@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/tests/asset-key-api.test.ts

@@ -5,7 +5,9 @@ import {
   type Server,
   type ServerResponse,
 } from "node:http";
-import { closeDb, createAgent, createTaskExtended, createUser, initDb } from "../be/db";
+import { createApp } from "../apps/store";
+import { closeDb, createAgent, createTaskExtended, createUser, getDb, initDb } from "../be/db";
+import { insertScript } from "../be/scripts/db";
 import { handleAssets } from "../http/assets";
 import { handlePages } from "../http/pages";
 import { handleSchedules } from "../http/schedules";
@@ -146,9 +148,44 @@ describe("asset namespace REST contract", () => {
     expect(page.status).toBe(201);
     expect(page.body.key).toBe("shared/team/");
 
+    const app = createApp({
+      name: "Namespaced app",
+      definition: { models: {}, pages: {}, defaultPage: "main" } as never,
+    });
+    const script = insertScript({
+      name: `namespaced-script-${Date.now()}`,
+      scope: "agent",
+      scopeId: agentId,
+      source: "export default async function () { return { ok: true }; }",
+      description: "Namespaced script",
+      intent: "Exercise asset namespace moves",
+      signatureJson: "{}",
+      agentId,
+      embeddingMode: "skip",
+    });
+    expect(
+      await api("PATCH", `/api/assets/app/${app.id}/key`, { key: "shared/team/" }, { agentId }),
+    ).toMatchObject({ status: 200, body: { entityType: "app", key: "shared/team/" } });
+    expect(
+      await api(
+        "PATCH",
+        `/api/assets/script/${script.id}/key`,
+        { key: "shared/team/" },
+        { agentId },
+      ),
+    ).toMatchObject({ status: 200, body: { entityType: "script", key: "shared/team/" } });
+    expect(
+      await api(
+        "PATCH",
+        `/api/assets/script/${script.id}/key`,
+        { key: "shared/other/" },
+        { agentId: secondAgentId },
+      ),
+    ).toMatchObject({ status: 403 });
+
     const aggregate = await api(
       "GET",
-      "/api/assets?keyPrefix=shared/team&types=task,workflow,schedule,page",
+      "/api/assets?keyPrefix=shared/team&types=task,workflow,schedule,page,app,script",
     );
     expect(aggregate.status).toBe(200);
     expect(aggregate.body.assets).toEqual(
@@ -165,8 +202,17 @@ describe("asset namespace REST contract", () => {
           key: "shared/team/",
         }),
         expect.objectContaining({ entityType: "page", id: page.body.id, key: "shared/team/" }),
+        expect.objectContaining({ entityType: "app", id: app.id, key: "shared/team/" }),
+        expect.objectContaining({ entityType: "script", id: script.id, key: "shared/team/" }),
       ]),
     );
+    expect(
+      getDb()
+        .prepare<{ entity_type: string }, [string, string]>(
+          "SELECT entity_type FROM asset_key_history WHERE entity_id IN (?, ?) ORDER BY entity_type",
+        )
+        .all(app.id, script.id),
+    ).toEqual([{ entity_type: "app" }, { entity_type: "script" }]);
     expect(JSON.stringify(aggregate.body)).not.toContain("namespaced task");
     expect(JSON.stringify(aggregate.body)).not.toContain("private content omitted");
 

package/src/tests/asset-key-invariants.test.ts

@@ -1,4 +1,5 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createApp } from "../apps/store";
 import { auditAssetKeys } from "../be/asset-key-audit";
 import {
   closeDb,
@@ -17,17 +18,35 @@ import {
   moveAssetKey,
   upsertAssetKeyMapping,
 } from "../be/db";
+import { insertScript } from "../be/scripts/db";
 import { createStandaloneScheduleTask } from "../scheduler/scheduler";
 
 const TEST_DB_PATH = "./test-asset-key-invariants.sqlite";
 
 let agentId: string;
 let userId: string;
+let appId: string;
+let scriptId: string;
 
