Update

tests/api/admin/containers/manage.py

@@ -0,0 +1,362 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import (
+    get_table,
+    get_primary_admin_uid,
+    invalidate_admins_cache,
+    refresh_snapshot,
+)
+from devplacepy.utils import clear_user_cache
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"acm{int(time.time() * 1000)}{_counter[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return row["uid"], row["api_key"]
+
+
+def _make_admin():
+    uid, key = _signup()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    invalidate_admins_cache()
+    return uid, key
+
+
+def _primary_admin_key():
+    refresh_snapshot()
+    uid = get_primary_admin_uid()
+    return get_table("users").find_one(uid=uid)["api_key"]
+
+
+def _headers(key):
+    return {**JSON, "X-API-KEY": key}
+
+
+def _create_project(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "admin container manage isolation test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_headers(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+
+
+def _insert_instance(project_uid, created_by):
+    uid = f"acm-{int(time.time() * 1000000)}"
+    get_table("instances").insert(
+        {
+            "uid": uid,
+            "slug": uid,
+            "name": "manage-test",
+            "project_uid": project_uid,
+            "created_by": created_by,
+            "owner_uid": "",
+            "status": "created",
+            "container_id": "",
+            "workspace_dir": "",
+            "restart_policy": "never",
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    refresh_snapshot()
+    return uid
+
+
+def _cleanup(inst_uid):
+    get_table("instances").delete(uid=inst_uid)
+    refresh_snapshot()
+
+
+def test_data_flags_can_manage_for_owner_and_hides_for_other_on_public_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Data Public", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        owner_rows = requests.get(
+            f"{BASE_URL}/admin/containers/data", headers=_headers(owner_key)
+        ).json()["instances"]
+        other_rows = requests.get(
+            f"{BASE_URL}/admin/containers/data", headers=_headers(other_key)
+        ).json()["instances"]
+        owner_row = next(r for r in owner_rows if r["uid"] == inst_uid)
+        other_row = next(r for r in other_rows if r["uid"] == inst_uid)
+        assert owner_row["can_manage"] is True
+        assert other_row["can_manage"] is False
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_data_excludes_others_private_project_instance(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Data Private", is_private=True)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        other_rows = requests.get(
+            f"{BASE_URL}/admin/containers/data", headers=_headers(other_key)
+        ).json()["instances"]
+        assert all(r["uid"] != inst_uid for r in other_rows)
+        owner_rows = requests.get(
+            f"{BASE_URL}/admin/containers/data", headers=_headers(owner_key)
+        ).json()["instances"]
+        assert any(r["uid"] == inst_uid for r in owner_rows)
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_primary_admin_sees_and_can_manage_others_private_instance(app_server):
+    owner_uid, owner_key = _make_admin()
+    primary_key = _primary_admin_key()
+    project = _create_project(owner_key, "Manage Data Primary", is_private=True)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        rows = requests.get(
+            f"{BASE_URL}/admin/containers/data", headers=_headers(primary_key)
+        ).json()["instances"]
+        row = next(r for r in rows if r["uid"] == inst_uid)
+        assert row["can_manage"] is True
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_instance_detail_404_for_non_viewer_on_private_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Detail Private", is_private=True)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}", headers=_headers(other_key)
+        )
+        assert r.status_code == 404
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}", headers=_headers(owner_key)
+        )
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_instance_detail_view_only_for_non_owner_on_public_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Detail Public", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}", headers=_headers(other_key)
+        )
+        assert r.status_code == 200
+        assert r.json()["can_manage"] is False
+
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}", headers=_headers(owner_key)
+        )
+        assert r.json()["can_manage"] is True
