@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/mcp-oauth-queries.test.ts

@@ -53,8 +53,8 @@ function makeServer(name: string) {
 
 const base = (mcpServerId: string) => ({
   mcpServerId,
-  accessToken: "access-123",
-  refreshToken: "refresh-456",
+  accessToken: "example-access-123",
+  refreshToken: "example-refresh-456",
   tokenType: "Bearer",
   expiresAt: new Date(Date.now() + 3600_000).toISOString(),
   scope: "read write",
@@ -64,7 +64,7 @@ const base = (mcpServerId: string) => ({
   tokenUrl: "https://as.example.com/token",
   revocationUrl: null,
   dcrClientId: "client-abc",
-  dcrClientSecret: "dcr-secret-xyz",
+  dcrClientSecret: "example-dcr-secret-xyz",
   clientSource: "dcr" as const,
   status: "connected" as const,
 });
@@ -76,9 +76,9 @@ describe("mcp_oauth_tokens encryption roundtrip", () => {
     const token = await getMcpOAuthToken(server.id);
 
     expect(token).not.toBeNull();
-    expect(token!.accessToken).toBe("access-123");
-    expect(token!.refreshToken).toBe("refresh-456");
-    expect(token!.dcrClientSecret).toBe("dcr-secret-xyz");
+    expect(token!.accessToken).toBe("example-access-123");
+    expect(token!.refreshToken).toBe("example-refresh-456");
+    expect(token!.dcrClientSecret).toBe("example-dcr-secret-xyz");
     expect(token!.tokenVersion).toBe(1);
     expect(token!.status).toBe("connected");
     const app = await getDbClient().get<{ source: string; metadata: string }>(
@@ -91,7 +91,10 @@ describe("mcp_oauth_tokens encryption roundtrip", () => {
 
   test("access token is encrypted at rest (not stored plaintext)", async () => {
     const server = await makeServer("mcp-enc-at-rest");
-    await upsertMcpOAuthToken({ ...base(server.id), accessToken: "UNIQUE_PLAINTEXT_TOKEN_ABC" });
+    await upsertMcpOAuthToken({
+      ...base(server.id),
+      accessToken: "example-UNIQUE_PLAINTEXT_TOKEN_ABC",
+    });
 
     // Use raw SQL to inspect the row bypassing the decrypt helper.
     const row = (await getDbClient().get(
@@ -105,7 +108,7 @@ describe("mcp_oauth_tokens encryption roundtrip", () => {
     )) as { accessToken: string } | null;
 
     expect(row).not.toBeNull();
-    expect(row!.accessToken).not.toBe("UNIQUE_PLAINTEXT_TOKEN_ABC");
+    expect(row!.accessToken).not.toBe("example-UNIQUE_PLAINTEXT_TOKEN_ABC");
     expect(row!.accessToken.length).toBeGreaterThan(24);
   });
 
@@ -114,15 +117,15 @@ describe("mcp_oauth_tokens encryption roundtrip", () => {
     await upsertMcpOAuthToken(base(server.id));
     await upsertMcpOAuthToken({
       ...base(server.id),
-      accessToken: "access-updated",
+      accessToken: "example-access-updated",
       refreshToken: undefined,
       scope: "read",
     });
     const token = await getMcpOAuthToken(server.id);
-    expect(token!.accessToken).toBe("access-updated");
+    expect(token!.accessToken).toBe("example-access-updated");
     // COALESCE behaviour on refreshToken: not overridden when updater omits it
     // (we re-pass the same refresh above, so expect it intact).
-    expect(token!.refreshToken).toBe("refresh-456");
+    expect(token!.refreshToken).toBe("example-refresh-456");
   });
 
   test("refresh CAS uses the tokenVersion observed before the provider request", async () => {
@@ -132,20 +135,20 @@ describe("mcp_oauth_tokens encryption roundtrip", () => {
 
     await upsertMcpOAuthToken({
       ...base(server.id),
-      accessToken: "concurrent-winner",
-      refreshToken: "refresh-456",
+      accessToken: "example-concurrent-winner",
+      refreshToken: "example-refresh-456",
     });
 
