@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/agent-fs-provision-seeder.test.ts

@@ -99,13 +99,13 @@ function createFetchStub(
         body.email !== "admin@example.test"
       ) {
         return Response.json({
-          apiKey: "afs-agent-key",
+          apiKey: "example-afs-agent-key",
           userId: "agent-user",
           orgId: "agent-personal-org",
         });
       }
       return Response.json({
-        apiKey: "afs-admin-key",
+        apiKey: "example-afs-admin-key",
         userId: "admin-user",
         orgId: "personal-org",
       });
@@ -208,7 +208,7 @@ describe("agent-fs provisioning seeder", () => {
 
     expect(result.failed).toEqual([]);
     expect(result.created).toBe(1);
-    expect(await configValue("API_AGENT_FS_API_KEY")).toBe("afs-admin-key");
+    expect(await configValue("API_AGENT_FS_API_KEY")).toBe("example-afs-admin-key");
     expect(
       (await getSwarmConfigs({ scope: "global", key: "API_AGENT_FS_API_KEY" }))[0]?.encrypted,
     ).toBe(true);
@@ -216,7 +216,7 @@ describe("agent-fs provisioning seeder", () => {
     expect(await configValue("AGENT_FS_DEFAULT_ORG_ID")).toBe("shared-org");
     expect(await configValue("AGENT_FS_SHARED_ORG_ID")).toBe("shared-org");
     expect(await configValue("AGENT_FS_DEFAULT_DRIVE_ID")).toBe("shared-drive");
-    expect(process.env.API_AGENT_FS_API_KEY).toBe("afs-admin-key");
+    expect(process.env.API_AGENT_FS_API_KEY).toBe("example-afs-admin-key");
 
     const register = records.find((r) => r.path === "/auth/register");
     expect(register?.body).toEqual({ email: "admin@example.test" });
@@ -255,7 +255,7 @@ describe("agent-fs provisioning seeder", () => {
     await upsertSwarmConfig({
       scope: "global",
       key: "API_AGENT_FS_API_KEY",
-      value: "afs-admin-key",
+      value: "example-afs-admin-key",
       isSecret: true,
     });
     await upsertSwarmConfig({
@@ -324,7 +324,7 @@ describe("agent-fs provisioning seeder", () => {
     await upsertSwarmConfig({
       scope: "global",
       key: "API_AGENT_FS_API_KEY",
-      value: "afs-admin-key",
+      value: "example-afs-admin-key",
       isSecret: true,
     });
     await upsertSwarmConfig({
@@ -388,7 +388,7 @@ describe("agent-fs provisioning seeder", () => {
     await upsertSwarmConfig({
       scope: "global",
       key: "API_AGENT_FS_API_KEY",
-      value: "afs-admin-key",
+      value: "example-afs-admin-key",
       isSecret: true,
     });
     await upsertSwarmConfig({
@@ -438,7 +438,7 @@ describe("agent-fs provisioning seeder", () => {
     await upsertSwarmConfig({
       scope: "global",
       key: "API_AGENT_FS_API_KEY",
-      value: "afs-admin-key",
+      value: "example-afs-admin-key",
       isSecret: true,
     });
     await upsertSwarmConfig({
@@ -492,7 +492,7 @@ describe("agent-fs provisioning seeder", () => {
         key: "AGENT_FS_API_KEY",
       })
     )[0];
-    expect(agentKey?.value).toBe("afs-agent-key");
+    expect(agentKey?.value).toBe("example-afs-agent-key");
     expect(agentKey?.encrypted).toBe(true);
     expect(records.find((r) => r.path === "/auth/register")?.body).toEqual({
       email: `custom-worker-${suffix}@example.test`,
@@ -516,7 +516,7 @@ describe("agent-fs provisioning seeder", () => {
     await upsertSwarmConfig({
       scope: "global",
       key: "API_AGENT_FS_API_KEY",
-      value: "afs-admin-key",
+      value: "example-afs-admin-key",
       isSecret: true,
     });
     await upsertSwarmConfig({
@@ -570,7 +570,7 @@ describe("agent-fs provisioning seeder", () => {
           key: "AGENT_FS_API_KEY",
         })
       )[0]?.value,
-    ).toBe("afs-agent-key");
+    ).toBe("example-afs-agent-key");
 
     const registrations = records
       .filter((record) => record.path === "/auth/register")
@@ -595,7 +595,7 @@ describe("agent-fs provisioning seeder", () => {
     const invite = records.find((r) => r.path === "/orgs/shared-org/members/invite");
     expect(invite?.method).toBe("POST");
     expect(invite?.body).toEqual({ email: "Customer@Example.test", role: "admin" });
-    expect(invite?.authorization).toBe("Bearer afs-admin-key");
+    expect(invite?.authorization).toBe("Bearer example-afs-admin-key");
   });
 
