@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/fixtures/extensions/no-exclamation-marks/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "no-exclamation-marks",
+  "description": "Rejects progress text that contains an exclamation mark",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/post-logger/hooks.ts

@@ -0,0 +1,9 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("post.task.created", async (_event, ctx) => {
+    await ctx.state.incr("created");
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/post-logger/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "post-logger",
+  "description": "Records task-created post events",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/priority-a/hooks.ts

@@ -0,0 +1,7 @@
+import { modify, type SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", (event) => modify({ description: `${event.description}a` }));
+};
+
+export default extension;

package/src/tests/fixtures/extensions/priority-a/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "priority-a",
+  "description": "Appends A to task descriptions",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/priority-b/hooks.ts

@@ -0,0 +1,7 @@
+import { modify, type SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", (event) => modify({ description: `${event.description}b` }));
+};
+
+export default extension;

package/src/tests/fixtures/extensions/priority-b/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "priority-b",
+  "description": "Appends B to task descriptions",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/record-only-on-tag/hooks.ts

@@ -0,0 +1,16 @@
+import { block, type ExtensionManifest, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({ tag: z.string() });
+
+type Manifest = ExtensionManifest & { runtime: "api"; config: typeof config };
+
+const extension: SwarmExtension<Manifest> = (api) => {
+  api.on("pre.heartbeat.remediate", (event, ctx) => {
+    if (event.task.tags.includes(ctx.config.tag)) {
+      return block(`Heartbeat remediation blocked for tag ${ctx.config.tag}`);
+    }
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/record-only-on-tag/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "record-only-on-tag",
+  "description": "Skips heartbeat remediation for tasks with a configured tag",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/reserved-assets/hooks.ts

@@ -0,0 +1,5 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = () => {};
+
+export default extension;

package/src/tests/fixtures/extensions/reserved-assets/manifest.json

@@ -0,0 +1,10 @@
+{
+  "name": "reserved-assets",
+  "description": "Extension with a reserved asset",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts",
+    "skills": ["skill.md"]
+  }
+}

package/src/tests/fixtures/extensions/rewrite-progress-prefix/hooks.ts

@@ -0,0 +1,22 @@
+import { modify, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({
+  prefix: z.string(),
+  invalid: z.boolean().optional().default(false),
+  tool: z.string().optional().default("store-progress"),
+});
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.tool.call", (event, ctx) => {
+    if (event.tool !== ctx.config.tool) return;
+    if (ctx.config.invalid) return modify({ args: { progress: 42 } });
+    if (!event.args || typeof event.args !== "object") return;
+    const args = event.args as Record<string, unknown>;
+    const progress = args.progress;
+    if (typeof progress !== "string") return modify({ args: { progress: ctx.config.prefix } });
+    return modify({ args: { ...args, progress: `${ctx.config.prefix}${progress}` } });
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/rewrite-progress-prefix/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "rewrite-progress-prefix",
+  "description": "Adds a configured prefix to progress text",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/rewrite-task-priority/hooks.ts

@@ -0,0 +1,7 @@
+import { modify, type SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => modify({ priority: 1 }));
+};
+
+export default extension;

package/src/tests/fixtures/extensions/rewrite-task-priority/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "rewrite-task-priority",
+  "description": "Rewrites task priority to one",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/route-channel-to-agent/hooks.ts

@@ -0,0 +1,26 @@
+import { modify, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({ channelId: z.string(), agentId: z.string() });
+
+const manifest = {
+  name: "route-channel-to-agent",
+  description: "Routes one Slack channel to a configured agent",
+  version: "1.0.0",
+  runtime: "api",
+  assets: { hooks: "hooks.ts" },
+  config,
+} as const;
+
+const extension: SwarmExtension<typeof manifest> = (api) => {
+  api.on("pre.slack.route", (event, ctx) => {
+    if (event.channelId !== ctx.config.channelId) return;
+    return modify({ target: { kind: "agent", agentId: ctx.config.agentId } });
+  });
+
+  api.on("post.slack.message", async (event, ctx) => {
+    await ctx.state.set(`slack:${event.channelId}`, event.userId);
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/route-channel-to-agent/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "route-channel-to-agent",
+  "description": "Routes one Slack channel to a configured agent",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/slow/hooks.ts

