@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/tests/scripts-http.test.ts

@@ -3,7 +3,7 @@ import { unlink } from "node:fs/promises";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { Readable } from "node:stream";
 import { createApp } from "../apps/store";
-import { closeDb, createAgent, getDbClient, initDb } from "../be/db";
+import { closeDb, createAgent, getDbClient, initDb, upsertSwarmConfig } from "../be/db";
 import { getScript, listScripts } from "../be/scripts/db";
 import { setScriptEmbeddingProviderForTests } from "../be/scripts/embeddings";
 import { configSecretName, registerStoredSecret } from "../be/secret-registry";
@@ -16,6 +16,7 @@ import {
 } from "../utils/secret-scrubber";
 import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
 import { randomToken } from "./synthetic-secret-helpers";
+import { CHILD_PROCESS_TEST_BUDGET_MS } from "./test-proc";
 
 const skip = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
 
@@ -737,3 +738,202 @@ describe("script source with an embedded secret is refused at write", () => {
     expect(response.status).toBe(200);
   });
 });
+
+// Regression: ctx.swarm.config.get used to return undefined for every key,
+// because no run entry point filled the payload's user config. These go
+// through the real POST /api/scripts/run route, not an injected payload.
+describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
+  const secretValue = `cfg-secret-${randomToken(32)}`;
+  // Under the global scrubber's 12-char floor, so only the run's own
+  // output boundary can redact it.
+  const shortSecretValue = randomToken(10);
+  const readerSource = `
+    import type { ScriptContext } from "swarm-sdk";
+    export default async (_args: unknown, ctx: ScriptContext) => {
+      const read = (key: string) => {
+        const value = ctx.swarm.config.get(key);
+        return value === undefined ? null : ctx.stdlib.Redacted.value(value);
+      };
+      const secret = ctx.swarm.config.get("SCRIPT_CFG_SECRET");
+      console.log("secret:", secret === undefined ? "missing" : ctx.stdlib.Redacted.value(secret));
+      return {
+        plain: read("SCRIPT_CFG_PLAIN"),
+        override: read("SCRIPT_CFG_OVERRIDE"),
+        // Compare by shape: the literal value in source would be refused at write.
+        secretMatches:
+          secret !== undefined &&
+          ctx.stdlib.Redacted.value(secret).startsWith("cfg-secret-") &&
+          ctx.stdlib.Redacted.value(secret).length === ${secretValue.length},
+        secretIsSecret: secret !== undefined && ctx.stdlib.Redacted.isSecret(secret),
+        secretStringified: String(secret),
+        missingIsUndefined: ctx.swarm.config.get("SCRIPT_CFG_NOT_SET") === undefined,
+        fallback: read("SCRIPT_CFG_NOT_SET") ?? "fallback",
+        apiOnly: read("SLACK_SIGNING_SECRET"),
+        proto: read("__proto__"),
+      };
+    };`;
+
+  type Reader = {
+    plain: string | null;
+    override: string | null;
+    secretMatches: boolean;
+    secretIsSecret: boolean;
+    secretStringified: string;
+    missingIsUndefined: boolean;
+    fallback: string;
+    apiOnly: string | null;
+    proto: string | null;
+  };
+
+  beforeAll(async () => {
+    await upsertSwarmConfig({ scope: "global", key: "SCRIPT_CFG_PLAIN", value: "plain-global" });
+    await upsertSwarmConfig({ scope: "global", key: "SCRIPT_CFG_OVERRIDE", value: "from-global" });
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: workerId,
+      key: "SCRIPT_CFG_OVERRIDE",
+      value: "from-worker",
+    });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "SCRIPT_CFG_SECRET",
+      value: secretValue,
+      isSecret: true,
+    });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "SCRIPT_CFG_SHORT_SECRET",
+      value: shortSecretValue,
+      isSecret: true,
+    });
+    await upsertSwarmConfig({ scope: "global", key: "__proto__", value: "proto-global" });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "SLACK_SIGNING_SECRET",
+      value: `signing-${randomToken(24)}`,
+      isSecret: true,
+    });
+  });
+
+  afterAll(async () => {
+    await getDbClient().run(
+      "DELETE FROM swarm_config WHERE key LIKE 'SCRIPT_CFG_%' OR key IN ('SLACK_SIGNING_SECRET', '__proto__')",
+    );
+    clearVolatileSecretsForTesting();
+  });
+
+  async function run(body: Record<string, unknown>, agentId: string) {
+    const response = await dispatch("/api/scripts/run", {
+      method: "POST",
+      agentId,
+      body: JSON.stringify(body),
+    });
+    expect(response.status).toBe(200);
+    return (await response.json()) as { result: Reader; stdout: string; error?: string };
