@desplega.ai/agent-swarm 1.152.1 → 1.153.0

package/src/tests/rbac-admission-e2e.test.ts

@@ -10,6 +10,7 @@
 import { Database } from "bun:sqlite";
 import { afterAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { join } from "node:path";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 import {
   api,
   makeScratchDir,
@@ -483,3 +484,56 @@ describe("RBAC admission over real HTTP", () => {
     );
   });
 });
+
+test.each(["true", "false"])("worker extension ownership with RBAC_ENABLED=%s", async (enabled) => {
+  const scratch = await makeScratchDir();
+  const instance = await spawnSwarmServer({
+    dbPath: join(scratch, "extension-admission.sqlite"),
+    logPath: join(scratch, "extension-admission.log"),
+    env: { RBAC_ENABLED: enabled },
+  });
+  try {
+    await registerAgent(instance.base, WORKER_A, "extension-owner", false);
+    const bundle = await loadBundleFixture("minimal");
+    const installed = await api(instance.base, "POST", "/api/extensions/install", {
+      agentId: WORKER_A,
+      body: bundle,
+    });
+    expect(installed.status).toBe(200);
+    expect(installed.body.extension).toMatchObject({
+      createdByAgentId: WORKER_A,
+      enabled: false,
+      status: "disabled",
+    });
+    const path = `/api/extensions/${installed.body.extension.id}`;
+    for (const operation of ["enable", "disable", "activate-version"]) {
+      expect(
+        (
+          await api(instance.base, "POST", `${path}/${operation}`, {
+            agentId: WORKER_A,
+            body: { version: 1 },
+          })
+        ).status,
+      ).toBe(403);
+    }
+    const operatorBundle = { ...bundle, manifest: { ...bundle.manifest, name: "operator-owned" } };
+    const operator = await api(instance.base, "POST", "/api/extensions/install", {
+      body: operatorBundle,
+    });
+    expect(operator.status).toBe(200);
+    expect(operator.body.extension.createdByAgentId).toBeNull();
+    for (const method of ["PATCH", "DELETE"]) {
+      expect(
+        (
+          await api(instance.base, method, `/api/extensions/${operator.body.extension.id}`, {
+            agentId: WORKER_A,
+            ...(method === "PATCH" ? { body: { priority: 1 } } : {}),
+          })
+        ).status,
+      ).toBe(403);
+    }
+  } finally {
+    await instance.stop();
+    await removeScratchDir(scratch);
+  }
+});

package/src/tests/rbac-e2e-helpers.ts

@@ -78,6 +78,8 @@ export async function spawnSwarmServer(opts: {
       API_KEY: E2E_API_KEY,
       AGENT_SWARM_API_KEY: E2E_API_KEY,
       PORT: String(port),
+      // MCP proxy tools must call this scratch server, never an inherited live URL.
+      MCP_BASE_URL: `http://localhost:${port}`,
       SLACK_DISABLE: "true",
       GITHUB_DISABLE: "true",
       JIRA_DISABLE: "true",

package/src/tests/rbac-engine.test.ts

@@ -255,6 +255,38 @@ describe("lead-or-operator-or-user verbs", () => {
   }
 });
 
+describe("extension ownership", () => {
+  test("workers create extensions and write only their own existing resource", () => {
+    const worker = { kind: "agent", agentId: "extension-owner", isLead: false } as const;
+    for (const resource of [
+      { kind: "extension" },
+      { kind: "extension", extensionId: "ext-1", createdByAgentId: worker.agentId },
+    ] as const) {
+      expect(
+        can({ principal: worker, verb: "extension.write", resource, source: "http" }).allow,
+      ).toBe(true);
+    }
+    for (const createdByAgentId of [null, "other-agent"]) {
+      expect(
+        can({
+          principal: worker,
+          verb: "extension.write",
+          resource: { kind: "extension", extensionId: "ext-1", createdByAgentId },
+          source: "http",
+        }).allow,
+      ).toBe(false);
+    }
+    expect(
+      can({
+        principal: { ...worker, agentId: "" },
+        verb: "extension.write",
+        resource: { kind: "extension" },
+        source: "http",
+      }).allow,
+    ).toBe(false);
+  });
+});
+
 describe("lead-or-resource-owner verbs", () => {
   const expected: Expected = {
     lead: true,