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_lifecycle_actions_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Lifecycle Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        for action in ("start", "stop", "pause", "resume", "restart"):
+            r = requests.post(
+                f"{BASE_URL}/admin/containers/{inst_uid}/{action}",
+                headers=_headers(other_key),
+            )
+            assert r.status_code == 403, action
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_lifecycle_actions_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Manage Lifecycle Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        for action in ("start", "stop", "pause", "resume", "restart"):
+            r = requests.post(
+                f"{BASE_URL}/admin/containers/{inst_uid}/{action}",
+                headers=_headers(owner_key),
+            )
+            assert r.status_code == 200, action
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_delete_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Delete Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/delete", headers=_headers(other_key)
+        )
+        assert r.status_code == 403
+        assert get_table("instances").find_one(uid=inst_uid) is not None
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_delete_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Manage Delete Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/delete", headers=_headers(owner_key)
+        )
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_sync_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Sync Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/sync", headers=_headers(other_key)
+        )
+        assert r.status_code == 403
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_sync_allowed_for_owner_reaches_workspace_check(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Manage Sync Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/sync", headers=_headers(owner_key)
+        )
+        assert r.status_code == 400
+        assert "workspace" in r.json()["error"]["message"]
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_configure_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Configure Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/edit",
+            headers=_headers(other_key),
+            data={"restart_policy": "always"},
+        )
+        assert r.status_code == 403
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_configure_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Manage Configure Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            f"{BASE_URL}/admin/containers/{inst_uid}/edit",
+            headers=_headers(owner_key),
+            data={"restart_policy": "always"},
+        )
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_edit_page_redirects_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Edit Page Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}/edit",
+            headers=_headers(other_key),
+            allow_redirects=False,
+        )
+        assert r.status_code == 302
+        assert r.headers["location"] == f"/admin/containers/{inst_uid}"
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_edit_page_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Manage Edit Page Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.get(
+            f"{BASE_URL}/admin/containers/{inst_uid}/edit", headers=_headers(owner_key)
+        )
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_create_rejects_others_private_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Manage Create Denied", is_private=True)
+    r = requests.post(
+        f"{BASE_URL}/admin/containers/create",
+        headers=_headers(other_key),
+        data={"project_slug": project["slug"], "name": "denied-instance"},
+    )
+    assert r.status_code == 404
+    assert get_table("instances").find_one(name="denied-instance") is None
+
+
+def test_projects_search_excludes_others_private_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    title = f"Manage Search Unique {int(time.time() * 1000)}"
+    project = _create_project(owner_key, title, is_private=True)
+    r = requests.get(
+        f"{BASE_URL}/admin/containers/projects/search",
+        headers=_headers(other_key),
+        params={"q": title},
+    )
+    assert all(res["slug"] != project["slug"] for res in r.json()["results"])
+    r = requests.get(
+        f"{BASE_URL}/admin/containers/projects/search",
+        headers=_headers(owner_key),
+        params={"q": title},
+    )
+    assert any(res["slug"] == project["slug"] for res in r.json()["results"])

