@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/src/tests/opus-5-5-registry.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import {
+  findKnownModel,
+  pickDefaultModelForHarness,
+} from "../../apps/ui/src/lib/agent-runtime-models";
+import { loadModelsDevCache } from "../be/modelsdev-cache";
+import { buildModelsDevSeedRows } from "../be/seed-pricing";
+
+describe("Opus 5.5 registry", () => {
+  test("defaults to Opus 5.5 and keeps Opus 5 selectable", () => {
+    expect(pickDefaultModelForHarness("claude", [])).toBe("claude-opus-5-5");
+    expect(findKnownModel("claude-opus-5-5")).toMatchObject({
+      id: "claude-opus-5-5",
+      reasoningLevels: ["low", "medium", "high", "xhigh"],
+    });
+    expect(findKnownModel("claude-opus-5")?.id).toBe("claude-opus-5");
+  });
+
+  test("seeds canonical and alias rates without changing Opus 5", () => {
+    const cache = loadModelsDevCache();
+    expect(cache).not.toBeNull();
+    const rows = buildModelsDevSeedRows(cache!);
+    for (const provider of ["claude", "claude-managed"] as const) {
+      for (const model of ["claude-opus-5-5", "opus"]) {
+        const rates = Object.fromEntries(
+          rows
+            .filter((row) => row.provider === provider && row.model === model)
+            .map((row) => [row.tokenClass, row.pricePerMillionUsd]),
+        );
+        expect(rates).toEqual({
+          input: 4,
+          output: 20,
+          cached_input: 0.2,
+          cache_write: 5,
+          cache_write_1h: 8,
+        });
+      }
+      expect(
+        rows.find(
+          (row) =>
+            row.provider === provider &&
+            row.model === "claude-opus-5" &&
+            row.tokenClass === "input",
+        )?.pricePerMillionUsd,
+      ).toBe(5);
+    }
+  });
+});

package/src/tests/pricing-refresh.test.ts

@@ -87,7 +87,7 @@ describe("models.dev runtime pricing refresh", () => {
     ).toBe(10);
     expect(
       (await getActivePricingRow("pi", "opus", "cache_write_1h", 500))?.pricePerMillionUsd,
-    ).toBe(10);
+    ).toBe(8);
     expect(
       (await getActivePricingRow("claude", "claude-opus-5", "cache_write", 500))
         ?.pricePerMillionUsd,

package/src/tests/pricing-routes.test.ts

@@ -13,6 +13,7 @@ import {
   type ServerResponse,
 } from "node:http";
 import { closeDb, getDbClient, getLogsByEventType, initDb } from "../be/db";
+import { seedPricingFromModelsDev } from "../be/seed-pricing";
 import { handleCore } from "../http/core";
 import { handlePricing } from "../http/pricing";
 import { getPathSegments, parseQueryParams } from "../http/utils";
@@ -53,6 +54,7 @@ let port: number;
 beforeAll(async () => {
   await removeDbFiles(TEST_DB_PATH);
   initDb(TEST_DB_PATH);
+  seedPricingFromModelsDev({ quiet: true });
   server = createTestServer(API_KEY);
   port = await listenOnFreePort(server);
 });
@@ -103,13 +105,23 @@ describe("Phase 6 — /api/pricing REST surface", () => {
       expect(res.status).toBe(200);
       const body = await res.json();
       expect(body.rows).toBeInstanceOf(Array);
-      // Codex seed rows include the migration 046 baseline plus later model
-      // backfills. They should all be present here.
+      // Boot seeding adds current snapshot models alongside historical rows.
+      // Check each current model rather than a fixed three-row total: some
+      // models also publish cache-write prices.
       const seedRows = body.rows.filter(
         (r: { provider: string; effectiveFrom: number }) =>
           r.provider === "codex" && r.effectiveFrom === 0,
       );
-      expect(seedRows.length).toBe(Object.keys(CODEX_MODEL_PRICING).length * 3);
+      for (const model of Object.keys(CODEX_MODEL_PRICING)) {
+        for (const tokenClass of ["input", "cached_input", "output"]) {
+          expect(
+            seedRows.some(
+              (row: { model: string; tokenClass: string }) =>
+                row.model === model && row.tokenClass === tokenClass,
+            ),
+          ).toBe(true);
+        }
+      }
     });
 
