@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/src/tests/script-connections-http.test.ts

@@ -254,6 +254,51 @@ describe("/api/script-connections HTTP", () => {
     expect(await res.json()).toEqual({ error: "Only the lead can manage script connections." });
   });
 
+  test("DELETE removes a connection, its managed binding, and its inline secret", async () => {
+    const created = await dispatch("/api/script-connections", {
+      method: "POST",
+      agentId: leadAgentId,
+      body: {
+        kind: "openapi",
+        slug: "deleteHttpVendor",
+        baseUrl: "https://api.vendor.test",
+        allowedHosts: ["api.vendor.test"],
+        auth: { type: "bearer", secret: "example-http-delete-tok" },
+        openapiSpecJson: inlineOpenApiSpec(),
+      },
+    });
+    expect(created.status).toBe(200);
+    const { connection } = (await created.json()) as { connection: { id: string } };
+
+    const forbidden = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: workerAgentId,
+    });
+    expect(forbidden.status).toBe(403);
+
+    const res = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: leadAgentId,
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ deleted: true, id: connection.id });
+
+    const counts = await getDbClient().get<{ conns: number; bindings: number; secrets: number }>(
+      `SELECT
+         (SELECT COUNT(*) FROM script_connections WHERE id = ?) AS conns,
+         (SELECT COUNT(*) FROM script_credential_bindings WHERE managed_by_connection_id = ?) AS bindings,
+         (SELECT COUNT(*) FROM swarm_config WHERE key = 'connection.deleteHttpVendor.secret') AS secrets`,
+      [connection.id, connection.id],
+    );
+    expect(counts).toEqual({ conns: 0, bindings: 0, secrets: 0 });
+
+    const missing = await dispatch(`/api/script-connections/${connection.id}`, {
+      method: "DELETE",
+      agentId: leadAgentId,
+    });
+    expect(missing.status).toBe(404);
+  });
+
   test("list returns connections without secrets", async () => {
     await upsertSwarmConfig({
       scope: "global",

package/src/tests/script-connections-mcp.test.ts

@@ -907,3 +907,44 @@ describe("script MCP connections", () => {
     }
   });
 });
+
+describe("script-connections MCP delete", () => {
+  test("lead deletes a connection and its inline secret; unknown id and non-lead fail", async () => {
+    const lead = await createAgent({ name: "mcp-delete-lead", isLead: true, status: "idle" });
+    const worker = await createAgent({ name: "mcp-delete-worker", isLead: false, status: "idle" });
+    const connection = await upsertScriptConnection({
+      slug: "mcpDeleteVendor",
+      kind: "graphql",
+      baseUrl: "https://api.vendor.test/graphql",
+      allowedHosts: ["api.vendor.test"],
+      auth: { type: "bearer", secret: "example-mcp-delete-tok" },
+    });
+
+    const denied = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(worker.id),
+    )) as ToolResult;
+    expect(denied.structuredContent.success).toBe(false);
+    expect(await getScriptConnectionById(connection.id)).not.toBeNull();
+
+    const result = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(lead.id),
+    )) as ToolResult;
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.connections.map((c) => c.id)).not.toContain(connection.id);
+    expect(await getScriptConnectionById(connection.id)).toBeNull();
+    const secretRow = await getDbClient().get<{ key: string }>(
+      "SELECT key FROM swarm_config WHERE key = ?",
+      ["connection.mcpDeleteVendor.secret"],
+    );
+    expect(secretRow).toBeNull();
+
+    const again = (await scriptConnectionsTool().handler(
+      { action: "delete", id: connection.id },
+      meta(lead.id),
+    )) as ToolResult;
+    expect(again.structuredContent.success).toBe(false);
+    expect(again.structuredContent.message).toContain("not found");
+  });
+});

