@desplega.ai/agent-swarm 1.131.1 → 1.134.0

package/src/tests/task-pull-request-backfill-migration.test.ts

@@ -0,0 +1,321 @@
+import { Database } from "bun:sqlite";
+import { afterEach, describe, expect, test } from "bun:test";
+import { runMigrations } from "../be/migrations/runner";
+import { extractGitHubPullRequestUrls } from "../utils/github-pull-request";
+
+const DB_PATH = "./test-task-pull-request-backfill-migration.sqlite";
+const ECMASCRIPT_WHITESPACE_CODE_POINTS = [
+  9, 10, 11, 12, 13, 32, 160, 5760, 8192, 8193, 8194, 8195, 8196, 8197, 8198, 8199, 8200, 8201,
+  8202, 8232, 8233, 8239, 8287, 12288, 65279,
+];
+
+async function removeDb(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await Bun.file(DB_PATH + suffix).delete();
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+afterEach(removeDb);
+
+describe("migration 135 task pull-request attachment backfill", () => {
+  test("applies fresh, backfills existing outputs, and replays idempotently", async () => {
+    await removeDb();
+    const db = new Database(DB_PATH, { create: true });
+    try {
+      runMigrations(db);
+      expect(
+        db.query<{ count: number }, []>("SELECT COUNT(*) AS count FROM task_attachments").get()
+          ?.count,
+      ).toBe(0);
+      db.run("DELETE FROM _migrations WHERE version = 135");
+
+      const now = new Date().toISOString();
+      const insertTask = db.prepare(
+        `INSERT INTO agent_tasks
+           (id, task, status, source, output, createdAt, lastUpdatedAt)
+         VALUES (?, 'fixture', 'completed', 'api', ?, ?, ?)`,
+      );
+      const firstTaskId = "11111111-1111-4111-8111-111111111111";
+      const secondTaskId = "22222222-2222-4222-8222-222222222222";
+      const thirdTaskId = "44444444-4444-4444-8444-444444444444";
+      const vcsOnlyTaskId = "66666666-6666-4666-8666-666666666666";
+      insertTask.run(
+        firstTaskId,
+        "Ignore https://notgithub.com/wrong/repo/pull/88. Shipped " +
+          "https://GitHub.com/desplega-ai/agent-swarm/pull/41/files and " +
+          "github.com/desplega-ai/docs/pull/9). Duplicate: " +
+          "https://github.com/desplega-ai/agent-swarm/pull/41#discussion",
+        now,
+        now,
+      );
+      insertTask.run(
+        secondTaskId,
+        "Existing https://github.com/desplega-ai/agent-swarm/pull/42. Reject " +
+          "https://github.com/org/repo/tree/pull/123 and " +
+          "https://github.com/org/repo/issues/1/pull/2 and " +
+          "https://_github.com/org/repo/pull/3 and " +
+          "https://evil.example/github.com/org/repo/pull/4 and " +
+          "https://github.com/org/repo/pull/123abc",
+        now,
+        now,
+      );
+      insertTask.run(
+        thirdTaskId,
+        "Valid output https://github.com/desplega-ai/agent-swarm/pull/43",
+        now,
+        now,
+      );
+      insertTask.run(vcsOnlyTaskId, "Completed through the historical VCS path", now, now);
+      db.run(
+        `UPDATE agent_tasks
+         SET vcsProvider = 'github', vcsRepo = 'desplega-ai/agent-swarm',
+             vcsNumber = 44, vcsUrl = 'https://github.com/desplega-ai/agent-swarm/pull/44'
+         WHERE id = ?`,
+        [vcsOnlyTaskId],
+      );
+      const existingId = "33333333-3333-4333-8333-333333333333";
+      db.run(
+        `INSERT INTO task_attachments
+           (id, task_id, name, kind, url, provider_id, provider_key, intent)
+         VALUES (?, ?, 'Caller supplied', 'url', ?, 'url', ?, 'review')`,
+        [
+          existingId,
+          secondTaskId,
+          "http://GitHub.com/desplega-ai/agent-swarm/pull/42/files",
+          "http://GitHub.com/desplega-ai/agent-swarm/pull/42/files",
+        ],
+      );
+      db.run(
+        `INSERT INTO task_attachments
+           (id, task_id, name, kind, url, provider_id, provider_key, intent)
+         VALUES (?, ?, 'Malformed attachment', 'url', ?, 'url', ?, 'review')`,
+        [
+          "55555555-5555-4555-8555-555555555555",
