@desplega.ai/agent-swarm 1.157.0 → 1.158.0

package/src/tests/provider-registration.test.ts

@@ -1,12 +1,214 @@
 import { describe, expect, test } from "bun:test";
+import { chmodSync, mkdtempSync, writeFileSync } from "node:fs";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 import { buildPricingSeedRows } from "../be/seed-pricing";
-import { CREDENTIAL_PROVIDER_CHECKERS } from "../commands/provider-credentials";
-import { ProviderNameSchema } from "../types";
+import {
+  CREDENTIAL_PROVIDER_CHECKERS,
+  validateProviderCredentials,
+} from "../commands/provider-credentials";
+import { createProviderAdapter } from "../providers";
+import { PricingProviderSchema, type ProviderName, ProviderNameSchema } from "../types";
+import { CHILD_PROCESS_TEST_BUDGET_MS, runChild } from "./test-proc";
 
-const entrypoint = await Bun.file(new URL("../../docker-entrypoint.sh", import.meta.url)).text();
+/**
+ * Every `ProviderNameSchema` member must reach every mandatory touch point, or
+ * be exempted there with a one-line reason (#1559). A failure names the
+ * provider and the file to edit.
+ *
+ * Some lists are subsets or supersets by design (PricingProviderSchema also
+ * accepts `gemini`; the local-harness lists skip cloud providers), so each
+ * touch point only asserts that every provider is present or consciously
+ * exempted. An exemption for a provider that is actually present fails as
+ * stale, so the map cannot rot.
+ *
+ * Touch points that are already compile-bound to one of these lists are not
+ * repeated here: HARNESS_LABEL and ICON_BY_HARNESS (`Record<ProviderName, …>`
+ * over the UI's PROVIDER_NAMES), ROUTING_PREFIXES_BY_PROVIDER
+ * (`Record<PricingProvider, …>`), the session-costs `provider` field (reuses
+ * PricingProviderSchema), DEFAULT_MODEL_TIER_MAP and PROVIDER_STEER_CAPABILITIES
+ * (`Record<ProviderName, …>`; the factory switch is covered by
+ * provider-steering-capabilities.test.ts).
+ */
+
+const repoRoot = join(import.meta.dir, "..", "..");
+
+async function readRepoFile(relPath: string): Promise<string> {
+  return Bun.file(join(repoRoot, relPath)).text();
+}
+
+/** The quoted members of the first array/enum literal matched by `pattern`. */
+async function literalMembers(relPath: string, pattern: RegExp): Promise<string[]> {
+  const match = (await readRepoFile(relPath)).match(pattern);
+  if (!match?.[1]) {
+    throw new Error(`Could not find ${pattern} in ${relPath}. Did the declaration move?`);
+  }
+  return [...match[1].matchAll(/"([^"]+)"/g)].map((m) => m[1] as string);
+}
+
+/** The provider names listed after `Supported:` in an unknown-provider error. */
+function supportedList(message: string): string[] {
+  const list = message.split("Supported:")[1];
+  if (list === undefined) throw new Error(`No "Supported:" list in: ${message}`);
+  return list
+    .replace(/\.\s*$/, "")
+    .split(",")
+    .map((name) => name.trim());
+}
+
+const modelsDevFixture = {
+  anthropic: { models: { "claude-test": { cost: { input: 1, output: 2 } } } },
+  openai: { models: { "gpt-test": { cost: { input: 1, output: 2 } } } },
+  openrouter: { models: { "test/model": { cost: { input: 1, output: 2 } } } },
+};
+
+interface TouchPoint {
+  /** The file a new provider must be added to. */
+  file: string;
+  /** What inside that file. */
+  what: string;
+  members: () => Promise<readonly string[]>;
+  /** Providers deliberately absent here, each with a one-line reason. */
+  exempt: Partial<Record<ProviderName, string>>;
+}
+
+const TOUCH_POINTS: TouchPoint[] = [
+  {
+    file: "src/commands/provider-credentials.ts",
+    what: "CREDENTIAL_PROVIDER_CHECKERS (and the SupportedProvider union it is keyed by)",
+    members: async () => Object.keys(CREDENTIAL_PROVIDER_CHECKERS),
+    exempt: {},
+  },
+  {
+    file: "src/commands/provider-credentials.ts",
+    what: "the validateProviderCredentials switch (dashboard Test connection)",
+    members: async () => {
+      const source = await readRepoFile("src/commands/provider-credentials.ts");
+      const start = source.indexOf("export async function validateProviderCredentials(");
+      const end = source.indexOf("\n}\n", start);
+      if (start === -1 || end === -1) {
+        throw new Error(
+          "Could not find validateProviderCredentials in src/commands/provider-credentials.ts.",
+        );
+      }
+      return [...source.slice(start, end).matchAll(/case "([^"]+)":/g)].map((m) => m[1] as string);
+    },
