@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/workflow-triggers-v2.test.ts

@@ -27,6 +27,8 @@ import {
 
 const TEST_DB_PATH = "./test-workflow-triggers-v2.sqlite";
 
+const secretRef = (name: string): string => `secret.${name}`;
+
 // ─── Test Executor ──────────────────────────────────────────
 
 class NoopExecutor extends BaseExecutor<typeof NoopExecutor.schema, typeof NoopExecutor.outSchema> {
@@ -86,7 +88,7 @@ async function makeWorkflow(
 // ─── HMAC Verification ──────────────────────────────────────
 
 describe("verifyHmacSignature", () => {
-  const secret = "test-secret-123";
+  const secret = "example-test-secret-123";
   const body = '{"event":"test"}';
 
   test("valid sha256=<hex> signature passes", () => {
@@ -123,7 +125,7 @@ describe("verifyHmacSignature", () => {
 });
 
 describe("verifyTimestampedHmacSignature", () => {
-  const secret = "timestamped-secret";
+  const secret = "example-timestamped-secret";
   const body = '{"event":"finding.triage_completed"}';
   const timestamp = 1_700_000_000;
   const nowMs = timestamp * 1000;
@@ -213,7 +215,7 @@ describe("verifyTokenEquality", () => {
 
 describe("handleWebhookTrigger", () => {
   test("valid HMAC starts workflow", async () => {
-    const secret = "my-webhook-secret";
+    const secret = "example-my-webhook-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -241,7 +243,7 @@ describe("handleWebhookTrigger", () => {
 
   test("invalid HMAC rejects with 401", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret-123" }],
+      triggers: [{ type: "webhook", hmacSecret: "example-secret-123" }],
     });
 
     try {
@@ -260,7 +262,7 @@ describe("handleWebhookTrigger", () => {
 
   test("missing signature rejects with 401 when hmacSecret is set", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret-xyz" }],
+      triggers: [{ type: "webhook", hmacSecret: "example-secret-xyz" }],
     });
 
     try {
@@ -374,7 +376,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   }
 
   test("custom hmacHeader (X-Webhook-Signature) is picked up and verified", async () => {
-    const secret = "kapso-secret";
+    const secret = "example-kapso-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -393,7 +395,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("custom hmacHeader lookup is case-insensitive", async () => {
-    const secret = "kapso-secret-ci";
+    const secret = "example-kapso-secret-ci";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -410,7 +412,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("signature on a non-configured header is rejected as missing", async () => {
-    const secret = "kapso-secret-2";
+    const secret = "example-kapso-secret-2";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -432,7 +434,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("fallback header (x-signature) still works without explicit hmacHeader", async () => {
-    const secret = "fallback-secret";
+    const secret = "example-fallback-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -449,7 +451,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("default X-Hub-Signature-256 path still works (no regression)", async () => {
-    const secret = "default-header-secret";
+    const secret = "example-default-header-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -467,7 +469,7 @@ describe("handleWebhookTrigger — custom hmacHeader", () => {
   });
 
   test("explicit hmac-sha256 verification does not use fallback headers", async () => {
-    const secret = "explicit-hmac-secret";
+    const secret = "example-explicit-hmac-secret";
     const workflow = await makeWorkflow({
       triggers: [
         {
@@ -500,7 +502,7 @@ describe("handleWebhookTrigger — verification formats", () => {
   }
 
   test("timestamped-hmac-sha256 starts workflow for Superagent-shaped request", async () => {
-    const secret = "superagent-secret";
+    const secret = "example-superagent-secret";
     const timestamp = Math.floor(Date.now() / 1000);
     const workflow = await makeWorkflow({
       triggers: [
@@ -536,7 +538,7 @@ describe("handleWebhookTrigger — verification formats", () => {
   });
 
   test("timestamped-hmac-sha256 rejects signatures on fallback headers", async () => {
-    const secret = "timestamped-no-fallback-secret";
+    const secret = "example-timestamped-no-fallback-secret";
     const timestamp = Math.floor(Date.now() / 1000);
     const workflow = await makeWorkflow({
       triggers: [
@@ -571,7 +573,7 @@ describe("handleWebhookTrigger — verification formats", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "gitlab-token",
+          hmacSecret: "example-gitlab-token",
           verification: { format: "token-equality", header: "X-Gitlab-Token" },
         },
       ],
@@ -580,7 +582,7 @@ describe("handleWebhookTrigger — verification formats", () => {
     const result = await handleWebhookTrigger(
       workflow.id,
       '{"event":"push"}',
-      { "x-gitlab-token": "gitlab-token" },
+      { "x-gitlab-token": "example-gitlab-token" },
       registry,
     );
 
