@desplega.ai/agent-swarm 1.49.0 → 1.52.0

package/src/tests/update-profile-auth.test.ts

@@ -0,0 +1,195 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, getAgentById, getLatestContextVersion, initDb } from "../be/db";
+import { registerUpdateProfileTool } from "../tools/update-profile";
+
+const TEST_DB_PATH = "./test-update-profile-auth.sqlite";
+
+const LEAD_ID = "aaaa0000-0000-4000-8000-000000000001";
+const WORKER_ID = "bbbb0000-0000-4000-8000-000000000002";
+const OTHER_WORKER_ID = "cccc0000-0000-4000-8000-000000000003";
+const NONEXISTENT_ID = "dddd0000-0000-4000-8000-000000000099";
+
+type StructuredContent = {
+  yourAgentId?: string;
+  success: boolean;
+  message: string;
+  agent?: { id: string; role?: string; description?: string };
+};
+
+/**
+ * Call the update-profile tool handler directly via the MCP server's internal registry.
+ * This bypasses the MCP transport layer but exercises the full tool handler logic
+ * including authorization checks.
+ */
+async function callUpdateProfile(
+  server: McpServer,
+  callerAgentId: string | undefined,
+  args: Record<string, unknown>,
+): Promise<{ structuredContent: StructuredContent }> {
+  const tools = (server as unknown as { _registeredTools: Record<string, { handler: Function }> })
+    ._registeredTools;
+  const handler = tools["update-profile"].handler;
+
+  // The handler receives (args, extra) where extra includes requestInfo headers.
+  // createToolRegistrar extracts agentId from extra.requestInfo.headers["x-agent-id"].
+  const extra = {
+    sessionId: "test-session",
+    requestInfo: {
+      headers: {
+        "x-agent-id": callerAgentId ?? "",
+      },
+    },
+  };
+
+  const result = await handler(args, extra);
+  return result as { structuredContent: StructuredContent };
+}
+
+describe("update-profile authorization", () => {
+  let server: McpServer;
+
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // File doesn't exist
+      }
+    }
+
+    closeDb();
+    initDb(TEST_DB_PATH);
+
+    createAgent({ id: LEAD_ID, name: "Test Lead", isLead: true, status: "idle" });
+    createAgent({ id: WORKER_ID, name: "Test Worker", isLead: false, status: "idle" });
+    createAgent({ id: OTHER_WORKER_ID, name: "Other Worker", isLead: false, status: "idle" });
+
+    server = new McpServer({ name: "test-update-profile-auth", version: "1.0.0" });
+    registerUpdateProfileTool(server);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(TEST_DB_PATH + suffix);
+      } catch {
+        // ignore
+      }
+    }
+  });
+
+  // ===================================================================
+  // 1. Lead can update another agent's profile (happy path)
+  // ===================================================================
+  test("lead can update another agent's profile", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: WORKER_ID,
+      role: "Senior Developer",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain(WORKER_ID);
+    expect(result.structuredContent.agent?.role).toBe("Senior Developer");
+
+    // Verify DB was updated
+    const agent = getAgentById(WORKER_ID);
+    expect(agent?.role).toBe("Senior Developer");
+  });
+
+  // ===================================================================
+  // 2. Non-lead is rejected when providing agentId (targeting another agent)
+  // ===================================================================
+  test("non-lead is rejected when targeting another agent", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      agentId: OTHER_WORKER_ID,
+      role: "Hacked Role",
+    });
+
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.message).toContain("Only lead agents");
+
+    // Verify DB was NOT updated
+    const agent = getAgentById(OTHER_WORKER_ID);
+    expect(agent?.role).not.toBe("Hacked Role");
+  });
+
+  // ===================================================================
+  // 3. Self-update via explicit agentId (matching own ID) works without lead check
+  // ===================================================================
+  test("self-update via explicit own agentId works for non-lead", async () => {
+    const result = await callUpdateProfile(server, OTHER_WORKER_ID, {
+      agentId: OTHER_WORKER_ID,
+      description: "I updated myself",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain("own");
+
+    // Verify DB was updated
+    const agent = getAgentById(OTHER_WORKER_ID);
+    expect(agent?.description).toBe("I updated myself");
+  });
+
+  // ===================================================================
+  // 4. Invalid agentId returns appropriate error
+  // ===================================================================
+  test("invalid agentId returns error when lead updates non-existent agent", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: NONEXISTENT_ID,
+      role: "Ghost Role",
+    });
+
+    // The tool should fail because the target agent doesn't exist in the DB
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.message).toContain("not found");
+  });
+
+  // ===================================================================
+  // 5. changeSource is correct for remote vs self updates
+  // ===================================================================
+  test("changeSource is 'lead_coaching' for remote updates", async () => {
+    const result = await callUpdateProfile(server, LEAD_ID, {
+      agentId: WORKER_ID,
+      soulMd: "Updated by lead",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+
+    // Verify the context version has the correct changeSource
+    const version = getLatestContextVersion(WORKER_ID, "soulMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("lead_coaching");
+    expect(version!.changedByAgentId).toBe(LEAD_ID);
+  });
+
+  test("changeSource is 'self_edit' for self updates", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      soulMd: "Updated by myself",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+
+    // Verify the context version has the correct changeSource
+    const version = getLatestContextVersion(WORKER_ID, "soulMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("self_edit");
+    expect(version!.changedByAgentId).toBe(WORKER_ID);
+  });
+
+  test("changeSource is 'self_edit' when explicit agentId matches caller", async () => {
+    const result = await callUpdateProfile(server, WORKER_ID, {
+      agentId: WORKER_ID,
+      identityMd: "Self update with explicit ID",
+    });
+
+    expect(result.structuredContent.success).toBe(true);
+    expect(result.structuredContent.message).toContain("own");
+
+    const version = getLatestContextVersion(WORKER_ID, "identityMd");
+    expect(version).not.toBeNull();
+    expect(version!.changeSource).toBe("self_edit");
+  });
+});