     await expect(
       applyMcpOAuthRefresh(observed.id, {
-        accessToken: "stale-refresh-result",
-        refreshToken: "stale-refresh-token",
+        accessToken: "example-stale-refresh-result",
+        refreshToken: "example-stale-refresh-token",
         expectedTokenVersion: observed.tokenVersion,
       }),
     ).rejects.toThrow(/token version changed during refresh/);
     expect(await getMcpOAuthToken(server.id)).toMatchObject({
-      accessToken: "concurrent-winner",
-      refreshToken: "refresh-456",
+      accessToken: "example-concurrent-winner",
+      refreshToken: "example-refresh-456",
     });
   });
 });
@@ -178,13 +181,13 @@ describe("markMcpOAuthTokenStatus + deleteMcpOAuthToken", () => {
 
     await upsertMcpOAuthToken({
       ...base(server.id),
-      accessToken: "reconnected-access",
-      refreshToken: "reconnected-refresh",
+      accessToken: "example-reconnected-access",
+      refreshToken: "example-reconnected-refresh",
     });
     expect(await getMcpOAuthToken(server.id)).toMatchObject({
       id: original.id,
-      accessToken: "reconnected-access",
-      refreshToken: "reconnected-refresh",
+      accessToken: "example-reconnected-access",
+      refreshToken: "example-reconnected-refresh",
       status: "connected",
     });
   });
@@ -264,13 +267,13 @@ describe("mcp_oauth_pending (state PK)", () => {
       tokenUrl: "https://as.example.com/token",
       redirectUri: "https://swarm.example.com/cb",
       dcrClientId: "client-abc",
-      dcrClientSecret: "secret-xyz",
+      dcrClientSecret: "example-secret-xyz",
     });
 
     const consumed = await consumeMcpOAuthPending("state-1");
     expect(consumed).not.toBeNull();
     expect(consumed!.codeVerifier).toBe("verifier-plain-1");
-    expect(consumed!.dcrClientSecret).toBe("secret-xyz");
+    expect(consumed!.dcrClientSecret).toBe("example-secret-xyz");
     expect(consumed!.mcpServerId).toBe(server.id);
 
     // Second consume returns null (row deleted).
@@ -297,7 +300,7 @@ describe("mcp_oauth_pending (state PK)", () => {
         authorizeUrl: `https://issuer-${suffix}.example.com/authorize`,
         tokenUrl: `https://issuer-${suffix}.example.com/token`,
         dcrClientId: `client-${suffix}`,
-        dcrClientSecret: `secret-${suffix}`,
+        dcrClientSecret: `example-secret-${suffix}`,
         redirectUri: "https://swarm.example.com/cb",
       });
     }
@@ -306,13 +309,13 @@ describe("mcp_oauth_pending (state PK)", () => {
       resourceUrl: "https://resource-b.example.com",
       tokenUrl: "https://issuer-b.example.com/token",
       dcrClientId: "client-b",
-      dcrClientSecret: "secret-b",
+      dcrClientSecret: "example-secret-b",
     });
     expect(await consumeMcpOAuthPending("state-a")).toMatchObject({
       resourceUrl: "https://resource-a.example.com",
       tokenUrl: "https://issuer-a.example.com/token",
       dcrClientId: "client-a",
-      dcrClientSecret: "secret-a",
+      dcrClientSecret: "example-secret-a",
     });
   });
 
@@ -328,7 +331,7 @@ describe("mcp_oauth_pending (state PK)", () => {
       authorizeUrl: "https://replacement-issuer.example.com/authorize",
       tokenUrl: "https://replacement-issuer.example.com/token",
       dcrClientId: "replacement-client",
-      dcrClientSecret: "replacement-secret",
+      dcrClientSecret: "example-replacement-secret",
       redirectUri: "https://swarm.example.com/cb",
     });
 
@@ -394,7 +397,7 @@ describe("findReusableMcpOAuthClient / invalidateMcpOAuthClient", () => {
     const reusable = await findReusableMcpOAuthClient(server.id);
     expect(reusable).toMatchObject({
       clientId: "client-abc",
-      clientSecret: "dcr-secret-xyz",
+      clientSecret: "example-dcr-secret-xyz",
       authorizationServerIssuer: "https://issuer.example.com",
       registrationEndpoint: "https://issuer.example.com/register",
       clientSource: "dcr",
@@ -431,7 +434,7 @@ describe("findReusableMcpOAuthClient / invalidateMcpOAuthClient", () => {
       authorizeUrl: "https://issuer.example.com/authorize",
       tokenUrl: "https://issuer.example.com/token",
       dcrClientId: "pending-client",
-      dcrClientSecret: "pending-secret",
+      dcrClientSecret: "example-pending-secret",
       redirectUri: "https://swarm.example.com/cb",
     });
 
