@desplega.ai/agent-swarm 1.147.0 → 1.149.0

package/src/tests/schedule-target-type.test.ts

@@ -12,11 +12,22 @@
  * - HTTP route cross-field validation (create + update) for workflow/script targets.
  */
 import { Database } from "bun:sqlite";
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  setSystemTime,
+  spyOn,
+  test,
+} from "bun:test";
 import { unlink } from "node:fs/promises";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { Readable } from "node:stream";
 import { z } from "zod";
+import * as preflightAlerts from "../automation-preflight-alert";
 import {
   type AutomationSetupStates,
   preflightAutomation,
@@ -88,6 +99,16 @@ class EchoExecutor extends BaseExecutor<typeof EchoExecutor.schema, typeof EchoE
 
 let savedEnv: NodeJS.ProcessEnv;
 let agentId: string;
+let notify: ReturnType<typeof spyOn<typeof preflightAlerts, "notifyAutomationPreflightFailure">>;
+
+beforeEach(() => {
+  notify = spyOn(preflightAlerts, "notifyAutomationPreflightFailure").mockResolvedValue(undefined);
+});
+
+afterEach(() => {
+  notify.mockRestore();
+  setSystemTime();
+});
 
 async function removeDbFiles(): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {
@@ -617,6 +638,10 @@ describe("dispatchScheduleTarget — automation preflight", () => {
 
     await executeSchedule(schedule);
     const first = (await getScheduledTaskById(schedule.id))!;
+    expect(notify).toHaveBeenCalledTimes(1);
+    expect(notify).toHaveBeenCalledWith(
+      expect.objectContaining({ kind: "schedule", name: schedule.name, state: "needs_setup" }),
+    );
     await executeSchedule(first);
     const second = (await getScheduledTaskById(schedule.id))!;
     const after = await getDbClient().get<{ count: number }>(
@@ -624,6 +649,7 @@ describe("dispatchScheduleTarget — automation preflight", () => {
     );
 
     expect(after?.count).toBe(before?.count);
+    expect(notify).toHaveBeenCalledTimes(1);
     expect(second.lastErrorAt).toBe(first.lastErrorAt);
     expect(second.lastErrorMessage).toBe("needs_setup: params=[REPO_URL] integrations=[]");
     expect(second.consecutiveErrors).toBe(0);
@@ -632,6 +658,27 @@ describe("dispatchScheduleTarget — automation preflight", () => {
     expect(new Date(second.nextRunAt!).getTime()).toBeGreaterThan(Date.now());
   });
 
+  test("alerts once for concurrent schedule refusals and again after UTC midnight", async () => {
+    setSystemTime(new Date("2026-09-14T23:59:59Z"));
+    const schedule = await createScheduledTask({
+      name: `dispatch-daily-alert-${crypto.randomUUID()}`,
+      intervalMs: 60_000,
+      taskTemplate: "Review {{REPO_URL}}",
+      requiredParams: ["REPO_URL"],
+    });
+
+    const refusals = await Promise.allSettled([
+      dispatchScheduleTarget(schedule),
+      dispatchScheduleTarget(schedule),
+    ]);
+    expect(refusals.every((result) => result.status === "rejected")).toBe(true);
+    expect(notify).toHaveBeenCalledTimes(1);
+
+    setSystemTime(new Date("2026-09-15T00:00:00Z"));
+    await expect(dispatchScheduleTarget(schedule)).rejects.toThrow("needs_setup:");
+    expect(notify).toHaveBeenCalledTimes(2);
+  });
+
   test("advances a cron schedule while its required timezone is still unset", async () => {
     const schedule = await createScheduledTask({
       name: `dispatch-needs-timezone-${crypto.randomUUID()}`,

