@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/tests/fixtures/runner-legacy-resume-prompt.ts

@@ -0,0 +1,122 @@
+/**
+ * Runs the real runner boot in a child process up to the legacy paused-task
+ * resume, and records the prompts the provider receives for that session.
+ */
+import { mock } from "bun:test";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import type { ProviderSessionConfig } from "../../providers/types";
+
+const directory = process.argv[2]!;
+const pausedTaskId = "44444444-4444-4444-8444-444444444444";
+const REQUESTER_SENTINEL = "RESUME_REQUESTER_SENTINEL_7f3a";
+const MISSING_DIR = "/nonexistent/legacy-resume-dir-7f3a";
+
+const resolver = await import("../../prompts/resolver");
+mock.module("../../prompts/resolver", () => ({
+  ...resolver,
+  configureHttpResolver() {},
+}));
+const profileSync = await import("../../commands/profile-sync");
+mock.module("../../commands/profile-sync", () => ({
+  ...profileSync,
+  SOUL_MD_PATH: join(directory, "SOUL.md"),
+  IDENTITY_MD_PATH: join(directory, "IDENTITY.md"),
+  TOOLS_MD_PATH: join(directory, "TOOLS.md"),
+  HEARTBEAT_MD_PATH: join(directory, "HEARTBEAT.md"),
+  CLAUDE_MD_PATH: join(directory, "CLAUDE.md"),
+  WORKSPACE_CLAUDE_MD_PATH: join(directory, "CLAUDE.md"),
+  SETUP_SCRIPT_PATH: join(directory, "start-up.sh"),
+  IDENTITY_BASELINES_PATH: join(directory, "baselines.json"),
+  async readIdentityBaselines() {
+    return {};
+  },
+  async writeProfileFileFromDb() {
+    return null;
+  },
+  async writeIdentityBaselines() {},
+  async syncProfileFilesToServer() {},
+  async prependProfileSyncRejectionBanner(prompt: string) {
+    return { prompt, injected: false };
+  },
+}));
+mock.module("../../utils/skills-refresh", () => ({
+  async refreshSkillsIfChanged() {
+    return { changed: false };
+  },
+}));
+const credentials = await import("../../utils/credentials");
+mock.module("../../utils/credentials", () => ({
+  ...credentials,
+  async resolveCredentialPools() {
+    return [];
+  },
+}));
+
+mock.module("../../providers/index", () => ({
+  async createProviderAdapter() {
+    return {
+      name: "pi",
+      traits: { hasMcp: true, hasLocalEnvironment: true, nativeSkillDiscovery: false },
+      formatCommand(name: string, args: string) {
+        return `/${name} ${args}`;
+      },
+      async createSession(config: ProviderSessionConfig) {
+        writeFileSync(
+          join(directory, "result.json"),
+          JSON.stringify({
+            taskId: config.taskId,
+            prompt: config.prompt,
+            systemPrompt: config.systemPrompt,
+          }),
+        );
+        // runAgent runs forever; the first spawn is the resumed task.
+        process.exit(0);
+      },
+    };
+  },
+}));
+
+// All requests terminate here. The paused-tasks endpoint carries the
+// requester projection the API attaches, as on a task_assigned trigger.
+globalThis.fetch = (async (input: string | URL | Request) => {
+  const url = new URL(input instanceof Request ? input.url : input.toString());
+  if (url.pathname === "/me") {
+    return Response.json({ name: "Fixture agent", soulMd: "Fixture soul" });
+  }
+  if (url.pathname === "/api/paused-tasks") {
+    return Response.json({
+      tasks: [
+        {
+          id: pausedTaskId,
+          task: "Resume the paused fixture task",
+          status: "paused",
+          dir: MISSING_DIR,
+          attachments: [],
+          requestedBy: {
+            id: "user-1",
+            name: "Fixture Requester",
+            email: "requester@example.com",
+            role: "CTO",
+            notes: REQUESTER_SENTINEL,
+          },
+        },
+      ],
+    });
+  }
+  if (url.pathname === "/api/poll") return new Promise(() => {});
+  if (url.pathname === "/api/config/resolved") return Response.json({ configs: [] });
+  if (url.pathname === "/api/agents") return Response.json({ enabledCapabilities: [] });
+  if (url.pathname === "/cancelled-tasks") return Response.json({ cancelled: [] });
+  if (url.pathname.startsWith("/api/tasks/")) {
+    return Response.json({ success: true, task: { id: pausedTaskId, status: "in_progress" } });
+  }
+  return Response.json({ enabled: false, recovered: 0, memories: [], configs: [] });
+}) as typeof fetch;
+
+process.env.MAX_CONCURRENT_TASKS = "1";
+const { runAgent } = await import("../../commands/runner");
+await runAgent(
+  { role: "worker", defaultPrompt: "Fixture", metadataType: "worker_metadata" },
+  { logsDir: join(directory, "logs"), systemPrompt: "Additional fixture instructions" },
+);

