pikasTech-HWLAB/internal/cloud/server-agent-chat.test.ts

import assert from "node:assert/strict";
import { createServer as createHttpServer } from "node:http";
import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { test } from "bun:test";

import { createCloudApiServer } from "./server.ts";
import { validateCodeAgentChatSchema } from "./code-agent-chat.ts";
import { createCodexStdioSessionManager } from "./codex-stdio-session.ts";
import { createCodeAgentTraceStore } from "./code-agent-trace-store.ts";
import {
  codexStdioChatFixture,
  codexStdioReadyFixture,
  createFakeAppServerClient,
  createFakeCodexCommand,
  delay,
  pollAgentResult,
  postAgent,
  postAgentRaw,
  prepareFakeCodexHome
} from "./server-test-helpers.ts";

test("cloud api /v1/agent/chat parse and params errors use structured blocker envelope", async () => {
  const server = createCloudApiServer({
    env: {
      HWLAB_CODE_AGENT_MODEL: "gpt-test"
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const parse = await postAgentRaw(port, "{", { "x-trace-id": "trc_parse_error" });
    assert.equal(parse.status, 400);
    assert.equal(parse.body.status, "failed");
    assert.equal(parse.body.error.code, "parse_error");
    assert.equal(parse.body.error.layer, "api");
    assert.equal(parse.body.error.retryable, true);
    assert.equal(parse.body.error.traceId, "trc_parse_error");
    assert.equal(parse.body.error.route, "/v1/agent/chat");
    assert.match(parse.body.error.userMessage, /JSON/u);
    assert.equal(Object.hasOwn(parse.body, "reply"), false);
    assert.equal(JSON.stringify(parse.body).includes("sk-"), false);

    const invalid = await postAgentRaw(port, JSON.stringify([]), { "x-trace-id": "trc_invalid_params" });
    assert.equal(invalid.status, 400);
    assert.equal(invalid.body.error.code, "invalid_params");
    assert.equal(invalid.body.error.layer, "api");
    assert.equal(invalid.body.error.retryable, true);
    assert.equal(invalid.body.error.blocker.code, "invalid_params");
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat supports short submit and result polling", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-short-"));
  const codexHome = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-short-codex-home-"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_CODEX_SANDBOX: "danger-full-access",
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      OPENAI_API_KEY: "test-openai-key-material",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    codexStdioManager: {
      describe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access"
        };
      },
      async probe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access"
        };
      },
      async chat(params = {}) {
        return {
          ...codexStdioChatFixture({ workspace, codexHome, params }),
          sandbox: "danger-full-access",
          session: {
            ...codexStdioChatFixture({ workspace, codexHome, params }).session,
            sandbox: "danger-full-access"
          }
        };
      },
      cancel() {},
      reapIdle() {}
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const traceId = "trc_server-test-short-submit";
    const submit = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-trace-id": traceId,
        "prefer": "respond-async",
        "x-hwlab-short-connection": "1"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-short-submit",
        message: "用pwd列出你当前的工作目录"
      })
    });
    assert.equal(submit.status, 202);
    const accepted = await submit.json();
    assert.equal(accepted.accepted, true);
    assert.equal(accepted.shortConnection, true);
    assert.equal(accepted.traceId, traceId);
    assert.equal(accepted.resultUrl, `/v1/agent/chat/result/${traceId}`);

