@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/src/tests/provider-registration.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildPricingSeedRows } from "../be/seed-pricing";
+import { CREDENTIAL_PROVIDER_CHECKERS } from "../commands/provider-credentials";
+import { ProviderNameSchema } from "../types";
+
+const entrypoint = await Bun.file(new URL("../../docker-entrypoint.sh", import.meta.url)).text();
+
+const bootstrapStart = 'if [ "$HARNESS_PROVIDER" = "pi" ]; then';
+const bootstrapEnd = "# ---- Verify provider binary is reachable ----";
+const bootstrapBlock = entrypoint.slice(
+  entrypoint.indexOf(bootstrapStart),
+  entrypoint.indexOf(bootstrapEnd),
+);
+const codexHomeAssignment = 'WORKER_CODEX_HOME="/home/worker/.codex"';
+const isolatedBootstrapBlock = bootstrapBlock.replace(
+  codexHomeAssignment,
+  'WORKER_CODEX_HOME="$TEST_WORKER_CODEX_HOME"',
+);
+if (isolatedBootstrapBlock === bootstrapBlock) {
+  throw new Error(`Could not isolate entrypoint assignment: ${codexHomeAssignment}`);
+}
+
+const modelsDevFixture = {
+  anthropic: { models: { "claude-test": { cost: { input: 1, output: 2 } } } },
+  openai: { models: { "gpt-test": { cost: { input: 1, output: 2 } } } },
+  openrouter: { models: { "test/model": { cost: { input: 1, output: 2 } } } },
+};
+
+const ENTRYPOINT_EXEMPTIONS = new Set(["claude", "acp"]);
+const ENTRYPOINT_OUTPUT: Record<string, string> = {
+  pi: "Warning: pi provider has no credentials yet",
+  opencode: "Warning: opencode provider has no credentials yet",
+  "claude-managed": "Warning: claude-managed provider missing:",
+  devin: "Warning: devin provider missing DEVIN_API_KEY / DEVIN_ORG_ID",
+  codex: "Warning: codex provider has no auth.json yet",
+};
+
+async function runCredentialBootstrap(provider: string): Promise<{
+  exitCode: number;
+  stdout: string;
+}> {
+  const testRoot = await mkdtemp(join(tmpdir(), "provider-registration-"));
+  try {
+    const proc = Bun.spawn(["bash", "-c", isolatedBootstrapBlock], {
+      env: {
+        PATH: process.env.PATH ?? "",
+        HOME: join(testRoot, "home"),
+        TEST_WORKER_CODEX_HOME: join(testRoot, "codex"),
+        HARNESS_PROVIDER: provider,
+        API_KEY: "",
+        MCP_BASE_URL: "",
+        MCP_URL: "",
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [exitCode, stdout] = await Promise.all([proc.exited, new Response(proc.stdout).text()]);
+    return { exitCode, stdout: stdout.trim() };
+  } finally {
+    await rm(testRoot, { recursive: true, force: true });
+  }
+}
+
+describe("provider registration synchronization", () => {
+  test("credential dispatcher has a concrete handler for every provider", () => {
+    expect(Object.keys(CREDENTIAL_PROVIDER_CHECKERS).sort()).toEqual(
+      [...ProviderNameSchema.options].sort(),
+    );
+  });
+
+  test("pricing seeder emits rows for every provider except ACP", () => {
+    const registered = new Set(buildPricingSeedRows(modelsDevFixture).map((row) => row.provider));
+    const expected = ProviderNameSchema.options.filter((provider) => provider !== "acp");
+    expect([...registered].filter((provider) => expected.includes(provider)).sort()).toEqual(
+      [...expected].sort(),
+    );
+  });
+
+  test.skipIf(process.platform === "win32")(
+    "entrypoint executes a credential bootstrap for every non-exempt provider",
+    async () => {
+      for (const provider of ProviderNameSchema.options) {
+        if (ENTRYPOINT_EXEMPTIONS.has(provider)) continue;
+        const result = await runCredentialBootstrap(provider);
+        expect(result.exitCode).toBe(0);
+        expect(result.stdout).toContain(ENTRYPOINT_OUTPUT[provider]);
+      }
+    },
+  );
+});