@@ -0,0 +1,10 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", async (_event, ctx) => {
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+    await ctx.state.incr("after-timeout");
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/slow/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "slow",
+  "description": "Exceeds the handler timeout",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/suppress-lead-follow-up/hooks.ts

@@ -0,0 +1,12 @@
+import { block, type SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.followUp", (event) => {
+    if (event.completedTask.source === "slack") {
+      return block("Slack tasks report in the original thread");
+    }
+  });
+  api.on("pre.task.create", () => undefined);
+};
+
+export default extension;

package/src/tests/fixtures/extensions/suppress-lead-follow-up/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "suppress-lead-follow-up",
+  "description": "Suppresses lead follow-ups for Slack tasks",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/throws/hooks.ts

@@ -0,0 +1,12 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const fail = () => {
+  throw new Error("fixture failure");
+};
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", fail);
+  api.on("post.task.created", fail);
+};
+
+export default extension;

package/src/tests/fixtures/extensions/throws/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "throws",
+  "description": "Throws from task handlers",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fixtures/extensions/worker-runtime/hooks.ts

@@ -0,0 +1,5 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = () => {};
+
+export default extension;

package/src/tests/fixtures/extensions/worker-runtime/manifest.json

@@ -0,0 +1,9 @@
+{
+  "name": "worker-runtime",
+  "description": "Reserved worker extension",
+  "version": "1.0.0",
+  "runtime": "worker",
+  "assets": {
+    "hooks": "hooks.ts"
+  }
+}

package/src/tests/fs-routes.test.ts

@@ -25,7 +25,7 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-fs-routes.sqlite";
 const TEST_FS_DIR = "./test-fs-routes-data";
-const API_KEY = "test-fs-key";
+const API_KEY = "example-test-fs-key";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/gitlab-auth.test.ts

@@ -24,12 +24,12 @@ describe("GitLab auth", () => {
     });
 
     test("returns true when GITLAB_WEBHOOK_SECRET is set", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       expect(isGitLabEnabled()).toBe(true);
     });
 
     test("returns false when GITLAB_DISABLE is true", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       process.env.GITLAB_DISABLE = "true";
       expect(isGitLabEnabled()).toBe(false);
     });
@@ -37,7 +37,7 @@ describe("GitLab auth", () => {
 
   describe("initGitLab", () => {
     test("initializes with custom URL", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       process.env.GITLAB_TOKEN = "glpat-abc123";
       process.env.GITLAB_URL = "https://gitlab.mycompany.com";
       initGitLab();
@@ -47,7 +47,7 @@ describe("GitLab auth", () => {
     });
 
     test("defaults to gitlab.com URL", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       initGitLab();
 
       expect(getGitLabUrl()).toBe("https://gitlab.com");
@@ -59,7 +59,7 @@ describe("GitLab auth", () => {
     });
 
     test("is idempotent", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       process.env.GITLAB_TOKEN = "token-1";
       initGitLab();
 
@@ -76,27 +76,27 @@ describe("GitLab auth", () => {
     });
 
     test("returns false when no token provided", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       initGitLab();
       expect(verifyGitLabWebhook(undefined)).toBe(false);
     });
 
     test("returns false for mismatched token", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       initGitLab();
       expect(verifyGitLabWebhook("wrong-secret")).toBe(false);
     });
 
     test("returns false for different length token", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       initGitLab();
       expect(verifyGitLabWebhook("short")).toBe(false);
     });
 
     test("returns true for matching token", () => {
-      process.env.GITLAB_WEBHOOK_SECRET = "test-secret";
+      process.env.GITLAB_WEBHOOK_SECRET = "example-test-secret";
       initGitLab();
-      expect(verifyGitLabWebhook("test-secret")).toBe(true);
+      expect(verifyGitLabWebhook("example-test-secret")).toBe(true);
     });
   });
 