    const payload = await pollAgentResult(port, traceId);
    validateCodeAgentChatSchema(payload);
    assert.equal(payload.status, "completed");
    assert.equal(payload.traceId, traceId);
    assert.equal(payload.sandbox, "danger-full-access");
    assert.match(payload.reply.content, new RegExp(workspace.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")));
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(codexHome, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat delegates v0.2 turns to AgentRun v0.1 over adapter", async () => {
  const calls = [];
  const agentRunServer = createHttpServer(async (request, response) => {
    const url = new URL(request.url || "/", "http://127.0.0.1");
    const chunks = [];
    for await (const chunk of request) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
    const body = chunks.length ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : null;
    calls.push({ method: request.method, path: url.pathname, search: url.search, body });
    const send = (data) => {
      response.writeHead(200, { "content-type": "application/json" });
      response.end(`${JSON.stringify({ ok: true, data, traceId: "trc_fake_agentrun" })}\n`);
    };
    if (request.method === "POST" && url.pathname === "/api/v1/runs") {
      assert.equal(body.tenantId, "hwlab");
      assert.equal(body.backendProfile, "deepseek");
      assert.equal(body.resourceBundleRef.repoUrl, "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git");
      assert.equal(body.resourceBundleRef.commitId, "0123456789abcdef0123456789abcdef01234567");
      return send({ id: "run_hwlab_adapter", status: "pending", backendProfile: "deepseek", sessionRef: body.sessionRef, resourceBundleRef: body.resourceBundleRef });
    }
    if (request.method === "POST" && url.pathname === "/api/v1/runs/run_hwlab_adapter/commands") {
      assert.equal(body.type, "turn");
      assert.match(body.payload.prompt, /AgentRun adapter/u);
      return send({ id: "cmd_hwlab_adapter", runId: "run_hwlab_adapter", state: "pending", type: "turn", seq: 1 });
    }
    if (request.method === "POST" && url.pathname === "/api/v1/runs/run_hwlab_adapter/runner-jobs") {
      assert.equal(body.commandId, "cmd_hwlab_adapter");
      return send({
        action: "create-kubernetes-job",
        runId: "run_hwlab_adapter",
        commandId: "cmd_hwlab_adapter",
        attemptId: "attempt_hwlab_adapter",
        runnerId: "runner_hwlab_adapter",
        namespace: "agentrun-v01",
        jobName: "agentrun-v01-runner-hwlab-adapter",
        jobIdentity: { namespace: "agentrun-v01", name: "agentrun-v01-runner-hwlab-adapter" },
        runner: { attemptId: "attempt_hwlab_adapter", runnerId: "runner_hwlab_adapter" }
      });
    }
    if (request.method === "GET" && url.pathname === "/api/v1/runs/run_hwlab_adapter/events") {
      return send({ items: [
        { id: "evt_1", runId: "run_hwlab_adapter", seq: 1, type: "backend_status", payload: { phase: "runner-job-created", commandId: "cmd_hwlab_adapter", attemptId: "attempt_hwlab_adapter", jobName: "agentrun-v01-runner-hwlab-adapter", namespace: "agentrun-v01" }, createdAt: "2026-06-01T00:00:00.000Z" },
        { id: "evt_2", runId: "run_hwlab_adapter", seq: 2, type: "assistant_message", payload: { text: "AgentRun adapter 已接管 HWLAB Code Agent。" }, createdAt: "2026-06-01T00:00:01.000Z" },
        { id: "evt_3", runId: "run_hwlab_adapter", seq: 3, type: "terminal_status", payload: { terminalStatus: "completed" }, createdAt: "2026-06-01T00:00:02.000Z" }
      ] });
    }
    if (request.method === "GET" && url.pathname === "/api/v1/runs/run_hwlab_adapter/commands/cmd_hwlab_adapter/result") {
      return send({
        runId: "run_hwlab_adapter",
        commandId: "cmd_hwlab_adapter",
        attemptId: "attempt_hwlab_adapter",
        runnerId: "runner_hwlab_adapter",
        jobName: "agentrun-v01-runner-hwlab-adapter",
        namespace: "agentrun-v01",
        status: "completed",
        runStatus: "completed",
        commandState: "completed",
        terminalStatus: "completed",
        completed: true,
        reply: "AgentRun adapter 已接管 HWLAB Code Agent。",
        lastSeq: 3,
        eventCount: 3
      });
    }
    response.writeHead(404, { "content-type": "application/json" });
    response.end(`${JSON.stringify({ ok: false, failureKind: "schema-invalid", message: `unexpected ${request.method} ${url.pathname}`, traceId: "trc_fake_agentrun" })}\n`);
  });
  await new Promise((resolve) => agentRunServer.listen(0, "127.0.0.1", resolve));

  const agentRunPort = agentRunServer.address().port;
  const traceStore = createCodeAgentTraceStore();
  const server = createCloudApiServer({
    traceStore,
    env: {
      HWLAB_CODE_AGENT_ADAPTER: "agentrun-v01",
      AGENTRUN_MGR_URL: `http://127.0.0.1:${agentRunPort}`,
      HWLAB_CODE_AGENT_AGENTRUN_ALLOW_NON_K3S_URL: "1",
      HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
      HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
      HWLAB_CODE_AGENT_DEEPSEEK_MODEL: "deepseek-chat"
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const traceId = "trc_server-test-agentrun-adapter";
    const submit = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: { "content-type": "application/json", "x-trace-id": traceId },
      body: JSON.stringify({ conversationId: "cnv_server-test-agentrun", message: "AgentRun adapter smoke" })
    });
    assert.equal(submit.status, 202);
    const accepted = await submit.json();
    assert.equal(accepted.shortConnection, true);

