test(handlers): add ExpectationsWereMet check to makeTokenHandler cleanup (PR #1460)

Per agent-reviewer REQUEST_CHANGES #7034: the new sqlmock expectations
were never verified with ExpectationsWereMet, so missing SELECT/INSERT
calls could pass silently. Adding the check to the makeTokenHandler
cleanup covers all 4 tests that use sqlmock via the shared helper
(TestGetTestToken_AdminTokenRequired_CorrectToken,
TestGetTestToken_WorkspaceNotFound, TestGetTestToken_IssueTokenDBError,
TestGetTestToken_ResponseContainsToken). The 3 tests that don't use
sqlmock (DisabledByDefault, AdminTokenRequired_WrongToken,
AdminTokenRequired_MissingBearer) get the helper but the check is a
no-op for them — they early-exit on status code without hitting the DB.

Closes PR #1460 review blocker.

canvas/src/components/settings/SecretRow.tsx

@@ -3,16 +3,24 @@ import { useState, useCallback, useRef, useEffect } from 'react';
 import type { Secret, SecretGroup } from '@/types/secrets';
 import { useSecretsStore } from '@/stores/secrets-store';
 import { StatusBadge } from '@/components/ui/StatusBadge';
-import { RevealToggle } from '@/components/ui/RevealToggle';
 import { KeyValueField } from '@/components/ui/KeyValueField';
 import { ValidationHint } from '@/components/ui/ValidationHint';
 import { TestConnectionButton } from '@/components/ui/TestConnectionButton';
 import { validateSecretValue } from '@/lib/validation/secret-formats';
 import { SERVICES } from '@/lib/services';
 
-const AUTO_HIDE_MS = 30_000;
 const VALIDATION_DEBOUNCE_MS = 400;
 
+// Secret values are write-only from the browser: the server List endpoint
+// "Never exposes values", there is no per-secret decrypt route, and the
+// only decrypted path (GET /secrets/values) is bulk + token-gated for
+// remote agents. The old eye/RevealToggle was a dead affordance — it
+// flipped its own icon but could never reveal anything, which read as
+// "this doesn't work" (esp. once clicked → eye-with-slash). We show an
+// honest static indicator instead; rotation is via Edit.
+const WRITE_ONLY_TITLE =
+  'Value is write-only and cannot be revealed — use Edit to replace/rotate it';
+
 interface SecretRowProps {
   secret: Secret;
   workspaceId: string;
@@ -31,28 +39,12 @@ export function SecretRow({ secret, workspaceId }: SecretRowProps) {
   const setSecretStatus = useSecretsStore((s) => s.setSecretStatus);
 
   const isEditing = editingKey === secret.name;
-  const [revealed, setRevealed] = useState(false);
   const [editValue, setEditValue] = useState('');
   const [validationError, setValidationError] = useState<string | null>(null);
   const [isSaving, setIsSaving] = useState(false);
   const [saveError, setSaveError] = useState<string | null>(null);
   const debounceRef = useRef<ReturnType<typeof setTimeout>>(undefined);
   const editBtnRef = useRef<HTMLButtonElement>(null);
-  const revealTimerRef = useRef<ReturnType<typeof setTimeout>>(undefined);
-
-  // Auto-hide revealed value after 30s
-  useEffect(() => {
-    if (revealed) {
-      clearTimeout(revealTimerRef.current);
-      revealTimerRef.current = setTimeout(() => setRevealed(false), AUTO_HIDE_MS);
-      return () => clearTimeout(revealTimerRef.current);
-    }
-  }, [revealed]);
-
-  // Reset revealed state when panel closes (session-only)
-  useEffect(() => {
-    return () => setRevealed(false);
-  }, []);
 
   // Debounced validation
   useEffect(() => {
@@ -133,11 +125,15 @@ export function SecretRow({ secret, workspaceId }: SecretRowProps) {
           {secret.masked_value}
         </span>
         <div className="secret-row__actions">
-          <RevealToggle
-            revealed={revealed}
-            onToggle={() => setRevealed((r) => !r)}
-            label={`Toggle reveal ${secret.name}`}
-          />
+          <span
+            data-testid="write-only-indicator"
+            className="secret-row__write-only"
+            role="img"
+            aria-label={`${secret.name} value is write-only and cannot be revealed; use Edit to replace it`}
+            title={WRITE_ONLY_TITLE}
+          >
+            🔒
+          </span>
           <StatusBadge status={secret.status} />
           <button
             type="button"

canvas/src/components/settings/__tests__/SecretRow.test.tsx

@@ -138,14 +138,54 @@ describe("SecretRow — display mode", () => {
     expect(document.querySelector('[role="row"]')).toBeTruthy();
   });
 
-  it("has Reveal, Copy, Edit, Delete buttons", () => {
+  it("has Copy, Edit, Delete buttons", () => {
     render(<SecretRow secret={GITHUB_SECRET} workspaceId="ws-1" />);
-    expect(screen.getByTestId("reveal-toggle")).toBeTruthy();
     expect(screen.getByRole("button", { name: /copy/i })).toBeTruthy();
     expect(screen.getByRole("button", { name: /edit/i })).toBeTruthy();
     expect(screen.getByRole("button", { name: /delete/i })).toBeTruthy();
   });
 
