@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/src/tests/scripts-external-api.test.ts

@@ -3,7 +3,7 @@ import { unlink } from "node:fs/promises";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { Readable } from "node:stream";
 import { __resetEncryptionKeyForTests } from "../be/crypto";
-import { closeDb, createAgent, getDb, initDb } from "../be/db";
+import { closeDb, createAgent, createMcpServer, getDb, initDb } from "../be/db";
 import {
   createScriptApi,
   getScriptApiById,
@@ -287,6 +287,54 @@ describe("public execution route", () => {
     expect(typeof body.durationMs).toBe("number");
   });
 
+  test("external endpoint runs receive ctx.mcp connections (parity with /api/scripts/run)", async () => {
+    const mcpServer = createMcpServer({
+      name: `x-mcp-${crypto.randomUUID()}`,
+      transport: "http",
+      scope: "global",
+      url: "http://mcp.invalid.test/mcp",
+    });
+    const runtimeDescriptor = {
+      slug: "xmcp",
+      kind: "mcp",
+      connectionId: crypto.randomUUID(),
+      tools: [{ name: "ping", inputSchema: {} }],
+    };
+    getDb()
+      .prepare(
+        `INSERT INTO script_connections
+           (id, slug, kind, scope, allowed_hosts_json, mcp_server_id, generated_runtime_json)
+         VALUES (?, ?, 'mcp', 'global', '[]', ?, ?)`,
+      )
+      .run(runtimeDescriptor.connectionId, "xmcp", mcpServer.id, JSON.stringify(runtimeDescriptor));
+
+    const script = insertScript({
+      name: `mcp-keys-${crypto.randomUUID().slice(0, 8)}`,
+      scope: "agent",
+      scopeId: workerId,
+      source:
+        "export default async function run(args, ctx) { return { slugs: Object.keys(ctx.mcp ?? {}) }; }",
+      description: "Lists ctx.mcp slugs",
+      intent: "test fixture",
+      signatureJson: "{}",
+    });
+    const endpoint = createScriptApi({
+      scriptId: script.id,
+      agentId: workerId,
+      authMode: "none",
+    });
+
+    const res = await dispatch(`/api/x/script/${endpoint.id}`, {
+      method: "POST",
+      body: JSON.stringify({}),
+      auth: null,
+    });
+    const body = (await res.json()) as { ok: boolean; result: { slugs: string[] } };
+    expect(res.status).toBe(200);
+    expect(body.ok).toBe(true);
+    expect(body.result.slugs).toContain("xmcp");
+  });
+
   test("oversized body → 413 before execution, even for authMode 'none'", async () => {
     const script = insertDoubler();
     const endpoint = createScriptApi({

package/src/tests/scripts-runtime-secret-egress.test.ts

@@ -61,6 +61,7 @@ describe("egress-substitution", () => {
           scope: "global",
           scopeId: null,
           active: true,
+          authKind: "config",
           value: "ghp_test1234567890abcdef",
         },
       ]);

package/src/tests/scripts-runtime.test.ts

@@ -1,8 +1,10 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { createApiRegistryClient } from "../scripts-runtime/api-client";
 import { runScript } from "../scripts-runtime/loader";
 import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
 
 const savedEnv = { ...process.env };
+const originalFetch = globalThis.fetch;
 const resources = { memoryMb: 2048, cpuTimeSec: 20, maxStdoutBytes: 1_048_576 };
 
