Merge branch 'main' of https://git.moleculesai.app/molecule-ai/molecule-core into infra/merge-563-autobump-fix

fix(ci): publish-runtime-autobump bump-and-tag condition is always-skipped

if: github.event.pull_request.base.ref == '' was always false on
PR-merge push (pull_request context persists in Gitea Actions),
permanently skipping bump-and-tag. Fix: github.event_name == 'push'.

Also adds workflow_dispatch for manual dispatch when Gitea Actions
API (/actions/*) is unreachable (act_runner 404 on Gitea 1.22.6).

.gitea/workflows/ci.yml

@@ -493,12 +493,10 @@ jobs:
     # explicitly excludes `github.event_name`-gated jobs from F1 (see
     # `.gitea/scripts/ci-required-drift.py::ci_job_names`).
     #
-    # Phase 3 (RFC #219 §1) safety: continue-on-error here so the sentinel
-    # does not hard-fail and block PRs while the underlying build jobs are
-    # still in Phase 3 (continue-on-error: true suppresses their status to null).
-    # When Phase 3 ends (defects fixed, continue-on-error flipped off on build
-    # jobs), remove continue-on-error here so the sentinel again hard-fails.
-    continue-on-error: true
+    # NOTE: `continue-on-error: true` is intentionally NOT set here — Phase 3
+    # (parent PR for ci.yml port, RFC §1) sets it on the underlying build
+    # jobs to surface defects without blocking. The sentinel itself must
+    # hard-fail; that's the whole point.
     runs-on: ubuntu-latest
     timeout-minutes: 1
     needs:
@@ -512,27 +510,18 @@ jobs:
       - name: Assert every required dependency succeeded
         run: |
           set -euo pipefail
-          # `needs.*.result` is one of: success | failure | cancelled | skipped | null.
+          # `needs.*.result` is one of: success | failure | cancelled | skipped
           # We assert success per dep (not != failure) — see RFC §2 reasoning above.
-          # Null results are skipped: they come from Phase 3 (continue-on-error: true
-          # suppresses status) or from jobs still in-flight. The sentinel succeeds
-          # rather than blocking PRs on Phase 3 noise.
           results='${{ toJSON(needs) }}'
           echo "$results"
           echo "$results" | python3 -c '
           import json, sys
           ns = json.load(sys.stdin)
-          # Exclude null (Phase 3 suppressed / in-flight) from the bad list.
-          bad = [(k, v.get("result")) for k, v in ns.items()
-                 if v.get("result") not in ("success", None)]
+          bad = [(k, v.get("result")) for k, v in ns.items() if v.get("result") != "success"]
           if bad:
               print(f"FAIL: jobs not green:", file=sys.stderr)
               for k, r in bad:
                   print(f"  - {k}: {r}", file=sys.stderr)
               sys.exit(1)
-          pending = [(k, v.get("result")) for k, v in ns.items() if v.get("result") is None]
-          if pending:
-              print(f"WARN: {len(pending)} job(s) still in-flight (result=null): " +
-                    ", ".join(k for k, _ in pending), file=sys.stderr)
-          print(f"OK: all {len(ns)} required jobs succeeded (or Phase-3 suppressed)")
+          print(f"OK: all {len(ns)} required jobs succeeded")
           '

.gitea/workflows/publish-workspace-server-image.yml

@@ -92,9 +92,10 @@ jobs:
           MOLECULE_GITEA_TOKEN: ${{ secrets.AUTO_SYNC_TOKEN }}
         run: |
           set -euo pipefail
-          # clone-manifest.sh supports anonymous cloning for public repos (post-
-          # 2026-05-08 migration). The token is only needed for private repos.
-          # Do NOT require it — a missing secret would fail the build unnecessarily.
+          if [ -z "${MOLECULE_GITEA_TOKEN}" ]; then
+            echo "::error::AUTO_SYNC_TOKEN secret is empty"
+            exit 1
+          fi
           mkdir -p .tenant-bundle-deps
           bash scripts/clone-manifest.sh \
             manifest.json \

canvas/src/components/__tests__/ApprovalBanner.test.tsx

@@ -5,22 +5,20 @@
  * Covers: renders nothing when no approvals, polls /approvals/pending,
  * shows approval cards, approve/deny decisions, toast notifications.
  *
- * Uses vi.hoisted + vi.mock (file-level) for @/lib/api. vi.resetModules()
- * in every afterEach undoes the mock so other test files that import the
- * real api module (e.g. socket.url.test.ts) are unaffected.
+ * Note: does NOT mock @/lib/api — uses vi.spyOn on the real module.
+ * vi.restoreAllMocks() is omitted from afterEach so queued mock values
+ * (set up via mockResolvedValueOnce in beforeEach) are preserved for the
+ * component's useEffect to consume.
  */
 import React from "react";
 import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
 import { afterEach, describe, expect, it, vi, beforeEach } from "vitest";
 import { ApprovalBanner } from "../ApprovalBanner";
 import { showToast } from "@/components/Toaster";
+import { api } from "@/lib/api";
 
-// ─── Hoisted mock refs ─────────────────────────────────────────────────────────
-// vi.hoisted runs in the same hoisting phase as vi.mock factories, so these
-// refs are stable across all tests and available inside the mock factory.
-const { mockApiGet, mockApiPost } = vi.hoisted(() => ({
-  mockApiGet: vi.fn<(args: unknown[]) => Promise<unknown>>(),
-  mockApiPost: vi.fn<(args: unknown[]) => Promise<unknown>>(),
+vi.mock("@/components/Toaster", () => ({
+  showToast: vi.fn(),
 }));
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -43,42 +41,28 @@ const pendingApproval = (id = "a1", workspaceId = "ws-1"): {
   created_at: "2026-05-10T10:00:00Z",
 });
 
-// ─── Static mocks (file-level — no other test needs the real modules) ─────────
+// Shared spy references so individual tests can reset or reject the POST mock
+// without needing to call spyOn again (which would create a duplicate spy).
+let mockGet: ReturnType<typeof vi.spyOn>;
+let mockPost: ReturnType<typeof vi.spyOn>;
 
-vi.mock("@/components/Toaster", () => ({
-  showToast: vi.fn(),
-}));
-
-// vi.resetModules() in afterEach undoes this mock so other files that import
-// the real api module are unaffected.
-vi.mock("@/lib/api", () => ({
-  api: {
-    get: mockApiGet,
-    post: mockApiPost,
-  },
-}));
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
+// ─── Tests ────────────────────────────────────────────────────────────────────
 
 describe("ApprovalBanner — empty state", () => {
   beforeEach(() => {
     vi.useFakeTimers();
-    mockApiGet.mockReset().mockResolvedValue([]);
-    mockApiPost.mockReset().mockResolvedValue({});
+    vi.spyOn(api, "get").mockResolvedValueOnce([]);
   });
 
   afterEach(() => {
     cleanup();
     vi.useRealTimers();
-    vi.restoreAllMocks();
-    vi.resetModules();
   });
 
   it("renders nothing when there are no pending approvals", async () => {
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     expect(screen.queryByRole("alert")).toBeNull();
-    expect(mockApiGet).toHaveBeenCalled();
   });
 
   it("does not render any approve/deny buttons when list is empty", async () => {
@@ -92,40 +76,41 @@ describe("ApprovalBanner — empty state", () => {
 describe("ApprovalBanner — renders approval cards", () => {
   beforeEach(() => {
     vi.useFakeTimers();
-    mockApiGet.mockReset().mockResolvedValue([
+    mockGet = vi.spyOn(api, "get").mockResolvedValueOnce([
       pendingApproval("a1"),
       pendingApproval("a2", "ws-2"),
     ]);
-    mockApiPost.mockReset().mockResolvedValue({});
   });
 
   afterEach(() => {
     cleanup();
     vi.useRealTimers();
-    vi.restoreAllMocks();
-    vi.resetModules();
   });
 
   it("renders an alert card for each pending approval", async () => {
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
-    expect(screen.getAllByRole("alert")).toHaveLength(2);
+    const alerts = screen.getAllByRole("alert");
+    expect(alerts).toHaveLength(2);
+    mockGet.mockRestore();
   });
 
   it("displays the workspace name and action text", async () => {
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
-    expect(screen.getAllByText(/test workspace needs approval/i)).toHaveLength(2);
+    const nameEls = screen.getAllByText(/test workspace needs approval/i);
+    expect(nameEls).toHaveLength(2);
   });
 
