@desplega.ai/agent-swarm 1.164.1 → 1.166.0

package/src/tests/credential-check.test.ts

@@ -887,6 +887,96 @@ describe("isCredCheckDisabled", () => {
 });
 
 describe("buildCredStatusReport", () => {
+  const HOME = "/home/worker";
+
+  for (const [provider, authPath] of [
+    ["pi", ".pi/agent/auth.json"],
+    ["opencode", ".local/share/opencode/auth.json"],
+  ] as const) {
+    test(`${provider}: auth.json gives a successful presence-only live test`, async () => {
+      const realFetch = globalThis.fetch;
+      const fetchMock = mock(async () => {
+        throw new Error("file credentials must not be sent to a provider endpoint");
+      });
+      globalThis.fetch = fetchMock as typeof fetch;
+      try {
+        for (const env of [{ HOME }, { HOME, OPENROUTER_API_KEY: "unused-key" }]) {
+          const snap = await buildCredStatusReport(
+            provider,
+            env,
+            { homeDir: HOME, fs: fsWith(new Set([`${HOME}/${authPath}`])) },
+            "boot",
+          );
+          expect(snap.ready).toBe(true);
+          expect(snap.satisfiedBy).toBe("file");
+          expect(snap.liveTest).toMatchObject({ ok: true, error: null, latency_ms: 0 });
+        }
+        expect(fetchMock).not.toHaveBeenCalled();
+      } finally {
+        globalThis.fetch = realFetch;
+      }
+    });
+
+    test(`${provider}: missing credentials do not become a successful live test`, async () => {
+      const snap = await buildCredStatusReport(
+        provider,
+        {},
+        { homeDir: HOME, fs: noFiles },
+        "boot",
+      );
+      expect(snap.ready).toBe(false);
+      expect(snap.liveTest).toBeNull();
+    });
+
+    for (const key of ["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY"] as const) {
+      test(`${provider}: ${key} still receives a live probe and reports its result`, async () => {
+        const realFetch = globalThis.fetch;
+        let responseStatus = 200;
+        const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+          return new Response("{}", { status: responseStatus });
+        });
+        globalThis.fetch = fetchMock as typeof fetch;
+        try {
+          const env = { [key]: "provider-key" };
+          const opts = { homeDir: HOME, fs: noFiles };
+          const success = await buildCredStatusReport(provider, env, opts, "boot");
+          expect(success.liveTest?.ok).toBe(true);
+          responseStatus = 401;
+          const failure = await buildCredStatusReport(provider, env, opts, "post_task");
+          expect(failure.ready).toBe(true);
+          expect(failure.liveTest?.ok).toBe(false);
+          expect(failure.liveTest?.error).toContain("HTTP 401");
+          expect(fetchMock).toHaveBeenCalledTimes(2);
+          expect(String(fetchMock.mock.calls[0]?.[0])).toMatch(/\/models$/);
+        } finally {
+          globalThis.fetch = realFetch;
+        }
+      });
+    }
+  }
+
+  test("pi: a Google model with only GEMINI_API_KEY gives a successful presence-only live test", async () => {
+    const realFetch = globalThis.fetch;
+    const fetchMock = mock(async () => {
+      throw new Error("a presence-only credential must not issue a live probe");
+    });
+    globalThis.fetch = fetchMock as typeof fetch;
+    try {
+      const snap = await buildCredStatusReport(
+        "pi",
+        { MODEL_OVERRIDE: "google/gemini-3-flash-preview", GEMINI_API_KEY: "google-key" },
+        { homeDir: HOME, fs: noFiles },
+        "boot",
+      );
+      expect(snap.ready).toBe(true);
+      expect(snap.satisfiedBy).toBe("env");
+      expect(snap.liveTest).toMatchObject({ ok: true, error: null, latency_ms: 0 });
+      expect(fetchMock).not.toHaveBeenCalled();
+    } finally {
+      globalThis.fetch = realFetch;
+    }
+  });
+
   test("not ready → no live test, snapshot mirrors presence check", async () => {
     const snap = await buildCredStatusReport("claude", {}, {}, "boot");
     expect(snap.ready).toBe(false);