package/src/tests/scheduled-task-required-params-migration.test.ts

@@ -0,0 +1,182 @@
+import { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { type AutomationSetupStates, preflightAutomation } from "../be/automation-preflight";
+import { runMigrations } from "../be/migrations/runner";
+import type { AutomationIntegrationId } from "../types";
+
+const original = await Bun.file(
+  new URL("../be/migrations/141_scheduled_task_automation_preflight.sql", import.meta.url),
+).text();
+const repair = await Bun.file(
+  new URL("../be/migrations/151_repair_scheduled_task_required_params.sql", import.meta.url),
+).text();
+
+const canonicalNames = [
+  "daily-blocker-digest",
+  "daily-compounding-reflection",
+  "daily-status-report",
+  "daily-workflow-health-audit",
+  "weekly-harness-upgrade-check",
+  "weekly-dependabot-triage",
+  "weekly-code-health-reports",
+  "weekly-dora-metrics",
+  "daily-hn-briefing",
+  "gtm-weekly-review",
+  "dream-daily",
+];
+
+interface ScheduleRow {
+  name: string;
+  taskTemplate: string | null;
+  timezone: string;
+  enabled: number;
+  params: string;
+  requiredParams: string;
+  requires: string;
+}
+
+const setup: AutomationSetupStates = {
+  slack: "verified",
+  github: "verified",
+  linear: "verified",
+  jira: "verified",
+  gsc: "verified",
+  agentmail: "verified",
+  agentfs: "verified",
+};
+
+function preflight(row: ScheduleRow) {
+  return preflightAutomation(
+    {
+      id: row.name,
+      name: row.name,
+      kind: "schedule",
+      params: JSON.parse(row.params),
+      requiredParams: JSON.parse(row.requiredParams),
+      requires: JSON.parse(row.requires) as AutomationIntegrationId[],
+    },
+    setup,
+  );
+}
+
+describe("scheduled task required params repair", () => {
+  let db: Database;
+
+  beforeEach(() => {
+    db = new Database(":memory:");
+    // Only the pre-141 columns consumed by the two data migrations.
+    db.exec(`CREATE TABLE scheduled_tasks (
+      name TEXT PRIMARY KEY, taskTemplate TEXT, timezone TEXT NOT NULL DEFAULT 'UTC',
+      enabled INTEGER NOT NULL DEFAULT 1
+    )`);
+  });
+
+  afterEach(() => db.close());
+
+  function insert(name: string, taskTemplate: string | null) {
+    db.run("INSERT INTO scheduled_tasks (name, taskTemplate) VALUES (?, ?)", [name, taskTemplate]);
+  }
+
+  function rows() {
+    return db.query<ScheduleRow, []>("SELECT * FROM scheduled_tasks ORDER BY name").all();
+  }
+
+  test("repairs concretized legacy schedules after 141 and is idempotent", () => {
+    for (const name of canonicalNames) {
+      insert(name, "Run the configured report for example/project and send it to ops@example.org.");
+    }
+    db.exec(original);
+    const before = rows();
+    expect(before.filter((row) => preflight(row).state === "needs_setup")).toHaveLength(6);
+    expect(before.find((row) => row.name === "weekly-dependabot-triage")?.timezone).toBe(
+      "{{TIMEZONE}}",
+    );
+
+    db.exec(repair);
+    expect(rows()).toEqual(
+      before.map((row) => ({ ...row, requiredParams: "[]", timezone: "UTC" })),
+    );
+    for (const row of rows()) expect(preflight(row).state).toBe("running");
+
+    const repaired = rows();
+    db.exec(repair);
+    expect(rows()).toEqual(repaired);
+  });
+
+  test("keeps every requirement on genuinely tokenized fresh templates", async () => {
+    for (const name of canonicalNames.filter((name) => name !== "dream-daily")) {
+      const template = new URL(`../../templates/schedules/${name}/content.md`, import.meta.url);
+      insert(name, await Bun.file(template).text());
+    }
+    db.exec(original);
+    const before = rows();
+
+    db.exec(repair);
+    expect(rows()).toEqual(before.map((row) => ({ ...row, timezone: "UTC" })));
+    expect(rows().map((row) => preflight(row).missing)).toEqual(
+      before.map((row) => preflight(row).missing),
+    );
+  });
+
+  test("keeps referenced keys in order and checks exact case-sensitive tokens", () => {
+    insert(
+      "weekly-code-health-reports",
+      "Report {{PAGE_ID}} for {{REPO_URL}}; {{BRANCH_SUFFIX}}, {{scope_path}}, REPORT_NAME",
+    );
+    db.exec(original);
+    db.exec(repair);
+    expect(rows()[0]?.requiredParams).toBe('["REPO_URL","PAGE_ID"]');
+  });
+
+  test("keeps timezone-only requirements when TIMEZONE has a binding", () => {
+    insert("weekly-dependabot-triage", null);
+    db.exec(original);
+    db.run("UPDATE scheduled_tasks SET params = ?", ['{"TIMEZONE":"Europe/Paris"}']);
+    db.exec(repair);
+    expect(rows()[0]).toMatchObject({
+      taskTemplate: null,
+      timezone: "{{TIMEZONE}}",
+      requiredParams: '["TIMEZONE"]',
+      params: '{"TIMEZONE":"Europe/Paris"}',
+      requires: '["github","slack"]',
+    });
+    expect(preflight(rows()[0]!).state).toBe("running");
+  });
+
+  test("restores an unbound timezone and removes unused requirements with a null body", () => {
+    insert("weekly-dependabot-triage", null);
+    db.exec(original);
+    db.run("UPDATE scheduled_tasks SET params = ?", ['{"TIMEZONE":null}']);
+    db.exec(repair);
+    expect(rows()[0]).toMatchObject({ timezone: "UTC", requiredParams: "[]" });
+  });
+
+  test("leaves manual repairs and schedules outside 141 unchanged", () => {
+    insert("weekly-dependabot-triage", "Review {{REPO_URL}}.");
+    insert("custom-schedule", null);
+    db.exec(original);
+    db.exec(`UPDATE scheduled_tasks SET
+      timezone = 'America/New_York', requiredParams = '[ "REPO_URL" ]',
+      params = '{"REPO_URL":"example/project"}', enabled = 0
+      WHERE name = 'weekly-dependabot-triage'`);
+    db.exec(`UPDATE scheduled_tasks SET
+      timezone = '{{TIMEZONE}}', requiredParams = '["TIMEZONE","CUSTOM"]'
+      WHERE name = 'custom-schedule'`);
+    const before = rows();
+    db.exec(repair);
+    expect(rows()).toEqual(before);
+  });
+});
+
+test("the migration runner applies the repair on a fresh database", () => {
+  const db = new Database(":memory:");
+  try {
+    runMigrations(db);
+    const applied = db.query("SELECT * FROM _migrations WHERE version = 151").get();
+    expect(applied).toMatchObject({ name: "151_repair_scheduled_task_required_params" });
+    runMigrations(db);
+    expect(db.query("SELECT * FROM _migrations WHERE version = 151").get()).toEqual(applied);
+  } finally {
+    db.close();
+  }
+});

