@desplega.ai/agent-swarm 1.149.0 → 1.150.0

package/src/tests/status.test.ts

@@ -245,13 +245,13 @@ describe("setup milestones", () => {
       hint: "Memory search is off. Set OPENAI_API_KEY (or EMBEDDING_API_KEY) on the API server to enable it; it is cheap.",
     });
 
-    process.env.OPENAI_API_KEY = "openai-embedding-key";
+    process.env.OPENAI_API_KEY = "example-openai-embedding-key";
     expect(getMilestone(await buildStatusPayload(), "embeddings").state).toBe("configured");
 
     process.env.EMBEDDING_API_KEY = "";
     expect(getMilestone(await buildStatusPayload(), "embeddings").state).toBe("unverified");
 
-    process.env.EMBEDDING_API_KEY = "dedicated-embedding-key";
+    process.env.EMBEDDING_API_KEY = "example-dedicated-embedding-key";
     delete process.env.OPENAI_API_KEY;
     expect(getMilestone(await buildStatusPayload(), "embeddings").state).toBe("configured");
   });
@@ -417,7 +417,7 @@ describe("setup milestones", () => {
     const a = await buildStatusPayload();
     expect(getMilestone(a, "github").state).toBe("unverified");
 
-    process.env.GITHUB_APP_PRIVATE_KEY = "-----BEGIN PRIVATE KEY-----\n...";
+    process.env.GITHUB_APP_PRIVATE_KEY = "[REDACTED:github_app_private_key]";
     const b = await buildStatusPayload();
     expect(getMilestone(b, "github").state).toBe("verified");
   });
@@ -456,7 +456,7 @@ describe("setup milestones", () => {
       scopes: "read",
     });
     await storeOAuthTokens("linear", {
-      accessToken: "lin-tok-xyz",
+      accessToken: "example-lin-tok-xyz",
       refreshToken: "ref",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
       scope: "read",
@@ -475,7 +475,7 @@ describe("setup milestones", () => {
       // metadata intentionally omitted on first upsert
     });
     await storeOAuthTokens("jira", {
-      accessToken: "jira-tok",
+      accessToken: "example-jira-tok",
       refreshToken: null,
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
       scope: null,
@@ -831,7 +831,7 @@ describe("validateProviderCredentials — error scrubbing", () => {
   });
 
   test("devin hits v3/self (not the deprecated v1 endpoint) and passes on 2xx", async () => {
-    process.env.DEVIN_API_KEY = "cog_fake-devin-key-1234";
+    process.env.DEVIN_API_KEY = "example-cog_fake-devin-key-1234";
     let capturedUrl = "";
     globalThis.fetch = (async (url) => {
       capturedUrl = String(url);
@@ -851,7 +851,7 @@ describe("validateProviderCredentials — error scrubbing", () => {
   });
 
   test("scrubs api key from error message on 401 response", async () => {
-    const fakeKey = "sk-ant-fakekey-DO-NOT-LEAK-1234567890abcdef";
+    const fakeKey = "example-anthropic-key-do-not-leak";
     process.env.ANTHROPIC_API_KEY = fakeKey;
     globalThis.fetch = (async () =>
       new Response(`Unauthorized: invalid key ${fakeKey}`, {

package/src/tests/steering-core.test.ts

@@ -413,7 +413,7 @@ describe("task steering core", () => {
 
   test("scrubs secrets before persisting the steering body", async () => {
     const previous = process.env.OPENAI_API_KEY;
-    const secret = "sk-proj-steering-secret-value-1234567890";
+    const secret = "example-steering-secret-value";
     process.env.OPENAI_API_KEY = secret;
     try {
       const task = await runningTask("pi", "secret scrubbing");

package/src/tests/steering-transport.test.ts

@@ -233,7 +233,7 @@ describe("steering worker transport", () => {
 
   test("scrubs provider errors before reporting an undeliverable reason", async () => {
     const pending = pendingMessage();
-    const secret = "sk-proj-steering-transport-secret-1234567890";
+    const secret = `sk-proj-${"steering".repeat(4)}`;
     let reportedBody = "";
     const fetchImpl = (async (input: string | URL | Request, init?: RequestInit) => {
       if (String(input).includes("/api/steering-messages?")) {
@@ -280,7 +280,7 @@ describe("steering worker transport", () => {
     expect(requested.outcome).toBe("queued");
 
