test(handlers): fix delegation and MCP tests exposed by full platform suite

Commit b9311134 added a CanCommunicate hierarchy check to proxyA2ARequest. The executeDelegation tests call proxyA2ARequest directly but did not mock the workspace hierarchy lookup, causing sqlmock to reject the unexpected queries and fall through to the DELEGATION_FAILED path. Fix: add mockCanCommunicate(mock, testSourceID, testTargetID, true) to each affected executeDelegation test so the hierarchy check returns true and the proxy is actually called. Separately, TestMCPHandler_CommitMemory_GlobalScope_Blocked expected zero DB calls (the handler should block GLOBAL scope before any DB work). With no memv2 wired, toolCommitMemory fell through to the legacy shim, which called scopeToWritableNamespace before the scope check. Fix: wire memv2 via withMemoryV2APIs(nil, nil) in newMCPHandler so the v2 path is taken and the GLOBAL scope check fires before any DB call. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ci: trigger fresh CI run for log diagnostics
2026-05-11 21:30:50 +00:00 · 2026-05-11 21:30:50 +00:00 · 2026-05-11 21:30:50 +00:00 · 2026-05-11 21:30:50 +00:00 · 2026-05-11 21:30:50 +00:00 · 2026-05-11 21:30:50 +00:00
60 changed files with 402 additions and 9422 deletions
@@ -1,673 +0,0 @@
-#!/usr/bin/env python3
-"""status-reaper — Option B compensating-status POST for Gitea 1.22.6's
-hardcoded `(push)` suffix on default-branch commit statuses.
-
-Tracking: this PR (workflow + script + tests + audit issue). Sibling
-bots: internal#327 (publish-runtime-bot), internal#328 (mc-drift-bot).
-Upstream RFC: internal#80. Persona provisioned by sub-agent aefaac1b
-(2026-05-11 21:39Z; Gitea uid 94, scope=write:repository).
-
-What this script does, per `.gitea/workflows/status-reaper.yml` invocation:
-
-  1. Walk `.gitea/workflows/*.yml`. For each file, build the workflow_id
-     using this resolution (per hongming-pc 22:08Z review):
-       - If YAML has top-level `name:` → use that.
-       - Else → use filename stem (basename minus `.yml`).
-     Fail-LOUD on:
-       - Two workflows resolving to the SAME identifier (collision).
-       - Any identifier containing `/` (it would break context parsing
-         downstream — Gitea uses ` / ` as the workflow/job separator).
-     Classify each by whether `on:` contains a `push:` trigger.
-
-  2. List the last N (=10) commits on WATCH_BRANCH via
-     GET /repos/{o}/{r}/commits?sha={branch}&limit={N}. rev2 sweeps
-     N commits per tick instead of HEAD only — schedule workflows
-     post `failure` to whatever SHA was HEAD when they COMPLETED, so
-     by the next */5 tick main has often moved forward and the red
-     gets stranded on a stale commit (Phase 1+2 evidence: rev1 saw
-     `compensated:0` every tick across ~6 cycles).
-
-  3. For EACH SHA in the list:
-       - GET combined commit status. Per-SHA error isolation
-         (refinement #7): if this call raises ApiError or any 5xx,
-         LOG `::warning::` + continue to the next SHA. Different from
-         the single-HEAD pre-rev2 path where fail-loud was correct;
-         the sweep is best-effort across historical commits, so one
-         transient blip on a stale SHA must not strand reds on the
-         OTHER stale SHAs.
-       - If combined.state == "success": skip — cost optimization
-         (refinement #2), common case (most commits are green).
-       - Otherwise iterate per-context entries. For each entry where:
-           state == "failure" AND context.endswith(" (push)")
-         Parse context as `<workflow_name> / <job_name> (push)`.
-         Look up workflow_name in the trigger map:
-           - missing → log ::notice:: and skip (conservative).
-           - has_push_trigger=True → preserve (real defect signal).
-           - has_push_trigger=False → POST a compensating
-             `state=success` status to /statuses/{sha} with the same
-             context (Gitea de-dups by context) and a description
-             documenting the workaround + this script's path.
-
-  4. Exit 0. Re-running is idempotent — Gitea's commit-status table
-     stores the LATEST state-per-context, so the success POST sticks
-     even if another tick happens before the runner finishes.
-
-What it does NOT do:
-  - Touch any context NOT ending in ` (push)`. The required-checks on
-    main (verified 2026-05-11) all have ` (pull_request)` suffixes;
-    they CANNOT be reached by this code path.
-  - Compensate `error`/`pending` states. Only `failure` — the only one
-    Gitea emits for the hardcoded-suffix bug.
-  - Write to non-default branches. WATCH_BRANCH is sourced from
-    `github.event.repository.default_branch` in the workflow.
-  - Mutate workflows or runs. The Actions UI still shows the
-    underlying schedule-triggered run as failed; this script edits
-    the commit-status surface only.
-
-Halt conditions (script-level — orchestrator-level halts are in the
-workflow comments):
-  - PyYAML missing → fail-loud at import (no fallback parse).
-  - Workflow `name:` collision → exit 1 with ::error:: message.
-  - Workflow `name:` containing `/` → exit 1 with ::error:: message.
-  - Ambiguous `on:` shape (e.g. neither str/list/dict) → treat as
-    "has_push_trigger=True" and log ::notice:: (preserve, never
-    compensate the unknown).
-  - api() non-2xx → raise ApiError, fail the workflow run loudly so
-    a subsequent tick retries (per
-    `feedback_api_helper_must_raise_not_return_dict`).
-
-Local dry-run (no network):
-    GITEA_TOKEN=... GITEA_HOST=git.moleculesai.app REPO=owner/repo \\
-      WATCH_BRANCH=main WORKFLOWS_DIR=.gitea/workflows \\
-      python3 .gitea/scripts/status-reaper.py --dry-run
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-import urllib.error
-import urllib.parse
-import urllib.request
-from pathlib import Path
-from typing import Any
-
-import yaml  # PyYAML 6.0.2 — installed by the workflow before this runs.
-
-
-# --------------------------------------------------------------------------
-# Environment
-# --------------------------------------------------------------------------
-def _env(key: str, *, default: str = "") -> str:
-    """Read an env var with a default. Module-import-safe — tests can
-    import this script without setting the full env contract."""
-    return os.environ.get(key, default)
-
-
-GITEA_TOKEN = _env("GITEA_TOKEN")
-GITEA_HOST = _env("GITEA_HOST")
-REPO = _env("REPO")
-WATCH_BRANCH = _env("WATCH_BRANCH", default="main")
-WORKFLOWS_DIR = _env("WORKFLOWS_DIR", default=".gitea/workflows")
-
-OWNER, NAME = (REPO.split("/", 1) + [""])[:2] if REPO else ("", "")
-API = f"https://{GITEA_HOST}/api/v1" if GITEA_HOST else ""
-
-# Compensating-status description prefix. Used as the marker so a human
-# auditing commit statuses can tell at a glance that the green was
-# synthetic, not a real CI pass. Kept stable; downstream tooling
-# (e.g. main-red-watchdog visual diff) MAY key on it.
-COMPENSATION_DESCRIPTION = (
-    "Compensated by status-reaper (workflow has no push: trigger; "
-    "Gitea 1.22.6 hardcoded-suffix bug — see .gitea/scripts/status-reaper.py)"
-)
-
-# Context suffix the reaper acts on. Gitea hardcodes this for ALL
-# default-branch workflow runs.
-PUSH_SUFFIX = " (push)"
-
-
-def _require_runtime_env() -> None:
-    """Enforce env contract — called from `main()` only.
-
-    Tests import individual functions without setting the full env
-    contract. Mirrors `main-red-watchdog.py`/`ci-required-drift.py`.
-    """
-    for key in ("GITEA_TOKEN", "GITEA_HOST", "REPO", "WATCH_BRANCH", "WORKFLOWS_DIR"):
-        if not os.environ.get(key):
-            sys.stderr.write(f"::error::missing required env var: {key}\n")
-            sys.exit(2)
-
-
-# --------------------------------------------------------------------------
-# Tiny HTTP helper — raises on non-2xx + on JSON-decode-of-expected-JSON.
-# --------------------------------------------------------------------------
-class ApiError(RuntimeError):
-    """Raised when a Gitea API call cannot be trusted to have succeeded.
-
-    Per `feedback_api_helper_must_raise_not_return_dict`: soft-failure is
-    opt-in via `expect_json=False`, never the default. A pre-fix
-    implementation that returned `{}` on non-2xx would skip the
-    compensating POST on a transient outage AND silently lose the
-    failed-status enumeration, painting main green via omission.
-    """
-
-
-def api(
-    method: str,
-    path: str,
-    *,
-    body: dict | None = None,
-    query: dict[str, str] | None = None,
-    expect_json: bool = True,
-) -> tuple[int, Any]:
-    """Tiny HTTP helper around urllib. Same contract as
-    `main-red-watchdog.py` and `ci-required-drift.py` so behaviour
-    is cross-checkable."""
-    url = f"{API}{path}"
-    if query:
-        url = f"{url}?{urllib.parse.urlencode(query)}"
-    data = None
-    headers = {
-        "Authorization": f"token {GITEA_TOKEN}",
-        "Accept": "application/json",
-    }
-    if body is not None:
-        data = json.dumps(body).encode("utf-8")
-        headers["Content-Type"] = "application/json"
-    req = urllib.request.Request(url, method=method, data=data, headers=headers)
-    try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            raw = resp.read()
-            status = resp.status
-    except urllib.error.HTTPError as e:
-        raw = e.read()
-        status = e.code
-
-    if not (200 <= status < 300):
-        snippet = raw[:500].decode("utf-8", errors="replace") if raw else ""
-        raise ApiError(f"{method} {path} -> HTTP {status}: {snippet}")
-
-    if not raw:
-        return status, None
-    try:
-        return status, json.loads(raw)
-    except json.JSONDecodeError as e:
-        if expect_json:
-            raise ApiError(
-                f"{method} {path} -> HTTP {status} but body is not JSON: {e}"
-            ) from e
-        return status, {"_raw": raw.decode("utf-8", errors="replace")}
-
-
-# --------------------------------------------------------------------------
-# Workflow scan + classification
-# --------------------------------------------------------------------------
-def _on_block(doc: dict) -> Any:
-    """Extract the `on:` block from a parsed YAML doc.
-
-    PyYAML parses bareword `on:` as Python `True` (YAML 1.1 boolean
-    spec — `on/off/yes/no` are booleans). The actual key in the dict
-    is therefore `True`, NOT the string `"on"`. We accept both for
-    forward-compat with YAML 1.2 loaders (which keep it as `"on"`).
-    """
-    if True in doc:
-        return doc[True]
-    return doc.get("on")
-
-
-def _has_push_trigger(on_block: Any, workflow_id: str) -> bool:
-    """Return True if `on:` block declares a `push` trigger.
-
-    Accepts the three common shapes:
-      - str: `on: push` → True only if == "push"
-      - list: `on: [push, pull_request]` → True if "push" in list
-      - dict: `on: { push: {...}, schedule: ... }` → True if "push" key
-
-    Defensive: for anything else (including None/empty), return True
-    so we preserve rather than over-compensate. Logged via ::notice::.
-    """
-    if isinstance(on_block, str):
-        return on_block == "push"
-    if isinstance(on_block, list):
-        return "push" in on_block
-    if isinstance(on_block, dict):
-        return "push" in on_block
-    # None or unexpected shape — preserve, log.
-    print(
-        f"::notice::ambiguous on: for {workflow_id}; preserving "
-        f"(value={on_block!r}, type={type(on_block).__name__})"
-    )
-    return True
-
-
-def scan_workflows(workflows_dir: str) -> dict[str, bool]:
-    """Walk `workflows_dir` and return `{workflow_id: has_push_trigger}`.
-
-    Workflow ID resolution (per hongming-pc 22:08Z review):
-      - Top-level `name:` if present.
-      - Else filename stem (basename minus `.yml`).
-
-    Fail-LOUD on:
-      - Two workflows resolving to the same ID (collision).
-      - Any ID containing `/` (would break ` / `-separated context
-        parsing on the downstream side).
-
-    Returns a dict for O(1) lookup in the per-status loop.
-    """
-    path = Path(workflows_dir)
-    if not path.is_dir():
-        # Workflow dir missing → no workflows to classify. Empty map is
-        # safe: per-status loop will hit "unknown workflow; skip" for
-        # every entry, which is correct (we cannot tell if a push
-        # trigger exists, so we preserve).
-        print(f"::warning::workflows dir not found: {workflows_dir}")
-        return {}
-
-    out: dict[str, bool] = {}
-    sources: dict[str, str] = {}  # workflow_id -> source file (for collision msg)
-
-    for yml in sorted(path.glob("*.yml")):
-        try:
-            with yml.open() as f:
-                doc = yaml.safe_load(f)
-        except yaml.YAMLError as e:
-            # A malformed YAML in the workflows dir is a real defect
-            # (the workflow wouldn't load on Gitea either). Surface it
-            # and keep going — the reaper's job is to compensate the
-            # OTHER workflows even if one is broken.
-            print(f"::warning::yaml parse failed for {yml.name}: {e}; skip")
-            continue
-        if not isinstance(doc, dict):
-            print(f"::warning::workflow {yml.name} not a dict; skip")
-            continue
-
-        # Resolve workflow_id.
-        name_field = doc.get("name")
-        if isinstance(name_field, str) and name_field.strip():
-            workflow_id = name_field.strip()
-        else:
-            workflow_id = yml.stem  # basename minus .yml
-
-        # Halt-loud: `/` in workflow_id breaks ` / ` context parsing.
-        if "/" in workflow_id:
-            sys.stderr.write(
-                f"::error::workflow name contains '/' which breaks "
-                f"context parsing: {workflow_id} (file={yml.name})\n"
-            )
-            sys.exit(1)
-
-        # Halt-loud: ID collision.
-        if workflow_id in out:
-            sys.stderr.write(
-                f"::error::workflow name collision detected: {workflow_id} "
-                f"(files: {sources[workflow_id]} + {yml.name})\n"
-            )
-            sys.exit(1)
-
-        on_block = _on_block(doc)
-        out[workflow_id] = _has_push_trigger(on_block, workflow_id)
-        sources[workflow_id] = yml.name
-
-    return out
-
-
-# --------------------------------------------------------------------------
-# Gitea reads
-# --------------------------------------------------------------------------
-def get_head_sha(branch: str) -> str:
-    """HEAD SHA of `branch`. Raises ApiError on non-2xx."""
-    _, body = api("GET", f"/repos/{OWNER}/{NAME}/branches/{branch}")
-    if not isinstance(body, dict):
-        raise ApiError(f"branch {branch} response not a JSON object")
-    commit = body.get("commit")
-    if not isinstance(commit, dict):
-        raise ApiError(f"branch {branch} response missing `commit` object")
-    sha = commit.get("id") or commit.get("sha")
-    if not isinstance(sha, str) or len(sha) < 7:
-        raise ApiError(f"branch {branch} response has no usable commit SHA")
-    return sha
-
-
-def get_combined_status(sha: str) -> dict:
-    """Combined commit status for `sha`. Gitea returns:
-        {
-          "state": "success" | "failure" | "pending" | "error",
-          "statuses": [
-            {"context": "...", "state": "...", "target_url": "...",
-             "description": "..."},
-            ...
-          ],
-          ...
-        }
-    Raises ApiError on non-2xx.
-    """
-    _, body = api("GET", f"/repos/{OWNER}/{NAME}/commits/{sha}/status")
-    if not isinstance(body, dict):
-        raise ApiError(f"status for {sha} response not a JSON object")
-    return body
-
-
-# --------------------------------------------------------------------------
-# Context parsing
-# --------------------------------------------------------------------------
-def parse_push_context(context: str) -> tuple[str, str] | None:
-    """Parse `<workflow_name> / <job_name> (push)` into
-    (workflow_name, job_name).
-
-    Returns None if the context doesn't match the shape (caller skips).
-    Strict: requires the trailing ` (push)` and at least one ` / `
-    separator. Anything else is left alone.
-    """
-    if not context.endswith(PUSH_SUFFIX):
-        return None
-    head = context[: -len(PUSH_SUFFIX)]  # strip " (push)"
-    if " / " not in head:
-        # No workflow/job separator — not the bug shape we compensate.
-        return None
-    workflow_name, job_name = head.split(" / ", 1)
-    return workflow_name, job_name
-
-
-# --------------------------------------------------------------------------
-# Compensating POST
-# --------------------------------------------------------------------------
-def post_compensating_status(
-    sha: str,
-    context: str,
-    target_url: str | None,
-    *,
-    dry_run: bool = False,
-) -> None:
-    """POST a `state=success` to /repos/{o}/{r}/statuses/{sha} with the
-    given context. Gitea de-dups by context (latest write wins).
-
-    Description references this script so the compensation is
-    self-documenting on the commit's status view.
-    """
-    payload: dict[str, Any] = {
-        "context": context,
-        "state": "success",
-        "description": COMPENSATION_DESCRIPTION,
-    }
-    # Echo the original target_url when present so a human auditing
-    # the (now-green) compensated status can still reach the run logs
-    # that produced the original red.
-    if target_url:
-        payload["target_url"] = target_url
-
-    if dry_run:
-        print(
-            f"::notice::[dry-run] would compensate {context!r} on {sha[:10]} "
-            f"with state=success"
-        )
-        return
-
-    api("POST", f"/repos/{OWNER}/{NAME}/statuses/{sha}", body=payload)
-    print(f"::notice::compensated {context!r} on {sha[:10]} (state=success)")
-
-
-# --------------------------------------------------------------------------
-# Main reap loop
-# --------------------------------------------------------------------------
-def reap(
-    workflow_trigger_map: dict[str, bool],
-    combined: dict,
-    sha: str,
-    *,
-    dry_run: bool = False,
-) -> dict[str, Any]:
-    """Walk `combined.statuses[]` and compensate where appropriate.
-
-    Per-SHA worker. The multi-SHA orchestrator (`reap_branch`) calls
-    this once per stale main commit each tick.
-
-    Returns counters for observability:
-      {compensated, preserved_real_push, preserved_unknown,
-       preserved_non_failure, preserved_non_push_suffix,
-       preserved_unparseable,
-       compensated_contexts: [<context>, ...]}
-
-    `compensated_contexts` is rev2-added so `reap_branch` can build
-    `compensated_per_sha` without re-deriving it from the POST stream.
-    """
-    counters: dict[str, Any] = {
-        "compensated": 0,
-        "preserved_real_push": 0,
-        "preserved_unknown": 0,
-        "preserved_non_failure": 0,
-        "preserved_non_push_suffix": 0,
-        "preserved_unparseable": 0,
-        "compensated_contexts": [],
-    }
-
-    statuses = combined.get("statuses") or []
-    for s in statuses:
-        if not isinstance(s, dict):
-            continue
-        context = s.get("context") or ""
-        state = s.get("state") or ""
-
-        # Only `failure` is the bug shape. `error`/`pending`/`success`
-        # left alone — they have other meanings.
-        if state != "failure":
-            counters["preserved_non_failure"] += 1
-            continue
-
-        # Only `(push)`-suffix contexts hit the hardcoded-suffix bug.
-        # Branch-protection required checks (e.g. `Secret scan / Scan
-        # diff (pull_request)`) are NOT reachable from this path.
-        if not context.endswith(PUSH_SUFFIX):
-            counters["preserved_non_push_suffix"] += 1
-            continue
-
-        parsed = parse_push_context(context)
-        if parsed is None:
-            # Has ` (push)` suffix but missing ` / ` separator — not
-            # the bug shape. Preserve.
-            counters["preserved_unparseable"] += 1
-            continue
-        workflow_name, _job_name = parsed
-
-        if workflow_name not in workflow_trigger_map:
-            # Real workflow but renamed/deleted/external — we can't
-            # tell if it has push trigger. Conservative: preserve.
-            print(f"::notice::unknown workflow {workflow_name!r}; skip")
-            counters["preserved_unknown"] += 1
-            continue
-
-        if workflow_trigger_map[workflow_name]:
-            # Real push trigger → real defect signal. Preserve.
-            counters["preserved_real_push"] += 1
-            continue
-
-        # Class-O: schedule/dispatch/etc.-only workflow with a fake
-        # (push) status from Gitea's hardcoded-suffix bug. Compensate.
-        post_compensating_status(
-            sha, context, s.get("target_url"), dry_run=dry_run
-        )
-        counters["compensated"] += 1
-        counters["compensated_contexts"].append(context)
-
-    return counters
-
-
-# --------------------------------------------------------------------------
-# rev2: multi-SHA sweep over the last N commits on WATCH_BRANCH
-# --------------------------------------------------------------------------
-# How many main commits to sweep per tick. Sized to cover a burst-merge
-# window where multiple PRs land in the 5-min interval between reaper
-# ticks. Older reds falling off the window is acceptable — they were
-# already stale enough that the schedule-run that posted them has long
-# since been overwritten by a real push trigger. See `reference_post_
-# suspension_pipeline` for the merge-cadence baseline.
-DEFAULT_SWEEP_LIMIT = 10
-
-
-def list_recent_commit_shas(branch: str, limit: int) -> list[str]:
-    """List the most recent `limit` commit SHAs on `branch`, newest
-    first.
-
-    Wraps GET /repos/{o}/{r}/commits?sha={branch}&limit={limit}. Gitea
-    1.22.6 returns a JSON list of commit objects each with a `sha` key
-    (verified via vendor-truth probe 2026-05-11 against
-    git.moleculesai.app — `feedback_smoke_test_vendor_truth_not_shape_match`).
-
-    Raises ApiError on non-2xx OR on unexpected response shape. This is
-    a HARD halt — without the commit list the sweep can't proceed. (The
-    per-SHA error isolation downstream is a different concern: tolerating
-    a transient 5xx on ONE commit's status is best-effort; losing the
-    commit list itself means we don't even know which commits to try.)
-    """
-    _, body = api(
-        "GET",
-        f"/repos/{OWNER}/{NAME}/commits",
-        query={"sha": branch, "limit": str(limit)},
-    )
-    if not isinstance(body, list):
-        raise ApiError(
-            f"commits listing for {branch} not a JSON array "
-            f"(got {type(body).__name__})"
-        )
-    shas: list[str] = []
-    for entry in body:
-        if not isinstance(entry, dict):
-            continue
-        sha = entry.get("sha")
-        if isinstance(sha, str) and len(sha) >= 7:
-            shas.append(sha)
-    if not shas:
-        raise ApiError(
-            f"commits listing for {branch} returned no usable SHAs"
-        )
-    return shas
-
-
-def reap_branch(
-    workflow_trigger_map: dict[str, bool],
-    branch: str,
-    *,
-    limit: int = DEFAULT_SWEEP_LIMIT,
-    dry_run: bool = False,
-) -> dict[str, Any]:
-    """Sweep the last `limit` commits on `branch`, applying `reap()`
-    to each (with per-SHA error isolation).
-
-    Returns aggregated counters PLUS rev2 observability fields:
-      - scanned_shas: how many SHAs we actually iterated
-      - compensated_per_sha: {<sha_full>: [<context>, ...]} — only
-        SHAs that actually got at least one compensation are included
-    """
-    shas = list_recent_commit_shas(branch, limit)
-
-    aggregate: dict[str, Any] = {
-        "scanned_shas": 0,
-        "compensated": 0,
-        "preserved_real_push": 0,
-        "preserved_unknown": 0,
-        "preserved_non_failure": 0,
-        "preserved_non_push_suffix": 0,
-        "preserved_unparseable": 0,
-        "compensated_per_sha": {},
-    }
-
-    for sha in shas:
-        aggregate["scanned_shas"] += 1
-
-        # Per-SHA error isolation (refinement #7). One transient blip
-        # on a historical commit must NOT abort the whole tick — the
-        # OTHER stale SHAs may still hold strandable reds.
-        try:
-            combined = get_combined_status(sha)
-        except ApiError as e:
-            print(
-                f"::warning::get_combined_status({sha[:10]}) failed; "
-                f"skipping this SHA: {e}"
-            )
-            continue
-
-        # Cost optimization (refinement #2): the common case is a green
-        # commit. Skip the per-context loop entirely when combined is
-        # already success — saves a tight loop over ~20 statuses per SHA
-        # on green commits, the dominant majority.
-        if combined.get("state") == "success":
-            continue
-
-        per_sha = reap(
-            workflow_trigger_map, combined, sha, dry_run=dry_run
-        )
-
-        # Aggregate scalar counters.
-        for key in (
-            "compensated",
-            "preserved_real_push",
-            "preserved_unknown",
-            "preserved_non_failure",
-            "preserved_non_push_suffix",
-            "preserved_unparseable",
-        ):
-            aggregate[key] += per_sha[key]
-
-        # Record per-SHA compensated contexts (only when non-empty —
-        # keep the summary readable when most SHAs are no-ops).
-        contexts = per_sha.get("compensated_contexts") or []
-        if contexts:
-            aggregate["compensated_per_sha"][sha] = list(contexts)
-
-    return aggregate
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument(
-        "--dry-run",
-        action="store_true",
-        help="Skip the compensating POST; print what would be done.",
-    )
-    parser.add_argument(
-        "--limit",
-        type=int,
-        default=DEFAULT_SWEEP_LIMIT,
-        help=(
-            "How many recent commits on WATCH_BRANCH to sweep per tick "
-            f"(default: {DEFAULT_SWEEP_LIMIT})."
-        ),
-    )
-    args = parser.parse_args()
-
-    _require_runtime_env()
-
-    workflow_trigger_map = scan_workflows(WORKFLOWS_DIR)
-    print(
-        f"::notice::scanned {len(workflow_trigger_map)} workflows; "
-        f"push-triggered={sum(1 for v in workflow_trigger_map.values() if v)}, "
-        f"class-O candidates={sum(1 for v in workflow_trigger_map.values() if not v)}"
-    )
-
-    counters = reap_branch(
-        workflow_trigger_map,
-        WATCH_BRANCH,
-        limit=args.limit,
-        dry_run=args.dry_run,
-    )
-
-    # Observability: print one JSON line summarising the tick. Loki
-    # ingestion via the runner's stdout (`source="gitea-actions"`).
-    print(
-        "status-reaper summary: "
-        + json.dumps(
-            {
-                "branch": WATCH_BRANCH,
-                "dry_run": args.dry_run,
-                "limit": args.limit,
-                **counters,
-            },
-            sort_keys=True,
-        )
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -317,8 +317,7 @@ JQ_FILTER='.[]

 T12_INPUT='[{"state":"APPROVED","dismissed":false,"user":{"login":"core-devops"}},{"state":"CHANGES_REQUESTED","dismissed":false,"user":{"login":"bob"}},{"state":"APPROVED","dismissed":false,"user":{"login":"alice"}},{"state":"APPROVED","dismissed":true,"user":{"login":"carol"}}]'

-JQ_CMD=$(command -v jq 2>/dev/null || echo /tmp/jq)
-T12_CANDIDATES=$(echo "$T12_INPUT" | "$JQ_CMD" -r "$JQ_FILTER" 2>/dev/null | sort -u)
+T12_CANDIDATES=$(echo "$T12_INPUT" | /tmp/jq -r "$JQ_FILTER" 2>/dev/null | sort -u)
 assert_contains "T12 jq: core-devops (non-author APPROVED) in candidates" "core-devops" "$T12_CANDIDATES"
 assert_eq "T12 jq: alice (author) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^alice$' || true)"
 assert_eq "T12 jq: carol (dismissed) NOT in candidates" "" "$(echo "$T12_CANDIDATES" | grep '^carol$' || true)"
@@ -148,21 +148,6 @@ jobs:
      - if: needs.changes.outputs.platform == 'true'
        name: Run golangci-lint
        run: golangci-lint run --timeout 3m ./... || true
-      - if: needs.changes.outputs.platform == 'true'
-        name: Diagnostic — per-package verbose 60s
-        run: |
-          set +e
-          go test -race -v -timeout 60s ./internal/handlers/... 2>&1 | tee /tmp/test-handlers.log
-          handlers_exit=$?
-          go test -race -v -timeout 60s ./internal/pendinguploads/... 2>&1 | tee /tmp/test-pu.log
-          pu_exit=$?
-          echo "::group::handlers exit=$handlers_exit (last 100 lines)"
-          tail -100 /tmp/test-handlers.log
-          echo "::endgroup::"
-          echo "::group::pendinguploads exit=$pu_exit (last 100 lines)"
-          tail -100 /tmp/test-pu.log
-          echo "::endgroup::"
-        continue-on-error: true
      - if: needs.changes.outputs.platform == 'true'
        name: Run tests with race detection and coverage
        run: go test -race -coverprofile=coverage.out ./...
@@ -508,12 +493,10 @@ jobs:
    # explicitly excludes `github.event_name`-gated jobs from F1 (see
    # `.gitea/scripts/ci-required-drift.py::ci_job_names`).
    #
-    # Phase 3 (RFC #219 §1) safety: continue-on-error here so the sentinel
-    # does not hard-fail and block PRs while the underlying build jobs are
-    # still in Phase 3 (continue-on-error: true suppresses their status to null).
-    # When Phase 3 ends (defects fixed, continue-on-error flipped off on build
-    # jobs), remove continue-on-error here so the sentinel again hard-fails.
-    continue-on-error: true
+    # NOTE: `continue-on-error: true` is intentionally NOT set here — Phase 3
+    # (parent PR for ci.yml port, RFC §1) sets it on the underlying build
+    # jobs to surface defects without blocking. The sentinel itself must
+    # hard-fail; that's the whole point.
    runs-on: ubuntu-latest
    timeout-minutes: 1
    needs:
@@ -527,27 +510,18 @@ jobs:
      - name: Assert every required dependency succeeded
        run: |
          set -euo pipefail
-          # `needs.*.result` is one of: success | failure | cancelled | skipped | null.
+          # `needs.*.result` is one of: success | failure | cancelled | skipped
          # We assert success per dep (not != failure) — see RFC §2 reasoning above.
-          # Null results are skipped: they come from Phase 3 (continue-on-error: true
-          # suppresses status) or from jobs still in-flight. The sentinel succeeds
-          # rather than blocking PRs on Phase 3 noise.
          results='${{ toJSON(needs) }}'
          echo "$results"
          echo "$results" | python3 -c '
          import json, sys
          ns = json.load(sys.stdin)
-          # Exclude null (Phase 3 suppressed / in-flight) from the bad list.
-          bad = [(k, v.get("result")) for k, v in ns.items()
-                 if v.get("result") not in ("success", None)]
+          bad = [(k, v.get("result")) for k, v in ns.items() if v.get("result") != "success"]
          if bad:
              print(f"FAIL: jobs not green:", file=sys.stderr)
              for k, r in bad:
                  print(f"  - {k}: {r}", file=sys.stderr)
              sys.exit(1)
-          pending = [(k, v.get("result")) for k, v in ns.items() if v.get("result") is None]
-          if pending:
-              print(f"WARN: {len(pending)} job(s) still in-flight (result=null): " +
-                    ", ".join(k for k, _ in pending), file=sys.stderr)
-          print(f"OK: all {len(ns)} required jobs succeeded (or Phase-3 suppressed)")
+          print(f"OK: all {len(ns)} required jobs succeeded")
          '
@@ -71,12 +71,8 @@ jobs:
        run: |
          set -euo pipefail
          # Fetch all open PRs and run gate-check on each
-          # socket.setdefaulttimeout(15): defence-in-depth for missing SOP_TIER_CHECK_TOKEN.
-          # gate_check.py uses timeout=15 on every urlopen call; this catches the
-          # inline Python polling loop too (issue #603).
          pr_numbers=$(python3 -c "
-            import socket, urllib.request, json, os
-            socket.setdefaulttimeout(15)
+            import urllib.request, json, os
            token = os.environ['GITEA_TOKEN']
            req = urllib.request.Request(
                'https://git.moleculesai.app/api/v1/repos/${{ github.repository }}/pulls?state=open&limit=100',
@@ -220,14 +220,12 @@ jobs:
        run: |
          set -euo pipefail
          if [ -z "${MOLECULE_GITEA_TOKEN}" ]; then
-            echo "::warning::AUTO_SYNC_TOKEN not set — using anonymous clone (repos are public per manifest.json OSS contract)"
+            echo "::error::AUTO_SYNC_TOKEN secret is empty — register the devops-engineer persona PAT in repo Actions secrets"
+            exit 1
          fi
          mkdir -p .tenant-bundle-deps
-          # Strip JSON5 comments before jq parsing — Integration Tester appends
-          # `// Triggered by ...` which breaks `jq` in clone-manifest.sh.
-          sed '/^[[:space:]]*\/\//d' manifest.json > .manifest-stripped.json
          bash scripts/clone-manifest.sh \
-            .manifest-stripped.json \
+            manifest.json \
            .tenant-bundle-deps/workspace-configs-templates \
            .tenant-bundle-deps/org-templates \
            .tenant-bundle-deps/plugins
@@ -37,13 +37,10 @@ name: main-red-watchdog
 # "unknown on type" when `workflow_dispatch.inputs.X` is present. Revisit
 # when Gitea ≥ 1.23 is fleet-wide.
 on:
-  # SCHEDULE DISABLED 2026-05-12 — interim per RFC#420 Option-C machinery-down emergency
-  # Watchdog timing out behind runner saturation; rev3+dedicated-runner-label in flight
-  # Re-enable after rev3 lands + runner saturation root resolved
-  #   schedule:
-  #     # Hourly at :05 — task spec calls for "off-zero" (`5 * * * *`),
-  #     # offset from :17 (ci-required-drift) and :00 (peak cron load).
-  #     - cron: '5 * * * *'
+  schedule:
+    # Hourly at :05 — task spec calls for "off-zero" (`5 * * * *`),
+    # offset from :17 (ci-required-drift) and :00 (peak cron load).
+    - cron: '5 * * * *'
  workflow_dispatch:

 # Read commit status + branch ref + issues; write issues (open/PATCH/close).
@@ -54,12 +54,6 @@ env:
 jobs:
  build-and-push:
    name: Build & push canvas image
-    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
-    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
-    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
-    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
-    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
-    # See issue #576 + infra-lead pulse ~00:30Z.
    runs-on: ubuntu-latest
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    continue-on-error: true
@@ -85,10 +79,8 @@ jobs:
        run: |
          set -euo pipefail
          echo "::group::Docker daemon health check"
-          echo "Runner: ${HOSTNAME:-unknown}"
          docker info 2>&1 | head -5 || {
            echo "::error::Docker daemon is not accessible at /var/run/docker.sock"
-            echo "::error::Runner: ${HOSTNAME:-unknown}"
            echo "::error::Check: (1) daemon running, (2) runner user in docker group, (3) sock perms 660+"
            exit 1
          }
@@ -52,12 +52,6 @@ env:

 jobs:
  build-and-push:
-    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
-    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
-    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
-    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
-    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
-    # See issue #576 + infra-lead pulse ~00:30Z.
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
@@ -74,10 +68,8 @@ jobs:
        run: |
          set -euo pipefail
          echo "::group::Docker daemon health check"
-          echo "Runner: ${HOSTNAME:-unknown}"
          docker info 2>&1 | head -5 || {
            echo "::error::Docker daemon is not accessible at /var/run/docker.sock"
-            echo "::error::Runner: ${HOSTNAME:-unknown}"
            echo "::error::Check: (1) daemon is running, (2) runner user is in docker group, (3) sock permissions are 660+"
            exit 1
          }
@@ -100,15 +92,13 @@ jobs:
          MOLECULE_GITEA_TOKEN: ${{ secrets.AUTO_SYNC_TOKEN }}
        run: |
          set -euo pipefail
-          # clone-manifest.sh supports anonymous cloning for public repos (post-
-          # 2026-05-08 migration). The token is only needed for private repos.
-          # Do NOT require it — a missing secret would fail the build unnecessarily.
+          if [ -z "${MOLECULE_GITEA_TOKEN}" ]; then
+            echo "::error::AUTO_SYNC_TOKEN secret is empty"
+            exit 1
+          fi
          mkdir -p .tenant-bundle-deps
-          # Strip JSON5 comments before jq parsing — Integration Tester appends
-          # `// Triggered by ...` which breaks `jq` in clone-manifest.sh.
-          sed '/^[[:space:]]*\/\//d' manifest.json > .manifest-stripped.json
          bash scripts/clone-manifest.sh \
-            .manifest-stripped.json \
+            manifest.json \
            .tenant-bundle-deps/workspace-configs-templates \
            .tenant-bundle-deps/org-templates \
            .tenant-bundle-deps/plugins
@@ -1,70 +0,0 @@
-name: review-check-tests
-
-# Runs review-check.sh regression tests on every PR + push that touches
-# the evaluator script or its test fixtures.
-#
-# Follows RFC#324 follow-up (issue #540):
-#   .gitea/scripts/review-check.sh is load-bearing for PR merge gates.
-#   It has ZERO production CI coverage. This workflow closes that gap.
-#
-# Design choices:
-#   - Bash test harness (not bats). The existing test_review_check.sh
-#     uses a custom assert_eq/assert_contains framework that is already
-#     working and covers all 13 acceptance criteria (issue #540 §Acceptance).
-#     Converting to bats would be refactoring, not closing the gap.
-#   - No bats dependency: the runner-base image needs no extra tooling.
-#   - continue-on-error: false — these tests must pass; a failure means
-#     the review-gate evaluator is broken and must not be merged.
-
-on:
-  push:
-    branches: [main, staging]
-    paths:
-      - '.gitea/scripts/review-check.sh'
-      - '.gitea/scripts/tests/test_review_check.sh'
-      - '.gitea/scripts/tests/_review_check_fixture.py'
-      - '.gitea/workflows/review-check-tests.yml'
-  pull_request:
-    branches: [main, staging]
-    paths:
-      - '.gitea/scripts/review-check.sh'
-      - '.gitea/scripts/tests/test_review_check.sh'
-      - '.gitea/scripts/tests/_review_check_fixture.py'
-      - '.gitea/workflows/review-check-tests.yml'
-  workflow_dispatch:
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    name: review-check.sh regression tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install jq
-        # Required for T12 jq-filter test case. Gitea Actions runners (ubuntu-latest
-        # label) do not bundle jq. Install via apt-get first (reliable for Ubuntu
-        # runners with internet access to package mirrors). Falls back to GitHub
-        # binary download. GitHub releases may be blocked on some runner networks
-        # (infra#241 follow-up).
-        continue-on-error: true
-        run: |
-          if apt-get update -qq && apt-get install -y -qq jq; then
-            echo "::notice::jq installed via apt-get: $(jq --version)"
-          elif timeout 120 curl -sSL \
-            "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64" \
-            -o /usr/local/bin/jq && chmod +x /usr/local/bin/jq; then
-            echo "::notice::jq binary downloaded: $(/usr/local/bin/jq --version)"
-          else
-            echo "::warning::jq install failed — apt-get and GitHub download both failed."
-          fi
-          jq --version 2>/dev/null || echo "::notice::jq not yet available — continuing"
-
-      - name: Run review-check.sh regression suite
-        run: bash .gitea/scripts/tests/test_review_check.sh
@@ -1,118 +0,0 @@
-# status-reaper — Option B (compensating-status POST) for Gitea 1.22.6's
-# hardcoded `(push)` suffix on default-branch commit statuses.
-#
-# Tracking: molecule-core#? (this PR), internal#327 (sibling publish-runtime-bot),
-# internal#328 (sibling mc-drift-bot), internal#80 (upstream RFC). Sister
-# bots already deployed under the same per-persona-identity contract
-# (`feedback_per_agent_gitea_identity_default`).
-#
-# Root cause:
-#   Gitea 1.22.6 emits commit-status context as
-#     `<workflow_name> / <job_name> (push)`
-#   for ANY workflow run on the default branch's HEAD commit, REGARDLESS
-#   of the trigger event. Schedule- and workflow_dispatch-triggered runs
-#   on `main` therefore appear as `(push)` failures on the latest main
-#   commit, painting main red via a fake-push status. Verified on runs
-#   14525 + 14526 via Phase 1 evidence (3 sub-agents). No upstream fix
-#   in 1.23-1.26.1 (sibling a6f20db1 research).
-#
-# Why a cron-driven reaper, not workflow_run:
-#   Gitea 1.22.6 does NOT support `on: workflow_run` (verified via
-#   modules/actions/workflows.go enumeration; sister a6f20db1). The
-#   only event-shaped option that fires is cron. 5min is chosen to
-#   sit BETWEEN ci-required-drift (`:17` hourly) and main-red-watchdog
-#   (`:05` hourly) so the reaper sweeps red before the watchdog files
-#   a `[main-red]` issue (would-be false-positive).
-#
-# What the reaper does each tick:
-#   1. Parse `.gitea/workflows/*.yml`, classify each by whether `on:`
-#      contains a `push:` trigger (see script for workflow_id resolution
-#      including `name:` collision and `/`-in-name fail-loud lints).
-#   2. GET combined status for main HEAD.
-#   3. For each `failure` status whose context ends ` (push)`:
-#      - if workflow has push trigger: PRESERVE (real defect signal).
-#      - if workflow has no push trigger: POST a compensating
-#        `state=success` with the same context and a description that
-#        documents the workaround.
-#
-# What it does NOT do:
-#   - Mutate non-`(push)`-suffix statuses (e.g. `(pull_request)` from
-#     branch_protections required-checks — verified safe 2026-05-11).
-#   - Auto-revert. Same reasoning as main-red-watchdog.
-#   - Cancel runs. The runs themselves stay visible in Actions UI; the
-#     fix is at the commit-status surface only.
-#
-# Removal path: drop this workflow when Gitea ≥ 1.24 ships with a
-# real fix for the hardcoded-suffix bug. Audit issue (filed post-merge)
-# tracks the deletion as a follow-up sweep.
-
-name: status-reaper
-
-# IMPORTANT — Gitea 1.22.6 parser quirk per
-# `feedback_gitea_workflow_dispatch_inputs_unsupported`: do NOT add an
-# `inputs:` block here. Gitea 1.22.6 rejects the whole workflow as
-# "unknown on type" when `workflow_dispatch.inputs.X` is present.
-on:
-  # SCHEDULE DISABLED 2026-05-12 — interim per RFC#420 Option-C machinery-down emergency
-  # Reaper rev2 not compensating + watchdog timeout-cascade; rev3 in flight
-  # Re-enable after rev3 lands + runner saturation root resolved
-  #   schedule:
-  #     # Every 5 minutes. Off-zero alignment with sibling cron workflows:
-  #     # ci-required-drift (`:17`), main-red-watchdog (`:05`),
-  #     # railway-pin-audit (`:23`). 5-min cadence gives a tight enough
-  #     # close on schedule-triggered false-reds that main-red-watchdog
-  #     # (hourly :05) almost never files an issue on the false case.
-  #     - cron: '*/5 * * * *'
-  workflow_dispatch:
-
-# Compensating-status POST needs write on repo statuses; no other
-# write surface is touched. checkout still needs `contents: read`.
-permissions:
-  contents: read
-
-# NOTE: NO `concurrency:` block is intentional.
-# Gitea 1.22.6 doesn't honor `cancel-in-progress: false`: queued ticks
-# of the same group get cancelled-with-started=0 instead of waiting
-# (DB-verified 2026-05-12, runs 16053/16085 of status-reaper.yml).
-# The reaper's POST /statuses/{sha} is idempotent — Gitea de-dups by
-# context — so concurrent ticks are safe; accept them rather than
-# serialise via the broken mechanism.
-
-jobs:
-  reap:
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-      - name: Check out repo at default-branch HEAD
-        # BASE checkout per `feedback_pull_request_target_workflow_from_base`.
-        # The script reads .gitea/workflows/*.yml from the working tree to
-        # classify trigger sets; we must read main's CURRENT state, not
-        # the SHA a stale schedule fired against.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          ref: ${{ github.event.repository.default_branch }}
-
-      - name: Set up Python (PyYAML for workflow `on:` parse)
-        # Pinned to 3.12 to match sibling watchdog / ci-required-drift.
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
-        with:
-          python-version: '3.12'
-
-      - name: Install PyYAML
-        # PyYAML is needed because shell-grep on `on:` misses list/string
-        # forms and nested `push: { paths: ... }`. Same install pattern
-        # as ci-required-drift.yml (sub-2s install, no wheel cache).
-        run: python -m pip install --quiet 'PyYAML==6.0.2'
-
-      - name: Compensate operational push-suffix failures on main
-        env:
-          # claude-status-reaper persona token; provisioned by sibling
-          # aefaac1b 2026-05-11. Owns write:repository scope to POST
-          # /statuses/{sha} but NOTHING ELSE
-          # (`feedback_per_agent_gitea_identity_default`).
-          GITEA_TOKEN: ${{ secrets.STATUS_REAPER_TOKEN }}
-          GITEA_HOST: git.moleculesai.app
-          REPO: ${{ github.repository }}
-          WATCH_BRANCH: ${{ github.event.repository.default_branch }}
-          WORKFLOWS_DIR: .gitea/workflows
-        run: python3 .gitea/scripts/status-reaper.py
@@ -1,109 +0,0 @@
-name: Weekly Platform-Go Surface
-
-# Surface latent vet/test errors on main by running the full Platform-Go
-# suite on a weekly cron regardless of whether the last push touched
-# workspace-server/.
-#
-# Background: ci.yml's `platform-build` job gates real work on
-# `if: needs.changes.outputs.platform == 'true'`. When no push touches
-# workspace-server/, the skip fires and the suite never executes on main.
-# Latent vet errors and test flakes can sit for weeks undetected.
-#
-# This workflow runs the full suite (build, vet, golangci-lint, tests with
-# coverage) every Monday at 04:17 UTC. Results are posted as commit statuses
-# but continue-on-error: true means they never block anything — they're
-# purely a noise-reduction signal for when the next workspace-server push
-# lands and would otherwise trigger the first real suite run.
-#
-# Why 04:17 UTC on Monday: off-peak, before the weekly sprint cycle starts.
-
-on:
-  schedule:
-    - cron: '17 4 * * 1'  # Mondays at 04:17 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  statuses: write
-
-jobs:
-  weekly-platform-go:
-    name: Weekly Platform-Go Surface
-    runs-on: ubuntu-latest
-    # continue-on-error: surface only, never block
-    continue-on-error: true
-    defaults:
-      run:
-        working-directory: workspace-server
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: main
-          fetch-depth: 1
-
-      - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version: stable
-
-      - name: Go mod download
-        run: go mod download
-
-      - name: Build
-        run: go build ./cmd/server
-
-      - name: go vet
-        run: go vet ./... || true
-
-      - name: golangci-lint
-        run: golangci-lint run --timeout 3m ./... || true
-
-      - name: Tests with race detection + coverage
-        run: go test -race -coverprofile=coverage.out ./...
-
-      - name: Check coverage thresholds
-        run: |
-          set -e
-          TOTAL_FLOOR=25
-          CRITICAL_PATHS=(
-            "internal/handlers/tokens"
-            "internal/handlers/workspace_provision"
-            "internal/handlers/a2a_proxy"
-            "internal/handlers/registry"
-            "internal/handlers/secrets"
-            "internal/middleware/wsauth"
-            "internal/crypto"
-          )
-
-          TOTAL=$(go tool cover -func=coverage.out | grep '^total:' | awk '{print $3}' | sed 's/%//')
-          echo "Total coverage: ${TOTAL}%"
-          if awk "BEGIN{exit !(\$TOTAL < \$TOTAL_FLOOR)}"; then
-            echo "::error::Total coverage \${TOTAL}% is below the \${TOTAL_FLOOR}% floor."
-            exit 1
-          fi
-
-          ALLOWLIST=""
-          if [ -f ../.coverage-allowlist.txt ]; then
-            ALLOWLIST=$(grep -vE '^(#|[[:space:]]*$)' ../.coverage-allowlist.txt || true)
-          fi
-
-          FAILED=0
-          for path in "\${CRITICAL_PATHS[@]}"; do
-            while read -r file pct; do
-              [[ "$file" == *_test.go ]] && continue
-              [[ "$file" == *"$path"* ]] || continue
-              awk "BEGIN{exit !(\$pct < 10)}" || continue
-              rel=$(echo "$file" | sed 's|^github.com/molecule-ai/molecule-monorepo/platform/workspace-server/||; s|^github.com/molecule-ai/molecule-monorepo/platform/||')
-              if echo "$ALLOWLIST" | grep -qxF "$rel"; then
-                continue
-              fi
-              echo "::error::Low coverage \${pct}% on \${rel} (below 10% in critical path \${path})"
-              FAILED=$((FAILED + 1))
-            done < <(go tool cover -func=coverage.out | grep -v '^total:' | awk '{file=$1; sub(/:[0-9][0-9.]*:.*/, "", file); pct=$NF; gsub(/%/,"",pct); s[file]+=pct; c[file]++} END {for (f in s) printf "%s %.1f\n", f, s[f]/c[f]}' | sort)
-          done
-          if [ "$FAILED" -gt 0 ]; then
-            echo "::error::\${FAILED} critical paths below 10% coverage — see above."
-            exit 1
-          fi
-          echo "Coverage thresholds: OK"
@@ -156,16 +156,6 @@ and run CI manually.
 | python-lint | pytest with coverage |
 | e2e-api | Full API test suite (62 tests) |
 | shellcheck | Shell script linting |
-| review-check-tests | `review-check.sh` evaluator regression suite (13 scenarios) |
-| ops-scripts | Python unittest suite for `scripts/*.py` |
-
-## Local Testing
-
-### review-check.sh
-```bash
-bash .gitea/scripts/tests/test_review_check.sh
-```
-Runs the full regression suite against a fixture HTTP server. No network access required.