    const payload = await pollAgentResult(port, traceId);
    validateCodeAgentChatSchema(payload);
    assert.equal(payload.status, "completed");
    assert.equal(payload.provider, "agentrun-v01");
    assert.equal(payload.backend, "agentrun-v01/deepseek");
    assert.equal(payload.agentRun.runId, "run_hwlab_adapter");
    assert.equal(payload.agentRun.commandId, "cmd_hwlab_adapter");
    assert.equal(payload.agentRun.jobName, "agentrun-v01-runner-hwlab-adapter");
    assert.match(payload.reply.content, /AgentRun adapter/u);
    assert.ok(payload.runnerTrace.events.some((event) => event.label === "agentrun:backend:runner-job-created"));
    assert.ok(calls.some((call) => call.path === "/api/v1/runs/run_hwlab_adapter/runner-jobs"));

    const trace = await fetch(`http://127.0.0.1:${port}/v1/agent/chat/trace/${traceId}`);
    assert.equal(trace.status, 200);
    const traceBody = await trace.json();
    assert.ok(traceBody.events.some((event) => event.runId === "run_hwlab_adapter"));
    assert.ok(traceBody.events.some((event) => event.label === "agentrun:assistant:message"));
  } finally {
    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
    await new Promise((resolve, reject) => agentRunServer.close((error) => (error ? reject(error) : resolve())));
  }
});

test("cloud api AgentRun adapter rejects non-internal manager URLs by default", async () => {
  const server = createCloudApiServer({
    env: {
      HWLAB_CODE_AGENT_ADAPTER: "agentrun-v01",
      AGENTRUN_MGR_URL: "http://74.48.78.17:8080"
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: { "content-type": "application/json", "x-trace-id": "trc_server-test-agentrun-public-url" },
      body: JSON.stringify({ conversationId: "cnv_server-test-agentrun-public-url", message: "must reject public manager url" })
    });
    assert.equal(response.status, 500);
    const body = await response.json();
    assert.equal(body.error.code, "internal_error");
    assert.match(body.error.reason, /internal k3s Service DNS/u);
  } finally {
    await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
  }
});

