@desplega.ai/agent-swarm 1.20.0 → 1.51.2

package/src/tests/update-profile-agentid.test.ts

@@ -0,0 +1,248 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createAgent,
+  getAgentById,
+  getLatestContextVersion,
+  initDb,
+  updateAgentName,
+  updateAgentProfile,
+} from "../be/db";
+
+const TEST_DB_PATH = "./test-update-profile-agentid.sqlite";
+
+describe("update-profile agentId authorization", () => {
+  const leadId = "aaaa0000-0000-4000-8000-000000000001";
+  const workerId = "bbbb0000-0000-4000-8000-000000000002";
+  const otherWorkerId = "cccc0000-0000-4000-8000-000000000003";
+  const nonExistentId = "dddd0000-0000-4000-8000-000000000099";
+
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // File doesn't exist
+      }
+    }
+
+    closeDb();
+    initDb(TEST_DB_PATH);
+
+    createAgent({ id: leadId, name: "Test Lead", isLead: true, status: "idle" });
+    createAgent({ id: workerId, name: "Test Worker", isLead: false, status: "idle" });
+    createAgent({ id: otherWorkerId, name: "Other Worker", isLead: false, status: "idle" });
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // File doesn't exist
+      }
+    }
+  });
+
+  // ==========================================================================
+  // Authorization logic (simulates update-profile tool handler checks)
+  // ==========================================================================
+
+  describe("lead agent can update another agent's profile", () => {
+    test("lead updates worker description", () => {
+      const callingAgent = getAgentById(leadId);
+      expect(callingAgent).not.toBeNull();
+      expect(callingAgent!.isLead).toBe(true);
+
+      // Lead updating another agent — this is the happy path
+      const updated = updateAgentProfile(
+        workerId,
+        { description: "Updated by lead" },
+        { changeSource: "lead_coaching", changedByAgentId: leadId },
+      );
+      expect(updated).not.toBeNull();
+      expect(updated!.description).toBe("Updated by lead");
+    });
+
+    test("lead updates worker soulMd with lead_coaching changeSource", () => {
+      const updated = updateAgentProfile(
+        workerId,
+        { soulMd: "# Soul updated by lead" },
+        { changeSource: "lead_coaching", changedByAgentId: leadId },
+      );
+      expect(updated).not.toBeNull();
+      expect(updated!.soulMd).toBe("# Soul updated by lead");
+
+      // Verify the context version records lead_coaching as changeSource
+      const version = getLatestContextVersion(workerId, "soulMd");
+      expect(version).not.toBeNull();
+      expect(version!.changeSource).toBe("lead_coaching");
+      expect(version!.changedByAgentId).toBe(leadId);
+    });
+
+    test("lead updates worker name", () => {
+      const updated = updateAgentName(workerId, "Renamed Worker");
+      expect(updated).not.toBeNull();
+      expect(updated!.name).toBe("Renamed Worker");
+
+      // Rename back for other tests
+      updateAgentName(workerId, "Test Worker");
+    });
+  });
+
+  describe("non-lead is rejected when providing agentId", () => {
+    test("non-lead agent cannot update another agent's profile", () => {
+      const callingAgent = getAgentById(workerId);
+      expect(callingAgent).not.toBeNull();
+      expect(callingAgent!.isLead).toBe(false);
+
+      // The tool handler checks isLead before calling DB functions.
+      // Simulate the authorization check the tool performs:
+      const isUpdatingSelf = otherWorkerId === workerId; // false — different agent
+      expect(isUpdatingSelf).toBe(false);
+
+      // Non-lead should be rejected
+      const canUpdate = callingAgent!.isLead;
+      expect(canUpdate).toBe(false);
+    });
+
+    test("non-lead agent cannot update lead's profile", () => {
+      const callingAgent = getAgentById(workerId);
+      expect(callingAgent!.isLead).toBe(false);
+
+      const isUpdatingSelf = leadId === workerId; // false
+      expect(isUpdatingSelf).toBe(false);
+
+      // Authorization would reject this
+      expect(callingAgent!.isLead).toBe(false);
+    });
+  });
+
+  describe("self-update via explicit agentId works without lead check", () => {
+    test("agent providing own agentId is treated as self-update", () => {
+      // Simulate: agentId param = caller's own ID
+      const requestAgentId = workerId;
+      const paramAgentId = workerId;
+      const isUpdatingSelf = !paramAgentId || paramAgentId === requestAgentId;
+      expect(isUpdatingSelf).toBe(true);
