@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/tests/credential-check.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, mock, test } from "bun:test";
+import { OPENAI_COMPATIBLE_PROVIDERS } from "@desplega/model-catalog";
 import {
   buildCredStatusReport,
   CREDENTIAL_PROVIDER_CHECKERS,
+  checkOpenAICompatibleProvider,
   checkProviderCredentials,
   isBedrockMode,
   isCredCheckDisabled,
@@ -652,6 +654,37 @@ describe("checkOpencodeCredentials", () => {
     ).toBe(true);
   });
 
+  test("strict: nan/* needs NAN_API_KEY or its HELMCODE_API_NAN alias", () => {
+    const env = { MODEL_OVERRIDE: "nan/glm5.3-flash", OPENROUTER_API_KEY: "x" };
+    const missing = checkOpencodeCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(missing.ready).toBe(false);
+    expect(missing.missing).toContain("NAN_API_KEY");
+    for (const name of ["NAN_API_KEY", "HELMCODE_API_NAN"]) {
+      expect(
+        checkOpencodeCredentials({ ...env, [name]: "x" }, { homeDir: HOME, fs: noFiles }).ready,
+      ).toBe(true);
+    }
+  });
+
+  test("strict: helmcode/* needs HELMCODE_API_KEY, not the NaN alias", () => {
+    const env = { MODEL_OVERRIDE: "helmcode/glm5.3", HELMCODE_API_NAN: "x" };
+    const missing = checkOpencodeCredentials(env, { homeDir: HOME, fs: noFiles });
+    expect(missing.ready).toBe(false);
+    expect(missing.missing).toContain("HELMCODE_API_KEY");
+    expect(
+      checkOpencodeCredentials({ ...env, HELMCODE_API_KEY: "x" }, { homeDir: HOME, fs: noFiles })
+        .ready,
+    ).toBe(true);
+  });
+
+  test("permissive: a NaN or Helmcode key alone is enough", () => {
+    for (const name of ["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]) {
+      expect(checkOpencodeCredentials({ [name]: "x" }, { homeDir: HOME, fs: noFiles }).ready).toBe(
+        true,
+      );
+    }
+  });
+
   test("not ready when nothing is set", () => {
     const status = checkOpencodeCredentials({}, { homeDir: HOME, fs: noFiles });
     expect(status.ready).toBe(false);
@@ -923,6 +956,112 @@ describe("REQUIRED_CRED_VARS_BY_PROVIDER", () => {
     // acp is credential-free by design: the target process owns its own auth.
     expect(REQUIRED_CRED_VARS_BY_PROVIDER.acp).toEqual([]);
   });
+
+  test("pi and opencode list the NaN (both names) and Helmcode key vars", () => {
+    for (const p of ["pi", "opencode"] as const) {
+      expect(REQUIRED_CRED_VARS_BY_PROVIDER[p]).toEqual(
+        expect.arrayContaining(["NAN_API_KEY", "HELMCODE_API_NAN", "HELMCODE_API_KEY"]),
+      );
+    }
+  });
+});
+
+describe("NaN and Helmcode live probes", () => {
+  const envReady = { ready: true, missing: [], satisfiedBy: "env" as const };
+
+  function fakeProvider(status: number) {
+    const seen: Array<{ path: string; authorization: string | null }> = [];
+    const server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        seen.push({
+          path: new URL(req.url).pathname,
+          authorization: req.headers.get("authorization"),
+        });
+        return new Response(status === 200 ? '{"data":[]}' : '{"error":"Invalid API key."}', {
+          status,
+        });
+      },
+    });
+    return { server, seen, baseUrl: `${server.url.toString().replace(/\/$/, "")}/v1` };
+  }
+
+  for (const [name, probe] of [
+    [
+      "nan",
+      (key: string, url: string) =>
+        checkOpenAICompatibleProvider(OPENAI_COMPATIBLE_PROVIDERS.nan, key, url),
+    ],
+    [
+      "helmcode",
+      (key: string, url: string) =>
+        checkOpenAICompatibleProvider(OPENAI_COMPATIBLE_PROVIDERS.helmcode, key, url),
+    ],
+  ] as const) {
+    test(`${name} probe lists models with a Bearer key at the injected base URL`, async () => {
+      const ok = fakeProvider(200);
+      const bad = fakeProvider(401);
+      try {
+        expect(await probe("fixture-key", `${ok.baseUrl}/`)).toMatchObject({ ok: true });
+        expect(ok.seen).toEqual([{ path: "/v1/models", authorization: "Bearer fixture-key" }]);
+        const failure = await probe("fixture-key", bad.baseUrl);
+        expect(failure.ok).toBe(false);
+        expect(failure.error).toContain("HTTP 401");
+      } finally {
+        ok.server.stop(true);
+        bad.server.stop(true);
+      }
+    });
+  }
+
+  for (const provider of ["pi", "opencode"] as const) {
+    for (const [env, url] of [
+      [{ NAN_API_KEY: "fixture-nan" }, "https://api.nan.builders/v1/models"],
+      [{ HELMCODE_API_NAN: "fixture-nan" }, "https://api.nan.builders/v1/models"],
+      [{ HELMCODE_API_KEY: "fixture-helm" }, "https://api.helmcode.com/v1/models"],
+      // `<ID>_BASE_URL` moves the probe with the provider.
+      [
+        { NAN_API_KEY: "fixture-nan", NAN_BASE_URL: "https://nan-gw.example.test/v1/" },
+        "https://nan-gw.example.test/v1/models",
+      ],
+    ] as const) {
+      test(`${provider}: ${Object.keys(env).join("+")} is probed at ${url}`, async () => {
+        const realFetch = globalThis.fetch;
+        const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+          return new Response("{}", { status: 200 });
+        });
+        globalThis.fetch = fetchMock as typeof fetch;
+        try {
+          const result = await validateProviderCredentials(provider, { ...env }, envReady);
+          expect(result.ok).toBe(true);
+          expect(fetchMock).toHaveBeenCalledTimes(1);
+          expect(String(fetchMock.mock.calls[0]?.[0])).toBe(url);
+          const headers = fetchMock.mock.calls[0]?.[1]?.headers as Record<string, string>;
+          expect(headers.Authorization).toBe(`Bearer ${Object.values(env)[0]}`);
+        } finally {
+          globalThis.fetch = realFetch;
+        }
+      });
+    }
+
+    test(`${provider}: an OpenRouter key keeps the probe ahead of a NaN key`, async () => {
+      const realFetch = globalThis.fetch;
+      const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+        return new Response("{}", { status: 200 });
+      });
+      globalThis.fetch = fetchMock as typeof fetch;
+      try {
+        await validateProviderCredentials(
+          provider,
+          { OPENROUTER_API_KEY: "fixture-or", NAN_API_KEY: "fixture-nan" },
+          envReady,
+        );
+        expect(String(fetchMock.mock.calls[0]?.[0])).not.toContain("nan.builders");
+      } finally {
+        globalThis.fetch = realFetch;
+      }
+    });
+  }
 });
 
