diff --git a/workspace-server/internal/handlers/plugins_sources_test.go b/workspace-server/internal/handlers/plugins_sources_test.go
new file mode 100644
index 000000000..9e40ee4da
--- /dev/null
+++ b/workspace-server/internal/handlers/plugins_sources_test.go
@@ -0,0 +1,50 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/plugins"
+	"github.com/gin-gonic/gin"
+)
+
+// stubSources implements pluginSources for ListSources tests.
+type stubSources struct {
+	schemes []string
+}
+
+func (s *stubSources) Schemes() []string   { return s.schemes }
+func (s *stubSources) Register(_ plugins.SourceResolver) {}
+func (s *stubSources) Resolve(source plugins.Source) (plugins.SourceResolver, error) { return nil, nil }
+
+func TestListSources_ReturnsRegisteredSchemes(t *testing.T) {
+	h := &PluginsHandler{sources: &stubSources{schemes: []string{"local", "github", "clawhub"}}}
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	h.ListSources(c)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d", w.Code)
+	}
+	body := w.Body.String()
+	// Verify all three schemes appear.
+	for _, scheme := range []string{"local", "github", "clawhub"} {
+		if !strings.Contains(body, scheme) {
+			t.Errorf("expected body to contain %q, got %s", scheme, body)
+		}
+	}
+}
+
+func TestListSources_EmptySchemes(t *testing.T) {
+	h := &PluginsHandler{sources: &stubSources{schemes: []string{}}}
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	h.ListSources(c)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d", w.Code)
+	}
+	if !strings.Contains(w.Body.String(), `"schemes":[]`) {
+		t.Errorf("expected empty schemes array, got %s", w.Body.String())
+	}
+}
diff --git a/workspace-server/internal/handlers/workspace_abilities_test.go b/workspace-server/internal/handlers/workspace_abilities_test.go
new file mode 100644
index 000000000..669981376
--- /dev/null
+++ b/workspace-server/internal/handlers/workspace_abilities_test.go
@@ -0,0 +1,211 @@
+package handlers
+
+import (
+	"database/sql"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
+	"github.com/gin-gonic/gin"
+)
+
+// Valid UUIDs used throughout.
+const (
+	wsAbilities = "00000000-0000-0000-0000-000000000020"
+	wsDNE       = "00000000-0000-0000-0000-000000000021"
+	wsDBError   = "00000000-0000-0000-0000-000000000022"
+)
+
+func makeAbilitiesHandler(t *testing.T) (sqlmock.Sqlmock, func()) {
+	t.Helper()
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	return mock, func() {
+		db.DB = prevDB
+		mockDB.Close()
+	}
+}
+
+func patchAbilities(t *testing.T, workspaceID string, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: workspaceID}}
+	c.Request = httptest.NewRequest("PATCH", "/workspaces/"+workspaceID+"/abilities", strings.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+	PatchAbilities(c)
+	return w
+}
+
+func TestPatchAbilities_InvalidWorkspaceID(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	w := patchAbilities(t, "not-a-uuid", `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	// sqlmock should not have been called — validation fails before DB.
+	if mock.ExpectationsWereMet() != nil {
+		t.Errorf("unexpected DB calls: %v", mock.ExpectationsWereMet())
+	}
+}
+
+func TestPatchAbilities_MalformedJSON(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	w := patchAbilities(t, wsAbilities, `{not-json`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	if mock.ExpectationsWereMet() != nil {
+		t.Errorf("unexpected DB calls: %v", mock.ExpectationsWereMet())
+	}
+}
+
+func TestPatchAbilities_NoAbilityFields(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	w := patchAbilities(t, wsAbilities, `{}`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	if mock.ExpectationsWereMet() != nil {
+		t.Errorf("unexpected DB calls: %v", mock.ExpectationsWereMet())
+	}
+}
+
+func TestPatchAbilities_WorkspaceNotFound(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsDNE).
+		WillReturnError(sql.ErrNoRows)
+
+	w := patchAbilities(t, wsDNE, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_ExistsCheckDBError(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsDBError).
+		WillReturnError(sql.ErrConnDone)
+
+	w := patchAbilities(t, wsDBError, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateBroadcastEnabled(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilities(t, wsAbilities, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateTalkToUserEnabled(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilities(t, wsAbilities, `{"talk_to_user_enabled":true}`)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateBothAbilities(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilities(t, wsAbilities, `{"broadcast_enabled":true,"talk_to_user_enabled":true}`)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateBroadcastFalse(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled`).
+		WithArgs(wsAbilities, false).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := patchAbilities(t, wsAbilities, `{"broadcast_enabled":false}`)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateDBErrorBroadcast(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnError(sql.ErrConnDone)
+
+	w := patchAbilities(t, wsAbilities, `{"broadcast_enabled":true}`)
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPatchAbilities_UpdateDBErrorTalkToUser(t *testing.T) {
+	mock, cleanup := makeAbilitiesHandler(t)
+	defer cleanup()
+	mock.ExpectQuery(`SELECT EXISTS\(SELECT 1 FROM workspaces`).
+		WithArgs(wsAbilities).
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	// talk_to_user_enabled is the second field, so broadcast_enabled succeeds first.
+	mock.ExpectExec(`UPDATE workspaces SET broadcast_enabled`).
+		WithArgs(wsAbilities, false). // pointer=false → false
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec(`UPDATE workspaces SET talk_to_user_enabled`).
+		WithArgs(wsAbilities, true).
+		WillReturnError(sql.ErrConnDone)
+
+	w := patchAbilities(t, wsAbilities, `{"broadcast_enabled":false,"talk_to_user_enabled":true}`)
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+}