 beforeAll(() => {
   initDb(TEST_DB_PATH);
   agentId = createAgent({ name: "namespace-worker", isLead: false, status: "idle" }).id;
   userId = createUser({ name: "Namespace User", email: "namespace@example.com" }).id;
+  appId = createApp({
+    name: "Default app",
+    definition: { models: {}, pages: {}, defaultPage: "main" } as never,
+  }).id;
+  scriptId = insertScript({
+    name: "default-script",
+    scope: "agent",
+    scopeId: agentId,
+    source: "export default async function () { return { ok: true }; }",
+    description: "Asset namespace test script",
+    intent: "Verify script asset keys",
+    signatureJson: "{}",
+    agentId,
+    embeddingMode: "skip",
+  }).id;
 });
 
 afterAll(() => {
@@ -59,9 +78,30 @@ describe("cross-entity asset namespace invariants", () => {
       `shared/schedule:${schedule.id}/`,
       `shared/page:${page.id}/`,
     ]);
+    expect(
+      getDb()
+        .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM apps WHERE id = ?')
+        .get(appId)?.key,
+    ).toBe(`shared/app:${appId}/`);
+    expect(
+      getDb()
+        .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM scripts WHERE id = ?')
+        .get(scriptId)?.key,
+    ).toBe(`shared/script:${scriptId}/`);
     expect(auditAssetKeys(getDb()).fatalCount).toBe(0);
   });
 
+  test("app and script triggers reject malformed keys", () => {
+    for (const [table, id] of [
+      ["apps", appId],
+      ["scripts", scriptId],
+    ] as const) {
+      expect(() =>
+        getDb().run(`UPDATE ${table} SET "key" = ? WHERE id = ?`, ["Shared/invalid", id]),
+      ).toThrow("invalid asset namespace key");
+    }
+  });
+
   test("children inherit a parent namespace unless explicitly overridden", () => {
     const parent = createTaskExtended("parent", { agentId, key: "shared/projects/" });
     const child = createTaskExtended("child", { parentTaskId: parent.id });
@@ -167,11 +207,63 @@ describe("cross-entity asset namespace invariants", () => {
     expect(summaries.some((asset) => asset.entityType === "workflow")).toBe(true);
     expect(summaries.some((asset) => asset.entityType === "schedule")).toBe(true);
     expect(summaries.some((asset) => asset.entityType === "page")).toBe(true);
+    expect(summaries.some((asset) => asset.entityType === "app" && asset.id === appId)).toBe(true);
+    expect(summaries.some((asset) => asset.entityType === "script" && asset.id === scriptId)).toBe(
+      true,
+    );
     expect(summaries.some((asset) => asset.entityType === "file")).toBe(true);
+    const expectedChecked = getDb()
+      .prepare<{ count: number }, []>(
+        `SELECT
+           (SELECT COUNT(*) FROM agent_tasks) +
+           (SELECT COUNT(*) FROM workflows) +
+           (SELECT COUNT(*) FROM scheduled_tasks) +
+           (SELECT COUNT(*) FROM pages) +
+           (SELECT COUNT(*) FROM apps) +
+           (SELECT COUNT(*) FROM scripts) +
+           (SELECT COUNT(*) FROM asset_key_mappings) AS count`,
+      )
+      .get()!.count;
+    expect(auditAssetKeys(getDb()).checked).toBe(expectedChecked);
     expect(JSON.stringify(summaries)).not.toContain("scheduled work");
     expect(JSON.stringify(summaries)).not.toContain("<p>ok</p>");
   });
 