@@ -440,7 +443,7 @@ describe("findReusableMcpOAuthClient / invalidateMcpOAuthClient", () => {
     const reusable = await findReusableMcpOAuthClient(server.id);
     expect(reusable).toMatchObject({
       clientId: "pending-client",
-      clientSecret: "pending-secret",
+      clientSecret: "example-pending-secret",
       authorizationServerIssuer: "https://issuer.example.com",
       registrationEndpoint: "https://issuer.example.com/register",
     });
@@ -463,7 +466,7 @@ describe("findReusableMcpOAuthClient / invalidateMcpOAuthClient", () => {
       authorizeUrl: "https://issuer.example.com/authorize",
       tokenUrl: "https://issuer.example.com/token",
       dcrClientId: "pending-client",
-      dcrClientSecret: "pending-secret",
+      dcrClientSecret: "example-pending-secret",
       redirectUri: "https://swarm.example.com/cb",
     });
     const after = (
@@ -491,7 +494,7 @@ describe("findReusableMcpOAuthClient / invalidateMcpOAuthClient", () => {
 
     // A fresh legitimate write (e.g. re-registering after invalidation)
     // clears the flag again.
-    await upsertMcpOAuthToken({ ...base(server.id), accessToken: "fresh-access" });
+    await upsertMcpOAuthToken({ ...base(server.id), accessToken: "example-fresh-access" });
     expect(await findReusableMcpOAuthClient(server.id)).not.toBeNull();
   });
 

package/src/tests/mcp-oauth-resolve-secrets.test.ts

@@ -81,7 +81,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     await setMcpServerAuthMethod(mcp.id, "oauth");
     await upsertMcpOAuthToken({
       mcpServerId: mcp.id,
-      accessToken: "bearer-live-123",
+      accessToken: "example-bearer-live-123",
       refreshToken: null,
       expiresAt: new Date(Date.now() + 3600_000).toISOString(), // fresh, no refresh path
       resourceUrl: "https://mcp.example.com/",
@@ -96,7 +96,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     const match = result.servers.find((s) => s.id === mcp.id);
     expect(match).toBeTruthy();
     expect(match!.authMethod).toBe("oauth");
-    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer bearer-live-123");
+    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer example-bearer-live-123");
     expect(match!.authError).toBeNull();
   });
 
@@ -122,7 +122,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     await setMcpServerAuthMethod(mcp.id, "oauth");
     await upsertMcpOAuthToken({
       mcpServerId: mcp.id,
-      accessToken: "lowercase-token-xyz",
+      accessToken: "example-lowercase-token-xyz",
       refreshToken: null,
       tokenType: "bearer", // lowercase, as RFC 6749 prescribes
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
@@ -137,7 +137,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     const result = await agentMcpServers(agent.id);
     const match = result.servers.find((s) => s.id === mcp.id);
     expect(match).toBeTruthy();
-    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer lowercase-token-xyz");
+    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer example-lowercase-token-xyz");
     expect(match!.resolvedHeaders?.Authorization?.startsWith("Bearer ")).toBe(true);
   });
 
@@ -161,7 +161,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     await setMcpServerAuthMethod(mcp.id, "oauth");
     await upsertMcpOAuthToken({
       mcpServerId: mcp.id,
-      accessToken: "mac-token-xyz",
+      accessToken: "example-mac-token-xyz",
       refreshToken: null,
       tokenType: "MAC",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
@@ -176,7 +176,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     const result = await agentMcpServers(agent.id);
     const match = result.servers.find((s) => s.id === mcp.id);
     expect(match).toBeTruthy();
-    expect(match!.resolvedHeaders?.Authorization).toBe("MAC mac-token-xyz");
+    expect(match!.resolvedHeaders?.Authorization).toBe("MAC example-mac-token-xyz");
   });
 
   test("OAuth server without token row surfaces authError", async () => {
@@ -261,7 +261,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     await setMcpServerAuthMethod(mcp.id, "oauth");
     await upsertMcpOAuthToken({
       mcpServerId: mcp.id,
-      accessToken: "new-bearer",
+      accessToken: "example-new-bearer",
       refreshToken: null,
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
       resourceUrl: "https://mcp.example.com/",
@@ -274,7 +274,7 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
 
     const result = await agentMcpServers(agent.id);
     const match = result.servers.find((s) => s.id === mcp.id);
-    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer new-bearer");
+    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer example-new-bearer");
   });
 
   test("static server retains default authError=null in the response shape", async () => {

