opus",
        numTurns: 5,
        durationMs: 30000,
      },
    });
    expect(status).toBe(201);
    expect(body.success).toBe(true);
    expect(body.cost).toBeDefined();
  });

  test("GET /api/session-costs — list costs", async () => {
    const { status, body } = await get("/api/session-costs");
    expect(status).toBe(200);
    expect(body.costs).toBeDefined();
    expect(Array.isArray(body.costs)).toBe(true);
  });

  test("GET /api/session-costs/summary — get cost summary", async () => {
    const { status } = await get("/api/session-costs/summary");
    expect(status).toBe(200);
  });

  test("GET /api/session-costs/dashboard — get dashboard data", async () => {
    const { status } = await get("/api/session-costs/dashboard");
    expect(status).toBe(200);
  });
});

// ===========================================================================
// 8. Active Sessions
// ===========================================================================

describe("Active Sessions", () => {
  test("POST /api/active-sessions — missing fields returns 400", async () => {
    const { status } = await post("/api/active-sessions", {
      body: { agentId: ids.workerAgent },
    });
    expect(status).toBe(400);
  });

  test("POST /api/active-sessions — create session", async () => {
    const { status, body } = await post("/api/active-sessions", {
      body: {
        agentId: ids.workerAgent,
        taskId: ids.task,
        triggerType: "task",
        taskDescription: "Test session",
      },
    });
    expect(status).toBe(201);
    expect(body.session).toBeDefined();
    ids.session = body.session.id;
  });

  test("GET /api/active-sessions — list sessions", async () => {
    const { status, body } = await get("/api/active-sessions");
    expect(status).toBe(200);
    expect(body.sessions).toBeDefined();
    expect(Array.isArray(body.sessions)).toBe(true);
  });

  test("GET /api/active-sessions?agentId=... — filter by agent", async () => {
    const { status, body } = await get(`/api/active-sessions?agentId=${ids.workerAgent}`);
    expect(status).toBe(200);
    expect(body.sessions).toBeDefined();
  });

  test("PUT /api/active-sessions/heartbeat/:taskId — update heartbeat", async () => {
    const { status } = await put(`/api/active-sessions/heartbeat/${ids.task}`);
    expect(status).toBe(200);
  });

  test("DELETE /api/active-sessions/:id — delete by session ID", async () => {
    const { status } = await del(`/api/active-sessions/${ids.session}`);
    expect(status).toBe(200);
  });

  test("DELETE /api/active-sessions/by-task/:taskId — delete by task", async () => {
    // Create a session then delete by task
    await post("/api/active-sessions", {
      body: { agentId: ids.workerAgent2, taskId: ids.task, triggerType: "task" },
    });
    const { status } = await del(`/api/active-sessions/by-task/${ids.task}`);
    expect(status).toBe(200);
  });

  test("POST /api/active-sessions/cleanup — cleanup stale sessions", async () => {
    const { status, body } = await post("/api/active-sessions/cleanup", {
      body: { maxAgeMinutes: 1 },
    });
    expect(status).toBe(200);
    expect(typeof body.cleaned).toBe("number");
  });

  test("POST /api/active-sessions/cleanup — cleanup by agent", async () => {
    const { status, body } = await post("/api/active-sessions/cleanup", {
      body: { agentId: ids.workerAgent },
    });
    expect(status).toBe(200);
    expect(typeof body.cleaned).toBe("number");
  });
});

// ===========================================================================
// 9. Stats, Logs, Services, Scheduled Tasks
// ===========================================================================

describe("Stats & Metadata", () => {
  test("GET /api/stats — returns stats", async () => {
    const { status, body } = await get("/api/stats");
    expect(status).toBe(200);
    expect(body.agents).toBeDefined();
    expect(body.tasks).toBeDefined();
    expect(body.agents.total).toBeGreaterThanOrEqual(3);
  });

  test("GET /api/logs — returns logs", async () => {
    const { status, body } = await get("/api/logs");
    expect(status).toBe(200);
    expect(body.logs).toBeDefined();
    expect(Array.isArray(body.logs)).toBe(true);
  });

  test("GET /api/services — returns services list", async () => {
    const { status, body } = await get("/api/services");
    expect(status).toBe(200);
    expect(body.services).toBeDefined();
    expect(Array.isArray(body.services)).toBe(true);
  });

  test("GET /api/scheduled-tasks — returns scheduled tasks", async () => {
    const { status, body } = await get("/api/scheduled-tasks");
    expect(status).toBe(200);
    expect(body.scheduledTasks).toBeDefined();
    expect(Array.isArray(body.scheduledTasks)).toBe(true);
  });

  test("GET /api/concurrent-context — returns concurrency info", async () => {
    const { status } = await get("/api/concurrent-context");
    expect(status).toBe(200);
  });
});