 // ─── Migration 055: report composition + opt-out ────────────────────────────

package/src/tests/credentials.test.ts

@@ -84,4 +84,25 @@ describe("validateOpencodeCredentials", () => {
       validateOpencodeCredentials({ OPENROUTER_API_KEY: "sk-or", ANTHROPIC_API_KEY: "sk-ant" }),
     ).toBe("openrouter_api_key");
   });
+
+  test("accepts a NaN key under either name", () => {
+    expect(validateOpencodeCredentials({ NAN_API_KEY: "example-nan" })).toBe("nan_api_key");
+    expect(validateOpencodeCredentials({ HELMCODE_API_NAN: "example-nan" })).toBe("nan_api_key");
+  });
+
+  test("accepts a Helmcode key", () => {
+    expect(validateOpencodeCredentials({ HELMCODE_API_KEY: "example-helm" })).toBe(
+      "helmcode_api_key",
+    );
+  });
+
+  test("keeps OpenRouter ahead of NaN and Helmcode", () => {
+    expect(
+      validateOpencodeCredentials({
+        OPENROUTER_API_KEY: "sk-or",
+        NAN_API_KEY: "example-nan",
+        HELMCODE_API_KEY: "example-helm",
+      }),
+    ).toBe("openrouter_api_key");
+  });
 });