 beforeEach(() => {
@@ -13,6 +15,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  globalThis.fetch = originalFetch;
   for (const key of Object.keys(process.env)) {
     if (!(key in savedEnv)) delete process.env[key];
   }
@@ -375,4 +378,292 @@ describe("runScript", () => {
     expect(output.result).toEqual({ doubled: 84 });
     expect(output.exitCode).toBe(0);
   });
+
+  test("ctx.api GraphQL client posts JSON body with credential placeholders", async () => {
+    let observed: {
+      url: string;
+      method: string;
+      contentType: string | null;
+      authorization: string | null;
+      body: unknown;
+    } | null = null;
+    globalThis.fetch = (async (input, init) => {
+      observed = {
+        url: String(input),
+        method: init?.method ?? "GET",
+        contentType: new Headers(init?.headers).get("content-type"),
+        authorization: new Headers(init?.headers).get("authorization"),
+        body: JSON.parse(String(init?.body)),
+      };
+      return Response.json({ data: { country: { name: "Ukraine", capital: "Kyiv" } } });
+    }) as typeof fetch;
+
+    const client = createApiRegistryClient([
+      {
+        slug: "countries",
+        kind: "graphql",
+        baseUrl: "https://countries.vendor.test/graphql",
+        credential: {
+          configKey: "COUNTRIES_KEY",
+          headerTemplate: "Authorization: Bearer [REDACTED:COUNTRIES_KEY]",
+        },
+      },
+    ]);
+
+    const result = await client.countries.graphql(
+      "query Country($code: ID!) { country(code: $code) { name capital } }",
+      {
+        code: "UA",
+      },
+    );
+
+    expect(result).toEqual({ country: { name: "Ukraine", capital: "Kyiv" } });
+    expect(observed).toEqual({
+      url: "https://countries.vendor.test/graphql",
+      method: "POST",
+      contentType: "application/json",
+      authorization: "Bearer [REDACTED:COUNTRIES_KEY]",
+      body: {
+        query: "query Country($code: ID!) { country(code: $code) { name capital } }",
+        variables: { code: "UA" },
+      },
+    });
+  });
+
+  test("ctx.api OpenAPI client preserves the baseUrl path prefix for absolute spec paths", async () => {
+    let observedUrl = "";
+    globalThis.fetch = (async (input) => {
+      observedUrl = String(input);
+      return Response.json({ ok: true });
+    }) as typeof fetch;
+
+    const client = createApiRegistryClient([
+      {
+        slug: "petstore",
+        kind: "openapi",
+        baseUrl: "https://petstore.vendor.test/api/v3",
+        credential: null,
+        operations: [
+          {
+            name: "getInventory",
+            method: "GET",
+            path: "/store/inventory",
+            parameters: [],
+            hasBody: false,
+            successStatus: "200",
+            requestType: "PetstoreGetInventoryArgs",
+            responseType: "PetstoreGetInventoryResponse",
+          },
+        ],
+      },
+    ]);
+
+    await client.petstore.getInventory({});
+    expect(observedUrl).toBe("https://petstore.vendor.test/api/v3/store/inventory");
+  });
+
+  test("ctx.api OpenAPI client default path still parses 2xx bodies", async () => {
+    const client = createApiRegistryClient(
+      [
+        {
+          slug: "repos",
+          kind: "openapi",
+          baseUrl: "https://api.vendor.test",
+          credential: null,
+          operations: [
+            {
+              name: "getRepo",
+              method: "GET",
+              path: "/repos/{owner}/{repo}",
+              parameters: [
+                { name: "owner", in: "path", required: true, schema: {} },
+                { name: "repo", in: "path", required: true, schema: {} },
+              ],
+              hasBody: false,
+              successStatus: "200",
+              responseSchema: {},
+              requestType: "ReposGetRepoArgs",
+              responseType: "ReposGetRepoResponse",
+            },
+          ],
+        },
+      ],
+      {
+        fetch: (async () =>
+          Response.json({ full_name: "desplega-ai/agent-swarm" })) as typeof fetch,
+      },
+    );
+
+    await expect(
+      client.repos.getRepo({ path: { owner: "desplega-ai", repo: "agent-swarm" } }),
+    ).resolves.toEqual({ full_name: "desplega-ai/agent-swarm" });
+  });
+
+  test("ctx.api OpenAPI client enriches default non-2xx errors", async () => {
+    const client = createApiRegistryClient(
+      [
+        {
+          slug: "repos",
+          kind: "openapi",
+          baseUrl: "https://api.vendor.test",
+          credential: null,
+          operations: [
+            {
+              name: "getRepo",
+              method: "GET",
+              path: "/repos/{owner}/{repo}",
+              parameters: [
+                { name: "owner", in: "path", required: true, schema: {} },
+                { name: "repo", in: "path", required: true, schema: {} },
+              ],
+              hasBody: false,
+              successStatus: "200",
+              responseSchema: {},
+              requestType: "ReposGetRepoArgs",