// ===========================================================================
// 10. Polling
// ===========================================================================

describe("Polling", () => {
  test("GET /api/poll — requires agent ID", async () => {
    const { status } = await get("/api/poll");
    expect(status).toBe(400);
  });

  test("GET /api/poll — returns poll response for agent", async () => {
    const { status, body } = await get("/api/poll", { agentId: ids.workerAgent });
    expect(status).toBe(200);
    expect(body).toBeDefined();
  });

  test("GET /api/poll — task_assigned trigger carries a slim attachments projection", async () => {
    // Dedicated agent + task so this doesn't race other tests' fixtures for
    // the shared worker agents.
    const attachAgent = randomUUID();
    const registered = await post("/api/agents", {
      agentId: attachAgent,
      body: { name: "AttachmentPollWorker" },
    });
    expect(registered.status).toBe(201);

    const created = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: { task: "Task with an attachment", agentId: attachAgent },
    });
    expect(created.status).toBe(201);
    const taskId = created.body.id as string;

    // Upload via the real provider-agnostic route (same one PR #850 added) —
    // this is the endpoint the injected fetch recipe below points at.
    const upload = await fetch(`${BASE}/api/fs/tasks/${taskId}/files?name=IMG_1357.jpeg`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${TEST_API_KEY}`,
        "x-agent-id": ids.leadAgent,
        "Content-Type": "image/jpeg",
      },
      body: Buffer.from("fake-jpeg-bytes"),
    });
    expect(upload.status).toBe(201);
    const attachment = await upload.json();

    const { status, body } = await get("/api/poll", { agentId: attachAgent });
    expect(status).toBe(200);
    expect(body.trigger?.type).toBe("task_assigned");
    expect(body.trigger?.taskId).toBe(taskId);

    const attachments = body.trigger?.task?.attachments;
    expect(attachments).toHaveLength(1);
    expect(attachments[0].id).toBe(attachment.id);
    expect(attachments[0].name).toBe("IMG_1357.jpeg");
    // NOTE: mimeType is whatever the provider's head() reports, which has a
    // known pre-existing bug (local-fs infers it from the storage key rather
    // than the upload's real Content-Type) — not asserted here, out of scope
    // for this fix. What matters for the attachment-read fix is id/name.
    expect(attachments[0].mimeType).toBe(attachment.mimeType);
    // Slim projection — no need to ship the full capabilities/provider blob
    // over every poll response.
    expect(attachments[0]).not.toHaveProperty("capabilities");
    expect(attachments[0]).not.toHaveProperty("providerKey");
  });
});

// ===========================================================================
// 11b. Schedule CRUD
// ===========================================================================

describe("Schedule CRUD", () => {
  let scheduleId: string;

  test("POST /api/schedules — create schedule with cron expression", async () => {
    const { status, body } = await post("/api/schedules", {
      body: {
        name: "test-schedule",
        taskTemplate: "Run integration test suite",
        cronExpression: "0 * * * *",
      },
    });
    expect(status).toBe(201);
    expect(body.id).toBeDefined();
    expect(body.name).toBe("test-schedule");
    expect(body.nextRunAt).toBeDefined();
    expect(body.enabled).toBe(true);
    scheduleId = body.id;
  });

  test("POST /api/schedules — missing name returns 400", async () => {
    const { status } = await post("/api/schedules", {
      body: { taskTemplate: "do something" },
    });
    expect(status).toBe(400);
  });

  test("POST /api/schedules — missing taskTemplate returns 400", async () => {
    const { status } = await post("/api/schedules", {
      body: { name: "no-template" },
    });
    expect(status).toBe(400);
  });

  test("POST /api/schedules — invalid cron expression returns 400", async () => {
    const { status } = await post("/api/schedules", {
      body: {
        name: "bad-cron",
        taskTemplate: "do something",
        cronExpression: "not-a-cron",
      },
    });
    expect(status).toBe(400);
  });

  test("POST /api/schedules — duplicate name returns 409", async () => {
    const { status } = await post("/api/schedules", {
      body: {
        name: "test-schedule",
        taskTemplate: "duplicate",
        cronExpression: "0 * * * *",
      },
    });
    expect([400, 409]).toContain(status);
  });

  test("GET /api/schedules/:id — fetch single schedule", async () => {
    const { status, body } = await get(`/api/schedules/${scheduleId}`);
    expect(status).toBe(200);
    expect(body.id).toBe(scheduleId);
    expect(body.name).toBe("test-schedule");
    expect(body.taskTemplate).toBe("Run integration test suite");
  });

  test("GET /api/schedules/:id — non-existent returns 404", async () => {
    const { status } = await get(`/api/schedules/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("PUT /api/schedules/:id — update name", async () => {
    const { status, body } = await put(`/api/schedules/${scheduleId}`, {
      body: { name: "updated-schedule" },
    });
    expect(status).toBe(200);
    expect(body.name).toBe("updated-schedule");
  });