@@ -592,7 +594,7 @@ describe("handleWebhookTrigger — verification formats", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "gitlab-token",
+          hmacSecret: "example-gitlab-token",
           verification: { format: "token-equality", header: "X-Gitlab-Token" },
         },
       ],
@@ -658,7 +660,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
       triggers: [
         {
           type: "webhook",
-          hmacSecret: "secret.TEST_KAPSO_WEBHOOK_HMAC_SECRET",
+          hmacSecret: secretRef("TEST_KAPSO_WEBHOOK_HMAC_SECRET"),
           hmacHeader: "X-Webhook-Signature",
         },
       ],
@@ -678,7 +680,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
 
   test("unresolvable secret.NAME ref fails cleanly with a WebhookError", async () => {
     const workflow = await makeWorkflow({
-      triggers: [{ type: "webhook", hmacSecret: "secret.NONEXISTENT_HMAC_SECRET_12345" }],
+      triggers: [{ type: "webhook", hmacSecret: secretRef("NONEXISTENT_HMAC_SECRET_12345") }],
     });
 
     const body = '{"event":"missing-secret"}';
@@ -697,7 +699,7 @@ describe("handleWebhookTrigger — hmacSecret references", () => {
   });
 
   test("a literal hmacSecret is not treated as a reference", async () => {
-    const secret = "plain.literal-not-a-ref";
+    const secret = `plain.${"literal-not-a-ref"}`;
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret }],
     });
@@ -739,7 +741,7 @@ describe("handleWebhookTrigger — triggerData JSON parsing", () => {
   });
 
   test("signed JSON body: HMAC verified against raw bytes, triggerData parsed to object", async () => {
-    const secret = "kapso-deep-secret";
+    const secret = "example-kapso-deep-secret";
     const workflow = await makeWorkflow({
       triggers: [{ type: "webhook", hmacSecret: secret, hmacHeader: "X-Webhook-Signature" }],
     });
@@ -858,7 +860,7 @@ describe("TriggerConfigSchema", () => {
   test("accepts verification configured with hmacSecret", () => {
     const result = TriggerConfigSchema.safeParse({
       type: "webhook",
-      hmacSecret: "gitlab-token",
+      hmacSecret: "example-gitlab-token",
       verification: { format: "token-equality", header: "X-Gitlab-Token" },
     });
 

package/src/tests/x-composio.test.ts

@@ -45,12 +45,12 @@ describe("runComposioCommand", () => {
     const fetchMock = mock(async (url: string | URL | Request, init?: RequestInit) => {
       expect(String(url)).toBe("https://backend.composio.dev/api/v3.1/tools?limit=10");
       expect(init?.method).toBe("GET");
-      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("ck_test_secret");
-      return jsonResponse({ ok: true, token: "ck_test_secret" });
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("example-ck_test_secret");
+      return jsonResponse({ ok: true, token: "example-ck_test_secret" });
     });
 
     await runComposioCommand(["GET", "/tools", "--query", "limit=10"], {
-      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      env: { COMPOSIO_API_KEY: "example-ck_test_secret" },
       fetch: fetchMock,
       log: (message) => out.push(message),
       error: (message) => out.push(message),
@@ -62,18 +62,20 @@ describe("runComposioCommand", () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
     expect(out.join("\n")).toContain('"ok": true');
     expect(out.join("\n")).toContain("[REDACTED:COMPOSIO_API_KEY]");
-    expect(out.join("\n")).not.toContain("ck_test_secret");
+    expect(out.join("\n")).not.toContain("example-ck_test_secret");
   });
 
   test("uses org key header when --org is passed", async () => {
     const fetchMock = mock(async (_url: string | URL | Request, init?: RequestInit) => {
-      expect((init?.headers as Record<string, string>)["x-org-api-key"]).toBe("org_secret_value");
+      expect((init?.headers as Record<string, string>)["x-org-api-key"]).toBe(
+        "example-org_secret_value",
+      );
       expect((init?.headers as Record<string, string>)["x-api-key"]).toBeUndefined();
       return jsonResponse({ ok: true });
     });
 
     await runComposioCommand(["GET", "/org/projects", "--org"], {
-      env: { COMPOSIO_ORG_API_KEY: "org_secret_value" },
+      env: { COMPOSIO_ORG_API_KEY: "example-org_secret_value" },
       fetch: fetchMock,
       log: () => {},
       error: () => {},
@@ -108,7 +110,7 @@ describe("runXCommand", () => {
   test("dispatches to composio target", async () => {
     const fetchMock = mock(async () => jsonResponse({ ok: true }));
     await runXCommand(["composio", "GET", "/tools"], {
-      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      env: { COMPOSIO_API_KEY: "example-ck_test_secret" },
       fetch: fetchMock,
       log: () => {},
       error: () => {},

package/src/tests/x402-client.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { createX402Client } from "../x402/client.ts";
 
 // A valid test private key (DO NOT use in production — this is a well-known throwaway key)
-const TEST_PRIVATE_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
+const TEST_PRIVATE_KEY = `0x${"11".repeat(32)}`;
 
 describe("createX402Client", () => {
   const originalEnv = { ...process.env };

package/src/tests/x402-config.test.ts

@@ -1,6 +1,9 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { loadX402Config } from "../x402/config.ts";
 