+  test("app and script moves update keys and write typed history rows", () => {
+    expect(
+      moveAssetKey({ entityType: "app", id: appId, key: "shared/products/", changedBy: userId }),
+    ).toBe(true);
+    expect(
+      moveAssetKey({
+        entityType: "script",
+        id: scriptId,
+        key: "shared/automation/",
+        changedBy: userId,
+      }),
+    ).toBe(true);
+
+    expect(
+      getDb()
+        .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM apps WHERE id = ?')
+        .get(appId),
+    ).toEqual({ key: "shared/products/" });
+    expect(
+      getDb()
+        .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM scripts WHERE id = ?')
+        .get(scriptId),
+    ).toEqual({ key: "shared/automation/" });
+    expect(
+      getDb()
+        .prepare<{ entity_type: string; new_key: string }, [string, string]>(
+          "SELECT entity_type, new_key FROM asset_key_history WHERE entity_id IN (?, ?) ORDER BY entity_type",
+        )
+        .all(appId, scriptId),
+    ).toEqual([
+      { entity_type: "app", new_key: "shared/products/" },
+      { entity_type: "script", new_key: "shared/automation/" },
+    ]);
+  });
+
   test("prefix filters treat SQL wildcard characters as literal key content", () => {
     const literal = createTaskExtended("literal wildcard", { agentId, key: "shared/percent%/" });
     const neighbor = createTaskExtended("wildcard neighbor", { agentId, key: "shared/percentx/" });

package/src/tests/asset-key-migration.test.ts

@@ -3,6 +3,7 @@ import { closeDb, createTaskExtended, createUser, getDb, initDb } from "../be/db
 
 const FRESH_DB = "./test-asset-key-migration-fresh.sqlite";
 const HISTORICAL_DB = "./test-asset-key-migration-historical.sqlite";
+const HISTORY_REBUILD_DB = "./test-asset-key-migration-history-rebuild.sqlite";
 const LEGACY_STATUS_DB = "./test-asset-key-migration-legacy-status.sqlite";
 
 const globals = globalThis as typeof globalThis & {
@@ -33,15 +34,59 @@ function dropMigration115ForHistoricalFixture(): void {
     "idx_workflows_asset_key",
     "idx_scheduled_tasks_asset_key",
     "idx_pages_asset_key",
+    "idx_apps_asset_key",
+    "idx_scripts_asset_key",
   ]) {
     db.run(`DROP INDEX IF EXISTS "${index}"`);
   }
   db.run("DROP TABLE asset_key_history");
   db.run("DROP TABLE asset_key_mappings");
-  for (const table of ["agent_tasks", "workflows", "scheduled_tasks", "pages"]) {
+  for (const table of ["agent_tasks", "workflows", "scheduled_tasks", "pages", "apps", "scripts"]) {
     db.run(`ALTER TABLE "${table}" DROP COLUMN "key"`);
   }
-  db.run("DELETE FROM _migrations WHERE version = 115");
+  db.run("DELETE FROM _migrations WHERE version IN (115, 129)");
+}
+
+function dropMigration129ForHistoricalFixture(): void {
+  const db = getDb();
+  for (const trigger of [
+    "validate_apps_asset_key_insert",
+    "validate_apps_asset_key_update",
+    "validate_scripts_asset_key_insert",
+    "validate_scripts_asset_key_update",
+  ]) {
+    db.run(`DROP TRIGGER "${trigger}"`);
+  }
+  db.run("DROP INDEX idx_apps_asset_key");
+  db.run("DROP INDEX idx_scripts_asset_key");
+  db.run('ALTER TABLE apps DROP COLUMN "key"');
+  db.run('ALTER TABLE scripts DROP COLUMN "key"');
+
+  db.run(`
+    CREATE TABLE asset_key_history_before_129 (
+      id           TEXT PRIMARY KEY,
+      entity_type  TEXT NOT NULL CHECK (entity_type IN ('task', 'workflow', 'schedule', 'page', 'file')),
+      entity_id    TEXT NOT NULL,
+      previous_key TEXT,
+      new_key      TEXT NOT NULL,
+      changed_by   TEXT REFERENCES users(id),
+      changed_at   TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    )
+  `);
+  db.run(`
+    INSERT INTO asset_key_history_before_129 (
+      id, entity_type, entity_id, previous_key, new_key, changed_by, changed_at
+    )
+    SELECT id, entity_type, entity_id, previous_key, new_key, changed_by, changed_at
+    FROM asset_key_history
+  `);
+  db.run("DROP TABLE asset_key_history");
+  db.run("ALTER TABLE asset_key_history_before_129 RENAME TO asset_key_history");
+  db.run(`
+    CREATE INDEX idx_asset_key_history_entity
+      ON asset_key_history(entity_type, entity_id, changed_at DESC)
+  `);
+  db.run("DELETE FROM _migrations WHERE version = 129");
 }
 