  test("PUT /api/schedules/:id — disable schedule clears nextRunAt", async () => {
    const { status, body } = await put(`/api/schedules/${scheduleId}`, {
      body: { enabled: false },
    });
    expect(status).toBe(200);
    expect(body.enabled).toBe(false);
    expect(body.nextRunAt).toBeFalsy();
  });

  test("PUT /api/schedules/:id — re-enable schedule recalculates nextRunAt", async () => {
    const { status, body } = await put(`/api/schedules/${scheduleId}`, {
      body: { enabled: true },
    });
    expect(status).toBe(200);
    expect(body.enabled).toBe(true);
    expect(body.nextRunAt).toBeDefined();
    expect(body.nextRunAt).not.toBeNull();
  });

  test("PUT /api/schedules/:id — non-existent returns 404", async () => {
    const { status } = await put(`/api/schedules/${randomUUID()}`, {
      body: { name: "ghost" },
    });
    expect(status).toBe(404);
  });

  test("PUT /api/schedules/:id — cron-based schedule accepts null intervalMs", async () => {
    // Reproduces CAI-1283: dashboard sends null for unused timing field
    const { status, body } = await put(`/api/schedules/${scheduleId}`, {
      body: { cronExpression: "0 2 * * *", intervalMs: null },
    });
    expect(status).toBe(200);
    expect(body.cronExpression).toBe("0 2 * * *");
    // intervalMs omitted from response when not set (null serialized as undefined in JSON)
    expect(body.intervalMs == null).toBe(true);
  });

  test("PUT /api/schedules/:id — interval-based schedule accepts null cronExpression", async () => {
    // Create an interval-based schedule to test against
    const { body: created } = await post("/api/schedules", {
      body: {
        name: "interval-test-cai-1283",
        taskTemplate: "interval task",
        intervalMs: 60000,
      },
    });
    const { status, body } = await put(`/api/schedules/${created.id}`, {
      body: { intervalMs: 60000, cronExpression: null },
    });
    expect(status).toBe(200);
    expect(body.intervalMs).toBe(60000);
    // Clean up
    await del(`/api/schedules/${created.id}`);
  });

  test("PUT /api/schedules/:id — both intervalMs and cronExpression null returns 400", async () => {
    const { status } = await put(`/api/schedules/${scheduleId}`, {
      body: { cronExpression: null, intervalMs: null },
    });
    expect(status).toBe(400);
  });

  test("POST /api/schedules/:id/run — run now creates a task", async () => {
    const { status, body } = await post(`/api/schedules/${scheduleId}/run`);
    expect(status).toBe(200);
    expect(body.schedule).toBeDefined();
    expect(body.task).toBeDefined();
    expect(body.task.id).toBeDefined();
  });

  test("POST /api/schedules/:id/run — propagates modelTier to the created task", async () => {
    const { body: created } = await post("/api/schedules", {
      body: {
        name: "model-tier-manual-run",
        taskTemplate: "Run model tier integration test",
        cronExpression: "0 * * * *",
        modelTier: "smart",
      },
    });

    const { status, body } = await post(`/api/schedules/${created.id}/run`);
    expect(status).toBe(200);
    expect(body.task).toBeDefined();
    expect(body.task.model).toBeUndefined();
    expect(body.task.modelTier).toBe("smart");

    await del(`/api/schedules/${created.id}`);
  });

  test("POST /api/schedules/:id/run — disabled schedule returns 400", async () => {
    // Disable the schedule first
    await put(`/api/schedules/${scheduleId}`, {
      body: { enabled: false },
    });
    const { status } = await post(`/api/schedules/${scheduleId}/run`);
    expect(status).toBe(400);
    // Re-enable for subsequent tests
    await put(`/api/schedules/${scheduleId}`, {
      body: { enabled: true },
    });
  });

  test("POST /api/schedules/:id/run — non-existent returns 404", async () => {
    const { status } = await post(`/api/schedules/${randomUUID()}/run`);
    expect(status).toBe(404);
  });

  test("DELETE /api/schedules/:id — delete schedule", async () => {
    const { status, body } = await del(`/api/schedules/${scheduleId}`);
    expect(status).toBe(200);
    expect(body.success).toBe(true);
  });

  test("DELETE /api/schedules/:id — non-existent returns 404", async () => {
    const { status } = await del(`/api/schedules/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("GET /api/schedules/:id — deleted schedule returns 404", async () => {
    const { status } = await get(`/api/schedules/${scheduleId}`);
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 12. Channels & Messages
// ===========================================================================
// Channel HTTP handler not yet implemented — tests removed.
// Re-add when /api/channels routes are created.

