@desplega.ai/agent-swarm 1.173.0 → 2.0.0

package/src/tests/chat-sdk-webhook-telegram.test.ts

@@ -0,0 +1,200 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import {
+  startTelegramBotApiMock,
+  type TelegramBotApiMock,
+} from "../../scripts/dev/telegram-bot-api-mock";
+import { closeDb, createAgent, getDbClient, initDb } from "../be/db";
+import { handleWebhooks } from "../http/webhooks";
+import { drainBackground } from "../integrations/chat-sdk/background";
+import { getChatSdkHealth, startChatSdk, stopChatSdk } from "../integrations/chat-sdk/runtime";
+import { flushAllChatBuffers } from "../integrations/chat-sdk/thread-buffer";
+import { getEnabledCapabilities } from "../server";
+import privateText from "./fixtures/chat-sdk/telegram-private-text.json";
+
+const TEST_DB_PATH = "./test-chat-sdk-telegram.sqlite";
+const SECRET = "s";
+const ENV_KEYS = ["CHAT_SDK_ENABLED", "CHAT_SDK_ADAPTERS", "CHAT_SDK_API_URL_OVERRIDES"];
+const savedEnv = new Map(ENV_KEYS.map((key) => [key, process.env[key]]));
+
+let mock: TelegramBotApiMock;
+let leadId: string;
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => {});
+  }
+}
+
+/** Minimal fake req/res to drive handleWebhooks without a live server. */
+function fakeReqRes(path: string, rawBody: string, headers: Record<string, string>) {
+  const rawHeaders = Object.entries(headers).flat();
+  const req = {
+    method: "POST",
+    url: path,
+    headers: Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])),
+    rawHeaders,
+    async *[Symbol.asyncIterator]() {
+      yield Buffer.from(rawBody);
+    },
+  } as unknown as IncomingMessage;
+
+  const captured = { status: 0, body: "" };
+  const res = {
+    writeHead(status: number) {
+      captured.status = status;
+      return this;
+    },
+    end(chunk?: string | Buffer) {
+      if (chunk) captured.body = chunk.toString();
+      return this;
+    },
+  } as unknown as ServerResponse;
+
+  return { req, res, captured };
+}
+
+async function post(adapter: string, body: unknown, headers: Record<string, string>) {
+  const path = `/api/integrations/chat/${adapter}/webhook`;
+  const { req, res, captured } = fakeReqRes(path, JSON.stringify(body), {
+    "Content-Type": "application/json",
+    ...headers,
+  });
+  const handled = await handleWebhooks(req, res, path.split("/").filter(Boolean));
+  expect(handled).toBe(true);
+  return captured;
+}
+
+beforeAll(async () => {
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  const lead = await createAgent({
+    id: crypto.randomUUID(),
+    name: "ChatLead",
+    isLead: true,
+    status: "idle",
+  });
+  leadId = lead.id;
+  mock = startTelegramBotApiMock();
+  process.env.CHAT_SDK_ENABLED = "true";
+  process.env.CHAT_SDK_ADAPTERS = JSON.stringify({
+    telegram: { botToken: "t", secretToken: SECRET, mode: "webhook" },
+  });
+  process.env.CHAT_SDK_API_URL_OVERRIDES = JSON.stringify({ telegram: mock.url });
+  await startChatSdk();
+});
+
+afterAll(async () => {
+  await stopChatSdk();
+  mock.stop();
+  for (const [key, value] of savedEnv) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  closeDb();
+  await removeDbFiles();
+});
+
+describe("Chat SDK Telegram webhook", () => {
+  test("the adapter starts healthy against the mock Bot API", () => {
+    expect(getChatSdkHealth().telegram?.status).toBe("ok");
+    expect(mock.calls.some((call) => call.method === "getMe")).toBe(true);
+  });
+
+  test("a wrong secret token is rejected with 401", async () => {
+    const captured = await post("telegram", privateText, {
+      "X-Telegram-Bot-Api-Secret-Token": "wrong",
+    });
+    expect(captured.status).toBe(401);
+  });
