@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/tests/seed-skills-retire.test.ts

@@ -0,0 +1,182 @@
+/**
+ * Retiring a seeded skill whose template was removed.
+ *
+ * Dropping `templates/skills/<name>/` alone leaves the last seeded row live on
+ * every existing install. `retireSeedSkills` deletes it, but only while the
+ * seeder still owns it: a recorded `seed_state` hash that the live copy
+ * matches and every metadata column still holds what the seeder wrote.
+ * Unrecorded and user-edited skills stay, including metadata-only edits.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  computeContentHash,
+  createAgent,
+  createSkill,
+  getAgentSkills,
+  getSkillByName,
+  getSkillFiles,
+  initDb,
+  installSkill,
+  updateSkill,
+  upsertSkillFiles,
+} from "../be/db";
+import { getSeedState, recordSeedState, runSeeder } from "../be/seed";
+import { RETIRED_SEED_SKILLS, retireSeedSkills, skillsSeeder } from "../be/seed-skills";
+
+const TEST_DB_PATH = `./test-seed-skills-retire-${process.pid}.sqlite`;
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(path + suffix).catch(() => {});
+  }
+}
+
+const BUNDLED_FILE = { path: "examples/serve.ts", content: "pm2 start serve.ts\n" };
+
+/**
+ * Seed a swarm skill the way the seeder does (frontmatter description equal to
+ * the description column, isComplex set from the file count) and record the
+ * hash it would have written.
+ */
+async function seedLegacySkill(name: string, withFile = false): Promise<string> {
+  const content = `---\nname: ${name}\ndescription: old\n---\n\nRun pm2 start.\n`;
+  const skill = await createSkill({
+    name,
+    description: "old",
+    content,
+    type: "personal",
+    scope: "swarm",
+    ownerAgentId: undefined,
+    systemDefault: false,
+    isComplex: withFile,
+  });
+  let hashed = `${content}\n\n# seed:systemDefault=0\n`;
+  if (withFile) {
+    await upsertSkillFiles(skill.id, [BUNDLED_FILE]);
+    hashed += `# seed:files\n${BUNDLED_FILE.path}\n${BUNDLED_FILE.content}\n`;
+  }
+  await recordSeedState("skill", name, computeContentHash(hashed));
+  return skill.id;
+}
+
+describe("retiring seeded skills", () => {
+  let agentId: string;
+
+  beforeAll(async () => {
+    await removeDbFiles(TEST_DB_PATH);
+    initDb(TEST_DB_PATH);
+    agentId = (
+      await createAgent({ name: "retire-test", isLead: false, status: "idle", capabilities: [] })
+    ).id;
+  });
+
+  afterAll(async () => {
+    closeDb();
+    await removeDbFiles(TEST_DB_PATH);
+  });
+
+  test("artifacts is retired and no longer seeded", async () => {
+    expect(RETIRED_SEED_SKILLS).toContain("artifacts");
+    const keys = (await skillsSeeder.items()).map((item) => item.key);
+    expect(keys).not.toContain("artifacts");
+  });
+
+  test("the seeder run deletes a pristine retired skill and its seed state", async () => {
+    const id = await seedLegacySkill("artifacts", true);
+    await installSkill(agentId, id);
+
+    const result = await runSeeder(skillsSeeder, { quiet: true });
+    expect(result.failed).toEqual([]);
+    expect(result.retired).toBe(1);
+    expect(await getSkillByName("artifacts", "swarm")).toBeNull();
+    expect(await getSkillFiles(id)).toEqual([]);
+    expect((await getAgentSkills(agentId, false)).map((s) => s.id)).not.toContain(id);
+    expect(await getSeedState("skill", "artifacts")).toBeNull();
+
+    // Settled: nothing left to retire on the next boot.
+    expect((await runSeeder(skillsSeeder, { quiet: true })).retired).toBe(0);
