@desplega.ai/agent-swarm 1.173.0 → 2.0.0

package/src/tests/credential-check.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, mock, test } from "bun:test";
+import { OPENAI_COMPATIBLE_PROVIDERS } from "@desplega/model-catalog";
 import {
   buildCredStatusReport,
   CREDENTIAL_PROVIDER_CHECKERS,
+  checkOpenAICompatibleProvider,
   checkProviderCredentials,
   isBedrockMode,
   isCredCheckDisabled,
@@ -652,6 +654,37 @@ describe("checkOpencodeCredentials", () => {
     ).toBe(true);
   });
 
+  test("strict: nan/* needs NAN_API_KEY or its HELMCODE_API_NAN alias", () => {
+    const env = { MODEL_OVERRIDE: "nan/glm5.3-flash", OPENROUTER_API_KEY: "x" };
+    const missing = checkOpencodeCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(missing.ready).toBe(false);
+    expect(missing.missing).toContain("NAN_API_KEY");
+    for (const name of ["NAN_API_KEY", "HELMCODE_API_NAN"]) {
+      expect(
+        checkOpencodeCredentials({ ...env, [name]: "x" }, { homeDir: HOME, fs: noFiles }).ready,
+      ).toBe(true);
+    }
+  });
+
+  test("strict: helmcode/* needs HELMCODE_API_KEY, not the NaN alias", () => {
+    const env = { MODEL_OVERRIDE: "helmcode/glm5.3", HELMCODE_API_NAN: "x" };
+    const missing = checkOpencodeCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(missing.ready).toBe(false);
+    expect(missing.missing).toContain("HELMCODE_API_KEY");
+    expect(
+      checkOpencodeCredentials({ ...env, HELMCODE_API_KEY: "x" }, { homeDir: HOME, fs: noFiles })
+        .ready,
+    ).toBe(true);
+  });
+
+  test("permissive: a NaN or Helmcode key alone is enough", () => {
+    for (const name of ["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]) {
+      expect(checkOpencodeCredentials({ [name]: "x" }, { homeDir: HOME, fs: noFiles }).ready).toBe(
+        true,
+      );
+    }
+  });
+
   test("not ready when nothing is set", () => {
     const status = checkOpencodeCredentials({}, { homeDir: HOME, fs: noFiles });
     expect(status.ready).toBe(false);
@@ -923,6 +956,112 @@ describe("REQUIRED_CRED_VARS_BY_PROVIDER", () => {
     // acp is credential-free by design: the target process owns its own auth.
     expect(REQUIRED_CRED_VARS_BY_PROVIDER.acp).toEqual([]);
   });
+
+  test("pi and opencode list the NaN (both names) and Helmcode key vars", () => {
+    for (const p of ["pi", "opencode"] as const) {
+      expect(REQUIRED_CRED_VARS_BY_PROVIDER[p]).toEqual(
+        expect.arrayContaining(["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]),
+      );
+    }
+  });
+});
+
+describe("NaN and Helmcode live probes", () => {
+  const envReady = { ready: true, missing: [], satisfiedBy: "env" as const };
+
+  function fakeProvider(status: number) {
+    const seen: Array<{ path: string; authorization: string | null }> = [];
+    const server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        seen.push({
+          path: new URL(req.url).pathname,
+          authorization: req.headers.get("authorization"),
+        });
+        return new Response(status === 200 ? '{"data":[]}' : '{"error":"Invalid API key."}', {
+          status,
+        });
+      },
+    });
+    return { server, seen, baseUrl: `${server.url.toString().replace(/\/$/, "")}/v1` };
+  }
+
+  for (const [name, probe] of [
+    [
+      "nan",
+      (key: string, url: string) =>
+        checkOpenAICompatibleProvider(OPENAI_COMPATIBLE_PROVIDERS.nan, key, url),
+    ],
+    [
+      "helmcode",
+      (key: string, url: string) =>
+        checkOpenAICompatibleProvider(OPENAI_COMPATIBLE_PROVIDERS.helmcode, key, url),
+    ],
+  ] as const) {
+    test(`${name} probe lists models with a Bearer key at the injected base URL`, async () => {
+      const ok = fakeProvider(200);
+      const bad = fakeProvider(401);
+      try {
+        expect(await probe("fixture-key", `${ok.baseUrl}/`)).toMatchObject({ ok: true });
+        expect(ok.seen).toEqual([{ path: "/v1/models", authorization: "Bearer fixture-key" }]);
+        const failure = await probe("fixture-key", bad.baseUrl);
+        expect(failure.ok).toBe(false);
+        expect(failure.error).toContain("HTTP 401");
+      } finally {
+        ok.server.stop(true);
+        bad.server.stop(true);
+      }
+    });
+  }
+
+  for (const provider of ["pi", "opencode"] as const) {
+    for (const [env, url] of [
+      [{ NAN_API_KEY: "fixture-nan" }, "https://api.nan.builders/v1/models"],
+      [{ HELMCODE_API_NAN: "fixture-nan" }, "https://api.nan.builders/v1/models"],
+      [{ HELMCODE_API_KEY: "fixture-helm" }, "https://api.helmcode.com/v1/models"],
+      // `<ID>_BASE_URL` moves the probe with the provider.
+      [
+        { NAN_API_KEY: "fixture-nan", NAN_BASE_URL: "https://nan-gw.example.test/v1/" },
+        "https://nan-gw.example.test/v1/models",
+      ],
+    ] as const) {
+      test(`${provider}: ${Object.keys(env).join("+")} is probed at ${url}`, async () => {
+        const realFetch = globalThis.fetch;
+        const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+          return new Response("{}", { status: 200 });
+        });
+        globalThis.fetch = fetchMock as typeof fetch;
+        try {
+          const result = await validateProviderCredentials(provider, { ...env }, envReady);
+          expect(result.ok).toBe(true);
+          expect(fetchMock).toHaveBeenCalledTimes(1);
+          expect(String(fetchMock.mock.calls[0]?.[0])).toBe(url);
+          const headers = fetchMock.mock.calls[0]?.[1]?.headers as Record<string, string>;
+          expect(headers.Authorization).toBe(`Bearer ${Object.values(env)[0]}`);
+        } finally {
+          globalThis.fetch = realFetch;
+        }
+      });
+    }
+
+    test(`${provider}: an OpenRouter key keeps the probe ahead of a NaN key`, async () => {
+      const realFetch = globalThis.fetch;
+      const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+        return new Response("{}", { status: 200 });
+      });
+      globalThis.fetch = fetchMock as typeof fetch;
+      try {
+        await validateProviderCredentials(
+          provider,
+          { OPENROUTER_API_KEY: "fixture-or", NAN_API_KEY: "fixture-nan" },
+          envReady,
+        );
+        expect(String(fetchMock.mock.calls[0]?.[0])).not.toContain("nan.builders");
+      } finally {
+        globalThis.fetch = realFetch;
+      }
+    });
+  }
 });
 