package/src/tests/rbac-e2e-helpers.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from "bun:test";
+import { closeSync, openSync } from "node:fs";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { type SwarmServer, waitForListen } from "./rbac-e2e-helpers";
+
+test("waitForListen includes a bounded server log when the process exits early", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "rbac-e2e-helper-"));
+  const logPath = join(dir, "server.log");
+  const knownLogLine = "known boot failure from the child process";
+  const discardedLogPrefix = "content before the bounded tail";
+  await Bun.write(logPath, `${discardedLogPrefix}${"x".repeat(8 * 1024)}\n`);
+  const logFd = openSync(logPath, "a");
+  let logFdOpen = true;
+
+  try {
+    const proc = Bun.spawn(["bun", "-e", `console.error(${JSON.stringify(knownLogLine)})`], {
+      stdout: logFd,
+      stderr: logFd,
+    });
+    await proc.exited;
+    closeSync(logFd);
+    logFdOpen = false;
+
+    const server: SwarmServer = {
+      proc,
+      port: 0,
+      base: "http://localhost:0",
+      dbPath: join(dir, "test.sqlite"),
+      logPath,
+      async stop() {
+        return proc.exitCode;
+      },
+    };
+
+    const earlyExitError = await waitForListen(server).catch((error: unknown) => error);
+    expect(earlyExitError).toBeInstanceOf(Error);
+    expect((earlyExitError as Error).message).toContain(knownLogLine);
+    expect((earlyExitError as Error).message).not.toContain(discardedLogPrefix);
+
+    const missingLogPath = join(dir, "missing.log");
+    const missingLogError = await waitForListen({ ...server, logPath: missingLogPath }).catch(
+      (error: unknown) => error,
+    );
+    expect(missingLogError).toBeInstanceOf(Error);
+    expect((missingLogError as Error).message).toContain(missingLogPath);
+    expect((missingLogError as Error).message).toContain("Could not read server log");
+  } finally {
+    if (logFdOpen) closeSync(logFd);
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/src/tests/rbac-e2e-helpers.ts

@@ -22,6 +22,8 @@ export { getFreePort };
 export const REPO_ROOT = join(import.meta.dir, "../..");
 export const E2E_API_KEY = "rbac-e2e-key";
 
+const SERVER_LOG_TAIL_BYTES = 8 * 1024;
+
 export const LEAD = "11111111-1111-4111-8111-111111111111";
 export const WORKER_A = "22222222-2222-4222-8222-222222222222";
 export const WORKER_B = "33333333-3333-4333-8333-333333333333";
@@ -115,7 +117,7 @@ export async function waitForListen(server: SwarmServer, deadlineMs = 90_000): P
   while (Date.now() - start < deadlineMs) {
     if (server.proc.exitCode !== null) {
       throw new Error(
-        `server exited with code ${server.proc.exitCode} before listening — see ${server.logPath}`,
+        `server exited with code ${server.proc.exitCode} before listening — see ${server.logPath}${await serverLogTail(server.logPath)}`,
       );
     }
     try {
@@ -126,7 +128,22 @@ export async function waitForListen(server: SwarmServer, deadlineMs = 90_000): P
     }
     await Bun.sleep(200);
   }
-  throw new Error(`server did not listen within ${deadlineMs}ms — see ${server.logPath}`);
+  throw new Error(
+    `server did not listen within ${deadlineMs}ms — see ${server.logPath}${await serverLogTail(server.logPath)}`,
+  );
+}
+
+async function serverLogTail(logPath: string): Promise<string> {
+  try {
+    const log = Bun.file(logPath);
+    if (!(await log.exists())) throw new Error("file does not exist");
+    const size = log.size;
+    const tail = await log.slice(Math.max(0, size - SERVER_LOG_TAIL_BYTES), size).text();
+    return `\n\nLog tail (up to ${SERVER_LOG_TAIL_BYTES} bytes):\n${tail}`;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return `\n\nCould not read server log at ${logPath}: ${reason}`;
+  }
 }
 