// ===========================================================================
// 13. Config
// ===========================================================================

describe("Config", () => {
  test("PUT /api/config — missing required fields returns 400", async () => {
    const { status } = await put("/api/config", {
      body: { scope: "global" },
    });
    expect(status).toBe(400);
  });

  test("PUT /api/config — create global config", async () => {
    const { status, body } = await put("/api/config", {
      body: {
        scope: "global",
        key: "TEST_CONFIG_KEY",
        value: "test_value",
        description: "Test config",
      },
    });
    expect(status).toBe(200);
    expect(body.key).toBe("TEST_CONFIG_KEY");
    ids.config = body.id;
  });

  test("PUT /api/config — agent scope requires scopeId", async () => {
    const { status, body } = await put("/api/config", {
      body: { scope: "agent", key: "AGENT_KEY", value: "v" },
    });
    expect(status).toBe(400);
    expect(body.error).toContain("scopeId");
  });

  test("PUT /api/config — create agent-scoped config", async () => {
    const { status, body } = await put("/api/config", {
      body: {
        scope: "agent",
        scopeId: ids.workerAgent,
        key: "AGENT_SPECIFIC",
        value: "agent_val",
      },
    });
    expect(status).toBe(200);
    expect(body.scope).toBe("agent");
  });

  test("GET /api/config — list all config entries", async () => {
    const { status, body } = await get("/api/config");
    expect(status).toBe(200);
    expect(body.configs).toBeDefined();
    expect(Array.isArray(body.configs)).toBe(true);
  });

  test("GET /api/config/:id — get specific config", async () => {
    const { status, body } = await get(`/api/config/${ids.config}`);
    expect(status).toBe(200);
    expect(body.key).toBe("TEST_CONFIG_KEY");
  });

  test("GET /api/config/:id — non-existent returns 404", async () => {
    const { status } = await get(`/api/config/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("GET /api/config/resolved — get merged config", async () => {
    const { status } = await get("/api/config/resolved");
    expect(status).toBe(200);
  });

  test("GET /api/config/resolved?agentId=... — with agent scope", async () => {
    const { status } = await get(`/api/config/resolved?agentId=${ids.workerAgent}`);
    expect(status).toBe(200);
  });

  test("DELETE /api/config/:id — delete config", async () => {
    // Create a config to delete
    const createRes = await put("/api/config", {
      body: { scope: "global", key: "DELETE_ME", value: "bye" },
    });
    const configId = createRes.body.id;
    const { status } = await del(`/api/config/${configId}`);
    expect(status).toBe(200);
  });

  test("DELETE /api/config/:id — non-existent returns 404", async () => {
    const { status } = await del(`/api/config/${randomUUID()}`);
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 14. Repos
// ===========================================================================

describe("Repos", () => {
  test("POST /api/repos — missing fields returns 400", async () => {
    const { status } = await post("/api/repos", {
      body: { name: "test-repo" },
    });
    expect(status).toBe(400);
  });

  test("POST /api/repos — create repo", async () => {
    const { status, body } = await post("/api/repos", {
      body: {
        name: "test-repo",
        url: "https://github.com/test-org/test-repo",
        defaultBranch: "main",
        description: "Test repository",
      },
    });
    expect(status).toBe(201);
    expect(body.id).toBeDefined();
    expect(body.name).toBe("test-repo");
    expect(body.clonePath).toBe("/workspace/personal/repos/test-repo");
    expect(body.defaultBranch).toBe("main");
    expect(body.autoClone).toBe(true);
    expect(body.hooks).toEqual({ enabled: true });
    ids.repo = body.id;
  });

  test("POST /api/repos — duplicate URL returns 409", async () => {
    const { status } = await post("/api/repos", {
      body: {
        name: "test-repo-dup",
        url: "https://github.com/test-org/test-repo",
      },
    });
    expect(status).toBe(409);
  });

  test("GET /api/repos — list repos", async () => {
    const { status, body } = await get("/api/repos");
    expect(status).toBe(200);
    expect(body.repos).toBeDefined();
    expect(Array.isArray(body.repos)).toBe(true);
  });

  test("GET /api/repos/:id — get specific repo", async () => {
    const { status, body } = await get(`/api/repos/${ids.repo}`);
    expect(status).toBe(200);
    expect(body.name).toBe("test-repo");
  });

  test("GET /api/repos/:id — non-existent returns 404", async () => {
    const { status } = await get(`/api/repos/${randomUUID()}`);
    expect(status).toBe(404);
  });

  test("PUT /api/repos/:id — update repo", async () => {
    const { status, body } = await put(`/api/repos/${ids.repo}`, {
      body: { defaultBranch: "develop" },
    });
    expect(status).toBe(200);
    expect(body.defaultBranch).toBe("develop");
  });

  test("PUT /api/repos/:id — non-existent returns 404", async () => {
    const { status } = await put(`/api/repos/${randomUUID()}`, {
      body: { description: "Ghost" },
    });
    expect(status).toBe(404);
  });

  test("DELETE /api/repos/:id — delete repo", async () => {
    // Create a repo to delete
    const createRes = await post("/api/repos", {
      body: { name: "delete-me", url: "https://github.com/test-org/delete-me" },
    });
    const repoId = createRes.body.id;
    const { status } = await del(`/api/repos/${repoId}`);
    expect(status).toBe(200);
  });

  test("DELETE /api/repos/:id — non-existent returns 404", async () => {
    const { status } = await del(`/api/repos/${randomUUID()}`);
    expect(status).toBe(404);
  });
});