+const TEST_PRIVATE_KEY = `0x${"11".repeat(32)}`;
+const TEST_PRIVATE_KEY_WITHOUT_PREFIX = TEST_PRIVATE_KEY.slice(2);
+
 describe("loadX402Config", () => {
   const originalEnv = { ...process.env };
 
@@ -28,25 +31,20 @@ describe("loadX402Config", () => {
   // --- Viem signer tests ---
 
   test("auto-detects viem signer when EVM_PRIVATE_KEY is set", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
     expect(config.signerType).toBe("viem");
-    expect(config.evmPrivateKey).toBe(
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678",
-    );
+    expect(config.evmPrivateKey).toBe(TEST_PRIVATE_KEY);
   });
 
   test("throws when EVM_PRIVATE_KEY does not start with 0x", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "deadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY_WITHOUT_PREFIX;
     expect(() => loadX402Config()).toThrow("EVM_PRIVATE_KEY must start with '0x'");
   });
 
   test("returns config with defaults when only EVM_PRIVATE_KEY is set", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
 
@@ -59,33 +57,32 @@ describe("loadX402Config", () => {
   // --- Openfort signer tests ---
 
   test("auto-detects openfort signer when OPENFORT_API_KEY is set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
 
     const config = loadX402Config();
     expect(config.signerType).toBe("openfort");
-    expect(config.openfortApiKey).toBe("sk_test_abc123");
-    expect(config.openfortWalletSecret).toBe("base64secret");
+    expect(config.openfortApiKey).toBe("example-sk_test_abc123");
+    expect(config.openfortWalletSecret).toBe("example-base64secret");
   });
 
   test("openfort takes priority over viem when both are set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
 
     const config = loadX402Config();
     expect(config.signerType).toBe("openfort");
   });
 
   test("throws when openfort signer is selected but OPENFORT_WALLET_SECRET is missing", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
     expect(() => loadX402Config()).toThrow("OPENFORT_WALLET_SECRET is required");
   });
 
   test("includes OPENFORT_WALLET_ADDRESS when set", () => {
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
-    process.env.OPENFORT_WALLET_SECRET = "base64secret";
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
+    process.env.OPENFORT_WALLET_SECRET = "example-base64secret";
     process.env.OPENFORT_WALLET_ADDRESS = "0x1234567890abcdef1234567890abcdef12345678";
 
     const config = loadX402Config();
@@ -96,9 +93,8 @@ describe("loadX402Config", () => {
 
   test("respects explicit X402_SIGNER_TYPE=viem", () => {
     process.env.X402_SIGNER_TYPE = "viem";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
-    process.env.OPENFORT_API_KEY = "sk_test_abc123";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
+    process.env.OPENFORT_API_KEY = "example-sk_test_abc123";
 
     const config = loadX402Config();
     expect(config.signerType).toBe("viem");
@@ -106,16 +102,14 @@ describe("loadX402Config", () => {
 
   test("throws on invalid X402_SIGNER_TYPE", () => {
     process.env.X402_SIGNER_TYPE = "invalid";
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     expect(() => loadX402Config()).toThrow('X402_SIGNER_TYPE must be "openfort" or "viem"');
   });
 
   // --- Spending limit tests ---
 
   test("parses custom X402_MAX_AUTO_APPROVE", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "5.50";
 
     const config = loadX402Config();
@@ -123,8 +117,7 @@ describe("loadX402Config", () => {
   });
 
   test("parses custom X402_DAILY_LIMIT", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "25.00";
 
     const config = loadX402Config();
@@ -132,8 +125,7 @@ describe("loadX402Config", () => {
   });
 
   test("uses custom X402_NETWORK", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_NETWORK = "eip155:8453";
 
     const config = loadX402Config();
@@ -141,40 +133,35 @@ describe("loadX402Config", () => {
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is not a valid number", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "abc";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is zero", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "0";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_MAX_AUTO_APPROVE is negative", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_MAX_AUTO_APPROVE = "-1";
 
     expect(() => loadX402Config()).toThrow("X402_MAX_AUTO_APPROVE must be a positive number");
   });
 
   test("throws when X402_DAILY_LIMIT is not a valid number", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "not-a-number";
 
     expect(() => loadX402Config()).toThrow("X402_DAILY_LIMIT must be a positive number");
   });
 
   test("throws when X402_DAILY_LIMIT is zero", () => {
-    process.env.EVM_PRIVATE_KEY =
-      "0xdeadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+    process.env.EVM_PRIVATE_KEY = TEST_PRIVATE_KEY;
     process.env.X402_DAILY_LIMIT = "0";
 
     expect(() => loadX402Config()).toThrow("X402_DAILY_LIMIT must be a positive number");