package/src/tests/scheduled-tasks.test.ts

@@ -399,12 +399,13 @@ describe("Scheduled Tasks Integration", () => {
 
       // Find the created task
       const createdTask = (await getDbClient().get(
-        "SELECT * FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
+        "SELECT *, routing_reason AS routingReason FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
         [schedule.taskTemplate!],
-      )) as { agentId: string; status: string };
+      )) as { agentId: string; routingReason: string; status: string };
 
       expect(createdTask).toBeDefined();
       expect(createdTask.agentId).toBe(targetAgent.id);
+      expect(createdTask.routingReason).toBe("human_pinned");
       expect(createdTask.status).toBe("pending"); // Should be pending when assigned to agent
     });
 
@@ -420,12 +421,13 @@ describe("Scheduled Tasks Integration", () => {
 
       // Find the created task
       const createdTask = (await getDbClient().get(
-        "SELECT * FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
+        "SELECT *, routing_reason AS routingReason FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
         [schedule.taskTemplate!],
-      )) as { agentId: string | null; status: string };
+      )) as { agentId: string | null; routingReason: string | null; status: string };
 
       expect(createdTask).toBeDefined();
       expect(createdTask.agentId).toBeNull();
+      expect(createdTask.routingReason).toBeNull();
       expect(createdTask.status).toBe("unassigned");
     });
 
@@ -529,7 +531,7 @@ describe("Scheduled Tasks Integration", () => {
 
       // Find the created task
       const createdTask = (await getDbClient().get(
-        "SELECT * FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
+        "SELECT *, routing_reason AS routingReason FROM agent_tasks WHERE task = ? ORDER BY createdAt DESC LIMIT 1",
         [schedule.taskTemplate!],
       )) as {
         task: string;
@@ -537,6 +539,7 @@ describe("Scheduled Tasks Integration", () => {
         tags: string;
         priority: number;
         agentId: string;
+        routingReason: string;
         creatorAgentId: string;
       };
 