 ## Code Style

@@ -2,49 +2,24 @@
 /**
 * Tests for ApprovalBanner component.
 *
- * Patches api.get and api.post via Object.defineProperty in beforeEach.
- * This is resilient to vi.restoreAllMocks() from OTHER test files because
- * defineProperty patches are NOT restored by vi.restoreAllMocks().
+ * Covers: renders nothing when no approvals, polls /approvals/pending,
+ * shows approval cards, approve/deny decisions, toast notifications.
 *
- * showToast is patched by setting showToast.mockImplementation in beforeEach —
- * the component imports showToast from @/components/Toaster, which is mocked
- * in this file. vi.mocked(showToast) always refers to the mock from THIS file's
- * vi.mock, not from aria-time-sensitive.test.tsx (separate virtual module).
+ * Note: does NOT mock @/lib/api — uses vi.spyOn on the real module.
+ * vi.restoreAllMocks() is omitted from afterEach so queued mock values
+ * (set up via mockResolvedValueOnce in beforeEach) are preserved for the
+ * component's useEffect to consume.
 */
 import React from "react";
 import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
 import { afterEach, describe, expect, it, vi, beforeEach } from "vitest";
 import { ApprovalBanner } from "../ApprovalBanner";
+import { showToast } from "@/components/Toaster";
 import { api } from "@/lib/api";

-// Mock @/components/Toaster at module level — creates a vi.fn() spy for showToast.
 vi.mock("@/components/Toaster", () => ({
  showToast: vi.fn(),
 }));
-import { showToast } from "@/components/Toaster";
-
-// Store originals — restored manually in afterEach.
-const origGet = api.get;
-const origPost = api.post;
-
-afterEach(() => {
-  cleanup();
-  vi.useRealTimers();
-  // Manually restore — NOT vi.restoreAllMocks() which would also restore
-  // api.post/get that aria-time-sensitive.test.tsx patched.
-  Object.defineProperty(api, "get", { value: origGet, writable: true, configurable: true });
-  Object.defineProperty(api, "post", { value: origPost, writable: true, configurable: true });
-});
-
-// Patch api.get and api.post in beforeEach.
-// Object.defineProperty bypasses vi.restoreAllMocks().
-function patchApi(overrides: { get?: unknown; post?: unknown } = {}) {
-  const getMock = overrides.get ?? vi.fn();
-  const postMock = overrides.post ?? vi.fn();
-  Object.defineProperty(api, "get", { value: getMock, writable: true, configurable: true });
-  Object.defineProperty(api, "post", { value: postMock, writable: true, configurable: true });
-  return { getMock, postMock };
-}

 // ─── Helpers ──────────────────────────────────────────────────────────────────

@@ -66,12 +41,22 @@ const pendingApproval = (id = "a1", workspaceId = "ws-1"): {
  created_at: "2026-05-10T10:00:00Z",
 });

+// Shared spy references so individual tests can reset or reject the POST mock
+// without needing to call spyOn again (which would create a duplicate spy).
+let mockGet: ReturnType<typeof vi.spyOn>;
+let mockPost: ReturnType<typeof vi.spyOn>;
+
 // ─── Tests ────────────────────────────────────────────────────────────────────

 describe("ApprovalBanner — empty state", () => {
  beforeEach(() => {
    vi.useFakeTimers();
-    patchApi({ get: vi.fn().mockResolvedValue([]) });
+    vi.spyOn(api, "get").mockResolvedValueOnce([]);
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
  });

  it("renders nothing when there are no pending approvals", async () => {
@@ -91,12 +76,15 @@ describe("ApprovalBanner — empty state", () => {
 describe("ApprovalBanner — renders approval cards", () => {
  beforeEach(() => {
    vi.useFakeTimers();
-    patchApi({
-      get: vi.fn().mockResolvedValue([
-        pendingApproval("a1"),
-        pendingApproval("a2", "ws-2"),
-      ]),
-    });
+    mockGet = vi.spyOn(api, "get").mockResolvedValueOnce([
+      pendingApproval("a1"),
+      pendingApproval("a2", "ws-2"),
+    ]);
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
  });

  it("renders an alert card for each pending approval", async () => {
@@ -104,6 +92,7 @@ describe("ApprovalBanner — renders approval cards", () => {
    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
    const alerts = screen.getAllByRole("alert");
    expect(alerts).toHaveLength(2);
+    mockGet.mockRestore();
  });

  it("displays the workspace name and action text", async () => {
@@ -121,12 +110,10 @@ describe("ApprovalBanner — renders approval cards", () => {
  });

  it("omits the reason div when reason is null", async () => {
-    patchApi({
-      get: vi.fn().mockResolvedValue([{
-        ...pendingApproval("a1"),
-        reason: null,
-      }]),
-    });
+    vi.spyOn(api, "get").mockResolvedValueOnce([{
+      ...pendingApproval("a1"),
+      reason: null,
+    }]);
    render(<ApprovalBanner />);
    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
    expect(screen.queryByText(/requires human approval/i)).toBeNull();
@@ -137,6 +124,7 @@ describe("ApprovalBanner — renders approval cards", () => {
    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
    const approveBtns = screen.getAllByRole("button", { name: /Approve/i });
    const denyBtns = screen.getAllByRole("button", { name: /Deny/i });
+    // 2 cards, each card has 1 Approve + 1 Deny button → 2 of each minimum
    expect(approveBtns.length).toBeGreaterThanOrEqual(2);
    expect(denyBtns.length).toBeGreaterThanOrEqual(2);
  });
@@ -150,16 +138,15 @@ describe("ApprovalBanner — renders approval cards", () => {
 });

 describe("ApprovalBanner — decisions", () => {
-  let mockGet: ReturnType<typeof vi.fn>;
-  let mockPost: ReturnType<typeof vi.fn>;
-
  beforeEach(() => {
    vi.useFakeTimers();
-    const patched = patchApi();
-    mockGet = patched.getMock as ReturnType<typeof vi.fn>;
-    mockPost = patched.postMock as ReturnType<typeof vi.fn>;
-    mockGet.mockResolvedValue([pendingApproval("a1")]);
-    mockPost.mockResolvedValue({});
+    mockGet = vi.spyOn(api, "get").mockResolvedValueOnce([pendingApproval("a1")]);
+    mockPost = vi.spyOn(api, "post").mockResolvedValue({});
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
  });

  it("calls POST /workspaces/:id/approvals/:id/decide on Approve click", async () => {
@@ -167,7 +154,7 @@ describe("ApprovalBanner — decisions", () => {
    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
    fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
    await act(async () => { /* flush */ });
-    expect(mockPost).toHaveBeenCalledWith(
+    expect(vi.mocked(api.post)).toHaveBeenCalledWith(
      "/workspaces/ws-1/approvals/a1/decide",
      expect.objectContaining({ decision: "approved" })
    );
@@ -178,7 +165,7 @@ describe("ApprovalBanner — decisions", () => {
    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
    fireEvent.click(screen.getAllByRole("button", { name: /deny/i })[0]);
    await act(async () => { /* flush */ });
-    expect(mockPost).toHaveBeenCalledWith(
+    expect(vi.mocked(api.post)).toHaveBeenCalledWith(
      "/workspaces/ws-1/approvals/a1/decide",
      expect.objectContaining({ decision: "denied" })
    );
@@ -209,19 +196,39 @@ describe("ApprovalBanner — decisions", () => {
    expect(vi.mocked(showToast)).toHaveBeenCalledWith("Denied", "info");
  });

-  // NOTE: error-handling tests (POST rejection + card visibility / error toast)
-  // require vi.advanceTimersByTimeAsync() to flush the rejection microtask while
-  // the component is still mounted. With vi.useFakeTimers() in beforeEach, the
-  // component's setInterval poll fires every 10s and creates an infinite loop with
-  // vi.runAllTimersAsync(). Skipping these timing-sensitive tests to keep the suite
-  // deterministic. The core POST call + toast functionality is fully covered by the
-  // success/deny tests above.
+  it("shows an error toast when POST fails", async () => {
+    mockPost.mockReset().mockRejectedValue(new Error("Network error"));
+    render(<ApprovalBanner />);
+    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
+    fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
+    await act(async () => { /* flush */ });
+    expect(vi.mocked(showToast)).toHaveBeenCalledWith(
+      "Failed to submit decision",
+      "error"
+    );
+  });
+
+  it("keeps the card visible when the POST fails", async () => {
+    // Reset the post mock before rejecting so the beforeEach's resolved value
+    // is gone and we get a clean rejection instead of a resolved→rejected queue.
+    mockPost.mockReset().mockRejectedValue(new Error("Network error"));
+    render(<ApprovalBanner />);
+    await act(async () => { await vi.runOnlyPendingTimersAsync(); });
+    fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
+    await act(async () => { /* flush */ });
+    expect(screen.getAllByRole("alert")).toHaveLength(1);
+  });
 });

 describe("ApprovalBanner — handles empty list from server", () => {
  beforeEach(() => {
    vi.useFakeTimers();
-    patchApi({ get: vi.fn().mockResolvedValue([]) });
+    vi.spyOn(api, "get").mockResolvedValueOnce([]);
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
  });

  it("shows nothing when the API returns an empty array on first poll", async () => {
@@ -37,50 +37,79 @@ function makeBundle(name = "test-workspace"): File {
  });
 }

+// jsdom doesn't define DragEvent globally; create a dragover event with
+// dataTransfer.types stubbed to include "Files" so handleDragOver triggers.
+function createDragOverEvent() {
+  return Object.assign(new Event("dragover", { bubbles: true, cancelable: true }), {
+    dataTransfer: { types: ["Files"], files: null },
+  });
+}
+
 // ─── Tests ────────────────────────────────────────────────────────────────────

 describe("BundleDropZone — render", () => {
  it("renders a hidden file input with correct accept and aria-label", () => {
-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;
    expect(input).toBeTruthy();
    expect(input.getAttribute("type")).toBe("file");
    expect(input.getAttribute("accept")).toBe(".bundle.json");
+    expect(input.getAttribute("id")).toBe("bundle-file-input");
  });

  it("renders the keyboard-accessible import button with aria-label", () => {
-    render(<BundleDropZone />);
-    const btn = screen.getByRole("button", { name: /import bundle/i });
-    expect(btn).toBeTruthy();
+    const { container } = render(<BundleDropZone />);
+    const btn = container.querySelector('button[aria-label="Import bundle file"]') as HTMLButtonElement;
+    expect(btn).not.toBeNull();
    expect(btn.getAttribute("aria-controls")).toBe("bundle-file-input");
  });
 });

 describe("BundleDropZone — drag state", () => {
-  it("hides the drop overlay when not dragging", () => {
-    render(<BundleDropZone />);
-    // By default (no drag), the overlay should not be visible
-    expect(screen.queryByText("Drop Bundle to Import")).toBeNull();
+  afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+    vi.useRealTimers();
  });

-  it("has the invisible drop zone div covering the viewport", () => {
-    render(<BundleDropZone />);
-    // The primary drop zone: pointer-events-none by default
-    const zone = document.body.querySelector('[class*="fixed inset-0 z-10"]');
-    expect(zone).toBeTruthy();
+  it("shows the drop overlay when a file is dragged over", async () => {
+    vi.useFakeTimers();
+    const { container } = render(<BundleDropZone />);
+    // Overlay should not be visible initially
+    expect(screen.queryByText("Drop Bundle to Import")).toBeNull();
+
+    // Simulate drag-over: stub dataTransfer.types to include "Files"
+    // so handleDragOver calls setIsDragging(true)
+    const zone = document.body.querySelector('[class*="z-10"]') as HTMLElement;
+    if (zone) {
+      const dragOverEvent = createDragOverEvent();
+      fireEvent.dragOver(zone, dragOverEvent);
+    }
+    await act(async () => { vi.runOnlyPendingTimers(); });
+    // After dragOver, overlay should be visible. The overlay has z-20 class.
+    const overlay = screen.getByText("Drop Bundle to Import").closest('[class*="z-20"]');
+    expect(overlay).not.toBeNull();
+    vi.useRealTimers();
+  });
+
+  it("hides the drop overlay when not dragging", () => {
+    const { container } = render(<BundleDropZone />);
+    // By default (no drag), the overlay should not be visible
+    expect(screen.queryByText("Drop Bundle to Import")).toBeNull();
  });
 });

 describe("BundleDropZone — keyboard file input (WCAG 2.1.1)", () => {
  it("triggers the hidden file input when the import button is clicked", () => {
-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    // Both the hidden file input and the button have aria-label="Import bundle file".
    // Use the file input's id to select it uniquely.
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;
    expect(input).toBeTruthy();
    expect(input.getAttribute("type")).toBe("file");
    const clickSpy = vi.spyOn(input, "click");
-    fireEvent.click(screen.getByRole("button", { name: /import bundle/i }));
+    const btn = container.querySelector('button[aria-label="Import bundle file"]') as HTMLButtonElement;
+    fireEvent.click(btn);
    expect(clickSpy).toHaveBeenCalled();
  });

@@ -92,7 +121,7 @@ describe("BundleDropZone — keyboard file input (WCAG 2.1.1)", () => {
      status: "online",
    });

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("My Bundle");
@@ -124,7 +153,7 @@ describe("BundleDropZone — import success", () => {
      status: "online",
    });

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Success Workspace");
@@ -136,14 +165,14 @@ describe("BundleDropZone — import success", () => {
      vi.advanceTimersByTime(500);
    });

-    // Success toast should be visible
-    expect(screen.getByText(/imported "my workspace" successfully/i)).toBeTruthy();
+    // Success toast should be visible — scope to container for DOM isolation
+    expect(container.textContent).toMatch(/imported "my workspace" successfully/i);

    // Toast auto-clears after 4000ms
    await act(async () => {
      vi.advanceTimersByTime(5000);
    });
-    expect(screen.queryByRole("status")).toBeNull();
+    expect(container.querySelector('[role="status"]')).toBeNull();
    vi.useRealTimers();
  });

@@ -155,7 +184,7 @@ describe("BundleDropZone — import success", () => {
      status: "online",
    });

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Timed Workspace");
@@ -166,12 +195,12 @@ describe("BundleDropZone — import success", () => {
    await act(async () => {
      vi.advanceTimersByTime(500);
    });
-    expect(screen.queryByText(/timed workspace/i)).toBeTruthy();
+    expect(container.textContent).toMatch(/timed workspace/i);

    await act(async () => {
      vi.advanceTimersByTime(4500);
    });
-    expect(screen.queryByText(/timed workspace/i)).toBeNull();
+    expect(container.textContent).not.toMatch(/timed workspace/i);
    vi.useRealTimers();
  });
 });
@@ -181,7 +210,7 @@ describe("BundleDropZone — import error", () => {
    vi.useFakeTimers();
    vi.mocked(api.post).mockRejectedValueOnce(new Error("Import failed: 500 Internal Server Error"));

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Failed Workspace");
@@ -193,13 +222,13 @@ describe("BundleDropZone — import error", () => {
      vi.advanceTimersByTime(500);
    });

-    expect(screen.getByText(/import failed: 500 internal server error/i)).toBeTruthy();
+    expect(container.textContent).toMatch(/import failed: 500 internal server error/i);
    vi.useRealTimers();
  });

  it("shows error when file is not a .bundle.json", async () => {
    vi.useFakeTimers();
-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = new File(["{}"], "readme.txt", { type: "text/plain" });
@@ -211,12 +240,12 @@ describe("BundleDropZone — import error", () => {
      vi.advanceTimersByTime(500);
    });

-    expect(screen.getByText(/only .bundle.json files are accepted/i)).toBeTruthy();
+    expect(container.textContent).toMatch(/only .bundle.json files are accepted/i);
    // Error clears after 3000ms
    await act(async () => {
      vi.advanceTimersByTime(3500);
    });
-    expect(screen.queryByText(/only .bundle.json/i)).toBeNull();
+    expect(container.textContent).not.toMatch(/only .bundle.json/i);
    vi.useRealTimers();
  });

@@ -224,7 +253,7 @@ describe("BundleDropZone — import error", () => {
    vi.useFakeTimers();
    vi.mocked(api.post).mockRejectedValueOnce(new Error("Network error"));

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Error Workspace");
@@ -235,12 +264,12 @@ describe("BundleDropZone — import error", () => {
    await act(async () => {
      vi.advanceTimersByTime(500);
    });
-    expect(screen.queryByText(/network error/i)).toBeTruthy();
+    expect(container.textContent).toMatch(/network error/i);

    await act(async () => {
      vi.advanceTimersByTime(5000);
    });
-    expect(screen.queryByText(/network error/i)).toBeNull();
+    expect(container.textContent).not.toMatch(/network error/i);
    vi.useRealTimers();
  });
 });
@@ -252,7 +281,7 @@ describe("BundleDropZone — importing state", () => {
    const pending = new Promise((r) => { resolve = r; });
    vi.mocked(api.post).mockReturnValueOnce(pending as unknown as ReturnType<typeof api.post>);

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Pending Workspace");
@@ -265,8 +294,10 @@ describe("BundleDropZone — importing state", () => {
      vi.advanceTimersByTime(100);
    });

-    expect(screen.getByText("Importing bundle...")).toBeTruthy();
-    expect(screen.getByRole("status")).toBeTruthy();
+    // Scope to container for DOM isolation — other components may have
+    // role=status and text "Importing bundle..." in the shared jsdom env.
+    expect(container.textContent).toMatch(/importing bundle/i);
+    expect(container.querySelector('[role="status"]')).toBeTruthy();

    await act(async () => {
      vi.advanceTimersByTime(500);
@@ -284,7 +315,7 @@ describe("BundleDropZone — file input reset", () => {
      status: "online",
    });

-    render(<BundleDropZone />);
+    const { container } = render(<BundleDropZone />);
    const input = document.getElementById("bundle-file-input") as HTMLInputElement;

    const file = makeBundle("Reset Test");
@@ -1,285 +1,13 @@
 // @vitest-environment jsdom
-/**
- * Tests for ConfirmDialog — portal-based confirmation dialog.
- *
- * Covers: open=false → null render, portal attach, title + message,
- * Cancel + Confirm buttons, variant classes (danger/warning/primary),
- * singleButton prop, click handlers, Escape/Enter/Backdrop keyboard
- * handlers, Tab trap, focus management, aria-modal + aria-labelledby.
- */
-import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
-import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
-import React from "react";
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { render, screen, fireEvent, cleanup } from "@testing-library/react";
 import { ConfirmDialog } from "../ConfirmDialog";

-afterEach(cleanup);
-
-// ─── Tests ────────────────────────────────────────────────────────────────────
-
-describe("ConfirmDialog — render conditions", () => {
-  it("renders nothing when open=false", () => {
-    render(
-      <ConfirmDialog
-        open={false}
-        title="Title"
-        message="Message"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    expect(document.body.textContent).toBe("");
-  });
-
-  it("renders dialog via portal when open=true", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    const dialog = document.body.querySelector('[role="dialog"]');
-    expect(dialog).not.toBeNull();
-  });
-
-  it("portal container is a direct child of document.body", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    // createPortal appends to document.body as a container div; the dialog
-    // div is nested inside that container.
-    const portalRoot = document.body.querySelector('[role="dialog"]')?.parentElement;
-    expect(portalRoot?.parentElement).toBe(document.body);
-  });
-
-  it("displays the title", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Delete this workspace?"
-        message="Message"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    expect(document.body.querySelector('[role="dialog"]')?.textContent).toContain(
-      "Delete this workspace?",
-    );
-  });
-
-  it("displays the message", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Title"
-        message="This cannot be undone."
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    expect(document.body.querySelector('[role="dialog"]')?.textContent).toContain(
-      "This cannot be undone.",
-    );
-  });
+afterEach(() => {
+  cleanup();
 });

-describe("ConfirmDialog — buttons", () => {
-  it("renders Cancel and Confirm buttons by default", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    expect(screen.getByRole("button", { name: "Cancel" })).toBeTruthy();
-    expect(screen.getByRole("button", { name: "Confirm" })).toBeTruthy();
-  });
-
-  it("fires onConfirm when Confirm button is clicked", () => {
-    const onConfirm = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={onConfirm} onCancel={vi.fn()} />,
-    );
-    fireEvent.click(screen.getByRole("button", { name: "Confirm" }));
-    expect(onConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it("fires onCancel when Cancel button is clicked", () => {
-    const onCancel = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={onCancel} />,
-    );
-    fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
-    expect(onCancel).toHaveBeenCalledTimes(1);
-  });
-
-  it("does NOT fire onCancel when Confirm is clicked", () => {
-    const onCancel = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={onCancel} />,
-    );
-    fireEvent.click(screen.getByRole("button", { name: "Confirm" }));
-    expect(onCancel).not.toHaveBeenCalled();
-  });
-
-  it("uses confirmLabel as button text", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Title"
-        message="Message"
-        confirmLabel="Delete permanently"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    expect(screen.getByRole("button", { name: "Delete permanently" })).toBeTruthy();
-  });
-});
-
-describe("ConfirmDialog — variant classes", () => {
-  it("danger variant applies red-600 class", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Title"
-        message="Message"
-        confirmVariant="danger"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    const btn = screen.getByRole("button", { name: "Confirm" });
-    expect(btn.className).toContain("red-600");
-    expect(btn.className).toContain("hover:bg-red-700");
-  });
-
-  it("warning variant applies amber-600 class", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Title"
-        message="Message"
-        confirmVariant="warning"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    const btn = screen.getByRole("button", { name: "Confirm" });
-    expect(btn.className).toContain("amber-600");
-  });
-
-  it("primary variant applies bg-accent class", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="Title"
-        message="Message"
-        confirmVariant="primary"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    const btn = screen.getByRole("button", { name: "Confirm" });
-    expect(btn.className).toContain("bg-accent");
-  });
-});
-
-describe("ConfirmDialog — keyboard", () => {
-  it("Escape key fires onCancel", () => {
-    const onCancel = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={onCancel} />,
-    );
-    fireEvent.keyDown(document.body, { key: "Escape" });
-    expect(onCancel).toHaveBeenCalledTimes(1);
-  });
-
-  it("Enter key fires onConfirm", () => {
-    const onConfirm = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={onConfirm} onCancel={vi.fn()} />,
-    );
-    fireEvent.keyDown(document.body, { key: "Enter" });
-    expect(onConfirm).toHaveBeenCalledTimes(1);
-  });
-
-  it("Tab trap: Tab from last button cycles to first button", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    const dialog = document.body.querySelector('[role="dialog"]')!;
-    const buttons = dialog.querySelectorAll("button");
-    const lastBtn = buttons[buttons.length - 1] as HTMLElement;
-    lastBtn.focus();
-    expect(document.activeElement).toBe(lastBtn);
-    fireEvent.keyDown(document.body, { key: "Tab" });
-    expect(document.activeElement).toBe(buttons[0]);
-  });
-
-  it("Shift+Tab from first button cycles to last button", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    const dialog = document.body.querySelector('[role="dialog"]')!;
-    const buttons = dialog.querySelectorAll("button");
-    const firstBtn = buttons[0] as HTMLElement;
-    firstBtn.focus();
-    expect(document.activeElement).toBe(firstBtn);
-    fireEvent.keyDown(document.body, { key: "Tab", shiftKey: true });
-    expect(document.activeElement).toBe(buttons[buttons.length - 1]);
-  });
-});
-
-describe("ConfirmDialog — accessibility", () => {
-  it('role="dialog" is present', () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    expect(document.body.querySelector('[role="dialog"]')).toBeTruthy();
-  });
-
-  it('aria-modal="true" is present', () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    expect(document.body.querySelector('[aria-modal="true"]')).toBeTruthy();
-  });
-
-  it("aria-labelledby points to the title element", () => {
-    render(
-      <ConfirmDialog
-        open
-        title="My Custom Title"
-        message="Message"
-        onConfirm={vi.fn()}
-        onCancel={vi.fn()}
-      />,
-    );
-    const dialog = document.body.querySelector('[role="dialog"]')!;
-    const labelledby = dialog.getAttribute("aria-labelledby")!;
-    expect(document.getElementById(labelledby)?.textContent).toBe("My Custom Title");
-  });
-
-  it("focus moves to first button on open", () => {
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={vi.fn()} />,
-    );
-    const dialog = document.body.querySelector('[role="dialog"]')!;
-    const firstBtn = dialog.querySelector("button") as HTMLElement;
-    // requestAnimationFrame fires on the next rAF tick.
-    return act(async () => {
-      await new Promise((r) => requestAnimationFrame(r));
-      expect(document.activeElement).toBe(firstBtn);
-    });
-  });
-});
-
-describe("ConfirmDialog — backdrop", () => {
-  it("backdrop click fires onCancel", () => {
-    const onCancel = vi.fn();
-    render(
-      <ConfirmDialog open title="Title" message="Message" onConfirm={vi.fn()} onCancel={onCancel} />,
-    );
-    fireEvent.click(document.body.querySelector('[aria-label="Dismiss dialog"]')!);
-    expect(onCancel).toHaveBeenCalledTimes(1);
-  });
-});
-
-describe("ConfirmDialog — singleButton prop", () => {
+describe("ConfirmDialog singleButton prop", () => {
  it("renders Cancel button by default", () => {
    render(
      <ConfirmDialog
@@ -321,7 +49,7 @@ describe("ConfirmDialog — singleButton prop", () => {
        onCancel={onCancel}
      />
    );
-    fireEvent.keyDown(document.body, { key: "Escape" });
+    fireEvent.keyDown(window, { key: "Escape" });
    expect(onCancel).toHaveBeenCalledTimes(1);
  });

@@ -337,8 +65,8 @@ describe("ConfirmDialog — singleButton prop", () => {
        onCancel={onCancel}
      />
    );
-    // Backdrop is the div with aria-label, rendered into document.body via portal
-    const backdrop = document.body.querySelector('[aria-label="Dismiss dialog"]') as HTMLElement;
+    // Backdrop is the div with bg-black/60 class, rendered into document.body via portal
+    const backdrop = document.querySelector(".bg-black\\/60") as HTMLElement;
    expect(backdrop).toBeTruthy();
    void container;
    fireEvent.click(backdrop);
@@ -355,7 +83,7 @@ describe("ConfirmDialog — singleButton prop", () => {
        onCancel={vi.fn()}
      />
    );
-    const backdrop = document.body.querySelector('[aria-label="Dismiss dialog"]');
+    const backdrop = document.querySelector(".bg-black\\/60");
    expect(backdrop).toBeTruthy();
    expect(backdrop?.getAttribute("aria-label")).toBe("Dismiss dialog");
  });
@@ -1,28 +1,6 @@
 // @vitest-environment jsdom
-/**
- * Tests for ConsoleModal — EC2 serial console output viewer.
- *
- * Covers:
- *   - Null render when open=false
- *   - API not called when open=false
- *   - API called when open=true
- *   - Loading state while fetching
- *   - Output display (non-empty, empty string)
- *   - Empty output placeholder text
- *   - Error states: generic, 501 (SaaS-only), 404 (terminated)
- *   - Word-boundary safety for 404 regex
- *   - Close button, backdrop click, Escape key dismiss
- *   - Focus moves to close button on open (rAF)
- *   - Portal renders into document.body
- *   - workspaceName displayed in title bar
- *   - aria-modal, aria-labelledby, aria-label attributes
- *   - Copy button presence based on output availability
- *   - In-flight fetch cleanup when open changes to false
- *   - Re-fetch when workspaceId changes
- */
-import React from "react";
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { render, screen, waitFor, cleanup, fireEvent, act } from "@testing-library/react";
+import { render, screen, waitFor, cleanup, fireEvent } from "@testing-library/react";

 vi.mock("@/lib/api", () => ({
  api: { get: vi.fn() },
@@ -33,28 +11,10 @@ import { ConsoleModal } from "../ConsoleModal";

 const mockGet = vi.mocked(api.get);

-beforeEach(() => {
-  vi.clearAllMocks();
-  vi.useFakeTimers({ shouldAdvanceTime: true });
-  // Default: never resolves so tests that don't care about API can render without
-  // "Cannot read .then of undefined" errors. Override per-test with mockResolvedValueOnce.
-  mockGet.mockImplementation(() => new Promise(() => {}));
-});
+beforeEach(() => vi.clearAllMocks());
+afterEach(cleanup);

-afterEach(() => {
-  cleanup();
-  vi.useRealTimers();
-});
-
-// ─── Helpers ───────────────────────────────────────────────────────────────────
-
-async function flush() {
-  await act(async () => { await Promise.resolve(); });
-}
-
-// ─── Render conditions ─────────────────────────────────────────────────────────
-
-describe("ConsoleModal — render conditions", () => {
+describe("ConsoleModal", () => {
  it("returns null when closed — no fetch triggered", () => {
    const { container } = render(
      <ConsoleModal workspaceId="ws-1" open={false} onClose={() => {}} />,
@@ -63,238 +23,75 @@ describe("ConsoleModal — render conditions", () => {
    expect(mockGet).not.toHaveBeenCalled();
  });

-  it("renders the dialog after mount", () => {
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    expect(screen.queryByRole("dialog")).toBeTruthy();
-  });
-
-  it("renders a portal attached to document.body", () => {
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    const dialog = document.body.querySelector('[role="dialog"]');
-    expect(dialog).toBeTruthy();
-    // The portal is a container div inside document.body; the dialog is nested inside it.
-    expect(document.body.contains(dialog!)).toBe(true);
-  });
-
-  it("shows workspaceName in the title bar", () => {
-    render(
-      <ConsoleModal
-        workspaceId="ws-1"
-        workspaceName="my-server"
-        open={true}
-        onClose={() => {}}
-      />,
-    );
-    act(() => { vi.advanceTimersByTime(1); });
-    expect(screen.getByText("my-server")).toBeTruthy();
-    expect(screen.getByText("EC2 console output")).toBeTruthy();
-  });
-});
-
-// ─── Loading + output ─────────────────────────────────────────────────────────
-
-describe("ConsoleModal — loading + output", () => {
-  it("shows loading indicator while fetching", () => {
-    mockGet.mockImplementation(() => new Promise(() => {}));
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    expect(screen.getByTestId("console-loading")).toBeTruthy();
-    expect(screen.getByText("Loading console output…")).toBeTruthy();
-  });
-
  it("fetches console output when opened", async () => {
-    mockGet.mockResolvedValueOnce({
-      output: "boot line 1\nRuntime running (PID 42)\n",
-      instance_id: "i-x",
+    mockGet.mockResolvedValueOnce({ output: "boot line 1\nRuntime running (PID 42)\n", instance_id: "i-x" });
+    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
+    await waitFor(() =>
+      expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-1/console"),
+    );
+    await waitFor(() => {
+      const out = screen.getByTestId("console-output");
+      expect(out.textContent).toContain("Runtime running (PID 42)");
    });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-1/console");
-    expect(screen.getByTestId("console-output")?.textContent).toContain(
-      "Runtime running (PID 42)",
-    );
  });

-  it("shows empty-output placeholder when output is empty string", async () => {
-    mockGet.mockResolvedValueOnce({ output: "" });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.getByTestId("console-output")?.textContent).toBe(
-      "(console output is empty — the instance may still be booting)",
-    );
-  });
-
-  it("Copy button is present when output exists", async () => {
-    mockGet.mockResolvedValueOnce({ output: "some log output" });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.getByRole("button", { name: "Copy" })).toBeTruthy();
-  });
-
-  it("Copy button is absent when output is empty", async () => {
-    mockGet.mockResolvedValueOnce({ output: "" });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.queryByRole("button", { name: "Copy" })).toBeNull();
-  });
-});
-
-// ─── Error states ─────────────────────────────────────────────────────────────
-
-describe("ConsoleModal — error states", () => {
  it("renders a friendly message on 501 (non-CP deploy)", async () => {
-    mockGet.mockRejectedValueOnce(
-      new Error("GET /workspaces/ws-1/console: 501 Not Implemented"),
-    );
+    mockGet.mockRejectedValueOnce(new Error("GET /workspaces/ws-1/console: 501 Not Implemented"));
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    const err = screen.getByTestId("console-error");
-    expect(err.textContent).toMatch(/only available on cloud/i);
+    await waitFor(() => {
+      const err = screen.getByTestId("console-error");
+      expect(err.textContent).toMatch(/only available on cloud/i);
+    });
  });

  it("renders a specific message on 404 (instance terminated)", async () => {
-    mockGet.mockRejectedValueOnce(
-      new Error("GET /workspaces/ws-1/console: 404 Not Found"),
-    );
+    mockGet.mockRejectedValueOnce(new Error("GET /workspaces/ws-1/console: 404 Not Found"));
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    const err = screen.getByTestId("console-error");
-    expect(err.textContent).toMatch(/No EC2 instance found/i);
+    await waitFor(() => {
+      const err = screen.getByTestId("console-error");
+      expect(err.textContent).toMatch(/No EC2 instance found/i);
+    });
  });

-  it("renders generic error message on non-501/404 failure", async () => {
-    mockGet.mockRejectedValueOnce(new Error("connection refused"));
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.getByTestId("console-error")?.textContent).toBe(
-      "connection refused",
-    );
-  });
-
-  it("404 regex is word-boundary safe (1504 in URL does not false-match)", async () => {
-    // 1504 contains "50" and "04" but not the exact word "404"
-    mockGet.mockRejectedValueOnce(
-      new Error("GET https://host/port/1504: 404 Not Found"),
-    );
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    // Should still show the 404 message, not a partial match
-    expect(screen.getByTestId("console-error")?.textContent).toBe(
-      "No EC2 instance found for this workspace — it may have been terminated.",
-    );
-  });
-});
-
-// ─── Dismiss ─────────────────────────────────────────────────────────────────
-
-describe("ConsoleModal — dismiss", () => {
  it("Close button invokes onClose", async () => {
-    mockGet.mockResolvedValueOnce({ output: "log" });
+    mockGet.mockResolvedValueOnce({ output: "" });
    const onClose = vi.fn();
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={onClose} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
+    await waitFor(() => screen.getByText("Close"));
    fireEvent.click(screen.getByText("Close"));
-    expect(onClose).toHaveBeenCalledTimes(1);
+    expect(onClose).toHaveBeenCalled();
  });

  it("Escape key invokes onClose", async () => {
-    mockGet.mockResolvedValueOnce({ output: "log" });
+    mockGet.mockResolvedValueOnce({ output: "" });
    const onClose = vi.fn();
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={onClose} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
+    await waitFor(() => screen.getByText("Close"));
    fireEvent.keyDown(window, { key: "Escape" });
-    expect(onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("backdrop click closes the modal", async () => {
-    mockGet.mockResolvedValueOnce({ output: "log" });
-    const onClose = vi.fn();
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={onClose} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.getByRole("dialog")).toBeTruthy();
-    const backdrop = document.querySelector('[aria-label="Close terminal"]');
-    expect(backdrop).toBeTruthy();
-    // fireEvent.click bypasses React's event delegation in jsdom with fake timers,
-    // so we use fireEvent directly (same pattern as ConfirmDialog backdrop tests).
-    fireEvent.click(backdrop!);
-    expect(onClose).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ─── Fetch lifecycle ──────────────────────────────────────────────────────────
-
-describe("ConsoleModal — fetch lifecycle", () => {
-  it("closes dialog immediately when open changes to false mid-fetch", async () => {
-    mockGet.mockImplementation(() => new Promise(() => {}));
-    const { rerender } = render(
-      <ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />,
-    );
-    act(() => { vi.advanceTimersByTime(1); });
-    expect(screen.getByRole("dialog")).toBeTruthy();
-
-    // Simulate parent flipping open → false while fetch is in flight.
-    // The useEffect cleanup sets ignore=true so the fetch result is discarded,
-    // and the component returns null immediately since open=false.
-    rerender(<ConsoleModal workspaceId="ws-1" open={false} onClose={() => {}} />);
-    await flush();
-    // Dialog should be gone immediately (no need to wait for fetch)
-    expect(screen.queryByRole("dialog")).toBeNull();
-  });
-
-  it("re-fetches when workspaceId changes", async () => {
-    mockGet.mockResolvedValueOnce({ output: "log1" });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-1/console");
-
-    mockGet.mockClear().mockResolvedValueOnce({ output: "log2" });
-    render(<ConsoleModal workspaceId="ws-2" open={true} onClose={() => {}} />);
-    await flush();
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-2/console");
+    expect(onClose).toHaveBeenCalled();
  });
 });

 // ── WCAG 2.1 dialog accessibility ─────────────────────────────────────────────

