@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/src/tests/acp-adapter.test.ts

@@ -1,15 +1,20 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync } from "node:fs";
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import type { Usage } from "@agentclientprotocol/sdk";
 import { normalizeSessionLogs } from "../../apps/ui/src/logs-parser";
 import {
   closeDb,
+  createAgent,
   createSessionLogs,
   createTaskExtended,
   getSessionLogsByTaskId,
   initDb,
 } from "../be/db";
+import { handleSessionData } from "../http/session-data";
+import { getPathSegments, parseQueryParams } from "../http/utils";
 import { createProviderAdapter } from "../providers";
 import {
   ACPAdapter,
@@ -19,6 +24,7 @@ import {
 } from "../providers/acp-adapter";
 import { AcpTargetResolutionError, resolveAcpTarget } from "../providers/acp-targets";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { listenOnFreePort } from "./test-net";
 
 const tmpDirs: string[] = [];
 
@@ -51,6 +57,32 @@ function baseConfig(overrides: Partial<ProviderSessionConfig> = {}): ProviderSes
   };
 }
 
+/**
+ * Start a minimal swarm API stub that handles POST /api/sessions/tokens and
+ * DELETE /api/sessions/tokens/:id. Returns the server and its base URL.
+ * The caller is responsible for closing the server.
+ */
+async function startTokenStubServer(
+  tokenId: string,
+  plaintext: string,
+): Promise<{ server: Server; apiUrl: string }> {
+  const stub = createServer(async (req: IncomingMessage, res: ServerResponse) => {
+    if (req.method === "POST" && req.url === "/api/sessions/tokens") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ tokenId, plaintext }));
+    } else if (req.method === "DELETE" && req.url?.startsWith("/api/sessions/tokens/")) {
+      res.writeHead(204);
+      res.end();
+    } else {
+      res.writeHead(404);
+      res.end();
+    }
+  });
+  await new Promise<void>((resolve) => stub.listen(0, "127.0.0.1", resolve));
+  const addr = stub.address() as import("net").AddressInfo;
+  return { server: stub, apiUrl: `http://127.0.0.1:${addr.port}` };
+}
+
 describe("ACPAdapter", () => {
   test("is registered with MCP and local-environment traits", async () => {
     const adapter = await createProviderAdapter("acp");
@@ -68,7 +100,32 @@ describe("ACPAdapter", () => {
     );
   });
 
-  test("redacts credential headers from arrays and nested maps before persistence", async () => {
+  test.each<{ name: string; usage?: Usage | null }>([
+    { name: "absent", usage: undefined },
+    { name: "null", usage: null },
+    {
+      name: "OpenCode observed",
+      usage: {
+        inputTokens: 84376,
+        outputTokens: 65,
+        totalTokens: 86233,
+        cachedReadTokens: 1792,
+      },
+    },
+    {
+      name: "populated",
+      usage: {
+        totalTokens: 180,
+        inputTokens: 100,
+        outputTokens: 30,
+        thoughtTokens: 10,
+        cachedReadTokens: 25,
+        cachedWriteTokens: 15,
+      },
+    },
+  ])("persists $name ACP usage with deliberate zero-coalescing of missing session-cost counters", async ({
+    usage,
+  }) => {
     const cwd = makeTempDir();
     const agentPath = join(cwd, "fake-acp-agent.ts");
     const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
@@ -222,7 +279,15 @@ class FakeAgent {
         rawOutput: { chunks: Array.from({ length: 20 }, () => "z".repeat(2_000)) },
       },
     });
-    return { stopReason: "end_turn" };
+    return ${JSON.stringify({
+      stopReason: "end_turn",
+      usage,
+      _meta: {
+        debug: "ghp_abcdefghijklmnopqrstuvwxyz0123456789",
+        authorization: "opaque-response-credential",
+        note: "response metadata",
+      },
+    })};
   }
 
   async cancel() {}
@@ -235,133 +300,205 @@ new AgentSideConnection((connection) => new FakeAgent(connection), stream);
 `,
     );
 
-    const adapter = new ACPAdapter();
-    const session = await adapter.createSession(
-      baseConfig({
-        cwd,
-        env: {
-          PATH: process.env.PATH ?? "",
-          HOME: process.env.HOME ?? "",
-          ACP_TARGET_COMMAND: "bun",
-          ACP_TARGET_ARGS: JSON.stringify([agentPath]),
-          ACP_CONFIG_OPTIONS: JSON.stringify({ thought: "high" }),
-        },
-      }),
+    const { server: tokenStub, apiUrl } = await startTokenStubServer(
+      "stub-token-id",
+      "aseph_stubtokenfortest1234567890",
     );
 
