@desplega.ai/agent-swarm 1.69.0 → 1.70.0

package/src/tests/context-key.test.ts

@@ -0,0 +1,173 @@
+import { describe, expect, test } from "bun:test";
+import {
+  agentmailContextKey,
+  githubContextKey,
+  gitlabContextKey,
+  linearContextKey,
+  parseContextKey,
+  scheduleContextKey,
+  slackContextKey,
+  workflowContextKey,
+} from "../tasks/context-key";
+
+describe("context-key builders", () => {
+  test("slackContextKey builds expected format", () => {
+    expect(slackContextKey({ channelId: "C123", threadTs: "1776800534.257079" })).toBe(
+      "task:slack:C123:1776800534.257079",
+    );
+  });
+
+  test("agentmailContextKey builds expected format", () => {
+    expect(agentmailContextKey({ threadId: "thr_abc" })).toBe("task:agentmail:thr_abc");
+  });
+
+  test("githubContextKey preserves owner/repo case", () => {
+    expect(
+      githubContextKey({ owner: "Desplega-AI", repo: "Agent-Swarm", kind: "pr", number: 42 }),
+    ).toBe("task:trackers:github:Desplega-AI:Agent-Swarm:pr:42");
+  });
+
+  test("gitlabContextKey accepts numeric project id and stringifies it", () => {
+    expect(gitlabContextKey({ projectId: 789, kind: "mr", iid: 12 })).toBe(
+      "task:trackers:gitlab:789:mr:12",
+    );
+  });
+
+  test("linearContextKey preserves identifier case", () => {
+    expect(linearContextKey({ issueIdentifier: "DES-42" })).toBe("task:trackers:linear:DES-42");
+  });
+
+  test("scheduleContextKey builds expected format", () => {
+    expect(scheduleContextKey({ scheduleId: "sched-uuid" })).toBe("task:schedule:sched-uuid");
+  });
+
+  test("workflowContextKey builds expected format", () => {
+    expect(workflowContextKey({ workflowRunId: "run-uuid" })).toBe("task:workflow:run-uuid");
+  });
+});
+
+describe("context-key separator safety", () => {
+  test("slackContextKey throws when channelId contains ':'", () => {
+    expect(() => slackContextKey({ channelId: "C:123", threadTs: "1" })).toThrow(
+      /must not contain/,
+    );
+  });
+
+  test("slackContextKey throws when threadTs contains ':'", () => {
+    expect(() => slackContextKey({ channelId: "C1", threadTs: "a:b" })).toThrow(/must not contain/);
+  });
+
+  test("githubContextKey throws when repo contains ':'", () => {
+    expect(() =>
+      githubContextKey({ owner: "desplega", repo: "bad:repo", kind: "pr", number: 1 }),
+    ).toThrow(/must not contain/);
+  });
+
+  test("agentmailContextKey throws when threadId contains ':'", () => {
+    expect(() => agentmailContextKey({ threadId: "thr:bad" })).toThrow(/must not contain/);
+  });
+
+  test("linearContextKey throws when identifier contains ':'", () => {
+    expect(() => linearContextKey({ issueIdentifier: "DES:42" })).toThrow(/must not contain/);
+  });
+
+  test("throws on empty values", () => {
+    expect(() => slackContextKey({ channelId: "", threadTs: "1" })).toThrow(/non-empty/);
+    expect(() => agentmailContextKey({ threadId: "" })).toThrow(/non-empty/);
+    expect(() => linearContextKey({ issueIdentifier: "" })).toThrow(/non-empty/);
+  });
+
+  test("githubContextKey validates kind", () => {
