@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/src/tests/db-task-write-contract.test.ts

@@ -95,8 +95,12 @@ type:UpsertAssetKeyMappingInput
 type:WorkflowFilters
 type:WorkflowRunListOptions
 type:WorkflowRunPage
+value:EXTENSION_AGENT_ROLE
+value:ExtensionAgentAssignmentError
 value:KvTypeCollisionError
 value:MAX_EMPTY_POLLS
+value:NOT_EXTENSION_AGENT_SQL
+value:ReservedAgentRoleError
 value:SKILL_FILE_LIMITS
 value:UNATTRIBUTED_USER_ID
 value:__resetSqliteVecExtensionPathCacheForTests
@@ -196,6 +200,7 @@ value:emitBuiltInIntegrationConnectedOnce
 value:emitMcpServerConnectedTelemetry
 value:ensureSlackDelegationActivation
 value:ensureSlackRenderV2Activation
+value:extensionAgentAssignmentError
 value:failPendingResumeIfUnclaimed
 value:failTask
 value:findCompletedTaskInThread
@@ -327,6 +332,7 @@ value:getRecentFailedTasks
 value:getRecentlyCancelledTasksForAgent
 value:getRecentlyFinishedWorkerTasks
 value:getRemainingCapacity
+value:getResolvableDeferralOutcomes
 value:getResolvedConfig
 value:getRetryableSteps
 value:getRootTaskChain
@@ -419,6 +425,7 @@ value:installMcpServer
 value:installSkill
 value:installSystemDefaultSkillsForAgent
 value:isAgentEligibleForTask
+value:isExtensionAgent
 value:isPendingSlackMessage
 value:isPoolAffinityEnforcementEnabled
 value:isSqliteVecAvailable
@@ -450,6 +457,7 @@ value:markInboxMessageDelegated
 value:markInboxMessageRead
 value:markInboxMessageResponded
 value:markKeyRateLimited
+value:markSlackDeferralResolved
 value:markSlackRelayAttempted
 value:markSlackRelayDelivered
 value:markSlackTreeRendered
@@ -486,6 +494,7 @@ value:releaseStaleReviewingTasks
 value:releaseTask
 value:replaceTaskAttachment
 value:reserveSlackMessage
+value:reservedRoleViolation
 value:resetEmptyPollCount
 value:resetOrphanedInProgressTasksForAgent
 value:resetPromptTemplateToDefault

package/src/tests/defer-task.test.ts

@@ -184,16 +184,19 @@ describe("defer-task handler", () => {
 
     const stored = await getTaskById(task.id);
     expect(stored?.status).toBe("completed");
-    // Human-facing output: one line, `Deferred until {date} {time} ({link}) -> {desc}`.
-    // No requestedByUserId is set on this task, so it falls back to UTC and
+    expect(stored?.deferredAt).toBeTruthy();
+    // Human-facing output for a time-based defer: when it comes back, nothing
+    // else. No requestedByUserId is set here, so it falls back to UTC and
     // labels it explicitly.
-    const shortId = schedule.id.slice(0, 8);
     expect(stored?.output).toMatch(
-      /^Deferred until (today|tomorrow|\d{2}-\d{2}) \d{2}:\d{2}:\d{2} UTC \(/,
-    );
-    expect(stored?.output).toContain(
-      `([${shortId}](https://app.agent-swarm.dev/schedules/${schedule.id})) -> deploy 42 is still running`,
+      /^Checking back (today|tomorrow|on \d{2}-\d{2}) at \d{2}:\d{2} UTC$/,
     );
+    // The agent's internal note, the checks, the schedule UUID and its link
+    // all stay out of the card — they live in the task log and the wake-up
+    // task's template.
+    expect(stored?.output).not.toContain("deploy 42 is still running");
+    expect(stored?.output).not.toContain(schedule.id);
+    expect(stored?.output).not.toContain("app.agent-swarm.dev");
     expect(stored?.output).not.toContain(schedule.nextRunAt!);
     expect(stored?.output).not.toContain("Checks:");
     expect(stored?.output).not.toContain("- smoke tests pass");
@@ -441,16 +444,15 @@ describe("defer-task handler", () => {
     )) as DeferTaskResult;
     expect(result.structuredContent.success).toBe(true);
     const stored = await getTaskById(task.id);
-    const shortId = result.structuredContent.scheduleId!.slice(0, 8);
     expect(stored?.output).toMatch(
-      /^Deferred until (today|tomorrow|\d{2}-\d{2}) \d{2}:\d{2}:\d{2} UTC \(/,
+      /^Checking back (today|tomorrow|on \d{2}-\d{2}) at \d{2}:\d{2} UTC$/,
     );
-    expect(stored?.output).toContain(`([${shortId}](`);
-    expect(stored?.output).toContain(") -> pending");
+    expect(stored?.output).not.toContain(result.structuredContent.scheduleId!);
+    expect(stored?.output).not.toContain("pending");
     expect(stored?.output).not.toContain(SUMMARY);
   });
 
