@desplega.ai/agent-swarm 1.166.0 → 1.168.0

package/src/tests/openrouter-base-url.test.ts

@@ -3,8 +3,7 @@
  *
  * Covers the shared resolver (`src/utils/openrouter-base-url.ts`), the pi
  * models.json override writer (`ensureOpenRouterModelsOverride`) including
- * its composition through pi-coding-agent's ModelRuntime, and the opencode
- * per-task config injection (`applyOpenRouterBaseUrlOverride`).
+ * its composition through pi-coding-agent's ModelRuntime, and attribution host gating.
  */
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
@@ -12,10 +11,12 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
-import type { Config } from "@opencode-ai/sdk";
-import { applyOpenRouterBaseUrlOverride } from "../providers/opencode-adapter";
 import { ensureOpenRouterModelsOverride } from "../providers/pi-mono-adapter";
-import { DEFAULT_OPENROUTER_BASE_URL, getOpenRouterBaseUrl } from "../utils/openrouter-base-url";
+import {
+  DEFAULT_OPENROUTER_BASE_URL,
+  getOpenRouterAttributionHeaders,
+  getOpenRouterBaseUrl,
+} from "../utils/openrouter-base-url";
 
 const GATEWAY = "https://control-plane.example/proxy/v1";
 
@@ -220,40 +221,30 @@ describe("ensureOpenRouterModelsOverride (pi)", () => {
   });
 });
 
-describe("applyOpenRouterBaseUrlOverride (opencode)", () => {
-  test("no-op when OPENROUTER_BASE_URL is unset", () => {
-    const config: Config = { model: "openrouter/google/gemini-3-flash-preview" };
-    applyOpenRouterBaseUrlOverride(config, {});
-    expect(config.provider).toBeUndefined();
-  });
-
-  test("sets provider.openrouter.options.baseURL when the env is set", () => {
-    const config: Config = { model: "openrouter/google/gemini-3-flash-preview" };
-    applyOpenRouterBaseUrlOverride(config, { OPENROUTER_BASE_URL: GATEWAY });
-    expect(config.provider?.openrouter?.options?.baseURL).toBe(GATEWAY);
-  });
-
-  test("preserves existing provider config (e.g. reasoning model options)", () => {
-    const config: Config = {
-      model: "openrouter/google/gemini-3-flash-preview",
-      provider: {
-        openrouter: {
-          models: {
-            "google/gemini-3-flash-preview": { options: { reasoning: { effort: "low" } } },
-          },
-          options: { apiKey: "sk-keep" },
-        },
-        anthropic: { options: { apiKey: "sk-ant" } },
-      },
-    };
-    applyOpenRouterBaseUrlOverride(config, { OPENROUTER_BASE_URL: GATEWAY });
-    expect(config.provider?.openrouter?.options).toEqual({
-      apiKey: "sk-keep",
-      baseURL: GATEWAY,
-    });
-    expect(config.provider?.openrouter?.models).toEqual({
-      "google/gemini-3-flash-preview": { options: { reasoning: { effort: "low" } } },
+describe("getOpenRouterAttributionHeaders", () => {
+  test.each([
+    "https://openrouter.ai/api/v1",
+    "https://api.openrouter.ai/v1",
+  ])("attributes direct OpenRouter host %s", (url) => {
+    expect(getOpenRouterAttributionHeaders(url, {})).toEqual({
+      "HTTP-Referer": "https://agent-swarm.dev",
+      "X-OpenRouter-Title": "Agent Swarm",
+      "X-OpenRouter-Categories": "personal-agent,cloud-agent",
     });
-    expect(config.provider?.anthropic).toEqual({ options: { apiKey: "sk-ant" } });
+  });
+  test.each([
+    "http://localhost:1234/v1",
+    "https://evil-openrouter.ai",
+    "https://openrouter.ai.evil.com",
+    "invalid",
+  ])("does not attribute gateway, lookalike or invalid URL %s", (url) => {
+    expect(getOpenRouterAttributionHeaders(url, {})).toEqual({});
+  });
+  test.each(["false", "FALSE", "FaLsE", "0"])("honors opt-out %s", (value) => {
+    expect(
+      getOpenRouterAttributionHeaders("https://openrouter.ai", {
+        OPENROUTER_APP_ATTRIBUTION: value,
+      }),
+    ).toEqual({});
   });
 });

