@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/scripts-mcp-e2e.test.ts

@@ -10,6 +10,7 @@ import { handleCore } from "../http/core";
 import { handleScriptRuns } from "../http/script-runs";
 import { handleScripts } from "../http/scripts";
 import { getPathSegments, parseQueryParams } from "../http/utils";
+import { proxyScriptsApi } from "../tools/script-common";
 import { registerScriptDeleteTool } from "../tools/script-delete";
 import { registerScriptRunTool } from "../tools/script-run";
 import { registerScriptRunsTools } from "../tools/script-runs";
@@ -22,7 +23,7 @@ import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 import "../prompts/session-templates";
 
 const TEST_DB_PATH = "./test-scripts-mcp-e2e.sqlite";
-const API_KEY = "test-scripts-mcp-key-1234567890";
+const API_KEY = "example-test-scripts-mcp-key-1234567890";
 const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 function fakeEmbedding(text: string): Float32Array {
@@ -221,6 +222,85 @@ beforeEach(async () => {
 });
 
 describe("script_ MCP HTTP proxy tools", () => {
+  test.each([200, 502])("rejects HTML responses with HTTP %i", async (status) => {
+    const tools = buildToolServer();
+    const html = "<!doctype html><html><body>Static site fallback</body></html>";
+    const previousFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(html, {
+        status,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      })) as typeof globalThis.fetch;
+    try {
+      const result = (await tools.listScriptRuns.handler(
+        { limit: 10, offset: 0 },
+        meta(workerId),
+      )) as StructuredResult<unknown>;
+
+      expect(result.isError).toBe(true);
+      expect(result.structuredContent.success).toBe(false);
+      expect(result.structuredContent.status).toBe(status);
+      expect(result.structuredContent.message).toContain("non-JSON");
+      expect(result.structuredContent.message).toContain(`HTTP ${status}`);
+      expect(result.structuredContent.message).toContain("text/html");
+      expect(result.content[0]?.text).toContain(html);
+      expect(result.content[0]?.text).not.toContain("Found 0 script run(s)");
+    } finally {
+      globalThis.fetch = previousFetch;
+    }
+  });
+
+  test("caps invalid JSON diagnostics without retaining the full body", async () => {
+    const body = `<html>${"x".repeat(20_000)}BODY_TAIL</html>`;
+    const previousFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(body, {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })) as typeof globalThis.fetch;
+    try {
+      const result = await proxyScriptsApi({
+        method: "GET",
+        path: "/api/script-runs",
+        requestInfo: {
+          sessionId: "s",
+          agentId: workerId,
+          runtimeInstanceId: undefined,
+          sourceTaskId: undefined,
+          contextKey: undefined,
+          callOrigin: "mcp",
+        },
+        successMessage: () => {
+          throw new Error("Invalid JSON must not reach the success callback");
+        },
+        uncappedDetails: true,
+      });
+
+      expect(result.ok).toBe(false);
+      expect(result.message).toContain("application/json");
+      expect(result.details).toContain("<html>");
+      expect(result.details).toContain("[truncated");
+      expect(result.details?.length).toBeLessThan(16_100);
+      expect(JSON.stringify(result)).not.toContain("BODY_TAIL");
+    } finally {
+      globalThis.fetch = previousFetch;
+    }
+  });
+
+  test("reports a legitimate JSON empty run list as success", async () => {
+    const tools = buildToolServer();
+    const result = (await tools.listScriptRuns.handler(
+      { limit: 10, offset: 0 },
+      meta(workerId),
+    )) as StructuredResult<{ total: number; runs: unknown[] }>;
+
+    expect(result.isError).toBeFalsy();
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.status).toBe(200);
+    expect(result.structuredContent.data?.runs).toEqual([]);
+    expect(result.structuredContent.message).toBe("Found 0 script run(s).");
+  });
+
   test("upserts the canonical script authoring contract example verbatim", async () => {
     const tools = buildToolServer();
     // The authoring contract lives in the seeded `swarm-scripts` skill since

