@desplega.ai/agent-swarm 1.164.1 → 1.166.0

package/src/tests/pr-body-leaks.test.ts

@@ -105,8 +105,10 @@ describe("findPrBodyLeaks: negative controls", () => {
   test("a fenced code example with a fresh UUID taskId", () => {
     const body = `## Proof of work\n\n\`\`\`ts\nconst taskId = "${randomUUID()}";\nawait store({ parentTaskId: "${randomUUID()}" });\n\`\`\`\n`;
     expect(findPrBodyLeaks(body)).toEqual([]);
-    // The same line outside the fence is still a ref.
-    expect(findPrBodyLeaks(`taskId = "${randomUUID()}"`)).toEqual(["swarm-task-ref"]);
+    // The same line outside the fence is still a ref. The rule needs a letter in
+    // the first group, so a random UUID would flake (~2% are all digits there).
+    const ref = `${hexWithLetter()}-1111-2222-3333-444444444444`;
+    expect(findPrBodyLeaks(`taskId = "${ref}"`)).toEqual(["swarm-task-ref"]);
   });
 
   test("a fence does not hide Slack or dashboard links", () => {
@@ -149,6 +151,159 @@ describe("findPrBodyLeaks: negative controls", () => {
   });
 });
 
+describe("findPrBodyLeaks: Swarm provenance allowlist", () => {
+  const provenance = (...lines: string[]) =>
+    `${NORMAL_BODY}\n## Swarm provenance <!-- bot -->\n\n${lines.map((l) => `- ${l}`).join("\n")}\n`;
+
+  test("task, session, agent-fs and Slack permalinks pass inside the section", () => {
+    const body = provenance(
+      `Task: ${dashboardLink()} · tree: ${dashboardLink().replace("/tasks/", "/sessions/")}`,
+      `Ask: ${slackLink()}?thread_ts=${slackTs()}&cid=${slackId("D")}`,
+      `Plan: ${agentFsLink()} (durable: ${agentFsPath()})`,
+      `Follow-up of task ${hexWithLetter()}.`,
+    );
+    expect(findPrBodyLeaks(body)).toEqual([]);
+  });
+
+  test("the same links outside the section still fail", () => {
+    const body = `${NORMAL_BODY}\nSee ${slackLink()} and ${dashboardLink()}.\n${provenance()}`;
+    // The permalink's embedded channel id also counts outside the section.
+    expect(findPrBodyLeaks(body)).toEqual(["slack-id", "slack-link", "swarm-dashboard-link"]);
+  });
+
+  test("bare Slack ids, ts values and private-chat quotes stay blocked inside it", () => {
+    expect(findPrBodyLeaks(provenance(`Channel ${slackId("C")}`))).toEqual(["slack-id"]);
+    expect(findPrBodyLeaks(provenance(`ts ${slackTs()}`))).toEqual(["slack-ts"]);
+    expect(
+      findPrBodyLeaks(provenance(`Taras in ${"DM"}: "it would be nice to explain the motivation"`)),
+    ).toEqual(["private-chat-quote"]);
+  });
+
+  test("the section ends at the next heading, and a fenced heading does not open it", () => {
+    const after = `${provenance(`Task: ${dashboardLink()}`)}\n## Notes\n\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(after)).toEqual(["swarm-dashboard-link"]);
+    const fenced = `\`\`\`md\n## Swarm provenance\n\`\`\`\n${slackLink()}\n`;
+    expect(findPrBodyLeaks(fenced)).toContain("slack-link");
+  });
+
+  test("a heading inside an HTML comment does not open it", () => {
+    const body = `<!--\n## Swarm provenance\n-->\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+    const oneLine = `<!-- note -->\n## Swarm provenance\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(oneLine)).toEqual([]);
+  });
+
+  test("a shorter fence does not close a longer one", () => {
+    const body = `\`\`\`\`md\n\`\`\`\n## Swarm provenance\n\`\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+  });
+
+  test("tildes do not close a backtick fence", () => {
+    const body = `\`\`\`\n~~~\n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+  });
+
+  test("a fence line with an info string does not close it", () => {
+    const body = `\`\`\`\n\`\`\`md\n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+  });
+
+  test("a longer closing fence closes it, so a later section opens", () => {
+    const body = `\`\`\`\ncode\n\`\`\`\`\`\n## Swarm provenance\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual([]);
+  });
+
+  // CommonMark 0.31.2 §4.5: a fence line is indented at most 3 columns, and a
+  // tab expands to the next multiple of 4, so a deeper "closer" is fence content.
+  test("a closer indented 4 spaces does not close the fence", () => {
+    const body = `\`\`\`\n    \`\`\`\n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+    expect(checkPrBodyLeaks(body)).toEqual(["internal identifier in body: swarm-dashboard-link"]);