   test("does not re-invite an external email whose current role already covers the request", async () => {

package/src/tests/api-key-tracking.test.ts

@@ -29,7 +29,7 @@ describe("selectCredential", () => {
   });
 
   test("comma-separated picks one randomly", () => {
-    const value = "key-aaa11,key-bbb22,key-ccc33";
+    const value = "example-key-aaa11,example-key-bbb22,example-key-ccc33";
     const results = new Set<string>();
     for (let i = 0; i < 100; i++) {
       const result = selectCredential(value);
@@ -44,47 +44,47 @@ describe("selectCredential", () => {
   });
 
   test("respects availableIndices for rate-limit-aware selection", () => {
-    const value = "key-aaa11,key-bbb22,key-ccc33";
+    const value = "example-key-aaa11,example-key-bbb22,example-key-ccc33";
     for (let i = 0; i < 50; i++) {
       const result = selectCredential(value, [1]); // Only index 1 is available
-      expect(result.selected).toBe("key-bbb22");
+      expect(result.selected).toBe("example-key-bbb22");
       expect(result.index).toBe(1);
     }
   });
 
   test("falls back to random when all keys are rate-limited (empty availableIndices)", () => {
-    const value = "key-aaa11,key-bbb22";
+    const value = "example-key-aaa11,example-key-bbb22";
     const result = selectCredential(value, []);
-    expect(["key-aaa11", "key-bbb22"]).toContain(result.selected);
+    expect(["example-key-aaa11", "example-key-bbb22"]).toContain(result.selected);
     expect(result.isRateLimitFallback).toBe(true);
   });
 
   test("filters out-of-range availableIndices", () => {
-    const value = "key-aaa11,key-bbb22";
+    const value = "example-key-aaa11,example-key-bbb22";
     const result = selectCredential(value, [99]); // Out of range
     // Falls back to random
-    expect(["key-aaa11", "key-bbb22"]).toContain(result.selected);
+    expect(["example-key-aaa11", "example-key-bbb22"]).toContain(result.selected);
     expect(result.isRateLimitFallback).toBe(true);
   });
 
   test("isRateLimitFallback is false when indices are available", () => {
-    const result = selectCredential("key-aaa11,key-bbb22", [0, 1]);
+    const result = selectCredential("example-key-aaa11,example-key-bbb22", [0, 1]);
     expect(result.isRateLimitFallback).toBe(false);
   });
 
   test("isRateLimitFallback is false when no availability info", () => {
-    const result = selectCredential("key-aaa11,key-bbb22");
+    const result = selectCredential("example-key-aaa11,example-key-bbb22");
     expect(result.isRateLimitFallback).toBe(false);
   });
 
   test("single key with empty availableIndices sets isRateLimitFallback", () => {
-    const result = selectCredential("single-key", []);
+    const result = selectCredential("example-single-key", []);
     expect(result.isRateLimitFallback).toBe(true);
-    expect(result.selected).toBe("single-key");
+    expect(result.selected).toBe("example-single-key");
   });
 
   test("keySuffix is last 5 chars of selected key", () => {
-    const result = selectCredential("sk-ant-api03-abcde12345");
+    const result = selectCredential("example-sk-ant-api03-abcde12345");
     expect(result.keySuffix).toBe("12345");
   });
 
@@ -102,31 +102,31 @@ describe("selectCredential", () => {
 describe("resolveCredentialPools", () => {
   test("returns selections for pool vars", async () => {
     const env: Record<string, string | undefined> = {
-      ANTHROPIC_API_KEY: "key-aaa11,key-bbb22",
+      ANTHROPIC_API_KEY: "example-key-aaa11,example-key-bbb22",
     };
     const selections = await resolveCredentialPools(env);
     expect(selections.length).toBe(1);
     expect(selections[0]!.total).toBe(2);
     expect(selections[0]!.keyType).toBe("ANTHROPIC_API_KEY");
     // Env should be mutated to the selected key
-    expect(["key-aaa11", "key-bbb22"]).toContain(env.ANTHROPIC_API_KEY);
+    expect(["example-key-aaa11", "example-key-bbb22"]).toContain(env.ANTHROPIC_API_KEY);
   });
 
