claude-code/packages/remote-control-server/src/__tests__/routes.test.ts

import { describe, test, expect, beforeEach, mock } from "bun:test";

// Mock config
const mockConfig = {
  port: 3000,
  host: "0.0.0.0",
  apiKeys: ["test-api-key"],
  baseUrl: "http://localhost:3000",
  pollTimeout: 1,
  heartbeatInterval: 20,
  jwtExpiresIn: 3600,
  disconnectTimeout: 300,
  webCorsOrigins: [],
  wsIdleTimeout: 30,
  wsKeepaliveInterval: 20,
};

mock.module("../config", () => ({
  config: mockConfig,
  getBaseUrl: () => "http://localhost:3000",
}));

import { Hono } from "hono";
import { storeReset, storeCreateSession, storeCreateEnvironment, storeBindSession } from "../store";
import { removeEventBus, getAllEventBuses, getEventBus } from "../transport/event-bus";
import { issueToken } from "../auth/token";
import { publishSessionEvent } from "../services/transport";
import { encodeWebSocketAuthProtocol } from "../auth/middleware";

// Import route modules
import v1Sessions from "../routes/v1/sessions";
import v1Environments from "../routes/v1/environments";
import v1EnvironmentsWork from "../routes/v1/environments.work";
import v1SessionIngress, {
  decodeSessionIngressWsMessage,
  handleSessionIngressWsPayload,
  websocket as sessionIngressWebsocket,
} from "../routes/v1/session-ingress";
import {
  decodeAcpWsMessageData,
  hasAcpRelayAuth,
  handleAcpWsPayload,
} from "../routes/acp";
import acpRoutes from "../routes/acp";
import v2CodeSessions from "../routes/v2/code-sessions";
import v2Worker from "../routes/v2/worker";
import v2WorkerEventsStream from "../routes/v2/worker-events-stream";
import v2WorkerEvents from "../routes/v2/worker-events";
import webAuth from "../routes/web/auth";
import webSessions from "../routes/web/sessions";
import webControl from "../routes/web/control";
import webEnvironments from "../routes/web/environments";

function createApp() {
  const app = new Hono();
  app.route("/v1/sessions", v1Sessions);
  app.route("/v1/environments", v1Environments);
  app.route("/v1/environments", v1EnvironmentsWork);
  app.route("/v2/session_ingress", v1SessionIngress);
  app.route("/v1/code/sessions", v2CodeSessions);
  app.route("/v1/code/sessions", v2Worker);
  app.route("/v1/code/sessions", v2WorkerEventsStream);
  app.route("/v1/code/sessions", v2WorkerEvents);
  app.route("/web", webAuth);
  app.route("/web", webSessions);
  app.route("/web", webControl);
  app.route("/web", webEnvironments);
  app.route("/acp", acpRoutes);
  return app;
}

const AUTH_HEADERS = { Authorization: "Bearer test-api-key", "X-Username": "testuser" };

function toWebSessionId(sessionId: string): string {
  if (!sessionId.startsWith("cse_")) return sessionId;
  return `session_${sessionId.slice("cse_".length)}`;
}

describe("V1 Session Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    app = createApp();
  });

  test("POST /v1/sessions — creates a session", async () => {
    const res = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ title: "Test Session" }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.id).toMatch(/^session_/);
    expect(body.title).toBe("Test Session");
    expect(body.status).toBe("idle");
  });

  test("POST /v1/sessions — requires auth", async () => {
    const res = await app.request("/v1/sessions", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    expect(res.status).toBe(401);
  });

  test("GET /v1/sessions/:id — returns created session", async () => {
    const createRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const getRes = await app.request(`/v1/sessions/${id}`, {
      headers: AUTH_HEADERS,
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.json();
    expect(body.id).toBe(id);
  });

  test("GET /v1/sessions/:id — 404 for unknown session", async () => {
    const res = await app.request("/v1/sessions/nope", {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(404);
  });

  test("GET /v1/sessions/:id — resolves compat code session IDs", async () => {
    const createRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await createRes.json();

    const getRes = await app.request(`/v1/sessions/${toWebSessionId(id)}`, {
      headers: AUTH_HEADERS,
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.json();
    expect(body.id).toBe(id);
  });

  test("PATCH /v1/sessions/:id — updates title", async () => {
    const createRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const patchRes = await app.request(`/v1/sessions/${id}`, {
      method: "PATCH",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ title: "Updated Title" }),
    });
    expect(patchRes.status).toBe(200);
    const body = await patchRes.json();
    expect(body.title).toBe("Updated Title");
  });

  test("POST /v1/sessions/:id/archive — archives session", async () => {
    const createRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const archiveRes = await app.request(`/v1/sessions/${id}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(archiveRes.status).toBe(200);
  });

  test("POST /v1/sessions/:id/archive — archives compat code session IDs", async () => {
    const createRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await createRes.json();
    const compatId = toWebSessionId(id);

    const archiveRes = await app.request(`/v1/sessions/${compatId}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(archiveRes.status).toBe(200);

    const getRes = await app.request(`/v1/sessions/${compatId}`, {
      headers: AUTH_HEADERS,
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.json();
    expect(body.id).toBe(id);
    expect(body.status).toBe("archived");
  });

  test("POST /v1/sessions/:id/events — publishes events", async () => {
    const createRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const eventsRes = await app.request(`/v1/sessions/${id}/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "user", content: "hello" }] }),
    });
    expect(eventsRes.status).toBe(200);
    const body = await eventsRes.json();
    expect(body.events).toBe(1);
  });

  test("POST /v1/sessions/:id/events — resolves compat code session IDs", async () => {
    const createRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await createRes.json();
    const compatId = toWebSessionId(id);

    const eventsRes = await app.request(`/v1/sessions/${compatId}/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "user", content: "hello from compat" }] }),
    });
    expect(eventsRes.status).toBe(200);

    const events = getEventBus(id).getEventsSince(0);
    expect(events).toHaveLength(1);
    expect(events[0]?.type).toBe("user");
    expect((events[0]?.payload as { content?: string }).content).toBe("hello from compat");
  });

  test("POST /v1/sessions with environment_id creates work item", async () => {
    // First register an environment
    const envRes = await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ machine_name: "test" }),
    });
    const { environment_id } = await envRes.json();