+
+  test("a body above 1 MiB is rejected with 413 before the adapter runs", async () => {
+    const path = "/api/integrations/chat/telegram/webhook";
+    const segments = path.split("/").filter(Boolean);
+    const oversized = "x".repeat(1024 * 1024 + 1);
+    const secretHeader = { "X-Telegram-Bot-Api-Secret-Token": SECRET };
+    const sentBefore = mock.calls.length;
+
+    // Declared up front: rejected before any chunk is read.
+    const declared = fakeReqRes(path, "{}", {
+      ...secretHeader,
+      "Content-Length": String(oversized.length),
+    });
+    expect(await handleWebhooks(declared.req, declared.res, segments)).toBe(true);
+    expect(declared.captured.status).toBe(413);
+
+    // Streamed without Content-Length: rejected once the cap is crossed.
+    const streamed = fakeReqRes(path, oversized, secretHeader);
+    expect(await handleWebhooks(streamed.req, streamed.res, segments)).toBe(true);
+    expect(streamed.captured.status).toBe(413);
+    expect(JSON.parse(streamed.captured.body).error).toContain("Payload too large");
+    expect(mock.calls.length).toBe(sentBefore);
+  });
+
+  test("an unconfigured adapter answers 404", async () => {
+    const captured = await post("discord", {}, {});
+    expect(captured.status).toBe(404);
+  });
+
+  test("a private-chat text update creates one Lead task with a chat-sdk contextKey", async () => {
+    const captured = await post("telegram", privateText, {
+      "X-Telegram-Bot-Api-Secret-Token": SECRET,
+    });
+    expect(captured.status).toBe(200);
+    expect(await drainBackground(5_000)).toBe(true);
+    // Messages wait in the thread buffer; flush it instead of waiting 10 s.
+    await flushAllChatBuffers();
+    expect(await drainBackground(5_000)).toBe(true);
+
+    const tasks = await getDbClient().query<{
+      id: string;
+      source: string;
+      contextKey: string;
+      agentId: string | null;
+      task: string;
+      taskType: string;
+    }>(
+      "SELECT id, source, contextKey, agentId, task, taskType FROM agent_tasks WHERE source = 'chat'",
+    );
+    expect(tasks).toHaveLength(1);
+    const [task] = tasks;
+    expect(task!.contextKey.startsWith("task:chat-sdk:telegram:")).toBe(true);
+    expect(task!.agentId).toBe(leadId);
+    expect(task!.taskType).toBe("chat-inbound");
+    expect(task!.task).toContain("summarize the open tasks");
+
+    const subscriptions = await getDbClient().query<{ thread_id: string }>(
+      "SELECT thread_id FROM chat_subscriptions",
+    );
+    expect(subscriptions.map((row) => row.thread_id)).toContain("telegram:555001");
+  });
+
+  test("a redelivered update is deduplicated", async () => {
+    const captured = await post("telegram", privateText, {
+      "X-Telegram-Bot-Api-Secret-Token": SECRET,
+    });
+    expect(captured.status).toBe(200);
+    expect(await drainBackground(5_000)).toBe(true);
+    await flushAllChatBuffers();
+    const row = await getDbClient().get<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM agent_tasks WHERE source = 'chat'",
+    );
+    expect(row?.n).toBe(1);
+  });
+});
+
+describe("chat-sdk capability", () => {
+  test("is advertised only when CHAT_SDK_ENABLED is true", () => {
+    const previous = process.env.CHAT_SDK_ENABLED;
+    try {
+      process.env.CHAT_SDK_ENABLED = "true";
+      expect(getEnabledCapabilities()).toContain("chat-sdk");
+      process.env.CHAT_SDK_ENABLED = "false";
+      expect(getEnabledCapabilities()).not.toContain("chat-sdk");
+    } finally {
+      if (previous === undefined) delete process.env.CHAT_SDK_ENABLED;
+      else process.env.CHAT_SDK_ENABLED = previous;
+    }
+  });
+});