// ===========================================================================
// 15. Memory
// ===========================================================================

describe("Memory", () => {
  test("POST /api/memory/index — missing required fields returns 400", async () => {
    const { status } = await post("/api/memory/index", {
      body: {},
    });
    expect(status).toBe(400);
  });

  test("POST /api/memory/index — index content (returns 202)", async () => {
    const { status, body } = await post("/api/memory/index", {
      agentId: ids.workerAgent,
      body: {
        content: "This is a test memory about API integration testing patterns.",
        name: "test-memory",
        scope: "agent",
        source: "manual",
      },
    });
    expect(status).toBe(202);
    expect(body.queued).toBe(true);
    expect(body.memoryIds).toBeDefined();
  });

  test("POST /api/memory/index — gates runner session summaries for automatic task classes", async () => {
    const automaticCases = [
      { label: "schedule source", source: "schedule", taskType: "maintenance", tags: [] },
      { label: "system source", source: "system", taskType: "maintenance", tags: [] },
      { label: "scheduled tag", source: "mcp", taskType: "maintenance", tags: ["scheduled"] },
      { label: "schedule tag", source: "mcp", taskType: "maintenance", tags: ["schedule:test"] },
      {
        label: "auto-generated tag",
        source: "mcp",
        taskType: "maintenance",
        tags: ["auto-generated"],
      },
      { label: "heartbeat", source: "mcp", taskType: "heartbeat", tags: [] },
      { label: "heartbeat checklist", source: "mcp", taskType: "heartbeat-checklist", tags: [] },
      { label: "boot triage", source: "mcp", taskType: "boot-triage", tags: [] },
      { label: "health check", source: "mcp", taskType: "health-check", tags: [] },
      {
        label: "monitor suffix",
        source: "mcp",
        taskType: "claude-code-changelog-monitor",
        tags: [],
      },
      { label: "digest suffix", source: "mcp", taskType: "daily-blocker-digest", tags: [] },
    ];

    for (const taskCase of automaticCases) {
      const task = await post("/api/tasks", {
        agentId: ids.leadAgent,
        body: {
          task: `Automatic memory integration test: ${taskCase.label}`,
          agentId: ids.workerAgent,
          source: taskCase.source,
          taskType: taskCase.taskType,
          tags: taskCase.tags,
        },
      });
      expect(task.status).toBe(201);

      const { status, body } = await post("/api/memory/index", {
        agentId: ids.workerAgent,
        body: {
          content: `Runner summary that should not persist for ${taskCase.label}.`,
          name: `automatic-session-summary-${taskCase.label}`,
          scope: "agent",
          source: "session_summary",
          sourceTaskId: task.body.id,
        },
      });
      expect(status).toBe(202);
      expect(body.queued).toBe(false);
      expect(body.memoryIds).toEqual([]);
      expect(body.skipped).toBe("automatic_task_memory_disabled");
    }
  });

  test("POST /api/memory/index — lets runner session summaries opt in for automatic tasks", async () => {
    const task = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: {
        task: "Scheduled memory integration opt-in test",
        agentId: ids.workerAgent,
        source: "schedule",
        taskType: "daily-digest",
        tags: ["schedule:test"],
      },
    });
    expect(task.status).toBe(201);

    const { status, body } = await post("/api/memory/index", {
      agentId: ids.workerAgent,
      body: {
        content: "Runner summary with reusable learning that explicitly opts into persistence.",
        name: "automatic-session-summary-opt-in",
        scope: "agent",
        source: "session_summary",
        sourceTaskId: task.body.id,
        persistMemory: true,
      },
    });
    expect(status).toBe(202);
    expect(body.queued).toBe(true);
    expect(body.memoryIds.length).toBeGreaterThan(0);
  });

  test("POST /api/memory/index — keeps runner session summaries for manual tasks", async () => {
    const task = await post("/api/tasks", {
      agentId: ids.leadAgent,
      body: {
        task: "Manual memory integration test",
        agentId: ids.workerAgent,
      },
    });
    expect(task.status).toBe(201);