   it("displays the reason when present", async () => {
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
-    expect(screen.getAllByText(/requires human approval/i)).toHaveLength(2);
+    const reasons = screen.getAllByText(/requires human approval/i);
+    expect(reasons).toHaveLength(2);
   });
 
   it("omits the reason div when reason is null", async () => {
-    mockApiGet.mockReset().mockResolvedValue([{
+    vi.spyOn(api, "get").mockResolvedValueOnce([{
       ...pendingApproval("a1"),
       reason: null,
     }]);
@@ -139,6 +124,7 @@ describe("ApprovalBanner — renders approval cards", () => {
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     const approveBtns = screen.getAllByRole("button", { name: /Approve/i });
     const denyBtns = screen.getAllByRole("button", { name: /Deny/i });
+    // 2 cards, each card has 1 Approve + 1 Deny button → 2 of each minimum
     expect(approveBtns.length).toBeGreaterThanOrEqual(2);
     expect(denyBtns.length).toBeGreaterThanOrEqual(2);
   });
@@ -146,22 +132,21 @@ describe("ApprovalBanner — renders approval cards", () => {
   it("has aria-live=assertive on the alert container", async () => {
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
-    expect(screen.getAllByRole("alert")[0].getAttribute("aria-live")).toBe("assertive");
+    const alert = screen.getAllByRole("alert")[0];
+    expect(alert.getAttribute("aria-live")).toBe("assertive");
   });
 });
 
 describe("ApprovalBanner — decisions", () => {
   beforeEach(() => {
     vi.useFakeTimers();
-    mockApiGet.mockReset().mockResolvedValue([pendingApproval("a1")]);
-    mockApiPost.mockReset().mockResolvedValue({});
+    mockGet = vi.spyOn(api, "get").mockResolvedValueOnce([pendingApproval("a1")]);
+    mockPost = vi.spyOn(api, "post").mockResolvedValue({});
   });
 
   afterEach(() => {
     cleanup();
     vi.useRealTimers();
-    vi.restoreAllMocks();
-    vi.resetModules();
   });
 
   it("calls POST /workspaces/:id/approvals/:id/decide on Approve click", async () => {
@@ -169,7 +154,7 @@ describe("ApprovalBanner — decisions", () => {
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
     await act(async () => { /* flush */ });
-    expect(mockApiPost).toHaveBeenCalledWith(
+    expect(vi.mocked(api.post)).toHaveBeenCalledWith(
       "/workspaces/ws-1/approvals/a1/decide",
       expect.objectContaining({ decision: "approved" })
     );
@@ -180,7 +165,7 @@ describe("ApprovalBanner — decisions", () => {
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     fireEvent.click(screen.getAllByRole("button", { name: /deny/i })[0]);
     await act(async () => { /* flush */ });
-    expect(mockApiPost).toHaveBeenCalledWith(
+    expect(vi.mocked(api.post)).toHaveBeenCalledWith(
       "/workspaces/ws-1/approvals/a1/decide",
       expect.objectContaining({ decision: "denied" })
     );
@@ -212,10 +197,7 @@ describe("ApprovalBanner — decisions", () => {
   });
 
   it("shows an error toast when POST fails", async () => {
-    // mockImplementation preserves the vi.fn() wrapper (unlike mockReset() which
-    // strips it and causes the real fetch() to fire — the root cause of the
-    // original flakiness in this file).
-    mockApiPost.mockImplementation(() => Promise.reject(new Error("Network error")));
+    mockPost.mockReset().mockRejectedValue(new Error("Network error"));
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
@@ -227,9 +209,9 @@ describe("ApprovalBanner — decisions", () => {
   });
 
   it("keeps the card visible when the POST fails", async () => {
-    // Same mockImplementation pattern — preserves the wrapper so the component's
-    // catch block runs instead of the real fetch().
-    mockApiPost.mockImplementation(() => Promise.reject(new Error("Network error")));
+    // Reset the post mock before rejecting so the beforeEach's resolved value
+    // is gone and we get a clean rejection instead of a resolved→rejected queue.
+    mockPost.mockReset().mockRejectedValue(new Error("Network error"));
     render(<ApprovalBanner />);
     await act(async () => { await vi.runOnlyPendingTimersAsync(); });
     fireEvent.click(screen.getAllByRole("button", { name: /approve/i })[0]);
@@ -241,15 +223,12 @@ describe("ApprovalBanner — decisions", () => {
 describe("ApprovalBanner — handles empty list from server", () => {
   beforeEach(() => {
     vi.useFakeTimers();
-    mockApiGet.mockReset().mockResolvedValue([]);
-    mockApiPost.mockReset().mockResolvedValue({});
+    vi.spyOn(api, "get").mockResolvedValueOnce([]);
   });
 
   afterEach(() => {
     cleanup();
     vi.useRealTimers();
-    vi.restoreAllMocks();
-    vi.resetModules();
   });
 
   it("shows nothing when the API returns an empty array on first poll", async () => {