package/src/tests/harness-provider-resolution.test.ts

@@ -118,18 +118,18 @@ describe("resolveHarnessProvider", () => {
   });
 
   test("prefers 'pi' when unset and only an OpenRouter key is present (fallbackEnv)", () => {
-    expect(resolveHarnessProvider({}, { OPENROUTER_API_KEY: "sk-or-v1-xxx" })).toBe("pi");
+    expect(resolveHarnessProvider({}, { OPENROUTER_API_KEY: "example-sk-or-v1-xxx" })).toBe("pi");
   });
 
   test("prefers 'pi' when unset and only an OpenRouter key is present (resolvedEnv)", () => {
-    expect(resolveHarnessProvider({ OPENROUTER_API_KEY: "sk-or-v1-xxx" }, {})).toBe("pi");
+    expect(resolveHarnessProvider({ OPENROUTER_API_KEY: "example-sk-or-v1-xxx" }, {})).toBe("pi");
   });
 
   test("prefers 'pi' when invalid and only an OpenRouter key is present", () => {
     expect(
       resolveHarnessProvider(
         { HARNESS_PROVIDER: "not-a-provider" },
-        { OPENROUTER_API_KEY: "sk-or-v1-xxx" },
+        { OPENROUTER_API_KEY: "example-sk-or-v1-xxx" },
       ),
     ).toBe("pi");
   });
@@ -138,7 +138,7 @@ describe("resolveHarnessProvider", () => {
     expect(
       resolveHarnessProvider(
         {},
-        { OPENROUTER_API_KEY: "sk-or-v1-xxx", ANTHROPIC_API_KEY: "sk-ant-xxx" },
+        { OPENROUTER_API_KEY: "example-sk-or-v1-xxx", ANTHROPIC_API_KEY: "example-sk-ant-xxx" },
       ),
     ).toBe("claude");
   });
@@ -147,7 +147,10 @@ describe("resolveHarnessProvider", () => {
     expect(
       resolveHarnessProvider(
         {},
-        { OPENROUTER_API_KEY: "sk-or-v1-xxx", CLAUDE_CODE_OAUTH_TOKEN: "token-xxx" },
+        {
+          OPENROUTER_API_KEY: "example-sk-or-v1-xxx",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-token-xxx",
+        },
       ),
     ).toBe("claude");
   });

package/src/tests/heartbeat-reroute-decision.test.ts

@@ -454,6 +454,7 @@ describe("Heartbeat — reroute-decision fallback (DES-523)", () => {
         task: "Resume the crashed work on B",
         agentId: agentB.id,
         routingReason: "reroute_fault",
+        routingNote: "This test explicitly selects the target worker",
         taskType: "resume",
         parentTaskId: original.id,
         allowDuplicate: true,

