@desplega.ai/agent-swarm 1.157.0 → 1.158.0

package/src/tests/webhooks-task-blocked.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { TaskCreationBlockedError } from "../tasks/errors";
+
+// A pre.task.create extension block must ack the delivery (200, skipped) and
+// still emit the delivery's workflow events; any other error stays a 500.
+
+type Outcome = "blocked" | "boom";
+let outcome: Outcome = "blocked";
+
+function failingHandler(): Promise<never> {
+  if (outcome === "blocked") {
+    return Promise.reject(
+      new TaskCreationBlockedError("sender not allowed", { id: "ext-1", name: "gate" }),
+    );
+  }
+  return Promise.reject(new Error("db exploded"));
+}
+
+const realGithub = await import("../github");
+const realGitlab = await import("../gitlab");
+mock.module("../github", () => ({
+  ...realGithub,
+  isGitHubEnabled: () => true,
+  verifyWebhookSignature: async () => true,
+  handleIssue: failingHandler,
+}));
+mock.module("../gitlab", () => ({
+  ...realGitlab,
+  isGitLabEnabled: () => true,
+  verifyGitLabWebhook: () => true,
+  handleIssue: failingHandler,
+}));
+
+const { handleWebhooks } = await import("../http/webhooks");
+const { workflowEventBus } = await import("../workflows/event-bus");
+
+function fakeReqRes(rawBody: string, headers: Record<string, string>) {
+  const req = {
+    method: "POST",
+    headers,
+    async *[Symbol.asyncIterator]() {
+      yield Buffer.from(rawBody);
+    },
+  } as unknown as IncomingMessage;
+  const captured = { status: 0, body: "" };
+  const res = {
+    writeHead(status: number) {
+      captured.status = status;
+      return this;
+    },
+    end(chunk?: string) {
+      if (chunk) captured.body = chunk;
+      return this;
+    },
+  } as unknown as ServerResponse;
+  return { req, res, captured };
+}
+
+const githubIssue = JSON.stringify({
+  action: "opened",
+  issue: { number: 7, title: "hi" },
+  repository: { full_name: "acme/repo" },
+});
+const gitlabIssue = JSON.stringify({
+  object_kind: "issue",
+  object_attributes: { action: "open", iid: 3, title: "hi" },
+  project: { path_with_namespace: "acme/repo" },
+});
+
+const cases = [
+  {
+    name: "GitHub",
+    path: ["api", "github", "webhook"],
+    body: githubIssue,
+    headers: { "x-github-event": "issues", "x-hub-signature-256": "sha256=x" },
+    event: "github.issue.opened",
+  },
+  {
+    name: "GitLab",
+    path: ["api", "gitlab", "webhook"],
+    body: gitlabIssue,
+    headers: { "x-gitlab-token": "t" },
+    event: "gitlab.issue.open",
+  },
+];
+
+let emitted: string[] = [];
+let originalEmit: typeof workflowEventBus.emit;
+
+beforeEach(() => {
+  emitted = [];
+  originalEmit = workflowEventBus.emit.bind(workflowEventBus);
+  workflowEventBus.emit = ((name: string) => {
+    emitted.push(name);
+  }) as typeof workflowEventBus.emit;
+});
+
+afterEach(() => {
+  workflowEventBus.emit = originalEmit;
+});
+
+describe("webhook task creation blocked by extension", () => {
+  for (const c of cases) {
+    test(`${c.name}: blocked create returns 200 skipped and still emits the workflow event`, async () => {
+      outcome = "blocked";
+      const { req, res, captured } = fakeReqRes(c.body, c.headers);
+      expect(await handleWebhooks(req, res, c.path)).toBe(true);
+      expect(captured.status).toBe(200);
+      expect(JSON.parse(captured.body)).toEqual({
+        created: false,
+        skipped: true,
+        reason: "sender not allowed",
+        extension: { id: "ext-1", name: "gate" },
+      });
+      expect(emitted).toEqual([c.event]);
+    });
+
+    test(`${c.name}: a non-blocked handler error still returns 500`, async () => {
+      outcome = "boom";
+      const { req, res, captured } = fakeReqRes(c.body, c.headers);
+      await handleWebhooks(req, res, c.path);
+      expect(captured.status).toBe(500);
+      expect(emitted).toEqual([]);
+    });
+  }
+});