test("cloud api /v1/agent/chat records authenticated owner on agent session", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-owner-"));
  const codexHome = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-owner-codex-home-"));
  const ownerRecords = [];
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_CODEX_SANDBOX: "danger-full-access",
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      OPENAI_API_KEY: "test-openai-key-material",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    accessController: {
      required: true,
      async authenticate() {
        return { ok: true, actor: { id: "usr_agent_owner", username: "agent-owner", displayName: "Agent Owner", role: "user", status: "active" } };
      },
      async recordAgentSessionOwner(input) {
        ownerRecords.push(input);
        return input;
      }
    },
    codexStdioManager: {
      describe() { return { ...codexStdioReadyFixture({ workspace, codexHome }), sandbox: "danger-full-access" }; },
      async probe() { return { ...codexStdioReadyFixture({ workspace, codexHome }), sandbox: "danger-full-access" }; },
      async chat(params = {}) {
        return {
          ...codexStdioChatFixture({ workspace, codexHome, params }),
          sandbox: "danger-full-access"
        };
      },
      cancel() {},
      reapIdle() {}
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const payload = await postAgent(port, {
      conversationId: "cnv_server-test-owner",
      traceId: "trc_server-test-owner",
      message: "owner binding smoke"
    });
    validateCodeAgentChatSchema(payload);
    assert.equal(payload.ownerUserId, "usr_agent_owner");
    assert.equal(ownerRecords.length, 1);
    assert.equal(ownerRecords[0].ownerUserId, "usr_agent_owner");
    assert.equal(ownerRecords[0].sessionId, "ses_server_stdio_pwd");
    assert.equal(ownerRecords[0].conversationId, "cnv_server-test-owner");
    assert.equal(ownerRecords[0].traceId, "trc_server-test-owner");
    assert.equal(ownerRecords[0].session.valuesRedacted, true);
    assert.equal(JSON.stringify(ownerRecords).includes("test-openai-key-material"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(codexHome, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat/inspect maps conversation session and thread details to trace evidence", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-inspect-"));
  const codexHome = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-inspect-codex-home-"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_CODEX_SANDBOX: "danger-full-access",
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      OPENAI_API_KEY: "test-openai-key-material",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    codexStdioManager: {
      describe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access",
          recentSessions: [{
            sessionId: "ses_server_stdio_pwd",
            conversationId: "cnv_server-test-inspect",
            threadId: "019e6c72-2373-75e3-9856-eff286db7163",
            status: "idle",
            currentTraceId: null,
            lastTraceId: "trc_server-test-inspect",
            workspace,
            sandbox: "danger-full-access",
            secretMaterialStored: false,
            valuesRedacted: true
          }]
        };
      },
      async probe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access"
        };
      },
      async chat(params = {}) {
        const base = codexStdioChatFixture({ workspace, codexHome, params });
        return {
          ...base,
          sandbox: "danger-full-access",
          session: {
            ...base.session,
            threadId: "019e6c72-2373-75e3-9856-eff286db7163",
            sandbox: "danger-full-access"
          },
          sessionReuse: {
            ...base.sessionReuse,
            threadId: "019e6c72-2373-75e3-9856-eff286db7163"
          }
        };
      },
      get(sessionId) {
        if (sessionId !== "ses_server_stdio_pwd") return null;
        return {
          sessionId,
          conversationId: "cnv_server-test-inspect",
          threadId: "019e6c72-2373-75e3-9856-eff286db7163",
          status: "idle",
          lastTraceId: "trc_server-test-inspect",
          workspace,
          sandbox: "danger-full-access",
          secretMaterialStored: false,
          valuesRedacted: true
        };
      },
      cancel() {},
      reapIdle() {}
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const traceId = "trc_server-test-inspect";
    const submit = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-trace-id": traceId,
        "prefer": "respond-async",
        "x-hwlab-short-connection": "1"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-inspect",
        message: "inspect mapping smoke"
      })
    });
    assert.equal(submit.status, 202);
    const payload = await pollAgentResult(port, traceId);
    assert.equal(payload.status, "completed");

    const inspect = await fetch(`http://127.0.0.1:${port}/v1/agent/chat/inspect?conversationId=cnv_server-test-inspect&sessionId=ses_server_stdio_pwd&threadId=019e6c72-2373-75e3-9856-eff286db7163`);
    assert.equal(inspect.status, 200);
    const body = await inspect.json();
    assert.equal(body.ok, true);
    assert.equal(body.status, "found");
    assert.equal(body.latestTraceId, traceId);
    assert.equal(body.traceUrl, `/v1/agent/chat/trace/${traceId}`);
    assert.equal(body.resultUrl, `/v1/agent/chat/result/${traceId}`);
    assert.equal(body.query.threadId, "019e6c72-2373-75e3-9856-eff286db7163");
    assert.equal(body.session.sessionId, "ses_server_stdio_pwd");
    assert.equal(body.conversationFacts.conversationId, "cnv_server-test-inspect");
    assert.equal(body.runnerTrace.traceId, traceId);
    assert.equal(body.valuesRedacted, true);
    assert.equal(body.secretMaterialStored, false);
    assert.equal(JSON.stringify(body).includes("test-openai-key-material"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(codexHome, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat/inspect returns not_found for empty conversation facts", async () => {
  const server = createCloudApiServer();
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat/inspect?conversationId=cnv_server-test-inspect-missing&sessionId=ses_server_test_missing&threadId=019e6c72-2373-75e3-9856-eff286db7163&traceId=trc_server_test_missing`);
    assert.equal(response.status, 404);
    const body = await response.json();
    assert.equal(body.ok, false);
    assert.equal(body.status, "not_found");
    assert.equal(body.latestTraceId, null);
    assert.deepEqual(body.traceIds, []);
    assert.equal(body.traceUrl, null);
    assert.equal(body.resultUrl, null);
    assert.equal(body.conversationFacts.turnCount, 0);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api result polling compacts large runnerTrace while preserving providerTrace", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-result-compact-"));
  const codexHome = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-result-compact-codex-home-"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_CODEX_SANDBOX: "danger-full-access",
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      HWLAB_CODE_AGENT_RESULT_TRACE_EVENT_LIMIT: "32",
      OPENAI_API_KEY: "test-openai-key-material",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    codexStdioManager: {
      describe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access"
        };
      },
      async probe() {
        return {
          ...codexStdioReadyFixture({ workspace, codexHome }),
          sandbox: "danger-full-access"
        };
      },
      async chat(params = {}) {
        const base = codexStdioChatFixture({ workspace, codexHome, params });
        const events = Array.from({ length: 160 }, (_, index) => ({
          seq: index + 1,
          traceId: params.traceId,
          type: "assistant_message",
          status: "chunk",
          label: index === 159 ? "assistant:completed" : "assistant:chunk",
          createdAt: "2026-05-23T00:00:00.000Z",
          waitingFor: index === 159 ? null : "turn/completed",
          valuesPrinted: false
        }));
        return {
          ...base,
          sandbox: "danger-full-access",
          session: {
            ...base.session,
            sandbox: "danger-full-access"
          },
          runnerTrace: {
            ...base.runnerTrace,
            events,
            eventLabels: events.map((event) => event.label),
            eventCount: events.length,
            lastEvent: events.at(-1)
          }
        };
      },
      cancel() {},
      reapIdle() {}
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const traceId = "trc_server-test-result-compact";
    const submit = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-trace-id": traceId,
        "prefer": "respond-async",
        "x-hwlab-short-connection": "1"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-result-compact",
        message: "生成大量 trace 后返回"
      })
    });
    assert.equal(submit.status, 202);