+
+      // Self-update should succeed regardless of isLead status
+      const updated = updateAgentProfile(
+        workerId,
+        { description: "Self-updated via explicit agentId" },
+        { changeSource: "self_edit", changedByAgentId: workerId },
+      );
+      expect(updated).not.toBeNull();
+      expect(updated!.description).toBe("Self-updated via explicit agentId");
+    });
+
+    test("self-update with omitted agentId also works", () => {
+      // When agentId is undefined, isUpdatingSelf = true
+      const agentId = undefined;
+      const isUpdatingSelf = !agentId || agentId === workerId;
+      expect(isUpdatingSelf).toBe(true);
+
+      const updated = updateAgentProfile(
+        workerId,
+        { role: "updated-role" },
+        { changeSource: "self_edit", changedByAgentId: workerId },
+      );
+      expect(updated).not.toBeNull();
+      expect(updated!.role).toBe("updated-role");
+    });
+  });
+
+  describe("invalid agentId returns appropriate error", () => {
+    test("updateAgentProfile returns null for non-existent target agent", () => {
+      const result = updateAgentProfile(
+        nonExistentId,
+        { description: "Should fail" },
+        { changeSource: "lead_coaching", changedByAgentId: leadId },
+      );
+      expect(result).toBeNull();
+    });
+
+    test("updateAgentName returns null for non-existent target agent", () => {
+      const result = updateAgentName(nonExistentId, "Ghost Agent");
+      expect(result).toBeNull();
+    });
+
+    test("getAgentById returns null for non-existent agent", () => {
+      const agent = getAgentById(nonExistentId);
+      expect(agent).toBeNull();
+    });
+  });
+
+  describe("changeSource is correct for remote vs self updates", () => {
+    test("lead_coaching changeSource for lead updating worker identityMd", () => {
+      updateAgentProfile(
+        otherWorkerId,
+        { identityMd: "# Identity set by lead" },
+        { changeSource: "lead_coaching", changedByAgentId: leadId },
+      );
+
+      const version = getLatestContextVersion(otherWorkerId, "identityMd");
+      expect(version).not.toBeNull();
+      expect(version!.changeSource).toBe("lead_coaching");
+      expect(version!.changedByAgentId).toBe(leadId);
+    });
+
+    test("self_edit changeSource for agent updating own claudeMd", () => {
+      updateAgentProfile(
+        workerId,
+        { claudeMd: "# My notes" },
+        { changeSource: "self_edit", changedByAgentId: workerId },
+      );
+
+      const version = getLatestContextVersion(workerId, "claudeMd");
+      expect(version).not.toBeNull();
+      expect(version!.changeSource).toBe("self_edit");
+      expect(version!.changedByAgentId).toBe(workerId);
+    });
+
+    test("lead_coaching changeSource for lead updating worker toolsMd", () => {
+      updateAgentProfile(
+        workerId,
+        { toolsMd: "# Tools set by lead" },
+        { changeSource: "lead_coaching", changedByAgentId: leadId },
+      );
+
+      const version = getLatestContextVersion(workerId, "toolsMd");
+      expect(version).not.toBeNull();
+      expect(version!.changeSource).toBe("lead_coaching");
+      expect(version!.changedByAgentId).toBe(leadId);
+    });
+
+    test("self_edit changeSource for agent updating own setupScript", () => {
+      updateAgentProfile(
+        otherWorkerId,
+        { setupScript: "echo hello" },
+        { changeSource: "self_edit", changedByAgentId: otherWorkerId },
+      );
+
+      const version = getLatestContextVersion(otherWorkerId, "setupScript");
+      expect(version).not.toBeNull();
+      expect(version!.changeSource).toBe("self_edit");
+      expect(version!.changedByAgentId).toBe(otherWorkerId);
+    });
+  });
+
+  // ==========================================================================
+  // Target agent existence validation (non-blocking suggestion)
+  // ==========================================================================
+
+  describe("target agent existence validation", () => {
+    test("getAgentById can validate target exists before update", () => {
+      // The tool should validate the target agent exists before attempting updates
+      const targetAgent = getAgentById(nonExistentId);
+      expect(targetAgent).toBeNull();
+
+      // Valid target should be found
+      const validTarget = getAgentById(workerId);
+      expect(validTarget).not.toBeNull();
+      expect(validTarget!.id).toBe(workerId);
+    });
+  });
+});

