@desplega.ai/agent-swarm 1.160.0 → 1.161.0

package/src/tests/claude-default-route.test.ts

@@ -0,0 +1,260 @@
+/**
+ * Issue #1800: a claude worker on a LiteLLM gateway, Microsoft Foundry,
+ * Bedrock, or Vertex passes the credential gate with no Anthropic credential,
+ * and its gateway key never reaches api.anthropic.com.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  buildCredStatusReport,
+  checkProviderCredentials,
+  validateProviderCredentials,
+} from "../commands/provider-credentials";
+import {
+  buildClaudeSessionEnvironment,
+  checkClaudeCredentials,
+  resolveClaudeBinaryArgv,
+  withClaudeRouteEnv,
+} from "../providers/claude-adapter";
+import type { ProviderSessionConfig } from "../providers/types";
+import { resolveCredentialPools, validateClaudeCredentials } from "../utils/credentials";
+import { resolveCredential } from "../utils/internal-ai/credentials";
+
+const GATEWAY_URL = "http://litellm.internal:4000";
+const UNTRUSTED_URL = { ANTHROPIC_BASE_URL: "https://untrusted.example" };
+const LITELLM_BEARER = { ANTHROPIC_BASE_URL: GATEWAY_URL, ANTHROPIC_AUTH_TOKEN: "sk-litellm" };
+const LITELLM_API_KEY = { ANTHROPIC_BASE_URL: GATEWAY_URL, ANTHROPIC_API_KEY: "sk-litellm" };
+const FOUNDRY = {
+  CLAUDE_CODE_USE_FOUNDRY: "1",
+  ANTHROPIC_FOUNDRY_RESOURCE: "my-foundry",
+  ANTHROPIC_FOUNDRY_API_KEY: "az-key",
+};
+const BEDROCK = { CLAUDE_CODE_USE_BEDROCK: "1", AWS_REGION: "us-east-1" };
+const VERTEX = {
+  CLAUDE_CODE_USE_VERTEX: "1",
+  CLOUD_ML_REGION: "us-east5",
+  ANTHROPIC_VERTEX_PROJECT_ID: "proj",
+};
+const OAUTH = { CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-example" };
+
+/** Records every request, whichever fetch the code under test reaches for. */
+let requests: string[] = [];
+let realFetch: typeof fetch;
+const recordingFetch = (async (url: string | URL | Request) => {
+  requests.push(String(url instanceof Request ? url.url : url));
+  return new Response(JSON.stringify({ data: [] }), { status: 200 });
+}) as typeof fetch;
+
+beforeEach(() => {
+  requests = [];
+  realFetch = globalThis.fetch;
+  globalThis.fetch = recordingFetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+const anthropicRequests = () => requests.filter((url) => url.includes("api.anthropic.com"));
+
+describe("claude credential gate", () => {
+  for (const [name, env] of Object.entries({
+    "LiteLLM bearer": LITELLM_BEARER,
+    "LiteLLM api key": LITELLM_API_KEY,
+    Foundry: FOUNDRY,
+    Bedrock: BEDROCK,
+    Vertex: VERTEX,
+  })) {
+    test(`${name} reports ready without an Anthropic credential`, async () => {
+      expect(checkClaudeCredentials(env)).toMatchObject({ ready: true, missing: [] });
+      expect((await checkProviderCredentials("claude", env)).ready).toBe(true);
+    });
+  }
+
+  test("no route lists the first-party credentials and mentions the alternatives", () => {
+    const status = checkClaudeCredentials({});
+    expect(status.ready).toBe(false);
+    expect(status.missing).toEqual(["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]);
+    expect(status.hint).toContain("ANTHROPIC_AUTH_TOKEN");
+    expect(status.hint).toContain("CLAUDE_CODE_USE_FOUNDRY");
+  });
+
+  test("an incomplete Foundry route names its missing resource", () => {
+    expect(checkClaudeCredentials({ CLAUDE_CODE_USE_FOUNDRY: "1", ...OAUTH })).toMatchObject({
+      ready: false,
+      missing: ["ANTHROPIC_FOUNDRY_RESOURCE"],
+    });
+  });
+});
+
+describe("claude live check", () => {
+  test("gateway keys are checked against the gateway, never api.anthropic.com", async () => {