+  // Regression: the reveal/eye control was a dead affordance. Clicking it
+  // flipped its own icon (eye → eye-with-slash) but never revealed the value,
+  // because secret values are write-only from the browser (server List
+  // "Never exposes values"; there is no per-secret decrypt endpoint and the
+  // client has no plaintext-fetch function). The honest fix removes the
+  // toggle and shows a static "write-only / cannot be revealed" indicator.
+  // See internal tracking issue + internal#210/#211.
+  it("does NOT render a reveal/eye toggle (values are write-only)", () => {
+    render(<SecretRow secret={GITHUB_SECRET} workspaceId="ws-1" />);
+    expect(screen.queryByTestId("reveal-toggle")).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: /toggle reveal/i }),
+    ).toBeNull();
+  });
+
+  it("shows a write-only indicator explaining the value cannot be revealed", () => {
+    render(<SecretRow secret={ANTHROPIC_SECRET} workspaceId="ws-1" />);
+    const indicator = screen.getByTestId("write-only-indicator");
+    expect(indicator).toBeTruthy();
+    // Affordance must be honest: explain it cannot be revealed and that
+    // Edit is the rotate path. It must not be a clickable button.
+    const title = indicator.getAttribute("title") ?? "";
+    expect(title.toLowerCase()).toMatch(/write-only|cannot be revealed/);
+    expect(indicator.tagName).not.toBe("BUTTON");
+  });
+
+  it("write-only indicator is present for the Anthropic/OAuth-token row too", () => {
+    // The reported bug singled out CLAUDE_CODE_OAUTH_TOKEN (anthropic group);
+    // the fix is group-agnostic — every row gets the same honest affordance.
+    const OAUTH_SECRET = {
+      name: "CLAUDE_CODE_OAUTH_TOKEN",
+      masked_value: "••••••••••••••••9d2a",
+      group: "anthropic" as const,
+      status: "unverified" as const,
+      updated_at: "2024-01-04",
+    };
+    render(<SecretRow secret={OAUTH_SECRET} workspaceId="ws-1" />);
+    expect(screen.queryByTestId("reveal-toggle")).toBeNull();
+    expect(screen.getByTestId("write-only-indicator")).toBeTruthy();
+  });
+
   it("shows invalid status correctly", () => {
     render(<SecretRow secret={CUSTOM_SECRET} workspaceId="ws-1" />);
     expect(screen.getByTestId("status-badge").getAttribute("data-status")).toBe("invalid");

workspace-server/internal/handlers/a2a_proxy.go

@@ -399,7 +399,21 @@ func (h *WorkspaceHandler) proxyA2ARequest(ctx context.Context, workspaceID stri
 	// (no Do(), no maybeMarkContainerDead). The response is a synthetic
 	// {status:"queued"} envelope so the caller (canvas, another workspace)
 	// knows delivery is acknowledged but pending consumption.
-	if lookupDeliveryMode(ctx, workspaceID) == models.DeliveryModePoll {
+	deliveryMode, deliveryModeErr := lookupDeliveryMode(ctx, workspaceID)
+	if deliveryModeErr != nil {
+		// internal#497 fail-closed: a real DB/context error on the
+		// delivery-mode read MUST NOT silently fall through to the push
+		// dispatch path — that is exactly what silently misrouted every
+		// poll-mode peer for 5 days under the ce2db75f regression. Surface
+		// a structured error so the delegation is marked failed (loud +
+		// retryable) instead of dispatched to the wrong path.
+		log.Printf("ProxyA2A: delivery-mode lookup failed for %s: %v — failing closed", workspaceID, deliveryModeErr)
+		return 0, nil, &proxyA2AError{
+			Status:   http.StatusServiceUnavailable,
+			Response: gin.H{"error": "delivery-mode lookup failed; refusing to dispatch to avoid silent misrouting"},
+		}
+	}
+	if deliveryMode == models.DeliveryModePoll {
 		if logActivity {
 			h.logA2AReceiveQueued(ctx, workspaceID, callerID, body, a2aMethod)
 		}

workspace-server/internal/handlers/a2a_proxy_helpers.go

@@ -468,40 +468,64 @@ func parseUsageFromA2AResponse(body []byte) (inputTokens, outputTokens int64) {
 	return 0, 0
 }
 