     await pollAndDispatchSteering(
-      { apiUrl: baseUrl, apiKey: "test-key", agentId: agent.id },
+      { apiUrl: baseUrl, apiKey: "example-test-key", agentId: agent.id },
       task.id,
       session(),
       createSteeringDispatchState(),
@@ -327,7 +327,7 @@ describe("steering worker transport", () => {
     // undeliverable — but the external-delivery flag short-circuits the poll.
     const codexLikeSession = { ...session(), steeringDeliveredExternally: true };
     await pollAndDispatchSteering(
-      { apiUrl: baseUrl, apiKey: "test-key", agentId: agent.id },
+      { apiUrl: baseUrl, apiKey: "example-test-key", agentId: agent.id },
       task.id,
       codexLikeSession,
       createSteeringDispatchState(),
@@ -343,7 +343,7 @@ describe("steering worker transport", () => {
     const previousBaseUrl = process.env.MCP_BASE_URL;
     const previousApiKey = process.env.AGENT_SWARM_API_KEY;
     process.env.MCP_BASE_URL = baseUrl;
-    process.env.AGENT_SWARM_API_KEY = "test-key";
+    process.env.AGENT_SWARM_API_KEY = "example-test-key";
     try {
       const agent = await createAgent({
         name: "accept steering worker",

package/src/tests/store-progress-output-guidance.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type * as z from "zod";
+import { registerStoreProgressTool } from "../tools/store-progress";
+
+describe("store-progress output guidance", () => {
+  const server = new McpServer({ name: "output-guidance-test", version: "1.0.0" });
+  registerStoreProgressTool(server);
+  const tools = (
+    server as unknown as {
+      _registeredTools: Record<string, { inputSchema: z.ZodObject }>;
+    }
+  )._registeredTools;
+  const outputSchema = tools["store-progress"].inputSchema.shape.output;
+
+  test("the exposed output field carries the same budget and exceptions as the prompts", () => {
+    expect(outputSchema.description).toContain("Keep free-text output under 120 words by default");
+    expect(outputSchema.description).toContain("published verbatim in the thread's outcome card");
+    expect(outputSchema.description).toContain("every artifact link");
+    expect(outputSchema.description).toContain("Link documents instead of inlining them");
+    expect(outputSchema.description).toContain(
+      "requested depth, enumerated results, essential evidence",
+    );
+    expect(outputSchema.description).toContain("the task's outputSchema requires longer output");
+    expect(outputSchema.description).toContain("output must be JSON matching it");
+  });
+
+  test("the style target does not reject longer requested or schema-constrained output", () => {
+    const longResult = "Required result. ".repeat(150);
+    for (const output of [longResult, JSON.stringify({ results: [longResult] })]) {
+      expect(outputSchema.parse(output)).toBe(output);
+    }
+  });
+});

package/src/tests/swarm-tool-result-gate.test.ts

@@ -111,38 +111,38 @@ describe("finalizeSwarmToolResult", () => {
   });
 
   test("secrets are scrubbed from message, details, and data at the egress point", async () => {
-    registerVolatileSecret("sk-super-secret-token-123", "TEST_TOKEN");
+    registerVolatileSecret("example-sk-super-secret-token-123", "TEST_TOKEN");
     try {
       const result = await finalizeSwarmToolResult("some-tool", {
         ok: false,
-        message: "Auth failed with sk-super-secret-token-123",
-        details: "header was sk-super-secret-token-123",
-        data: { token: "sk-super-secret-token-123" },
+        message: "Auth failed with example-sk-super-secret-token-123",
+        details: "header was example-sk-super-secret-token-123",
+        data: { token: "example-sk-super-secret-token-123" },
       });
       const serialized = JSON.stringify(result);
-      expect(serialized).not.toContain("sk-super-secret-token-123");
+      expect(serialized).not.toContain("example-sk-super-secret-token-123");
     } finally {
       clearVolatileSecretsForTesting();
     }
   });
 