+    for (const env of [LITELLM_BEARER, LITELLM_API_KEY, { ...LITELLM_API_KEY, ...OAUTH }]) {
+      const result = await validateProviderCredentials("claude", env);
+      expect(result.ok).toBe(true);
+    }
+    expect(requests).toEqual([
+      `${GATEWAY_URL}/v1/models`,
+      `${GATEWAY_URL}/v1/models`,
+      `${GATEWAY_URL}/v1/models`,
+    ]);
+    expect(anthropicRequests()).toEqual([]);
+  });
+
+  test("Foundry makes no request and is reported as configured, not verified", async () => {
+    const result = await validateProviderCredentials("claude", FOUNDRY);
+    expect(result).toMatchObject({ ok: true, skipped: true });
+    const report = await buildCredStatusReport("claude", FOUNDRY, {}, "boot");
+    expect(report.ready).toBe(true);
+    expect(report.liveTest).toBeNull();
+    expect(requests).toEqual([]);
+  });
+
+  test("a rejected gateway key fails the live test", async () => {
+    const reject = (async () =>
+      new Response("bad key", { status: 401 })) as unknown as typeof fetch;
+    globalThis.fetch = reject;
+    const result = await validateProviderCredentials("claude", LITELLM_BEARER);
+    expect(result.ok).toBe(false);
+    expect(result.error).toContain("HTTP 401");
+  });
+
+  test("buildCredStatusReport checks the env it was given, not only process.env", async () => {
+    const report = await buildCredStatusReport("claude", LITELLM_BEARER, {}, "post_task");
+    expect(report.liveTest?.ok).toBe(true);
+    expect(requests).toEqual([`${GATEWAY_URL}/v1/models`]);
+  });
+
+  test("an Anthropic API key without a gateway still checks api.anthropic.com", async () => {
+    await validateProviderCredentials("claude", { ANTHROPIC_API_KEY: "sk-ant" });
+    expect(requests).toEqual(["https://api.anthropic.com/v1/models"]);
+  });
+});
+
+describe("claude spawn env", () => {
+  const config = (env: Record<string, string>) =>
+    ({
+      taskId: crypto.randomUUID(),
+      agentId: crypto.randomUUID(),
+      env,
+      apiUrl: "http://fixture.invalid",
+      apiKey: "example-fixture-swarm-key",
+    }) as ProviderSessionConfig;
+  const spawnEnv = (env: Record<string, string>) =>
+    buildClaudeSessionEnvironment(config(env), "sonnet", "/tmp/fixture-task").env;
+  /** The spawned env carries the token under no key, and OAuth is explicitly blank. */
+  const expectNoSubscriptionToken = (env: Record<string, string>, token: string) => {
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe("");
+    expect(Object.values(env).filter((value) => value?.includes(token))).toEqual([]);
+  };
+
+  test("a gateway route blanks the OAuth token so it cannot reach the gateway", () => {
+    const { env } = buildClaudeSessionEnvironment(
+      config({ ...LITELLM_BEARER, ...OAUTH }),
+      "sonnet",
+      "/tmp/fixture-task",
+    );
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe("");
+    expect(env.ANTHROPIC_AUTH_TOKEN).toBe("sk-litellm");
+    expect(env.ANTHROPIC_BASE_URL).toBe(GATEWAY_URL);
+  });
+
+  test("cloud routes blank the OAuth token too", () => {
+    for (const route of [FOUNDRY, BEDROCK, VERTEX]) {
+      expect(withClaudeRouteEnv({ ...route, ...OAUTH }).CLAUDE_CODE_OAUTH_TOKEN).toBe("");
+    }
+  });
+
+  test("the subscription route keeps the OAuth token", () => {
+    const { env } = buildClaudeSessionEnvironment(config(OAUTH), "sonnet", "/tmp/fixture-task");
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe(OAUTH.CLAUDE_CODE_OAUTH_TOKEN);
+  });
+
+  test("arbitrary URL + OAuth + no gateway key parks and spawns without the token", async () => {
+    const env = { ...UNTRUSTED_URL, ...OAUTH };
+    expect(checkClaudeCredentials(env)).toMatchObject({