package/src/tests/mcp-oauth-wrapper.test.ts

@@ -389,7 +389,7 @@ describe("registerClient (RFC 7591 DCR)", () => {
       return new Response(
         JSON.stringify({
           client_id: "issued-id",
-          client_secret: "issued-secret",
+          client_secret: "example-issued-secret",
           client_id_issued_at: 1700000000,
         }),
         { status: 201, headers: { "Content-Type": "application/json" } },
@@ -404,7 +404,7 @@ describe("registerClient (RFC 7591 DCR)", () => {
     });
 
     expect(res.client_id).toBe("issued-id");
-    expect(res.client_secret).toBe("issued-secret");
+    expect(res.client_secret).toBe("example-issued-secret");
     expect(capturedBody).toBeTruthy();
     expect(JSON.parse(capturedBody!).client_name).toBe("agent-swarm");
   });
@@ -471,7 +471,7 @@ describe("exchangeCodeForTokens", () => {
     const res = await exchangeCodeForTokens({
       tokenUrl: "https://as.example.com/token",
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_post",
       redirectUri: "https://swarm.example.com/callback",
       code: "authcode-1",
@@ -485,7 +485,7 @@ describe("exchangeCodeForTokens", () => {
     expect(params.get("code")).toBe("authcode-1");
     expect(params.get("code_verifier")).toBe("verifier-1");
     expect(params.get("resource")).toBe("https://mcp.example.com/");
-    expect(params.get("client_secret")).toBe("secret-xyz");
+    expect(params.get("client_secret")).toBe("example-secret-xyz");
     expect(res.access_token).toBe("at-1");
   });
 
@@ -551,8 +551,8 @@ describe("refreshMcpToken", () => {
   });
 
   test("scrubs an echoed client_secret/refresh_token from the thrown error body", async () => {
-    const clientSecret = "super-secret-client-value-123456";
-    const refreshToken = "super-secret-refresh-value-654321";
+    const clientSecret = "example-super-secret-client-value-123456";
+    const refreshToken = "example-super-secret-refresh-value-654321";
     globalThis.fetch = async () =>
       new Response(
         JSON.stringify({
@@ -706,7 +706,7 @@ describe("token-endpoint client authentication is applied per the registered met
     await exchangeCodeForTokens({
       tokenUrl: "https://as.example.com/token",
       clientId: creds.clientId ?? "client-xyz",
-      clientSecret: creds.clientSecret ?? "secret-xyz",
+      clientSecret: creds.clientSecret ?? "example-secret-xyz",
       tokenEndpointAuthMethod,
       redirectUri: "https://swarm.example.com/callback",
       code: "authcode-1",
@@ -719,7 +719,7 @@ describe("token-endpoint client authentication is applied per the registered met
   test("client_secret_basic → Authorization: Basic header, no creds in the body", async () => {
     const { params, headers } = await captureExchange("client_secret_basic");
     expect(headers.Authorization).toBe(
-      `Basic ${Buffer.from("client-xyz:secret-xyz").toString("base64")}`,
+      `Basic ${Buffer.from("client-xyz:example-secret-xyz").toString("base64")}`,
     );
     expect(params.get("client_id")).toBeNull();
     expect(params.get("client_secret")).toBeNull();
@@ -729,7 +729,7 @@ describe("token-endpoint client authentication is applied per the registered met
     const { params, headers } = await captureExchange("client_secret_post");
     expect(headers.Authorization).toBeUndefined();
     expect(params.get("client_id")).toBe("client-xyz");
-    expect(params.get("client_secret")).toBe("secret-xyz");
+    expect(params.get("client_secret")).toBe("example-secret-xyz");
   });
 
   test("none → client_id only in the body, no secret anywhere", async () => {
@@ -821,7 +821,7 @@ describe("token-endpoint client authentication is applied per the registered met
     await exchangeCodeForTokens({
       tokenUrl: "https://as.example.com/token",
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_post",
       redirectUri: "https://swarm.example.com/callback",
       code,
@@ -836,7 +836,7 @@ describe("token-endpoint client authentication is applied per the registered met
   });
 
   test("a form-encoded refresh token is redacted on a failed refresh", async () => {
-    const refreshToken = "rt+slash/eq=";
+    const refreshToken = "example-rt+slash/eq=";
     const encoded = new URLSearchParams({ v: refreshToken }).toString().slice(2);
     globalThis.fetch = async () =>
       new Response(`{"detail":"refresh_token=${encoded}"}`, { status: 400 });
@@ -844,7 +844,7 @@ describe("token-endpoint client authentication is applied per the registered met
     await refreshMcpToken({
       tokenUrl: "https://as.example.com/token",
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_post",
       refreshToken,
       resource: "https://mcp.example.com/",
@@ -856,7 +856,7 @@ describe("token-endpoint client authentication is applied per the registered met
   });
 
   test("a form-encoded revoked token is redacted on a failed revocation", async () => {
-    const token = "tok+slash/eq=";
+    const token = "example-tok+slash/eq=";
     const encoded = new URLSearchParams({ v: token }).toString().slice(2);
     globalThis.fetch = async () => new Response(`{"detail":"token=${encoded}"}`, { status: 400 });
 