package/src/tests/rbac-wire-e2e.test.ts

@@ -18,6 +18,7 @@
 import { Database } from "bun:sqlite";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { join } from "node:path";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 import {
   api,
   LEAD,
@@ -119,6 +120,38 @@ afterAll(async () => {
 });
 
 describe("MCP gate matrix", () => {
+  test("worker MCP installs retain ownership and lifecycle calls remain lead-only", async () => {
+    const bundle = await loadBundleFixture("minimal");
+    bundle.manifest.name = "worker-owned-wire";
+    const installed = await mcpCall(base, WORKER_A, sidA, "extension-install", bundle);
+    expect(installed.structuredContent).toMatchObject({ success: true });
+    expect(installed.structuredContent).toMatchObject({
+      createdByAgentId: WORKER_A,
+      enabled: false,
+      status: "disabled",
+    });
+    expectRow({ type: "agent", id: WORKER_A }, "extension.write", "allow", null, "http");
+    const id = installed.structuredContent.id;
+    const listed = await mcpCall(base, WORKER_A, sidA, "extension-list", {});
+    expect(listed.structuredContent.extensions).toContainEqual(
+      expect.objectContaining({ id, createdByAgentId: WORKER_A }),
+    );
+    for (const tool of ["extension-enable", "extension-disable", "extension-activate-version"]) {
+      const denied = await mcpCall(base, WORKER_A, sidA, tool, {
+        id,
+        ...(tool === "extension-activate-version" ? { version: 1 } : {}),
+      });
+      expect(denied.structuredContent.success).toBe(false);
+      expectRow(
+        { type: "agent", id: WORKER_A },
+        "extension.activate",
+        "deny",
+        "requires operator/user authentication, or a lead with EXTENSION_ALLOW_LEAD_ACTIVATION enabled",
+        "http",
+      );
+    }
+  });
+
   test("config: set/delete lead-gated; includeSecrets masks for non-lead (DES-445 follow-up)", async () => {
     // set-config (non-credential key): worker denied, lead allowed.
     const setWorker = await mcpCall(base, WORKER_A, sidA, "set-config", {

package/src/tests/reasoning-effort.test.ts

@@ -22,6 +22,14 @@ describe("REASONING_EFFORT_LEVELS", () => {
 });
 
 describe("reasoningCapability — cache-sourced levels", () => {
+  test("Claude Opus 5.5 exposes supported CLI effort levels", () => {
+    expect(reasoningCapability("claude", "claude-opus-5-5").levels).toEqual([
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+    ]);
+  });
   test("claude claude-opus-4-8: levels come from reasoning_options.effort, not the fallback", () => {
     const cap = reasoningCapability("claude", "claude-opus-4-8");
     expect(cap.supported).toBe(true);

package/src/tests/reload-config.test.ts

@@ -323,6 +323,39 @@ describe("reload-config", () => {
     }
   });
 
+  test("reload applies HTTP mode without reporting a Slack socket as reinitialized", async () => {
+    const keys = [
+      "SLACK_MODE",
+      "SLACK_DISABLE",
+      "SLACK_BOT_TOKEN",
+      "SLACK_SIGNING_SECRET",
+    ] as const;
+    const originals = new Map(keys.map((key) => [key, process.env[key]]));
+    process.env.SLACK_DISABLE = "false";
+    process.env.SLACK_BOT_TOKEN = "xoxb-test";
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    const config = await upsertSwarmConfig({
+      scope: "global",
+      key: "SLACK_MODE",
+      value: "http",
+    });
+
+    try {
+      const result = await reloadGlobalConfigsAndIntegrations();
+      expect(result.keysUpdated).toContain("SLACK_MODE");
+      expect(result.integrationsReinitialized).not.toContain("slack");
+      expect(process.env.SLACK_MODE).toBe("http");
+    } finally {
+      await deleteSwarmConfig(config.id);
+      await loadGlobalConfigsIntoEnv(true);
+      for (const key of keys) {
+        const value = originals.get(key);
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  });
+
   // Regression: injection used to be one-way. Deleting a global row left the
   // previously-injected value live in process.env until the process restarted,
   // so "reset to default" in the dashboard silently did nothing.