-    const events: ProviderEvent[] = [];
-    session.onEvent((event) => events.push(event));
-    const result = await session.waitForCompletion();
+    try {
+      const adapter = new ACPAdapter();
+      const session = await adapter.createSession(
+        baseConfig({
+          cwd,
+          apiUrl,
+          env: {
+            PATH: process.env.PATH ?? "",
+            HOME: process.env.HOME ?? "",
+            ACP_TARGET_COMMAND: "bun",
+            ACP_TARGET_ARGS: JSON.stringify([agentPath]),
+            ACP_CONFIG_OPTIONS: JSON.stringify({ thought: "high" }),
+          },
+        }),
+      );
 
-    expect(result).toMatchObject({
-      exitCode: 0,
-      sessionId: "acp-session-1",
-      output: "done",
-      isError: false,
-    });
-    expect(events.some((event) => event.type === "session_init")).toBe(true);
-    expect(events.find((event) => event.type === "session_init")).toMatchObject({
-      providerMeta: {
-        target: "custom",
-        configOptions: [
-          { id: "model", currentValue: "fake-model" },
-          { id: "thought", currentValue: "high" },
-        ],
-      },
-    });
-    expect(events.some((event) => event.type === "message" && event.content === "done")).toBe(true);
-    expect(events.some((event) => event.type === "tool_start")).toBe(true);
-    expect(events.some((event) => event.type === "tool_end")).toBe(true);
-    expect(events.some((event) => event.type === "result")).toBe(true);
-
-    const rawLogs = events
-      .filter(
-        (event): event is Extract<ProviderEvent, { type: "raw_log" }> => event.type === "raw_log",
-      )
-      .map((event) => event.content);
-    expect(rawLogs.length).toBeGreaterThan(0);
-    expect(
-      rawLogs.some((content) => {
-        const event = JSON.parse(content) as Record<string, unknown>;
-        const update = event.update as Record<string, unknown> | undefined;
-        return update?.sessionUpdate === "agent_message_chunk";
-      }),
-    ).toBe(true);
-    expect(
-      rawLogs.some((content) => {
-        const event = JSON.parse(content) as Record<string, unknown>;
-        const update = event.update as Record<string, unknown> | undefined;
-        return update?.sessionUpdate === "current_mode_update";
-      }),
-    ).toBe(true);
-    expect(
-      rawLogs.some((content) => {
-        const event = JSON.parse(content) as Record<string, unknown>;
-        return event.type === "message" && event.content === "done";
-      }),
-    ).toBe(true);
-    expect(rawLogs.every((content) => content.length <= 30_000)).toBe(true);
+      const events: ProviderEvent[] = [];
+      session.onEvent((event) => events.push(event));
+      const result = await session.waitForCompletion();
 