package/src/tests/workflow-approval-recovery.test.ts

@@ -0,0 +1,203 @@
+import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { z } from "zod";
+import * as db from "../be/db";
+import {
+  closeDb,
+  createWorkflow,
+  getApprovalRequestById,
+  getDbClient,
+  getWorkflowRun,
+  getWorkflowRunStepsByRunId,
+  initDb,
+} from "../be/db";
+import type { ExecutorMeta, WorkflowDefinition } from "../types";
+import { startWorkflowExecution } from "../workflows/engine";
+import {
+  BaseExecutor,
+  type ExecutorDependencies,
+  type ExecutorResult,
+} from "../workflows/executors/base";
+import { ExecutorRegistry } from "../workflows/executors/registry";
+import { recoverIncompleteRuns } from "../workflows/recovery";
+
+const TEST_DB_PATH = "./test-workflow-approval-recovery.sqlite";
+
+class MockHITLExecutor extends BaseExecutor<
+  typeof MockHITLExecutor.schema,
+  typeof MockHITLExecutor.outSchema
+> {
+  static readonly schema = z.object({ title: z.string() });
+  static readonly outSchema = z.object({
+    requestId: z.string(),
+    status: z.string(),
+    responses: z.record(z.string(), z.unknown()).nullable(),
+  });
+
+  readonly type = "mock-hitl";
+  readonly mode = "async" as const;
+  readonly configSchema = MockHITLExecutor.schema;
+  readonly outputSchema = MockHITLExecutor.outSchema;
+  lastRequestId: string | null = null;
+
+  protected async execute(
+    config: z.infer<typeof MockHITLExecutor.schema>,
+    _context: Readonly<Record<string, unknown>>,
+    meta: ExecutorMeta,
+  ): Promise<ExecutorResult<z.infer<typeof MockHITLExecutor.outSchema>>> {
+    const requestId = crypto.randomUUID();
+    this.lastRequestId = requestId;
+    await this.deps.db.createApprovalRequest({
+      id: requestId,
+      title: config.title,
+      questions: [{ id: "q1", type: "approval", label: "Approve?", required: true }],
+      approvers: { policy: "any" as const },
+      workflowRunId: meta.runId,
+      workflowRunStepId: meta.stepId,
+    });
+    return {
+      status: "success",
+      async: true,
+      waitFor: "approval.resolved",
+      correlationId: requestId,
+    } as unknown as ExecutorResult<z.infer<typeof MockHITLExecutor.outSchema>>;
+  }
+}
+
+class EchoExecutor extends BaseExecutor<typeof EchoExecutor.schema, typeof EchoExecutor.outSchema> {
+  static readonly schema = z.object({ message: z.string() });
+  static readonly outSchema = z.object({ echo: z.string() });
+
+  readonly type = "echo";
+  readonly mode = "instant" as const;
+  readonly configSchema = EchoExecutor.schema;
+  readonly outputSchema = EchoExecutor.outSchema;
+
+  protected async execute(
+    config: z.infer<typeof EchoExecutor.schema>,
+  ): Promise<ExecutorResult<z.infer<typeof EchoExecutor.outSchema>>> {
+    return { status: "success", output: { echo: config.message } };
+  }
+}
+
+const deps: ExecutorDependencies = {
+  db: db as typeof import("../be/db"),
+  eventBus: { emit: () => {}, on: () => {}, off: () => {} },
+  interpolate: (t: string) => t,
+};
+
+const definition: WorkflowDefinition = {
+  nodes: [
+    {
+      id: "review",
+      type: "mock-hitl",
+      config: { title: "Review" },
+      next: { approved: "deploy", rejected: "reject", timeout: "notify-timeout" },
+    },
+    { id: "deploy", type: "echo", config: { message: "deploying" } },
+    { id: "reject", type: "echo", config: { message: "rejected" } },
+    { id: "notify-timeout", type: "echo", config: { message: "timed out" } },
+  ],
+};
+
+let counter = 0;