+  }
+
+  skip(
+    "inline run reads existing keys, agent scope over global, and undefined for a missing key",
+    async () => {
+      const out = await run({ source: readerSource, intent: "config get regression" }, workerId);
+      expect(out.error).toBeUndefined();
+      expect(out.result).toEqual({
+        plain: "plain-global",
+        override: "from-worker",
+        secretMatches: true,
+        secretIsSecret: true,
+        secretStringified: "<redacted>",
+        missingIsUndefined: true,
+        fallback: "fallback",
+        apiOnly: null,
+        proto: "proto-global",
+      });
+      // The unwrapped secret is scrubbed from everything the run returns.
+      expect(out.stdout).toContain("secret:");
+      expect(JSON.stringify(out)).not.toContain(secretValue);
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  skip(
+    "named run resolves config for the invoking agent",
+    async () => {
+      expect((await upsert({ name: "config-reader", source: readerSource }, leadId)).status).toBe(
+        200,
+      );
+      const out = await run({ name: "config-reader" }, leadId);
+      expect(out.error).toBeUndefined();
+      // The worker's agent-scope override does not leak to another agent.
+      expect(out.result.override).toBe("from-global");
+      expect(out.result.plain).toBe("plain-global");
+      expect(out.result.secretMatches).toBe(true);
+      expect(out.result.missingIsUndefined).toBe(true);
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  skip(
+    "a short secret the run read stays out of stdout, result and the stored run row",
+    async () => {
+      // No `secret:` label in the log line: that prefix triggers structural
+      // masking and would hide a missing value-level redaction.
+      const source = `
+      import type { ScriptContext } from "swarm-sdk";
+      export default async (_args: unknown, ctx: ScriptContext) => {
+        const raw = ctx.stdlib.Redacted.value(ctx.swarm.config.get("SCRIPT_CFG_SHORT_SECRET")!);
+        console.log("read:", raw);
+        return { leaked: raw, length: raw.length, [raw]: "as-key" };
+      };`;
+      const response = await dispatch("/api/scripts/run", {
+        method: "POST",
+        agentId: workerId,
+        body: JSON.stringify({ source, intent: "short config secret redaction" }),
+      });
+      expect(response.status).toBe(200);
+      const out = (await response.json()) as {
+        result: Record<string, unknown>;
+        stdout: string;
+        error?: string;
+      };
+      expect(out.error).toBeUndefined();
+      // The script really read the value: only its rendering is redacted.
+      expect(out.result.length).toBe(shortSecretValue.length);
+      expect(out.stdout).toContain("read: [REDACTED:config:SCRIPT_CFG_SHORT_SECRET]");
+      expect(out.stdout).not.toContain(shortSecretValue);
+      expect(out.result.leaked).toBe("[REDACTED:config:SCRIPT_CFG_SHORT_SECRET]");
+      expect(JSON.stringify(out.result)).not.toContain(shortSecretValue);
+
+      const row = await getDbClient().get<{ output: string | null }>(
+        "SELECT output FROM script_runs WHERE agentId = ? AND source = ?",
+        [workerId, source],
+      );
+      expect(row?.output).toBeTruthy();
+      expect(row?.output).toContain("[REDACTED:config:SCRIPT_CFG_SHORT_SECRET]");
+      expect(row?.output).not.toContain(shortSecretValue);
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
+  test("an import rejection quoting a short secret stays out of stderr and the stored run row", async () => {
+    // The import check returns before any process spawns, so its diagnostic
+    // needs the run-local scrub too.
+    const source = `import nope from "${shortSecretValue}"; export default async () => nope;`;
+    const response = await dispatch("/api/scripts/run", {
+      method: "POST",
+      agentId: workerId,
+      body: JSON.stringify({ source, intent: "short config secret in import diagnostic" }),
+    });
+    expect(response.status).toBe(200);
+    const out = (await response.json()) as { stderr: string; error?: string };
+    expect(out.error).toBe("import_violation");
+    expect(out.stderr).toContain("[REDACTED:config:SCRIPT_CFG_SHORT_SECRET]");
+    expect(out.stderr).not.toContain(shortSecretValue);
+
+    const row = await getDbClient().get<{ error: string | null }>(
+      "SELECT error FROM script_runs WHERE agentId = ? AND source = ?",
+      [workerId, source],
+    );
+    expect(row?.error).toBeTruthy();
+    expect(row?.error).not.toContain(shortSecretValue);
+  });
+});