-    initDb(":memory:");
-    try {
-      const task = await createTaskExtended("ACP persistence test");
-      await createSessionLogs({
-        taskId: task.id,
-        sessionId: session.sessionId,
-        iteration: 1,
-        cli: "acp",
-        lines: rawLogs,
+      expect(result).toMatchObject({
+        exitCode: 0,
+        sessionId: "acp-session-1",
+        output: "done",
+        isError: false,
       });
-      const persisted = await getSessionLogsByTaskId(task.id);
-      expect(persisted).toHaveLength(rawLogs.length);
-      expect(persisted.map((entry) => entry.content)).toEqual(rawLogs);
-      expect(persisted.every((entry) => entry.cli === "acp")).toBe(true);
-      const persistedJson = persisted.map((entry) => entry.content).join("\n");
-      const credentialHeaderNames = [
-        "authorization",
-        "proxy-authorization",
-        "cookie",
-        "set-cookie",
-        "www-authenticate",
-        "proxy-authenticate",
-        "x-api-key",
-        "api-key",
-        "x-auth-token",
-        "x-access-token",
-        "x-session-token",
-      ];
-      for (const headerName of credentialHeaderNames) {
-        expect(persistedJson.toLowerCase()).not.toContain(headerName);
-      }
-      const credentialValues = credentialHeaderNames.flatMap((headerName) => [
-        `opaque-array-${headerName}-credential`,
-        `opaque-map-${headerName}-credential`,
-      ]);
-      for (const credentialValue of credentialValues) {
-        expect(persistedJson).not.toContain(credentialValue);
-      }
-      expect(persistedJson).toContain("X-Debug");
-      expect(persistedJson).toContain("X-Debug-Map");
-      expect(persistedJson).not.toContain("ghp_abcdefghijklmnopqrstuvwxyz0123456789");
-      expect(persistedJson).toContain("[REDACTED:github_token]");
-      expect(persistedJson).toContain("… [truncated]");
-      expect(persistedJson).not.toContain("x".repeat(30_001));
-      const transcript = normalizeSessionLogs(persisted);
-      expect(transcript.items.some((item) => item.kind === "unknown")).toBe(false);
+      expect(events.some((event) => event.type === "session_init")).toBe(true);
+      expect(events.find((event) => event.type === "session_init")).toMatchObject({
+        providerMeta: {
+          target: "custom",
+          configOptions: [
+            { id: "model", currentValue: "fake-model" },
+            { id: "thought", currentValue: "high" },
+          ],
+        },
+      });
+      expect(events.some((event) => event.type === "message" && event.content === "done")).toBe(
+        true,
+      );
+      expect(events.some((event) => event.type === "tool_start")).toBe(true);
+      expect(events.some((event) => event.type === "tool_end")).toBe(true);
+      expect(events.some((event) => event.type === "result")).toBe(true);
+
+      const rawLogs = events
+        .filter(
+          (event): event is Extract<ProviderEvent, { type: "raw_log" }> => event.type === "raw_log",
+        )
+        .map((event) => event.content);
+      expect(rawLogs.length).toBeGreaterThan(0);
       expect(
-        transcript.items.some(
-          (item) => item.kind === "text" && item.role === "assistant" && item.text === "done",
-        ),
+        rawLogs.some((content) => {
+          const event = JSON.parse(content) as Record<string, unknown>;
+          const update = event.update as Record<string, unknown> | undefined;
+          return update?.sessionUpdate === "agent_message_chunk";
+        }),
       ).toBe(true);
       expect(
-        transcript.items.some((item) => item.kind === "tool_call" && item.tool?.id === "tool-1"),
+        rawLogs.some((content) => {
+          const event = JSON.parse(content) as Record<string, unknown>;
+          const update = event.update as Record<string, unknown> | undefined;
+          return update?.sessionUpdate === "current_mode_update";
+        }),
       ).toBe(true);
       expect(
-        transcript.items.find((item) => item.kind === "tool_result" && item.result?.id === "tool-1")
-          ?.result?.isError,
+        rawLogs.some((content) => {
+          const event = JSON.parse(content) as Record<string, unknown>;
+          return event.type === "message" && event.content === "done";
+        }),
       ).toBe(true);
+      expect(rawLogs.every((content) => content.length <= 30_000)).toBe(true);
+
+      initDb(":memory:");
+      try {
+        const task = await createTaskExtended("ACP persistence test");
+        await createSessionLogs({
+          taskId: task.id,
+          sessionId: session.sessionId,
+          iteration: 1,
+          cli: "acp",
+          lines: rawLogs,
+        });
+        const persisted = await getSessionLogsByTaskId(task.id);
+        expect(persisted).toHaveLength(rawLogs.length);
+        expect(persisted.map((entry) => entry.content)).toEqual(rawLogs);
+        expect(persisted.every((entry) => entry.cli === "acp")).toBe(true);
+        // Match saveCostData's JSON transport: undefined counters disappear on the wire.
+        // The existing API deliberately coalesces them to zero; only raw logs retain absence.
+        const agent = await createAgent({ name: "ACP cost test", isLead: false, status: "idle" });
+        const server = createServer(async (req, res) => {
+          const handled = await handleSessionData(
+            req,
+            res,
+            getPathSegments(req.url ?? ""),
+            parseQueryParams(req.url ?? ""),
+            agent.id,
+          );
+          if (!handled) {
+            res.writeHead(404);
+            res.end();
+          }
+        });
+        try {
+          const port = await listenOnFreePort(server);
+          const endpoint = `http://127.0.0.1:${port}/api/session-costs`;
+          const body = JSON.stringify({ ...result.cost, agentId: agent.id, taskId: task.id });
+          if (!usage) {
+            for (const counter of [
+              "inputTokens",
+              "outputTokens",
+              "cacheReadTokens",
+              "cacheWriteTokens",
+            ]) {
+              expect(JSON.parse(body)).not.toHaveProperty(counter);
+            }
+          }
+          const response = await fetch(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body,
+          });
+          expect(response.status).toBe(201);
+          const { cost } = await response.json();
+          expect(cost).toMatchObject({
+            inputTokens: usage?.inputTokens ?? 0,
+            outputTokens: usage?.outputTokens ?? 0,
+            cacheReadTokens: usage?.cachedReadTokens ?? 0,
+            cacheWriteTokens: usage?.cachedWriteTokens ?? 0,
+            costSource: "unpriced",
+          });
+          const readback = await fetch(`${endpoint}?taskId=${task.id}`);
+          expect(readback.status).toBe(200);
+          const { costs } = await readback.json();
+          expect(costs).toHaveLength(1);
+          expect(costs[0]).toMatchObject({
+            id: cost.id,
+            inputTokens: cost.inputTokens,
+            outputTokens: cost.outputTokens,
+            cacheReadTokens: cost.cacheReadTokens,
+            cacheWriteTokens: cost.cacheWriteTokens,
+            costSource: cost.costSource,
+          });
+        } finally {
+          await new Promise<void>((resolve) => server.close(() => resolve()));
+        }
+        const persistedJson = persisted.map((entry) => entry.content).join("\n");
+        const credentialHeaderNames = [
+          "authorization",
+          "proxy-authorization",
+          "cookie",
+          "set-cookie",
+          "www-authenticate",
+          "proxy-authenticate",
+          "x-api-key",
+          "api-key",
+          "x-auth-token",
+          "x-access-token",
+          "x-session-token",
+        ];
+        for (const headerName of credentialHeaderNames) {
+          expect(persistedJson.toLowerCase()).not.toContain(headerName);
+        }
+        const credentialValues = credentialHeaderNames.flatMap((headerName) => [
+          `opaque-array-${headerName}-credential`,
+          `opaque-map-${headerName}-credential`,
+        ]);
+        for (const credentialValue of credentialValues) {
+          expect(persistedJson).not.toContain(credentialValue);
+        }
+        expect(persistedJson).toContain("X-Debug");
+        expect(persistedJson).toContain("X-Debug-Map");
+        expect(persistedJson).not.toContain("ghp_abcdefghijklmnopqrstuvwxyz0123456789");
+        expect(persistedJson).toContain("[REDACTED:github_token]");
+        expect(persistedJson).toContain("… [truncated]");
+        expect(persistedJson).not.toContain("x".repeat(30_001));
+        const transcript = normalizeSessionLogs(persisted);
+        expect(transcript.items.some((item) => item.kind === "unknown")).toBe(false);
+        expect(
+          transcript.items.some(
+            (item) => item.kind === "text" && item.role === "assistant" && item.text === "done",
+          ),
+        ).toBe(true);
+        expect(
+          transcript.items.some((item) => item.kind === "tool_call" && item.tool?.id === "tool-1"),
+        ).toBe(true);
+        expect(
+          transcript.items.find(
+            (item) => item.kind === "tool_result" && item.result?.id === "tool-1",
+          )?.result?.isError,
+        ).toBe(true);
+      } finally {
+        closeDb();
+      }
     } finally {
-      closeDb();
+      await new Promise<void>((resolve) => tokenStub.close(() => resolve()));
     }
   });
 