    const { status, body } = await post("/api/memory/index", {
      agentId: ids.workerAgent,
      body: {
        content: "Runner summary that should persist for a manual task.",
        name: "manual-session-summary",
        scope: "agent",
        source: "session_summary",
        sourceTaskId: task.body.id,
      },
    });
    expect(status).toBe(202);
    expect(body.queued).toBe(true);
    expect(body.memoryIds.length).toBeGreaterThan(0);

    const memory = await get(`/api/memory/${body.memoryIds[0]}`, { agentId: ids.workerAgent });
    expect(memory.status).toBe(200);
    expect(memory.body.memory.sourceTaskId).toBe(task.body.id);
  });

  test("POST /api/memory/search — missing query returns 400", async () => {
    const { status } = await post("/api/memory/search", {
      body: {},
    });
    expect(status).toBe(400);
  });

  test("POST /api/memory/search — search with valid query", async () => {
    const { status } = await post("/api/memory/search", {
      agentId: ids.workerAgent,
      body: { query: "integration testing", limit: 5 },
    });
    // May return 200 (success) or 500 (no OPENAI_API_KEY for embeddings)
    expect([200, 500]).toContain(status);
  });
});

// ===========================================================================
// 16. Ecosystem
// ===========================================================================

describe("Ecosystem", () => {
  test("GET /ecosystem — missing agent ID header returns 400", async () => {
    const { status } = await get("/ecosystem");
    expect(status).toBe(400);
  });

  test("GET /ecosystem — returns ecosystem config for agent", async () => {
    const { status, body } = await get("/ecosystem", { agentId: ids.workerAgent });
    expect(status).toBe(200);
    expect(body.apps).toBeDefined();
    expect(Array.isArray(body.apps)).toBe(true);
  });
});

// ===========================================================================
// 17. Close Agent (run near end as it changes agent state)
// ===========================================================================

describe("Close Agent", () => {
  test("POST /close — close agent session", async () => {
    // Create a disposable agent to close
    const closeAgentId = randomUUID();
    await post("/api/agents", {
      agentId: closeAgentId,
      body: { name: "DisposableAgent" },
    });

    const { status } = await post("/close", { agentId: closeAgentId });
    expect(status).toBe(204);

    // Verify agent is now offline
    const { body } = await get(`/api/agents/${closeAgentId}`);
    expect(body.status).toBe("offline");
  });

  test("POST /close — non-existent agent returns 404", async () => {
    const { status } = await post("/close", { agentId: randomUUID() });
    expect(status).toBe(404);
  });
});

// ===========================================================================
// AgentMail Webhooks
// ===========================================================================

// ---------------------------------------------------------------------------
// Workflows
// ---------------------------------------------------------------------------

describe("Workflows", () => {
  let workflowId: string;

  test("POST /api/workflows — create workflow", async () => {
    const { status, body } = await post("/api/workflows", {
      body: {
        name: "integration-test-wf",
        definition: {
          nodes: [
            { id: "a", type: "agent-task", config: { template: "Hello" }, next: "b" },
            { id: "b", type: "agent-task", config: { template: "World" } },
          ],
        },
      },
    });
    expect(status).toBe(201);
    expect(body.id).toBeDefined();
    expect(body.definition.nodes).toHaveLength(2);
    workflowId = body.id;
  });

  test("GET /api/workflows — list workflows", async () => {
    const { status, body } = await get("/api/workflows");
    expect(status).toBe(200);
    expect(Array.isArray(body)).toBe(true);
    expect(body.some((w: { id: string }) => w.id === workflowId)).toBe(true);
  });

  test("GET /api/workflows/:id — get workflow", async () => {
    const { status, body } = await get(`/api/workflows/${workflowId}`);
    expect(status).toBe(200);
    expect(body.name).toBe("integration-test-wf");
    expect(body.edges).toBeDefined(); // auto-generated edges
  });

  test("PUT /api/workflows/:id — update workflow", async () => {
    const { status, body } = await put(`/api/workflows/${workflowId}`, {
      body: { name: "renamed-wf" },
    });
    expect(status).toBe(200);
    expect(body.name).toBe("renamed-wf");
  });

  test("PATCH /api/workflows/:id — bulk patch (create + update nodes)", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}`, {
      body: {
        create: [{ id: "c", type: "agent-task", config: { template: "New" } }],
        update: [{ nodeId: "b", node: { next: "c" } }],
      },
    });
    expect(status).toBe(200);
    expect(body.definition.nodes).toHaveLength(3);
    const nodeB = body.definition.nodes.find((n: { id: string }) => n.id === "b");
    expect(nodeB.next).toBe("c");
  });