package/src/tests/db-query-denylist.test.ts

@@ -0,0 +1,202 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createServer as createHttpServer, type Server } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { closeDb, getDb, initDb, upsertKv } from "../be/db";
+import { upsertCodexDeviceFlow } from "../be/db/codex-oauth-device-flows";
+import {
+  DbQueryDeniedTableError,
+  executeReadOnlyQueryGated,
+  handleDbQuery,
+} from "../http/db-query";
+import { executeReadOnlyQuery } from "../http/db-query-shared";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+// A real on-disk database: the bounded path spawns a child process that opens
+// its own connection, so an in-memory test template would be invisible to it.
+const DB_PATH = join(tmpdir(), `db-query-denylist-${process.pid}-${Date.now()}.sqlite`);
+
+const testGlobals = globalThis as typeof globalThis & {
+  __testMigrationTemplate?: Uint8Array;
+};
+let savedTemplate: Uint8Array | undefined;
+
+// Built at runtime so no secret-shaped literal lands in the repo.
+const syntheticToken = () => `gh${"p"}_${"K".repeat(36)}`;
+
+async function removeDb(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await Bun.file(`${DB_PATH}${suffix}`).delete();
+    } catch {}
+  }
+}
+
+beforeAll(async () => {
+  savedTemplate = testGlobals.__testMigrationTemplate;
+  testGlobals.__testMigrationTemplate = undefined;
+  closeDb();
+  await removeDb();
+  initDb(DB_PATH);
+  const db = getDb();
+  db.run("CREATE VIEW denylist_test_view AS SELECT * FROM oauth_authorizations");
+  db.run("CREATE TABLE denylist_test_notes (id INTEGER PRIMARY KEY, body TEXT)");
+  db.run("INSERT INTO denylist_test_notes (body) VALUES (?)", [
+    `deploy used ${syntheticToken()} from the env dump`,
+  ]);
+});
+
+afterAll(async () => {
+  closeDb();
+  testGlobals.__testMigrationTemplate = savedTemplate;
+  await removeDb();
+});
+
+const DENIED_QUERIES: Array<[string, string, string]> = [
+  ["direct read", "SELECT * FROM oauth_authorizations", "oauth_authorizations"],
+  ["alias", "SELECT a.accessToken FROM oauth_authorizations AS a", "oauth_authorizations"],
+  ["CTE", "WITH t AS (SELECT * FROM oauth_authorizations) SELECT * FROM t", "oauth_authorizations"],
+  [
+    "join",
+    "SELECT n.body, p.codeVerifier FROM denylist_test_notes n JOIN oauth_pending p ON 1 = 1",
+    "oauth_pending",
+  ],
+  ["subquery", "SELECT * FROM (SELECT * FROM user_tokens)", "user_tokens"],
+  ["view", "SELECT * FROM denylist_test_view", "oauth_authorizations"],
+  ["scalar subquery", "SELECT (SELECT clientSecret FROM oauth_apps LIMIT 1) AS s", "oauth_apps"],
+  ["count only", "SELECT COUNT(*) FROM session_tokens", "session_tokens"],
+  ["mixed case", "select * from Script_Apis", "script_apis"],
+];
+
+describe("db-query credential-table denylist", () => {
+  for (const [label, sql, table] of DENIED_QUERIES) {
+    test(`in-process path rejects a ${label}`, () => {
+      expect(() => executeReadOnlyQuery(sql)).toThrow(DbQueryDeniedTableError);
+      expect(() => executeReadOnlyQuery(sql)).toThrow(table);
+    });
+  }
+
+  test("bounded path rejects before spawning a child", async () => {
+    for (const [, sql, table] of DENIED_QUERIES) {
+      await expect(executeReadOnlyQueryGated(sql, [], 5_000, 10)).rejects.toThrow(table);
+    }
+  });
+
+  test("allows swarm_config, EXPLAIN and a table name in a string literal", async () => {
+    const config = await executeReadOnlyQueryGated("SELECT key FROM swarm_config", [], 5_000, 10);
+    expect(config.columns).toEqual(["key"]);
+
+    const explained = executeReadOnlyQuery("EXPLAIN QUERY PLAN SELECT * FROM oauth_authorizations");
+    expect(explained.columns.length).toBeGreaterThan(0);
+