 // ─── Migration 055: report composition + opt-out ────────────────────────────

package/src/tests/credentials.test.ts

@@ -84,4 +84,25 @@ describe("validateOpencodeCredentials", () => {
       validateOpencodeCredentials({ OPENROUTER_API_KEY: "sk-or", ANTHROPIC_API_KEY: "sk-ant" }),
     ).toBe("openrouter_api_key");
   });
+
+  test("accepts a NaN key under either name", () => {
+    expect(validateOpencodeCredentials({ NAN_API_KEY: "example-nan" })).toBe("nan_api_key");
+    expect(validateOpencodeCredentials({ HELMCODE_API_NAN: "example-nan" })).toBe("nan_api_key");
+  });
+
+  test("accepts a Helmcode key", () => {
+    expect(validateOpencodeCredentials({ HELMCODE_API_KEY: "example-helm" })).toBe(
+      "helmcode_api_key",
+    );
+  });
+
+  test("keeps OpenRouter ahead of NaN and Helmcode", () => {
+    expect(
+      validateOpencodeCredentials({
+        OPENROUTER_API_KEY: "sk-or",
+        NAN_API_KEY: "example-nan",
+        HELMCODE_API_KEY: "example-helm",
+      }),
+    ).toBe("openrouter_api_key");
+  });
 });

package/src/tests/db-runtime.test.ts

@@ -1,6 +1,11 @@
+import { Database } from "bun:sqlite";
 import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import * as facade from "../be/db";
 import * as runtime from "../be/db/runtime";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
 