  test("PATCH /api/workflows/:id — bulk patch (delete + replace node)", async () => {
    // State: a → b → c. Delete c, create d, rewire b → d.
    const { status, body } = await patch(`/api/workflows/${workflowId}`, {
      body: {
        delete: ["c"],
        create: [{ id: "d", type: "agent-task", config: { template: "Replacement" } }],
        update: [{ nodeId: "b", node: { next: "d" } }],
      },
    });
    expect(status).toBe(200);
    expect(body.definition.nodes).toHaveLength(3); // a, b, d
    expect(body.definition.nodes.find((n: { id: string }) => n.id === "c")).toBeUndefined();
    expect(body.definition.nodes.find((n: { id: string }) => n.id === "d")).toBeDefined();
  });

  test("PATCH /api/workflows/:id — patch onNodeFailure", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}`, {
      body: { onNodeFailure: "continue" },
    });
    expect(status).toBe(200);
    expect(body.definition.onNodeFailure).toBe("continue");
  });

  test("PATCH /api/workflows/:id — 400 on non-existent delete", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}`, {
      body: { delete: ["nonexistent"] },
    });
    expect(status).toBe(400);
    expect(body.error).toContain("non-existent");
  });

  test("PATCH /api/workflows/:id — 400 on broken next ref", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}`, {
      body: { update: [{ nodeId: "b", node: { next: "ghost" } }] },
    });
    expect(status).toBe(400);
    expect(body.error).toContain("non-existent");
  });

  test("PATCH /api/workflows/:id/nodes/:nodeId — single node patch", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}/nodes/b`, {
      body: { label: "Updated Label", config: { template: "Changed" } },
    });
    expect(status).toBe(200);
    const nodeB = body.definition.nodes.find((n: { id: string }) => n.id === "b");
    expect(nodeB.label).toBe("Updated Label");
    expect(nodeB.config.template).toBe("Changed");
  });

  test("PATCH /api/workflows/:id/nodes/:nodeId — 400 on non-existent node", async () => {
    const { status, body } = await patch(`/api/workflows/${workflowId}/nodes/nope`, {
      body: { label: "x" },
    });
    expect(status).toBe(400);
    expect(body.error).toContain("non-existent");
  });

  test("GET /api/workflows/:id/versions — version history", async () => {
    const { status, body } = await get(`/api/workflows/${workflowId}/versions`);
    expect(status).toBe(200);
    // Multiple patches should have created multiple versions
    expect(body.versions.length).toBeGreaterThanOrEqual(1);
  });

  test("DELETE /api/workflows/:id — delete workflow", async () => {
    const { status } = await del(`/api/workflows/${workflowId}`);
    expect(status).toBe(204);
  });

  test("GET /api/workflows/:id — 404 after delete", async () => {
    const { status } = await get(`/api/workflows/${workflowId}`);
    expect(status).toBe(404);
  });

  test("PATCH /api/workflows/:id — 404 for deleted workflow", async () => {
    const { status } = await patch(`/api/workflows/${workflowId}`, {
      body: { create: [{ id: "x", type: "agent-task", config: {} }] },
    });
    expect(status).toBe(404);
  });
});

describe("AgentMail Webhooks (disabled)", () => {
  test("POST /api/agentmail/webhook returns 503 when disabled", async () => {
    const { status, body } = await post("/api/agentmail/webhook", {
      body: { type: "event", event_type: "message.received", event_id: "test-1" },
    });
    expect(status).toBe(503);
    expect(body.error).toContain("not configured");
  });
});

describe("AgentMail Webhooks (with filters)", () => {
  const AGENTMAIL_PORT = 19877 + 8; // avoid colliding with page-proxy route tests
  const AGENTMAIL_DB = `/tmp/test-agentmail-${Date.now()}.sqlite`;
  const AGENTMAIL_BASE = `http://localhost:${AGENTMAIL_PORT}`;
  const WEBHOOK_SECRET = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"; // test-only secret
  let agentmailProc: Subprocess;

  function signPayload(payload: unknown): { body: string; headers: Record<string, string> } {
    const wh = new Webhook(WEBHOOK_SECRET);
    const msgId = `msg_${randomUUID()}`;
    const timestamp = new Date();
    const body = JSON.stringify(payload);
    const signature = wh.sign(msgId, timestamp, body);
    return {
      body,
      headers: {
        "svix-id": msgId,
        "svix-timestamp": Math.floor(timestamp.getTime() / 1000).toString(),
        "svix-signature": signature,
      },
    };
  }

  async function postWebhook(payload: unknown): Promise<{ status: number; body: unknown }> {
    const signed = signPayload(payload);
    const res = await fetch(`${AGENTMAIL_BASE}/api/agentmail/webhook`, {
      method: "POST",
      headers: { "Content-Type": "application/json", ...signed.headers },
      body: signed.body,
    });
    const text = await res.text();
    let parsed: unknown;
    try {
      parsed = JSON.parse(text);
    } catch {
      parsed = text;
    }
    return { status: res.status, body: parsed };
  }

