@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/task-tools-ctx.test.ts

@@ -86,6 +86,7 @@ describe("task tool ctx", () => {
       task: "ordinary direct assignment",
       agentId: lead.id,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       offerMode: false,
       allowDuplicate: false,
     });
@@ -108,6 +109,7 @@ describe("task tool ctx", () => {
       task: "ordinary offer",
       agentId: lead.id,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       offerMode: true,
       allowDuplicate: false,
     });

package/src/tests/tasks-requested-by-filter.test.ts

@@ -101,8 +101,8 @@ describe("getAllTasks / getTasksCount requestedByUserId filter", () => {
 // `GET /api/tasks` handler actually translates the `?requestedByUserId=none`
 // sentinel into `requestedByUserIdIsNull`, or that the omitted-param path
 // stays backwards compatible.
-const ROUTE_TEST_DB_PATH = "./test-tasks-requested-by-filter-route.sqlite";
-const ROUTE_API_KEY = "test-tasks-requested-by-filter-route";
+const ROUTE_TEST_DB_PATH = "./example-test-tasks-requested-by-filter-route.sqlite";
+const ROUTE_API_KEY = "example-test-tasks-requested-by-filter-route";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/telemetry-init.test.ts

@@ -204,6 +204,14 @@ describe("initTelemetry", () => {
       const metadata = (captured as { metadata: Record<string, unknown> }).metadata;
       expect(metadata.organization_id).toBeUndefined();
       expect(metadata.organization_name).toBeUndefined();
+
+      // Dashboard config reloads update the env after telemetry initialized.
+      process.env.SWARM_ORG_NAME = "  Acme Engineering  ";
+      track({ event: "test.event", properties: {} });
+      await new Promise((r) => setTimeout(r, 0));
+      expect((captured as { metadata: Record<string, unknown> }).metadata.organization_name).toBe(
+        "Acme Engineering",
+      );
     });
 
     test("includes organization_id + organization_name when SWARM_ORG_* set", async () => {
@@ -756,11 +764,11 @@ describe("initTelemetry", () => {
 
   describe("_hasEmbeddingKey", () => {
     test("true when EMBEDDING_API_KEY is set", () => {
-      expect(_hasEmbeddingKey({ EMBEDDING_API_KEY: "sk-embed" })).toBe(true);
+      expect(_hasEmbeddingKey({ EMBEDDING_API_KEY: "example-sk-embed" })).toBe(true);
     });
 
     test("true when OPENAI_API_KEY is set", () => {
-      expect(_hasEmbeddingKey({ OPENAI_API_KEY: "sk-openai" })).toBe(true);
+      expect(_hasEmbeddingKey({ OPENAI_API_KEY: "example-sk-openai" })).toBe(true);
     });
 
     test("false when neither is set (onboard wizard only writes ANTHROPIC_API_KEY)", () => {
@@ -941,7 +949,7 @@ describe("initTelemetry", () => {
     });
 
     test("channels + embedding key all present", async () => {
-      process.env.EMBEDDING_API_KEY = "sk-embed";
+      process.env.EMBEDDING_API_KEY = "example-sk-embed";
       process.env.SLACK_BOT_TOKEN = "xoxb-1";
       process.env.SLACK_APP_TOKEN = "xapp-1";
       process.env.AGENTMAIL_WEBHOOK_SECRET = "whsec_1";

package/src/tests/tool-annotations.test.ts

@@ -378,7 +378,7 @@ describe("Tool Annotations & Classification", () => {
     // Includes 11 skill tools, 7 MCP server tools, reusable script tools, and the
     // native Kapso/WhatsApp tools (register/unregister number + send/reply message).
     expect(count).toBeGreaterThanOrEqual(45);
-    expect(count).toBeLessThanOrEqual(141);
+    expect(count).toBeLessThanOrEqual(143);
   });
 
   test("core tools are fewer than deferred tools", () => {

package/src/tests/tool-output-agent-id.test.ts

@@ -165,6 +165,7 @@ describe("agent-id fields accept non-UUID agent ids", () => {
     const parsed = sendTaskInputSchema.parse({
       agentId: SLUG_WORKER_ID,
       routingReason: "skill",
+      routingNote: "This test explicitly selects the target worker",
       task: "do the thing",
     });
     expect(parsed.agentId).toBe(SLUG_WORKER_ID);

