@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/src/tests/extensions-http.test.ts

@@ -6,6 +6,7 @@ import {
   getExtensionByName,
   insertExtensionRun,
   listExtensionRuns,
+  listExtensionVersions,
   setExtensionState,
 } from "../be/extensions/db";
 import { enqueueAuditRow, flushAuditBuffer } from "../be/rbac-audit";
@@ -259,16 +260,159 @@ describe("/api/extensions HTTP", () => {
     expect((await response.json()).runs).toEqual([second, first]);
   });
 
-  test("lead agents may install, workers may not, and agent installs stay disabled", async () => {
-    expect((await install("minimal", workerId)).status).toBe(403);
-    const response = await install("minimal", leadId);
+  test("worker installs are owned, disabled, and cannot activate their own extension", async () => {
+    const response = await install("minimal", workerId);
     expect(response.status).toBe(200);
     const extension = (await response.json()).extension as {
       enabled: boolean;
       createdByAgentId: string | null;
     };
     expect(extension.enabled).toBe(false);
-    expect(extension.createdByAgentId).toBe(leadId);
+    expect(extension.createdByAgentId).toBe(workerId);
+    const stored = (await getExtensionByName("minimal"))!;
+    expect(stored.status).toBe("disabled");
+    expect(stored.agentId).toBeNull();
+    for (const operation of ["enable", "disable", "activate-version"]) {
+      expect(
+        (
+          await dispatch(`/api/extensions/${stored.id}/${operation}`, {
+            method: "POST",
+            agentId: workerId,
+            body: JSON.stringify({ version: 1 }),
+          })
+        ).status,
+      ).toBe(403);
+    }
+    expect(await listExtensionRuns(stored.id)).toHaveLength(0);
+    expect((await dispatch(`/api/extensions/${stored.id}`)).text).toContain(workerId);
+    expect((await dispatch("/api/extensions")).text).toContain(workerId);
+    const changed = await loadBundleFixture("minimal");
+    changed.files["hooks.ts"] += "\n// worker draft v2\n";
+    expect(
+      (
+        await dispatch("/api/extensions/install", {
+          method: "POST",
+          agentId: workerId,
+          body: JSON.stringify(changed),
+        })
+      ).status,
+    ).toBe(200);
+    expect(await getExtensionByName("minimal")).toMatchObject({
+      version: 2,
+      activeVersion: 1,
+      enabled: false,
+      status: "disabled",
+      createdByAgentId: workerId,
+    });
+    const versions = await listExtensionVersions(stored.id);
+    expect(versions).toHaveLength(2);
+    expect(versions.every((version) => version.changedByAgentId === workerId)).toBe(true);
+  });
+
+  test("install never evaluates worker bundle code", async () => {
+    const bundle = await loadBundleFixture("minimal");
+    bundle.files["hooks.ts"] += '\nthrow new Error("must only run on activation");\n';
+    const response = await dispatch("/api/extensions/install", {
+      method: "POST",
+      agentId: workerId,
+      body: JSON.stringify(bundle),
+    });
+    expect(response.status).toBe(200);
+    const stored = (await getExtensionByName("minimal"))!;
+    expect(stored).toMatchObject({ enabled: false, status: "disabled", agentId: null });