package/src/tests/script-connections.test.ts

@@ -615,6 +615,8 @@ describe("script connections", () => {
       markMigrationApplied(database, "201_workflow_replay_columns.sql");
       // 202 moves rows out of kv_entries, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "202_codex_oauth_device_flows.sql");
+      // 203 alters workflow_runs, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "203_workflow_run_parent_step.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-executor-quickjs-pool.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, test } from "bun:test";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
+
+// Each child gets a fresh shared pool. Hold host calls open so queued runs
+// cannot reuse an idle worker and hide the configured concurrency limit.
+const probe = `
+import { QuickJSScriptExecutor, quickJSWorkerCount } from "./src/scripts-runtime/executors/quickjs";
+import { DEFAULT_SCRIPT_RESOURCES } from "./src/scripts-runtime/executors/types";
+let release;
+const gate = new Promise(resolve => { release = resolve; });
+let started = 0;
+let inFlight = 0;
+let peak = 0;
+const server = Bun.serve({ port: 0, async fetch() {
+  started++;
+  peak = Math.max(peak, ++inFlight);
+  await gate;
+  inFlight--;
+  return new Response("ok");
+}});
+try {
+  const executor = new QuickJSScriptExecutor();
+  const input = {
+    source: 'export default async (args) => (await fetch(args.url)).text();',
+    args: { url: "http://127.0.0.1:" + server.port },
+    configPayload: { system: {
+      apiKey: { value: "pool-test", isSecret: true },
+      agentId: { value: crypto.randomUUID(), isSecret: false },
+      mcpBaseUrl: { value: "http://127.0.0.1:" + server.port, isSecret: false },
+    }, user: {} },
+    resources: DEFAULT_SCRIPT_RESOURCES,
+    fsMode: "none", network: "open",
+  };
+  const jobs = Array.from({ length: 10 }, () => executor.run(input));
+  const workers = quickJSWorkerCount();
+  const deadline = Date.now() + 10_000;
+  while (started < workers && Date.now() < deadline) await Bun.sleep(10);
+  const heldPeak = peak;
+  release();
+  const outputs = await Promise.all(jobs);
+  process.env.SCRIPT_QUICKJS_POOL_SIZE = "16";
+  const later = await executor.run(input);
+  console.log(JSON.stringify({ workers, heldPeak, results: outputs.map(o => o.result),
+    errors: outputs.map(o => o.error), stderr: outputs[0].stderr,
+    retainedWorkers: quickJSWorkerCount(), laterResult: later.result }));
+} finally {
+  release();
+  server.stop(true);
+}
+`;
+
+async function inspectPool(size?: string) {
+  const env = { ...process.env };
+  if (size === undefined) delete env.SCRIPT_QUICKJS_POOL_SIZE;
+  else env.SCRIPT_QUICKJS_POOL_SIZE = size;
+  const result = expectChildOk(
+    await runChild([process.execPath, "--eval", probe], { env }),
+    "QuickJS pool probe",
+  );
+  return JSON.parse(result.stdout.trim()) as {
+    workers: number;
+    heldPeak: number;
+    results: string[];
+    errors: Array<string | null>;
+    stderr: string;
+    retainedWorkers: number;
+    laterResult: string;
+  };
+}
+
+describe("QuickJS pool configuration", () => {
+  for (const [size, expected] of [
+    [undefined, 4],
+    ["1", 1],
+    ["2", 2],
+    ["8", 8],
+  ] as const) {
+    test(
+      `pool size ${size ?? "unset"} controls workers and queues excess runs`,
+      async () => {
+        const result = await inspectPool(size);
+        expect(result.workers).toBe(expected);
+        expect(result.heldPeak).toBe(expected);
+        expect(result.results).toEqual(Array(10).fill("ok"));
+        expect(result.errors).toEqual(Array(10).fill(null));
+        expect(result.retainedWorkers).toBe(expected);
+        expect(result.laterResult).toBe("ok");
+      },
+      CHILD_PROCESS_TEST_BUDGET_MS,
+    );
+  }
+
+  for (const size of ["0", "33"]) {
+    test(
+      `invalid pool size ${size} fails before spawning workers`,
+      async () => {
+        const result = await inspectPool(size);
+        expect(result.workers).toBe(0);
+        expect(result.errors).toEqual(Array(10).fill("executor_error"));
+        expect(result.stderr).toContain("SCRIPT_QUICKJS_POOL_SIZE");
+        expect(result.stderr).toContain("integer between 1 and 32");
+      },
+      CHILD_PROCESS_TEST_BUDGET_MS,
+    );
+  }
+});

package/src/tests/script-executor-registry.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, test } from "bun:test";
+import { validateConfigValue } from "../be/swarm-config-guard";
 import { NativeScriptExecutor } from "../scripts-runtime/executors/native";
 import { QuickJSScriptExecutor } from "../scripts-runtime/executors/quickjs";
+import { resolveQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-pool-config";
 import { getScriptExecutor } from "../scripts-runtime/executors/registry";
 