package/src/tests/scripts-only-gating.test.ts

@@ -10,7 +10,7 @@ import type { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/se
 import { closeDb, createAgent, getDbClient, initDb, upsertSwarmConfig } from "../be/db";
 import { _resetAutoReloadForTests, flushPendingIntegrationsReload } from "../http/core";
 import { handleMcp } from "../http/mcp";
-import { getBasePrompt } from "../prompts/base-prompt";
+import { getBasePrompt, getTaskContextPrompt } from "../prompts/base-prompt";
 import { createServer } from "../server";
 import { resolveScriptsOnlyMode } from "../utils/scripts-only-mode";
 import { listenOnFreePort } from "./test-net";
@@ -371,9 +371,8 @@ describe("scripts-only prompt gating", () => {
   });
 
   test("uses the scripts-only Slack variant for Slack-originated tasks", async () => {
-    const prompt = await getBasePrompt({
+    const prompt = await getTaskContextPrompt({
       role: "worker",
-      agentId: "scripts-only-slack-agent",
       scriptsOnly: true,
       slackContext: { channelId: "C123", threadTs: "123.456" },
     });

package/src/tests/scripts-runtime.test.ts

@@ -96,54 +96,72 @@ describe("runScript", () => {
     expect(output.result).toEqual({ status: 200, parsed: { ok: true } });
   });
 
-  spawnTest("ctx.swarm bridge round-trips kv_set then kv_get", async () => {
-    const entries = new Map<string, unknown>();
-    const server = Bun.serve({
-      port: 0,
-      async fetch(req) {
-        expect(req.headers.get("authorization")).toBe(
-          "Bearer example-runtime-test-secret-1234567890",
-        );
-        expect(req.headers.get("x-agent-id")).toBe("agent-1");
+  spawnTest(
+    "ctx.swarm bridge respects URL overrides and PORT fallback",
+    async () => {
+      const entries = new Map<string, unknown>();
+      const agentId = crypto.randomUUID();
+      const server = Bun.serve({
+        hostname: "localhost",
+        port: 0,
+        async fetch(req) {
+          expect(req.headers.get("authorization")).toBe(
+            "Bearer example-runtime-test-secret-1234567890",
+          );
+          expect(req.headers.get("x-agent-id")).toBe(agentId);
+
+          const url = new URL(req.url);
+          if (req.method === "PUT" && url.pathname.startsWith("/api/kv/")) {
+            const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
+            const body = (await req.json()) as { value: unknown };
+            entries.set(key, body.value);
+            return Response.json({ key, value: body.value });
+          }
+          if (req.method === "GET" && url.pathname.startsWith("/api/kv/")) {
+            const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
+            return Response.json({ key, value: entries.get(key) ?? null });
+          }
+          return Response.json({ error: "not found" }, { status: 404 });
+        },
+      });
 
-        const url = new URL(req.url);
-        if (req.method === "PUT" && url.pathname.startsWith("/api/kv/")) {
-          const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
-          const body = (await req.json()) as { value: unknown };
-          entries.set(key, body.value);
-          return Response.json({ key, value: body.value });
-        }
-        if (req.method === "GET" && url.pathname.startsWith("/api/kv/")) {
-          const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
-          return Response.json({ key, value: entries.get(key) ?? null });
-        }
-        return Response.json({ error: "not found" }, { status: 404 });
-      },
-    });
+      try {
+        const baseUrl = `http://localhost:${server.port}`;
+        for (const urlSource of ["input", "MCP_BASE_URL", "PORT"] as const) {
+          delete process.env.PORT;
+          process.env.MCP_BASE_URL = "http://unused.invalid";
+          if (urlSource === "MCP_BASE_URL") {
+            process.env.MCP_BASE_URL = baseUrl;
+          } else if (urlSource === "PORT") {
+            delete process.env.MCP_BASE_URL;
+            process.env.PORT = String(server.port);
+          }
 