package/src/tests/db-runtime.test.ts

@@ -1,6 +1,11 @@
+import { Database } from "bun:sqlite";
 import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import * as facade from "../be/db";
 import * as runtime from "../be/db/runtime";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
 
 const runtimeExports = [
   "__resetSqliteVecExtensionPathCacheForTests",
@@ -67,4 +72,60 @@ describe("database runtime facade", () => {
       globals.__testMigrationTemplate = template;
     }
   });
+
+  // rbac-admission-e2e restarted its server on an existing DB and the server
+  // died with "Encryption key not resolved yet": boot hit SQLITE_BUSY before
+  // resolving the key, and the db-client's BUSY retry reused the half-booted
+  // handle instead of booting again. Child processes boot cold (no test
+  // template) and leave no in-process connection blocking the lock below.
+  test(
+    "a cold boot that hits SQLITE_BUSY boots again before serving queries",
+    async () => {
+      const dir = mkdtempSync(join(tmpdir(), "db-runtime-busy-"));
+      const dbPath = join(dir, "boot.sqlite");
+      const child = (source: string) =>
+        runChild([process.execPath, "--eval", source], {
+          cwd: new URL("../../", import.meta.url).pathname,
+          env: { ...process.env, DATABASE_PATH: dbPath, AGENT_SWARM_TELEMETRY_DISABLED: "1" },
+        });
+      try {
+        expectChildOk(
+          await child(`
+            const db = await import("./src/be/db");
+            db.initDb(process.env.DATABASE_PATH);
+            await db.upsertSwarmConfig({ scope: "global", key: "BOOT_BUSY_SECRET", value: "boot-busy-value", isSecret: true });
+            db.closeDb();
+          `),
+          "seed",
+        );
+
+        const holder = new Database(dbPath);
+        holder.run("PRAGMA locking_mode = EXCLUSIVE");
+        holder.run("BEGIN EXCLUSIVE");
+        let released = false;
+        const releaseLock = () => {
+          if (released) return;
+          released = true;
+          holder.run("COMMIT");
+          holder.close();
+        };
+        const release = setTimeout(releaseLock, 500);
+        try {
+          const read = await child(`
+            const db = await import("./src/be/db");
+            const configs = await db.getInjectableGlobalConfigs();
+            console.log("VALUE=" + configs.find((c) => c.key === "BOOT_BUSY_SECRET")?.value);
+          `);
+          expect(read.stderr).not.toContain("Encryption key not resolved yet");
+          expect(read.stdout).toContain("VALUE=boot-busy-value");
+        } finally {
+          clearTimeout(release);
+          releaseLock();
+        }
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS * 2,
+  );
 });