package/src/tests/pi-mono-extension.test.ts

@@ -1,5 +1,6 @@
 /**
- * Unit tests for `summarizeSessionForPi` in `src/providers/pi-mono-extension.ts`.
+ * Unit tests for `summarizeSessionForPi` in `src/providers/pi-mono-extension.ts`,
+ * plus the extension's advisory nudges (delivered with `pi.sendMessage`).
  *
  * Plan: thoughts/taras/plans/2026-05-10-fix-session-summarization-workers.md
  * → Phase 1 § "Test coverage"
@@ -19,8 +20,14 @@
  */
 
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { ExtensionAPI, ExtensionFactory } from "@earendil-works/pi-coding-agent";
+import { clearToolHistory } from "../hooks/tool-loop-detection";
 import type { SummarizeSessionForPiDeps, SwarmHooksConfig } from "../providers/pi-mono-extension";
-import { summarizeSessionForPi } from "../providers/pi-mono-extension";
+import {
+  createSwarmHooksExtension,
+  SWARM_NUDGE_CUSTOM_TYPE,
+  summarizeSessionForPi,
+} from "../providers/pi-mono-extension";
 
 // ── helpers ───────────────────────────────────────────────────────────────────
 
@@ -345,3 +352,155 @@ describe("summarizeSessionForPi", () => {
     expect(consoleErrors.length).toBe(0);
   });
 });
+
+describe("pi provider header attribution", () => {
+  test("uses request model URL and task env, replacing pi attribution", async () => {
+    let handler:
+      | ((event: { headers: Record<string, string> }, ctx: { model: { baseUrl: string } }) => void)
+      | undefined;
+    const pi = {
+      on: (event: string, callback: unknown) => {
+        if (event === "before_provider_headers") handler = callback as NonNullable<typeof handler>;
+      },
+    } as unknown as ExtensionAPI;
+    const config = { ...makeConfig(), env: {} as Record<string, string | undefined> };
+    await createSwarmHooksExtension(config)(pi);
+    expect(handler).toBeDefined();
+    const headers = {
+      "HTTP-Referer": "https://pi.dev",
+      "X-OpenRouter-Title": "pi",
+      "X-Custom": "keep",
+    };
+    handler!({ headers }, { model: { baseUrl: "https://openrouter.ai/api" } });
+    expect(headers).toEqual({
+      "HTTP-Referer": "https://agent-swarm.dev",
+      "X-OpenRouter-Title": "Agent Swarm",
+      "X-OpenRouter-Categories": "personal-agent,cloud-agent",
+      "X-Custom": "keep",
+    });
+    config.env.OPENROUTER_APP_ATTRIBUTION = "false";
+    const optedOut = { "X-Custom": "keep" };
+    handler!({ headers: optedOut }, { model: { baseUrl: "https://openrouter.ai/api" } });
+    expect(optedOut).toEqual({ "X-Custom": "keep" });
+    config.env = {};
+    const gateway = {};
+    handler!({ headers: gateway }, { model: { baseUrl: "http://localhost:1234/v1" } });
+    expect(gateway).toEqual({});
+  });
+});
+
+// ── advisory nudges reach the model via pi.sendMessage ───────────────────────
+
+type Handler = (event: unknown, ctx: unknown) => Promise<unknown> | unknown;
+type SentMessage = { customType: string; content: Array<{ type: string; text: string }> };
+
+/** Minimal stand-in for pi's ExtensionAPI: records handlers and sent messages. */
+function loadExtension(config: SwarmHooksConfig) {
+  const handlers = new Map<string, Handler>();
+  const sent: SentMessage[] = [];
+  const pi = {
+    on: (event: string, handler: Handler) => {
+      handlers.set(event, handler);
+    },
+    sendMessage: (message: SentMessage) => {
+      sent.push(message);
+    },
+    registerMcpServer: () => {},
+  };
+  createSwarmHooksExtension(config)(pi as unknown as Parameters<ExtensionFactory>[0]);
+  const ctx = { getContextUsage: () => undefined };
+  const fire = (event: string, payload: unknown = {}) => {
+    const handler = handlers.get(event);
+    if (!handler) throw new Error(`no handler for ${event}`);
+    return handler({ type: event, ...(payload as object) }, ctx);
+  };
+  const texts = () =>
+    sent.map((m) => {
+      expect(m.customType).toBe(SWARM_NUDGE_CUSTOM_TYPE);
+      return m.content.map((c) => c.text).join("");
+    });
+  return { fire, texts };
+}
+
+function jsonResponse(body: unknown): FetchHandlerResp {