package/src/tests/helper-credentials.test.ts

@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { chmod, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
+
+describe("helper credentials", () => {
+  let dir: string;
+  let env: Record<string, string | undefined>;
+
+  async function stub(name: string, body: string) {
+    const path = join(dir, name);
+    await Bun.write(path, `#!/usr/bin/env bash\nset -eu\n${body}\n`);
+    await chmod(path, 0o755);
+  }
+
+  beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), "helper-credentials-"));
+    env = {
+      PATH: `${dir}:${process.env.PATH}`,
+      TMPDIR: dir,
+      CAPTURE: join(dir, "capture"),
+      REAL_BUN: process.execPath,
+    };
+    await stub("id", "echo 0");
+    await stub("curl", 'printf "%s\\n" "$@" >> "$CAPTURE"; exit 23');
+  });
+
+  afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  for (const script of ["e2e-workflow-test.sh", "seed-api-keys.sh", "scripts-api-smoke.sh"]) {
+    for (const empty of [false, true]) {
+      test(`${script} rejects ${empty ? "empty" : "missing"} credentials before requests`, async () => {
+        const result = await runChild(["bash", `scripts/${script}`], {
+          env: {
+            ...env,
+            SWARM_BASE_URL: "http://unused.invalid",
+            ...(empty ? { AGENT_SWARM_API_KEY: "", API_KEY: "" } : {}),
+          },
+        });
+        expect(result.exitCode).not.toBe(0);
+        expect(result.stderr).toContain("AGENT_SWARM_API_KEY");
+        expect(await Bun.file(env.CAPTURE as string).exists()).toBe(false);
+      });
+    }
+  }
+
+  for (const preferred of [false, true]) {
+    test(`workflow helper uses ${preferred ? "preferred" : "legacy"} exported key`, async () => {
+      const key = crypto.randomUUID();
+      const result = await runChild(["bash", "scripts/e2e-workflow-test.sh"], {
+        env: {
+          ...env,
+          API_KEY: preferred ? crypto.randomUUID() : key,
+          ...(preferred ? { AGENT_SWARM_API_KEY: key } : {}),
+        },
+      });
+      expect(result.exitCode).toBe(1); // Deliberate connection failure after capturing auth.
+      expect(await Bun.file(env.CAPTURE as string).text()).toContain(
+        `Authorization: Bearer ${key}`,
+      );
+      expect(result.stdout + result.stderr).not.toContain(key);
+    });
+  }
+
+  test("seed helper gives its explicit argument precedence over exported keys", async () => {
+    await stub("curl", 'printf "%s\\n" "$@" >> "$CAPTURE"');
+    const key = crypto.randomUUID();
+    const result = await runChild(
+      ["bash", "scripts/seed-api-keys.sh", "http://unused.invalid", key],
+      {
+        env: { ...env, AGENT_SWARM_API_KEY: crypto.randomUUID(), API_KEY: crypto.randomUUID() },
+      },
+    );
+    expectChildOk(result, "seed helper");
+    const captured = await Bun.file(env.CAPTURE as string).text();
+    expect(captured.match(/Authorization: Bearer /g)?.length).toBe(158);
+    expect(captured.match(new RegExp(key, "g"))?.length).toBe(158);
+    expect(result.stdout + result.stderr).not.toContain(key);
+  });
+
+  test(
+    "self-hosted smoke generates a fresh key per run and uses it for server and clients",
+    async () => {
+      // Run the real key generator; replace only server startup and HTTP transport.
+      await stub(
+        "bun",
+        'if [[ "$1" != run ]]; then exec "$REAL_BUN" "$@"; fi\nprintf "%s" "$AGENT_SWARM_API_KEY" > "$CAPTURE.server"',
+      );
+      await stub(
+        "curl",
+        `if [[ "$*" == *"/health"* ]]; then exit 0; fi
+for _ in {1..100}; do [[ -s "$CAPTURE.server" ]] && break; sleep 0.01; done
+expected="Authorization: Bearer $(cat "$CAPTURE.server")"
+for arg in "$@"; do
+  if [[ "$arg" == "$expected" ]]; then
+    echo authenticated >> "$CAPTURE"
+    echo '{"version":1,"name":"scripts-smoke-double","result":42,"deleted":true}'
+    exit 0
+  fi
+done
+exit 22`,
+      );
+      const keys: string[] = [];
+      for (let i = 0; i < 2; i++) {
+        await rm(`${env.CAPTURE}.server`, { force: true });
+        const result = await runChild(["bash", "scripts/scripts-api-smoke.sh"], { env });
+        expectChildOk(result, "self-hosted smoke");
+        const key = await Bun.file(`${env.CAPTURE}.server`).text();
+        expect(key).toMatch(/^[\da-f]{8}-[\da-f]{4}-4[\da-f]{3}-[89ab][\da-f]{3}-[\da-f]{12}$/);
+        expect(result.stdout + result.stderr).not.toContain(key);
+        keys.push(key);
+      }
+      expect(keys[0]).not.toBe(keys[1]);
+      expect((await Bun.file(env.CAPTURE as string).text()).trim().split("\n")).toHaveLength(10);
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  for (const empty of [false, true]) {
+    test(`PostgreSQL rejects ${empty ? "empty" : "missing"} password before creating a cluster`, async () => {
+      const cluster = join(dir, "cluster");
+      const result = await runChild(["bash", "scripts/init-local-postgres.sh"], {
+        env: {
+          ...env,
+          LOCAL_POSTGRES_DATA_DIR: cluster,
+          ...(empty ? { LOCAL_POSTGRES_PASSWORD: "" } : {}),
+        },
+      });
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("LOCAL_POSTGRES_PASSWORD");
+      expect(await Bun.file(join(cluster, "data", "PG_VERSION")).exists()).toBe(false);
+    });
+  }
+});