+
+async function startWaitingRun(registry: ExecutorRegistry) {
+  counter++;
+  const workflow = await createWorkflow({
+    name: `approval-recovery-${counter}-${Date.now()}`,
+    definition,
+  });
+  const runId = await startWorkflowExecution(workflow, {}, registry);
+  const requestId = (registry.get("mock-hitl") as MockHITLExecutor).lastRequestId!;
+  expect((await getWorkflowRun(runId))!.status).toBe("waiting");
+  return { runId, requestId };
+}
+
+function makeRegistry(): ExecutorRegistry {
+  const registry = new ExecutorRegistry();
+  registry.register(new MockHITLExecutor(deps));
+  registry.register(new EchoExecutor(deps));
+  return registry;
+}
+
+describe("recoverApprovalWaitingRuns", () => {
+  beforeAll(async () => {
+    try {
+      await unlink(TEST_DB_PATH);
+    } catch {}
+    initDb(TEST_DB_PATH);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+  });
+
+  test("a cancelled request never routes its waiting step", async () => {
+    const registry = makeRegistry();
+    const { runId, requestId } = await startWaitingRun(registry);
+    await getDbClient().run(
+      "UPDATE approval_requests SET status = 'cancelled', resolutionReason = 'x' WHERE id = ?",
+      [requestId],
+    );
+
+    await recoverIncompleteRuns(registry);
+
+    expect((await getWorkflowRun(runId))!.status).toBe("waiting");
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    expect(steps.map((s) => s.nodeId)).toEqual(["review"]);
+    expect(steps[0]!.status).toBe("waiting");
+  });
+
+  test("an expired pending request becomes timeout and routes on the timeout port", async () => {
+    const registry = makeRegistry();
+    const { runId, requestId } = await startWaitingRun(registry);
+    const expiresAt = new Date(Date.now() - 60_000).toISOString();
+    await getDbClient().run("UPDATE approval_requests SET expiresAt = ? WHERE id = ?", [
+      expiresAt,
+      requestId,
+    ]);
+
+    await recoverIncompleteRuns(registry);
+
+    const request = await getApprovalRequestById(requestId);
+    expect(request!.status).toBe("timeout");
+    expect(request!.resolutionReason).toStartWith("Timed out: no answer before");
+    const nodeIds = (await getWorkflowRunStepsByRunId(runId)).map((s) => s.nodeId);
+    expect(nodeIds).toContain("notify-timeout");
+    expect(nodeIds).not.toContain("deploy");
+  });
+
+  test("a request cancelled after the snapshot never routes its waiting step", async () => {
+    const registry = makeRegistry();
+    const { runId, requestId } = await startWaitingRun(registry);
+    await getDbClient().run("UPDATE approval_requests SET expiresAt = ? WHERE id = ?", [
+      new Date(Date.now() - 60_000).toISOString(),
+      requestId,
+    ]);
+
+    // The snapshot still reads pending past expiresAt; a cancel then lands
+    // before the recovery pass writes timeout.
+    const original = db.getStuckApprovalRuns;
+    const spy = spyOn(db, "getStuckApprovalRuns").mockImplementation(async () => {
+      const rows = await original();
+      await db.cancelApprovalRequestById(requestId, { reason: "cancelled", resolvedBy: null });
+      return rows;
+    });
+    try {
+      await recoverIncompleteRuns(registry);
+    } finally {
+      spy.mockRestore();
+    }
+
+    expect((await getApprovalRequestById(requestId))!.status).toBe("cancelled");
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    expect(steps.map((s) => s.nodeId)).toEqual(["review"]);
+    expect(steps[0]!.status).toBe("waiting");
+  });
+});