+          thirdTaskId,
+          "https://github.com/desplega-ai/agent-swarm/pull/43abc",
+          "https://github.com/desplega-ai/agent-swarm/pull/43abc",
+        ],
+      );
+
+      runMigrations(db);
+
+      const rows = db
+        .query<
+          {
+            id: string;
+            taskId: string;
+            name: string;
+            url: string;
+            providerId: string | null;
+            providerKey: string | null;
+            capabilities: Record<string, unknown> | null;
+            intent: string | null;
+          },
+          []
+        >(
+          `SELECT id, task_id AS taskId, name, url,
+                  provider_id AS providerId, provider_key AS providerKey,
+                  json(capabilities) AS capabilities, intent
+           FROM task_attachments
+           ORDER BY task_id, url`,
+        )
+        .all();
+      expect(rows).toHaveLength(6);
+      expect(
+        rows.map((row) => ({
+          ...row,
+          id: undefined,
+          capabilities: row.capabilities ? JSON.parse(String(row.capabilities)) : null,
+        })),
+      ).toEqual([
+        {
+          id: undefined,
+          taskId: firstTaskId,
+          name: "GitHub pull request #41",
+          url: "https://github.com/desplega-ai/agent-swarm/pull/41",
+          providerId: "github",
+          providerKey: "https://github.com/desplega-ai/agent-swarm/pull/41",
+          capabilities: {
+            _agentSwarmGeneratedBy: "task-pull-request-recorder",
+          },
+          intent: "task-deliverable",
+        },
+        {
+          id: undefined,
+          taskId: firstTaskId,
+          name: "GitHub pull request #9",
+          url: "https://github.com/desplega-ai/docs/pull/9",
+          providerId: "github",
+          providerKey: "https://github.com/desplega-ai/docs/pull/9",
+          capabilities: {
+            _agentSwarmGeneratedBy: "task-pull-request-recorder",
+          },
+          intent: "task-deliverable",
+        },
+        {
+          id: undefined,
+          taskId: secondTaskId,
+          name: "Caller supplied",
+          url: "http://GitHub.com/desplega-ai/agent-swarm/pull/42/files",
+          providerId: "url",
+          providerKey: "http://GitHub.com/desplega-ai/agent-swarm/pull/42/files",
+          capabilities: null,
+          intent: "review",
+        },
+        {
+          id: undefined,
+          taskId: thirdTaskId,
+          name: "GitHub pull request #43",
+          url: "https://github.com/desplega-ai/agent-swarm/pull/43",
+          providerId: "github",
+          providerKey: "https://github.com/desplega-ai/agent-swarm/pull/43",
+          capabilities: {
+            _agentSwarmGeneratedBy: "task-pull-request-recorder",
+          },
+          intent: "task-deliverable",
+        },
+        {
+          id: undefined,
+          taskId: thirdTaskId,
+          name: "Malformed attachment",
+          url: "https://github.com/desplega-ai/agent-swarm/pull/43abc",
+          providerId: "url",
+          providerKey: "https://github.com/desplega-ai/agent-swarm/pull/43abc",
+          capabilities: null,
+          intent: "review",
+        },
+        {
+          id: undefined,
+          taskId: vcsOnlyTaskId,
+          name: "GitHub pull request #44",
+          url: "https://github.com/desplega-ai/agent-swarm/pull/44",
+          providerId: "github",
+          providerKey: "https://github.com/desplega-ai/agent-swarm/pull/44",
+          capabilities: {
+            _agentSwarmGeneratedBy: "task-pull-request-recorder",
+          },
+          intent: "task-deliverable",
+        },
+      ]);
+      for (const row of rows) {
+        expect(row.id).toMatch(
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/,
+        );
+      }
+      expect(rows.find((row) => row.taskId === secondTaskId)?.id).toBe(existingId);
+
+      db.run("DELETE FROM _migrations WHERE version = 135");
+      runMigrations(db);
+      expect(