    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ environment_id }),
    });
    expect(sessRes.status).toBe(200);
    const body = await sessRes.json();
    expect(body.environment_id).toBe(environment_id);
  });

  test("POST /v1/sessions with invalid environment_id — session created, work item fails silently", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ environment_id: "env_nonexistent" }),
    });
    expect(sessRes.status).toBe(200);
    const body = await sessRes.json();
    expect(body.id).toMatch(/^session_/);
  });

  test("POST /v1/sessions with events — publishes initial events", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "init", data: "starting" }] }),
    });
    expect(sessRes.status).toBe(200);
  });
});

describe("V1 Environment Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    app = createApp();
  });

  test("POST /v1/environments/bridge — registers environment", async () => {
    const res = await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ machine_name: "mac1", directory: "/home" }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.environment_id).toMatch(/^env_/);
    expect(body.status).toBe("active");
  });

  test("DELETE /v1/environments/bridge/:id — deregisters environment", async () => {
    const envRes = await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { environment_id } = await envRes.json();

    const delRes = await app.request(`/v1/environments/bridge/${environment_id}`, {
      method: "DELETE",
      headers: AUTH_HEADERS,
    });
    expect(delRes.status).toBe(200);
  });

  test("POST /v1/environments/:id/bridge/reconnect — reconnects environment", async () => {
    const envRes = await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { environment_id } = await envRes.json();

    const reconnectRes = await app.request(`/v1/environments/${environment_id}/bridge/reconnect`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(reconnectRes.status).toBe(200);
  });
});

describe("V1 Work Routes", () => {
  let app: Hono;
  let envId: string;

  beforeEach(async () => {
    storeReset();
    app = createApp();

    const envRes = await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    envId = (await envRes.json()).environment_id;
  });

  test("GET /v1/environments/:id/work/poll — returns 204 when no work", async () => {
    const res = await app.request(`/v1/environments/${envId}/work/poll`, {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(204);
  });

  test("work lifecycle: create → poll → ack → stop", async () => {
    // Create session with environment (creates work item)
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ environment_id: envId }),
    });
    const sessionId = (await sessRes.json()).id;

    // Poll for work
    const pollRes = await app.request(`/v1/environments/${envId}/work/poll`, {
      headers: AUTH_HEADERS,
    });
    expect(pollRes.status).toBe(200);
    const work = await pollRes.json();
    expect(work.id).toMatch(/^work_/);
    expect(work.data.id).toBe(sessionId);

    // Ack work
    const ackRes = await app.request(`/v1/environments/${envId}/work/${work.id}/ack`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(ackRes.status).toBe(200);

    // Stop work
    const stopRes = await app.request(`/v1/environments/${envId}/work/${work.id}/stop`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(stopRes.status).toBe(200);
  });

  test("POST work heartbeat", async () => {
    // Create session + work
    await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ environment_id: envId }),
    });
    const pollRes = await app.request(`/v1/environments/${envId}/work/poll`, {
      headers: AUTH_HEADERS,
    });
    const work = await pollRes.json();

    const hbRes = await app.request(`/v1/environments/${envId}/work/${work.id}/heartbeat`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(hbRes.status).toBe(200);
    const body = await hbRes.json();
    expect(body.lease_extended).toBe(true);
  });
});

describe("V2 Code Session Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    process.env.RCS_API_KEYS = "test-api-key";
    app = createApp();
  });

  test("POST /v1/code/sessions — creates code session", async () => {
    const res = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ title: "Code Session" }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.session.id).toMatch(/^cse_/);
    expect(body.session.title).toBe("Code Session");
  });

  test("POST /v1/code/sessions/:id/bridge — returns bridge info with JWT", async () => {
    // Create code session
    const createRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = (await createRes.json()).session;

    const bridgeRes = await app.request(`/v1/code/sessions/${id}/bridge`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(bridgeRes.status).toBe(200);
    const body = await bridgeRes.json();
    expect(body.api_base_url).toBe("http://localhost:3000");
    expect(body.worker_epoch).toBe(1);
    expect(body.worker_jwt).toBeTruthy();
    expect(body.expires_in).toBe(3600);
  });

  test("POST /v1/code/sessions/:id/bridge — 404 for unknown session", async () => {
    const res = await app.request("/v1/code/sessions/nope/bridge", {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(404);
  });
});

describe("V2 Worker Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    process.env.RCS_API_KEYS = "test-api-key";
    app = createApp();
  });

  test("POST /v1/code/sessions/:id/worker/register — increments epoch", async () => {
    // Create session
    const createRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const regRes = await app.request(`/v1/code/sessions/${id}/worker/register`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(regRes.status).toBe(200);
    const body = await regRes.json();
    expect(body.worker_epoch).toBe(1);
  });

  test("POST /v1/code/sessions/:id/worker/register — 404 for unknown", async () => {
    const res = await app.request("/v1/code/sessions/nope/worker/register", {
      method: "POST",
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(404);
  });
});

describe("Web Auth Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    app = createApp();
  });

  test("POST /web/bind — binds session to UUID", async () => {
    // Create session first
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const bindRes = await app.request("/web/bind?uuid=test-uuid", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ sessionId: id }),
    });
    expect(bindRes.status).toBe(200);
    const body = await bindRes.json();
    expect(body.ok).toBe(true);
  });

  test("POST /web/bind — binds compat code session ID to UUID", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const body = await sessRes.json();
    const compatId = toWebSessionId(body.session.id);