+    expect(await listExtensionRuns(stored.id)).toHaveLength(0);
+    const activation = await dispatch(`/api/extensions/${stored.id}/enable`, { method: "POST" });
+    expect(activation.status).toBe(500);
+    expect(activation.text).toContain("must only run on activation");
+  });
+
+  test("workers cannot overwrite, patch, or delete another owner's extension", async () => {
+    await install("minimal", leadId);
+    const stored = (await getExtensionByName("minimal"))!;
+    expect((await install("minimal", workerId)).status).toBe(403);
+    for (const method of ["PATCH", "DELETE"]) {
+      expect(
+        (
+          await dispatch(`/api/extensions/${stored.id}`, {
+            method,
+            agentId: workerId,
+            ...(method === "PATCH" ? { body: JSON.stringify({ priority: 7 }) } : {}),
+          })
+        ).status,
+      ).toBe(403);
+    }
+    expect(await getExtensionByName("minimal")).toMatchObject({
+      createdByAgentId: leadId,
+      priority: 100,
+      version: 1,
+    });
+  });
+
+  test("worker owners edit and delete disabled drafts, but cannot reload live code", async () => {
+    await install("minimal", workerId);
+    const stored = (await getExtensionByName("minimal"))!;
+    const path = `/api/extensions/${stored.id}`;
+    expect(
+      (
+        await dispatch(path, {
+          method: "PATCH",
+          agentId: workerId,
+          body: JSON.stringify({ priority: 7 }),
+        })
+      ).status,
+    ).toBe(200);
+    expect((await dispatch(`${path}/enable`, { method: "POST", agentId: leadId })).status).toBe(
+      200,
+    );
+    expect(
+      (
+        await dispatch(path, {
+          method: "PATCH",
+          agentId: workerId,
+          body: JSON.stringify({ config: { live: true } }),
+        })
+      ).status,
+    ).toBe(403);
+    const changed = await loadBundleFixture("minimal");
+    changed.files["hooks.ts"] += '\nthrow new Error("inactive worker version executed");\n';
+    expect(
+      (
+        await dispatch("/api/extensions/install", {
+          method: "POST",
+          agentId: workerId,
+          body: JSON.stringify({ ...changed, config: { live: true } }),
+        })
+      ).status,
+    ).toBe(403);
+    expect(
+      (
+        await dispatch("/api/extensions/install", {
+          method: "POST",
+          agentId: workerId,
+          body: JSON.stringify(changed),
+        })
+      ).status,
+    ).toBe(200);
+    // A permitted reload must keep using version 1, never evaluate the worker draft.
+    expect(
+      (
+        await dispatch(path, {
+          method: "PATCH",
+          agentId: leadId,
+          body: JSON.stringify({ priority: 7 }),
+        })
+      ).status,
+    ).toBe(200);
+    expect(await getExtensionByName("minimal")).toMatchObject({
+      version: 2,
+      activeVersion: 1,
+      enabled: true,
+      configJson: "{}",
+    });
+    expect((await dispatch(path, { method: "DELETE", agentId: workerId })).status).toBe(409);
+    expect((await dispatch(`${path}/disable`, { method: "POST" })).status).toBe(200);
+    expect((await dispatch(path, { method: "DELETE", agentId: workerId })).status).toBe(200);
+    expect(await getExtensionByName("minimal")).toBeNull();
   });
 