@@ -550,4 +687,119 @@ new AgentSideConnection((connection) => new FakeAgent(connection), stream);
     expect(toAcpMcpServers({ broken: { foo: "bar" } })).toEqual([]);
     expect(toAcpMcpServers(null)).toEqual([]);
   });
+
+  test("mints an ephemeral token and revokes it when the session ends", async () => {
+    const cwd = makeTempDir();
+    const agentPath = join(cwd, "fake-acp-ephem-agent.ts");
+    const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
+
+    const captureFile = join(cwd, "captured-auth.txt");
+
+    await Bun.write(
+      agentPath,
+      `
+import { Readable, Writable } from "node:stream";
+import { AgentSideConnection, PROTOCOL_VERSION, ndJsonStream } from "${sdkPath}";
+class FakeAgent {
+  constructor(connection) { this.connection = connection; }
+  async initialize() {
+    return { protocolVersion: PROTOCOL_VERSION, agentCapabilities: { loadSession: false } };
+  }
+  async newSession(params) {
+    const swarm = params.mcpServers.find((s) => s.name === "swarm");
+    const auth = swarm?.headers?.find((h) => h.name === "Authorization")?.value ?? "";
+    // Write bearer to a file so the test can read it back without relying on
+    // a custom sessionUpdate type that the ACP SDK schema rejects.
+    await Bun.write(${JSON.stringify(captureFile)}, auth);
+    // newSession must return { sessionId, configOptions? }, not a prompt response.
+    return { sessionId: "ephem-session-1" };
+  }
+  async prompt(params) {
+    await this.connection.sessionUpdate({
+      sessionId: params.sessionId,
+      update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: "done" }, messageId: "m1" },
+    });
+    return { stopReason: "end_turn" };
+  }
+  async cancel() {}
+}
+const stream = ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+new AgentSideConnection((connection) => new FakeAgent(connection), stream);
+`,
+    );
+
+    // Minimal swarm API stub: tracks calls to the session token endpoints.
+    const FAKE_TOKEN = "aseph_ephemtesttoken12345678901234";
+    const FAKE_TOKEN_ID = "fake-ephem-token-id";
+    let mintCalled = false;
+    let revokeCalled = false;
+    let mintBody: Record<string, unknown> = {};
+
+    const swarmServer = createServer(async (req: IncomingMessage, res: ServerResponse) => {
+      if (req.method === "POST" && req.url === "/api/sessions/tokens") {
+        mintCalled = true;
+        const chunks: Buffer[] = [];
+        for await (const chunk of req) chunks.push(chunk as Buffer);
+        try {
+          mintBody = JSON.parse(Buffer.concat(chunks).toString()) as Record<string, unknown>;
+        } catch {
+          /* ignore */
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ tokenId: FAKE_TOKEN_ID, plaintext: FAKE_TOKEN }));
+      } else if (req.method === "DELETE" && req.url === `/api/sessions/tokens/${FAKE_TOKEN_ID}`) {
+        revokeCalled = true;
+        res.writeHead(204);
+        res.end();
+      } else {
+        res.writeHead(404);
+        res.end();
+      }
+    });
+    await new Promise<void>((resolve) => swarmServer.listen(0, "127.0.0.1", resolve));
+    const swarmPort = (swarmServer.address() as import("net").AddressInfo).port;
+
+    try {
+      const adapter = new ACPAdapter();
+      const session = await adapter.createSession(
+        baseConfig({
+          cwd,
+          apiUrl: `http://127.0.0.1:${swarmPort}`,
+          apiKey: "real-operator-key",
+          env: {
+            PATH: process.env.PATH ?? "",
+            HOME: process.env.HOME ?? "",
+            ACP_TARGET_COMMAND: "bun",
+            ACP_TARGET_ARGS: JSON.stringify([agentPath]),
+          },
+        }),
+      );
+
+      const events: ProviderEvent[] = [];
+      session.onEvent((e) => events.push(e));
+      const result = await session.waitForCompletion();
+      // Give the revoke call (fire-and-forget) a moment to complete.
+      await Bun.sleep(100);
+
+      expect(result.exitCode).toBe(0);
+
+      // The adapter must have minted an ephemeral token.
+      expect(mintCalled).toBe(true);
+      expect(mintBody).toMatchObject({
+        agentId: "agent-1",
+        taskId: "task-1",
+      });
+
+      // The adapter must have revoked the token after the session ended.
+      expect(revokeCalled).toBe(true);
+
+      // Verify the bearer forwarded to the ACP target is the ephemeral token.
+      // The fake agent wrote the captured Authorization header value to a file
+      // during newSession; read it back here.
+      const captured = await Bun.file(captureFile).text();
+      expect(captured).toBe(`Bearer ${FAKE_TOKEN}`);
+    } finally {
+      await new Promise<void>((resolve) => swarmServer.close(() => resolve()));
+    }
+  });
 });