package/src/tests/github-handlers.test.ts

@@ -421,3 +421,38 @@ describe("no github email enrichment", () => {
     expect(await getKv(UNMAPPED_NAMESPACE, "triage-target:count")).toBeNull();
   });
 });
+
+// ── Every no-task comment path logs why ──
+
+describe("comment skip reasons", () => {
+  async function skippedReasons(events: CommentEvent[]): Promise<string[]> {
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      for (const event of events) {
+        expect((await handleComment(event, "issue_comment")).created).toBe(false);
+      }
+      return logSpy.mock.calls
+        .map((args) => String(args[0]))
+        .filter((line) => line.startsWith("[GitHub] Skipped issue_comment."));
+    } finally {
+      logSpy.mockRestore();
+    }
+  }
+
+  test("edited, unmentioned and duplicate comments each log a reason", async () => {
+    const mention = `@${GITHUB_BOT_NAME} please review`;
+    const edited = { ...makeCommentEvent("skip-edit", mention), action: "edited" };
+    edited.comment = { ...edited.comment, id: 7001 };
+    const noMention = makeCommentEvent("skip-plain", "no ping here");
+    noMention.comment = { ...noMention.comment, id: 7002 };
+    const first = makeCommentEvent("skip-dup", mention);
+    first.comment = { ...first.comment, id: 7003 };
+
+    expect((await handleComment(first, "issue_comment")).created).toBe(true);
+    expect(await skippedReasons([edited, noMention, first])).toEqual([
+      "[GitHub] Skipped issue_comment.edited by skip-edit on test/repo comment 7001: action is not created",
+      "[GitHub] Skipped issue_comment.created by skip-plain on test/repo comment 7002: no bot mention",
+      "[GitHub] Skipped issue_comment.created by skip-dup on test/repo comment 7003: duplicate delivery",
+    ]);
+  });
+});

package/src/tests/harness-provider-resolution.test.ts

@@ -158,6 +158,18 @@ describe("resolveHarnessProvider", () => {
   test("keeps 'claude' when no credentials are present at all", () => {
     expect(resolveHarnessProvider({}, {})).toBe("claude");
   });
+
+  test("prefers 'pi' when a NaN or Helmcode key is the only LLM credential", () => {
+    expect(resolveHarnessProvider({ NAN_API_KEY: "example-nan" }, {})).toBe("pi");
+    expect(resolveHarnessProvider({}, { HELMCODE_API_NAN: "example-nan" })).toBe("pi");
+    expect(resolveHarnessProvider({ HELMCODE_API_KEY: "example-helm" }, {})).toBe("pi");
+  });
+
+  test("keeps 'claude' when a NaN key sits next to an Anthropic credential", () => {
+    expect(
+      resolveHarnessProvider({ NAN_API_KEY: "example-nan", ANTHROPIC_API_KEY: "example-ant" }, {}),
+    ).toBe("claude");
+  });
 });
 