+  });
+
+  test("the seeder run keeps a retired skill with metadata-only edits, with its installs and files", async () => {
+    const id = await seedLegacySkill("artifacts", true);
+    await installSkill(agentId, id);
+    await updateSkill(id, {
+      allowedTools: "Read",
+      model: "user-selected-model",
+      description: "my edited description",
+    });
+
+    const result = await runSeeder(skillsSeeder, { quiet: true });
+    expect(result.failed).toEqual([]);
+    expect(result.retired).toBe(0);
+
+    const kept = await getSkillByName("artifacts", "swarm");
+    expect(kept?.id).toBe(id);
+    expect(kept?.model).toBe("user-selected-model");
+    expect((await getSkillFiles(id)).map((file) => file.path)).toEqual([BUNDLED_FILE.path]);
+    expect((await getAgentSkills(agentId, false)).map((s) => s.id)).toContain(id);
+  });
+
+  // Every column updateSkill can write outside the seed hash. Each one alone
+  // marks the row as user-edited.
+  const METADATA_EDITS: [string, Parameters<typeof updateSkill>[1]][] = [
+    ["description", { description: "mine" }],
+    ["allowedTools", { allowedTools: "Read" }],
+    ["model", { model: "opus" }],
+    ["effort", { effort: "high" }],
+    ["context", { context: "fork" }],
+    ["agent", { agent: "reviewer" }],
+    ["disableModelInvocation", { disableModelInvocation: true }],
+    ["isEnabled", { isEnabled: false }],
+    ["isComplex", { isComplex: true }],
+    ["sourceUrl", { sourceUrl: "https://example.com/SKILL.md" }],
+    ["sourceRepo", { sourceRepo: "me/skills" }],
+    ["sourcePath", { sourcePath: "skills/artifacts" }],
+    ["sourceBranch", { sourceBranch: "dev" }],
+    ["sourceHash", { sourceHash: "abc123" }],
+    ["lastFetchedAt", { lastFetchedAt: "2026-01-01T00:00:00.000Z" }],
+  ];
+
+  test.each(METADATA_EDITS)("a retired skill with an edited %s is kept", async (field, edit) => {
+    const name = `zz-retired-meta-${field.toLowerCase()}`;
+    const id = await seedLegacySkill(name);
+    await updateSkill(id, edit);
+
+    expect(await retireSeedSkills([name])).toEqual([]);
+    expect(await getSkillByName(name, "swarm")).not.toBeNull();
+  });
+
+  test("a pristine retired skill touched by a no-op update is still retired", async () => {
+    const id = await seedLegacySkill("zz-retired-noop");
+    await updateSkill(id, {});
+
+    expect(await retireSeedSkills(["zz-retired-noop"])).toEqual(["zz-retired-noop"]);
+    expect(await getSkillByName("zz-retired-noop", "swarm")).toBeNull();
+  });
+
+  test("a retired skill edited since it was seeded is kept", async () => {
+    const id = await seedLegacySkill("zz-retired-edited");
+    await updateSkill(id, { content: "---\nname: zz-retired-edited\n---\n\nmine\n" });
+
+    expect(await retireSeedSkills(["zz-retired-edited"])).toEqual([]);
+    expect(await getSkillByName("zz-retired-edited", "swarm")).not.toBeNull();
+  });
+
+  test("a same-name skill the seeder never recorded is kept", async () => {
+    await createSkill({
+      name: "zz-retired-unrecorded",
+      description: "user authored",
+      content: "---\nname: zz-retired-unrecorded\n---\n\nmine\n",
+      type: "personal",
+      scope: "swarm",
+      ownerAgentId: undefined,
+      systemDefault: false,
+    });
+
+    expect(await retireSeedSkills(["zz-retired-unrecorded"])).toEqual([]);
+    expect(await getSkillByName("zz-retired-unrecorded", "swarm")).not.toBeNull();
+  });
+});