@@ -544,6 +547,7 @@ describe("Scheduled Tasks Integration", () => {
       expect(createdTask.taskType).toBe("comprehensive");
       expect(createdTask.priority).toBe(90);
       expect(createdTask.agentId).toBe(testAgent.id);
+      expect(createdTask.routingReason).toBe("human_pinned");
       expect(createdTask.creatorAgentId).toBe(testAgent.id);
 
       const tags = JSON.parse(createdTask.tags);

package/src/tests/script-connections.test.ts

@@ -566,6 +566,10 @@ describe("script connections", () => {
       markMigrationApplied(database, "147_scheduled_tasks_parent_task.sql");
       // 148 rebuilds pages, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "148_pages_svg.sql");
+      // 151 repairs scheduled_tasks, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "151_repair_scheduled_task_required_params.sql");
+      // 152 indexes task routing context absent from this migration-112-only fixture.
+      markMigrationApplied(database, "152_routing_decisions.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-runs-http.test.ts

@@ -401,6 +401,37 @@ describe("/api/script-runs HTTP", () => {
     expect(stepCount.c).toBe(1);
   });
 
+  test("agent-task dispatch preserves existing author pins and records human_pinned", async () => {
+    const created = await dispatch("/api/script-runs", {
+      method: "POST",
+      agentId,
+      body: createBody(),
+    });
+    const { id: runId } = (await created.json()) as { id: string };
+
+    const responsePromise = dispatch(`/api/internal/script-runs/${runId}/agent-task`, {
+      method: "POST",
+      agentId,
+      body: JSON.stringify({ stepKey: "pinned", task: "do pinned work", agentId }),
+    });
+
+    let dispatched = await getLatestScriptRunStepTaskByContextKey(`script-run:${runId}:pinned`);
+    for (let i = 0; i < 50 && !dispatched; i++) {
+      await Bun.sleep(20);
+      dispatched = await getLatestScriptRunStepTaskByContextKey(`script-run:${runId}:pinned`);
+    }
+    expect(dispatched).not.toBeNull();
+    await completeTask(dispatched!.id, "done");
+    const response = await responsePromise;
+    expect(response.status).toBe(200);
+    const { taskId } = (await response.json()) as { taskId: string };
+    expect(
+      await getDbClient().get("SELECT agentId, routing_reason FROM agent_tasks WHERE id = ?", [
+        taskId,
+      ]),
+    ).toEqual({ agentId, routing_reason: "human_pinned" });
+  });
+
   test("agent-task polling returns the step output when a newer completed follow-up shares its context key", async () => {
     const created = await dispatch("/api/script-runs", {
       method: "POST",

package/src/tests/scripts-typecheck.test.ts

@@ -47,6 +47,17 @@ afterAll(async () => {
 });
 
 describe("typecheckScript", () => {
+  test("task_defer accepts task wakeOn with a required caller-supplied ceiling", async () => {
+    const result = await typecheckScript(`
+      import type { ScriptContext } from "swarm-sdk";
+      export default async function(args: unknown, ctx: ScriptContext) {
+        return ctx.swarm.task_defer({ taskId: "parent", delayMs: 60000,
+          wakeOn: { event: "settled", taskId: "producer" }, summary: "submitted", note: "check result" });
+      }
+    `);
+    expect(result).toEqual({ ok: true });
+  });
+
   test("accepts ES2022 globals: JSON, Math, Date, Number, String, Error, isFinite, encodeURIComponent, parseInt, parseFloat", async () => {
     const source = `
       export default async () => {

package/src/tests/secret-scrubber.test.ts

@@ -28,6 +28,18 @@ afterEach(() => {
 });
 
 describe("scrubSecrets — edge cases", () => {
+  test("redacts ACP session tokens in plain text and escaped session logs", () => {
+    const token = `aseph_${"aB3".repeat(11)}`;
+    const github = `ghp_${"gH4".repeat(12)}`;
+    for (const prefix of ["Bearer ", "\\n", "\\t", '"']) {
+      const input = `${prefix}${token} tail ${github}`;
+      const output = scrubSecrets(input);
+      expect(output).not.toContain(github);
+      expect(output).toBe(`${prefix}[REDACTED:acp_session_token] tail [REDACTED:github_token]`);
+      expect(scrubObject({ output: input })).toEqual({ output });
+    }
+  });
+
   test("empty string passes through", () => {
     expect(scrubSecrets("")).toBe("");
   });

package/src/tests/send-task-output-schema.test.ts

@@ -2,7 +2,14 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { closeDb, createAgent, createUser, getTaskById, initDb } from "../be/db";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  createUser,
+  getTaskById,
+  initDb,
+} from "../be/db";
 import { createUserServer, userSendTaskInputSchema } from "../server-user";
 import { registerSendTaskTool, sendTaskInputSchema } from "../tools/send-task";
 
