@desplega.ai/agent-swarm 1.158.0 → 1.160.0

package/src/tests/harness-version.test.ts

@@ -1,20 +1,43 @@
-import { describe, expect, mock, test } from "bun:test";
-import { readPkgVersion } from "../providers/harness-version";
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readInstalledCliPackageVersion, readPkgVersion } from "../providers/harness-version";
 
 describe("readPkgVersion", () => {
-  test("reads pi version from the CLI before package.json probes", () => {
+  test("reads the pi version from the installed package without spawning", () => {
+    const spawn = mock(() => ({ stdout: "9.9.9\n", stderr: "", status: 0 }));
+    const requirePackageJson = mock(() => ({ version: "0.0.0" }));
+    const readInstalledVersion = mock(() => "0.79.1");
+
+    const version = readPkgVersion("@earendil-works/pi-coding-agent", {
+      requirePackageJson,
+      spawn,
+      readInstalledVersion,
+    });
+
+    expect(version).toBe("0.79.1");
+    expect(readInstalledVersion).toHaveBeenCalledWith("pi", "@earendil-works/pi-coding-agent");
+    expect(spawn).not.toHaveBeenCalled();
+    expect(requirePackageJson).not.toHaveBeenCalled();
+  });
+
+  test("reads pi version from the CLI when the installed package cannot be found", () => {
     const spawn = mock(() => ({ stdout: "0.79.1\n", stderr: "", status: 0 }));
     const requirePackageJson = mock(() => ({ version: "0.0.0" }));
 
     const version = readPkgVersion("@earendil-works/pi-coding-agent", {
       requirePackageJson,
       spawn,
+      readInstalledVersion: () => undefined,
     });
 
     expect(version).toBe("0.79.1");
     expect(spawn).toHaveBeenCalledWith("pi", ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5_000,
+      killSignal: "SIGKILL",
     });
     expect(requirePackageJson).not.toHaveBeenCalled();
   });
@@ -26,12 +49,15 @@ describe("readPkgVersion", () => {
     const version = readPkgVersion("@opencode-ai/sdk", {
       requirePackageJson,
       spawn,
+      readInstalledVersion: () => undefined,
     });
 
     expect(version).toBe("1.16.2");
     expect(spawn).toHaveBeenCalledWith("opencode", ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5_000,
+      killSignal: "SIGKILL",
     });
     expect(requirePackageJson).not.toHaveBeenCalled();
   });
@@ -40,8 +66,49 @@ describe("readPkgVersion", () => {
     const version = readPkgVersion("@earendil-works/pi-coding-agent", {
       requirePackageJson: () => ({ version: "0.79.1" }),
       spawn: mock(() => ({ stdout: "", stderr: "", status: 0 })),
+      readInstalledVersion: () => undefined,
     });
 
     expect(version).toBe("0.79.1");
   });
 });
+
+describe("readInstalledCliPackageVersion", () => {
+  const originalPath = process.env.PATH;
+  const tmpRoots: string[] = [];
+
+  afterEach(() => {
+    process.env.PATH = originalPath;
+    for (const dir of tmpRoots.splice(0)) rmSync(dir, { recursive: true, force: true });
+  });
+
+  /** A global-install layout: `<root>/bin/fake-cli` -> `<root>/lib/node_modules/@acme/fake/dist/bundle/cli.js`. */
+  function installFakeCli(packageName: string, version: string): string {
+    const root = mkdtempSync(join(tmpdir(), "harness-version-"));
+    tmpRoots.push(root);
+    const pkgDir = join(root, "lib", "node_modules", "@acme", "fake");
+    mkdirSync(join(pkgDir, "dist", "bundle"), { recursive: true });
+    mkdirSync(join(root, "bin"), { recursive: true });
+    writeFileSync(join(pkgDir, "package.json"), JSON.stringify({ name: packageName, version }));
+    // A nested package.json without a matching name must be walked past.
+    writeFileSync(join(pkgDir, "dist", "package.json"), JSON.stringify({ type: "module" }));
+    writeFileSync(join(pkgDir, "dist", "bundle", "cli.js"), "#!/usr/bin/env node\n");
+    symlinkSync(join(pkgDir, "dist", "bundle", "cli.js"), join(root, "bin", "fake-cli"));
+    return join(root, "bin");
+  }
+
+  test("resolves the owning package version through the PATH symlink", () => {
+    process.env.PATH = installFakeCli("@acme/fake", "1.2.3");
+    expect(readInstalledCliPackageVersion("fake-cli", "@acme/fake")).toBe("1.2.3");
+  });
+
+  test("returns undefined when the owning package is a different one", () => {
+    process.env.PATH = installFakeCli("@acme/other", "1.2.3");
+    expect(readInstalledCliPackageVersion("fake-cli", "@acme/fake")).toBeUndefined();
+  });
+
+  test("returns undefined when the command is not on PATH", () => {
+    process.env.PATH = installFakeCli("@acme/fake", "1.2.3");
+    expect(readInstalledCliPackageVersion("not-installed-cli", "@acme/fake")).toBeUndefined();
+  });
+});