+    // @ts-expect-error — testing runtime guard
+    expect(() => githubContextKey({ owner: "a", repo: "b", kind: "bogus", number: 1 })).toThrow(
+      /kind/,
+    );
+  });
+
+  test("gitlabContextKey validates kind", () => {
+    // @ts-expect-error — testing runtime guard
+    expect(() => gitlabContextKey({ projectId: "1", kind: "bogus", iid: 1 })).toThrow(/kind/);
+  });
+
+  test("githubContextKey rejects non-numeric number", () => {
+    // @ts-expect-error — testing runtime guard
+    expect(() => githubContextKey({ owner: "a", repo: "b", kind: "pr", number: "abc" })).toThrow(
+      /integer/,
+    );
+  });
+});
+
+describe("parseContextKey", () => {
+  test("round-trips slack keys", () => {
+    const key = slackContextKey({ channelId: "C0A4J7GB0UD", threadTs: "1776800534.257079" });
+    const parsed = parseContextKey(key);
+    expect(parsed).toEqual({
+      family: "slack",
+      parts: { channelId: "C0A4J7GB0UD", threadTs: "1776800534.257079" },
+    });
+  });
+
+  test("round-trips agentmail keys", () => {
+    const key = agentmailContextKey({ threadId: "thr_abc" });
+    expect(parseContextKey(key)).toEqual({
+      family: "agentmail",
+      parts: { threadId: "thr_abc" },
+    });
+  });
+
+  test("round-trips github keys and preserves case", () => {
+    const key = githubContextKey({
+      owner: "Desplega-AI",
+      repo: "Agent-Swarm",
+      kind: "issue",
+      number: 123,
+    });
+    expect(parseContextKey(key)).toEqual({
+      family: "trackers",
+      subFamily: "github",
+      parts: { owner: "Desplega-AI", repo: "Agent-Swarm", kind: "issue", number: 123 },
+    });
+  });
+
+  test("round-trips gitlab keys", () => {
+    const key = gitlabContextKey({ projectId: 789, kind: "mr", iid: 7 });
+    expect(parseContextKey(key)).toEqual({
+      family: "trackers",
+      subFamily: "gitlab",
+      parts: { projectId: "789", kind: "mr", iid: 7 },
+    });
+  });
+
+  test("round-trips linear keys with case preserved", () => {
+    const key = linearContextKey({ issueIdentifier: "DES-42" });
+    expect(parseContextKey(key)).toEqual({
+      family: "trackers",
+      subFamily: "linear",
+      parts: { issueIdentifier: "DES-42" },
+    });
+  });
+
+  test("round-trips schedule keys", () => {
+    const key = scheduleContextKey({ scheduleId: "sched-1" });
+    expect(parseContextKey(key)).toEqual({
+      family: "schedule",
+      parts: { scheduleId: "sched-1" },
+    });
+  });
+
+  test("round-trips workflow keys", () => {
+    const key = workflowContextKey({ workflowRunId: "run-1" });
+    expect(parseContextKey(key)).toEqual({
+      family: "workflow",
+      parts: { workflowRunId: "run-1" },
+    });
+  });
+
+  test("throws on malformed keys", () => {
+    expect(() => parseContextKey("")).toThrow();
+    expect(() => parseContextKey("not-a-task-key")).toThrow();
+    expect(() => parseContextKey("task:slack:C1")).toThrow(/slack/);
+    expect(() => parseContextKey("task:trackers:bogus:x")).toThrow(/sub-family/);
+    expect(() => parseContextKey("task:trackers:github:a:b:weird:1")).toThrow(/kind/);
+  });
+});