package/src/tests/session-costs-model-key-normalize.test.ts

@@ -133,6 +133,7 @@ describe("normalizeModelKey()", () => {
     expect(normalizeModelKey("claude", "claude-opus-4-7")).toBe("claude-opus-4-7");
     expect(normalizeModelKey("claude", "claude-fable-5-1")).toBe("claude-fable-5-1");
     expect(normalizeModelKey("claude", "claude-mythos-5-1")).toBe("claude-mythos-5-1");
+    expect(normalizeModelKey("claude", "claude-opus-5-5")).toBe("claude-opus-5-5");
     expect(normalizeModelKey("claude", "claude-opus-5")).toBe("claude-opus-5");
     expect(normalizeModelKey("claude", "claude-fable-5")).toBe("claude-fable-5");
     expect(normalizeModelKey("claude", "claude-mythos-5")).toBe("claude-mythos-5");

package/src/tests/slack-assistant.test.ts

@@ -6,9 +6,15 @@ import {
   createTaskExtended,
   getAgentWorkingOnThread,
   getLeadAgent,
+  getMostRecentTaskInThread,
   getTaskById,
   initDb,
 } from "../be/db";
+import { createAssistant } from "../slack/assistant";
+import { getBufferMessageCount, instantFlush } from "../slack/thread-buffer";
+
+/** The single function Bolt's `Assistant` stores for the `message` event — not part of its public type. */
+type AssistantUserMessageHandler = (args: Record<string, unknown>) => Promise<void>;
 
 process.env.SLACK_RENDER_V2 = "false";
 
@@ -121,6 +127,134 @@ describe("assistant userMessage routing — follow-up (working agent exists)", (
   });
 });
 