package/src/tests/tool-registrar-no-input.test.ts

@@ -1,7 +1,11 @@
 import { describe, expect, test } from "bun:test";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as z from "zod";
-import { createToolRegistrar } from "../tools/utils";
+import {
+  createToolRegistrar,
+  finalizeSwarmToolResult,
+  markExtensionRequestOrigin,
+} from "../tools/utils";
 
 describe("createToolRegistrar with no inputSchema", () => {
   test("handler receives requestInfo from meta when no inputSchema is defined", async () => {
@@ -117,4 +121,41 @@ describe("createToolRegistrar with no inputSchema", () => {
     });
     expect(result).toBeDefined();
   });
+
+  test("server-marked extension calls carry extension origin", async () => {
+    const server = new McpServer({ name: "test-extension-origin", version: "1.0.0" });
+    let callOrigin: string | undefined;
+    createToolRegistrar(server)(
+      "test-extension-origin-tool",
+      {
+        inputSchema: z.object({}),
+        outputSchema: z.looseObject({}),
+      },
+      async (_args, requestInfo) => {
+        callOrigin = requestInfo.callOrigin;
+        return { ok: true, message: "ok" };
+      },
+    );
+    const registeredTools = (server as Record<string, unknown>)._registeredTools as Record<
+      string,
+      { handler: (args: unknown, extra: unknown) => Promise<unknown> }
+    >;
+    const extra = markExtensionRequestOrigin({
+      sessionId: "extension",
+      requestInfo: { headers: { "x-agent-id": "extension-agent" } },
+    });
+
+    await registeredTools["test-extension-origin-tool"]!.handler({}, extra);
+    expect(callOrigin).toBe("extension");
+  });
+
+  test("extension calls bypass the model context ceiling", async () => {
+    const result = await finalizeSwarmToolResult(
+      "large-extension-result",
+      { ok: true, message: "ok", data: { value: "x".repeat(1_100_000) } },
+      { agentId: "extension-agent", callOrigin: "extension" },
+    );
+    expect(result.structuredContent?.truncation).toBeUndefined();
+    expect((result.structuredContent?.value as string).length).toBe(1_100_000);
+  });
 });

package/src/tests/tracker-fold.test.ts

@@ -154,7 +154,7 @@ beforeAll(async () => {
           expires_in: 3600,
           scope: "read write",
         };
-        if (includeRefreshToken) body.refresh_token = "rotated-refresh-token";
+        if (includeRefreshToken) body.refresh_token = "example-rotated-refresh-token";
         return Response.json(body);
       }
       return new Response("not found", { status: 404 });
@@ -227,7 +227,7 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     // possible since the carve-out removal made the linear row user-manageable.
     await upsertOAuthApp("linear", {
       clientId: "pre-existing",
-      clientSecret: "pre-existing-secret",
+      clientSecret: "example-pre-existing-secret",
       authorizeUrl: "https://linear.app/oauth/authorize",
       tokenUrl: "https://api.linear.app/oauth/token",
       redirectUri: `${appBase}/api/trackers/linear/callback`,
@@ -345,8 +345,8 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     const authorization = await upsertAuthorization({
       appId,
       label: "default",
-      accessToken: "stale-access",
-      refreshToken: "old-refresh",
+      accessToken: "example-stale-access",
+      refreshToken: "example-old-refresh",
       expiresAt: new Date(Date.now() - 60_000).toISOString(),
       status: "active",
     });
@@ -366,7 +366,7 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
       body: JSON.stringify({
         provider: "linear",
         clientId: "generic-linear-client",
-        clientSecret: "generic-linear-secret",
+        clientSecret: "example-generic-linear-secret",
         authorizeUrl: "https://linear.app/oauth/authorize",
         tokenUrl: "https://api.linear.app/oauth/token",
         scopes: ["read", "write"],
@@ -389,8 +389,8 @@ describe("step-8: tracker fold onto the unified OAuth core", () => {
     const authorization = await upsertAuthorization({
       appId,
       label: "default",
-      accessToken: "initial-access",
-      refreshToken: "linear-refresh",
+      accessToken: "example-initial-access",
+      refreshToken: "example-linear-refresh",
       expiresAt: new Date(Date.now() - 60_000).toISOString(),
       status: "active",
     });