 describe("getScriptExecutor", () => {
@@ -20,3 +22,57 @@ describe("getScriptExecutor", () => {
     expect(() => getScriptExecutor("e2b")).toThrow("Available: native, quickjs");
   });
 });
+
+describe("SCRIPT_EXECUTOR configuration", () => {
+  test("every accepted value resolves to its executor", () => {
+    for (const value of ["native", "quickjs", " native ", " quickjs "]) {
+      expect(validateConfigValue("SCRIPT_EXECUTOR", value)).toBeNull();
+      expect(getScriptExecutor(value).name).toBe(value.trim());
+    }
+  });
+
+  test("rejects unsupported names, blank values and non-string values", () => {
+    for (const value of ["e2b", "Native", "QUICKJS", "", " ", null, undefined, 1, true]) {
+      expect(validateConfigValue("SCRIPT_EXECUTOR", value)).toBe(
+        "Invalid SCRIPT_EXECUTOR value (must be one of: native, quickjs)",
+      );
+    }
+  });
+});
+
+describe("SCRIPT_QUICKJS_POOL_SIZE configuration", () => {
+  test("defaults to four and accepts bounded whole numbers", () => {
+    expect(resolveQuickJSPoolSize(undefined)).toBe(4);
+    for (const value of ["1", "4", "32", " 2 ", 1, 32]) {
+      expect(validateConfigValue("SCRIPT_QUICKJS_POOL_SIZE", value)).toBeNull();
+      expect(resolveQuickJSPoolSize(String(value))).toBe(Number(value));
+    }
+  });
+
+  test("config writes and deployment env reject invalid sizes", () => {
+    for (const value of [
+      0,
+      33,
+      1.5,
+      "0",
+      "33",
+      "1.5",
+      "1e1",
+      "0x10",
+      "NaN",
+      "",
+      " ",
+      "99999999999999999",
+    ]) {
+      expect(validateConfigValue("SCRIPT_QUICKJS_POOL_SIZE", value)).toContain(
+        "integer between 1 and 32",
+      );
+      expect(() => resolveQuickJSPoolSize(String(value))).toThrow("integer between 1 and 32");
+    }
+    for (const value of [null, undefined, true, [2], {}, { toString: null }]) {
+      expect(validateConfigValue("SCRIPT_QUICKJS_POOL_SIZE", value)).toContain(
+        "integer between 1 and 32",
+      );
+    }
+  });
+});

package/src/tests/send-task-self-send.test.ts

@@ -0,0 +1,107 @@
+// send-task refuses an agent session that targets itself, but a script runs as its owner (a
+// scheduled script as the schedule's creator), so a Lead-owned script must be able to file
+// work for the Lead. Script calls reach the tool through /api/mcp-bridge as `script-sdk`.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlinkSync } from "node:fs";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, createAgent, getDbClient, initDb } from "../be/db";
+import { handleMcpBridge } from "../http/mcp-bridge";
+import { getPathSegments } from "../http/utils";
+import { sendTaskHandler } from "../tools/send-task";
+import { ownerCtx } from "../tools/task-tool-ctx";
+import { getRequestInfo } from "../tools/utils";
+
+const TEST_DB_PATH = "./test-send-task-self-send.sqlite";
+
+let server: Server;
+let baseUrl: string;
+let leadId = "";
+
+const selfSendArgs = (agentId: string) => ({
+  task: "x mention to triage",
+  agentId,
+  routingReason: "skill" as const,
+  routingNote: "Lead triages mentions itself",
+  offerMode: false,
+  allowDuplicate: true,
+});
+
+async function tasksFor(agentId: string): Promise<number> {
+  return (await getDbClient().get<{ c: number }>(
+    "SELECT COUNT(*) AS c FROM agent_tasks WHERE agentId = ?",
+    [agentId],
+  ))!.c;
+}
+
+beforeAll(async () => {
+  initDb(TEST_DB_PATH);
+  leadId = (
+    await createAgent({ name: "self-send-lead", isLead: true, status: "idle", maxTasks: 5 })
+  ).id;
+  server = createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    const ok = await handleMcpBridge(
+      req,
+      res,
+      getPathSegments(req.url || ""),
+      undefined,
+      myAgentId,
+    );
+    if (!ok) {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  });
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const addr = server.address();
+  if (!addr || typeof addr === "string") throw new Error("no port");
+  baseUrl = `http://127.0.0.1:${addr.port}`;
+});
+
+afterAll(() => {
+  server.close();
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      unlinkSync(TEST_DB_PATH + suffix);
+    } catch {
+      // ignore
+    }
+  }
+});
+
+describe("send-task self-send guard", () => {
+  test("a script sending a task to its own agent succeeds", async () => {
+    const before = await tasksFor(leadId);
+    const res = await fetch(`${baseUrl}/api/mcp-bridge`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "x-agent-id": leadId },
+      body: JSON.stringify({ tool: "send-task", args: selfSendArgs(leadId) }),
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { success?: boolean; message?: string };
+    expect(body.message).not.toContain("Cannot send a task to yourself");
+    expect(body.success).toBe(true);
+    expect(await tasksFor(leadId)).toBe(before + 1);
+  });
+
+  test("an agent session sending a task to itself is still refused", async () => {
+    const before = await tasksFor(leadId);
+    // An MCP session's meta carries no origin mark, so getRequestInfo reports `mcp`.
+    const info = getRequestInfo({
+      sessionId: "session-1",
+      requestInfo: { headers: { "x-agent-id": leadId } },
+    } as unknown as Parameters<typeof getRequestInfo>[0]);
+    expect(info.callOrigin).toBe("mcp");
+    const result = await sendTaskHandler(ownerCtx(info), selfSendArgs(leadId));
+    expect(result.ok).toBe(false);
+    expect(result.message).toContain("Cannot send a task to yourself");
+    expect(await tasksFor(leadId)).toBe(before);
+  });
+});

