@desplega.ai/agent-swarm 1.152.2 → 1.153.0

package/src/tests/claude-managed-adapter.test.ts

@@ -898,6 +898,12 @@ describe("ClaudeManagedAdapter (Phase 4) — repo provisioning + cost data", ()
       cacheReadPerMillion: 0.25,
       cacheWritePerMillion: 12.5,
     });
+    expect(CLAUDE_MANAGED_MODEL_PRICING["claude-opus-5-5"]).toEqual({
+      inputPerMillion: 4.0,
+      outputPerMillion: 20.0,
+      cacheReadPerMillion: 0.2,
+      cacheWritePerMillion: 5.0,
+    });
     expect(CLAUDE_MANAGED_MODEL_PRICING["claude-opus-5"]).toEqual({
       inputPerMillion: 5.0,
       outputPerMillion: 25.0,

package/src/tests/codex-gpt6-release.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import { modelGroupsForHarness } from "../../apps/ui/src/lib/agent-runtime-models";
+import { buildModelsCatalog } from "../be/models-catalog";
+import cache from "../be/modelsdev-cache.json";
+import { buildModelsDevSeedRows } from "../be/seed-pricing";
+import {
+  CODEX_DEFAULT_MODEL,
+  CODEX_MODELS,
+  computeCodexCostUsd,
+  FALLBACK_CODEX_MODEL_PRICING,
+  getCodexContextWindow,
+  resolveCodexModel,
+} from "../providers/codex-models";
+import { applyReasoningEffort, reasoningCapability } from "../providers/reasoning-effort";
+
+const releases = [
+  { id: "gpt-6-sol", label: "GPT-6 Sol", input: 2, output: 10, read: 0.2, write: 2.5 },
+  { id: "gpt-6-luna", label: "GPT-6 Luna", input: 0.1, output: 0.5, read: 0.01, write: 0.125 },
+] as const;
+
+for (const release of releases) {
+  describe(release.id, () => {
+    test("uses the exact bare CLI ID with verified context and base costs", () => {
+      expect(CODEX_MODELS).toContain(release.id);
+      expect(resolveCodexModel(release.id.toUpperCase())).toBe(release.id);
+      expect(getCodexContextWindow(release.id)).toBe(1_050_000);
+      expect(cache.openai.models[release.id].limit.output).toBe(128_000);
+      expect(FALLBACK_CODEX_MODEL_PRICING[release.id]).toEqual({
+        inputPerMillion: release.input,
+        cachedInputPerMillion: release.read,
+        outputPerMillion: release.output,
+      });
+      expect(computeCodexCostUsd(release.id, 1_000_000, 250_000, 100_000)).toBeCloseTo(
+        release.input * 0.75 + release.read * 0.25 + release.output * 0.1,
+        8,
+      );
+    });
+
+    test("exposes the full reasoning range and transports none/max correctly", () => {
+      expect(reasoningCapability("codex", release.id)).toEqual({
+        supported: true,
+        levels: ["off", "low", "medium", "high", "xhigh", "max"],
+        default: "medium",
+      });
+      for (const [effort, value] of [
+        ["off", "none"],
+        ["max", "max"],
+      ] as const) {
+        expect(applyReasoningEffort("codex", release.id, effort)).toEqual({
+          kind: "codex-config",
+          config: { model_reasoning_effort: value },
+        });
+      }
+    });
+
+    test("seeds all four token classes under canonical Codex IDs", () => {
+      const rows = buildModelsDevSeedRows(cache).filter(
+        (row) => row.provider === "codex" && row.model === release.id,
+      );
+      expect(
+        Object.fromEntries(rows.map((row) => [row.tokenClass, row.pricePerMillionUsd])),
+      ).toEqual({
+        input: release.input,
+        output: release.output,
+        cached_input: release.read,
+        cache_write: release.write,
+      });
+      expect(cache.openai.models[release.id].cost.tiers).toEqual([
+        {
+          input: release.input * 2,
+          output: release.output * 1.5,
+          cache_read: release.read * 2,
+          cache_write: release.write * 2,
+          tier: { type: "context", size: 272000 },
+        },
+      ]);
+    });
+
+    test("is available through the catalog and direct UI selector", () => {
+      const model = buildModelsCatalog(cache).openai?.models[release.id];
+      expect(model?.limit?.context).toBe(1_050_000);
+      expect(model?.cost).toEqual({ input: release.input, output: release.output });
+      const option = modelGroupsForHarness("codex", undefined, undefined)
+        .flatMap((group) => group.models)
+        .find((entry) => entry.id === release.id);
+      expect(option?.label).toBe(release.label);
+      expect(option?.reasoningLevels).toEqual(["off", "low", "medium", "high", "xhigh", "max"]);
+    });
+  });
+}
+
+test("release additions preserve rollout-safe defaults and aliases", () => {
+  expect(CODEX_DEFAULT_MODEL).toBe("gpt-5.6-terra");
+  expect(resolveCodexModel("sonnet")).toBe("gpt-5.6-terra");
+  expect(resolveCodexModel("haiku")).toBe("gpt-5.6-luna");
+  expect(resolveCodexModel("opus")).toBe("gpt-5.6-sol");
+});