package/src/tests/scripts-only-gating.test.ts

@@ -17,6 +17,8 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-scripts-only-gating.sqlite";
 const SCRIPT_TOOL_NAMES = [
+  "extension-install",
+  "extension-list",
   "get-script-run",
   "launch-script-run",
   "list-script-runs",
@@ -193,8 +195,8 @@ beforeEach(async () => {
   await scriptsOnlyEnvQueue;
   savedSlackBotToken = process.env.SLACK_BOT_TOKEN;
   savedSlackAppToken = process.env.SLACK_APP_TOKEN;
-  process.env.SLACK_BOT_TOKEN = "test-bot-token";
-  process.env.SLACK_APP_TOKEN = "test-app-token";
+  process.env.SLACK_BOT_TOKEN = "example-test-bot-token";
+  process.env.SLACK_APP_TOKEN = "example-test-app-token";
   await getDbClient().run("DELETE FROM swarm_config WHERE key = 'SCRIPTS_ONLY_MCP'");
 });
 

package/src/tests/scripts-retention.test.ts

@@ -39,7 +39,7 @@ async function addScript(name: string, isScratch: boolean) {
 
 describe("scratch script retention", () => {
   beforeAll(async () => {
-    process.env.AGENT_SWARM_API_KEY = "scripts-retention-test-key";
+    process.env.AGENT_SWARM_API_KEY = "example-scripts-retention-test-key";
     await clearDb();
     initDb(TEST_DB_PATH);
   });

package/src/tests/scripts-runtime-identity.test.ts

@@ -30,7 +30,7 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-scripts-runtime-identity.sqlite";
 let baseUrl = "";
-const API_KEY = "scripts-runtime-identity-key-1234567890";
+const API_KEY = "example-scripts-runtime-identity-key-1234567890";
 const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const savedEnv = { ...process.env };
@@ -374,7 +374,7 @@ describe("script SDK dispatch hits the real runtime gates", () => {
   });
 
   test("with the flag off, the SDK dispatches without runtime identity as before", async () => {
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     const agentId = await makeAgent(1);
     const task = await createTaskExtended("legacy-claim-work");
 

package/src/tests/scripts-runtime-secret-egress.test.ts

@@ -14,7 +14,7 @@ const savedEnv = { ...process.env };
 const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 beforeEach(() => {
-  process.env.AGENT_SWARM_API_KEY = "runtime-egress-secret-1234567890";
+  process.env.AGENT_SWARM_API_KEY = "example-runtime-egress-secret-1234567890";
   refreshSecretScrubberCache();
 });
 

package/src/tests/scripts-runtime.test.ts

@@ -15,7 +15,7 @@ const resources = { memoryMb: 2048, cpuTimeSec: 20, maxStdoutBytes: 1_048_576 };
 const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 beforeEach(() => {
-  process.env.AGENT_SWARM_API_KEY = "runtime-test-secret-1234567890";
+  process.env.AGENT_SWARM_API_KEY = "example-runtime-test-secret-1234567890";
   delete process.env.API_KEY;
   process.env.MCP_BASE_URL = "http://localhost:3013";
   refreshSecretScrubberCache();
@@ -99,7 +99,9 @@ describe("runScript", () => {
     const server = Bun.serve({
       port: 0,
       async fetch(req) {
-        expect(req.headers.get("authorization")).toBe("Bearer runtime-test-secret-1234567890");
+        expect(req.headers.get("authorization")).toBe(
+          "Bearer example-runtime-test-secret-1234567890",
+        );
         expect(req.headers.get("x-agent-id")).toBe("agent-1");
 
         const url = new URL(req.url);
@@ -280,8 +282,8 @@ describe("runScript", () => {
   });
 