package/src/tests/send-task-requester-gate.test.ts

@@ -2,6 +2,7 @@
  * A task's requester drives attribution, cost reporting and admission. A non-lead agent may omit
  * `requestedByUserId` or pass the requester of its own current task. Only a lead, the operator or
  * a user may name any other registered user. Covers the send-task tool and POST /api/tasks.
+ * POST /api/tasks also refuses an agent a foreign parent or a chat thread it does not own.
  */
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
@@ -18,6 +19,7 @@ import {
   initDb,
 } from "../be/db";
 import { handleTasks } from "../http/tasks";
+import { chatSdkContextKey } from "../tasks/context-key";
 import { registerSendTaskTool } from "../tools/send-task";
 import { type HttpRequestAuth, setRequestAuth } from "../utils/request-auth-context";
 
@@ -258,3 +260,59 @@ describe("POST /api/tasks with an X-Agent-ID on the swarm key", () => {
     expect(lead.body.requestedByUserId).toBe(userBId);
   });
 });
+
+describe("POST /api/tasks parent and chat-thread binding for an agent caller", () => {
+  test("a worker cannot attach a child to a task it neither owns nor created", async () => {
+    const foreign = await createTaskExtended("lead chat task (http)", {
+      agentId: LEAD_ID,
+      source: "chat",
+      contextKey: chatSdkContextKey("telegram:552222"),
+    });
+    const before = await taskCount();
+    const result = await postTask(
+      { agentId: WORKER_ID },
+      { parentTaskId: foreign.id, agentId: WORKER_ID, routingReason: "skill" },
+    );
+    expect(result.status).toBe(403);
+    expect(await taskCount()).toBe(before);
+  });
+
+  test("a worker cannot bind a new task to a chat thread by contextKey", async () => {
+    const before = await taskCount();
+    const result = await postTask(
+      { agentId: WORKER_ID },
+      {
+        contextKey: chatSdkContextKey("telegram:552222"),
+        agentId: WORKER_ID,
+        routingReason: "skill",
+      },
+    );
+    expect(result.status).toBe(403);
+    expect(await taskCount()).toBe(before);
+  });
+
+  test("a worker may attach under its own task, and the operator and a lead keep access", async () => {
+    const own = await createTaskExtended("worker chat task (http)", {
+      agentId: WORKER_ID,
+      source: "chat",
+      contextKey: chatSdkContextKey("telegram:551111"),
+    });
+    const child = await postTask(
+      { agentId: WORKER_ID },
+      { parentTaskId: own.id, agentId: OTHER_WORKER_ID, routingReason: "skill" },
+    );
+    expect(child.status).toBe(201);
+
+    const foreign = await createTaskExtended("lead chat task (http, open)", {
+      agentId: LEAD_ID,
+      source: "chat",
+      contextKey: chatSdkContextKey("telegram:553333"),
+    });
+    expect((await postTask({}, { parentTaskId: foreign.id })).status).toBe(201);
+    expect((await postTask({ agentId: LEAD_ID }, { parentTaskId: foreign.id })).status).toBe(201);
+    expect(
+      (await postTask({ agentId: LEAD_ID }, { contextKey: chatSdkContextKey("telegram:554444") }))
+        .status,
+    ).toBe(201);
+  });
+});

package/src/tests/session-cost-recompute-unit.test.ts

@@ -3,6 +3,8 @@
 // behavior that is uneconomical to express through a server round-trip.
 
 import { describe, expect, test } from "bun:test";
+import { loadModelsDevCache } from "../be/modelsdev-cache";
+import { buildModelsDevSeedRows } from "../be/seed-pricing";
 import { recomputeSessionCost } from "../http/session-cost-recompute";
 import type { PricingProvider, PricingTokenClass } from "../types";
 