package/src/tests/heartbeat-checklist-config.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import { startHeartbeatChecklist, stopHeartbeatChecklist } from "../heartbeat/heartbeat";
+
+// startHeartbeatChecklist reads HEARTBEAT_CHECKLIST_DISABLE and
+// HEARTBEAT_CHECKLIST_INTERVAL_MS at call time. These cases pin how each raw
+// env string is interpreted, observed through the startup log line.
+const ENV_KEYS = ["HEARTBEAT_CHECKLIST_DISABLE", "HEARTBEAT_CHECKLIST_INTERVAL_MS"] as const;
+const saved = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+
+function startWithEnv(env: Partial<Record<(typeof ENV_KEYS)[number], string>>): string[] {
+  for (const key of ENV_KEYS) {
+    if (env[key] === undefined) delete process.env[key];
+    else process.env[key] = env[key];
+  }
+  const spy = spyOn(console, "log").mockImplementation(() => {});
+  try {
+    startHeartbeatChecklist();
+    return spy.mock.calls.map((args) => String(args[0]));
+  } finally {
+    spy.mockRestore();
+  }
+}
+
+const DISABLED = "[Heartbeat] Checklist disabled via HEARTBEAT_CHECKLIST_DISABLE";
+const TICK_OFF =
+  "[Heartbeat] Recurring checklist off (HEARTBEAT_CHECKLIST_INTERVAL_MS=0); boot triage still scheduled";
+const starting = (ms: number) => `[Heartbeat] Checklist starting with ${ms}ms interval`;
+
+describe("startHeartbeatChecklist env parsing", () => {
+  afterEach(() => {
+    stopHeartbeatChecklist();
+    for (const key of ENV_KEYS) {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    }
+  });
+
+  test.each([
+    ["unset", undefined],
+    ["empty", ""],
+    ["false", "false"],
+    ["0", "0"],
+    ["FALSE", "FALSE"],
+    ["typo falls back to on", "treu"],
+  ])("HEARTBEAT_CHECKLIST_DISABLE %s keeps the checklist on", (_label, value) => {
+    expect(startWithEnv({ HEARTBEAT_CHECKLIST_DISABLE: value })).toEqual([starting(1_800_000)]);
+  });
+
+  test.each([
+    ["true"],
+    ["1"],
+    ["TRUE"],
+  ])("HEARTBEAT_CHECKLIST_DISABLE %s turns the checklist off", (value) => {
+    expect(startWithEnv({ HEARTBEAT_CHECKLIST_DISABLE: value })).toEqual([DISABLED]);
+  });
+
+  test.each([
+    ["0", [TICK_OFF]],
+    ["-5", [TICK_OFF]],
+    ["60000", [starting(60_000)]],
+    ["abc", [starting(1_800_000)]],
+    ["", [starting(1_800_000)]],
+  ])("HEARTBEAT_CHECKLIST_INTERVAL_MS=%p", (value, expected) => {
+    expect(startWithEnv({ HEARTBEAT_CHECKLIST_INTERVAL_MS: value })).toEqual(expected);
+  });
+
+  test("interval 0: a second start does not schedule boot triage again", () => {
+    expect(startWithEnv({ HEARTBEAT_CHECKLIST_INTERVAL_MS: "0" })).toEqual([TICK_OFF]);
+    expect(startWithEnv({ HEARTBEAT_CHECKLIST_INTERVAL_MS: "0" })).toEqual([]);
+  });
+});

package/src/tests/heartbeat-checklist.test.ts

@@ -290,8 +290,10 @@ describe("Heartbeat Checklist", () => {
       expect(tasks[0]!.task).toContain("≤10 items");
       expect(tasks[0]!.task).toContain("20 is the absolute max");
       expect(tasks[0]!.task).toContain("script-run");
-      expect(tasks[0]!.task).toContain("Heartbeat Audit");
-      expect(tasks[0]!.task).toContain("Rule #11");
+      expect(tasks[0]!.task).toContain("schedule-health");
+      expect(tasks[0]!.task).toContain("task-failure-audit");
+      expect(tasks[0]!.task).not.toContain("Heartbeat Audit");
+      expect(tasks[0]!.task).not.toMatch(/Rules? #\d/);
     });
 
     test("created task has correct tags", async () => {

package/src/tests/heartbeat-orphan-resume.test.ts

@@ -24,6 +24,7 @@ import {
   runRebootSweep,
   setBeforeHeartbeatSupersedeForTests,
 } from "../heartbeat/heartbeat";
+import { createResumeFollowUp } from "../tasks/worker-follow-up";
 
 const TEST_DB_PATH = "./test-heartbeat-orphan-resume.sqlite";
 