+    exempt: {},
+  },
+  {
+    file: "src/commands/provider-credentials.ts",
+    what: "the validateProviderCredentials unknown-provider error message",
+    members: async () => {
+      const result = await validateProviderCredentials("__unregistered_provider__");
+      return supportedList(result.ok ? "" : result.error);
+    },
+    exempt: {},
+  },
+  {
+    file: "src/providers/index.ts",
+    what: "the createProviderAdapter unknown-provider error message",
+    members: async () => {
+      try {
+        await createProviderAdapter("__unregistered_provider__");
+      } catch (error) {
+        return supportedList(String(error));
+      }
+      throw new Error("createProviderAdapter accepted an unregistered provider.");
+    },
+    exempt: {},
+  },
+  {
+    file: "src/types.ts",
+    what: "PricingProviderSchema (#1636; the session-costs provider field reuses it)",
+    members: async () => PricingProviderSchema.options,
+    exempt: {},
+  },
+  {
+    file: "src/be/seed-pricing.ts",
+    what: "the provider rows buildPricingSeedRows emits",
+    members: async () => [
+      ...new Set(buildPricingSeedRows(modelsDevFixture).map((row) => row.provider)),
+    ],
+    exempt: {
+      acp: "A generic ACP target owns its own billing and the adapter reports totalCostUsd: 0.",
+      dsh: "The dsh adapter reports no cost data today, so there is nothing to price.",
+    },
+  },
+  {
+    file: "apps/ui/src/api/types.ts",
+    what: "PROVIDER_NAMES (#1637; HARNESS_LABEL and ICON_BY_HARNESS are typed against it)",
+    members: () =>
+      literalMembers("apps/ui/src/api/types.ts", /export const PROVIDER_NAMES = \[([^\]]*)\]/),
+    exempt: {},
+  },
+  {
+    file: "src/http/agents.ts",
+    what: "LocalHarnessProviderSchema (PATCH /api/agents/{id}/runtime)",
+    members: () =>
+      literalMembers(
+        "src/http/agents.ts",
+        /const LocalHarnessProviderSchema = z\.enum\(\[([^\]]*)\]/,
+      ),
+    exempt: {
+      "claude-managed":
+        "Cloud harness: runs in Anthropic's sandbox, no local runtime to configure.",
+      devin: "Cloud harness: runs on Devin's API, no local runtime to configure.",
+    },
+  },
+  {
+    file: "apps/ui/src/lib/agent-runtime-models.ts",
+    what: "LOCAL_HARNESSES (dashboard runtime harness picker)",
+    members: () =>
+      literalMembers(
+        "apps/ui/src/lib/agent-runtime-models.ts",
+        /export const LOCAL_HARNESSES[^=]*=\s*\[([^\]]*)\]/,
+      ),
+    exempt: {
+      "claude-managed":
+        "Cloud harness: runs in Anthropic's sandbox, no local runtime to configure.",
+      devin: "Cloud harness: runs on Devin's API, no local runtime to configure.",
+      dsh: "KNOWN GAP (#1559): the server's LocalHarnessProviderSchema accepts dsh but the picker does not offer it yet.",
+    },
+  },
+];
+
+describe("provider registration synchronization", () => {
+  for (const touchPoint of TOUCH_POINTS) {
+    describe(`${touchPoint.file}: ${touchPoint.what}`, () => {
+      test("the extractor finds the list and every exemption is still needed", async () => {
+        const members = await touchPoint.members();
+        expect(members.length).toBeGreaterThan(0);
+        const stale = Object.keys(touchPoint.exempt).filter((provider) =>
+          members.includes(provider),
+        );
+        if (stale.length > 0) {
+          throw new Error(
+            `Stale exemption in ${touchPoint.file} (${touchPoint.what}): ${stale.join(", ")} is now present. Remove it from the exempt map in src/tests/provider-registration.test.ts.`,
+          );
+        }
+      });
+
+      for (const provider of ProviderNameSchema.options) {
+        if (touchPoint.exempt[provider]) continue;
+        test(`registers ${provider}`, async () => {
+          const members = await touchPoint.members();
+          if (!members.includes(provider)) {
+            throw new Error(
+              `Provider "${provider}" is missing from ${touchPoint.what} in ${touchPoint.file}. Add it there, or exempt it for this touch point in src/tests/provider-registration.test.ts with a one-line reason.`,
+            );
+          }
+        });
+      }
+    });
+  }
+});
+
+// ─── docker-entrypoint.sh ────────────────────────────────────────────────────
+// Bash chains a TS type cannot reach, so these run the real blocks in a bash
+// subprocess and check which branch each provider lands in.
+
+const entrypoint = await readRepoFile("docker-entrypoint.sh");
 