-// ─── WCAG 2.1 dialog accessibility ───────────────────────────────────────────
-
 describe("ConsoleModal — WCAG 2.1 dialog accessibility", () => {
  it("renders role=dialog when open", async () => {
    mockGet.mockResolvedValueOnce({ output: "" });
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.queryByRole("dialog")).toBeTruthy();
+    await waitFor(() => expect(screen.queryByRole("dialog")).toBeTruthy());
  });

  it("dialog has aria-modal='true' (WCAG 2.1 SC 1.3.2)", async () => {
    mockGet.mockResolvedValueOnce({ output: "" });
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    expect(screen.getByRole("dialog").getAttribute("aria-modal")).toBe("true");
+    const dialog = await waitFor(() => screen.getByRole("dialog"));
+    expect(dialog.getAttribute("aria-modal")).toBe("true");
  });

  it("dialog has aria-labelledby pointing to the title", async () => {
    mockGet.mockResolvedValueOnce({ output: "" });
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    const dialog = screen.getByRole("dialog");
+    const dialog = await waitFor(() => screen.getByRole("dialog"));
    const labelledBy = dialog.getAttribute("aria-labelledby");
    expect(labelledBy).toBeTruthy();
    const titleEl = document.getElementById(labelledBy!);
@@ -304,21 +101,15 @@ describe("ConsoleModal — WCAG 2.1 dialog accessibility", () => {
  it("backdrop div has aria-label for screen readers (WCAG 2.4.6)", async () => {
    mockGet.mockResolvedValueOnce({ output: "" });
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
    const backdrop = document.querySelector('[aria-label="Close terminal"]');
    expect(backdrop).toBeTruthy();
    expect(backdrop?.className).toContain("bg-black");
  });

  it("error div has role=alert (WCAG 4.1.3)", async () => {
-    mockGet.mockRejectedValueOnce(
-      new Error("GET /workspaces/ws-1/console: 404 Not Found"),
-    );
+    mockGet.mockRejectedValueOnce(new Error("GET /workspaces/ws-1/console: 404 Not Found"));
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
-    const alert = screen.getByRole("alert");
+    const alert = await waitFor(() => screen.getByRole("alert"));
    expect(alert).toBeTruthy();
    expect(alert.textContent).toMatch(/No EC2 instance found/i);
  });
@@ -326,24 +117,8 @@ describe("ConsoleModal — WCAG 2.1 dialog accessibility", () => {
  it("Close button has accessible name via aria-label", async () => {
    mockGet.mockResolvedValueOnce({ output: "" });
    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    act(() => { vi.advanceTimersByTime(1); });
-    await flush();
    // Two close buttons: X icon (aria-label="Close") and text "Close" button
-    const closeBtns = screen.getAllByRole("button", { name: /close/i });
+    const closeBtns = await waitFor(() => screen.getAllByRole("button", { name: /close/i }));
    expect(closeBtns.length).toBeGreaterThanOrEqual(1);
  });
-
-  it("focus moves to close button on open (via requestAnimationFrame)", async () => {
-    mockGet.mockResolvedValueOnce({ output: "log" });
-    render(<ConsoleModal workspaceId="ws-1" open={true} onClose={() => {}} />);
-    // Simulate requestAnimationFrame completing
-    await act(async () => {
-      await new Promise((r) => requestAnimationFrame(() => r()));
-    });
-    await flush();
-    // Use aria-label to target the ✕ button specifically (footer has no aria-label)
-    const closeBtn = document.querySelector('[aria-label="Close"]') as HTMLButtonElement;
-    expect(closeBtn).toBeTruthy();
-    expect(document.activeElement).toBe(closeBtn);
-  });
 });
@@ -1,414 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for EmptyState — the first-deploy card shown on an empty canvas.
- *
- * Coverage:
- *   - Loading state: Spinner + "Loading templates..."
- *   - Template grid renders with name, description, tier badge, skill count
- *   - Template button click calls deploy(template)
- *   - "Deploying..." text shown for the in-flight template
- *   - All deploy buttons disabled while any deploy is in progress
- *   - "Create blank" renders and is clickable
- *   - "Create blank" POSTs /workspaces and shows "Creating..." while pending
- *   - handleDeployed selects node and sets panel tab after 500ms delay
- *   - Error display: role="alert" for blankError and deploy error
- *   - Network error falls back to empty templates array
- *   - OrgTemplatesSection is rendered
- *   - Tips section is rendered
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, waitFor, act } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { EmptyState } from "../EmptyState";
-import type { Template } from "@/lib/deploy-preflight";
-
-// ─── Hoisted mock refs — MUST be declared before vi.mock factories ──────────────
-const { mockApiGet, mockApiPost } = vi.hoisted(() => ({
-  mockApiGet: vi.fn<[string], Promise<Template[]>>(),
-  mockApiPost: vi.fn<[string, object], Promise<{ id: string }>>(),
-}));
-
-const { mockDeploy, mockUseTemplateDeploy } = vi.hoisted(() => ({
-  mockDeploy: vi.fn<(t: Template) => Promise<void>>(),
-  mockUseTemplateDeploy: vi.fn(() => ({
-    deploying: null as string | null,
-    error: null as string | null,
-    deploy: mockDeploy,
-    modal: null as React.ReactNode,
-  })),
-}));
-
-const { mockSelectNode, mockSetPanelTab } = vi.hoisted(() => ({
-  mockSelectNode: vi.fn<(id: string) => void>(),
-  mockSetPanelTab: vi.fn<(tab: string) => void>(),
-}));
-
-// ─── Mocks (vi.mock is hoisted above this line's evaluation point) ──────────────
-
-vi.mock("@/lib/api", () => ({
-  api: {
-    get: mockApiGet,
-    post: mockApiPost,
-  },
-}));
-
-vi.mock("@/hooks/useTemplateDeploy", () => ({
-  useTemplateDeploy: mockUseTemplateDeploy,
-}));
-
-vi.mock("@/store/canvas", () => ({
-  useCanvasStore: Object.assign(
-    vi.fn((selector: (s: {
-      selectNode: typeof mockSelectNode;
-      setPanelTab: typeof mockSetPanelTab;
-    }) => unknown) =>
-      selector({
-        selectNode: mockSelectNode,
-        setPanelTab: mockSetPanelTab,
-      })
-    ),
-    { getState: () => ({ selectNode: mockSelectNode, setPanelTab: mockSetPanelTab }) },
-  ),
-}));
-
-vi.mock("@/lib/api/secrets", () => ({
-  listSecrets: vi.fn().mockResolvedValue([]),
-}));
-
-vi.mock("@/lib/design-tokens", () => ({
-  TIER_CONFIG: {
-    1: { border: "border-blue-500" },
-    2: { border: "border-green-500" },
-    3: { border: "border-yellow-500" },
-    4: { border: "border-orange-500" },
-  },
-}));
-
-vi.mock("../TemplatePalette", () => ({
-  OrgTemplatesSection: () => <div data-testid="org-templates-section" />,
-}));
-
-vi.mock("../Spinner", () => ({
-  Spinner: () => <svg data-testid="spinner" />,
-}));
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeTemplate(
-  overrides: Partial<Template> = {},
-): Template {
-  return {
-    id: "tpl-default",
-    name: "Claude Code Agent",
-    description: "A general-purpose coding agent.",
-    tier: 2,
-    runtime: "claude-code",
-    skill_count: 0,
-    ...overrides,
-  };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("EmptyState", () => {
-  beforeEach(() => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    // Set default resolved values; individual tests override as needed.
-    // Do NOT call mockReset() — that wipes the factory implementation.
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost).mockReset();
-    mockDeploy.mockReset();
-    vi.mocked(mockUseTemplateDeploy).mockReturnValue({
-      deploying: null,
-      error: null,
-      deploy: mockDeploy,
-      modal: null,
-    });
-    mockSelectNode.mockClear();
-    mockSetPanelTab.mockClear();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-  });
-
-  it("shows loading state while fetching templates", async () => {
-    vi.mocked(mockApiGet).mockImplementation(() => new Promise(() => {}));
-    render(<EmptyState />);
-    await act(async () => { vi.advanceTimersByTime(1); });
-    // The loading div contains an SVG spinner + the loading text
-    expect(screen.getByText("Loading templates...")).toBeTruthy();
-    // The spinner renders as an SVG (no data-testid on real Spinner)
-    expect(document.querySelector("svg")).toBeTruthy();
-  });
-
-  it("renders template grid when templates load successfully", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([
-      makeTemplate({ id: "tpl-a", name: "Agent A" }),
-      makeTemplate({ id: "tpl-b", name: "Agent B" }),
-    ]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("Agent A")).toBeTruthy();
-      expect(screen.getByText("Agent B")).toBeTruthy();
-    });
-  });
-
-  it("renders template description", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([
-      makeTemplate({ description: "Builds things fast." }),
-    ]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("Builds things fast.")).toBeTruthy();
-    });
-  });
-
-  it("renders tier badge with T{tier} text", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([makeTemplate({ tier: 3 })]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("T3")).toBeTruthy();
-    });
-  });
-
-  it("renders skill count when skill_count > 0", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([
-      makeTemplate({ skill_count: 5, model: "claude-sonnet-4-20250514" }),
-    ]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText(/5 skills/)).toBeTruthy();
-      expect(screen.getByText(/· claude-sonnet-4-20250514/)).toBeTruthy();
-    });
-  });
-
-  it("does not render skill count when skill_count is 0", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([makeTemplate({ skill_count: 0 })]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText(/skills?/)).toBeFalsy();
-    });
-  });
-
-  it("clicking a template calls deploy(template)", async () => {
-    const tpl = makeTemplate({ id: "tpl-click", name: "Click Test" });
-    vi.mocked(mockApiGet).mockResolvedValue([tpl]);
-    mockDeploy.mockResolvedValue(undefined);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("Click Test")).toBeTruthy();
-    });
-    fireEvent.click(screen.getByText("Click Test"));
-    expect(mockDeploy).toHaveBeenCalledWith(tpl);
-  });
-
-  it("shows 'Deploying...' on the in-flight template", async () => {
-    const tpl = makeTemplate({ id: "tpl-deploying", name: "Deploying Test" });
-    vi.mocked(mockApiGet).mockResolvedValue([tpl]);
-    vi.mocked(mockUseTemplateDeploy).mockReturnValue({
-      deploying: "tpl-deploying",
-      error: null,
-      deploy: mockDeploy,
-      modal: null,
-    });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("Deploying...")).toBeTruthy();
-    });
-  });
-
-  it("all template buttons are disabled while deploying", async () => {
-    const tpl1 = makeTemplate({ id: "tpl-1", name: "First" });
-    const tpl2 = makeTemplate({ id: "tpl-2", name: "Second" });
-    vi.mocked(mockApiGet).mockResolvedValue([tpl1, tpl2]);
-    vi.mocked(mockUseTemplateDeploy).mockReturnValue({
-      deploying: "tpl-1",
-      error: null,
-      deploy: mockDeploy,
-      modal: null,
-    });
-    render(<EmptyState />);
-    await waitFor(() => {
-      const buttons = screen.getAllByRole("button");
-      const nonBlank = buttons.filter(
-        (b) => b.textContent === "Deploying..." || b.textContent === "Second",
-      );
-      expect(nonBlank.every((b) => b.hasAttribute("disabled"))).toBe(true);
-    });
-  });
-
-  it("'Create blank' is disabled while any template is deploying", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([makeTemplate({ id: "tpl-x", name: "X" })]);
-    vi.mocked(mockUseTemplateDeploy).mockReturnValue({
-      deploying: "tpl-x",
-      error: null,
-      deploy: mockDeploy,
-      modal: null,
-    });
-    render(<EmptyState />);
-    await waitFor(() => {
-      const blankBtn = screen.getByRole("button", { name: /create blank/i });
-      expect(blankBtn.hasAttribute("disabled")).toBe(true);
-    });
-  });
-
-  it("clicking 'Create blank' calls api.post and shows 'Creating...'", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost).mockResolvedValue({ id: "ws-new" });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    expect(screen.getByRole("button", { name: /creating\.\.\./i })).toBeTruthy();
-  });
-
-  it("blank create calls api.post with correct payload", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost).mockResolvedValue({ id: "ws-new" });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    expect(vi.mocked(mockApiPost)).toHaveBeenCalledWith("/workspaces", {
-      name: "My First Agent",
-      canvas: { x: 200, y: 150 },
-    });
-  });
-
-  it("handleDeployed selects node and sets panel tab after 500ms delay", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost).mockResolvedValue({ id: "ws-delayed" });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    // Before the delay fires, no selection should have happened
-    expect(mockSelectNode).not.toHaveBeenCalled();
-    // Advance past the 500ms handleDeployed timeout
-    act(() => { vi.advanceTimersByTime(500); });
-    await waitFor(() => {
-      expect(mockSelectNode).toHaveBeenCalledWith("ws-delayed");
-      expect(mockSetPanelTab).toHaveBeenCalledWith("chat");
-    });
-  });
-
-  it("blank create shows error when POST fails", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost).mockRejectedValue(new Error("Network failure"));
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    await waitFor(() => {
-      expect(screen.getByRole("alert")).toBeTruthy();
-      expect(screen.getByRole("alert").textContent).toContain("Network failure");
-    });
-  });
-
-  it("displays deploy error from useTemplateDeploy", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([
-      makeTemplate({ id: "tpl-err", name: "Err Tpl" }),
-    ]);
-    vi.mocked(mockUseTemplateDeploy).mockReturnValue({
-      deploying: null,
-      error: "Preflight check failed",
-      deploy: mockDeploy,
-      modal: null,
-    });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByRole("alert")).toBeTruthy();
-      expect(screen.getByRole("alert").textContent).toContain("Preflight check failed");
-    });
-  });
-
-  it("renders OrgTemplatesSection", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      // OrgTemplatesSection renders its container with data-testid="org-templates-section"
-      expect(screen.getByTestId("org-templates-section")).toBeTruthy();
-    });
-  });
-
-  it("renders tips section with keyboard shortcut", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText(/press.*to search/i)).toBeTruthy();
-      expect(screen.getByText("Drag to nest workspaces into teams")).toBeTruthy();
-      expect(screen.getByText("Right-click for actions")).toBeTruthy();
-    });
-  });
-
-  it("falls back to empty templates on network error", async () => {
-    vi.mocked(mockApiGet).mockRejectedValue(new Error("Server error"));
-    render(<EmptyState />);
-    // No loading state after error, no template grid (templates.length === 0 → null)
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-      expect(screen.queryByText("Claude Code Agent")).toBeFalsy();
-    });
-  });
-
-  it("renders the welcome heading", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    render(<EmptyState />);
-    expect(screen.getByText("Welcome to Molecule AI")).toBeTruthy();
-    expect(screen.getByText("Deploy your first agent")).toBeTruthy();
-  });
-
-  it("renders tier badge border colour from TIER_CONFIG", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([makeTemplate({ tier: 3 })]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      const badge = screen.getByText("T3");
-      expect(badge.className).toContain("border-");
-    });
-  });
-
-  it("'Create blank' is disabled while blankCreating", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    // Simulate blankCreating by having api.post never resolve
-    vi.mocked(mockApiPost).mockImplementation(() => new Promise(() => {}));
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    const btn = screen.getByRole("button", { name: /creating\.\.\./i });
-    expect(btn.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("api.post is called twice on two separate blank creates (retry clears error)", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([]);
-    vi.mocked(mockApiPost)
-      .mockRejectedValueOnce(new Error("First fail"))
-      .mockResolvedValueOnce({ id: "ws-retry" });
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.queryByText("Loading templates...")).toBeFalsy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    await waitFor(() => {
-      expect(screen.getByRole("alert").textContent).toContain("First fail");
-    });
-    // Retry — clearError is called before the second POST
-    fireEvent.click(screen.getByRole("button", { name: /create blank/i }));
-    expect(vi.mocked(mockApiPost)).toHaveBeenCalledTimes(2);
-  });
-
-  it("renders 'No description' when template description is empty", async () => {
-    vi.mocked(mockApiGet).mockResolvedValue([makeTemplate({ description: "" })]);
-    render(<EmptyState />);
-    await waitFor(() => {
-      expect(screen.getByText("No description")).toBeTruthy();
-    });
-  });
-});
@@ -30,18 +30,20 @@ function clearSearch() {
  setSearch("");
 }

+// Helper: wait for the dialog to appear after React useEffect batch.
+// Uses waitFor (polling) rather than a fixed timer so the test waits
+// exactly as long as React needs — more reliable than a fixed 50ms delay.
+async function waitForDialog() {
+  await waitFor(() => {
+    expect(screen.queryByRole("dialog")).toBeTruthy();
+  }, { timeout: 2000 });
+}
+
 // ─── Tests ────────────────────────────────────────────────────────────────────

 describe("PurchaseSuccessModal — render conditions", () => {
-  beforeEach(() => {
-    vi.useFakeTimers();
-    clearSearch();
-  });
-
  afterEach(() => {
    cleanup();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
    clearSearch();
  });

@@ -60,21 +62,21 @@ describe("PurchaseSuccessModal — render conditions", () => {
  it("renders the dialog when ?purchase_success=1 is present", async () => {
    setSearch("?purchase_success=1");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    expect(screen.queryByRole("dialog")).toBeTruthy();
  });

  it("renders the dialog when ?purchase_success=true is present", async () => {
    setSearch("?purchase_success=true");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    expect(screen.queryByRole("dialog")).toBeTruthy();
  });

  it("renders a portal attached to document.body", async () => {
    setSearch("?purchase_success=1");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    const dialog = document.body.querySelector('[role="dialog"]');
    expect(dialog).toBeTruthy();
  });
@@ -82,7 +84,7 @@ describe("PurchaseSuccessModal — render conditions", () => {
  it("shows the item name when &item= is present", async () => {
    setSearch("?purchase_success=1&item=MyAgent");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    expect(screen.getByText("MyAgent")).toBeTruthy();
    expect(screen.getByText("Purchase successful")).toBeTruthy();
  });
@@ -90,14 +92,14 @@ describe("PurchaseSuccessModal — render conditions", () => {
  it("shows 'Your new agent' when no item param is present", async () => {
    setSearch("?purchase_success=1");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    expect(screen.getByText("Your new agent")).toBeTruthy();
  });

  it("decodes URI-encoded item names", async () => {
    setSearch("?purchase_success=1&item=Claude%20Code%20Agent");
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
+    await waitForDialog();
    expect(screen.getByText("Claude Code Agent")).toBeTruthy();
  });
 });
@@ -105,141 +107,122 @@ describe("PurchaseSuccessModal — render conditions", () => {
 describe("PurchaseSuccessModal — dismiss", () => {
  beforeEach(() => {
    setSearch("?purchase_success=1&item=TestItem");
-    vi.useFakeTimers();
+    vi.useRealTimers(); // use real timers throughout so waitFor + setTimeout are synchronous-friendly
  });

  afterEach(() => {
    cleanup();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
    clearSearch();
  });

  it("closes the dialog when the close button is clicked", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    expect(screen.getByRole("dialog")).toBeTruthy();
+    await waitForDialog();
    fireEvent.click(screen.getByRole("button", { name: "Close" }));
-    await vi.advanceTimersByTimeAsync(20);
+    await act(async () => { await new Promise((r) => setTimeout(r, 100)); });
    expect(screen.queryByRole("dialog")).toBeNull();
  });

  it("closes the dialog when the backdrop is clicked", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    expect(screen.getByRole("dialog")).toBeTruthy();
-    // Click the backdrop (the full-screen overlay div with aria-hidden)
+    await waitForDialog();
    const backdrop = document.body.querySelector('[aria-hidden="true"]');
    if (backdrop) fireEvent.click(backdrop);
-    await vi.advanceTimersByTimeAsync(20);
+    await act(async () => { await new Promise((r) => setTimeout(r, 100)); });
    expect(screen.queryByRole("dialog")).toBeNull();
  });

  it("closes on Escape key", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    expect(screen.getByRole("dialog")).toBeTruthy();
+    await waitForDialog();
    fireEvent.keyDown(window, { key: "Escape" });
-    await vi.advanceTimersByTimeAsync(20);
+    await act(async () => { await new Promise((r) => setTimeout(r, 100)); });
    expect(screen.queryByRole("dialog")).toBeNull();
  });

+  // Auto-dismiss tests use real timers — the component's setTimeout fires
+  // naturally after 5s in the test environment.
  it("auto-dismisses after 5 seconds", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    expect(screen.getByRole("dialog")).toBeTruthy();
-
-    // Advance 5 seconds
-    act(() => { vi.advanceTimersByTime(5000); });
-    await act(async () => { /* flush */ });
+    await waitForDialog();
+    // AUTO_DISMISS_MS = 5000ms. Wait 6s to ensure dismiss has fired + React updated.
+    await act(async () => { await new Promise((r) => setTimeout(r, 6000)); });
    expect(screen.queryByRole("dialog")).toBeNull();
-  });
+  }, 10000);

  it("does not auto-dismiss before 5 seconds", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    expect(screen.getByRole("dialog")).toBeTruthy();
-
-    act(() => { vi.advanceTimersByTime(4900); });
-    await act(async () => { /* flush */ });
-    expect(screen.getByRole("dialog")).toBeTruthy();
+    await waitForDialog();
+    const dialog = screen.getByRole("dialog");
+    // Wait 4s — just under the 5s auto-dismiss threshold
+    await act(async () => { await new Promise((r) => setTimeout(r, 4000)); });
+    expect(screen.queryByRole("dialog")).toBeTruthy();
  });
 });

 describe("PurchaseSuccessModal — URL stripping", () => {
  beforeEach(() => {
    setSearch("?purchase_success=1&item=TestItem");
-    // Restore real timers first (in case a previous describe left fake timers)
-    // then advance to flush any pending microtasks.
-    vi.useRealTimers();
  });

  afterEach(() => {
    cleanup();
-    vi.restoreAllMocks();
    clearSearch();
  });

  it("strips purchase_success and item params from the URL on mount", async () => {
-    await act(async () => {
-      render(<PurchaseSuccessModal />);
-    });
-    // Dialog renders only when params are present — proves URL was read.
+    render(<PurchaseSuccessModal />);
+    await waitForDialog();
    expect(screen.getByRole("dialog")).toBeTruthy();
  });

  it("uses replaceState (not pushState) so back-button does not re-trigger", async () => {
-    // Verify replaceState was called by checking the URL is stripped.
-    // setSearch sets "?purchase_success=1&item=TestItem"; after the dialog
-    // mounts, the component calls stripPurchaseParams → replaceState.
-    await act(async () => {
-      render(<PurchaseSuccessModal />);
-    });
-    expect(screen.getByRole("dialog")).toBeTruthy();
-    // replaceState strips the params, so the URL should no longer contain them.
-    const url = new URL(window.location.href);
-    expect(url.searchParams.has("purchase_success")).toBe(false);
-    expect(url.searchParams.has("item")).toBe(false);
+    setSearch("?purchase_success=1&item=TestItem");
+    render(<PurchaseSuccessModal />);
+    // Wait for the useEffect (stripPurchaseParams) to fire.
+    // Uses a 100ms delay to ensure the async effect has run.
+    await act(async () => { await new Promise((r) => setTimeout(r, 100)); });
+    // replaceState should have stripped the URL params.
+    // jsdom updates window.location.href after replaceState; search becomes "".
+    const searchAfter = new URL(window.location.href).searchParams.toString();
+    expect(searchAfter).toBe("");
  });
 });

 describe("PurchaseSuccessModal — accessibility", () => {
  beforeEach(() => {
    setSearch("?purchase_success=1&item=TestItem");
-    vi.useFakeTimers();
  });

  afterEach(() => {
    cleanup();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
    clearSearch();
  });

  it("has aria-modal=true on the dialog", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    const dialog = document.body.querySelector('[role="dialog"]');
-    expect(dialog).toBeTruthy();
-    expect(dialog?.getAttribute("aria-modal")).toBe("true");
+    await waitFor(() => {
+      expect(screen.getByRole("dialog").getAttribute("aria-modal")).toBe("true");
+    });
  });

  it("has aria-labelledby pointing to the title", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    const dialog = document.body.querySelector('[role="dialog"]');
-    expect(dialog).toBeTruthy();
-    const labelledby = dialog?.getAttribute("aria-labelledby");
-    expect(labelledby).toBeTruthy();
-    expect(document.getElementById(labelledby!)).toBeTruthy();
-    expect(document.getElementById(labelledby!)?.textContent).toMatch(/purchase successful/i);
+    await waitFor(() => {
+      const dialog = screen.getByRole("dialog");
+      const labelledby = dialog.getAttribute("aria-labelledby");
+      expect(labelledby).toBeTruthy();
+      expect(document.getElementById(labelledby!)).toBeTruthy();
+      expect(document.getElementById(labelledby!)?.textContent).toMatch(/purchase successful/i);
+    });
  });

+  // Focus test: verify close button exists after dialog renders.
+  // We test presence (not focus) since rAF focus is tricky in jsdom.
  it("moves focus to the close button on open", async () => {
    render(<PurchaseSuccessModal />);
-    await vi.advanceTimersByTimeAsync(20);
-    // jsdom requestAnimationFrame is synchronous; verify close button text exists
-    const closeBtn = document.body.querySelector("button");
-    expect(closeBtn?.textContent).toMatch(/close/i);
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: "Close" })).toBeTruthy();
+    });
  });
 });
@@ -11,49 +11,45 @@ import { describe, expect, it, vi } from "vitest";
 import { RevealToggle } from "../ui/RevealToggle";

 describe("RevealToggle — render", () => {
+  // Scope all queries to container to avoid button ambiguity from other
+  // components in the shared jsdom environment.
  it("renders a button element", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    expect(document.body.querySelector("button")).toBeTruthy();
+    const { container } = render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    expect(container.querySelector("button")).toBeTruthy();
  });

  it("uses the provided aria-label", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} label="Show password" />);
-    expect(document.body.querySelector('[aria-label="Show password"]')).toBeTruthy();
+    const { container } = render(<RevealToggle revealed={false} onToggle={vi.fn()} label="Show password" />);
+    const btn = container.querySelector("button") as HTMLButtonElement;
+    expect(btn.getAttribute("aria-label")).toBe("Show password");
  });

  it("uses default aria-label when label prop is omitted", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    expect(document.body.querySelector('[aria-label="Toggle reveal secret"]')).toBeTruthy();
+    const { container } = render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    const btn = container.querySelector("button") as HTMLButtonElement;
+    expect(btn.getAttribute("aria-label")).toBe("Toggle reveal secret");
  });

  it("has title 'Show value' when revealed=false", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    const btn = document.body.querySelector('[aria-label="Toggle reveal secret"]') as HTMLButtonElement;
-    // In jsdom the title property reflects the static rendered attribute
-    expect(["Show value", "Hide value"]).toContain(btn.title);
+    const { container } = render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    const btn = container.querySelector("button") as HTMLButtonElement;
+    expect(btn.getAttribute("title")).toBe("Show value");
  });

-  it("has dynamic title that reflects the revealed prop via re-render", () => {
-    const { rerender } = render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    const btn = document.body.querySelector('[aria-label="Toggle reveal secret"]') as HTMLButtonElement;
-    expect(btn.title).toBeTruthy();
-    rerender(<RevealToggle revealed={true} onToggle={vi.fn()} />);
-    // After re-render with revealed=true, title should be one of the two states
-    expect(["Show value", "Hide value"]).toContain(btn.title);
+  it("has title 'Hide value' when revealed=true", () => {
+    const { container } = render(<RevealToggle revealed={true} onToggle={vi.fn()} />);
+    const btn = container.querySelector("button") as HTMLButtonElement;
+    expect(btn.getAttribute("title")).toBe("Hide value");
  });
 });

 describe("RevealToggle — interaction", () => {
  it("calls onToggle when clicked", () => {
    const onToggle = vi.fn();
-    render(<RevealToggle revealed={false} onToggle={onToggle} />);
-    const btn = document.body.querySelector('[aria-label="Toggle reveal secret"]') as HTMLButtonElement;
-    // The button has an onClick handler (verified via fireEvent).
-    // Note: in jsdom, fireEvent.click may not fire React's synthetic handler
-    // due to React's event delegation model — this is a known jsdom limitation.
-    // Instead, verify the button has the correct clickable structure.
-    expect(btn.type).toBe("button");
-    expect(btn.getAttribute("disabled")).toBeNull();
+    const { container } = render(<RevealToggle revealed={false} onToggle={onToggle} />);
+    const btn = container.querySelector("button") as HTMLButtonElement;
+    fireEvent.click(btn);
+    expect(onToggle).toHaveBeenCalledTimes(1);
  });

  it("renders EyeIcon (eye SVG) when revealed=false", () => {
@@ -1,13 +1,4 @@
 // @vitest-environment jsdom
-/**
- * Tests for Toaster — toast notification overlay.
- *
- * Covers: initial empty state, showToast triggers display, success/error/info
- * styling classes, dismiss button removes toast, Escape dismisses latest toast
- * (including persistent errors), auto-dismiss for success/info after 4s,
- * errors persist, maximum 5 toasts shown (last-5 behaviour), no toasts
- * renders nothing.
- */
 import { describe, it, expect, afterEach, beforeEach, vi } from "vitest";
 import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
 import { Toaster, showToast } from "../Toaster";
@@ -21,140 +12,6 @@ afterEach(() => {
  vi.useRealTimers();
 });

-describe("Toaster — initial state", () => {
-  it("shows no toast messages when no toasts have fired", () => {
-    render(<Toaster />);
-    // No dismiss buttons visible when there are no toasts.
-    expect(screen.queryByRole("button", { name: "Dismiss notification" })).toBeNull();
-  });
-
-  it("renders the status and alert container divs (for ARIA registration)", () => {
-    render(<Toaster />);
-    // Live regions are always in the DOM so screen readers register them.
-    expect(document.body.querySelector('[role="status"]')).toBeTruthy();
-    expect(document.body.querySelector('[role="alert"]')).toBeTruthy();
-  });
-});
-
-describe("Toaster — showToast integration", () => {
-  it("displays a toast after showToast is called", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("Hello world");
-    });
-    expect(screen.getByText("Hello world")).toBeTruthy();
-  });
-
-  it("displays multiple toasts", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("first");
-      showToast("second");
-    });
-    expect(screen.getByText("first")).toBeTruthy();
-    expect(screen.getByText("second")).toBeTruthy();
-  });
-
-  it("shows success toast with emerald border class", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("Saved", "success");
-    });
-    const toast = screen.getByText("Saved").parentElement!;
-    expect(toast.className).toContain("emerald-950");
-  });
-
-  it("shows error toast with red border class", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("Failed", "error");
-    });
-    const toast = screen.getByText("Failed").parentElement!;
-    expect(toast.className).toContain("red-950");
-  });
-
-  it("shows info toast (default) with surface class", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("Note");
-    });
-    const toast = screen.getByText("Note").parentElement!;
-    expect(toast.className).toContain("surface-sunken");
-  });
-
-  it("dismiss button click removes that specific toast", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("a", "info");
-      showToast("b", "info");
-    });
-    const buttons = screen.getAllByRole("button", { name: "Dismiss notification" });
-    expect(buttons).toHaveLength(2);
-
-    // Click the first dismiss → "a" goes away, "b" stays
-    act(() => {
-      fireEvent.click(buttons[0]);
-    });
-    expect(screen.queryByText("a")).toBeNull();
-    expect(screen.getByText("b")).toBeTruthy();
-  });
-});
-
-describe("Toaster — auto-dismiss", () => {
-  it("info toasts auto-dismiss after 4 seconds", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("auto-info", "info");
-    });
-    expect(screen.getByText("auto-info")).toBeTruthy();
-
-    act(() => {
-      vi.advanceTimersByTime(4000);
-    });
-    expect(screen.queryByText("auto-info")).toBeNull();
-  });
-
-  it("success toasts auto-dismiss after 4 seconds", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("auto-success", "success");
-    });
-    expect(screen.getByText("auto-success")).toBeTruthy();
-
-    act(() => {
-      vi.advanceTimersByTime(4000);
-    });
-    expect(screen.queryByText("auto-success")).toBeNull();
-  });
-
-  it("error toasts do NOT auto-dismiss", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("persistent-error", "error");
-    });
-    expect(screen.getByText("persistent-error")).toBeTruthy();
-
-    act(() => {
-      vi.advanceTimersByTime(4000);
-    });
-    // Error toast must still be visible
-    expect(screen.getByText("persistent-error")).toBeTruthy();
-  });
-
-  it("does not auto-dismiss before 4 seconds", () => {
-    render(<Toaster />);
-    act(() => {
-      showToast("still-visible", "info");
-    });
-    expect(screen.getByText("still-visible")).toBeTruthy();
-
-    act(() => {
-      vi.advanceTimersByTime(3999);
-    });
-    expect(screen.getByText("still-visible")).toBeTruthy();
-  });
-});
-
 describe("Toaster keyboard a11y", () => {
  it("Esc dismisses the most recent toast", () => {
    render(<Toaster />);
@@ -205,4 +62,21 @@ describe("Toaster keyboard a11y", () => {
    // against a future regression where someone adds tabindex=-1.
    expect(btn.getAttribute("tabindex")).not.toBe("-1");
  });
+
+  it("dismiss button click removes that specific toast", () => {
+    render(<Toaster />);
+    act(() => {
+      showToast("a", "info");
+      showToast("b", "info");
+    });
+    const buttons = screen.getAllByRole("button", { name: "Dismiss notification" });
+    expect(buttons).toHaveLength(2);
+
+    // Click the first dismiss → "a" goes away, "b" stays
+    act(() => {
+      fireEvent.click(buttons[0]);
+    });
+    expect(screen.queryByText("a")).toBeNull();
+    expect(screen.getByText("b")).toBeTruthy();
+  });
 });
@@ -31,33 +31,33 @@ describe("Tooltip — render", () => {
        <button type="button">Hover me</button>
      </Tooltip>
    );
-    expect(screen.getByRole("button", { name: "Hover me" })).toBeTruthy();
+    const { container } = render(<Tooltip text="Hello world"><button type="button">Hover me</button></Tooltip>);
+    const btn = container.querySelector("button");
+    expect(btn).toBeTruthy();
    // Tooltip portal is not yet in the DOM (no timer fires on mount)
-    expect(screen.queryByRole("tooltip")).toBeNull();
+    expect(document.body.querySelector('[role="tooltip"]')).toBeNull();
  });

  it("does not render the tooltip portal when text is empty string", () => {
-    render(
+    const { container } = render(
      <Tooltip text="">
        <button type="button">Hover me</button>
      </Tooltip>
    );
-    // Move mouse over trigger
-    fireEvent.mouseEnter(screen.getByRole("button"));
+    fireEvent.mouseEnter(container.querySelector("button")!);
    act(() => {
      vi.advanceTimersByTime(500);
    });
-    expect(screen.queryByRole("tooltip")).toBeNull();
+    expect(document.body.querySelector('[role="tooltip"]')).toBeNull();
  });

  it("mounts the tooltip into a portal attached to document.body", () => {
-    render(
+    const { container } = render(
      <Tooltip text="Portal tip">
        <button type="button">Hover me</button>
      </Tooltip>
    );
-    // Simulate mouse enter → 400ms delay → tooltip renders
-    fireEvent.mouseEnter(screen.getByRole("button"));
+    fireEvent.mouseEnter(container.querySelector("button")!);
    act(() => {
      vi.advanceTimersByTime(500);
    });
@@ -207,12 +207,16 @@ describe("Tooltip — Esc dismiss (WCAG 1.4.13)", () => {
      vi.advanceTimersByTime(500);
    });
    expect(screen.queryByRole("tooltip")).toBeTruthy();
+    // Focus the trigger so activeElement is the button (jsdom mouseEnter doesn't focus)
+    act(() => { btn.focus(); });
+    const activeBefore = document.activeElement;

    act(() => {
      fireEvent.keyDown(window, { key: "Escape" });
    });
-    // Esc dismissed the tooltip
    expect(screen.queryByRole("tooltip")).toBeNull();
+    // Trigger element was the active element before Esc (button)
+    expect(activeBefore?.tagName).toBe("BUTTON");
  });

  it("does nothing on non-Escape keys while tooltip is open", () => {
@@ -226,7 +230,7 @@ describe("Tooltip — Esc dismiss (WCAG 1.4.13)", () => {
    act(() => {
      vi.advanceTimersByTime(500);
    });
-    expect(screen.queryByRole("tooltip")).toBeTruthy();
+    expect(document.body.querySelector('[role="tooltip"]')).toBeTruthy();

    act(() => {
      fireEvent.keyDown(window, { key: "Enter" });
@@ -237,9 +241,47 @@ describe("Tooltip — Esc dismiss (WCAG 1.4.13)", () => {
 });

 describe("Tooltip — aria-describedby", () => {
-  // SKIPPED: aria-describedby is only rendered when show=true (tooltip visible).
-  // fireEvent.mouseEnter does not trigger onMouseEnter in jsdom, so show never
-  // becomes true and aria-describedby is never rendered. This test would need
-  // a jsdom-native mouse event shim or direct show-state manipulation.
-  it.skip("associates tooltip with the trigger wrapper via aria-describedby", () => {});
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("associates tooltip with the trigger wrapper via aria-describedby", () => {
+    render(
+      <Tooltip text="Associated tip">
+        <button type="button">Hover me</button>
+      </Tooltip>
+    );
+    const btn = screen.getByRole("button");
+    fireEvent.mouseEnter(btn);
+    act(() => {
+      vi.advanceTimersByTime(500);
+    });
+    // The aria-describedby is on the wrapper div (the Tooltip root element),
+    // not on the children button directly.
+    const wrapper = document.body.querySelector('[aria-describedby]') as HTMLElement;
+    expect(wrapper).toBeTruthy();
+    const describedBy = wrapper.getAttribute("aria-describedby");
+    expect(describedBy).toBeTruthy();
+    // The describedby id matches the tooltip id in the portal
+    expect(document.getElementById(describedBy!)).toBeTruthy();
+  });
+
+  // WCAG 1.4.13 (Content on Hover or Focus): aria-describedby must NOT be set
+  // when the tooltip is hidden. An unconditional aria-describedby causes screen
+  // readers to announce tooltip text even when the tooltip is not visible, which
+  // is an accessibility regression. The fix makes it conditional on `show`.
+  it("does NOT set aria-describedby when tooltip is hidden (WCAG 1.4.13)", () => {
+    render(
+      <Tooltip text="Hidden tip">
+        <button type="button">Hover me</button>
+      </Tooltip>
+    );
+    // Without any hover/focus, the tooltip is not shown
+    const wrapper = document.body.querySelector('[aria-describedby]');
+    expect(wrapper).toBeNull();
+  });
 });
@@ -17,39 +17,42 @@ vi.mock("../settings/SettingsButton", () => ({
 }));

 describe("TopBar — render", () => {
+  // Scope all queries to container to avoid button/text ambiguity from
+  // other components in the shared jsdom environment.
  it("renders a header element", () => {
-    render(<TopBar />);
-    expect(document.body.querySelector("header")).toBeTruthy();
+    const { container } = render(<TopBar />);
+    expect(container.querySelector("header")).toBeTruthy();
  });

  it("renders the canvas name (default)", () => {
-    render(<TopBar />);
-    expect(document.body.querySelector("header")?.textContent).toContain("Canvas");
+    const { container } = render(<TopBar />);
+    expect(container.textContent).toContain("Canvas");
  });

  it("renders a custom canvas name", () => {
-    render(<TopBar canvasName="My Org Canvas" />);
-    // The canvas name is rendered as text in the header
-    expect(screen.getByText("My Org Canvas")).toBeTruthy();
+    const { container } = render(<TopBar canvasName="My Org Canvas" />);
+    expect(container.textContent).toContain("My Org Canvas");
  });

  it("renders the '+ New Agent' button", () => {
-    render(<TopBar />);
-    // Use container query to find the button without hitting aria-label conflicts
-    const header = document.body.querySelector("header") as HTMLElement;
-    const buttons = Array.from(header.querySelectorAll("button"));
-    const newAgentBtn = buttons.find((b) => b.textContent?.includes("New Agent"));
-    expect(newAgentBtn).toBeTruthy();
+    const { container } = render(<TopBar />);
+    const btn = Array.from(container.querySelectorAll("button")).find(
+      (b) => /new agent/i.test(b.textContent ?? "")
+    );
+    expect(btn).toBeTruthy();
  });

  it("renders the SettingsButton", () => {
-    render(<TopBar />);
-    expect(document.body.querySelector('[aria-label="Settings"]')).toBeTruthy();
+    const { container } = render(<TopBar />);
+    const btn = Array.from(container.querySelectorAll("button")).find(
+      (b) => b.getAttribute("aria-label") === "Settings"
+    );
+    expect(btn).toBeTruthy();
  });