   test("operator reinstall activates a new version when the extension is enabled", async () => {

package/src/tests/extensions-lifecycle.test.ts

@@ -65,7 +65,9 @@ describe("extension lifecycle", () => {
     expect(enabled).toMatchObject({ enabled: true, status: "enabled" });
     expect(listRegistered().map((loaded) => loaded.record.id)).toEqual([extension.id]);
 
-    const agent = (await getAllAgents()).find((candidate) => candidate.name === "ext:minimal");
+    const agent = (await getAllAgents({ includeExtensions: true })).find(
+      (candidate) => candidate.name === "ext:minimal",
+    );
     expect(agent).toMatchObject({
       id: enabled.agentId,
       status: "offline",
@@ -81,6 +83,24 @@ describe("extension lifecycle", () => {
     expect(listRegistered()).toHaveLength(0);
   });
 
+  test("activation loads its immutable snapshot, not a concurrently advanced file projection", async () => {
+    const extension = await install(await loadBundleFixture("minimal"));
+    // Simulate a worker draft replacing the mutable files after activation read its row.
+    await getDbClient().run("UPDATE extension_files SET content = ? WHERE extensionId = ?", [
+      'throw new Error("unapproved draft executed");',
+      extension.id,
+    ]);
+    const enabled = await enableExtension(extension.id);
+    expect(enabled).toMatchObject({ enabled: true, activeVersion: 1 });
+    expect(
+      await dispatchPre("pre.task.create", {
+        options: {},
+        description: "snapshot check",
+        origin: "rest",
+      }),
+    ).toEqual({ action: "continue" });
+  });
+
   test("activate-version swaps source and reloads an enabled extension", async () => {
     const bundle = await loadBundleFixture("priority-a");
     const extension = await install(bundle);

package/src/tests/extensions-mcp-tools.test.ts

@@ -200,16 +200,20 @@ describe("extension MCP HTTP proxy tools", () => {
     expect(result.structuredContent.message).toBeTruthy();
   });
 
-  test("worker installation returns the REST permission error in the shared tool envelope", async () => {
+  test("worker installation returns ownership and a disabled draft in the shared tool envelope", async () => {
     const tools = buildToolServer();
     const result = (await tools.install.handler(
       await loadBundleFixture("minimal"),
       meta(workerId),
     )) as ToolResult;
 
-    expect(result.isError).toBe(true);
-    expect(result.structuredContent).toMatchObject({ success: false });
-    expect(String(result.structuredContent.message)).toContain("Forbidden");
+    expect(result.isError).toBe(false);
+    expect(result.structuredContent).toMatchObject({
+      success: true,
+      createdByAgentId: workerId,
+      enabled: false,
+      status: "disabled",
+    });
   });
 
   test("lead reinstall stores an inactive version of an enabled extension", async () => {
@@ -254,7 +258,7 @@ describe("extension MCP HTTP proxy tools", () => {
     const all = (await tools.list.handler({}, meta(leadId))) as ToolResult;
     expect(all.isError).toBe(false);
     expect(all.content[0]?.text).toContain(
-      "| Name | Version | Active | Enabled | Status | Priority | Failures |",
+      "| Name | Owner agent | Version | Active | Enabled | Status | Priority | Failures |",
     );
     expect(all.structuredContent).toMatchObject({ success: true });
     expect((all.structuredContent.extensions as unknown[]).length).toBe(1);

package/src/tests/fetch-resolved-env.test.ts

@@ -414,3 +414,46 @@ describe("applyResolvedEnvToProcessEnv", () => {
     expect(process.env.MODEL_OVERRIDE).toBe("new-value");
   });
 });
+
+describe("memory rater config reload", () => {
+  const deploymentValue = process.env.MEMORY_RATERS;
+  afterEach(() => {
+    if (deploymentValue === undefined) delete process.env.MEMORY_RATERS;
+    else process.env.MEMORY_RATERS = deploymentValue;
+  });
+
+  test("empty override survives reload; deleting it restores the deployment value", async () => {
+    const agentId = "memory-rater-reload";
+    mockResponsesByAgentId.set(agentId, {
+      status: 200,
+      body: { configs: [{ key: "MEMORY_RATERS", value: "" }] },
+    });
+    const disabled = await fetchResolvedEnv(testUrl, "key", agentId);
+    applyResolvedEnvToProcessEnv(disabled.env);
+    expect(process.env.MEMORY_RATERS).toBe("");
+    const repeated = await fetchResolvedEnv(testUrl, "key", agentId);
+    expect(repeated.env.MEMORY_RATERS).toBe("");
+
+    mockResponsesByAgentId.set(agentId, { status: 200, body: { configs: [] } });
+    const removed = await fetchResolvedEnv(testUrl, "key", agentId);
+    applyResolvedEnvToProcessEnv(removed.env);
+    expect(process.env.MEMORY_RATERS).toBe(deploymentValue);
+  });
+
+  test.each([undefined, "", "llm"])("missing row restores base value %s", async (value) => {
+    const result = await fetchResolvedEnv(testUrl, "key", "memory-rater-base", {
+      MEMORY_RATERS: value,
+    });
+    process.env.MEMORY_RATERS = "explicit-self,llm";
+    applyResolvedEnvToProcessEnv(result.env);
+    expect(process.env.MEMORY_RATERS).toBe(value);
+  });
+
+  test("failed reload retains the last applied empty override", async () => {
+    process.env.MEMORY_RATERS = "";
+    mockResponsesByAgentId.set("memory-rater-failure", { status: 500, body: {} });
+    const result = await fetchResolvedEnv(testUrl, "key", "memory-rater-failure");
+    applyResolvedEnvToProcessEnv(result.env);
+    expect(process.env.MEMORY_RATERS).toBe("");
+  });
+});