+  return { ok: true, status: 200, text: async () => "", json: async () => body };
+}
+
+describe("createSwarmHooksExtension nudges", () => {
+  test("loop warning on tool_call is sent to the model", async () => {
+    const config = { ...makeConfig(), taskId: `task-pi-loop-${crypto.randomUUID()}` };
+    const { fire, texts } = loadExtension(config);
+    try {
+      for (let i = 0; i < 8; i++) {
+        const result = await fire("tool_call", { toolName: "bash", input: { command: "ls" } });
+        expect(result).toBeUndefined();
+      }
+      const warnings = texts().filter((t) => t.startsWith("Warning: "));
+      expect(warnings.length).toBe(1);
+      expect(warnings[0]).toContain("bash");
+    } finally {
+      await clearToolHistory(config.taskId);
+    }
+  });
+
+  test("lead send-task reminder on tool_result is sent to the model", async () => {
+    const { fire, texts } = loadExtension({ ...makeConfig(), isLead: true });
+    await fire("tool_result", { toolName: "mcp__agent-swarm__send-task", input: {} });
+    expect(texts()).toEqual([
+      "Task sent successfully. Monitor progress using the get-task-details tool periodically.",
+    ]);
+  });
+
+  test("lead concurrent context on session_start is sent to the model", async () => {
+    fetchHandler = async (url) =>
+      url.includes("/api/concurrent-context")
+        ? jsonResponse({
+            processingInboxMessages: [
+              { content: "deploy the thing", source: "slack", createdAt: "now" },
+            ],
+            recentTaskDelegations: [],
+            activeSwarmTasks: [],
+          })
+        : jsonResponse({});
+    const { fire, texts } = loadExtension({ ...makeConfig(), isLead: true });
+    await fire("session_start");
+    expect(texts().length).toBe(1);
+    expect(texts()[0]).toContain("=== CONCURRENT SESSION AWARENESS ===");
+    expect(texts()[0]).toContain("deploy the thing");
+  });
+
+  test("goal reminder is sent after compaction, not before every LLM call", async () => {
+    fetchHandler = async (url) =>
+      url.endsWith("/api/tasks/task-pi-1")
+        ? jsonResponse({ id: "task-pi-1", task: "ship the fix", progress: "tests green" })
+        : jsonResponse({});
+    const { fire, texts } = loadExtension(makeConfig());
+
+    await fire("context", { messages: [] });
+    expect(texts()).toEqual([]);
+
+    await fire("session_compact");
+    expect(texts()).toEqual([
+      [
+        "=== GOAL REMINDER (injected before context compaction) ===",
+        "Task ID: task-pi-1",
+        "Task: ship the fix",
+        "Current Progress: tests green",
+        "=== Continue working on this task after compaction ===",
+      ].join("\n"),
+    ]);
+  });
+
+  test("cancelled task on input skips the turn and leaves the nudge in the session", async () => {
+    fetchHandler = async (url) =>
+      url.includes("/cancelled-tasks")
+        ? jsonResponse({ cancelled: [{ id: "task-pi-1", failureReason: "lead stopped it" }] })
+        : jsonResponse({});
+    const { fire, texts } = loadExtension(makeConfig());
+    const result = await fire("input", { text: "go", source: "rpc" });
+    expect(result).toEqual({ action: "handled" });
+    expect(texts()).toEqual([
+      "🛑 TASK CANCELLED: lead stopped it. Stop working and use store-progress to acknowledge.",
+    ]);
+  });
+});

package/src/tests/pricing-refresh.test.ts

@@ -2,8 +2,9 @@ import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test
 import { unlink } from "node:fs/promises";
 import { closeDb, getActivePricingRow, getDbClient, getLogsByEventType, initDb } from "../be/db";
 import { getModelsCatalog, resetModelsCatalogForTests } from "../be/models-catalog";
-import type { ModelsDevCache } from "../be/modelsdev-cache";
+import { loadModelsDevCache, type ModelsDevCache } from "../be/modelsdev-cache";
 import { refreshPricingFromModelsDev } from "../be/pricing-refresh";
+import { buildModelsDevSeedRows, buildPricingSeedRows } from "../be/seed-pricing";
 
 const TEST_DB_PATH = "./test-pricing-refresh.sqlite";
 