   spawnTest("subprocess env is stripped to the explicit allowlist", async () => {
-    process.env.API_KEY = "legacy-secret-that-must-not-leak";
-    process.env.AGENT_SWARM_API_KEY = "preferred-secret-that-must-not-leak";
+    process.env.API_KEY = "example-legacy-secret-that-must-not-leak";
+    process.env.AGENT_SWARM_API_KEY = "example-preferred-secret-that-must-not-leak";
     refreshSecretScrubberCache();
 
     const output = await runScript({

package/src/tests/scripts-typecheck.test.ts

@@ -47,6 +47,27 @@ afterAll(async () => {
 });
 
 describe("typecheckScript", () => {
+  test("task_send requires a routing note for explicit assignments at typecheck", async () => {
+    const missing = await typecheckScript(`
+      import type { ScriptContext } from "swarm-sdk";
+      export default async function(args: unknown, ctx: ScriptContext) {
+        return ctx.swarm.task_send({ task: "work", agentId: "worker", routingReason: "skill" });
+      }
+    `);
+    expect(missing.ok).toBe(false);
+    if (!missing.ok) expect(missing.diagnostics.join("\n")).toContain("routingNote");
+
+    const valid = await typecheckScript(`
+      import type { ScriptContext } from "swarm-sdk";
+      export default async function(args: unknown, ctx: ScriptContext) {
+        await ctx.swarm.task_send({ task: "work", agentId: "worker", routingReason: "skill", routingNote: "Owns this code path" });
+        await ctx.swarm.task_send({ task: "pool work" });
+        await ctx.swarm.task_send({ task: "continue", parentTaskId: "parent" });
+      }
+    `);
+    expect(valid).toEqual({ ok: true });
+  });
+
   test("task_defer accepts task wakeOn with a required caller-supplied ceiling", async () => {
     const result = await typecheckScript(`
       import type { ScriptContext } from "swarm-sdk";

package/src/tests/sdk-allowlist.test.ts

@@ -220,7 +220,7 @@ describe("script SDK allowlist", () => {
 
 describe("mcp-bridge allowlist gate", () => {
   const TEST_DB_PATH = "./test-sdk-allowlist-bridge.sqlite";
-  const API_KEY = "test-mcp-bridge-key-1234567890";
+  const API_KEY = "example-test-mcp-bridge-key-1234567890";
   let prevApiKey: string | undefined;
   let oversizedTaskId: string;
 

package/src/tests/secret-scrubber.test.ts

@@ -67,23 +67,23 @@ describe("scrubSecrets — env-based replacement", () => {
   });
 
   test("redacts any key with _API_KEY suffix", () => {
-    process.env.FOO_SERVICE_API_KEY = "supersecretFooApiKey_longerthan12chars";
+    process.env.FOO_SERVICE_API_KEY = "example-supersecretFooApiKey_longerthan12chars";
     refreshSecretScrubberCache();
-    const out = scrubSecrets("key=supersecretFooApiKey_longerthan12chars tail");
+    const out = scrubSecrets("key=example-supersecretFooApiKey_longerthan12chars tail");
     expect(out).toBe("key=[REDACTED:FOO_SERVICE_API_KEY] tail");
   });
 
   test("redacts any key with _TOKEN suffix", () => {
-    process.env.WEIRD_SERVICE_TOKEN = "weirdserviceTOKENvalue_1234567890";
+    process.env.WEIRD_SERVICE_TOKEN = "example-weirdserviceTOKENvalue_1234567890";
     refreshSecretScrubberCache();
-    const out = scrubSecrets("t=weirdserviceTOKENvalue_1234567890");
+    const out = scrubSecrets("t=example-weirdserviceTOKENvalue_1234567890");
     expect(out).toBe("t=[REDACTED:WEIRD_SERVICE_TOKEN]");
   });
 
   test("redacts any key with _SECRET suffix", () => {
-    process.env.MY_OAUTH_CLIENT_SECRET = "oauthsecret_verylong_1234567890abcdef";
+    process.env.MY_OAUTH_CLIENT_SECRET = "example-oauthsecret_verylong_1234567890abcdef";
     refreshSecretScrubberCache();
-    const out = scrubSecrets("secret=oauthsecret_verylong_1234567890abcdef");
+    const out = scrubSecrets("secret=example-oauthsecret_verylong_1234567890abcdef");
     expect(out).toBe("secret=[REDACTED:MY_OAUTH_CLIENT_SECRET]");
   });
 