 // ─── validateConfigValue ─────────────────────────────────────────────────────

package/src/tests/heartbeat-checklist.test.ts

@@ -524,7 +524,8 @@ describe("Heartbeat Checklist", () => {
             buildCredentials: () => {
               setupStarted.resolve();
               return new Promise((resolve) => {
-                releaseSetup = () => resolve({ egressSecrets: [], failedBindings: [] });
+                releaseSetup = () =>
+                  resolve({ egressSecrets: [], failedBindings: [], userConfig: {} });
               });
             },
           });
@@ -561,7 +562,7 @@ describe("Heartbeat Checklist", () => {
         {
           buildCredentials: async () => {
             controller.abort();
-            return { egressSecrets: [], failedBindings: [] };
+            return { egressSecrets: [], failedBindings: [], userConfig: {} };
           },
         },
       );

package/src/tests/heartbeat-jev-gate-credentials.test.ts

@@ -0,0 +1,168 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, initDb, upsertSwarmConfig } from "../be/db";
+import { buildScriptCredentialBindingsWithFailures } from "../be/script-credential-broker";
+import { patchFetchWithEgressSubstitution } from "../scripts-runtime/egress-secrets";
+import { runScript } from "../scripts-runtime/loader";
+import { registerSystemOneDecideTool } from "../tools/system-one-decide";
+import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+
+// The Jev gate's two provider keys must never reach a script's JavaScript realm,
+// and an OpenRouter key must never go to openrouter.ai while the deployment
+// routes OpenRouter through a gateway. These tests drive the real credential
+// resolver, the real fetch patch and the real script runtime.
+
+const TYPESAFE_KEY = "typesafe-jev-regression-key";
+const OPENROUTER_KEY = "openrouter-jev-regression-key";
+const GATEWAY = "https://gateway.example/v1";
+
+const savedEnv = { ...process.env };
+const realFetch = globalThis.fetch;
+const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
+
+let agentId: string;
+
+beforeAll(async () => {
+  initDb(":memory:");
+  agentId = (await createAgent({ name: "jev-cred-lead", isLead: true, status: "idle" })).id;
+  for (const [key, value] of [
+    ["TYPESAFE_API_KEY", TYPESAFE_KEY],
+    ["OPENROUTER_API_KEY", OPENROUTER_KEY],
+  ]) {
+    await upsertSwarmConfig({ scope: "global", key, value, isSecret: true });
+  }
+});
+
+afterAll(() => closeDb());
+
+beforeEach(() => {
+  process.env.AGENT_SWARM_API_KEY = "example-jev-gate-credentials-api-key-123";
+  // The gateway is set only in the environment, never as a stored config row.
+  process.env.OPENROUTER_BASE_URL = GATEWAY;
+  refreshSecretScrubberCache();
+});
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  refreshSecretScrubberCache();
+});
+
+/** Records the Authorization header of every request that reaches the network layer. */
+function recordAuthorization(): Array<{ url: string; authorization: string | null }> {
+  const sent: Array<{ url: string; authorization: string | null }> = [];
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = input instanceof Request ? input.url : String(input);
+    sent.push({ url, authorization: new Headers(init?.headers).get("authorization") });
+    return Response.json({
+      model: "jev-latest",
+      answers: { act: { type: "noul", noul: 0.2 } },
+      usage: { input_tokens: 10, output_tokens: 0 },
+    });
+  }) as typeof fetch;
+  return sent;
+}
+
+describe("script egress never carries the Jev keys", () => {
+  test("a script fetch to openrouter.ai or api.typesafe.ai gets no stored key", async () => {
+    const { egressSecrets } = await buildScriptCredentialBindingsWithFailures({ agentId });
+    const sent = recordAuthorization();
+    patchFetchWithEgressSubstitution(egressSecrets);