     test("GET /api/pricing/{provider}/{model}/{tokenClass} returns rows latest-first", async () => {

package/src/tests/provider-registration.test.ts

@@ -31,6 +31,7 @@ const modelsDevFixture = {
 
 const ENTRYPOINT_EXEMPTIONS = new Set(["claude", "acp"]);
 const ENTRYPOINT_OUTPUT: Record<string, string> = {
+  dsh: "Warning: dsh provider has no credentials yet",
   pi: "Warning: pi provider has no credentials yet",
   opencode: "Warning: opencode provider has no credentials yet",
   "claude-managed": "Warning: claude-managed provider missing:",
@@ -71,9 +72,11 @@ describe("provider registration synchronization", () => {
     );
   });
 
-  test("pricing seeder emits rows for every provider except ACP", () => {
+  test("pricing seeder emits rows for providers with cost reporting", () => {
     const registered = new Set(buildPricingSeedRows(modelsDevFixture).map((row) => row.provider));
-    const expected = ProviderNameSchema.options.filter((provider) => provider !== "acp");
+    const expected = ProviderNameSchema.options.filter(
+      (provider) => provider !== "acp" && provider !== "dsh",
+    );
     expect([...registered].filter((provider) => expected.includes(provider)).sort()).toEqual(
       [...expected].sort(),
     );

package/src/tests/rbac-admission-e2e.test.ts

@@ -10,6 +10,7 @@
 import { Database } from "bun:sqlite";
 import { afterAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { join } from "node:path";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 import {
   api,
   makeScratchDir,
@@ -483,3 +484,56 @@ describe("RBAC admission over real HTTP", () => {
     );
   });
 });
+
+test.each(["true", "false"])("worker extension ownership with RBAC_ENABLED=%s", async (enabled) => {
+  const scratch = await makeScratchDir();
+  const instance = await spawnSwarmServer({
+    dbPath: join(scratch, "extension-admission.sqlite"),
+    logPath: join(scratch, "extension-admission.log"),
+    env: { RBAC_ENABLED: enabled },
+  });
+  try {
+    await registerAgent(instance.base, WORKER_A, "extension-owner", false);
+    const bundle = await loadBundleFixture("minimal");
+    const installed = await api(instance.base, "POST", "/api/extensions/install", {
+      agentId: WORKER_A,
+      body: bundle,
+    });
+    expect(installed.status).toBe(200);
+    expect(installed.body.extension).toMatchObject({
+      createdByAgentId: WORKER_A,
+      enabled: false,
+      status: "disabled",
+    });
+    const path = `/api/extensions/${installed.body.extension.id}`;
+    for (const operation of ["enable", "disable", "activate-version"]) {
+      expect(
+        (
+          await api(instance.base, "POST", `${path}/${operation}`, {
+            agentId: WORKER_A,
+            body: { version: 1 },
+          })
+        ).status,
+      ).toBe(403);
+    }
+    const operatorBundle = { ...bundle, manifest: { ...bundle.manifest, name: "operator-owned" } };
+    const operator = await api(instance.base, "POST", "/api/extensions/install", {
+      body: operatorBundle,
+    });
+    expect(operator.status).toBe(200);
+    expect(operator.body.extension.createdByAgentId).toBeNull();
+    for (const method of ["PATCH", "DELETE"]) {
+      expect(
+        (
+          await api(instance.base, method, `/api/extensions/${operator.body.extension.id}`, {
+            agentId: WORKER_A,
+            ...(method === "PATCH" ? { body: { priority: 1 } } : {}),
+          })
+        ).status,
+      ).toBe(403);
+    }
+  } finally {
+    await instance.stop();
+    await removeScratchDir(scratch);
+  }
+});