+        db.query<{ count: number }, []>("SELECT COUNT(*) AS count FROM task_attachments").get()
+          ?.count,
+      ).toBe(6);
+    } finally {
+      db.close();
+    }
+  });
+
+  test("deduplicates caller URLs ending in ECMAScript whitespace", async () => {
+    await removeDb();
+    const db = new Database(DB_PATH, { create: true });
+    try {
+      runMigrations(db);
+      db.run("DELETE FROM _migrations WHERE version = 135");
+      const now = new Date().toISOString();
+      const whitespaceCodePoints = [11, 12, 160];
+
+      whitespaceCodePoints.forEach((codePoint, index) => {
+        const suffix = String(index + 1).padStart(12, "0");
+        const taskId = `bbbbbbbb-bbbb-4bbb-8bbb-${suffix}`;
+        const canonicalUrl = `https://github.com/owner/repo/pull/${index + 1}`;
+        db.run(
+          `INSERT INTO agent_tasks
+             (id, task, status, source, output, createdAt, lastUpdatedAt)
+           VALUES (?, 'fixture', 'completed', 'api', ?, ?, ?)`,
+          [taskId, `Shipped ${canonicalUrl}`, now, now],
+        );
+        db.run(
+          `INSERT INTO task_attachments (id, task_id, name, kind, url)
+           VALUES (?, ?, 'Caller supplied', 'url', ?)`,
+          [
+            `cccccccc-cccc-4ccc-8ccc-${suffix}`,
+            taskId,
+            `${canonicalUrl}${String.fromCodePoint(codePoint)}`,
+          ],
+        );
+      });
+
+      runMigrations(db);
+
+      expect(
+        db.query<{ count: number }, []>("SELECT COUNT(*) AS count FROM task_attachments").get()
+          ?.count,
+      ).toBe(whitespaceCodePoints.length);
+      expect(
+        db
+          .query<{ count: number }, []>(
+            "SELECT COUNT(*) AS count FROM task_attachments WHERE capabilities IS NOT NULL",
+          )
+          .get()?.count,
+      ).toBe(0);
+    } finally {
+      db.close();
+    }
+  });
+
+  test("matches the TypeScript extractor across host and token boundaries", async () => {
+    await removeDb();
+    const db = new Database(DB_PATH, { create: true });
+    try {
+      runMigrations(db);
+      db.run("DELETE FROM _migrations WHERE version = 135");
+      const fixtures = [
+        "https://evil.example/?next=github.com/o/r/pull/8",
+        "xhttps://github.com/o/r/pull/1",
+        "https://github.com/o/r/pull/8/files",
+        "github.com/o/r/pull/8",
+        "Shipped https://github.com/o/r/pull/8, with follow-up prose.",
+        "https://notgithub.com/o/r/pull/8",
+        "https://_github.com/o/r/pull/8",
+        "https://evil.example/github.com/o/r/pull/8",
+        "https://github.com/o/r/pull/123abc",
+        "https://github.com/o/r/pull/123.foo",
+        "https://github.com/o/r/pull/123,abc",
+        "https://github.com/o/./pull/1",
+        "https://github.com/../r/pull/1",
+        ...ECMASCRIPT_WHITESPACE_CODE_POINTS.map(
+          (codePoint) => `done${String.fromCodePoint(codePoint)}https://github.com/o/r/pull/8`,
+        ),
+      ];
+      const now = new Date().toISOString();
+      const insertTask = db.prepare(
+        `INSERT INTO agent_tasks
+           (id, task, status, source, output, createdAt, lastUpdatedAt)
+         VALUES (?, 'fixture', 'completed', 'api', ?, ?, ?)`,
+      );
+      fixtures.forEach((fixture, index) => {
+        const suffix = String(index + 1).padStart(12, "0");
+        insertTask.run(`aaaaaaaa-aaaa-4aaa-8aaa-${suffix}`, fixture, now, now);
+      });
+
+      runMigrations(db);
+
+      fixtures.forEach((fixture, index) => {
+        const suffix = String(index + 1).padStart(12, "0");
+        const taskId = `aaaaaaaa-aaaa-4aaa-8aaa-${suffix}`;
+        const count = db
+          .query<{ count: number }, [string]>(
+            "SELECT COUNT(*) AS count FROM task_attachments WHERE task_id = ?",
+          )
+          .get(taskId)?.count;
+        expect(Boolean(count)).toBe(extractGitHubPullRequestUrls(fixture).length > 0);
+      });
+    } finally {
+      db.close();
+    }
+  });
+});