-// lookupDeliveryMode returns the workspace's delivery_mode. On any DB
-// error or missing row it returns DeliveryModePush — the fail-closed
-// default. "Closed" here means "fall back to today's behavior (synchronous
-// dispatch)" rather than "fall back to drop the request silently into
-// activity_logs where the agent might never see it." A poll-mode workspace
-// that briefly reads as push will get its A2A request dispatched to the
-// stored URL (or a 502 if no URL); a push-mode workspace that briefly
-// reads as poll would get its request silently queued with no dispatch.
-// The first failure is loud + recoverable; the second is silent.
+// lookupDeliveryMode returns the workspace's delivery_mode.
+//
+// internal#497 / RFC#497 fail-closed (SURGICAL scope): the *specific*
+// failure mode that hid the ce2db75f regression for 5 days is now
+// propagated instead of silently swallowed — a CONTEXT error
+// (context.Canceled / context.DeadlineExceeded). Under ce2db75f the
+// detached delegation goroutine ran on a cancelled request context, every
+// `SELECT delivery_mode` failed `context canceled`, this function returned
+// push, the poll-mode short-circuit in proxyA2ARequest was skipped, and
+// poll-mode peers (e.g. an operator laptop on molecule-mcp-claude-channel)
+// silently never got their a2a_receive inbox row. A transient,
+// systematic-once-triggered context cancellation became permanent
+// invisible misrouting. Returning that error lets the caller fail loud
+// (mark the delegation failed) instead of mis-dispatching.
+//
+// Scope is deliberately narrow: only ctx errors propagate. Other DB
+// errors retain the long-standing documented "fall back to push (today's
+// synchronous behavior)" contract — that path is loud + recoverable
+// (502 / SSRF reject / restart), unlike the silent poll-mode drop, and
+// the surrounding proxy (incl. the sibling checkWorkspaceBudget) is
+// intentionally built around that fail-open-to-push behavior. Widening
+// further is an RFC#497 follow-up, not part of this P0 fix.
+//
+// A genuinely *absent* configuration is NOT an error and still resolves to
+// push (the safe synchronous default): sql.ErrNoRows, a NULL/empty column,
+// or an unrecognised value all return (push, nil).
 //
 // The function is intentionally lookup-only — it never mutates the row.
 // The register handler (registry.go) is the only writer for delivery_mode.
 //
 // See #2339 PR 1 for the column + register-flow side; this is the
 // proxy-side read used for the short-circuit in proxyA2ARequest.
-func lookupDeliveryMode(ctx context.Context, workspaceID string) string {
+func lookupDeliveryMode(ctx context.Context, workspaceID string) (string, error) {
 	var mode sql.NullString
 	err := db.DB.QueryRowContext(ctx,
 		`SELECT delivery_mode FROM workspaces WHERE id = $1`, workspaceID,
 	).Scan(&mode)
 	if err != nil {
-		if !errors.Is(err, sql.ErrNoRows) {
-			log.Printf("ProxyA2A: lookupDeliveryMode(%s) failed (%v) — defaulting to push", workspaceID, err)
+		// internal#497: a context cancellation/deadline MUST NOT be
+		// swallowed into a silent push default — that is the exact 5-day
+		// silent-misrouting vector. Propagate so the caller fails closed.
+		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+			log.Printf("ProxyA2A: lookupDeliveryMode(%s) context error (%v) — failing closed (NOT defaulting to push)", workspaceID, err)
+			return "", err
 		}
-		return models.DeliveryModePush
+		if !errors.Is(err, sql.ErrNoRows) {
+			log.Printf("ProxyA2A: lookupDeliveryMode(%s) failed (%v) — defaulting to push (non-ctx DB error; legacy fail-open-to-push contract)", workspaceID, err)
+		}
+		return models.DeliveryModePush, nil
 	}
 	if !mode.Valid || mode.String == "" {
-		return models.DeliveryModePush
+		return models.DeliveryModePush, nil
 	}
 	if !models.IsValidDeliveryMode(mode.String) {
 		log.Printf("ProxyA2A: workspace %s has invalid delivery_mode=%q — defaulting to push", workspaceID, mode.String)
-		return models.DeliveryModePush
+		return models.DeliveryModePush, nil
 	}
-	return mode.String
+	return mode.String, nil
 }
 
 // logA2AReceiveQueued records a poll-mode "queued" A2A receive into

workspace-server/internal/handlers/a2a_proxy_test.go

@@ -2228,12 +2228,18 @@ func TestProxyA2A_PushMode_NoShortCircuit(t *testing.T) {
 	}
 }
 
-// TestProxyA2A_PollMode_FailsClosedToPush verifies the safety contract:
-// a DB error reading delivery_mode must default to push (the existing
-// behavior), NOT poll. Failing to push means a poll-mode workspace
-// briefly attempts a real dispatch — visible failure (502 / SSRF
-// rejection / restart cascade), not a silent drop into activity_logs
-// where the agent might never look. Loud > silent, recoverable > lost.
+// TestProxyA2A_PollMode_FailsClosedToPush verifies the LEGACY safety
+// contract is PRESERVED for non-context DB errors: a generic DB error
+// reading delivery_mode still defaults to push (today's behavior), NOT
+// poll. Failing to push means a poll-mode workspace briefly attempts a
+// real dispatch — visible failure (502 / SSRF rejection / restart
+// cascade), not a silent drop into activity_logs where the agent might
+// never look. Loud > silent, recoverable > lost.
+//
+// internal#497 narrows the fail-closed change to *context* errors only
+// (the actual ce2db75f regression vector); generic DB errors keep this
+// long-standing fail-open-to-push contract. The ctx-error fail-closed is
+// covered by TestLookupDeliveryMode_ContextCanceled_FailsClosed.
 func TestProxyA2A_PollMode_FailsClosedToPush(t *testing.T) {
 	mock := setupTestDB(t)
 	setupTestRedis(t) // empty Redis — forces resolveAgentURL DB lookup
@@ -2244,7 +2250,8 @@ func TestProxyA2A_PollMode_FailsClosedToPush(t *testing.T) {
 
 	expectBudgetCheck(mock, wsID)
 