 const bootstrapStart = 'if [ "$HARNESS_PROVIDER" = "pi" ]; then';
 const bootstrapEnd = "# ---- Verify provider binary is reachable ----";
@@ -23,20 +225,23 @@ if (isolatedBootstrapBlock === bootstrapBlock) {
   throw new Error(`Could not isolate entrypoint assignment: ${codexHomeAssignment}`);
 }
 
-const modelsDevFixture = {
-  anthropic: { models: { "claude-test": { cost: { input: 1, output: 2 } } } },
-  openai: { models: { "gpt-test": { cost: { input: 1, output: 2 } } } },
-  openrouter: { models: { "test/model": { cost: { input: 1, output: 2 } } } },
-};
-
-const ENTRYPOINT_EXEMPTIONS = new Set(["claude", "acp"]);
-const ENTRYPOINT_OUTPUT: Record<string, string> = {
-  dsh: "Warning: dsh provider has no credentials yet",
-  pi: "Warning: pi provider has no credentials yet",
-  opencode: "Warning: opencode provider has no credentials yet",
-  "claude-managed": "Warning: claude-managed provider missing:",
-  devin: "Warning: devin provider missing DEVIN_API_KEY / DEVIN_ORG_ID",
-  codex: "Warning: codex provider has no auth.json yet",
+/**
+ * The line each provider's credential-bootstrap branch prints with no
+ * credentials set, or why it has no branch. Typed over every provider, so a
+ * new one does not compile until it is listed here.
+ */
+const BOOTSTRAP: Record<ProviderName, { expect: string } | { exempt: string }> = {
+  claude: { expect: "Warning: claude provider has no credentials yet" },
+  dsh: { expect: "Warning: dsh provider has no credentials yet" },
+  pi: { expect: "Warning: pi provider has no credentials yet" },
+  opencode: { expect: "Warning: opencode provider has no credentials yet" },
+  "claude-managed": { expect: "Warning: claude-managed provider missing:" },
+  devin: { expect: "Warning: devin provider missing DEVIN_API_KEY / DEVIN_ORG_ID" },
+  codex: { expect: "Warning: codex provider has no auth.json yet" },
+  acp: {
+    exempt:
+      "KNOWN GAP (#1559): no acp branch, so it falls into the claude else branch and prints the claude warning.",
+  },
 };
 
 async function runCredentialBootstrap(provider: string): Promise<{
@@ -65,32 +270,81 @@ async function runCredentialBootstrap(provider: string): Promise<{
   }
 }
 
-describe("provider registration synchronization", () => {
-  test("credential dispatcher has a concrete handler for every provider", () => {
-    expect(Object.keys(CREDENTIAL_PROVIDER_CHECKERS).sort()).toEqual(
-      [...ProviderNameSchema.options].sort(),
-    );
-  });
+function extractMarkedBlock(name: string): string {
+  const begin = entrypoint.indexOf(`# BEGIN ${name}`);
+  const end = entrypoint.indexOf(`# END ${name}`, begin);
+  if (begin === -1 || end === -1) {
+    throw new Error(`Could not find the # BEGIN/END ${name} markers in docker-entrypoint.sh.`);
+  }
+  return entrypoint.slice(begin, end);
+}
 
-  test("pricing seeder emits rows for providers with cost reporting", () => {
-    const registered = new Set(buildPricingSeedRows(modelsDevFixture).map((row) => row.provider));
-    const expected = ProviderNameSchema.options.filter(
-      (provider) => provider !== "acp" && provider !== "dsh",
-    );
-    expect([...registered].filter((provider) => expected.includes(provider)).sort()).toEqual(
-      [...expected].sort(),
-    );
-  });
+/** Resolvable no-op stubs for every binary the verify chain may look up. */
+function makeBinaryStubDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "provider-registration-bin-"));
+  for (const name of ["claude", "codex", "opencode", "dsh"]) {
+    const file = join(dir, name);
+    writeFileSync(file, "#!/bin/sh\nexit 0\n");
+    chmodSync(file, 0o755);
+  }
+  return dir;
+}
 