   test("passes availableIndicesMap through", async () => {
     const env: Record<string, string | undefined> = {
-      ANTHROPIC_API_KEY: "key-aaa11,key-bbb22,key-ccc33",
+      ANTHROPIC_API_KEY: "example-key-aaa11,example-key-bbb22,example-key-ccc33",
     };
     const selections = await resolveCredentialPools(env, {
       availableIndicesMap: { ANTHROPIC_API_KEY: [2] },
     });
     expect(selections.length).toBe(1);
     expect(selections[0]!.index).toBe(2);
-    expect(env.ANTHROPIC_API_KEY).toBe("key-ccc33");
+    expect(env.ANTHROPIC_API_KEY).toBe("example-key-ccc33");
   });
 
   test("single keys are tracked with index 0", async () => {
     const env: Record<string, string | undefined> = {
-      ANTHROPIC_API_KEY: "single-key",
+      ANTHROPIC_API_KEY: "example-single-key",
     };
     const selections = await resolveCredentialPools(env);
     expect(selections.length).toBe(1);
@@ -134,7 +134,7 @@ describe("resolveCredentialPools", () => {
     expect(selections[0]!.total).toBe(1);
     expect(selections[0]!.keySuffix).toBe("e-key");
     expect(selections[0]!.keyType).toBe("ANTHROPIC_API_KEY");
-    expect(env.ANTHROPIC_API_KEY).toBe("single-key");
+    expect(env.ANTHROPIC_API_KEY).toBe("example-single-key");
   });
 });
 

package/src/tests/api-key.test.ts

@@ -11,11 +11,13 @@ describe("getApiKey", () => {
   });
 
   test("returns AGENT_SWARM_API_KEY when only preferred var is set", () => {
-    expect(getApiKey({ AGENT_SWARM_API_KEY: "preferred" })).toBe("preferred");
+    expect(getApiKey({ AGENT_SWARM_API_KEY: "example-preferred" })).toBe("example-preferred");
   });
 
   test("prefers AGENT_SWARM_API_KEY over API_KEY when both set", () => {
-    expect(getApiKey({ AGENT_SWARM_API_KEY: "preferred", API_KEY: "legacy" })).toBe("preferred");
+    expect(getApiKey({ AGENT_SWARM_API_KEY: "example-preferred", API_KEY: "legacy" })).toBe(
+      "example-preferred",
+    );
   });
 
   test("falls back to API_KEY if AGENT_SWARM_API_KEY is undefined", () => {

package/src/tests/apps-rbac.test.ts

@@ -22,7 +22,7 @@ import { registerAppPatchTool } from "../tools/app-patch";
 import { setRequestAuth } from "../utils/request-auth-context";
 
 const TEST_DB_PATH = `/private/tmp/test-apps-rbac-${process.pid}.sqlite`;
-const API_KEY = "apps-rbac-test-key";
+const API_KEY = "example-apps-rbac-test-key";
 const AGENT_ID = crypto.randomUUID();
 const LEAD_ID = crypto.randomUUID();
 const OPERATOR_ACTOR: IdentityActor = { kind: "operator", id: "apps-rbac-test" };

package/src/tests/apps-spike5.test.ts

@@ -1806,7 +1806,7 @@ describe("apps spike 5 lifecycle", () => {
     const appId = await createApp(migrationDefinition);
     const row = await createRow(appId, { title: "MCP failure", status: "open" });
     const namespace = appsNamespace(appId);
-    const secret = "phase2-migration-secret-value";
+    const secret = "example-phase2-migration-secret-value";
     process.env.SPIKE5_MIGRATION_SECRET = secret;
     refreshSecretScrubberCache();
     await getDbClient().run(`

package/src/tests/apps-sync-engine.test.ts

@@ -61,7 +61,7 @@ const spawnDescribe = describe.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = `/private/tmp/test-apps-sync-engine-${process.pid}.sqlite`;
-const API_KEY = "apps-sync-engine-test-key-0123456789";
+const API_KEY = "example-apps-sync-engine-test-key-0123456789";
 const OWNER_AGENT_ID = crypto.randomUUID();
 const LEAD_AGENT_ID = crypto.randomUUID();
 const savedEnv = { ...process.env };
@@ -933,7 +933,7 @@ describe("swarm-tasks source", () => {
   });
 
   test("engine-generated warnings carrying a known secret come back redacted", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -968,7 +968,7 @@ describe("swarm-tasks source", () => {
   });
 
   test("an engine-generated pass error carrying a known secret is redacted in the status KV", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -1429,7 +1429,7 @@ spawnDescribe("pass snapshot consistency", () => {
 
 spawnDescribe("secret hygiene and sync status", () => {
   test("a pass error carrying a known secret comes back redacted", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -1588,7 +1588,7 @@ spawnDescribe("secret hygiene and sync status", () => {
   });
 