tests/api/projects/containers/manage.py

@@ -0,0 +1,269 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import (
+    get_table,
+    get_primary_admin_uid,
+    invalidate_admins_cache,
+    refresh_snapshot,
+)
+from devplacepy.utils import clear_user_cache
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"pcm{int(time.time() * 1000)}{_counter[0]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    row = get_table("users").find_one(username=name)
+    return row["uid"], row["api_key"]
+
+
+def _make_admin():
+    uid, key = _signup()
+    get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    clear_user_cache(uid)
+    invalidate_admins_cache()
+    return uid, key
+
+
+def _primary_admin_key():
+    refresh_snapshot()
+    uid = get_primary_admin_uid()
+    return get_table("users").find_one(uid=uid)["api_key"]
+
+
+def _headers(key):
+    return {**JSON, "X-API-KEY": key}
+
+
+def _create_project(key, title, is_private=False):
+    data = {
+        "title": title,
+        "description": "project container manage isolation test",
+        "project_type": "software",
+        "status": "In Development",
+    }
+    if is_private:
+        data["is_private"] = "on"
+    r = requests.post(f"{BASE_URL}/projects/create", headers=_headers(key), data=data)
+    assert r.status_code == 200, r.text
+    return r.json()["data"]
+
+
+def _insert_instance(project_uid, created_by):
+    uid = f"pcm-{int(time.time() * 1000000)}"
+    get_table("instances").insert(
+        {
+            "uid": uid,
+            "slug": uid,
+            "name": "manage-test",
+            "project_uid": project_uid,
+            "created_by": created_by,
+            "owner_uid": "",
+            "status": "created",
+            "container_id": "",
+            "workspace_dir": "",
+            "restart_policy": "never",
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    refresh_snapshot()
+    return uid
+
+
+def _cleanup(inst_uid):
+    get_table("instances").delete(uid=inst_uid)
+    get_table("instance_schedules").delete(instance_uid=inst_uid)
+    refresh_snapshot()
+
+
+def _url(slug, inst_uid, tail=""):
+    base = f"{BASE_URL}/projects/{slug}/containers/instances/{inst_uid}"
+    return f"{base}{tail}" if tail else base
+
+
+def test_delete_denied_for_non_owner_admin_on_public_project(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Delete Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(_url(project["slug"], inst_uid, "/delete"), headers=_headers(other_key))
+        assert r.status_code == 403
+        assert get_table("instances").find_one(uid=inst_uid) is not None
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_delete_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Delete Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(_url(project["slug"], inst_uid, "/delete"), headers=_headers(owner_key))
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_lifecycle_actions_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Lifecycle Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        for action in ("start", "stop", "pause", "resume", "restart"):
+            r = requests.post(_url(project["slug"], inst_uid, f"/{action}"), headers=_headers(other_key))
+            assert r.status_code == 403, action
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_lifecycle_actions_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Lifecycle Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        for action in ("start", "stop", "pause", "resume", "restart"):
+            r = requests.post(_url(project["slug"], inst_uid, f"/{action}"), headers=_headers(owner_key))
+            assert r.status_code == 200, action
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_exec_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Exec Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            _url(project["slug"], inst_uid, "/exec"),
+            headers=_headers(other_key),
+            data={"command": "ls"},
+        )
+        assert r.status_code == 403
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_exec_allowed_for_owner_reaches_running_check(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Exec Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            _url(project["slug"], inst_uid, "/exec"),
+            headers=_headers(owner_key),
+            data={"command": "ls"},
+        )
+        assert r.status_code == 400
+        assert "not running" in r.json()["error"]["message"]
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_sync_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Sync Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(_url(project["slug"], inst_uid, "/sync"), headers=_headers(other_key))
+        assert r.status_code == 403
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_sync_allowed_for_owner_reaches_workspace_check(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Sync Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(_url(project["slug"], inst_uid, "/sync"), headers=_headers(owner_key))
+        assert r.status_code == 400
+        assert "workspace" in r.json()["error"]["message"]
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_schedule_create_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Schedule Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            _url(project["slug"], inst_uid, "/schedules"),
+            headers=_headers(other_key),
+            data={"action": "start", "kind": "cron", "cron": "0 3 * * *"},
+        )
+        assert r.status_code == 403
+        assert get_table("instance_schedules").find_one(instance_uid=inst_uid) is None
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_schedule_create_allowed_for_owner(app_server):
+    owner_uid, owner_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Schedule Owner", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(
+            _url(project["slug"], inst_uid, "/schedules"),
+            headers=_headers(owner_key),
+            data={"action": "start", "kind": "cron", "cron": "0 3 * * *"},
+        )
+        assert r.status_code == 200
+        assert get_table("instance_schedules").find_one(instance_uid=inst_uid) is not None
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_schedule_delete_denied_for_non_owner_admin(app_server):
+    owner_uid, owner_key = _make_admin()
+    _, other_key = _make_admin()
+    project = _create_project(owner_key, "Project Manage Schedule Delete Denied", is_private=False)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        created = requests.post(
+            _url(project["slug"], inst_uid, "/schedules"),
+            headers=_headers(owner_key),
+            data={"action": "start", "kind": "cron", "cron": "0 3 * * *"},
+        )
+        sched_uid = created.json()["data"]["schedule"]["uid"]
+        r = requests.post(
+            _url(project["slug"], inst_uid, f"/schedules/{sched_uid}/delete"),
+            headers=_headers(other_key),
+        )
+        assert r.status_code == 403
+        assert get_table("instance_schedules").find_one(uid=sched_uid) is not None
+    finally:
+        _cleanup(inst_uid)
+
+
+def test_primary_admin_can_manage_others_private_instance(app_server):
+    owner_uid, owner_key = _make_admin()
+    primary_key = _primary_admin_key()
+    project = _create_project(owner_key, "Project Manage Primary Private", is_private=True)
+    inst_uid = _insert_instance(project["uid"], owner_uid)
+    try:
+        r = requests.post(_url(project["slug"], inst_uid, "/stop"), headers=_headers(primary_key))
+        assert r.status_code == 200
+    finally:
+        _cleanup(inst_uid)