 beforeAll(async () => {
@@ -50,6 +95,7 @@ beforeAll(async () => {
   closeDb();
   await removeDb(FRESH_DB);
   await removeDb(HISTORICAL_DB);
+  await removeDb(HISTORY_REBUILD_DB);
   await removeDb(LEGACY_STATUS_DB);
   initDb(FRESH_DB);
 });
@@ -60,12 +106,20 @@ afterAll(async () => {
   globals.__savedAssetKeyTemplate = undefined;
   await removeDb(FRESH_DB);
   await removeDb(HISTORICAL_DB);
+  await removeDb(HISTORY_REBUILD_DB);
   await removeDb(LEGACY_STATUS_DB);
 });
 
-describe("migration 115 asset namespace keys", () => {
+describe("asset namespace key migrations", () => {
   test("fresh schema has mandatory defaults, non-unique indexes, triggers, and mapping tables", () => {
-    for (const table of ["agent_tasks", "workflows", "scheduled_tasks", "pages"]) {
+    for (const table of [
+      "agent_tasks",
+      "workflows",
+      "scheduled_tasks",
+      "pages",
+      "apps",
+      "scripts",
+    ]) {
       const column = getDb()
         .prepare<{ name: string; notnull: number; dflt_value: string | null }, []>(
           `PRAGMA table_info("${table}")`,
@@ -89,6 +143,8 @@ describe("migration 115 asset namespace keys", () => {
       "idx_workflows_asset_key",
       "idx_scheduled_tasks_asset_key",
       "idx_pages_asset_key",
+      "idx_apps_asset_key",
+      "idx_scripts_asset_key",
     ]) {
       expect(indexes.has(index)).toBe(true);
     }
@@ -98,7 +154,7 @@ describe("migration 115 asset namespace keys", () => {
           "SELECT COUNT(*) AS count FROM sqlite_master WHERE type = 'trigger' AND name LIKE 'validate_%asset_key%'",
         )
         .get()?.count,
-    ).toBeGreaterThanOrEqual(8);
+    ).toBeGreaterThanOrEqual(12);
     for (const table of ["asset_key_mappings", "asset_key_history"]) {
       expect(
         getDb()
@@ -108,6 +164,13 @@ describe("migration 115 asset namespace keys", () => {
           .get(table)?.present,
       ).toBe(1);
     }
+    const historySchema = getDb()
+      .prepare<{ sql: string }, []>(
+        "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'asset_key_history'",
+      )
+      .get()!.sql;
+    expect(historySchema).toContain("'app'");
+    expect(historySchema).toContain("'script'");
   });
 
   test("old insert statements may omit key and repeated shared namespaces are valid", () => {
@@ -132,8 +195,27 @@ describe("migration 115 asset namespace keys", () => {
       `INSERT INTO pages (agentId, slug, title, contentType, authMode, body)
        VALUES ('legacy-agent', 'legacy-page', 'Legacy page', 'text/html', 'authed', '<p>ok</p>')`,
     );
+    getDb().run(
+      `INSERT INTO apps (id, name, definition, created_at, updated_at)
+       VALUES (?, 'legacy app', '{}', ?, ?)`,
+      [crypto.randomUUID(), now, now],
+    );
+    getDb().run(
+      `INSERT INTO scripts (
+         id, name, scope, source, description, intent, signatureJson,
+         contentHash, createdAt, updatedAt
+       ) VALUES (?, 'legacy-script', 'global', 'export default () => null', '', '', '{}', '', ?, ?)`,
+      [crypto.randomUUID(), now, now],
+    );
 