 // ── HTTP helpers ─────────────────────────────────────────────────────────────

package/src/tests/reload-config.test.ts

@@ -12,6 +12,7 @@ import {
   loadGlobalConfigsIntoEnv,
   scheduleIntegrationsReload,
 } from "../http/core";
+import { isOriginAllowedForCredentials } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-reload-config.sqlite";
@@ -199,6 +200,31 @@ describe("reload-config", () => {
     expect(process.env.API_KEY).toBeUndefined();
   });
 
+  test("stored CORS bypass cannot enable or override deployment CORS at boot or reload", async () => {
+    const key = "CORS_ALLOW_ANY_ORIGIN";
+    const original = process.env[key];
+    const rowId = await insertLegacyReservedRow(key, "true");
+    try {
+      for (const override of [false, true]) {
+        delete process.env[key];
+        expect(await loadGlobalConfigsIntoEnv(override)).not.toContain(key);
+        expect(process.env[key]).toBeUndefined();
+        expect(isOriginAllowedForCredentials("https://attacker.invalid")).toBe(false);
+        process.env[key] = "false";
+        await loadGlobalConfigsIntoEnv(override);
+        expect(process.env[key]).toBe("false");
+        process.env[key] = "true";
+        await loadGlobalConfigsIntoEnv(override);
+        expect(process.env[key]).toBe("true");
+        expect(isOriginAllowedForCredentials("https://attacker.invalid")).toBe(false);
+      }
+    } finally {
+      await deleteSwarmConfig(rowId);
+      if (original === undefined) delete process.env[key];
+      else process.env[key] = original;
+    }
+  });
+
   test("loadGlobalConfigsIntoEnv skips unreadable reserved secret rows before decrypting them", async () => {
     const id = await insertUnreadableReservedSecretRow("SECRETS_ENCRYPTION_KEY");
 

package/src/tests/routing-affinity-inventory.test.ts

@@ -40,7 +40,7 @@ const EXPECTED_INVENTORY: InventoryEntry[] = [
     kind: "consumer",
   },
   {
-    file: "src/be/db.ts",
+    file: "src/be/db/tasks/read.ts",
     owner: "rowToAgentTask",
     syntax: "ShorthandPropertyAssignment",
     count: 1,

package/src/tests/runner-attachments-section.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { buildAttachmentsSection } from "../commands/runner";
+import { buildAttachmentsSection } from "../commands/attachments-section";
 
 describe("buildAttachmentsSection", () => {
   test("returns empty string when there are no attachments", () => {
@@ -20,7 +20,7 @@ describe("buildAttachmentsSection", () => {
     expect(section).toContain("IMG_1357.jpeg");
     expect(section).toContain("image/jpeg, 2816227 bytes");
     expect(section).toContain(
-      '$MCP_BASE_URL/api/fs/tasks/task-123/files/att-1/raw" -o /tmp/IMG_1357.jpeg',
+      "$MCP_BASE_URL/api/fs/tasks/task-123/files/att-1/raw\" --create-dirs -o '/tmp/attachments/att-1/IMG_1357.jpeg'",
     );
     // No org/drive discovery should be required — the whole point of the fix.
     expect(section).not.toContain("agent-fs");
@@ -41,6 +41,26 @@ describe("buildAttachmentsSection", () => {
     expect(lines[1]).toContain("b.pdf");
   });
 
+  test("quotes the output path so names from users can't break the command", () => {
+    const section = buildAttachmentsSection("task-123", [
+      { id: "att-1", name: "Screenshot 2026-09-11 at 1.55 PM.png" },
+      { id: "att-2", name: "it's ../../etc/passwd" },
+    ]);
+
+    expect(section).toContain("-o '/tmp/attachments/att-1/Screenshot 2026-09-11 at 1.55 PM.png'");
+    expect(section).toContain("-o '/tmp/attachments/att-2/it'\\''s .._.._etc_passwd'");
+  });
+
+  test("gives every attachment its own download path, even when names repeat", () => {
+    const section = buildAttachmentsSection("task-123", [
+      { id: "att-1", name: "image.png" },
+      { id: "att-2", name: "image.png" },
+    ]);
+
+    expect(section).toContain("-o '/tmp/attachments/att-1/image.png'");
+    expect(section).toContain("-o '/tmp/attachments/att-2/image.png'");
+  });
+
   test("skips malformed attachment entries without throwing", () => {
     const section = buildAttachmentsSection("task-123", [
       { id: "att-1" }, // missing name — id used as fallback name