package/src/tests/config-api-only-keys.test.ts

@@ -50,6 +50,12 @@ beforeAll(async () => {
     value: BOOTSTRAP_VALUE,
     isSecret: true,
   });
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "SLACK_SIGNING_SECRET",
+    value: "synthetic-api-only-signing-secret",
+    isSecret: true,
+  });
   await upsertSwarmConfig({
     scope: "global",
     key: "SOME_WORKER_SECRET",
@@ -86,6 +92,7 @@ describe("API-only config keys are never served over HTTP", () => {
   test("GET /api/config/resolved WITHOUT agentId strips the bootstrap key", async () => {
     const { configs } = await getJson("/api/config/resolved?includeSecrets=true");
     expect(configs.some((c) => c.key === BOOTSTRAP_KEY)).toBe(false);
+    expect(configs.some((c) => c.key === "SLACK_SIGNING_SECRET")).toBe(false);
     // A legitimate worker secret still comes through.
     expect(configs.some((c) => c.key === "SOME_WORKER_SECRET")).toBe(true);
   });
@@ -95,11 +102,13 @@ describe("API-only config keys are never served over HTTP", () => {
       `/api/config/resolved?includeSecrets=true&agentId=${agentId}`,
     );
     expect(configs.some((c) => c.key === BOOTSTRAP_KEY)).toBe(false);
+    expect(configs.some((c) => c.key === "SLACK_SIGNING_SECRET")).toBe(false);
   });
 
   test("GET /api/config?scope=global strips the bootstrap key", async () => {
     const { configs } = await getJson("/api/config?scope=global&includeSecrets=true");
     expect(configs.some((c) => c.key === BOOTSTRAP_KEY)).toBe(false);
+    expect(configs.some((c) => c.key === "SLACK_SIGNING_SECRET")).toBe(false);
     expect(configs.some((c) => c.key === "SOME_WORKER_SECRET")).toBe(true);
   });
 });

package/src/tests/context-window.test.ts

@@ -18,6 +18,7 @@ describe("getContextWindowSize", () => {
   });
 
   test("returns 1M for opus models", () => {
+    expect(getContextWindowSize("claude-opus-5-5")).toBe(1_000_000);
     expect(getContextWindowSize("claude-opus-5")).toBe(1_000_000);
     expect(getContextWindowSize("claude-opus-4-8")).toBe(1_000_000);
     expect(getContextWindowSize("claude-opus-4-7")).toBe(1_000_000);