+      ready: false,
+      missing: ["ANTHROPIC_AUTH_TOKEN"],
+    });
+    expect(() => validateClaudeCredentials(env)).toThrow("ANTHROPIC_AUTH_TOKEN");
+    expect((await validateProviderCredentials("claude", env)).ok).toBe(false);
+    expect((await buildCredStatusReport("claude", env, {}, "boot")).liveTest).toBeNull();
+    expect(requests).toEqual([]);
+    expectNoSubscriptionToken(spawnEnv(env), OAUTH.CLAUDE_CODE_OAUTH_TOKEN);
+  });
+
+  test("an OAuth token picked from the pool never reaches a keyless gateway", async () => {
+    const env: Record<string, string> = {
+      ...UNTRUSTED_URL,
+      CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-pool-a,sk-ant-oat01-pool-b",
+    };
+    await resolveCredentialPools(env, { provider: "claude" });
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toMatch(/^sk-ant-oat01-pool-[ab]$/);
+    expect(checkClaudeCredentials(env).ready).toBe(false);
+    expectNoSubscriptionToken(spawnEnv(env), "sk-ant-oat01-pool");
+  });
+
+  test("an OAuth token inherited from process.env is blanked, not revived", () => {
+    const previous = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = OAUTH.CLAUDE_CODE_OAUTH_TOKEN;
+    try {
+      const env = withClaudeRouteEnv({ ...UNTRUSTED_URL, SWARM_USE_CLAUDE_BRIDGE: "true" });
+      expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe("");
+      expect(resolveClaudeBinaryArgv(env).useClaudeBridge).toBe(false);
+      expectNoSubscriptionToken(
+        spawnEnv({ ...UNTRUSTED_URL, SWARM_USE_CLAUDE_BRIDGE: "true" }),
+        OAUTH.CLAUDE_CODE_OAUTH_TOKEN,
+      );
+    } finally {
+      if (previous === undefined) delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      else process.env.CLAUDE_CODE_OAUTH_TOKEN = previous;
+    }
+  });
+
+  test("a gateway key cleared after being set does not fall back to OAuth", () => {
+    const env: Record<string, string> = { ...UNTRUSTED_URL, ...OAUTH, ANTHROPIC_AUTH_TOKEN: "k" };
+    expect(checkClaudeCredentials(env).ready).toBe(true);
+    expectNoSubscriptionToken(spawnEnv(env), OAUTH.CLAUDE_CODE_OAUTH_TOKEN);
+
+    for (const cleared of [
+      { ...env, ANTHROPIC_AUTH_TOKEN: "" },
+      Object.fromEntries(Object.entries(env).filter(([key]) => key !== "ANTHROPIC_AUTH_TOKEN")),
+    ]) {
+      expect(checkClaudeCredentials(cleared)).toMatchObject({
+        ready: false,
+        missing: ["ANTHROPIC_AUTH_TOKEN"],
+      });
+      expectNoSubscriptionToken(spawnEnv(cleared), OAUTH.CLAUDE_CODE_OAUTH_TOKEN);
+    }
+  });
+
+  test("claude-bridge stays off on a gateway route even when process.env has OAuth", () => {
+    const env = withClaudeRouteEnv({
+      ...LITELLM_BEARER,
+      ...OAUTH,
+      SWARM_USE_CLAUDE_BRIDGE: "true",
+    });
+    const argv = resolveClaudeBinaryArgv(env, { ...OAUTH });
+    expect(argv.useClaudeBridge).toBe(false);
+  });
+});
+
+describe("internal-ai credential", () => {
+  const opts = (env: NodeJS.ProcessEnv) => ({
+    env,
+    _getEnvApiKey: () => undefined,
+    _getValidCodexOAuth: async () => null,
+    _getOAuthApiKey: async () => null,
+    _persistCodexOAuth: async () => undefined,
+  });
+
+  test("a gateway's ANTHROPIC_API_KEY is not used for api.anthropic.com calls", async () => {
+    expect(await resolveCredential(opts(LITELLM_API_KEY))).toBeNull();
+  });
+
+  test("an ANTHROPIC_API_KEY with a first-party base URL is still used", async () => {
+    const cred = await resolveCredential(
+      opts({ ANTHROPIC_BASE_URL: "https://api.anthropic.com", ANTHROPIC_API_KEY: "sk-ant" }),
+    );
+    expect(cred?.kind).toBe("anthropic");
+  });
+});