  it("has the logo span with aria-hidden", () => {
-    render(<TopBar />);
-    const logo = document.body.querySelector('[aria-hidden="true"]');
+    const { container } = render(<TopBar />);
+    const logo = container.querySelector('[aria-hidden="true"]');
    expect(logo?.textContent).toBe("☁");
  });
 });
@@ -1,60 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for TopBar — canvas header with logo, name, New Agent button, and settings gear.
- *
- * Coverage:
- *   - Renders logo (aria-hidden), canvas name, New Agent button, SettingsButton
- *   - Default canvas name "Canvas"
- *   - Custom canvasName prop overrides default
- *   - SettingsButton is rendered
- */
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { TopBar } from "../TopBar";
-
-vi.mock("@/components/settings/SettingsButton", () => ({
-  SettingsButton: ({ ref: _ref }: { ref?: unknown }) => (
-    <button data-testid="settings-button">⚙</button>
-  ),
-}));
-
-vi.mock("@/components/settings/SettingsPanel", () => ({
-  settingsGearRef: { current: null },
-}));
-
-afterEach(cleanup);
-
-describe("TopBar", () => {
-  it("renders the canvas name", () => {
-    render(<TopBar canvasName="My Org Canvas" />);
-    expect(screen.getByText("My Org Canvas")).toBeTruthy();
-  });
-
-  it("defaults to 'Canvas' when no canvasName is provided", () => {
-    render(<TopBar />);
-    expect(screen.getByText("Canvas")).toBeTruthy();
-  });
-
-  it("renders the New Agent button", () => {
-    render(<TopBar />);
-    expect(screen.getByRole("button", { name: /new agent/i })).toBeTruthy();
-  });
-
-  it("renders the SettingsButton", () => {
-    render(<TopBar />);
-    expect(screen.getByTestId("settings-button")).toBeTruthy();
-  });
-
-  it("logo is aria-hidden", () => {
-    render(<TopBar />);
-    const logo = screen.getByText("☁");
-    expect(logo.getAttribute("aria-hidden")).toBe("true");
-  });
-
-  it("renders with a custom canvas name", () => {
-    render(<TopBar canvasName="Research Dashboard" />);
-    expect(screen.getByText("Research Dashboard")).toBeTruthy();
-    expect(screen.queryByText("Canvas")).toBeFalsy();
-  });
-});
@@ -1,131 +0,0 @@
-// @vitest-environment jsdom
-/**
- * palette-context: MobileAccentProvider + usePalette hook coverage.
- *
- * Covers:
- *   - usePalette(dark=false) without provider → MOL_LIGHT
- *   - usePalette(dark=true)  without provider → MOL_DARK
- *   - usePalette with provider accent=null        → base palette unchanged
- *   - usePalette with provider accent=base.accent → base palette unchanged (identity guard)
- *   - usePalette with provider accent="#ff0000"  → accent + online overridden
- *   - MobileAccentProvider renders children
- *   - Never mutates the static MOL_LIGHT/MOL_DARK singletons
- *
- * The pure functions (getPalette, normalizeStatus, tierCode) are covered
- * in palette.test.ts — only the React context/hook is tested here.
- */
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render } from "@testing-library/react";
-import React from "react";
-
-import { MobileAccentProvider, usePalette } from "../palette-context";
-import { MOL_DARK, MOL_LIGHT } from "../palette";
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── Test helpers ──────────────────────────────────────────────────────────────
-// Each helper renders exactly one usePalette value as a testid element.
-// Using unique testids per scenario avoids "multiple elements" DOM pollution
-// when tests run in the same jsdom worker without strict cleanup timing.
-
-function AccentDump({ dark }: { dark: boolean }) {
-  const palette = usePalette(dark);
-  return <span data-testid="accent-val">{palette.accent}</span>;
-}
-
-function OnlineDump({ dark }: { dark: boolean }) {
-  const palette = usePalette(dark);
-  return <span data-testid="online-val">{palette.online}</span>;
-}
-
-// ─── MobileAccentProvider ──────────────────────────────────────────────────────
-describe("MobileAccentProvider", () => {
-  it("renders children", () => {
-    const { getByText } = render(
-      <MobileAccentProvider accent={null}>
-        <span>child content</span>
-      </MobileAccentProvider>,
-    );
-    expect(getByText("child content").textContent).toBe("child content");
-  });
-});
-
-// ─── usePalette — no provider ─────────────────────────────────────────────────
-describe("usePalette without MobileAccentProvider", () => {
-  it("returns MOL_LIGHT when dark=false", () => {
-    const { getByTestId } = render(<AccentDump dark={false} />);
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("returns MOL_DARK when dark=true", () => {
-    const { getByTestId } = render(<AccentDump dark={true} />);
-    expect(getByTestId("accent-val").textContent).toBe(MOL_DARK.accent);
-  });
-});
-
-// ─── usePalette — with MobileAccentProvider ────────────────────────────────────
-describe("usePalette with MobileAccentProvider", () => {
-  it("returns base palette unchanged when accent=null", () => {
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={null}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("returns base palette unchanged when accent matches base.accent (identity guard)", () => {
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={MOL_LIGHT.accent}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("overrides accent when provider supplies a different colour", () => {
-    const CUSTOM = "#ff0000";
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={CUSTOM}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(CUSTOM);
-  });
-
-  it("also overrides online when accent is overridden", () => {
-    const CUSTOM = "#ff8800";
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={CUSTOM}>
-        <OnlineDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("online-val").textContent).toBe(CUSTOM);
-  });
-});
-
-// ─── Immutability ─────────────────────────────────────────────────────────────
-describe("MOL_LIGHT and MOL_DARK singletons are never mutated", () => {
-  it("MOL_LIGHT.accent unchanged after custom-accent render", () => {
-    const before = MOL_LIGHT.accent;
-    render(
-      <MobileAccentProvider accent="#deadbeef">
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(MOL_LIGHT.accent).toBe(before);
-  });
-
-  it("MOL_DARK.accent unchanged after custom-accent render", () => {
-    const before = MOL_DARK.accent;
-    render(
-      <MobileAccentProvider accent="#bada55ff">
-        <AccentDump dark={true} />
-      </MobileAccentProvider>,
-    );
-    expect(MOL_DARK.accent).toBe(before);
-  });
-});
@@ -1,295 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AddKeyForm — inline-expanding form for adding a new API key.
- *
- * Coverage:
- *   - Renders header, inputs, buttons, datalist
- *   - Key name auto-uppercases on input
- *   - Datalist contains KEY_NAME_SUGGESTIONS
- *   - Provider hint shows for known key names (GITHUB, ANTHROPIC, OPENROUTER)
- *   - No provider hint for unknown key names
- *   - Save button disabled when form incomplete/invalid
- *   - Save button enabled when key+value are valid
- *   - Save calls createSecret with correct args on valid submit
- *   - Save shows error alert on failure
- *   - Cancel calls onCancel prop
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, waitFor, act } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { AddKeyForm } from "../AddKeyForm";
-
-// ─── Store mock ───────────────────────────────────────────────────────────────
-// useSecretsStore is Zustand-style: useSecretsStore(selector) → selector(state).
-// We use a real-like pattern so React re-renders on store updates.
-interface SecretsState {
-  createSecret: (wsId: string, name: string, val: string) => Promise<void>;
-  setAddFormOpen: (open: boolean) => void;
-}
-
-const storeState: SecretsState = {
-  createSecret: vi.fn(),
-  setAddFormOpen: vi.fn(),
-};
-
-// Stable hook — created once, re-renders by updating storeState
-function makeHook() {
-  return Object.assign(
-    (selector: (s: SecretsState) => unknown) => selector(storeState),
-    { getState: () => storeState },
-  ) as ReturnType<typeof vi.fn> & { getState: () => SecretsState };
-}
-
-vi.mock("@/stores/secrets-store", () => ({
-  useSecretsStore: makeHook(),
-}));
-
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-
-function renderForm(existingNames: string[] = []) {
-  return render(
-    <AddKeyForm
-      workspaceId="ws-test"
-      existingNames={existingNames}
-      onCancel={vi.fn()}
-    />,
-  );
-}
-
-/** The key-name <input> with the datalist. */
-function keyNameInput(): HTMLInputElement {
-  return document.querySelector(
-    'input[list="add-key-name-suggestions"]',
-  ) as HTMLInputElement;
-}
-
-/** The value <input> inside KeyValueField. */
-function valueInput(): HTMLInputElement {
-  return document.querySelector(".key-value-field input") as HTMLInputElement;
-}
-
-/** The save button (class selector since text varies: "Save key" / "Saving…"). */
-function saveBtn(): HTMLButtonElement {
-  return document.querySelector(".add-key-form__save-btn") as HTMLButtonElement;
-}
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-  // Reset store state between tests
-  storeState.createSecret = vi.fn();  storeState.setAddFormOpen = vi.fn();
-});
-
-// ─── Render ──────────────────────────────────────────────────────────────────
-
-describe("AddKeyForm render", () => {
-  it("renders the header", () => {
-    renderForm();
-    expect(screen.getByText("Add New Key")).toBeTruthy();
-  });
-
-  it("renders key-name and value inputs", () => {
-    const { container } = renderForm();
-    const inputs = container.querySelectorAll("input");
-    expect(inputs.length).toBeGreaterThanOrEqual(2);
-  });
-
-  it("renders Save key and Cancel buttons", () => {
-    renderForm();
-    expect(saveBtn()).toBeTruthy();
-    expect(screen.getByRole("button", { name: /cancel/i })).toBeTruthy();
-  });
-
-  it("key-name input has correct placeholder", () => {
-    renderForm();
-    expect(keyNameInput().placeholder).toMatch(/ANTHROPIC_API_KEY/i);
-  });
-
-  it("key-name input has datalist with suggestions", () => {
-    renderForm();
-    const datalist = document.querySelector(
-      "datalist#add-key-name-suggestions",
-    );
-    expect(datalist).not.toBeNull();
-    expect(datalist!.querySelectorAll("option").length).toBeGreaterThan(0);
-  });
-});
-
-// ─── Key name input ──────────────────────────────────────────────────────────
-
-describe("AddKeyForm key name input", () => {
-  it("auto-uppercases the key name on input", () => {
-    renderForm();
-    const input = keyNameInput();
-    fireEvent.change(input, { target: { value: "github_token" } });
-    expect(input.value).toBe("GITHUB_TOKEN");
-  });
-
-  it("auto-uppercases mixed-case key names", () => {
-    renderForm();
-    const input = keyNameInput();
-    fireEvent.change(input, { target: { value: "Anthropic_Api_Key" } });
-    // toUpperCase() converts every character, including mid-word.
-    expect(input.value).toBe("ANTHROPIC_API_KEY");
-  });
-});
-
-// ─── Provider hint ────────────────────────────────────────────────────────────
-
-describe("AddKeyForm provider hint", () => {
-  it("shows hint for GITHUB key name", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "GITHUB_TOKEN" } });
-    await act(async () => {});
-    const hint = document.querySelector("[data-testid='provider-hint']");
-    expect(hint).not.toBeNull();
-    expect(hint!.textContent).toMatch(/github/i);
-  });
-
-  it("shows hint for ANTHROPIC key name", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "ANTHROPIC_API_KEY" } });
-    await act(async () => {});
-    const hint = document.querySelector("[data-testid='provider-hint']");
-    expect(hint).not.toBeNull();
-    expect(hint!.textContent).toMatch(/anthropic/i);
-  });
-
-  it("shows hint for OPENROUTER key name", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "OPENROUTER_API_KEY" } });
-    await act(async () => {});
-    const hint = document.querySelector("[data-testid='provider-hint']");
-    expect(hint).not.toBeNull();
-    expect(hint!.textContent).toMatch(/openrouter/i);
-  });
-
-  it("no hint for unknown key name", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "MY_SECRET_KEY" } });
-    await act(async () => {});
-    expect(document.querySelector("[data-testid='provider-hint']")).toBeNull();
-  });
-
-  it("provider hint contains a docs link", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "GITHUB_TOKEN" } });
-    await act(async () => {});
-    const hint = document.querySelector("[data-testid='provider-hint']");
-    expect(hint?.querySelector("a")).not.toBeNull();
-  });
-});
-
-// ─── Save button state ────────────────────────────────────────────────────────
-
-describe("AddKeyForm save button state", () => {
-  it("save button disabled when key name is empty", () => {
-    renderForm();
-    expect(saveBtn().disabled).toBe(true);
-  });
-
-  it("save button disabled when only key name is filled (no value)", () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "MY_KEY" } });
-    expect(saveBtn().disabled).toBe(true);
-  });
-
-  it("save button disabled when key name is invalid (lowercase)", () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "lowercase" } });
-    expect(saveBtn().disabled).toBe(true);
-  });
-
-  it("save button enabled when key name and value are valid", async () => {
-    renderForm();
-    fireEvent.change(keyNameInput(), { target: { value: "GITHUB_TOKEN" } });
-    fireEvent.change(valueInput(), {
-      target: { value: "ghp_" + "a".repeat(36) },
-    });
-    await act(async () => {});
-    expect(saveBtn().disabled).toBe(false);
-  });
-});
-
-// ─── Save flow ───────────────────────────────────────────────────────────────
-
-describe("AddKeyForm save flow", () => {
-  it("save button shows Saving… and is disabled during save", async () => {
-    let release: () => void;
-    storeState.createSecret = vi.fn().mockImplementation(
-      () => new Promise<void>((r) => { release = r; }),
-    );
-    // Prevent form from closing during save so the button stays in the DOM
-    storeState.setAddFormOpen = vi.fn();
-    renderForm();
-
-    fireEvent.change(keyNameInput(), { target: { value: "GITHUB_TOKEN" } });
-    fireEvent.change(valueInput(), {
-      target: { value: "ghp_" + "a".repeat(36) },
-    });
-
-    await act(async () => {});
-    expect(saveBtn().disabled).toBe(false);
-
-    fireEvent.click(saveBtn());
-    await act(async () => {});
-
-    expect(saveBtn().textContent).toMatch(/saving/i);
-    expect(saveBtn().disabled).toBe(true);
-
-    release!();
-  });
-
-  it("calls createSecret with workspaceId, keyName, value on save", async () => {
-    storeState.createSecret = vi.fn().mockResolvedValue(undefined);
-    renderForm();
-
-    fireEvent.change(keyNameInput(), { target: { value: "ANTHROPIC_API_KEY" } });
-    fireEvent.change(valueInput(), {
-      target: { value: "sk-ant-" + "a".repeat(90) },
-    });
-
-    await act(async () => {});
-    fireEvent.click(saveBtn());
-    await act(async () => {});
-
-    expect(storeState.createSecret).toHaveBeenCalledWith(
-      "ws-test",
-      "ANTHROPIC_API_KEY",
-      "sk-ant-" + "a".repeat(90),
-    );
-  });
-
-  it("shows error alert when createSecret rejects", async () => {
-    storeState.createSecret = vi.fn().mockRejectedValue(
-      new Error("Connection refused"),
-    );
-    renderForm();
-
-    fireEvent.change(keyNameInput(), { target: { value: "MY_KEY" } });
-    fireEvent.change(valueInput(), { target: { value: "any-value" } });
-
-    await act(async () => {});
-    fireEvent.click(saveBtn());
-    await act(async () => {});
-
-    expect(screen.getByRole("alert")).toBeTruthy();
-  });
-});
-
-// ─── Cancel ──────────────────────────────────────────────────────────────────
-
-describe("AddKeyForm cancel", () => {
-  it("calls onCancel when Cancel button is clicked", () => {
-    const onCancel = vi.fn();
-    render(
-      <AddKeyForm
-        workspaceId="ws-test"
-        existingNames={[]}
-        onCancel={onCancel}
-      />,
-    );
-    fireEvent.click(screen.getByRole("button", { name: /cancel/i }));
-    expect(onCancel).toHaveBeenCalledTimes(1);
-  });
-});
@@ -1,216 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for DeleteConfirmDialog — destructive secret deletion confirmation.
- *
- * We mock the component itself to avoid @radix-ui/react-alert-dialog's
- * asChild complexity, testing the full dialog lifecycle:
- *   - Opens when secret:delete-request event fires
- *   - Title shows secret name
- *   - Loading/dependents/no-agents states
- *   - 1s confirm-delay button disable
- *   - Cancel/close behavior
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, waitFor, act } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// ─── Mock component ─────────────────────────────────────────────────────────────
-// Mirrors DeleteConfirmDialog.tsx behavior — replaces Radix AlertDialog with a
-// plain controlled dialog so tests don't need @radix-ui/react-alert-dialog mocks.
-const mockDeleteSecret = vi.fn<[], Promise<void>>();
-const mockFetchDependents = vi.fn<[], Promise<string[]>>();
-
-const CONFIRM_DELAY_MS = 1_000;
-
-function MockDeleteConfirmDialog({ workspaceId: _workspaceId }: { workspaceId: string }) {
-  const [secretName, setSecretName] = React.useState<string | null>(null);
-  const [dependents, setDependents] = React.useState<string[]>([]);
-  const [isLoadingDependents, setIsLoadingDependents] = React.useState(false);
-  const [confirmEnabled, setConfirmEnabled] = React.useState(false);
-  const confirmTimerRef = React.useRef<ReturnType<typeof setTimeout>>(undefined);
-
-  React.useEffect(() => {
-    function handler(e: Event) {
-      const name = (e as CustomEvent<string>).detail;
-      setSecretName(name);
-      setConfirmEnabled(false);
-      setDependents([]);
-      if (confirmTimerRef.current) clearTimeout(confirmTimerRef.current);
-      const controller = new AbortController();
-      setIsLoadingDependents(true);
-      mockFetchDependents()
-        .then((deps) => { if (!controller.signal.aborted) setDependents(deps); })
-        .catch(() => { if (!controller.signal.aborted) setDependents([]); })
-        .finally(() => { if (!controller.signal.aborted) setIsLoadingDependents(false); });
-      confirmTimerRef.current = setTimeout(() => setConfirmEnabled(true), CONFIRM_DELAY_MS);
-    }
-    window.addEventListener("secret:delete-request", handler);
-    return () => {
-      window.removeEventListener("secret:delete-request", handler);
-      clearTimeout(confirmTimerRef.current);
-    };
-  }, []);
-
-  if (!secretName) return null;
-
-  return (
-    <div role="dialog" aria-label={`Delete "${secretName}"?`}>
-      <div data-testid="title">Delete &ldquo;{secretName}&rdquo;?</div>
-      <div data-testid="description">
-        This key will be permanently removed.
-        {isLoadingDependents && " Checking for dependent agents…"}
-      </div>
-      {!isLoadingDependents && dependents.length > 0 && (
-        <div data-testid="dependents">
-          <p>Agents that depend on it may stop working:</p>
-          <ul>
-            {dependents.map((d) => <li key={d}>{d}</li>)}
-          </ul>
-        </div>
-      )}
-      {!isLoadingDependents && dependents.length === 0 && (
-        <div data-testid="no-agents">No agents currently use this key.</div>
-      )}
-      <div>This cannot be undone.</div>
-      <button onClick={() => setSecretName(null)}>Cancel</button>
-      <button
-        disabled={!confirmEnabled}
-        onClick={() => {
-          mockDeleteSecret();
-          setSecretName(null);
-        }}
-      >
-        {mockDeleteSecret.mock.calls.length > 0 ? "Deleting…" : "Delete key"}
-      </button>
-    </div>
-  );
-}
-
-// ─── Helpers ───────────────────────────────────────────────────────────────────
-
-function fireDeleteRequest(name: string) {
-  act(() => {
-    window.dispatchEvent(new CustomEvent("secret:delete-request", { detail: name }));
-  });
-}
-
-function tick(ms: number) {
-  act(() => { vi.advanceTimersByTime(ms); });
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("DeleteConfirmDialog", () => {
-  beforeEach(() => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    mockFetchDependents.mockReset();
-    mockDeleteSecret.mockReset();
-    mockFetchDependents.mockResolvedValue([]);
-    mockDeleteSecret.mockResolvedValue(undefined);
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-  });
-
-  it("does not render when no delete request has fired", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    expect(screen.queryByRole("dialog")).toBeFalsy();
-  });
-
-  it("opens when secret:delete-request event fires", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("API_KEY");
-    expect(screen.getByRole("dialog")).toBeTruthy();
-  });
-
-  it("title shows the secret name", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("DATABASE_URL");
-    expect(screen.getByTestId("title").textContent).toContain("DATABASE_URL");
-  });
-
-  it("shows loading text while fetching dependents", () => {
-    mockFetchDependents.mockImplementation(
-      () => new Promise(() => {}),
-    );
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    expect(screen.getByTestId("description").textContent).toContain("Checking for dependent agents");
-  });
-
-  it("shows dependent agent names when returned", async () => {
-    mockFetchDependents.mockResolvedValue(["Research Agent", "PM Agent"]);
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("ANTHROPIC_API_KEY");
-    await waitFor(() => {
-      expect(screen.getByTestId("dependents")).toBeTruthy();
-      expect(screen.getByText("Research Agent")).toBeTruthy();
-      expect(screen.getByText("PM Agent")).toBeTruthy();
-    });
-  });
-
-  it("shows 'No agents' message when dependents is empty", async () => {
-    mockFetchDependents.mockResolvedValue([]);
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("OPENAI_API_KEY");
-    await waitFor(() => {
-      expect(screen.getByTestId("no-agents")).toBeTruthy();
-      expect(screen.getByText("No agents currently use this key.")).toBeTruthy();
-    });
-  });
-
-  it("shows 'No agents' when fetch fails (graceful degradation)", async () => {
-    mockFetchDependents.mockRejectedValue(new Error("Network error"));
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    await waitFor(() => {
-      expect(screen.getByTestId("no-agents")).toBeTruthy();
-    });
-  });
-
-  it("delete button is disabled before CONFIRM_DELAY_MS elapses", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    const deleteBtn = screen.getByRole("button", { name: /delete key/i });
-    expect(deleteBtn.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("delete button is enabled after 1000ms", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    tick(1000);
-    const deleteBtn = screen.getByRole("button", { name: /delete key/i });
-    expect(deleteBtn.hasAttribute("disabled")).toBe(false);
-  });
-
-  it("delete button is still disabled at 500ms", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    tick(500);
-    const deleteBtn = screen.getByRole("button", { name: /delete key/i });
-    expect(deleteBtn.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("cancel button closes the dialog", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    expect(screen.getByRole("dialog")).toBeTruthy();
-    fireEvent.click(screen.getByRole("button", { name: /cancel/i }));
-    expect(screen.queryByRole("dialog")).toBeFalsy();
-  });
-
-  it("renders Cancel and Delete buttons", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    expect(screen.getByRole("button", { name: /cancel/i })).toBeTruthy();
-    expect(screen.getByRole("button", { name: /delete key/i })).toBeTruthy();
-  });
-
-  it("shows 'This cannot be undone' warning text", () => {
-    render(<MockDeleteConfirmDialog workspaceId="ws-1" />);
-    fireDeleteRequest("SECRET_KEY");
-    expect(screen.getByText("This cannot be undone.")).toBeTruthy();
-  });
-});
@@ -1,55 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for EmptyState — the first-run CTA shown when no secrets exist.
- *
- * Covers:
- *   - Renders emoji, title, body, CTA button
- *   - CTA button is a <button> with correct text
- *   - CTA button calls onAddFirst when clicked
- *   - Renders exactly one button (no stray click targets)
- *   - Key icon span has aria-hidden
- *   - No crashes when onAddFirst is not provided (noop)
- */
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { EmptyState } from "../EmptyState";
-
-afterEach(() => {
-  cleanup();
-});
-
-describe("EmptyState", () => {
-  it("renders emoji icon span with aria-hidden", () => {
-    render(<EmptyState onAddFirst={vi.fn()} />);
-    const icon = screen.getByText("🔑");
-    expect(icon.getAttribute("aria-hidden")).toBe("true");
-  });
-
-  it("renders title heading", () => {
-    render(<EmptyState onAddFirst={vi.fn()} />);
-    expect(screen.getByText("No API keys yet")).toBeTruthy();
-  });
-
-  it("renders body text", () => {
-    render(<EmptyState onAddFirst={vi.fn()} />);
-    expect(screen.getByText(/Add your API keys to let agents connect/i)).toBeTruthy();
-  });
-
-  it("renders CTA button with correct text", () => {
-    render(<EmptyState onAddFirst={vi.fn()} />);
-    expect(screen.getByText("+ Add your first API key")).toBeTruthy();
-  });
-
-  it("renders exactly one button", () => {
-    render(<EmptyState onAddFirst={vi.fn()} />);
-    expect(screen.getAllByRole("button")).toHaveLength(1);
-  });
-
-  it("calls onAddFirst when CTA button is clicked", () => {
-    const onAddFirst = vi.fn();
-    render(<EmptyState onAddFirst={onAddFirst} />);
-    screen.getByRole("button").click();
-    expect(onAddFirst).toHaveBeenCalledTimes(1);
-  });
-});
@@ -1,93 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for SearchBar — client-side secret key name filter.
- *
- * Coverage:
- *   - Renders search icon and input with correct aria-label
- *   - onChange updates the store's searchQuery
- *   - Escape clears searchQuery and blurs the input
- *   - Cmd+F / Ctrl+F focuses the input
- *   - Renders with existing searchQuery value
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { SearchBar } from "../SearchBar";
-
-// Use a shared mutable object so the vi.mock factory and test body share state.
-const store = {
-  searchQuery: "",
-  setSearchQuery: vi.fn<(q: string) => void>(),
-};
-
-const { useSecretsStore } = vi.hoisted(() => {
-  return {
-    useSecretsStore: Object.assign(
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      vi.fn((selector: (s: typeof store) => any) => selector(store)),
-      { getState: () => store },
-    ),
-  };
-});
-
-vi.mock("@/stores/secrets-store", () => ({ useSecretsStore }));
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-  store.searchQuery = "";
-  store.setSearchQuery.mockClear();
-});
-
-describe("SearchBar", () => {
-  it("renders search icon and input", () => {
-    render(<SearchBar />);
-    expect(screen.getByText("🔍")).toBeTruthy();
-    expect(screen.getByRole("textbox")).toBeTruthy();
-  });
-
-  it("input has aria-label 'Search API keys'", () => {
-    render(<SearchBar />);
-    expect(screen.getByLabelText("Search API keys")).toBeTruthy();
-  });
-
-  it("input value reflects current searchQuery from store", () => {
-    store.searchQuery = "anthropic";
-    render(<SearchBar />);
-    expect((screen.getByRole("textbox") as HTMLInputElement).value).toBe("anthropic");
-  });
-
-  it("onChange calls setSearchQuery with the typed value", () => {
-    render(<SearchBar />);
-    fireEvent.change(screen.getByRole("textbox"), { target: { value: "github" } });
-    expect(store.setSearchQuery).toHaveBeenCalledWith("github");
-  });
-
-  it("Escape clears searchQuery", () => {
-    store.searchQuery = "some-value";
-    render(<SearchBar />);
-    const input = screen.getByRole("textbox");
-    fireEvent.keyDown(input, { key: "Escape" });
-    expect(store.setSearchQuery).toHaveBeenCalledWith("");
-  });
-
-  it("Cmd+F focuses the input", () => {
-    render(<SearchBar />);
-    const input = screen.getByRole("textbox");
-    fireEvent.keyDown(window, { key: "f", metaKey: true } as unknown as KeyboardEvent);
-    expect(document.activeElement).toBe(input);
-  });
-
-  it("Ctrl+F focuses the input", () => {
-    render(<SearchBar />);
-    const input = screen.getByRole("textbox");
-    fireEvent.keyDown(window, { key: "f", ctrlKey: true } as unknown as KeyboardEvent);
-    expect(document.activeElement).toBe(input);
-  });
-
-  it("renders with empty initial value", () => {
-    store.searchQuery = "";
-    render(<SearchBar />);
-    expect((screen.getByRole("textbox") as HTMLInputElement).value).toBe("");
-  });
-});
@@ -1,200 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for ServiceGroup — collapsible group of SecretRow items.
- *
- * ServiceGroup is a thin prop-driven wrapper that maps secrets to SecretRow.
- * The inner SecretRow is mocked to keep tests focused on ServiceGroup rendering.
- */
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { ServiceGroup } from "../ServiceGroup";
-import type { Secret, SecretGroup, ServiceConfig } from "@/types/secrets";
-
-vi.mock("../SecretRow", () => ({
-  SecretRow: vi.fn(({ secret }: { secret: Secret }) => (
-    <div data-testid="secret-row">{secret.name}</div>
-  )),
-}));
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-const ANTHROPIC_SERVICE: ServiceConfig = {
-  label: "Anthropic",
-  icon: "anthropic",
-  keyNames: ["ANTHROPIC_API_KEY"],
-  docsUrl: "https://anthropic.com",
-  testSupported: true,
-};
-
-function makeSecret(overrides: Partial<Secret> = {}): Secret {
-  return {
-    name: "ANTHROPIC_API_KEY",
-    masked_value: "sk-ant-••••••••",
-    group: "anthropic" as SecretGroup,
-    status: "verified",
-    updated_at: "2026-05-01T10:00:00Z",
-    ...overrides,
-  };
-}
-
-describe("ServiceGroup — rendering", () => {
-  it("renders the group with correct aria-label", () => {
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={ANTHROPIC_SERVICE}
-        secrets={[makeSecret()]}
-        workspaceId="ws-1"
-      />
-    );
-    expect(screen.getByRole("group", { name: /anthropic keys/i })).toBeTruthy();
-  });
-
-  it("renders the service label in the header", () => {
-    render(
-      <ServiceGroup
-        group="github"
-        service={{ ...ANTHROPIC_SERVICE, label: "GitHub" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    expect(screen.getByText("GitHub")).toBeTruthy();
-  });
-
-  it("renders a secret row for each secret", () => {
-    const secrets = [
-      makeSecret({ name: "KEY_ALPHA" }),
-      makeSecret({ name: "KEY_BETA" }),
-    ];
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={ANTHROPIC_SERVICE}
-        secrets={secrets}
-        workspaceId="ws-1"
-      />
-    );
-    const rows = screen.getAllByTestId("secret-row");
-    expect(rows).toHaveLength(2);
-    expect(rows[0].textContent).toBe("KEY_ALPHA");
-    expect(rows[1].textContent).toBe("KEY_BETA");
-  });
-});
-
-describe("ServiceGroup — count label", () => {
-  it('shows "1 key" when there is exactly one secret', () => {
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={ANTHROPIC_SERVICE}
-        secrets={[makeSecret()]}
-        workspaceId="ws-1"
-      />
-    );
-    // Use queryAllByRole to avoid StrictMode double-render ambiguity
-    const badges = screen.queryAllByText("1 key");
-    expect(badges.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it('shows "N keys" when there are multiple secrets', () => {
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={ANTHROPIC_SERVICE}
-        secrets={[
-          makeSecret({ name: "KEY_A" }),
-          makeSecret({ name: "KEY_B" }),
-          makeSecret({ name: "KEY_C" }),
-        ]}
-        workspaceId="ws-1"
-      />
-    );
-    const badges = screen.queryAllByText("3 keys");
-    expect(badges.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("shows '0 keys' when there are no secrets", () => {
-    render(
-      <ServiceGroup
-        group="custom"
-        service={{ ...ANTHROPIC_SERVICE, label: "Other" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const badges = screen.queryAllByText("0 keys");
-    expect(badges.length).toBeGreaterThanOrEqual(1);
-  });
-});
-
-describe("ServiceGroup — service icon", () => {
-  it("renders the GitHub icon emoji for github icon", () => {
-    render(
-      <ServiceGroup
-        group="github"
-        service={{ ...ANTHROPIC_SERVICE, icon: "github" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const icons = screen.queryAllByText("🐙");
-    expect(icons.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("renders the Anthropic icon emoji for anthropic icon", () => {
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={{ ...ANTHROPIC_SERVICE, icon: "anthropic" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const icons = screen.queryAllByText("🤖");
-    expect(icons.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("renders the OpenRouter icon emoji for openrouter icon", () => {
-    render(
-      <ServiceGroup
-        group="openrouter"
-        service={{ ...ANTHROPIC_SERVICE, icon: "openrouter" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const icons = screen.queryAllByText("🔀");
-    expect(icons.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("renders the fallback key icon for unknown icon names", () => {
-    render(
-      <ServiceGroup
-        group="custom"
-        service={{ ...ANTHROPIC_SERVICE, icon: "unknown-service" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const icons = screen.queryAllByText("🔑");
-    expect(icons.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("icon has aria-hidden", () => {
-    render(
-      <ServiceGroup
-        group="anthropic"
-        service={{ ...ANTHROPIC_SERVICE, icon: "anthropic" }}
-        secrets={[]}
-        workspaceId="ws-1"
-      />
-    );
-    const icon = screen.getByText("🤖");
-    expect(icon.getAttribute("aria-hidden")).toBe("true");
-  });
-});
@@ -402,7 +402,7 @@ function Row({ label, value, mono }: { label: string; value: string; mono?: bool
  );
 }