package/src/tests/tool-annotations.test.ts

@@ -111,6 +111,7 @@ describe("Tool Annotations & Classification", () => {
       "delete-page",
       "unregister-service",
       "slack-delete",
+      "slack-archive-channel",
     ];
 
     for (const name of expectedDestructive) {
@@ -164,6 +165,9 @@ describe("Tool Annotations & Classification", () => {
       "slack-read",
       "slack-post",
       "slack-start-thread",
+      "slack-create-channel",
+      "slack-invite-to-channel",
+      "slack-archive-channel",
       "slack-upload-file",
       "slack-download-file",
       "slack-list-channels",

package/src/tests/update-profile-api.test.ts

@@ -2,6 +2,12 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
 import { createServer as createHttpServer, type Server } from "node:http";
 import { closeDb, createAgent, getAgentById, initDb, updateAgentProfile } from "../be/db";
+import type { Agent } from "../types";
+import {
+  IDENTITY_MD_MAX_CHARS,
+  IdentityFieldBudgetError,
+  SOUL_MD_MAX_CHARS,
+} from "../utils/identity-field-budget";
 
 const TEST_DB_PATH = "./test-update-profile-api.sqlite";
 const TEST_PORT = 13020;
@@ -72,30 +78,23 @@ async function handleRequest(
       return { status: 400, body: { error: "Capabilities must be an array of strings" } };
     }
 
-    // Validate claudeMd size if provided (max 64KB)
-    if (body.claudeMd !== undefined && body.claudeMd.length > 65536) {
-      return { status: 400, body: { error: "claudeMd must be 64KB or less" } };
-    }
-
-    // Validate soulMd size if provided (max 64KB)
-    if (body.soulMd !== undefined && body.soulMd.length > 65536) {
-      return { status: 400, body: { error: "soulMd must be 64KB or less" } };
-    }
-
-    // Validate identityMd size if provided (max 64KB)
-    if (body.identityMd !== undefined && body.identityMd.length > 65536) {
-      return { status: 400, body: { error: "identityMd must be 64KB or less" } };
+    let agent: Agent | null;
+    try {
+      agent = updateAgentProfile(agentId, {
+        role: body.role,
+        description: body.description,
+        capabilities: body.capabilities,
+        claudeMd: body.claudeMd,
+        soulMd: body.soulMd,
+        identityMd: body.identityMd,
+      });
+    } catch (error) {
+      if (error instanceof IdentityFieldBudgetError) {
+        return { status: 400, body: { error: error.message } };
+      }
+      throw error;
     }
 
-    const agent = updateAgentProfile(agentId, {
-      role: body.role,
-      description: body.description,
-      capabilities: body.capabilities,
-      claudeMd: body.claudeMd,
-      soulMd: body.soulMd,
-      identityMd: body.identityMd,
-    });
-
     if (!agent) {
       return { status: 404, body: { error: "Agent not found" } };
     }
@@ -487,9 +486,16 @@ describe("PUT /api/agents/:id/profile", () => {
       expect(agent?.claudeMd).toBe(claudeMdContent);
     });
 
-    test("should return 400 if claudeMd exceeds 64KB", async () => {
-      const largeContent = "a".repeat(65537); // 64KB + 1 byte
-      const response = await fetch(`${baseUrl}/api/agents/test-agent/profile`, {
+    test("should return the ratchet reason if claudeMd exceeds its session budget", async () => {
+      const agentId = "test-agent-claudemd-over-budget";
+      createAgent({
+        id: agentId,
+        name: "Test Agent ClaudeMd Over Budget",
+        isLead: false,
+        status: "idle",
+      });
+      const largeContent = "a".repeat(20_001);
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ claudeMd: largeContent }),
@@ -497,19 +503,27 @@ describe("PUT /api/agents/:id/profile", () => {
 
       expect(response.status).toBe(400);
       const data = (await response.json()) as { error?: string };
-      expect(data.error).toContain("64KB");
+      expect(data.error).toContain("claudeMd");
+      expect(data.error).toContain("current size 0");
+      expect(data.error).toContain("budget 20000");
+      expect(data.error).toContain("delta +20001");
+      expect(data.error).toBe(
+        "Update rejected for claudeMd: current size 0 characters, budget 20000 characters, delta +20001 characters." +
+          " The tail past the 20000-character cap is dropped from the base prompt and only reaches harnesses with a native CLAUDE.md loader." +
+          " Move durable content into memories and keep pointers to it in this field.",
+      );
     });
 