+describe("assistant DM path self-mention rendering — production ingestion path", () => {
+  // Drives `createAssistant()`'s real `userMessage` handler end-to-end (the
+  // production DM path), rather than calling `rewriteSlackMentions` in
+  // isolation. It must fail if the fix at src/slack/assistant.ts (the
+  // `cachedBotUserId ?? undefined` argument to `rewriteSlackMentions`) is
+  // reverted.
+  const BOT_USER_ID = "U0PRODBOT99";
+  const OTHER_USER_ID = "U0PRODOTHR1";
+  const CHANNEL_ID = "D_PROD_DM_SELF_MENTION";
+  const THREAD_TS = "5551112223.000001";
+
+  test("resolves the bot's own mention and leaves another user's mention correct", async () => {
+    const assistant = createAssistant();
+    const userMessage = (assistant as unknown as { userMessage: AssistantUserMessageHandler[] })
+      .userMessage[0];
+
+    const client = {
+      auth: { test: async () => ({ user_id: BOT_USER_ID }) },
+      reactions: { add: async () => ({}) },
+      chat: { postMessage: async () => ({}) },
+      users: { info: async () => ({ user: undefined }) },
+    };
+
+    const message = {
+      channel: CHANNEL_ID,
+      ts: THREAD_TS,
+      thread_ts: THREAD_TS,
+      text: `<@${BOT_USER_ID}> can you loop in <@${OTHER_USER_ID}> on this?`,
+      user: "U_PROD_REQUESTER",
+    };
+
+    await userMessage({
+      message,
+      body: { event_id: "Ev_PROD_DM_SELF_MENTION_1" },
+      say: async () => {},
+      setStatus: async () => ({}),
+      setTitle: async () => ({}),
+      getThreadContext: async () => undefined,
+      client,
+    });
+
+    const task = await getMostRecentTaskInThread(CHANNEL_ID, THREAD_TS);
+    expect(task).toBeDefined();
+    expect(task!.task).toBe(
+      `<@${BOT_USER_ID}> (that's you) can you loop in <@${OTHER_USER_ID}> (unknown user) on this?`,
+    );
+  });
+});
+
+describe("assistant DM path self-mention rendering — buffered follow-up path (ADDITIVE_SLACK)", () => {
+  // With ADDITIVE_SLACK=true and an active agent already on the DM thread,
+  // userMessage buffers the message and returns before the direct
+  // rewriteSlackMentions(..., cachedBotUserId) call runs. The bot ID must
+  // still reach the later flush in thread-buffer.ts, or the bot's own
+  // mention renders as "(unknown user)" instead of "(that's you)".
+  // `cachedBotUserId` in assistant.ts is a module-level singleton resolved
+  // once per process, so this must reuse the ID the earlier describe block
+  // already cached via auth.test() — a fresh ID here would make this
+  // message look like it mentions "someone else" and never reach the
+  // buffered branch at all.
+  const BOT_USER_ID = "U0PRODBOT99";
+  const OTHER_USER_ID = "U0BUFOTHR01";
+  const CHANNEL_ID = "D_BUF_DM_SELF_MENTION";
+  const THREAD_TS = "5552223334.000001";
+
+  const originalAdditiveSlack = process.env.ADDITIVE_SLACK;
+
+  beforeAll(() => {
+    process.env.ADDITIVE_SLACK = "true";
+  });
+
+  afterAll(() => {
+    if (originalAdditiveSlack === undefined) delete process.env.ADDITIVE_SLACK;
+    else process.env.ADDITIVE_SLACK = originalAdditiveSlack;
+  });
+
+  test("bot's own mention resolves through the buffered flush", async () => {
+    const worker = await createAgent({ name: "BufferedDmWorker", isLead: false, status: "idle" });
+    await createTaskExtended("original task in buffered DM thread", {
+      agentId: worker.id,
+      source: "slack",
+      slackChannelId: CHANNEL_ID,
+      slackThreadTs: THREAD_TS,
+      slackUserId: "U_BUF_REQUESTER",
+    });
+
+    const assistant = createAssistant();
+    const userMessage = (assistant as unknown as { userMessage: AssistantUserMessageHandler[] })
+      .userMessage[0];
+
+    const client = {
+      auth: { test: async () => ({ user_id: BOT_USER_ID }) },
+      reactions: { add: async () => ({}) },
+      chat: { postMessage: async () => ({}) },
+      users: { info: async () => ({ user: undefined }) },
+    };
+
+    const message = {
+      channel: CHANNEL_ID,
+      ts: "5552223334.000002",
+      thread_ts: THREAD_TS,
+      text: `<@${BOT_USER_ID}> can you loop in <@${OTHER_USER_ID}> on this?`,
+      user: "U_BUF_REQUESTER",
+    };
+
+    await userMessage({
+      message,
+      body: { event_id: "Ev_BUF_DM_SELF_MENTION_1" },
+      say: async () => {},
+      setStatus: async () => ({}),
+      setTitle: async () => ({}),
+      getThreadContext: async () => undefined,
+      client,
+    });
+
+    // Buffered, not turned into a task synchronously.
+    expect(getBufferMessageCount(`${CHANNEL_ID}:${THREAD_TS}`)).toBe(1);
+
+    await instantFlush(`${CHANNEL_ID}:${THREAD_TS}`);
+
+    const flushed = await getMostRecentTaskInThread(CHANNEL_ID, THREAD_TS);
+    expect(flushed).toBeDefined();
+    expect(flushed!.task).toContain(`<@${BOT_USER_ID}> (that's you)`);
+    expect(flushed!.task).not.toContain(`<@${BOT_USER_ID}> (unknown user)`);
+    expect(flushed!.task).toContain(`<@${OTHER_USER_ID}> (unknown user)`);
+  });
+});
+
 describe("assistant thread title truncation", () => {
   test("short messages stay as-is", () => {
     const text = "Check agent status";