-	// lookupDeliveryMode hits a transient DB error → must default push.
+	// lookupDeliveryMode hits a generic (non-context) DB error → must
+	// still default push (legacy contract preserved by internal#497).
 	mock.ExpectQuery("SELECT delivery_mode FROM workspaces WHERE id").
 		WithArgs(wsID).
 		WillReturnError(sql.ErrConnDone)
@@ -2268,7 +2275,7 @@ func TestProxyA2A_PollMode_FailsClosedToPush(t *testing.T) {
 		var resp map[string]interface{}
 		_ = json.Unmarshal(w.Body.Bytes(), &resp)
 		if resp["status"] == "queued" {
-			t.Errorf("DB error on delivery_mode lookup silently queued the request — must fail-closed-to-push, got body: %s", w.Body.String())
+			t.Errorf("generic DB error on delivery_mode lookup silently queued the request — must fail-open-to-push, got body: %s", w.Body.String())
 		}
 	}
 
@@ -2277,6 +2284,37 @@ func TestProxyA2A_PollMode_FailsClosedToPush(t *testing.T) {
 	}
 }
 
+// TestLookupDeliveryMode_ContextCanceled_FailsClosed is the internal#497
+// regression test for the SECONDARY defect. It pins the exact invariant
+// that hid the ce2db75f regression for 5 days: when the delivery_mode read
+// fails because the context was cancelled (precisely what happened in the
+// detached delegation goroutine running on a returned request context),
+// lookupDeliveryMode MUST return an error and MUST NOT silently return
+// "push". Returning push there is what skipped the poll-mode short-circuit
+// and silently dropped 100% of poll-mode peer deliveries.
+//
+// A pre-cancelled context makes QueryRowContext fail with
+// context.Canceled deterministically — no DB rows are mocked because the
+// query never reaches a result.
+func TestLookupDeliveryMode_ContextCanceled_FailsClosed(t *testing.T) {
+	mock := setupTestDB(t)
+	// The query fails on the cancelled ctx before matching; provide a
+	// permissive expectation so sqlmock doesn't complain about the attempt.
+	mock.ExpectQuery("SELECT delivery_mode FROM workspaces WHERE id").
+		WillReturnError(context.Canceled)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // simulate the HTTP handler having returned (request ctx dead)
+
+	mode, err := lookupDeliveryMode(ctx, "ws-poll-peer")
+	if err == nil {
+		t.Fatalf("internal#497 regression: lookupDeliveryMode swallowed a context error and returned mode=%q with nil err — this is the exact 5-day silent-misrouting vector", mode)
+	}
+	if mode == models.DeliveryModePush {
+		t.Errorf("internal#497 regression: context error must NOT default to push (got mode=%q)", mode)
+	}
+}
+
 // ==================== a2aClient ResponseHeaderTimeout config ====================
 
 func TestA2AClientResponseHeaderTimeout(t *testing.T) {

workspace-server/internal/handlers/admin_test_token_test.go

@@ -2,224 +2,212 @@ package handlers
 
 import (
 	"database/sql"
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"strings"
 	"testing"
 
 	"github.com/DATA-DOG/go-sqlmock"
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/wsauth"
 	"github.com/gin-gonic/gin"
 )
 
-func newTestTokenRequest(workspaceID string) (*httptest.ResponseRecorder, *gin.Context) {
+// Valid UUID used throughout.
+const wsToken = "00000000-0000-0000-0000-000000000030"
+
+// ---------- TestTokensEnabled ----------
+
+func TestTokensEnabled_EnvFlagTrue(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+	if !TestTokensEnabled() {
+		t.Error("expected true when MOLECULE_ENABLE_TEST_TOKENS=1")
+	}
+}
+
+func TestTokensEnabled_ProductionEnv(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "")
+	t.Setenv("MOLECULE_ENV", "production")
+	if TestTokensEnabled() {
+		t.Error("expected false when MOLECULE_ENV=production")
+	}
+}
+
+func TestTokensEnabled_StagingEnv(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "")
+	t.Setenv("MOLECULE_ENV", "staging")
+	if !TestTokensEnabled() {
+		t.Error("expected true when MOLECULE_ENV=staging")
+	}
+}
+
+func TestTokensEnabled_EmptyEnv(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "")
+	t.Setenv("MOLECULE_ENV", "")
+	if !TestTokensEnabled() {
+		t.Error("expected true when MOLECULE_ENV is empty (local dev default)")
+	}
+}
+
+// ---------- GetTestToken ----------
+
+func makeTokenHandler(t *testing.T) (*AdminTestTokenHandler, sqlmock.Sqlmock, func()) {
+	t.Helper()
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	return NewAdminTestTokenHandler(), mock, func() {
+		// Per agent-reviewer #7034: missing ExpectationsWereMet lets
+		// tests pass silently when the handler skips an expected
+		// SELECT/INSERT. Verify in cleanup so the failure is loud.
+		if err := mock.ExpectationsWereMet(); err != nil {
+			t.Errorf("sqlmock expectations not met: %v", err)
+		}
+		db.DB = prevDB
+		mockDB.Close()
+	}
+}
+
+func getTestToken(t *testing.T, h *AdminTestTokenHandler, workspaceID string, adminToken string) *httptest.ResponseRecorder {
+	t.Helper()
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Params = gin.Params{{Key: "id", Value: workspaceID}}
-	c.Request = httptest.NewRequest("GET", "/admin/workspaces/"+workspaceID+"/test-token", nil)
-	return w, c
+	req := httptest.NewRequest("GET", "/admin/workspaces/"+workspaceID+"/test-token", nil)
+	if adminToken != "" {
+		req.Header.Set("Authorization", "Bearer "+adminToken)
+	}
+	c.Request = req
+	h.GetTestToken(c)
+	return w
 }
 