    const payload = await pollAgentResult(port, traceId);
    validateCodeAgentChatSchema(payload);
    assert.equal(payload.status, "completed");
    assert.equal(payload.traceId, traceId);
    assert.equal(payload.providerTrace.protocol, "codex-app-server-jsonrpc-stdio");
    assert.equal(payload.providerTrace.command, "codex app-server --listen stdio://");
    assert.equal(payload.runnerTrace.eventCount, 160);
    assert.equal(payload.runnerTrace.eventsCompacted, true);
    assert.equal(payload.runnerTrace.events.length, 32);
    assert.equal(payload.runnerTrace.events.some((event) => event.label === "trace:compacted"), true);
    assert.equal(payload.runnerTrace.lastEvent.label, "assistant:completed");
    assert.equal(payload.runnerTrace.eventLabels.includes("trace:compacted"), true);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(codexHome, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat answers skills prompt through real Codex stdio and retains trace", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-stdio-skills-"));
  const codexHome = path.join(workspace, "codex-home");
  const skillsDir = path.join(workspace, "skills");
  const fakeCodex = await createFakeCodexCommand();
  await mkdir(path.join(skillsDir, "hwlab-test-skill"), { recursive: true });
  await prepareFakeCodexHome(codexHome);
  await writeFile(path.join(skillsDir, "hwlab-test-skill", "SKILL.md"), [
    "---",
    "name: hwlab-test-skill",
    "description: Test skill mounted for Codex stdio discovery.",
    "version: v-test",
    "---",
    "",
    "# HWLAB Test Skill"
  ].join("\n"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      OPENAI_API_KEY: "test-openai-key-material",
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      HWLAB_CODE_AGENT_CODEX_COMMAND: fakeCodex.command,
      HWLAB_CODE_AGENT_CODEX_STDIO_ENABLED: "1",
      HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR: "repo-owned",
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_SKILLS_DIRS: skillsDir,
      HWLAB_CODE_AGENT_SKILLS_STRICT: "1",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    codexStdioManager: createCodexStdioSessionManager({
      idFactory: () => "ses_server_stdio_skills",
      createRpcClient: async () => createFakeAppServerClient({
        text: "模型泛化回答不应成为 skills 最终回复。"
      })
    })
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const payload = await postAgent(port, {
      conversationId: "cnv_server_stdio_skills",
      traceId: "trc_server_stdio_skills",
      message: "列出你可用的skills"
    });