package/src/tests/runner-context-preamble.test.ts

@@ -5,6 +5,7 @@ import {
   CONTEXT_PREAMBLE_MAX_CHARS,
   CONTEXT_PREAMBLE_MAX_TOKENS,
   fetchTaskContextForPreamble,
+  prependContextPreamble,
   type TaskContextForPreamble,
 } from "../commands/context-preamble";
 import { listenOnFreePort } from "./test-net";
@@ -51,6 +52,35 @@ function seedTask(task: TaskContextForPreamble): void {
   mockTasks[task.id] = task;
 }
 
+describe("prependContextPreamble", () => {
+  const preamble = "\n---\n## Prior Conversation Context\nParent task evidence\n\n";
+
+  test.each([
+    "/work-on-task",
+    "/skill:work-on-task",
+    "/review-offered-task",
+  ])("preserves the leading %s invocation and the full task body", (command) => {
+    const prompt = `${command} task-id\n\nTask: follow up\nAttachments: artifact\n`;
+    expect(prependContextPreamble(prompt, preamble)).toBe(
+      `${command} task-id\n${preamble}\nTask: follow up\nAttachments: artifact\n`,
+    );
+  });
+
+  test("preserves a command-only prompt and leaves empty context unchanged", () => {
+    expect(prependContextPreamble("/work-on-task task-id", preamble)).toBe(
+      `/work-on-task task-id\n${preamble}`,
+    );
+    expect(prependContextPreamble("/work-on-task task-id\n\nTask", "")).toBe(
+      "/work-on-task task-id\n\nTask",
+    );
+  });
+
+  test("prepends context normally when there is no leading skill", () => {
+    const prompt = "Continue the task\n/work-on-task is quoted here";
+    expect(prependContextPreamble(prompt, preamble)).toBe(preamble + prompt);
+  });
+});
+
 describe("fetchTaskContextForPreamble", () => {
   test("returns null on 404", async () => {
     const result = await fetchTaskContextForPreamble(API_URL, API_KEY, "missing-id");