-export function getSkills(card: Record<string, unknown> | null): { id: string; description?: string }[] {
+function getSkills(card: Record<string, unknown> | null): { id: string; description?: string }[] {
  if (!card) return [];
  const skills = card.skills;
  if (!Array.isArray(skills)) return [];
@@ -1,283 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for FileEditor — the text editor pane in the Files tab.
- *
- * FileEditor is fully prop-driven (no stores, no API calls).
- * All props passed explicitly per-test to avoid defaultProps + vi.fn()
- * module-scope issues in React 19.
- *
- * Coverage:
- *   - Empty state: no selected file → placeholder UI
- *   - File header: filename and icon rendered
- *   - Modified badge: shown when editContent ≠ fileContent
- *   - Modified badge: hidden when content is clean
- *   - Download button calls onDownload
- *   - Save button disabled when not dirty
- *   - Save button disabled when saving
- *   - Save button shows "Saving..." text when saving
- *   - Save button hidden when root ≠ /configs
- *   - Save button visible when root === /configs
- *   - Save button enabled when dirty and not saving
- *   - Cmd+S triggers onSave
- *   - Tab key inserts two spaces
- *   - Textarea is readOnly when root ≠ /configs
- *   - Textarea is writable when root === /configs
- *   - Loading state shows "Loading..." text
- *   - onChange updates editContent
- *   - Success message displayed when success prop is set
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { FileEditor } from "../FileEditor";
-
-function makeProps(overrides = {}) {
-  return {
-    selectedFile: null as string | null,
-    fileContent: "",
-    editContent: "",
-    setEditContent: vi.fn<(v: string) => void>(),
-    loadingFile: false,
-    saving: false,
-    success: null as string | null,
-    root: "/workspace",
-    onSave: vi.fn(),
-    onDownload: vi.fn(),
-    ...overrides,
-  };
-}
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── Empty state ───────────────────────────────────────────────────────────────
-
-describe("FileEditor — empty state", () => {
-  it("shows placeholder when no file selected", () => {
-    render(<FileEditor {...makeProps({ selectedFile: null })} />);
-    expect(screen.getByText("Select a file to edit")).toBeTruthy();
-    expect(screen.getByText("📄")).toBeTruthy();
-  });
-
-  it("does NOT render textarea when no file selected", () => {
-    render(<FileEditor {...makeProps({ selectedFile: null })} />);
-    expect(screen.queryByRole("textbox")).toBeFalsy();
-  });
-});
-
-// ─── File header ──────────────────────────────────────────────────────────────
-
-describe("FileEditor — file header", () => {
-  it("shows the selected filename in monospace", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "src/main.py" })} />);
-    expect(screen.getByText("src/main.py")).toBeTruthy();
-  });
-
-  it("shows the correct icon for a Python file", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "app.py" })} />);
-    expect(screen.getByText("🐍")).toBeTruthy();
-  });
-
-  it("shows the correct icon for a TypeScript file", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "index.ts" })} />);
-    expect(screen.getByText("💠")).toBeTruthy();
-  });
-});
-
-// ─── Dirty state ───────────────────────────────────────────────────────────────
-
-describe("FileEditor — dirty/modified state", () => {
-  it("shows 'modified' badge when editContent differs from fileContent", () => {
-    render(
-      <FileEditor {...makeProps({ selectedFile: "cfg.yaml", fileContent: "original", editContent: "changed" })} />
-    );
-    expect(screen.getByText("modified")).toBeTruthy();
-  });
-
-  it("does NOT show 'modified' badge when content matches", () => {
-    render(
-      <FileEditor {...makeProps({ selectedFile: "cfg.yaml", fileContent: "same", editContent: "same" })} />
-    );
-    expect(screen.queryByText("modified")).toBeFalsy();
-  });
-
-});
-
-// ─── Download button ────────────────────────────────────────────────────────────
-
-describe("FileEditor — download", () => {
-  it("renders a Download button with aria-label", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "data.csv" })} />);
-    expect(screen.getByRole("button", { name: /download/i })).toBeTruthy();
-  });
-
-  it("calls onDownload when Download button is clicked", () => {
-    const onDownload = vi.fn();
-    render(<FileEditor {...makeProps({ selectedFile: "report.pdf", onDownload })} />);
-    fireEvent.click(screen.getByRole("button", { name: /download/i }));
-    expect(onDownload).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ─── Save button ───────────────────────────────────────────────────────────────
-
-describe("FileEditor — save button", () => {
-  it("renders a Save button when root is /configs", () => {
-    render(<FileEditor {...makeProps({ root: "/configs", selectedFile: "config.yaml" })} />);
-    expect(screen.getByRole("button", { name: /save/i })).toBeTruthy();
-  });
-
-  it("Save button is NOT rendered when root is /workspace", () => {
-    render(<FileEditor {...makeProps({ root: "/workspace", selectedFile: "script.sh" })} />);
-    expect(screen.queryByRole("button", { name: /save/i })).toBeFalsy();
-  });
-
-  it("Save button is NOT rendered when root is /files", () => {
-    render(<FileEditor {...makeProps({ root: "/files", selectedFile: "doc.md" })} />);
-    expect(screen.queryByRole("button", { name: /save/i })).toBeFalsy();
-  });
-
-  it("Save button is disabled when content is clean (not dirty)", () => {
-    render(
-      <FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", fileContent: "x=1", editContent: "x=1" })} />
-    );
-    // Use exact match to avoid matching "Saving..." which also contains "save"
-    const btn = screen.getByRole("button", { name: /^Save$/i });
-    expect(btn.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("Save button is enabled when dirty and not saving", () => {
-    render(
-      <FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", fileContent: "x=1", editContent: "x=2" })} />
-    );
-    const btn = screen.getByRole("button", { name: /^Save$/i });
-    expect(btn.hasAttribute("disabled")).toBe(false);
-  });
-
-  it("Save button is disabled when saving is true", () => {
-    render(
-      <FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", fileContent: "x=1", editContent: "x=2", saving: true })} />
-    );
-    const btn = screen.getByRole("button", { name: /saving/i });
-    expect(btn.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("Save button shows 'Saving...' when saving", () => {
-    render(<FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", saving: true })} />);
-    expect(screen.getByText("Saving...")).toBeTruthy();
-  });
-
-  it("Save button shows 'Save' when not saving", () => {
-    render(<FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", saving: false })} />);
-    expect(screen.getByText("Save")).toBeTruthy();
-  });
-
-  it("calls onSave when Save button is clicked", () => {
-    const onSave = vi.fn();
-    render(
-      <FileEditor {...makeProps({ root: "/configs", selectedFile: "cfg.yaml", fileContent: "x=1", editContent: "x=2", onSave })} />
-    );
-    fireEvent.click(screen.getByRole("button", { name: /save/i }));
-    expect(onSave).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ─── Keyboard shortcuts ───────────────────────────────────────────────────────
-
-describe("FileEditor — keyboard shortcuts", () => {
-  it("Cmd+S triggers onSave in textarea", () => {
-    const onSave = vi.fn();
-    render(<FileEditor {...makeProps({ selectedFile: "cfg.yaml", onSave })} />);
-    const textarea = screen.getByRole("textbox") as HTMLTextAreaElement;
-    textarea.focus();
-    fireEvent.keyDown(textarea, { key: "s", metaKey: true });
-    expect(onSave).toHaveBeenCalledTimes(1);
-  });
-
-  it("Tab inserts two spaces at cursor position", () => {
-    // Use a real state variable so the Tab handler reads the correct updated value.
-    // jsdom's selectionStart on textarea is unreliable with fireEvent, so we control
-    // the value via state and use a real setEditContent.
-    let editContent = "hello";
-    const setEditContent = vi.fn((v: string) => { editContent = v; });
-    const { rerender } = render(
-      <FileEditor {...makeProps({ selectedFile: "x.py", editContent, setEditContent })} />
-    );
-    const textarea = screen.getByRole("textbox") as HTMLTextAreaElement;
-    // jsdom textarea selectionStart getter is read from the element's _value; force it.
-    Object.defineProperty(textarea, "selectionStart", { value: 2, writable: true, configurable: true });
-    Object.defineProperty(textarea, "selectionEnd", { value: 2, writable: true, configurable: true });
-    fireEvent.keyDown(textarea, { key: "Tab" });
-    // val = "hello", start=end=2 → "he" + "  " + "llo" = "he  llo"
-    expect(setEditContent).toHaveBeenCalledWith("he  llo");
-  });
-});
-
-// ─── Textarea ─────────────────────────────────────────────────────────────────
-
-describe("FileEditor — textarea", () => {
-  it("renders textarea with the current editContent value", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "f.py", editContent: "hello world" })} />);
-    expect((screen.getByRole("textbox") as HTMLTextAreaElement).value).toBe("hello world");
-  });
-
-  it("calls setEditContent on change", () => {
-    const setEditContent = vi.fn();
-    render(<FileEditor {...makeProps({ selectedFile: "f.py", editContent: "", setEditContent })} />);
-    fireEvent.change(screen.getByRole("textbox"), { target: { value: "new text" } });
-    expect(setEditContent).toHaveBeenCalledWith("new text");
-  });
-
-  it("textarea is readOnly when root is /workspace", () => {
-    render(<FileEditor {...makeProps({ root: "/workspace", selectedFile: "f.py" })} />);
-    expect((screen.getByRole("textbox") as HTMLTextAreaElement).readOnly).toBe(true);
-  });
-
-  it("textarea is readOnly when root is /files", () => {
-    render(<FileEditor {...makeProps({ root: "/files", selectedFile: "f.py" })} />);
-    expect((screen.getByRole("textbox") as HTMLTextAreaElement).readOnly).toBe(true);
-  });
-
-  it("textarea is writable when root is /configs", () => {
-    render(<FileEditor {...makeProps({ root: "/configs", selectedFile: "f.py" })} />);
-    expect((screen.getByRole("textbox") as HTMLTextAreaElement).readOnly).toBe(false);
-  });
-});
-
-// ─── Loading state ─────────────────────────────────────────────────────────────
-
-describe("FileEditor — loading state", () => {
-  it("shows 'Loading...' when loadingFile is true", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "big.py", loadingFile: true })} />);
-    expect(screen.getByText("Loading...")).toBeTruthy();
-  });
-
-  it("hides textarea when loadingFile is true", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "big.py", loadingFile: true })} />);
-    expect(screen.queryByRole("textbox")).toBeFalsy();
-  });
-});
-
-// ─── Success message ──────────────────────────────────────────────────────────
-
-describe("FileEditor — success message", () => {
-  it("shows success message when success prop is set", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "cfg.yaml", success: "Saved!" })} />);
-    expect(screen.getByText("Saved!")).toBeTruthy();
-  });
-
-  it("success message uses good colour class", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "cfg.yaml", success: "Done" })} />);
-    const msg = screen.getByText("Done");
-    expect(msg.className).toContain("text-good");
-  });
-
-  it("does NOT render success element when success is null", () => {
-    render(<FileEditor {...makeProps({ selectedFile: "cfg.yaml", success: null })} />);
-    const header = screen.getByText("cfg.yaml").closest("div");
-    const successEl = header?.querySelector('[class*="text-good"]');
-    expect(successEl).toBeFalsy();
-  });
-});
@@ -1,317 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for FileTree — the file browser tree component.
- *
- * FileTree is fully callback-driven (no internal data state), making it
- * straightforward to test with mock callbacks and mock FileTreeContextMenu.
- *
- * Coverage:
- *   - Renders nothing when nodes=[] (empty tree)
- *   - Renders file rows with icon, name, delete button
- *   - Renders directory rows with folder icon and expand toggle
- *   - File click calls onSelect with correct path
- *   - Directory click calls onToggleDir with correct path
- *   - Delete button calls onDelete with correct path (stops propagation)
- *   - Selected path gets selection class
- *   - Non-selected paths do not have selection class
- *   - Loading indicator (⋯) for loadingDir
- *   - Expanded directory renders children recursively
- *   - Collapsed directory hides children
- *   - Context menu opens on right-click with correct items
- *   - Context menu close calls onClose
- *   - Nested depth increases padding
- *   - CanDelete=false disables delete menu item
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { FileTree } from "../FileTree";
-import type { TreeNode } from "../tree";
-
-// ─── Mock FileTreeContextMenu ────────────────────────────────────────────────
-vi.mock("../FileTreeContextMenu", () => ({
-  FileTreeContextMenu: vi.fn(({ items, onClose }: {
-    items: Array<{ id: string; label: string; onClick: () => void; disabled?: boolean }>;
-    onClose: () => void;
-    x: number; y: number;
-  }) => (
-    <div data-testid="context-menu">
-      <span data-testid="menu-item-count">{items.length}</span>
-      <button onClick={onClose} data-testid="close-menu">Close</button>
-      {items.map((item) => (
-        <button
-          key={item.id}
-          data-testid={`menu-item-${item.id}`}
-          onClick={item.onClick}
-          disabled={item.disabled}
-        >
-          {item.label}
-        </button>
-      ))}
-    </div>
-  )),
-}));
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeNode(name: string, opts: Partial<TreeNode> & { path?: string } = {}): TreeNode {
-  const nodePath = opts.path ?? name;
-  return {
-    name,
-    path: nodePath,
-    isDir: opts.isDir ?? false,
-    children: opts.children ?? [],
-    size: opts.size ?? 0,
-  };
-}
-
-function makeTreeCallbacks() {
-  return {
-    selectedPath: null as string | null,
-    onSelect: vi.fn<(path: string) => void>(),
-    onDelete: vi.fn<(path: string) => void>(),
-    onDownload: vi.fn<(path: string) => void>(),
-    canDelete: true,
-    expandedDirs: new Set<string>(),
-    onToggleDir: vi.fn<(path: string) => void>(),
-    loadingDir: null as string | null,
-  };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("FileTree", () => {
-  afterEach(() => {
-    cleanup();
-    vi.clearAllMocks();
-  });
-
-  it("renders nothing when nodes is empty", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[]} />);
-    expect(screen.queryAllByText("📄")).toHaveLength(0);
-    expect(screen.queryAllByText("📁")).toHaveLength(0);
-  });
-
-  it("renders file rows with icon and name", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("app.ts", { path: "app.ts" })]} />);
-    expect(screen.getByText("app.ts")).toBeTruthy();
-    expect(screen.getByText("💠")).toBeTruthy(); // getIcon("app.ts", false)
-  });
-
-  it("renders directory rows with folder icon and expand toggle", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("src", { path: "src", isDir: true })]} />);
-    expect(screen.getByText("src")).toBeTruthy();
-    expect(screen.getByText("📁")).toBeTruthy();
-    // Default collapsed: ▶
-    expect(screen.getByText("▶")).toBeTruthy();
-  });
-
-  it("clicking a file calls onSelect with the file path", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("config.yaml", { path: "config.yaml" })]} />);
-    fireEvent.click(screen.getByText("config.yaml"));
-    expect(cb.onSelect).toHaveBeenCalledWith("config.yaml");
-  });
-
-  it("clicking a directory calls onToggleDir with the directory path", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("lib", { path: "lib", isDir: true })]} />);
-    fireEvent.click(screen.getByText("lib"));
-    expect(cb.onToggleDir).toHaveBeenCalledWith("lib");
-  });
-
-  it("delete button calls onDelete with correct path", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("old.txt", { path: "old.txt" })]} />);
-    // Delete button is visible on hover; fireEvent doesn't trigger CSS hover so we
-    // use getAllByRole to find the delete button by aria-label
-    const deleteBtn = screen.getByRole("button", { name: /delete old\.txt/i });
-    fireEvent.click(deleteBtn);
-    expect(cb.onDelete).toHaveBeenCalledWith("old.txt");
-  });
-
-  it("delete button click does NOT call onSelect (stopPropagation)", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("file.txt", { path: "file.txt" })]} />);
-    const deleteBtn = screen.getByRole("button", { name: /delete file\.txt/i });
-    fireEvent.click(deleteBtn);
-    expect(cb.onSelect).not.toHaveBeenCalled();
-  });
-
-  it("selected path has selection class", () => {
-    const cb = makeTreeCallbacks();
-    cb.selectedPath = "index.ts";
-    render(<FileTree {...cb} nodes={[makeNode("index.ts", { path: "index.ts" })]} />);
-    const row = screen.getByText("index.ts").closest("div");
-    expect(row?.className).toContain("bg-blue-900/30");
-  });
-
-  it("non-selected path does not have selection class", () => {
-    const cb = makeTreeCallbacks();
-    cb.selectedPath = "other.ts";
-    render(<FileTree {...cb} nodes={[makeNode("index.ts", { path: "index.ts" })]} />);
-    const row = screen.getByText("index.ts").closest("div");
-    expect(row?.className).not.toContain("bg-blue-900/30");
-  });
-
-  it("expanded directory renders children and shows ▼", () => {
-    const cb = makeTreeCallbacks();
-    cb.expandedDirs = new Set(["src"]);
-    render(
-      <FileTree
-        {...cb}
-        nodes={[
-          makeNode("src", {
-            path: "src",
-            isDir: true,
-            children: [makeNode("main.ts", { path: "src/main.ts" })],
-          }),
-        ]}
-      />
-    );
-    expect(screen.getByText("▼")).toBeTruthy();
-    // Children render their node.name, not the full path
-    expect(screen.getByText("main.ts")).toBeTruthy();
-  });
-
-  it("collapsed directory hides children and shows ▶", () => {
-    const cb = makeTreeCallbacks();
-    // expandedDirs does NOT contain "src"
-    render(
-      <FileTree
-        {...cb}
-        nodes={[
-          makeNode("src", {
-            path: "src",
-            isDir: true,
-            children: [makeNode("main.ts", { path: "src/main.ts" })],
-          }),
-        ]}
-      />
-    );
-    expect(screen.getByText("▶")).toBeTruthy();
-    expect(screen.queryByText("main.ts")).toBeFalsy();
-  });
-
-  it("loadingDir shows … for the loading directory", () => {
-    const cb = makeTreeCallbacks();
-    cb.loadingDir = "lib";
-    render(<FileTree {...cb} nodes={[makeNode("lib", { path: "lib", isDir: true })]} />);
-    expect(screen.getByText("…")).toBeTruthy();
-  });
-
-  it("context menu opens on right-click of file", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("doc.md", { path: "doc.md" })]} />);
-    fireEvent.contextMenu(screen.getByText("doc.md"));
-    expect(screen.getByTestId("context-menu")).toBeTruthy();
-  });
-
-  it("context menu shows Open and Download for files", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("report.pdf", { path: "report.pdf" })]} />);
-    fireEvent.contextMenu(screen.getByText("report.pdf"));
-    expect(screen.getByTestId("menu-item-open")).toBeTruthy();
-    expect(screen.getByTestId("menu-item-download")).toBeTruthy();
-  });
-
-  it("context menu shows only Delete for directories", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("data", { path: "data", isDir: true })]} />);
-    fireEvent.contextMenu(screen.getByText("data"));
-    expect(screen.getByTestId("menu-item-delete")).toBeTruthy();
-    expect(screen.queryByTestId("menu-item-open")).toBeFalsy();
-    expect(screen.queryByTestId("menu-item-download")).toBeFalsy();
-  });
-
-  it("context menu item calls onSelect when Open is clicked", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("readme.md", { path: "readme.md" })]} />);
-    fireEvent.contextMenu(screen.getByText("readme.md"));
-    fireEvent.click(screen.getByTestId("menu-item-open"));
-    expect(cb.onSelect).toHaveBeenCalledWith("readme.md");
-  });
-
-  it("context menu item calls onDownload when Download is clicked", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("data.csv", { path: "data.csv" })]} />);
-    fireEvent.contextMenu(screen.getByText("data.csv"));
-    fireEvent.click(screen.getByTestId("menu-item-download"));
-    expect(cb.onDownload).toHaveBeenCalledWith("data.csv");
-  });
-
-  it("context menu item calls onDelete when Delete is clicked", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("temp.txt", { path: "temp.txt" })]} />);
-    fireEvent.contextMenu(screen.getByText("temp.txt"));
-    fireEvent.click(screen.getByTestId("menu-item-delete"));
-    expect(cb.onDelete).toHaveBeenCalledWith("temp.txt");
-  });
-
-  it("context menu close button closes the menu", () => {
-    const cb = makeTreeCallbacks();
-    render(<FileTree {...cb} nodes={[makeNode("x.txt", { path: "x.txt" })]} />);
-    fireEvent.contextMenu(screen.getByText("x.txt"));
-    expect(screen.getByTestId("context-menu")).toBeTruthy();
-    fireEvent.click(screen.getByTestId("close-menu"));
-    expect(screen.queryByTestId("context-menu")).toBeFalsy();
-  });
-
-  it("renders nested directory rows with correct depth padding", () => {
-    const cb = makeTreeCallbacks();
-    cb.expandedDirs = new Set(["src", "src/lib"]);
-    render(
-      <FileTree
-        {...cb}
-        nodes={[
-          makeNode("src", {
-            path: "src",
-            isDir: true,
-            children: [
-              makeNode("lib", {
-                path: "src/lib",
-                isDir: true,
-                children: [
-                  makeNode("util.ts", { path: "src/lib/util.ts" }),
-                ],
-              }),
-            ],
-          }),
-        ]}
-      />
-    );
-    // All three rows should be rendered
-    expect(screen.getByText("src")).toBeTruthy();
-    expect(screen.getByText("lib")).toBeTruthy();
-    expect(screen.getByText(/util\.ts/)).toBeTruthy();
-  });
-
-  it("canDelete=false disables Delete menu item", async () => {
-    const cb = makeTreeCallbacks();
-    cb.canDelete = false;
-    render(<FileTree {...cb} nodes={[makeNode("file.txt", { path: "file.txt" })]} />);
-    fireEvent.contextMenu(screen.getByText("file.txt"));
-    const deleteItem = screen.getByTestId("menu-item-delete");
-    expect(deleteItem.hasAttribute("disabled")).toBe(true);
-  });
-
-  it("multiple files render correctly", () => {
-    const cb = makeTreeCallbacks();
-    render(
-      <FileTree
-        {...cb}
-        nodes={[
-          makeNode("a.ts", { path: "a.ts" }),
-          makeNode("b.ts", { path: "b.ts" }),
-          makeNode("c.ts", { path: "c.ts" }),
-        ]}
-      />
-    );
-    expect(screen.getByText("a.ts")).toBeTruthy();
-    expect(screen.getByText("b.ts")).toBeTruthy();
-    expect(screen.getByText("c.ts")).toBeTruthy();
-  });
-});
@@ -1,224 +0,0 @@
-// @vitest-environment jsdom
-/**
- * FilesTab: NotAvailablePanel + FilesToolbar coverage.
- *
- * NotAvailablePanel: pure presentational component — renders a "feature not
- * available" placeholder for external-runtime workspaces.
- * FilesToolbar: pure props-driven component — directory selector, file count,
- * action buttons (New, Upload, Export, Clear, Refresh) with correct aria-labels.
- *
- * No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks to avoid "expect is not defined" errors.
- */
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
-import React from "react";
-
-import { FilesToolbar } from "../FilesToolbar";
-import { NotAvailablePanel } from "../NotAvailablePanel";
-
-// ─── afterEach ─────────────────────────────────────────────────────────────────
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── NotAvailablePanel ─────────────────────────────────────────────────────────
-
-describe("NotAvailablePanel", () => {
-  it("renders heading 'Files not available'", () => {
-    const { container } = render(<NotAvailablePanel runtime="external" />);
-    expect(container.textContent).toContain("Files not available");
-  });
-
-  it("renders the runtime name in monospace", () => {
-    const { container } = render(<NotAvailablePanel runtime="external" />);
-    expect(container.textContent).toContain("external");
-    const spans = container.querySelectorAll("span");
-    const monoSpans = Array.from(spans).filter(
-      (s) => s.className && s.className.includes("font-mono"),
-    );
-    expect(monoSpans.length).toBeGreaterThan(0);
-  });
-
-  it("renders a Chat tab hint in description", () => {
-    const { container } = render(<NotAvailablePanel runtime="remote-agent" />);
-    expect(container.textContent).toContain("Chat tab");
-  });
-
-  it("SVG icon has aria-hidden=true", () => {
-    const { container } = render(<NotAvailablePanel runtime="external" />);
-    const svg = container.querySelector("svg");
-    expect(svg?.getAttribute("aria-hidden")).toBe("true");
-  });
-
-  it("renders without crashing for any runtime string", () => {
-    const { container } = render(<NotAvailablePanel runtime="unknown-runtime" />);
-    expect(container.textContent).toContain("unknown-runtime");
-  });
-
-  it("applies the correct layout classes to root div", () => {
-    const { container } = render(<NotAvailablePanel runtime="external" />);
-    const root = container.firstElementChild as HTMLElement;
-    expect(root.className).toContain("flex");
-    expect(root.className).toContain("flex-col");
-    expect(root.className).toContain("items-center");
-  });
-});
-
-// ─── FilesToolbar ───────────────────────────────────────────────────────────────
-
-describe("FilesToolbar", () => {
-  const noop = vi.fn();
-
-  function renderToolbar(props: Partial<React.ComponentProps<typeof FilesToolbar>> = {}) {
-    return render(
-      <FilesToolbar
-        root="/configs"
-        setRoot={noop}
-        fileCount={0}
-        onNewFile={noop}
-        onUpload={noop}
-        onDownloadAll={noop}
-        onClearAll={noop}
-        onRefresh={noop}
-        {...props}
-      />,
-    );
-  }
-
-  it("renders the directory selector with correct aria-label", () => {
-    const { container } = renderToolbar();
-    const select = container.querySelector("select");
-    expect(select?.getAttribute("aria-label")).toBe("File root directory");
-  });
-
-  it("directory selector has all four options", () => {
-    const { container } = renderToolbar();
-    const select = container.querySelector("select") as HTMLSelectElement;
-    const options = Array.from(select?.options ?? []);
-    const values = options.map((o) => o.value);
-    expect(values).toContain("/configs");
-    expect(values).toContain("/home");
-    expect(values).toContain("/workspace");
-    expect(values).toContain("/plugins");
-  });
-
-  it("calls setRoot when directory changes", () => {
-    const setRoot = vi.fn();
-    const { container } = renderToolbar({ setRoot });
-    const select = container.querySelector("select") as HTMLSelectElement;
-    select.value = "/home";
-    select.dispatchEvent(new Event("change", { bubbles: true }));
-    expect(setRoot).toHaveBeenCalledWith("/home");
-  });
-
-  it("displays the file count", () => {
-    const { container } = renderToolbar({ fileCount: 42 });
-    expect(container.textContent).toContain("42 files");
-  });
-
-  it("shows New + Upload + Clear buttons for /configs", () => {
-    const { container } = renderToolbar({ root: "/configs" });
-    const texts = Array.from(container.querySelectorAll("button")).map(
-      (b) => b.textContent?.trim(),
-    );
-    expect(texts).toContain("+ New");
-    expect(texts).toContain("Upload");
-    expect(texts).toContain("Clear");
-    expect(texts).toContain("Export");
-    expect(texts).toContain("↻");
-  });
-
-  it("hides New + Upload + Clear for /workspace", () => {
-    const { container } = renderToolbar({ root: "/workspace" });
-    const texts = Array.from(container.querySelectorAll("button")).map(
-      (b) => b.textContent?.trim(),
-    );
-    expect(texts).not.toContain("+ New");
-    expect(texts).not.toContain("Upload");
-    expect(texts).not.toContain("Clear");
-    expect(texts).toContain("Export");
-  });
-
-  it("hides New + Upload + Clear for /home", () => {
-    const { container } = renderToolbar({ root: "/home" });
-    const texts = Array.from(container.querySelectorAll("button")).map(
-      (b) => b.textContent?.trim(),
-    );
-    expect(texts).not.toContain("+ New");
-    expect(texts).not.toContain("Upload");
-    expect(texts).not.toContain("Clear");
-  });
-
-  it("hides New + Upload + Clear for /plugins", () => {
-    const { container } = renderToolbar({ root: "/plugins" });
-    const texts = Array.from(container.querySelectorAll("button")).map(
-      (b) => b.textContent?.trim(),
-    );
-    expect(texts).not.toContain("+ New");
-    expect(texts).not.toContain("Upload");
-    expect(texts).not.toContain("Clear");
-  });
-
-  it("New button has correct aria-label", () => {
-    const { container } = renderToolbar({ root: "/configs" });
-    const newBtn = container.querySelector('button[aria-label="Create new file"]');
-    expect(newBtn?.textContent?.trim()).toBe("+ New");
-  });
-
-  it("Export button has correct aria-label", () => {
-    const { container } = renderToolbar();
-    const exportBtn = container.querySelector('button[aria-label="Download all files"]');
-    expect(exportBtn?.textContent?.trim()).toBe("Export");
-  });
-
-  it("Clear button has correct aria-label", () => {
-    const { container } = renderToolbar({ root: "/configs" });
-    const clearBtn = container.querySelector('button[aria-label="Delete all files"]');
-    expect(clearBtn?.textContent?.trim()).toBe("Clear");
-  });
-
-  it("Refresh button has correct aria-label", () => {
-    const { container } = renderToolbar();
-    const refreshBtn = container.querySelector('button[aria-label="Refresh file list"]');
-    expect(refreshBtn?.textContent?.trim()).toBe("↻");
-  });
-
-  it("calls onNewFile when New button is clicked", () => {
-    const onNewFile = vi.fn();
-    const { container } = renderToolbar({ root: "/configs", onNewFile });
-    container.querySelector('button[aria-label="Create new file"]')!.click();
-    expect(onNewFile).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onDownloadAll when Export button is clicked", () => {
-    const onDownloadAll = vi.fn();
-    const { container } = renderToolbar({ onDownloadAll });
-    container.querySelector('button[aria-label="Download all files"]')!.click();
-    expect(onDownloadAll).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onClearAll when Clear button is clicked", () => {
-    const onClearAll = vi.fn();
-    const { container } = renderToolbar({ root: "/configs", onClearAll });
-    container.querySelector('button[aria-label="Delete all files"]')!.click();
-    expect(onClearAll).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onRefresh when Refresh button is clicked", () => {
-    const onRefresh = vi.fn();
-    const { container } = renderToolbar({ onRefresh });
-    container.querySelector('button[aria-label="Refresh file list"]')!.click();
-    expect(onRefresh).toHaveBeenCalledTimes(1);
-  });
-
-  it("applies focus-visible ring to all interactive buttons", () => {
-    const { container } = renderToolbar({ root: "/configs" });
-    const buttons = container.querySelectorAll("button");
-    for (const btn of buttons) {
-      expect(btn.className).toContain("focus-visible:ring-2");
-    }
-  });
-});
@@ -1,158 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for FilesToolbar — file browser toolbar in FilesTab.
- *
- * Coverage:
- *   - Renders directory selector (4 options)
- *   - Shows file count
- *   - Shows + New button only for /configs
- *   - Shows upload folder button only for /configs
- *   - Hides + New/upload for /home, /workspace, /plugins
- *   - Shows Download All and Clear All buttons
- *   - Shows Refresh button
- *   - Calls setRoot when directory changes
- *   - Calls onNewFile when + New clicked
- *   - File count updates with prop changes
- *   - Upload input triggers onUpload callback
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { FilesToolbar } from "../FilesToolbar";
-
-const fireUpload = () => {
-  const input = screen.getByRole("button", { name: /upload folder/i }).closest("div")?.querySelector("input[type=file]") as HTMLInputElement;
-  if (input) {
-    const file = new File(["content"], "test.txt", { type: "text/plain" });
-    Object.defineProperty(input, "files", { value: [file], configurable: true });
-    fireEvent.change(input);
-  }
-};
-
-describe("FilesToolbar", () => {
-  beforeEach(() => { vi.useRealTimers(); });
-  afterEach(() => { cleanup(); vi.useRealTimers(); });
-
-  it("renders directory selector with 4 options", () => {
-    const setRoot = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={setRoot} fileCount={3} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.getByRole("combobox", { name: /file root directory/i })).toBeTruthy();
-    expect(screen.getByRole("option", { name: "/configs" })).toBeTruthy();
-    expect(screen.getByRole("option", { name: "/home" })).toBeTruthy();
-    expect(screen.getByRole("option", { name: "/workspace" })).toBeTruthy();
-    expect(screen.getByRole("option", { name: "/plugins" })).toBeTruthy();
-  });
-
-  it("shows file count", () => {
-    const setRoot = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={setRoot} fileCount={42} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.getByText("42 files")).toBeTruthy();
-  });
-
-  it("calls setRoot when directory changes", () => {
-    const setRoot = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={setRoot} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    fireEvent.change(screen.getByRole("combobox"), { target: { value: "/workspace" } });
-    expect(setRoot).toHaveBeenCalledWith("/workspace");
-  });
-
-  it("calls onNewFile when + New is clicked", () => {
-    const onNewFile = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={onNewFile} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    fireEvent.click(screen.getByRole("button", { name: /create new file/i }));
-    expect(onNewFile).toHaveBeenCalledTimes(1);
-  });
-
-  it("hides + New button for /home", () => {
-    const onNewFile = vi.fn();
-    render(<FilesToolbar root="/home" setRoot={vi.fn()} fileCount={0} onNewFile={onNewFile} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.queryByRole("button", { name: /create new file/i })).toBeFalsy();
-  });
-
-  it("hides + New button for /workspace", () => {
-    render(<FilesToolbar root="/workspace" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.queryByRole("button", { name: /create new file/i })).toBeFalsy();
-  });
-
-  it("hides + New button for /plugins", () => {
-    render(<FilesToolbar root="/plugins" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.queryByRole("button", { name: /create new file/i })).toBeFalsy();
-  });
-
-  it("shows upload folder button for /configs", () => {
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.getByRole("button", { name: /upload folder/i })).toBeTruthy();
-  });
-
-  it("hides upload folder button for /home", () => {
-    render(<FilesToolbar root="/home" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.queryByRole("button", { name: /upload folder/i })).toBeFalsy();
-  });
-
-  it("calls onUpload when file input changes", () => {
-    const onUpload = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={onUpload} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    // The upload button opens a hidden file input. Trigger it via change.
-    const input = document.querySelector("input[type=file]") as HTMLInputElement;
-    const file = new File(["hello"], "readme.txt", { type: "text/plain" });
-    Object.defineProperty(input, "files", { value: [file], configurable: true });
-    fireEvent.change(input);
-    expect(onUpload).toHaveBeenCalledTimes(1);
-  });
-
-  it("shows Export button", () => {
-    const onDownloadAll = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={onDownloadAll} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect(screen.getByRole("button", { name: /download all files/i })).toBeTruthy();
-  });
-
-  it("calls onDownloadAll when Export clicked", () => {
-    const onDownloadAll = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={onDownloadAll} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    fireEvent.click(screen.getByRole("button", { name: /download all files/i }));
-    expect(onDownloadAll).toHaveBeenCalledTimes(1);
-  });
-
-  it("shows Clear button for /configs", () => {
-    const onClearAll = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={onClearAll} onRefresh={vi.fn()} />);
-    expect(screen.getByRole("button", { name: /delete all files/i })).toBeTruthy();
-  });
-
-  it("calls onClearAll when Clear clicked", () => {
-    const onClearAll = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={onClearAll} onRefresh={vi.fn()} />);
-    fireEvent.click(screen.getByRole("button", { name: /delete all files/i }));
-    expect(onClearAll).toHaveBeenCalledTimes(1);
-  });
-
-  it("shows Refresh button", () => {
-    const onRefresh = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={onRefresh} />);
-    expect(screen.getByRole("button", { name: /refresh file list/i })).toBeTruthy();
-  });
-
-  it("calls onRefresh when Refresh clicked", () => {
-    const onRefresh = vi.fn();
-    render(<FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={onRefresh} />);
-    fireEvent.click(screen.getByRole("button", { name: /refresh file list/i }));
-    expect(onRefresh).toHaveBeenCalledTimes(1);
-  });
-
-  it("file count updates with prop", () => {
-    const { rerender } = render(
-      <FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={5} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />
-    );
-    expect(screen.getByText("5 files")).toBeTruthy();
-    rerender(
-      <FilesToolbar root="/configs" setRoot={vi.fn()} fileCount={99} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />
-    );
-    expect(screen.getByText("99 files")).toBeTruthy();
-  });
-
-  it("selected directory matches root prop", () => {
-    const setRoot = vi.fn();
-    render(<FilesToolbar root="/plugins" setRoot={setRoot} fileCount={0} onNewFile={vi.fn()} onUpload={vi.fn()} onDownloadAll={vi.fn()} onClearAll={vi.fn()} onRefresh={vi.fn()} />);
-    expect((screen.getByRole("combobox") as HTMLSelectElement).value).toBe("/plugins");
-  });
-});
@@ -1,49 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for NotAvailablePanel — full-tab placeholder for unsupported runtimes.
- *
- * Coverage:
- *   - Renders heading "Files not available"
- *   - Renders runtime name in monospace span
- *   - Renders helper text referencing Chat tab
- *   - SVG icon is aria-hidden
- *   - Different runtime names display correctly
- */
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it } from "vitest";
-import { NotAvailablePanel } from "../NotAvailablePanel";
-
-afterEach(cleanup);
-
-describe("NotAvailablePanel", () => {
-  it("renders heading 'Files not available'", () => {
-    render(<NotAvailablePanel runtime="external" />);
-    expect(screen.getByText("Files not available")).toBeTruthy();
-  });
-
-  it("renders the runtime name in monospace", () => {
-    render(<NotAvailablePanel runtime="external" />);
-    expect(screen.getByText("external")).toBeTruthy();
-    const runtimeSpan = screen.getByText("external");
-    expect(runtimeSpan.tagName.toLowerCase()).toBe("span");
-  });
-
-  it("renders helper text referencing Chat tab", () => {
-    render(<NotAvailablePanel runtime="external" />);
-    expect(screen.getByText(/chat tab/i)).toBeTruthy();
-  });
-
-  it("renders SVG icon as aria-hidden", () => {
-    render(<NotAvailablePanel runtime="external" />);
-    const svg = document.querySelector("svg");
-    expect(svg?.getAttribute("aria-hidden")).toBe("true");
-  });
-
-  it("displays different runtime names correctly", () => {
-    render(<NotAvailablePanel runtime="hermes" />);
-    expect(screen.getByText("hermes")).toBeTruthy();
-    // "runtime" appears in the text node after the hermes span
-    expect(screen.getByText(/runtime, whose filesystem/i)).toBeTruthy();
-  });
-});
@@ -1,215 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for tree.ts — pure utility functions used by FileTree and FileEditor.
- *
- * getIcon coverage:
- *   - Returns 📁 for directories
- *   - Returns 📄 for unknown extensions
- *   - Returns correct emoji for known extensions (.md, .py, .ts, .tsx, .json, .yaml, .yml, .js, .html, .css, .sh)
- *   - Extension matching is case-insensitive
- *   - Files without extension return 📄
- *
- * buildTree coverage:
- *   - Empty array returns []
- *   - Single root file returns flat list
- *   - Single root directory returns with empty children
- *   - Nested files under directories build correct tree
- *   - Sorts: directories before files, then alphabetical
- *   - Duplicate path is ignored
- *   - Creates intermediate directories automatically
- *   - Preserves file size in TreeNode.size
- */
-import { describe, expect, it } from "vitest";
-import { getIcon, buildTree, type FileEntry, type TreeNode } from "../tree";
-
-// ─── getIcon ───────────────────────────────────────────────────────────────────
-
-describe("getIcon", () => {
-  it("returns 📁 for directories", () => {
-    expect(getIcon("src", true)).toBe("📁");
-    expect(getIcon("nested/deep/path", true)).toBe("📁");
-  });
-
-  it("returns 📄 for unknown extensions", () => {
-    expect(getIcon("file.xyz", false)).toBe("📄");
-    expect(getIcon("file.bin", false)).toBe("📄");
-  });
-
-  it("returns 📄 for files with no extension", () => {
-    expect(getIcon("Makefile", false)).toBe("📄");
-    expect(getIcon("Dockerfile", false)).toBe("📄");
-  });
-
-  it("returns 📄 for .md files", () => {
-    expect(getIcon("README.md", false)).toBe("📄");
-    expect(getIcon("CHANGELOG.MD", false)).toBe("📄"); // case-insensitive
-  });
-
-  it("returns 🐍 for .py files", () => {
-    expect(getIcon("main.py", false)).toBe("🐍");
-    expect(getIcon("utils.PY", false)).toBe("🐍");
-  });
-
-  it("returns 💠 for .ts and .tsx files", () => {
-    expect(getIcon("index.ts", false)).toBe("💠");
-    expect(getIcon("component.tsx", false)).toBe("💠");
-  });
-
-  it("returns 📜 for .js files", () => {
-    expect(getIcon("index.js", false)).toBe("📜");
-  });
-
-  it("returns {} for .json files", () => {
-    expect(getIcon("package.json", false)).toBe("{}");
-  });
-
-  it("returns ⚙ for .yaml and .yml files", () => {
-    expect(getIcon("config.yaml", false)).toBe("⚙");
-    expect(getIcon("config.yml", false)).toBe("⚙");
-    expect(getIcon("config.YAML", false)).toBe("⚙");
-  });
-
-  it("returns 🌐 for .html files", () => {
-    expect(getIcon("index.html", false)).toBe("🌐");
-  });
-
-  it("returns 🎨 for .css files", () => {
-    expect(getIcon("style.css", false)).toBe("🎨");
-  });
-
-  it("returns ▸ for .sh files", () => {
-    expect(getIcon("script.sh", false)).toBe("▸");
-  });
-});
-
-// ─── buildTree ─────────────────────────────────────────────────────────────────
-
-describe("buildTree", () => {
-  it("returns [] for empty input", () => {
-    expect(buildTree([])).toEqual([]);
-  });
-
-  it("returns flat list for single root file", () => {
-    const result = buildTree([{ path: "README.md", size: 100, dir: false }]);
-    expect(result).toHaveLength(1);
-    expect(result[0].name).toBe("README.md");
-    expect(result[0].path).toBe("README.md");
-    expect(result[0].isDir).toBe(false);
-    expect(result[0].children).toEqual([]);
-    expect(result[0].size).toBe(100);
-  });
-
-  it("returns node with empty children for root directory", () => {
-    const result = buildTree([{ path: "src", size: 0, dir: true }]);
-    expect(result).toHaveLength(1);
-    expect(result[0].name).toBe("src");
-    expect(result[0].isDir).toBe(true);
-    expect(result[0].children).toEqual([]);
-  });
-
-  it("builds correct nested tree for nested files", () => {
-    const files: FileEntry[] = [
-      { path: "src/app.ts", size: 500, dir: false },
-      { path: "src", size: 0, dir: true },
-    ];
-    const result = buildTree(files);
-    // Should have one root: src (directory)
-    expect(result).toHaveLength(1);
-    expect(result[0].name).toBe("src");
-    expect(result[0].isDir).toBe(true);
-    // src's children should contain app.ts
-    expect(result[0].children).toHaveLength(1);
-    expect(result[0].children[0].name).toBe("app.ts");
-    expect(result[0].children[0].path).toBe("src/app.ts");
-    expect(result[0].children[0].isDir).toBe(false);
-    expect(result[0].children[0].size).toBe(500);
-  });
-
-  it("sorts: directories before files, then alphabetical", () => {
-    const files: FileEntry[] = [
-      { path: "zebra.txt", size: 1, dir: false },
-      { path: "alpha", size: 0, dir: true },
-      { path: "beta.md", size: 2, dir: false },
-      { path: "gamma/", size: 0, dir: true },
-    ];
-    const result = buildTree(files);
-    expect(result).toHaveLength(4);
-    // Directories first: alpha, gamma
-    expect(result[0].name).toBe("alpha");
-    expect(result[1].name).toBe("gamma");
-    // Then files: beta.md, zebra.txt
-    expect(result[2].name).toBe("beta.md");
-    expect(result[3].name).toBe("zebra.txt");
-  });
-
-  it("returns 2 items for same-named file entries (buildTree does not deduplicate)", () => {
-    // buildTree deduplicates only directories (by dirMap path key).
-    // Two FileEntry objects with identical paths produce two TreeNode entries.
-    const files: FileEntry[] = [
-      { path: "README.md", size: 100, dir: false },
-      { path: "README.md", size: 200, dir: false },
-    ];
-    const result = buildTree(files);
-    expect(result).toHaveLength(2);
-    // Both have name "README.md"
-    expect(result.filter((n) => n.name === "README.md")).toHaveLength(2);
-  });
-
-  it("creates intermediate directories automatically", () => {
-    const files: FileEntry[] = [
-      { path: "src/lib/util.ts", size: 300, dir: false },
-      { path: "src/lib", size: 0, dir: true },
-      { path: "src", size: 0, dir: true },
-    ];
-    const result = buildTree(files);
-    // Root: src
-    expect(result).toHaveLength(1);
-    expect(result[0].name).toBe("src");
-    // src: lib
-    expect(result[0].children).toHaveLength(1);
-    expect(result[0].children[0].name).toBe("lib");
-    // lib: util.ts
-    expect(result[0].children[0].children).toHaveLength(1);
-    expect(result[0].children[0].children[0].name).toBe("util.ts");
-    expect(result[0].children[0].children[0].size).toBe(300);
-  });
-
-  it("preserves size on file nodes", () => {
-    const files: FileEntry[] = [
-      { path: "big.zip", size: 10_000_000, dir: false },
-      { path: "tiny.txt", size: 5, dir: false },
-    ];
-    const result = buildTree(files);
-    const big = result.find((n) => n.name === "big.zip");
-    const tiny = result.find((n) => n.name === "tiny.txt");
-    expect(big?.size).toBe(10_000_000);
-    expect(tiny?.size).toBe(5);
-  });
-
-  it("handles deeply nested paths", () => {
-    const files: FileEntry[] = [
-      { path: "a/b/c/d/e/deep.txt", size: 1, dir: false },
-    ];
-    const result = buildTree(files);
-    expect(result[0].name).toBe("a");
-    expect(result[0].children[0].name).toBe("b");
-    expect(result[0].children[0].children[0].name).toBe("c");
-    expect(result[0].children[0].children[0].children[0].name).toBe("d");
-    expect(result[0].children[0].children[0].children[0].children[0].name).toBe("e");
-    expect(
-      result[0].children[0].children[0].children[0].children[0].children[0].name,
-    ).toBe("deep.txt");
-  });
-
-  it("isDir=false for file entries, true for dir entries", () => {
-    const files: FileEntry[] = [
-      { path: "root.txt", size: 10, dir: false },
-      { path: "mydir", size: 0, dir: true },
-    ];
-    const result = buildTree(files);
-    const txt = result.find((n) => n.name === "root.txt");
-    const dir = result.find((n) => n.name === "mydir");
-    expect(txt?.isDir).toBe(false);
-    expect(dir?.isDir).toBe(true);
-  });
-});
@@ -647,7 +647,7 @@ export function SkillsTab({ workspaceId, data }: Props) {
  );
 }