   test("a pulled field carrying a known secret is redacted before it lands in a row", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -1610,7 +1610,7 @@ spawnDescribe("secret hygiene and sync status", () => {
   });
 
   test("a secret straddling the prompt cap is scrubbed before truncation", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -1643,7 +1643,7 @@ spawnDescribe("secret hygiene and sync status", () => {
   });
 
   test("a secret straddling the stderr cap is scrubbed before truncation", async () => {
-    const secret = "fixture-secret-value-0123456789";
+    const secret = "example-fixture-secret-value-0123456789";
     process.env.APPS_SYNC_FIXTURE_TOKEN = secret;
     refreshSecretScrubberCache();
     try {
@@ -2376,7 +2376,7 @@ spawnDescribe("a sync source against a dummy GitHub through the real sandbox", (
   // that is the point of these tests: GITHUB_TOKEN's binding is allowlisted to
   // api.github.com, so an active binding exists while the fixture host does not
   // match it — the placeholder must therefore leave the sandbox unsubstituted.
-  const FIXTURE_TOKEN = "ghp_fixture_secret_value_9876543210";
+  const FIXTURE_TOKEN = "example-ghp_fixture_secret_value_9876543210";
 
   let fixture: ReturnType<typeof Bun.serve>;
   let origin = "";

package/src/tests/apps-user-config.test.ts

@@ -25,7 +25,7 @@ import type { RbacCheck } from "../rbac/types";
 import { setRequestAuth } from "../utils/request-auth-context";
 
 const TEST_DB_PATH = `/private/tmp/test-apps-user-config-${process.pid}.sqlite`;
-const API_KEY = "apps-user-config-test-key";
+const API_KEY = "example-apps-user-config-test-key";
 const AGENT_ID = crypto.randomUUID();
 const OPERATOR_ACTOR: IdentityActor = { kind: "operator", id: "apps-user-config-test" };
 const mutableLegacyPolicy = LEGACY_POLICY as unknown as Record<"app.use", LegacyRule>;

package/src/tests/artifact-sdk.test.ts

@@ -142,7 +142,7 @@ describe("createArtifactServer", () => {
 
   beforeAll(() => {
     process.env.AGENT_ID = "test-agent-id";
-    process.env.API_KEY = "test-api-key";
+    process.env.API_KEY = "example-test-api-key";
     process.env.MCP_BASE_URL = "http://localhost:19999"; // Intentionally unreachable
   });
 
@@ -342,7 +342,7 @@ describe("createArtifactServer", () => {
         const path = c.req.path.replace("/@swarm/api", "/api");
         const targetUrl = `http://localhost:${mockMcpPort}${path}`;
         const headers: Record<string, string> = {
-          Authorization: "Bearer test-api-key",
+          Authorization: "Bearer example-test-api-key",
           "X-Agent-ID": "test-agent-id",
         };
         if (c.req.method !== "GET") {
@@ -368,7 +368,7 @@ describe("createArtifactServer", () => {
       try {
         // Test GET request headers
         await fetch(`http://localhost:${proxyPort}/@swarm/api/agents`);
-        expect(capturedHeaders.authorization).toBe("Bearer test-api-key");
+        expect(capturedHeaders.authorization).toBe("Bearer example-test-api-key");
         expect(capturedHeaders["x-agent-id"]).toBe("test-agent-id");
 
         // GET should NOT have Content-Type
@@ -379,7 +379,7 @@ describe("createArtifactServer", () => {
           method: "POST",
           body: JSON.stringify({ task: "test" }),
         });
-        expect(capturedHeaders.authorization).toBe("Bearer test-api-key");
+        expect(capturedHeaders.authorization).toBe("Bearer example-test-api-key");
         expect(capturedHeaders["x-agent-id"]).toBe("test-agent-id");
         expect(capturedHeaders["content-type"]).toBe("application/json");
       } finally {
@@ -594,7 +594,7 @@ describe("artifact CLI command", () => {
 
       const origEnv = { ...process.env };
       process.env.MCP_BASE_URL = `http://localhost:${mockPort}`;
-      process.env.API_KEY = "test-key";
+      process.env.API_KEY = "example-test-key";
       process.env.AGENT_ID = "test-agent";
 
       const consoleSpy = mock(() => {});
@@ -627,7 +627,7 @@ describe("artifact CLI command", () => {
 
       const origEnv = { ...process.env };
       process.env.MCP_BASE_URL = `http://localhost:${mockPort}`;
-      process.env.API_KEY = "test-key";
+      process.env.API_KEY = "example-test-key";
       process.env.AGENT_ID = "test-agent";
 