-    for (const table of ["agent_tasks", "workflows", "scheduled_tasks", "pages"]) {
+    for (const table of [
+      "agent_tasks",
+      "workflows",
+      "scheduled_tasks",
+      "pages",
+      "apps",
+      "scripts",
+    ]) {
       const count = getDb()
         .prepare<{ count: number }, []>(
           `SELECT COUNT(*) AS count FROM "${table}" WHERE "key" = 'shared/'`,
@@ -143,6 +225,63 @@ describe("migration 115 asset namespace keys", () => {
     }
   });
 
+  test("migration 129 preserves existing history rows while widening entity types", () => {
+    closeDb();
+    initDb(HISTORY_REBUILD_DB);
+
+    const historyId = crypto.randomUUID();
+    const entityId = crypto.randomUUID();
+    const user = createUser({ name: "History User", email: "history@example.com" });
+    const changedAt = "2026-08-08T12:34:56.789Z";
+    getDb().run(
+      `INSERT INTO asset_key_history (
+         id, entity_type, entity_id, previous_key, new_key, changed_by, changed_at
+       ) VALUES (?, 'task', ?, 'shared/inbox/', 'shared/archive/', ?, ?)`,
+      [historyId, entityId, user.id, changedAt],
+    );
+
+    dropMigration129ForHistoricalFixture();
+    closeDb();
+    initDb(HISTORY_REBUILD_DB);
+
+    try {
+      expect(
+        getDb()
+          .prepare<
+            {
+              id: string;
+              entity_type: string;
+              entity_id: string;
+              previous_key: string;
+              new_key: string;
+              changed_by: string;
+              changed_at: string;
+            },
+            [string]
+          >("SELECT * FROM asset_key_history WHERE id = ?")
+          .get(historyId),
+      ).toEqual({
+        id: historyId,
+        entity_type: "task",
+        entity_id: entityId,
+        previous_key: "shared/inbox/",
+        new_key: "shared/archive/",
+        changed_by: user.id,
+        changed_at: changedAt,
+      });
+      expect(
+        getDb()
+          .prepare<{ count: number }, []>(
+            "SELECT COUNT(*) AS count FROM _migrations WHERE version = 129",
+          )
+          .get()?.count,
+      ).toBe(1);
+    } finally {
+      closeDb();
+      initDb(FRESH_DB);
+    }
+  });
+
   test("triggers reject malformed and unknown-personal keys but allow an existing personal user", () => {
     const taskId = getDb()
       .prepare<{ id: string }, []>("SELECT id FROM agent_tasks LIMIT 1")
@@ -166,6 +305,13 @@ describe("migration 115 asset namespace keys", () => {
         taskId,
       ]),
     ).not.toThrow();
+
+    for (const table of ["apps", "scripts"]) {
+      const id = getDb().prepare<{ id: string }, []>(`SELECT id FROM ${table} LIMIT 1`).get()!.id;
+      expect(() =>
+        getDb().run(`UPDATE ${table} SET "key" = ? WHERE id = ?`, ["INVALID", id]),
+      ).toThrow("invalid asset namespace key");
+    }
   });
 
   test("upgrades a historical database, backfills attachment mappings, and is repeatable", async () => {
@@ -176,6 +322,8 @@ describe("migration 115 asset namespace keys", () => {
     const now = new Date().toISOString();
     const taskId = crypto.randomUUID();
     const attachmentId = crypto.randomUUID();
+    const appId = crypto.randomUUID();
+    const scriptId = crypto.randomUUID();
     getDb().run(
       `INSERT INTO agent_tasks (id, task, status, source, createdAt, lastUpdatedAt)
        VALUES (?, 'historical task', 'unassigned', 'api', ?, ?)`,
@@ -188,6 +336,18 @@ describe("migration 115 asset namespace keys", () => {
                'reports/artifact.md', 'org', 'drive')`,
       [attachmentId, taskId],
     );
+    getDb().run(
+      `INSERT INTO apps (id, name, definition, created_at, updated_at)
+       VALUES (?, 'historical app', '{}', ?, ?)`,
+      [appId, now, now],
+    );
+    getDb().run(
+      `INSERT INTO scripts (
+         id, name, scope, source, description, intent, signatureJson,
+         contentHash, createdAt, updatedAt
+       ) VALUES (?, 'historical-script', 'global', 'export default () => null', '', '', '{}', '', ?, ?)`,
+      [scriptId, now, now],
+    );
     closeDb();
 