    const bindRes = await app.request("/web/bind?uuid=test-uuid", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ sessionId: compatId }),
    });
    expect(bindRes.status).toBe(200);
    const bindBody = await bindRes.json();
    expect(bindBody.ok).toBe(true);
    expect(bindBody.sessionId).toBe(compatId);
  });

  test("POST /web/bind — 404 for unknown session", async () => {
    const res = await app.request("/web/bind?uuid=test-uuid", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ sessionId: "nope" }),
    });
    expect(res.status).toBe(404);
  });

  test("POST /web/bind — 400 when missing params", async () => {
    const res = await app.request("/web/bind", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    expect(res.status).toBe(400);
  });
});

describe("Web Session Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    app = createApp();
  });

  test("POST /web/sessions — creates and auto-binds session", async () => {
    const res = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ title: "Web Session" }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.id).toMatch(/^session_/);
    expect(body.source).toBe("web");
  });

  test("GET /web/sessions — returns sessions owned by UUID", async () => {
    // Create and bind
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const listRes = await app.request("/web/sessions?uuid=user-1");
    expect(listRes.status).toBe(200);
    const sessions = await listRes.json();
    expect(sessions).toHaveLength(1);
    expect(sessions[0].id).toBe(id);
  });

  test("GET /web/sessions and /all — serialize owned code sessions as compat IDs", async () => {
    const codeSession = storeCreateSession({ idPrefix: "cse_" });
    storeBindSession(codeSession.id, "user-1");
    const compatId = toWebSessionId(codeSession.id);

    const listRes = await app.request("/web/sessions?uuid=user-1");
    expect(listRes.status).toBe(200);
    const sessions = await listRes.json();
    expect(sessions).toHaveLength(1);
    expect(sessions[0].id).toBe(compatId);

    const allRes = await app.request("/web/sessions/all?uuid=user-1");
    expect(allRes.status).toBe(200);
    const summaries = await allRes.json();
    expect(summaries).toHaveLength(1);
    expect(summaries[0].id).toBe(compatId);
  });

  test("GET /web/sessions — requires UUID", async () => {
    const res = await app.request("/web/sessions");
    expect(res.status).toBe(401);
  });

  test("GET /web/sessions/all — lists only sessions owned by requesting UUID", async () => {
    // Create 2 sessions via different users
    await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    await app.request("/web/sessions?uuid=user-2", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });

    const allRes = await app.request("/web/sessions/all?uuid=user-1");
    expect(allRes.status).toBe(200);
    const sessions = await allRes.json();
    expect(sessions).toHaveLength(1); // only user-1's session, not user-2's
  });

  test("GET /web/sessions and /all — hides archived and inactive sessions", async () => {
    const archived = storeCreateSession({});
    const inactive = storeCreateSession({});
    const open = storeCreateSession({});
    storeBindSession(archived.id, "user-1");
    storeBindSession(inactive.id, "user-1");
    storeBindSession(open.id, "user-1");

    await app.request(`/v1/sessions/${archived.id}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });

    const { storeUpdateSession } = await import("../store");
    storeUpdateSession(inactive.id, { status: "inactive" });

    const listRes = await app.request("/web/sessions?uuid=user-1");
    expect(listRes.status).toBe(200);
    const sessions = await listRes.json();
    expect(sessions.map((session: { id: string }) => session.id)).toEqual([open.id]);

    const allRes = await app.request("/web/sessions/all?uuid=user-1");
    expect(allRes.status).toBe(200);
    const summaries = await allRes.json();
    expect(summaries.map((session: { id: string }) => session.id)).toEqual([open.id]);
  });

  test("GET /web/sessions/:id — returns owned session", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const getRes = await app.request(`/web/sessions/${id}?uuid=user-1`);
    expect(getRes.status).toBe(200);
  });

  test("GET /web/sessions/:id — includes automation_state snapshot when worker metadata has it", async () => {
    const createRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await createRes.json();
    storeBindSession(id, "user-1");

    await app.request(`/v1/code/sessions/${id}/worker`, {
      method: "PUT",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({
        worker_epoch: 1,
        external_metadata: {
          automation_state: {
            enabled: true,
            phase: "standby",
            next_tick_at: 123456,
            sleep_until: null,
          },
        },
      }),
    });

    const getRes = await app.request(`/web/sessions/${toWebSessionId(id)}?uuid=user-1`);
    expect(getRes.status).toBe(200);
    const body = await getRes.json();
    expect(body.automation_state).toEqual({
      enabled: true,
      phase: "standby",
      next_tick_at: 123456,
      sleep_until: null,
    });
  });

  test("GET /web/sessions/:id — 403 for non-owner", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const getRes = await app.request(`/web/sessions/${id}?uuid=user-2`);
    expect(getRes.status).toBe(403);
  });

  test("GET /web/sessions/:id/history — returns events", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`);
    expect(histRes.status).toBe(200);
    const body = await histRes.json();
    expect(body.events).toEqual([]);
  });

  test("GET /web/sessions/:id/history — returns task_state snapshots", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    publishSessionEvent(
      id,
      "task_state",
      {
        task_list_id: "team-alpha",
        tasks: [{ id: "1", subject: "Investigate", status: "pending" }],
      },
      "inbound",
    );