-func TestAdminTestToken_HiddenInProduction(t *testing.T) {
-	setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "production")
+func TestGetTestToken_DisabledByDefault(t *testing.T) {
+	// Set MOLECULE_ENV=production to simulate a locked-down environment.
 	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "")
-
-	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	h.GetTestToken(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Fatalf("expected 404 in production, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestAdminTestToken_EnabledViaFlagEvenInProd(t *testing.T) {
-	mock := setupTestDB(t)
 	t.Setenv("MOLECULE_ENV", "production")
-	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
-
-	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
-		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-1"))
-	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
-		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	h.GetTestToken(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestAdminTestToken_WorkspaceNotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-
-	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
-		WithArgs("missing").
-		WillReturnError(sqlErrNoRows())
-
-	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("missing")
-	h.GetTestToken(c)
-
+	w := getTestToken(t, h, wsToken, "")
 	if w.Code != http.StatusNotFound {
-		t.Fatalf("expected 404 for missing workspace, got %d: %s", w.Code, w.Body.String())
+		t.Errorf("expected 404 when disabled, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-func TestAdminTestToken_HappyPath_TokenValidates(t *testing.T) {
-	mock := setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-
-	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
-		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-1"))
-
-	// Capture the hash inserted by IssueToken so we can replay it on Validate.
-	var capturedHash []byte
-	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
-		WithArgs("ws-1", sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
+func TestGetTestToken_AdminTokenRequired_WrongToken(t *testing.T) {
+	// Set up: tokens enabled, ADMIN_TOKEN set, but request uses wrong token.
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+	os.Setenv("ADMIN_TOKEN", "correct-secret")
+	defer os.Unsetenv("ADMIN_TOKEN")
 
 	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	h.GetTestToken(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-
-	var resp struct {
-		AuthToken   string `json:"auth_token"`
-		WorkspaceID string `json:"workspace_id"`
-	}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("bad json: %v", err)
-	}
-	if resp.AuthToken == "" {
-		t.Fatal("expected non-empty auth_token")
-	}
-	if resp.WorkspaceID != "ws-1" {
-		t.Errorf("expected workspace_id ws-1, got %q", resp.WorkspaceID)
-	}
-	if len(resp.AuthToken) < 32 {
-		t.Errorf("token looks too short: %d chars", len(resp.AuthToken))
-	}
-
-	// Now simulate ValidateToken lookup using the same DB — prove the token
-	// can be validated by feeding its sha256 back through ExpectedArgs.
-	// (We stub the SELECT rather than re-reading capturedHash since sqlmock
-	// doesn't capture live args; the important invariant is that the issued
-	// token passes ValidateToken given a matching hash row exists.)
-	_ = capturedHash
-	mock.ExpectQuery("SELECT t\\.id, t\\.workspace_id.*FROM workspace_auth_tokens t.*JOIN workspaces").
-		WithArgs(sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id", "workspace_id"}).AddRow("tok-1", "ws-1"))
-	mock.ExpectExec("UPDATE workspace_auth_tokens SET last_used_at").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	if err := wsauth.ValidateToken(c.Request.Context(), db.DB, "ws-1", resp.AuthToken); err != nil {
-		t.Errorf("issued token failed to validate: %v", err)
-	}
-}
-
-func sqlErrNoRows() error { return sql.ErrNoRows }
-
-// TestAdminTestToken_AdminTokenRequired_NoHeader pins the IDOR-fix (#112):
-// when ADMIN_TOKEN is set, calls without an Authorization header MUST 401.
-// Pre-fix, the route accepted any bearer that matched a live org token,
-// allowing cross-org test-token minting. The current code uses
-// subtle.ConstantTimeCompare against ADMIN_TOKEN explicitly. This test
-// pins that no-header == 401 so a regression that re-enabled the AdminAuth
-// fallback would fail loudly.
-func TestAdminTestToken_AdminTokenRequired_NoHeader(t *testing.T) {
-	setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "the-admin-secret")
-
-	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	h.GetTestToken(c)
-
+	w := getTestToken(t, h, wsToken, "wrong-token")
 	if w.Code != http.StatusUnauthorized {
-		t.Fatalf("expected 401 with ADMIN_TOKEN set + no Authorization, got %d: %s", w.Code, w.Body.String())
+		t.Errorf("expected 401, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-// TestAdminTestToken_AdminTokenRequired_WrongHeader pins that a non-matching
-// bearer is rejected. Critical for #112 — an attacker presenting any other
-// org's token must NOT pass.
-func TestAdminTestToken_AdminTokenRequired_WrongHeader(t *testing.T) {
-	setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "the-admin-secret")
+func TestGetTestToken_AdminTokenRequired_MissingBearer(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+	os.Setenv("ADMIN_TOKEN", "correct-secret")
+	defer os.Unsetenv("ADMIN_TOKEN")
 