package/src/tests/db-task-read-contract.test.ts

@@ -72,6 +72,7 @@ type:McpServerFilters
 type:McpServerInsert
 type:MentionPreview
 type:PageListOptions
+type:PendingChatRelay
 type:PlanSource
 type:RecordBudgetRefusalNotificationInput
 type:ScheduledTaskFilters
@@ -109,6 +110,7 @@ value:NOT_EXTENSION_AGENT_SQL
 value:ReservedAgentRoleError
 value:SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS
 value:SKILL_FILE_LIMITS
+value:SUPERSEDED_RESUME_REPAIR_WINDOW_MS
 value:UNATTRIBUTED_USER_ID
 value:__resetSqliteVecExtensionPathCacheForTests
 value:abandonSlackOutcomeDelivery
@@ -237,6 +239,7 @@ value:getAgentMcpServers
 value:getAgentSkills
 value:getAgentStatusCounts
 value:getAgentWithTasks
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllAgentMailInboxMappings
 value:getAllAgents
@@ -298,8 +301,10 @@ value:getKv
 value:getLastReadAt
 value:getLastRunStart
 value:getLastSuccessfulRun
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
 value:getLatestContextVersion
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestPageBySlug
 value:getLatestScriptRunStepTaskByContextKey
@@ -329,6 +334,7 @@ value:getPageVersion
 value:getPageVersions
 value:getPausedTasksForAgent
 value:getPendingApprovalVoteState
+value:getPendingChatRelayTasks
 value:getPendingEventWaitNames
 value:getPendingSlackRelayTasks
 value:getPendingSteeringForAgent
@@ -426,6 +432,7 @@ value:getWorkflowRunStepsByRunId
 value:getWorkflowVersion
 value:getWorkflowVersions
 value:getWorkflowsByScheduleId
+value:giveUpStaleChatRelays
 value:hasBudgetRefusalNotificationToday
 value:hasCapacity
 value:hasFirstCompletedTask
@@ -477,6 +484,9 @@ value:listUserFavorites
 value:listWorkflowRuns
 value:listWorkflowRunsPage
 value:listWorkflows
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markInboxMessageDelegated
 value:markInboxMessageRead
@@ -505,6 +515,7 @@ value:promoteDraftTask
 value:reassociateSessionLogs
 value:recordApprovalVotes
 value:recordBudgetRefusalNotification
+value:recordChatRelayError
 value:recordInlineScriptRun
 value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows
@@ -598,24 +609,30 @@ value:upsertSwarmConfig
 value:withFavoriteFlags`.split("\n");
 const selected = `type:ExistingTrackerContextWork
 type:ExistingTrackerContextWorkReason
+type:PendingChatRelay
 type:TaskFilters
+value:SUPERSEDED_RESUME_REPAIR_WINDOW_MS
 value:findCompletedTaskInThread
 value:findExistingLinearTrackerContextWork
 value:findRecentCancelledTaskInThread
 value:findTaskByGitHub
 value:findTaskByVcs
 value:getAgentCurrentTask
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllTasks
 value:getChildTasks
 value:getCompletedSlackTasks
 value:getInProgressSlackTasks
 value:getInProgressTasksByContextKey
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestScriptRunStepTaskByContextKey
 value:getLatestTaskByContextKey
 value:getMostRecentTaskInThread
+value:getPendingChatRelayTasks
 value:getPendingSlackRelayTasks
 value:getRecentlyFinishedWorkerTasks
 value:getSlackTasksMissingTree
@@ -626,13 +643,18 @@ value:getTaskStats
 value:getTasksByAgentId
 value:getTasksByStatus
 value:getTasksCount
+value:giveUpStaleChatRelays
 value:hasNonTerminalRerouteDecisionChild
 value:hasNonTerminalResumeChild
 value:isLinearTrackerContextKey
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markSlackRelayAttempted
 value:markSlackRelayDelivered
 value:markTasksNotified
+value:recordChatRelayError
 value:resetTasksNotified`.split("\n");
 const internal = [
   "type:AgentTaskRow",