+    const literal = executeReadOnlyQuery("SELECT 'oauth_authorizations' AS name");
+    expect(literal.rows).toEqual([["oauth_authorizations"]]);
+  });
+});
+
+describe("POST /api/db-query", () => {
+  let server: Server;
+  let baseUrl = "";
+
+  beforeAll(async () => {
+    server = createHttpServer(async (req, res) => {
+      const handled = await handleDbQuery(
+        req,
+        res,
+        getPathSegments(req.url || ""),
+        parseQueryParams(req.url || ""),
+      );
+      if (!handled) {
+        res.writeHead(404);
+        res.end();
+      }
+    });
+    baseUrl = `http://localhost:${await listenOnFreePort(server)}`;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  });
+
+  async function post(sql: string) {
+    const res = await fetch(`${baseUrl}/api/db-query`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sql }),
+    });
+    return { status: res.status, body: (await res.json()) as Record<string, unknown> };
+  }
+
+  test("rejects a credential table with a clear 400", async () => {
+    const { status, body } = await post("SELECT * FROM oauth_authorizations");
+    expect(status).toBe(400);
+    expect(String(body.error)).toContain("oauth_authorizations");
+    expect(String(body.error)).toContain("credentials");
+  });
+
+  test("redacts a secret stored in an allowed table and keeps the context", async () => {
+    const { status, body } = await post("SELECT body FROM denylist_test_notes");
+    expect(status).toBe(200);
+    const serialized = JSON.stringify(body.rows);
+    expect(serialized).not.toContain(syntheticToken());
+    expect(serialized).toContain("[REDACTED:");
+    expect(serialized).toContain("from the env dump");
+  });
+
+  test("denies Codex device-login state and keeps general KV readable", async () => {
+    const marker = `device-state-${crypto.randomUUID()}`;
+    await upsertCodexDeviceFlow({
+      flowId: crypto.randomUUID(),
+      state: marker,
+      expiresAt: Date.now() + 60_000,
+    });
+    await upsertKv({
+      namespace: "denylist-test",
+      key: "note",
+      value: "plain kv value",
+      valueType: "string",
+    });
+
+    for (const sql of [
+      "SELECT * FROM codex_oauth_device_flows",
+      "SELECT f.state FROM codex_oauth_device_flows f JOIN kv_entries k ON 1",
+    ]) {
+      const { status, body } = await post(sql);
+      expect(status).toBe(400);
+      expect(String(body.error)).toContain("codex_oauth_device_flows");
+      expect(JSON.stringify(body)).not.toContain(marker);
+    }
+
+    const kv = await post("SELECT namespace, value FROM kv_entries");
+    expect(kv.status).toBe(200);
+    const rows = JSON.stringify(kv.body.rows);
+    expect(rows).toContain("plain kv value");
+    expect(rows).not.toContain("codex-oauth-device");
+    expect(rows).not.toContain(marker);
+  });
+
+  test("migration 202 moves legacy kv device flows out of kv_entries", async () => {
+    const flowId = crypto.randomUUID();
+    const marker = `legacy-state-${crypto.randomUUID()}`;
+    await upsertKv({
+      namespace: "codex-oauth-device",
+      key: flowId,
+      value: marker,
+      valueType: "string",
+      expiresAt: Date.now() + 60_000,
+    });
+    const migration = await Bun.file(
+      join(import.meta.dir, "../be/migrations/202_codex_oauth_device_flows.sql"),
+    ).text();
+    getDb().exec(migration);
+
+    const kv = await post("SELECT key FROM kv_entries WHERE namespace = 'codex-oauth-device'");
+    expect(kv.status).toBe(200);
+    expect(kv.body.rows).toEqual([]);
+    const moved = getDb()
+      .query("SELECT state FROM codex_oauth_device_flows WHERE flow_id = ?")
+      .get(flowId) as { state: string } | null;
+    expect(moved?.state).toBe(marker);
+  });
+});