       const consoleSpy = mock(() => {});
@@ -678,7 +678,7 @@ describe("artifact CLI command", () => {
 
       const origEnv = { ...process.env };
       process.env.MCP_BASE_URL = `http://localhost:${mockPort}`;
-      process.env.API_KEY = "test-key";
+      process.env.API_KEY = "example-test-key";
       process.env.AGENT_ID = "test-agent";
 
       const consoleSpy = mock(() => {});
@@ -734,7 +734,7 @@ describe("artifact CLI command", () => {
 
       const origEnv = { ...process.env };
       process.env.MCP_BASE_URL = `http://localhost:${mockPort}`;
-      process.env.API_KEY = "test-key";
+      process.env.API_KEY = "example-test-key";
       process.env.AGENT_ID = "test-agent";
 
       const consoleSpy = mock(() => {});

package/src/tests/asset-key-mcp.test.ts

@@ -77,6 +77,7 @@ describe("asset namespace MCP exposure", () => {
       {
         agentId: targetAgentId,
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: `inherited namespace ${Date.now()}`,
         allowDuplicate: true,
       },
@@ -92,6 +93,7 @@ describe("asset namespace MCP exposure", () => {
       {
         agentId: targetAgentId,
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: `wrong namespace ${Date.now()}`,
         key: `personal/${otherUserId}/drafts/`,
         allowDuplicate: true,

package/src/tests/automation-preflight-alert.test.ts

@@ -73,7 +73,7 @@ describe("Automation preflight alerts", () => {
   });
 
   test("scrubs alert text and logs Slack failures without throwing", async () => {
-    const secret = "preflight-alert-sensitive-fixture";
+    const secret = "example-preflight-alert-sensitive-fixture";
     registerVolatileSecret(secret, "PREFLIGHT_TEST_SECRET");
     postMessage.mockRejectedValueOnce(new Error(`Slack failed: ${secret}`));
     const error = spyOn(console, "error").mockImplementation(() => {});

package/src/tests/base-prompt.test.ts

@@ -636,6 +636,7 @@ describe("getBasePrompt: steering section", () => {
   });
 
   test("excluded when steering is not enabled", async () => {
+    process.env.STEERING_ENABLED = "false";
     const result = await getBasePrompt({ ...minimalArgs, traits: steerableTraits });
     expect(result).not.toContain(STEERING_HEADER);
   });
@@ -960,21 +961,21 @@ describe("truncateRepoClaudeMd", () => {
 // ---------------------------------------------------------------------------
 
 describe("getBasePrompt: size budget", () => {
-  // The v2 rewrite cut the static prompt from ~25k characters to ~4.2k. These
-  // ceilings are generous, so they only fire on a regression back to v1 size.
-  test("a fresh claude worker stays under 5,000 characters", async () => {
+  // Include the explicit task-output budget and exceptions in the static prompt.
+  // Keep tight role-specific ceilings to catch unrelated prompt growth.
+  test("a fresh claude worker stays under 5,400 characters", async () => {
     const result = await getBasePrompt({ ...minimalArgs, name: "Ada", traits: localTraits });
-    expect(result.length).toBeLessThan(5_000);
+    expect(result.length).toBeLessThan(5_400);
   });
 
-  test("a fresh claude lead stays under 5,200 characters", async () => {
+  test("a fresh claude lead stays under 5,500 characters", async () => {
     const result = await getBasePrompt({
       ...minimalArgs,
       role: "lead",
       name: "Cora",
       traits: localTraits,
     });
-    expect(result.length).toBeLessThan(5_200);
+    expect(result.length).toBeLessThan(5_500);
   });
 
   test("Picateclas spawn-OOM hardening: the kitchen sink stays below MAX_ARG_STRLEN", async () => {

package/src/tests/budget-user-scope.test.ts

@@ -29,7 +29,7 @@ import { listenOnFreePort } from "./test-net";
 const TEST_DB_PATH = "./test-budget-user-scope.sqlite";
 const NOW = new Date("2026-04-28T15:30:00.000Z");
 const TODAY = "2026-04-28";
-const API_KEY = "test-budget-user-scope-key";
+const API_KEY = "example-test-budget-user-scope-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "phase6-test" };
 
 async function removeDbFiles(path: string): Promise<void> {

package/src/tests/budgets-routes.test.ts

@@ -25,7 +25,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-budgets-routes.sqlite";
-const API_KEY = "test-budget-secret-key";
+const API_KEY = "example-test-budget-secret-key";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {