feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/test/routes-sql-meta.test.ts

@@ -0,0 +1,158 @@
+import { test, expect } from "vitest";
+import { buildApp } from "../src/app.js";
+import { loadConfig } from "../src/config.js";
+
+// ---------------------------------------------------------------------------
+// SQL routes
+// ---------------------------------------------------------------------------
+
+test("POST /sessions/:id/sql/preview returns rows from injected thtRunner stub", async () => {
+  const previewResult = {
+    columns: ["a"],
+    rows: [[1]],
+    execution_ms: 2,
+    truncated: false,
+  };
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {
+      sqlPreview: async () => previewResult,
+    } as any,
+  });
+
+  const res = await app.inject({
+    method: "POST",
+    url: "/sessions/s1/sql/preview",
+    payload: { limit: 10, offset: 0 },
+  });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual(previewResult);
+});
+
+test("POST /sessions/:id/sql/preview passes limit and offset to thtRunner", async () => {
+  let captured: any;
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {
+      sqlPreview: async (id: string, p: any) => {
+        captured = { id, ...p };
+        return { columns: [], rows: [], execution_ms: 0, truncated: false };
+      },
+    } as any,
+  });
+
+  await app.inject({
+    method: "POST",
+    url: "/sessions/abc/sql/preview",
+    payload: { limit: 25, offset: 50 },
+  });
+
+  expect(captured.id).toBe("abc");
+  expect(captured.limit).toBe(25);
+  expect(captured.offset).toBe(50);
+});
+
+test("POST /sessions/:id/sql/export returns {path} from injected thtRunner stub", async () => {
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {
+      sqlExport: async (_id: string) => ({ path: "/tmp/export.csv" }),
+    } as any,
+  });
+
+  const res = await app.inject({
+    method: "POST",
+    url: "/sessions/s1/sql/export",
+    payload: {},
+  });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual({ path: "/tmp/export.csv" });
+});
+
+test("POST /sessions/:id/sql/preview returns 500 when thtRunner throws", async () => {
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {
+      sqlPreview: async () => { throw new Error("tht boom"); },
+    } as any,
+  });
+
+  const res = await app.inject({
+    method: "POST",
+    url: "/sessions/s1/sql/preview",
+    payload: {},
+  });
+
+  expect(res.statusCode).toBe(500);
+  expect(res.json()).toMatchObject({ error: /boom/ });
+});
+
+// ---------------------------------------------------------------------------
+// Meta routes
+// ---------------------------------------------------------------------------
+
+test("GET /workspaces lists yaml files from ../harness/workspaces", async () => {
+  // The real ../harness/workspaces directory contains *.yaml files.
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {} as any,
+  });
+
+  const res = await app.inject({ method: "GET", url: "/workspaces" });
+
+  expect(res.statusCode).toBe(200);
+  const body = res.json() as { name: string; file: string }[];
+  expect(Array.isArray(body)).toBe(true);
+  // ../harness/workspaces has at least one yaml (tht-test.yaml / tht.example.yaml)
+  expect(body.length).toBeGreaterThan(0);
+  for (const w of body) {
+    expect(typeof w.name).toBe("string");
+    expect(w.name).not.toContain(".yaml");  // name strips extension
+    expect(w.file).toMatch(/\.ya?ml$/);
+  }
+});
+
+test("GET /workspaces returns [] when harnessDir has no workspaces subdir", async () => {
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "/nonexistent-harness-dir" }), {
+    thtRunner: {} as any,
+  });
+
+  const res = await app.inject({ method: "GET", url: "/workspaces" });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual([]);
+});
+
+test("GET /models returns {models:[...]} from injected listModels stub", async () => {
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {} as any,
+    listModels: async () => ["claude-opus-4", "claude-sonnet-4-5"],
+  });
+
+  const res = await app.inject({ method: "GET", url: "/models" });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual({ models: ["claude-opus-4", "claude-sonnet-4-5"] });
+});
+
+test("GET /models returns {models:[]} when listModels throws (graceful fallback)", async () => {
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {} as any,
+    listModels: async () => { throw new Error("Pi not running"); },
+  });
+
+  const res = await app.inject({ method: "GET", url: "/models" });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual({ models: [] });
+});
+
+test("GET /models with no listModels injected falls back to {models:[]}", async () => {
+  // No listModels dep → defaultListModels → returns [] → {models:[]}
+  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+    thtRunner: {} as any,
+    // listModels intentionally omitted
+  });
+
+  const res = await app.inject({ method: "GET", url: "/models" });
+
+  expect(res.statusCode).toBe(200);
+  expect(res.json()).toEqual({ models: [] });
+});