-    try {
-      const output = await runScript({
-        agentId: "agent-1",
-        mcpBaseUrl: `http://127.0.0.1:${server.port}`,
-        resources,
-        source: `
+          const output = await runScript({
+            agentId,
+            mcpBaseUrl: urlSource === "input" ? baseUrl : undefined,
+            resources,
+            source: `
           export default async (_args, ctx) => {
             await ctx.swarm.kv_set({ key: "bridge-smoke", value: { ok: true } });
             return await ctx.swarm.kv_get({ key: "bridge-smoke" });
           };
         `,
-      });
+          });
 
-      expect(output.error).toBeUndefined();
-      expect(output.result).toEqual({
-        success: true,
-        status: 200,
-        data: { key: "bridge-smoke", value: { ok: true } },
-      });
-    } finally {
-      server.stop(true);
-    }
-  });
+          expect(output.error, `${urlSource}: ${output.stderr}`).toBeUndefined();
+          expect(output.result, urlSource).toEqual({
+            success: true,
+            status: 200,
+            data: { key: "bridge-smoke", value: { ok: true } },
+          });
+        }
+      } finally {
+        server.stop(true);
+      }
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
 
   spawnTest("ctx.swarm.kv_get forwards path/offset/limit as a view query", async () => {
     const seen: string[] = [];

package/src/tests/secret-scrubber.test.ts

@@ -1,10 +1,14 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { openAICompatibleKeyVars } from "@desplega/model-catalog";
 import {
   clearVolatileSecretsForTesting,
+  createValueScrubber,
   isSensitiveKey,
   refreshSecretScrubberCache,
+  registerEnvSecrets,
   registerSensitiveKeyName,
   registerVolatileSecret,
+  SCRUBBER_RULES_VERSION,
   scrubObject,
   scrubSecrets,
   unregisterVolatileSecret,
@@ -77,6 +81,33 @@ describe("scrubSecrets — env-based replacement", () => {
     expect(out).toBe("key=[REDACTED:FOO_SERVICE_API_KEY] tail");
   });
 
+  test("redacts NaN and Helmcode keys, including the suffix-less HELMCODE_API_NAN alias", () => {
+    const values = {
+      NAN_API_KEY: `example-nan-${randomToken(24)}`,
+      HELMCODE_API_NAN: `example-nanalias-${randomToken(24)}`,
+      HELMCODE_API_KEY: `example-helm-${randomToken(24)}`,
+    };
+    for (const [name, value] of Object.entries(values)) process.env[name] = value;
+    refreshSecretScrubberCache();
+    for (const [name, value] of Object.entries(values)) {
+      expect(isSensitiveKey(name)).toBe(true);
+      expect(scrubSecrets(`Bearer ${value} tail`)).toBe(`Bearer [REDACTED:${name}] tail`);
+    }
+  });
+
+  test("the registry key vars are pinned to SCRUBBER_RULES_VERSION", () => {
+    // Every registry key var is an exact sensitive key, so a new registry
+    // entry changes the rules: bump SCRUBBER_RULES_VERSION (the boot sweep
+    // re-redacts stored rows once per version), then update this pin.
+    expect({
+      version: SCRUBBER_RULES_VERSION,
+      keyVars: [...openAICompatibleKeyVars()].sort(),
+    }).toEqual({
+      version: 8,
+      keyVars: ["AI_GATEWAY_API_KEY", "HELMCODE_API_KEY", "HELMCODE_API_NAN", "NAN_API_KEY"],
+    });
+  });
+
   test("redacts any key with _TOKEN suffix", () => {
     process.env.WEIRD_SERVICE_TOKEN = "example-weirdserviceTOKENvalue_1234567890";
     refreshSecretScrubberCache();
@@ -390,6 +421,23 @@ describe("registerVolatileSecret", () => {
     expect(out).not.toContain(secret);
   });
 