tests/api/tools/deepsearch/export.py

@@ -33,7 +33,6 @@ def _seed_done(owner_id="ds-export-owner"):
         "query": "q",
         "summary": "A grounded summary.",
         "findings": [{"title": "F1", "detail": "d", "confidence": 0.8, "citations": [1]}],
-        "gaps": ["gap"],
         "sources": [{"url": "https://example.com", "title": "Example", "source": "httpx"}],
         "score": 70,
         "confidence": 0.7,

tests/api/tools/deepsearch/session.py

@@ -33,7 +33,6 @@ def _seed_done_session(owner_id="ds-session-owner"):
         "findings": [
             {"title": "Finding one", "detail": "Detail.", "confidence": 0.8, "citations": [1]}
         ],
-        "gaps": ["An open gap."],
         "sources": [{"url": "https://example.com", "title": "Example", "source": "httpx"}],
         "score": 70,
         "confidence": 0.7,
@@ -113,6 +112,64 @@ def test_session_html_renders_without_jinja_global_collision(app_server):
         _clear()
 
 
+def test_session_reads_disk_report_before_result_commit(app_server):
+    from pathlib import Path
+    import shutil
+
+    from devplacepy.config import DEEPSEARCH_DIR
+
+    owner_id = "ds-race-owner"
+    uid = queue.enqueue(
+        "deepsearch",
+        {"query": "race question", "depth": 2, "max_pages": 10},
+        "user",
+        owner_id,
+        "DeepSearch: race question",
+    )
+    create_deepsearch_session(
+        uid, "user", owner_id, "race question", 2, 10, f"ds_{uid.replace('-', '')}"
+    )
+    report = {
+        "query": "race question",
+        "summary": "A grounded summary from disk.",
+        "findings": [
+            {"title": "Disk finding", "detail": "D.", "confidence": 0.8, "citations": [1]}
+        ],
+        "sources": [{"url": "https://example.com", "title": "Example", "source": "httpx"}],
+        "score": 84,
+        "confidence": 0.85,
+        "source_diversity": 0.75,
+        "synthesis": "agents",
+        "page_count": 12,
+        "chunk_count": 61,
+    }
+    session_dir = DEEPSEARCH_DIR / uid
+    session_dir.mkdir(parents=True, exist_ok=True)
+    (session_dir / "report.json").write_text(json.dumps(report), encoding="utf-8")
+    get_table("deepsearch_sessions").update(
+        {"uid": uid, "status": "done"}, ["uid"]
+    )
+    refresh_snapshot()
+    try:
+        r = requests.get(
+            f"{BASE_URL}/tools/deepsearch/{uid}/session", headers=_json_headers()
+        )
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert body["status"] == "done"
+        assert body["score"] == 84
+        assert body["chunk_count"] == 61
+        assert body["findings"]
+        assert body["sources"]
+        assert body["chat_ws_url"] == f"/tools/deepsearch/{uid}/chat"
+        md = requests.get(f"{BASE_URL}/tools/deepsearch/{uid}/export.md")
+        assert md.status_code == 200, md.text
+        assert "Disk finding" in md.text
+    finally:
+        shutil.rmtree(session_dir, ignore_errors=True)
+        _clear()
+
+
 def test_session_unknown_uid_404(app_server):
     r = requests.get(
         f"{BASE_URL}/tools/deepsearch/nope/session", headers=_json_headers()