package/src/tests/claude-adapter-binary.test.ts

@@ -49,7 +49,7 @@ import {
   resolveClaudeBridgeEnabled,
   resolveClaudeTrustDirs,
 } from "../providers/claude-adapter";
-import { ClaudeSettingsConfigError } from "../providers/claude-flag-settings";
+import { ClaudeSettingsConfigError, userClaudeMdExclude } from "../providers/claude-flag-settings";
 import type { ProviderSessionConfig } from "../providers/types";
 import { setFlockForTests } from "../utils/file-lock";
 import { holdFileLock } from "./fixtures/hold-file-lock";
@@ -775,7 +775,7 @@ describe("CLAUDE_BINARY env override", () => {
     expect(argv[0]).toBe("claude");
   });
 
-  test("excludes only /workspace/CLAUDE.md from Claude's memory load", async () => {
+  test("excludes both on-disk agent CLAUDE.md copies from Claude's memory load", async () => {
     const adapter = new ClaudeAdapter();
     await createCompletedSession(adapter, makeConfig());
 
@@ -783,7 +783,7 @@ describe("CLAUDE_BINARY env override", () => {
     const at = argv.indexOf("--settings");
     expect(at).toBeGreaterThan(0);
     expect(JSON.parse(argv[at + 1] ?? "")).toEqual({
-      claudeMdExcludes: [WORKSPACE_CLAUDE_MD_PATH],
+      claudeMdExcludes: [WORKSPACE_CLAUDE_MD_PATH, userClaudeMdExclude()],
     });
   });
 
@@ -820,7 +820,12 @@ describe("CLAUDE_BINARY env override", () => {
       expect(JSON.parse(argv[argv.indexOf("--settings") + 1] ?? "")).toEqual({
         model: "from-file",
         env: { X: "kept" },
-        claudeMdExcludes: ["/repo/CLAUDE.md", WORKSPACE_CLAUDE_MD_PATH, "/other/CLAUDE.md"],
+        claudeMdExcludes: [
+          "/repo/CLAUDE.md",
+          WORKSPACE_CLAUDE_MD_PATH,
+          "/other/CLAUDE.md",
+          userClaudeMdExclude(),
+        ],
       });
       expect(argv[0]).toBe("claude");
       expect(argv.slice(argv.indexOf("--max-turns"), argv.indexOf("--max-turns") + 2)).toEqual([

package/src/tests/claude-flag-settings.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import {
   ClaudeSettingsConfigError,
   mergeClaudeSettingsArgs,
+  userClaudeMdExclude,
   WORKSPACE_CLAUDE_MD_EXCLUDE,
 } from "../providers/claude-flag-settings";
 
@@ -22,7 +23,9 @@ describe("mergeClaudeSettingsArgs", () => {
   test("no caller settings: args pass through, only the workspace exclusion", () => {
     const merged = mergeClaudeSettingsArgs([["--max-turns", "3"]], directory);
     expect(merged.argLists).toEqual([["--max-turns", "3"]]);
-    expect(merged.settings).toEqual({ claudeMdExcludes: [WORKSPACE_CLAUDE_MD_EXCLUDE] });
+    expect(merged.settings).toEqual({
+      claudeMdExcludes: [WORKSPACE_CLAUDE_MD_EXCLUDE, userClaudeMdExclude()],
+    });
   });
 
   test("strips both flag forms, keeps caller keys, unions and dedupes claudeMdExcludes", async () => {
@@ -44,7 +47,12 @@ describe("mergeClaudeSettingsArgs", () => {
     expect(merged.settings).toEqual({
       model: "file",
       env: { X: "kept" },
-      claudeMdExcludes: ["/a/CLAUDE.md", WORKSPACE_CLAUDE_MD_EXCLUDE, "/b/CLAUDE.md"],
+      claudeMdExcludes: [
+        "/a/CLAUDE.md",
+        WORKSPACE_CLAUDE_MD_EXCLUDE,
+        "/b/CLAUDE.md",
+        userClaudeMdExclude(),
+      ],
     });
   });
 
@@ -100,7 +108,7 @@ describe("mergeClaudeSettingsArgs", () => {
     expect(merged.settings).toEqual({
       model: "b",
       env: {},
-      claudeMdExcludes: [WORKSPACE_CLAUDE_MD_EXCLUDE],
+      claudeMdExcludes: [WORKSPACE_CLAUDE_MD_EXCLUDE, userClaudeMdExclude()],
     });
   });
 });

package/src/tests/claude-managed-adapter.test.ts

@@ -966,7 +966,7 @@ describe("ClaudeManagedAdapter (Phase 4) — repo provisioning + cost data", ()
     expect(getClaudeManagedModelPricing("claude-sonnet-5-5")).toEqual({
       inputPerMillion: 2.0,
       outputPerMillion: 10.0,
-      cacheReadPerMillion: 0.2,
+      cacheReadPerMillion: 0.1,
       cacheWritePerMillion: 2.5,
     });
     expect(getClaudeManagedModelPricing("claude-sonnet-5")).toEqual({

package/src/tests/claude-sdk-lifecycle.test.ts

@@ -3,6 +3,7 @@ import { mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ClaudeAdapter, getTaskFilePath } from "../providers/claude-adapter";
+import { userClaudeMdExclude } from "../providers/claude-flag-settings";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
 import { CHILD_PROCESS_TEST_BUDGET_MS, runChild } from "./test-proc";
 