package/src/tests/rbac-e2e-helpers.ts

@@ -78,6 +78,8 @@ export async function spawnSwarmServer(opts: {
       API_KEY: E2E_API_KEY,
       AGENT_SWARM_API_KEY: E2E_API_KEY,
       PORT: String(port),
+      // MCP proxy tools must call this scratch server, never an inherited live URL.
+      MCP_BASE_URL: `http://localhost:${port}`,
       SLACK_DISABLE: "true",
       GITHUB_DISABLE: "true",
       JIRA_DISABLE: "true",

package/src/tests/rbac-engine.test.ts

@@ -255,6 +255,38 @@ describe("lead-or-operator-or-user verbs", () => {
   }
 });
 
+describe("extension ownership", () => {
+  test("workers create extensions and write only their own existing resource", () => {
+    const worker = { kind: "agent", agentId: "extension-owner", isLead: false } as const;
+    for (const resource of [
+      { kind: "extension" },
+      { kind: "extension", extensionId: "ext-1", createdByAgentId: worker.agentId },
+    ] as const) {
+      expect(
+        can({ principal: worker, verb: "extension.write", resource, source: "http" }).allow,
+      ).toBe(true);
+    }
+    for (const createdByAgentId of [null, "other-agent"]) {
+      expect(
+        can({
+          principal: worker,
+          verb: "extension.write",
+          resource: { kind: "extension", extensionId: "ext-1", createdByAgentId },
+          source: "http",
+        }).allow,
+      ).toBe(false);
+    }
+    expect(
+      can({
+        principal: { ...worker, agentId: "" },
+        verb: "extension.write",
+        resource: { kind: "extension" },
+        source: "http",
+      }).allow,
+    ).toBe(false);
+  });
+});
+
 describe("lead-or-resource-owner verbs", () => {
   const expected: Expected = {
     lead: true,

package/src/tests/rbac-wire-e2e.test.ts

@@ -18,6 +18,7 @@
 import { Database } from "bun:sqlite";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { join } from "node:path";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 import {
   api,
   LEAD,
@@ -119,6 +120,38 @@ afterAll(async () => {
 });
 
 describe("MCP gate matrix", () => {
+  test("worker MCP installs retain ownership and lifecycle calls remain lead-only", async () => {
+    const bundle = await loadBundleFixture("minimal");
+    bundle.manifest.name = "worker-owned-wire";
+    const installed = await mcpCall(base, WORKER_A, sidA, "extension-install", bundle);
+    expect(installed.structuredContent).toMatchObject({ success: true });
+    expect(installed.structuredContent).toMatchObject({
+      createdByAgentId: WORKER_A,
+      enabled: false,
+      status: "disabled",
+    });
+    expectRow({ type: "agent", id: WORKER_A }, "extension.write", "allow", null, "http");
+    const id = installed.structuredContent.id;
+    const listed = await mcpCall(base, WORKER_A, sidA, "extension-list", {});
+    expect(listed.structuredContent.extensions).toContainEqual(
+      expect.objectContaining({ id, createdByAgentId: WORKER_A }),
+    );
+    for (const tool of ["extension-enable", "extension-disable", "extension-activate-version"]) {
+      const denied = await mcpCall(base, WORKER_A, sidA, tool, {
+        id,
+        ...(tool === "extension-activate-version" ? { version: 1 } : {}),
+      });
+      expect(denied.structuredContent.success).toBe(false);
+      expectRow(
+        { type: "agent", id: WORKER_A },
+        "extension.activate",
+        "deny",
+        "requires operator/user authentication, or a lead with EXTENSION_ALLOW_LEAD_ACTIVATION enabled",
+        "http",
+      );
+    }
+  });
+
   test("config: set/delete lead-gated; includeSecrets masks for non-lead (DES-445 follow-up)", async () => {
     // set-config (non-credential key): worker denied, lead allowed.
     const setWorker = await mcpCall(base, WORKER_A, sidA, "set-config", {