    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`);
    expect(histRes.status).toBe(200);
    const body = await histRes.json();
    expect(body.events).toHaveLength(1);
    expect(body.events[0]?.type).toBe("task_state");
    expect(body.events[0]?.payload.task_list_id).toBe("team-alpha");
    expect(body.events[0]?.payload.tasks).toEqual([
      { id: "1", subject: "Investigate", status: "pending" },
    ]);
  });

  test("GET /web/sessions/:id and history — supports compat code session IDs", async () => {
    const codeSession = storeCreateSession({ idPrefix: "cse_" });
    storeBindSession(codeSession.id, "user-1");
    const compatId = toWebSessionId(codeSession.id);

    const getRes = await app.request(`/web/sessions/${compatId}?uuid=user-1`);
    expect(getRes.status).toBe(200);
    const session = await getRes.json();
    expect(session.id).toBe(compatId);

    const histRes = await app.request(`/web/sessions/${compatId}/history?uuid=user-1`);
    expect(histRes.status).toBe(200);
    const history = await histRes.json();
    expect(history.events).toEqual([]);
  });

  test("GET /web/sessions/:id/history — 403 for non-owner", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-2`);
    expect(histRes.status).toBe(403);
  });

  test("GET /web/sessions/:id — 404 after session deleted", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    // Archive/delete the session via v1
    await app.request(`/v1/sessions/${id}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });

    // Session still exists (archived), so we can still get it
    const getRes = await app.request(`/web/sessions/${id}?uuid=user-1`);
    // After archive, session status is "archived" but still exists
    expect(getRes.status).toBe(200);
  });

  test("GET /web/sessions/:id/history — 404 for non-existent session", async () => {
    // Bind to a non-existent session won't work, but if ownership was set
    // and session deleted, we need to test the 404 path
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    // Delete the session from store directly
    const { storeDeleteSession } = await import("../store");
    storeDeleteSession(id);

    const histRes = await app.request(`/web/sessions/${id}/history?uuid=user-1`);
    expect(histRes.status).toBe(404);
  });

  test("POST /web/sessions with invalid environment_id — handles work item error", async () => {
    const res = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ environment_id: "env_nonexistent" }),
    });
    // Session is still created even if work item fails
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.id).toMatch(/^session_/);
  });

  test("GET /web/sessions/:id/events — returns SSE stream", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const eventsRes = await app.request(`/web/sessions/${id}/events?uuid=user-1`);
    expect(eventsRes.status).toBe(200);
    expect(eventsRes.headers.get("Content-Type")).toBe("text/event-stream");

    // Read initial keepalive and cancel
    const reader = eventsRes.body?.getReader();
    if (reader) {
      const { value } = await reader.read();
      const text = new TextDecoder().decode(value!);
      expect(text).toContain(": keepalive");
      reader.cancel();
    }
  });

  test("GET /web/sessions/:id/events — supports compat code session IDs", async () => {
    const codeSession = storeCreateSession({ idPrefix: "cse_" });
    storeBindSession(codeSession.id, "user-1");
    const compatId = toWebSessionId(codeSession.id);

    const eventsRes = await app.request(`/web/sessions/${compatId}/events?uuid=user-1`);
    expect(eventsRes.status).toBe(200);
    expect(eventsRes.headers.get("Content-Type")).toBe("text/event-stream");

    const reader = eventsRes.body?.getReader();
    if (reader) {
      const { value } = await reader.read();
      const text = new TextDecoder().decode(value!);
      expect(text).toContain(": keepalive");
      reader.cancel();
    }
  });

  test("GET /web/sessions/:id/events — 403 for non-owner", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const eventsRes = await app.request(`/web/sessions/${id}/events?uuid=user-2`);
    expect(eventsRes.status).toBe(403);
  });

  test("GET /web/sessions/:id/events — 409 for archived session", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    await app.request(`/v1/sessions/${id}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });

    const res = await app.request(`/web/sessions/${id}/events?uuid=user-1`);
    expect(res.status).toBe(409);
    const body = await res.json();
    expect(body.error.type).toBe("session_closed");
  });
});

describe("Web Control Routes", () => {
  let app: Hono;
  let sessionId: string;

  beforeEach(async () => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    app = createApp();

    // Create and bind session
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    sessionId = (await createRes.json()).id;
  });

  test("POST /web/sessions/:id/events — sends user message", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/events?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "user", content: "hello" }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.status).toBe("ok");
    expect(body.event).toBeTruthy();
  });

  test("POST /web/sessions/:id/events/control/interrupt — supports compat code session IDs", async () => {
    const rawSessionId = storeCreateSession({ idPrefix: "cse_" }).id;
    storeBindSession(rawSessionId, "user-1");
    const compatId = toWebSessionId(rawSessionId);

    const eventsRes = await app.request(`/web/sessions/${compatId}/events?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "user", content: "hello" }),
    });
    expect(eventsRes.status).toBe(200);

    const controlRes = await app.request(`/web/sessions/${compatId}/control?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "permission_response", approved: true, request_id: "r1" }),
    });
    expect(controlRes.status).toBe(200);

    const interruptRes = await app.request(`/web/sessions/${compatId}/interrupt?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    expect(interruptRes.status).toBe(200);
  });

  test("POST /web/sessions/:id/events — 403 for non-owner", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/events?uuid=user-2`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "user", content: "hello" }),
    });
    expect(res.status).toBe(403);
  });

  test("POST /web/sessions/:id/control — sends control request", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/control?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "permission_response", approved: true, request_id: "r1" }),
    });
    expect(res.status).toBe(200);
  });

  test("POST /web/sessions/:id/interrupt — interrupts session", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/interrupt?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    expect(res.status).toBe(200);
  });

  test("POST /web/sessions/:id/interrupt — 403 for non-owner", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/interrupt?uuid=user-2`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    expect(res.status).toBe(403);
  });

  test("POST /web/sessions/:id/control — 403 for non-owner", async () => {
    const res = await app.request(`/web/sessions/${sessionId}/control?uuid=user-2`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "permission_response", approved: true }),
    });
    expect(res.status).toBe(403);
  });

  test("POST /web/sessions/:id/events — 403 for non-existent session with no ownership", async () => {
    const res = await app.request("/web/sessions/nonexistent/events?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "user", content: "hello" }),
    });
    expect(res.status).toBe(403);
  });