package/src/tests/update-profile-api.test.ts

@@ -30,7 +30,14 @@ async function handleRequest(
   ) {
     const agentId = pathSegments[2];
 
-    let body: { role?: string; description?: string; capabilities?: string[]; claudeMd?: string };
+    let body: {
+      role?: string;
+      description?: string;
+      capabilities?: string[];
+      claudeMd?: string;
+      soulMd?: string;
+      identityMd?: string;
+    };
     try {
       body = JSON.parse(bodyText);
     } catch {
@@ -42,13 +49,15 @@ async function handleRequest(
       body.role === undefined &&
       body.description === undefined &&
       body.capabilities === undefined &&
-      body.claudeMd === undefined
+      body.claudeMd === undefined &&
+      body.soulMd === undefined &&
+      body.identityMd === undefined
     ) {
       return {
         status: 400,
         body: {
           error:
-            "At least one field (role, description, capabilities, or claudeMd) must be provided",
+            "At least one field (role, description, capabilities, claudeMd, soulMd, or identityMd) must be provided",
         },
       };
     }
@@ -68,11 +77,23 @@ async function handleRequest(
       return { status: 400, body: { error: "claudeMd must be 64KB or less" } };
     }
 
+    // Validate soulMd size if provided (max 64KB)
+    if (body.soulMd !== undefined && body.soulMd.length > 65536) {
+      return { status: 400, body: { error: "soulMd must be 64KB or less" } };
+    }
+
+    // Validate identityMd size if provided (max 64KB)
+    if (body.identityMd !== undefined && body.identityMd.length > 65536) {
+      return { status: 400, body: { error: "identityMd must be 64KB or less" } };
+    }
+
     const agent = updateAgentProfile(agentId, {
       role: body.role,
       description: body.description,
       capabilities: body.capabilities,
       claudeMd: body.claudeMd,
+      soulMd: body.soulMd,
+      identityMd: body.identityMd,
     });
 