-  test("human-facing output strips a repeated Pending: prefix and caps a long note", async () => {
+  test("a long note never reaches the card, only the log and the wake-up task", async () => {
     const task = await startedTask("verbose note");
     const longNote = `Pending: ${"x".repeat(300)}\nsecond line is dropped`;
     const result = (await buildTool().handler(
@@ -460,10 +462,11 @@ describe("defer-task handler", () => {
 
     expect(result.structuredContent.success).toBe(true);
     const stored = await getTaskById(task.id);
-    // No doubled "Pending: Pending:", no second line, capped with an ellipsis.
-    expect(stored?.output).not.toContain("Pending: Pending:");
+    // The card answers "when", so there is nothing left to truncate: no note
+    // fragment, no ellipsis, no mid-sentence cut.
+    expect(stored?.output).not.toContain("x");
     expect(stored?.output).not.toContain("second line is dropped");
-    expect(stored?.output).toContain(`-> ${"x".repeat(99)}…`);
+    expect(stored?.output).not.toContain("…");
 
     // The full untrimmed note still reaches the task log and the wake-up task.
     const logs = (await getLogsByTaskId(task.id)).filter(
@@ -489,7 +492,7 @@ describe("defer-task handler", () => {
     const stored = await getTaskById(task.id);
     // A real timezone is on file: no explicit "UTC" label on the time.
     expect(stored?.output).toMatch(
-      /^Deferred until (today|tomorrow|\d{2}-\d{2}) \d{2}:\d{2}:\d{2} \(/,
+      /^Checking back (today|tomorrow|on \d{2}-\d{2}) at \d{2}:\d{2}$/,
     );
   });
 