  test("POST /web/sessions/:id/events/control/interrupt — 409 for archived session", async () => {
    await app.request(`/v1/sessions/${sessionId}/archive`, {
      method: "POST",
      headers: AUTH_HEADERS,
    });

    const eventsRes = await app.request(`/web/sessions/${sessionId}/events?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "user", content: "hello" }),
    });
    expect(eventsRes.status).toBe(409);

    const controlRes = await app.request(`/web/sessions/${sessionId}/control?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ type: "permission_response", approved: true, request_id: "r1" }),
    });
    expect(controlRes.status).toBe(409);

    const interruptRes = await app.request(`/web/sessions/${sessionId}/interrupt?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    expect(interruptRes.status).toBe(409);
  });
});

describe("Web Environment Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    app = createApp();
  });

  test("GET /web/environments — lists active environments", async () => {
    // Register an env via v1
    await app.request("/v1/environments/bridge", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ machine_name: "mac1" }),
    });

    const res = await app.request("/web/environments?uuid=user-1");
    expect(res.status).toBe(200);
    const envs = await res.json();
    expect(envs).toHaveLength(1);
    expect(envs[0].machine_name).toBe("mac1");
  });

  test("GET /web/environments — requires UUID", async () => {
    const res = await app.request("/web/environments");
    expect(res.status).toBe(401);
  });
});

describe("V1 Session Ingress Routes (HTTP)", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    process.env.RCS_API_KEYS = "test-api-key";
    app = createApp();
  });

  test("POST /v2/session_ingress/session/:sessionId/events — ingests events with API key", async () => {
    // Create session first
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const res = await app.request(`/v2/session_ingress/session/${id}/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "assistant", content: "response" }] }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.status).toBe("ok");
  });

  test("POST /v2/session_ingress/session/:sessionId/events — rejects without auth", async () => {
    const res = await app.request("/v2/session_ingress/session/nope/events", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ events: [] }),
    });
    expect(res.status).toBe(401);
  });

  test("POST /v2/session_ingress/session/:sessionId/events — 404 for unknown session", async () => {
    const res = await app.request("/v2/session_ingress/session/nope/events", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "user", content: "hi" }] }),
    });
    expect(res.status).toBe(404);
  });

  test("POST /v2/session_ingress/session/:sessionId/events — resolves compat code session IDs", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await sessRes.json();
    const compatId = toWebSessionId(id);

    const res = await app.request(`/v2/session_ingress/session/${compatId}/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ events: [{ type: "assistant", message: { role: "assistant", content: "compat ok" } }] }),
    });
    expect(res.status).toBe(200);

    const events = getEventBus(id).getEventsSince(0);
    expect(events).toHaveLength(1);
    expect(events[0]?.type).toBe("assistant");
  });

  test("GET /v2/session_ingress/ws/:sessionId — accepts small payload into handler", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const event = await new Promise((resolve, reject) => {
        let ws: WebSocket | undefined;
        const timeout = setTimeout(() => {
          ws?.close();
          reject(new Error("Timed out waiting for inbound WebSocket payload"));
        }, 2000);
        const bus = getEventBus(id);
        const unsub = bus.subscribe((sessionEvent) => {
          if (sessionEvent.direction === "inbound" && sessionEvent.type === "user") {
            clearTimeout(timeout);
            unsub();
            ws?.close();
            resolve(sessionEvent);
          }
        });
        ws = new WebSocket(`ws://127.0.0.1:${server.port}/v2/session_ingress/ws/${id}`, [
          encodeWebSocketAuthProtocol("test-api-key"),
        ]);
        ws.onopen = () => {
          ws.send(JSON.stringify({ type: "user", message: { role: "user", content: "hello" } }) + "\n");
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          unsub();
          reject(new Error("Session ingress WebSocket connection failed"));
        };
      });

      expect((event as { type?: string }).type).toBe("user");
    } finally {
      await server.stop(true);
    }
  });

  test("GET /v2/session_ingress/ws/:sessionId — closes 11MB payload with 1009", () => {
    const close = mock(() => {});
    const handled = handleSessionIngressWsPayload(
      { close } as any,
      "session_large",
      "x".repeat(11 * 1024 * 1024),
    );

    expect(handled).toBe(false);
    expect(close).toHaveBeenCalledWith(1009, "message too large");
  });

  test("session ingress decode rejects unsupported payload types", () => {
    const close = mock(() => {});
    const handled = handleSessionIngressWsPayload(
      { close } as any,
      "session_bad",
      { data: "bad" },
    );

    expect(decodeSessionIngressWsMessage({ data: "bad" }).ok).toBe(false);
    expect(handled).toBe(false);
    expect(close).toHaveBeenCalledWith(1003, "unsupported message payload");
  });

  test("GET /v2/session_ingress/ws/:sessionId — resolves compat code session IDs", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const {
      session: { id },
    } = await sessRes.json();
    const compatId = toWebSessionId(id);

    publishSessionEvent(id, "user", { content: "compat ws replay" }, "outbound");

    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const message = await new Promise<string>((resolve, reject) => {
        const ws = new WebSocket(`ws://127.0.0.1:${server.port}/v2/session_ingress/ws/${compatId}`, [
          encodeWebSocketAuthProtocol("test-api-key"),
        ]);
        const timeout = setTimeout(() => {
          ws.close();
          reject(new Error("Timed out waiting for compat WebSocket replay"));
        }, 2000);

        ws.onmessage = (event) => {
          const data = typeof event.data === "string" ? event.data : String(event.data);
          if (data.includes("\"type\":\"user\"")) {
            clearTimeout(timeout);
            ws.close();
            resolve(data);
          }
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          reject(new Error("Compat WebSocket connection failed"));
        };
      });

      expect(message).toContain("\"type\":\"user\"");
      expect(message).toContain(`"session_id":"${id}"`);
      expect(message).toContain("compat ws replay");
    } finally {
      await server.stop(true);
    }
  });
});

