@desplega.ai/agent-swarm 1.136.0 → 1.138.0

package/src/tests/vendored-openapi.test.ts

@@ -111,6 +111,7 @@ describe("vendored OpenAPI", () => {
       "linear",
       "jira",
       "gmail",
+      "microsoft-graph",
     ]);
     for (const entry of manifest.integrations) {
       const specText = readFileSync(path.join(directory, entry.specFile), "utf-8");
@@ -139,6 +140,17 @@ describe("vendored OpenAPI", () => {
     const refreshed = await refreshScriptConnection(connection.id);
     expect(refreshed?.generationError).toBeNull();
     expect(refreshed?.version).toBe(connection.version + 1);
+
+    const microsoftGraph = await upsertScriptConnection({
+      slug: "microsoftGraph",
+      kind: "openapi",
+      openapiSpecSourceKind: "vendored",
+      openapiSpecSource: "microsoft-graph",
+    });
+    expect(microsoftGraph.baseUrl).toBe("https://graph.microsoft.com/v1.0");
+    expect(microsoftGraph.generationError).toBeNull();
+    expect(microsoftGraph.generatedTypes).toContain("sendChannelMessage");
+    expect(microsoftGraph.generatedTypes).toContain('"team-id"');
   });
 
   test("resolves vendored specs from the module location when cwd is unrelated (npm-package install)", () => {
@@ -187,7 +199,7 @@ describe("vendored OpenAPI", () => {
       partial: boolean;
     };
     expect(down.partial).toBe(true);
-    expect(down.entries).toHaveLength(5);
+    expect(down.entries).toHaveLength(6);
     expect(down.entries.every((entry) => entry.feeds.includes("blessed"))).toBe(true);
 
     globalThis.fetch = (async () =>
@@ -209,13 +221,14 @@ describe("vendored OpenAPI", () => {
       partial: boolean;
     };
     expect(merged.partial).toBe(false);
-    expect(merged.entries.slice(0, 5).every((entry) => entry.feeds.includes("blessed"))).toBe(true);
+    expect(merged.entries.slice(0, 6).every((entry) => entry.feeds.includes("blessed"))).toBe(true);
     expect(merged.entries.map((entry) => entry.slug)).toEqual([
       "github",
       "slack",
       "linear",
       "jira",
       "gmail",
+      "microsoft-graph",
       "stripe",
     ]);
   });

package/src/tests/workflow-e2e.test.ts

@@ -21,6 +21,9 @@ import { ExecutorRegistry } from "../workflows/executors/registry";
 import { SwarmScriptExecutor } from "../workflows/executors/swarm-script";
 import { setupWorkflowResumeListener } from "../workflows/resume";
 import { interpolate } from "../workflows/template";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+
+const spawnDescribe = describe.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-e2e.sqlite";
 const API_KEY = "test-workflow-e2e-key-1234567890";
@@ -133,7 +136,7 @@ beforeEach(async () => {
   await client.run("DELETE FROM workflows");
 });
 
-describe("workflow e2e swarm-script", () => {
+spawnDescribe("workflow e2e swarm-script", () => {
   test("swarm-script full workflow run executes through the engine", async () => {
     await saveScript(
       "square",

package/src/tests/workflow-engine-v2.test.ts

@@ -25,6 +25,9 @@ import {
 import { ExecutorRegistry } from "../workflows/executors/registry";
 import { ScriptExecutor } from "../workflows/executors/script";
 import { resolveInputs } from "../workflows/input";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+
+const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-engine-v2.sqlite";
 
@@ -412,7 +415,7 @@ describe("Workflow Engine v2 (Phase 3)", () => {
     // RLIMIT_AS), so the script dies before the watchdog behavior under test.
     // Linux CI is the enforcing environment; the skip only unblocks local
     // macOS pushes now that pre-push tests are blocking (#1216).
-    test.skipIf(process.platform === "darwin")(
+    test.skipIf(process.platform === "darwin" || SKIP_SANDBOX_SPAWN_TESTS)(
       "inline script timeout also extends the workflow step watchdog",
       async () => {
         const registry = createTestRegistry();
@@ -828,7 +831,7 @@ describe("Workflow Engine v2 (Phase 3)", () => {
       expect(step?.output).toBeUndefined();
     });
 