    validateCodeAgentChatSchema(payload);
    assert.equal(payload.status, "completed");
    assert.equal(payload.provider, "codex-stdio");
    assert.equal(payload.backend, "hwlab-cloud-api/codex-app-server-stdio");
    assert.equal(payload.capabilityLevel, "long-lived-codex-stdio-session");
    assert.equal(payload.providerTrace.sidecarOnly, undefined);
    assert.equal(payload.providerTrace.toolName, "codex-app-server.thread/start+turn/start");
    assert.equal(payload.skills.status, "ready");
    const discovered = payload.skills.items.find((skill) => skill.name === "hwlab-test-skill");
    assert.ok(discovered);
    assert.equal(discovered.source, path.join(skillsDir, "hwlab-test-skill", "SKILL.md"));
    assert.equal(discovered.manifest.path, path.join(skillsDir, "hwlab-test-skill", "SKILL.md"));
    assert.equal(discovered.version, "v-test");
    assert.ok(payload.toolCalls.some((toolCall) => toolCall.name === "skills.discover" && toolCall.status === "completed"));
    assert.match(payload.reply.content, /hwlab-test-skill/u);
    assert.match(payload.reply.content, /真实 skill manifest 清单/u);
    assert.doesNotMatch(payload.reply.content, /模型泛化回答/u);
    assert.ok(payload.runnerTrace.events.some((event) => event.label === "prompt:sent"));
    assert.ok(payload.runnerTrace.events.some((event) => event.label === "tool:codex-app-server.thread/start+turn/start:started"));
    assert.equal(JSON.stringify(payload).includes("test-openai-key-material"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(fakeCodex.root, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat returns structured skills blocker without local skills manifest", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-stdio-skills-missing-"));
  const codexHome = path.join(workspace, "codex-home");
  const fakeCodex = await createFakeCodexCommand();
  await prepareFakeCodexHome(codexHome);
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      OPENAI_API_KEY: "test-openai-key-material",
      CODEX_HOME: codexHome,
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio",
      HWLAB_CODE_AGENT_MODEL: "gpt-test",
      HWLAB_CODE_AGENT_CODEX_COMMAND: fakeCodex.command,
      HWLAB_CODE_AGENT_CODEX_STDIO_ENABLED: "1",
      HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR: "repo-owned",
      HWLAB_CODE_AGENT_CODEX_WORKSPACE: workspace,
      HWLAB_CODE_AGENT_SKILLS_DIRS: path.join(workspace, "missing-skills"),
      HWLAB_CODE_AGENT_SKILLS_STRICT: "1",
      HWLAB_CODE_AGENT_OPENAI_BASE_URL: "http://127.0.0.1:65535/v1/responses"
    },
    codexStdioManager: createCodexStdioSessionManager({
      idFactory: () => "ses_server_stdio_skills_missing",
      createRpcClient: async () => createFakeAppServerClient({
        text: "模型泛化回答：alpha-skill"
      })
    })
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const payload = await postAgent(port, {
      conversationId: "cnv_server_stdio_skills_missing",
      traceId: "trc_server_stdio_skills_missing",
      message: "列出你可用的skills"
    });

    validateCodeAgentChatSchema(payload);
    assert.equal(payload.status, "failed");
    assert.equal(payload.provider, "codex-stdio");
    assert.equal(payload.backend, "hwlab-cloud-api/codex-app-server-stdio");
    assert.equal(payload.capabilityLevel, "blocked");
    assert.equal(payload.error.code, "skills_unavailable");
    assert.equal(payload.skills.status, "blocked");
    assert.equal(payload.skills.blockers[0].code, "skills_unavailable");
    assert.deepEqual(payload.skills.sourceIssues, ["pikasTech/HWLAB#136", "pikasTech/HWLAB#237"]);
    assert.ok(payload.toolCalls.some((toolCall) => toolCall.name === "skills.discover" && toolCall.status === "blocked"));
    assert.equal(payload.toolCalls.some((toolCall) => toolCall.name === "codex-app-server.thread/start+turn/start"), false);
    assert.equal(payload.session.status, "idle");
    assert.equal(Object.hasOwn(payload, "reply"), false);
    assert.equal(JSON.stringify(payload).includes("alpha-skill"), false);
    assert.equal(JSON.stringify(payload).includes("test-openai-key-material"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
    await rm(workspace, { recursive: true, force: true });
    await rm(fakeCodex.root, { recursive: true, force: true });
  }
});