     if (!agent) {
@@ -558,4 +579,123 @@ describe("PUT /api/agents/:id/profile", () => {
       expect(data.claudeMd).toBe("My notes");
     });
   });
+
+  describe("Update soulMd", () => {
+    test("should update agent soulMd successfully", async () => {
+      const agentId = "test-agent-soulmd-update";
+      createAgent({
+        id: agentId,
+        name: "Test Agent SoulMd Update",
+        isLead: false,
+        status: "idle",
+      });
+
+      const soulContent = "# SOUL.md — Test Agent\n\nYou are a coding specialist.";
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ soulMd: soulContent }),
+      });
+
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as { id?: string; soulMd?: string };
+      expect(data.id).toBe(agentId);
+      expect(data.soulMd).toBe(soulContent);
+
+      // Verify in database
+      const agent = getAgentById(agentId);
+      expect(agent?.soulMd).toBe(soulContent);
+    });
+
+    test("should return 400 if soulMd exceeds 64KB", async () => {
+      const largeContent = "a".repeat(65537);
+      const response = await fetch(`${baseUrl}/api/agents/test-agent/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ soulMd: largeContent }),
+      });
+
+      expect(response.status).toBe(400);
+      const data = (await response.json()) as { error?: string };
+      expect(data.error).toContain("64KB");
+    });
+  });
+
+  describe("Update identityMd", () => {
+    test("should update agent identityMd successfully", async () => {
+      const agentId = "test-agent-identitymd-update";
+      createAgent({
+        id: agentId,
+        name: "Test Agent IdentityMd Update",
+        isLead: false,
+        status: "idle",
+      });
+
+      const identityContent = "# IDENTITY.md — Test Agent\n\nRole: developer\nVibe: focused";
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ identityMd: identityContent }),
+      });
+
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as { id?: string; identityMd?: string };
+      expect(data.id).toBe(agentId);
+      expect(data.identityMd).toBe(identityContent);
+
+      // Verify in database
+      const agent = getAgentById(agentId);
+      expect(agent?.identityMd).toBe(identityContent);
+    });
+
+    test("should return 400 if identityMd exceeds 64KB", async () => {
+      const largeContent = "a".repeat(65537);
+      const response = await fetch(`${baseUrl}/api/agents/test-agent/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ identityMd: largeContent }),
+      });
+
+      expect(response.status).toBe(400);
+      const data = (await response.json()) as { error?: string };
+      expect(data.error).toContain("64KB");
+    });
+
+    test("should preserve soulMd and identityMd when updating other fields", async () => {
+      const agentId = "test-agent-identity-preserve";
+      createAgent({
+        id: agentId,
+        name: "Test Agent Identity Preserve",
+        isLead: false,
+        status: "idle",
+      });
+
+      // Set initial soul and identity
+      await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          soulMd: "My soul",
+          identityMd: "My identity",
+        }),
+      });
+
+      // Update only the role
+      const response = await fetch(`${baseUrl}/api/agents/${agentId}/profile`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ role: "Developer" }),
+      });
+
+      expect(response.status).toBe(200);
+      const data = (await response.json()) as {
+        role?: string;
+        soulMd?: string;
+        identityMd?: string;
+      };
+      expect(data.role).toBe("Developer");
+      expect(data.soulMd).toBe("My soul");
+      expect(data.identityMd).toBe("My identity");
+    });
+  });
 });