@@ -166,4 +168,96 @@ describe("recomputeSessionCost — pure branch behavior", () => {
     expect(result.costSource).toBe("unpriced");
     expect(result.totalCostUsd).toBe(0);
   });
+
+  // Task 06c031dd (opencode 2.0.28): the session's tokens at the live
+  // OpenRouter list rates, vs the billed `usage.cost` sum the adapter flags.
+  const OPENCODE_DEEPSEEK: RateBook = {
+    "opencode:deepseek/deepseek-v4.1-flash:input": 0.0441,
+    "opencode:deepseek/deepseek-v4.1-flash:output": 0.765,
+    "opencode:deepseek/deepseek-v4.1-flash:cached_input": 0.0054,
+  };
+  const OPENCODE_ROW = {
+    ...BASE,
+    provider: "opencode",
+    model: "openrouter/deepseek/deepseek-v4.1-flash",
+    inputTokens: 65_917,
+    outputTokens: 212,
+    cacheReadTokens: 116_736,
+  } as const;
+
+  test("opencode without a billed cost prices its tokens from the table", async () => {
+    const result = await recomputeSessionCost(
+      { ...OPENCODE_ROW, harnessCostUsd: 0.0014022106 },
+      lookupFrom(OPENCODE_DEEPSEEK),
+    );
+    expect(result.costSource).toBe("pricing-table");
+    expect(result.totalCostUsd).toBeCloseTo(
+      (65_917 * 0.0441 + 116_736 * 0.0054 + 212 * 0.765) / 1_000_000,
+      12,
+    );
+  });
+
+  test("a billed harness cost wins over the table", async () => {
+    const result = await recomputeSessionCost(
+      { ...OPENCODE_ROW, harnessCostUsd: 0.0207, harnessCostBilled: true },
+      lookupFrom(OPENCODE_DEEPSEEK),
+    );
+    expect(result).toEqual({
+      totalCostUsd: 0.0207,
+      costSource: "harness",
+      modelBreakdown: undefined,
+    });
+  });
+
+  test("a billed flag with no cost still prices from the table", async () => {
+    const result = await recomputeSessionCost(
+      { ...OPENCODE_ROW, harnessCostUsd: 0, harnessCostBilled: true },
+      lookupFrom(OPENCODE_DEEPSEEK),
+    );
+    expect(result.costSource).toBe("pricing-table");
+  });
+});
+
+describe("nan and helmcode sessions price at $0 from the seeded table", () => {
+  // Rows projected from the vendored snapshot, exactly as the boot seeder and
+  // the runtime refresh insert them.
+  const cache = loadModelsDevCache();
+  const rows = cache ? buildModelsDevSeedRows(cache) : [];
+  const book: RateBook = Object.fromEntries(
+    rows.map((row) => [`${row.provider}:${row.model}:${row.tokenClass}`, row.pricePerMillionUsd]),
+  );
+
+  test("pi on nan/glm5.3-flash and opencode on helmcode/qwen3.6 record pricing-table, total 0", async () => {
+    for (const [provider, model] of [
+      ["pi", "nan/glm5.3-flash"],
+      ["opencode", "helmcode/qwen3.6"],
+    ] as const) {
+      const result = await recomputeSessionCost(
+        {
+          ...BASE,
+          provider,
+          model,
+          harnessCostUsd: 0,
+          inputTokens: 50_000,
+          outputTokens: 2_000,
+          cacheReadTokens: 10_000,
+        },
+        lookupFrom(book),
+      );
+      expect(result.costSource).toBe("pricing-table");
+      expect(result.totalCostUsd).toBe(0);
+    }
+  });
+
+  test("nan/qwen3.6 and helmcode/qwen3.6 are separate pricing keys", () => {
+    for (const harness of ["pi", "opencode"]) {
+      const keys = new Set(
+        rows
+          .filter((row) => row.provider === harness && row.model.endsWith("/qwen3.6"))
+          .map((row) => row.model),
+      );
+      expect(keys.has("nan/qwen3.6")).toBe(true);
+      expect(keys.has("helmcode/qwen3.6")).toBe(true);
+    }
+  });
 });