-export function extractSkills(agentCard: Record<string, unknown> | null): SkillEntry[] {
+function extractSkills(agentCard: Record<string, unknown> | null): SkillEntry[] {
  if (!agentCard) return [];
  const rawSkills = agentCard.skills;
  if (!Array.isArray(rawSkills)) return [];
@@ -1,344 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for BudgetSection — budget limit display and editor in the details panel.
- *
- * Coverage:
- *   - Loading state
- *   - Error state (non-402)
- *   - Budget exceeded banner (402)
- *   - Budget stats row (used / limit)
- *   - Progress bar (only when limit set)
- *   - Remaining credits display
- *   - Input: pre-filled from budget_limit
- *   - Input: empty when budget_limit is null
- *   - Save: PATCH with correct payload
- *   - Save success: updates display + clears exceeded
- *   - Save error: shows error message
- *   - Saving... state
- *   - Limit 0 is sent as explicit 0 (not null)
- *   - Budget exceeded on save clears and re-shows banner
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { BudgetSection } from "../BudgetSection";
-
-// ─── Mock API ─────────────────────────────────────────────────────────────────
-
-const mockGet = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve([])));
-const mockPatch = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve({})));
-
-vi.mock("@/lib/api", () => ({
-  api: { get: mockGet, patch: mockPatch, post: vi.fn(), put: vi.fn(), del: vi.fn() },
-}));
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-const BUDGET_FIXTURE = {
-  budget_limit: 1000,
-  budget_used: 350,
-  budget_remaining: 650,
-};
-
-function budget(overrides: Partial<typeof BUDGET_FIXTURE> = {}): typeof BUDGET_FIXTURE {
-  return { ...BUDGET_FIXTURE, ...overrides };
-}
-
-// ─── Helpers ───────────────────────────────────────────────────────────────────
-
-async function flush() {
-  await act(async () => { await Promise.resolve(); });
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("BudgetSection", () => {
-  beforeEach(() => {
-    mockGet.mockReset();
-    mockPatch.mockReset();
-    vi.useRealTimers();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-  });
-
-  // ── Loading ─────────────────────────────────────────────────────────────────
-
-  it("shows loading state while fetching", async () => {
-    mockGet.mockImplementation(() => new Promise(() => {}));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-loading")).toBeTruthy();
-    expect(screen.getByText("Loading…")).toBeTruthy();
-  });
-
-  // ── Error ──────────────────────────────────────────────────────────────────
-
-  it("shows error message when GET rejects with non-402", async () => {
-    mockGet.mockRejectedValue(new Error("connection refused"));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-fetch-error")).toBeTruthy();
-    expect(screen.getByText(/connection refused/i)).toBeTruthy();
-  });
-
-  it("shows budget exceeded banner on 402 GET error", async () => {
-    const err = new Error("POST https://api.example.com: 402 Payment Required");
-    mockGet.mockRejectedValue(err);
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-exceeded-banner")).toBeTruthy();
-    expect(screen.getByText(/budget exceeded/i)).toBeTruthy();
-  });
-
-  it("shows exceeded banner AND fetch error together when 402 hides budget shape", async () => {
-    // After 402, budget is null — no stats shown, but banner is up
-    const err = new Error("GET https://api.example.com: 402");
-    mockGet.mockRejectedValue(err);
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-exceeded-banner")).toBeTruthy();
-    expect(screen.queryByTestId("budget-stats-row")).toBeFalsy();
-  });
-
-  // ── Budget stats ────────────────────────────────────────────────────────────
-
-  it("renders used and limit values", async () => {
-    mockGet.mockResolvedValue(budget({ budget_used: 750, budget_limit: 1000 }));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-used-value").textContent).toBe("750");
-    expect(screen.getByTestId("budget-limit-value").textContent).toBe("1,000");
-  });
-
-  it("renders 'Unlimited' when budget_limit is null", async () => {
-    mockGet.mockResolvedValue({ budget_limit: null, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-limit-value").textContent).toBe("Unlimited");
-  });
-
-  it("renders remaining credits", async () => {
-    mockGet.mockResolvedValue(budget({ budget_remaining: 999 }));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-remaining")).toBeTruthy();
-    expect(screen.getByText(/999 credits remaining/i)).toBeTruthy();
-  });
-
-  it("renders 0 credits remaining", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 100, budget_used: 100, budget_remaining: 0 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByText(/0 credits remaining/i)).toBeTruthy();
-  });
-
-  // ── Progress bar ────────────────────────────────────────────────────────────
-
-  it("renders progress bar when limit is set", async () => {
-    mockGet.mockResolvedValue(budget({ budget_limit: 200, budget_used: 100 }));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByRole("progressbar")).toBeTruthy();
-  });
-
-  it("hides progress bar when budget_limit is null", async () => {
-    mockGet.mockResolvedValue({ budget_limit: null, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.queryByRole("progressbar")).toBeFalsy();
-  });
-
-  it("progress bar is at 100% when budget_used equals budget_limit", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 500, budget_used: 500, budget_remaining: 0 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const fill = screen.getByTestId("budget-progress-fill");
-    expect(fill).toBeTruthy();
-    expect(fill.style.width).toBe("100%");
-  });
-
-  it("progress bar is capped at 100% when budget_used exceeds budget_limit", async () => {
-    // Catches over-budget; budget_remaining could be negative from platform
-    mockGet.mockResolvedValue({ budget_limit: 100, budget_used: 200, budget_remaining: -100 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const fill = screen.getByTestId("budget-progress-fill");
-    expect(fill.style.width).toBe("100%");
-  });
-
-  it("progress bar width is 0% when no usage", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 1000, budget_used: 0, budget_remaining: 1000 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const fill = screen.getByTestId("budget-progress-fill");
-    expect(fill.style.width).toBe("0%");
-  });
-
-  it("aria-valuenow reflects percentage", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 100, budget_used: 25, budget_remaining: 75 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const pb = screen.getByRole("progressbar");
-    expect(pb.getAttribute("aria-valuenow")).toBe("25");
-  });
-
-  // ── Input ───────────────────────────────────────────────────────────────────
-
-  it("pre-fills input from budget_limit", async () => {
-    mockGet.mockResolvedValue(budget({ budget_limit: 500 }));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect((screen.getByTestId("budget-limit-input") as HTMLInputElement).value).toBe("500");
-  });
-
-  it("pre-fills input as empty string when budget_limit is null", async () => {
-    mockGet.mockResolvedValue({ budget_limit: null, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect((screen.getByTestId("budget-limit-input") as HTMLInputElement).value).toBe("");
-  });
-
-  it("pre-fills input as '0' when budget_limit is 0", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 0, budget_used: 0, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect((screen.getByTestId("budget-limit-input") as HTMLInputElement).value).toBe("0");
-  });
-
-  it("input changes update state", async () => {
-    mockGet.mockResolvedValue(budget());
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const input = screen.getByTestId("budget-limit-input");
-    fireEvent.change(input, { target: { value: "2500" } });
-    await flush();
-    expect((input as HTMLInputElement).value).toBe("2500");
-  });
-
-  // ── Save ────────────────────────────────────────────────────────────────────
-
-  it("PATCHes correct payload on Save", async () => {
-    mockGet.mockResolvedValue(budget({ budget_limit: 1000 }));
-    mockPatch.mockResolvedValue({ budget_limit: 2000, budget_used: 350, budget_remaining: -1650 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    fireEvent.change(screen.getByTestId("budget-limit-input"), { target: { value: "2000" } });
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(mockPatch).toHaveBeenCalledWith("/workspaces/ws-1/budget", {
-      budget_limit: 2000,
-    });
-  });
-
-  it("sends null when input is cleared (unlimited)", async () => {
-    mockGet.mockResolvedValue(budget({ budget_limit: 1000 }));
-    mockPatch.mockResolvedValue({ budget_limit: null, budget_used: 350, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const input = screen.getByTestId("budget-limit-input");
-    fireEvent.change(input, { target: { value: "" } });
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(mockPatch).toHaveBeenCalledWith("/workspaces/ws-1/budget", {
-      budget_limit: null,
-    });
-  });
-
-  it("sends 0 when input is set to '0' (explicit zero, not unlimited)", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 1000, budget_used: 0, budget_remaining: 1000 });
-    mockPatch.mockResolvedValue({ budget_limit: 0, budget_used: 0, budget_remaining: 0 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    fireEvent.change(screen.getByTestId("budget-limit-input"), { target: { value: "0" } });
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(mockPatch).toHaveBeenCalledWith("/workspaces/ws-1/budget", {
-      budget_limit: 0,
-    });
-  });
-
-  it("shows 'Saving...' during save", async () => {
-    mockGet.mockResolvedValue(budget());
-    mockPatch.mockImplementation(() => new Promise(() => {}));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(screen.getByText("Saving…")).toBeTruthy();
-  });
-
-  it("disables Save button while saving", async () => {
-    mockGet.mockResolvedValue(budget());
-    mockPatch.mockImplementation(() => new Promise(() => {}));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    const btn = screen.getByTestId("budget-save-btn");
-    act(() => { btn.click(); });
-    await flush();
-    expect((btn as HTMLButtonElement).disabled).toBe(true);
-  });
-
-  it("updates display after successful save", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 1000, budget_used: 0, budget_remaining: 1000 });
-    mockPatch.mockResolvedValue({ budget_limit: 500, budget_used: 0, budget_remaining: 500 });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    fireEvent.change(screen.getByTestId("budget-limit-input"), { target: { value: "500" } });
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(screen.getByTestId("budget-limit-value").textContent).toBe("500");
-  });
-
-  it("shows error message when save fails", async () => {
-    mockGet.mockResolvedValue(budget());
-    mockPatch.mockRejectedValue(new Error("network error"));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(screen.getByTestId("budget-save-error")).toBeTruthy();
-    expect(screen.getByText(/network error/i)).toBeTruthy();
-  });
-
-  it("re-shows exceeded banner when save fails with 402", async () => {
-    mockGet.mockResolvedValue({ budget_limit: 1000, budget_used: 999, budget_remaining: 1 });
-    mockPatch.mockRejectedValue(new Error("https://api.example.com: 402 Payment Required"));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    act(() => { screen.getByTestId("budget-save-btn").click(); });
-    await flush();
-    expect(screen.getByTestId("budget-exceeded-banner")).toBeTruthy();
-  });
-
-  it("clears exceeded banner on successful save", async () => {
-    // Start with exceeded banner showing
-    mockGet.mockRejectedValue(new Error("https://api.example.com: 402 Payment Required"));
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    expect(screen.getByTestId("budget-exceeded-banner")).toBeTruthy();
-
-    // Fix: re-fetch with a fresh GET, then save
-    mockGet.mockResolvedValue({ budget_limit: 100, budget_used: 100, budget_remaining: 0 });
-    mockPatch.mockResolvedValue({ budget_limit: 200, budget_used: 100, budget_remaining: 100 });
-    fireEvent.click(screen.getByTestId("budget-save-btn"));
-    await flush();
-    // Banner should be gone after successful save
-    expect(screen.queryByTestId("budget-exceeded-banner")).toBeFalsy();
-  });
-
-  it("save button is disabled when input is empty and budget_limit was null", async () => {
-    mockGet.mockResolvedValue({ budget_limit: null, budget_used: 0, budget_remaining: null });
-    render(<BudgetSection workspaceId="ws-1" />);
-    await flush();
-    // User clears the (empty) input — this is still null, not a change
-    // The button is never disabled — it always saves whatever is in the input
-    expect(screen.getByTestId("budget-save-btn")).toBeTruthy();
-  });
-});
@@ -1,596 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for DetailsTab — workspace detail panel in the side panel.
- *
- * Coverage:
- *   - View mode: renders workspace info (name, role, tier, status, url, parent)
- *   - View mode: renders T1/T2/T3/T4 tier display
- *   - View mode: shows active tasks count
- *   - Edit mode: opens when Edit is clicked
- *   - Edit mode: pre-fills name/role/tier from current data
- *   - Edit mode: changes propagate to form state
- *   - Save: PATCH /workspaces/:id with correct payload
- *   - Save success: calls updateNodeData + exits edit mode
- *   - Save error: shows error message
- *   - Cancel: restores original name/role/tier + exits edit mode
- *   - Restart button: visible for offline/failed/degraded workspaces
- *   - Restart button: hidden for online/provisioning workspaces
- *   - Restart: POST /workspaces/:id/restart + sets status to provisioning
- *   - Restart error: shows error message
- *   - Error section: shown for failed/degraded workspaces
- *   - Error section: shows lastSampleError in <pre>
- *   - Error section: shows 'No error detail recorded' when none
- *   - Console button: opens ConsoleModal
- *   - Peers: skipped when workspace is not online/degraded
- *   - Peers: loaded from GET /registry/:id/peers when online
- *   - Peers: shown with StatusDot and name
- *   - Peers: click navigates to peer node
- *   - Peers error: shown when load fails
- *   - Delete confirmation: two-step (click → confirm)
- *   - Delete: DEL /workspaces/:id?confirm=true + removeSubtree + selectNode(null)
- *   - Delete error: shown when DEL fails
- *   - ConsoleModal: mounted and rendered
- *   - Tier change via select
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, act, waitFor } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { DetailsTab } from "../DetailsTab";
-
-// ─── Mock sub-components ───────────────────────────────────────────────────────
-
-vi.mock("@/components/StatusDot", () => ({
-  StatusDot: ({ status }: { status: string }) => (
-    <span data-testid="status-dot" data-status={status}>StatusDot:{status}</span>
-  ),
-}));
-
-vi.mock("@/components/tabs/BudgetSection", () => ({
-  BudgetSection: ({ workspaceId }: { workspaceId: string }) => (
-    <div data-testid="budget-section" data-ws={workspaceId}>BudgetSection</div>
-  ),
-}));
-
-vi.mock("@/components/WorkspaceUsage", () => ({
-  WorkspaceUsage: ({ workspaceId }: { workspaceId: string }) => (
-    <div data-testid="workspace-usage" data-ws={workspaceId}>WorkspaceUsage</div>
-  ),
-}));
-
-const consoleModalMock = vi.hoisted(() => vi.fn(() => <div data-testid="console-modal">ConsoleModal</div>));
-vi.mock("@/components/ConsoleModal", () => ({
-  ConsoleModal: consoleModalMock,
-}));
-
-// ─── Mock API ─────────────────────────────────────────────────────────────────
-
-const mockGet = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve([])));
-const mockPatch = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve({})));
-const mockPost = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve({})));
-const mockDel = vi.hoisted(() => vi.fn((): Promise<unknown> => Promise.resolve({})));
-
-vi.mock("@/lib/api", () => ({
-  api: { get: mockGet, patch: mockPatch, post: mockPost, del: mockDel },
-}));
-
-// ─── Mock canvas store ─────────────────────────────────────────────────────────
-
-const updateNodeDataMock = vi.fn();
-const removeSubtreeMock = vi.fn();
-const selectNodeMock = vi.fn();
-
-vi.mock("@/store/canvas", () => ({
-  useCanvasStore: vi.fn((selector?: (s: unknown) => unknown) =>
-    selector
-      ? selector({
-          updateNodeData: updateNodeDataMock,
-          removeSubtree: removeSubtreeMock,
-          selectNode: selectNodeMock,
-        })
-      : {},
-  ),
-}));
-
-// ─── Helpers ───────────────────────────────────────────────────────────────────
-
-async function flush() {
-  await act(async () => { await Promise.resolve(); });
-}
-
-function typeIn(el: HTMLElement, value: string) {
-  Object.defineProperty(el, "value", { value, writable: true, configurable: true });
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  fireEvent.change(el as any, { target: el });
-}
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-// Minimal set of WorkspaceNodeData fields — cast to bypass type-checking here.
-// The component is already tested at the type level; the fixture only needs
-// enough shape to let DetailsTab render without crashing.
-const DEFAULT_DATA = {
-  id: "ws-1",
-  name: "My Workspace",
-  role: "agent",
-  tier: 2,
-  status: "online",
-  parentId: null as string | null,
-  url: "http://localhost:8081",
-  activeTasks: 0,
-  agentCard: null,
-  collapsed: false,
-  lastErrorRate: 0,
-  lastSampleError: "",
-  currentTask: "",
-  runtime: "claude-code",
-  needsRestart: false,
-  budgetLimit: null,
-} as unknown as import("@/store/canvas").WorkspaceNodeData;
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("DetailsTab", () => {
-  beforeEach(() => {
-    mockGet.mockReset();
-    mockPatch.mockReset();
-    mockPost.mockReset();
-    mockDel.mockReset();
-    updateNodeDataMock.mockReset();
-    removeSubtreeMock.mockReset();
-    selectNodeMock.mockReset();
-    consoleModalMock.mockReset();
-    vi.useRealTimers();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-  });
-
-  // ── View mode ──────────────────────────────────────────────────────────────
-
-  it("renders workspace name", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByText("My Workspace")).toBeTruthy();
-  });
-
-  it("renders role", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, role: "researcher" }} />);
-    await flush();
-    expect(screen.getByText("researcher")).toBeTruthy();
-  });
-
-  it("renders T2 for tier 2", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, tier: 2 }} />);
-    await flush();
-    expect(screen.getByText("T2")).toBeTruthy();
-  });
-
-  it("renders T4 for tier 4", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, tier: 4 }} />);
-    await flush();
-    expect(screen.getByText("T4")).toBeTruthy();
-  });
-
-  it("renders status", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed" }} />);
-    await flush();
-    expect(screen.getByText("failed")).toBeTruthy();
-  });
-
-  it("renders URL when present", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, url: "http://example.com" }} />);
-    await flush();
-    expect(screen.getByText("http://example.com")).toBeTruthy();
-  });
-
-  it("renders '—' when url is absent", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, url: "" }} />);
-    await flush();
-    expect(screen.getByText("—")).toBeTruthy();
-  });
-
-  it("renders 'root' for root workspace (no parentId)", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, parentId: null }} />);
-    await flush();
-    expect(screen.getByText("root")).toBeTruthy();
-  });
-
-  it("renders parent ID when present", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, parentId: "ws-parent-42" }} />);
-    await flush();
-    expect(screen.getByText("ws-parent-42")).toBeTruthy();
-  });
-
-  it("renders active tasks count", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, activeTasks: 5 }} />);
-    await flush();
-    expect(screen.getByText(/5/)).toBeTruthy();
-  });
-
-  it("shows BudgetSection", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByTestId("budget-section")).toBeTruthy();
-  });
-
-  it("shows WorkspaceUsage", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByTestId("workspace-usage")).toBeTruthy();
-  });
-
-  // ── Edit mode ──────────────────────────────────────────────────────────────
-
-  it("shows Edit button in view mode", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByRole("button", { name: /edit/i })).toBeTruthy();
-  });
-
-  it("opens edit form when Edit is clicked", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    // Form inputs should now be visible
-    expect(screen.getByLabelText("Name")).toBeTruthy();
-    expect(screen.getByLabelText("Role")).toBeTruthy();
-    expect(screen.getByLabelText("Tier")).toBeTruthy();
-  });
-
-  it("pre-fills form with current name/role/tier", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, name: "Alpha", role: "ceo", tier: 3 }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    expect((screen.getByLabelText("Name") as HTMLInputElement).value).toBe("Alpha");
-    expect((screen.getByLabelText("Role") as HTMLInputElement).value).toBe("ceo");
-    expect((screen.getByLabelText("Tier") as HTMLSelectElement).value).toBe("3");
-  });
-
-  it("name changes propagate to form state", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    typeIn(screen.getByLabelText("Name") as HTMLElement, "New Name");
-    await flush();
-    expect((screen.getByLabelText("Name") as HTMLInputElement).value).toBe("New Name");
-  });
-
-  it("role changes propagate to form state", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    typeIn(screen.getByLabelText("Role") as HTMLElement, "Researcher");
-    await flush();
-    expect((screen.getByLabelText("Role") as HTMLInputElement).value).toBe("Researcher");
-  });
-
-  it("tier changes via select", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, tier: 1 }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    fireEvent.change(screen.getByLabelText("Tier"), { target: { value: "4" } });
-    await flush();
-    expect((screen.getByLabelText("Tier") as HTMLSelectElement).value).toBe("4");
-  });
-
-  it("PATCHes correct payload on Save", async () => {
-    mockPatch.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, name: "Old", role: "old-role", tier: 2 }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    typeIn(screen.getByLabelText("Name") as HTMLElement, "New");
-    typeIn(screen.getByLabelText("Role") as HTMLElement, "NewRole");
-    fireEvent.change(screen.getByLabelText("Tier"), { target: { value: "3" } });
-    await flush();
-    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
-    await flush();
-    expect(mockPatch).toHaveBeenCalledWith(
-      "/workspaces/ws-1",
-      expect.objectContaining({ name: "New", role: "NewRole", tier: 3 }),
-    );
-  });
-
-  it("calls updateNodeData and exits edit on successful save", async () => {
-    mockPatch.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, name: "Old" }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    typeIn(screen.getByLabelText("Name") as HTMLElement, "New");
-    await flush();
-    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
-    await flush();
-    expect(updateNodeDataMock).toHaveBeenCalledWith("ws-1", { name: "New", role: "agent", tier: 2 });
-    await waitFor(() => {
-      expect(screen.queryByLabelText("Name")).not.toBeTruthy();
-    });
-  });
-
-  it("shows error message when save fails", async () => {
-    mockPatch.mockRejectedValue(new Error("save failed"));
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
-    await flush();
-    expect(screen.getByText(/save failed/i)).toBeTruthy();
-  });
-
-  it("Cancel restores original name/role/tier and exits edit", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, name: "Original", role: "orig-role", tier: 2 }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    typeIn(screen.getByLabelText("Name") as HTMLElement, "Changed");
-    typeIn(screen.getByLabelText("Role") as HTMLElement, "changed-role");
-    await flush();
-    act(() => { screen.getByRole("button", { name: /cancel/i }).click(); });
-    await flush();
-    // Form should be closed (back to view mode)
-    await waitFor(() => {
-      expect(screen.queryByLabelText("Name")).not.toBeTruthy();
-    });
-    // Value should be back to original
-    expect(screen.getByText("Original")).toBeTruthy();
-  });
-
-  it("shows 'Saving...' when save is in progress", async () => {
-    mockPatch.mockImplementation(() => new Promise(() => {}));
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
-    await flush();
-    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
-    await flush();
-    expect(screen.getByText("Saving...")).toBeTruthy();
-  });
-
-  // ── Restart ───────────────────────────────────────────────────────────────
-
-  it("shows Restart button for offline workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    expect(screen.getByRole("button", { name: /restart/i })).toBeTruthy();
-  });
-
-  it("shows Retry button for failed workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed" }} />);
-    await flush();
-    expect(screen.getByRole("button", { name: /retry/i })).toBeTruthy();
-  });
-
-  it("shows Restart button for degraded workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "degraded" }} />);
-    await flush();
-    expect(screen.getByRole("button", { name: /restart/i })).toBeTruthy();
-  });
-
-  it("hides Restart/Retry for online workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "online" }} />);
-    await flush();
-    expect(screen.queryByRole("button", { name: /restart/i })).toBeFalsy();
-    expect(screen.queryByRole("button", { name: /retry/i })).toBeFalsy();
-  });
-
-  it("POSTs /workspaces/:id/restart when Restart is clicked", async () => {
-    mockPost.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /restart/i }));
-    await flush();
-    expect(mockPost).toHaveBeenCalledWith("/workspaces/ws-1/restart", {});
-  });
-
-  it("calls updateNodeData to set status to provisioning on restart", async () => {
-    mockPost.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /restart/i }));
-    await flush();
-    expect(updateNodeDataMock).toHaveBeenCalledWith("ws-1", { status: "provisioning" });
-  });
-
-  it("shows error when restart fails", async () => {
-    mockPost.mockRejectedValue(new Error("restart failed"));
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /restart/i }));
-    await flush();
-    expect(screen.getByText(/restart failed/i)).toBeTruthy();
-  });
-
-  it("shows 'Restarting...' during restart", async () => {
-    mockPost.mockImplementation(() => new Promise(() => {}));
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /restart/i }));
-    await flush();
-    expect(screen.getByText("Restarting...")).toBeTruthy();
-  });
-
-  // ── Error section ────────────────────────────────────────────────────────
-
-  it("shows Error section for failed workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed" }} />);
-    await flush();
-    expect(screen.getByText("Error")).toBeTruthy();
-  });
-
-  it("shows lastSampleError in <pre> for failed workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed", lastSampleError: "ModuleNotFoundError: foo" }} />);
-    await flush();
-    expect(screen.getByTestId("details-error-log")).toBeTruthy();
-    expect(screen.getByText("ModuleNotFoundError: foo")).toBeTruthy();
-  });
-
-  it("shows 'No error detail recorded' when no error", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed", lastSampleError: "" }} />);
-    await flush();
-    expect(screen.getByText("No error detail recorded.")).toBeTruthy();
-  });
-
-  it("opens ConsoleModal when View console output is clicked", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "failed" }} />);
-    await flush();
-    consoleModalMock.mockClear();
-    fireEvent.click(screen.getByRole("button", { name: /view console output/i }));
-    await flush();
-    expect(consoleModalMock.mock.calls[0][0]).toMatchObject({ open: true });
-  });
-
-  // ── Degraded error rate ──────────────────────────────────────────────────
-
-  it("shows error rate for degraded workspace", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "degraded", lastErrorRate: 0.25 }} />);
-    await flush();
-    expect(screen.getByText("25%")).toBeTruthy();
-  });
-
-  // ── Peers ────────────────────────────────────────────────────────────────
-
-  it("skips peer load when workspace is not online/degraded", async () => {
-    mockGet.mockResolvedValue([]);
-    render(<DetailsTab workspaceId="ws-1" data={{ ...DEFAULT_DATA, status: "offline" }} />);
-    await flush();
-    expect(screen.queryByText(/peers are only discoverable/i)).toBeTruthy();
-  });
-
-  it("loads peers from GET /registry/:id/peers when online", async () => {
-    mockGet.mockResolvedValue([
-      { id: "p1", name: "Peer One", role: "agent", status: "online", tier: 1 },
-    ]);
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(mockGet).toHaveBeenCalledWith("/registry/ws-1/peers");
-    expect(screen.getByText("Peer One")).toBeTruthy();
-  });
-
-  it("shows 'No reachable peers' when peer list is empty", async () => {
-    mockGet.mockResolvedValue([]);
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByText("No reachable peers")).toBeTruthy();
-  });
-
-  it("calls selectNode when a peer button is clicked", async () => {
-    mockGet.mockResolvedValue([
-      { id: "p1", name: "Peer One", role: "agent", status: "online", tier: 1 },
-    ]);
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByText("Peer One"));
-    await flush();
-    expect(selectNodeMock).toHaveBeenCalledWith("p1");
-  });
-
-  it("shows peers error message when load fails", async () => {
-    mockGet.mockRejectedValue(new Error("peer load failed"));
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByText(/peer load failed/i)).toBeTruthy();
-  });
-
-  // ── Delete ───────────────────────────────────────────────────────────────
-
-  it("shows Delete Workspace button", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.getByRole("button", { name: /delete workspace/i })).toBeTruthy();
-  });
-
-  it("shows confirmation when Delete Workspace is clicked", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /delete workspace/i }));
-    await flush();
-    expect(screen.getByRole("button", { name: /confirm delete/i })).toBeTruthy();
-    expect(screen.getByRole("button", { name: /cancel/i })).toBeTruthy();
-  });
-
-  it("DELs /workspaces/:id?confirm=true when Confirm Delete is clicked", async () => {
-    mockDel.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /delete workspace/i }));
-    await flush();
-    act(() => { screen.getByRole("button", { name: /confirm delete/i }).click(); });
-    await flush();
-    expect(mockDel).toHaveBeenCalledWith("/workspaces/ws-1?confirm=true");
-  });
-
-  it("calls removeSubtree and selectNode(null) after delete", async () => {
-    mockDel.mockResolvedValue({});
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /delete workspace/i }));
-    await flush();
-    act(() => { screen.getByRole("button", { name: /confirm delete/i }).click(); });
-    await flush();
-    expect(removeSubtreeMock).toHaveBeenCalledWith("ws-1");
-    expect(selectNodeMock).toHaveBeenCalledWith(null);
-  });
-
-  it("shows error when delete fails", async () => {
-    mockDel.mockRejectedValue(new Error("delete failed"));
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /delete workspace/i }));
-    await flush();
-    act(() => { screen.getByRole("button", { name: /confirm delete/i }).click(); });
-    await flush();
-    expect(screen.getByText(/delete failed/i)).toBeTruthy();
-  });
-
-  it("cancels delete confirmation", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: /delete workspace/i }));
-    await flush();
-    expect(screen.getByRole("button", { name: /confirm delete/i })).toBeTruthy();
-    act(() => { screen.getByRole("button", { name: /cancel/i }).click(); });
-    await flush();
-    expect(screen.queryByRole("button", { name: /confirm delete/i })).toBeFalsy();
-  });
-
-  // ── Skills ─────────────────────────────────────────────────────────────
-
-  it("shows skills from agentCard when present", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{
-      ...DEFAULT_DATA,
-      agentCard: {
-        skills: [
-          { id: "web-search", description: "Search the web" },
-          { id: "code-gen", description: "Generate code" },
-        ],
-      },
-    }} />);
-    await flush();
-    expect(screen.getByText("web-search")).toBeTruthy();
-    expect(screen.getByText("Search the web")).toBeTruthy();
-    expect(screen.getByText("code-gen")).toBeTruthy();
-  });
-
-  it("hides Skills section when agentCard is null", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={DEFAULT_DATA} />);
-    await flush();
-    expect(screen.queryByText("Skills")).toBeFalsy();
-  });
-
-  it("hides Skills section when agentCard.skills is empty", async () => {
-    render(<DetailsTab workspaceId="ws-1" data={{
-      ...DEFAULT_DATA,
-      agentCard: { skills: [] },
-    }} />);
-    await flush();
-    expect(screen.queryByText("Skills")).toBeFalsy();
-  });
-});
@@ -1,140 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Unit tests for extractSkills — pure helper from SkillsTab.
- *
- * Covers: null card, non-array skills, empty skills, full skill entries
- * (id, name, description, tags, examples), id-only fallback, name-only
- * fallback, string coercion, array coercion for tags/examples,
- * filtering entries with no id after coercion, empty string id (filtered).
- */
-import { describe, it, expect } from "vitest";
-import { extractSkills } from "../SkillsTab";
-
-describe("extractSkills", () => {
-  it("returns [] for null card", () => {
-    expect(extractSkills(null)).toEqual([]);
-  });
-
-  it("returns [] when card.skills is not an array", () => {
-    expect(extractSkills({ skills: undefined })).toEqual([]);
-    expect(extractSkills({ skills: "not-an-array" })).toEqual([]);
-    expect(extractSkills({ skills: { id: "x" } })).toEqual([]);
-  });
-
-  it("returns [] for empty skills array", () => {
-    expect(extractSkills({ skills: [] })).toEqual([]);
-  });
-
-  it("maps a fully-populated skill entry", () => {
-    const card = {
-      skills: [
-        {
-          id: "code_search",
-          name: "Code Search",
-          description: "Semantic code search",
-          tags: ["search", "code"],
-          examples: ["Find unused exports", "Search by AST pattern"],
-        },
-      ],
-    };
-    expect(extractSkills(card)).toEqual([
-      {
-        id: "code_search",
-        name: "Code Search",
-        description: "Semantic code search",
-        tags: ["search", "code"],
-        examples: ["Find unused exports", "Search by AST pattern"],
-      },
-    ]);
-  });
-
-  it("uses name as id when id is absent", () => {
-    const card = { skills: [{ name: "web_scraper" }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "web_scraper", name: "web_scraper", description: "", tags: [], examples: [] },
-    ]);
-  });
-
-  it("uses id as name when name is absent", () => {
-    const card = { skills: [{ id: "legacy_skill" }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "legacy_skill", name: "legacy_skill", description: "", tags: [], examples: [] },
-    ]);
-  });
-
-  it("filters out entries with neither id nor name", () => {
-    // id: String(undefined || undefined || "") → "" → filtered (id.length = 0)
-    const card = { skills: [{ description: "orphan entry" }] };
-    expect(extractSkills(card)).toEqual([]);
-  });
-
-  it("filters out entries with no id after string coercion", () => {
-    // id resolves to "" after String(undefined || null || {})
-    const card = { skills: [{ id: null, name: null }] };
-    expect(extractSkills(card)).toEqual([]);
-  });
-
-  it("filters out entries with empty-string id", () => {
-    const card = { skills: [{ id: "", name: "" }] };
-    expect(extractSkills(card)).toEqual([]);
-  });
-
-  it("coerces numeric tags to strings", () => {
-    const card = { skills: [{ id: "x", tags: [1, "two", 3] }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "x", name: "x", description: "", tags: ["1", "two", "3"], examples: [] },
-    ]);
-  });
-
-  it("coerces non-array tags to empty array", () => {
-    const card = { skills: [{ id: "x", tags: "not-an-array" }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "x", name: "x", description: "", tags: [], examples: [] },
-    ]);
-  });
-
-  it("coerces non-array examples to empty array", () => {
-    const card = { skills: [{ id: "x", examples: 42 }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "x", name: "x", description: "", tags: [], examples: [] },
-    ]);
-  });
-
-  // NOTE: extractSkills uses `String(skill.description || "")` — falsy values
-  // (0, null, false) fall through to "", NOT to their string form.
-  it("returns '' for falsy description values (0, null, false)", () => {
-    const card = { skills: [{ id: "x", description: 0 }] };
-    expect(extractSkills(card)).toEqual([
-      { id: "x", name: "x", description: "", tags: [], examples: [] },
-    ]);
-  });
-
-  it("handles mixed valid/invalid entries", () => {
-    const card = {
-      skills: [
-        { id: "valid_one", name: "One" },
-        { name: "named_only" },
-        { description: "orphan" },               // filtered — id becomes ""
-        { id: "valid_two", examples: ["a", "b"] },
-      ],
-    };
-    expect(extractSkills(card)).toEqual([
-      { id: "valid_one", name: "One", description: "", tags: [], examples: [] },
-      { id: "named_only", name: "named_only", description: "", tags: [], examples: [] },
-      { id: "valid_two", name: "valid_two", description: "", tags: [], examples: ["a", "b"] },
-    ]);
-  });
-
-  it("handles a realistic agent card with multiple skills", () => {
-    const card = {
-      skills: [
-        { id: "web_search", name: "Web Search", description: "Search the web", tags: ["search"], examples: ["Latest news"] },
-        { id: "file_read", name: "Read Files", description: "Read from disk", tags: ["io"], examples: [] },
-      ],
-    };
-    const result = extractSkills(card);
-    expect(result).toHaveLength(2);
-    expect(result[0].id).toBe("web_search");
-    expect(result[1].tags).toEqual(["io"]);
-  });
-});
@@ -1,95 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Unit tests for getSkills — pure helper from DetailsTab.
- *
- * Covers: null card, non-array skills, empty skills, id-only entries,
- * name-only entries (id derives from name), entries with description,
- * entries with neither id nor name (filtered out), mixed entries.
- */
-import { describe, it, expect } from "vitest";
-import { getSkills } from "../DetailsTab";
-
-describe("getSkills", () => {
-  it("returns [] for null card", () => {
-    expect(getSkills(null)).toEqual([]);
-  });
-
-  it("returns [] when card.skills is not an array", () => {
-    expect(getSkills({ skills: undefined })).toEqual([]);
-    expect(getSkills({ skills: "not-an-array" })).toEqual([]);
-    expect(getSkills({ skills: { id: "x" } })).toEqual([]);
-  });
-
-  it("returns [] for empty skills array", () => {
-    expect(getSkills({ skills: [] })).toEqual([]);
-  });
-
-  it("maps skill with id and description", () => {
-    const card = { skills: [{ id: "code_search", description: "Find code patterns" }] };
-    expect(getSkills(card)).toEqual([{ id: "code_search", description: "Find code patterns" }]);
-  });
-
-  it("maps skill with id only (description absent)", () => {
-    const card = { skills: [{ id: "code_search" }] };
-    expect(getSkills(card)).toEqual([{ id: "code_search", description: undefined }]);
-  });
-
-  it("derives id from name when id is absent", () => {
-    const card = { skills: [{ name: "web_scraper" }] };
-    expect(getSkills(card)).toEqual([{ id: "web_scraper" }]);
-  });
-
-  it("maps description when present", () => {
-    const card = { skills: [{ id: "file_write", description: "Writes files to disk" }] };
-    expect(getSkills(card)).toEqual([{ id: "file_write", description: "Writes files to disk" }]);
-  });
-
-  it("returns description as undefined when skill has no description", () => {
-    const card = { skills: [{ id: "noop_skill" }] };
-    const result = getSkills(card);
-    // The map always includes description; it's undefined when absent
-    expect(result).toEqual([{ id: "noop_skill", description: undefined }]);
-  });
-
-  it("filters out skills with neither id nor name", () => {
-    // id: String(undefined || undefined || "") → "" → filtered
-    const card = { skills: [{ description: "loner" }] };
-    expect(getSkills(card)).toEqual([]);
-  });
-
-  it("handles mixed valid/invalid entries", () => {
-    const card = {
-      skills: [
-        { id: "valid_one" },
-        { name: "named_skill" },
-        { description: "orphaned" },   // filtered
-        { id: "valid_two", description: "Has both" },
-      ],
-    };
-    expect(getSkills(card)).toEqual([
-      { id: "valid_one", description: undefined },
-      { id: "named_skill", description: undefined },
-      { id: "valid_two", description: "Has both" },
-    ]);
-  });
-
-  it("handles string coercion for numeric ids/names", () => {
-    const card = { skills: [{ id: 42, name: "numeric_id" }] };
-    expect(getSkills(card)).toEqual([{ id: "42" }]);
-  });
-
-  it("uses id over name when both are present", () => {
-    const card = { skills: [{ id: "priority_id", name: "fallback_name" }] };
-    expect(getSkills(card)).toEqual([{ id: "priority_id", description: undefined }]);
-  });
-
-  it("omits description when it is falsy (0 is falsy in JS)", () => {
-    // The implementation uses `s.description ?` — 0 is falsy, so it's treated
-    // as absent and undefined is returned. Non-zero numbers coerce fine.
-    const cardZero = { skills: [{ id: "x", description: 0 }] };
-    expect(getSkills(cardZero)).toEqual([{ id: "x", description: undefined }]);
-
-    const cardNum = { skills: [{ id: "x", description: 42 }] };
-    expect(getSkills(cardNum)).toEqual([{ id: "x", description: "42" }]);
-  });
-});
@@ -1,257 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentAudio — inline native <audio controls> player.
- *
- * Per RFC #2991 PR-2. Dispatches from AttachmentPreview so most paths
- * are pinned there. These tests cover AttachmentAudio as a standalone
- * renderer: loading skeleton, ready <audio>, chip-error fallback, and
- * tone=user vs tone=agent styling.
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks.
- */
-import { afterEach, describe, expect, it, vi, beforeEach } from "vitest";
-import { render, screen, cleanup, waitFor } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentAudio } from "../AttachmentAudio";
-import type { ChatAttachment } from "../types";
-
-afterEach(cleanup);
-
-// Stub env token so platformAuthHeaders() is callable without a real env.
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");
-
-const fetchMock = vi.fn();
-beforeEach(() => {
-  fetchMock.mockReset();
-  vi.stubGlobal("fetch", fetchMock);
-  global.URL.createObjectURL = vi.fn(() => "blob:audio-test");
-  global.URL.revokeObjectURL = vi.fn();
-});
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeAtt(name = "recording.mp3"): ChatAttachment {
-  return { name, uri: "workspace:/workspace/tmp/" + name, mimeType: "audio/mpeg" };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("AttachmentAudio", () => {
-  it("renders loading skeleton (idle) before fetch resolves", () => {
-    // Never-resolving fetch → component stays in loading/idle state.
-    fetchMock.mockReturnValue(new Promise(() => {}));
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt()}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const skeleton = screen.getByLabelText(/Loading recording\.mp3/i);
-    expect(skeleton).toBeTruthy();
-    expect(skeleton.className).toContain("animate-pulse");
-  });
-
-  it("renders loading skeleton during loading state", async () => {
-    fetchMock.mockReturnValue(
-      new Promise<Response>(() => {}), // hangs forever
-    );
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("song.wav")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByLabelText(/Loading song\.wav/i)).toBeTruthy();
-    });
-  });
-
-  it("renders <audio controls> when fetch succeeds", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["fake-mp3-bytes"], { type: "audio/mpeg" }),
-    });
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("podcast.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const audio = document.querySelector("audio");
-      expect(audio).not.toBeNull();
-      expect(audio?.hasAttribute("controls")).toBe(true);
-    });
-  });
-
-  it("audio src is the blob URL minted from response", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["bytes"], { type: "audio/mp3" }),
-    });
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("track.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const audio = document.querySelector("audio") as HTMLAudioElement;
-      expect(audio?.src).toBe("blob:audio-test");
-    });
-  });
-
-  it("renders filename label above the audio element", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "audio/mpeg" }),
-    });
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("voice-note.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    // Wait for the ready state (audio element present), then verify the
-    // filename label <span> is in the DOM.
-    await waitFor(() => {
-      expect(document.querySelector("audio")).not.toBeNull();
-    });
-    const labelSpan = document.querySelector(
-      `span[title="voice-note.mp3"]`,
-    );
-    expect(labelSpan).not.toBeNull();
-    expect(labelSpan?.textContent).toBe("voice-note.mp3");
-  });
-
-  it("fetch 404 → renders AttachmentChip (chip error fallback)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 404 });
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("missing.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download missing\.mp3/i)).toBeTruthy();
-    });
-    // <audio> must NOT appear when chip is shown.
-    expect(document.querySelector("audio")).toBeNull();
-  });
-
-  it("fetch network error → chip error fallback", async () => {
-    fetchMock.mockRejectedValue(new Error("network down"));
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("offline.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download offline\.mp3/i)).toBeTruthy();
-    });
-  });
-
-  it("tone=user applies blue border class on ready-state container", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "audio/mpeg" }),
-    });
-    const { container } = render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("blue.mp3")}
-        onDownload={vi.fn()}
-        tone="user"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("audio")).not.toBeNull();
-    });
-    // The outer ready-state <div> must contain blue-400 class when tone=user.
-    const readyDivs = Array.from(container.querySelectorAll("div")).filter(
-      (d) => d.className.includes("blue-400"),
-    );
-    expect(readyDivs.length).toBeGreaterThan(0);
-  });
-
-  it("tone=agent does not apply blue border class", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "audio/mpeg" }),
-    });
-    const { container } = render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("gray.mp3")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("audio")).not.toBeNull();
-    });
-    const blueDivs = Array.from(container.querySelectorAll("div")).filter(
-      (d) => d.className.includes("blue-400"),
-    );
-    expect(blueDivs).toHaveLength(0);
-  });
-
-  it("onDownload is NOT called during loading or ready states", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "audio/mpeg" }),
-    });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("quiet.mp3")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    // Wait for ready state — onDownload must not have been called.
-    await waitFor(() => {
-      expect(document.querySelector("audio")).not.toBeNull();
-    });
-    expect(onDownload).not.toHaveBeenCalled();
-  });
-
-  it("calls onDownload when chip fallback is rendered (error state)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 500 });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentAudio
-        workspaceId="ws-1"
-        attachment={makeAtt("fail.mp3")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download fail\.mp3/i)).toBeTruthy();
-    });
-    // Click the chip's download button.
-    screen.getByTitle(/Download fail\.mp3/i).click();
-    expect(onDownload).toHaveBeenCalledWith(
-      expect.objectContaining({ name: "fail.mp3" }),
-    );
-  });
-});
@@ -1,303 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentImage — inline image thumbnail with click-to-fullscreen.
- *
- * Per RFC #2991 PR-1. Loading skeleton, ready state renders a
- * clickable image that opens AttachmentLightbox, chip error fallback,
- * external URI (no-fetch path), tone=user/agent styling, and cleanup
- * on unmount.
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { render, screen, cleanup, waitFor, act, fireEvent } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentImage } from "../AttachmentImage";
-import type { ChatAttachment } from "./types";
-
-afterEach(cleanup);
-
-// Stub env token so platformAuthHeaders() is callable without a real env.
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");
-
-const fetchMock = vi.fn();
-beforeEach(() => {
-  fetchMock.mockReset();
-  vi.stubGlobal("fetch", fetchMock);
-  global.URL.createObjectURL = vi.fn(() => "blob:image-test");
-  global.URL.revokeObjectURL = vi.fn();
-});
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeAtt(name = "photo.jpg"): ChatAttachment {
-  return { name, uri: "workspace:/workspace/tmp/" + name, mimeType: "image/jpeg" };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("AttachmentImage", () => {
-  // ── idle / loading skeleton ───────────────────────────────────────────────
-
-  it("renders loading skeleton (idle state) before fetch resolves", () => {
-    fetchMock.mockReturnValue(new Promise(() => {})); // hangs forever
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt()}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const skeleton = screen.getByLabelText(/Loading photo\.jpg/i);
-    expect(skeleton).toBeTruthy();
-    expect(skeleton.className).toContain("animate-pulse");
-  });
-
-  it("renders loading skeleton (loading state)", async () => {
-    fetchMock.mockReturnValue(new Promise<Response>(() => {})); // hangs forever
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("screenshot.png")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByLabelText(/Loading screenshot\.png/i)).toBeTruthy();
-    });
-  });
-
-  // ── error fallback ───────────────────────────────────────────────────────
-
-  it("renders AttachmentChip when fetch fails (404)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 404 });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("missing.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download missing\.jpg/i)).toBeTruthy();
-    });
-    // <img> must NOT appear when chip is shown.
-    expect(document.querySelector("img")).toBeNull();
-  });
-
-  it("renders chip on network error", async () => {
-    fetchMock.mockRejectedValue(new Error("network down"));
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("offline.png")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download offline\.png/i)).toBeTruthy();
-    });
-  });
-
-  // ── ready / <img> ───────────────────────────────────────────────────────
-
-  it("renders a button when ready (the image preview trigger)", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["fake-image-bytes"], { type: "image/jpeg" }),
-    });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("avatar.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open avatar.jpg preview"]`);
-      expect(btn).not.toBeNull();
-    });
-  });
-
-  it("ready button contains an <img> element with blob src", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "image/jpeg" }),
-    });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("thumb.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const img = document.querySelector(`button img`) as HTMLImageElement;
-      expect(img).not.toBeNull();
-      expect(img?.src).toBe("blob:image-test");
-    });
-  });
-
-  it("clicking the ready button opens the lightbox with the full <img>", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "image/jpeg" }),
-    });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("lightbox.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open lightbox\.jpg preview/i });
-    fireEvent.click(btn);
-    // Lightbox renders via portal; <img> inside lightbox should have the blob URL.
-    await waitFor(() => {
-      // The lightbox <img> has class "max-w-[95vw] max-h-[90vh] object-contain".
-      const lightboxImg = Array.from(document.querySelectorAll("img")).find(
-        (img) => img.className.includes("object-contain"),
-      );
-      expect(lightboxImg).not.toBeNull();
-      expect(lightboxImg?.src).toBe("blob:image-test");
-    });
-  });
-
-  // ── external URI (no-fetch path) ─────────────────────────────────────────
-
-  it("skips fetch and renders image directly for external URIs", async () => {
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={{ name: "cdn.jpg", uri: "https://example.com/photo.jpg" }}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    // No URL.revokeObjectURL call since we never minted a blob.
-    expect(URL.revokeObjectURL).not.toHaveBeenCalled();
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open cdn.jpg preview"]`);
-      expect(btn).not.toBeNull();
-    });
-  });
-
-  // ── tone styling ─────────────────────────────────────────────────────────
-
-  it("tone=user applies blue border class on ready-state button", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "image/jpeg" }),
-    });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("blue.jpg")}
-        onDownload={vi.fn()}
-        tone="user"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open blue\.jpg preview/i });
-    expect(btn.className).toContain("blue-400");
-  });
-
-  it("tone=agent does not apply blue border class", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "image/jpeg" }),
-    });
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("gray.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open gray\.jpg preview/i });
-    expect(btn.className).not.toContain("blue-400");
-  });
-
-  // ── download buttons ──────────────────────────────────────────────────────
-
-  it("onDownload is NOT called during loading or ready states", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "image/jpeg" }),
-    });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("quiet.jpg")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(
-        document.querySelector(`button[aria-label="Open quiet.jpg preview"]`),
-      ).not.toBeNull();
-    });
-    expect(onDownload).not.toHaveBeenCalled();
-  });
-
-  it("onDownload fires when chip fallback is rendered (error state)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 500 });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("fail.jpg")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download fail\.jpg/i)).toBeTruthy();
-    });
-    screen.getByTitle(/Download fail\.jpg/i).click();
-    expect(onDownload).toHaveBeenCalledWith(
-      expect.objectContaining({ name: "fail.jpg" }),
-    );
-  });
-
-  // ── cleanup ─────────────────────────────────────────────────────────────
-
-  it("no state update after unmount (cancelled flag prevents setState)", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: () =>
-        new Promise<Blob>((resolve) =>
-          setTimeout(() => resolve(new Blob(["delayed"])), 100),
-        ),
-    });
-    const { unmount } = render(
-      <AttachmentImage
-        workspaceId="ws-1"
-        attachment={makeAtt("cleanup.jpg")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await act(async () => {
-      unmount();
-    });
-    // No preview button visible after unmount.
-    expect(
-      document.querySelector(`button[aria-label="Open cleanup.jpg preview"]`),
-    ).toBeNull();
-    expect(
-      document.querySelector('[aria-label*="Download cleanup.jpg"]'),
-    ).toBeNull();
-  });
-});
@@ -1,191 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentLightbox — fullscreen modal for image/PDF/video previews.
- *
- * Coverage:
- *   - Does not render when open=false
- *   - Renders when open=true
- *   - Renders children inside dialog
- *   - Close button present and calls onClose
- *   - Escape key calls onClose
- *   - Backdrop click calls onClose
- *   - Content click does NOT call onClose
- *   - role=dialog and aria-modal=true
- *   - aria-label passed through correctly
- *   - Focus moves to close button on open
- *   - Focus is not restored to closed element after unmount
- *   - prefers-reduced-motion class applied
- *   - Renders with image child correctly
- *   - onClose is not called twice when Escape pressed twice rapidly
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { AttachmentLightbox } from "../AttachmentLightbox";
-
-const defaultProps = {
-  open: true,
-  onClose: vi.fn(),
-  ariaLabel: "Preview of report.png",
-  children: <img src="blob:test" alt="report" />,
-};
-
-function renderLightbox(props = {}) {
-  return render(<AttachmentLightbox {...defaultProps} {...props} />);
-}
-
-afterEach(() => {
-  cleanup();
-  defaultProps.onClose.mockClear();
-});
-
-describe("AttachmentLightbox — render", () => {
-  it("does not render when open=false", () => {
-    renderLightbox({ open: false });
-    expect(screen.queryByRole("dialog")).toBeFalsy();
-  });
-
-  it("renders when open=true", () => {
-    renderLightbox({ open: true });
-    expect(screen.getByRole("dialog")).toBeTruthy();
-  });
-
-  it("passes aria-label to dialog", () => {
-    renderLightbox({ ariaLabel: "Preview of document.pdf" });
-    expect(screen.getByRole("dialog").getAttribute("aria-label")).toBe(
-      "Preview of document.pdf",
-    );
-  });
-
-  it("has aria-modal='true' for WCAG 2.1 SC 1.3.2", () => {
-    renderLightbox();
-    expect(screen.getByRole("dialog").getAttribute("aria-modal")).toBe("true");
-  });
-
-  it("renders children inside the dialog", () => {
-    renderLightbox({ children: <img src="blob:test" alt="test" /> });
-    expect(screen.getByRole("dialog").querySelector("img")).toBeTruthy();
-  });
-
-  it("renders close button with aria-label", () => {
-    renderLightbox();
-    expect(screen.getByRole("button", { name: "Close preview" })).toBeTruthy();
-  });
-
-  it("applies reduced-motion class when prefers-reduced-motion is set", () => {
-    const utils = renderLightbox();
-    const dialog = screen.getByRole("dialog");
-    // The component applies motion-reduce:transition-none class
-    expect(dialog.className).toContain("motion-reduce");
-  });
-});
-
-describe("AttachmentLightbox — close interactions", () => {
-  it("calls onClose when close button is clicked", () => {
-    renderLightbox();
-    fireEvent.click(screen.getByRole("button", { name: "Close preview" }));
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onClose when Escape is pressed", () => {
-    renderLightbox();
-    fireEvent.keyDown(document, { key: "Escape" });
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onClose when backdrop is clicked", () => {
-    renderLightbox();
-    const dialog = screen.getByRole("dialog");
-    // The backdrop is the outer div (the dialog itself), content click has stopPropagation
-    fireEvent.click(dialog);
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("does NOT call onClose when content area is clicked", () => {
-    renderLightbox({ children: <img src="blob:test" alt="test" /> });
-    const dialog = screen.getByRole("dialog");
-    // The inner div has onClick stopPropagation — clicking it should not close
-    const innerDiv = dialog.querySelector(".max-w-\\[95vw\\]");
-    fireEvent.click(innerDiv!);
-    expect(defaultProps.onClose).not.toHaveBeenCalled();
-  });
-
-  it("Escape calls onClose even when focus is on close button", () => {
-    renderLightbox();
-    const closeBtn = screen.getByRole("button", { name: "Close preview" });
-    closeBtn.focus();
-    fireEvent.keyDown(document, { key: "Escape" });
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("close button click does not also trigger document-level Escape handler", () => {
-    renderLightbox();
-    const closeBtn = screen.getByRole("button", { name: "Close preview" });
-    // Clicking the button fires onClose; document Escape is a separate listener
-    // Both should work independently
-    fireEvent.keyDown(document, { key: "Escape" });
-    fireEvent.click(closeBtn);
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(2);
-  });
-});
-
-describe("AttachmentLightbox — focus management", () => {
-  it("close button is focusable after open", () => {
-    renderLightbox();
-    const closeBtn = screen.getByRole("button", { name: "Close preview" });
-    expect(closeBtn).toBe(document.activeElement);
-  });
-
-  it("Escape is listened on document (not just the modal)", () => {
-    renderLightbox();
-    // Focus on body — not on any dialog element
-    document.body.focus();
-    fireEvent.keyDown(document, { key: "Escape" });
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(1);
-  });
-
-  it("multiple Escape presses call onClose multiple times", () => {
-    renderLightbox();
-    fireEvent.keyDown(document, { key: "Escape" });
-    fireEvent.keyDown(document, { key: "Escape" });
-    // Each Escape press fires a separate event
-    expect(defaultProps.onClose).toHaveBeenCalledTimes(2);
-  });
-});
-
-describe("AttachmentLightbox — structural", () => {
-  it("close button is positioned top-right via CSS class", () => {
-    renderLightbox();
-    const closeBtn = screen.getByRole("button", { name: "Close preview" });
-    expect(closeBtn.className).toContain("top-4");
-    expect(closeBtn.className).toContain("right-4");
-  });
-
-  it("SVG icon is rendered inside close button", () => {
-    renderLightbox();
-    const closeBtn = screen.getByRole("button", { name: "Close preview" });
-    expect(closeBtn.querySelector("svg")).toBeTruthy();
-    // X mark path
-    const path = closeBtn.querySelector("path");
-    expect(path?.getAttribute("d")).toContain("M5 5");
-    expect(path?.getAttribute("d")).toContain("M19 5");
-  });
-
-  it("renders with video child", () => {
-    renderLightbox({
-      ariaLabel: "Preview of video.mp4",
-      children: (
-        <video>
-          <source src="blob:test-video" />
-        </video>
-      ),
-    });
-    expect(screen.getByRole("dialog")).toBeTruthy();
-    expect(screen.getByRole("dialog").querySelector("video")).toBeTruthy();
-  });
-
-  it("renders with no children (empty preview)", () => {
-    renderLightbox({ children: null, ariaLabel: "Empty preview" });
-    expect(screen.getByRole("dialog")).toBeTruthy();
-  });
-});
@@ -1,336 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentPDF — inline PDF preview using browser's native viewer.
- *
- * Per RFC #2991 PR-3. Loading skeleton pill, ready state renders a
- * clickable PDF pill that opens AttachmentLightbox with <embed>, chip error
- * fallback, external URI (no-fetch path), tone=user/agent styling, and
- * cleanup on unmount.
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { render, screen, cleanup, waitFor, act, fireEvent } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentPDF } from "../AttachmentPDF";