@@ -111,10 +111,11 @@ describe("scrubSecrets — env-based replacement", () => {
 
   test("handles comma-separated pool values (scrubs both the full pool and each component)", () => {
     process.env.POOL_TOKEN =
-      "ghp_poolfirst1234567890abcdefABCDEF1234567890,ghp_poolsecond1234567890abcdef1234567890AB";
+      "example-ghp_poolfirst1234567890abcdefABCDEF1234567890," +
+      "example-ghp_poolsecond1234567890abcdef1234567890AB";
     refreshSecretScrubberCache();
-    const out = scrubSecrets("using ghp_poolfirst1234567890abcdefABCDEF1234567890");
-    expect(out).not.toContain("ghp_poolfirst1234567890abcdefABCDEF1234567890");
+    const out = scrubSecrets("using example-ghp_poolfirst1234567890abcdefABCDEF1234567890");
+    expect(out).not.toContain("example-ghp_poolfirst1234567890abcdefABCDEF1234567890");
     expect(out).toContain("[REDACTED:");
   });
 
@@ -123,7 +124,8 @@ describe("scrubSecrets — env-based replacement", () => {
     process.env.OPENAI_API_KEY = "sk-proj-abcd1234567890EFGHefgh1234567890";
     refreshSecretScrubberCache();
     const input =
-      "gh=ghp_abcdefghijklmnopqrstuvwxyz0123456789 and openai=sk-proj-abcd1234567890EFGHefgh1234567890";
+      "gh=example-ghp_abcdefghijklmnopqrstuvwxyz0123456789 " +
+      "and openai=example-sk-proj-abcd1234567890EFGHefgh1234567890";
     const out = scrubSecrets(input);
     expect(out).toContain("[REDACTED:GITHUB_TOKEN]");
     expect(out).toContain("[REDACTED:OPENAI_API_KEY]");
@@ -146,63 +148,65 @@ describe("scrubSecrets — env-based replacement", () => {
     const out1 = scrubSecrets("no secret yet here_abcdefghij");
     expect(out1).toBe("no secret yet here_abcdefghij");
 
-    process.env.NEW_SERVICE_API_KEY = "here_abcdefghij_andmore1234567890";
+    process.env.NEW_SERVICE_API_KEY = "example-here_abcdefghij_andmore1234567890";
     refreshSecretScrubberCache();
-    const out2 = scrubSecrets("value=here_abcdefghij_andmore1234567890");
+    const out2 = scrubSecrets("value=example-here_abcdefghij_andmore1234567890");
     expect(out2).toBe("value=[REDACTED:NEW_SERVICE_API_KEY]");
   });
 });
 
 describe("scrubSecrets — regex patterns", () => {
   test("redacts github_pat_ fine-grained PATs", () => {
-    const out = scrubSecrets("PAT: github_pat_11B4WKYAA0Qe95fajGmt3o_ABCDEF1234567890abcdef");
+    const token = `github_pat_${"a".repeat(32)}`;
+    const out = scrubSecrets(`PAT: ${token}`);
     expect(out).toContain("[REDACTED:github_pat]");
-    expect(out).not.toContain("github_pat_11B4WKYAA");
+    expect(out).not.toContain(token);
   });
 
   test("redacts ghp_ classic tokens", () => {
-    const out = scrubSecrets("PAT: ghp_1234567890abcdefABCDEF1234567890ABCD end");
+    const out = scrubSecrets("PAT: example-ghp_1234567890abcdefABCDEF1234567890ABCD end");
     expect(out).toContain("[REDACTED:github_token]");
     expect(out).not.toContain("ghp_1234567890abcdef");
   });
 