@@ -562,4 +565,100 @@ describe("defer-task handler", () => {
     const stored = await getTaskById(task.id);
     expect(stored?.status).toBe("completed");
   });
+
+  test("a wakeOn defer names who it is waiting on, with the ceiling as the fallback", async () => {
+    const watchedOwner = (
+      await createAgent({
+        name: "Researcher",
+        description: "Agent whose task is watched",
+        role: "worker",
+        isLead: false,
+        status: "busy",
+        maxTasks: 1,
+        capabilities: [],
+      })
+    ).id;
+    const watched = await startedTask("the work being waited on", watchedOwner);
+    const task = await startedTask("waiting on a sibling");
+
+    const result = (await buildTool().handler(
+      {
+        taskId: task.id,
+        delayMs: 1_800_000,
+        summary: SUMMARY,
+        note: "internal handoff note that must not appear",
+        wakeOn: { event: "settled", taskIds: [watched.id] },
+      },
+      meta(),
+    )) as DeferTaskResult;
+
+    expect(result.structuredContent.success).toBe(true);
+    const stored = await getTaskById(task.id);
+    // Event-based AND time-based: `delayMs`/`runAt` is required even with
+    // wakeOn, so the ceiling is always the honest fallback.
+    expect(stored?.output).toMatch(
+      /^Waiting on Researcher — or (today|tomorrow|on \d{2}-\d{2}) at \d{2}:\d{2} UTC at the latest$/,
+    );
+    expect(stored?.output).not.toContain("internal handoff note");
+    expect(stored?.output).not.toContain(watched.id);
+  });
+
+  test("a wakeOn defer on unassigned tasks falls back to a count, not a UUID", async () => {
+    const watched = await createTaskExtended("unassigned watched work", { source: "mcp" });
+    const task = await startedTask("waiting on an unassigned task");
+
+    await buildTool().handler(
+      {
+        taskId: task.id,
+        delayMs: 60_000,
+        summary: SUMMARY,
+        note: "pending",
+        wakeOn: { event: "settled", taskIds: [watched.id] },
+      },
+      meta(),
+    );
+
+    const stored = await getTaskById(task.id);
+    expect(stored?.output).toStartWith("Waiting on 1 task — or ");
+    expect(stored?.output).not.toContain(watched.id);
+  });
+
+  test("the schedule keeps the delay that was actually requested", async () => {
+    const byDelay = await startedTask("delay provenance");
+    await buildTool().handler(
+      { taskId: byDelay.id, delayMs: 1_800_000, summary: SUMMARY, note: "pending" },
+      meta(),
+    );
+    const delaySchedule = (await schedulesForTask(byDelay.id))[0]!;
+    expect(delaySchedule.requestedDelayMs).toBe(1_800_000);
+    expect(delaySchedule.requestedRunAt).toBeUndefined();
+
+    const runAt = new Date(Date.now() + 3_600_000).toISOString();
+    const byRunAt = await startedTask("runAt provenance");
+    await buildTool().handler(
+      { taskId: byRunAt.id, runAt, summary: SUMMARY, note: "pending" },
+      meta(),
+    );
+    const runAtSchedule = (await schedulesForTask(byRunAt.id))[0]!;
+    expect(runAtSchedule.requestedRunAt).toBe(runAt);
+    expect(runAtSchedule.requestedDelayMs).toBeUndefined();
+  });
+
+  test("deferredAt marks the deferring task, and a plain completion leaves it unset", async () => {
+    const deferred = await startedTask("ends in a deferral");
+    await buildTool().handler(
+      { taskId: deferred.id, delayMs: 60_000, summary: SUMMARY, note: "pending" },
+      meta(),
+    );
+    expect((await getTaskById(deferred.id))?.deferredAt).toBeTruthy();
+
+    // Negative control: the same tag on a task that simply finished. A wake-up
+    // task inherits `deferred` from its schedule, so the tag alone cannot tell
+    // "parked" from "done" — only `deferredAt` can.
+    const finished = await startedTask("ends normally");
+    await completeTask(finished.id, "done", { addTags: ["deferred"] });
+    const storedFinished = await getTaskById(finished.id);
+    expect(storedFinished?.tags).toContain("deferred");
+    expect(storedFinished?.deferredAt).toBeUndefined();
+  });
 });

