@desplega.ai/agent-swarm 1.162.0 → 1.164.0

package/src/tests/memory-store.test.ts

@@ -51,6 +51,172 @@ describe("SqliteMemoryStore", () => {
     }
   });
 
+  test("deleting either keyed chunk removes the document before a shorter replacement", async () => {
+    for (const deletedIndex of [0, 1]) {
+      const key = `/test/delete-chunks/${deletedIndex}`;
+      const inputs = [0, 1].map((chunkIndex) => ({
+        agentId: agentA,
+        scope: "agent" as const,
+        source: "manual" as const,
+        name: "old document",
+        content: `chunk ${chunkIndex}`,
+        key,
+        chunkIndex,
+        totalChunks: 2,
+      }));
+      const chunks = await store.storeBatch(inputs);
+      const otherOwner = await store.store({ ...inputs[0]!, agentId: agentB });
+      const otherScope = await store.store({ ...inputs[0]!, scope: "swarm" });
+      await store.whenFtsPopulated();
+      for (const chunk of chunks) await store.updateEmbedding(chunk.id, vector({ 0: 1 }), "test");
+      expect(await store.delete(chunks[deletedIndex]!.id)).toBe(true);
+      for (const chunk of chunks) {
+        expect(await store.peek(chunk.id)).toBeNull();
+        expect(
+          await getDbClient().get("SELECT memory_id FROM memory_fts WHERE memory_id = ?", [
+            chunk.id,
+          ]),
+        ).toBeNull();
+        if (isSqliteVecAvailable()) {
+          expect(
+            await getDbClient().get("SELECT memory_id FROM memory_vec WHERE memory_id = ?", [
+              chunk.id,
+            ]),
+          ).toBeNull();
+        }
+      }
+      expect(await store.peek(otherOwner.id)).not.toBeNull();
+      expect(await store.peek(otherScope.id)).not.toBeNull();
+      await store.store({ ...inputs[0]!, name: "replacement", totalChunks: 1 });
+      const rows = await getDbClient().query<{ chunkIndex: number }>(
+        "SELECT chunkIndex FROM agent_memory WHERE key = ? AND scope = 'agent' AND agentId = ?",
+        [key, agentA],
+      );
+      expect(rows).toEqual([{ chunkIndex: 0 }]);
+      expect(await store.delete(chunks[deletedIndex]!.id)).toBe(false);
+    }
+  });
+
+  test("deletion groups unowned swarm chunks without touching another owner", async () => {
+    const input = {
+      agentId: null,
+      scope: "swarm" as const,
+      source: "manual" as const,
+      name: "unowned",
+      content: "chunk",
+      key: "/test/delete-unowned",
+    };
+    const chunks = await store.storeBatch(
+      [0, 1].map((chunkIndex) => ({
+        ...input,
+        chunkIndex,
+        totalChunks: 2,
+      })),
+    );
+    const owned = await store.store({ ...input, agentId: agentA });
+    expect(await store.delete(chunks[1]!.id)).toBe(true);
+    for (const chunk of chunks) expect(await store.peek(chunk.id)).toBeNull();
+    expect(await store.peek(owned.id)).not.toBeNull();
+  });
+
+  test("source-path rewrite removes old chunks and duplicate-key writes roll back", async () => {
+    const key = "/test/rewrite-chunks";
+    const input = {
+      agentId: agentA,
+      scope: "agent" as const,
+      source: "manual" as const,
+      name: "rewrite",
+      content: "old",
+      key,
+      sourcePath: key,
+    };
+    const chunks = await store.storeBatch(
+      [0, 1].map((chunkIndex) => ({
+        ...input,
+        chunkIndex,
+        totalChunks: 2,
+      })),
+    );
+    await expect(store.storeBatch([{ ...input, content: "new" }])).rejects.toThrow();
+    for (const chunk of chunks) expect(await store.peek(chunk.id)).not.toBeNull();
+    expect(await store.deleteBySourcePath(key, agentA)).toBe(2);
+    const replacement = await store.storeBatch([{ ...input, content: "new" }]);
+    expect(replacement).toHaveLength(1);
+    for (const chunk of chunks) expect(await store.peek(chunk.id)).toBeNull();
+  });
+
+  test("orphan migration preserves valid and legacy chunks and is idempotent", async () => {
+    const input = {
+      agentId: agentA,
+      scope: "agent" as const,
+      source: "manual" as const,
+      name: "migration",
+      content: "chunk",
+    };
+    const valid = await store.storeBatch(
+      [0, 1].map((chunkIndex) => ({
+        ...input,
+        key: "/test/migration-valid",
+        chunkIndex,
+        totalChunks: 2,
+      })),
+    );
+    const head = await store.store({ ...input, key: "/test/migration-short" });
+    const tail = await store.store({ ...input, key: head.key, chunkIndex: 1, totalChunks: 2 });
+    const missingHead = await store.store({
+      ...input,
+      key: "/test/migration-missing",
+      chunkIndex: 1,
+      totalChunks: 2,
+    });
+    const legacy = await store.store({ ...input, chunkIndex: 1, totalChunks: 2 });
+    const nullOwnerHead = await store.store({
+      ...input,
+      agentId: null,
+      scope: "swarm",
+      key: "/test/migration-null-owner",
+      totalChunks: 2,
+    });
+    const nullOwnerTail = await store.store({
+      ...input,
+      agentId: null,
+      scope: "swarm",
+      key: nullOwnerHead.key,
+      chunkIndex: 1,
+      totalChunks: 2,
+    });
+    const isolatedOwner = await store.store({
+      ...input,
+      agentId: agentB,
+      key: valid[0]!.key,
+      chunkIndex: 1,
+      totalChunks: 2,
+    });
+    const isolatedScope = await store.store({
+      ...input,
+      scope: "swarm",
+      key: valid[0]!.key,
+      chunkIndex: 1,
+      totalChunks: 2,
+    });
+    const sql = await Bun.file(
+      new URL("../be/migrations/194_memory_orphan_chunks.sql", import.meta.url),
+    ).text();
+    await getDbClient().run(sql);
+    for (const row of [tail, missingHead, isolatedOwner, isolatedScope]) {
+      expect(await store.peek(row.id)).toBeNull();
+      expect(
+        await getDbClient().get("SELECT id FROM agent_memory_version WHERE memory_id = ?", [
+          row.id,
+        ]),
+      ).toBeNull();
+    }
+    for (const row of [...valid, head, legacy, nullOwnerHead, nullOwnerTail]) {
+      expect(await store.peek(row.id)).not.toBeNull();
+    }
+    expect((await getDbClient().run(sql)).changes).toBe(0);
+  });
+
   describe("store()", () => {
     test("creates memory with correct fields", async () => {
       const memory = await store.store({