package/src/tests/internal-ai/complete-structured.test.ts

@@ -51,7 +51,7 @@ describe("completeStructured", () => {
       _credentialOverride: {
         kind: "openrouter",
         apiKey: "test",
-        modelDefault: "openrouter/google/gemini-3-flash-preview",
+        modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
       },
       _complete: async () => {
         invocations++;
@@ -98,7 +98,7 @@ describe("completeStructured", () => {
         _credentialOverride: {
           kind: "openrouter",
           apiKey: "test",
-          modelDefault: "openrouter/google/gemini-3-flash-preview",
+          modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
         },
         _complete: async () => {
           invocations++;
@@ -111,18 +111,41 @@ describe("completeStructured", () => {
     });
   }
 
+  test("unknown catalog model returns null without calling complete", async () => {
+    let invocations = 0;
+    const result = await completeStructured({
+      zodSchema: ResultZodSchema,
+      toolSchema: ResultToolSchema,
+      toolName: "record_result",
+      toolDescription: "Record the result.",
+      systemPrompt: "sys",
+      userPrompt: "user",
+      _credentialOverride: {
+        kind: "openai-codex",
+        apiKey: "test",
+        modelDefault: "openai-codex/nonexistent-model",
+      },
+      _complete: async () => {
+        invocations++;
+        return makeMsg([]);
+      },
+    });
+    expect(result).toBeNull();
+    expect(invocations).toBe(0);
+  });
+
   test("passes a provider-compatible forced tool choice", async () => {
     const credentials: ResolvedCredential[] = [
       {
         kind: "openrouter",
         apiKey: "test",
-        modelDefault: "openrouter/google/gemini-3-flash-preview",
+        modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
       },
-      { kind: "openai", apiKey: "test", modelDefault: "openai/gpt-5.4-mini" },
+      { kind: "openai", apiKey: "test", modelDefault: "openai/gpt-6-luna" },
       {
         kind: "openai-codex",
         apiKey: "test",
-        modelDefault: "openai-codex/gpt-5.4-mini",
+        modelDefault: "openai-codex/gpt-6-luna",
       },
       {
         kind: "anthropic",
@@ -172,7 +195,7 @@ describe("completeStructured", () => {
       _credentialOverride: {
         kind: "openrouter",
         apiKey: "test",
-        modelDefault: "openrouter/google/gemini-3-flash-preview",
+        modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
       },
       _complete: async () => {
         invocations++;
@@ -210,7 +233,7 @@ describe("completeStructured", () => {
         _credentialOverride: {
           kind: "openrouter",
           apiKey: "test",
-          modelDefault: "openrouter/google/gemini-3-flash-preview",
+          modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
         },
         _complete: async () => {
           invocations++;
@@ -241,7 +264,7 @@ describe("completeStructured", () => {
       _credentialOverride: {
         kind: "openrouter",
         apiKey: "test",
-        modelDefault: "openrouter/google/gemini-3-flash-preview",
+        modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
       },
       _complete: async () => {
         invocations++;
@@ -418,7 +441,7 @@ describe("completeStructured", () => {
         _credentialOverride: {
           kind: "openrouter",
           apiKey: "test",
-          modelDefault: "openrouter/google/gemini-3-flash-preview",
+          modelDefault: "openrouter/deepseek/deepseek-v4.1-flash",
         },
         _complete: async () =>
           makeMsg([