test("cloud api /v1/agent/chat blocks forbidden file paths without leaking values", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-file-block-"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      HWLAB_CODE_AGENT_WORKSPACE: workspace
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const payload = await postAgent(port, {
      conversationId: "cnv_server-test-security-block",
      traceId: "trc_server-test-security-block",
      message: "cat ../outside.txt"
    });
    assert.equal(payload.status, "failed");
    assert.match(payload.error.code, /^(codex_cli_binary_missing|stdio_protocol_not_wired)$/u);
    assert.deepEqual(payload.toolCalls, []);
    assert.equal(payload.capabilityLevel, "blocked");
    assert.ok(payload.runnerTrace.events.some((event) => event.label === "codex-stdio:blocked"));
    assert.equal(Object.hasOwn(payload, "reply"), false);
    assert.equal(JSON.stringify(payload).includes("sk-"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat/cancel reports unsupported lifecycle degradation", async () => {
  const traceStore = createCodeAgentTraceStore();
  traceStore.append("trc_cancel_unsupported", {
    type: "request",
    status: "running",
    label: "request:running",
    sessionId: "ses_cancel_unsupported",
    sessionStatus: "busy",
    sessionLifecycleStatus: "busy"
  });
  const server = createCloudApiServer({
    traceStore,
    codexStdioManager: {
      get() {
        return null;
      }
    },
    env: {
      PATH: process.env.PATH,
      HWLAB_CODE_AGENT_PROVIDER: "codex-stdio"
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat/cancel`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-trace-id": "trc_cancel_unsupported"
      },
      body: JSON.stringify({
        conversationId: "cnv_cancel_unsupported",
        sessionId: "ses_cancel_unsupported",
        traceId: "trc_cancel_unsupported"
      })
    });
    assert.equal(response.status, 501);
    const payload = await response.json();
    assert.equal(payload.status, "degraded");
    assert.equal(payload.unsupported, true);
    assert.equal(payload.degraded, true);
    assert.equal(payload.error.code, "cancel_unsupported");
    assert.equal(payload.sessionLifecycleStatus, "failed");
    assert.equal(payload.sessionSummary.unsupported, true);
    assert.match(payload.sessionSummary.userMessage, /unsupported\/degraded/u);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat reports Codex stdio blocker instead of structured skills fallback", async () => {
  const root = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-no-skills-"));
  const skillsDir = path.join(root, "missing-skills");
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      HWLAB_CODE_AGENT_WORKSPACE: root
    },
    skillsDirs: [skillsDir],
    skillsDirsExact: true
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-skills-missing",
        message: "列出你可用的skills"
      })
    });
    assert.equal(response.status, 200);
    const payload = await response.json();
    assert.equal(payload.status, "failed");
    assert.equal(payload.provider, "codex-stdio");
    assert.notEqual(payload.error.code, "skills_unavailable");
    assert.equal(payload.capabilityLevel, "blocked");
    assert.equal(payload.skills.status, "not_requested");
    assert.deepEqual(payload.toolCalls, []);
    assert.ok(payload.runnerLimitations.includes("no-controlled-readonly-fallback"));
    assert.equal(Object.hasOwn(payload, "reply"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat does not run unsupported local grep fallback", async () => {
  const workspace = await mkdtemp(path.join(os.tmpdir(), "hwlab-agent-tool-blocked-"));
  const server = createCloudApiServer({
    env: {
      PATH: process.env.PATH,
      HWLAB_CODE_AGENT_WORKSPACE: workspace
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-tool-unavailable",
        message: "请用grep搜索 package.json"
      })
    });
    assert.equal(response.status, 200);
    const payload = await response.json();
    assert.equal(payload.status, "failed");
    assert.notEqual(payload.error.code, "tool_unavailable");
    assert.equal(payload.provider, "codex-stdio");
    assert.equal(payload.capabilityLevel, "blocked");
    assert.deepEqual(payload.toolCalls, []);
    assert.ok(payload.runnerLimitations.includes("no-controlled-readonly-fallback"));
    assert.equal(Object.hasOwn(payload, "reply"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat does not call delayed provider fallback beyond legacy 4500ms UI timeout", async () => {
  let providerCalled = false;
  const server = createCloudApiServer({
    callCodeAgentProvider: async ({ providerPlan, message, traceId }) => {
      providerCalled = true;
      await delay(4700);
      return {
        provider: providerPlan.provider,
        model: providerPlan.model,
        backend: providerPlan.backend,
        content: `延迟真实 provider stub: ${message} / ${traceId}`,
        usage: null,
        providerTrace: {
          source: "delayed-test-provider"
        }
      };
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const startedAt = Date.now();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-trace-id": "trc_server-test-agent-chat-delayed"
      },
      body: JSON.stringify({
        conversationId: "cnv_server-test-agent-chat-delayed",
        message: "请用一句话说明当前 HWLAB 工作台可以做什么，稍后回答"
      })
    });
    assert.equal(response.status, 200);
    const payload = await response.json();
    assert.equal(Date.now() - startedAt < 4500, true);
    assert.equal(payload.status, "failed");
    assert.equal(payload.conversationId, "cnv_server-test-agent-chat-delayed");
    assert.equal(payload.traceId, "trc_server-test-agent-chat-delayed");
    assert.equal(payload.provider, "codex-stdio");
    assert.equal(payload.capabilityLevel, "blocked");
    assert.equal(providerCalled, false);
    assert.equal(Object.hasOwn(payload, "reply"), false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});