package/src/tests/update-profile-auth.test.ts

@@ -0,0 +1,195 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, getAgentById, getLatestContextVersion, initDb } from "../be/db";
+import { registerUpdateProfileTool } from "../tools/update-profile";
+
+const TEST_DB_PATH = "./test-update-profile-auth.sqlite";
+
+const LEAD_ID = "aaaa0000-0000-4000-8000-000000000001";
+const WORKER_ID = "bbbb0000-0000-4000-8000-000000000002";
+const OTHER_WORKER_ID = "cccc0000-0000-4000-8000-000000000003";
+const NONEXISTENT_ID = "dddd0000-0000-4000-8000-000000000099";
+
+type StructuredContent = {
+  yourAgentId?: string;
+  success: boolean;
+  message: string;
+  agent?: { id: string; role?: string; description?: string };
+};
+
+/**
+ * Call the update-profile tool handler directly via the MCP server's internal registry.
+ * This bypasses the MCP transport layer but exercises the full tool handler logic
+ * including authorization checks.
+ */
+async function callUpdateProfile(
+  server: McpServer,
+  callerAgentId: string | undefined,
+  args: Record<string, unknown>,
+): Promise<{ structuredContent: StructuredContent }> {
+  const tools = (server as unknown as { _registeredTools: Record<string, { handler: Function }> })
+    ._registeredTools;
+  const handler = tools["update-profile"].handler;
+
+  // The handler receives (args, extra) where extra includes requestInfo headers.
+  // createToolRegistrar extracts agentId from extra.requestInfo.headers["x-agent-id"].
+  const extra = {
+    sessionId: "test-session",
+    requestInfo: {
+      headers: {
+        "x-agent-id": callerAgentId ?? "",
+      },
+    },
+  };
+
+  const result = await handler(args, extra);
+  return result as { structuredContent: StructuredContent };
+}
+
+describe("update-profile authorization", () => {
+  let server: McpServer;
+
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // File doesn't exist
+      }
+    }
+
+    closeDb();
+    initDb(TEST_DB_PATH);
+
+    createAgent({ id: LEAD_ID, name: "Test Lead", isLead: true, status: "idle" });
+    createAgent({ id: WORKER_ID, name: "Test Worker", isLead: false, status: "idle" });
+    createAgent({ id: OTHER_WORKER_ID, name: "Other Worker", isLead: false, status: "idle" });
+
+    server = new McpServer({ name: "test-update-profile-auth", version: "1.0.0" });
+    registerUpdateProfileTool(server);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // ignore
+      }
+    }
+  });
+
+  // ===================================================================
+  // 1. Lead can update another agent's profile (happy path)
+  // ===================================================================
+  test("lead can update another agent's profile", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: WORKER_ID,
+      role: "Senior Developer",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain(WORKER_ID);
+    expect(result.structuredContent.agent?.role).toBe("Senior Developer");
+
+    // Verify DB was updated
+    const agent = getAgentById(WORKER_ID);
+    expect(agent?.role).toBe("Senior Developer");
+  });
+
+  // ===================================================================
+  // 2. Non-lead is rejected when providing agentId (targeting another agent)
+  // ===================================================================
+  test("non-lead is rejected when targeting another agent", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      agentId: OTHER_WORKER_ID,
+      role: "Hacked Role",
+    });
+
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.message).toContain("Only lead agents");
+
+    // Verify DB was NOT updated
+    const agent = getAgentById(OTHER_WORKER_ID);
+    expect(agent?.role).not.toBe("Hacked Role");
+  });
+
+  // ===================================================================
+  // 3. Self-update via explicit agentId (matching own ID) works without lead check
+  // ===================================================================
+  test("self-update via explicit own agentId works for non-lead", async () => {
+    const result = await callUpdateProfile(server, OTHER_WORKER_ID, {
+      agentId: OTHER_WORKER_ID,
+      description: "I updated myself",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain("own");
+
+    // Verify DB was updated
+    const agent = getAgentById(OTHER_WORKER_ID);
+    expect(agent?.description).toBe("I updated myself");
+  });
+
+  // ===================================================================
+  // 4. Invalid agentId returns appropriate error
+  // ===================================================================
+  test("invalid agentId returns error when lead updates non-existent agent", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: NONEXISTENT_ID,
+      role: "Ghost Role",
+    });
+
+    // The tool should fail because the target agent doesn't exist in the DB
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.message).toContain("not found");
+  });
+
+  // ===================================================================
+  // 5. changeSource is correct for remote vs self updates
+  // ===================================================================
+  test("changeSource is 'lead_coaching' for remote updates", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: WORKER_ID,
+      soulMd: "Updated by lead",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+
+    // Verify the context version has the correct changeSource
+    const version = getLatestContextVersion(WORKER_ID, "soulMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("lead_coaching");
+    expect(version!.changedByAgentId).toBe(LEAD_ID);
+  });
+
+  test("changeSource is 'self_edit' for self updates", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      soulMd: "Updated by myself",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+
+    // Verify the context version has the correct changeSource
+    const version = getLatestContextVersion(WORKER_ID, "soulMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("self_edit");
+    expect(version!.changedByAgentId).toBe(WORKER_ID);
+  });
+
+  test("changeSource is 'self_edit' when explicit agentId matches caller", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      agentId: WORKER_ID,
+      identityMd: "Self update with explicit ID",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain("own");
+
+    const version = getLatestContextVersion(WORKER_ID, "identityMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("self_edit");
+  });
+});