-  test.skipIf(process.platform === "win32")(
-    "entrypoint executes a credential bootstrap for every non-exempt provider",
-    async () => {
-      for (const provider of ProviderNameSchema.options) {
-        if (ENTRYPOINT_EXEMPTIONS.has(provider)) continue;
+describe.skipIf(process.platform === "win32")("docker-entrypoint.sh provider chains", () => {
+  for (const provider of ProviderNameSchema.options) {
+    const entry = BOOTSTRAP[provider] as (typeof BOOTSTRAP)[ProviderName] | undefined;
+    if (entry && !("expect" in entry)) {
+      test(`credential bootstrap exemption for ${provider} is still needed`, async () => {
         const result = await runCredentialBootstrap(provider);
-        expect(result.exitCode).toBe(0);
-        expect(result.stdout).toContain(ENTRYPOINT_OUTPUT[provider]);
+        if (result.stdout.includes(`Warning: ${provider} provider`)) {
+          throw new Error(
+            `Stale exemption: docker-entrypoint.sh now has a ${provider} credential-bootstrap branch. Replace its BOOTSTRAP exemption in src/tests/provider-registration.test.ts with the warning it prints.`,
+          );
+        }
+      });
+      continue;
+    }
+    test(`credential bootstrap has a ${provider} branch`, async () => {
+      if (!entry) {
+        throw new Error(
+          `Provider "${provider}" is missing from BOOTSTRAP in src/tests/provider-registration.test.ts. Add its docker-entrypoint.sh credential warning, or an exemption with a one-line reason.`,
+        );
       }
-    },
-  );
+      const result = await runCredentialBootstrap(provider);
+      expect(result.exitCode).toBe(0);
+      if (!result.stdout.includes(entry.expect)) {
+        throw new Error(
+          `Provider "${provider}" has no credential-bootstrap branch in docker-entrypoint.sh (expected "${entry.expect}", got "${result.stdout}"). Add an elif, or exempt it in BOOTSTRAP with a one-line reason.`,
+        );
+      }
+    });
+  }
+
+  // #1463 class: a provider with no branch of its own falls through to the
+  // catch-all and gets the claude CLI checked instead of its own binary.
+  const verifyChain = extractMarkedBlock("verify_provider_binary");
+  for (const provider of ProviderNameSchema.options) {
+    test(
+      `verify_provider_binary does not route ${provider} through another provider's check`,
+      async () => {
+        const stubDir = makeBinaryStubDir();
+        const result = await runChild(["bash", "-c", verifyChain], {
+          env: {
+            PATH: [stubDir, "/usr/bin", "/bin"].join(delimiter),
+            HARNESS_PROVIDER: provider,
+            ACP_TARGET: "opencode",
+          },
+        });
+        await rm(stubDir, { recursive: true, force: true });
+        expect(result.exitCode).toBe(0);
+        const checkedClaude = result.stdout.includes("Claude CLI:");
+        if (checkedClaude !== (provider === "claude")) {
+          throw new Error(
+            `Provider "${provider}" ${checkedClaude ? "falls through to the claude CLI check" : "skips the claude CLI check"} in docker-entrypoint.sh verify_provider_binary. Give it its own elif, or add it to the final \`!= "pi"\` guard if it has no binary.`,
+          );
+        }
+      },
+      CHILD_PROCESS_TEST_BUDGET_MS,
+    );
+  }
 });

package/src/tests/rbac-engine.test.ts

@@ -97,6 +97,8 @@ const LEAD_OR_TASK_CREATOR_VERBS: PermissionVerb[] = ["task.cancel.any", "task.s
 
 const LEAD_OR_OWN_NAMESPACE_VERBS: PermissionVerb[] = ["kv.write.any"];
 
+const HUMAN_OR_LEAD_OR_RESOURCE_OWNER_VERBS: PermissionVerb[] = ["approval.cancel.any"];
+
 const ANY_AUTHENTICATED_VERBS: PermissionVerb[] = [
   "app.manage",
   "app.use",
@@ -171,6 +173,7 @@ describe("verb-group partition", () => {
       ...LEAD_OR_RESOURCE_OWNER_VERBS,
       ...LEAD_OR_TASK_CREATOR_VERBS,
       ...LEAD_OR_OWN_NAMESPACE_VERBS,
+      ...HUMAN_OR_LEAD_OR_RESOURCE_OWNER_VERBS,
       ...ANY_AUTHENTICATED_VERBS,
       ...REQUESTER_OWNS_TASK_VERBS,
       ...COMPOSITE_VERBS,
@@ -314,6 +317,33 @@ describe("lead-or-resource-owner verbs", () => {
   });
 });
 