package/src/tests/dsh-adapter.test.ts

@@ -0,0 +1,276 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { chmod, mkdtemp, rename, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkProviderCredentials } from "../commands/provider-credentials";
+import { createProviderAdapter } from "../providers";
+import { checkDshCredentials, DshAdapter } from "../providers/dsh-adapter";
+import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { DEFAULT_MODEL_TIER_MAP } from "../types";
+import { getModelAwareCredentialVars } from "../utils/credentials";
+import { resolveHarnessProvider } from "../utils/harness-provider";
+import { DEFAULT_OPENROUTER_BASE_URL } from "../utils/openrouter-base-url";
+
+const directories: string[] = [];
+afterEach(async () => {
+  await Promise.all(
+    directories.splice(0).map((path) => rm(path, { recursive: true, force: true })),
+  );
+});
+
+async function fixture(mode = "success"): Promise<ProviderSessionConfig> {
+  const cwd = await mkdtemp(join(tmpdir(), "dsh-adapter-test-"));
+  directories.push(cwd);
+  const binary = join(cwd, "dsh");
+  await Bun.write(
+    binary,
+    `#!${process.execPath}
+const args = process.argv.slice(2);
+const patchPath = args[args.indexOf("--patch") + 1];
+const patch = await Bun.file(patchPath).json();
+const prompt = await Bun.stdin.text();
+await Bun.write("invocation.json", JSON.stringify({ args, patchPath, patch, prompt, cwd: process.cwd() }));
+const emit = (event) => console.log(JSON.stringify(event));
+emit({ type: "session", sessionId: "dsh-test-session" });
+const mode = process.env.DSH_TEST_MODE;
+if (mode === "abort") { setInterval(() => {}, 1000); }
+else {
+  if (mode === "malformed") console.log("bad json");
+  emit({ type: "status", phase: "turn_end", reason: { kind: mode === "failure" ? "error" : "completed" } });
+  if (mode !== "missing-final") {
+    // A split UTF-8 character plus a final line without a newline exercises both decoders.
+    const line = Buffer.from(JSON.stringify({ type: "final", text: "Done ✓" }));
+    const split = line.indexOf(Buffer.from("✓")) + 1;
+    process.stdout.write(line.subarray(0, split));
+    await Bun.sleep(10);
+    process.stdout.write(line.subarray(split));
+  }
+  if (mode === "failure") { console.error(process.env.DEEPSEEK_API_KEY); process.exitCode = 7; }
+}
+`,
+  );
+  await chmod(binary, 0o700);
+  return {
+    prompt: "--not-a-flag\nKeep $() and `quotes` literal.",
+    systemPrompt: "System instructions:\n!!js must remain text",
+    model: "deepseek-v4-pro",
+    role: "worker",
+    agentId: "agent-test",
+    taskId: "task-test",
+    apiUrl: "http://unused.invalid",
+    apiKey: "unused",
+    cwd,
+    logFile: join(cwd, "log.jsonl"),
+    env: {
+      DSH_BINARY: binary,
+      DEEPSEEK_API_KEY: "dsh-test-credential-value",
+      OPENROUTER_API_KEY: "",
+      OPENROUTER_BASE_URL: "",
+      DSH_TEST_MODE: mode,
+    },
+  };
+}
+
+describe("dsh harness", () => {
+  test("registry, model defaults, and credential dispatch select dsh", async () => {
+    expect(await createProviderAdapter("dsh")).toBeInstanceOf(DshAdapter);
+    expect(resolveHarnessProvider({ HARNESS_PROVIDER: "dsh" }, {})).toBe("dsh");
+    expect(DEFAULT_MODEL_TIER_MAP.dsh).toEqual(DEFAULT_MODEL_TIER_MAP.pi);
+    expect(checkDshCredentials({ OPENAI_API_KEY: "unrelated" }).ready).toBe(false);
+    expect(checkDshCredentials({ DEEPSEEK_API_KEY: " " }).ready).toBe(false);
+    expect(checkDshCredentials({}).missing).toEqual(["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY"]);
+    expect((await checkProviderCredentials("dsh", { OPENROUTER_API_KEY: "present" })).ready).toBe(
+      true,
+    );
+    expect(getModelAwareCredentialVars("dsh", DEFAULT_MODEL_TIER_MAP.dsh.ultra)).toEqual([
+      "OPENROUTER_API_KEY",
+    ]);
+    expect(getModelAwareCredentialVars("dsh", "deepseek-v4-pro")).toEqual(["DEEPSEEK_API_KEY"]);
+    expect((await checkProviderCredentials("dsh", { DEEPSEEK_API_KEY: "present" })).ready).toBe(
+      true,
+    );
+  });
+
+  test("passes prompt on stdin, patches model/system, preserves cwd and cleans up", async () => {
+    const config = await fixture();
+    const session = await new DshAdapter().createSession(config);
+    const events: ProviderEvent[] = [];
+    session.onEvent((event) => events.push(event));
+    expect(await session.waitForCompletion()).toMatchObject({
+      exitCode: 0,
+      isError: false,
+      output: "Done ✓",
+      sessionId: "dsh-test-session",
+    });
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(invocation.prompt).toBe(config.prompt);
+    expect(invocation.cwd).toBe(config.cwd);
+    expect(invocation.args).toEqual([
+      "--profile",
+      "headless",
+      "--patch",
+      invocation.patchPath,
+      "--json",
+      "-",
+    ]);
+    expect(invocation.patch).toContainEqual({
+      id: "agent-default-model",
+      config: { provider: "deepseek-official", model: config.model },
+    });
+    expect(invocation.patch).toContainEqual({
+      id: "system-prompt",
+      config: { personaPrefix: config.systemPrompt },
+    });
+    expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+    expect(events).toContainEqual({
+      type: "session_init",
+      sessionId: "dsh-test-session",
+      provider: "dsh",