package/src/tests/model-tier-resolution.test.ts

@@ -508,8 +508,8 @@ describe("previewModelTiers", () => {
 
     // acp has no portable tier mapping, so it has nothing to preview.
     expect(rows.some((r) => r.provider === "acp")).toBe(false);
-    expect(new Set(rows.map((r) => r.provider)).size).toBe(7);
-    expect(rows).toHaveLength(28);
+    expect(new Set(rows.map((r) => r.provider)).size).toBe(9);
+    expect(rows).toHaveLength(36);
   });
 
   test("an alias that resolves to nothing reports the default it falls back to", async () => {
@@ -564,7 +564,7 @@ describe("GET /api/models-catalog/tiers", () => {
     expect(handled).toBe(true);
     expect(status).toBe(200);
     const body = JSON.parse(bodyStr) as { tiers: { provider: string; tier: string }[] };
-    expect(body.tiers).toHaveLength(28);
+    expect(body.tiers).toHaveLength(36);
     expect(body.tiers.find((t) => t.provider === "claude" && t.tier === "smart")).toMatchObject({
       key: "MODEL_TIER_CLAUDE_SMART",
       source: "tier-config",

package/src/tests/pricing-refresh.test.ts

@@ -101,13 +101,14 @@ describe("models.dev runtime pricing refresh", () => {
        VALUES ('codex', 'gpt-refresh-test', 'input', 0, 1, 0, 0)`,
     );
 