+describe("human-or-lead-or-resource-owner verbs (approval.cancel.any)", () => {
+  const expected: Expected = {
+    lead: true,
+    worker: false,
+    ownerWorker: true,
+    creatorWorker: false,
+    userRequester: true,
+    foreignUser: true,
+    operator: true,
+  };
+  for (const verb of HUMAN_OR_LEAD_OR_RESOURCE_OWNER_VERBS) {
+    test(`${verb}: humans, lead, or owner allowed`, () => {
+      expectDecisions(verb, OWNED_RESOURCE, expected);
+    });
+  }
+
+  test("ownerless resource denies non-lead agents", () => {
+    const decision = can({
+      principal: PRINCIPALS.ownerWorker,
+      verb: "approval.cancel.any",
+      resource: { kind: "owned", ownerAgentId: null },
+      source: "mcp",
+    });
+    expect(decision.allow).toBe(false);
+  });
+});
+
 describe("lead-or-task-creator verbs (task.cancel.any)", () => {
   const expected: Expected = {
     lead: true,

package/src/tests/reasoning-effort.test.ts

@@ -30,6 +30,14 @@ describe("reasoningCapability — cache-sourced levels", () => {
       "xhigh",
     ]);
   });
+  test("Claude Sonnet 5.5 exposes supported CLI effort levels", () => {
+    expect(reasoningCapability("claude", "claude-sonnet-5-5").levels).toEqual([
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+    ]);
+  });
   test("claude claude-opus-4-8: levels come from reasoning_options.effort, not the fallback", () => {
     const cap = reasoningCapability("claude", "claude-opus-4-8");
     expect(cap.supported).toBe(true);

package/src/tests/script-connections.test.ts

@@ -578,6 +578,13 @@ describe("script connections", () => {
       // 164 indexes agent_tasks columns and alters api_key_status, neither of
       // which this migration-112-only fixture creates.
       markMigrationApplied(database, "164_usage_cover_index_and_key_plans.sql");
+      markMigrationApplied(database, "166_approval_request_auto_cancellation.sql");
+      // 171 alters memory_retrieval, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "171_memory_retrieval_relevance.sql");
+      // 175 indexes workflow_runs, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "175_workflow_runs_list_index.sql");
+      // 177 indexes events, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "177_events_event_agent_created_index.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/sdk-allowlist.test.ts

@@ -98,6 +98,45 @@ describe("script SDK allowlist", () => {
     }
   });
 
+  test("approval_cancel posts to the cancel route with the reason", async () => {
+    let request: { method: string; path: string; body: unknown } | undefined;
+    const httpServer = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        request = {
+          method: req.method,
+          path: new URL(req.url).pathname,
+          body: await req.json(),
+        };
+        return Response.json({ alreadyCancelled: false, runCancelled: false });
+      },
+    });
+    const config = new SwarmConfig({
+      system: {
+        apiKey: { value: "sdk-test-key", isSecret: true },
+        agentId: { value: "sdk-test-agent", isSecret: false },
+        mcpBaseUrl: { value: `http://127.0.0.1:${httpServer.port}`, isSecret: false },
+      },
+      user: {},
+    });
+    const sdk = createSwarmSdk(config);
+
+    try {
+      const requestId = crypto.randomUUID();
+      await sdk.approval_cancel({ requestId, reason: "done" });
+      expect(request).toEqual({
+        method: "POST",
+        path: `/api/approval-requests/${requestId}/cancel`,
+        body: { reason: "done" },
+      });
+      await expect(sdk.approval_cancel({} as { requestId: string })).rejects.toThrow(
+        "approval_cancel requires string `requestId`",
+      );
+    } finally {
+      httpServer.stop(true);
+    }
+  });
+
   test("schedule_list maps includeFull to the full HTTP field and keeps the default slim", async () => {
     const requestUrls: URL[] = [];
     const httpServer = Bun.serve({

package/src/tests/session-costs-model-key-normalize.test.ts

@@ -137,6 +137,7 @@ describe("normalizeModelKey()", () => {
     expect(normalizeModelKey("claude", "claude-opus-5")).toBe("claude-opus-5");
     expect(normalizeModelKey("claude", "claude-fable-5")).toBe("claude-fable-5");
     expect(normalizeModelKey("claude", "claude-mythos-5")).toBe("claude-mythos-5");
+    expect(normalizeModelKey("claude", "claude-sonnet-5-5")).toBe("claude-sonnet-5-5");
     expect(normalizeModelKey("claude", "claude-sonnet-5")).toBe("claude-sonnet-5");
   });