@@ -81,4 +82,51 @@ describe("Heartbeat orphaned supersede repair (TLA+ counterexample)", () => {
     expect((await getTaskById(task.id))?.status).toBe("superseded");
     expect(await getChildTasks(task.id)).toHaveLength(1);
   });
+
+  // Crash after createResumeFollowUp, before backfillSupersedeTaskResumeTaskId.
+  test("a dependent left waiting on a superseded task with a resume is re-pointed on the next sweep", async () => {
+    const agent = await createAgent({ name: "crashed-worker", isLead: false, status: "idle" });
+    const task = await createTaskExtended("Work interrupted mid-backfill", { agentId: agent.id });
+    const dependent = await createTaskExtended("Waits on the interrupted work", {
+      agentId: agent.id,
+      dependsOn: [task.id],
+    });
+    await startTask(task.id);
+
+    await supersedeTask(task.id, { reason: "crash_recovery", resumeTaskId: null });
+    const resume = await createResumeFollowUp({ parentId: task.id, reason: "crash_recovery" });
+    if (resume.kind !== "created") throw new Error(`resume not created: ${resume.kind}`);
+    await getDbClient().run("UPDATE agent_tasks SET finishedAt = ? WHERE id = ?", [
+      new Date(Date.now() - 10 * 60 * 1000).toISOString(),
+      task.id,
+    ]);
+
+    await runRebootSweep();
+    await codeLevelTriage();
+
+    const after = await getTaskById(dependent.id);
+    expect(after?.status).toBe("pending");
+    expect(after?.dependsOn).toEqual([resume.task.id]);
+    expect(await getChildTasks(task.id)).toHaveLength(1);
+  });
+
+  test("dependents of a superseded task that gets no resume are cascade-failed by the sweep", async () => {
+    const task = await createTaskExtended("Unassigned work superseded before any resume");
+    const dependent = await createTaskExtended("Waits on unassigned work", {
+      dependsOn: [task.id],
+    });
+
+    await supersedeTask(task.id, { reason: "manual", resumeTaskId: null });
+    expect((await getTaskById(dependent.id))?.status).toBe("unassigned");
+    await getDbClient().run("UPDATE agent_tasks SET finishedAt = ? WHERE id = ?", [
+      new Date(Date.now() - 10 * 60 * 1000).toISOString(),
+      task.id,
+    ]);
+
+    await codeLevelTriage();
+
+    const after = await getTaskById(dependent.id);
+    expect(after?.status).toBe("failed");
+    expect(after?.failureReason).toContain("was superseded");
+  });
 });