package/src/tests/core-auth.test.ts

@@ -0,0 +1,142 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { handleCore } from "../http/core";
+// Importing the handlers here is load-bearing: each import populates
+// `routeRegistry` as a side effect via the `route()` factory, which is what
+// the auth middleware consults.
+import "../http/webhooks";
+import "../http/mcp-oauth";
+import "../http/trackers/linear";
+import "../http/workflows";
+
+const API_KEY = "test-secret-key";
+
+function createTestServer(apiKey: string): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    const handled = await handleCore(req, res, myAgentId, apiKey);
+    if (!handled) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ passed: true }));
+    }
+  });
+}
+
+async function listen(server: Server): Promise<number> {
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const addr = server.address();
+  if (!addr || typeof addr === "string") throw new Error("no port");
+  return addr.port;
+}
+
+describe("handleCore auth middleware (route() auth.apiKey=false is honored)", () => {
+  let server: Server;
+  let port: number;
+
+  beforeAll(async () => {
+    server = createTestServer(API_KEY);
+    port = await listen(server);
+  });
+
+  afterAll(() => {
+    server.close();
+  });
+
+  test("public route (auth:{apiKey:false}) passes without a Bearer", async () => {
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/callback`);
+    // The callback route is public — without a state param it returns 400
+    // from the handler, but it must NOT be 401 from the auth middleware.
+    expect(res.status).not.toBe(401);
+  });
+
+  test("authed route (no auth flag → default authed) returns 401 without Bearer", async () => {
+    // /api/mcp-oauth/<id>/status is declared with auth:{apiKey:true}
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/some-id/status`);
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("authed route passes with correct Bearer", async () => {
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/some-id/status`, {
+      headers: { Authorization: `Bearer ${API_KEY}` },
+    });
+    // Middleware passes (no 401). Downstream handler decides the final status.
+    expect(res.status).not.toBe(401);
+  });
+
+  test("authed route returns 401 with wrong Bearer", async () => {
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/some-id/status`, {
+      headers: { Authorization: "Bearer WRONG" },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test("GitHub webhook is still public (auth:{apiKey:false})", async () => {
+    const res = await fetch(`http://localhost:${port}/api/github/webhook`, { method: "POST" });
+    expect(res.status).not.toBe(401);
+  });
+
+  test("GitLab webhook is still public", async () => {
+    const res = await fetch(`http://localhost:${port}/api/gitlab/webhook`, { method: "POST" });
+    expect(res.status).not.toBe(401);
+  });
+
+  test("AgentMail webhook is still public", async () => {
+    const res = await fetch(`http://localhost:${port}/api/agentmail/webhook`, { method: "POST" });
+    expect(res.status).not.toBe(401);
+  });
+
+  test("Linear webhook/authorize/callback are still public", async () => {
+    for (const path of [
+      "/api/trackers/linear/authorize",
+      "/api/trackers/linear/callback",
+      "/api/trackers/linear/webhook",
+    ]) {
+      const method = path.endsWith("/webhook") ? "POST" : "GET";
+      const res = await fetch(`http://localhost:${port}${path}`, { method });
+      expect(res.status).not.toBe(401);
+    }
+  });
+
+  test("Workflow webhook trigger is still public", async () => {
+    const res = await fetch(`http://localhost:${port}/api/webhooks/some-workflow-id`, {
+      method: "POST",
+    });
+    expect(res.status).not.toBe(401);
+  });
+
+  test("unknown /api/* path fails closed (401 without Bearer)", async () => {
+    const res = await fetch(`http://localhost:${port}/api/does-not-exist/xyz`);
+    expect(res.status).toBe(401);
+  });
+
+  test("/health is always public", async () => {
+    const res = await fetch(`http://localhost:${port}/health`);
+    expect(res.status).toBe(200);
+  });
+});
+
+describe("handleCore auth middleware (no API_KEY configured)", () => {
+  let server: Server;
+  let port: number;
+
+  beforeAll(async () => {
+    server = createTestServer(""); // empty == auth disabled
+    port = await listen(server);
+  });
+
+  afterAll(() => {
+    server.close();
+  });
+
+  test("authed routes pass without Bearer when API_KEY is empty", async () => {
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/some-id/status`);
+    expect(res.status).not.toBe(401);
+  });
+});

package/src/tests/mcp-oauth-resolve-secrets.test.ts

@@ -101,6 +101,85 @@ describe("resolveSecrets integration — OAuth Authorization injection", () => {
     expect(match!.authError).toBeNull();
   });
 