package/src/tests/dsh-adapter.test.ts

@@ -0,0 +1,276 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { chmod, mkdtemp, rename, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkProviderCredentials } from "../commands/provider-credentials";
+import { createProviderAdapter } from "../providers";
+import { checkDshCredentials, DshAdapter } from "../providers/dsh-adapter";
+import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { DEFAULT_MODEL_TIER_MAP } from "../types";
+import { getModelAwareCredentialVars } from "../utils/credentials";
+import { resolveHarnessProvider } from "../utils/harness-provider";
+import { DEFAULT_OPENROUTER_BASE_URL } from "../utils/openrouter-base-url";
+
+const directories: string[] = [];
+afterEach(async () => {
+  await Promise.all(
+    directories.splice(0).map((path) => rm(path, { recursive: true, force: true })),
+  );
+});
+
+async function fixture(mode = "success"): Promise<ProviderSessionConfig> {
+  const cwd = await mkdtemp(join(tmpdir(), "dsh-adapter-test-"));
+  directories.push(cwd);
+  const binary = join(cwd, "dsh");
+  await Bun.write(
+    binary,
+    `#!${process.execPath}
+const args = process.argv.slice(2);
+const patchPath = args[args.indexOf("--patch") + 1];
+const patch = await Bun.file(patchPath).json();
+const prompt = await Bun.stdin.text();
+await Bun.write("invocation.json", JSON.stringify({ args, patchPath, patch, prompt, cwd: process.cwd() }));
+const emit = (event) => console.log(JSON.stringify(event));
+emit({ type: "session", sessionId: "dsh-test-session" });
+const mode = process.env.DSH_TEST_MODE;
+if (mode === "abort") { setInterval(() => {}, 1000); }
+else {
+  if (mode === "malformed") console.log("bad json");
+  emit({ type: "status", phase: "turn_end", reason: { kind: mode === "failure" ? "error" : "completed" } });
+  if (mode !== "missing-final") {
+    // A split UTF-8 character plus a final line without a newline exercises both decoders.
+    const line = Buffer.from(JSON.stringify({ type: "final", text: "Done ✓" }));
+    const split = line.indexOf(Buffer.from("✓")) + 1;
+    process.stdout.write(line.subarray(0, split));
+    await Bun.sleep(10);
+    process.stdout.write(line.subarray(split));
+  }
+  if (mode === "failure") { console.error(process.env.DEEPSEEK_API_KEY); process.exitCode = 7; }
+}
+`,
+  );
+  await chmod(binary, 0o700);
+  return {
+    prompt: "--not-a-flag\nKeep $() and `quotes` literal.",
+    systemPrompt: "System instructions:\n!!js must remain text",
+    model: "deepseek-v4-pro",
+    role: "worker",
+    agentId: "agent-test",
+    taskId: "task-test",
+    apiUrl: "http://unused.invalid",
+    apiKey: "unused",
+    cwd,
+    logFile: join(cwd, "log.jsonl"),
+    env: {
+      DSH_BINARY: binary,
+      DEEPSEEK_API_KEY: "dsh-test-credential-value",
+      OPENROUTER_API_KEY: "",
+      OPENROUTER_BASE_URL: "",
+      DSH_TEST_MODE: mode,
+    },
+  };
+}
+
+describe("dsh harness", () => {
+  test("registry, model defaults, and credential dispatch select dsh", async () => {
+    expect(await createProviderAdapter("dsh")).toBeInstanceOf(DshAdapter);
+    expect(resolveHarnessProvider({ HARNESS_PROVIDER: "dsh" }, {})).toBe("dsh");
+    expect(DEFAULT_MODEL_TIER_MAP.dsh).toEqual(DEFAULT_MODEL_TIER_MAP.pi);
+    expect(checkDshCredentials({ OPENAI_API_KEY: "unrelated" }).ready).toBe(false);
+    expect(checkDshCredentials({ DEEPSEEK_API_KEY: " " }).ready).toBe(false);
+    expect(checkDshCredentials({}).missing).toEqual(["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY"]);
+    expect((await checkProviderCredentials("dsh", { OPENROUTER_API_KEY: "present" })).ready).toBe(
+      true,
+    );
+    expect(getModelAwareCredentialVars("dsh", DEFAULT_MODEL_TIER_MAP.dsh.ultra)).toEqual([
+      "OPENROUTER_API_KEY",
+    ]);
+    expect(getModelAwareCredentialVars("dsh", "deepseek-v4-pro")).toEqual(["DEEPSEEK_API_KEY"]);
+    expect((await checkProviderCredentials("dsh", { DEEPSEEK_API_KEY: "present" })).ready).toBe(
+      true,
+    );
+  });
+
+  test("passes prompt on stdin, patches model/system, preserves cwd and cleans up", async () => {
+    const config = await fixture();
+    const session = await new DshAdapter().createSession(config);
+    const events: ProviderEvent[] = [];
+    session.onEvent((event) => events.push(event));
+    expect(await session.waitForCompletion()).toMatchObject({
+      exitCode: 0,
+      isError: false,
+      output: "Done ✓",
+      sessionId: "dsh-test-session",
+    });
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(invocation.prompt).toBe(config.prompt);
+    expect(invocation.cwd).toBe(config.cwd);
+    expect(invocation.args).toEqual([
+      "--profile",
+      "headless",
+      "--patch",
+      invocation.patchPath,
+      "--json",
+      "-",
+    ]);
+    expect(invocation.patch).toContainEqual({
+      id: "agent-default-model",
+      config: { provider: "deepseek-official", model: config.model },
+    });
+    expect(invocation.patch).toContainEqual({
+      id: "system-prompt",
+      config: { personaPrefix: config.systemPrompt },
+    });
+    expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+    expect(events).toContainEqual({
+      type: "session_init",
+      sessionId: "dsh-test-session",
+      provider: "dsh",
+    });
+  });
+
+  for (const model of [
+    DEFAULT_MODEL_TIER_MAP.dsh.regular,
+    DEFAULT_MODEL_TIER_MAP.dsh.ultra,