package/src/tests/db-task-write-contract.test.ts

@@ -95,6 +95,7 @@ type:McpServerFilters
 type:McpServerInsert
 type:MentionPreview
 type:PageListOptions
+type:PendingChatRelay
 type:PlanSource
 type:RecordBudgetRefusalNotificationInput
 type:ScheduledTaskFilters
@@ -132,6 +133,7 @@ value:NOT_EXTENSION_AGENT_SQL
 value:ReservedAgentRoleError
 value:SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS
 value:SKILL_FILE_LIMITS
+value:SUPERSEDED_RESUME_REPAIR_WINDOW_MS
 value:UNATTRIBUTED_USER_ID
 value:__resetSqliteVecExtensionPathCacheForTests
 value:abandonSlackOutcomeDelivery
@@ -260,6 +262,7 @@ value:getAgentMcpServers
 value:getAgentSkills
 value:getAgentStatusCounts
 value:getAgentWithTasks
+value:getAgentWorkingOnContextKey
 value:getAgentWorkingOnThread
 value:getAllAgentMailInboxMappings
 value:getAllAgents
@@ -321,8 +324,10 @@ value:getKv
 value:getLastReadAt
 value:getLastRunStart
 value:getLastSuccessfulRun
+value:getLatestActiveTaskByContextKey
 value:getLatestActiveTaskInThread
 value:getLatestContextVersion
+value:getLatestLeadTaskByContextKey
 value:getLatestLeadTaskInThread
 value:getLatestPageBySlug
 value:getLatestScriptRunStepTaskByContextKey
@@ -352,6 +357,7 @@ value:getPageVersion
 value:getPageVersions
 value:getPausedTasksForAgent
 value:getPendingApprovalVoteState
+value:getPendingChatRelayTasks
 value:getPendingEventWaitNames
 value:getPendingSlackRelayTasks
 value:getPendingSteeringForAgent
@@ -449,6 +455,7 @@ value:getWorkflowRunStepsByRunId
 value:getWorkflowVersion
 value:getWorkflowVersions
 value:getWorkflowsByScheduleId
+value:giveUpStaleChatRelays
 value:hasBudgetRefusalNotificationToday
 value:hasCapacity
 value:hasFirstCompletedTask
@@ -500,6 +507,9 @@ value:listUserFavorites
 value:listWorkflowRuns
 value:listWorkflowRunsPage
 value:listWorkflows
+value:markChatRelayAttempted
+value:markChatRelayDelivered
+value:markChatRelayGivenUp
 value:markFinalizedSlackRelaysDelivered
 value:markInboxMessageDelegated
 value:markInboxMessageRead
@@ -528,6 +538,7 @@ value:promoteDraftTask
 value:reassociateSessionLogs
 value:recordApprovalVotes
 value:recordBudgetRefusalNotification
+value:recordChatRelayError
 value:recordInlineScriptRun
 value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows

package/src/tests/deferred-task-wake.test.ts

@@ -21,6 +21,10 @@ import {
   supersedeTask,
   updateScheduledTask,
 } from "../be/db";
+import { installExtension, setExtensionState } from "../be/extensions/db";
+import { listRegistered, registerLoaded, unregister } from "../extensions/dispatcher";
+import { ensureExtensionAgent } from "../extensions/identity";
+import { loadExtension } from "../extensions/loader";
 import {
   dispatchDeferredTaskWait,
   initDeferredTaskWaits,
@@ -32,6 +36,7 @@ import { dispatchScheduleTarget, executeSchedule } from "../scheduler/scheduler"
 import { createResumeFollowUp } from "../tasks/worker-follow-up";
 import { registerDeferTaskTool } from "../tools/defer-task";
 import type { AgentTask } from "../types";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 
 type Result = { structuredContent: { success: boolean; message: string; scheduleId?: string } };
 type Tool = {
@@ -69,7 +74,13 @@ beforeAll(async () => {
     "defer-task"
   ]!;
 });
-afterEach(() => stopDeferredTaskWaits());
+afterEach(async () => {
+  stopDeferredTaskWaits();
+  for (const loaded of listRegistered()) {
+    unregister(loaded.record.id);
+    await loaded.dispose();
+  }
+});
 afterAll(async () => {
   closeDb();
   templateGlobals.__testMigrationTemplate = savedTemplate;
@@ -172,6 +183,72 @@ async function multiFixture(mode?: "all" | "any", event: TaskWakeEvent = "settle
 }
 