package/src/tests/db-task-read-contract.test.ts

@@ -357,6 +357,7 @@ value:getScheduledTaskByName
 value:getScheduledTasks
 value:getScriptRun
 value:getScriptRunByIdempotencyKey
+value:getScriptRunExecutionArgs
 value:getScriptRunJournalStep
 value:getServiceByAgentAndName
 value:getServiceById

package/src/tests/db-task-write-contract.test.ts

@@ -380,6 +380,7 @@ value:getScheduledTaskByName
 value:getScheduledTasks
 value:getScriptRun
 value:getScriptRunByIdempotencyKey
+value:getScriptRunExecutionArgs
 value:getScriptRunJournalStep
 value:getServiceByAgentAndName
 value:getServiceById

package/src/tests/docs-index-footprint.test.js

@@ -78,7 +78,7 @@ describe("docs API index footprint", () => {
     expect(tasks).toContain('"path":"/api/task-templates","method":"get"');
   });
 
-  test("OpenAPI and generated pages keep all 396 operations", async () => {
+  test("OpenAPI and generated pages keep all 399 operations", async () => {
     const spec = await Bun.file(resolve(repoRoot, "openapi.json")).json();
     const operationKeys = [];
     const tags = new Set();
@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(396);
-    expect(generatedKeys).toHaveLength(396);
+    expect(operationKeys).toHaveLength(399);
+    expect(generatedKeys).toHaveLength(399);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });
 

package/src/tests/entrypoint-acp-target-binary.test.ts

@@ -43,6 +43,8 @@ const STUB_BINARIES = [
   "claude",
   "codex",
   "opencode",
+  "gemini",
+  "copilot",
   "dsh",
   "acp-target-stub",
   "acp target stub",
@@ -129,6 +131,47 @@ describe("docker-entrypoint.sh: acp target binary verification", () => {
     CHILD_PROCESS_TEST_BUDGET_MS,
   );
 
+  test(
+    "resolves the gemini catalog target to the gemini binary",
+    async () => {
+      const result = await runChain({ HARNESS_PROVIDER: "acp", ACP_TARGET: "gemini" });
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("ACP target: ");
+      expect(result.stdout).toContain("ACP_TARGET='gemini'");
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  test(
+    "resolves the copilot catalog target to the copilot binary",
+    async () => {
+      const result = await runChain({ HARNESS_PROVIDER: "acp", ACP_TARGET: "copilot" });
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("ACP target: ");
+      expect(result.stdout).toContain("ACP_TARGET='copilot'");
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  test(
+    "fails boot with an install hint when the copilot binary is missing",
+    async () => {
+      // No stub dir on PATH, so `copilot` cannot resolve.
+      const result = await runChain({
+        HARNESS_PROVIDER: "acp",
+        ACP_TARGET: "copilot",
+        PATH: "/usr/bin:/bin",
+      });
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stdout).toContain("FATAL: ACP target binary not found: 'copilot'");
+      expect(result.stdout).toContain("npm install -g @github/copilot");
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
   test(
     "resolves a custom target supplied as a command string with argv",
     async () => {
@@ -178,7 +221,7 @@ describe("docker-entrypoint.sh: acp target binary verification", () => {
 
       expect(result.exitCode).not.toBe(0);
       expect(result.stdout).toContain(
-        "FATAL: unsupported ACP target 'gemini-cli'. Supported targets: opencode, custom.",
+        "FATAL: unsupported ACP target 'gemini-cli'. Supported targets: opencode, gemini, copilot, custom.",
       );
     },
     CHILD_PROCESS_TEST_BUDGET_MS,