+  test("registerEnvSecrets covers a per-task env that never reached process.env", () => {
+    const picked = `opaque${randomToken(20)}`;
+    const member = `opaque${randomToken(20)}`;
+    const env = {
+      HELMCODE_API_KEY: picked,
+      HELMCODE_API_NAN: `${member},opaque${randomToken(20)}`,
+      HELMCODE_BASE_URL: "http://127.0.0.1:9/v1",
+    };
+    expect(process.env.HELMCODE_API_KEY).not.toBe(picked);
+    expect(scrubSecrets(`echo ${picked}`)).toContain(picked);
+    registerEnvSecrets(env);
+    expect(scrubSecrets(`echo ${picked}`)).toBe("echo [REDACTED:HELMCODE_API_KEY]");
+    expect(scrubSecrets(`echo ${member}`)).toBe("echo [REDACTED:HELMCODE_API_NAN]");
+    // A non-secret key stays readable.
+    expect(scrubSecrets("http://127.0.0.1:9/v1")).toBe("http://127.0.0.1:9/v1");
+  });
+
   test("ignores values shorter than the minimum length", () => {
     registerVolatileSecret("short", "TOO_SHORT");
     const out = scrubSecrets("contains short somewhere");
@@ -889,3 +937,41 @@ describe("scrubSecrets — over-redaction guards", () => {
     { retry: 2 },
   );
 });
+
+describe("createValueScrubber (per-run exact values)", () => {
+  test("redacts values under the global floor without registering them swarm-wide", () => {
+    const short = randomToken(5);
+    const scrub = createValueScrubber([{ value: short, name: "config:SHORT" }]);
+    expect(scrub.text(`got ${short}!`)).toBe("got [REDACTED:config:SHORT]!");
+    expect(scrubSecrets(`got ${short}!`)).toBe(`got ${short}!`);
+  });
+
+  test("a one-char value is redacted everywhere in the run's output", () => {
+    const scrub = createValueScrubber([{ value: "x", name: "config:ONE" }]);
+    expect(scrub.text("x+x")).toBe("[REDACTED:config:ONE]+[REDACTED:config:ONE]");
+  });
+
+  test("one pass, longest first: a marker is never rewritten by another value", () => {
+    const scrub = createValueScrubber([
+      { value: "RED", name: "config:A" },
+      { value: "REDACT", name: "config:B" },
+    ]);
+    expect(scrub.text("RED REDACT")).toBe("[REDACTED:config:A] [REDACTED:config:B]");
+  });
+
+  test("covers JSON-escaped forms, object keys and nested values", () => {
+    const value = 'a"b';
+    const scrub = createValueScrubber([{ value, name: "config:Q" }]);
+    expect(scrub.text(JSON.stringify({ v: value }))).toBe('{"v":"[REDACTED:config:Q]"}');
+    expect(scrub.object({ [value]: [value, 1, null] })).toEqual({
+      "[REDACTED:config:Q]": ["[REDACTED:config:Q]", 1, null],
+    });
+  });
+
+  test("no values and empty values are a no-op", () => {
+    const scrub = createValueScrubber([{ value: "", name: "config:EMPTY" }]);
+    expect(scrub.text("unchanged")).toBe("unchanged");
+    const obj = { a: 1 };
+    expect(scrub.object(obj)).toBe(obj);
+  });
+});

package/src/tests/seed-skills-bundled-files.test.ts

@@ -1,7 +1,8 @@
 /**
  * Multi-file (bundled) seeded skills.
  *
- * Regression coverage for the collision that shipped `artifacts` twice — once
+ * Regression coverage for the collision that shipped the since-retired
+ * `artifacts` skill twice — once
  * baked into the worker image with an `examples/` directory, once seeded from
  * `templates/skills/` as a simple skill. The DB copy won at runtime, dropped a
  * `.swarm-managed` marker, and the next reconcile pass deleted the baked
@@ -58,17 +59,9 @@ describe("seeded skills with bundled files", () => {
     await removeDbFiles(TEST_DB_PATH);
   });
 
-  test("embedded manifest exposes bundled files for artifacts and pages", async () => {
+  test("embedded manifest exposes bundled files for pages", async () => {
     const skills = await loadSeedSkills();
 