   test("allowSecretEgress skips scrubbing for deliberate credential reveals only", async () => {
-    registerVolatileSecret("xsk_reveal_me_once_456", "TEST_REVEAL");
+    registerVolatileSecret("example-xsk_reveal_me_once_456", "TEST_REVEAL");
     try {
       const revealed = await finalizeSwarmToolResult("script-apis", {
         ok: true,
         message: "Endpoint created.",
-        details: "Bearer token (shown once — save it now): xsk_reveal_me_once_456",
-        data: { token: "xsk_reveal_me_once_456" },
+        details: "Bearer token (shown once — save it now): example-xsk_reveal_me_once_456",
+        data: { token: "example-xsk_reveal_me_once_456" },
         allowSecretEgress: true,
       });
-      expect(JSON.stringify(revealed)).toContain("xsk_reveal_me_once_456");
+      expect(JSON.stringify(revealed)).toContain("example-xsk_reveal_me_once_456");
 
       const scrubbed = await finalizeSwarmToolResult("some-tool", {
         ok: true,
-        message: "leaky xsk_reveal_me_once_456",
+        message: "leaky example-xsk_reveal_me_once_456",
       });
-      expect(JSON.stringify(scrubbed)).not.toContain("xsk_reveal_me_once_456");
+      expect(JSON.stringify(scrubbed)).not.toContain("example-xsk_reveal_me_once_456");
     } finally {
       clearVolatileSecretsForTesting();
     }

package/src/tests/swarm-x-tool.test.ts

@@ -36,12 +36,14 @@ afterEach(() => {
 
 describe("swarm_x MCP tool", () => {
   test("routes composio requests with server-side auth and scrubbed output", async () => {
-    process.env.COMPOSIO_API_KEY = "ck_tool_secret_value";
+    process.env.COMPOSIO_API_KEY = "example-ck_tool_secret_value";
     const fetchMock = mock(async (url: string | URL | Request, init?: RequestInit) => {
       expect(String(url)).toBe("https://backend.composio.dev/api/v3.1/tools?limit=1");
       expect(init?.method).toBe("GET");
-      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("ck_tool_secret_value");
-      return jsonResponse({ ok: true, token: "ck_tool_secret_value" });
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe(
+        "example-ck_tool_secret_value",
+      );
+      return jsonResponse({ ok: true, token: "example-ck_tool_secret_value" });
     });
     globalThis.fetch = fetchMock;
 
@@ -65,11 +67,11 @@ describe("swarm_x MCP tool", () => {
     expect(JSON.stringify(result.structuredContent.response)).toContain(
       "[REDACTED:COMPOSIO_API_KEY]",
     );
-    expect(result.structuredContent.responseText).not.toContain("ck_tool_secret_value");
+    expect(result.structuredContent.responseText).not.toContain("example-ck_tool_secret_value");
   });
 
   test("rejects absolute composio paths", async () => {
-    process.env.COMPOSIO_API_KEY = "ck_tool_secret_value";
+    process.env.COMPOSIO_API_KEY = "example-ck_tool_secret_value";
     const fetchMock = mock(async () => jsonResponse({ ok: true }));
     globalThis.fetch = fetchMock;
 

package/src/tests/sync-ai-toolbox-skills.test.ts

@@ -10,6 +10,7 @@ import {
   type Manifest,
   type PathRewrite,
   parseSkillMd,
+  rewriteBundledFileComments,
   rewriteSkillReferences,
   sanitizeSyncedVia,
   stableJson,
@@ -215,6 +216,24 @@ describe("ai-toolbox skill sync pure transforms", () => {
     ).toThrow("exceed 10485760 bytes total");
   });
 