@@ -148,11 +149,11 @@ describe("Claude SDK production adapter lifecycle", () => {
             argument === "--system-prompt" && fixtureState.argv[index + 1] === "",
         ),
       ).toBeFalse();
-      // The SDK forwards `settings` as `--settings`: Claude skips /workspace/CLAUDE.md.
+      // The SDK forwards `settings` as `--settings`: Claude skips both agent CLAUDE.md copies.
       const settingsAt = fixtureState.argv.indexOf("--settings");
       expect(settingsAt).toBeGreaterThan(-1);
       expect(JSON.parse(fixtureState.argv[settingsAt + 1] ?? "")).toMatchObject({
-        claudeMdExcludes: ["/workspace/CLAUDE.md"],
+        claudeMdExcludes: ["/workspace/CLAUDE.md", userClaudeMdExclude()],
       });
     },
     { timeout: CHILD_PROCESS_TEST_BUDGET_MS },
@@ -191,7 +192,12 @@ describe("Claude SDK production adapter lifecycle", () => {
       expect(JSON.parse(argv[argv.indexOf("--settings") + 1] ?? "")).toEqual({
         model: "from-file",
         env: { X: "kept" },
-        claudeMdExcludes: ["/repo/CLAUDE.md", "/other/CLAUDE.md", "/workspace/CLAUDE.md"],
+        claudeMdExcludes: [
+          "/repo/CLAUDE.md",
+          "/other/CLAUDE.md",
+          "/workspace/CLAUDE.md",
+          userClaudeMdExclude(),
+        ],
       });
       expect(argv).not.toContain(settingsFile);
       // The version probe carries the same merged settings value.

package/src/tests/claude-thinking-tokens.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+import { normalizeClaudeMessage } from "../providers/claude-session-events";
+
+const state = {
+  taskId: "task-fixture",
+  agentId: "agent-fixture",
+  model: "claude-opus-5-5",
+  contextWindowSize: 1_000_000,
+  transport: "cli" as const,
+};
+
+// Trimmed from a claude CLI stream-json `result` line.
+const resultLine = {
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  duration_ms: 48_210,
+  num_turns: 6,
+  session_id: "session-fixture",
+  total_cost_usd: 0.3121,
+  usage: {
+    input_tokens: 12,
+    cache_creation_input_tokens: 20_792,
+    cache_read_input_tokens: 54_611,
+    output_tokens: 2_993,
+    output_tokens_details: { thinking_tokens: 1_304 },
+    cache_creation: { ephemeral_5m_input_tokens: 0, ephemeral_1h_input_tokens: 20_792 },
+  },
+  modelUsage: {
+    "claude-opus-5-5": {
+      inputTokens: 12,
+      outputTokens: 2_993,
+      cacheReadInputTokens: 54_611,
+      cacheCreationInputTokens: 20_792,
+      webSearchRequests: 0,
+      costUSD: 0.3121,
+      contextWindow: 1_000_000,
+    },
+  },
+};
+
+describe("claude result-line thinking tokens", () => {
+  test("records output_tokens_details.thinking_tokens without touching output or cost", () => {
+    const { cost } = normalizeClaudeMessage(resultLine, state);
+    expect(cost).toMatchObject({
+      thinkingTokens: 1_304,
+      outputTokens: 2_993,
+      totalCostUsd: 0.3121,
+    });
+  });
+
+  test("reports zero when the result line has no thinking breakdown", () => {
+    const { output_tokens_details: _, ...usage } = resultLine.usage;
+    const { cost } = normalizeClaudeMessage({ ...resultLine, usage }, state);
+    expect(cost?.thinkingTokens).toBe(0);
+  });
+});

package/src/tests/claude-worker-parity.test.ts

@@ -27,7 +27,6 @@ let sut: Sut;
 let api: ApiClient;
 let fixtureDir: string;
 let fixturePath: string;
-let pm2StubPath: string;
 let openRouterMock: Bun.Server;
 