package/src/tests/claude-managed-adapter.test.ts

@@ -244,6 +244,53 @@ describe("ClaudeManagedAdapter (Phase 3) — session lifecycle", () => {
     expect(a[1]?.text).not.toBe(b[1]?.text);
   });
 
+  test("agent.message with a redacted block keeps a visible placeholder instead of dropping it", async () => {
+    const events: Array<Record<string, unknown>> = [
+      {
+        type: "agent.message",
+        id: "evt1",
+        processed_at: "2026-01-01T00:00:01Z",
+        content: [
+          { type: "text", text: "before " },
+          { type: "redacted" },
+          { type: "text", text: " after" },
+        ],
+      },
+      {
+        type: "agent.message",
+        id: "evt2",
+        processed_at: "2026-01-01T00:00:02Z",
+        content: [{ type: "redacted" }],
+      },
+      {
+        type: "session.status_idle",
+        id: "evt3",
+        processed_at: "2026-01-01T00:00:03Z",
+        stop_reason: { type: "end_turn" },
+      },
+    ];
+    const spy = makeFakeClient({
+      streamEvents: async function* () {
+        for (const e of events) yield e;
+      },
+    });
+    const adapter = new ClaudeManagedAdapter({ client: spy.client });
+    const session = await adapter.createSession(
+      tConfig({ logFile: join(tmpLogDir, "redacted.log") }),
+    );
+    const emitted: ProviderEvent[] = [];
+    session.onEvent((e) => emitted.push(e));
+    await session.waitForCompletion();
+
+    const messages = emitted.flatMap((e) =>
+      e.type === "message" && e.role === "assistant" ? [e.content] : [],
+    );
+    expect(messages).toEqual([
+      "before [content redacted by Anthropic model policy] after",
+      "[content redacted by Anthropic model policy]",
+    ]);
+  });
+
   test("happy path: agent.message → message ProviderEvent, span.model_request_end → cost + context_usage, status_idle → result", async () => {
     const events: Array<Record<string, unknown>> = [
       { type: "session.status_running", id: "evt1", processed_at: "2026-01-01T00:00:00Z" },

package/src/tests/claude-managed-setup.test.ts

@@ -193,6 +193,54 @@ describe("runClaudeManagedSetupFlow — happy path", () => {
   });
 });
 
+describe("runClaudeManagedSetupFlow — skill dedupe by display_name", () => {
+  function skill(id: string, displayName: string, updatedAt: string) {
+    return {
+      id,
+      display_name: displayName,
+      updated_at: updatedAt,
+      created_at: updatedAt,
+      latest_version_id: `skver_${id}`,
+      source: { type: "custom" },
+      type: "skill",
+    };
+  }
+
+  test("reuses existing skills by display_name and creates only the missing ones", async () => {
+    const skillsList = mock(async function* () {
+      yield skill("skill_old_worker", "start-worker", "2026-09-01T00:00:00Z");
+      // display_name is not unique: the newest duplicate wins.
+      yield skill("skill_new_worker", "start-worker", "2026-09-20T00:00:00Z");
+      yield skill("skill_stale_worker", "start-worker", "2026-08-01T00:00:00Z");
+    });
+    const skillsCreate = mock(async (params: { display_name?: string }) => ({
+      id: `skill_created_${params.display_name}`,
+    }));
+    const { client } = makeMockClient();
+    client.beta.skills = { create: skillsCreate, list: skillsList } as never;
+
+    const result = await runClaudeManagedSetupFlow(baseConfig, {
+      client: client as any,
+      fetchConfig: mock(async () => null),
+      upsert: mock(async () => undefined),
+      loadSkills: mock(async () => fakeSkillFiles),
+      loadSeededSkills: mock(async () => []),
+      log: mock(() => undefined),
+    });
+
+    expect(result.skillIds).toEqual(["skill_new_worker", "skill_created_create-pr"]);
+    expect(skillsList).toHaveBeenCalledTimes(1);
+    // GA shape only: sending the old beta header would make the API answer
+    // with `display_title`, and the name index would silently be empty.
+    expect(skillsList.mock.calls[0]).toEqual([{ source: "custom" }]);
+    expect(skillsCreate).toHaveBeenCalledTimes(1);
+    const createArgs = skillsCreate.mock.calls[0]?.[0] as Record<string, unknown>;
+    expect(createArgs.display_name).toBe("create-pr");
+    expect(createArgs).not.toHaveProperty("display_title");
+    expect(createArgs).not.toHaveProperty("betas");
+  });
+});
+
 describe("runClaudeManagedSetupFlow — idempotent re-run", () => {
   test("short-circuits with already-configured when managed_agent_id exists in swarm_config", async () => {
     const { client, environmentsCreate, agentsCreate } = makeMockClient();