+    // codex, pi, cursor and amp each project the OpenAI rows: 4 providers x 2 token classes.
     const first = await refreshPricingFromModelsDev({
       now: 1_000,
       fetchImpl: async () => responseFor(openAiCache(2, 8), '"etag-1"'),
     });
     expect(first.status).toBe("refreshed");
-    expect(first.candidateRows).toBe(4);
-    expect(first.inserted).toBe(4);
+    expect(first.candidateRows).toBe(8);
+    expect(first.inserted).toBe(8);
     expect(first.unchanged).toBe(0);
 
     const activeChanged = await getActivePricingRow("codex", "gpt-refresh-test", "input", 1_000);
@@ -119,7 +120,7 @@ describe("models.dev runtime pricing refresh", () => {
       fetchImpl: async () => responseFor(openAiCache(2, 8), '"etag-2"'),
     });
     expect(second.inserted).toBe(0);
-    expect(second.unchanged).toBe(4);
+    expect(second.unchanged).toBe(8);
 
     const rows = await getDbClient().query<{ effective_from: number }>(
       `SELECT effective_from FROM pricing
@@ -208,7 +209,7 @@ describe("models.dev runtime pricing refresh", () => {
 
     const logs = await getLogsByEventType("pricing.refresh");
     expect(logs).toHaveLength(1);
-    expect(logs[0]?.newValue).toContain("inserted=4");
+    expect(logs[0]?.newValue).toContain("inserted=8");
     expect(logs[0]?.metadata).toContain('"etag":"\\"etag-log\\""');
   });
 });

package/src/tests/prompt-template-session.test.ts

@@ -21,6 +21,7 @@ const EM_DASH = "\u2014";
 const SYSTEM_TEMPLATES = [
   "system.agent.communication",
   "system.agent.communication.remote",
+  "system.agent.cursor.first_message",
   "system.agent.lead",
   "system.agent.memory",
   "system.agent.memory.remote",
@@ -36,6 +37,7 @@ const SYSTEM_TEMPLATES = [
   "system.agent.steering.delivery",
   "system.agent.tool_preload",
   "system.agent.tool_discovery.search",
+  "system.agent.tool_discovery.amp",
   "system.agent.tool_discovery.direct",
   "system.agent.tools_skills",
   "system.agent.worker",
@@ -114,11 +116,11 @@ describe("Session templates: registration", () => {
     expect(sessionSystemEventTypes("session")).toEqual([...SESSION_TEMPLATES].sort());
   });
 
-  test("registers 28 system and session templates in total", () => {
+  test("registers 30 system and session templates in total", () => {
     const all = getAllTemplateDefinitions();
     const sessionSystem = all.filter((d) => d.category === "system" || d.category === "session");
-    // 23 system blocks + 5 session composites.
-    expect(sessionSystem.length).toBe(28);
+    // 25 system blocks + 5 session composites.
+    expect(sessionSystem.length).toBe(30);
   });
 
   test("drops the v1 blocks that prompt v2 deleted", () => {

package/src/tests/provider-process-group.test.ts

@@ -4,6 +4,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ClaudeAdapter } from "../providers/claude-adapter";
 import type { ProviderSession, ProviderSessionConfig } from "../providers/types";
+import {
+  detachedProcessGroup,
+  listDescendantPids,
+  terminateProcessTree,
+} from "../utils/process-group";
 import { CHILD_PROCESS_TEST_BUDGET_MS } from "./test-proc";
 
 function processExists(pid: number): boolean {
@@ -193,4 +198,40 @@ describe("provider process groups", () => {
     },
     CHILD_PROCESS_TEST_BUDGET_MS,
   );
+
+  test.skipIf(process.platform !== "linux")(
+    "terminateProcessTree also kills a descendant that left the process group",
+    async () => {
+      // `setsid` gives the sleep its own session, as Amp's shell tool does, so a
+      // group kill cannot reach it.
+      const proc = Bun.spawn(["sh", "-c", "setsid sleep 120 & wait"], {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+        detached: detachedProcessGroup,
+      });
+      let descendants: number[] = [];
+      try {
+        for (let i = 0; i < 100 && descendants.length === 0; i++) {
+          descendants = await listDescendantPids(proc.pid);
+          if (descendants.length === 0) await Bun.sleep(30);
+        }
+        expect(descendants.length).toBeGreaterThan(0);
+        expect(descendants).not.toContain(proc.pid);
+        await terminateProcessTree(proc.pid);
+        for (const pid of descendants) {
+          expect(await waitForProcessGone(pid, PROCESS_GONE_TIMEOUT_MS)).toBe(true);
+        }
+      } finally {
+        for (const pid of descendants) {
+          try {
+            process.kill(pid, "SIGKILL");
+          } catch {
+            // Already gone.
+          }
+        }
+      }
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
 });