 const fixtureSource = `#!/usr/bin/env bun
@@ -248,7 +247,7 @@ async function runTransport(transport: "cli" | "sdk", agentId: string): Promise<
   const home = await mkdtemp(join(fixtureDir, `home-${transport}-`));
   const workerEnv = {
     ...minimalEnv(),
-    PATH: `${pm2StubPath}:${process.env.PATH ?? "/usr/bin:/bin"}`,
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
     HOME: home,
     AGENT_SWARM_API_KEY: sut.apiKey,
     API_KEY: sut.apiKey,
@@ -387,7 +386,7 @@ async function runCredentialRotation(): Promise<void> {
   const observationFile = join(home, "fixture-observation.json");
   const workerEnv = {
     ...minimalEnv(),
-    PATH: `${pm2StubPath}:${process.env.PATH ?? "/usr/bin:/bin"}`,
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
     HOME: home,
     AGENT_SWARM_API_KEY: sut.apiKey,
     API_KEY: sut.apiKey,
@@ -537,12 +536,8 @@ describe("Claude worker transport parity", () => {
     }
     fixtureDir = await mkdtemp("/tmp/claude-worker-parity-");
     fixturePath = join(fixtureDir, "claude-fixture");
-    pm2StubPath = join(fixtureDir, "bin");
-    await Bun.$`mkdir -p ${pm2StubPath}`.quiet();
     await Bun.write(fixturePath, fixtureSource);
-    await Bun.write(join(pm2StubPath, "pm2"), "#!/bin/sh\nexit 0\n");
     await Bun.$`chmod 755 ${fixturePath}`.quiet();
-    await Bun.$`chmod 755 ${join(pm2StubPath, "pm2")}`.quiet();
     openRouterMock = Bun.serve({
       port: 0,
       fetch: () =>

package/src/tests/config-env-export-chat-sdk.test.ts

@@ -0,0 +1,11 @@
+import { describe, expect, test } from "bun:test";
+import { defaultExportToEnv } from "../utils/config-env-export";
+
+describe("defaultExportToEnv for Chat SDK rows", () => {
+  test("CHAT_SDK_* rows start server-only; other keys keep the default", () => {
+    expect(defaultExportToEnv("CHAT_SDK_TELEGRAM_BOT_TOKEN")).toBe(false);
+    expect(defaultExportToEnv("chat_sdk_adapters")).toBe(false);
+    expect(defaultExportToEnv("CHAT_SDK_ENABLED")).toBe(false);
+    expect(defaultExportToEnv("MY_TOOL_TOKEN")).toBe(true);
+  });
+});

package/src/tests/config-refs.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, test } from "bun:test";
+import { ConfigRefError, isConfigRef, resolveConfigRefs } from "../be/config-refs";
+
+const values: Record<string, string> = { A: "alpha", B: "bravo" };
+const lookup = (key: string) => values[key];
+
+describe("resolveConfigRefs", () => {
+  test("resolves nested refs and refs inside arrays", () => {
+    const resolved = resolveConfigRefs<Record<string, unknown>>(
+      {
+        top: { $config: "A" },
+        nested: { deep: { value: { $config: "B" } } },
+        list: [{ $config: "A" }, "plain", { inner: { $config: "B" } }],
+      },
+      lookup,
+    );
+    expect(resolved).toEqual({
+      top: "alpha",
+      nested: { deep: { value: "bravo" } },
+      list: ["alpha", "plain", { inner: "bravo" }],
+    });
+  });
+
+  test("aggregates every missing key into one error", () => {
+    let error: unknown;
+    try {
+      resolveConfigRefs({ a: { $config: "MISSING_2" }, b: [{ $config: "MISSING_1" }] }, lookup);
+    } catch (caught) {
+      error = caught;
+    }
+    expect(error).toBeInstanceOf(ConfigRefError);
+    expect((error as ConfigRefError).missingKeys).toEqual(["MISSING_1", "MISSING_2"]);
+    expect((error as Error).message).toContain("MISSING_1, MISSING_2");
+  });
+
+  test("leaves non-ref objects and scalars untouched", () => {
+    const input = {
+      notRef: { $config: "A", extra: true },
+      emptyRef: { $config: "" },
+      numberRef: { $config: 7 },
+      n: 1,
+      b: false,
+      nil: null,
+    };
+    expect(resolveConfigRefs(input, lookup)).toEqual(input);
+  });
+
+  test("propagates a lookup that throws", () => {
+    expect(() =>
+      resolveConfigRefs({ k: { $config: "FORBIDDEN" } }, () => {
+        throw new Error("forbidden key");
+      }),
+    ).toThrow("forbidden key");
+  });
+});
+
+describe("isConfigRef", () => {
+  test("accepts only a single non-empty $config string key", () => {
+    expect(isConfigRef({ $config: "X" })).toBe(true);
+    expect(isConfigRef({ $config: "X", other: 1 })).toBe(false);
+    expect(isConfigRef({ $config: "" })).toBe(false);
+    expect(isConfigRef([{ $config: "X" }])).toBe(false);
+    expect(isConfigRef("X")).toBe(false);
+    expect(isConfigRef(null)).toBe(false);
+  });
+});

package/src/tests/context-key.test.ts

@@ -5,6 +5,7 @@ import {
   azureDevOpsContextKey,
   azureDevOpsWorkItemContextKey,
   buildJiraContextKey,
+  chatSdkContextKey,
   githubContextKey,
   gitlabContextKey,
   linearContextKey,
@@ -166,6 +167,24 @@ describe("parseContextKey", () => {
     });
   });
 