+  });
+
+  test("a closer with a leading tab does not close the fence", () => {
+    const body = `\`\`\`\n\t\`\`\`\n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+    expect(checkPrBodyLeaks(body)).toEqual(["internal identifier in body: swarm-dashboard-link"]);
+  });
+
+  // CommonMark §2.1 whitespace is ASCII space and tab only; JS trim() and \s
+  // also strip U+00A0, which GitHub renders as text.
+  test("a closer followed by a no-break space does not close the fence", () => {
+    const body = `\`\`\`\n\`\`\` \n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+    expect(checkPrBodyLeaks(body)).toEqual(["internal identifier in body: swarm-dashboard-link"]);
+  });
+
+  test("a closer followed by ASCII spaces or a tab still closes the fence", () => {
+    for (const tail of ["  ", "\t", " \t "]) {
+      const body = `\`\`\`\ncode\n\`\`\`${tail}\n## Swarm provenance\n\n- ${dashboardLink()}\n`;
+      expect(findPrBodyLeaks(body)).toEqual([]);
+      expect(checkPrBodyLeaks(body)).toEqual([]);
+    }
+  });
+
+  test("a heading needs ASCII whitespace after the hashes to open the section", () => {
+    const nbsp = `## Swarm provenance\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(nbsp)).toEqual(["swarm-dashboard-link"]);
+    expect(checkPrBodyLeaks(nbsp)).toEqual(["internal identifier in body: swarm-dashboard-link"]);
+    const glued = `## Swarm provenance#\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(glued)).toEqual(["swarm-dashboard-link"]);
+    const closed = `##\tSwarm provenance ##\t\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(closed)).toEqual([]);
+  });
+
+  test("a non-breaking space in the heading text is part of the name", () => {
+    for (const heading of ["## Swarm provenance ", "## Swarm provenance"]) {
+      const body = `${heading}\n\n- ${dashboardLink()}\n`;
+      expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+      expect(checkPrBodyLeaks(body)).toEqual(["internal identifier in body: swarm-dashboard-link"]);
+    }
+    const spaced = `##  Swarm \t provenance \t\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(spaced)).toEqual([]);
+    const commented = `## Swarm provenance <!-- bot --> \n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(commented)).toEqual([]);
+  });
+
+  test("a closer indented 3 spaces still closes the fence", () => {
+    const body = `\`\`\`\ncode\n   \`\`\`\n## Swarm provenance\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual([]);
+  });
+
+  test("an opener indented 4 spaces is not a fence, for sections or prose", () => {
+    const ref = `${hexWithLetter()}-1111-2222-3333-444444444444`;
+    expect(findPrBodyLeaks(`    \`\`\`\ntaskId = "${ref}"\n\`\`\`\n`)).toEqual(["swarm-task-ref"]);
+    const body = `    \`\`\`\n## Swarm provenance\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual([]);
+  });
+
+  test("a fence closed less indented than its opener cannot open the section", () => {
+    // In a list item the closer ends the item and opens a new fence, which hides the heading.
+    const body = `- y\n  \`\`\`\n\`\`\`\n## Swarm provenance\n\`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+  });
+
+  test("an indented heading cannot open the section", () => {
+    // A list item fence indented 4 columns hides it on GitHub.
+    const body = `- y\n    \`\`\`\n   ## Swarm provenance\n    \`\`\`\n${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual(["swarm-dashboard-link"]);
+  });
+
+  test("an indented, setext, or commented-out heading still ends the section", () => {
+    const section = provenance(`Task: ${dashboardLink()}`);
+    for (const end of ["   ## Notes", "- ## Notes", "\nNotes\n---", "    <!--\n## Notes\n-->"]) {
+      expect(findPrBodyLeaks(`${section}\n${end}\n\n${dashboardLink()}\n`)).toEqual([
+        "swarm-dashboard-link",
+      ]);
+    }
+  });
+
+  test("the heading matches case-insensitively with a trailing marker", () => {
+    const body = `## swarm  PROVENANCE <!-- bot -->\n\n- ${dashboardLink()}\n`;
+    expect(findPrBodyLeaks(body)).toEqual([]);
+  });
+});
+
 describe("check-pr-body leak gating", () => {
   test("only bot authors, or a local run without an author, get the leak check", () => {
     expect(shouldCheckLeaks(undefined)).toBe(true);