@@ -160,6 +167,7 @@ describe("send-task: outputSchema propagation", () => {
     expect(s.success).toBe(true);
     const created = await getTaskById(s.task!.id);
     expect(created?.outputSchema).toEqual(schema);
+    expect(created?.routingReason).toBeUndefined();
   });
 
   test("a provided outputSchema is persisted when the task is offered to an agent", async () => {
@@ -175,6 +183,7 @@ describe("send-task: outputSchema propagation", () => {
       {
         task: "offered task with a schema",
         agentId: worker.id,
+        routingReason: "human_pinned",
         offerMode: true,
         outputSchema: schema,
         allowDuplicate: true,
@@ -204,6 +213,7 @@ describe("send-task: outputSchema propagation", () => {
       {
         task: "directly assigned task with a schema",
         agentId: worker.id,
+        routingReason: "human_pinned",
         outputSchema: schema,
         allowDuplicate: true,
       },
@@ -213,6 +223,61 @@ describe("send-task: outputSchema propagation", () => {
     expect(s.success).toBe(true);
     const created = await getTaskById(s.task!.id);
     expect(created?.outputSchema).toEqual(schema);
+    expect(created?.routingReason).toBe("human_pinned");
+  });
+
+  test("implicit parent routing stamps continuity while pool creation omits a reason", async () => {
+    const worker = await createAgent({
+      name: "Continuity worker",
+      isLead: false,
+      status: "idle",
+      maxTasks: 2,
+    });
+    const parent = await createTaskExtended("continuity parent", {
+      agentId: worker.id,
+      routingReason: "human_pinned",
+    });
+    const continued = await callSendTask(
+      server,
+      {
+        task: "continue implicitly",
+        parentTaskId: parent.id,
+        allowDuplicate: true,
+      },
+      LEAD_ID,
+    );
+    const continuedTask = await getTaskById(structuredOf(continued).task!.id);
+    expect(continuedTask?.agentId).toBe(worker.id);
+    expect(continuedTask?.routingReason).toBe("continuity");
+
+    const pooled = await callSendTask(
+      server,
+      { task: "stay pooled", allowDuplicate: true },
+      LEAD_ID,
+    );
+    expect((await getTaskById(structuredOf(pooled).task!.id))?.routingReason).toBeUndefined();
+  });
+
+  test("direct routing note is persisted", async () => {
+    const worker = await createAgent({
+      name: "Noted worker",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+    });
+    const result = await callSendTask(
+      server,
+      {
+        task: "direct task with routing note",
+        agentId: worker.id,
+        routingReason: "skill",
+        routingNote: "matches the required runtime specialization",
+        allowDuplicate: true,
+      },
+      LEAD_ID,
+    );
+    const created = await getTaskById(structuredOf(result).task!.id);
+    expect(created?.routingNote).toBe("matches the required runtime specialization");
   });
 });
 

package/src/tests/send-task-requested-by.test.ts

@@ -151,6 +151,7 @@ describe("send-task: requestedByUserId inheritance", () => {
       {
         task: "worker direct assign — inherit user",
         agentId: WORKER_ID,
+        routingReason: "human_pinned",
         allowDuplicate: true,
       },
       LEAD_ID,

package/src/tests/send-task-slack-routing-guard.test.ts

@@ -275,6 +275,7 @@ describe("send-task: Slack-routing coherence guard", () => {
       {
         task: "direct assign with wrong channel",
         agentId: WORKER_ID,
+        routingReason: "human_pinned",
         slackChannelId: "C_WRONG_DIRECT",
         slackThreadTs: "555.555",
         allowDuplicate: true,
@@ -299,6 +300,7 @@ describe("send-task: Slack-routing coherence guard", () => {
       {
         task: "offer with wrong channel",
         agentId: WORKER_ID,
+        routingReason: "human_pinned",
         offerMode: true,
         slackChannelId: "C_WRONG_OFFER",
         slackThreadTs: "666.666",