+  test("round-trips chat-sdk keys whose thread id contains colons", () => {
+    const threadId = "telegram:-1001234567890:42";
+    const key = chatSdkContextKey(threadId);
+    expect(key).toBe("task:chat-sdk:telegram:-1001234567890%3A42");
+    expect(key.split(":")).toHaveLength(4);
+    expect(parseContextKey(key)).toEqual({
+      family: "chat-sdk",
+      parts: { adapter: "telegram", threadId },
+    });
+  });
+
+  test("chat-sdk keys reject thread ids without an adapter prefix", () => {
+    expect(() => chatSdkContextKey("no-adapter")).toThrow(/<adapter>:<id>/);
+    expect(() => chatSdkContextKey(":123")).toThrow(/<adapter>:<id>/);
+    expect(() => chatSdkContextKey("telegram:")).toThrow(/<adapter>:<id>/);
+    expect(() => parseContextKey("task:chat-sdk:telegram")).toThrow(/malformed chat-sdk/);
+  });
+
   test("round-trips agentmail keys", () => {
     const key = agentmailContextKey({ threadId: "thr_abc" });
     expect(parseContextKey(key)).toEqual({

package/src/tests/cors-allowlist.test.ts

@@ -58,6 +58,31 @@ describe("isOriginAllowedForCredentials", () => {
     expect(isOriginAllowedForCredentials("https://evil.example")).toBe(false);
   });
 
+  test("development trusts loopback origins on any port; other modes do not", () => {
+    const originalNodeEnv = process.env.NODE_ENV;
+    try {
+      process.env.NODE_ENV = "development";
+      delete process.env[ENV_KEY];
+      expect(isOriginAllowedForCredentials("http://localhost:5974")).toBe(true);
+      expect(isOriginAllowedForCredentials("http://127.0.0.1:4173")).toBe(true);
+      expect(isOriginAllowedForCredentials("http://[::1]:3000")).toBe(true);
+      expect(isOriginAllowedForCredentials("https://localhost:8443")).toBe(true);
+      expect(isOriginAllowedForCredentials("http://localhost.evil.example")).toBe(false);
+      expect(isOriginAllowedForCredentials("http://evil.example:5974")).toBe(false);
+      // A custom allowlist does not switch the loopback rule off in development.
+      process.env[ENV_KEY] = "https://app.example";
+      expect(isOriginAllowedForCredentials("http://localhost:5974")).toBe(true);
+
+      process.env.NODE_ENV = "production";
+      expect(isOriginAllowedForCredentials("http://localhost:5974")).toBe(false);
+      delete process.env.NODE_ENV;
+      expect(isOriginAllowedForCredentials("http://localhost:5974")).toBe(false);
+    } finally {
+      if (originalNodeEnv === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = originalNodeEnv;
+    }
+  });
+
   test("denies arbitrary origins when CORS_ALLOWED_ORIGINS is blank", () => {
     process.env[ENV_KEY] = "  ";
     expect(isOriginAllowedForCredentials("https://evil.example")).toBe(false);

package/src/tests/create-page-tool.test.ts

@@ -159,6 +159,24 @@ describe("create_page MCP tool", () => {
     // Parent now holds the new body.
     const row = await getPageBySlug(agentId, "upsert");
     expect(row?.body).toBe("v1");
+
+    // The counter and the next snapshot number keep climbing from MAX(version).
+    const third = (await tool.handler(
+      {
+        title: "Upsert Page",
+        slug: "upsert",
+        body: "v2",
+        contentType: "text/html",
+        authMode: "public",
+      },
+      fakeMeta,
+    )) as { structuredContent: { version: number } };
+    expect(third.structuredContent.version).toBe(3);
+    const after = await getPageVersions(first.structuredContent.id);
+    expect(after.map((v) => [v.version, v.snapshot.body])).toEqual([
+      [2, "v1"],
+      [1, "v0"],
+    ]);
   });
 
   test("missing X-Agent-ID returns an error result", async () => {