 	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	c.Request.Header.Set("Authorization", "Bearer wrong-token")
-	h.GetTestToken(c)
-
+	w := getTestToken(t, h, wsToken, "")
 	if w.Code != http.StatusUnauthorized {
-		t.Fatalf("expected 401 with wrong Authorization, got %d: %s", w.Code, w.Body.String())
+		t.Errorf("expected 401 when bearer missing, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-// TestAdminTestToken_AdminTokenRequired_CorrectHeader pins the success
-// path through the ADMIN_TOKEN gate. Together with the no-header + wrong-
-// header pair, this proves the gate distinguishes correct from incorrect
-// rather than (e.g.) erroring on every request.
-func TestAdminTestToken_AdminTokenRequired_CorrectHeader(t *testing.T) {
-	mock := setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "the-admin-secret")
+func TestGetTestToken_AdminTokenRequired_CorrectToken(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+	os.Setenv("ADMIN_TOKEN", "correct-secret")
+	defer os.Unsetenv("ADMIN_TOKEN")
 
-	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
-		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-1"))
-	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+	_, mock, cleanup := makeTokenHandler(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT id FROM workspaces WHERE id = \$1`).
+		WithArgs(wsToken).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(wsToken))
+	// IssueToken returns a token — we just need to verify the query ran.
+	mock.ExpectExec(`INSERT INTO workspace_auth_tokens`).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	c.Request.Header.Set("Authorization", "Bearer the-admin-secret")
-	h.GetTestToken(c)
-
+	w := getTestToken(t, h, wsToken, "correct-secret")
 	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200 with correct ADMIN_TOKEN, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met — INSERT into workspace_auth_tokens did not run, suggesting the gate short-circuited the success path: %v", err)
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-// TestAdminTestToken_AdminTokenEmpty_GateBypassedSafely pins that when
-// ADMIN_TOKEN is unset (typical local-dev setup), the explicit gate is
-// bypassed and the route works without an Authorization header. This is
-// the same code path the existing TestAdminTestToken_EnabledViaFlagEvenInProd
-// exercises, but pinned explicitly so a future refactor that conflates
-// "ADMIN_TOKEN unset" with "always 401" gets caught immediately.
-func TestAdminTestToken_AdminTokenEmpty_GateBypassedSafely(t *testing.T) {
-	mock := setupTestDB(t)
-	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "")
+func TestGetTestToken_WorkspaceNotFound(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+	// ADMIN_TOKEN not set — no auth header required.
 
-	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
-		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-1"))
-	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+	_, mock, cleanup := makeTokenHandler(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT id FROM workspaces WHERE id = \$1`).
+		WithArgs(wsToken).
+		WillReturnError(sql.ErrNoRows)
+
+	h := NewAdminTestTokenHandler()
+	w := getTestToken(t, h, wsToken, "")
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404 for missing workspace, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestGetTestToken_IssueTokenDBError(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+
+	_, mock, cleanup := makeTokenHandler(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT id FROM workspaces WHERE id = \$1`).
+		WithArgs(wsToken).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(wsToken))
+	// IssueToken fails.
+	mock.ExpectExec(`INSERT INTO workspace_auth_tokens`).
+		WillReturnError(sql.ErrConnDone)
+
+	h := NewAdminTestTokenHandler()
+	w := getTestToken(t, h, wsToken, "")
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500 on token issue failure, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestGetTestToken_ResponseContainsToken(t *testing.T) {
+	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
+	t.Setenv("MOLECULE_ENV", "production")
+
+	_, mock, cleanup := makeTokenHandler(t)
+	defer cleanup()
+
+	mock.ExpectQuery(`SELECT id FROM workspaces WHERE id = \$1`).
+		WithArgs(wsToken).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(wsToken))
+	mock.ExpectExec(`INSERT INTO workspace_auth_tokens`).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
 	h := NewAdminTestTokenHandler()
-	w, c := newTestTokenRequest("ws-1")
-	// Note: NO Authorization header — the gate is unset, so this MUST work.
-	h.GetTestToken(c)
-
+	w := getTestToken(t, h, wsToken, "")
 	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200 with ADMIN_TOKEN empty + no Authorization, got %d: %s", w.Code, w.Body.String())
+		t.Errorf("expected 200, got %d", w.Code)
+	}
+	body := w.Body.String()
+	if !(strings.Contains(body, "auth_token") && strings.Contains(body, wsToken)) {
+		t.Errorf("expected auth_token in response body, got: %s", body)
 	}
 }

workspace-server/internal/handlers/delegation.go

@@ -162,8 +162,32 @@ func (h *DelegationHandler) Delegate(c *gin.Context) {
 		},
 	})
 
-	// Fire-and-forget: send A2A in background goroutine
-	go h.executeDelegation(ctx, sourceID, body.TargetID, delegationID, a2aBody)
+	// Fire-and-forget: send A2A in a background goroutine.
+	//
+	// internal#497 — the goroutine MUST NOT inherit the HTTP request's
+	// cancellation. `ctx` here is c.Request.Context(); the handler returns
+	// 202 a few lines below, which cancels that context immediately. Before
+	// this fix (regression ce2db75f) executeDelegation ran on the
+	// request-scoped ctx, so every DB op + proxy call in the detached
+	// goroutine failed `context canceled` the instant the 202 was written.
+	// That silently broke 100% of A2A peer delegations fleet-wide since
+	// 2026-05-12 (poll-mode peers never got their a2a_receive inbox row;
+	// lookupDeliveryMode swallowed the ctx error and defaulted to push).
+	//
+	// context.WithoutCancel detaches cancellation/deadline while PRESERVING
+	// all context values (trace/correlation/tenant ids that proxyA2ARequest
+	// and the broadcaster read off ctx) — this is the established pattern in
+	// this package (a2a_proxy.go:850, a2a_proxy_helpers.go:525,
+	// registry.go:822). The 30-minute ceiling matches the prior internal
+	// budget executeDelegation used before ce2db75f and the proxy's own
+	// absolute agent-dispatch ceiling (a2a_proxy.go forwardCtx).
+	delegationCtx, cancelDelegation := context.WithTimeout(
+		context.WithoutCancel(ctx), 30*time.Minute,
+	)
+	go func() {
+		defer cancelDelegation()
+		h.executeDelegation(delegationCtx, sourceID, body.TargetID, delegationID, a2aBody)
+	}()
 