+  test("clarifies only the Codex helper comment and preserves executable sandbox settings", () => {
+    const comment =
+      "#   CODEX_SANDBOX default: workspace-write      read-only | workspace-write | danger-full-access";
+    const executable = `SANDBOX="\${CODEX_SANDBOX:-workspace-write}"\nargs+=( --dangerously-bypass-approvals-and-sandbox )\n`;
+    const source = `${comment}\n${executable}`;
+    expect(rewriteBundledFileComments("delegate-work", "scripts/codex-exec.sh", source)).toBe(
+      `#   CODEX_SANDBOX default: workspace-write (passed to codex's -s option)\n${executable}`,
+    );
+    expect(rewriteBundledFileComments("other", "scripts/codex-exec.sh", source)).toBe(source);
+    expect(rewriteBundledFileComments("delegate-work", "scripts/other.sh", source)).toBe(source);
+    expect(() =>
+      rewriteBundledFileComments("delegate-work", "scripts/codex-exec.sh", executable),
+    ).toThrow("expected one upstream sandbox default comment");
+    expect(() =>
+      rewriteBundledFileComments("delegate-work", "scripts/codex-exec.sh", `${comment}\n${source}`),
+    ).toThrow("expected one upstream sandbox default comment");
+  });
+
   test("reports executable text downgrades and rejects binary files", () => {
     const executable = validateBundledFileBytes(
       "fixture",

package/src/tests/task-supersede-resume.test.ts

@@ -645,7 +645,7 @@ describe("Task Supersede + Resume", () => {
     test("scrubs secret-shaped values from session-log summaries", async () => {
       // GitHub PAT-shaped token — matches a structural pattern in
       // scrubSecrets (regardless of env state).
-      const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+      const fakeToken = `ghp_${"a".repeat(36)}`;
       mockSessionLogs = [
         {
           createdAt: new Date().toISOString(),

package/src/tests/task-tools-ctx.test.ts

@@ -86,6 +86,7 @@ describe("task tool ctx", () => {
       task: "ordinary direct assignment",
       agentId: lead.id,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       offerMode: false,
       allowDuplicate: false,
     });
@@ -108,6 +109,7 @@ describe("task tool ctx", () => {
       task: "ordinary offer",
       agentId: lead.id,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       offerMode: true,
       allowDuplicate: false,
     });

package/src/tests/tasks-requested-by-filter.test.ts

@@ -101,8 +101,8 @@ describe("getAllTasks / getTasksCount requestedByUserId filter", () => {
 // `GET /api/tasks` handler actually translates the `?requestedByUserId=none`
 // sentinel into `requestedByUserIdIsNull`, or that the omitted-param path
 // stays backwards compatible.
-const ROUTE_TEST_DB_PATH = "./test-tasks-requested-by-filter-route.sqlite";
-const ROUTE_API_KEY = "test-tasks-requested-by-filter-route";
+const ROUTE_TEST_DB_PATH = "./example-test-tasks-requested-by-filter-route.sqlite";
+const ROUTE_API_KEY = "example-test-tasks-requested-by-filter-route";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/telemetry-init.test.ts

@@ -204,6 +204,14 @@ describe("initTelemetry", () => {
       const metadata = (captured as { metadata: Record<string, unknown> }).metadata;
       expect(metadata.organization_id).toBeUndefined();
       expect(metadata.organization_name).toBeUndefined();
+
+      // Dashboard config reloads update the env after telemetry initialized.
+      process.env.SWARM_ORG_NAME = "  Acme Engineering  ";
+      track({ event: "test.event", properties: {} });
+      await new Promise((r) => setTimeout(r, 0));
+      expect((captured as { metadata: Record<string, unknown> }).metadata.organization_name).toBe(
+        "Acme Engineering",
+      );
     });
 
     test("includes organization_id + organization_name when SWARM_ORG_* set", async () => {
@@ -756,11 +764,11 @@ describe("initTelemetry", () => {
 
   describe("_hasEmbeddingKey", () => {
     test("true when EMBEDDING_API_KEY is set", () => {
-      expect(_hasEmbeddingKey({ EMBEDDING_API_KEY: "sk-embed" })).toBe(true);
+      expect(_hasEmbeddingKey({ EMBEDDING_API_KEY: "example-sk-embed" })).toBe(true);
     });
 