package/src/tests/workflow-async-v2.test.ts

@@ -3,18 +3,17 @@ import { unlink } from "node:fs/promises";
 import { z } from "zod";
 import {
   closeDb,
-  createTaskExtended,
+  completeTask,
   createWorkflow,
   deleteWorkflow,
   getTaskByWorkflowRunStepId,
   getWorkflowRun,
   getWorkflowRunStepsByRunId,
   initDb,
-  updateTask,
 } from "../be/db";
 import type { Workflow, WorkflowDefinition } from "../types";
-import { startWorkflowExecution, walkGraph } from "../workflows/engine";
-import { workflowEventBus } from "../workflows/event-bus";
+import { startWorkflowExecution } from "../workflows/engine";
+import { InProcessEventBus, workflowEventBus } from "../workflows/event-bus";
 import { AgentTaskExecutor } from "../workflows/executors/agent-task";
 import {
   BaseExecutor,
@@ -383,4 +382,127 @@ describe("Workflow Async v2 (Phase 4)", () => {
       expect(task.tags).toEqual(["workflow", "test"]);
     });
   });
+
+  describe("Fan-out → Convergence with async tasks", () => {
+    test("fan-out to 3 parallel agent-tasks, converge on merge node — no duplicate steps", async () => {
+      // Use isolated event bus to prevent interference from other test files' listeners
+      const localBus = new InProcessEventBus();
+      const localDeps: ExecutorDependencies = { ...mockDeps, eventBus: localBus };
+      const localRegistry = new ExecutorRegistry();
+      localRegistry.register(new EchoExecutor(localDeps));
+      localRegistry.register(new AgentTaskExecutor(localDeps));
+      setupWorkflowResumeListener(localBus, localRegistry);
+      const workflow = makeWorkflow({
+        nodes: [
+          {
+            id: "start",
+            type: "echo",
+            config: { message: "go" },
+            next: ["review-a", "review-b", "review-c"],
+          },
+          {
+            id: "review-a",
+            type: "agent-task",
+            config: { template: "Review A" },
+            next: "merge",
+          },
+          {
+            id: "review-b",
+            type: "agent-task",
+            config: { template: "Review B" },
+            next: "merge",
+          },
+          {
+            id: "review-c",
+            type: "agent-task",
+            config: { template: "Review C" },
+            next: "merge",
+          },
+          {
+            id: "merge",
+            type: "echo",
+            config: { message: "done" },
+            inputs: { a: "review-a", b: "review-b", c: "review-c" },
+          },
+        ],
+      });
+
+      // Start the workflow — echo "start" completes, 3 agent-tasks created
+      const runId = await startWorkflowExecution(workflow, {}, localRegistry);
+
+      let steps = getWorkflowRunStepsByRunId(runId);
+      expect(steps.filter((s) => s.nodeId === "start")).toHaveLength(1);