-    test("should allow claudeMd at exactly 64KB", async () => {
-      const agentId = "test-agent-claudemd-64kb";
+    test("should allow claudeMd at exactly its session budget", async () => {
+      const agentId = "test-agent-claudemd-budget";
       createAgent({
         id: agentId,
-        name: "Test Agent ClaudeMd 64KB",
+        name: "Test Agent ClaudeMd Budget",
         isLead: false,
         status: "idle",
       });
 
-      const exactContent = "a".repeat(65536); // Exactly 64KB
+      const exactContent = "a".repeat(20_000);
       const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
@@ -518,7 +532,7 @@ describe("PUT /api/agents/:id/profile", () => {
 
       expect(response.status).toBe(200);
       const data = (await response.json()) as { claudeMd?: string };
-      expect(data.claudeMd?.length).toBe(65536);
+      expect(data.claudeMd?.length).toBe(20_000);
     });
 
     test("should allow clearing claudeMd by setting empty string", async () => {
@@ -607,9 +621,16 @@ describe("PUT /api/agents/:id/profile", () => {
       expect(agent?.soulMd).toBe(soulContent);
     });
 
-    test("should return 400 if soulMd exceeds 64KB", async () => {
-      const largeContent = "a".repeat(65537);
-      const response = await fetch(`${baseUrl}/api/agents/test-agent/profile`, {
+    test("should return 400 if soulMd exceeds its session budget", async () => {
+      const agentId = "test-agent-soulmd-over-budget";
+      createAgent({
+        id: agentId,
+        name: "Test Agent SoulMd Over Budget",
+        isLead: false,
+        status: "idle",
+      });
+      const largeContent = "a".repeat(SOUL_MD_MAX_CHARS + 1);
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ soulMd: largeContent }),
@@ -617,7 +638,7 @@ describe("PUT /api/agents/:id/profile", () => {
 
       expect(response.status).toBe(400);
       const data = (await response.json()) as { error?: string };
-      expect(data.error).toContain("64KB");
+      expect(data.error).toContain(`budget ${SOUL_MD_MAX_CHARS}`);
     });
   });
 
@@ -648,9 +669,16 @@ describe("PUT /api/agents/:id/profile", () => {
       expect(agent?.identityMd).toBe(identityContent);
     });
 
-    test("should return 400 if identityMd exceeds 64KB", async () => {
-      const largeContent = "a".repeat(65537);
-      const response = await fetch(`${baseUrl}/api/agents/test-agent/profile`, {
+    test("should return 400 if identityMd exceeds its session budget", async () => {
+      const agentId = "test-agent-identitymd-over-budget";
+      createAgent({
+        id: agentId,
+        name: "Test Agent IdentityMd Over Budget",
+        isLead: false,
+        status: "idle",
+      });
+      const largeContent = "a".repeat(IDENTITY_MD_MAX_CHARS + 1);
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ identityMd: largeContent }),
@@ -658,7 +686,7 @@ describe("PUT /api/agents/:id/profile", () => {
 
       expect(response.status).toBe(400);
       const data = (await response.json()) as { error?: string };
-      expect(data.error).toContain("64KB");
+      expect(data.error).toContain(`budget ${IDENTITY_MD_MAX_CHARS}`);
     });
 
     test("should preserve soulMd and identityMd when updating other fields", async () => {

package/src/tests/update-profile-auth.test.ts

@@ -1,8 +1,15 @@
 import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
-import { unlink } from "node:fs/promises";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { closeDb, createAgent, getAgentById, getLatestContextVersion, initDb } from "../be/db";
+import {
+  closeDb,
+  createAgent,
+  deleteAgent,
+  getAgentById,
+  getLatestContextVersion,
+  initDb,
+} from "../be/db";
 import { registerUpdateProfileTool } from "../tools/update-profile";
+import { SOUL_MD_MAX_CHARS } from "../utils/identity-field-budget";
 
 const TEST_DB_PATH = "./test-update-profile-auth.sqlite";
 
@@ -54,7 +61,7 @@ describe("update-profile authorization", () => {
   beforeAll(async () => {
     for (const suffix of ["", "-wal", "-shm"]) {
       try {
-        await unlink(TEST_DB_PATH + suffix);
+        await Bun.file(TEST_DB_PATH + suffix).delete();
       } catch {
         // File doesn't exist
       }
@@ -75,7 +82,7 @@ describe("update-profile authorization", () => {
     closeDb();
     for (const suffix of ["", "-wal", "-shm"]) {
       try {
-        await unlink(TEST_DB_PATH + suffix);
+        await Bun.file(TEST_DB_PATH + suffix).delete();
       } catch {
         // ignore
       }
@@ -208,6 +215,21 @@ describe("update-profile authorization", () => {
     expect(agent?.setupScript).toBe(before);
   });
 