package/src/tests/tracker-tools.test.ts

@@ -34,7 +34,7 @@ describe("tracker-status (DB layer)", () => {
   test("returns token info after storing tokens", async () => {
     await upsertOAuthApp("linear", {
       clientId: "test-client",
-      clientSecret: "test-secret",
+      clientSecret: "example-test-secret",
       authorizeUrl: "https://linear.app/oauth/authorize",
       tokenUrl: "https://api.linear.app/oauth/token",
       redirectUri: "http://localhost:3013/api/trackers/linear/callback",
@@ -42,8 +42,8 @@ describe("tracker-status (DB layer)", () => {
     });
 
     await storeOAuthTokens("linear", {
-      accessToken: "test-token",
-      refreshToken: "test-refresh",
+      accessToken: "example-test-token",
+      refreshToken: "example-test-refresh",
       expiresAt: new Date(Date.now() + 3600 * 1000).toISOString(),
       scope: "read,write",
     });

package/src/tests/ui-followup-lead-delegation.test.ts

@@ -169,6 +169,7 @@ describe("session-UI follow-up → Lead → onward delegation", () => {
         task: "please pick this up",
         agentId: differentWorkerId,
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         allowDuplicate: true,
       },
       leadAgentId,

package/src/tests/unified-oauth-migration.test.ts

@@ -44,7 +44,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-linear",
       provider: "linear",
       clientId: "linear-client",
-      clientSecret: "linear-client-secret",
+      clientSecret: "example-linear-client-secret",
       authorizeUrl: "https://linear.test/authorize",
       tokenUrl: "https://linear.test/token",
       redirectUri: "https://swarm.test/api/oauth/linear/callback",
@@ -60,7 +60,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-jira",
       provider: "jira",
       clientId: "jira-client",
-      clientSecret: "jira-client-secret",
+      clientSecret: "example-jira-client-secret",
       authorizeUrl: "https://jira.test/authorize",
       tokenUrl: "https://jira.test/token",
       redirectUri: "https://swarm.test/api/oauth/jira/callback",
@@ -77,7 +77,7 @@ async function pre117Database(path = ":memory:"): Promise<Database> {
       id: "app-vendor",
       provider: "vendor",
       clientId: "vendor-client",
-      clientSecret: "vendor-client-secret",
+      clientSecret: "example-vendor-client-secret",
       authorizeUrl: "https://vendor.test/authorize",
       tokenUrl: "https://vendor.test/token",
       redirectUri: "https://swarm.test/api/oauth/vendor/callback",
@@ -422,9 +422,9 @@ describe("migration 117 unified OAuth storage", () => {
         )
         .get();
       expect(encryptedLinear?.clientSecretEncrypted).toBe(1);
-      expect(encryptedLinear?.clientSecret).not.toBe("linear-client-secret");
+      expect(encryptedLinear?.clientSecret).not.toBe("example-linear-client-secret");
       expect(decryptSecret(encryptedLinear!.clientSecret, getEncryptionKey())).toBe(
-        "linear-client-secret",
+        "example-linear-client-secret",
       );
       const encryptedAuthorization = database
         .query<{ accessToken: string; refreshToken: string | null; tokensEncrypted: number }, []>(

package/src/tests/user-token-rest-auth.test.ts

@@ -21,7 +21,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-user-token-rest-auth.sqlite";
-const API_KEY = "test-api-key";
+const API_KEY = "example-test-api-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
 
 function createTestServer(): Server {

package/src/tests/user-token-routes.test.ts

@@ -14,7 +14,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-user-token-routes.sqlite";
-const API_KEY = "test-user-token-key";
+const API_KEY = "example-test-user-token-key";
 const ORIGINAL_API_KEY = process.env.AGENT_SWARM_API_KEY;
 
 async function removeDbFiles(path: string): Promise<void> {

package/src/tests/whoami-route.test.ts

@@ -24,7 +24,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-whoami-route.sqlite";
-const API_KEY = "test-api-key";
+const API_KEY = "example-test-api-key";
 const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
 
 interface WhoamiBody {

package/src/tests/workflow-agent-task.test.ts

@@ -37,7 +37,6 @@ const mockDeps: ExecutorDependencies = {
 // IDs for workflow prerequisites (set in beforeAll)
 let workflowId: string;
 let runId: string;
-let stepId1: string;
 let stepId2: string;
 