+    });
+  });
+
+  for (const model of [
+    DEFAULT_MODEL_TIER_MAP.dsh.regular,
+    DEFAULT_MODEL_TIER_MAP.dsh.ultra,
+    "openrouter/vendor/new-model",
+  ]) {
+    test(`routes ${model} through OpenRouter with only its key`, async () => {
+      const config = await fixture();
+      config.model = model;
+      config.env = {
+        ...config.env,
+        DEEPSEEK_API_KEY: "",
+        OPENROUTER_API_KEY: "openrouter-test-key",
+      };
+      const session = await new DshAdapter().createSession(config);
+      expect((await session.waitForCompletion()).isError).toBe(false);
+      const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+      const modelId = model.slice("openrouter/".length);
+      expect(patch).toContainEqual({
+        id: "agent-default-model",
+        config: { provider: "openrouter", model: modelId },
+      });
+      expect(patch).toContainEqual({
+        id: "llm-pi-ai",
+        config: {
+          providers: {
+            openrouter: {
+              apiKeyEnv: "OPENROUTER_API_KEY",
+              baseURL: DEFAULT_OPENROUTER_BASE_URL,
+              api: "openai-completions",
+              models: [{ id: modelId }],
+            },
+          },
+        },
+      });
+      expect(JSON.stringify(patch)).not.toContain("openrouter-test-key");
+    });
+  }
+
+  test("defaults to OpenRouter and honors its base URL when both keys exist", async () => {
+    const config = await fixture();
+    config.model = undefined;
+    config.env = {
+      ...config.env,
+      OPENROUTER_API_KEY: "openrouter-test-key",
+      OPENROUTER_BASE_URL: " https://gateway.example/proxy/v1/// ",
+    };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(patch[0].config).toEqual({
+      provider: "openrouter",
+      model: "deepseek/deepseek-v4.1-flash",
+    });
+    expect(patch[2].config.providers.openrouter.baseURL).toBe("https://gateway.example/proxy/v1");
+  });
+
+  test("bare models keep direct DeepSeek when both keys exist", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, OPENROUTER_API_KEY: "openrouter-test-key" };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(patch[0].config.provider).toBe("deepseek-official");
+    expect(patch[2]).toEqual({ id: "llm-deepseek", config: { apiKeyEnv: "DEEPSEEK_API_KEY" } });
+  });
+
+  test("fails closed for absent or mismatched credentials and empty model IDs", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DEEPSEEK_API_KEY: "", OPENROUTER_API_KEY: "" };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "DEEPSEEK_API_KEY or OPENROUTER_API_KEY",
+    );
+    config.env.DEEPSEEK_API_KEY = "direct-test-key";
+    config.model = DEFAULT_MODEL_TIER_MAP.dsh.regular;
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "requires OPENROUTER_API_KEY",
+    );
+    config.env = { ...config.env, DEEPSEEK_API_KEY: "", OPENROUTER_API_KEY: "openrouter-test-key" };
+    config.model = "deepseek-v4-pro";
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "requires DEEPSEEK_API_KEY",
+    );
+    config.model = "openrouter/";
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow("requires a model ID");
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  test("fails closed when only npx is installed", async () => {
+    const config = await fixture();
+    await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
+    config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.1.7-alpha.2",
+    );
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  test("uses a preinstalled dsh from PATH without DSH_BINARY", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(invocation.args[0]).toBe("--profile");
+  });
+
+  test("does not fall back when an explicit DSH_BINARY is missing", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DSH_BINARY: join(config.cwd, "missing"), PATH: config.cwd };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow();
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  for (const mode of ["failure", "missing-final", "malformed"]) {
+    test(`reports ${mode} as failure even with output or exit zero`, async () => {
+      const config = await fixture(mode);
+      const session = await new DshAdapter().createSession(config);
+      const events: ProviderEvent[] = [];
+      session.onEvent((event) => events.push(event));
+      const result = await session.waitForCompletion();
+      expect(result.isError).toBe(true);
+      expect(result.exitCode).toBe(mode === "failure" ? 7 : 1);
+      expect(JSON.stringify({ result, events })).not.toContain(config.env!.DEEPSEEK_API_KEY);
+      const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+      expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+    });
+  }
+
+  test("abort terminates a running process and removes its patch", async () => {
+    const config = await fixture("abort");
+    const session = await new DshAdapter().createSession(config);
+    await new Promise<void>((resolve) =>
+      session.onEvent((event) => {
+        if (event.type === "session_init") resolve();
+      }),
+    );
+    await session.abort();
+    expect(await session.waitForCompletion()).toMatchObject({
+      isError: true,
+      failureReason: "dsh session aborted",
+    });
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+  });
+});