+    await fetch("https://openrouter.ai/api/alpha/decisions", {
+      method: "POST",
+      headers: { Authorization: "Bearer [REDACTED:OPENROUTER_API_KEY]" },
+      body: "{}",
+    });
+    await fetch("https://api.typesafe.ai/v1/systemone", {
+      method: "POST",
+      headers: { Authorization: "Bearer [REDACTED:TYPESAFE_API_KEY]" },
+      body: "{}",
+    });
+
+    expect(sent).toHaveLength(2);
+    for (const { authorization } of sent) {
+      expect(authorization ?? "").not.toContain(OPENROUTER_KEY);
+      expect(authorization ?? "").not.toContain(TYPESAFE_KEY);
+    }
+    expect(egressSecrets.map((s) => s.configKey)).not.toContain("OPENROUTER_API_KEY");
+    expect(egressSecrets.map((s) => s.configKey)).not.toContain("TYPESAFE_API_KEY");
+  });
+
+  spawnTest("a script that hooks Headers.prototype.set captures neither key", async () => {
+    // Same env-sourced resolution runScript() uses when the caller passes no bindings.
+    process.env.TYPESAFE_API_KEY = TYPESAFE_KEY;
+    process.env.OPENROUTER_API_KEY = OPENROUTER_KEY;
+    const output = await runScript({
+      agentId,
+      resources: { memoryMb: 2048 },
+      source: `
+        async function capture(url, placeholder) {
+          let captured = "";
+          const savedSet = Headers.prototype.set;
+          Headers.prototype.set = function (key, value) {
+            if (String(key).toLowerCase() === "authorization") captured = String(value).slice(7);
+            return savedSet.call(this, key, value);
+          };
+          const abort = new AbortController();
+          abort.abort();
+          await fetch(url, {
+            signal: abort.signal,
+            headers: { Authorization: "Bearer " + placeholder },
+          }).catch(() => {});
+          Headers.prototype.set = savedSet;
+          return btoa(captured);
+        }
+        export default async () => ({
+          typesafe: await capture("https://api.typesafe.ai/", "[REDACTED:TYPESAFE_API_KEY]"),
+          openrouter: await capture("https://openrouter.ai/", "[REDACTED:OPENROUTER_API_KEY]"),
+        });
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    const result = output.result as { typesafe: string; openrouter: string };
+    expect(atob(result.typesafe)).not.toContain(TYPESAFE_KEY);
+    expect(atob(result.openrouter)).not.toContain(OPENROUTER_KEY);
+  });
+});
+
+describe("system-one-decide keeps the key on the server", () => {
+  const extra = () => ({ sessionId: "s", requestInfo: { headers: { "x-agent-id": agentId } } });
+  const tool = () => {
+    const server = new McpServer({ name: "jev-cred-decide", version: "1" });
+    registerSystemOneDecideTool(server);
+    return (server as any)._registeredTools["system-one-decide"];
+  };
+  const request = (provider: string) => ({
+    provider,
+    state: { now: "2026-10-16 10:00 UTC" },
+    questions: { act: { type: "noul", instructions: "Act now?" } },
+    maxRetries: 0,
+  });
+
+  test("openrouter is refused while OPENROUTER_BASE_URL is a gateway, with no request sent", async () => {
+    const sent = recordAuthorization();
+    const result = await tool().handler(request("openrouter"), extra());
+    expect(result.isError).toBe(true);
+    expect(result.structuredContent.message).toContain("OPENROUTER_BASE_URL points at a gateway");
+    expect(sent).toHaveLength(0);
+  });
+
+  test("typesafe answers; the key goes only to api.typesafe.ai and never into the result", async () => {
+    const sent = recordAuthorization();
+    const result = await tool().handler(request("typesafe"), extra());
+    expect(result.isError).toBeFalsy();
+    expect(result.structuredContent.answers.act.noul).toBe(0.2);
+    expect(sent).toEqual([
+      { url: "https://api.typesafe.ai/v1/systemone", authorization: `Bearer ${TYPESAFE_KEY}` },
+    ]);
+    expect(JSON.stringify(result)).not.toContain(TYPESAFE_KEY);
+  });
+});