package/src/tests/provider-registration.test.ts

@@ -231,6 +231,8 @@ if (isolatedBootstrapBlock === bootstrapBlock) {
 const BOOTSTRAP: Record<ProviderName, { expect: string } | { exempt: string }> = {
   claude: { expect: "Warning: claude provider has no credentials yet" },
   dsh: { expect: "Warning: dsh provider has no credentials yet" },
+  amp: { expect: "Warning: amp provider has no credentials yet" },
+  cursor: { expect: "Warning: cursor provider has no credentials yet" },
   pi: { expect: "Warning: pi provider has no credentials yet" },
   opencode: { expect: "Warning: opencode provider has no credentials yet" },
   "claude-managed": { expect: "Warning: claude-managed provider missing:" },
@@ -280,7 +282,7 @@ function extractMarkedBlock(name: string): string {
 /** Resolvable no-op stubs for every binary the verify chain may look up. */
 function makeBinaryStubDir(): string {
   const dir = mkdtempSync(join(tmpdir(), "provider-registration-bin-"));
-  for (const name of ["claude", "codex", "opencode", "dsh"]) {
+  for (const name of ["claude", "codex", "opencode", "dsh", "amp"]) {
     const file = join(dir, name);
     writeFileSync(file, "#!/bin/sh\nexit 0\n");
     chmodSync(file, 0o755);

package/src/tests/rbac-charact-misc-tools.test.ts

@@ -281,7 +281,7 @@ describe("context-history / context-diff gates (characterization)", () => {
 });
 
 describe("memory-delete gate (characterization)", () => {
-  // memory-delete.ts:54,56 — owner OR (lead AND scope=swarm)
+  // memory.delete.any for agents: owner of an agent-scoped memory, or lead for own/swarm-scoped
   test("worker cannot delete another agent's memory", async () => {
     const memory = await getMemoryStore().store({
       agentId: LEAD_ID,
@@ -295,7 +295,7 @@ describe("memory-delete gate (characterization)", () => {
 
     expect(result.structuredContent.success).toBe(false);
     expect(result.structuredContent.message).toBe(
-      "Permission denied. You can only delete your own memories, or swarm memories if you are the lead.",
+      "Permission denied. You can only delete your own agent-scoped memories; only the lead can delete swarm memories.",
     );
     // DB not mutated
     expect(await getMemoryStore().peek(memory.id)).not.toBeNull();
@@ -316,6 +316,21 @@ describe("memory-delete gate (characterization)", () => {
     expect(await getMemoryStore().peek(memory.id)).toBeNull();
   });
 
+  test("owner worker cannot delete its own swarm-scoped memory", async () => {
+    const memory = await getMemoryStore().store({
+      agentId: WORKER_ID,
+      scope: "swarm",
+      name: "charact worker swarm memory",
+      content: "shared by worker",
+      source: "manual",
+    });
+
+    const result = await callTool("memory-delete", WORKER_ID, { memoryId: memory.id });
+
+    expect(result.structuredContent.success).toBe(false);
+    expect(await getMemoryStore().peek(memory.id)).not.toBeNull();
+  });
+
   test("lead can delete another agent's swarm-scoped memory", async () => {
     const memory = await getMemoryStore().store({
       agentId: WORKER_ID,
@@ -345,7 +360,7 @@ describe("memory-delete gate (characterization)", () => {
 