package/src/tests/events-scrub.test.ts

@@ -0,0 +1,88 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { closeDb, getDbClient, initDb } from "../be/db";
+import { createEvent, createEventsBatch } from "../be/events";
+import { randomToken, syntheticSecret } from "./synthetic-secret-helpers";
+
+const TEST_DB_PATH = "./test-events-scrub.sqlite";
+
+beforeAll(async () => {
+  try {
+    await unlink(TEST_DB_PATH);
+  } catch {}
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(`${TEST_DB_PATH}${suffix}`);
+    } catch {}
+  }
+});
+
+async function readData(sessionId: string): Promise<string[]> {
+  const rows = await getDbClient().query<{ data: string | null }>(
+    "SELECT data FROM events WHERE sessionId = ? ORDER BY rowid",
+    [sessionId],
+  );
+  return rows.map((r) => r.data ?? "");
+}
+
+describe("events.data scrub at write", () => {
+  test("createEvent redacts a secret in the payload and keeps valid JSON", async () => {
+    const pat = ["ghp", randomToken(36)].join("_");
+    const sessionId = crypto.randomUUID();
+    await createEvent({
+      category: "session",
+      event: "session.start",
+      source: "api",
+      sessionId,
+      data: { note: "cloned repo with token", output: `remote: ${pat} ok`, count: 3 },
+    });
+
+    const [raw] = await readData(sessionId);
+    expect(raw).toBeDefined();
+    expect(raw).not.toContain(pat);
+    expect(raw).toContain("[REDACTED:");
+    const parsed = JSON.parse(raw as string);
+    expect(parsed.note).toBe("cloned repo with token");
+    expect(parsed.output).toStartWith("remote: ");
+    expect(parsed.output).toEndWith(" ok");
+    expect(parsed.count).toBe(3);
+  });
+
+  test("createEventsBatch redacts every row and keeps valid JSON", async () => {
+    // Registered per test: the preload clears volatile secrets after each one.
+    const known = syntheticSecret("evscrub");
+    const sessionId = crypto.randomUUID();
+    const count = await createEventsBatch([
+      {
+        category: "tool",
+        event: "tool.start",
+        source: "worker",
+        sessionId,
+        data: { tool: "Bash", input: `echo ${known.value}` },
+      },
+      {
+        category: "tool",
+        event: "tool.end",
+        source: "worker",
+        sessionId,
+        data: { tool: "Bash", nested: { lines: ["first", `leaked ${known.value} here`] } },
+      },
+    ]);
+    expect(count).toBe(2);
+
+    const rows = await readData(sessionId);
+    expect(rows).toHaveLength(2);
+    for (const raw of rows) {
+      expect(raw).not.toContain(known.value);
+      expect(raw).toContain(`[REDACTED:${known.name}]`);
+      expect(JSON.parse(raw).tool).toBe("Bash");
+    }
+    expect(JSON.parse(rows[0] as string).input).toStartWith("echo ");
+    expect(JSON.parse(rows[1] as string).nested.lines[0]).toBe("first");
+  });
+});

package/src/tests/explicit-model-validation.test.ts

@@ -47,6 +47,7 @@ let leadId = "";
 let workerId = "";
 let acpId = "";
 let codexId = "";
+let grokId = "";
 
 beforeAll(async () => {
   await removeDbFiles(TEST_DB_PATH);
@@ -78,6 +79,14 @@ beforeAll(async () => {
       harnessProvider: "codex",
     })
   ).id;
+  grokId = (
+    await createAgent({
+      name: "validation-grok",
+      isLead: false,
+      status: "idle",
+      harnessProvider: "grok",
+    })
+  ).id;
 
   server = createServer((req, res) => {
     setRequestAuth(req, { kind: "operator", fingerprint: "explicit-model-validation-test" });
@@ -250,6 +259,78 @@ describe("explicitModelError", () => {
   });
 });
 
+describe("grok model namespace", () => {
+  test("another vendor's id, namespace or alias is refused, even with allowCustomModel", async () => {
+    for (const model of [
+      "claude-opus-5-5",
+      "anthropic/claude-opus-5-5",
+      "gpt-5.6-sol",
+      "openai/gpt-5.6-sol",
+      "deepseek/deepseek-v4.1-flash",
+      "latest:anthropic/opus",
+      "latest:openai/gpt-5*",
+    ]) {
+      for (const allowCustomModel of [false, true]) {
+        const error = await explicitModelError({
+          model,
+          harnessProvider: "grok",
+          allowCustomModel,
+        });
+        expect(error).toContain(`Model "${model}" does not run on the grok harness`);
+        expect(error).toContain("openrouter/<vendor>/<id>");
+      }
+    }
+  });
+
+  test("bare xAI ids and both OpenRouter spellings pass", async () => {
+    for (const model of [
+      "grok-4.6",
+      "openrouter/deepseek/deepseek-v4.1-flash",
+      "latest:openrouter/deepseek/deepseek-v4.1-*",
+    ]) {
+      expect(await explicitModelError({ model, harnessProvider: "grok" })).toBeNull();
+    }
+  });
+
+  test("xai/<id> runs on grok; the API catalog has no xai section, so it needs allowCustomModel", async () => {
+    expect(
+      await explicitModelError({
+        model: "xai/grok-4.6",
+        harnessProvider: "grok",
+        allowCustomModel: true,
+      }),
+    ).toBeNull();
+    expect(await explicitModelError({ model: "xai/grok-4.6", harnessProvider: "grok" })).toContain(
+      'Unknown model "xai/grok-4.6"',
+    );
+  });
+
+  test("POST /api/tasks to a grok agent: vendor ids are a 400, xAI and OpenRouter ids a 201", async () => {
+    const base = { task: "grok route", agentId: grokId, routingReason: "human_pinned" };
+    for (const model of ["claude-opus-5-5", "latest:anthropic/opus"]) {
+      const refused = await api("POST", "/api/tasks", { ...base, model });
+      expect(refused.status).toBe(400);
+      expect(String(refused.body.error)).toContain(
+        `does not run on the grok harness of agent "validation-grok" (${grokId})`,
+      );
+    }
+    for (const model of ["grok-4.6", "openrouter/deepseek/deepseek-v4.1-flash"]) {
+      const accepted = await api("POST", "/api/tasks", { ...base, model });
+      expect(accepted.status).toBe(201);
+    }
+  });
+
+  test("MODEL_TIER_GROK_<TIER> refuses another vendor's model", () => {
+    expect(validateTierConfigValue("MODEL_TIER_GROK_SMART", "claude-opus-5-5")).toBe(
+      'Invalid MODEL_TIER_GROK_SMART: model "claude-opus-5-5" does not run on the grok harness.',
+    );
+    expect(validateTierConfigValue("MODEL_TIER_GROK_SMART", "grok-4.6")).toBeNull();
+    expect(
+      validateTierConfigValue("MODEL_TIER_GROK_SMOL", "openrouter/deepseek/deepseek-v4.1-flash"),
+    ).toBeNull();
+  });
+});
+
 describe("MODEL_TIER_<PROVIDER>_<TIER> values", () => {
   test("a model from another harness family is rejected on write", () => {
     expect(validateTierConfigValue("MODEL_TIER_CODEX_SMART", "claude-opus-5-5")).toBe(