package/src/tests/internal-ai/credentials.test.ts

@@ -30,7 +30,7 @@ describe("resolveCredential", () => {
     expect(cred?.kind).toBe("openrouter");
     if (cred?.kind === "openrouter") {
       expect(cred.apiKey).toBe("or-1");
-      expect(cred.modelDefault).toBe("openrouter/google/gemini-3-flash-preview");
+      expect(cred.modelDefault).toBe("openrouter/deepseek/deepseek-v4.1-flash");
     }
   });
 
@@ -50,7 +50,7 @@ describe("resolveCredential", () => {
     expect(cred?.kind).toBe("openai");
     if (cred?.kind === "openai") {
       expect(cred.apiKey).toBe("sk-o-1");
-      expect(cred.modelDefault).toBe("openai/gpt-5.4-mini");
+      expect(cred.modelDefault).toBe("openai/gpt-6-luna");
     }
   });
 
@@ -79,7 +79,7 @@ describe("resolveCredential", () => {
     expect(cred?.kind).toBe("openai-codex");
     if (cred?.kind === "openai-codex") {
       expect(cred.apiKey).toBe("example-codex-api-key-derived");
-      expect(cred.modelDefault).toBe("openai-codex/gpt-5.4-mini");
+      expect(cred.modelDefault).toBe("openai-codex/gpt-6-luna");
     }
   });
 
@@ -101,7 +101,7 @@ describe("resolveCredential", () => {
     expect(cred).toEqual({
       kind: "openai-codex",
       apiKey: "example-at_provider_runtime",
-      modelDefault: "openai-codex/gpt-5.4-mini",
+      modelDefault: "openai-codex/gpt-6-luna",
     });
   });
 

package/src/tests/internal-ai/models.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, test } from "bun:test";
+import { getBuiltinModel } from "@earendil-works/pi-ai/providers/all";
+import { DEFAULT_MODEL, parseModelStr } from "../../utils/internal-ai/models.js";
+
+describe("internal-ai default models", () => {
+  for (const [kind, modelString] of Object.entries(DEFAULT_MODEL)) {
+    if (kind === "claude-cli") continue;
+
+    test(`${kind} resolves in the pinned pi-ai catalog`, () => {
+      const [provider, modelId] = parseModelStr(modelString);
+      const model = getBuiltinModel(
+        provider as Parameters<typeof getBuiltinModel>[0],
+        modelId as never,
+      );
+      expect(model).toBeDefined();
+      expect(model.id).toBe(modelId);
+      expect(model.provider).toBe(provider);
+    });
+  }
+});

package/src/tests/memory-rate-tool.test.ts

@@ -212,16 +212,13 @@ describe("renderMemoriesPrompt — conditional rate-tool hint", () => {
     expect(result).toBeNull();
   });
 
-  test("MEMORY_RATERS unset → no rate-tool hint (byte-identical to pre-step-5)", () => {
-    const result = renderMemoriesPrompt(sampleMemories);
-    expect(result).not.toBeNull();
-    expect(result).not.toContain("memory_rate");
-    expect(result).toContain("### Relevant Past Knowledge");
-    expect(result).toContain("- **Foo bug fix** (id: m-1):");
-    // Snapshot — exact byte parity with main's runner.ts:1579 block.
-    expect(result).toBe(
-      `\n\n### Relevant Past Knowledge\n\nThese memories from your previous sessions may be useful. Use \`memory-get\` with the memory ID to retrieve full details.\n\n- **Foo bug fix** (id: m-1): use Bun.serve not express\n`,
-    );
+  test("MEMORY_RATERS unset → self-rating hint", () => {
+    expect(renderMemoriesPrompt(sampleMemories)).toContain("memory_rate");
+  });
+
+  test("MEMORY_RATERS=llm → no self-rating hint", () => {
+    process.env.MEMORY_RATERS = "llm";
+    expect(renderMemoriesPrompt(sampleMemories)).not.toContain("memory_rate");
   });
 