package/src/tests/workflow-hitl-routing.test.ts

@@ -147,7 +147,7 @@ async function makeWorkflow(def: WorkflowDefinition): Promise<Workflow> {
  * Returns the run ID and step details for verification.
  */
 async function runHITLWorkflow(
-  approvalStatus: "approved" | "rejected" | "timeout",
+  approvalStatus: "approved" | "rejected" | "timeout" | "cancelled",
   eventBus: InProcessEventBus,
   registry: ExecutorRegistry,
 ) {
@@ -287,6 +287,27 @@ describe("HITL port-based routing", () => {
     expect(stepNodeIds).not.toContain("notify-timeout");
   });
 
+  test("cancelled → routes to no port; the step stays waiting", async () => {
+    const eventBus = new InProcessEventBus();
+    const registry = new ExecutorRegistry();
+    registry.register(new MockHITLExecutor({ ...mockDeps, eventBus }));
+    registry.register(new EchoExecutor({ ...mockDeps, eventBus }));
+    setupWorkflowResumeListener(eventBus, registry);
+
+    const { runId } = await runHITLWorkflow("cancelled", eventBus, registry);
+
+    const run = await getWorkflowRun(runId);
+    expect(run!.status).toBe("waiting");
+
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    expect(steps.find((s) => s.nodeId === "review")!.status).toBe("waiting");
+    expect(steps.map((s) => s.nodeId).sort()).toEqual(["review", "start"]);
+    const tasks = await db
+      .getDbClient()
+      .query<{ id: string }>("SELECT id FROM agent_tasks WHERE workflowRunId = ?", [runId]);
+    expect(tasks).toHaveLength(0);
+  });
+
   test("timeout → routes to 'timeout' port successor (notify-timeout)", async () => {
     const eventBus = new InProcessEventBus();
     const registry = new ExecutorRegistry();

package/src/tests/workflow-hitl-slack-card.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, mock, test } from "bun:test";
+
+const postMessage = mock(async (_args: Record<string, unknown>) => ({ ts: "1.0" }));
+mock.module("../slack/app", () => ({
+  getSlackApp: () => ({ client: { chat: { postMessage } } }),
+}));
+
+import type { ExecutorDependencies } from "../workflows/executors/base";
+import { HumanInTheLoopExecutor } from "../workflows/executors/human-in-the-loop";
+
+describe("HITL Slack card timeout caption", () => {
+  test("says the request times out, never that it auto-rejects", async () => {
+    const deps: ExecutorDependencies = {
+      db: {
+        getApprovalRequestByStepId: async () => null,
+        createApprovalRequest: async () => ({ status: "pending" }),
+        updateApprovalRequestNotifications: async () => {},
+        getApprovalRequestById: async () => ({ status: "pending" }),
+      } as unknown as typeof import("../be/db"),
+      eventBus: { emit: () => {}, on: () => {}, off: () => {} },
+      interpolate: (template: string) => template,
+    };
+    const executor = new HumanInTheLoopExecutor(deps);
+
+    await executor.run({
+      config: {
+        title: "Deploy",
+        questions: [{ id: "q1", type: "approval", label: "Approve?", required: true }],
+        approvers: { policy: "any" },
+        timeout: { seconds: 3600, action: "reject" },
+        notifications: [{ channel: "slack", target: "C1" }],
+      },
+      context: {},
+      meta: {
+        runId: crypto.randomUUID(),
+        stepId: crypto.randomUUID(),
+        nodeId: "review",
+        workflowId: crypto.randomUUID(),
+        dryRun: false,
+      },
+    });
+    // Notifications are fire-and-forget; wait for the dispatch to post.
+    for (let i = 0; i < 50 && postMessage.mock.calls.length === 0; i++) {
+      await Bun.sleep(10);
+    }
+
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    const blocks = JSON.stringify(postMessage.mock.calls[0]![0].blocks);
+    expect(blocks).toContain("times out if not responded");
+    expect(blocks).not.toContain("auto-rejects");
+  });
+});

package/src/tests/workflow-http-v2.test.ts

@@ -753,7 +753,7 @@ describe("Workflow HTTP API v2", () => {
       // List all runs
       const res1 = await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs`, { headers });
       expect(res1.status).toBe(200);
-      const allRuns = (await res1.json()) as WorkflowRun[];
+      const allRuns = ((await res1.json()) as { runs: WorkflowRun[] }).runs;
       expect(allRuns.length).toBeGreaterThanOrEqual(1);
 
       // Filter by status — use a status that likely doesn't match
@@ -761,14 +761,14 @@ describe("Workflow HTTP API v2", () => {
         headers,
       });
       expect(res2.status).toBe(200);
-      const filteredRuns = (await res2.json()) as WorkflowRun[];
+      const filteredRuns = ((await res2.json()) as { runs: WorkflowRun[] }).runs;
       // All returned runs should have the requested status
       for (const run of filteredRuns) {
         expect(run.status).toBe("waiting");
       }
     });
 