canvas/src/components/__tests__/EmptyState.test.tsx

@@ -1,370 +0,0 @@
-// @vitest-environment jsdom
-/**
- * Tests for EmptyState — the full-canvas welcome card shown on first load.
- *
- * Covers:
- *   - Loading state (GET /templates in flight)
- *   - Fetch failure → empty template grid (templates = [])
- *   - Template grid renders with correct content
- *   - Template button disabled while deploying
- *   - "Deploying..." label on the button being deployed
- *   - "Create blank" button POSTs /workspaces
- *   - "Creating..." label while blank workspace is being created
- *   - Blank create error shows error banner
- *   - Error banner has role="alert"
- *   - All buttons disabled while any deploy is in-flight
- *   - handleDeployed fires after 500ms delay
- *
- * Uses vi.hoisted + vi.mock to fully isolate the api module, matching
- * the pattern established in ApprovalBanner, MemoryTab, and ScheduleTab tests.
- */
-import React from "react";
-import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { EmptyState } from "../EmptyState";
-
-// ─── Hoisted mock refs ─────────────────────────────────────────────────────────
-// vi.hoisted runs in the same hoisting phase as vi.mock factories, so all refs
-// are available both to the factory and to test bodies.
-const { mockApiGet, mockApiPost } = vi.hoisted(() => ({
-  mockApiGet: vi.fn<(args: unknown[]) => Promise<unknown>>(),
-  mockApiPost: vi.fn<(args: unknown[]) => Promise<{ id: string }>>(),
-}));
-
-// Mutable deploy state — object reference is const; properties can be mutated.
-const _deploy = vi.hoisted(() => ({
-  deployFn: vi.fn(),
-  deploying: undefined as string | undefined,
-  error: undefined as string | undefined,
-  modal: null as React.ReactNode,
-}));
-
-const { mockSelectNode, mockSetPanelTab } = vi.hoisted(() => ({
-  mockSelectNode: vi.fn(),
-  mockSetPanelTab: vi.fn(),
-}));
-
-// ─── Mocks ────────────────────────────────────────────────────────────────────
-
-vi.mock("@/lib/api", () => ({
-  api: {
-    get: mockApiGet,
-    post: mockApiPost,
-  },
-}));
-
-vi.mock("@/hooks/useTemplateDeploy", () => ({
-  useTemplateDeploy: () => ({
-    deploy: _deploy.deployFn,
-    deploying: _deploy.deploying,
-    error: _deploy.error,
-    modal: _deploy.modal,
-  }),
-}));
-
-vi.mock("@/store/canvas", () => ({
-  useCanvasStore: Object.assign(
-    vi.fn((selector: (s: { getState: () => { selectNode: typeof mockSelectNode; setPanelTab: typeof mockSetPanelTab } }) => unknown) =>
-      selector({
-        getState: () => ({
-          selectNode: mockSelectNode,
-          setPanelTab: mockSetPanelTab,
-        }),
-      })
-    ),
-    { getState: () => ({ selectNode: mockSelectNode, setPanelTab: mockSetPanelTab }) }
-  ),
-}));
-
-vi.mock("../TemplatePalette", () => ({
-  OrgTemplatesSection: () => null,
-}));
-
-vi.mock("../Spinner", () => ({
-  Spinner: () => <span data-testid="spinner">⟳</span>,
-}));
-
-vi.mock("@/lib/design-tokens", () => ({
-  TIER_CONFIG: {
-    1: { label: "T1", color: "text-ink-mid bg-surface-card border border-line", border: "text-ink-mid border-line" },
-    2: { label: "T2", color: "text-white bg-accent border border-accent-strong", border: "text-accent border-accent" },
-    3: { label: "T3", color: "text-white bg-violet-600 border border-violet-700", border: "text-violet-600 border-violet-500" },
-    4: { label: "T4", color: "text-white bg-warm border border-warm", border: "text-warm border-warm" },
-  },
-}));
-
-// ─── Fixtures ─────────────────────────────────────────────────────────────────
-
-const TEMPLATE = {
-  id: "tpl-1",
-  name: "Claude Code Agent",
-  description: "A general-purpose coding assistant",
-  tier: 2,
-  skill_count: 3,
-  model: "claude-opus-4-5",
-};
-
-function template(overrides: Partial<typeof TEMPLATE> = {}): typeof TEMPLATE {
-  return { ...TEMPLATE, ...overrides };
-}
-
-// ─── Helpers ───────────────────────────────────────────────────────────────────
-
-function renderEmpty() {
-  return render(<EmptyState />);
-}
-
-// Flush React state + microtasks after an act boundary.
-async function flush() {
-  await act(async () => { await Promise.resolve(); });
-}
-
-// Reset deploy state to defaults before each test.
-function resetDeployState() {
-  _deploy.deployFn.mockReset();
-  _deploy.deploying = undefined;
-  _deploy.error = undefined;
-  _deploy.modal = null;
-}
-
-// ─── Tests ─────────────────────────────────────────────────────────────────────
-
-describe("EmptyState — loading", () => {
-  beforeEach(() => {
-    mockApiGet.mockReset().mockImplementation(
-      () => new Promise(() => {}) // never resolves
-    );
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.restoreAllMocks();
-  });
-
-  it("shows loading state while GET /templates is pending", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByTestId("spinner")).toBeTruthy();
-    expect(screen.getByText("Loading templates...")).toBeTruthy();
-  });
-
-  // "create blank" is rendered outside the loading/template-grid conditional,
-  // so it is always visible — adjust expectation accordingly.
-  it("renders 'create blank' button during loading", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByRole("button", { name: "+ Create blank workspace" })).toBeTruthy();
-  });
-
-  it("does not render template buttons while loading", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.queryByText("Claude Code Agent")).toBeNull();
-  });
-});
-
-describe("EmptyState — templates", () => {
-  beforeEach(() => {
-    mockApiGet.mockReset().mockResolvedValue([template()]);
-    resetDeployState();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.restoreAllMocks();
-  });
-
-  it("renders the welcome heading", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByText("Deploy your first agent")).toBeTruthy();
-  });
-
-  it("renders template buttons with name and description", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByText("Claude Code Agent")).toBeTruthy();
-    expect(screen.getByText("A general-purpose coding assistant")).toBeTruthy();
-  });
-
-  it("renders tier badge and skill count", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByText("T2")).toBeTruthy();
-    // skill_count renders as "3 skills · <model>"
-    expect(screen.getByText(/^3 skills/)).toBeTruthy();
-  });
-
-  it("renders model name when present", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByText(/claude-opus/i)).toBeTruthy();
-  });
-
-  it("calls deploy with the template on click", async () => {
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByText("Claude Code Agent"));
-    expect(_deploy.deployFn).toHaveBeenCalledWith(template());
-  });
-
-  it("shows 'Deploying...' on the button of the template being deployed", async () => {
-    _deploy.deploying = "tpl-1";
-    renderEmpty();
-    await flush();
-    expect(screen.getByText("Deploying...")).toBeTruthy();
-  });
-
-  it("disables the template button of the deploying template", async () => {
-    _deploy.deploying = "tpl-1";
-    renderEmpty();
-    await flush();
-    const btn = screen.getByText("Deploying...").closest("button") as HTMLButtonElement;
-    expect(btn.disabled).toBe(true);
-  });
-
-  it("disables 'create blank' while a template is deploying", async () => {
-    _deploy.deploying = "tpl-1";
-    renderEmpty();
-    await flush();
-    expect(screen.getByRole("button", { name: "+ Create blank workspace" }).disabled).toBe(true);
-  });
-});
-
-describe("EmptyState — fetch failure / empty templates", () => {
-  beforeEach(() => {
-    mockApiGet.mockReset().mockResolvedValue([]);
-    resetDeployState();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.restoreAllMocks();
-  });
-
-  it("does not render template grid when GET /templates returns []", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.queryByText("Claude Code Agent")).toBeNull();
-  });
-
-  it("renders 'create blank' button when templates list is empty", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.getByRole("button", { name: "+ Create blank workspace" })).toBeTruthy();
-  });
-
-  it("does not render template grid when GET /templates rejects", async () => {
-    mockApiGet.mockReset().mockRejectedValue(new Error("Network failure"));
-    renderEmpty();
-    await flush();
-    expect(screen.queryByText("Claude Code Agent")).toBeNull();
-  });
-});
-
-describe("EmptyState — create blank", () => {
-  beforeEach(() => {
-    mockApiGet.mockReset().mockResolvedValue([template()]);
-    mockApiPost.mockReset().mockResolvedValue({ id: "ws-new" });
-    resetDeployState();
-    vi.useFakeTimers();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
-  });
-
-  it("calls POST /workspaces on 'create blank' click", async () => {
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); });
-    expect(mockApiPost).toHaveBeenCalledWith(
-      "/workspaces",
-      expect.objectContaining({ name: "My First Agent" })
-    );
-  });
-
-  it("shows 'Creating...' while blank workspace POST is pending", async () => {
-    mockApiPost.mockReset().mockImplementation(
-      () => new Promise(() => {}) // never resolves
-    );
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); });
-    expect(screen.getByRole("button", { name: "Creating..." })).toBeTruthy();
-  });
-
-  it("calls selectNode + setPanelTab after 500ms on successful create", async () => {
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); }); // flush POST
-    await act(async () => { vi.advanceTimersByTime(500); });
-    expect(mockSelectNode).toHaveBeenCalledWith("ws-new");
-    expect(mockSetPanelTab).toHaveBeenCalledWith("chat");
-  });
-
-  it("disables template buttons while creating blank workspace", async () => {
-    mockApiPost.mockReset().mockImplementation(
-      () => new Promise(() => {}) // never resolves
-    );
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); });
-    expect((screen.getByText("Claude Code Agent").closest("button") as HTMLButtonElement).disabled).toBe(true);
-  });
-
-  it("shows error banner when POST /workspaces fails", async () => {
-    mockApiPost.mockReset().mockRejectedValue(new Error("Server error"));
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); });
-    expect(screen.getByRole("alert")).toBeTruthy();
-    expect(screen.getByText(/server error/i)).toBeTruthy();
-  });
-
-  it("clears 'Creating...' and shows button again after POST failure", async () => {
-    mockApiPost.mockReset().mockRejectedValue(new Error("Server error"));
-    renderEmpty();
-    await flush();
-    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
-    await act(async () => { await Promise.resolve(); });
-    // After rejection, blankCreating = false → button reverts to default label
-    expect(screen.getByRole("button", { name: "+ Create blank workspace" })).toBeTruthy();
-  });
-});
-
-describe("EmptyState — error banner", () => {
-  beforeEach(() => {
-    mockApiGet.mockReset().mockResolvedValue([template()]);
-    resetDeployState();
-    vi.useFakeTimers();
-  });
-
-  afterEach(() => {
-    cleanup();
-    vi.useRealTimers();
-    vi.restoreAllMocks();
-  });
-
-  it("has role=alert on the error banner", async () => {
-    _deploy.error = "Template deploy failed";
-    renderEmpty();
-    await flush();
-    const alert = screen.getByRole("alert");
-    expect(alert).toBeTruthy();
-    expect(alert.textContent).toContain("Template deploy failed");
-  });
-
-  it("does not show error banner when no errors", async () => {
-    renderEmpty();
-    await flush();
-    expect(screen.queryByRole("alert")).toBeNull();
-  });
-});