package/src/tests/e2e-nightly-report.test.ts

@@ -85,11 +85,11 @@ describe("nightly report", () => {
     });
     expect(report.ok).toBe(true);
     expect(report.missingLegs).toEqual([]);
-    expect(report.totalCostUsd).toBeCloseTo(0.0615, 6);
+    expect(report.totalCostUsd).toBeCloseTo(0.0738, 6);
     expect(report.warnings).toEqual([]);
     const markdown = nightlyMarkdown(report, [], DEFAULT_PROVIDERS);
     expect(markdown).toContain("## Nightly E2E: PASS");
-    expect(markdown).toContain("5/5 harness legs passed");
+    expect(markdown).toContain("6/6 harness legs passed");
     expect(markdown).toContain("| claude | claude-model | PASS | 1 |");
     expect(markdown).not.toContain("### Warnings");
   });
@@ -159,7 +159,7 @@ describe("nightly report", () => {
       results: [contractResult(), harnessResult([leg("claude")]), harnessResult([failed])],
     });
     expect(report.ok).toBe(false);
-    expect(report.missingLegs).toEqual(["claude-sdk", "pi", "opencode"]);
+    expect(report.missingLegs).toEqual(["claude-sdk", "pi", "opencode", "dsh"]);
     expect(report.warnings).toContain("pi: no result file from the leg.");
     expect(report.warnings).toContain("codex: needed 2 attempts.");
     const markdown = nightlyMarkdown(report, [], DEFAULT_PROVIDERS);