package/src/tests/runner-deployment-resume.test.ts

@@ -0,0 +1,107 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { rm } from "node:fs/promises";
+import { createServer, type Server } from "node:http";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  getDbClient,
+  initDb,
+  insertTaskAttachment,
+} from "../be/db";
+import { buildResumePrompt, getPausedTasksFromAPI } from "../commands/runner";
+import { handleTasks } from "../http/tasks";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { setRequestAuth } from "../utils/request-auth-context";
+import { listenOnFreePort } from "./test-net";
+
+const dbPath = `/tmp/test-deployment-resume-${crypto.randomUUID()}.sqlite`;
+let server: Server;
+let apiUrl: string;
+let agentId: string;
+const outputSchema = {
+  type: "object",
+  required: ["answer"],
+  properties: { answer: { type: "string" } },
+};
+
+beforeAll(async () => {
+  initDb(dbPath);
+  agentId = (await createAgent({ name: "resume-worker", isLead: false, status: "idle" })).id;
+  server = createServer(async (req, res) => {
+    setRequestAuth(req, { kind: "operator", fingerprint: "resume-test" });
+    if (
+      await handleTasks(
+        req,
+        res,
+        getPathSegments(req.url ?? ""),
+        parseQueryParams(req.url ?? ""),
+        req.headers["x-agent-id"] as string | undefined,
+      )
+    )
+      return;
+    res.writeHead(404).end();
+  });
+  const port = await listenOnFreePort(server);
+  apiUrl = `http://127.0.0.1:${port}`;
+});
+
+afterAll(async () => {
+  if (server) await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) await rm(dbPath + suffix, { force: true });
+});
+
+describe("deployment resume context", () => {
+  for (const progress of [undefined, "Read the first page"]) {
+    test(`paused task retains its attachment and output schema (${progress ? "with" : "without"} progress)`, async () => {
+      const task = await createTaskExtended("Summarize the attached input", {
+        agentId,
+        outputSchema,
+      });
+      await getDbClient().run(
+        "UPDATE agent_tasks SET status = 'paused', progress = ? WHERE id = ?",
+        [progress ?? null, task.id],
+      );
+      const attachment = await insertTaskAttachment({
+        taskId: task.id,
+        kind: "url",
+        name: "input.txt",
+        url: "https://example.com/input.txt",
+        mimeType: "text/plain",
+        sizeBytes: 42,
+      });
+      const tasks = await getPausedTasksFromAPI({ apiUrl, apiKey: "test-key", agentId });
+      const paused = tasks.find((row) => row.id === task.id);
+      expect(paused).toBeDefined();
+      if (!paused) throw new Error("Paused task missing");
+      expect(paused.outputSchema).toEqual(outputSchema);
+      expect(paused.attachments).toContainEqual(
+        expect.objectContaining({ id: attachment.id, name: "input.txt" }),
+      );
+      const prompt = await buildResumePrompt(paused);
+      expect(prompt).toContain(`/work-on-task ${task.id}`);
+      expect(prompt).toContain(`/api/fs/tasks/${task.id}/files/${attachment.id}/raw`);
+      expect(prompt).toContain("input.txt");
+      expect(prompt).toContain("**Required Output Format**");
+      expect(prompt).toContain(JSON.stringify(outputSchema, null, 2));
+      expect(prompt).toContain(progress ?? "No progress was saved");
+    });
+  }
+
+  test("legacy tasks without a schema retain the generic completion instruction", async () => {
+    const prompt = await buildResumePrompt({ id: "task", task: "Continue" });
+    expect(prompt).toContain('status: "completed"');
+    expect(prompt).not.toContain("Required Output Format");
+  });
+
+  test("providers without MCP omit the MCP output instruction", async () => {
+    const prompt = await buildResumePrompt(
+      { id: "task", task: "Continue", outputSchema },
+      undefined,
+      { hasMcp: false },
+    );
+    expect(prompt).not.toContain("store-progress");
+    expect(prompt).not.toContain("/work-on-task");
+  });
+});

package/src/tests/runner-repo-autostash.test.ts

@@ -248,6 +248,18 @@ describe("isFirstKickoffTask", () => {
     expect(await isFirstKickoffTask({ taskType: "resume" })).toBe(false);
   });
 
+  test("a deferred wake-up task is never a first kickoff", async () => {
+    // The `defer-task` parent is already `completed`, so the parent-status
+    // check alone would clear it for a destructive hard reset.
+    expect(await isFirstKickoffTask({ taskType: "deferred" })).toBe(false);
+    expect(
+      await isFirstKickoffTask(
+        { taskType: "deferred", parentTaskId: "parent-1" },
+        async () => "completed",
+      ),
+    ).toBe(false);
+  });
+
   test("a brand-new top-level task with no fields at all is a first kickoff", async () => {
     expect(await isFirstKickoffTask({})).toBe(true);
   });

package/src/tests/script-connections.test.ts

@@ -562,6 +562,10 @@ describe("script connections", () => {
       markMigrationApplied(database, "142_workflow_automation_preflight.sql");
       // 143 backfills pricing, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "143_backfill_gpt_6_astra_pricing.sql");
+      // 147 alters scheduled_tasks, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "147_scheduled_tasks_parent_task.sql");
+      // 148 rebuilds pages, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "148_pages_svg.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/seed-scripts.test.ts

@@ -55,8 +55,8 @@ afterAll(async () => {
 });
 
 describe("seed-scripts catalog", () => {
-  test("manifest holds 26 unique, well-described scripts", () => {
-    expect(SEED_SCRIPTS.length).toBe(26);
+  test("manifest holds 27 unique, well-described scripts", () => {
+    expect(SEED_SCRIPTS.length).toBe(27);
     const names = SEED_SCRIPTS.map((s) => s.name);
     expect(new Set(names).size).toBe(names.length);
     for (const s of SEED_SCRIPTS) {