canvas/src/components/mobile/__tests__/palette-context.test.tsx

@@ -1,131 +0,0 @@
-// @vitest-environment jsdom
-/**
- * palette-context: MobileAccentProvider + usePalette hook coverage.
- *
- * Covers:
- *   - usePalette(dark=false) without provider → MOL_LIGHT
- *   - usePalette(dark=true)  without provider → MOL_DARK
- *   - usePalette with provider accent=null        → base palette unchanged
- *   - usePalette with provider accent=base.accent → base palette unchanged (identity guard)
- *   - usePalette with provider accent="#ff0000"  → accent + online overridden
- *   - MobileAccentProvider renders children
- *   - Never mutates the static MOL_LIGHT/MOL_DARK singletons
- *
- * The pure functions (getPalette, normalizeStatus, tierCode) are covered
- * in palette.test.ts — only the React context/hook is tested here.
- */
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, render } from "@testing-library/react";
-import React from "react";
-
-import { MobileAccentProvider, usePalette } from "../palette-context";
-import { MOL_DARK, MOL_LIGHT } from "../palette";
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-});
-
-// ─── Test helpers ──────────────────────────────────────────────────────────────
-// Each helper renders exactly one usePalette value as a testid element.
-// Using unique testids per scenario avoids "multiple elements" DOM pollution
-// when tests run in the same jsdom worker without strict cleanup timing.
-
-function AccentDump({ dark }: { dark: boolean }) {
-  const palette = usePalette(dark);
-  return <span data-testid="accent-val">{palette.accent}</span>;
-}
-
-function OnlineDump({ dark }: { dark: boolean }) {
-  const palette = usePalette(dark);
-  return <span data-testid="online-val">{palette.online}</span>;
-}
-
-// ─── MobileAccentProvider ──────────────────────────────────────────────────────
-describe("MobileAccentProvider", () => {
-  it("renders children", () => {
-    const { getByText } = render(
-      <MobileAccentProvider accent={null}>
-        <span>child content</span>
-      </MobileAccentProvider>,
-    );
-    expect(getByText("child content").textContent).toBe("child content");
-  });
-});
-
-// ─── usePalette — no provider ─────────────────────────────────────────────────
-describe("usePalette without MobileAccentProvider", () => {
-  it("returns MOL_LIGHT when dark=false", () => {
-    const { getByTestId } = render(<AccentDump dark={false} />);
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("returns MOL_DARK when dark=true", () => {
-    const { getByTestId } = render(<AccentDump dark={true} />);
-    expect(getByTestId("accent-val").textContent).toBe(MOL_DARK.accent);
-  });
-});
-
-// ─── usePalette — with MobileAccentProvider ────────────────────────────────────
-describe("usePalette with MobileAccentProvider", () => {
-  it("returns base palette unchanged when accent=null", () => {
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={null}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("returns base palette unchanged when accent matches base.accent (identity guard)", () => {
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={MOL_LIGHT.accent}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("overrides accent when provider supplies a different colour", () => {
-    const CUSTOM = "#ff0000";
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={CUSTOM}>
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("accent-val").textContent).toBe(CUSTOM);
-  });
-
-  it("also overrides online when accent is overridden", () => {
-    const CUSTOM = "#ff8800";
-    const { getByTestId } = render(
-      <MobileAccentProvider accent={CUSTOM}>
-        <OnlineDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(getByTestId("online-val").textContent).toBe(CUSTOM);
-  });
-});
-
-// ─── Immutability ─────────────────────────────────────────────────────────────
-describe("MOL_LIGHT and MOL_DARK singletons are never mutated", () => {
-  it("MOL_LIGHT.accent unchanged after custom-accent render", () => {
-    const before = MOL_LIGHT.accent;
-    render(
-      <MobileAccentProvider accent="#deadbeef">
-        <AccentDump dark={false} />
-      </MobileAccentProvider>,
-    );
-    expect(MOL_LIGHT.accent).toBe(before);
-  });
-
-  it("MOL_DARK.accent unchanged after custom-accent render", () => {
-    const before = MOL_DARK.accent;
-    render(
-      <MobileAccentProvider accent="#bada55ff">
-        <AccentDump dark={true} />
-      </MobileAccentProvider>,
-    );
-    expect(MOL_DARK.accent).toBe(before);
-  });
-});