 describe("defer-task wakeOn", () => {
+  async function ceilingHook(action: string) {
+    const bundle = await loadBundleFixture("minimal");
+    bundle.manifest = { ...bundle.manifest, name: `ceiling-${crypto.randomUUID()}` };
+    bundle.files["hooks.ts"] = `
+      import { block, modify } from "swarm-extension";
+      export default (api) => {
+        api.on("pre.task.create", () => ${action});
+      };
+    `;
+    const installed = await installExtension(bundle);
+    const record = await setExtensionState(installed.extension.id, {
+      agentId: await ensureExtensionAgent(installed.extension.name),
+    });
+    const loaded = await loadExtension({ record: record!, ...bundle });
+    registerLoaded(loaded);
+    return loaded;
+  }
+
+  test("ceiling honours pre.task.create blocks and leaves the wait pending", async () => {
+    const { schedule } = await fixture();
+    await ceilingHook('block("ceiling denied")');
+    await executeSchedule(schedule);
+    expect(await children(schedule.id)).toHaveLength(0);
+    expect(await waitState(schedule.id)).toMatchObject({ status: "pending", childTaskId: null });
+    expect(await getScheduledTaskById(schedule.id)).toMatchObject({
+      consecutiveErrors: 1,
+      lastErrorMessage: expect.stringContaining("ceiling denied"),
+    });
+  });
+
+  test("ceiling applies pre.task.create payload modifications", async () => {
+    const { schedule } = await fixture();
+    await ceilingHook('modify({ description: "modified ceiling wake" })');
+    await executeSchedule(schedule);
+    const found = await children(schedule.id);
+    expect(found).toHaveLength(1);
+    expect(found[0]!.task).toBe("modified ceiling wake");
+    expect(await waitState(schedule.id)).toMatchObject({ status: "fired", firedBy: "ceiling" });
+  });
+
+  test("a ceiling moved during pre-hook preparation cannot fire the stale occurrence", async () => {
+    const { schedule } = await fixture();
+    const nextRunAt = new Date(Date.now() + 120_000).toISOString();
+    const loaded = await ceilingHook('modify({ description: "stale preparation" })');
+    const handler = loaded.handlers[0]!;
+    const original = handler.handler;
+    handler.handler = async (event, ctx) => {
+      await updateScheduledTask(schedule.id, { nextRunAt });
+      return original(event, ctx);
+    };
+    await executeSchedule(schedule);
+    expect(await children(schedule.id)).toHaveLength(0);
+    expect(await waitState(schedule.id)).toMatchObject({ status: "pending" });
+    expect(await getScheduledTaskById(schedule.id)).toMatchObject({ enabled: true, nextRunAt });
+  });
+
+  test("a stale ceiling snapshot cannot fire after re-defer moves nextRunAt", async () => {
+    const { schedule } = await fixture();
+    const nextRunAt = new Date(Date.now() + 120_000).toISOString();
+    await updateScheduledTask(schedule.id, { nextRunAt });
+    await executeSchedule(schedule);
+    expect(await children(schedule.id)).toHaveLength(0);
+    expect(await waitState(schedule.id)).toMatchObject({ status: "pending" });
+    expect(await getScheduledTaskById(schedule.id)).toMatchObject({ enabled: true, nextRunAt });
+  });
+
   test.each([
     "completed",
     "failed",

package/src/tests/docs-index-footprint.test.js

@@ -78,7 +78,7 @@ describe("docs API index footprint", () => {
     expect(tasks).toContain('"path":"/api/task-templates","method":"get"');
   });
 
-  test("OpenAPI and generated pages keep all 400 operations", async () => {
+  test("OpenAPI and generated pages keep all 425 operations", async () => {
     const spec = await Bun.file(resolve(repoRoot, "openapi.json")).json();
     const operationKeys = [];
     const tags = new Set();
@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(424);
-    expect(generatedKeys).toHaveLength(424);
+    expect(operationKeys).toHaveLength(430);
+    expect(generatedKeys).toHaveLength(430);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });
 

package/src/tests/dsh-adapter.test.ts

@@ -376,7 +376,7 @@ describe("dsh harness", () => {
     await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
     config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
     await expect(new DshAdapter().createSession(config)).rejects.toThrow(
-      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.3",
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.5",
     );
     expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
   });

package/src/tests/enabled-capabilities.test.ts

@@ -0,0 +1,20 @@
+import { afterEach, expect, test } from "bun:test";
+import { ALL_CAPABILITIES, getEnabledCapabilities, hasCapability } from "../server";
+
+const originalCapabilities = process.env.CAPABILITIES;
+
+afterEach(() => {
+  if (originalCapabilities === undefined) delete process.env.CAPABILITIES;
+  else process.env.CAPABILITIES = originalCapabilities;
+});
+
+// `services` was a real capability until the PM2 service registry was removed.
+// A deployment that still lists it must keep registering agents: the register
+// response validates enabledCapabilities against ALL_CAPABILITIES.
+test("enabledCapabilities drops retired and free-form names", () => {
+  process.env.CAPABILITIES = "core,services,artifacts,pages";
+
+  expect(ALL_CAPABILITIES as readonly string[]).not.toContain("services");
+  expect(getEnabledCapabilities()).toEqual(["core", "pages"]);
+  expect(hasCapability("pages")).toBe(true);
+});