package/src/tests/e2e-redact.test.ts

@@ -43,6 +43,7 @@ describe("e2e redaction", () => {
     const saved = { ...process.env };
     try {
       process.env.OPENROUTER_API_KEY = "example-sk-or-v1-known-value-1234";
+      process.env.DEEPSEEK_API_KEY = "deepseek-known-value-1234";
       process.env.CODEX_OAUTH = JSON.stringify({
         access: "access-token-value-1234",
         refresh: "refresh-token-value-1234",
@@ -51,6 +52,7 @@ describe("e2e redaction", () => {
       });
       const known = knownSecrets(["extra-secret-value"]);
       expect(known).toContain("example-sk-or-v1-known-value-1234");
+      expect(known).toContain("deepseek-known-value-1234");
       expect(known).toContain("access-token-value-1234");
       expect(known).toContain("refresh-token-value-1234");
       expect(known).toContain("extra-secret-value");

package/src/tests/env-flag.test.ts

@@ -62,6 +62,12 @@ describe("swarm-config-guard: Configuration-page value validation", () => {
     expect(validateConfigValue("SLACK_THREAD_STEERING_MODE", "now")).toContain("must be one of");
   });
 
+  test("Slack transport is constrained", () => {
+    expect(validateConfigValue("SLACK_MODE", "socket")).toBeNull();
+    expect(validateConfigValue("SLACK_MODE", "http")).toBeNull();
+    expect(validateConfigValue("SLACK_MODE", "webhook")).toContain("must be one of");
+  });
+
   test("Slack reaction shortcode keys accept bare and colon-wrapped names", () => {
     const keys = [
       "SLACK_REACTION_ACCEPTED",

package/src/tests/extensions-db.test.ts

@@ -2,6 +2,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { closeDb, getDbClient, initDb } from "../be/db";
 import {
   deleteExtension,
+  ExtensionOwnershipError,
   getExtensionById,
   getExtensionFiles,
   getExtensionVersion,
@@ -67,6 +68,46 @@ describe("extension DB helpers", () => {
     ).toBe(1);
   });
 
+  test("concurrent worker installs cannot take ownership of the same name", async () => {
+    const bundle = await loadBundleFixture("minimal");
+    const results = await Promise.allSettled(
+      ["worker-a", "worker-b"].map((agentId) =>
+        installExtension({ ...bundle, agentId, ownerOnly: agentId }),
+      ),
+    );
+    expect(results.filter((result) => result.status === "fulfilled")).toHaveLength(1);
+    const rejected = results.find((result) => result.status === "rejected");
+    expect(rejected?.status === "rejected" && rejected.reason).toBeInstanceOf(
+      ExtensionOwnershipError,
+    );
+    const winner = results.find((result) => result.status === "fulfilled");
+    if (winner?.status !== "fulfilled") throw new Error("missing winning install");
+    expect(await listExtensionVersions(winner.value.extension.id)).toHaveLength(1);
+  });
+
+  test("worker metadata writes and deletion recheck disabled ownership at the database write", async () => {
+    const installed = await installExtension({
+      ...(await loadBundleFixture("minimal")),
+      agentId: "owner",
+    });
+    const id = installed.extension.id;
+    await expect(
+      updateExtensionMeta(id, { priority: 7, ownerOnly: "other" }),
+    ).rejects.toBeInstanceOf(ExtensionOwnershipError);
+    await expect(deleteExtension(id, "other")).rejects.toBeInstanceOf(ExtensionOwnershipError);
+    await setExtensionState(id, { enabled: true, status: "enabled" });
+    await expect(
+      updateExtensionMeta(id, { priority: 7, ownerOnly: "owner" }),
+    ).rejects.toBeInstanceOf(ExtensionOwnershipError);
+    await expect(deleteExtension(id, "owner")).rejects.toBeInstanceOf(ExtensionOwnershipError);
+    expect(await getExtensionById(id)).toMatchObject({ enabled: true, priority: 100 });
+    await setExtensionState(id, { enabled: false, status: "disabled" });
+    expect(await updateExtensionMeta(id, { priority: 7, ownerOnly: "owner" })).toMatchObject({
+      priority: 7,
+    });
+    expect(await deleteExtension(id, "owner")).toBe(true);
+  });
+
   test("matching bundles dedupe and changed hooks create a complete snapshot", async () => {
     const bundle = await loadBundleFixture("minimal");
     const first = await installExtension(bundle);