package/src/tests/slack-config.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { startSlackMock, stopSlackMock } from "../../scripts/e2e/slack";
+import { closeDb, initDb } from "../be/db";
+import { getEnabledCapabilities } from "../server";
+import { getSlackApp, startSlackApp, stopSlackApp } from "../slack/app";
+import { getSlackConfiguration, isSlackConfigured } from "../slack/config";
+
+const SLACK_ENV_KEYS = [
+  "NODE_ENV",
+  "SLACK_ALLOW_DEV_SOCKET_MODE",
+  "CAPABILITIES",
+  "SLACK_MODE",
+  "SLACK_DISABLE",
+  "SLACK_BOT_TOKEN",
+  "SLACK_APP_TOKEN",
+  "SLACK_SIGNING_SECRET",
+  "SLACK_API_URL",
+] as const;
+const originalEnv = new Map(SLACK_ENV_KEYS.map((key) => [key, process.env[key]]));
+
+beforeEach(() => {
+  for (const key of SLACK_ENV_KEYS) delete process.env[key];
+  process.env.NODE_ENV = "test";
+  process.env.SLACK_DISABLE = "false";
+});
+
+afterEach(async () => {
+  await stopSlackApp();
+  for (const key of SLACK_ENV_KEYS) {
+    const value = originalEnv.get(key);
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+describe("Slack transport configuration", () => {
+  test("defaults to Socket Mode and requires the existing token pair", () => {
+    expect(getSlackConfiguration({})).toEqual({
+      disabled: false,
+      mode: "socket",
+      missingCredentials: ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"],
+    });
+    expect(getEnabledCapabilities()).toContain("slack");
+    expect(isSlackConfigured({ SLACK_BOT_TOKEN: "xoxb-test", SLACK_APP_TOKEN: "xapp-test" })).toBe(
+      true,
+    );
+  });
+
+  test("HTTP mode requires bot and signing credentials without an app token", () => {
+    const env = {
+      SLACK_MODE: "http",
+      SLACK_BOT_TOKEN: "xoxb-test",
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+    };
+    expect(getSlackConfiguration(env)).toEqual({
+      disabled: false,
+      mode: "http",
+      missingCredentials: [],
+    });
+    expect(isSlackConfigured(env)).toBe(true);
+  });
+
+  test("disabled and invalid configurations fail closed", () => {
+    expect(
+      isSlackConfigured({
+        SLACK_DISABLE: "true",
+        SLACK_BOT_TOKEN: "xoxb-test",
+        SLACK_APP_TOKEN: "xapp-test",
+      }),
+    ).toBe(false);
+    expect(
+      getSlackConfiguration({
+        SLACK_MODE: "webhook",
+        SLACK_BOT_TOKEN: "xoxb-test",
+        SLACK_APP_TOKEN: "xapp-test",
+      }),
+    ).toMatchObject({ mode: null });
+  });
+
+  test("HTTP selection remains unavailable and never creates a socket app", async () => {
+    process.env.SLACK_MODE = "http";
+    expect(getEnabledCapabilities()).not.toContain("slack");
+    process.env.SLACK_BOT_TOKEN = "xoxb-test";
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    delete process.env.SLACK_APP_TOKEN;
+
+    const error = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      expect(await startSlackApp()).toBe(false);
+      expect(getSlackApp()).toBeNull();
+      expect(error).toHaveBeenCalledWith(
+        "[Slack] HTTP mode is configured but unavailable until the HTTP receiver is installed",
+      );
+    } finally {
+      error.mockRestore();
+    }
+  });
+});
+
+test.each([
+  "disabled",
+  "invalid mode",
+  "missing credentials",
+  "HTTP unavailable",
+  "socket blocked",
+])("failed init is retryable without stop: %s", async (reason) => {
+  const slack = await startSlackMock(false);
+  initDb(":memory:");
+  try {
+    Object.assign(process.env, slack.mock.env);
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    if (reason === "disabled") process.env.SLACK_DISABLE = "true";
+    if (reason === "invalid mode") process.env.SLACK_MODE = "invalid";
+    if (reason === "missing credentials") delete process.env.SLACK_APP_TOKEN;
+    if (reason === "HTTP unavailable") process.env.SLACK_MODE = "http";
+    if (reason === "socket blocked") process.env.NODE_ENV = "development";
+
+    expect(await startSlackApp()).toBe(false);
+    expect(getSlackApp()).toBeNull();
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(0);
+
+    Object.assign(process.env, slack.mock.env);
+    process.env.SLACK_DISABLE = "false";
+    process.env.SLACK_MODE = "socket";
+    process.env.NODE_ENV = "test";
+    // Deliberately retry without stopSlackApp: failed initialization must not latch.
+    expect(await startSlackApp()).toBe(true);
+    await slack.mock.waitForConnection(10_000);
+    expect(slack.mock.connectionCount).toBe(1);
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(1);
+  } finally {
+    await stopSlackApp();
+    await stopSlackMock(slack, false);
+    closeDb();
+  }
+}, 20_000);