   test("redacts gho_ OAuth tokens", () => {
-    const out = scrubSecrets("OAuth: gho_abcdef1234567890ABCDEF1234567890abcd");
+    const out = scrubSecrets("OAuth: example-gho_abcdef1234567890ABCDEF1234567890abcd");
     expect(out).toContain("[REDACTED:github_token]");
   });
 
   test("redacts ghs_ installation tokens", () => {
-    const out = scrubSecrets("Installation: ghs_abcdef1234567890ABCDEF1234567890abcd");
+    const out = scrubSecrets("Installation: example-ghs_abcdef1234567890ABCDEF1234567890abcd");
     expect(out).toContain("[REDACTED:github_token]");
   });
 
   test("redacts glpat- GitLab PATs", () => {
-    const out = scrubSecrets("GL: glpat-abcdef1234567890ABCDEFgh");
+    const out = scrubSecrets("GL: example-glpat-abcdef1234567890ABCDEFgh");
     expect(out).toContain("[REDACTED:gitlab_pat]");
     expect(out).not.toContain("glpat-abcdef");
   });
 
   test("redacts sk-ant- Anthropic keys", () => {
-    const out = scrubSecrets("Anthropic: sk-ant-api03-abc123def456ghi789jkl012mno345");
+    const token = `sk-ant-${"a".repeat(32)}`;
+    const out = scrubSecrets(`Anthropic: ${token}`);
     expect(out).toContain("[REDACTED:anthropic_key]");
-    expect(out).not.toContain("sk-ant-api03");
+    expect(out).not.toContain(token);
   });
 
   test("redacts sk-proj- OpenAI project keys (preferred over legacy sk-)", () => {
-    const out = scrubSecrets("OpenAI: sk-proj-abcdefghijklmnopqrstuvwxyz012345");
+    const out = scrubSecrets("OpenAI: example-sk-proj-abcdefghijklmnopqrstuvwxyz012345");
     expect(out).toContain("[REDACTED:openai_proj_key]");
     expect(out).not.toContain("sk-proj-abcdefghijkl");
   });
 
   test("redacts legacy sk- keys (catch-all)", () => {
-    const out = scrubSecrets("Legacy: sk-abcdefghijklmnopqrstuvwxyz0123");
+    const out = scrubSecrets("Legacy: example-sk-abcdefghijklmnopqrstuvwxyz0123");
     expect(out).toContain("[REDACTED:sk_key]");
   });
 
   test("redacts Slack xoxb tokens", () => {
-    const out = scrubSecrets("slack=xoxb-1234567890-0987654321-abcdefghij");
+    const out = scrubSecrets("slack=example-xoxb-1234567890-0987654321-abcdefghij");
     expect(out).toContain("[REDACTED:slack_token]");
-    expect(out).not.toContain("xoxb-1234567890");
+    expect(out).not.toContain("example-xoxb-1234567890");
   });
 
   test("redacts AWS access key IDs", () => {
@@ -228,7 +232,7 @@ describe("scrubSecrets — regex patterns", () => {
 
   test("regex patterns catch tokens even when env is empty", () => {
     // Fresh env — no secrets registered — regex should still catch well-known shapes.
-    const out = scrubSecrets("token=ghp_1234567890abcdefABCDEF1234567890ABCD");
+    const out = scrubSecrets("token=example-ghp_1234567890abcdefABCDEF1234567890ABCD");
     expect(out).toContain("[REDACTED:github_token]");
   });
 