package/src/tests/preload.ts

@@ -30,6 +30,16 @@ startHangWatchdog();
 // drain set API_DRAIN_MAX_MS for their own server.
 process.env.API_DRAIN_MAX_MS = "0";
 
+// Credential and provider-routing tests assume no Anthropic credentials, as
+// on CI. A developer shell (or a repo .env, which Bun loads before this file)
+// often sets them, for example a Claude Code session behind a proxy. Then
+// ~17 tests fail locally and the pre-push hook blocks the push. Remove them
+// here; spawned servers inherit the cleaned env, and suites that need a
+// value set their own.
+for (const key of ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"]) {
+  delete process.env[key];
+}
+
 // @hono/node-server (pulled in transitively by @modelcontextprotocol/sdk's
 // streamableHttp transport) replaces globalThis.Response/Request with its own
 // lightweight Node-adapter classes the first time getRequestListener() runs.

package/src/tests/provider-registration.test.ts

@@ -61,6 +61,7 @@ const modelsDevFixture = {
   anthropic: { models: { "claude-test": { cost: { input: 1, output: 2 } } } },
   openai: { models: { "gpt-test": { cost: { input: 1, output: 2 } } } },
   openrouter: { models: { "test/model": { cost: { input: 1, output: 2 } } } },
+  xai: { models: { "grok-test": { cost: { input: 1, output: 2 } } } },
 };
 
 interface TouchPoint {
@@ -233,6 +234,7 @@ const BOOTSTRAP: Record<ProviderName, { expect: string } | { exempt: string }> =
   dsh: { expect: "Warning: dsh provider has no credentials yet" },
   amp: { expect: "Warning: amp provider has no credentials yet" },
   cursor: { expect: "Warning: cursor provider has no credentials yet" },
+  grok: { expect: "Warning: grok provider has no credentials yet" },
   pi: { expect: "Warning: pi provider has no credentials yet" },
   opencode: { expect: "Warning: opencode provider has no credentials yet" },
   "claude-managed": { expect: "Warning: claude-managed provider missing:" },
@@ -282,7 +284,7 @@ function extractMarkedBlock(name: string): string {
 /** Resolvable no-op stubs for every binary the verify chain may look up. */
 function makeBinaryStubDir(): string {
   const dir = mkdtempSync(join(tmpdir(), "provider-registration-bin-"));
-  for (const name of ["claude", "codex", "opencode", "dsh", "amp"]) {
+  for (const name of ["claude", "codex", "opencode", "dsh", "amp", "grok"]) {
     const file = join(dir, name);
     writeFileSync(file, "#!/bin/sh\nexit 0\n");
     chmodSync(file, 0o755);

package/src/tests/rbac-audit.test.ts

@@ -168,6 +168,38 @@ describe("buffer + flush persistence", () => {
     expect(denyRow?.reason).toBeTruthy();
   });
 