package/src/tests/reasoning-effort.test.ts

@@ -22,6 +22,14 @@ describe("REASONING_EFFORT_LEVELS", () => {
 });
 
 describe("reasoningCapability — cache-sourced levels", () => {
+  test("Claude Opus 5.5 exposes supported CLI effort levels", () => {
+    expect(reasoningCapability("claude", "claude-opus-5-5").levels).toEqual([
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+    ]);
+  });
   test("claude claude-opus-4-8: levels come from reasoning_options.effort, not the fallback", () => {
     const cap = reasoningCapability("claude", "claude-opus-4-8");
     expect(cap.supported).toBe(true);

package/src/tests/reload-config.test.ts

@@ -323,6 +323,39 @@ describe("reload-config", () => {
     }
   });
 
+  test("reload applies HTTP mode without reporting a Slack socket as reinitialized", async () => {
+    const keys = [
+      "SLACK_MODE",
+      "SLACK_DISABLE",
+      "SLACK_BOT_TOKEN",
+      "SLACK_SIGNING_SECRET",
+    ] as const;
+    const originals = new Map(keys.map((key) => [key, process.env[key]]));
+    process.env.SLACK_DISABLE = "false";
+    process.env.SLACK_BOT_TOKEN = "xoxb-test";
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    const config = await upsertSwarmConfig({
+      scope: "global",
+      key: "SLACK_MODE",
+      value: "http",
+    });
+
+    try {
+      const result = await reloadGlobalConfigsAndIntegrations();
+      expect(result.keysUpdated).toContain("SLACK_MODE");
+      expect(result.integrationsReinitialized).not.toContain("slack");
+      expect(process.env.SLACK_MODE).toBe("http");
+    } finally {
+      await deleteSwarmConfig(config.id);
+      await loadGlobalConfigsIntoEnv(true);
+      for (const key of keys) {
+        const value = originals.get(key);
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  });
+
   // Regression: injection used to be one-way. Deleting a global row left the
   // previously-injected value live in process.env until the process restarted,
   // so "reset to default" in the dashboard silently did nothing.

package/src/tests/script-connections.test.ts

@@ -572,6 +572,9 @@ describe("script connections", () => {
       markMigrationApplied(database, "152_routing_decisions.sql");
       // 156 alters inbox_item_state, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "156_inbox_item_state_read_at.sql");
+      // 157 alters scheduled_tasks and slack_messages, neither of which this
+      // migration-112-only fixture creates.
+      markMigrationApplied(database, "157_defer_provenance_and_marker.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/session-costs-model-key-normalize.test.ts

@@ -133,6 +133,7 @@ describe("normalizeModelKey()", () => {
     expect(normalizeModelKey("claude", "claude-opus-4-7")).toBe("claude-opus-4-7");
     expect(normalizeModelKey("claude", "claude-fable-5-1")).toBe("claude-fable-5-1");
     expect(normalizeModelKey("claude", "claude-mythos-5-1")).toBe("claude-mythos-5-1");
+    expect(normalizeModelKey("claude", "claude-opus-5-5")).toBe("claude-opus-5-5");
     expect(normalizeModelKey("claude", "claude-opus-5")).toBe("claude-opus-5");
     expect(normalizeModelKey("claude", "claude-fable-5")).toBe("claude-fable-5");
     expect(normalizeModelKey("claude", "claude-mythos-5")).toBe("claude-mythos-5");