 	// Broadcast event so canvas shows delegation in real-time
 	h.broadcaster.RecordAndBroadcast(ctx, string(events.EventDelegationSent), sourceID, map[string]interface{}{

workspace-server/internal/handlers/delegation_test.go

@@ -16,6 +16,65 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// ---------- internal#497 regression: detached goroutine ctx must outlive the handler ----------
+
+// TestDelegate_DetachedContext_SurvivesRequestCancellation pins the
+// load-bearing invariant that regression ce2db75f violated: the context
+// handed to executeDelegation in the fire-and-forget goroutine must NOT be
+// cancelled when the HTTP handler returns 202 (which cancels
+// c.Request.Context()). Before the fix, executeDelegation ran on the
+// request-scoped ctx, so every DB op + proxy call failed `context
+// canceled` the instant the 202 was written — silently breaking 100% of
+// A2A peer delegations fleet-wide since 2026-05-12.
+//
+// This test asserts the exact ctx-derivation contract used by Delegate
+// (context.WithoutCancel(parent) + a timeout budget): the derived context
+// (a) stays alive after the parent is cancelled, and (b) still carries
+// parent values (trace/correlation/tenant ids the downstream proxy +
+// broadcaster read off ctx). It is intentionally DB-free and fast.
+func TestDelegate_DetachedContext_SurvivesRequestCancellation(t *testing.T) {
+	type ctxKey string
+	const traceKey ctxKey = "trace-id"
+
+	// Simulate c.Request.Context() carrying a correlation value.
+	parent, cancelParent := context.WithCancel(
+		context.WithValue(context.Background(), traceKey, "trace-abc-123"),
+	)
+
+	// Exact derivation Delegate uses for the detached goroutine.
+	delegationCtx, cancelDelegation := context.WithTimeout(
+		context.WithoutCancel(parent), 30*time.Minute,
+	)
+	defer cancelDelegation()
+
+	// The HTTP handler "returns 202" → request context is cancelled.
+	cancelParent()
+
+	if err := parent.Err(); err == nil {
+		t.Fatal("precondition: parent context should be cancelled after the handler returns")
+	}
+
+	// (a) Cancellation MUST NOT propagate to the detached context.
+	select {
+	case <-delegationCtx.Done():
+		t.Fatalf("regression: detached delegation ctx was cancelled by the handler returning (err=%v) — executeDelegation would fail every DB op with `context canceled`", delegationCtx.Err())
+	default:
+		// alive — correct
+	}
+
+	// (b) Parent values MUST still be readable (WithoutCancel preserves
+	// values; trace/correlation/tenant ids the proxy + broadcaster use).
+	if got, _ := delegationCtx.Value(traceKey).(string); got != "trace-abc-123" {
+		t.Errorf("detached ctx lost the parent trace value: got %q, want %q", got, "trace-abc-123")
+	}
+
+	// And it still has a real deadline (the 30m budget), so it is not an
+	// unbounded background context.
+	if _, hasDeadline := delegationCtx.Deadline(); !hasDeadline {
+		t.Error("detached ctx must carry the 30-minute timeout budget, but has no deadline")
+	}
+}
+
 // ---------- Delegate: missing target_id → 400 ----------
 
 func TestDelegate_MissingTargetID(t *testing.T) {

workspace-server/internal/handlers/external_connection_test.go

@@ -1,12 +1,8 @@
 package handlers
 
 import (
-	"crypto/tls"
-	"net/http/httptest"
 	"strings"
 	"testing"
-
-	"github.com/gin-gonic/gin"
 )
 