describe("ACP Routes", () => {
  let app: Hono;

  function createRelayAuthApp() {
    const authApp = new Hono();
    authApp.get("/relay-auth", (c) => c.json({ ok: hasAcpRelayAuth(c) }));
    return authApp;
  }

  beforeEach(() => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    app = createApp();
  });

  test("GET /acp/agents requires auth", async () => {
    const res = await app.request("/acp/agents");
    expect(res.status).toBe(401);
  });

  test("GET /acp/agents rejects UUID-only auth", async () => {
    const res = await app.request("/acp/agents?uuid=user-1");
    expect(res.status).toBe(401);
  });

  test("GET /acp/agents accepts API key header", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/agents", {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body).toHaveLength(1);
    expect(body[0].agent_name).toBe("agent-one");
  });

  test("GET /acp/channel-groups requires auth", async () => {
    const res = await app.request("/acp/channel-groups");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups rejects UUID-only auth", async () => {
    const res = await app.request("/acp/channel-groups?uuid=user-1");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups accepts API key header", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/channel-groups", {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body).toHaveLength(1);
    expect(body[0].channel_group_id).toBe("group-one");
  });

  test("GET /acp/channel-groups/:id requires auth", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/channel-groups/group-one");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups/:id rejects query token auth", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/channel-groups/group-one?token=test-api-key");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups/:id rejects UUID-only auth", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/channel-groups/group-one?uuid=user-1");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups/:id returns group with API key auth", async () => {
    storeCreateEnvironment({
      secret: "secret",
      machineName: "agent-one",
      workerType: "acp",
      bridgeId: "group-one",
    });

    const res = await app.request("/acp/channel-groups/group-one", {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.channel_group_id).toBe("group-one");
    expect(body.member_count).toBe(1);
  });

  test("GET /acp/channel-groups/:id/events requires auth", async () => {
    const res = await app.request("/acp/channel-groups/group-one/events");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups/:id/events rejects UUID-only auth", async () => {
    const res = await app.request("/acp/channel-groups/group-one/events?uuid=user-1");
    expect(res.status).toBe(401);
  });

  test("GET /acp/channel-groups/:id/events accepts API key header", async () => {
    const res = await app.request("/acp/channel-groups/group-one/events", {
      headers: AUTH_HEADERS,
    });
    expect(res.status).toBe(200);
    expect(res.headers.get("Content-Type")).toBe("text/event-stream");

    await res.body?.cancel();
  });

  test("ACP relay auth rejects UUID-only auth", async () => {
    const res = await createRelayAuthApp().request("/relay-auth?uuid=user-1");
    expect(await res.json()).toEqual({ ok: false });
  });

  test("ACP relay auth accepts API key header", async () => {
    const res = await createRelayAuthApp().request("/relay-auth", {
      headers: AUTH_HEADERS,
    });
    expect(await res.json()).toEqual({ ok: true });
  });

  test("ACP relay auth accepts WebSocket protocol auth", async () => {
    const res = await createRelayAuthApp().request("/relay-auth", {
      headers: {
        "Sec-WebSocket-Protocol": encodeWebSocketAuthProtocol("test-api-key"),
      },
    });
    expect(await res.json()).toEqual({ ok: true });
  });

  test("ACP WebSocket rejects legacy query-token auth on the real upgrade path", async () => {
    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const close = await new Promise<CloseEvent>((resolve, reject) => {
        const ws = new WebSocket(`ws://127.0.0.1:${server.port}/acp/ws?token=test-api-key`);
        const timeout = setTimeout(() => {
          ws.close();
          reject(new Error("Timed out waiting for ACP WebSocket auth rejection"));
        }, 2000);

        ws.onclose = (event) => {
          clearTimeout(timeout);
          resolve(event);
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          reject(new Error("ACP WebSocket query-token test failed before close"));
        };
      });

      expect(close.code).toBe(4003);
      expect(close.reason).toBe("unauthorized");
    } finally {
      server.stop(true);
    }
  });

  test("ACP WebSocket accepts subprotocol auth on the real upgrade path", async () => {
    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const message = await new Promise<string>((resolve, reject) => {
        const ws = new WebSocket(`ws://127.0.0.1:${server.port}/acp/ws`, [
          encodeWebSocketAuthProtocol("test-api-key"),
        ]);
        const timeout = setTimeout(() => {
          ws.close();
          reject(new Error("Timed out waiting for ACP WebSocket registration"));
        }, 2000);

        ws.onopen = () => {
          ws.send(JSON.stringify({ type: "register", agent_name: "agent-one" }) + "\n");
        };
        ws.onmessage = (event) => {
          const data = typeof event.data === "string" ? event.data : String(event.data);
          if (data.includes("\"type\":\"registered\"")) {
            clearTimeout(timeout);
            ws.close();
            resolve(data);
          }
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          reject(new Error("ACP WebSocket subprotocol auth failed"));
        };
      });

      expect(message).toContain("\"agent_id\"");
    } finally {
      await server.stop(true);
    }
  });

  test("ACP relay WebSocket rejects legacy query-token auth on the real upgrade path", async () => {
    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const close = await new Promise<CloseEvent>((resolve, reject) => {
        const ws = new WebSocket(`ws://127.0.0.1:${server.port}/acp/relay/agent_123?token=test-api-key`);
        const timeout = setTimeout(() => {
          ws.close();
          reject(new Error("Timed out waiting for ACP relay query-token rejection"));
        }, 2000);

        ws.onclose = (event) => {
          clearTimeout(timeout);
          resolve(event);
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          reject(new Error("ACP relay query-token test failed before close"));
        };
      });

      expect(close.code).toBe(4003);
      expect(close.reason).toBe("unauthorized");
    } finally {
      server.stop(true);
    }
  });

