Merge remote-tracking branch 'origin/fix/watch-mode-keepalive-tri-13065' into feat/query-safety-tri-11165

Author: kathiekiwi

apps/webapp/test/dashboardAgentForeignChat.test.ts

@@ -6,7 +6,10 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock("~/db.server", () => ({ $replica: {}, prisma: {} }));
-vi.mock("~/env.server", () => ({ env: { SESSION_SECRET: "test-session-secret" } }));
+// env.server is left real: the route transitively pulls in the ClickHouse client singleton,
+// which reads its URLs and tuning from the parsed env at import. A stubbed env starves those
+// (`Invalid URL`); the real schema fills them from CI's CLICKHOUSE_URL, same as every other
+// route test.
 vi.mock("~/services/session.server", () => ({
   requireUser: async () => ({ id: "usr_real", admin: false, isImpersonating: false }),
 }));

apps/webapp/test/dashboardAgentWatches.test.ts

@@ -89,7 +89,7 @@ vi.mock("~/v3/canAccessDashboardAgent.server", () => ({
 // The routes drive the real service, which builds a TriggerClient from .env — so an unmocked
 // suite triggers actual runs against whatever origin .env names.
 vi.mock("@trigger.dev/sdk", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@trigger.dev/sdk")>();
+  const actual = await importOriginal<Record<string, unknown>>();
   return {
     ...actual,
     TriggerClient: class {
@@ -108,6 +108,9 @@ process.env.SESSION_SECRET = SESSION_SECRET;
 // The agent's subscribe endpoint refuses without an email transport configured.
 process.env.ALERT_FROM_EMAIL = "alerts@example.com";
 process.env.ALERT_EMAIL_TRANSPORT = "smtp";
+// Arming a batch chain builds a (stubbed) client only when this is set; unset in CI, it would
+// no-op and the check test's trigger assertion would never see the batch task.
+process.env.DASHBOARD_AGENT_SECRET_KEY = "test-dashboard-agent-secret";
 
 const {
   armDashboardAgentWatchBatch,