+              responseType: "ReposGetRepoResponse",
+            },
+          ],
+        },
+      ],
+      {
+        fetch: (async () =>
+          Response.json(
+            { error: "missing" },
+            { status: 404, statusText: "Not Found" },
+          )) as typeof fetch,
+      },
+    );
+
+    try {
+      await client.repos.getRepo({ path: { owner: "desplega-ai", repo: "missing" } });
+      throw new Error("expected request to throw");
+    } catch (error) {
+      const err = error as Error & {
+        status?: number;
+        statusText?: string;
+        body?: unknown;
+        response?: Response;
+      };
+      expect(err.message).toBe("ctx.api.repos.getRepo failed with 404");
+      expect(err.status).toBe(404);
+      expect(err.statusText).toBe("Not Found");
+      expect(err.body).toEqual({ error: "missing" });
+      expect(err.response?.status).toBe(404);
+      expect(await err.response?.json()).toEqual({ error: "missing" });
+    }
+  });
+
+  test("ctx.api OpenAPI client raw mode returns binary 2xx responses without parsing", async () => {
+    let observedAuthorization: string | null = null;
+    const client = createApiRegistryClient(
+      [
+        {
+          slug: "studioApi",
+          kind: "openapi",
+          baseUrl: "https://studio.vendor.test",
+          credential: {
+            configKey: "STUDIO_API_KEY",
+            headerTemplate: "Authorization: Bearer [REDACTED:STUDIO_API_KEY]",
+          },
+          operations: [
+            {
+              name: "downloadRenderFile",
+              method: "GET",
+              path: "/renders/{id}/file",
+              parameters: [{ name: "id", in: "path", required: true, schema: {} }],
+              hasBody: false,
+              successStatus: "200",
+              responseSchema: {},
+              requestType: "StudioApiDownloadRenderFileArgs",
+              responseType: "StudioApiDownloadRenderFileResponse",
+            },
+          ],
+        },
+      ],
+      {
+        fetch: (async (_input, init) => {
+          observedAuthorization = new Headers(init?.headers).get("authorization");
+          return new Response(new Uint8Array([0, 1, 255]), {
+            status: 200,
+            headers: { "content-type": "application/octet-stream", "x-render-id": "render-123" },
+          });
+        }) as typeof fetch,
+      },
+    );
+
+    const result = (await client.studioApi.downloadRenderFile(
+      { path: { id: "render-123" } },
+      { raw: true },
+    )) as { ok: boolean; status: number; headers: Record<string, string>; response: Response };
+
+    expect(result.ok).toBe(true);
+    expect(result.status).toBe(200);
+    expect(result.headers).toBeTypeOf("object");
+    expect(Array.from(new Uint8Array(await result.response.arrayBuffer()))).toEqual([0, 1, 255]);
+    expect(observedAuthorization).toBe("Bearer [REDACTED:STUDIO_API_KEY]");
+  });
+
+  test("ctx.api OpenAPI client raw mode returns non-2xx responses without throwing", async () => {
+    const client = createApiRegistryClient(
+      [
+        {
+          slug: "repos",
+          kind: "openapi",
+          baseUrl: "https://api.vendor.test",
+          credential: null,
+          operations: [
+            {
+              name: "getRepo",
+              method: "GET",
+              path: "/repos/{owner}/{repo}",
+              parameters: [
+                { name: "owner", in: "path", required: true, schema: {} },
+                { name: "repo", in: "path", required: true, schema: {} },
+              ],
+              hasBody: false,
+              successStatus: "200",
+              responseSchema: {},
+              requestType: "ReposGetRepoArgs",
+              responseType: "ReposGetRepoResponse",
+            },
+          ],
+        },
+      ],
+      {
+        fetch: (async () =>
+          Response.json(
+            { error: "rate limited" },
+            { status: 429, statusText: "Too Many Requests" },
+          )) as typeof fetch,
+      },
+    );
+
+    const result = (await client.repos.getRepo(
+      { path: { owner: "desplega-ai", repo: "agent-swarm" } },
+      { raw: true },
+    )) as { ok: boolean; status: number; statusText: string; response: Response };
+
+    expect(result.ok).toBe(false);
+    expect(result.status).toBe(429);
+    expect(result.statusText).toBe("Too Many Requests");
+    expect(await result.response.json()).toEqual({ error: "rate limited" });
+  });
+
+  test("ctx.api GraphQL client throws on errors-only responses", async () => {
+    globalThis.fetch = (async () =>
+      Response.json({ errors: [{ message: "Cannot query field nope" }] })) as typeof fetch;
+
+    const client = createApiRegistryClient([
+      {
+        slug: "countries",
+        kind: "graphql",
+        baseUrl: "https://countries.vendor.test/graphql",
+        credential: null,
+      },
+    ]);
+
+    await expect(client.countries.graphql("query { nope }")).rejects.toThrow(
+      /Cannot query field nope/,
+    );
+  });
 });