@@ -201,6 +202,74 @@ describe("models.dev runtime pricing refresh", () => {
     expect(rows.map((row) => row.effective_from)).toEqual([2_000, 3_000]);
   });
 
+  test("refreshes when dated snapshots collapse onto one amp key at different prices", async () => {
+    // models.dev's live gpt-4o family. Amp strips the dated suffix, so all four
+    // land on amp|gpt-4o; the 2024-05-13 snapshot is priced higher. Its key
+    // comes first, as upstream serves it, so a first-wins builder would pick it.
+    const cache: ModelsDevCache = {
+      openai: {
+        models: {
+          "gpt-4o-2024-05-13": { cost: { input: 5, output: 15 } },
+          "gpt-4o": { cost: { input: 2.5, output: 10, cache_read: 1.25 } },
+          "gpt-4o-2024-08-06": { cost: { input: 2.5, output: 10, cache_read: 1.25 } },
+          "gpt-4o-2024-11-20": { cost: { input: 2.5, output: 10, cache_read: 1.25 } },
+        },
+      },
+    };
+
+    const result = await refreshPricingFromModelsDev({
+      now: 1_000,
+      fetchImpl: async () => responseFor(cache, '"etag-collapse"'),
+    });
+
+    expect(result.status).toBe("refreshed");
+    expect(await getLogsByEventType("pricing.refresh.failed")).toHaveLength(0);
+    // The undated alias wins every token class.
+    expect((await getActivePricingRow("amp", "gpt-4o", "input", 1_000))?.pricePerMillionUsd).toBe(
+      2.5,
+    );
+    expect((await getActivePricingRow("amp", "gpt-4o", "output", 1_000))?.pricePerMillionUsd).toBe(
+      10,
+    );
+    expect(
+      (await getActivePricingRow("amp", "gpt-4o", "cached_input", 1_000))?.pricePerMillionUsd,
+    ).toBe(1.25);
+    // Providers that keep the dated id still price each snapshot on its own.
+    expect(
+      (await getActivePricingRow("codex", "gpt-4o-2024-05-13", "input", 1_000))?.pricePerMillionUsd,
+    ).toBe(5);
+  });
+
+  test("picks the newest dated snapshot when no undated alias exists", () => {
+    const rows = buildModelsDevSeedRows({
+      openai: {
+        models: {
+          "gpt-x-2025-08-07": { cost: { input: 2, output: 8 } },
+          "gpt-x-2025-01-01": { cost: { input: 1, output: 4 } },
+        },
+      },
+    }).filter((row) => row.provider === "amp");
+
+    expect(rows).toEqual([
+      { provider: "amp", model: "gpt-x", tokenClass: "input", pricePerMillionUsd: 2 },
+      { provider: "amp", model: "gpt-x", tokenClass: "output", pricePerMillionUsd: 8 },
+    ]);
+  });
+
+  test("the vendored models.dev snapshot yields one row per (provider, model, tokenClass)", () => {
+    const cache = loadModelsDevCache();
+    expect(cache).not.toBeNull();
+    const rows = buildPricingSeedRows(cache);
+    const seen = new Set<string>();
+    const duplicates: string[] = [];
+    for (const row of rows) {
+      const key = `${row.provider}|${row.model}|${row.tokenClass}`;
+      if (seen.has(key)) duplicates.push(key);
+      seen.add(key);
+    }
+    expect(duplicates).toEqual([]);
+  });
+
   test("writes scrubbed audit log entries for successful refreshes", async () => {
     await refreshPricingFromModelsDev({
       now: 1_000,