-    const artifacts = skills.find((skill) => skill.name === "artifacts");
-    expect(artifacts?.files.map((file) => file.path).sort()).toEqual([
-      "examples/approval-flow.ts",
-      "examples/hono-dashboard.ts",
-      "examples/multi-artifact.ts",
-      "examples/static-report.sh",
-    ]);
-
     const pages = skills.find((skill) => skill.name === "pages");
     expect(pages?.files.map((file) => file.path).sort()).toEqual([
       "examples/annotated-pr.html",
@@ -84,7 +77,7 @@ describe("seeded skills with bundled files", () => {
     const embedded = await loadSeedSkills();
     const fromDisk = await loadSeedSkills(TEMPLATES_DIR);
 
-    for (const name of ["artifacts", "pages"]) {
+    for (const name of ["pages", "script-builder"]) {
       const a = embedded.find((skill) => skill.name === name);
       const b = fromDisk.find((skill) => skill.name === name);
       expect(a?.files).toEqual(b?.files ?? []);
@@ -107,18 +100,17 @@ describe("seeded skills with bundled files", () => {
   });
 
   test("seeding writes skill_files rows and marks the skill complex", async () => {
-    const artifacts = await getSkillByName("artifacts", "swarm");
-    expect(artifacts).toBeTruthy();
-    if (!artifacts) return;
+    const pages = await getSkillByName("pages", "swarm");
+    expect(pages).toBeTruthy();
+    if (!pages) return;
 
-    expect(artifacts.isComplex).toBe(true);
+    expect(pages.isComplex).toBe(true);
 
-    const files = await getSkillFiles(artifacts.id);
+    const files = await getSkillFiles(pages.id);
     expect(files.map((file) => file.path).sort()).toEqual([
-      "examples/approval-flow.ts",
-      "examples/hono-dashboard.ts",
-      "examples/multi-artifact.ts",
-      "examples/static-report.sh",
+      "examples/annotated-pr.html",
+      "examples/multiplayer-board.html",
+      "examples/report-page.html",
     ]);
     expect(files.every((file) => file.content.length > 0)).toBe(true);
   });
@@ -131,24 +123,24 @@ describe("seeded skills with bundled files", () => {
   });
 
   test("a bundled-file edit registers as drift and is preserved", async () => {
-    const item = (await skillsSeeder.items()).find((candidate) => candidate.key === "artifacts");
+    const item = (await skillsSeeder.items()).find((candidate) => candidate.key === "pages");
     expect(item).toBeDefined();
     if (!item) return;
 
     // Freshly seeded and untouched: upstream hashes to exactly the source.
     expect(await skillsSeeder.upstreamHash(item)).toBe(item.contentHash);
 
-    const artifacts = await getSkillByName("artifacts", "swarm");
-    if (!artifacts) throw new Error("artifacts skill missing");
-    const original = (await getSkillFiles(artifacts.id)).find(
-      (file) => file.path === "examples/hono-dashboard.ts",
+    const pages = await getSkillByName("pages", "swarm");
+    if (!pages) throw new Error("pages skill missing");
+    const original = (await getSkillFiles(pages.id)).find(
+      (file) => file.path === "examples/report-page.html",
     );
     if (!original) throw new Error("bundled example missing");
 
     // Simulate a user editing a bundled file through the skills API.
-    await upsertSkillFile(artifacts.id, {
+    await upsertSkillFile(pages.id, {
       path: original.path,
-      content: `${original.content}\n// edited by a user`,
+      content: `${original.content}\n<!-- edited by a user -->`,
     });
 
     // The edit must move the upstream hash — otherwise the seeder would think
@@ -159,11 +151,11 @@ describe("seeded skills with bundled files", () => {
     expect(result.failed).toEqual([]);
     expect(result.skippedUserModified).toBeGreaterThan(0);
 
-    const after = (await getSkillFiles(artifacts.id)).find((file) => file.path === original.path);
-    expect(after?.content).toContain("// edited by a user");
+    const after = (await getSkillFiles(pages.id)).find((file) => file.path === original.path);
+    expect(after?.content).toContain("<!-- edited by a user -->");
 