-    test("supports deterministic limit/offset pages while preserving the omitted legacy shape", async () => {
+    test("supports deterministic limit/offset pages", async () => {
       const workflow = await createTestWorkflow();
       const runIds = Array.from({ length: 5 }, () => crypto.randomUUID());
       const statuses = ["running", "failed", "running", "failed", "running"] as const;
@@ -782,11 +782,11 @@ describe("Workflow HTTP API v2", () => {
         ]);
       }
 
-      const legacyRes = await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs`, { headers });
-      expect(legacyRes.status).toBe(200);
-      const legacyBody = (await legacyRes.json()) as WorkflowRun[];
-      expect(Array.isArray(legacyBody)).toBe(true);
-      expect(legacyBody.map((run) => run.id)).toEqual([...runIds].reverse());
+      const defaultRes = await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs`, { headers });
+      expect(defaultRes.status).toBe(200);
+      const defaultBody = (await defaultRes.json()) as { runs: WorkflowRun[]; page: unknown };
+      expect(defaultBody.runs.map((run) => run.id)).toEqual([...runIds].reverse());
+      expect(defaultBody.page).toEqual({ limit: 50, offset: 0, total: 5, hasMore: false });
 
       const pageRes = await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs?limit=2&offset=1`, {
         headers,
@@ -829,6 +829,97 @@ describe("Workflow HTTP API v2", () => {
       expect(invalidRes.status).toBe(400);
     });
 
+    test("caps an unpaged request at 50 runs and pages through the rest", async () => {
+      const workflow = await createTestWorkflow();
+      const total = 53;
+      for (let index = 0; index < total; index++) {
+        const id = crypto.randomUUID();
+        await createWorkflowRun({ id, workflowId: workflow.id });
+        await getDbClient().run("UPDATE workflow_runs SET startedAt = ? WHERE id = ?", [
+          new Date(Date.UTC(2026, 0, 1, 0, 0, index)).toISOString(),
+          id,
+        ]);
+      }
+
+      const first = (await (
+        await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs`, { headers })
+      ).json()) as {
+        runs: WorkflowRun[];
+        page: {
+          limit: number;
+          offset: number;
+          total: number;
+          hasMore: boolean;
+          nextOffset?: number;
+        };
+      };
+      expect(first.runs).toHaveLength(50);
+      expect(first.page).toEqual({ limit: 50, offset: 0, total, hasMore: true, nextOffset: 50 });
+
+      const second = (await (
+        await fetch(
+          `${baseUrl}/api/workflows/${workflow.id}/runs?offset=${first.page.nextOffset}`,
+          {
+            headers,
+          },
+        )
+      ).json()) as { runs: WorkflowRun[]; page: { hasMore: boolean } };
+      expect(second.runs).toHaveLength(3);
+      expect(second.page.hasMore).toBe(false);
+      expect(new Set([...first.runs, ...second.runs].map((run) => run.id)).size).toBe(total);
+    });
+
+    test("list rows carry triggerData but not context; the detail route serves context", async () => {
+      const workflow = await createTestWorkflow();
+      const run = await createWorkflowRun({
+        id: crypto.randomUUID(),
+        workflowId: workflow.id,
+        triggerData: { topic: "runs" },
+      });
+      await updateWorkflowRun(run.id, { context: { nodeOutput: "x".repeat(50_000) } });
+
+      const body = (await (
+        await fetch(`${baseUrl}/api/workflows/${workflow.id}/runs`, { headers })
+      ).json()) as { runs: Array<Record<string, unknown>> };
+      expect(body.runs).toHaveLength(1);
+      expect(body.runs[0]!.id).toBe(run.id);
+      expect(body.runs[0]!.triggerData).toEqual({ topic: "runs" });
+      expect("context" in body.runs[0]!).toBe(false);
+
+      const detail = (await (
+        await fetch(`${baseUrl}/api/workflow-runs/${run.id}`, { headers })
+      ).json()) as { run: WorkflowRun };
+      expect(detail.run.context).toEqual({ nodeOutput: "x".repeat(50_000) });
+    });
+
+    test("a run page and its count read from the workflow indexes without a sort or cross-workflow scan", async () => {
+      const explain = async (sql: string, params: string[]) =>
+        (await getDbClient().query<{ detail: string }>(`EXPLAIN QUERY PLAN ${sql}`, params))
+          .map((row) => row.detail)
+          .join("\n");
+      const workflowId = crypto.randomUUID();
+
+      const page = await explain(
+        "SELECT id FROM workflow_runs WHERE workflowId = ? ORDER BY startedAt DESC, id DESC LIMIT 50",
+        [workflowId],
+      );
+      expect(page).toContain("idx_workflow_runs_workflow_started");
+      expect(page).not.toContain("USE TEMP B-TREE");
+
+      const filtered = await explain(
+        "SELECT id FROM workflow_runs WHERE workflowId = ? AND status = ? ORDER BY startedAt DESC, id DESC LIMIT 50",
+        [workflowId, "failed"],
+      );
+      expect(filtered).toContain("idx_workflow_runs_workflow_status_started");
+      expect(filtered).not.toContain("USE TEMP B-TREE");
+
+      const count = await explain(
+        "SELECT COUNT(*) FROM workflow_runs WHERE workflowId = ? AND status = ?",
+        [workflowId, "failed"],
+      );
+      expect(count).toContain("COVERING INDEX idx_workflow_runs_workflow_status_started");
+    });
+
     test("MCP run listing defaults to bounded slim rows and preserves an explicit full-row opt-in", async () => {
       const workflow = await createTestWorkflow();
       const largeValue = "x".repeat(100_000);