canvas/src/components/tabs/config/__tests__/form-inputs.test.tsx

@@ -1,451 +0,0 @@
-// @vitest-environment jsdom
-/**
- * form-inputs — pure presentational form primitives for the Config tab.
- *
- * NOTE: No @testing-library/jest-dom import — use textContent / className /
- * getAttribute / checked / value checks to avoid "expect is not defined"
- * errors in this vitest configuration.
- *
- * Covers:
- *   - TextInput renders label and input with correct value
- *   - TextInput calls onChange with new value on keystroke
- *   - TextInput renders placeholder text when provided
- *   - TextInput applies mono class when mono=true
- *   - TextInput input has accessible aria-label from label
- *   - TextInput input is not mono by default
- *   - NumberInput renders label and number input
- *   - NumberInput calls onChange with parsed integer on keystroke
- *   - NumberInput calls onChange with 0 for non-numeric input
- *   - NumberInput respects min/max bounds
- *   - NumberInput input has aria-label from label prop
- *   - NumberInput input has font-mono class
- *   - Toggle renders checkbox with label text
- *   - Toggle renders checked/unchecked state correctly
- *   - Toggle calls onChange with boolean on toggle
- *   - TagList renders existing tags with remove buttons
- *   - TagList × button has aria-label "Remove tag {value}"
- *   - TagList calls onChange without removed tag on × click
- *   - TagList renders the label text
- *   - TagList renders placeholder text when provided
- *   - TagList renders exactly one textbox
- *   - TagList adds tag on Enter key
- *   - TagList does not add empty/whitespace-only tags on Enter
- *   - TagList clears input after adding tag
- *   - Section renders the title
- *   - Section renders children when open (defaultOpen=true)
- *   - Section starts closed when defaultOpen=false
- *   - Section opens/closes content on title click
- *   - Section button has aria-expanded reflecting open state
- *   - Section toggle indicator changes on open/close
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { cleanup, fireEvent, render, screen } from "@testing-library/react";
-import React from "react";
-
-import {
-  TextInput,
-  NumberInput,
-  Toggle,
-  TagList,
-  Section,
-} from "../form-inputs";
-
-afterEach(() => {
-  cleanup();
-  vi.restoreAllMocks();
-  vi.resetModules();
-});
-
-// ─── TextInput ───────────────────────────────────────────────────────────────
-
-describe("TextInput", () => {
-  it("renders the label text", () => {
-    const { container } = render(
-      <TextInput label="Agent Name" value="" onChange={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("Agent Name");
-  });
-
-  it("renders the input with the given value", () => {
-    render(<TextInput label="Model" value="claude-opus-4" onChange={vi.fn()} />);
-    const input = document.querySelector("input") as HTMLInputElement;
-    expect(input.value).toBe("claude-opus-4");
-  });
-
-  it("calls onChange with new value on keystroke", () => {
-    const onChange = vi.fn();
-    render(<TextInput label="Name" value="hello" onChange={onChange} />);
-    const input = document.querySelector("input") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "hello world" } });
-    expect(onChange).toHaveBeenCalledWith("hello world");
-  });
-
-  it("renders placeholder text when provided", () => {
-    render(
-      <TextInput
-        label="Token"
-        value=""
-        onChange={vi.fn()}
-        placeholder="sk-..."
-      />,
-    );
-    const input = document.querySelector("input") as HTMLInputElement;
-    expect(input.getAttribute("placeholder")).toBe("sk-...");
-  });
-
-  it("applies mono class when mono=true", () => {
-    const { container } = render(
-      <TextInput label="Model" value="" onChange={vi.fn()} mono />,
-    );
-    const input = container.querySelector("input") as HTMLInputElement;
-    expect(input.className).toContain("font-mono");
-  });
-
-  it("input has aria-label matching the label", () => {
-    render(<TextInput label="API Key" value="" onChange={vi.fn()} />);
-    const input = document.querySelector("input") as HTMLInputElement;
-    expect(input.getAttribute("aria-label")).toBe("API Key");
-  });
-
-  it("input is not mono by default", () => {
-    const { container } = render(
-      <TextInput label="Description" value="" onChange={vi.fn()} />,
-    );
-    const input = container.querySelector("input") as HTMLInputElement;
-    expect(input.className).not.toContain("font-mono");
-  });
-});
-
-// ─── NumberInput ─────────────────────────────────────────────────────────────
-
-describe("NumberInput", () => {
-  it("renders the label text", () => {
-    const { container } = render(
-      <NumberInput label="Timeout (s)" value={30} onChange={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("Timeout (s)");
-  });
-
-  it("renders the input with the given numeric value", () => {
-    render(<NumberInput label="Retries" value={3} onChange={vi.fn()} />);
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    expect(input.value).toBe("3");
-  });
-
-  it("calls onChange with parsed integer on keystroke", () => {
-    const onChange = vi.fn();
-    render(<NumberInput label="Delay" value={1} onChange={onChange} />);
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "7" } });
-    expect(onChange).toHaveBeenCalledWith(7);
-  });
-
-  it("calls onChange with 0 for non-numeric input", () => {
-    const onChange = vi.fn();
-    render(<NumberInput label="Count" value={5} onChange={onChange} />);
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "abc" } });
-    expect(onChange).toHaveBeenCalledWith(0);
-  });
-
-  it("respects min attribute", () => {
-    render(
-      <NumberInput
-        label="Port"
-        value={8000}
-        onChange={vi.fn()}
-        min={1024}
-      />,
-    );
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    expect(input.getAttribute("min")).toBe("1024");
-  });
-
-  it("respects max attribute", () => {
-    render(
-      <NumberInput
-        label="Memory (MB)"
-        value={256}
-        onChange={vi.fn()}
-        max={65535}
-      />,
-    );
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    expect(input.getAttribute("max")).toBe("65535");
-  });
-
-  it("input has aria-label from label prop", () => {
-    render(<NumberInput label="Timeout" value={60} onChange={vi.fn()} />);
-    const input = document.querySelector("input[type=number]") as HTMLInputElement;
-    expect(input.getAttribute("aria-label")).toBe("Timeout");
-  });
-
-  it("input has font-mono class", () => {
-    const { container } = render(
-      <NumberInput label="Budget" value={100} onChange={vi.fn()} />,
-    );
-    const input = container.querySelector("input") as HTMLInputElement;
-    expect(input.className).toContain("font-mono");
-  });
-});
-
-// ─── Toggle ──────────────────────────────────────────────────────────────────
-
-describe("Toggle", () => {
-  it("renders the checkbox with label text", () => {
-    const { container } = render(
-      <Toggle label="Enable streaming" checked={false} onChange={vi.fn()} />,
-    );
-    const checkbox = container.querySelector(
-      "input[type=checkbox]",
-    ) as HTMLInputElement;
-    expect(checkbox.checked).toBe(false);
-    expect(
-      checkbox.closest("label")?.textContent,
-    ).toContain("Enable streaming");
-  });
-
-  it("renders checked state correctly", () => {
-    const { container } = render(
-      <Toggle label="Push notifications" checked onChange={vi.fn()} />,
-    );
-    const checkbox = container.querySelector(
-      "input[type=checkbox]",
-    ) as HTMLInputElement;
-    expect(checkbox.checked).toBe(true);
-  });
-
-  it("calls onChange with true when toggled on", () => {
-    const onChange = vi.fn();
-    const { container } = render(
-      <Toggle label="Escalate" checked={false} onChange={onChange} />,
-    );
-    const checkbox = container.querySelector(
-      "input[type=checkbox]",
-    ) as HTMLInputElement;
-    checkbox.click();
-    expect(onChange).toHaveBeenCalledWith(true);
-  });
-
-  it("calls onChange with false when toggled off", () => {
-    const onChange = vi.fn();
-    const { container } = render(
-      <Toggle label="Escalate" checked onChange={onChange} />,
-    );
-    const checkbox = container.querySelector(
-      "input[type=checkbox]",
-    ) as HTMLInputElement;
-    checkbox.click();
-    expect(onChange).toHaveBeenCalledWith(false);
-  });
-
-  it("checkbox is a native input element", () => {
-    const { container } = render(
-      <Toggle label="Feature flag" checked={false} onChange={vi.fn()} />,
-    );
-    expect(container.querySelector("input[type=checkbox]")).toBeTruthy();
-  });
-});
-
-// ─── TagList ────────────────────────────────────────────────────────────────
-
-describe("TagList", () => {
-  it("renders existing tags", () => {
-    const { container } = render(
-      <TagList label="Tools" values={["file_read", "bash"]} onChange={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("file_read");
-    expect(container.textContent).toContain("bash");
-  });
-
-  it("renders × remove button for each tag with aria-label", () => {
-    render(
-      <TagList
-        label="Skills"
-        values={["python", "golang"]}
-        onChange={vi.fn()}
-      />,
-    );
-    const buttons = document.querySelectorAll("button");
-    // buttons[0] = first × (python), buttons[1] = second × (golang)
-    expect(buttons[0].getAttribute("aria-label")).toBe(
-      "Remove tag python",
-    );
-    expect(buttons[1].getAttribute("aria-label")).toBe(
-      "Remove tag golang",
-    );
-  });
-
-  it("calls onChange without removed tag when × is clicked", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList
-        label="Tags"
-        values={["react", "vue", "angular"]}
-        onChange={onChange}
-      />,
-    );
-    const buttons = document.querySelectorAll("button");
-    // buttons[0] = react ×, buttons[1] = vue ×, buttons[2] = angular ×
-    buttons[0].click(); // Remove react
-    expect(onChange).toHaveBeenCalledWith(["vue", "angular"]);
-  });
-
-  it("renders the label text", () => {
-    const { container } = render(
-      <TagList label="Required env vars" values={[]} onChange={vi.fn()} />,
-    );
-    expect(container.textContent).toContain("Required env vars");
-  });
-
-  it("renders placeholder text when provided", () => {
-    render(
-      <TagList
-        label="Tags"
-        values={[]}
-        onChange={vi.fn()}
-        placeholder="Add a tag..."
-      />,
-    );
-    const input = document.querySelector("input[type=text]") as HTMLInputElement;
-    expect(input.getAttribute("placeholder")).toBe("Add a tag...");
-  });
-
-  it("renders exactly one textbox (the input)", () => {
-    const { container } = render(
-      <TagList
-        label="Tools"
-        values={["read", "write"]}
-        onChange={vi.fn()}
-      />,
-    );
-    expect(
-      container.querySelectorAll("input[type=text]"),
-    ).toHaveLength(1);
-  });
-
-  it("adds tag on Enter key", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Skills" values={["python"]} onChange={onChange} />,
-    );
-    const input = document.querySelector("input[type=text]") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "rust" } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).toHaveBeenCalledWith(["python", "rust"]);
-  });
-
-  it("does not add empty tag on Enter", () => {
-    const onChange = vi.fn();
-    render(
-      <TagList label="Tools" values={[]} onChange={onChange} />,
-    );
-    const input = document.querySelector("input[type=text]") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "   " } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(onChange).not.toHaveBeenCalled();
-  });
-
-  it("clears input after adding tag", () => {
-    render(
-      <TagList label="Tags" values={[]} onChange={vi.fn()} />,
-    );
-    const input = document.querySelector("input[type=text]") as HTMLInputElement;
-    fireEvent.change(input, { target: { value: "golang" } });
-    fireEvent.keyDown(input, { key: "Enter" });
-    expect(input.value).toBe("");
-  });
-});
-
-// ─── Section ───────────────────────────────────────────────────────────────
-
-describe("Section", () => {
-  it("renders the title", () => {
-    const { container } = render(
-      <Section title="Runtime config">Content here</Section>,
-    );
-    expect(container.textContent).toContain("Runtime config");
-  });
-
-  it("renders children when open (defaultOpen=true)", () => {
-    const { container } = render(
-      <Section title="A section">Hidden content</Section>,
-    );
-    expect(container.textContent).toContain("Hidden content");
-  });
-
-  it("starts closed when defaultOpen=false", () => {
-    const { container } = render(
-      <Section title="Collapsed" defaultOpen={false}>
-        Should not be visible
-      </Section>,
-    );
-    expect(container.textContent).not.toContain("Should not be visible");
-  });
-
-  it("opens/closes content on title click", () => {
-    const { container } = render(
-      <Section title="Toggle me" defaultOpen={false}>
-        Now you see me
-      </Section>,
-    );
-    // Should be closed initially
-    expect(container.textContent).not.toContain("Now you see me");
-    // Click to open
-    const btn = container.querySelector("button") as HTMLButtonElement;
-    fireEvent.click(btn);
-    expect(container.textContent).toContain("Now you see me");
-    // Click to close
-    fireEvent.click(btn);
-    expect(container.textContent).not.toContain("Now you see me");
-  });
-
-  it("title button has aria-expanded reflecting open state", () => {
-    // Open section
-    const { container: openContainer } = render(
-      <Section title="A section" defaultOpen={true}>
-        Open content
-      </Section>,
-    );
-    const openBtn = openContainer.querySelector(
-      "button",
-    ) as HTMLButtonElement;
-    expect(openBtn.getAttribute("aria-expanded")).toBe("true");
-
-    // Closed section
-    const { container: closedContainer } = render(
-      <Section title="B section" defaultOpen={false}>
-        Closed content
-      </Section>,
-    );
-    const closedBtn = closedContainer.querySelector(
-      "button",
-    ) as HTMLButtonElement;
-    expect(closedBtn.getAttribute("aria-expanded")).toBe("false");
-  });
-
-  it("toggle indicator changes between ▾ (open) and ▸ (closed)", () => {
-    // Open: uses ▾
-    const { container: openContainer } = render(
-      <Section title="Indicator" defaultOpen={true}>
-        Open
-      </Section>,
-    );
-    // Button has two spans: title (first) and indicator (second, aria-hidden)
-    const openSpans = openContainer
-      .querySelectorAll("button span");
-    const openIndicator = openSpans[1]?.textContent?.trim();
-    expect(openIndicator).toBe("▾");
-
-    // Closed: uses ▸
-    const { container: closedContainer } = render(
-      <Section title="Indicator" defaultOpen={false}>
-        Closed
-      </Section>,
-    );
-    const closedSpans = closedContainer
-      .querySelectorAll("button span");
-    const closedIndicator = closedSpans[1]?.textContent?.trim();
-    expect(closedIndicator).toBe("▸");
-  });
-});