@@ -241,7 +245,7 @@ describe("scrubSecrets — regex patterns", () => {
   });
 
   test("redacts Linear OAuth tokens", () => {
-    const out = scrubSecrets("Authorization: Bearer lin_oauth_test123abcdef end");
+    const out = scrubSecrets("Authorization: Bearer example-lin_oauth_test123abcdef end");
     expect(out).toContain("[REDACTED:linear_oauth]");
     expect(out).not.toContain("lin_oauth_test123");
   });
@@ -279,7 +283,10 @@ describe("scrubSecrets — regex patterns", () => {
   });
 
   test("redacts tokens in double-encoded JSON with escape sequences", () => {
-    const inner = JSON.stringify({ access_token: "lin_oauth_test123abcdef", scope: "read" });
+    const inner = JSON.stringify({
+      access_token: "example-lin_oauth_test123abcdef",
+      scope: "read",
+    });
     const content = `{"output":${JSON.stringify(inner)}}`;
     const out = scrubSecrets(content);
     expect(out).toContain("[REDACTED:linear_oauth]");
@@ -333,14 +340,14 @@ describe("scrubSecrets — does not over-scrub", () => {
 
 describe("scrubObject", () => {
   test("scrubs nested object and array string leaves", () => {
-    process.env.NESTED_TOKEN = "nested-secret-value-1234567890";
+    process.env.NESTED_TOKEN = "example-nested-secret-value-1234567890";
     refreshSecretScrubberCache();
 
     const out = scrubObject({
       keep: 1,
       nested: {
-        secret: "nested-secret-value-1234567890",
-        list: ["safe", "nested-secret-value-1234567890"],
+        secret: "example-nested-secret-value-1234567890",
+        list: ["safe", "example-nested-secret-value-1234567890"],
       },
       nullish: null,
       bool: true,
@@ -371,7 +378,7 @@ describe("registerVolatileSecret", () => {
   });
 
   test("scrubs a runtime-registered volatile secret", () => {
-    const secret = "volatile_runtime_token_1234567890abcdef";
+    const secret = "example-volatile_runtime_token_1234567890abcdef";
     registerVolatileSecret(secret, "RUNTIME_TOKEN");
     const out = scrubSecrets(`key=${secret}`);
     expect(out).toBe("key=[REDACTED:RUNTIME_TOKEN]");

package/src/tests/seed-registry.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
-import { closeDb, initDb, listWorkflows } from "../be/db";
+import { closeDb, getScheduledTasks, initDb, listWorkflows } from "../be/db";
 import { runSeeder, SEEDERS } from "../be/seed";
 import { schedulesSeeder } from "../be/seed/schedules-seeder";
 import { workflowsSeeder } from "../be/seed/workflows-seeder";
@@ -38,17 +38,55 @@ describe("seeder registry", () => {
     ]);
   });
 
-  test("the built-in catalogs expose the expected candidate counts", () => {
-    expect(workflowsSeeder.items()).toHaveLength(5);
-    expect(schedulesSeeder.items()).toHaveLength(5);
+  test("the bundled catalogs include every workflow and schedule template", async () => {
+    for (const [kind, seeder] of [
+      ["workflows", workflowsSeeder],
+      ["schedules", schedulesSeeder],
+    ] as const) {
+      const catalogNames: string[] = [];
+      const catalogDir = `${import.meta.dir}/../../templates/${kind}`;
+      for await (const path of new Bun.Glob("*/config.json").scan(catalogDir)) {
+        const config = await Bun.file(`${catalogDir}/${path}`).json();
+        catalogNames.push(config.name);
+      }
+      expect(
+        seeder
+          .items()
+          .map((item) => item.key)
+          .sort(),
+      ).toEqual(catalogNames.sort());
+    }
   });
 
-  test("seeds all starter workflow and schedule rows on a fresh database", async () => {
+  test("seeds all 21 automation templates on a fresh database and re-runs as a no-op", async () => {
+    expect(await listWorkflows()).toHaveLength(0);
+    expect(await getScheduledTasks()).toHaveLength(0);
+
     const workflowResult = await runSeeder(workflowsSeeder, { quiet: true });
     const scheduleResult = await runSeeder(schedulesSeeder, { quiet: true });
 