-    test("bundled ralph-loop scripts execute with trigger and upstream values passed as args", async () => {
+    skip("bundled ralph-loop scripts execute with trigger and upstream values passed as args", async () => {
       const receipt = (await Bun.file(
         new URL("../../docs-site/public/receipts/workflows/ralph-loop.json", import.meta.url),
       ).json()) as { definition: WorkflowDefinition };

package/src/tests/workflow-executors.test.ts

@@ -20,6 +20,9 @@ import { createExecutorRegistry } from "../workflows/executors/registry";
 import { ScriptExecutor, ScriptOutputSchema } from "../workflows/executors/script";
 import { ValidateExecutor, ValidateOutputSchema } from "../workflows/executors/validate";
 import { VcsExecutor, VcsOutputSchema } from "../workflows/executors/vcs";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+
+const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-executors.sqlite";
 
@@ -482,7 +485,7 @@ describe("ScriptExecutor", () => {
     ).toBe(false);
   });
 
-  test("runs bash script and captures stdout", async () => {
+  skip("runs bash script and captures stdout", async () => {
     const result = await executor.run(input({ runtime: "bash", script: "echo 'hello world'" }, {}));
     expect(result.status).toBe("success");
     const out = result.output as { exitCode: number; stdout: string; stderr: string };
@@ -492,7 +495,7 @@ describe("ScriptExecutor", () => {
     expect(result.nextPort).toBe("success");
   });
 
-  test("marks step failed and captures stderr on non-zero exit", async () => {
+  skip("marks step failed and captures stderr on non-zero exit", async () => {
     const result = await executor.run(
       input({ runtime: "bash", script: "echo err >&2; exit 1" }, {}),
     );
@@ -503,7 +506,7 @@ describe("ScriptExecutor", () => {
     expect(out.stderr).toBe("err");
   });
 
-  test("marks step failed on non-zero exit code (exit 1)", async () => {
+  skip("marks step failed on non-zero exit code (exit 1)", async () => {
     const result = await executor.run(input({ runtime: "bash", script: "exit 1" }, {}));
     expect(result.status).toBe("failed");
     expect(result.error).toBe("Script exited with code 1");
@@ -511,7 +514,7 @@ describe("ScriptExecutor", () => {
     expect(out?.exitCode).toBe(1);
   });
 
-  test("marks step failed with exit code in error when no stderr (exit 42)", async () => {
+  skip("marks step failed with exit code in error when no stderr (exit 42)", async () => {
     const result = await executor.run(input({ runtime: "bash", script: "exit 42" }, {}));
     expect(result.status).toBe("failed");
     expect(result.error).toBe("Script exited with code 42");
@@ -519,7 +522,7 @@ describe("ScriptExecutor", () => {
     expect(out?.exitCode).toBe(42);
   });
 
-  test("runs TypeScript script via bun", async () => {
+  skip("runs TypeScript script via bun", async () => {
     const result = await executor.run(
       input({ runtime: "ts", script: "console.log('ts works')" }, {}),
     );
@@ -534,7 +537,7 @@ describe("ScriptExecutor", () => {
     expect(valid.success).toBe(true);
   });
 
-  test("keeps raw {exitCode, stdout, stderr} when stdout is not valid JSON", async () => {
+  skip("keeps raw {exitCode, stdout, stderr} when stdout is not valid JSON", async () => {
     const result = await executor.run(
       input({ runtime: "bash", script: "echo 'not-json {at all'" }, {}),
     );
@@ -549,7 +552,7 @@ describe("ScriptExecutor", () => {
     expect(Object.keys(out).sort()).toEqual(["exitCode", "stderr", "stdout"]);
   });
 