@@ -864,7 +864,7 @@ describe("token-endpoint client authentication is applied per the registered met
       revocationUrl: "https://as.example.com/revoke",
       token,
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_post",
     }).catch((err: Error) => {
       expect(err.message).toContain("Token revocation failed (400)");
@@ -876,7 +876,7 @@ describe("token-endpoint client authentication is applied per the registered met
   test("an upstream error body echoing the client secret is scrubbed before it is thrown", async () => {
     // The callback logs this message AND reflects it into the dashboard
     // redirect as error_description, so an echoed credential would escape.
-    const secret = "sk-echoed-secret-value-1234567890";
+    const secret = "example-echoed-client-secret-value";
     globalThis.fetch = async () =>
       new Response(`{"error":"invalid_client","detail":"bad client_secret: ${secret}"}`, {
         status: 401,
@@ -910,14 +910,14 @@ describe("token-endpoint client authentication is applied per the registered met
   });
 
   test("a revocation error body echoing the token is scrubbed before it is thrown", async () => {
-    const token = "rt-echoed-refresh-token-0987654321";
+    const token = "example-rt-echoed-refresh-token-0987654321";
     globalThis.fetch = async () => new Response(`{"error":"bad token: ${token}"}`, { status: 400 });
 
     await revokeMcpToken({
       revocationUrl: "https://as.example.com/revoke",
       token,
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_post",
     }).catch((err: Error) => {
       expect(err.message).toContain("Token revocation failed (400)");
@@ -929,7 +929,7 @@ describe("token-endpoint client authentication is applied per the registered met
     for (const missing of [undefined, null, "some-unknown-method"]) {
       const { params, headers } = await captureExchange(missing);
       expect(headers.Authorization).toBe(
-        `Basic ${Buffer.from("client-xyz:secret-xyz").toString("base64")}`,
+        `Basic ${Buffer.from("client-xyz:example-secret-xyz").toString("base64")}`,
       );
       expect(params.get("client_id")).toBeNull();
       expect(params.get("client_secret")).toBeNull();
@@ -980,7 +980,7 @@ describe("token-endpoint client authentication is applied per the registered met
     await refreshMcpToken({
       tokenUrl: "https://as.example.com/token",
       clientId: "client-xyz",
-      clientSecret: "secret-xyz",
+      clientSecret: "example-secret-xyz",
       tokenEndpointAuthMethod: "client_secret_basic",
       refreshToken: "rt-abc",
       resource: "https://mcp.example.com/",
@@ -988,7 +988,7 @@ describe("token-endpoint client authentication is applied per the registered met
 
     const params = new URLSearchParams(capturedBody);
     expect(capturedHeaders.Authorization).toBe(
-      `Basic ${Buffer.from("client-xyz:secret-xyz").toString("base64")}`,
+      `Basic ${Buffer.from("client-xyz:example-secret-xyz").toString("base64")}`,
     );
     expect(params.get("client_id")).toBeNull();
     expect(params.get("client_secret")).toBeNull();

package/src/tests/mcp-user-route.test.ts

@@ -23,7 +23,7 @@ import { handleMcpUser } from "../http/mcp-user";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-mcp-user-route.sqlite";
-const API_KEY = "test-mcp-user-key";
+const API_KEY = "example-test-mcp-user-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "test" };
 
 async function removeDbFiles(path: string): Promise<void> {

package/src/tests/memory-edges.test.ts

@@ -32,7 +32,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-edges-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/memory-edit-authorization.test.ts