package/src/tests/http/context-routes.test.ts

@@ -30,8 +30,8 @@ import { handleCore } from "../../http/core";
 import { getPathSegments, parseQueryParams } from "../../http/utils";
 import { listenOnFreePort } from "../test-net";
 
-const TEST_DB_PATH = "./test-context-routes.sqlite";
-const API_KEY = "test-context-routes";
+const TEST_DB_PATH = "./example-test-context-routes.sqlite";
+const API_KEY = "example-test-context-routes";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/http-api-integration.test.ts

@@ -20,7 +20,7 @@ const TEST_DB_PATH = `/tmp/test-http-integration-${Date.now()}.sqlite`;
 // the attachment test was leaking data/fs/tasks/<id>/ into the worktree).
 const TEST_FS_DIR = `/tmp/test-http-integration-fs-${Date.now()}`;
 let BASE = "";
-const TEST_API_KEY = "test-http-integration-key";
+const TEST_API_KEY = "example-test-http-integration-key";
 
 let serverProc: Subprocess;
 
@@ -535,6 +535,7 @@ describe("Tasks", () => {
     expect(status).toBe(201);
     expect(body.id).toBeDefined();
     expect(body.task).toBe("Integration test task 1");
+    expect(body.routingSource).toBe("engine_default");
     ids.task = body.id;
   });
 
@@ -550,6 +551,8 @@ describe("Tasks", () => {
     expect(status).toBe(201);
     expect(body.agentId).toBe(ids.workerAgent);
     expect(body.routingReason).toBe("human_pinned");
+    expect(body.routingSource).toBe("declared");
+    expect(body.routingNote).toBeUndefined(); // REST deliberately keeps notes optional.
     ids.task2 = body.id;
   });
 
@@ -1984,7 +1987,7 @@ describe("AgentMail Webhooks (with filters)", () => {
   let AGENTMAIL_PORT = 0;
   const AGENTMAIL_DB = `/tmp/test-agentmail-${Date.now()}.sqlite`;
   let AGENTMAIL_BASE = "";
-  const WEBHOOK_SECRET = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"; // test-only secret
+  const WEBHOOK_SECRET = `whsec_${Buffer.alloc(32, 1).toString("base64")}`;
   let agentmailProc: Subprocess;
 
   function signPayload(payload: unknown): { body: string; headers: Record<string, string> } {

package/src/tests/http-users.test.ts

@@ -41,7 +41,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-http-users.sqlite";
-const API_KEY = "test-users-key";
+const API_KEY = "example-test-users-key";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/identity-refresh.test.ts

@@ -16,7 +16,7 @@ const cached: IdentityProfileFields = {
 };
 const context: IdentityRefreshContext = {
   apiUrl: "http://identity.invalid",
-  apiKey: "test-key",
+  apiKey: "example-test-key",
   agentId: "38d36438-58a0-45b5-8602-a5d52b07c2f1",
   role: "worker",
   timeoutMs: 20,
@@ -133,7 +133,7 @@ describe("refreshIdentityIfChanged", () => {
       expect(url).toBe(`${context.apiUrl}/me`);
       expect(init?.headers).toEqual({
         "X-Agent-ID": context.agentId,
-        Authorization: "Bearer test-key",
+        Authorization: "Bearer example-test-key",
       });
       signal = init?.signal ?? undefined;
       return Response.json({ soulMd: "new" });