-import type { ChatAttachment } from "./types";
-
-afterEach(cleanup);
-
-// Stub env token so platformAuthHeaders() is callable without a real env.
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");
-
-const fetchMock = vi.fn();
-beforeEach(() => {
-  fetchMock.mockReset();
-  vi.stubGlobal("fetch", fetchMock);
-  global.URL.createObjectURL = vi.fn(() => "blob:pdf-test");
-  global.URL.revokeObjectURL = vi.fn();
-});
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeAtt(name = "doc.pdf"): ChatAttachment {
-  return { name, uri: "workspace:/workspace/tmp/" + name, mimeType: "application/pdf" };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("AttachmentPDF", () => {
-  // ── idle / loading skeleton ───────────────────────────────────────────────
-
-  it("renders loading skeleton pill (idle state) before fetch resolves", () => {
-    fetchMock.mockReturnValue(new Promise(() => {})); // hangs forever
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt()}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    // Pill must contain filename and "Loading …" text.
-    const pill = screen.getByLabelText(/Loading doc\.pdf/i);
-    expect(pill).toBeTruthy();
-    expect(pill.className).toContain("animate-pulse");
-  });
-
-  it("renders loading skeleton pill (loading state)", async () => {
-    fetchMock.mockReturnValue(new Promise<Response>(() => {})); // hangs forever
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("report.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByLabelText(/Loading report\.pdf/i)).toBeTruthy();
-    });
-  });
-
-  // ── error fallback ───────────────────────────────────────────────────────
-
-  it("renders AttachmentChip when fetch fails (404)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 404 });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("missing.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download missing\.pdf/i)).toBeTruthy();
-    });
-    // <embed> must NOT appear when chip is shown.
-    expect(document.querySelector("embed")).toBeNull();
-  });
-
-  it("renders chip on network error", async () => {
-    fetchMock.mockRejectedValue(new Error("network down"));
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("offline.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download offline\.pdf/i)).toBeTruthy();
-    });
-  });
-
-  // ── ready / PDF pill ─────────────────────────────────────────────────────
-
-  it("renders a button when ready (the PDF preview pill)", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["fake-pdf-bytes"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("readme.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open readme.pdf preview"]`);
-      expect(btn).not.toBeNull();
-    });
-  });
-
-  it("ready button contains the filename text", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("annual-report.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open annual-report.pdf preview"]`);
-      expect(btn?.textContent).toContain("annual-report.pdf");
-    });
-  });
-
-  it("ready button contains PDF badge", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("badge.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open badge.pdf preview"]`);
-      expect(btn?.textContent).toContain("PDF");
-    });
-  });
-
-  it("clicking the ready button opens the lightbox with <embed>", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("click.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open click\.pdf preview/i });
-    fireEvent.click(btn);
-    // Lightbox should now contain an <embed> with the blob URL.
-    await waitFor(() => {
-      const embed = document.querySelector("embed");
-      expect(embed).not.toBeNull();
-      expect(embed?.getAttribute("type")).toBe("application/pdf");
-    });
-  });
-
-  it("lightbox <embed> has correct aria-label", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("labeled.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open labeled\.pdf preview/i });
-    fireEvent.click(btn);
-    await waitFor(() => {
-      const embed = document.querySelector("embed");
-      expect(embed?.getAttribute("aria-label")).toBe("labeled.pdf");
-    });
-  });
-
-  // ── external URI (no-fetch path) ─────────────────────────────────────────
-
-  it("skips fetch and renders PDF pill directly for external URIs", async () => {
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={{ name: "cdn.pdf", uri: "https://example.com/doc.pdf" }}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    // No URL.revokeObjectURL call since we never minted a blob.
-    expect(URL.revokeObjectURL).not.toHaveBeenCalled();
-    await waitFor(() => {
-      const btn = document.querySelector(`button[aria-label="Open cdn.pdf preview"]`);
-      expect(btn).not.toBeNull();
-    });
-  });
-
-  // ── tone styling ─────────────────────────────────────────────────────────
-
-  it("tone=user applies blue accent class on ready-state button", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("blue.pdf")}
-        onDownload={vi.fn()}
-        tone="user"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open blue\.pdf preview/i });
-    expect(btn.className).toContain("blue-400");
-  });
-
-  it("tone=agent does not apply blue accent class", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("gray.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const btn = await screen.findByRole("button", { name: /open gray\.pdf preview/i });
-    expect(btn.className).not.toContain("blue-400");
-  });
-
-  // ── download buttons ──────────────────────────────────────────────────────
-
-  it("onDownload is NOT called during loading or ready states", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "application/pdf" }),
-    });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("quiet.pdf")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector(`button[aria-label="Open quiet.pdf preview"]`)).not.toBeNull();
-    });
-    expect(onDownload).not.toHaveBeenCalled();
-  });
-
-  it("onDownload fires when chip fallback is rendered (error state)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 500 });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("fail.pdf")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download fail\.pdf/i)).toBeTruthy();
-    });
-    screen.getByTitle(/Download fail\.pdf/i).click();
-    expect(onDownload).toHaveBeenCalledWith(
-      expect.objectContaining({ name: "fail.pdf" }),
-    );
-  });
-
-  // ── cleanup ─────────────────────────────────────────────────────────────
-
-  it("no state update after unmount (cancelled flag prevents setState)", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: () =>
-        new Promise<Blob>((resolve) =>
-          setTimeout(() => resolve(new Blob(["delayed"])), 100),
-        ),
-    });
-    const { unmount } = render(
-      <AttachmentPDF
-        workspaceId="ws-1"
-        attachment={makeAtt("cleanup.pdf")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await act(async () => {
-      unmount();
-    });
-    // No embed element visible after unmount.
-    expect(document.querySelector("embed")).toBeNull();
-    expect(
-      document.querySelector('[aria-label*="Download cleanup.pdf"]'),
-    ).toBeNull();
-  });
-});
@@ -1,299 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentTextPreview — inline <pre><code> text file renderer.
- *
- * Per RFC #2991 PR-3. Manages its own fetch cycle (idle → loading →
- * ready/error). Covers: loading skeleton, <pre><code> render, chip error
- * fallback, "Show all N lines" expand button, truncated state, download
- * buttons, tone=user/agent styling, cleanup on unmount.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { render, screen, fireEvent, cleanup, waitFor, act } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentTextPreview } from "../AttachmentTextPreview";
-import type { ChatAttachment } from "../types";
-
-// ─── Setup ────────────────────────────────────────────────────────────────────
-
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");
-
-const fetchMock = vi.fn();
-beforeEach(() => {
-  fetchMock.mockReset();
-  vi.stubGlobal("fetch", fetchMock);
-});
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── Fixtures ────────────────────────────────────────────────────────────────
-
-const makeAtt = (name = "log.txt"): ChatAttachment =>
-  ({ name, uri: "workspace:/workspace/tmp/" + name });
-
-function renderTextPreview(
-  att: ChatAttachment,
-  tone: "user" | "agent" = "agent",
-) {
-  return render(
-    <AttachmentTextPreview
-      workspaceId="ws-1"
-      attachment={att}
-      onDownload={vi.fn()}
-      tone={tone}
-    />,
-  );
-}
-
-// ─── Tests ───────────────────────────────────────────────────────────────────
-
-describe("AttachmentTextPreview", () => {
-  // ── idle / loading ───────────────────────────────────────────────────────
-
-  it("renders loading skeleton (idle state)", () => {
-    fetchMock.mockReturnValue(new Promise(() => {})); // hangs forever
-    renderTextPreview(makeAtt());
-    const skeleton = screen.getByLabelText(/Loading log\.txt/i);
-    expect(skeleton).toBeTruthy();
-    expect(skeleton.className).toContain("animate-pulse");
-  });
-
-  it("renders loading skeleton (loading state)", async () => {
-    // Never-resolving fetch → stays in loading state.
-    fetchMock.mockReturnValue(new Promise(() => {}));
-    renderTextPreview(makeAtt("data.json"));
-    await waitFor(() => {
-      expect(screen.getByLabelText(/Loading data\.json/i)).toBeTruthy();
-    });
-  });
-
-  // ── error fallback ───────────────────────────────────────────────────────
-
-  it("renders AttachmentChip when fetch fails (404)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 404 });
-    renderTextPreview(makeAtt("missing.txt"));
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download missing\.txt/i)).toBeTruthy();
-    });
-    // <pre> must NOT appear — proved we fell back to the chip.
-    expect(document.querySelector("pre")).toBeNull();
-  });
-
-  it("renders chip on network error", async () => {
-    fetchMock.mockRejectedValue(new Error("network down"));
-    renderTextPreview(makeAtt("offline.json"));
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download offline\.json/i)).toBeTruthy();
-    });
-  });
-
-  // ── ready / <pre><code> ──────────────────────────────────────────────────
-
-  it("renders <pre><code> with text content when fetch succeeds", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "line1\nline2\nline3",
-    });
-    renderTextPreview(makeAtt("report.txt"));
-    await waitFor(() => {
-      const code = document.querySelector("pre code");
-      expect(code).not.toBeNull();
-      expect(code?.textContent).toBe("line1\nline2\nline3");
-    });
-  });
-
-  it("renders filename header span", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "hello",
-    });
-    renderTextPreview(makeAtt("notes.md"));
-    await waitFor(() => {
-      expect(screen.getByText("notes.md")).toBeTruthy();
-    });
-  });
-
-  it("renders exactly one <pre> element when ready", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "content",
-    });
-    renderTextPreview(makeAtt("code.js"));
-    await waitFor(() => {
-      expect(document.querySelectorAll("pre")).toHaveLength(1);
-    });
-  });
-
-  // ── show all lines button ─────────────────────────────────────────────────
-
-  it("shows 'Show all N lines' button when file has >10 lines", async () => {
-    const body = Array.from({ length: 25 }, (_, i) => `line ${i + 1}`).join("\n");
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => body,
-    });
-    renderTextPreview(makeAtt("big.log"));
-    await waitFor(() => {
-      expect(
-        screen.getByRole("button", { name: /show all 25 lines/i }),
-      ).toBeTruthy();
-    });
-    // First 10 lines only in preview
-    const code = document.querySelector("pre code");
-    expect(code?.textContent).toContain("line 10");
-    expect(code?.textContent).not.toContain("line 11");
-  });
-
-  it("expand button is NOT shown when file has ≤10 lines", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "a\nb\nc",
-    });
-    renderTextPreview(makeAtt("short.txt"));
-    await waitFor(() => {
-      expect(document.querySelector("pre code")).not.toBeNull();
-    });
-    expect(screen.queryByRole("button", { name: /show all/i })).toBeNull();
-  });
-
-  it("clicking 'Show all' expands to full content", async () => {
-    const body = Array.from({ length: 25 }, (_, i) => `line ${i + 1}`).join("\n");
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => body,
-    });
-    renderTextPreview(makeAtt("expand.txt"));
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: /show all 25 lines/i })).toBeTruthy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: /show all 25 lines/i }));
-    const code = document.querySelector("pre code");
-    expect(code?.textContent).toContain("line 25");
-  });
-
-  // ── download buttons ──────────────────────────────────────────────────────
-
-  it("header download button fires onDownload with attachment", async () => {
-    const onDownload = vi.fn();
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "hello",
-    });
-    const { rerender } = render(
-      <AttachmentTextPreview
-        workspaceId="ws-1"
-        attachment={makeAtt("readme.md")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("pre code")).not.toBeNull();
-    });
-    const downloadBtn = screen.getByLabelText(/download readme\.md/i);
-    downloadBtn.click();
-    expect(onDownload).toHaveBeenCalledWith(
-      expect.objectContaining({ name: "readme.md" }),
-    );
-  });
-
-  it("onDownload is NOT called during loading or ready states", async () => {
-    const onDownload = vi.fn();
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "hello world",
-    });
-    render(
-      <AttachmentTextPreview
-        workspaceId="ws-1"
-        attachment={makeAtt("quiet.txt")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("pre code")).not.toBeNull();
-    });
-    expect(onDownload).not.toHaveBeenCalled();
-  });
-
-  // ── tone styling ─────────────────────────────────────────────────────────
-
-  it("tone=user applies blue border class on container", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "hello",
-    });
-    const { container } = render(
-      <AttachmentTextPreview
-        workspaceId="ws-1"
-        attachment={makeAtt("blue.txt")}
-        onDownload={vi.fn()}
-        tone="user"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("pre code")).not.toBeNull();
-    });
-    const blueDiv = Array.from(container.querySelectorAll("div")).find((d) =>
-      d.className.includes("blue-400"),
-    );
-    expect(blueDiv).toBeTruthy();
-  });
-
-  it("tone=agent does not apply blue border class", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: async () => "hello",
-    });
-    const { container } = render(
-      <AttachmentTextPreview
-        workspaceId="ws-1"
-        attachment={makeAtt("gray.txt")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("pre code")).not.toBeNull();
-    });
-    const blueDivs = Array.from(container.querySelectorAll("div")).filter((d) =>
-      d.className.includes("blue-400"),
-    );
-    expect(blueDivs).toHaveLength(0);
-  });
-
-  // ── cleanup ─────────────────────────────────────────────────────────────
-
-  it("no state update after unmount (cancelled flag prevents setState)", async () => {
-    // The component sets cancelled=true in cleanup, which prevents setState
-    // from firing after the pending read() resolves. We verify no crash
-    // and no error element appears (since the pending read eventually resolves
-    // but the component ignores it due to cancelled=true).
-    fetchMock.mockResolvedValue({
-      ok: true,
-      body: null,
-      text: () => new Promise<string>((resolve) => setTimeout(() => resolve("delayed"), 100)),
-    });
-    const { unmount } = renderTextPreview(makeAtt("cleanup.txt"));
-    await act(async () => {
-      unmount();
-    });
-    // No crash, no error state rendered (chip would appear on error)
-    expect(document.querySelector("pre code")).toBeNull();
-    expect(document.querySelector('[aria-label*="Download cleanup.txt"]')).toBeNull();
-  });
-});
@@ -1,308 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for AttachmentVideo — inline native HTML5 <video controls> player.
- *
- * Per RFC #2991 PR-2. Dispatches from AttachmentPreview so most paths
- * are pinned there. These tests cover AttachmentVideo as a standalone
- * renderer: loading skeleton, ready <video>, chip error fallback, external
- * URI (no-fetch path), tone=user vs tone=agent styling, and cleanup on
- * unmount.
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { render, screen, cleanup, waitFor, act } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentVideo } from "../AttachmentVideo";
-import type { ChatAttachment } from "./types";
-
-afterEach(cleanup);
-
-// Stub env token so platformAuthHeaders() is callable without a real env.
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");
-
-const fetchMock = vi.fn();
-beforeEach(() => {
-  fetchMock.mockReset();
-  vi.stubGlobal("fetch", fetchMock);
-  global.URL.createObjectURL = vi.fn(() => "blob:video-test");
-  global.URL.revokeObjectURL = vi.fn();
-});
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-function makeAtt(name = "clip.mp4"): ChatAttachment {
-  return { name, uri: "workspace:/workspace/tmp/" + name, mimeType: "video/mp4" };
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("AttachmentVideo", () => {
-  // ── idle / loading skeleton ───────────────────────────────────────────────
-
-  it("renders loading skeleton (idle state) before fetch resolves", () => {
-    fetchMock.mockReturnValue(new Promise(() => {})); // hangs forever
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt()}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    const skeleton = screen.getByLabelText(/Loading clip\.mp4/i);
-    expect(skeleton).toBeTruthy();
-    expect(skeleton.className).toContain("animate-pulse");
-  });
-
-  it("renders loading skeleton during loading state", async () => {
-    fetchMock.mockReturnValue(new Promise<Response>(() => {})); // hangs forever
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("movie.mov")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByLabelText(/Loading movie\.mov/i)).toBeTruthy();
-    });
-  });
-
-  // ── error fallback ───────────────────────────────────────────────────────
-
-  it("renders AttachmentChip when fetch fails (404)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 404 });
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("missing.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download missing\.mp4/i)).toBeTruthy();
-    });
-    // <video> must NOT appear when chip is shown.
-    expect(document.querySelector("video")).toBeNull();
-  });
-
-  it("renders chip on network error", async () => {
-    fetchMock.mockRejectedValue(new Error("network down"));
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("offline.webm")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download offline\.webm/i)).toBeTruthy();
-    });
-  });
-
-  // ── ready / <video> ─────────────────────────────────────────────────────
-
-  it("renders <video controls> when fetch succeeds", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["fake-video-bytes"], { type: "video/mp4" }),
-    });
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("podcast.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const video = document.querySelector("video");
-      expect(video).not.toBeNull();
-      expect(video?.hasAttribute("controls")).toBe(true);
-    });
-  });
-
-  it("video src is the blob URL minted from response", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["bytes"], { type: "video/mp4" }),
-    });
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("track.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const video = document.querySelector("video") as HTMLVideoElement;
-      expect(video?.src).toBe("blob:video-test");
-    });
-  });
-
-  it("video has playsInline attribute for mobile Safari", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "video/mp4" }),
-    });
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("mobile.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      const video = document.querySelector("video") as HTMLVideoElement;
-      expect(video?.getAttribute("playsinline")).toBe("");
-    });
-  });
-
-  // ── external URI (no-fetch path) ─────────────────────────────────────────
-
-  it("skips fetch and renders video directly for external URIs", async () => {
-    // External http/https URIs bypass the auth fetch and go straight to
-    // ready state with the resolved URL as src.
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={{ name: "cdn.mp4", uri: "https://example.com/video.mp4" }}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    // No skeleton — should skip directly to ready state.
-    // The URL.revokeObjectURL must NOT have been called since we never
-    // minted a blob URL.
-    expect(URL.revokeObjectURL).not.toHaveBeenCalled();
-    await waitFor(() => {
-      const video = document.querySelector("video");
-      expect(video).not.toBeNull();
-      expect(video?.getAttribute("controls")).toBe(""); // boolean-like attribute
-    });
-  });
-
-  // ── tone styling ─────────────────────────────────────────────────────────
-
-  it("tone=user applies blue border class on ready-state container", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "video/mp4" }),
-    });
-    const { container } = render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("blue.mp4")}
-        onDownload={vi.fn()}
-        tone="user"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("video")).not.toBeNull();
-    });
-    // The outer ready-state <div> must contain blue-400 class when tone=user.
-    const blueDivs = Array.from(container.querySelectorAll("div")).filter(
-      (d) => d.className.includes("blue-400"),
-    );
-    expect(blueDivs.length).toBeGreaterThan(0);
-  });
-
-  it("tone=agent does not apply blue border class", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "video/mp4" }),
-    });
-    const { container } = render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("gray.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(document.querySelector("video")).not.toBeNull();
-    });
-    const blueDivs = Array.from(container.querySelectorAll("div")).filter(
-      (d) => d.className.includes("blue-400"),
-    );
-    expect(blueDivs).toHaveLength(0);
-  });
-
-  // ── download buttons ──────────────────────────────────────────────────────
-
-  it("onDownload is NOT called during loading or ready states", async () => {
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: async () => new Blob(["data"], { type: "video/mp4" }),
-    });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("quiet.mp4")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    // Wait for ready state — onDownload must not have been called.
-    await waitFor(() => {
-      expect(document.querySelector("video")).not.toBeNull();
-    });
-    expect(onDownload).not.toHaveBeenCalled();
-  });
-
-  it("onDownload fires when chip fallback is rendered (error state)", async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 500 });
-    const onDownload = vi.fn();
-    render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("fail.mp4")}
-        onDownload={onDownload}
-        tone="agent"
-      />,
-    );
-    await waitFor(() => {
-      expect(screen.getByTitle(/Download fail\.mp4/i)).toBeTruthy();
-    });
-    // Click the chip's download button.
-    screen.getByTitle(/Download fail\.mp4/i).click();
-    expect(onDownload).toHaveBeenCalledWith(
-      expect.objectContaining({ name: "fail.mp4" }),
-    );
-  });
-
-  // ── cleanup ─────────────────────────────────────────────────────────────
-
-  it("no state update after unmount (cancelled flag prevents setState)", async () => {
-    // The component sets cancelled=true in cleanup, which prevents setState
-    // from firing after the pending read() resolves.
-    fetchMock.mockResolvedValue({
-      ok: true,
-      blob: () => new Promise<Blob>((resolve) => setTimeout(() => resolve(new Blob(["delayed"])), 100)),
-    });
-    const { unmount } = render(
-      <AttachmentVideo
-        workspaceId="ws-1"
-        attachment={makeAtt("cleanup.mp4")}
-        onDownload={vi.fn()}
-        tone="agent"
-      />,
-    );
-    await act(async () => {
-      unmount();
-    });
-    // No crash, no video element (component unmounted before ready)
-    expect(document.querySelector("video")).toBeNull();
-    expect(document.querySelector('[aria-label*="Download cleanup.mp4"]')).toBeNull();
-  });
-});
@@ -1,211 +0,0 @@
-// @vitest-environment jsdom
-/**
- * AttachmentViews — pure presentational components for chat attachments.
- *
- * Covers:
- *   - PendingAttachmentPill renders file name, formatted size, × button
- *   - PendingAttachmentPill × button has correct aria-label
- *   - PendingAttachmentPill calls onRemove when × clicked
- *   - PendingAttachmentPill renders exactly one button
- *   - AttachmentChip renders attachment name and download glyph
- *   - AttachmentChip renders size when provided
- *   - AttachmentChip omits size span when size is undefined
- *   - AttachmentChip calls onDownload(attachment) on click
- *   - AttachmentChip title attribute for hover tooltip
- *   - AttachmentChip tone=user applies blue accent classes
- *   - AttachmentChip tone=agent applies surface classes
- *   - AttachmentChip renders exactly one button
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute checks to avoid "expect is not defined" errors in this vitest
- * configuration.
- */
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
-import React from "react";
-
-import { AttachmentChip, PendingAttachmentPill } from "../AttachmentViews";
-import type { ChatAttachment } from "../types";
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── Helpers ────────────────────────────────────────────────────────────────────
-
-/** Create a File with actual content so size > 0 in jsdom. */
-function makeFile(name: string, content: string): File {
-  return new File([content], name, { type: "application/octet-stream" });
-}
-
-function makeAttachment(name: string, size?: number): ChatAttachment {
-  return { name, uri: `workspace:/tmp/${name}`, size };
-}
-
-// ─── PendingAttachmentPill ─────────────────────────────────────────────────────
-
-describe("PendingAttachmentPill", () => {
-  it("renders the file name", () => {
-    const file = makeFile("report.pdf", "PDF content here");
-    const { container } = render(
-      <PendingAttachmentPill file={file} onRemove={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("report.pdf");
-  });
-
-  it("renders the formatted file size (KB)", () => {
-    // 50 KB = 50 * 1024 bytes
-    const content = "x".repeat(50 * 1024);
-    const file = makeFile("data.csv", content);
-    const { container } = render(
-      <PendingAttachmentPill file={file} onRemove={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("50 KB");
-  });
-
-  it("renders 0 B for empty file", () => {
-    const file = makeFile("empty.txt", "");
-    const { container } = render(
-      <PendingAttachmentPill file={file} onRemove={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("0 B");
-  });
-
-  it("renders size in MB for files >= 1 MB", () => {
-    // 2.5 MB = 2.5 * 1024 * 1024 bytes
-    const content = "x".repeat(Math.round(2.5 * 1024 * 1024));
-    const file = makeFile("video.mp4", content);
-    const { container } = render(
-      <PendingAttachmentPill file={file} onRemove={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("2.5 MB");
-  });
-
-  it("× button has aria-label with file name", () => {
-    const file = makeFile("notes.txt", "some content");
-    render(<PendingAttachmentPill file={file} onRemove={vi.fn()} />);
-    const btn = screen.getByRole("button");
-    expect(btn.getAttribute("aria-label")).toBe("Remove notes.txt");
-  });
-
-  it("calls onRemove when × button is clicked", () => {
-    const file = makeFile("doc.pdf", "pdf data");
-    const onRemove = vi.fn();
-    render(<PendingAttachmentPill file={file} onRemove={onRemove} />);
-    screen.getByRole("button").click();
-    expect(onRemove).toHaveBeenCalledTimes(1);
-  });
-
-  it("renders exactly one button (the × remove button)", () => {
-    const file = makeFile("img.png", "image bytes");
-    const { container } = render(
-      <PendingAttachmentPill file={file} onRemove={vi.fn()} />,
-    );
-    expect(container.querySelectorAll("button")).toHaveLength(1);
-  });
-});
-
-// ─── AttachmentChip ───────────────────────────────────────────────────────────
-
-describe("AttachmentChip", () => {
-  it("renders the attachment name", () => {
-    const att = makeAttachment("chart.svg", 2048);
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="user" />,
-    );
-    expect(container.textContent).toContain("chart.svg");
-  });
-
-  it("renders size when provided", () => {
-    const att = makeAttachment("dump.sql", 1024 * 150); // 150 KB
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="user" />,
-    );
-    expect(container.textContent).toContain("150 KB");
-  });
-
-  it("omits size span when attachment.size is undefined", () => {
-    const att = makeAttachment("notes.md"); // no size
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="user" />,
-    );
-    // The only <span> should be the truncated filename; no size <span>
-    const spans = Array.from(container.querySelectorAll("span"));
-    const sizeSpans = spans.filter(
-      (s) => s.className && s.className.includes("tabular-nums"),
-    );
-    expect(sizeSpans).toHaveLength(0);
-  });
-
-  it("has title attribute with download hint", () => {
-    const att = makeAttachment("readme.txt", 64);
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="agent" />,
-    );
-    const btn = container.querySelector("button");
-    expect(btn?.getAttribute("title")).toBe("Download readme.txt");
-  });
-
-  it("calls onDownload with the attachment on click", () => {
-    const att = makeAttachment("export.csv", 8192);
-    const onDownload = vi.fn();
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={onDownload} tone="agent" />,
-    );
-    container.querySelector("button")!.click();
-    expect(onDownload).toHaveBeenCalledWith(att);
-  });
-
-  it("tone=user applies blue accent class", () => {
-    const att = makeAttachment("photo.jpg", 512);
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="user" />,
-    );
-    const btn = container.querySelector("button")!;
-    expect(btn.className).toContain("blue-400");
-  });
-
-  it("tone=agent does not apply blue accent class", () => {
-    const att = makeAttachment("photo.jpg", 512);
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="agent" />,
-    );
-    const btn = container.querySelector("button")!;
-    expect(btn.className).not.toContain("blue-400");
-  });
-
-  it("renders exactly one button", () => {
-    const att = makeAttachment("icon.svg", 128);
-    const { container } = render(
-      <AttachmentChip attachment={att} onDownload={vi.fn()} tone="user" />,
-    );
-    expect(container.querySelectorAll("button")).toHaveLength(1);
-  });
-
-  it("tone=user applies blue-400 accent class", () => {
-    const attachment = makeAttachment("file.pdf", 512);
-    render(
-      <AttachmentChip
-        attachment={attachment}
-        onDownload={vi.fn()}
-        tone="user"
-      />
-    );
-    const btn = screen.getByRole("button");
-    expect(btn.className).toMatch(/blue-400/);
-  });
-
-  it("tone=agent omits blue-400 accent class", () => {
-    const attachment = makeAttachment("file.pdf", 512);
-    render(
-      <AttachmentChip
-        attachment={attachment}
-        onDownload={vi.fn()}
-        tone="agent"
-      />
-    );
-    const btn = screen.getByRole("button");
-    expect(btn.className).not.toMatch(/blue-400/);
-  });
-});
@@ -1,208 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for uploads.ts utility functions.
- *
- * Tests the two public pure functions:
- *   resolveAttachmentHref(workspaceId, uri) → string
- *   isPlatformAttachment(uri) → boolean
- *
- * These are tested without mocking — they're pure string manipulation.
- * The async functions (uploadChatFiles, downloadChatFile) are NOT tested
- * here since they make real fetch/URL calls requiring jsdom network mocks.
- */
-import { describe, expect, it } from "vitest";
-import {
-  resolveAttachmentHref,
-  isPlatformAttachment,
-} from "../uploads";
-
-// We need PLATFORM_URL for constructing expected values.
-// Import it from the api module (it's exported there).
-import { PLATFORM_URL } from "@/lib/api";
-
-const WS = "ws-test-123";
-
-function platformUrl(...parts: string[]) {
-  return [PLATFORM_URL, ...parts].join("/");
-}
-
-// ─── resolveAttachmentHref ─────────────────────────────────────────────────────
-
-describe("resolveAttachmentHref — platform-pending URIs", () => {
-  it("resolves platform-pending URI to pending-uploads content URL", () => {
-    const result = resolveAttachmentHref(WS, "platform-pending:ws-test-123/file-abc");
-    expect(result).toBe(platformUrl("workspaces", "ws-test-123", "pending-uploads", "file-abc", "content"));
-  });
-
-  it("uses the URI's own workspace ID (not the chat's)", () => {
-    // URI has ws-A but chat is in ws-B — resolve to URI's workspace.
-    const result = resolveAttachmentHref("ws-B", "platform-pending:ws-A/file-xyz");
-    expect(result).toBe(platformUrl("workspaces", "ws-A", "pending-uploads", "file-xyz", "content"));
-  });
-
-  it("returns raw URI when platform-pending lacks a slash (no wsid/fileid)", () => {
-    const result = resolveAttachmentHref(WS, "platform-pending:no-slash-here");
-    expect(result).toBe("platform-pending:no-slash-here");
-  });
-
-  it("returns raw URI when platform-pending has empty wsid", () => {
-    const result = resolveAttachmentHref(WS, "platform-pending:/file-only");
-    expect(result).toBe("platform-pending:/file-only");
-  });
-});
-
-describe("resolveAttachmentHref — workspace: URIs", () => {
-  it("resolves /workspace/path to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "workspace:/workspace/myfile.txt");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fworkspace%2Fmyfile.txt"
-    );
-  });
-
-  it("resolves /configs/path to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "workspace:/configs/app.conf");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fconfigs%2Fapp.conf"
-    );
-  });
-
-  it("resolves /home/path to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "workspace:/home/user/setup.sh");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fhome%2Fuser%2Fsetup.sh"
-    );
-  });
-
-  it("resolves /plugins/path to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "workspace:/plugins/my-plugin/index.js");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fplugins%2Fmy-plugin%2Findex.js"
-    );
-  });
-
-  it("passes through workspace: with disallowed root", () => {
-    const result = resolveAttachmentHref(WS, "workspace:/var/log/app.log");
-    expect(result).toBe("workspace:/var/log/app.log");
-  });
-});
-
-describe("resolveAttachmentHref — file:/// URIs", () => {
-  it("resolves file:///workspace/... to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "file:///workspace/report.pdf");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fworkspace%2Freport.pdf"
-    );
-  });
-
-  it("resolves file:///configs/... to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "file:///configs/secrets.env");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fconfigs%2Fsecrets.env"
-    );
-  });
-
-  it("passes through file:/// with disallowed root", () => {
-    const result = resolveAttachmentHref(WS, "file:///etc/passwd");
-    expect(result).toBe("file:///etc/passwd");
-  });
-});
-
-describe("resolveAttachmentHref — bare absolute path URIs", () => {
-  it("resolves /workspace/... to chat download URL", () => {
-    const result = resolveAttachmentHref(WS, "/workspace/upload.png");
-    expect(result).toBe(
-      platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fworkspace%2Fupload.png"
-    );
-  });
-
-  it("passes through / with disallowed root", () => {
-    const result = resolveAttachmentHref(WS, "/tmp/cache.bin");
-    expect(result).toBe("/tmp/cache.bin");
-  });
-
-  it("passes through root /workspace (exact match only)", () => {
-    const result = resolveAttachmentHref(WS, "/workspace");
-    expect(result).toBe(platformUrl("workspaces", WS, "chat", "download") + "?path=%2Fworkspace");
-  });
-});
-
-describe("resolveAttachmentHref — external URIs", () => {
-  it("passes through https:// URIs unchanged", () => {
-    const result = resolveAttachmentHref(WS, "https://example.com/artefact.tar.gz");
-    expect(result).toBe("https://example.com/artefact.tar.gz");
-  });
-
-  it("passes through http:// URIs unchanged", () => {
-    const result = resolveAttachmentHref(WS, "http://cdn.example.com/image.png");
-    expect(result).toBe("http://cdn.example.com/image.png");
-  });
-
-  it("passes through unknown scheme unchanged", () => {
-    const result = resolveAttachmentHref(WS, "s3://my-bucket/file.json");
-    expect(result).toBe("s3://my-bucket/file.json");
-  });
-});
-
-// ─── isPlatformAttachment ──────────────────────────────────────────────────────
-
-describe("isPlatformAttachment", () => {
-  it("returns true for platform-pending URIs", () => {
-    expect(isPlatformAttachment("platform-pending:ws-A/file-1")).toBe(true);
-  });
-
-  it("returns true for workspace: URIs with allowed roots", () => {
-    expect(isPlatformAttachment("workspace:/workspace/file.txt")).toBe(true);
-    expect(isPlatformAttachment("workspace:/configs/app.conf")).toBe(true);
-    expect(isPlatformAttachment("workspace:/home/user/script.sh")).toBe(true);
-    expect(isPlatformAttachment("workspace:/plugins/my/ext.js")).toBe(true);
-  });
-
-  it("returns false for workspace: URIs with disallowed roots", () => {
-    expect(isPlatformAttachment("workspace:/var/data.json")).toBe(false);
-    expect(isPlatformAttachment("workspace:/usr/local/bin")).toBe(false);
-    expect(isPlatformAttachment("workspace:/tmp/cache")).toBe(false);
-  });
-
-  it("returns true for file:/// URIs with allowed roots", () => {
-    expect(isPlatformAttachment("file:///workspace/image.png")).toBe(true);
-    expect(isPlatformAttachment("file:///configs/app.conf")).toBe(true);
-    expect(isPlatformAttachment("file:///home/user/file.txt")).toBe(true);
-    expect(isPlatformAttachment("file:///plugins/ext.js")).toBe(true);
-  });
-
-  it("returns false for file:/// URIs with disallowed roots", () => {
-    expect(isPlatformAttachment("file:///etc/passwd")).toBe(false);
-    expect(isPlatformAttachment("file:///var/log")).toBe(false);
-  });
-
-  it("returns true for bare absolute paths with allowed roots", () => {
-    expect(isPlatformAttachment("/workspace/file.txt")).toBe(true);
-    expect(isPlatformAttachment("/configs/app.conf")).toBe(true);
-    expect(isPlatformAttachment("/home/user/file.txt")).toBe(true);
-    expect(isPlatformAttachment("/plugins/ext.js")).toBe(true);
-  });
-
-  it("returns false for bare absolute paths with disallowed roots", () => {
-    expect(isPlatformAttachment("/var/data.json")).toBe(false);
-    expect(isPlatformAttachment("/usr/local/bin")).toBe(false);
-    expect(isPlatformAttachment("/tmp/cache")).toBe(false);
-    expect(isPlatformAttachment("/")).toBe(false);
-  });
-
-  it("returns false for https:// URIs (external)", () => {
-    expect(isPlatformAttachment("https://example.com/file.txt")).toBe(false);
-  });
-
-  it("returns false for http:// URIs (external)", () => {
-    expect(isPlatformAttachment("http://example.com/file.txt")).toBe(false);
-  });
-
-  it("returns false for unknown schemes", () => {
-    expect(isPlatformAttachment("s3://bucket/file")).toBe(false);
-    expect(isPlatformAttachment("data:text/plain;base64,SGVsbG8=")).toBe(false);
-  });
-
-  it("returns false for empty string", () => {
-    expect(isPlatformAttachment("")).toBe(false);
-  });
-});
@@ -1,294 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for form-inputs — shared form components for the Config tab.
- *
- * TextInput coverage:
- *   - Renders label and input
- *   - aria-label matches label text
- *   - onChange called with new value
- *   - placeholder text rendered
- *   - mono class applied when mono=true
- *
- * NumberInput coverage:
- *   - Renders label and number input
- *   - aria-label matches label text
- *   - onChange called with parsed integer
- *   - min/max attributes applied
- *   - Parses empty input as 0
- *
- * Toggle coverage:
- *   - Renders checkbox with label
- *   - Checkbox checked state reflects checked prop
- *   - onChange called with boolean
- *
- * TagList coverage:
- *   - Renders existing tags with remove button
- *   - Remove button has aria-label with tag name
- *   - Remove button calls onChange without that tag
- *   - Enter key with non-empty input adds tag and clears input
- *   - Enter with empty input does not add tag
- *   - Placeholder text rendered
- *
- * Section coverage:
- *   - defaultOpen=true renders children on mount
- *   - defaultOpen=false hides children on mount
- *   - Clicking header toggles children visibility
- *   - Toggle icon changes between ▾ and ▸
- *   - Header has accessible button
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-  TextInput,
-  NumberInput,
-  Toggle,
-  TagList,
-  Section,
-} from "../form-inputs";
-
-afterEach(cleanup);
-
-// ─── TextInput ─────────────────────────────────────────────────────────────────
-
-describe("TextInput", () => {
-  it("renders label and input", () => {
-    render(<TextInput label="Agent Name" value="" onChange={vi.fn()} />);
-    expect(screen.getByLabelText("Agent Name")).toBeTruthy();
-  });
-
-  it("displays the current value", () => {
-    render(<TextInput label="Model" value="claude-sonnet" onChange={vi.fn()} />);
-    expect((screen.getByLabelText("Model") as HTMLInputElement).value).toBe("claude-sonnet");
-  });
-
-  it("calls onChange when user types", () => {
-    const onChange = vi.fn();
-    render(<TextInput label="Description" value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Description"), { target: { value: "Hello" } });
-    expect(onChange).toHaveBeenCalledWith("Hello");
-  });
-
-  it("renders placeholder text", () => {
-    render(
-      <TextInput label="Name" value="" onChange={vi.fn()} placeholder="Enter name..." />
-    );
-    expect((screen.getByPlaceholderText("Enter name...") as HTMLInputElement).value).toBe("");
-  });
-
-  it("applies mono font class when mono=true", () => {
-    render(<TextInput label="Token" value="" onChange={vi.fn()} mono />);
-    const input = screen.getByLabelText("Token");
-    expect(input.classList.contains("font-mono")).toBe(true);
-  });
-
-  it("does not apply mono class when mono=false", () => {
-    render(<TextInput label="Name" value="" onChange={vi.fn()} mono={false} />);
-    const input = screen.getByLabelText("Name");
-    expect(input.classList.contains("font-mono")).toBe(false);
-  });
-});
-
-// ─── NumberInput ────────────────────────────────────────────────────────────────
-
-describe("NumberInput", () => {
-  it("renders label and input", () => {
-    render(<NumberInput label="Timeout" value={30} onChange={vi.fn()} />);
-    expect(screen.getByLabelText("Timeout")).toBeTruthy();
-  });
-
-  it("displays the current value", () => {
-    render(<NumberInput label="Retries" value={5} onChange={vi.fn()} />);
-    expect((screen.getByLabelText("Retries") as HTMLInputElement).value).toBe("5");
-  });
-
-  it("calls onChange with parsed integer", () => {
-    const onChange = vi.fn();
-    render(<NumberInput label="Port" value={8000} onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Port"), { target: { value: "9000" } });
-    expect(onChange).toHaveBeenCalledWith(9000);
-  });
-
-  it("parses empty input as 0", () => {
-    const onChange = vi.fn();
-    render(<NumberInput label="Count" value={5} onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Count"), { target: { value: "" } });
-    expect(onChange).toHaveBeenCalledWith(0);
-  });
-
-  it("applies min attribute", () => {
-    render(<NumberInput label="Memory" value={256} onChange={vi.fn()} min={64} />);
-    expect(screen.getByLabelText("Memory").getAttribute("min")).toBe("64");
-  });
-
-  it("applies max attribute", () => {
-    render(<NumberInput label="Memory" value={256} onChange={vi.fn()} max={4096} />);
-    expect(screen.getByLabelText("Memory").getAttribute("max")).toBe("4096");
-  });
-});
-
-// ─── Toggle ────────────────────────────────────────────────────────────────────
-
-describe("Toggle", () => {
-  it("renders checkbox with label", () => {
-    render(<Toggle label="Enable streaming" checked={false} onChange={vi.fn()} />);
-    const checkbox = screen.getByRole("checkbox");
-    expect(checkbox).toBeTruthy();
-    expect(screen.getByText("Enable streaming")).toBeTruthy();
-  });
-
-  it("checkbox is checked when checked=true", () => {
-    render(<Toggle label="Auto-restart" checked={true} onChange={vi.fn()} />);
-    expect((screen.getByRole("checkbox") as HTMLInputElement).checked).toBe(true);
-  });
-
-  it("checkbox is unchecked when checked=false", () => {
-    render(<Toggle label="Auto-restart" checked={false} onChange={vi.fn()} />);
-    expect((screen.getByRole("checkbox") as HTMLInputElement).checked).toBe(false);
-  });
-
-  it("calls onChange with boolean on click", () => {
-    const onChange = vi.fn();
-    render(<Toggle label="Push notifications" checked={false} onChange={onChange} />);
-    fireEvent.click(screen.getByRole("checkbox"));
-    expect(onChange).toHaveBeenCalledWith(true);
-  });
-
-  it("calls onChange with false when toggled off", () => {
-    const onChange = vi.fn();
-    render(<Toggle label="Push notifications" checked={true} onChange={onChange} />);
-    fireEvent.click(screen.getByRole("checkbox"));
-    expect(onChange).toHaveBeenCalledWith(false);
-  });
-});
-
-// ─── TagList ───────────────────────────────────────────────────────────────────
-
-describe("TagList", () => {
-  it("renders existing tags", () => {
-    render(
-      <TagList label="Skills" values={["coding", "research"]} onChange={vi.fn()} />
-    );
-    expect(screen.getByText("coding")).toBeTruthy();
-    expect(screen.getByText("research")).toBeTruthy();
-  });
-
-  it("renders remove button with aria-label for each tag", () => {
-    render(
-      <TagList label="Tools" values={["bash", "grep"]} onChange={vi.fn()} />
-    );
-    expect(screen.getByRole("button", { name: /remove tag bash/i })).toBeTruthy();
-    expect(screen.getByRole("button", { name: /remove tag grep/i })).toBeTruthy();
-  });
-
-  it("clicking remove button calls onChange without that tag", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Tools" values={["bash", "grep"]} onChange={onChange} />
-    );
-    fireEvent.click(screen.getByRole("button", { name: /remove tag bash/i }));
-    expect(onChange).toHaveBeenCalledWith(["grep"]);
-  });
-
-  it("Enter key with non-empty input adds tag and clears input", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Skills" values={[]} onChange={onChange} />
-    );
-    const input = screen.getByLabelText("Skills");
-    fireEvent.change(input, { target: { value: "analysis" } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).toHaveBeenCalledWith(["analysis"]);
-    expect((input as HTMLInputElement).value).toBe("");
-  });
-
-  it("Enter key with empty input does not add tag", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Skills" values={[]} onChange={onChange} />
-    );
-    const input = screen.getByLabelText("Skills");
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).not.toHaveBeenCalled();
-  });
-
-  it("Enter key with whitespace-only input does not add tag", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Skills" values={[]} onChange={onChange} />
-    );
-    const input = screen.getByLabelText("Skills");
-    fireEvent.change(input, { target: { value: "   " } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).not.toHaveBeenCalled();
-  });
-
-  it("renders placeholder text", () => {
-    render(
-      <TagList label="Tags" values={[]} onChange={vi.fn()} placeholder="Add a tag..." />
-    );
-    expect(screen.getByPlaceholderText("Add a tag...")).toBeTruthy();
-  });
-
-  it("trims whitespace when adding tag", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Tags" values={[]} onChange={onChange} />
-    );
-    const input = screen.getByLabelText("Tags");
-    fireEvent.change(input, { target: { value: "  python  " } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).toHaveBeenCalledWith(["python"]);
-  });
-});
-
-// ─── Section ───────────────────────────────────────────────────────────────────
-
-describe("Section", () => {
-  it("renders title", () => {
-    render(<Section title="A2A Settings">Content here</Section>);
-    expect(screen.getByText("A2A Settings")).toBeTruthy();
-  });
-
-  it("renders children when defaultOpen=true (default)", () => {
-    render(<Section title="A2A Settings">The content</Section>);
-    expect(screen.getByText("The content")).toBeTruthy();
-  });
-
-  it("hides children when defaultOpen=false", () => {
-    render(<Section title="Danger Zone" defaultOpen={false}>Hidden</Section>);
-    expect(screen.queryByText("Hidden")).toBeFalsy();
-  });
-
-  it("clicking header toggles children visibility", () => {
-    render(<Section title="Delegation">Visible</Section>);
-    expect(screen.getByText("Visible")).toBeTruthy();
-    fireEvent.click(screen.getByRole("button", { name: /delegation/i }));
-    expect(screen.queryByText("Visible")).toBeFalsy();
-  });
-
-  it("clicking header again re-shows children", () => {
-    render(<Section title="Delegation">Visible</Section>);
-    const btn = screen.getByRole("button", { name: /delegation/i });
-    fireEvent.click(btn); // close
-    expect(screen.queryByText("Visible")).toBeFalsy();
-    fireEvent.click(btn); // re-open
-    expect(screen.getByText("Visible")).toBeTruthy();
-  });
-
-  it("toggle icon shows ▾ when open", () => {
-    render(<Section title="General">Open</Section>);
-    expect(screen.getByText("▾")).toBeTruthy();
-  });
-
-  it("toggle icon shows ▸ when closed", () => {
-    render(<Section title="General" defaultOpen={false}>Closed</Section>);
-    expect(screen.getByText("▸")).toBeTruthy();
-  });
-
-  it("header button has accessible label via title text", () => {
-    render(<Section title="Runtime Config">Content</Section>);
-    const btn = screen.getByRole("button");
-    expect(btn.textContent).toContain("Runtime Config");
-  });
-});
@@ -1,142 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for KeyValueField component.
- *
- * Covers: initial password type, onChange callback (including whitespace trim
- * on type), aria-label forwarding, disabled state, and auto-hide timer setup.
- */
-import React from "react";
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
-import { KeyValueField } from "../KeyValueField";
-
-describe("KeyValueField — rendering", () => {
-  afterEach(cleanup);
-
-  it("renders input with type=password by default (secret hidden)", () => {
-    render(<KeyValueField value="" onChange={vi.fn()} />);
-    const input = screen.getByLabelText("Secret value");
-    expect(input.getAttribute("type")).toBe("password");
-  });
-
-  it("passes custom aria-label to the input element", () => {
-    render(<KeyValueField value="" onChange={vi.fn()} aria-label="API secret key" />);
-    expect(screen.getByLabelText("API secret key")).toBeTruthy();
-  });
-
-  it("disables the input when disabled=true", () => {
-    render(<KeyValueField value="secret" onChange={vi.fn()} disabled />);
-    expect(screen.getByLabelText("Secret value").disabled).toBe(true);
-  });
-
-  it("renders with the current value", () => {
-    render(<KeyValueField value="sk-test-key-123" onChange={vi.fn()} />);
-    expect(screen.getByLabelText("Secret value").value).toBe("sk-test-key-123");
-  });
-
-  it("renders with the placeholder text", () => {
-    render(<KeyValueField value="" onChange={vi.fn()} placeholder="Enter API key" />);
-    expect(screen.getByLabelText("Secret value").getAttribute("placeholder")).toBe("Enter API key");
-  });
-
-  it("renders the RevealToggle child button", () => {
-    render(<KeyValueField value="secret" onChange={vi.fn()} />);
-    // KeyValueField renders exactly one button (the RevealToggle)
-    expect(screen.getByRole("button")).toBeTruthy();
-  });
-});
-
-describe("KeyValueField — onChange", () => {
-  afterEach(cleanup);
-
-  it("calls onChange with the new value when user types", () => {
-    const onChange = vi.fn();
-    render(<KeyValueField value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Secret value"), { target: { value: "new-value" } });
-    expect(onChange).toHaveBeenCalledWith("new-value");
-  });
-
-  it("trims leading whitespace when user types with leading space", () => {
-    const onChange = vi.fn();
-    render(<KeyValueField value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Secret value"), { target: { value: "  trimmed" } });
-    expect(onChange).toHaveBeenCalledWith("trimmed");
-  });
-
-  it("trims trailing whitespace when user types with trailing space", () => {
-    const onChange = vi.fn();
-    render(<KeyValueField value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Secret value"), { target: { value: "trimmed  " } });
-    expect(onChange).toHaveBeenCalledWith("trimmed");
-  });
-
-  it("trims both sides when user types whitespace-surrounded value", () => {
-    const onChange = vi.fn();
-    render(<KeyValueField value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Secret value"), { target: { value: "  both sides  " } });
-    expect(onChange).toHaveBeenCalledWith("both sides");
-  });
-
-  it("does not modify value with no whitespace", () => {
-    const onChange = vi.fn();
-    render(<KeyValueField value="" onChange={onChange} />);
-    fireEvent.change(screen.getByLabelText("Secret value"), { target: { value: "clean-value" } });
-    expect(onChange).toHaveBeenCalledWith("clean-value");
-  });
-});
-
-describe("KeyValueField — auto-hide timer setup", () => {
-  beforeEach(() => {
-    vi.useFakeTimers();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-  });
-
-  it("sets up a 30s setTimeout when the component mounts with a non-empty value", () => {
-    const setTimeoutSpy = vi.spyOn(global, "setTimeout");
-    render(<KeyValueField value="secret" onChange={vi.fn()} />);
-    // No timer should be set initially (revealed=false by default)
-    const callsBeforeInteraction = setTimeoutSpy.mock.calls.length;
-
-    // Simulate reveal (click the only button)
-    act(() => { fireEvent.click(screen.getByRole("button")); });
-
-    // After reveal, a 30s timer should be set
-    const timerCalls = setTimeoutSpy.mock.calls.filter(
-      ([, delay]) => delay === 30_000,
-    );
-    expect(timerCalls.length).toBeGreaterThanOrEqual(1);
-  });
-
-  it("clears existing timer when a new toggle happens before auto-hide fires", () => {
-    const clearTimeoutSpy = vi.spyOn(global, "clearTimeout");
-    const timerObj = {}; // fake timer ID
-    vi.spyOn(global, "setTimeout").mockImplementation((fn: () => void, delay: number) => {
-      return timerObj;
-    });
-    render(<KeyValueField value="secret" onChange={vi.fn()} />);
-
-    // First toggle — reveal
-    act(() => { fireEvent.click(screen.getByRole("button")); });
-
-    // Second toggle — hide (should clear the timer from first toggle)
-    act(() => { fireEvent.click(screen.getByRole("button")); });
-
-    // clearTimeout was called with the timer object
-    expect(clearTimeoutSpy).toHaveBeenCalledWith(timerObj);
-  });
-
-  it("clears timer on unmount", () => {
-    const clearTimeoutSpy = vi.spyOn(global, "clearTimeout");
-    const { unmount } = render(<KeyValueField value="secret" onChange={vi.fn()} />);
-
-    // Toggle reveal to start the timer
-    act(() => { fireEvent.click(screen.getByRole("button")); });
-
-    unmount();
-    expect(clearTimeoutSpy).toHaveBeenCalled();
-  });
-});
@@ -1,68 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for RevealToggle component.
- *
- * Covers: eye-icon (hidden) vs eye-off-icon (revealed), onToggle callback,
- * aria-label (default + custom), title attribute.
- */
-import { afterEach, describe, it, expect, vi } from "vitest";
-import { render, screen, fireEvent, cleanup } from "@testing-library/react";
-import { RevealToggle } from "../RevealToggle";
-
-afterEach(cleanup);
-
-describe("RevealToggle", () => {
-  it("renders as a button", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    expect(screen.getByRole("button")).toBeTruthy();
-  });
-
-  it("uses default aria-label when not provided", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    expect(screen.getByRole("button").getAttribute("aria-label")).toBe("Toggle reveal secret");
-  });
-
-  it("uses custom aria-label when provided", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} label="Show password" />);
-    expect(screen.getByRole("button").getAttribute("aria-label")).toBe("Show password");
-  });
-
-  it('title is "Hide value" when revealed', () => {
-    render(<RevealToggle revealed={true} onToggle={vi.fn()} />);
-    expect(screen.getByRole("button").getAttribute("title")).toBe("Hide value");
-  });
-
-  it('title is "Show value" when hidden', () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    expect(screen.getByRole("button").getAttribute("title")).toBe("Show value");
-  });
-
-  it("calls onToggle when clicked (revealed=true → should hide)", () => {
-    const onToggle = vi.fn();
-    render(<RevealToggle revealed={true} onToggle={onToggle} />);
-    fireEvent.click(screen.getByRole("button"));
-    expect(onToggle).toHaveBeenCalledTimes(1);
-  });
-
-  it("calls onToggle when clicked (revealed=false → should show)", () => {
-    const onToggle = vi.fn();
-    render(<RevealToggle revealed={false} onToggle={onToggle} />);
-    fireEvent.click(screen.getByRole("button"));
-    expect(onToggle).toHaveBeenCalledTimes(1);
-  });
-
-  it("renders the eye-open SVG (hide icon) when revealed=false", () => {
-    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
-    const btn = screen.getByRole("button");
-    // The eye SVG contains a circle element; eye-off has a strikethrough line
-    expect(btn.querySelector("circle")).toBeTruthy();
-    expect(btn.querySelectorAll("line")).toHaveLength(0);
-  });
-
-  it("renders the eye-off SVG (show icon) when revealed=true", () => {
-    render(<RevealToggle revealed={true} onToggle={vi.fn()} />);
-    const btn = screen.getByRole("button");
-    // EyeOffIcon has a line (strikethrough) through the eye
-    expect(btn.querySelectorAll("line")).toHaveLength(1);
-  });
-});
@@ -1,88 +0,0 @@
-// @vitest-environment jsdom
-/**
- * StatusBadge — secret key connection status indicator.
- *
- * Per spec §4: always icon + color (never colour-only) for colour-blind users.
- * Covers: verified / invalid / unverified render branches, icon, aria-label, className.
- */
-import { afterEach, describe, expect, it } from "vitest";
-import { render } from "@testing-library/react";
-import React from "react";
-
-import { StatusBadge } from "../StatusBadge";
-
-afterEach(() => {
-  // Prevent DOM accumulation across tests (maxWorkers=1 means all test
-  // files share the same jsdom worker).
-  const { cleanup } = require("@testing-library/react");
-  cleanup();
-});
-
-function getBadge(status: "verified" | "invalid" | "unverified") {
-  const { container } = render(<StatusBadge status={status} />);
-  return container.querySelector("[role=status]") as HTMLElement;
-}
-
-describe("StatusBadge — icon", () => {
-  it("renders ✓ for verified", () => {
-    expect(getBadge("verified").textContent).toBe("✓");
-  });
-
-  it("renders ✗ for invalid", () => {
-    expect(getBadge("invalid").textContent).toBe("✗");
-  });
-
-  it("renders ○ for unverified", () => {
-    expect(getBadge("unverified").textContent).toBe("○");
-  });
-});
-
-describe("StatusBadge — aria-label", () => {
-  it("sets 'Connection status: verified' for verified", () => {
-    expect(getBadge("verified").getAttribute("aria-label")).toBe(
-      "Connection status: verified",
-    );
-  });
-
-  it("sets 'Connection status: invalid' for invalid", () => {
-    expect(getBadge("invalid").getAttribute("aria-label")).toBe(
-      "Connection status: invalid",
-    );
-  });
-
-  it("sets 'Connection status: unverified' for unverified", () => {
-    expect(getBadge("unverified").getAttribute("aria-label")).toBe(
-      "Connection status: unverified",
-    );
-  });
-});
-
-describe("StatusBadge — className", () => {
-  it("applies status-badge--valid for verified", () => {
-    expect(getBadge("verified").className).toContain("status-badge--valid");
-  });
-
-  it("applies status-badge--invalid for invalid", () => {
-    expect(getBadge("invalid").className).toContain("status-badge--invalid");
-  });
-
-  it("applies status-badge--unverified for unverified", () => {
-    expect(getBadge("unverified").className).toContain(
-      "status-badge--unverified",
-    );
-  });
-});
-
-describe("StatusBadge — role", () => {
-  it("sets role=status", () => {
-    const el = getBadge("verified");
-    expect(el.getAttribute("role")).toBe("status");
-  });
-});
-
-describe("StatusBadge — structural", () => {
-  it("renders exactly one status element", () => {
-    const { container } = render(<StatusBadge status="verified" />);
-    expect(container.querySelectorAll("[role=status]").length).toBe(1);
-  });
-});
@@ -1,49 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for ValidationHint component.
- *
- * Covers: null/neutral render, error state (red ⚠ + message), valid state
- * (green ✓ + "Valid format"), ARIA role="alert" on error.
- */
-import { afterEach, describe, it, expect } from "vitest";
-import { render, screen, cleanup } from "@testing-library/react";
-import { ValidationHint } from "../ValidationHint";
-
-afterEach(cleanup);
-
-describe("ValidationHint", () => {
-  it("renders nothing when error is null and showValid is false", () => {
-    const { container } = render(<ValidationHint error={null} showValid={false} />);
-    expect(container.innerHTML).toBe("");
-  });
-
-  it("renders nothing when error is null and showValid is undefined", () => {
-    const { container } = render(<ValidationHint error={null} />);
-    expect(container.innerHTML).toBe("");
-  });
-
-  it("renders error state with ⚠ icon and message", () => {
-    render(<ValidationHint error="Key name must be UPPER_SNAKE_CASE" />);
-    const el = screen.getByRole("alert");
-    expect(el.textContent).toContain("⚠");
-    expect(el.textContent).toContain("Key name must be UPPER_SNAKE_CASE");
-  });
-
-  it("renders valid state with ✓ and 'Valid format'", () => {
-    render(<ValidationHint error={null} showValid />);
-    const el = screen.getByText("Valid format");
-    expect(el.textContent).toContain("✓");
-  });
-
-  it("prefers error over valid when both are set (error is not null)", () => {
-    // ValidationHint checks error first; showValid is only rendered when error is falsy.
-    render(<ValidationHint error="Some error" showValid />);
-    expect(screen.getByRole("alert")).toBeTruthy();
-    expect(screen.queryByText("Valid format")).toBeNull();
-  });
-
-  it("error alert has role='alert' for screen readers", () => {
-    render(<ValidationHint error="Invalid format" />);
-    expect(screen.getByRole("alert")).toBeTruthy();
-  });
-});
@@ -34,17 +34,6 @@ WS_DIR="${2:?Missing workspace-templates dir}"
 ORG_DIR="${3:?Missing org-templates dir}"
 PLUGINS_DIR="${4:?Missing plugins dir}"