package/src/tests/slack-inbound-diagnostics-auth.test.ts

@@ -0,0 +1,93 @@
+/**
+ * GET /api/slack/inbound/diagnostics is operator-only. `auth.apiKey` admits
+ * user `aswt_` tokens and verb-less GETs pass RBAC admission, so the handler
+ * gates on the principal kind. Runs the real handleCore auth path.
+ */
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, createUser, initDb } from "../be/db";
+import { ensureRbacSeedsSynced } from "../be/rbac-roles";
+import { type IdentityActor, mintToken } from "../be/users";
+import { handleCore } from "../http/core";
+import { handleSlackInbound } from "../http/slack-inbound";
+import { getPathSegments } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+const TEST_DB_PATH = "./test-slack-inbound-diagnostics-auth.sqlite";
+const API_KEY = "example-test-api-key";
+const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
+const PATH = "/api/slack/inbound/diagnostics";
+
+let server: Server;
+let port = 0;
+let savedRbac: string | undefined;
+
+async function removeDbFiles() {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(TEST_DB_PATH + suffix);
+    } catch {
+      // File does not exist.
+    }
+  }
+}
+
+async function get(bearer: string): Promise<{ status: number; body: unknown }> {
+  const res = await fetch(`http://localhost:${port}${PATH}`, {
+    headers: { Authorization: `Bearer ${bearer}` },
+  });
+  return { status: res.status, body: await res.json() };
+}
+
+beforeAll(async () => {
+  savedRbac = process.env.RBAC_ENABLED;
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  ensureRbacSeedsSynced({ quiet: true });
+  server = createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    if (await handleCore(req, res, undefined, API_KEY)) return;
+    if (await handleSlackInbound(req, res, getPathSegments(req.url || ""))) return;
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Not Found" }));
+  });
+  port = await listenOnFreePort(server);
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+  await removeDbFiles();
+  if (savedRbac === undefined) delete process.env.RBAC_ENABLED;
+  else process.env.RBAC_ENABLED = savedRbac;
+});
+
+describe("GET /api/slack/inbound/diagnostics authorization", () => {
+  test("operator key reads diagnostics", async () => {
+    const res = await get(API_KEY);
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveProperty("receipts.counts");
+  });
+
+  test("active user token is refused with 403 whether RBAC admission is on or off", async () => {
+    const user = await createUser({ name: "Diagnostics User" });
+    const { plaintext } = await mintToken(user.id, "diagnostics", ACTOR);
+
+    for (const flag of ["true", "false"]) {
+      process.env.RBAC_ENABLED = flag;
+      const res = await get(plaintext);
+      expect(res.status).toBe(403);
+      expect(res.body).toEqual({ error: "Operator access required" });
+    }
+  });
+
+  test("unknown bearer is refused with 401", async () => {
+    const res = await get("aswt_not-a-real-token");
+    expect(res.status).toBe(401);
+  });
+});