+    "openrouter/vendor/new-model",
+  ]) {
+    test(`routes ${model} through OpenRouter with only its key`, async () => {
+      const config = await fixture();
+      config.model = model;
+      config.env = {
+        ...config.env,
+        DEEPSEEK_API_KEY: "",
+        OPENROUTER_API_KEY: "openrouter-test-key",
+      };
+      const session = await new DshAdapter().createSession(config);
+      expect((await session.waitForCompletion()).isError).toBe(false);
+      const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+      const modelId = model.slice("openrouter/".length);
+      expect(patch).toContainEqual({
+        id: "agent-default-model",
+        config: { provider: "openrouter", model: modelId },
+      });
+      expect(patch).toContainEqual({
+        id: "llm-pi-ai",
+        config: {
+          providers: {
+            openrouter: {
+              apiKeyEnv: "OPENROUTER_API_KEY",
+              baseURL: DEFAULT_OPENROUTER_BASE_URL,
+              api: "openai-completions",
+              models: [{ id: modelId }],
+            },
+          },
+        },
+      });
+      expect(JSON.stringify(patch)).not.toContain("openrouter-test-key");
+    });
+  }
+
+  test("defaults to OpenRouter and honors its base URL when both keys exist", async () => {
+    const config = await fixture();
+    config.model = undefined;
+    config.env = {
+      ...config.env,
+      OPENROUTER_API_KEY: "openrouter-test-key",
+      OPENROUTER_BASE_URL: " https://gateway.example/proxy/v1/// ",
+    };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(patch[0].config).toEqual({
+      provider: "openrouter",
+      model: "deepseek/deepseek-v4.1-flash",
+    });
+    expect(patch[2].config.providers.openrouter.baseURL).toBe("https://gateway.example/proxy/v1");
+  });
+
+  test("bare models keep direct DeepSeek when both keys exist", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, OPENROUTER_API_KEY: "openrouter-test-key" };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(patch[0].config.provider).toBe("deepseek-official");
+    expect(patch[2]).toEqual({ id: "llm-deepseek", config: { apiKeyEnv: "DEEPSEEK_API_KEY" } });
+  });
+
+  test("fails closed for absent or mismatched credentials and empty model IDs", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DEEPSEEK_API_KEY: "", OPENROUTER_API_KEY: "" };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "DEEPSEEK_API_KEY or OPENROUTER_API_KEY",
+    );
+    config.env.DEEPSEEK_API_KEY = "direct-test-key";
+    config.model = DEFAULT_MODEL_TIER_MAP.dsh.regular;
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "requires OPENROUTER_API_KEY",
+    );
+    config.env = { ...config.env, DEEPSEEK_API_KEY: "", OPENROUTER_API_KEY: "openrouter-test-key" };
+    config.model = "deepseek-v4-pro";
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "requires DEEPSEEK_API_KEY",
+    );
+    config.model = "openrouter/";
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow("requires a model ID");
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  test("fails closed when only npx is installed", async () => {
+    const config = await fixture();
+    await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
+    config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow(
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.1.7-alpha.2",
+    );
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  test("uses a preinstalled dsh from PATH without DSH_BINARY", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(invocation.args[0]).toBe("--profile");
+  });
+
+  test("does not fall back when an explicit DSH_BINARY is missing", async () => {
+    const config = await fixture();
+    config.env = { ...config.env, DSH_BINARY: join(config.cwd, "missing"), PATH: config.cwd };
+    await expect(new DshAdapter().createSession(config)).rejects.toThrow();
+    expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
+  });
+
+  for (const mode of ["failure", "missing-final", "malformed"]) {
+    test(`reports ${mode} as failure even with output or exit zero`, async () => {
+      const config = await fixture(mode);
+      const session = await new DshAdapter().createSession(config);
+      const events: ProviderEvent[] = [];
+      session.onEvent((event) => events.push(event));
+      const result = await session.waitForCompletion();
+      expect(result.isError).toBe(true);
+      expect(result.exitCode).toBe(mode === "failure" ? 7 : 1);
+      expect(JSON.stringify({ result, events })).not.toContain(config.env!.DEEPSEEK_API_KEY);
+      const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+      expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+    });
+  }
+
+  test("abort terminates a running process and removes its patch", async () => {
+    const config = await fixture("abort");
+    const session = await new DshAdapter().createSession(config);
+    await new Promise<void>((resolve) =>
+      session.onEvent((event) => {
+        if (event.type === "session_init") resolve();
+      }),
+    );
+    await session.abort();
+    expect(await session.waitForCompletion()).toMatchObject({
+      isError: true,
+      failureReason: "dsh session aborted",
+    });
+    const invocation = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(await Bun.file(invocation.patchPath).exists()).toBe(false);
+  });
+});