+  test("rejected combined name and identity update leaves the name unchanged", async () => {
+    const before = getAgentById(WORKER_ID);
+
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      name: "Partially Renamed Worker",
+      soulMd: "x".repeat(SOUL_MD_MAX_CHARS + 1),
+    });
+
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.message).toContain("Update rejected for soulMd");
+    const after = getAgentById(WORKER_ID);
+    expect(after?.name).toBe(before?.name);
+    expect(after?.soulMd).toBe(before?.soulMd);
+  });
+
   test("logs setupScript audit diff for accepted updates", async () => {
     const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
 
@@ -227,4 +249,26 @@ describe("update-profile authorization", () => {
       warnSpy.mockRestore();
     }
   });
+
+  test("missing self agent does not write supplied profile files", async () => {
+    const originalAgentId = process.env.AGENT_ID;
+    const writeSpy = spyOn(Bun, "write").mockImplementation(async () => 0);
+
+    try {
+      process.env.AGENT_ID = WORKER_ID;
+      expect(deleteAgent(WORKER_ID)).toBe(true);
+
+      const result = await callUpdateProfile(server, WORKER_ID, {
+        soulMd: "must not reach the workspace",
+      });
+
+      expect(result.structuredContent.success).toBe(false);
+      expect(result.structuredContent.message).toContain("Agent not found");
+      expect(writeSpy).not.toHaveBeenCalled();
+    } finally {
+      writeSpy.mockRestore();
+      if (originalAgentId === undefined) delete process.env.AGENT_ID;
+      else process.env.AGENT_ID = originalAgentId;
+    }
+  });
 });

package/src/tests/user-attribution-migration.test.ts

@@ -158,3 +158,57 @@ describe("migration 127 user attribution backfill", () => {
     }
   });
 });
+
+describe("migration 136 requester provenance backfill", () => {
+  test("marks matching descendant requesters as inherited", async () => {
+    await removeDb();
+    const db = new Database(DB_PATH, { create: true });
+    try {
+      db.run(`CREATE TABLE agent_tasks (
+        id TEXT PRIMARY KEY,
+        parentTaskId TEXT,
+        requestedByUserId TEXT,
+        taskType TEXT,
+        tags TEXT,
+        created_by TEXT
+      )`);
+      db.run(`INSERT INTO agent_tasks
+        (id, parentTaskId, requestedByUserId, taskType, tags, created_by) VALUES
+        ('root', NULL, 'user-a', 'heartbeat-checklist', '[]', NULL),
+        ('child', 'root', 'user-a', NULL, '[]', NULL),
+        ('grandchild', 'child', 'user-a', NULL, '[]', NULL),
+        ('handoff', 'root', 'user-b', NULL, '[]', NULL),
+        ('handoff-child', 'handoff', 'user-b', NULL, '[]', NULL),
+        ('same-user-handoff', 'root', 'user-a', NULL, '[]', 'user-a'),
+        ('same-user-handoff-child', 'same-user-handoff', 'user-a', NULL, '[]', NULL),
+        ('unattributed-child', 'root', NULL, NULL, '[]', NULL),
+        ('ordinary-root', NULL, 'user-a', NULL, '[]', NULL),
+        ('ordinary-child', 'ordinary-root', 'user-a', NULL, '[]', NULL)`);
+
+      const migration = await Bun.file(
+        new URL("../be/migrations/136_task_requester_provenance.sql", import.meta.url),
+      ).text();
+      db.exec(migration);
+
+      const rows = db
+        .query<{ id: string; inherited: number }, []>(
+          "SELECT id, requestedByUserIdInherited AS inherited FROM agent_tasks ORDER BY id",
+        )
+        .all();
+      expect(Object.fromEntries(rows.map((row) => [row.id, row.inherited]))).toEqual({
+        child: 1,
+        grandchild: 1,
+        handoff: 0,
+        "handoff-child": 0,
+        "ordinary-child": 0,
+        "ordinary-root": 0,
+        root: 0,
+        "same-user-handoff": 0,
+        "same-user-handoff-child": 0,
+        "unattributed-child": 0,
+      });
+    } finally {
+      db.close();
+    }
+  });
+});