+  test("persists a mixed batch with a guest denial and an operator decision", async () => {
+    setAuditSink(enqueueAuditRow);
+
+    const operator = can({
+      principal: { kind: "operator" },
+      verb: "models.catalog.write",
+      source: "http",
+    });
+    const guest = can({
+      principal: { kind: "guest" },
+      verb: "models.catalog.write",
+      source: "http",
+    });
+    expect(operator.allow).toBe(true);
+    expect(guest.allow).toBe(false);
+
+    await flushAuditBuffer();
+
+    const rows = await selectAuditRows();
+    expect(rows.length).toBe(2);
+    expect(rows.find((r) => r.principalType === "operator")).toMatchObject({
+      principalId: null,
+      verb: "models.catalog.write",
+      decision: "allow",
+    });
+    expect(rows.find((r) => r.principalType === "guest")).toMatchObject({
+      principalId: null,
+      verb: "models.catalog.write",
+      decision: "deny",
+    });
+  });
+
   test("auto-flushes at the 200-row threshold without the interval writer", async () => {
     for (let i = 0; i < 200; i++) {
       enqueueAuditRow(

package/src/tests/rbac-mcp-admission-e2e.test.ts

@@ -155,13 +155,6 @@ async function createPendingTask(base: string, token: string): Promise<string> {
   return res.body.id as string;
 }
 
-function taskIdFrom(result: ToolCallResult): string {
-  expect(result.isError).not.toBe(true);
-  const task = result.structuredContent?.task as { id?: unknown } | undefined;
-  expect(typeof task?.id).toBe("string");
-  return task.id as string;
-}
-
 function expectToolSuccess(result: ToolCallResult): void {
   expect(result.isError).not.toBe(true);
   expect(result.structuredContent?.success).toBe(true);
@@ -179,24 +172,11 @@ function expectSoftForbidden(result: ToolCallResult, verb: string): void {
   );
 }
 
-async function createUnassignedViaMcp(
-  base: string,
-  token: string,
-  sessionId: string,
-): Promise<string> {
-  const created = await mcpUserCall(base, token, sessionId, "send-task", {
-    task: `unassigned task ${crypto.randomUUID()}`,
-  });
-  expectToolSuccess(created);
-  return taskIdFrom(created);
-}
-
 async function exerciseAllowedUserTools(
   base: string,
   token: string,
   sessionId: string,
   pendingTaskId: string,
-  unassignedTaskId: string,
 ): Promise<void> {
   const created = await mcpUserCall(base, token, sessionId, "send-task", {
     task: `allowed send-task ${crypto.randomUUID()}`,
@@ -217,12 +197,6 @@ async function exerciseAllowedUserTools(
     reason: "rbac mcp-user e2e",
   });
   expectToolSuccess(cancelled);
-
-  const moved = await mcpUserCall(base, token, sessionId, "task-action", {
-    action: "to_backlog",
-    taskId: unassignedTaskId,
-  });
-  expectToolSuccess(moved);
 }
 
 describe("RBAC admission over /mcp-user", () => {
@@ -248,25 +222,13 @@ describe("RBAC admission over /mcp-user", () => {
     const admin = await createUserToken(server.base, "MCP Admin");
     const adminSid = await mcpUserInit(server.base, admin.token);
     const adminPendingTaskId = await createPendingTask(server.base, admin.token);
-    const adminUnassignedTaskId = await createUnassignedViaMcp(server.base, admin.token, adminSid);
 
-    await exerciseAllowedUserTools(
-      server.base,
-      admin.token,
-      adminSid,
-      adminPendingTaskId,
-      adminUnassignedTaskId,
-    );
+    await exerciseAllowedUserTools(server.base, admin.token, adminSid, adminPendingTaskId);
     expect(countAuditRows(enabledDbPath)).toBe(0);
 
     const requester = await createUserToken(server.base, "MCP Requester");
     const requesterSid = await mcpUserInit(server.base, requester.token);
     const requesterPendingTaskId = await createPendingTask(server.base, requester.token);
-    const requesterUnassignedTaskId = await createUnassignedViaMcp(
-      server.base,
-      requester.token,
-      requesterSid,
-    );
     rewriteUserRoles(enabledDbPath, requester.userId, [REQUESTER_ROLE_ID]);
 
     await exerciseAllowedUserTools(
@@ -274,13 +236,11 @@ describe("RBAC admission over /mcp-user", () => {
       requester.token,
       requesterSid,
       requesterPendingTaskId,
-      requesterUnassignedTaskId,
     );
 