package/src/tests/e2e-nightly-report.test.ts

@@ -85,11 +85,11 @@ describe("nightly report", () => {
     });
     expect(report.ok).toBe(true);
     expect(report.missingLegs).toEqual([]);
-    expect(report.totalCostUsd).toBeCloseTo(0.0615, 6);
+    expect(report.totalCostUsd).toBeCloseTo(0.0738, 6);
     expect(report.warnings).toEqual([]);
     const markdown = nightlyMarkdown(report, [], DEFAULT_PROVIDERS);
     expect(markdown).toContain("## Nightly E2E: PASS");
-    expect(markdown).toContain("5/5 harness legs passed");
+    expect(markdown).toContain("6/6 harness legs passed");
     expect(markdown).toContain("| claude | claude-model | PASS | 1 |");
     expect(markdown).not.toContain("### Warnings");
   });
@@ -159,7 +159,7 @@ describe("nightly report", () => {
       results: [contractResult(), harnessResult([leg("claude")]), harnessResult([failed])],
     });
     expect(report.ok).toBe(false);
-    expect(report.missingLegs).toEqual(["claude-sdk", "pi", "opencode"]);
+    expect(report.missingLegs).toEqual(["claude-sdk", "pi", "opencode", "dsh"]);
     expect(report.warnings).toContain("pi: no result file from the leg.");
     expect(report.warnings).toContain("codex: needed 2 attempts.");
     const markdown = nightlyMarkdown(report, [], DEFAULT_PROVIDERS);

package/src/tests/e2e-redact.test.ts

@@ -43,6 +43,7 @@ describe("e2e redaction", () => {
     const saved = { ...process.env };
     try {
       process.env.OPENROUTER_API_KEY = "example-sk-or-v1-known-value-1234";
+      process.env.DEEPSEEK_API_KEY = "deepseek-known-value-1234";
       process.env.CODEX_OAUTH = JSON.stringify({
         access: "access-token-value-1234",
         refresh: "refresh-token-value-1234",
@@ -51,6 +52,7 @@ describe("e2e redaction", () => {
       });
       const known = knownSecrets(["extra-secret-value"]);
       expect(known).toContain("example-sk-or-v1-known-value-1234");
+      expect(known).toContain("deepseek-known-value-1234");
       expect(known).toContain("access-token-value-1234");
       expect(known).toContain("refresh-token-value-1234");
       expect(known).toContain("extra-secret-value");

package/src/tests/env-flag.test.ts

@@ -62,6 +62,12 @@ describe("swarm-config-guard: Configuration-page value validation", () => {
     expect(validateConfigValue("SLACK_THREAD_STEERING_MODE", "now")).toContain("must be one of");
   });
 
+  test("Slack transport is constrained", () => {
+    expect(validateConfigValue("SLACK_MODE", "socket")).toBeNull();
+    expect(validateConfigValue("SLACK_MODE", "http")).toBeNull();
+    expect(validateConfigValue("SLACK_MODE", "webhook")).toContain("must be one of");
+  });
+
   test("Slack reaction shortcode keys accept bare and colon-wrapped names", () => {
     const keys = [
       "SLACK_REACTION_ACCEPTED",