     expect(result.structuredContent.success).toBe(false);
     expect(result.structuredContent.message).toBe(
-      "Permission denied. You can only delete your own memories, or swarm memories if you are the lead.",
+      "Permission denied. You can only delete your own agent-scoped memories; only the lead can delete swarm memories.",
     );
     expect(await getMemoryStore().peek(memory.id)).not.toBeNull();
   });

package/src/tests/rbac-engine.test.ts

@@ -84,11 +84,15 @@ const LEAD_ONLY_VERBS: PermissionVerb[] = [
 
 const OPERATOR_ONLY_VERBS: PermissionVerb[] = [];
 const LEAD_OR_OPERATOR_OR_USER_VERBS: PermissionVerb[] = [
+  "mcp-server.stdio.write",
+  "memory.read.any",
   "extension.write",
+  "task.requester.assign",
   "extension.activate",
   "extension.install.inline",
+  "repo.merge-policy.write",
 ];
-const OPERATOR_OR_USER_VERBS: PermissionVerb[] = ["comb.presence"];
+const OPERATOR_OR_USER_VERBS: PermissionVerb[] = ["comb.presence", "approval.respond"];
 
 const LEAD_OR_OPERATOR_VERBS: PermissionVerb[] = ["models.catalog.write"];
 
@@ -533,28 +537,28 @@ describe("any-authenticated verbs", () => {
   }
 });
 
-describe("memory.delete.any composite (owner OR (lead AND scope=swarm))", () => {
-  test("swarm-scoped memory: owner or lead allowed", () => {
+describe("memory.delete.any composite (human, lead for swarm, owner for agent scope)", () => {
+  test("swarm-scoped memory: lead and humans allowed, owner worker denied", () => {
     expectDecisions("memory.delete.any", SWARM_MEMORY_RESOURCE, {
       lead: true,
       worker: false,
-      ownerWorker: true,
+      ownerWorker: false,
       creatorWorker: false,
-      userRequester: false,
-      foreignUser: false,
-      operator: false,
+      userRequester: true,
+      foreignUser: true,
+      operator: true,
     });
   });
 
-  test("agent-scoped memory: only owner allowed — lead is denied (deny edge)", () => {
+  test("agent-scoped memory: owner and humans allowed — lead is denied (deny edge)", () => {
     expectDecisions("memory.delete.any", AGENT_MEMORY_RESOURCE, {
       lead: false,
       worker: false,
       ownerWorker: true,
       creatorWorker: false,
-      userRequester: false,
-      foreignUser: false,
-      operator: false,
+      userRequester: true,
+      foreignUser: true,
+      operator: true,
     });
   });
 });

package/src/tests/rbac-wire-e2e.test.ts

@@ -82,7 +82,8 @@ const DENY = {
   leadOrTaskCreator: "requires lead agent or task creator",
   leadOrResourceOwner: "requires lead agent or resource owner",
   leadOrOwnNamespace: "requires lead agent or your own task:agent: namespace",
-  memoryOwnerOrLeadSwarm: "requires memory owner, or lead agent for swarm-scoped memories",
+  memoryDelete:
+    "requires operator or user, the lead for swarm-scoped memories, or the owner for agent-scoped memories",
 } as const;
 
 const skillMd = (name: string, description: string) =>
@@ -329,7 +330,7 @@ describe("MCP gate matrix", () => {
       { type: "agent", id: WORKER_B },
       "memory.delete.any",
       "deny",
-      DENY.memoryOwnerOrLeadSwarm,
+      DENY.memoryDelete,
       "mcp",
     );
 
@@ -342,13 +343,7 @@ describe("MCP gate matrix", () => {
       memoryId: m3,
     });
     expect(leadOnAgentScoped.structuredContent.success).toBe(false);
-    expectRow(
-      { type: "agent", id: LEAD },
-      "memory.delete.any",
-      "deny",
-      DENY.memoryOwnerOrLeadSwarm,
-      "mcp",
-    );
+    expectRow({ type: "agent", id: LEAD }, "memory.delete.any", "deny", DENY.memoryDelete, "mcp");
 
     const leadOnSwarmScoped = await mcpCall(base, LEAD, sidLead, "memory-delete", {
       memoryId: m2,