package/src/tests/entrypoint-api-readiness.test.ts

@@ -221,28 +221,34 @@ describe("wait_for_api_ready: immediate success", () => {
 
 describe("wait_for_api_ready: transient failure then success", () => {
   test("retries roughly once per second until the server recovers", async () => {
-    let requestCount = 0;
+    // A per-test path prefix: an ephemeral port can be reused from another test
+    // process whose poller still hits /health, and those stray requests used
+    // to count as retries (3 requests in 1033 ms on CI).
+    const prefix = `/${crypto.randomUUID()}`;
+    const requestTimes: number[] = [];
     server = Bun.serve({
       port: 0,
       hostname: "127.0.0.1",
       fetch(req) {
         const url = new URL(req.url);
-        if (url.pathname !== "/health") return new Response("not found", { status: 404 });
-        requestCount += 1;
-        if (requestCount < 3) return new Response("unavailable", { status: 503 });
+        if (url.pathname !== `${prefix}/health`) return new Response("not found", { status: 404 });
+        requestTimes.push(performance.now());
+        if (requestTimes.length < 3) return new Response("unavailable", { status: 503 });
         return new Response("ok", { status: 200 });
       },
     });
 
-    const result = await runWaitForApiReady(server.url.toString(), {
+    const result = await runWaitForApiReady(`${server.url.origin}${prefix}/`, {
       WORKER_API_READY_TIMEOUT_SECONDS: "10",
     });
 
     expect(result.exitCode).toBe(0);
-    expect(requestCount).toBeGreaterThanOrEqual(3);
+    expect(requestTimes).toHaveLength(3);
     expect(result.stdout).toContain("API ready at");
-    // Two ~1s retries before success — bounded, not instant, not stalled.
-    expect(result.durationMs).toBeGreaterThanOrEqual(1500);
+    // Each retry waits out `sleep 1` after the previous response, so the
+    // server-side gap cannot shrink under load: paced, not a hot loop.
+    expect(requestTimes[1]! - requestTimes[0]!).toBeGreaterThanOrEqual(900);
+    expect(requestTimes[2]! - requestTimes[1]!).toBeGreaterThanOrEqual(900);
     expect(result.durationMs).toBeLessThan(15000);
   }, 20000);
 });

package/src/tests/entrypoint-config-env-export.test.ts

@@ -93,7 +93,10 @@ function extractExportFilter(lineMarker: string): string {
   const line = script.split("\n").find((l) => l.includes(lineMarker) && l.includes("jq -r '"));
   if (!line) throw new Error(`Could not locate the jq line containing ${lineMarker}`);
   const start = line.indexOf("jq -r '") + "jq -r '".length;
-  const end = line.indexOf("' /tmp/swarm_config.json", start);
+  // Inline programs read /tmp/swarm_config.json; the swarm_config_env_lines
+  // function reads its "$1" argument.
+  const ends = ["' /tmp/swarm_config.json", '\' "$1"'].map((tail) => line.indexOf(tail, start));
+  const end = ends.find((index) => index !== -1) ?? -1;
   if (end === -1) throw new Error(`Could not locate the end of the jq program for ${lineMarker}`);
   return line.slice(start, end);
 }
@@ -127,7 +130,7 @@ describe("entrypoint config env export: real jq filter", () => {
   test(
     "never exports codex_oauth or codex_oauth_<n>, nor the runner-resolved keys",
     async () => {
-      const lines = await runJq(extractExportFilter("> /tmp/swarm_config.env"), configs);
+      const lines = await runJq(extractExportFilter("(.value | @sh)"), configs);
       const keys = lines.map((l) => l.slice(0, l.indexOf("=")));
       expect(keys).toEqual(["NORMAL", "codex_oauth_extra"]);
       expect(lines.join("\n")).not.toContain("rt.secret");