  function makePayload(
    overrides: { inboxId?: string; from?: string | string[]; eventId?: string } = {},
  ) {
    return {
      type: "event",
      event_type: "message.received",
      event_id: overrides.eventId ?? randomUUID(),
      message: {
        message_id: randomUUID(),
        thread_id: randomUUID(),
        inbox_id: overrides.inboxId ?? "bot@x.dev",
        organization_id: "org-1",
        from_: overrides.from ?? "alice@a.com",
        to: [overrides.inboxId ?? "bot@x.dev"],
        cc: [],
        bcc: [],
        reply_to: [],
        subject: "Test",
        preview: "Test email",
        text: "Hello",
        html: null,
        labels: [],
        attachments: [],
        in_reply_to: null,
        references: [],
        timestamp: new Date().toISOString(),
        created_at: new Date().toISOString(),
        updated_at: new Date().toISOString(),
      },
    };
  }

  beforeAll(async () => {
    try {
      await unlink(AGENTMAIL_DB);
    } catch {}
    try {
      await unlink(`${AGENTMAIL_DB}-wal`);
    } catch {}
    try {
      await unlink(`${AGENTMAIL_DB}-shm`);
    } catch {}

    agentmailProc = Bun.spawn(["bun", "src/http.ts"], {
      cwd: `${import.meta.dir}/../..`,
      env: {
        ...process.env,
        PORT: String(AGENTMAIL_PORT),
        DATABASE_PATH: AGENTMAIL_DB,
        API_KEY: "",
        CAPABILITIES: "core,task-pool,messaging,profiles",
        SLACK_BOT_TOKEN: "",
        GITHUB_WEBHOOK_SECRET: "",
        AGENTMAIL_WEBHOOK_SECRET: WEBHOOK_SECRET,
        AGENTMAIL_INBOX_DOMAIN_FILTER: "x.dev,y.xyz",
        AGENTMAIL_SENDER_DOMAIN_FILTER: "a.com,b.com",
      },
      stdout: "ignore",
      stderr: "ignore",
    });

    await waitForServer(`${AGENTMAIL_BASE}/health`);

    // Register a lead agent so messages can be routed
    await fetch(`${AGENTMAIL_BASE}/api/agents`, {
      method: "POST",
      headers: { "Content-Type": "application/json", "x-agent-id": randomUUID() },
      body: JSON.stringify({ name: "TestLead", isLead: true }),
    });
  }, 20000);

  afterAll(async () => {
    if (agentmailProc) {
      agentmailProc.kill();
      try {
        await agentmailProc.exited;
      } catch {}
    }
    await Bun.sleep(50);
    try {
      await unlink(AGENTMAIL_DB);
    } catch {}
    try {
      await unlink(`${AGENTMAIL_DB}-wal`);
    } catch {}
    try {
      await unlink(`${AGENTMAIL_DB}-shm`);
    } catch {}
  });

  test("rejects unsigned webhook with 401", async () => {
    const res = await fetch(`${AGENTMAIL_BASE}/api/agentmail/webhook`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(makePayload()),
    });
    expect(res.status).toBe(401);
  });

  test("accepts signed webhook with allowed inbox + sender", async () => {
    const { status, body } = await postWebhook(
      makePayload({ inboxId: "bot@x.dev", from: "alice@a.com" }),
    );
    expect(status).toBe(200);
    expect(body).toEqual({ received: true });
  });

  test.each([
    "message.received",
    "message.received.unauthenticated",
  ])("accepts webhook for allowed event type '%s'", async (eventType) => {
    const { status } = await postWebhook({
      ...makePayload({ inboxId: "support@y.xyz", from: "bob@b.com" }),
      event_type: eventType,
    });
    expect(status).toBe(200);
  });

  test("filters out disallowed inbox domain (returns 200 but no processing)", async () => {
    // The server returns 200 before filtering (Svix best practice),
    // so we verify by checking that no task was created for a disallowed inbox.
    const { status } = await postWebhook(
      makePayload({ inboxId: "bot@evil.com", from: "alice@a.com" }),
    );
    expect(status).toBe(200);
  });

  test("filters out disallowed sender domain (returns 200 but no processing)", async () => {
    const { status } = await postWebhook(
      makePayload({ inboxId: "bot@x.dev", from: "hacker@evil.org" }),
    );
    expect(status).toBe(200);
  });

  test("filters out when sender is array of disallowed domains", async () => {
    const { status } = await postWebhook(
      makePayload({ inboxId: "bot@x.dev", from: ["hacker@evil.org", "spam@bad.net"] }),
    );
    expect(status).toBe(200);
  });

  test("allows when at least one sender in array matches", async () => {
    const { status } = await postWebhook(
      makePayload({ inboxId: "bot@x.dev", from: ["hacker@evil.org", "alice@a.com"] }),
    );
    expect(status).toBe(200);
  });
});