package/src/tests/seed-scripts.test.ts

@@ -9,6 +9,7 @@ import { typecheckScript } from "../be/scripts/typecheck";
 import { runSeeder } from "../be/seed";
 import { SEED_SCRIPTS, scriptsSeeder } from "../be/seed-scripts";
 import bootTriage from "../be/seed-scripts/catalog/boot-triage";
+import { renderCatalogReportPage } from "../be/seed-scripts/catalog/catalog-report";
 import compoundInsights from "../be/seed-scripts/catalog/compound-insights";
 import opsCatalogAudit, {
   renderPage as renderOpsCatalogAuditPage,
@@ -710,6 +711,41 @@ describe("seed-scripts catalog", () => {
     expect(html).not.toContain("<ul>");
   });
 
+  test("catalog report renders complex checks as main-column data panels", () => {
+    const html = renderCatalogReportPage({
+      title: "Compound Insights Audit",
+      slug: "compound-insights",
+      description: "Daily ops snapshot.",
+      generatedAt: "2026-07-09T12:00:00.000Z",
+      lede: "Swarm-wide 3-day snapshot.",
+      metrics: [["Tasks", 12]],
+      sections: [
+        {
+          key: "script-usage",
+          goal: "Track script execution without dumping JSON into sidebars.",
+          findingCount: 0,
+          checks: {
+            total: 10,
+            perScript: [
+              { scriptName: "compound-insights", runs: 3, successRate: 100 },
+              { scriptName: "smart-recall", runs: 2, successRate: 100 },
+            ],
+          },
+          findings: [],
+        },
+      ],
+      appendix: { ok: true },
+    });
+
+    expect(html).toContain('class="report-nav"');
+    expect(html).toContain('class="data-panel"');
+    expect(html).toContain("<h3>Per Script</h3>");
+    expect(html).toContain("<th>Script Name</th>");
+    expect(html).toContain("<td>compound-insights</td>");
+    expect(html).toContain("<span>Total</span>");
+    expect(html).not.toContain("<strong>[{&quot;scriptName&quot;");
+  });
+
   test("boot-triage returns one read-only post-restart snapshot", async () => {
     const queries: Array<{ sql: string; params?: unknown[] }> = [];
     const result: any = await bootTriage(