-    expect(workflowResult).toMatchObject({ created: 5, failed: [] });
-    expect(scheduleResult).toMatchObject({ created: 5, failed: [] });
-    expect(await listWorkflows()).toHaveLength(5);
+    expect(workflowResult).toMatchObject({ created: 10, failed: [] });
+    expect(scheduleResult).toMatchObject({ created: 11, failed: [] });
+    expect((await listWorkflows()).map((workflow) => workflow.name).sort()).toEqual(
+      workflowsSeeder.items().map((item) => item.key),
+    );
+    expect((await getScheduledTasks()).map((schedule) => schedule.name).sort()).toEqual(
+      schedulesSeeder.items().map((item) => item.key),
+    );
+
+    expect(await runSeeder(workflowsSeeder, { quiet: true })).toMatchObject({
+      created: 0,
+      updated: 0,
+      skippedUnchanged: 10,
+      failed: [],
+    });
+    expect(await runSeeder(schedulesSeeder, { quiet: true })).toMatchObject({
+      created: 0,
+      updated: 0,
+      skippedUnchanged: 11,
+      failed: [],
+    });
+    expect(await listWorkflows()).toHaveLength(10);
+    expect(await getScheduledTasks()).toHaveLength(11);
   });
 });

package/src/tests/seed-schedules.test.ts

@@ -1,6 +1,12 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
-import { closeDb, getScheduledTaskByName, initDb, updateScheduledTask } from "../be/db";
+import {
+  closeDb,
+  getScheduledTaskByName,
+  getScheduledTasks,
+  initDb,
+  updateScheduledTask,
+} from "../be/db";
 import { runSeeder } from "../be/seed";
 import {
   createSchedulesSeeder,
@@ -69,6 +75,7 @@ function zeroConfigScheduleSource(opts?: {
 const ORIGINAL_SEED_AUTOMATIONS_ENABLED = process.env.SEED_AUTOMATIONS_ENABLED;
 
 beforeEach(async () => {
+  delete process.env.SEED_AUTOMATIONS_ENABLED;
   await removeDbFiles();
   initDb(TEST_DB_PATH);
 });
@@ -84,9 +91,9 @@ afterEach(async () => {
 });
 
 describe("schedules seeder", () => {
-  test("loads only the five starter candidates, including the unfenced schedule block", () => {
+  test("loads all eleven schedule templates, including the unfenced schedule block", () => {
     const schedules = loadSeedSchedules();
-    expect(schedules).toHaveLength(5);
+    expect(schedules).toHaveLength(11);
     // Zero-config, requires:[], placeholders:[], template enabled:true -> auto-enabled
     // under the default (unset -> on) SEED_AUTOMATIONS_ENABLED switch.
     expect(schedules.find((schedule) => schedule.name === "daily-status-report")).toMatchObject({
@@ -102,18 +109,46 @@ describe("schedules seeder", () => {
       requiredParams: [],
       requires: [],
     });
-    expect(schedules.some((schedule) => schedule.name === "weekly-dependabot-triage")).toBe(false);
-    expect(schedules.some((schedule) => schedule.name === "weekly-harness-upgrade-check")).toBe(
-      false,
-    );
+    expect(
+      schedules.find((schedule) => schedule.name === "weekly-harness-upgrade-check"),
+    ).toMatchObject({
+      enabled: false,
+      requiredParams: ["REPO_URL", "PR_REVIEWER"],
+      requires: ["github"],
+    });
+    expect(
+      schedules.filter((schedule) => schedule.enabled).map((schedule) => schedule.name),
+    ).toEqual([
+      "daily-blocker-digest",
+      "daily-compounding-reflection",
+      "daily-status-report",
+      "daily-swarm-update-check",
+      "daily-workflow-health-audit",
+    ]);
   });
 