 // ─── Setup / Teardown ────────────────────────────────────────
@@ -64,14 +63,6 @@ beforeAll(async () => {
   const run = await createWorkflowRun({ id: crypto.randomUUID(), workflowId: wf.id });
   runId = run.id;
 
-  const step1 = await createWorkflowRunStep({
-    id: crypto.randomUUID(),
-    runId: run.id,
-    nodeId: "test-node-1",
-    nodeType: "agent-task",
-  });
-  stepId1 = step1.id;
-
   const step2 = await createWorkflowRunStep({
     id: crypto.randomUUID(),
     runId: run.id,
@@ -159,7 +150,10 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     expect(parsed.success).toBe(false);
   });
 
-  test("execute() creates task with workspace fields forwarded", async () => {
+  test.each([
+    undefined,
+    "skill",
+  ] as const)("execute() forwards workspace fields and routing provenance for %s", async (routingReason) => {
     const executor = new AgentTaskExecutor(mockDeps);
     const worker = await createAgent({
       name: "Pinned workflow worker",
@@ -168,15 +162,22 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     });
     const config = {
       agentId: worker.id,
+      routingReason,
       template: "List files in workspace",
       dir: "/workspace/repos/agent-swarm",
       vcsRepo: "desplega-ai/agent-swarm",
       model: "sonnet",
     };
+    const step = await createWorkflowRunStep({
+      id: crypto.randomUUID(),
+      runId,
+      nodeId: `routing-${routingReason ?? "default"}`,
+      nodeType: "agent-task",
+    });
     const meta: ExecutorMeta = {
       runId,
-      stepId: stepId1,
-      nodeId: "test-node-1",
+      stepId: step.id,
+      nodeId: step.nodeId,
       workflowId,
       dryRun: false,
     };
@@ -195,7 +196,8 @@ describe("AgentTaskExecutor — workspace scoping", () => {
     expect(task!.modelTier).toBe("regular");
     expect(task!.source).toBe("workflow");
     expect(task!.agentId).toBe(worker.id);
-    expect(task!.routingReason).toBe("human_pinned");
+    expect(task!.routingReason).toBe(routingReason ?? "human_pinned");
+    expect(task!.routingSource).toBe(routingReason ? "declared" : "engine_default");
   });
 
   test("execute() creates task without workspace fields (backward compat)", async () => {

package/src/tests/workflow-ctx.test.ts

@@ -19,7 +19,7 @@ describe("workflow-ctx: ctx.swarm proxy tool name resolution", () => {
       const { ctx } = buildWorkflowCtx({
         runId: "test-run",
         agentId: "test-agent",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         baseUrl: "http://localhost:9999",
         args: {},
       });

package/src/tests/workflow-e2e.test.ts

@@ -26,7 +26,7 @@ import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 const spawnDescribe = describe.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-e2e.sqlite";
-const API_KEY = "test-workflow-e2e-key-1234567890";
+const API_KEY = "example-test-workflow-e2e-key-1234567890";
 
 const noOpEmbeddingProvider = {
   name: "test/noop-workflow-e2e-embedding",

package/src/tests/workflow-engine-v2.test.ts

@@ -43,6 +43,8 @@ const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-engine-v2.sqlite";
 
+const inputRef = (name: string): string => `input.${name}`;
+
 // ─── Test Executors ──────────────────────────────────────────
 
 class EchoExecutor extends BaseExecutor<typeof EchoExecutor.schema, typeof EchoExecutor.outSchema> {
@@ -1158,7 +1160,7 @@ describe("interpolateNodeConfig — script node", () => {
   test("an inputs alias pointing at workflow input is still interpolated into the script", () => {
     const node = {
       type: "script",
-      inputs: { token: "input.API_TOKEN" },
+      inputs: { token: inputRef("API_TOKEN") },
       config: { runtime: "bash", script: "curl -H 'Authorization: {{token}}' https://x" },
     };
     const ctx = { input: { API_TOKEN: "tok-123" }, token: "tok-123" };

package/src/tests/workflow-executors.test.ts

@@ -594,8 +594,8 @@ describe("ScriptExecutor", () => {
 
   skip("child process never inherits the server's secrets — env is scrubbed, not passed through", async () => {
     const savedKey = process.env.AGENT_SWARM_API_KEY;
-    process.env.AGENT_SWARM_API_KEY = "super-secret-operator-bearer";
-    process.env.SOME_OTHER_SERVER_SECRET = "also-should-not-leak";
+    process.env.AGENT_SWARM_API_KEY = "example-super-secret-operator-bearer";
+    process.env.SOME_OTHER_SERVER_SECRET = "example-also-should-not-leak";
     try {
       const result = await executor.run(
         input(