     test("true when OPENAI_API_KEY is set", () => {
-      expect(_hasEmbeddingKey({ OPENAI_API_KEY: "sk-openai" })).toBe(true);
+      expect(_hasEmbeddingKey({ OPENAI_API_KEY: "example-sk-openai" })).toBe(true);
     });
 
     test("false when neither is set (onboard wizard only writes ANTHROPIC_API_KEY)", () => {
@@ -941,7 +949,7 @@ describe("initTelemetry", () => {
     });
 
     test("channels + embedding key all present", async () => {
-      process.env.EMBEDDING_API_KEY = "sk-embed";
+      process.env.EMBEDDING_API_KEY = "example-sk-embed";
       process.env.SLACK_BOT_TOKEN = "xoxb-1";
       process.env.SLACK_APP_TOKEN = "xapp-1";
       process.env.AGENTMAIL_WEBHOOK_SECRET = "whsec_1";

package/src/tests/tool-output-agent-id.test.ts

@@ -165,6 +165,7 @@ describe("agent-id fields accept non-UUID agent ids", () => {
     const parsed = sendTaskInputSchema.parse({
       agentId: SLUG_WORKER_ID,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       task: "do the thing",
     });
     expect(parsed.agentId).toBe(SLUG_WORKER_ID);

package/src/tests/tracker-fold.test.ts

@@ -154,7 +154,7 @@ beforeAll(async () => {
           expires_in: 3600,
           scope: "read write",
         };
-        if (includeRefreshToken) body.refresh_token = "rotated-refresh-token";
+        if (includeRefreshToken) body.refresh_token = "example-rotated-refresh-token";
         return Response.json(body);
       }
       return new Response("not found", { status: 404 });
@@ -227,7 +227,7 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     // possible since the carve-out removal made the linear row user-manageable.
     await upsertOAuthApp("linear", {
       clientId: "pre-existing",
-      clientSecret: "pre-existing-secret",
+      clientSecret: "example-pre-existing-secret",
       authorizeUrl: "https://linear.app/oauth/authorize",
       tokenUrl: "https://api.linear.app/oauth/token",
       redirectUri: `${appBase}/api/trackers/linear/callback`,
@@ -345,8 +345,8 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     const authorization = await upsertAuthorization({
       appId,
       label: "default",
-      accessToken: "stale-access",
-      refreshToken: "old-refresh",
+      accessToken: "example-stale-access",
+      refreshToken: "example-old-refresh",
       expiresAt: new Date(Date.now() - 60_000).toISOString(),
       status: "active",
     });
@@ -366,7 +366,7 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
       body: JSON.stringify({
         provider: "linear",
         clientId: "generic-linear-client",
-        clientSecret: "generic-linear-secret",
+        clientSecret: "example-generic-linear-secret",
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenUrl: "https://api.linear.app/oauth/token",
         scopes: ["read", "write"],
@@ -389,8 +389,8 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     const authorization = await upsertAuthorization({
       appId,
       label: "default",
-      accessToken: "initial-access",
-      refreshToken: "linear-refresh",
+      accessToken: "example-initial-access",
+      refreshToken: "example-linear-refresh",
       expiresAt: new Date(Date.now() - 60_000).toISOString(),
       status: "active",
     });

package/src/tests/tracker-tools.test.ts

@@ -34,7 +34,7 @@ describe("tracker-status (DB layer)", () => {
   test("returns token info after storing tokens", async () => {
     await upsertOAuthApp("linear", {
       clientId: "test-client",
-      clientSecret: "test-secret",
+      clientSecret: "example-test-secret",
       authorizeUrl: "https://linear.app/oauth/authorize",
       tokenUrl: "https://api.linear.app/oauth/token",
       redirectUri: "http://localhost:3013/api/trackers/linear/callback",
@@ -42,8 +42,8 @@ describe("tracker-status (DB layer)", () => {
     });
 