-  test("SEED_AUTOMATIONS_ENABLED=false keeps every candidate disabled, including zero-config ones", () => {
+  test("SEED_AUTOMATIONS_ENABLED=false still seeds all schedules disabled", async () => {
     process.env.SEED_AUTOMATIONS_ENABLED = "false";
-    const schedules = loadSeedSchedules();
+    const result = await runSeeder(createSchedulesSeeder(), { quiet: true });
+    expect(result).toMatchObject({ created: 11, failed: [] });
+    const schedules = await getScheduledTasks();
+    expect(schedules).toHaveLength(11);
     expect(schedules.every((schedule) => schedule.enabled === false)).toBe(true);
   });
 
+  test("seeds a disabled schedule whose timezone still needs setup", async () => {
+    const result = await runSeeder(createSchedulesSeeder(), { quiet: true });
+    expect(result).toMatchObject({ created: 11, failed: [] });
+    expect(await getScheduledTaskByName("weekly-dependabot-triage")).toMatchObject({
+      cronExpression: "40 3 * * 0",
+      timezone: "{{TIMEZONE}}",
+      enabled: false,
+      nextRunAt: undefined,
+      requiredParams: ["REPO_URL", "SLACK_CHANNEL_ID", "TIMEZONE"],
+      requires: ["github", "slack"],
+    });
+  });
+
   test("switch on: a zero-config candidate auto-enables via createSchedulesSeeder/apply", async () => {
     delete process.env.SEED_AUTOMATIONS_ENABLED;
     const seeder = createSchedulesSeeder([zeroConfigScheduleSource()]);

package/src/tests/seed-workflows.test.ts

@@ -66,6 +66,7 @@ async function getWorkflow(name = "test-seeded-workflow") {
 const ORIGINAL_SEED_AUTOMATIONS_ENABLED = process.env.SEED_AUTOMATIONS_ENABLED;
 
 beforeEach(async () => {
+  delete process.env.SEED_AUTOMATIONS_ENABLED;
   await removeDbFiles();
   initDb(TEST_DB_PATH);
 });
@@ -81,24 +82,35 @@ afterEach(async () => {
 });
 
 describe("workflows seeder", () => {
-  test("loads only the five starter candidates with their setup metadata", () => {
+  test("loads all ten workflow templates with their setup metadata", () => {
     const workflows = loadSeedWorkflows();
-    expect(workflows).toHaveLength(5);
+    expect(workflows).toHaveLength(10);
     expect(workflows.find((workflow) => workflow.name === "autopilot")).toMatchObject({
       enabled: false,
       requiredParams: ["REPO_URL"],
       requires: ["github"],
     });
-    expect(workflows.some((workflow) => workflow.name === "ralph-loop")).toBe(false);
-    expect(workflows.some((workflow) => workflow.name === "claude-code-changelog-watch")).toBe(
-      false,
-    );
-    expect(workflows.some((workflow) => workflow.name === "gsc-topic-miner")).toBe(false);
+    expect(
+      workflows.find((workflow) => workflow.name === "claude-code-changelog-watch"),
+    ).toMatchObject({
+      enabled: false,
+      requiredParams: [],
+      requires: [],
+    });
+    expect(workflows.find((workflow) => workflow.name === "gsc-topic-miner")).toMatchObject({
+      enabled: false,
+      requiredParams: ["GSC_PROPERTY"],
+      requires: ["gsc", "agentfs"],
+    });
+    expect(workflows.every((workflow) => !workflow.enabled)).toBe(true);
   });
 
-  test("SEED_AUTOMATIONS_ENABLED=false keeps every candidate disabled, including zero-config ones", () => {
+  test("SEED_AUTOMATIONS_ENABLED=false still seeds all workflows disabled", async () => {
     process.env.SEED_AUTOMATIONS_ENABLED = "false";
-    const workflows = loadSeedWorkflows();
+    const result = await runSeeder(createWorkflowsSeeder(), { quiet: true });
+    expect(result).toMatchObject({ created: 10, failed: [] });
+    const workflows = await listWorkflows();
+    expect(workflows).toHaveLength(10);
     expect(workflows.every((workflow) => workflow.enabled === false)).toBe(true);
   });