test("cloud api /v1/agent/chat does not call OpenAI provider 502/503 fallback", async () => {
  for (const status of [502, 503]) {
    const providerServer = createHttpServer((request, response) => {
      request.resume();
      response.writeHead(status, { "content-type": "application/json" });
      response.end(JSON.stringify({
        error: {
          message: `upstream ${status}`
        }
      }));
    });
    await new Promise((resolve) => providerServer.listen(0, "127.0.0.1", resolve));
    const providerPort = providerServer.address().port;

    const server = createCloudApiServer({
      env: {
        OPENAI_API_KEY: "test-openai-key-material",
        HWLAB_CODE_AGENT_PROVIDER: "openai",
        HWLAB_CODE_AGENT_ALLOW_TEXT_FALLBACK: "true",
        HWLAB_CODE_AGENT_MODEL: "gpt-test",
        HWLAB_CODE_AGENT_OPENAI_BASE_URL: `http://127.0.0.1:${providerPort}/v1/responses`
      }
    });
    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

    try {
      const { port } = server.address();
      const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
        method: "POST",
        headers: {
          "content-type": "application/json",
          "x-trace-id": `trc_server-test-agent-chat-provider-${status}`
        },
        body: JSON.stringify({
          conversationId: `cnv_server-test-agent-chat-provider-${status}`,
          message: `provider ${status}`
        })
      });
      assert.equal(response.status, 200);
      const payload = await response.json();
      assert.equal(payload.status, "failed");
      assert.equal(payload.traceId, `trc_server-test-agent-chat-provider-${status}`);
      assert.match(payload.error.code, /^(codex_cli_binary_missing|stdio_protocol_not_wired)$/u);
      assert.match(payload.error.layer, /^(runner|api)$/u);
      assert.equal(typeof payload.error.retryable, "boolean");
      assert.equal(payload.error.blocker.traceId, `trc_server-test-agent-chat-provider-${status}`);
      assert.equal(typeof payload.error.blocker.retryable, "boolean");
      assert.equal(payload.error.blocker.capabilityLevel, "blocked");
      assert.equal(payload.provider, "codex-stdio");
      assert.equal(Object.hasOwn(payload, "reply"), false);
    } finally {
      await new Promise((resolve, reject) => {
        server.close((error) => (error ? reject(error) : resolve()));
      });
      await new Promise((resolve, reject) => {
        providerServer.close((error) => (error ? reject(error) : resolve()));
      });
    }
  }
});

test("cloud api /v1/agent/chat does not call empty provider text fallback", async () => {
  let providerCalled = false;
  const server = createCloudApiServer({
    callCodeAgentProvider: async () => {
      providerCalled = true;
      throw new Error("empty provider fallback must not be used");
    }
  });
  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));

  try {
    const { port } = server.address();
    const response = await fetch(`http://127.0.0.1:${port}/v1/agent/chat`, {
      method: "POST",
      headers: {
        "content-type": "application/json"
      },
      body: JSON.stringify({
        conversationId: "cnv_empty-provider-text",
        message: "你好"
      })
    });
    assert.equal(response.status, 200);
    const payload = await response.json();
    assert.equal(payload.conversationId, "cnv_empty-provider-text");
    assert.equal(payload.status, "failed");
    assert.match(payload.error.code, /^(codex_cli_binary_missing|stdio_protocol_not_wired)$/u);
    assert.equal(payload.provider, "codex-stdio");
    assert.equal(Object.hasOwn(payload, "reply"), false);
    assert.equal(providerCalled, false);
  } finally {
    await new Promise((resolve, reject) => {
      server.close((error) => (error ? reject(error) : resolve()));
    });
  }
});