fix: finish 2.9.0 plugin moves and get every check green

src/backend/tests/utils/safe-outbound-fetch-proxy.test.ts

@@ -0,0 +1,53 @@
+/**
+ * An admin-allowlisted private host goes through the configured proxy; a
+ * public host never does, since the proxy would skip the address check.
+ */
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const h = vi.hoisted(() => ({
+  calls: [] as Array<{ url: string; dispatcher: unknown }>,
+  proxy: { kind: "proxy" } as unknown,
+  proxyConfigured: true,
+}));
+
+vi.mock("undici", () => ({
+  Agent: class {
+    kind = "direct";
+    async close() {}
+  },
+  fetch: async (url: string, init: { dispatcher: unknown }) => {
+    h.calls.push({ url, dispatcher: init.dispatcher });
+    return new Response("ok");
+  },
+}));
+
+vi.mock("../../utils/proxy-agent.js", () => ({
+  getProxyAgent: () => (h.proxyConfigured ? h.proxy : undefined),
+}));
+
+const { safeOutboundFetch } =
+  await import("../../utils/safe-outbound-fetch.js");
+
+beforeEach(() => {
+  h.calls.length = 0;
+  h.proxyConfigured = true;
+});
+
+describe("safeOutboundFetch and the proxy", () => {
+  it("sends an allowlisted private host through the proxy", async () => {
+    await safeOutboundFetch("http://10.0.0.5:11434/api", {}, ["10.0.0.5"]);
+    expect(h.calls[0].dispatcher).toBe(h.proxy);
+  });
+
+  it("keeps a public host on the checked direct connection", async () => {
+    await safeOutboundFetch("https://api.example.com/v1", {}, []);
+    expect(h.calls[0].dispatcher).not.toBe(h.proxy);
+  });
+
+  it("connects directly when no proxy is configured", async () => {
+    h.proxyConfigured = false;
+    await safeOutboundFetch("http://10.0.0.5/api", {}, ["10.0.0.5"]);
+    expect(h.calls[0].dispatcher).not.toBe(h.proxy);
+  });
+});

src/backend/tests/utils/session-recording-settings-migration.test.ts

@@ -11,7 +11,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 interface HostRow {
   id: number;
-  enable_session_logging: boolean | null;
+  enable_session_logging: boolean | number | null;
 }
 
 interface SettingsRow {
@@ -112,6 +112,16 @@ describe("runSessionRecordingSettingsMigration", () => {
     expect(storedValue(3, "enableSessionRecording")).toBe(false);
   });
 
+  it("reads SQLite 0 and 1 as off and on", async () => {
+    hostRows.push({ id: 6, enable_session_logging: 0 });
+    hostRows.push({ id: 7, enable_session_logging: 1 });
+
+    await runSessionRecordingSettingsMigration();
+
+    expect(storedValue(6, "enableSessionRecording")).toBe(false);
+    expect(storedValue(7, "enableSessionRecording")).toBe(true);
+  });
+
   it("treats a null legacy value as on, matching the old column default", async () => {
     hostRows.push({ id: 4, enable_session_logging: null });
 

src/backend/tests/utils/totp-migration.test.ts

@@ -167,6 +167,18 @@ describe("runTotpMigration", () => {
     expect(await runTotpMigration()).toEqual({ factors: 0, secrets: 1 });
   });
 
+  it("moves only the named user when a login opens their key", async () => {
+    setup({ pluginTable: true });
+    addTotpUser("alice", "JBSWY3DPEHPK3PXP", []);
+    addTotpUser("bob", "KRSXG5CTMVRXEZLU", []);
+
+    expect(await runTotpMigration("alice")).toEqual({ factors: 1, secrets: 1 });
+    const moved = sqlite
+      .prepare("SELECT user_id FROM p_totp_enrollments")
+      .all();
+    expect(moved).toEqual([{ user_id: "alice" }]);
+  });
+
   it("drops a duplicate core row when the plugin row already exists", async () => {
     setup({ pluginTable: true });
     sqlite.exec(`