     // Restore so later tests see a pristine skill.
-    await upsertSkillFile(artifacts.id, { path: original.path, content: original.content });
+    await upsertSkillFile(pages.id, { path: original.path, content: original.content });
   });
 
   test("a userInvocable flip registers as drift and is preserved", async () => {
@@ -195,24 +187,24 @@ describe("seeded skills with bundled files", () => {
     // format (no bundled-file section). The new seeder must still recognise it
     // as pristine and update it — not misread it as user-modified and skip it
     // forever, which would mean the merged content never reaches production.
-    const artifacts = await getSkillByName("artifacts", "swarm");
-    if (!artifacts) throw new Error("artifacts skill missing");
+    const pages = await getSkillByName("pages", "swarm");
+    if (!pages) throw new Error("pages skill missing");
 
-    const legacyContent = "---\nname: artifacts\ndescription: old\n---\n\nold body\n";
-    await updateSkill(artifacts.id, { content: legacyContent, isComplex: false });
-    for (const file of await getSkillFiles(artifacts.id)) {
-      await deleteSkillFile(artifacts.id, file.path);
+    const legacyContent = "---\nname: pages\ndescription: old\n---\n\nold body\n";
+    await updateSkill(pages.id, { content: legacyContent, isComplex: false });
+    for (const file of await getSkillFiles(pages.id)) {
+      await deleteSkillFile(pages.id, file.path);
     }
 
     // Old-format hash: base only, no file section. The flag mirrors the seeded
-    // config so the test does not pin artifacts' systemDefault value.
+    // config so the test does not pin pages' systemDefault value.
     const legacyHash = computeContentHash(
-      `${legacyContent}\n\n# seed:systemDefault=${artifacts.systemDefault ? 1 : 0}\n`,
+      `${legacyContent}\n\n# seed:systemDefault=${pages.systemDefault ? 1 : 0}\n`,
     );
-    await recordSeedState("skill", "artifacts", legacyHash);
+    await recordSeedState("skill", "pages", legacyHash);
 
-    const item = (await skillsSeeder.items()).find((candidate) => candidate.key === "artifacts");
-    if (!item) throw new Error("artifacts seed item missing");
+    const item = (await skillsSeeder.items()).find((candidate) => candidate.key === "pages");
+    if (!item) throw new Error("pages seed item missing");
 
     // Pristine: upstream (file-less) still hashes in the old format.
     expect(await skillsSeeder.upstreamHash(item)).toBe(legacyHash);
@@ -221,10 +213,10 @@ describe("seeded skills with bundled files", () => {
     expect(result.failed).toEqual([]);
     expect(result.skippedUserModified).toBe(0);
 
-    const upgraded = await getSkillByName("artifacts", "swarm");
+    const upgraded = await getSkillByName("pages", "swarm");
     expect(upgraded?.isComplex).toBe(true);
     expect(upgraded?.content).not.toBe(legacyContent);
-    expect((await getSkillFiles(upgraded?.id ?? "")).length).toBe(4);
+    expect((await getSkillFiles(upgraded?.id ?? "")).length).toBe(3);
 
     // And it settles: the next run is a clean no-op.
     const second = await runSeeder(skillsSeeder, { quiet: true });
@@ -273,18 +265,18 @@ describe("seeded skills with bundled files", () => {
   });
 
   test("bundled files survive repeated filesystem syncs (the reconcile bug)", async () => {
-    const artifacts = await getSkillByName("artifacts", "swarm");
-    expect(artifacts).toBeTruthy();
-    if (!artifacts) return;
+    const pages = await getSkillByName("pages", "swarm");
+    expect(pages).toBeTruthy();
+    if (!pages) return;
 
     const entry: SkillFsEntry = {
-      id: artifacts.id,
-      name: artifacts.name,
-      content: artifacts.content,
-      isComplex: artifacts.isComplex,
+      id: pages.id,
+      name: pages.name,
+      content: pages.content,
+      isComplex: pages.isComplex,
       isEnabled: true,
       isActive: true,
-      files: (await getSkillFiles(artifacts.id)).map((file) => ({
+      files: (await getSkillFiles(pages.id)).map((file) => ({
         path: file.path,
         content: file.content,
         isBinary: file.isBinary,
@@ -297,9 +289,9 @@ describe("seeded skills with bundled files", () => {
       FAKE_HOME,
       ".claude",
       "skills",
-      "artifacts",
+      "pages",
       "examples",
-      "hono-dashboard.ts",
+      "report-page.html",
     );
     expect(existsSync(examplePath)).toBe(true);