     const empty = await createUserToken(server.base, "MCP Empty Grant");
     const emptySid = await mcpUserInit(server.base, empty.token);
     const emptyPendingTaskId = await createPendingTask(server.base, empty.token);
-    const emptyUnassignedTaskId = await createUnassignedViaMcp(server.base, empty.token, emptySid);
     rewriteUserRoles(enabledDbPath, empty.userId, []);
 
     expectSoftForbidden(
@@ -295,13 +255,6 @@ describe("RBAC admission over /mcp-user", () => {
       }),
       "task.cancel.own",
     );
-    expectSoftForbidden(
-      await mcpUserCall(server.base, empty.token, emptySid, "task-action", {
-        action: "to_backlog",
-        taskId: emptyUnassignedTaskId,
-      }),
-      "task.action.own",
-    );
     expectReadableToolResult(
       await mcpUserCall(server.base, empty.token, emptySid, "get-tasks", { limit: 10 }),
     );
@@ -323,7 +276,7 @@ describe("RBAC admission over /mcp-user", () => {
               row.verb === "task.create.own" &&
               row.decision === "allow",
           ) &&
-          ["task.create.own", "task.cancel.own", "task.action.own"].every((verb) =>
+          ["task.create.own", "task.cancel.own"].every((verb) =>
             auditRows.some(
               (row) =>
                 row.principalId === empty.userId && row.decision === "deny" && row.verb === verb,
@@ -346,7 +299,7 @@ describe("RBAC admission over /mcp-user", () => {
       mcpRows
         .filter((row) => row.principalId === empty.userId && row.decision === "deny")
         .map((row) => row.verb),
-    ).toEqual(["task.create.own", "task.cancel.own", "task.action.own"]);
+    ).toEqual(["task.create.own", "task.cancel.own"]);
 
     await server.stop();
     server = undefined;
@@ -362,19 +315,8 @@ describe("RBAC admission over /mcp-user", () => {
     const flagOffSid = await mcpUserInit(server.base, flagOff.token);
     rewriteUserRoles(disabledDbPath, flagOff.userId, []);
     const flagOffPendingTaskId = await createPendingTask(server.base, flagOff.token);
-    const flagOffUnassignedTaskId = await createUnassignedViaMcp(
-      server.base,
-      flagOff.token,
-      flagOffSid,
-    );
 
-    await exerciseAllowedUserTools(
-      server.base,
-      flagOff.token,
-      flagOffSid,
-      flagOffPendingTaskId,
-      flagOffUnassignedTaskId,
-    );
+    await exerciseAllowedUserTools(server.base, flagOff.token, flagOffSid, flagOffPendingTaskId);
     expect(countAuditRows(disabledDbPath)).toBe(0);
   });
 });

package/src/tests/script-connections.test.ts

@@ -606,6 +606,15 @@ describe("script connections", () => {
       markMigrationApplied(database, "195_approval_request_approvals.sql");
       // 196 alters skills, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "196_skill_invocations.sql");
+      // 198 rebuilds permission_audit, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "198_permission_audit_guest.sql");
+      // 200 backfills agent_memory, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "200_backfill_auto_memory_expiry.sql");
+      // 201 alters workflow_runs and workflow_run_steps, which this
+      // migration-112-only fixture does not create.
+      markMigrationApplied(database, "201_workflow_replay_columns.sql");
+      // 202 moves rows out of kv_entries, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "202_codex_oauth_device_flows.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-executor-conformance.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { classifyExit, NativeScriptExecutor } from "../scripts-runtime/executors/native";
+import { QuickJSScriptExecutor } from "../scripts-runtime/executors/quickjs";
 import type {
   ExecutorInput,
   ExecutorOutput,
@@ -128,6 +129,8 @@ function conformance(name: string, makeExecutor: () => ScriptExecutor, spawns: b
 
 conformance("native", () => new NativeScriptExecutor(), true);
 conformance("fake", () => new FakeScriptExecutor(), false);
+// Worker threads and WASM, no Bun.spawn: runs even when the spawn probe fails.
+conformance("quickjs", () => new QuickJSScriptExecutor(), false);
 
 describe("native-only executor behavior", () => {
   test.skipIf(SKIP_SANDBOX_SPAWN_TESTS)("timeout maps to timeout", async () => {