package/src/tests/workflow-retry-validation.test.ts

@@ -47,6 +47,19 @@ class NumberExecutor extends BaseExecutor<
   }
 }
 
+/**
+ * NumberExecutor that also emits `nextPort: "success"`, like `script` / `swarm-script`.
+ */
+class SuccessPortNumberExecutor extends NumberExecutor {
+  override readonly type = "success-port-number";
+
+  protected override async execute(
+    config: z.infer<typeof NumberExecutor.schema>,
+  ): Promise<ExecutorResult<z.infer<typeof NumberExecutor.outSchema>>> {
+    return { status: "success", output: { result: config.value }, nextPort: "success" };
+  }
+}
+
 /**
  * Validate executor stub that checks if the target node's result is > 50.
  * Returns { pass: true } or { pass: false, reason: string }.
@@ -112,6 +125,7 @@ function createTestRegistry(): ExecutorRegistry {
   const registry = new ExecutorRegistry();
   registry.register(new NumberExecutor(mockDeps));
   registry.register(new ValidateStubExecutor(mockDeps));
+  registry.register(new SuccessPortNumberExecutor(mockDeps));
   return registry;
 }
 
@@ -249,6 +263,48 @@ describe("Retry Poller — Validation on Retry", () => {
     expect(validateCallCount).toBeGreaterThanOrEqual(1);
   });
 
+  test('retried script-like node routes to "pass" once validation passes', async () => {
+    validateCallCount = 0;
+    validateAlwaysPass = false;
+
+    const workflow = await makeWorkflow({
+      nodes: [
+        {
+          id: "n1",
+          type: "success-port-number",
+          config: { value: 10 },
+          next: { pass: "on-pass", fail: "on-fail" },
+          validation: {
+            executor: "validate",
+            config: { prompt: "Is result > 50?" },
+            mustPass: true,
+            retry: { strategy: "static", maxRetries: 2, baseDelayMs: 10, maxDelayMs: 10 },
+          },
+        },
+        { id: "on-pass", type: "number-gen", config: { value: 1 } },
+        { id: "on-fail", type: "number-gen", config: { value: 2 } },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    const initial = (await getWorkflowRunStepsByRunId(runId)).find((s) => s.nodeId === "n1")!;
+    expect(initial.status).toBe("failed");
+    expect(initial.nextRetryAt).toBeTruthy();
+
+    validateAlwaysPass = true;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    startRetryPoller(registry, 10);
+    await new Promise((resolve) => setTimeout(resolve, 150));
+    stopRetryPoller();
+    validateAlwaysPass = false;
+
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    const nodeIds = steps.map((s) => s.nodeId);
+    expect(steps.find((s) => s.nodeId === "n1")!.nextPort).toBe("pass");
+    expect(nodeIds).toContain("on-pass");
+    expect(nodeIds).not.toContain("on-fail");
+  });
+
   test("validation halt on retry → step and run marked failed", async () => {
     validateCallCount = 0;
     validateAlwaysPass = false;