     await storeOAuthTokens("linear", {
-      accessToken: "test-token",
-      refreshToken: "test-refresh",
+      accessToken: "example-test-token",
+      refreshToken: "example-test-refresh",
       expiresAt: new Date(Date.now() + 3600 * 1000).toISOString(),
       scope: "read,write",
     });

package/src/tests/ui-followup-lead-delegation.test.ts

@@ -169,6 +169,7 @@ describe("session-UI follow-up → Lead → onward delegation", () => {
         task: "please pick this up",
         agentId: differentWorkerId,
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         allowDuplicate: true,
       },
       leadAgentId,

package/src/tests/unified-oauth-migration.test.ts

@@ -44,7 +44,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-linear",
       provider: "linear",
       clientId: "linear-client",
-      clientSecret: "linear-client-secret",
+      clientSecret: "example-linear-client-secret",
       authorizeUrl: "https://linear.test/authorize",
       tokenUrl: "https://linear.test/token",
       redirectUri: "https://swarm.test/api/oauth/linear/callback",
@@ -60,7 +60,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-jira",
       provider: "jira",
       clientId: "jira-client",
-      clientSecret: "jira-client-secret",
+      clientSecret: "example-jira-client-secret",
       authorizeUrl: "https://jira.test/authorize",
       tokenUrl: "https://jira.test/token",
       redirectUri: "https://swarm.test/api/oauth/jira/callback",
@@ -77,7 +77,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-vendor",
       provider: "vendor",
       clientId: "vendor-client",
-      clientSecret: "vendor-client-secret",
+      clientSecret: "example-vendor-client-secret",
       authorizeUrl: "https://vendor.test/authorize",
       tokenUrl: "https://vendor.test/token",
       redirectUri: "https://swarm.test/api/oauth/vendor/callback",
@@ -422,9 +422,9 @@ describe("migration 117 unified OAuth storage", () => {
         )
         .get();
       expect(encryptedLinear?.clientSecretEncrypted).toBe(1);
-      expect(encryptedLinear?.clientSecret).not.toBe("linear-client-secret");
+      expect(encryptedLinear?.clientSecret).not.toBe("example-linear-client-secret");
       expect(decryptSecret(encryptedLinear!.clientSecret, getEncryptionKey())).toBe(
-        "linear-client-secret",
+        "example-linear-client-secret",
       );
       const encryptedAuthorization = database
         .query<{ accessToken: string; refreshToken: string | null; tokensEncrypted: number }, []>(

package/src/tests/user-token-rest-auth.test.ts

@@ -21,7 +21,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-user-token-rest-auth.sqlite";
-const API_KEY = "test-api-key";
+const API_KEY = "example-test-api-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
 
 function createTestServer(): Server {

package/src/tests/user-token-routes.test.ts

@@ -14,7 +14,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-user-token-routes.sqlite";
-const API_KEY = "test-user-token-key";
+const API_KEY = "example-test-user-token-key";
 const ORIGINAL_API_KEY = process.env.AGENT_SWARM_API_KEY;
 
 async function removeDbFiles(path: string): Promise<void> {

package/src/tests/whoami-route.test.ts

@@ -24,7 +24,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-whoami-route.sqlite";
-const API_KEY = "test-api-key";
+const API_KEY = "example-test-api-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
 
 interface WhoamiBody {

package/src/tests/workflow-agent-task.test.ts

@@ -37,7 +37,6 @@ const mockDeps: ExecutorDependencies = {
 // IDs for workflow prerequisites (set in beforeAll)
 let workflowId: string;
 let runId: string;
-let stepId1: string;
 let stepId2: string;
 
 // ─── Setup / Teardown ────────────────────────────────────────
@@ -64,14 +63,6 @@ beforeAll(async () => {
   const run = await createWorkflowRun({ id: crypto.randomUUID(), workflowId: wf.id });
   runId = run.id;
 
-  const step1 = await createWorkflowRunStep({
-    id: crypto.randomUUID(),
-    runId: run.id,
-    nodeId: "test-node-1",
-    nodeType: "agent-task",
-  });
-  stepId1 = step1.id;
-
   const step2 = await createWorkflowRunStep({
     id: crypto.randomUUID(),
     runId: run.id,
@@ -159,7 +150,10 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     expect(parsed.success).toBe(false);
   });
 