+      expect(steps.filter((s) => s.nodeId === "start")[0]!.status).toBe("completed");
+
+      // 3 agent-task steps should be waiting
+      const reviewSteps = steps.filter((s) => s.nodeId.startsWith("review-"));
+      expect(reviewSteps).toHaveLength(3);
+      for (const s of reviewSteps) {
+        expect(s.status).toBe("waiting");
+      }
+
+      // No merge step yet (convergence not ready)
+      expect(steps.filter((s) => s.nodeId === "merge")).toHaveLength(0);
+
+      // Complete review-a
+      const taskA = getTaskByWorkflowRunStepId(
+        reviewSteps.find((s) => s.nodeId === "review-a")!.id,
+      )!;
+      completeTask(taskA.id, "output-a");
+      localBus.emit("task.completed", {
+        taskId: taskA.id,
+        output: "output-a",
+        workflowRunId: runId,
+        workflowRunStepId: reviewSteps.find((s) => s.nodeId === "review-a")!.id,
+      });
+      await new Promise((r) => setTimeout(r, 50));
+
+      // After A completes — merge should NOT have been created yet (B, C still pending)
+      steps = getWorkflowRunStepsByRunId(runId);
+      expect(steps.filter((s) => s.nodeId === "merge")).toHaveLength(0);
+
+      // Complete review-b
+      const taskB = getTaskByWorkflowRunStepId(
+        reviewSteps.find((s) => s.nodeId === "review-b")!.id,
+      )!;
+      completeTask(taskB.id, "output-b");
+      localBus.emit("task.completed", {
+        taskId: taskB.id,
+        output: "output-b",
+        workflowRunId: runId,
+        workflowRunStepId: reviewSteps.find((s) => s.nodeId === "review-b")!.id,
+      });
+      await new Promise((r) => setTimeout(r, 50));
+
+      // After B completes — merge STILL should not exist (C still pending)
+      steps = getWorkflowRunStepsByRunId(runId);
+      expect(steps.filter((s) => s.nodeId === "merge")).toHaveLength(0);
+
+      // Complete review-c
+      const taskC = getTaskByWorkflowRunStepId(
+        reviewSteps.find((s) => s.nodeId === "review-c")!.id,
+      )!;
+      completeTask(taskC.id, "output-c");
+      localBus.emit("task.completed", {
+        taskId: taskC.id,
+        output: "output-c",
+        workflowRunId: runId,
+        workflowRunStepId: reviewSteps.find((s) => s.nodeId === "review-c")!.id,
+      });
+      await new Promise((r) => setTimeout(r, 50));
+
+      // Now ALL 3 are done — merge should execute exactly ONCE
+      // Allow extra time for serialized queue processing
+      await new Promise((r) => setTimeout(r, 100));
+
+      steps = getWorkflowRunStepsByRunId(runId);
+      const mergeSteps = steps.filter((s) => s.nodeId === "merge");
+      expect(mergeSteps).toHaveLength(1);
+      expect(mergeSteps[0]!.status).toBe("completed");
+
+      // Workflow run should be completed
+      const run = getWorkflowRun(runId)!;
+      expect(run.status).toBe("completed");
+    });
+  });
 });