canvas/src/components/tabs/config/form-inputs.tsx

@@ -127,21 +127,13 @@ export function TagList({ label, values, onChange, placeholder }: { label: strin
 
 export function Section({ title, children, defaultOpen = true }: { title: string; children: React.ReactNode; defaultOpen?: boolean }) {
   const [open, setOpen] = useState(defaultOpen);
-  // Stable id for aria-controls linkage
-  const id = `section-content-${title.toLowerCase().replace(/\s+/g, "-")}`;
   return (
     <div className="border border-line rounded mb-2">
-      <button
-        type="button"
-        onClick={() => setOpen(!open)}
-        aria-expanded={open}
-        aria-controls={id}
-        className="w-full flex items-center justify-between px-3 py-1.5 text-[10px] text-ink-mid hover:text-ink bg-surface-sunken/50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
-      >
+      <button type="button" onClick={() => setOpen(!open)} className="w-full flex items-center justify-between px-3 py-1.5 text-[10px] text-ink-mid hover:text-ink bg-surface-sunken/50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1">
         <span className="font-medium uppercase tracking-wider">{title}</span>
-        <span aria-hidden="true">{open ? "▾" : "▸"}</span>
+        <span>{open ? "▾" : "▸"}</span>
       </button>
-      {open && <div id={id} className="p-3 space-y-3">{children}</div>}
+      {open && <div className="p-3 space-y-3">{children}</div>}
     </div>
   );
 }

canvas/src/components/ui/__tests__/StatusBadge.test.tsx

@@ -1,88 +0,0 @@
-// @vitest-environment jsdom
-/**
- * StatusBadge — secret key connection status indicator.
- *
- * Per spec §4: always icon + color (never colour-only) for colour-blind users.
- * Covers: verified / invalid / unverified render branches, icon, aria-label, className.
- */
-import { afterEach, describe, expect, it } from "vitest";
-import { render } from "@testing-library/react";
-import React from "react";
-
-import { StatusBadge } from "../StatusBadge";
-
-afterEach(() => {
-  // Prevent DOM accumulation across tests (maxWorkers=1 means all test
-  // files share the same jsdom worker).
-  const { cleanup } = require("@testing-library/react");
-  cleanup();
-});
-
-function getBadge(status: "verified" | "invalid" | "unverified") {
-  const { container } = render(<StatusBadge status={status} />);
-  return container.querySelector("[role=status]") as HTMLElement;
-}
-
-describe("StatusBadge — icon", () => {
-  it("renders ✓ for verified", () => {
-    expect(getBadge("verified").textContent).toBe("✓");
-  });
-
-  it("renders ✗ for invalid", () => {
-    expect(getBadge("invalid").textContent).toBe("✗");
-  });
-
-  it("renders ○ for unverified", () => {
-    expect(getBadge("unverified").textContent).toBe("○");
-  });
-});
-
-describe("StatusBadge — aria-label", () => {
-  it("sets 'Connection status: verified' for verified", () => {
-    expect(getBadge("verified").getAttribute("aria-label")).toBe(
-      "Connection status: verified",
-    );
-  });
-
-  it("sets 'Connection status: invalid' for invalid", () => {
-    expect(getBadge("invalid").getAttribute("aria-label")).toBe(
-      "Connection status: invalid",
-    );
-  });
-
-  it("sets 'Connection status: unverified' for unverified", () => {
-    expect(getBadge("unverified").getAttribute("aria-label")).toBe(
-      "Connection status: unverified",
-    );
-  });
-});
-
-describe("StatusBadge — className", () => {
-  it("applies status-badge--valid for verified", () => {
-    expect(getBadge("verified").className).toContain("status-badge--valid");
-  });
-
-  it("applies status-badge--invalid for invalid", () => {
-    expect(getBadge("invalid").className).toContain("status-badge--invalid");
-  });
-
-  it("applies status-badge--unverified for unverified", () => {
-    expect(getBadge("unverified").className).toContain(
-      "status-badge--unverified",
-    );
-  });
-});
-
-describe("StatusBadge — role", () => {
-  it("sets role=status", () => {
-    const el = getBadge("verified");
-    expect(el.getAttribute("role")).toBe("status");
-  });
-});
-
-describe("StatusBadge — structural", () => {
-  it("renders exactly one status element", () => {
-    const { container } = render(<StatusBadge status="verified" />);
-    expect(container.querySelectorAll("[role=status]").length).toBe(1);
-  });
-});

scripts/clone-manifest.sh

@@ -34,17 +34,6 @@ WS_DIR="${2:?Missing workspace-templates dir}"
 ORG_DIR="${3:?Missing org-templates dir}"
 PLUGINS_DIR="${4:?Missing plugins dir}"
 
-# Strip JSON5-style // comments from manifest.json before parsing.
-# The automated Integration Tester appends a trailing comment
-# (// Triggered by ... ) which is valid JSON5 but not standard JSON.
-# jq's default parser rejects it. This sed removes only full-line comments
-# (lines starting with optional whitespace followed by //) before jq reads the file.
-_strip_comments() {
-    # Remove full-line // comments (whitespace-safe); pass-through for non-comment lines
-    sed 's/^[[:space:]]*\/\/.*//' "$MANIFEST"
-}
-MANIFEST_JSON="$(_strip_comments)"
-
 EXPECTED=0
 CLONED=0
 
@@ -99,15 +88,15 @@ clone_category() {
     mkdir -p "$target_dir"
 
     local count
-    count=$(echo "$MANIFEST_JSON" | jq -r ".${category} | length")
+    count=$(jq -r ".${category} | length" "$MANIFEST")
     EXPECTED=$((EXPECTED + count))
 
     local i=0
     while [ "$i" -lt "$count" ]; do
         local name repo ref
-        name=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].name")
-        repo=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].repo")
-        ref=$(echo "$MANIFEST_JSON" | jq -r ".${category}[$i].ref // \"main\"")
+        name=$(jq -r ".${category}[$i].name" "$MANIFEST")
+        repo=$(jq -r ".${category}[$i].repo" "$MANIFEST")
+        ref=$(jq -r ".${category}[$i].ref // \"main\"" "$MANIFEST")
 