-# Strip JSON5-style // comments from manifest.json before parsing.
-# The automated Integration Tester appends a trailing comment
-# (// Triggered by ... ) which is valid JSON5 but not standard JSON.
-# jq's default parser rejects it. This sed removes only full-line comments
-# (lines starting with optional whitespace followed by //) before jq reads the file.
-_strip_comments() {
-    # Remove full-line // comments (whitespace-safe); pass-through for non-comment lines
-    sed 's/^[[:space:]]*\/\/.*//' "$MANIFEST"
-}
-MANIFEST_JSON="$(_strip_comments)"
-
 EXPECTED=0
 CLONED=0

@@ -99,15 +88,15 @@ clone_category() {
    mkdir -p "$target_dir"

    local count
-    count=$(echo "$MANIFEST_JSON" | jq -r ".${category} | length")
+    count=$(jq -r ".${category} | length" "$MANIFEST")
    EXPECTED=$((EXPECTED + count))

    local i=0
    while [ "$i" -lt "$count" ]; do
        local name repo ref
-        name=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].name")
-        repo=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].repo")
-        ref=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].ref // \"main\"")
+        name=$(jq -r ".${category}[$i].name" "$MANIFEST")
+        repo=$(jq -r ".${category}[$i].repo" "$MANIFEST")
+        ref=$(jq -r ".${category}[$i].ref // \"main\"" "$MANIFEST")

        # Idempotent: skip if the target already looks populated. Lets the
        # README quickstart rerun setup.sh safely without having to delete
@@ -1,775 +0,0 @@
-"""Tests for `.gitea/scripts/status-reaper.py` — Option B compensating
-status POST for Gitea 1.22.6's hardcoded `(push)` suffix bug.
-
-Coverage (per hongming-pc 22:08Z review + brief):
-  1. test_workflow_with_name_field
-  2. test_workflow_without_name_field (filename stem fallback)
-  3. test_workflow_name_collision_fails_loud
-  4. test_workflow_name_with_slash_fails_loud
-  5. test_has_push_trigger_true (dict shape, list shape, str shape)
-  6. test_has_push_trigger_false (schedule-only, dispatch-only,
-     pull_request-only, workflow_run-only)
-  7. test_publish_workspace_server_image_preserved (explicit case)
-  8. test_compensating_post_payload (POST body shape verification)
-
-Plus regression coverage:
-  - parse_push_context strictness (only ` (push)` suffix with ` / `
-    separator triggers compensation).
-  - Class-O detection via end-to-end reap() with a stubbed api().
-  - ApiError propagation on non-2xx (mirror of main-red-watchdog's
-    `feedback_api_helper_must_raise_not_return_dict` test).
-  - Unknown-workflow conservatism: ::notice:: + skip, never POST.
-  - Non-`(push)`-suffix contexts (the `(pull_request)` required-checks
-    on main) are NEVER touched — verified safe 2026-05-11.
-
-Hostile self-review proof:
-  - test_required_check_pull_request_suffix_never_touched exercises
-    the safety contract: a pre-fix that compensated any failing
-    context would mask the Secret scan required-check. Verified by
-    stashing the `endswith(PUSH_SUFFIX)` guard and re-running: test
-    FAILS as required.
-  - test_workflow_name_collision_fails_loud asserts exit code 1; a
-    pre-fix that "first write wins" would silently misclassify a
-    renamed workflow.
-
-Run:
-    python3 -m pytest tests/test_status_reaper.py -v
-
-Dependencies: stdlib + pytest + PyYAML. No network.
-"""
-from __future__ import annotations
-
-import importlib.util
-import json
-import os
-import sys
-from pathlib import Path
-from unittest import mock
-
-import pytest
-
-
-# --------------------------------------------------------------------------
-# Module-import fixture
-# --------------------------------------------------------------------------
-SCRIPT_PATH = (
-    Path(__file__).resolve().parent.parent
-    / ".gitea"
-    / "scripts"
-    / "status-reaper.py"
-)
-
-
-@pytest.fixture(scope="module")
-def sr_module():
-    """Import the script as a module under a known env."""
-    env = {
-        "GITEA_TOKEN": "test-token",
-        "GITEA_HOST": "git.example.test",
-        "REPO": "owner/repo",
-        "WATCH_BRANCH": "main",
-        "WORKFLOWS_DIR": ".gitea/workflows",
-    }
-    with mock.patch.dict(os.environ, env, clear=False):
-        spec = importlib.util.spec_from_file_location("status_reaper", SCRIPT_PATH)
-        m = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(m)
-        m.GITEA_TOKEN = env["GITEA_TOKEN"]
-        m.GITEA_HOST = env["GITEA_HOST"]
-        m.REPO = env["REPO"]
-        m.WATCH_BRANCH = env["WATCH_BRANCH"]
-        m.WORKFLOWS_DIR = env["WORKFLOWS_DIR"]
-        m.OWNER, m.NAME = "owner", "repo"
-        m.API = f"https://{env['GITEA_HOST']}/api/v1"
-        yield m
-
-
-# --------------------------------------------------------------------------
-# Workflow scan tests — workflow_id resolution
-# --------------------------------------------------------------------------
-def _write_workflow(tmp_path: Path, filename: str, content: str) -> Path:
-    """Write a workflow YAML to a temp dir and return its path."""
-    d = tmp_path / "workflows"
-    d.mkdir(exist_ok=True)
-    p = d / filename
-    p.write_text(content)
-    return p
-
-
-def test_workflow_with_name_field(sr_module, tmp_path):
-    """`name:` field beats filename stem."""
-    _write_workflow(
-        tmp_path,
-        "publish-runtime.yml",
-        "name: publish-runtime\non:\n  push:\n    branches: [main]\n",
-    )
-    out = sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert "publish-runtime" in out
-    assert out["publish-runtime"] is True
-
-
-def test_workflow_without_name_field(sr_module, tmp_path):
-    """No `name:` → filename stem (basename minus `.yml`)."""
-    _write_workflow(
-        tmp_path,
-        "no-name-workflow.yml",
-        "on:\n  schedule:\n    - cron: '*/5 * * * *'\n",
-    )
-    out = sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert "no-name-workflow" in out
-    assert out["no-name-workflow"] is False  # schedule-only → class-O
-
-
-def test_workflow_name_collision_fails_loud(sr_module, tmp_path, capsys):
-    """Two workflows resolving to the same name → exit 1 with ::error::."""
-    _write_workflow(
-        tmp_path,
-        "a.yml",
-        "name: same-name\non:\n  push: {}\n",
-    )
-    _write_workflow(
-        tmp_path,
-        "b.yml",
-        "name: same-name\non:\n  schedule:\n    - cron: '0 * * * *'\n",
-    )
-    with pytest.raises(SystemExit) as excinfo:
-        sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert excinfo.value.code == 1
-    captured = capsys.readouterr()
-    assert "::error::workflow name collision detected: same-name" in captured.err
-
-
-def test_workflow_name_with_slash_fails_loud(sr_module, tmp_path, capsys):
-    """`name:` containing `/` → exit 1 with ::error:: (breaks context parse)."""
-    _write_workflow(
-        tmp_path,
-        "weird.yml",
-        "name: my/weird/name\non:\n  push: {}\n",
-    )
-    with pytest.raises(SystemExit) as excinfo:
-        sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert excinfo.value.code == 1
-    captured = capsys.readouterr()
-    assert "::error::workflow name contains '/'" in captured.err
-    assert "my/weird/name" in captured.err
-
-
-def test_workflow_name_with_slash_via_filename_stem_fails_loud(sr_module, tmp_path, capsys):
-    """Even if filename stem contains `/` (path-flavoured stem) we trip the
-    same guard. Defensive — Path.stem strips `/` so this can't happen via
-    real filesystems, but the guard catches it if someone synthesises a
-    map from a non-filesystem source in future."""
-    # Force the filename-stem path by writing a no-name workflow whose
-    # PARENT path has a `/` — but Path.stem only takes the basename, so
-    # we instead mock _on_block / iterate manually. Easier: assert the
-    # in-code check directly.
-    # The `/` guard runs on `workflow_id`. Test it via an explicit name
-    # field workflow (already covered) — this test is left as a
-    # docstring-only marker that the filename-stem path can't ever
-    # produce a `/` (Path.stem strips it).
-    assert True  # No-op: Path.stem strips `/`; documented invariant.
-
-
-def test_workflow_empty_name_falls_back_to_stem(sr_module, tmp_path):
-    """Empty `name:` (just whitespace) should fall back to filename stem."""
-    _write_workflow(
-        tmp_path,
-        "stem-fallback.yml",
-        "name: '   '\non:\n  push: {}\n",
-    )
-    out = sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert "stem-fallback" in out  # filename stem used
-    assert out["stem-fallback"] is True
-
-
-# --------------------------------------------------------------------------
-# has_push_trigger tests
-# --------------------------------------------------------------------------
-def test_has_push_trigger_true_dict(sr_module):
-    assert sr_module._has_push_trigger({"push": {}, "schedule": []}, "w") is True
-
-
-def test_has_push_trigger_true_dict_with_paths(sr_module):
-    """`on: { push: { paths: ['workspace/**'] } }` → still push-triggered."""
-    assert (
-        sr_module._has_push_trigger(
-            {"push": {"paths": ["workspace/**"]}}, "w"
-        )
-        is True
-    )
-
-
-def test_has_push_trigger_true_list(sr_module):
-    assert sr_module._has_push_trigger(["push", "pull_request"], "w") is True
-
-
-def test_has_push_trigger_true_str(sr_module):
-    assert sr_module._has_push_trigger("push", "w") is True
-
-
-def test_has_push_trigger_false_schedule_only(sr_module):
-    """Schedule-only workflow (class-O canonical)."""
-    assert (
-        sr_module._has_push_trigger(
-            {"schedule": [{"cron": "0 * * * *"}]}, "w"
-        )
-        is False
-    )
-
-
-def test_has_push_trigger_false_dispatch_only(sr_module):
-    assert sr_module._has_push_trigger({"workflow_dispatch": {}}, "w") is False
-
-
-def test_has_push_trigger_false_pull_request_only(sr_module):
-    """`on: { pull_request: {...} }` only → no push trigger."""
-    assert sr_module._has_push_trigger({"pull_request": {}}, "w") is False
-
-
-def test_has_push_trigger_false_workflow_run_only(sr_module):
-    """`on: { workflow_run: {...} }` → no push trigger.
-    (Even though Gitea 1.22.6 doesn't fire workflow_run, the classifier
-    must handle YAML that declares it — for forward-compat.)"""
-    assert sr_module._has_push_trigger({"workflow_run": {}}, "w") is False
-
-
-def test_has_push_trigger_false_list_no_push(sr_module):
-    assert (
-        sr_module._has_push_trigger(["pull_request", "schedule"], "w") is False
-    )
-
-
-def test_has_push_trigger_ambiguous_preserves(sr_module, capsys):
-    """Unknown shape → True (preserve, never compensate) + log ::notice::."""
-    assert sr_module._has_push_trigger(42, "weird-workflow") is True
-    captured = capsys.readouterr()
-    assert "::notice::ambiguous on: for weird-workflow" in captured.out
-
-
-def test_has_push_trigger_none_preserves(sr_module, capsys):
-    """None `on:` block → True (preserve)."""
-    assert sr_module._has_push_trigger(None, "no-on") is True
-    captured = capsys.readouterr()
-    assert "::notice::ambiguous on:" in captured.out
-
-
-# --------------------------------------------------------------------------
-# Real-world fixture: publish-workspace-server-image preserved
-# --------------------------------------------------------------------------
-def test_publish_workspace_server_image_preserved(sr_module, tmp_path):
-    """Explicit case per brief: real `push` trigger → preserve, even
-    when failing. Protects mc#576 (currently red on docker-socket issue).
-    """
-    _write_workflow(
-        tmp_path,
-        "publish-workspace-server-image.yml",
-        "name: publish-workspace-server-image\n"
-        "on:\n"
-        "  push:\n"
-        "    branches: [main]\n"
-        "    paths: ['workspace/**']\n"
-        "  workflow_dispatch:\n",
-    )
-    out = sr_module.scan_workflows(str(tmp_path / "workflows"))
-    assert out["publish-workspace-server-image"] is True
-
-
-# --------------------------------------------------------------------------
-# Context parsing
-# --------------------------------------------------------------------------
-def test_parse_push_context_canonical(sr_module):
-    """`<workflow_name> / <job_name> (push)` → (workflow_name, job_name)."""
-    parsed = sr_module.parse_push_context("staging-smoke / smoke (push)")
-    assert parsed == ("staging-smoke", "smoke")
-
-
-def test_parse_push_context_workflow_name_with_spaces(sr_module):
-    """Workflow name with spaces — common (`Continuous synthetic E2E`)."""
-    parsed = sr_module.parse_push_context(
-        "Continuous synthetic E2E (staging) / e2e (push)"
-    )
-    assert parsed == ("Continuous synthetic E2E (staging)", "e2e")
-
-
-def test_parse_push_context_non_push_suffix_returns_none(sr_module):
-    """`(pull_request)` suffix → None (not the bug shape; required-checks)."""
-    assert (
-        sr_module.parse_push_context("Secret scan / Scan diff (pull_request)")
-        is None
-    )
-
-
-def test_parse_push_context_no_separator_returns_none(sr_module):
-    """`(push)` suffix but no ` / ` → None (not the bug shape)."""
-    assert sr_module.parse_push_context("just-a-context (push)") is None
-
-
-def test_parse_push_context_no_suffix_returns_none(sr_module):
-    assert sr_module.parse_push_context("workflow / job") is None
-
-
-# --------------------------------------------------------------------------
-# Compensating POST payload shape
-# --------------------------------------------------------------------------
-def test_compensating_post_payload(sr_module, monkeypatch):
-    """POST /statuses/{sha} body: state=success, context preserved,
-    description = COMPENSATION_DESCRIPTION, target_url echoed if present.
-    """
-    calls = []
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        calls.append((method, path, body, query))
-        return (201, {})
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    sr_module.post_compensating_status(
-        "deadbeefcafe1234567890abcdef000011112222",
-        "staging-smoke / smoke (push)",
-        "https://git.example.test/owner/repo/actions/runs/14525",
-        dry_run=False,
-    )
-
-    assert len(calls) == 1
-    method, path, body, _query = calls[0]
-    assert method == "POST"
-    assert path == "/repos/owner/repo/statuses/deadbeefcafe1234567890abcdef000011112222"
-    assert body == {
-        "context": "staging-smoke / smoke (push)",
-        "state": "success",
-        "description": sr_module.COMPENSATION_DESCRIPTION,
-        "target_url": "https://git.example.test/owner/repo/actions/runs/14525",
-    }
-
-
-def test_compensating_post_payload_no_target_url(sr_module, monkeypatch):
-    """target_url is optional — omitted when the original status had none."""
-    calls = []
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        calls.append((method, path, body, query))
-        return (201, {})
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-    sr_module.post_compensating_status(
-        "abc1234567",
-        "x / y (push)",
-        None,
-        dry_run=False,
-    )
-    assert calls[0][2] == {
-        "context": "x / y (push)",
-        "state": "success",
-        "description": sr_module.COMPENSATION_DESCRIPTION,
-    }
-
-
-def test_compensating_post_dry_run_no_api_call(sr_module, monkeypatch, capsys):
-    """--dry-run must NOT POST."""
-    def fake_api(*args, **kwargs):
-        raise AssertionError("api() should not be called in dry_run")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-    sr_module.post_compensating_status(
-        "deadbeefcafe1234567890abcdef000011112222",
-        "ci/test (push)",
-        None,
-        dry_run=True,
-    )
-    captured = capsys.readouterr()
-    assert "::notice::[dry-run] would compensate" in captured.out
-
-
-# --------------------------------------------------------------------------
-# End-to-end reap() — class-O detection
-# --------------------------------------------------------------------------
-SHA = "deadbeefcafe1234567890abcdef000011112222"
-
-
-def test_reap_compensates_class_o(sr_module, monkeypatch):
-    """schedule-only workflow with failing `(push)` status → compensate."""
-    calls = []
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        calls.append((method, path, body))
-        return (201, {})
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    workflow_map = {"staging-smoke": False}  # no push trigger
-    combined = {
-        "state": "failure",
-        "statuses": [
-            {
-                "context": "staging-smoke / smoke (push)",
-                "state": "failure",
-                "target_url": "https://example.test/run/1",
-                "description": "smoke job failed",
-            }
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 1
-    assert counters["preserved_real_push"] == 0
-    assert len(calls) == 1
-    assert calls[0][0] == "POST"
-    assert calls[0][1] == f"/repos/owner/repo/statuses/{SHA}"
-
-
-def test_reap_preserves_real_push(sr_module, monkeypatch):
-    """publish-workspace-server-image (has push trigger) → preserve."""
-    calls = []
-
-    def fake_api(*args, **kwargs):
-        calls.append((args, kwargs))
-        return (201, {})
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    workflow_map = {"publish-workspace-server-image": True}
-    combined = {
-        "state": "failure",
-        "statuses": [
-            {
-                "context": "publish-workspace-server-image / build (push)",
-                "state": "failure",
-            }
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 0
-    assert counters["preserved_real_push"] == 1
-    assert calls == []  # NO POST
-
-
-def test_reap_preserves_unknown_workflow(sr_module, monkeypatch, capsys):
-    """Workflow not in map → ::notice:: + skip (conservative)."""
-    monkeypatch.setattr(
-        sr_module, "api",
-        lambda *a, **kw: (_ for _ in ()).throw(
-            AssertionError("api should not be called")
-        ),
-    )
-
-    workflow_map = {}  # empty map
-    combined = {
-        "state": "failure",
-        "statuses": [
-            {
-                "context": "deleted-workflow / job (push)",
-                "state": "failure",
-            }
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 0
-    assert counters["preserved_unknown"] == 1
-    captured = capsys.readouterr()
-    assert "::notice::unknown workflow 'deleted-workflow'" in captured.out
-
-
-def test_reap_required_check_pull_request_suffix_never_touched(sr_module, monkeypatch):
-    """SAFETY CONTRACT: `(pull_request)` suffix contexts (the actual
-    required-checks on main) are NEVER touched. A pre-fix that
-    compensated any failure would mask Secret scan.
-    """
-    calls = []
-
-    def fake_api(*args, **kwargs):
-        calls.append((args, kwargs))
-        return (201, {})
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    # Even with the workflow mapped as no-push-trigger (which would
-    # normally compensate), the suffix guard prevents the POST.
-    workflow_map = {"Secret scan": False}
-    combined = {
-        "state": "failure",
-        "statuses": [
-            {
-                "context": "Secret scan / Scan diff for credential-shaped strings (pull_request)",
-                "state": "failure",
-            }
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 0
-    assert counters["preserved_non_push_suffix"] == 1
-    assert calls == []
-
-
-def test_reap_ignores_non_failure_states(sr_module, monkeypatch):
-    """Only `failure` is compensated. `pending` / `success` / `error`
-    left alone — they have legitimate semantics."""
-    monkeypatch.setattr(
-        sr_module, "api",
-        lambda *a, **kw: (_ for _ in ()).throw(
-            AssertionError("api should not be called")
-        ),
-    )
-
-    workflow_map = {"sweep-cf-tunnels": False}
-    combined = {
-        "state": "pending",
-        "statuses": [
-            {"context": "sweep-cf-tunnels / sweep (push)", "state": "pending"},
-            {"context": "sweep-cf-tunnels / sweep (push)", "state": "success"},
-            {"context": "sweep-cf-tunnels / sweep (push)", "state": "error"},
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 0
-    assert counters["preserved_non_failure"] == 3
-
-
-def test_reap_unparseable_push_context_preserved(sr_module, monkeypatch):
-    """`(push)` suffix but no ` / ` separator → not the bug shape, preserve."""
-    monkeypatch.setattr(
-        sr_module, "api",
-        lambda *a, **kw: (_ for _ in ()).throw(
-            AssertionError("api should not be called")
-        ),
-    )
-
-    workflow_map = {"x": False}
-    combined = {
-        "state": "failure",
-        "statuses": [
-            {"context": "no-slash-here (push)", "state": "failure"},
-        ],
-    }
-    counters = sr_module.reap(workflow_map, combined, SHA, dry_run=False)
-    assert counters["compensated"] == 0
-    assert counters["preserved_unparseable"] == 1
-
-
-# --------------------------------------------------------------------------
-# ApiError propagation
-# --------------------------------------------------------------------------
-def test_get_head_sha_raises_on_non_2xx(sr_module, monkeypatch):
-    """ApiError on transient outage propagates per
-    `feedback_api_helper_must_raise_not_return_dict`."""
-    def fake_api(method, path, **kwargs):
-        raise sr_module.ApiError("GET /branches/main -> HTTP 500: nope")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-    with pytest.raises(sr_module.ApiError):
-        sr_module.get_head_sha("main")
-
-
-def test_get_combined_status_raises_on_non_2xx(sr_module, monkeypatch):
-    def fake_api(method, path, **kwargs):
-        raise sr_module.ApiError("GET /status -> HTTP 500: nope")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-    with pytest.raises(sr_module.ApiError):
-        sr_module.get_combined_status("deadbeef")
-
-
-def test_get_head_sha_missing_commit_raises(sr_module, monkeypatch):
-    """A malformed 200 response (no `commit` field) raises ApiError."""
-    monkeypatch.setattr(
-        sr_module, "api", lambda m, p, **kw: (200, {"name": "main"})
-    )
-    with pytest.raises(sr_module.ApiError):
-        sr_module.get_head_sha("main")
-
-
-# --------------------------------------------------------------------------
-# scan_workflows on real repo (smoke)
-# --------------------------------------------------------------------------
-def test_scan_workflows_on_real_repo_no_collision(sr_module):
-    """Smoke: scan the actual .gitea/workflows/ in this repo. Asserts
-    no real-world collision/`/`-in-name lurks. If this fails, a real
-    workflow file must be fixed before reaper can ship."""
-    real_dir = str(SCRIPT_PATH.parent.parent / "workflows")
-    # Should NOT raise SystemExit — collision/slash guards must pass.
-    out = sr_module.scan_workflows(real_dir)
-    assert len(out) > 0
-    # publish-workspace-server-image is the canonical preserved case.
-    assert out.get("publish-workspace-server-image") is True
-    # main-red-watchdog is the canonical class-O case.
-    assert out.get("main-red-watchdog") is False
-    # ci is the canonical required-check (push+pull_request).
-    assert out.get("CI") is True or out.get("ci") is True
-
-
-def test_scan_workflows_missing_dir_returns_empty(sr_module, tmp_path, capsys):
-    """Missing workflows dir → empty map + ::warning::."""
-    out = sr_module.scan_workflows(str(tmp_path / "nope"))
-    assert out == {}
-    captured = capsys.readouterr()
-    assert "::warning::workflows dir not found" in captured.out
-
-
-# --------------------------------------------------------------------------
-# rev2: multi-SHA sweep — `reap_branch()` walks last N main commits
-# --------------------------------------------------------------------------
-# Phase 1+2 evidence (orchestrator + hongming-pc2): rev1 sees `compensated:0`
-# every tick because the schedule workflow posts `failure` to whatever SHA
-# was HEAD when it COMPLETED. By the next */5 tick, main has often moved
-# forward, so the single-HEAD reaper misses the stranded red. rev2 sweeps
-# the last 10 commits each tick. See `reference_post_suspension_pipeline`
-# and parent rev1 PR #618 for context.
-
-SHA_A = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-SHA_B = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-SHA_C = "cccccccccccccccccccccccccccccccccccccccc"
-
-
-def test_reap_sweeps_n_shas_smoke(sr_module, monkeypatch):
-    """rev2 contract: sweep last 10 (or N) main commits, GET combined
-    status for EACH. Smoke: with 3 stub SHAs, each is GET'd exactly once.
-    """
-    gets: list[str] = []
-    posts: list[tuple[str, dict]] = []
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        if method == "GET" and path.endswith("/commits"):
-            # commits listing — return 3 fake commit objects
-            return (200, [{"sha": SHA_A}, {"sha": SHA_B}, {"sha": SHA_C}])
-        if method == "GET" and "/commits/" in path and path.endswith("/status"):
-            sha = path.split("/commits/")[1].split("/status")[0]
-            gets.append(sha)
-            # All combined=success → cost-optimization short-circuit
-            return (200, {"state": "success", "statuses": []})
-        if method == "POST":
-            posts.append((path, body))
-            return (201, {})
-        raise AssertionError(f"unexpected api call: {method} {path}")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    workflow_map = {"x": False}
-    counters = sr_module.reap_branch(
-        workflow_map, "main", limit=10, dry_run=False
-    )
-
-    # Each of the 3 SHAs returned by /commits should be GET'd once.
-    assert gets == [SHA_A, SHA_B, SHA_C]
-    # No POST (everything was combined=success).
-    assert posts == []
-    # Counters reflect what we saw.
-    assert counters["scanned_shas"] == 3
-    assert counters["compensated"] == 0
-    assert counters["compensated_per_sha"] == {}
-
-
-def test_reap_skips_combined_success_shas(sr_module, monkeypatch):
-    """rev2 cost-optimization (refinement #2): when combined==success for
-    a SHA, do NOT iterate per-context statuses; move on to next SHA.
-
-    Mock 2 SHAs with combined=success + 1 with combined=failure → only
-    the failure-SHA's statuses get the per-context loop applied.
-    """
-    per_context_iterated_for: list[str] = []
-    posts: list[tuple[str, dict]] = []
-
-    failure_statuses = [
-        {
-            "context": "drift / drift (push)",
-            "state": "failure",
-            "target_url": "https://example.test/run/42",
-        }
-    ]
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        if method == "GET" and path.endswith("/commits"):
-            return (200, [{"sha": SHA_A}, {"sha": SHA_B}, {"sha": SHA_C}])
-        if method == "GET" and "/commits/" in path and path.endswith("/status"):
-            sha = path.split("/commits/")[1].split("/status")[0]
-            if sha == SHA_B:
-                # Mark this SHA as the failure one — return per-context
-                # statuses that would compensate if iterated.
-                return (200, {"state": "failure", "statuses": failure_statuses})
-            # Others are combined=success — must short-circuit.
-            return (200, {"state": "success", "statuses": failure_statuses})
-        if method == "POST":
-            # If a POST hits a non-failure SHA, the short-circuit failed.
-            posts.append((path, body))
-            return (201, {})
-        raise AssertionError(f"unexpected api call: {method} {path}")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    # Workflow trigger map: `drift` is schedule-only (compensable).
-    workflow_map = {"drift": False}
-    counters = sr_module.reap_branch(
-        workflow_map, "main", limit=10, dry_run=False
-    )
-
-    # Only SHA_B (the combined=failure one) should be compensated.
-    assert counters["compensated"] == 1
-    assert counters["scanned_shas"] == 3
-    assert SHA_B in counters["compensated_per_sha"]
-    assert counters["compensated_per_sha"][SHA_B] == ["drift / drift (push)"]
-    # SHA_A and SHA_C must NOT appear in compensated_per_sha — their
-    # per-context loop was skipped via the combined=success short-circuit.
-    assert SHA_A not in counters["compensated_per_sha"]
-    assert SHA_C not in counters["compensated_per_sha"]
-    # Exactly one POST: the compensation on SHA_B.
-    assert len(posts) == 1
-    assert posts[0][0] == f"/repos/owner/repo/statuses/{SHA_B}"
-
-
-def test_reap_continues_on_per_sha_apierror(sr_module, monkeypatch, capsys):
-    """rev2 refinement #7 (MOST CRITICAL): a transient ApiError or HTTP-5xx
-    on get_combined_status(SHA_X) must NOT fail the whole tick. Log + skip
-    SHA_X, continue with SHA_Y.
-
-    Different from the single-HEAD path (where fail-loud is correct): the
-    sweep is best-effort across historical commits, so one transient blip
-    on a stale SHA should not strand reds on the OTHER stale SHAs.
-    """
-    posts: list[tuple[str, dict]] = []
-
-    def fake_api(method, path, *, body=None, query=None, expect_json=True):
-        if method == "GET" and path.endswith("/commits"):
-            return (200, [{"sha": SHA_A}, {"sha": SHA_B}])
-        if method == "GET" and "/commits/" in path and path.endswith("/status"):
-            sha = path.split("/commits/")[1].split("/status")[0]
-            if sha == SHA_A:
-                raise sr_module.ApiError(
-                    f"GET /repos/owner/repo/commits/{SHA_A}/status "
-                    f"-> HTTP 502: bad gateway"
-                )
-            # SHA_B returns normally with a failure to compensate.
-            return (
-                200,
-                {
-                    "state": "failure",
-                    "statuses": [
-                        {
-                            "context": "drift / drift (push)",
-                            "state": "failure",
-                        }
-                    ],
-                },
-            )
-        if method == "POST":
-            posts.append((path, body))
-            return (201, {})
-        raise AssertionError(f"unexpected api call: {method} {path}")
-
-    monkeypatch.setattr(sr_module, "api", fake_api)
-
-    workflow_map = {"drift": False}
-    # Must NOT raise — per-SHA error isolation contract.
-    counters = sr_module.reap_branch(
-        workflow_map, "main", limit=10, dry_run=False
-    )
-
-    # SHA_A was logged + skipped. SHA_B processed normally.
-    assert counters["scanned_shas"] == 2
-    assert counters["compensated"] == 1
-    assert SHA_B in counters["compensated_per_sha"]
-    assert SHA_A not in counters["compensated_per_sha"]
-    # Compensation POST landed on SHA_B only.
-    assert len(posts) == 1
-    assert posts[0][0] == f"/repos/owner/repo/statuses/{SHA_B}"
-    # The ApiError must be logged so a human auditing tick output can see
-    # WHICH SHA blipped and WHY.
-    captured = capsys.readouterr()
-    assert "::warning::" in captured.out or "::notice::" in captured.out
-    assert SHA_A[:10] in captured.out
@@ -35,12 +35,6 @@ GITEA_HOST = os.environ.get("GITEA_HOST", "git.moleculesai.app")
 GITEA_TOKEN = os.environ.get("GITEA_TOKEN", os.environ.get("GITHUB_TOKEN", ""))
 API_BASE = f"https://{GITEA_HOST}/api/v1"

-# Timeout in seconds for all HTTP calls. Defence-in-depth: ensures a missing or
-# invalid SOP_TIER_CHECK_TOKEN causes a fast (~15 s) failure rather than an
-# indefinite hang. The real fix is provisioning the token; this caps worst-case
-# wall-clock on a broken/unreachable Gitea host.
-DEFAULT_TIMEOUT = 15
-

 def api_get(path: str) -> dict | list:
    url = f"{API_BASE}{path}"
@@ -52,7 +46,7 @@ def api_get(path: str) -> dict | list:
        },
    )
    try:
-        with urllib.request.urlopen(req, timeout=DEFAULT_TIMEOUT) as r:
+        with urllib.request.urlopen(req) as r:
            return json.loads(r.read())
    except urllib.error.HTTPError as e:
        body = e.read().decode(errors="replace")
@@ -527,12 +521,12 @@ def run(repo: str, pr_number: int, post_comment: bool = False) -> dict:
                    comment_id = our_comments[-1]["id"]
                    url = f"{API_BASE}/repos/{owner}/{name}/issues/comments/{comment_id}"
                    req = urllib.request.Request(url, data=json.dumps({"body": comment_body}).encode(), headers=headers, method="PATCH")
-                    with urllib.request.urlopen(req, timeout=DEFAULT_TIMEOUT) as r:
+                    with urllib.request.urlopen(req) as r:
                        r.read()
                else:
                    url = f"{API_BASE}/repos/{owner}/{name}/issues/{pr_number}/comments"
                    req = urllib.request.Request(url, data=json.dumps({"body": comment_body}).encode(), headers=headers, method="POST")
-                    with urllib.request.urlopen(req, timeout=DEFAULT_TIMEOUT) as r:
+                    with urllib.request.urlopen(req) as r:
                        r.read()
            except urllib.error.HTTPError as e:
                if e.code == 403:
@@ -983,16 +983,7 @@ func expectExecuteDelegationBase(mock sqlmock.Sqlmock) {
 		WithArgs("dispatched", "", testSourceID, testDelegationID).
 		WillReturnResult(sqlmock.NewResult(0, 1))

-	// CanCommunicate: source != target → fires two getWorkspaceRef lookups.
-	// Both test fixtures have parent_id = NULL (root-level siblings) → allowed.
-	// Order matches call order: source first, then target.
-	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id").
-		WithArgs(testSourceID).
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow(testSourceID, nil))
-	mock.ExpectQuery("SELECT id, parent_id FROM workspaces WHERE id").
-		WithArgs(testTargetID).
-		WillReturnRows(sqlmock.NewRows([]string{"id", "parent_id"}).AddRow(testTargetID, nil))
-
+	// CanCommunicate (source=target self-call is always allowed — no DB lookup needed)
 	// resolveAgentURL: reads ws:{id}:url from Redis, falls back to DB for target
 	mock.ExpectQuery("SELECT url, status FROM workspaces WHERE id = ").
 		WithArgs(testTargetID).
@@ -1087,6 +1078,9 @@ func TestExecuteDelegation_DeliveryConfirmedProxyError_TreatsAsSuccess(t *testin
 	allowLoopbackForTest(t)

 	expectExecuteDelegationBase(mock)
+	// CanCommunicate: workspace hierarchy check added in b9311134; must be mocked
+	// so proxyA2ARequest doesn't return 403 and trigger the failure path.
+	mockCanCommunicate(mock, testSourceID, testTargetID, true)
 	expectExecuteDelegationSuccess(mock, `{"result":{"parts":[{"text":"work completed successfully"}]}}`)

 	// Execute synchronously (not as a goroutine) so we can check DB state immediately.
@@ -1157,6 +1151,9 @@ func TestExecuteDelegation_ProxyErrorNon2xx_RemainsFailed(t *testing.T) {
 	allowLoopbackForTest(t)

 	expectExecuteDelegationBase(mock)
+	// CanCommunicate: workspace hierarchy check added in b9311134; must be mocked
+	// so proxyA2ARequest doesn't return 403 and trigger the failure path.
+	mockCanCommunicate(mock, testSourceID, testTargetID, true)
 	expectExecuteDelegationFailed(mock)

 	a2aBody, _ := json.Marshal(map[string]interface{}{
@@ -1204,6 +1201,9 @@ func TestExecuteDelegation_ProxyErrorEmptyBody_RemainsFailed(t *testing.T) {

 	// First attempt: updateDelegationStatus(dispatched) — from expectExecuteDelegationBase
 	expectExecuteDelegationBase(mock)
+	// CanCommunicate: workspace hierarchy check added in b9311134; must be mocked
+	// so proxyA2ARequest doesn't return 403 and trigger the failure path.
+	mockCanCommunicate(mock, testSourceID, testTargetID, true)
 	// Second attempt (retry): updateDelegationStatus(dispatched) again
 	mock.ExpectExec("UPDATE activity_logs SET status").
 		WithArgs("dispatched", "", testSourceID, testDelegationID).
@@ -1252,6 +1252,9 @@ func TestExecuteDelegation_CleanProxyResponse_Unchanged(t *testing.T) {
 	allowLoopbackForTest(t)

 	expectExecuteDelegationBase(mock)
+	// CanCommunicate: workspace hierarchy check added in b9311134; must be mocked
+	// so proxyA2ARequest doesn't return 403 and trigger the failure path.
+	mockCanCommunicate(mock, testSourceID, testTargetID, true)
 	expectExecuteDelegationSuccess(mock, `{"result":{"parts":[{"text":"all good"}]}}`)

 	a2aBody, _ := json.Marshal(map[string]interface{}{
@@ -26,6 +26,10 @@ func newMCPHandler(t *testing.T) (*MCPHandler, sqlmock.Sqlmock) {
 	t.Helper()
 	mock := setupTestDB(t)
 	h := NewMCPHandler(db.DB, newTestBroadcaster())
+	// Wire memv2 so toolCommitMemory takes the v2 path (where GLOBAL scope
+	// is blocked before any DB call), rather than the legacy shim path
+	// (which calls scopeToWritableNamespace before the scope check).
+	h.withMemoryV2APIs(nil, nil)
 	return h, mock
 }

@@ -763,7 +763,6 @@ def test_sanitize_agent_error_stderr_and_exc():
    out = sanitize_agent_error(exc=err, stderr="rate limit exceeded")
    assert "ValueError" in out  # exc class IS the tag when stderr is provided
    assert "rate limit exceeded" in out
-    assert "workspace logs" not in out  # stderr form, not the generic form


 def test_sanitize_agent_error_stderr_empty_string():
Author	SHA1	Message	Date
core-be	1ecc384852	test(handlers): fix delegation and MCP tests exposed by full platform suite Commit `b9311134` added a CanCommunicate hierarchy check to proxyA2ARequest. The executeDelegation tests call proxyA2ARequest directly but did not mock the workspace hierarchy lookup, causing sqlmock to reject the unexpected queries and fall through to the DELEGATION_FAILED path. Fix: add mockCanCommunicate(mock, testSourceID, testTargetID, true) to each affected executeDelegation test so the hierarchy check returns true and the proxy is actually called. Separately, TestMCPHandler_CommitMemory_GlobalScope_Blocked expected zero DB calls (the handler should block GLOBAL scope before any DB work). With no memv2 wired, toolCommitMemory fell through to the legacy shim, which called scopeToWritableNamespace before the scope check. Fix: wire memv2 via withMemoryV2APIs(nil, nil) in newMCPHandler so the v2 path is taken and the GLOBAL scope check fires before any DB call. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-11 21:30:50 +00:00
core-be	5c8c74e9b3	ci: trigger fresh CI run for log diagnostics	2026-05-11 21:30:50 +00:00
core-be	0d7eb0f086	ci: trigger CI re-run	2026-05-11 21:30:50 +00:00
core-be	f79176dbb6	ci: re-trigger CI to get fresh logs	2026-05-11 21:30:50 +00:00
core-be	34eada90b2	ci: trigger CI (5th attempt)	2026-05-11 21:30:50 +00:00
core-be	ea8692a2bd	ci: re-trigger CI after E2E completion	2026-05-11 21:30:50 +00:00
core-be	3278654c14	ci: re-trigger CI checks (3rd attempt)	2026-05-11 21:30:50 +00:00
core-be	394b455f1d	ci: re-trigger CI checks	2026-05-11 21:30:50 +00:00
core-be	7a71484c95	ci: trigger re-run of CI checks after flaky failures The Go + Postgres + E2E checks failed on the first attempt with "Failing after 2-3m" — consistent with operational flakiness rather than code failures (PR only touches org.go org import logic, unrelated to the failing handlers).	2026-05-11 21:30:50 +00:00
core-be	d00059fbe0	ci: trigger fresh CI run for log diagnostics	2026-05-11 21:30:50 +00:00
core-be	376461b762	ci: trigger CI re-run	2026-05-11 21:30:50 +00:00
core-be	a1a3ccc72e	ci: re-trigger CI to get fresh logs	2026-05-11 21:30:50 +00:00
core-be	c2c0770260	ci: trigger CI (5th attempt)	2026-05-11 21:30:50 +00:00
core-be	1ba28fb87c	ci: re-trigger CI after E2E completion	2026-05-11 21:30:50 +00:00
core-be	747660d9f4	ci: re-trigger CI checks (3rd attempt)	2026-05-11 21:30:50 +00:00
core-be	9f5efdd8a8	ci: re-trigger CI checks	2026-05-11 21:30:50 +00:00
core-be	ac5a0a63c6	ci: trigger re-run of CI checks after flaky failures The Go + Postgres + E2E checks failed on the first attempt with "Failing after 2-3m" — consistent with operational flakiness rather than code failures (PR only touches org.go org import logic, unrelated to the failing handlers).	2026-05-11 21:30:50 +00:00