 const runtimeExports = [
   "__resetSqliteVecExtensionPathCacheForTests",
@@ -67,4 +72,60 @@ describe("database runtime facade", () => {
       globals.__testMigrationTemplate = template;
     }
   });
+
+  // rbac-admission-e2e restarted its server on an existing DB and the server
+  // died with "Encryption key not resolved yet": boot hit SQLITE_BUSY before
+  // resolving the key, and the db-client's BUSY retry reused the half-booted
+  // handle instead of booting again. Child processes boot cold (no test
+  // template) and leave no in-process connection blocking the lock below.
+  test(
+    "a cold boot that hits SQLITE_BUSY boots again before serving queries",
+    async () => {
+      const dir = mkdtempSync(join(tmpdir(), "db-runtime-busy-"));
+      const dbPath = join(dir, "boot.sqlite");
+      const child = (source: string) =>
+        runChild([process.execPath, "--eval", source], {
+          cwd: new URL("../../", import.meta.url).pathname,
+          env: { ...process.env, DATABASE_PATH: dbPath, AGENT_SWARM_TELEMETRY_DISABLED: "1" },
+        });
+      try {
+        expectChildOk(
+          await child(`
+            const db = await import("./src/be/db");
+            db.initDb(process.env.DATABASE_PATH);
+            await db.upsertSwarmConfig({ scope: "global", key: "BOOT_BUSY_SECRET", value: "boot-busy-value", isSecret: true });
+            db.closeDb();
+          `),
+          "seed",
+        );
+
+        const holder = new Database(dbPath);
+        holder.run("PRAGMA locking_mode = EXCLUSIVE");
+        holder.run("BEGIN EXCLUSIVE");
+        let released = false;
+        const releaseLock = () => {
+          if (released) return;
+          released = true;
+          holder.run("COMMIT");
+          holder.close();
+        };
+        const release = setTimeout(releaseLock, 500);
+        try {
+          const read = await child(`
+            const db = await import("./src/be/db");
+            const configs = await db.getInjectableGlobalConfigs();
+            console.log("VALUE=" + configs.find((c) => c.key === "BOOT_BUSY_SECRET")?.value);
+          `);
+          expect(read.stderr).not.toContain("Encryption key not resolved yet");
+          expect(read.stdout).toContain("VALUE=boot-busy-value");
+        } finally {
+          clearTimeout(release);
+          releaseLock();
+        }
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS * 2,
+  );
 });

package/src/tests/db-task-read-contract.test.ts

@@ -72,6 +72,7 @@ type:McpServerFilters
 type:McpServerInsert
 type:MentionPreview
 type:PageListOptions
+type:PendingChatRelay
 type:PlanSource
 type:RecordBudgetRefusalNotificationInput
 type:ScheduledTaskFilters
@@ -237,6 +238,7 @@ value:getAgentMcpServers
 value:getAgentSkills
 value:getAgentStatusCounts
 value:getAgentWithTasks
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllAgentMailInboxMappings
 value:getAllAgents
@@ -298,8 +300,10 @@ value:getKv
 value:getLastReadAt
 value:getLastRunStart
 value:getLastSuccessfulRun
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
 value:getLatestContextVersion
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestPageBySlug
 value:getLatestScriptRunStepTaskByContextKey
@@ -329,6 +333,7 @@ value:getPageVersion
 value:getPageVersions
 value:getPausedTasksForAgent
 value:getPendingApprovalVoteState
+value:getPendingChatRelayTasks
 value:getPendingEventWaitNames
 value:getPendingSlackRelayTasks
 value:getPendingSteeringForAgent
@@ -426,6 +431,7 @@ value:getWorkflowRunStepsByRunId
 value:getWorkflowVersion
 value:getWorkflowVersions
 value:getWorkflowsByScheduleId
+value:giveUpStaleChatRelays
 value:hasBudgetRefusalNotificationToday
 value:hasCapacity
 value:hasFirstCompletedTask
@@ -477,6 +483,9 @@ value:listUserFavorites
 value:listWorkflowRuns
 value:listWorkflowRunsPage
 value:listWorkflows
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markInboxMessageDelegated
 value:markInboxMessageRead
@@ -505,6 +514,7 @@ value:promoteDraftTask
 value:reassociateSessionLogs
 value:recordApprovalVotes
 value:recordBudgetRefusalNotification
+value:recordChatRelayError
 value:recordInlineScriptRun
 value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows
@@ -598,6 +608,7 @@ value:upsertSwarmConfig
 value:withFavoriteFlags`.split("\n");
 const selected = `type:ExistingTrackerContextWork
 type:ExistingTrackerContextWorkReason
+type:PendingChatRelay
 type:TaskFilters
 value:findCompletedTaskInThread
 value:findExistingLinearTrackerContextWork
@@ -605,17 +616,21 @@ value:findRecentCancelledTaskInThread
 value:findTaskByGitHub
 value:findTaskByVcs
 value:getAgentCurrentTask
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllTasks
 value:getChildTasks
 value:getCompletedSlackTasks
 value:getInProgressSlackTasks
 value:getInProgressTasksByContextKey
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestScriptRunStepTaskByContextKey
 value:getLatestTaskByContextKey
 value:getMostRecentTaskInThread
+value:getPendingChatRelayTasks
 value:getPendingSlackRelayTasks
 value:getRecentlyFinishedWorkerTasks
 value:getSlackTasksMissingTree
@@ -626,13 +641,18 @@ value:getTaskStats
 value:getTasksByAgentId
 value:getTasksByStatus
 value:getTasksCount
+value:giveUpStaleChatRelays
 value:hasNonTerminalRerouteDecisionChild
 value:hasNonTerminalResumeChild
 value:isLinearTrackerContextKey
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markSlackRelayAttempted
 value:markSlackRelayDelivered
 value:markTasksNotified
+value:recordChatRelayError
 value:resetTasksNotified`.split("\n");
 const internal = [
   "type:AgentTaskRow",