         # Idempotent: skip if the target already looks populated. Lets the
         # README quickstart rerun setup.sh safely without having to delete

workspace-server/internal/handlers/org.go

@@ -697,31 +697,6 @@ func (h *OrgHandler) Import(c *gin.Context) {
 			})
 			return
 		}
-
-		// Per-workspace RequiredEnv preflight: checks that every RequiredEnv
-		// declared at the workspace level is covered by either (a) a global
-		// secret key (already validated above) or (b) a key present in the
-		// workspace's on-disk .env files (org root .env + per-workspace
-		// <files_dir>/.env). If neither covers the key the workspace is
-		// imported NOT CONFIGURED, which silently breaks the workspace at
-		// start time — the container boots without the required credential
-		// and every LLM call 401s or fails silently.  Issue #232.
-		// orgBaseDir is empty when importing via body.Template (inline YAML);
-		// in that case we cannot check .env files, so we skip this check
-		// and fall back to the global-only gate above (which correctly
-		// rejects any strict requirement not covered by global_secrets).
-		if orgBaseDir != "" {
-			wsMissing := collectPerWorkspaceUnsatisfied(tmpl.Workspaces, orgBaseDir, configured)
-			if len(wsMissing) > 0 {
-				c.JSON(http.StatusPreconditionFailed, gin.H{
-					"error":            "missing per-workspace required environment variables",
-					"missing_workspace_env": wsMissing,
-					"template":         tmpl.Name,
-					"suggestion":       "add these keys to the workspace's .env file or set them as global secrets before importing",
-				})
-				return
-			}
-		}
 	}
 
 	results := []map[string]interface{}{}

workspace-server/internal/handlers/org_external.go

@@ -346,7 +346,7 @@ func (g *gitFetcher) Fetch(ctx context.Context, rootDir, host, repoPath, ref str
 	// MkdirTemp creates the dir; git clone refuses to clone into a
 	// non-empty dir. Remove + recreate empty.
 	os.RemoveAll(tmpDir)
-	cloneAndConfig := gitArgs("clone", "--quiet", "--depth=1", "-b", ref, cloneURL, tmpDir)
+	cloneAndConfig := append(gitArgs("clone", "--quiet", "--depth=1", "-b", ref, cloneURL, tmpDir))
 	cmd := exec.CommandContext(ctx, "git", cloneAndConfig...)
 	cmd.Env = append(os.Environ(), "GIT_TERMINAL_PROMPT=0")
 	if out, err := cmd.CombinedOutput(); err != nil {

workspace-server/internal/handlers/org_import.go

@@ -941,65 +941,6 @@ func flattenAndSortRequirements(by map[string]EnvRequirement) []EnvRequirement {
 // can investigate.
 const globalSecretsPreflightLimit = 10000
 
-// PerWorkspaceUnsatisfied describes one per-workspace RequiredEnv that is
-// not covered by either a global secret or a key present in the
-// corresponding .env file.
-type PerWorkspaceUnsatisfied struct {
-	Workspace   string         `json:"workspace"`
-	FilesDir    string         `json:"files_dir,omitempty"`
-	Unsatisfied EnvRequirement `json:"unsatisfied_env"`
-}
-
-// collectPerWorkspaceUnsatisfied recursively walks workspaces and returns
-// per-workspace RequiredEnv entries that are not covered by (a) a global
-// secret key or (b) a key present in the workspace's .env file(s) (org root
-// .env + per-workspace <files_dir>/.env). This complements
-// collectOrgEnv + loadConfiguredGlobalSecretKeys, which together only
-// validate global-level RequiredEnv against global_secrets. The .env
-// lookup mirrors the runtime resolution in createWorkspaceTree so that
-// the preflight result matches what the container actually receives at
-// start time.
-func collectPerWorkspaceUnsatisfied(workspaces []OrgWorkspace, orgBaseDir string, globalSecrets map[string]struct{}) []PerWorkspaceUnsatisfied {
-	var out []PerWorkspaceUnsatisfied
-	var walk func([]OrgWorkspace)
-	walk = func(wsList []OrgWorkspace) {
-		for _, ws := range wsList {
-			// Build the set of keys available to this workspace from .env.
-			// This is the same three-source stack that createWorkspaceTree
-			// injects into the container:
-			//   1. Org root .env (parseEnvFile, no filesDir)
-			//   2. Workspace <files_dir>/.env (if filesDir is set)
-			//   3. Persona bootstrap env (MOLECULE_PERSONA_ROOT/<filesDir>/env)
-			// Items 1+2 are on-disk and testable; item 3 is host-only and
-			// skipped here (persona env does NOT satisfy required_env —
-			// it carries identity tokens, not workspace LLM keys).
-			envFromFiles := loadWorkspaceEnv(orgBaseDir, ws.FilesDir)
-			// Convert map[string]string (from .env files) to map[string]struct{}
-			// to match IsSatisfied's signature.
-			envSet := make(map[string]struct{}, len(envFromFiles))
-			for k := range envFromFiles {
-				envSet[k] = struct{}{}
-			}
-			for _, req := range ws.RequiredEnv {
-				if req.IsSatisfied(globalSecrets) {
-					continue // covered by a global secret
-				}
-				if req.IsSatisfied(envSet) {
-					continue // covered by a per-workspace .env file
-				}
-				out = append(out, PerWorkspaceUnsatisfied{
-					Workspace:   ws.Name,
-					FilesDir:    ws.FilesDir,
-					Unsatisfied: req,
-				})
-			}
-			walk(ws.Children)
-		}
-	}
-	walk(workspaces)
-	return out
-}
-
 func loadConfiguredGlobalSecretKeys(ctx context.Context) (map[string]struct{}, error) {
 	rows, err := db.DB.QueryContext(ctx,
 		`SELECT key FROM global_secrets WHERE octet_length(encrypted_value) > 0 LIMIT $1`,