  test("ACP relay WebSocket accepts subprotocol auth on the real upgrade path", async () => {
    const server = Bun.serve({
      port: 0,
      fetch: app.fetch,
      websocket: {
        ...sessionIngressWebsocket,
        idleTimeout: 30,
      },
    });

    try {
      const close = await new Promise<CloseEvent>((resolve, reject) => {
        const ws = new WebSocket(`ws://127.0.0.1:${server.port}/acp/relay/agent_123`, [
          encodeWebSocketAuthProtocol("test-api-key"),
        ]);
        const timeout = setTimeout(() => {
          ws.close();
          reject(new Error("Timed out waiting for ACP relay authenticated close"));
        }, 2000);

        ws.onclose = (event) => {
          clearTimeout(timeout);
          resolve(event);
        };
        ws.onerror = () => {
          clearTimeout(timeout);
          reject(new Error("ACP relay subprotocol auth failed before close"));
        };
      });

      expect(close.code).toBe(4004);
      expect(close.reason).toBe("agent not found");
    } finally {
      server.stop(true);
    }
  });

});

describe("ACP WebSocket payload guards", () => {
  test("rejects oversized multibyte text by byte size", () => {
    const close = mock(() => {});
    const handleMessage = mock(() => {});
    const payload = "你".repeat(4 * 1024 * 1024);
    const decoded = decodeAcpWsMessageData(payload);
    const handled = handleAcpWsPayload(
      { close } as any,
      "[ACP-WS]",
      "wsId=multibyte",
      payload,
      handleMessage,
    );

    expect(decoded.ok && decoded.size).toBeGreaterThan(10 * 1024 * 1024);
    expect(handled).toBe(false);
    expect(handleMessage).not.toHaveBeenCalled();
    expect(close).toHaveBeenCalledWith(1009, "message too large");
  });

  test("rejects oversized binary payload by byte size", () => {
    const close = mock(() => {});
    const handleMessage = mock(() => {});
    const payload = new Uint8Array(11 * 1024 * 1024);
    const decoded = decodeAcpWsMessageData(payload);
    const handled = handleAcpWsPayload(
      { close } as any,
      "[ACP-Relay]",
      "relayWsId=binary",
      payload,
      handleMessage,
    );

    expect(decoded).toEqual({
      ok: false,
      reason: "message too large",
      size: 11 * 1024 * 1024,
    });
    expect(handled).toBe(false);
    expect(handleMessage).not.toHaveBeenCalled();
    expect(close).toHaveBeenCalledWith(1009, "message too large");
  });

  test("accepts small payload into ACP handler", () => {
    const close = mock(() => {});
    const handleMessage = mock(() => {});
    const handled = handleAcpWsPayload(
      { close } as any,
      "[ACP-WS]",
      "wsId=small",
      '{"type":"keep_alive"}',
      handleMessage,
    );

    expect(handled).toBe(true);
    expect(handleMessage).toHaveBeenCalledWith('{"type":"keep_alive"}');
    expect(close).not.toHaveBeenCalled();
  });
});

describe("V2 Worker Events Routes", () => {
  let app: Hono;

  beforeEach(() => {
    storeReset();
    for (const [key] of getAllEventBuses()) {
      removeEventBus(key);
    }
    process.env.RCS_API_KEYS = "test-api-key";
    app = createApp();
  });

  test("POST /v1/code/sessions/:id/worker/events — publishes worker events", async () => {
    // Create session
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify([{ type: "assistant", content: "response" }]),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.status).toBe("ok");
    expect(body.count).toBe(1);
  });

  test("POST /v1/code/sessions/:id/worker/events — unwraps CCR batch payloads", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { session: { id } } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/events`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({
        worker_epoch: 1,
        events: [{ payload: { type: "assistant", content: "response" } }],
      }),
    });
    expect(res.status).toBe(200);
    const body = await res.json();
    expect(body.count).toBe(1);

    const events = getEventBus(id).getEventsSince(0);
    expect(events).toHaveLength(1);
    expect(events[0]?.type).toBe("assistant");
    expect((events[0]?.payload as { content?: string }).content).toBe("response");
  });

  test("GET/PUT /v1/code/sessions/:id/worker — stores worker state", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { session: { id } } = await sessRes.json();

    const putRes = await app.request(`/v1/code/sessions/${id}/worker`, {
      method: "PUT",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({
        worker_epoch: 1,
        worker_status: "running",
        external_metadata: {
          permission_mode: "default",
          automation_state: {
            enabled: true,
            phase: "sleeping",
            next_tick_at: null,
            sleep_until: 123456,
          },
        },
      }),
    });
    expect(putRes.status).toBe(200);

    const getRes = await app.request(`/v1/code/sessions/${id}/worker`, {
      headers: AUTH_HEADERS,
    });
    expect(getRes.status).toBe(200);
    const body = await getRes.json();
    expect(body.worker.worker_status).toBe("running");
    expect(body.worker.external_metadata.permission_mode).toBe("default");
    expect(body.worker.external_metadata.automation_state).toEqual({
      enabled: true,
      phase: "sleeping",
      next_tick_at: null,
      sleep_until: 123456,
    });

    const events = getEventBus(id).getEventsSince(0);
    expect(events.some((event) => event.type === "automation_state")).toBe(true);
    expect(events.at(-1)?.payload).toEqual({
      enabled: true,
      phase: "sleeping",
      next_tick_at: null,
      sleep_until: 123456,
    });
  });

  test("POST /v1/code/sessions/:id/worker/heartbeat — updates heartbeat", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { session: { id } } = await sessRes.json();

    const heartbeatRes = await app.request(`/v1/code/sessions/${id}/worker/heartbeat`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ worker_epoch: 1 }),
    });
    expect(heartbeatRes.status).toBe(200);