package/src/tests/skill-get-name-resolution.test.ts

@@ -0,0 +1,137 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, createSkill, initDb } from "../be/db";
+import { skillsSeeder } from "../be/seed-skills";
+import { registerSkillGetTool } from "../tools/skills/skill-get";
+
+const TEST_DB_PATH = "./test-skill-get-name-resolution.sqlite";
+
+const CALLER_ID = "aaaa0000-0000-4000-8000-000000000031";
+const OTHER_ID = "bbbb0000-0000-4000-8000-000000000032";
+const THIRD_ID = "cccc0000-0000-4000-8000-000000000033";
+
+type StructuredContent = {
+  success: boolean;
+  message: string;
+  skill?: { id: string; ownerAgentId: string | null };
+};
+
+async function callSkillGet(
+  server: McpServer,
+  callerAgentId: string | undefined,
+  args: Record<string, unknown>,
+): Promise<StructuredContent> {
+  // biome-ignore lint/complexity/noBannedTypes: accessing internal MCP SDK type for test
+  const tools = (server as unknown as { _registeredTools: Record<string, { handler: Function }> })
+    ._registeredTools;
+  const result = await tools["skill-get"].handler(args, {
+    sessionId: "test-session",
+    requestInfo: { headers: { "x-agent-id": callerAgentId ?? "" } },
+  });
+  return (result as { structuredContent: StructuredContent }).structuredContent;
+}
+
+function swarmSkill(name: string, ownerAgentId: string | null) {
+  return createSkill({
+    name,
+    description: `${name} description`,
+    content: `---\nname: ${name}\ndescription: ${name} description\n---\n\nBody.`,
+    type: "personal",
+    scope: "swarm",
+    ownerAgentId: ownerAgentId ?? undefined,
+  });
+}
+
+describe("skill-get swarm name resolution", () => {
+  let server: McpServer;
+
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // File doesn't exist
+      }
+    }
+    closeDb();
+    initDb(TEST_DB_PATH);
+    for (const [id, name] of [
+      [CALLER_ID, "Caller"],
+      [OTHER_ID, "Other"],
+      [THIRD_ID, "Third"],
+    ] as const) {
+      await createAgent({ id, name, isLead: false, status: "idle" });
+    }
+    server = new McpServer({ name: "test-skill-get-name-resolution", version: "1.0.0" });
+    registerSkillGetTool(server);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // ignore
+      }
+    }
+  });
+
+  test("an owned-only swarm skill resolves by name", async () => {
+    const owned = await swarmSkill("owned-only-skill", OTHER_ID);
+
+    const withCaller = await callSkillGet(server, CALLER_ID, { name: "owned-only-skill" });
+    expect(withCaller.success).toBe(true);
+    expect(withCaller.skill?.id).toBe(owned.id);
+
+    const anonymous = await callSkillGet(server, undefined, { name: "owned-only-skill" });
+    expect(anonymous.success).toBe(true);
+    expect(anonymous.skill?.id).toBe(owned.id);
+  });
+
+  test("the ownerless row beats owned rows, including the caller's own", async () => {
+    // Live shape: qa-loom has an ownerless row and an agent-owned twin.
+    const owned = await swarmSkill("shadowed-skill", CALLER_ID);
+    const ownerless = await swarmSkill("shadowed-skill", null);
+    expect(owned.createdAt <= ownerless.createdAt).toBe(true);
+
+    const result = await callSkillGet(server, CALLER_ID, { name: "shadowed-skill" });
+    expect(result.success).toBe(true);
+    expect(result.skill?.id).toBe(ownerless.id);
+  });
+
+  test("the caller's own row beats another agent's row", async () => {
+    await swarmSkill("two-owner-skill", OTHER_ID);
+    const mine = await swarmSkill("two-owner-skill", CALLER_ID);
+
+    const result = await callSkillGet(server, CALLER_ID, { name: "two-owner-skill" });
+    expect(result.success).toBe(true);
+    expect(result.skill?.id).toBe(mine.id);
+  });
+
+  test("two foreign-owned rows return an error naming both ids", async () => {
+    const first = await swarmSkill("foreign-pair-skill", OTHER_ID);
+    const second = await swarmSkill("foreign-pair-skill", THIRD_ID);
+
+    const result = await callSkillGet(server, CALLER_ID, { name: "foreign-pair-skill" });
+    expect(result.success).toBe(false);
+    expect(result.message).toContain(first.id);
+    expect(result.message).toContain(second.id);
+    expect(result.message).toContain("skillId");
+
+    const byId = await callSkillGet(server, CALLER_ID, { skillId: second.id });
+    expect(byId.success).toBe(true);
+    expect(byId.skill?.id).toBe(second.id);
+  });
+
+  test("the seed path still matches ownerless rows only", async () => {
+    await swarmSkill("seed-owned-only", OTHER_ID);
+
+    const item = { key: "seed-owned-only", contentHash: "" } as never;
+    expect(await skillsSeeder.upstreamHash(item)).toBeNull();
+
+    await swarmSkill("seed-owned-only", null);
+    expect(await skillsSeeder.upstreamHash(item)).not.toBeNull();
+  });
+});