workspace-server/internal/handlers/org_workspace_required_env_test.go

@@ -1,226 +0,0 @@
-package handlers
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// TestCollectPerWorkspaceUnsatisfied_BothFiles covers the case where a key
-// is present in both the org root .env and the workspace-specific .env. Both
-// should satisfy the requirement (no entry in output).
-func TestCollectPerWorkspaceUnsatisfied_BothFiles(t *testing.T) {
-	tmp := t.TempDir()
-	writeEnvFile(t, tmp, ".env", "PER_WS_KEY=globalvalue")
-	writeEnvFile(t, tmp, "ws-a/.env", "PER_WS_KEY=wsvalue")
-
-	workspaces := []OrgWorkspace{
-		{Name: "ws-a", FilesDir: "ws-a", RequiredEnv: []EnvRequirement{{Name: "PER_WS_KEY"}}},
-	}
-
-	// Global secret covers it.
-	globals := map[string]struct{}{"PER_WS_KEY": {}}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 0 {
-		t.Errorf("PER_WS_KEY present in global + .env: should be satisfied, got %d missing", len(missing))
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_WorkspaceEnvOnly covers a key present
-// only in the workspace-specific .env file (not global). Should be satisfied.
-func TestCollectPerWorkspaceUnsatisfied_WorkspaceEnvOnly(t *testing.T) {
-	tmp := t.TempDir()
-	writeEnvFile(t, tmp, "dev-lead/.env", "WORKSPACE_KEY=val")
-
-	workspaces := []OrgWorkspace{
-		{Name: "Dev Lead", FilesDir: "dev-lead", RequiredEnv: []EnvRequirement{{Name: "WORKSPACE_KEY"}}},
-	}
-
-	globals := map[string]struct{}{} // nothing in global
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 0 {
-		t.Errorf("WORKSPACE_KEY in ws .env only: should be satisfied, got %d missing", len(missing))
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_OrgRootEnvOnly covers a key present
-// only in the org root .env file (not per-workspace). Should be satisfied.
-func TestCollectPerWorkspaceUnsatisfied_OrgRootEnvOnly(t *testing.T) {
-	tmp := t.TempDir()
-	writeEnvFile(t, tmp, ".env", "ORG_ROOT_KEY=val")
-
-	workspaces := []OrgWorkspace{
-		{Name: "ws-b", FilesDir: "ws-b", RequiredEnv: []EnvRequirement{{Name: "ORG_ROOT_KEY"}}},
-	}
-
-	globals := map[string]struct{}{}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 0 {
-		t.Errorf("ORG_ROOT_KEY in org root .env only: should be satisfied, got %d missing", len(missing))
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_GlobalCovers checks that a global
-// secret alone satisfies a per-workspace RequiredEnv even when the .env
-// files don't have the key.
-func TestCollectPerWorkspaceUnsatisfied_GlobalCovers(t *testing.T) {
-	tmp := t.TempDir()
-	// No .env files at all.
-
-	workspaces := []OrgWorkspace{
-		{Name: "ws-c", RequiredEnv: []EnvRequirement{{Name: "GLOBAL_COVERED"}}},
-	}
-
-	globals := map[string]struct{}{"GLOBAL_COVERED": {}}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 0 {
-		t.Errorf("GLOBAL_COVERED satisfied by global: should be satisfied, got %d missing", len(missing))
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_Missing covers the core bug: a
-// RequiredEnv declared at the workspace level where the key is absent from
-// both global_secrets and the .env file. The import MUST return 412.
-func TestCollectPerWorkspaceUnsatisfied_Missing(t *testing.T) {
-	tmp := t.TempDir()
-	// No .env files at all.
-
-	workspaces := []OrgWorkspace{
-		{Name: "Dev Lead", FilesDir: "dev-lead", RequiredEnv: []EnvRequirement{{Name: "MISSING_REQUIRED_KEY"}}},
-	}
-
-	globals := map[string]struct{}{} // no global secret
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 1 {
-		t.Fatalf("expected 1 missing entry, got %d", len(missing))
-	}
-	if missing[0].Workspace != "Dev Lead" {
-		t.Errorf("expected workspace 'Dev Lead', got %q", missing[0].Workspace)
-	}
-	if missing[0].Unsatisfied.Name != "MISSING_REQUIRED_KEY" {
-		t.Errorf("expected unsatisfied key 'MISSING_REQUIRED_KEY', got %q", missing[0].Unsatisfied.Name)
-	}
-	if missing[0].FilesDir != "dev-lead" {
-		t.Errorf("expected files_dir 'dev-lead', got %q", missing[0].FilesDir)
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_AnyOfGroup covers an any-of group where
-// none of the alternatives are present in global or .env. Should report
-// the group as unsatisfied.
-func TestCollectPerWorkspaceUnsatisfied_AnyOfGroup(t *testing.T) {
-	tmp := t.TempDir()
-
-	workspaces := []OrgWorkspace{
-		{
-			Name:     "Claude Bot",
-			FilesDir: "claude-bot",
-			RequiredEnv: []EnvRequirement{
-				{AnyOf: []string{"ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"}},
-			},
-		},
-	}
-
-	globals := map[string]struct{}{}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 1 {
-		t.Fatalf("expected 1 missing any-of entry, got %d", len(missing))
-	}
-	if missing[0].Workspace != "Claude Bot" {
-		t.Errorf("expected workspace 'Claude Bot', got %q", missing[0].Workspace)
-	}
-	if len(missing[0].Unsatisfied.AnyOf) != 2 {
-		t.Errorf("expected any-of group with 2 members, got %v", missing[0].Unsatisfied.AnyOf)
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_NestedChildren covers grandchildren
-// workspaces that also declare RequiredEnv. The recursive walk must visit
-// children and grandchildren.
-func TestCollectPerWorkspaceUnsatisfied_NestedChildren(t *testing.T) {
-	tmp := t.TempDir()
-
-	workspaces := []OrgWorkspace{
-		{
-			Name: "Root",
-			Children: []OrgWorkspace{
-				{
-					Name: "Child",
-					Children: []OrgWorkspace{
-						{Name: "Grandchild", FilesDir: "grandchild", RequiredEnv: []EnvRequirement{{Name: "DEEP_KEY"}}},
-					},
-				},
-			},
-		},
-	}
-
-	globals := map[string]struct{}{}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 1 {
-		t.Fatalf("expected 1 missing entry from grandchild, got %d", len(missing))
-	}
-	if missing[0].Workspace != "Grandchild" {
-		t.Errorf("expected 'Grandchild', got %q", missing[0].Workspace)
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_EmptyOrgBaseDir covers the case where
-// orgBaseDir is empty (inline template import). No .env files can be
-// checked, so missing keys cannot be attributed to .env absence. The
-// function should NOT crash and should only report entries satisfiable
-// by global (all missing since globals is empty).
-func TestCollectPerWorkspaceUnsatisfied_EmptyOrgBaseDir(t *testing.T) {
-	workspaces := []OrgWorkspace{
-		{Name: "ws-x", RequiredEnv: []EnvRequirement{{Name: "KEY_X"}}},
-	}
-
-	globals := map[string]struct{}{}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, "", globals)
-
-	// With no orgBaseDir and no global, KEY_X must be reported missing.
-	if len(missing) != 1 {
-		t.Errorf("expected 1 missing with empty orgBaseDir, got %d", len(missing))
-	}
-}
-
-// TestCollectPerWorkspaceUnsatisfied_MultipleWorkspaces reports only the
-// workspace whose RequiredEnv is unsatisfied, not the whole batch.
-func TestCollectPerWorkspaceUnsatisfied_MultipleWorkspaces(t *testing.T) {
-	tmp := t.TempDir()
-	writeEnvFile(t, tmp, "ws-ok/.env", "OK_KEY=val")
-
-	workspaces := []OrgWorkspace{
-		{Name: "ws-ok", FilesDir: "ws-ok", RequiredEnv: []EnvRequirement{{Name: "OK_KEY"}}},
-		{Name: "ws-missing", FilesDir: "ws-missing", RequiredEnv: []EnvRequirement{{Name: "BAD_KEY"}}},
-	}
-
-	globals := map[string]struct{}{}
-	missing := collectPerWorkspaceUnsatisfied(workspaces, tmp, globals)
-
-	if len(missing) != 1 {
-		t.Errorf("expected exactly 1 missing (BAD_KEY), got %d", len(missing))
-	}
-	if missing[0].Workspace != "ws-missing" {
-		t.Errorf("expected missing workspace 'ws-missing', got %q", missing[0].Workspace)
-	}
-}
-
-// writeEnvFile is a test helper that creates a .env file at the given path
-// with the given content.
-func writeEnvFile(t *testing.T, baseDir, relPath, content string) {
-	t.Helper()
-	fullPath := filepath.Join(baseDir, relPath)
-	if err := os.MkdirAll(filepath.Dir(fullPath), 0755); err != nil {
-		t.Fatalf("mkdirAll: %v", err)
-	}
-	if err := os.WriteFile(fullPath, []byte(content), 0644); err != nil {
-		t.Fatalf("writeFile %s: %v", fullPath, err)
-	}
-}

workspace-server/internal/pendinguploads/export_test.go

@@ -12,8 +12,8 @@ import (
 // time. The Go convention `export_test.go` keeps this seam OUT of the
 // production binary — files ending in _test.go are stripped at build
 // time, so this re-export only exists during `go test`.
-func StartSweeperWithIntervalForTest(ctx context.Context, storage Storage, ackRetention, interval time.Duration, done chan struct{}) {
-	startSweeperWithInterval(ctx, storage, ackRetention, interval, done)
+func StartSweeperWithIntervalForTest(ctx context.Context, storage Storage, ackRetention, interval time.Duration) {
+	startSweeperWithInterval(ctx, storage, ackRetention, interval, nil)
 }
 
 // StartSweeperForTest starts the sweeper and returns a done channel

workspace-server/internal/pendinguploads/sweeper_test.go

@@ -190,14 +190,7 @@ func TestStartSweeperWithInterval_TickerFiresAdditionalCycles(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	// Use a short ticker interval (100ms) so the test runs fast without
-	// burning real wall-clock time. StartSweeperWithIntervalForTest is the
-	// test-friendly variant that accepts a caller-specified interval; the
-	// production SweepInterval of 5m is too coarse for a 2s deadline on
-	// a loaded CI runner (the ticker may not fire at all under CPU
-	// contention — the root cause of the pre-existing CI flake).
-	done := make(chan struct{})
-	go pendinguploads.StartSweeperWithIntervalForTest(ctx, store, time.Hour, 100*time.Millisecond, done)
+	done := pendinguploads.StartSweeperForTest(ctx, store, time.Hour)
 	// Immediate cycle + at least one tick-driven cycle.
 	store.waitForCycle(t, 2, 2*time.Second)