package/src/tests/db-task-write-contract.test.ts

@@ -95,6 +95,7 @@ type:McpServerFilters
 type:McpServerInsert
 type:MentionPreview
 type:PageListOptions
+type:PendingChatRelay
 type:PlanSource
 type:RecordBudgetRefusalNotificationInput
 type:ScheduledTaskFilters
@@ -260,6 +261,7 @@ value:getAgentMcpServers
 value:getAgentSkills
 value:getAgentStatusCounts
 value:getAgentWithTasks
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllAgentMailInboxMappings
 value:getAllAgents
@@ -321,8 +323,10 @@ value:getKv
 value:getLastReadAt
 value:getLastRunStart
 value:getLastSuccessfulRun
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
 value:getLatestContextVersion
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestPageBySlug
 value:getLatestScriptRunStepTaskByContextKey
@@ -352,6 +356,7 @@ value:getPageVersion
 value:getPageVersions
 value:getPausedTasksForAgent
 value:getPendingApprovalVoteState
+value:getPendingChatRelayTasks
 value:getPendingEventWaitNames
 value:getPendingSlackRelayTasks
 value:getPendingSteeringForAgent
@@ -449,6 +454,7 @@ value:getWorkflowRunStepsByRunId
 value:getWorkflowVersion
 value:getWorkflowVersions
 value:getWorkflowsByScheduleId
+value:giveUpStaleChatRelays
 value:hasBudgetRefusalNotificationToday
 value:hasCapacity
 value:hasFirstCompletedTask
@@ -500,6 +506,9 @@ value:listUserFavorites
 value:listWorkflowRuns
 value:listWorkflowRunsPage
 value:listWorkflows
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markInboxMessageDelegated
 value:markInboxMessageRead
@@ -528,6 +537,7 @@ value:promoteDraftTask
 value:reassociateSessionLogs
 value:recordApprovalVotes
 value:recordBudgetRefusalNotification
+value:recordChatRelayError
 value:recordInlineScriptRun
 value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows

package/src/tests/docs-index-footprint.test.js

@@ -78,7 +78,7 @@ describe("docs API index footprint", () => {
     expect(tasks).toContain('"path":"/api/task-templates","method":"get"');
   });
 