-  test("execute() creates task with workspace fields forwarded", async () => {
+  test.each([
+    undefined,
+    "skill",
+  ] as const)("execute() forwards workspace fields and routing provenance for %s", async (routingReason) => {
     const executor = new AgentTaskExecutor(mockDeps);
     const worker = await createAgent({
       name: "Pinned workflow worker",
@@ -168,15 +162,22 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     });
     const config = {
       agentId: worker.id,
+      routingReason,
       template: "List files in workspace",
       dir: "/workspace/repos/agent-swarm",
       vcsRepo: "desplega-ai/agent-swarm",
       model: "sonnet",
     };
+    const step = await createWorkflowRunStep({
+      id: crypto.randomUUID(),
+      runId,
+      nodeId: `routing-${routingReason ?? "default"}`,
+      nodeType: "agent-task",
+    });
     const meta: ExecutorMeta = {
       runId,
-      stepId: stepId1,
-      nodeId: "test-node-1",
+      stepId: step.id,
+      nodeId: step.nodeId,
       workflowId,
       dryRun: false,
     };
@@ -195,7 +196,8 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     expect(task!.modelTier).toBe("regular");
     expect(task!.source).toBe("workflow");
     expect(task!.agentId).toBe(worker.id);
-    expect(task!.routingReason).toBe("human_pinned");
+    expect(task!.routingReason).toBe(routingReason ?? "human_pinned");
+    expect(task!.routingSource).toBe(routingReason ? "declared" : "engine_default");
   });
 
   test("execute() creates task without workspace fields (backward compat)", async () => {

package/src/tests/workflow-ctx.test.ts

@@ -19,7 +19,7 @@ describe("workflow-ctx: ctx.swarm proxy tool name resolution", () => {
       const { ctx } = buildWorkflowCtx({
         runId: "test-run",
         agentId: "test-agent",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         baseUrl: "http://localhost:9999",
         args: {},
       });

package/src/tests/workflow-e2e.test.ts

@@ -26,7 +26,7 @@ import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 const spawnDescribe = describe.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-e2e.sqlite";
-const API_KEY = "test-workflow-e2e-key-1234567890";
+const API_KEY = "example-test-workflow-e2e-key-1234567890";
 
 const noOpEmbeddingProvider = {
   name: "test/noop-workflow-e2e-embedding",

package/src/tests/workflow-engine-v2.test.ts

@@ -43,6 +43,8 @@ const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-engine-v2.sqlite";
 
+const inputRef = (name: string): string => `input.${name}`;
+
 // ─── Test Executors ──────────────────────────────────────────
 
 class EchoExecutor extends BaseExecutor<typeof EchoExecutor.schema, typeof EchoExecutor.outSchema> {
@@ -1158,7 +1160,7 @@ describe("interpolateNodeConfig — script node", () => {
   test("an inputs alias pointing at workflow input is still interpolated into the script", () => {
     const node = {
       type: "script",
-      inputs: { token: "input.API_TOKEN" },
+      inputs: { token: inputRef("API_TOKEN") },
       config: { runtime: "bash", script: "curl -H 'Authorization: {{token}}' https://x" },
     };
     const ctx = { input: { API_TOKEN: "tok-123" }, token: "tok-123" };

package/src/tests/workflow-executors.test.ts

@@ -594,8 +594,8 @@ describe("ScriptExecutor", () => {
 
   skip("child process never inherits the server's secrets — env is scrubbed, not passed through", async () => {
     const savedKey = process.env.AGENT_SWARM_API_KEY;
-    process.env.AGENT_SWARM_API_KEY = "super-secret-operator-bearer";
-    process.env.SOME_OTHER_SERVER_SECRET = "also-should-not-leak";
+    process.env.AGENT_SWARM_API_KEY = "example-super-secret-operator-bearer";
+    process.env.SOME_OTHER_SERVER_SECRET = "example-also-should-not-leak";
     try {
       const result = await executor.run(
         input(