package/src/tests/extensions-pre-task.test.ts

@@ -8,6 +8,7 @@ import {
   createAgent,
   createScheduledTask,
   createTaskExtended,
+  createUser,
   createWorkflow,
   createWorkflowRun,
   createWorkflowRunStep,
@@ -26,8 +27,9 @@ import { handleTasks } from "../http/tasks";
 import { dispatchScheduleTarget } from "../scheduler/scheduler";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { createWorkerTaskFollowUp } from "../tasks/worker-follow-up";
-import { registerSendTaskTool } from "../tools/send-task";
+import { registerSendTaskTool, sendTaskHandler } from "../tools/send-task";
 import { registerTaskActionTool } from "../tools/task-action";
+import { userCtx } from "../tools/task-tool-ctx";
 import { markExtensionRequestOrigin } from "../tools/utils";
 import { workflowEventBus } from "../workflows/event-bus";
 import { AgentTaskExecutor } from "../workflows/executors/agent-task";
@@ -139,6 +141,7 @@ describe("extension task boundaries", () => {
     const client = getDbClient();
     await client.run("DELETE FROM agent_tasks");
     await client.run("DELETE FROM extensions");
+    await client.run("DELETE FROM users");
     await client.run("DELETE FROM agents");
   });
 
@@ -501,6 +504,35 @@ export default extension;
     expect(compatible.body.model).toBe("claude-opus-5-5");
   });
 
+  test("user send-task rejects an extension that retargets the Lead assignment", async () => {
+    await createAgent({ name: "user-task-lead", isLead: true, status: "idle" });
+    const worker = await createAgent({ name: "user-task-worker", isLead: false, status: "idle" });
+    const user = await createUser({ name: "Extension Guard User" });
+    await installSource(
+      "retarget-user-task",
+      `import type { SwarmExtension } from "swarm-extension";
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => ({ action: "modify", data: { agentId: "${worker.id}" } }));
+};
+export default extension;
+`,
+    );
+
+    const result = await sendTaskHandler(
+      userCtx(user),
+      sendTaskArgs("extension must not retarget this user task"),
+    );
+
+    expect(result.ok).toBe(false);
+    expect(result.message).toBe(
+      "A pre.task.create extension cannot change the user task's Lead assignment.",
+    );
+    expect(
+      (await getDbClient().get<{ count: number }>("SELECT COUNT(*) AS count FROM agent_tasks"))
+        ?.count,
+    ).toBe(0);
+  });
+
   test("extension tool calls derive their origin and skip the creating extension", async () => {
     const creator = await installAndEnable("rewrite-task-priority");
     await installAndEnable("block-tasks-from-source", {