package/src/tests/slack-mode-lifecycle.test.ts

@@ -0,0 +1,69 @@
+import { expect, test } from "bun:test";
+import { createApiClient, pollUntil } from "../../scripts/e2e/http";
+import { startSlackMock, stopSlackMock } from "../../scripts/e2e/slack";
+import { type Sut, startSut, stopSut } from "../../scripts/e2e/sut";
+
+test("config reload disconnects a live socket for HTTP and can return to Socket Mode", async () => {
+  const slack = await startSlackMock(false);
+  let sut: Sut | undefined;
+  try {
+    sut = await startSut(false, slack.mock.env, {
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+      HEARTBEAT_DISABLE: "true",
+    });
+    await slack.mock.waitForConnection(10_000);
+    expect(slack.mock.connectionCount).toBe(1);
+    const opened = slack.mock.apiCalls("apps.connections.open").length;
+    const api = createApiClient(sut.baseUrl, sut.apiKey);
+    const http = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "http" },
+    });
+    expect(http.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 0, 10_000, 50)).toBe(true);
+    const reload = await api("POST", "/api/config/reload");
+    expect(reload.status).toBe(200);
+    expect(reload.json).toMatchObject({ success: true });
+    expect(
+      (reload.json as { integrationsReinitialized: string[] }).integrationsReinitialized,
+    ).not.toContain("slack");
+    expect(slack.mock.apiCalls("apps.connections.open").length).toBe(opened);
+    const socket = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "socket" },
+    });
+    expect(socket.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 1, 10_000, 50)).toBe(true);
+    expect(slack.mock.apiCalls("apps.connections.open").length).toBe(opened + 1);
+  } finally {
+    if (sut) await stopSut(sut, false);
+    await stopSlackMock(slack, false);
+  }
+}, 30_000);
+
+test("config reload recovers from an initial unavailable HTTP transport", async () => {
+  const slack = await startSlackMock(false);
+  let sut: Sut | undefined;
+  try {
+    sut = await startSut(false, slack.mock.env, {
+      SLACK_MODE: "http",
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+      HEARTBEAT_DISABLE: "true",
+    });
+    const api = createApiClient(sut.baseUrl, sut.apiKey);
+    const initialReload = await api("POST", "/api/config/reload");
+    expect(initialReload.status).toBe(200);
+    expect(
+      (initialReload.json as { integrationsReinitialized: string[] }).integrationsReinitialized,
+    ).not.toContain("slack");
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(0);
+
+    const socket = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "socket" },
+    });
+    expect(socket.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 1, 10_000, 50)).toBe(true);
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(1);
+  } finally {
+    if (sut) await stopSut(sut, false);
+    await stopSlackMock(slack, false);
+  }
+}, 30_000);

package/src/tests/status.test.ts

@@ -96,6 +96,8 @@ const ENV_KEYS_TO_RESET = [
   "DEVIN_ORG_ID",
   "SLACK_BOT_TOKEN",
   "SLACK_APP_TOKEN",
+  "SLACK_SIGNING_SECRET",
+  "SLACK_MODE",
   "SLACK_DISABLE",
   "GITHUB_WEBHOOK_SECRET",
   "GITHUB_APP_ID",
@@ -409,20 +411,38 @@ describe("setup milestones", () => {
     });
   });
 