package/src/tests/reasoning-effort.test.ts

@@ -305,7 +305,9 @@ describe("Claude CLI shortnames (the tier defaults) take effort like the model t
     expect(reasoningCapability("claude", "sonnet")).toEqual(
       reasoningCapability("claude", "claude-sonnet-5-5"),
     );
-    expect(reasoningCapability("claude", "haiku").levels).toContain("off");
+    expect(reasoningCapability("claude", "haiku")).toEqual(
+      reasoningCapability("claude", "claude-haiku-5-5"),
+    );
     expect(reasoningCapability("claude", "fable").supported).toBe(true);
   });
 

package/src/tests/schedule-target-type.test.ts

@@ -33,6 +33,7 @@ import {
   preflightAutomation,
   renderAutomationTokens,
 } from "../be/automation-preflight";
+import * as dbModule from "../be/db";
 import {
   closeDb,
   createAgent,
@@ -58,6 +59,7 @@ import {
   startScheduler,
   stopScheduler,
 } from "../scheduler/scheduler";
+import * as scriptLoader from "../scripts-runtime/loader";
 import type { Workflow, WorkflowDefinition } from "../types";
 import { InProcessEventBus } from "../workflows/event-bus";
 import { BaseExecutor, type ExecutorResult } from "../workflows/executors/base";
@@ -148,6 +150,38 @@ async function saveGlobalScript(name: string, source: string) {
   });
 }
 
+type ScheduleScriptRunRow = {
+  agentId: string;
+  scriptName: string;
+  source: string;
+  kind: string;
+  status: string;
+  output: string | null;
+  error: string | null;
+  finishedAt: string | null;
+};
+
+async function scriptRunsFor(scriptName: string): Promise<ScheduleScriptRunRow[]> {
+  return getDbClient().query<ScheduleScriptRunRow>(
+    "SELECT agentId, scriptName, source, kind, status, output, error, finishedAt FROM script_runs WHERE scriptName = ?",
+    [scriptName],
+  );
+}
+
+type RunScriptOutput = Awaited<ReturnType<typeof scriptLoader.runScript>>;
+
+function fakeRunOutput(overrides: Partial<RunScriptOutput>): RunScriptOutput {
+  return {
+    result: undefined,
+    stdout: "",
+    stderr: "",
+    exitCode: 0,
+    durationMs: 1,
+    truncated: { stdout: false, stderr: false },
+    ...overrides,
+  } as RunScriptOutput;
+}
+
 beforeAll(async () => {
   savedEnv = { ...process.env };
   await removeDbFiles();
@@ -718,6 +752,11 @@ describe("dispatchScheduleTarget — script target", () => {
     const result = await dispatchScheduleTarget(schedule);
     expect(result.triggeredWorkflows).toBe(false);
     expect(result.task).toBeUndefined();
+
+    const runs = await scriptRunsFor("schedule-target-type-echo");
+    expect(runs).toHaveLength(1);
+    expect(runs[0]?.status).toBe("completed");
+    expect(JSON.parse(runs[0]?.output ?? "null")).toEqual({ received: { hello: "world" } });
   }, 15_000);
 
   skip("scheduled script runs receive ctx.api and ctx.mcp connections", async () => {
@@ -794,9 +833,106 @@ describe("dispatchScheduleTarget — script target", () => {
     });
 
     await expect(dispatchScheduleTarget(schedule)).rejects.toThrow();
+
+    const runs = await scriptRunsFor("schedule-target-type-throws");
+    expect(runs).toHaveLength(1);
+    expect(runs[0]?.status).toBe("failed");
+    expect(runs[0]?.error).toContain("boom");
   }, 15_000);
 });
 