package/src/tests/workflow-definition-validation.test.ts

@@ -288,3 +288,79 @@ describe("validateDefinition — input mapping validation", () => {
     expect(errors).toHaveLength(0);
   });
 });
+
+// ─── Fan-out (array next) tests ─────────────────────────────
+
+describe("fan-out with array next", () => {
+  test("single entry fans out to 3 parallel nodes → valid", () => {
+    const def = makeDef([
+      { id: "start", type: "script", config: {}, next: ["review-a", "review-b", "review-c"] },
+      { id: "review-a", type: "script", config: {}, next: "merge" },
+      { id: "review-b", type: "script", config: {}, next: "merge" },
+      { id: "review-c", type: "script", config: {}, next: "merge" },
+      {
+        id: "merge",
+        type: "script",
+        config: {},
+        inputs: { a: "review-a", b: "review-b", c: "review-c" },
+      },
+    ]);
+    const { valid, errors } = validateDefinition(def);
+    expect(valid).toBe(true);
+    expect(errors).toHaveLength(0);
+  });
+
+  test("fan-out targets that don't exist → error", () => {
+    const def = makeDef([
+      { id: "start", type: "script", config: {}, next: ["a", "b", "nonexistent"] },
+      { id: "a", type: "script", config: {} },
+      { id: "b", type: "script", config: {} },
+    ]);
+    const { valid, errors } = validateDefinition(def);
+    expect(valid).toBe(false);
+    expect(errors.some((e) => e.includes("nonexistent"))).toBe(true);
+  });
+
+  test("fan-out nodes are not entry nodes", () => {
+    const def = makeDef([
+      { id: "start", type: "script", config: {}, next: ["a", "b"] },
+      { id: "a", type: "script", config: {} },
+      { id: "b", type: "script", config: {} },
+    ]);
+    const { valid, errors } = validateDefinition(def);
+    // Only "start" is entry node — a and b are targets
+    expect(valid).toBe(true);
+    expect(errors).toHaveLength(0);
+  });
+
+  test("isUpstream works with fan-out", () => {
+    const def = makeDef([
+      { id: "start", type: "script", config: {}, next: ["a", "b", "c"] },
+      { id: "a", type: "script", config: {}, next: "merge" },
+      { id: "b", type: "script", config: {}, next: "merge" },
+      { id: "c", type: "script", config: {}, next: "merge" },
+      { id: "merge", type: "script", config: {} },
+    ]);
+    expect(isUpstream(def, "start", "a")).toBe(true);
+    expect(isUpstream(def, "start", "merge")).toBe(true);
+    expect(isUpstream(def, "a", "merge")).toBe(true);
+    expect(isUpstream(def, "merge", "start")).toBe(false);
+  });
+
+  test("fan-out node inputs from parallel siblings → valid (all upstream via start)", () => {
+    const def = makeDef([
+      { id: "start", type: "script", config: {}, next: ["a", "b"] },
+      { id: "a", type: "script", config: {}, next: "merge" },
+      { id: "b", type: "script", config: {}, next: "merge" },
+      {
+        id: "merge",
+        type: "script",
+        config: {},
+        inputs: { fromA: "a.output", fromB: "b.output" },
+      },
+    ]);
+    const { valid, errors } = validateDefinition(def);
+    expect(valid).toBe(true);
+    expect(errors).toHaveLength(0);
+  });
+});

package/src/tests/workflow-executors.test.ts

@@ -690,7 +690,7 @@ describe("ValidateExecutor", () => {
 // ─── Registry Wiring ─────────────────────────────────────────
 
 describe("createExecutorRegistry", () => {
-  test("registers all 8 executors (7 instant + 1 async)", () => {
+  test("registers all 9 executors (7 instant + 2 async)", () => {
     const registry = createExecutorRegistry(mockDeps);
     const types = registry.types();
 
@@ -702,7 +702,8 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("vcs");
     expect(types).toContain("validate");
     expect(types).toContain("agent-task");
-    expect(types).toHaveLength(8);
+    expect(types).toContain("human-in-the-loop");
+    expect(types).toHaveLength(9);
   });
 
   test("instant executors have mode instant, async executors have mode async", () => {
@@ -720,6 +721,7 @@ describe("createExecutorRegistry", () => {
       expect(registry.get(type).mode).toBe("instant");
     }
     expect(registry.get("agent-task").mode).toBe("async");
+    expect(registry.get("human-in-the-loop").mode).toBe("async");
   });
 