-  test("slack: needs both bot+app tokens AND not disabled", async () => {
+  test("slack: reports mode-aware credentials as configured, not live-verified", async () => {
     process.env.SLACK_BOT_TOKEN = "xoxb-test";
     const a = await buildStatusPayload();
     expect(getMilestone(a, "slack").state).toBe("unverified");
 
     process.env.SLACK_APP_TOKEN = "xapp-test";
     const b = await buildStatusPayload();
-    expect(getMilestone(b, "slack").state).toBe("verified");
+    expect(getMilestone(b, "slack").state).toBe("configured");
+    expect(getMilestone(b, "slack").hint).toContain("not been verified");
+
+    process.env.SLACK_MODE = "http";
+    delete process.env.SLACK_APP_TOKEN;
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    const http = await buildStatusPayload();
+    expect(getMilestone(http, "slack").state).toBe("unverified");
+    expect(getMilestone(http, "slack").hint).toContain("unavailable");
 
     process.env.SLACK_DISABLE = "true";
     const c = await buildStatusPayload();
     expect(getMilestone(c, "slack").state).toBe("unverified");
   });
 
+  test("slack: invalid mode fails closed with a specific hint", async () => {
+    process.env.SLACK_MODE = "webhook";
+    process.env.SLACK_BOT_TOKEN = "xoxb-test";
+    process.env.SLACK_APP_TOKEN = "xapp-test";
+
+    const milestone = getMilestone(await buildStatusPayload(), "slack");
+    expect(milestone.state).toBe("unverified");
+    expect(milestone.hint).toContain("Invalid SLACK_MODE");
+  });
+
   test("github: needs webhook secret + app id + private key", async () => {
     process.env.GITHUB_WEBHOOK_SECRET = "secret";
     process.env.GITHUB_APP_ID = "12345";

package/src/tests/task-tool-preload-mcp.test.ts

@@ -73,6 +73,8 @@ async function pins(client: Client): Promise<string[]> {
     .sort();
 }
 
+// Eight real MCP sessions approach the 10s CI default under parallel runner load.
+// Keep the session-lifetime assertions together with room for connection setup.
 test("wire response is default-on, per-task, additive, and fixed for one MCP session", async () => {
   const task = await createTaskExtended("review fixture", { agentId, taskType: "review" });
   const other = await createTaskExtended("other fixture", { agentId, taskType: "other" });
@@ -115,7 +117,7 @@ test("wire response is default-on, per-task, additive, and fixed for one MCP ses
   await configure("TASK_TOOL_PRELOAD_ENABLED", "true");
   await configure("TASK_TOOL_MANIFESTS", "invalid deployment JSON");
   expect(await pins(await connect(task.id))).toEqual([]);
-});
+}, 30_000);
 
 test("a manifest cannot expand the scripts-only capability surface", async () => {
   const task = await createTaskExtended("script fixture", { agentId, taskType: "script" });

package/src/tests/telemetry-init.test.ts

@@ -794,6 +794,24 @@ describe("initTelemetry", () => {
       ).toBe(false);
     });
 
+    test("Slack HTTP mode uses the signing secret instead of an app token", () => {
+      expect(
+        _hasSlackChannel({
+          SLACK_MODE: "http",
+          SLACK_BOT_TOKEN: "xoxb-1",
+          SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+        }),
+      ).toBe(true);
+      expect(_hasSlackChannel({ SLACK_MODE: "http", SLACK_BOT_TOKEN: "xoxb-1" })).toBe(false);
+      expect(
+        _hasSlackChannel({
+          SLACK_MODE: "invalid",
+          SLACK_BOT_TOKEN: "xoxb-1",
+          SLACK_APP_TOKEN: "xapp-1",
+        }),
+      ).toBe(false);
+    });
+
     test("Email requires AGENTMAIL_WEBHOOK_SECRET", () => {
       expect(_hasEmailChannel({})).toBe(false);
       expect(_hasEmailChannel({ AGENTMAIL_WEBHOOK_SECRET: "whsec_1" })).toBe(true);