-  test("populates structured output on timeout instead of leaving it null", async () => {
+  skip("populates structured output on timeout instead of leaving it null", async () => {
     const result = await executor.run(
       input({ runtime: "bash", script: "sleep 5", timeout: 1000 }, {}),
     );
@@ -562,7 +565,7 @@ describe("ScriptExecutor", () => {
     expect(out.stderr).toContain("Script timed out after 1000ms");
   });
 
-  test("a timed-out script is TERMINATED, not just abandoned (Promise.race regression)", async () => {
+  skip("a timed-out script is TERMINATED, not just abandoned (Promise.race regression)", async () => {
     // A `sleep` is not bounded by the CPU ulimit, so before this fix the
     // wall-clock timeout only abandoned the promise and the child kept
     // running — long enough to finish its side effect after the step failed.
@@ -589,7 +592,7 @@ describe("ScriptExecutor", () => {
 
   // ─── Sandbox regression tests (superagent.sh c27edfd7, finding b132d7c5) ──
 
-  test("child process never inherits the server's secrets — env is scrubbed, not passed through", async () => {
+  skip("child process never inherits the server's secrets — env is scrubbed, not passed through", async () => {
     const savedKey = process.env.AGENT_SWARM_API_KEY;
     process.env.AGENT_SWARM_API_KEY = "super-secret-operator-bearer";
     process.env.SOME_OTHER_SERVER_SECRET = "also-should-not-leak";
@@ -618,9 +621,11 @@ describe("ScriptExecutor", () => {
   // RLIMIT_AS); the spawned script fails before the behavior under test runs.
   // Linux CI is the enforcing environment for these paths; the skips only
   // unblock local macOS pushes now that pre-push tests are blocking (#1216).
-  const skipOnMacOS = test.skipIf(process.platform === "darwin");
+  const spawnTestUnlessMacOS = test.skipIf(
+    process.platform === "darwin" || SKIP_SANDBOX_SPAWN_TESTS,
+  );
 
-  skipOnMacOS(
+  spawnTestUnlessMacOS(
     "resource ulimits actually apply to the spawned process (not just documented)",
     async () => {
       const result = await executor.run(input({ runtime: "bash", script: "ulimit -v" }, {}));
@@ -632,7 +637,7 @@ describe("ScriptExecutor", () => {
     },
   );
 
-  test("no explicit cwd: runs in a scoped tmpdir, not the server's working directory", async () => {
+  skip("no explicit cwd: runs in a scoped tmpdir, not the server's working directory", async () => {
     const result = await executor.run(input({ runtime: "bash", script: "pwd" }, {}));
     expect(result.status).toBe("success");
     const out = result.output as { stdout: string };
@@ -642,7 +647,7 @@ describe("ScriptExecutor", () => {
 
   // ─── Codex review follow-ups (PR #1112, review 4876200033) ──────────────
 
-  skipOnMacOS(
+  spawnTestUnlessMacOS(
     "truncated stdout carries an explicit marker instead of silently presenting a partial result as complete (PRRT_kwDOQr3Tmc6XCRu1)",
     async () => {
       const result = await executor.run(
@@ -658,7 +663,7 @@ describe("ScriptExecutor", () => {
     },
   );
 
-  skipOnMacOS(
+  spawnTestUnlessMacOS(
     "drain-deadline snapshot keeps the partial output already read instead of discarding it as empty (PRRT_kwDOQr3Tmc6XCRuy)",
     async () => {
       // The direct child prints known output, backgrounds a descendant that
@@ -692,7 +697,7 @@ describe("ScriptExecutor", () => {
   // running them: an interpolated arg literally named `--eval=<code>` was a
   // second, attacker-controlled script.
 