    const getRes = await app.request(`/v1/code/sessions/${id}/worker`, {
      headers: AUTH_HEADERS,
    });
    const body = await getRes.json();
    expect(body.worker.last_heartbeat_at).toBeTruthy();
  });

  test("GET /v1/code/sessions/:id/worker/events/stream — emits CCR client_event frames", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { session: { id } } = await sessRes.json();

    const streamRes = await app.request(`/v1/code/sessions/${id}/worker/events/stream`, {
      headers: AUTH_HEADERS,
    });
    expect(streamRes.status).toBe(200);

    const reader = streamRes.body?.getReader();
    expect(reader).toBeTruthy();
    if (!reader) return;

    const firstChunk = await reader.read();
    const keepalive = new TextDecoder().decode(firstChunk.value!);
    expect(keepalive).toContain(": keepalive");

    publishSessionEvent(id, "user", { type: "user", content: "hello" }, "outbound");

    const secondChunk = await reader.read();
    const frame = new TextDecoder().decode(secondChunk.value!);
    expect(frame).toContain("event: client_event");
    expect(frame).toContain("\"payload\":{\"type\":\"user\",\"content\":\"hello\",\"message\":{\"content\":\"hello\"}}");
    reader.cancel();
  });

  test("GET /v1/code/sessions/:id/worker/events/stream — normalizes web permission approvals to control_response", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const streamRes = await app.request(`/v1/code/sessions/${id}/worker/events/stream`, {
      headers: AUTH_HEADERS,
    });
    expect(streamRes.status).toBe(200);

    const reader = streamRes.body?.getReader();
    expect(reader).toBeTruthy();
    if (!reader) return;

    await reader.read(); // initial keepalive

    const controlRes = await app.request(`/web/sessions/${id}/control?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        type: "permission_response",
        approved: true,
        request_id: "req-1",
      }),
    });
    expect(controlRes.status).toBe(200);

    const chunk = await reader.read();
    const frame = new TextDecoder().decode(chunk.value!);
    expect(frame).toContain("event: client_event");
    expect(frame).toContain("\"event_type\":\"permission_response\"");
    expect(frame).toContain("\"payload\":{\"type\":\"control_response\"");
    expect(frame).toContain("\"request_id\":\"req-1\"");
    expect(frame).toContain("\"behavior\":\"allow\"");
    reader.cancel();
  });

  test("GET /v1/code/sessions/:id/worker/events/stream — normalizes web plan rejection feedback to deny control_response", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const streamRes = await app.request(`/v1/code/sessions/${id}/worker/events/stream`, {
      headers: AUTH_HEADERS,
    });
    expect(streamRes.status).toBe(200);

    const reader = streamRes.body?.getReader();
    expect(reader).toBeTruthy();
    if (!reader) return;

    await reader.read(); // initial keepalive

    const controlRes = await app.request(`/web/sessions/${id}/control?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        type: "permission_response",
        approved: false,
        request_id: "req-2",
        message: "Need more detail",
      }),
    });
    expect(controlRes.status).toBe(200);

    const chunk = await reader.read();
    const frame = new TextDecoder().decode(chunk.value!);
    expect(frame).toContain("event: client_event");
    expect(frame).toContain("\"event_type\":\"permission_response\"");
    expect(frame).toContain("\"payload\":{\"type\":\"control_response\"");
    expect(frame).toContain("\"request_id\":\"req-2\"");
    expect(frame).toContain("\"subtype\":\"error\"");
    expect(frame).toContain("\"behavior\":\"deny\"");
    expect(frame).toContain("\"message\":\"Need more detail\"");
    reader.cancel();
  });

  test("GET /v1/code/sessions/:id/worker/events/stream — normalizes web interrupts to control_request", async () => {
    const createRes = await app.request("/web/sessions?uuid=user-1", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await createRes.json();

    const streamRes = await app.request(`/v1/code/sessions/${id}/worker/events/stream`, {
      headers: AUTH_HEADERS,
    });
    expect(streamRes.status).toBe(200);

    const reader = streamRes.body?.getReader();
    expect(reader).toBeTruthy();
    if (!reader) return;

    await reader.read(); // initial keepalive

    const interruptRes = await app.request(`/web/sessions/${id}/interrupt?uuid=user-1`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    expect(interruptRes.status).toBe(200);

    const chunk = await reader.read();
    const frame = new TextDecoder().decode(chunk.value!);
    expect(frame).toContain("event: client_event");
    expect(frame).toContain("\"event_type\":\"interrupt\"");
    expect(frame).toContain("\"payload\":{\"type\":\"control_request\"");
    expect(frame).toContain("\"subtype\":\"interrupt\"");
    reader.cancel();
  });

  test("PUT /v1/code/sessions/:id/worker/state — updates session status", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/state`, {
      method: "PUT",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ status: "running" }),
    });
    expect(res.status).toBe(200);
  });

  test("PUT /v1/code/sessions/:id/worker/external_metadata — no-op", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/external_metadata`, {
      method: "PUT",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ meta: "data" }),
    });
    expect(res.status).toBe(200);
  });

  test("POST /v1/code/sessions/:id/worker/events/:eventId/delivery — no-op", async () => {
    const sessRes = await app.request("/v1/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { id } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/events/evt123/delivery`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ status: "received" }),
    });
    expect(res.status).toBe(200);
  });

  test("POST /v1/code/sessions/:id/worker/events/delivery — batch no-op", async () => {
    const sessRes = await app.request("/v1/code/sessions", {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({}),
    });
    const { session: { id } } = await sessRes.json();

    const res = await app.request(`/v1/code/sessions/${id}/worker/events/delivery`, {
      method: "POST",
      headers: { ...AUTH_HEADERS, "Content-Type": "application/json" },
      body: JSON.stringify({ worker_epoch: 1, updates: [{ event_id: "evt123", status: "received" }] }),
    });
    expect(res.status).toBe(200);
  });
});