+describe("dispatchScheduleTarget — script target records a script_runs row", () => {
+  async function scheduleFor(scriptName: string) {
+    await saveGlobalScript(scriptName, `export default async () => ({ ok: true });`);
+    return createScheduledTask({
+      name: `record-${scriptName}`,
+      intervalMs: 60_000,
+      targetType: "script",
+      scriptName,
+      createdByAgentId: agentId,
+    });
+  }
+
+  test("a completed scheduled run writes a completed inline row that points at the script version", async () => {
+    const scriptName = `record-ok-${crypto.randomUUID()}`;
+    const schedule = await scheduleFor(scriptName);
+    const run = spyOn(scriptLoader, "runScript").mockResolvedValue(
+      fakeRunOutput({ result: { polled: 3 } }),
+    );
+    try {
+      await dispatchScheduleTarget(schedule);
+    } finally {
+      run.mockRestore();
+    }
+
+    const runs = await scriptRunsFor(scriptName);
+    expect(runs).toHaveLength(1);
+    const row = runs[0];
+    expect(row?.kind).toBe("inline");
+    expect(row?.status).toBe("completed");
+    expect(row?.agentId).toBe(agentId);
+    expect(row?.finishedAt).toBeTruthy();
+    expect(row?.error).toBeNull();
+    expect(JSON.parse(row?.output ?? "null")).toEqual({ polled: 3 });
+    expect(row?.source).toContain(`'${scriptName}' v1`);
+    expect(row?.source).toContain(`by schedule '${schedule.name}'`);
+    expect(row?.source).not.toContain("export default");
+  });
+
+  test("a failed scheduled run writes a failed row and still throws", async () => {
+    const scriptName = `record-fail-${crypto.randomUUID()}`;
+    const schedule = await scheduleFor(scriptName);
+    const run = spyOn(scriptLoader, "runScript").mockResolvedValue(
+      fakeRunOutput({ exitCode: 1, stderr: "upstream 503" }),
+    );
+    try {
+      await expect(dispatchScheduleTarget(schedule)).rejects.toThrow("upstream 503");
+    } finally {
+      run.mockRestore();
+    }
+
+    const runs = await scriptRunsFor(scriptName);
+    expect(runs).toHaveLength(1);
+    expect(runs[0]?.status).toBe("failed");
+    expect(runs[0]?.error).toBe("upstream 503");
+  });
+
+  test("a runtime that throws before returning writes a failed row and rethrows", async () => {
+    const scriptName = `record-throw-${crypto.randomUUID()}`;
+    const schedule = await scheduleFor(scriptName);
+    const run = spyOn(scriptLoader, "runScript").mockRejectedValue(new Error("spawn failed"));
+    try {
+      await expect(dispatchScheduleTarget(schedule)).rejects.toThrow("spawn failed");
+    } finally {
+      run.mockRestore();
+    }
+
+    const runs = await scriptRunsFor(scriptName);
+    expect(runs.map((r) => [r.status, r.error])).toEqual([["failed", "spawn failed"]]);
+  });
+
+  test("a persistence error changes neither outcome", async () => {
+    const scriptName = `record-dberr-${crypto.randomUUID()}`;
+    const schedule = await scheduleFor(scriptName);
+    const record = spyOn(dbModule, "recordInlineScriptRun").mockRejectedValue(
+      new Error("database is locked"),
+    );
+    const run = spyOn(scriptLoader, "runScript")
+      .mockResolvedValueOnce(fakeRunOutput({ result: { ok: true } }))
+      .mockResolvedValueOnce(fakeRunOutput({ exitCode: 1, stderr: "real failure" }));
+    try {
+      const result = await dispatchScheduleTarget(schedule);
+      expect(result.triggeredWorkflows).toBe(false);
+      await expect(dispatchScheduleTarget(schedule)).rejects.toThrow("real failure");
+      expect(record).toHaveBeenCalledTimes(2);
+    } finally {
+      run.mockRestore();
+      record.mockRestore();
+    }
+    expect(await scriptRunsFor(scriptName)).toHaveLength(0);
+  });
+});
+
 // ─── HTTP route cross-field validation ────────────────────────────────────────
 
 function makeHttpReq(

package/src/tests/script-connections-http.test.ts

@@ -254,6 +254,51 @@ describe("/api/script-connections HTTP", () => {
     expect(await res.json()).toEqual({ error: "Only the lead can manage script connections." });
   });
 