-  test("bun runtime: an arg shaped like --eval=<code> is inert data, not executed", async () => {
+  skip("bun runtime: an arg shaped like --eval=<code> is inert data, not executed", async () => {
     const result = await executor.run(
       input(
         {
@@ -713,7 +718,7 @@ describe("ScriptExecutor", () => {
     expect(JSON.parse(out.stdout)).toEqual(["--eval=console.log('INJECTED')"]);
   });
 
-  test("bun runtime: an arg shaped like --preload=<path> is inert data, not loaded", async () => {
+  skip("bun runtime: an arg shaped like --preload=<path> is inert data, not loaded", async () => {
     const result = await executor.run(
       input(
         {
@@ -736,7 +741,7 @@ describe("ScriptExecutor", () => {
     ]);
   });
 
-  test("bun runtime: normal args keep their previous argv indexing after the -- fix", async () => {
+  skip("bun runtime: normal args keep their previous argv indexing after the -- fix", async () => {
     const result = await executor.run(
       input(
         {
@@ -753,7 +758,7 @@ describe("ScriptExecutor", () => {
     expect(JSON.parse(out.stdout)).toEqual(["hello", "world"]);
   });
 
-  test("bash runtime: an arg shaped like --eval=<code> was already inert (documents why -- is not added)", async () => {
+  skip("bash runtime: an arg shaped like --eval=<code> was already inert (documents why -- is not added)", async () => {
     // bash -c script [$0 [$1 ...]] binds the first trailing arg to $0, not to
     // an option — there is no flag-reparsing surface to close here, and
     // adding `--` would shift $0 into args[0], breaking existing workflows.
@@ -772,7 +777,7 @@ describe("ScriptExecutor", () => {
     expect(out.stdout).toBe("[--eval=INJECTED][second]");
   });
 
-  test("python runtime: an arg shaped like -c <code> was already inert (documents why -- is not added)", async () => {
+  skip("python runtime: an arg shaped like -c <code> was already inert (documents why -- is not added)", async () => {
     // python3 -c code also stops option parsing after the -c operand —
     // trailing args (even another literal -c) land verbatim in sys.argv.
     const result = await executor.run(

package/src/tests/workflow-http-v2.test.ts

@@ -9,9 +9,11 @@ import {
 } from "node:http";
 import {
   closeDb,
+  createApprovalRequest,
   createUser,
   createWorkflowRun,
   createWorkflowRunStep,
+  getApprovalRequestById,
   getDbClient,
   getWorkflowRun,
   getWorkflowVersions,
@@ -964,11 +966,20 @@ describe("Workflow HTTP API v2", () => {
       await createWorkflowRun({ id: runId, workflowId: workflow.id });
 
       // Create a step in 'running' state
+      const stepId = crypto.randomUUID();
       await createWorkflowRunStep({
-        id: crypto.randomUUID(),
+        id: stepId,
         runId,
         nodeId: "n1",
-        nodeType: "notify",
+        nodeType: "human-in-the-loop",
+      });
+      const approval = await createApprovalRequest({
+        id: crypto.randomUUID(),
+        title: "Approve release",
+        questions: [{ id: "approve", type: "approval", label: "Approve?" }],
+        approvers: { policy: "any" },
+        workflowRunId: runId,
+        workflowRunStepId: stepId,
       });
 
       // Cancel the run
@@ -988,6 +999,10 @@ describe("Workflow HTTP API v2", () => {
       expect(run.status).toBe("cancelled");
       expect(run.error).toBe("Test cancellation");
       expect(run.finishedAt).toBeDefined();
+      expect(await getApprovalRequestById(approval.id)).toMatchObject({
+        status: "cancelled",
+        resolutionReason: "Test cancellation",
+      });
     });
 