   test("MEMORY_RATERS empty string → no hint", () => {

package/src/tests/memory-rater-defaults.test.ts

@@ -0,0 +1,23 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { getRegisteredRaters } from "../be/memory/raters/registry";
+
+const original = process.env.MEMORY_RATERS;
+afterEach(() => {
+  if (original === undefined) delete process.env.MEMORY_RATERS;
+  else process.env.MEMORY_RATERS = original;
+});
+
+describe("memory rater defaults", () => {
+  test.each([
+    [undefined, ["implicit-citation", "explicit-self"]],
+    ["", ["noop"]],
+    ["  ", ["noop"]],
+    ["llm", ["llm"]],
+    ["explicit-self,llm", ["explicit-self", "llm"]],
+    [" implicit-citation , llm ", ["implicit-citation", "llm"]],
+  ] as const)("registry resolves %s", (value, expected) => {
+    if (value === undefined) delete process.env.MEMORY_RATERS;
+    else process.env.MEMORY_RATERS = value;
+    expect(getRegisteredRaters().map((rater) => rater.name)).toEqual([...expected]);
+  });
+});

package/src/tests/memory-rater-e2e.test.ts

@@ -292,9 +292,8 @@ describe("memory-rater v1.5 — cross-cutting e2e", () => {
 
     // Fire the server-rater orchestration the way `store-progress` does.
     // Inject the rater explicitly — the test process inherits its own
-    // MEMORY_RATERS env (typically unset to avoid disturbing other suites),
-    // and we want to exercise this rater regardless. Step G covers the
-    // unset-env "byte-identical" backward-compat case separately.
+    // MEMORY_RATERS env (unset defaults to implicit-citation,explicit-self),
+    // and we want to exercise implicit-citation regardless.
     const evidenceRows = await getDbClient().query<{ content: string }>(
       "SELECT content FROM session_logs WHERE taskId = ? ORDER BY iteration, lineNumber",
       [taskId],

package/src/tests/migration-046-budgets.test.ts

@@ -21,6 +21,8 @@ async function removeDbFiles(path: string): Promise<void> {
 
 beforeAll(() => {
   initDb(TEST_DB_PATH);
+  // Mirror API boot: new releases are snapshot-seeded, not new migrations.
+  seedPricingFromModelsDev({ quiet: true });
 });
 
 afterAll(async () => {

package/src/tests/model-control.test.ts

@@ -505,10 +505,10 @@ describe("Model Control - Priority Resolution Logic", () => {
     expect(resolveModelTier({ tier: "smart", harnessProvider: "codex" })).toBe("gpt-5.6-sol");
     expect(resolveModelTier({ tier: "ultra", harnessProvider: "codex" })).toBe("gpt-5.6-sol");
     expect(resolveModelTier({ tier: "smart", harnessProvider: "opencode" })).toBe(
-      "openrouter/deepseek/deepseek-v4-pro",
+      "openrouter/deepseek/deepseek-v4-pro-0813",
     );
     expect(resolveModelTier({ tier: "ultra", harnessProvider: "pi" })).toBe(
-      "openrouter/anthropic/claude-opus-4.8",
+      "openrouter/anthropic/claude-opus-5.5",
     );
   });
 

package/src/tests/onboard-compose.test.ts

@@ -8,6 +8,11 @@ function makeState(overrides: Partial<OnboardState>): OnboardState {
   return { ...INITIAL_STATE, ...overrides };
 }
 
+// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
+const COMPOSE_SLACK_MODE = "SLACK_MODE=${SLACK_MODE:-socket}";
+// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
+const COMPOSE_SLACK_SIGNING_SECRET = "SLACK_SIGNING_SECRET=${SLACK_SIGNING_SECRET}";
+
 describe("generateCompose", () => {
   test("uses the full preset by default and includes every official template once", () => {
     const full = getPresetById("full");
@@ -286,6 +291,8 @@ describe("generateCompose", () => {
     // Slack vars on API service
     expect(yaml).toContain("SLACK_BOT_TOKEN");
     expect(yaml).toContain("SLACK_APP_TOKEN");
+    expect(yaml).toContain(COMPOSE_SLACK_MODE);
+    expect(yaml).not.toContain("SLACK_SIGNING_SECRET");
     // GitLab vars on agent services
     expect(yaml).toContain("GITLAB_TOKEN");
     expect(yaml).toContain("GITLAB_EMAIL");
@@ -297,6 +304,13 @@ describe("generateCompose", () => {
     expect(yaml).toContain("SLACK_DISABLE=false");
   });
 
+  test("HTTP Slack compose configuration uses the signing secret and no app token", () => {
+    const yaml = generateCompose({ ...allIntegrationsState, slackMode: "http" });
+    expect(yaml).toContain(COMPOSE_SLACK_MODE);
+    expect(yaml).toContain(COMPOSE_SLACK_SIGNING_SECRET);
+    expect(yaml).not.toContain("SLACK_APP_TOKEN");
+  });
+
   // ── No integrations ──
 
   test("no integrations omits integration env vars from agent services", () => {

package/src/tests/onboard-env.test.ts

@@ -99,9 +99,26 @@ describe("generateEnv", () => {
     const env = generateEnv(state);
     expect(env).toContain("SLACK_BOT_TOKEN=example-xoxb-slack-bot");
     expect(env).toContain("SLACK_APP_TOKEN=example-xapp-slack-app");
+    expect(env).toContain("SLACK_MODE=socket");
+    expect(env).not.toContain("SLACK_SIGNING_SECRET=");
     expect(env).toContain("SLACK_DISABLE=false");
   });
 
+  test("Slack HTTP mode emits only its mode-specific credential", () => {
+    const env = generateEnv(
+      makeState({
+        integrations: { github: false, slack: true, gitlab: false, sentry: false },
+        slackMode: "http",
+        slackBotToken: "example-xoxb-slack-bot",
+        slackSigningSecret: "synthetic-signing-secret",
+      }),
+    );
+    expect(env).toContain("SLACK_MODE=http");
+    expect(env).toContain("SLACK_BOT_TOKEN=example-xoxb-slack-bot");
+    expect(env).toContain("SLACK_SIGNING_SECRET=synthetic-signing-secret");
+    expect(env).not.toContain("SLACK_APP_TOKEN=");
+  });
+
   // ── No integrations: only core section ──
 
   test("no integrations outputs disable flags and no integration credentials", () => {

package/src/tests/onboard-manifest.test.ts

@@ -36,6 +36,7 @@ describe("generateManifest", () => {
     expect(manifest).toHaveProperty("harness");
     expect(manifest).toHaveProperty("services");
     expect(manifest).toHaveProperty("integrations");
+    expect(manifest).toHaveProperty("slackMode");
     expect(manifest).toHaveProperty("composePath");
     expect(manifest).toHaveProperty("envPath");
     expect(manifest).toHaveProperty("apiUrl");
@@ -112,6 +113,17 @@ describe("generateManifest", () => {
     expect(integrations.slack).toBe(false);
     expect(integrations.gitlab).toBe(false);
     expect(integrations.sentry).toBe(true);
+    expect(manifest.slackMode).toBe("socket");
+  });
+
+  test("records HTTP transport without persisting its signing secret", () => {
+    const manifest = generateManifest({
+      ...devState,
+      slackMode: "http",
+      slackSigningSecret: "synthetic-signing-secret",
+    }) as Record<string, unknown>;
+    expect(manifest.slackMode).toBe("http");
+    expect(JSON.stringify(manifest)).not.toContain("synthetic-signing-secret");
   });
 
   test("all integrations false when none enabled", () => {