package/src/tests/slack-channel-join.test.ts

@@ -1,6 +1,7 @@
-import { describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 import type { WebClient } from "@slack/web-api";
 import { withAutoJoin } from "../slack/channel-join";
+import { resetExternalChannelStateForTesting } from "../slack/external-channel";
 
 // Mirrors the shape @slack/web-api's platformErrorFromResult produces:
 // message = "An API error occurred: <code>", data.error = "<code>"
@@ -37,6 +38,8 @@ function makeClient(opts: {
 }
 
 describe("withAutoJoin", () => {
+  beforeEach(() => resetExternalChannelStateForTesting());
+
   test("success: fn called once, join and info not called", async () => {
     const { client, infoFn, joinFn } = makeClient({});
     const fn = mock(() => Promise.resolve("ok"));

package/src/tests/slack-external-channel-config.test.ts

@@ -0,0 +1,65 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createServer, type Server } from "node:http";
+import { closeDb, getSwarmConfigs, initDb } from "../be/db";
+import { handleConfig } from "../http/config";
+import { handleCore } from "../http/core";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+// A typo such as 'treu' must not reach the DB: parseEnvFlag would read it as
+// false and silently turn the external-channel block off.
+
+const API_KEY = "example-slack-external-config-test-key";
+const KEY = "SLACK_BLOCK_EXTERNAL_CHANNELS";
+
+let server: Server;
+let baseUrl: string;
+
+beforeAll(async () => {
+  initDb(":memory:");
+  server = createServer(async (req, res) => {
+    if (await handleCore(req, res, req.headers["x-agent-id"] as string | undefined, API_KEY)) {
+      return;
+    }
+    const segments = getPathSegments(req.url || "");
+    const query = parseQueryParams(req.url || "");
+    if (await handleConfig(req, res, segments, query)) return;
+    res.writeHead(404).end();
+  });
+  baseUrl = `http://127.0.0.1:${await listenOnFreePort(server)}`;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+});
+
+function putConfig(value: string): Promise<Response> {
+  return fetch(`${baseUrl}/api/config`, {
+    method: "PUT",
+    headers: { Authorization: `Bearer ${API_KEY}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ scope: "global", key: KEY, value }),
+  });
+}
+
+async function storedValue(): Promise<string | undefined> {
+  const rows = await getSwarmConfigs({ scope: "global", key: KEY });
+  return rows[0]?.value;
+}
+
+describe("SLACK_BLOCK_EXTERNAL_CHANNELS config write", () => {
+  test("PUT /api/config rejects a non-boolean value and stores nothing", async () => {
+    const response = await putConfig("treu");
+    expect(response.status).toBe(400);
+    expect(await response.text()).toContain(`Invalid ${KEY}`);
+    expect(await storedValue()).toBeUndefined();
+  });
+
+  test("PUT /api/config accepts boolean literals", async () => {
+    for (const value of ["true", "false", "1", "0"]) {
+      const response = await putConfig(value);
+      expect(response.status).toBe(200);
+      expect(await storedValue()).toBe(value);
+    }
+  });
+});