package/src/tests/http-task-write-ownership.test.ts

@@ -0,0 +1,172 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, createAgent, createTaskExtended, getTaskById, initDb, startTask } from "../be/db";
+import { handleTasks } from "../http/tasks";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { type HttpRequestAuth, setRequestAuth } from "../utils/request-auth-context";
+import { listenOnFreePort } from "./test-net";
+
+// Regression: an agent got 200 from HTTP progress and HTTP cancel on another
+// agent's in-progress task. Progress follows task.progress.write (assignee,
+// lead, human); cancel follows the MCP cancel-task policy for agents (lead or
+// creator). Humans and the keyed runner wrapper keep access.
+const ownerId = "aaaa0000-0000-4000-8000-000000000b01";
+const otherId = "bbbb0000-0000-4000-8000-000000000b02";
+const creatorId = "cccc0000-0000-4000-8000-000000000b03";
+const leadId = "dddd0000-0000-4000-8000-000000000b04";
+const userId = "eeee0000-0000-4000-8000-000000000b05";
+
+type Caller =
+  | { as: "operator"; agentId?: string }
+  | { as: "session"; agentId: string }
+  | { as: "user" };
+
+let server: Server;
+let baseUrl: string;
+
+function authFor(caller: Caller): HttpRequestAuth {
+  if (caller.as === "session") {
+    return { kind: "agent", agentId: caller.agentId, taskId: "session-task" };
+  }
+  if (caller.as === "user") {
+    return { kind: "user", userId, user: { id: userId } as never };
+  }
+  return { kind: "operator", fingerprint: "http-task-write-ownership" };
+}
+
+async function post(path: string, caller: Caller, body: unknown) {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "x-test-caller": JSON.stringify(caller),
+  };
+  if (caller.as === "operator" && caller.agentId) headers["X-Agent-ID"] = caller.agentId;
+  const response = await fetch(`${baseUrl}${path}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+  });
+  return response.status;
+}
+
+async function inProgressTask() {
+  const row = await createTaskExtended("http write ownership", {
+    agentId: ownerId,
+    creatorAgentId: creatorId,
+    source: "system",
+    followUpConfig: { disabled: true },
+  });
+  await startTask(row.id);
+  return row;
+}
+
+beforeAll(async () => {
+  initDb(":memory:");
+  await createAgent({ id: ownerId, name: "Owner", isLead: false, status: "idle" });
+  await createAgent({ id: otherId, name: "Other", isLead: false, status: "idle" });
+  await createAgent({ id: creatorId, name: "Creator", isLead: false, status: "idle" });
+  await createAgent({ id: leadId, name: "Lead", isLead: true, status: "idle" });
+
+  server = createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const caller = JSON.parse(String(req.headers["x-test-caller"])) as Caller;
+    setRequestAuth(req, authFor(caller));
+    res.setHeader("Content-Type", "application/json");
+    const pathSegments = getPathSegments(req.url ?? "");
+    const query = parseQueryParams(req.url ?? "");
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    if (await handleTasks(req, res, pathSegments, query, myAgentId)) return;
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: "Not found" }));
+  });
+  const port = await listenOnFreePort(server);
+  baseUrl = `http://127.0.0.1:${port}`;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+});
+
+describe("POST /api/tasks/{id}/progress ownership", () => {
+  test("another agent on the shared key gets 403 and writes nothing", async () => {
+    const task = await inProgressTask();
+    const status = await post(
+      `/api/tasks/${task.id}/progress`,
+      { as: "operator", agentId: otherId },
+      { progress: "not mine" },
+    );
+    expect(status).toBe(403);
+    expect((await getTaskById(task.id))?.progress).toBeUndefined();
+  });
+
+  test("another agent on a session token gets 403", async () => {
+    const task = await inProgressTask();
+    const status = await post(
+      `/api/tasks/${task.id}/progress`,
+      { as: "session", agentId: otherId },
+      { progress: "not mine" },
+    );
+    expect(status).toBe(403);
+    expect((await getTaskById(task.id))?.progress).toBeUndefined();
+  });
+
+  test("the assignee, a lead, the keyed runner wrapper, and a user may write", async () => {
+    const task = await inProgressTask();
+    const callers: Caller[] = [
+      { as: "operator", agentId: ownerId },
+      { as: "operator", agentId: leadId },
+      { as: "operator" },
+      { as: "user" },
+    ];
+    for (const [i, caller] of callers.entries()) {
+      const status = await post(`/api/tasks/${task.id}/progress`, caller, {
+        progress: `step ${i}`,
+      });
+      expect(status, JSON.stringify(caller)).toBe(200);
+      expect((await getTaskById(task.id))?.progress).toBe(`step ${i}`);
+    }
+  });
+});
+
+describe("POST /api/tasks/{id}/cancel ownership", () => {
+  test("an agent that is neither lead nor creator gets 403 and the task keeps running", async () => {
+    const task = await inProgressTask();
+    const status = await post(
+      `/api/tasks/${task.id}/cancel`,
+      { as: "operator", agentId: otherId },
+      { reason: "not mine" },
+    );
+    expect(status).toBe(403);
+    expect((await getTaskById(task.id))?.status).toBe("in_progress");
+  });
+
+  test("the assignee alone cannot cancel, matching MCP cancel-task", async () => {
+    const task = await inProgressTask();
+    const status = await post(
+      `/api/tasks/${task.id}/cancel`,
+      { as: "operator", agentId: ownerId },
+      {},
+    );
+    expect(status).toBe(403);
+    expect((await getTaskById(task.id))?.status).toBe("in_progress");
+  });
+
+  test("the creator, a lead, the operator, and a user may cancel", async () => {
+    const callers: Caller[] = [
+      { as: "operator", agentId: creatorId },
+      { as: "session", agentId: leadId },
+      { as: "operator" },
+      { as: "user" },
+    ];
+    for (const caller of callers) {
+      const task = await inProgressTask();
+      const status = await post(`/api/tasks/${task.id}/cancel`, caller, { reason: "stop" });
+      expect(status, JSON.stringify(caller)).toBe(200);
+      expect((await getTaskById(task.id))?.status).toBe("cancelled");
+    }
+  });
+});