     test("returns 400 for already completed run", async () => {

package/src/tests/workflow-llm.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+import { resolveWorkflowLlmConfig } from "../workflows/executors/workflow-llm";
+
+describe("resolveWorkflowLlmConfig", () => {
+  test("routes OpenRouter credentials through the configured gateway", async () => {
+    const config = await resolveWorkflowLlmConfig(undefined, {
+      OPENROUTER_API_KEY: "sk-or-test",
+      OPENROUTER_BASE_URL: "https://gateway.example.test/v1",
+    });
+
+    expect(config).toEqual({
+      apiKey: "sk-or-test",
+      baseURL: "https://gateway.example.test/v1",
+      model: "google/gemini-3-flash-preview",
+    });
+  });
+
+  test("routes OpenAI credentials to the SDK default endpoint", async () => {
+    const config = await resolveWorkflowLlmConfig(undefined, {
+      OPENAI_API_KEY: "sk-openai-test",
+    });
+
+    expect(config).toEqual({
+      apiKey: "sk-openai-test",
+      baseURL: undefined,
+      model: "gpt-5.4-mini",
+    });
+  });
+
+  test("does not reuse the memory-rater model as a workflow default", async () => {
+    const previous = process.env.MEMORY_RATER_MODEL;
+    process.env.MEMORY_RATER_MODEL = "openrouter/anthropic/claude-sonnet-4-5";
+    try {
+      const config = await resolveWorkflowLlmConfig(undefined, {
+        OPENAI_API_KEY: "sk-openai-test",
+      });
+      expect(config.model).toBe("gpt-5.4-mini");
+    } finally {
+      if (previous === undefined) delete process.env.MEMORY_RATER_MODEL;
+      else process.env.MEMORY_RATER_MODEL = previous;
+    }
+  });
+
+  test("preserves an explicit provider-compatible model", async () => {
+    const config = await resolveWorkflowLlmConfig("openai/gpt-5.4", {
+      OPENAI_API_KEY: "sk-openai-test",
+    });
+
+    expect(config.model).toBe("gpt-5.4");
+  });
+
+  test("rejects credential kinds without an OpenAI-compatible endpoint", async () => {
+    await expect(
+      resolveWorkflowLlmConfig(undefined, { ANTHROPIC_API_KEY: "sk-ant-test" }),
+    ).rejects.toThrow("do not support the resolved anthropic credential yet");
+  });
+});

package/src/tests/workflow-retry-v2.test.ts

@@ -26,6 +26,7 @@ import {
 } from "../workflows/executors/base";
 import { ExecutorRegistry } from "../workflows/executors/registry";
 import { recoverIncompleteRuns } from "../workflows/recovery";
+import { retryFailedRun } from "../workflows/resume";
 import { calculateDelay, startRetryPoller, stopRetryPoller } from "../workflows/retry-poller";
 import { interpolate } from "../workflows/template";
 
@@ -40,7 +41,10 @@ class FailOnceExecutor extends BaseExecutor<
   typeof FailOnceExecutor.schema,
   typeof FailOnceExecutor.outSchema
 > {
-  static readonly schema = z.object({ failUntilAttempt: z.number().default(1) });
+  static readonly schema = z.object({
+    failUntilAttempt: z.number().default(1),
+    message: z.string().min(1).optional(),
+  });
   static readonly outSchema = z.object({ attempt: z.number() });
 
   readonly type = "fail-once";
@@ -91,10 +95,13 @@ class NotifyStubExecutor extends BaseExecutor<
   readonly outputSchema = NotifyStubExecutor.outSchema;
 
   protected async execute(): Promise<ExecutorResult<z.infer<typeof NotifyStubExecutor.outSchema>>> {
+    notifyCounter++;
     return { status: "success", output: { sent: true } };
   }
 }
 
+let notifyCounter = 0;
+
 // ─── Mock Dependencies ───────────────────────────────────────
 
 import * as db from "../be/db";
@@ -227,6 +234,59 @@ describe("Workflow Retry v2 (Phase 4)", () => {
   });
 