-  test("OpenAPI and generated pages keep all 400 operations", async () => {
+  test("OpenAPI and generated pages keep all 425 operations", async () => {
     const spec = await Bun.file(resolve(repoRoot, "openapi.json")).json();
     const operationKeys = [];
     const tags = new Set();
@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(424);
-    expect(generatedKeys).toHaveLength(424);
+    expect(operationKeys).toHaveLength(425);
+    expect(generatedKeys).toHaveLength(425);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });
 

package/src/tests/dsh-adapter.test.ts

@@ -376,7 +376,7 @@ describe("dsh harness", () => {
     await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
     config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
     await expect(new DshAdapter().createSession(config)).rejects.toThrow(
-      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.3",
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.4",
     );
     expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
   });

package/src/tests/enabled-capabilities.test.ts

@@ -0,0 +1,20 @@
+import { afterEach, expect, test } from "bun:test";
+import { ALL_CAPABILITIES, getEnabledCapabilities, hasCapability } from "../server";
+
+const originalCapabilities = process.env.CAPABILITIES;
+
+afterEach(() => {
+  if (originalCapabilities === undefined) delete process.env.CAPABILITIES;
+  else process.env.CAPABILITIES = originalCapabilities;
+});
+
+// `services` was a real capability until the PM2 service registry was removed.
+// A deployment that still lists it must keep registering agents: the register
+// response validates enabledCapabilities against ALL_CAPABILITIES.
+test("enabledCapabilities drops retired and free-form names", () => {
+  process.env.CAPABILITIES = "core,services,artifacts,pages";
+
+  expect(ALL_CAPABILITIES as readonly string[]).not.toContain("services");
+  expect(getEnabledCapabilities()).toEqual(["core", "pages"]);
+  expect(hasCapability("pages")).toBe(true);
+});

package/src/tests/entrypoint-api-readiness.test.ts

@@ -221,28 +221,34 @@ describe("wait_for_api_ready: immediate success", () => {
 
 describe("wait_for_api_ready: transient failure then success", () => {
   test("retries roughly once per second until the server recovers", async () => {
-    let requestCount = 0;
+    // A per-test path prefix: an ephemeral port can be reused from another test
+    // process whose poller still hits /health, and those stray requests used
+    // to count as retries (3 requests in 1033 ms on CI).
+    const prefix = `/${crypto.randomUUID()}`;
+    const requestTimes: number[] = [];
     server = Bun.serve({
       port: 0,
       hostname: "127.0.0.1",
       fetch(req) {
         const url = new URL(req.url);
-        if (url.pathname !== "/health") return new Response("not found", { status: 404 });
-        requestCount += 1;
-        if (requestCount < 3) return new Response("unavailable", { status: 503 });
+        if (url.pathname !== `${prefix}/health`) return new Response("not found", { status: 404 });
+        requestTimes.push(performance.now());
+        if (requestTimes.length < 3) return new Response("unavailable", { status: 503 });
         return new Response("ok", { status: 200 });
       },
     });
 
-    const result = await runWaitForApiReady(server.url.toString(), {
+    const result = await runWaitForApiReady(`${server.url.origin}${prefix}/`, {
       WORKER_API_READY_TIMEOUT_SECONDS: "10",
     });
 
     expect(result.exitCode).toBe(0);
-    expect(requestCount).toBeGreaterThanOrEqual(3);
+    expect(requestTimes).toHaveLength(3);
     expect(result.stdout).toContain("API ready at");
-    // Two ~1s retries before success — bounded, not instant, not stalled.
-    expect(result.durationMs).toBeGreaterThanOrEqual(1500);
+    // Each retry waits out `sleep 1` after the previous response, so the
+    // server-side gap cannot shrink under load: paced, not a hot loop.
+    expect(requestTimes[1]! - requestTimes[0]!).toBeGreaterThanOrEqual(900);
+    expect(requestTimes[2]! - requestTimes[1]!).toBeGreaterThanOrEqual(900);
     expect(result.durationMs).toBeLessThan(15000);
   }, 20000);
 });