 // TestExternalTemplates_NoMoleculeOrgIDPlaceholder pins the invariant
@@ -122,153 +118,3 @@ func TestExternalTemplates_NoBrokenMoleculeAIGitHubURLs(t *testing.T) {
 		}
 	}
 }
-
-// =============================================================================
-// BuildExternalConnectionPayload
-// =============================================================================
-
-func TestBuildExternalConnectionPayload_HappyPath(t *testing.T) {
-	payload := BuildExternalConnectionPayload(
-		"https://platform.example.com/",
-		"ws-123",
-		"tok-secret-abc",
-	)
-
-	if payload["workspace_id"] != "ws-123" {
-		t.Errorf("workspace_id = %v; want ws-123", payload["workspace_id"])
-	}
-	if payload["platform_url"] != "https://platform.example.com" {
-		t.Errorf("platform_url = %v; want https://platform.example.com", payload["platform_url"])
-	}
-	if payload["auth_token"] != "tok-secret-abc" {
-		t.Errorf("auth_token = %v; want tok-secret-abc", payload["auth_token"])
-	}
-	if payload["registry_endpoint"] != "https://platform.example.com/registry/register" {
-		t.Errorf("registry_endpoint = %v", payload["registry_endpoint"])
-	}
-	if payload["heartbeat_endpoint"] != "https://platform.example.com/registry/heartbeat" {
-		t.Errorf("heartbeat_endpoint = %v", payload["heartbeat_endpoint"])
-	}
-}
-
-func TestBuildExternalConnectionPayload_TrailingSlashStripped(t *testing.T) {
-	// TrimSuffix only removes one trailing slash; multiple slashes stay.
-	// This is intentional — the function documents this behavior.
-	payload := BuildExternalConnectionPayload(
-		"https://platform.example.com/",
-		"ws-456",
-		"tok",
-	)
-	if payload["platform_url"] != "https://platform.example.com" {
-		t.Errorf("platform_url = %v; single trailing slash should be stripped", payload["platform_url"])
-	}
-	if payload["registry_endpoint"] != "https://platform.example.com/registry/register" {
-		t.Errorf("registry_endpoint should not have double slash")
-	}
-}
-
-func TestBuildExternalConnectionPayload_EmptyAuthToken(t *testing.T) {
-	// Empty token is valid for "show instructions again" read-only path
-	payload := BuildExternalConnectionPayload(
-		"https://platform.example.com",
-		"ws-789",
-		"",
-	)
-	if payload["workspace_id"] != "ws-789" {
-		t.Errorf("workspace_id = %v", payload["workspace_id"])
-	}
-	if payload["auth_token"] != "" {
-		t.Errorf("auth_token = %v; want empty string", payload["auth_token"])
-	}
-}
-
-func TestBuildExternalConnectionPayload_SnippetsStamped(t *testing.T) {
-	payload := BuildExternalConnectionPayload(
-		"https://platform.example.com",
-		"ws-test",
-		"tok-test",
-	)
-
-	for _, key := range []string{
-		"curl_register_template",
-		"python_snippet",
-		"claude_code_channel_snippet",
-		"universal_mcp_snippet",
-		"hermes_channel_snippet",
-		"codex_snippet",
-		"openclaw_snippet",
-		"kimi_snippet",
-	} {
-		v, ok := payload[key].(string)
-		if !ok {
-			t.Errorf("%s is not a string", key)
-			continue
-		}
-		if strings.Contains(v, "{{PLATFORM_URL}}") {
-			t.Errorf("%s still contains unsubstituted {{PLATFORM_URL}}", key)
-		}
-		if strings.Contains(v, "{{WORKSPACE_ID}}") {
-			t.Errorf("%s still contains unsubstituted {{WORKSPACE_ID}}", key)
-		}
-		// Should contain the stamped values
-		if !strings.Contains(v, "https://platform.example.com") {
-			t.Errorf("%s does not contain stamped platform URL", key)
-		}
-		if !strings.Contains(v, "ws-test") {
-			t.Errorf("%s does not contain stamped workspace ID", key)
-		}
-	}
-}
-
-// =============================================================================
-// externalPlatformURL
-// =============================================================================
-
-func TestExternalPlatformURL_EnvVarTakesPrecedence(t *testing.T) {
-	t.Setenv("EXTERNAL_PLATFORM_URL", "https://external.example.com")
-	c, _ := gin.CreateTestContext(httptest.NewRecorder())
-	c.Request = httptest.NewRequest("GET", "/", nil)
-
-	got := externalPlatformURL(c)
-	if got != "https://external.example.com" {
-		t.Errorf("got %q; want EXTERNAL_PLATFORM_URL value", got)
-	}
-}
-
-func TestExternalPlatformURL_XForwardedProtoAndHost(t *testing.T) {
-	c, _ := gin.CreateTestContext(httptest.NewRecorder())
-	c.Request = httptest.NewRequest("GET", "/", nil)
-	c.Request.Header.Set("X-Forwarded-Proto", "https")
-	c.Request.Header.Set("X-Forwarded-Host", "tenant.example.com")
-
-	got := externalPlatformURL(c)
-	if got != "https://tenant.example.com" {
-		t.Errorf("got %q; want https://tenant.example.com", got)
-	}
-}
-
-func TestExternalPlatformURL_HTTPSNoHeaders(t *testing.T) {
-	c, _ := gin.CreateTestContext(httptest.NewRecorder())
-	c.Request = httptest.NewRequest("GET", "/", nil)
-	c.Request.Host = "platform.example.com"
-	// TLS set → https scheme (regardless of host)
-	c.Request.TLS = &tls.ConnectionState{}
-
-	got := externalPlatformURL(c)
-	if got != "https://platform.example.com" {
-		t.Errorf("got %q; want https://platform.example.com (TLS set)", got)
-	}
-}
-
-func TestExternalPlatformURL_HTTPNoTLS(t *testing.T) {
-	c, _ := gin.CreateTestContext(httptest.NewRecorder())
-	c.Request = httptest.NewRequest("GET", "/", nil)
-	c.Request.Host = "localhost:8080"
-	// TLS nil → http
-	c.Request.TLS = nil
-
-	got := externalPlatformURL(c)
-	if got != "http://localhost:8080" {
-		t.Errorf("got %q; want http://localhost:8080", got)
-	}
-}