package/src/tests/slack-identity-resolution.test.ts

@@ -19,9 +19,16 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { unlinkSync } from "node:fs";
-import { closeDb, getDb, getKv, initDb } from "../be/db";
-import { findUserByExternalId, getUserIdentities } from "../be/users";
-import { enrichSlackUserEmail, resolveSlackUserId } from "../slack/enrich";
+import { closeDb, createUser, getDb, getKv, initDb } from "../be/db";
+import {
+  findUserByExternalId,
+  getUserIdentities,
+  type IdentityActor,
+  linkIdentity,
+} from "../be/users";
+import { enrichSlackUserEmail, resolveSlackUserId, rewriteSlackMentions } from "../slack/enrich";
+
+const SYSTEM_ACTOR: IdentityActor = { kind: "system", id: "test" };
 
 const TEST_DB_PATH = "./test-slack-identity-resolution.sqlite";
 
@@ -346,3 +353,30 @@ describe("findUserByExternalId — sanity check after cascade", () => {
     expect(looked!.id).toBe(id);
   });
 });
+
+describe("rewriteSlackMentions — pure DB, zero Slack API calls", () => {
+  test("resolved mention renders '<@id|Name>' — the canonical pair", () => {
+    const user = createUser({ name: "Manuel", email: "manuel-rw@example.com" });
+    linkIdentity(user.id, "slack", "U3000RESOLVED", SYSTEM_ACTOR);
+
+    const rewritten = rewriteSlackMentions("hey <@U3000RESOLVED> can you look at this");
+    expect(rewritten).toBe("hey <@U3000RESOLVED|Manuel> can you look at this");
+  });
+
+  test("unresolved mention renders '<@id> (unknown user)' — never a guessed name", () => {
+    const rewritten = rewriteSlackMentions("hey <@U4000UNKNOWN> can you look at this");
+    expect(rewritten).toBe("hey <@U4000UNKNOWN> (unknown user) can you look at this");
+  });
+
+  test("multiple mentions in one string are each rewritten independently", () => {
+    const user = createUser({ name: "Tainá", email: "taina-rw@example.com" });
+    linkIdentity(user.id, "slack", "U5000RESOLVED", SYSTEM_ACTOR);
+
+    const rewritten = rewriteSlackMentions("<@U5000RESOLVED> and <@U6000UNKNOWN> both here");
+    expect(rewritten).toBe("<@U5000RESOLVED|Tainá> and <@U6000UNKNOWN> (unknown user) both here");
+  });
+
+  test("text with no mentions passes through unchanged", () => {
+    expect(rewriteSlackMentions("no mentions here")).toBe("no mentions here");
+  });
+});