package/src/tests/workflow-http-v2.test.ts

@@ -41,6 +41,8 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-workflow-http-v2.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // ─── Test Server ─────────────────────────────────────────────
 
 function createTestServer(): Server {
@@ -201,10 +203,10 @@ describe("Workflow HTTP API v2", () => {
           name: "full-schema-workflow",
           description: "test",
           definition: simpleDefinition(),
-          triggers: [{ type: "webhook", hmacSecret: "secret-123" }],
+          triggers: [{ type: "webhook", hmacSecret: "example-secret-123" }],
           cooldown: { minutes: 30 },
           // biome-ignore lint/suspicious/noTemplateCurlyInString: intentional — this is the input resolution syntax
-          input: { apiKey: "${API_KEY}", secret: "secret.MY_SECRET", literal: "hello" },
+          input: { apiKey: "${API_KEY}", secret: secretRef("MY_SECRET"), literal: "hello" },
         }),
       });
 
@@ -480,7 +482,7 @@ describe("Workflow HTTP API v2", () => {
         method: "PUT",
         headers,
         body: JSON.stringify({
-          triggers: [{ type: "webhook", hmacSecret: "new-secret" }],
+          triggers: [{ type: "webhook", hmacSecret: "example-new-secret" }],
           cooldown: { seconds: 30 },
           input: { key: "value" },
           params: { REPO_URL: "acme/widgets" },
@@ -921,11 +923,11 @@ describe("Workflow HTTP API v2", () => {
   describe("POST /api/webhooks/:workflowId", () => {
     test("valid HMAC returns 201", async () => {
       const workflow = await createTestWorkflow({
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
       });
 
       const body = '{"event":"test"}';
-      const hmac = crypto.createHmac("sha256", "test-secret");
+      const hmac = crypto.createHmac("sha256", "example-test-secret");
       hmac.update(body);
       const sig = `sha256=${hmac.digest("hex")}`;
 
@@ -944,7 +946,7 @@ describe("Workflow HTTP API v2", () => {
 
     test("invalid HMAC returns 401", async () => {
       const workflow = await createTestWorkflow({
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
       });
 
       const res = await fetch(`${baseUrl}/api/webhooks/${workflow.id}`, {

package/src/tests/workflow-input-redaction.test.ts

@@ -26,6 +26,8 @@ import {
 
 const TEST_DB_PATH = "./test-workflow-input-redaction.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // Captures the input it was invoked with so we can assert what the executor
 // actually receives (real value, not redacted).
 class CaptureExecutor extends BaseExecutor<
@@ -52,7 +54,7 @@ class CaptureExecutor extends BaseExecutor<
 
 describe("getSecretInputKeys", () => {
   test("flags secret.* references", () => {
-    const keys = getSecretInputKeys({ GITHUB_TOKEN: "secret.GITHUB_TOKEN" });
+    const keys = getSecretInputKeys({ GITHUB_TOKEN: secretRef("GITHUB_TOKEN") });
     expect(keys.has("GITHUB_TOKEN")).toBe(true);
     expect(keys.size).toBe(1);
   });
@@ -104,7 +106,7 @@ describe("redactSecretsForStorage", () => {
   test("redacts only declared secret keys in ctx.input", () => {
     const ctx = {
       trigger: { topic: "tuxedo" },
-      input: { GITHUB_TOKEN: "ghp_real_value_xxx", branch: "main" },
+      input: { GITHUB_TOKEN: "example-ghp_real_value_xxx", branch: "main" },
     };
     const out = redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
     expect((out.input as Record<string, unknown>).GITHUB_TOKEN).toBe(REDACTED_SECRET_VALUE);
@@ -114,9 +116,9 @@ describe("redactSecretsForStorage", () => {
   });
 
   test("does not mutate the original ctx (executor still sees real value)", () => {
-    const ctx = { input: { GITHUB_TOKEN: "ghp_real" } };
+    const ctx = { input: { GITHUB_TOKEN: "example-ghp_real" } };
     redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
-    expect((ctx.input as Record<string, unknown>).GITHUB_TOKEN).toBe("ghp_real");
+    expect((ctx.input as Record<string, unknown>).GITHUB_TOKEN).toBe("example-ghp_real");
   });
 