package/src/tests/entrypoint-config-env-export.test.ts

@@ -93,7 +93,10 @@ function extractExportFilter(lineMarker: string): string {
   const line = script.split("\n").find((l) => l.includes(lineMarker) && l.includes("jq -r '"));
   if (!line) throw new Error(`Could not locate the jq line containing ${lineMarker}`);
   const start = line.indexOf("jq -r '") + "jq -r '".length;
-  const end = line.indexOf("' /tmp/swarm_config.json", start);
+  // Inline programs read /tmp/swarm_config.json; the swarm_config_env_lines
+  // function reads its "$1" argument.
+  const ends = ["' /tmp/swarm_config.json", '\' "$1"'].map((tail) => line.indexOf(tail, start));
+  const end = ends.find((index) => index !== -1) ?? -1;
   if (end === -1) throw new Error(`Could not locate the end of the jq program for ${lineMarker}`);
   return line.slice(start, end);
 }
@@ -127,7 +130,7 @@ describe("entrypoint config env export: real jq filter", () => {
   test(
     "never exports codex_oauth or codex_oauth_<n>, nor the runner-resolved keys",
     async () => {
-      const lines = await runJq(extractExportFilter("> /tmp/swarm_config.env"), configs);
+      const lines = await runJq(extractExportFilter("(.value | @sh)"), configs);
       const keys = lines.map((l) => l.slice(0, l.indexOf("=")));
       expect(keys).toEqual(["NORMAL", "codex_oauth_extra"]);
       expect(lines.join("\n")).not.toContain("rt.secret");

package/src/tests/entrypoint-export-to-env.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
+
+/**
+ * Runs the real swarm_config_env block from docker-entrypoint.sh (extracted
+ * between its BEGIN/END markers) against a /api/config/resolved fixture, the
+ * same way the entrypoint sources it, and reads the resulting env.
+ */
+
+const entrypoint = readFileSync("docker-entrypoint.sh", "utf8");
+const block = entrypoint.slice(
+  entrypoint.indexOf("# BEGIN swarm_config_env"),
+  entrypoint.indexOf("# END swarm_config_env"),
+);
+
+let dir = "";
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), "entrypoint-export-"));
+});
+afterAll(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+async function exportedEnv(configs: unknown[], containerEnv: Record<string, string> = {}) {
+  const fixture = join(dir, `${crypto.randomUUID()}.json`);
+  writeFileSync(fixture, JSON.stringify({ configs }));
+  const script = `${block}
+swarm_config_env_lines "$1" > "$1.env"
+set -a; . "$1.env"; set +a
+for withheld_key in $(swarm_config_withheld_keys "$1"); do unset "$withheld_key"; done
+env
+`;
+  const result = await runChild(["bash", "-c", script, "bash", fixture], {
+    env: { PATH: process.env.PATH ?? "/usr/bin:/bin", ...containerEnv },
+    timeoutMs: CHILD_PROCESS_TEST_BUDGET_MS,
+  });
+  expectChildOk(result, "entrypoint export block");
+  return Object.fromEntries(
+    result.stdout
+      .split("\n")
+      .filter((line) => line.includes("="))
+      .map((line) => [line.slice(0, line.indexOf("=")), line.slice(line.indexOf("=") + 1)]),
+  );
+}
+
+describe("docker-entrypoint.sh swarm_config_env", () => {
+  test("markers are present", () => {
+    expect(block).toContain("swarm_config_env_lines()");
+    expect(block).toContain("swarm_config_withheld_keys()");
+  });
+
+  test("exports exportToEnv rows and drops withheld ones, including container copies", async () => {
+    const env = await exportedEnv(
+      [
+        { key: "GITHUB_TOKEN", value: "row-github", isSecret: true, exportToEnv: true },
+        { key: "VERCEL_TOKEN", value: "row-vercel", isSecret: true, exportToEnv: false },
+        { key: "QUOTED", value: "it's $HOME", isSecret: false, exportToEnv: true },
+        // A pre-215 API sends no flag: the row keeps exporting.
+        { key: "LEGACY", value: "row-legacy", isSecret: true },
+        { key: "CF-Access-Client-Id", value: "x", isSecret: true, exportToEnv: true },
+        { key: "codex_oauth_1", value: "x", isSecret: true, exportToEnv: true },
+        { key: "HARNESS_PROVIDER", value: "pi", isSecret: false, exportToEnv: true },
+      ],
+      { VERCEL_TOKEN: "container-vercel" },
+    );
+    expect(env.GITHUB_TOKEN).toBe("row-github");
+    expect(env.QUOTED).toBe("it's $HOME");
+    expect(env.LEGACY).toBe("row-legacy");
+    expect(env.VERCEL_TOKEN).toBeUndefined();
+    expect(env.codex_oauth_1).toBeUndefined();
+    expect(env.HARNESS_PROVIDER).toBeUndefined();
+    expect(Object.values(env)).not.toContain("row-vercel");
+  });
+});