package/src/tests/slack-inline-output.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import {
+  formatInlineCompletionOutputText,
+  MAX_INLINE_OUTPUT_MESSAGE_LENGTH,
+  shouldPostInlineCompletionOutput,
+} from "../slack/responses";
+import type { AgentTask, TaskAttachment } from "../types";
+
+const TASK_ID = "abcdef12-3456-7890-abcd-ef1234567890";
+
+function task(overrides: Partial<AgentTask> = {}): AgentTask {
+  return {
+    id: TASK_ID,
+    task: "Answer the question",
+    status: "completed",
+    output: "Here is the answer with enough substance to post inline.",
+    slackChannelId: "C123",
+    slackThreadTs: "1700000000.000001",
+    slackReplySent: false,
+    ...overrides,
+  } as AgentTask;
+}
+
+function attachment(overrides: Partial<TaskAttachment> = {}): TaskAttachment {
+  return {
+    id: crypto.randomUUID(),
+    taskId: TASK_ID,
+    agentId: null,
+    name: "report",
+    kind: "url",
+    url: "https://example.com/report",
+    isPrimary: false,
+    createdAt: new Date().toISOString(),
+    ...overrides,
+  } as TaskAttachment;
+}
+
+describe("Slack inline completion output", () => {
+  test("posts only completed Slack tasks with substantive output and no primary artifact", () => {
+    expect(shouldPostInlineCompletionOutput(task(), [])).toBe(true);
+    expect(shouldPostInlineCompletionOutput(task(), [attachment()])).toBe(true);
+    expect(shouldPostInlineCompletionOutput(task(), [attachment({ isPrimary: true })])).toBe(false);
+    expect(shouldPostInlineCompletionOutput(task({ slackReplySent: true }), [])).toBe(false);
+    expect(shouldPostInlineCompletionOutput(task({ output: "done" }), [])).toBe(false);
+    expect(shouldPostInlineCompletionOutput(task({ slackChannelId: undefined }), [])).toBe(false);
+    expect(shouldPostInlineCompletionOutput(task({ status: "failed" }), [])).toBe(false);
+  });
+
+  test("formats markdown output and keeps the Slack fallback text under 4000 chars", () => {
+    const text = formatInlineCompletionOutputText({
+      agentName: "Analyst",
+      taskId: TASK_ID,
+      output: `### Summary\n\n**Answer:** ${"This is a detailed prose finding. ".repeat(220)}`,
+    });
+
+    expect(text.length).toBeLessThanOrEqual(MAX_INLINE_OUTPUT_MESSAGE_LENGTH);
+    expect(text).toContain("✅ *Analyst* completed with output");
+    expect(text).toContain("*Summary*");
+    expect(text).toContain("*Answer:*");
+    expect(text).not.toContain("###");
+    expect(text).not.toContain("**Answer:**");
+    expect(text).toContain("…(full output in task");
+    expect(text).toContain("|`abcdef12`>");
+  });
+});

package/src/tests/slack-thread-buffer.test.ts

@@ -4,9 +4,11 @@ import {
   closeDb,
   createAgent,
   createTaskExtended,
+  createUser,
   getLatestActiveTaskInThread,
   initDb,
 } from "../be/db";
+import { type IdentityActor, linkIdentity } from "../be/users";
 import {
   bufferThreadMessage,
   getBufferMessageCount,
@@ -14,6 +16,8 @@ import {
   isThreadBuffered,
 } from "../slack/thread-buffer";
 
+const SYSTEM_ACTOR: IdentityActor = { kind: "system", id: "test" };
+
 const TEST_DB_PATH = "./test-slack-thread-buffer.sqlite";
 
 beforeAll(() => {
@@ -125,6 +129,30 @@ describe("Slack thread buffer", () => {
       expect(task!.slackChannelId).toBe(channelId);
       expect(task!.slackThreadTs).toBe(threadTs);
     });
+
+    test("in-body <@U…> mentions are rewritten via the identity primitive — resolved and unknown", async () => {
+      const channelId = "C601";
+      const threadTs = "6001.0001";
+      const linked = createUser({ name: "Luis", email: "luis-buf@example.com" });
+      // Slack user ids are uppercase-alphanumeric only (matches the
+      // `/<@([A-Z0-9]+)>/g` mention regex) — no underscores.
+      linkIdentity(linked.id, "slack", "U1000LINKED", SYSTEM_ACTOR);
+
+      bufferThreadMessage(
+        channelId,
+        threadTs,
+        "cc <@U1000LINKED> and <@U2000UNKNOWN>",
+        "U1",
+        "6001.0010",
+      );
+
+      await instantFlush(`${channelId}:${threadTs}`);
+
+      const task = getLatestActiveTaskInThread(channelId, threadTs);
+      expect(task).not.toBeNull();
+      expect(task!.task).toContain("<@U1000LINKED|Luis>");
+      expect(task!.task).toContain("<@U2000UNKNOWN> (unknown user)");
+    });
   });
 
   describe("flush sets dependsOn to latest active task in thread", () => {

package/src/tests/tool-annotations.test.ts

@@ -106,6 +106,7 @@ describe("Tool Annotations & Classification", () => {
       "delete-schedule",
       "delete-config",
       "delete-workflow",
+      "delete-page",
       "unregister-service",
       "slack-delete",
     ];