   test("no-ops when ctx has no input block", () => {
@@ -187,7 +189,7 @@ describe("end-to-end — workflow step persistence redacts secrets", () => {
       definition: def,
       triggers: [],
       input: {
-        GITHUB_TOKEN: "secret.TEST_REDACTION_GITHUB_TOKEN",
+        GITHUB_TOKEN: secretRef("TEST_REDACTION_GITHUB_TOKEN"),
         plain: "not-a-secret",
       },
     });

package/src/tests/workflow-integration-io.test.ts

@@ -588,7 +588,7 @@ describe("Workflow Integration — I/O Schemas, Convergence, TriggerSchema (Phas
       };
 
       // Set env var for input resolution
-      process.env.TEST_INTEG_API_KEY = "secret123";
+      process.env.TEST_INTEG_API_KEY = "example-secret123";
       const workflow = await makeWorkflow(def, {
         // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env var syntax
         input: { API_KEY: "${TEST_INTEG_API_KEY}" },
@@ -600,7 +600,7 @@ describe("Workflow Integration — I/O Schemas, Convergence, TriggerSchema (Phas
       expect(run!.status).toBe("completed");
 
       const ctx = run!.context as Record<string, unknown>;
-      expect(ctx.step1).toEqual({ echo: "env=secret123" });
+      expect(ctx.step1).toEqual({ echo: "env=example-secret123" });
     });
   });
 

package/src/tests/workflow-llm.test.ts

@@ -17,11 +17,11 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("routes OpenAI credentials to the SDK default endpoint", async () => {
     const config = await resolveWorkflowLlmConfig(undefined, {
-      OPENAI_API_KEY: "sk-openai-test",
+      OPENAI_API_KEY: "example-sk-openai-test",
     });
 
     expect(config).toEqual({
-      apiKey: "sk-openai-test",
+      apiKey: "example-sk-openai-test",
       baseURL: undefined,
       model: "gpt-5.4-mini",
     });
@@ -32,7 +32,7 @@ describe("resolveWorkflowLlmConfig", () => {
     process.env.MEMORY_RATER_MODEL = "openrouter/anthropic/claude-sonnet-4-5";
     try {
       const config = await resolveWorkflowLlmConfig(undefined, {
-        OPENAI_API_KEY: "sk-openai-test",
+        OPENAI_API_KEY: "example-sk-openai-test",
       });
       expect(config.model).toBe("gpt-5.4-mini");
     } finally {
@@ -43,7 +43,7 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("preserves an explicit provider-compatible model", async () => {
     const config = await resolveWorkflowLlmConfig("openai/gpt-5.4", {
-      OPENAI_API_KEY: "sk-openai-test",
+      OPENAI_API_KEY: "example-sk-openai-test",
     });
 
     expect(config.model).toBe("gpt-5.4");
@@ -51,7 +51,7 @@ describe("resolveWorkflowLlmConfig", () => {
 
   test("rejects credential kinds without an OpenAI-compatible endpoint", async () => {
     await expect(
-      resolveWorkflowLlmConfig(undefined, { ANTHROPIC_API_KEY: "sk-ant-test" }),
+      resolveWorkflowLlmConfig(undefined, { ANTHROPIC_API_KEY: "example-sk-ant-test" }),
     ).rejects.toThrow("do not support the resolved anthropic credential yet");
   });
 });

package/src/tests/workflow-registry.test.ts

@@ -500,7 +500,7 @@ describe("Workflow Registry & Definition (Phase 1)", () => {
             { id: "b", type: "notify", config: { channel: "swarm", template: "done" } },
           ],
         },
-        triggers: [{ type: "webhook", hmacSecret: "test-secret" }],
+        triggers: [{ type: "webhook", hmacSecret: "example-test-secret" }],
         cooldown: { hours: 1 },
         input: { apiKey: envVarRef },
       });

package/src/tests/workflow-swarm-script.test.ts

@@ -35,7 +35,7 @@ import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
 const TEST_DB_PATH = "./test-workflow-swarm-script.sqlite";
-const API_KEY = "test-workflow-swarm-script-key-1234567890";
+const API_KEY = "example-test-workflow-swarm-script-key-1234567890";
 
 const noOpEmbeddingProvider = {
   name: "test/noop-workflow-script-embedding",