package/src/tests/slack-config.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { startSlackMock, stopSlackMock } from "../../scripts/e2e/slack";
+import { closeDb, initDb } from "../be/db";
+import { getEnabledCapabilities } from "../server";
+import { getSlackApp, startSlackApp, stopSlackApp } from "../slack/app";
+import { getSlackConfiguration, isSlackConfigured } from "../slack/config";
+
+const SLACK_ENV_KEYS = [
+  "NODE_ENV",
+  "SLACK_ALLOW_DEV_SOCKET_MODE",
+  "CAPABILITIES",
+  "SLACK_MODE",
+  "SLACK_DISABLE",
+  "SLACK_BOT_TOKEN",
+  "SLACK_APP_TOKEN",
+  "SLACK_SIGNING_SECRET",
+  "SLACK_API_URL",
+] as const;
+const originalEnv = new Map(SLACK_ENV_KEYS.map((key) => [key, process.env[key]]));
+
+beforeEach(() => {
+  for (const key of SLACK_ENV_KEYS) delete process.env[key];
+  process.env.NODE_ENV = "test";
+  process.env.SLACK_DISABLE = "false";
+});
+
+afterEach(async () => {
+  await stopSlackApp();
+  for (const key of SLACK_ENV_KEYS) {
+    const value = originalEnv.get(key);
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+describe("Slack transport configuration", () => {
+  test("defaults to Socket Mode and requires the existing token pair", () => {
+    expect(getSlackConfiguration({})).toEqual({
+      disabled: false,
+      mode: "socket",
+      missingCredentials: ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"],
+    });
+    expect(getEnabledCapabilities()).toContain("slack");
+    expect(isSlackConfigured({ SLACK_BOT_TOKEN: "xoxb-test", SLACK_APP_TOKEN: "xapp-test" })).toBe(
+      true,
+    );
+  });
+
+  test("HTTP mode requires bot and signing credentials without an app token", () => {
+    const env = {
+      SLACK_MODE: "http",
+      SLACK_BOT_TOKEN: "xoxb-test",
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+    };
+    expect(getSlackConfiguration(env)).toEqual({
+      disabled: false,
+      mode: "http",
+      missingCredentials: [],
+    });
+    expect(isSlackConfigured(env)).toBe(true);
+  });
+
+  test("disabled and invalid configurations fail closed", () => {
+    expect(
+      isSlackConfigured({
+        SLACK_DISABLE: "true",
+        SLACK_BOT_TOKEN: "xoxb-test",
+        SLACK_APP_TOKEN: "xapp-test",
+      }),
+    ).toBe(false);
+    expect(
+      getSlackConfiguration({
+        SLACK_MODE: "webhook",
+        SLACK_BOT_TOKEN: "xoxb-test",
+        SLACK_APP_TOKEN: "xapp-test",
+      }),
+    ).toMatchObject({ mode: null });
+  });
+
+  test("HTTP selection remains unavailable and never creates a socket app", async () => {
+    process.env.SLACK_MODE = "http";
+    expect(getEnabledCapabilities()).not.toContain("slack");
+    process.env.SLACK_BOT_TOKEN = "xoxb-test";
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    delete process.env.SLACK_APP_TOKEN;
+
+    const error = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      expect(await startSlackApp()).toBe(false);
+      expect(getSlackApp()).toBeNull();
+      expect(error).toHaveBeenCalledWith(
+        "[Slack] HTTP mode is configured but unavailable until the HTTP receiver is installed",
+      );
+    } finally {
+      error.mockRestore();
+    }
+  });
+});
+
+test.each([
+  "disabled",
+  "invalid mode",
+  "missing credentials",
+  "HTTP unavailable",
+  "socket blocked",
+])("failed init is retryable without stop: %s", async (reason) => {
+  const slack = await startSlackMock(false);
+  initDb(":memory:");
+  try {
+    Object.assign(process.env, slack.mock.env);
+    process.env.SLACK_SIGNING_SECRET = "synthetic-signing-secret";
+    if (reason === "disabled") process.env.SLACK_DISABLE = "true";
+    if (reason === "invalid mode") process.env.SLACK_MODE = "invalid";
+    if (reason === "missing credentials") delete process.env.SLACK_APP_TOKEN;
+    if (reason === "HTTP unavailable") process.env.SLACK_MODE = "http";
+    if (reason === "socket blocked") process.env.NODE_ENV = "development";
+
+    expect(await startSlackApp()).toBe(false);
+    expect(getSlackApp()).toBeNull();
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(0);
+
+    Object.assign(process.env, slack.mock.env);
+    process.env.SLACK_DISABLE = "false";
+    process.env.SLACK_MODE = "socket";
+    process.env.NODE_ENV = "test";
+    // Deliberately retry without stopSlackApp: failed initialization must not latch.
+    expect(await startSlackApp()).toBe(true);
+    await slack.mock.waitForConnection(10_000);
+    expect(slack.mock.connectionCount).toBe(1);
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(1);
+  } finally {
+    await stopSlackApp();
+    await stopSlackMock(slack, false);
+    closeDb();
+  }
+}, 20_000);