   describe("Retry Poller", () => {
+    test("rehydrates completed step outputs before interpolating retry inputs", async () => {
+      const workflow = await makeWorkflow({
+        nodes: [
+          {
+            id: "producer",
+            type: "echo",
+            config: { message: "release payload" },
+            next: "consumer",
+          },
+          {
+            id: "consumer",
+            type: "fail-once",
+            inputs: { payload: "producer.echo" },
+            config: { failUntilAttempt: 1, message: "{{payload}}" },
+            retry: {
+              strategy: "static",
+              maxRetries: 2,
+              baseDelayMs: 1,
+              maxDelayMs: 1,
+            },
+          },
+        ],
+      });
+
+      failCounter = 0;
+      const runId = await startWorkflowExecution(workflow, {}, registry);
+      const initialRun = (await getWorkflowRun(runId))!;
+      const consumerStep = (await getWorkflowRunStepsByRunId(runId)).find(
+        (step) => step.nodeId === "consumer",
+      )!;
+      expect(consumerStep.status).toBe("failed");
+      expect(consumerStep.input).toMatchObject({ producer: { echo: "release payload" } });
+
+      const { producer: _lostOutput, ...contextWithoutProducer } = initialRun.context as Record<
+        string,
+        unknown
+      >;
+      await updateWorkflowRun(runId, { context: contextWithoutProducer });
+
+      try {
+        startRetryPoller(registry, 5);
+        for (let i = 0; i < 100 && (await getWorkflowRun(runId))?.status !== "completed"; i++) {
+          await new Promise((resolve) => setTimeout(resolve, 5));
+        }
+      } finally {
+        stopRetryPoller();
+      }
+
+      const completedRun = await getWorkflowRun(runId);
+      expect(completedRun?.status).toBe("completed");
+      expect(completedRun?.context).toMatchObject({ producer: { echo: "release payload" } });
+    });
+
     test("rehydrates requester attribution before retrying an executor", async () => {
       const user = await createUser({ name: "Retry Requester" });
       const workflow = await makeWorkflow({
@@ -445,4 +505,85 @@ describe("Workflow Retry v2 (Phase 4)", () => {
       expect(run!.status).toBe("completed");
     });
   });
+
+  describe("External retry", () => {
+    test("does not execute a node behind a gate port that was not taken", async () => {
+      const workflow = await makeWorkflow({
+        nodes: [
+          {
+            id: "gate",
+            type: "echo",
+            config: { message: "gate" },
+            next: { true: "inactive", false: "taken" },
+          },
+          {
+            id: "inactive",
+            type: "notify",
+            config: { channel: "test", template: "must not run" },
+          },
+          {
+            id: "taken",
+            type: "echo",
+            config: { message: "taken" },
+          },
+        ],
+      });
+      const runId = crypto.randomUUID();
+      await createWorkflowRun({ id: runId, workflowId: workflow.id, triggerData: {} });
+
+      const gateStepId = crypto.randomUUID();
+      await createWorkflowRunStep({
+        id: gateStepId,
+        runId,
+        nodeId: "gate",
+        nodeType: "echo",
+        input: {},
+      });
+      await updateWorkflowRunStep(gateStepId, {
+        status: "completed",
+        output: { echo: "gate" },
+        nextPort: "false",
+        finishedAt: new Date().toISOString(),
+      });
+
+      const takenStepId = crypto.randomUUID();
+      await createWorkflowRunStep({
+        id: takenStepId,
+        runId,
+        nodeId: "taken",
+        nodeType: "echo",
+        input: {},
+      });
+      await updateWorkflowRunStep(takenStepId, {
+        status: "completed",
+        output: { echo: "taken" },
+        finishedAt: new Date().toISOString(),
+      });
+
+      const failedStepId = crypto.randomUUID();
+      await createWorkflowRunStep({
+        id: failedStepId,
+        runId,
+        nodeId: "inactive",
+        nodeType: "notify",
+        input: {},
+      });
+      await updateWorkflowRunStep(failedStepId, {
+        status: "failed",
+        error: "retry target failed",
+        finishedAt: new Date().toISOString(),
+      });
+      await updateWorkflowRun(runId, { status: "failed", error: "retry target failed" });
+
+      notifyCounter = 0;
+      await retryFailedRun(runId, registry);
+
+      expect(notifyCounter).toBe(0);
+      expect((await getWorkflowRun(runId))?.status).toBe("completed");
+      expect(
+        (await getWorkflowRunStepsByRunId(runId)).find((step) => step.nodeId === "inactive")
+          ?.status,
+      ).toBe("cancelled");
+    });
+  });
 });