+  test("DELETE removes a connection, its managed binding, and its inline secret", async () => {
+    const created = await dispatch("/api/script-connections", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: {
+        kind: "openapi",
+        slug: "deleteHttpVendor",
+        baseUrl: "https://api.vendor.test",
+        allowedHosts: ["api.vendor.test"],
+        auth: { type: "bearer", secret: "example-http-delete-tok" },
+        openapiSpecJson: inlineOpenApiSpec(),
+      },
+    });
+    expect(created.status).toBe(200);
+    const { connection } = (await created.json()) as { connection: { id: string } };
+
+    const forbidden = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: workerAgentId,
+    });
+    expect(forbidden.status).toBe(403);
+
+    const res = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: leadAgentId,
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ deleted: true, id: connection.id });
+
+    const counts = await getDbClient().get<{ conns: number; bindings: number; secrets: number }>(
+      `SELECT
+         (SELECT COUNT(*) FROM script_connections WHERE id = ?) AS conns,
+         (SELECT COUNT(*) FROM script_credential_bindings WHERE managed_by_connection_id = ?) AS bindings,
+         (SELECT COUNT(*) FROM swarm_config WHERE key = 'connection.deleteHttpVendor.secret') AS secrets`,
+      [connection.id, connection.id],
+    );
+    expect(counts).toEqual({ conns: 0, bindings: 0, secrets: 0 });
+
+    const missing = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: leadAgentId,
+    });
+    expect(missing.status).toBe(404);
+  });
+
   test("list returns connections without secrets", async () => {
     await upsertSwarmConfig({
       scope: "global",

package/src/tests/script-connections-mcp.test.ts

@@ -907,3 +907,44 @@ describe("script MCP connections", () => {
     }
   });
 });
+
+describe("script-connections MCP delete", () => {
+  test("lead deletes a connection and its inline secret; unknown id and non-lead fail", async () => {
+    const lead = await createAgent({ name: "mcp-delete-lead", isLead: true, status: "idle" });
+    const worker = await createAgent({ name: "mcp-delete-worker", isLead: false, status: "idle" });
+    const connection = await upsertScriptConnection({
+      slug: "mcpDeleteVendor",
+      kind: "graphql",
+      baseUrl: "https://api.vendor.test/graphql",
+      allowedHosts: ["api.vendor.test"],
+      auth: { type: "bearer", secret: "example-mcp-delete-tok" },
+    });
+
+    const denied = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(worker.id),
+    )) as ToolResult;
+    expect(denied.structuredContent.success).toBe(false);
+    expect(await getScriptConnectionById(connection.id)).not.toBeNull();
+
+    const result = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(lead.id),
+    )) as ToolResult;
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.connections.map((c) => c.id)).not.toContain(connection.id);
+    expect(await getScriptConnectionById(connection.id)).toBeNull();
+    const secretRow = await getDbClient().get<{ key: string }>(
+      "SELECT key FROM swarm_config WHERE key = ?",
+      ["connection.mcpDeleteVendor.secret"],
+    );
+    expect(secretRow).toBeNull();
+
+    const again = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(lead.id),
+    )) as ToolResult;
+    expect(again.structuredContent.success).toBe(false);
+    expect(again.structuredContent.message).toContain("not found");
+  });
+});

package/src/tests/script-executor-registry.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { validateConfigValue } from "../be/swarm-config-guard";
 import { NativeScriptExecutor } from "../scripts-runtime/executors/native";
 import { QuickJSScriptExecutor } from "../scripts-runtime/executors/quickjs";
 import { getScriptExecutor } from "../scripts-runtime/executors/registry";
@@ -20,3 +21,20 @@ describe("getScriptExecutor", () => {
     expect(() => getScriptExecutor("e2b")).toThrow("Available: native, quickjs");
   });
 });
+
+describe("SCRIPT_EXECUTOR configuration", () => {
+  test("every accepted value resolves to its executor", () => {
+    for (const value of ["native", "quickjs", " native ", " quickjs "]) {
+      expect(validateConfigValue("SCRIPT_EXECUTOR", value)).toBeNull();
+      expect(getScriptExecutor(value).name).toBe(value.trim());
+    }
+  });
+
+  test("rejects unsupported names, blank values and non-string values", () => {
+    for (const value of ["e2b", "Native", "QUICKJS", "", " ", null, undefined, 1, true]) {
+      expect(validateConfigValue("SCRIPT_EXECUTOR", value)).toBe(
+        "Invalid SCRIPT_EXECUTOR value (must be one of: native, quickjs)",
+      );
+    }
+  });
+});