package/src/tests/slack-mode-lifecycle.test.ts

@@ -0,0 +1,69 @@
+import { expect, test } from "bun:test";
+import { createApiClient, pollUntil } from "../../scripts/e2e/http";
+import { startSlackMock, stopSlackMock } from "../../scripts/e2e/slack";
+import { type Sut, startSut, stopSut } from "../../scripts/e2e/sut";
+
+test("config reload disconnects a live socket for HTTP and can return to Socket Mode", async () => {
+  const slack = await startSlackMock(false);
+  let sut: Sut | undefined;
+  try {
+    sut = await startSut(false, slack.mock.env, {
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+      HEARTBEAT_DISABLE: "true",
+    });
+    await slack.mock.waitForConnection(10_000);
+    expect(slack.mock.connectionCount).toBe(1);
+    const opened = slack.mock.apiCalls("apps.connections.open").length;
+    const api = createApiClient(sut.baseUrl, sut.apiKey);
+    const http = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "http" },
+    });
+    expect(http.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 0, 10_000, 50)).toBe(true);
+    const reload = await api("POST", "/api/config/reload");
+    expect(reload.status).toBe(200);
+    expect(reload.json).toMatchObject({ success: true });
+    expect(
+      (reload.json as { integrationsReinitialized: string[] }).integrationsReinitialized,
+    ).not.toContain("slack");
+    expect(slack.mock.apiCalls("apps.connections.open").length).toBe(opened);
+    const socket = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "socket" },
+    });
+    expect(socket.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 1, 10_000, 50)).toBe(true);
+    expect(slack.mock.apiCalls("apps.connections.open").length).toBe(opened + 1);
+  } finally {
+    if (sut) await stopSut(sut, false);
+    await stopSlackMock(slack, false);
+  }
+}, 30_000);
+
+test("config reload recovers from an initial unavailable HTTP transport", async () => {
+  const slack = await startSlackMock(false);
+  let sut: Sut | undefined;
+  try {
+    sut = await startSut(false, slack.mock.env, {
+      SLACK_MODE: "http",
+      SLACK_SIGNING_SECRET: "synthetic-signing-secret",
+      HEARTBEAT_DISABLE: "true",
+    });
+    const api = createApiClient(sut.baseUrl, sut.apiKey);
+    const initialReload = await api("POST", "/api/config/reload");
+    expect(initialReload.status).toBe(200);
+    expect(
+      (initialReload.json as { integrationsReinitialized: string[] }).integrationsReinitialized,
+    ).not.toContain("slack");
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(0);
+
+    const socket = await api("PUT", "/api/config", {
+      body: { scope: "global", key: "SLACK_MODE", value: "socket" },
+    });
+    expect(socket.status).toBe(200);
+    expect(await pollUntil(() => slack.mock.connectionCount === 1, 10_000, 50)).toBe(true);
+    expect(slack.mock.apiCalls("apps.connections.open")).toHaveLength(1);
+  } finally {
+    if (sut) await stopSut(sut, false);
+    await stopSlackMock(slack, false);
+  }
+}, 30_000);