package/src/tests/claude-prompt-body-once.test.ts

@@ -0,0 +1,117 @@
+/**
+ * The claude harness must deliver the task body once in a task's first
+ * message. Claude Code's native `/<skill> <args>` expansion puts the args in
+ * `<command-args>` and again after `ARGUMENTS:`, so the adapter inlines the
+ * runner's skill command instead (`resolveClaudePrompt`).
+ */
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { cpSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildPromptForTrigger, buildResumePrompt } from "../commands/runner";
+import { ClaudeAdapter, resolveClaudePrompt } from "../providers/claude-adapter";
+
+const BODY_MARKER = "BODY-MARKER-4c1e";
+const TASK_ID = "00000000-0000-4000-8000-000000000001";
+const BODY = `${BODY_MARKER} Fix the flaky export.\n\nMulti-line body with "quotes" and $ARGUMENTS text.`;
+
+let home: string;
+const fmt = (cmd: string) => new ClaudeAdapter().formatCommand(cmd);
+
+function countOccurrences(haystack: string, needle: string): number {
+  return haystack.split(needle).length - 1;
+}
+
+beforeAll(() => {
+  home = join(tmpdir(), `claude-prompt-body-once-${crypto.randomUUID()}`);
+  for (const skill of ["work-on-task", "review-offered-task"]) {
+    const dir = join(home, ".claude", "skills", skill);
+    mkdirSync(dir, { recursive: true });
+    cpSync(
+      join(import.meta.dir, "../../templates/skills", skill, "SKILL.md"),
+      join(dir, "SKILL.md"),
+    );
+  }
+});
+
+afterAll(() => {
+  rmSync(home, { recursive: true, force: true });
+});
+
+beforeEach(async () => {
+  // Other test files clear the template registry; re-register the defaults.
+  await import(`../commands/templates?t=${Date.now()}`);
+});
+
+describe("claude first-message prompt", () => {
+  const cases: Array<{ name: string; skill: string; build: () => Promise<string> }> = [
+    {
+      name: "task_assigned (new tasks, follow-ups, heartbeat checklist)",
+      skill: "work-on-task",
+      build: () =>
+        buildPromptForTrigger(
+          { type: "task_assigned", taskId: TASK_ID, task: { id: TASK_ID, task: BODY } },
+          "",
+          fmt,
+        ),
+    },
+    {
+      name: "task_offered",
+      skill: "review-offered-task",
+      build: () =>
+        buildPromptForTrigger(
+          { type: "task_offered", taskId: TASK_ID, task: { id: TASK_ID, task: BODY } },
+          "",
+          fmt,
+        ),
+    },
+    {
+      name: "resumed task with progress",
+      skill: "work-on-task",
+      build: () => buildResumePrompt({ id: TASK_ID, task: BODY, progress: "Read the file" }, fmt),
+    },
+    {
+      name: "resumed task without progress",
+      skill: "work-on-task",
+      build: () => buildResumePrompt({ id: TASK_ID, task: BODY }, fmt),
+    },
+  ];
+
+  for (const { name, skill, build } of cases) {
+    test(`${name}: skill inlined, body sent once`, async () => {
+      const runnerPrompt = await build();
+      // The runner still emits a slash command carrying the body as its args.
+      expect(runnerPrompt.startsWith(`/${skill} ${TASK_ID}`)).toBe(true);
+
+      const prompt = await resolveClaudePrompt(runnerPrompt, home);
+
+      // No leading slash, so Claude Code does not re-expand (and duplicate) it.
+      expect(prompt.startsWith("/")).toBe(false);
+      // No leading dash either: `claude -p <prompt>` would parse it as an option.
+      expect(prompt.startsWith("-")).toBe(false);
+      expect(prompt.startsWith("# ")).toBe(true);
+      expect(prompt).not.toContain(`name: ${skill}`);
+      expect(prompt).toContain(`User request: ${TASK_ID}`);
+      expect(prompt).toContain(TASK_ID);
+      expect(countOccurrences(prompt, BODY_MARKER)).toBe(1);
+    });
+  }
+
+  test("commands without a SKILL.md pass through for native expansion", async () => {
+    const runnerPrompt = `/desplega:research ${TASK_ID}\n\n${BODY}`;
+    expect(await resolveClaudePrompt(runnerPrompt, home)).toBe(runnerPrompt);
+  });
+
+  test("a skill that would start the prompt with a dash keeps the native form", async () => {
+    const dir = join(home, ".claude", "skills", "dash-skill");
+    mkdirSync(dir, { recursive: true });
+    await Bun.write(join(dir, "SKILL.md"), "--flag-looking first line\n");
+    const runnerPrompt = `/dash-skill ${TASK_ID}\n\n${BODY}`;
+    expect(await resolveClaudePrompt(runnerPrompt, home)).toBe(runnerPrompt);
+  });
+
+  test("prompts without a slash command are unchanged", async () => {
+    expect(await resolveClaudePrompt(BODY, home)).toBe(BODY);
+  });
+});