@@ -293,3 +293,35 @@ test("boot re-embedding still updates rows belonging to multiple agents", async
     });
   }
 });
+
+// Regression: memories written while no embedding key was configured have
+// embedding = NULL, not a wrong-dimension value. The backfill used to only
+// target `embedding IS NOT NULL AND length != N`, so these rows were never
+// swept once a key landed — the customer-reported symptom (60 memories with
+// 0 embeddings, permanently stuck on FTS/keyword fallback).
+test("boot re-embedding backfills rows that never got an embedding at all", async () => {
+  const memory = await store.store({
+    agentId: owner,
+    scope: "agent",
+    name: randomUUID(),
+    content: "never embedded",
+    source: "manual",
+  });
+  const before = await getDbClient().get<{ embedding: unknown }>(
+    "SELECT embedding FROM agent_memory WHERE id = ?",
+    [memory.id],
+  );
+  expect(before?.embedding).toBeNull();
+
+  await runBootReembed();
+
+  const row = await getDbClient().get(
+    "SELECT agentId, length(embedding) AS bytes, embeddingModel FROM agent_memory WHERE id = ?",
+    [memory.id],
+  );
+  expect(row).toEqual({
+    agentId: memory.agentId,
+    bytes: EMBEDDING_DIMENSIONS * 4,
+    embeddingModel: provider.name,
+  });
+});

package/src/tests/memory-rate-endpoint.test.ts

@@ -20,7 +20,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rate-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/memory-rate-tool.test.ts

@@ -64,7 +64,7 @@ const memoryId = "22222222-2222-4222-8222-222222222222";
 describe("memory_rate MCP tool", () => {
   beforeEach(() => {
     process.env.MCP_BASE_URL = "http://test-host:9999";
-    process.env.API_KEY = "test-key";
+    process.env.API_KEY = "example-test-key";
   });
 
   afterEach(() => {
@@ -89,7 +89,7 @@ describe("memory_rate MCP tool", () => {
     expect(calls[0]!.init?.method).toBe("POST");
     const headers = calls[0]!.init?.headers as Record<string, string>;
     expect(headers["X-Agent-ID"]).toBe("agent-abc");
-    expect(headers.Authorization).toBe("Bearer test-key");
+    expect(headers.Authorization).toBe("Bearer example-test-key");
     const body = JSON.parse(calls[0]!.init?.body as string);
     expect(body).toEqual({
       events: [

package/src/tests/memory-rater-e2e.test.ts

@@ -49,7 +49,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rater-e2e-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 let store: SqliteMemoryStore;

package/src/tests/memory-rater-llm-summarizer.test.ts

@@ -113,7 +113,7 @@ describe("runMemoryRater — request shape", () => {
 
     const result = await runMemoryRater({
       prompt: "test prompt",
-      apiKey: "test-api-key-123",
+      apiKey: "example-test-api-key-123",
       fetchImpl: fakeFetch,
     });
 
@@ -125,7 +125,7 @@ describe("runMemoryRater — request shape", () => {
 
     const headers = capturedInit?.headers as Record<string, string>;
     expect(headers["Content-Type"]).toBe("application/json");
-    expect(headers.Authorization).toBe("Bearer test-api-key-123");
+    expect(headers.Authorization).toBe("Bearer example-test-api-key-123");
 
     const body = JSON.parse(String(capturedInit?.body));
     expect(body.model).toBe(DEFAULT_MEMORY_RATER_MODEL);
@@ -151,7 +151,7 @@ describe("runMemoryRater — request shape", () => {
 
       const result = await runMemoryRater({
         prompt: "test prompt",
-        apiKey: "test-api-key-123",
+        apiKey: "example-test-api-key-123",
         fetchImpl: fakeFetch,
       });
 

package/src/tests/memory-rater-llm.test.ts

@@ -520,7 +520,7 @@ describe("LlmRater.rate(ctx) — per-memory path with MockLlmRaterClient", () =>
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rater-llm-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/model-control.test.ts

@@ -560,6 +560,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         model: "gpt-5.5",
       }).model,
@@ -583,6 +584,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         effort: "xhigh",
       }).effort,
@@ -591,6 +593,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         effort: "max",
       }).effort,

package/src/tests/multi-runtime-enabled-stats.test.ts

@@ -89,11 +89,11 @@ afterAll(async () => {
 });
 
 describe("MULTI_RUNTIME_ENABLED on the authenticated stats endpoint", () => {
-  test("reports false when the flag is unset — multi-runtime is opt-in", async () => {
+  test("reports true when the flag is unset", async () => {
     await withMultiRuntime(undefined, async () => {
       const stats = await api("GET", "/api/stats");
       expect(stats.status).toBe(200);
-      expect(stats.body.multiRuntimeEnabled).toBe(false);
+      expect(stats.body.multiRuntimeEnabled).toBe(true);
     });
   });