package/src/tests/budget-claim-gate.test.ts

@@ -157,6 +157,7 @@ describe("Phase 3 — /api/poll budget admission gate", () => {
     if ("error" in body) throw new Error("unexpected error response");
     expect(body.trigger?.type).toBe("task_assigned");
     expect(body.trigger?.requestedBy).toEqual({
+      id: requester.id,
       name: "Requester One",
       email: "requester@example.com",
       role: "engineering manager",

package/src/tests/build-pi-skills.test.ts

@@ -23,7 +23,7 @@ describe("build-pi-skills", () => {
     .map((d) => d.name);
 
   test("build script runs successfully", () => {
-    expect(buildOutput).toContain("Converted 13 skills");
+    expect(buildOutput).toContain("Converted 11 skills");
   });
 
   test("every command has a corresponding pi-skill", () => {
@@ -75,12 +75,10 @@ describe("build-pi-skills", () => {
   });
 
   describe("slash command syntax", () => {
-    const skillsWithCrossRefs = [
-      "work-on-task",
-      "start-worker",
-      "start-leader",
-      "review-offered-task",
-    ];
+    // `work-on-task` / `review-offered-task` are seeded skills, not commands —
+    // they have no pi-skill directory. The commands that link to them still
+    // must render the reference as `/skill:work-on-task`.
+    const skillsWithCrossRefs = ["start-worker", "start-leader"];
 
     for (const skill of skillsWithCrossRefs) {
       test(`${skill} uses /skill: prefix for cross-references`, () => {