     initDb(HISTORICAL_DB);
@@ -201,16 +361,22 @@ describe("migration 115 asset namespace keys", () => {
         )
         .get("reports/artifact.md"),
     ).toEqual({ key: "shared/", source_entity_id: attachmentId });
+    expect(getDb().query('SELECT "key" FROM apps WHERE id = ?').get(appId)).toEqual({
+      key: "shared/",
+    });
+    expect(getDb().query('SELECT "key" FROM scripts WHERE id = ?').get(scriptId)).toEqual({
+      key: "shared/",
+    });
 
     closeDb();
     expect(() => initDb(HISTORICAL_DB)).not.toThrow();
     expect(
       getDb()
         .prepare<{ count: number }, []>(
-          "SELECT COUNT(*) AS count FROM _migrations WHERE version = 115",
+          "SELECT COUNT(*) AS count FROM _migrations WHERE version IN (115, 129)",
         )
         .get()?.count,
-    ).toBe(1);
+    ).toBe(2);
   });
 
   test("preserves asset keys when upgrading a legacy restrictive task status schema", () => {

package/src/tests/asset-key-normalization.test.ts

@@ -34,6 +34,8 @@ describe("asset namespace key normalization", () => {
   test("builds resource-specific defaults inside the shared namespace", () => {
     expect(defaultAssetKey("task", "ABC-123")).toBe("shared/task:abc-123/");
     expect(defaultAssetKey("workflow", "workflow-id")).toBe("shared/workflow:workflow-id/");
+    expect(defaultAssetKey("app", "APP-ID")).toBe("shared/app:app-id/");
+    expect(defaultAssetKey("script", "SCRIPT-ID")).toBe("shared/script:script-id/");
     expect(defaultAssetKey("fs:agent-fs", "mapping-id")).toBe("shared/fs:agent-fs:mapping-id/");
   });
 

package/src/tests/credential-broker.test.ts

@@ -328,7 +328,7 @@ describe("credential broker", () => {
     expect(authorization).toBe("Bearer ghp_secret");
   });
 
-  test("does not substitute placeholders for non-allowlisted hosts", async () => {
+  test("drops a placeholder header for non-allowlisted hosts instead of forwarding the literal", async () => {
     let authorization: string | null = null;
     globalThis.fetch = (async (_input: string | URL | Request, init?: RequestInit) => {
       authorization = new Headers(init?.headers).get("authorization");
@@ -352,7 +352,32 @@ describe("credential broker", () => {
       headers: { Authorization: "Bearer [REDACTED:GITHUB_TOKEN]" },
     });
 
-    expect(authorization).toBe("Bearer [REDACTED:GITHUB_TOKEN]");
+    // The literal placeholder is useless to any provider and must never egress.
+    expect(authorization).toBeNull();
+  });
+
+  test("drops a placeholder header when no binding resolves (fresh install)", async () => {
+    let authorization: string | null = null;
+    let accept: string | null = null;
+    globalThis.fetch = (async (_input: string | URL | Request, init?: RequestInit) => {
+      const headers = new Headers(init?.headers);
+      authorization = headers.get("authorization");
+      accept = headers.get("accept");
+      return Response.json([]);
+    }) as typeof fetch;
+
+    patchFetchWithCredentialBroker([]);
+
+    await fetch("https://api.github.com/repos/owner/name/issues", {
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: "Bearer [REDACTED:GITHUB_TOKEN]",
+      },
+    });
+
+    // No GITHUB_TOKEN configured: auth is omitted so public repos still pull.
+    expect(authorization).toBeNull();
+    expect(accept).toBe("application/vnd.github+json");
   });
 
   test("substitutes query placeholders for allowlisted hosts", async () => {