   test("get() retrieves the correct executor by type", () => {

package/src/tests/workflow-retry-v2.test.ts

@@ -16,7 +16,7 @@ import {
   updateWorkflowRunStep,
 } from "../be/db";
 import type { RetryPolicy, Workflow, WorkflowDefinition } from "../types";
-import { findReadyNodes, startWorkflowExecution, walkGraph } from "../workflows/engine";
+import { startWorkflowExecution } from "../workflows/engine";
 import { workflowEventBus } from "../workflows/event-bus";
 import {
   BaseExecutor,

package/src/tests/workflow-schedule-trigger.test.ts

@@ -0,0 +1,104 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createWorkflow,
+  getWorkflowsByScheduleId,
+  initDb,
+  updateWorkflow,
+} from "../be/db";
+
+const TEST_DB_PATH = "./test-wf-schedule-trigger.sqlite";
+
+beforeAll(async () => {
+  try {
+    await unlink(TEST_DB_PATH);
+  } catch {
+    // Ignore
+  }
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  closeDb();
+  try {
+    await unlink(TEST_DB_PATH);
+    await unlink(`${TEST_DB_PATH}-wal`);
+    await unlink(`${TEST_DB_PATH}-shm`);
+  } catch {
+    // Ignore
+  }
+});
+
+describe("getWorkflowsByScheduleId", () => {
+  const scheduleId1 = crypto.randomUUID();
+  const scheduleId2 = crypto.randomUUID();
+  const scheduleIdUnlinked = crypto.randomUUID();
+
+  beforeAll(() => {
+    // Workflow linked to scheduleId1
+    createWorkflow({
+      name: "wf-linked-1",
+      definition: { nodes: [{ id: "n1", type: "agent-task", config: { template: "test" } }] },
+      triggers: [{ type: "schedule", scheduleId: scheduleId1 }],
+    });
+
+    // Second workflow also linked to scheduleId1 (multiple workflows same schedule)
+    createWorkflow({
+      name: "wf-linked-2",
+      definition: { nodes: [{ id: "n1", type: "agent-task", config: { template: "test" } }] },
+      triggers: [{ type: "schedule", scheduleId: scheduleId1 }],
+    });
+
+    // Workflow linked to scheduleId2
+    createWorkflow({
+      name: "wf-linked-other",
+      definition: { nodes: [{ id: "n1", type: "agent-task", config: { template: "test" } }] },
+      triggers: [{ type: "schedule", scheduleId: scheduleId2 }],
+    });
+
+    // Disabled workflow linked to scheduleId1 — should NOT be returned
+    const disabled = createWorkflow({
+      name: "wf-disabled",
+      definition: { nodes: [{ id: "n1", type: "agent-task", config: { template: "test" } }] },
+      triggers: [{ type: "schedule", scheduleId: scheduleId1 }],
+    });
+    updateWorkflow(disabled.id, { enabled: false });
+
+    // Workflow with webhook trigger only (no schedule) — should NOT match
+    createWorkflow({
+      name: "wf-webhook-only",
+      definition: { nodes: [{ id: "n1", type: "agent-task", config: { template: "test" } }] },
+      triggers: [{ type: "webhook" }],
+    });
+  });
+
+  test("returns workflows with matching schedule trigger", () => {
+    const results = getWorkflowsByScheduleId(scheduleId1);
+    expect(results.length).toBe(2);
+    const names = results.map((w) => w.name).sort();
+    expect(names).toEqual(["wf-linked-1", "wf-linked-2"]);
+  });
+
+  test("returns empty when no workflows match", () => {
+    const results = getWorkflowsByScheduleId(scheduleIdUnlinked);
+    expect(results.length).toBe(0);
+  });
+
+  test("ignores disabled workflows", () => {
+    const results = getWorkflowsByScheduleId(scheduleId1);
+    const names = results.map((w) => w.name);
+    expect(names).not.toContain("wf-disabled");
+  });
+
+  test("multiple workflows can reference the same schedule", () => {
+    const results = getWorkflowsByScheduleId(scheduleId1);
+    expect(results.length).toBe(2);
+  });
+
+  test("returns correct workflow for different schedule", () => {
+    const results = getWorkflowsByScheduleId(scheduleId2);
+    expect(results.length).toBe(1);
+    expect(results[0]!.name).toBe("wf-linked-other");
+  });
+});