+  test("lowercase 'bearer' tokenType is normalized to capital 'Bearer' in Authorization header", async () => {
+    // Providers that follow RFC 6749 strictly (e.g. Amplitude's MCP) return
+    // `token_type: "bearer"`. Some resource servers then reject the lowercase
+    // prefix with 401. The fix in src/http/mcp-servers.ts normalizes the
+    // scheme to capital "Bearer". See GitHub issue #368.
+    const agent = createAgent({
+      id: crypto.randomUUID(),
+      name: "oauth-agent-lowercase",
+      status: "idle",
+      isLead: false,
+    });
+    const mcp = createMcpServer({
+      name: "mcp-oauth-lowercase-bearer",
+      transport: "http",
+      url: "https://mcp.example.com",
+      scope: "agent",
+      ownerAgentId: agent.id,
+    });
+    installMcpServer(agent.id, mcp.id);
+    setMcpServerAuthMethod(mcp.id, "oauth");
+    upsertMcpOAuthToken({
+      mcpServerId: mcp.id,
+      accessToken: "lowercase-token-xyz",
+      refreshToken: null,
+      tokenType: "bearer", // lowercase, as RFC 6749 prescribes
+      expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+      resourceUrl: "https://mcp.example.com/",
+      authorizationServerIssuer: "https://as.example.com",
+      authorizeUrl: "https://as.example.com/authorize",
+      tokenUrl: "https://as.example.com/token",
+      clientSource: "dcr",
+      status: "connected",
+    });
+
+    const result = await agentMcpServers(agent.id);
+    const match = result.servers.find((s) => s.id === mcp.id);
+    expect(match).toBeTruthy();
+    expect(match!.resolvedHeaders?.Authorization).toBe("Bearer lowercase-token-xyz");
+    expect(match!.resolvedHeaders?.Authorization?.startsWith("Bearer ")).toBe(true);
+  });
+
+  test("non-bearer tokenType (e.g. 'MAC') is preserved verbatim in Authorization header", async () => {
+    // RFC 6749 allows non-bearer token types. The normalization must only
+    // touch the bearer scheme and leave others alone.
+    const agent = createAgent({
+      id: crypto.randomUUID(),
+      name: "oauth-agent-mac",
+      status: "idle",
+      isLead: false,
+    });
+    const mcp = createMcpServer({
+      name: "mcp-oauth-mac",
+      transport: "http",
+      url: "https://mcp.example.com",
+      scope: "agent",
+      ownerAgentId: agent.id,
+    });
+    installMcpServer(agent.id, mcp.id);
+    setMcpServerAuthMethod(mcp.id, "oauth");
+    upsertMcpOAuthToken({
+      mcpServerId: mcp.id,
+      accessToken: "mac-token-xyz",
+      refreshToken: null,
+      tokenType: "MAC",
+      expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+      resourceUrl: "https://mcp.example.com/",
+      authorizationServerIssuer: "https://as.example.com",
+      authorizeUrl: "https://as.example.com/authorize",
+      tokenUrl: "https://as.example.com/token",
+      clientSource: "dcr",
+      status: "connected",
+    });
+
+    const result = await agentMcpServers(agent.id);
+    const match = result.servers.find((s) => s.id === mcp.id);
+    expect(match).toBeTruthy();
+    expect(match!.resolvedHeaders?.Authorization).toBe("MAC mac-token-xyz");
+  });
+
   test("OAuth server without token row surfaces authError", async () => {
     const agent = createAgent({
       id: crypto.randomUUID(),

package/src/tests/sibling-awareness-db.test.ts

@@ -0,0 +1,172 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlinkSync } from "node:fs";
+import { closeDb, completeTask, createAgent, createTaskExtended, initDb } from "../be/db";
+import { slackContextKey } from "../tasks/context-key";
+import { applySiblingAwareness } from "../tasks/sibling-awareness";
+
+const TEST_DB_PATH = "./test-sibling-awareness-db.sqlite";
+
+beforeAll(() => {
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(() => {
+  closeDb();
+  try {
+    unlinkSync(TEST_DB_PATH);
+    unlinkSync(`${TEST_DB_PATH}-wal`);
+    unlinkSync(`${TEST_DB_PATH}-shm`);
+  } catch {
+    // ignore
+  }
+});
+
+describe("applySiblingAwareness — no siblings", () => {
+  test("returns description unchanged when no siblings exist", () => {
+    const key = slackContextKey({
+      channelId: "C_SIB_NONE",
+      threadTs: "1700000000.000001",
+    });
+    const out = applySiblingAwareness({ description: "Do the thing", contextKey: key });
+    expect(out.description).toBe("Do the thing");
+    expect(out.parentTaskId).toBeUndefined();
+    expect(out.siblings).toEqual([]);
+  });
+
+  test("returns description unchanged when contextKey is empty", () => {
+    const out = applySiblingAwareness({ description: "body", contextKey: "" });
+    expect(out.description).toBe("body");
+    expect(out.parentTaskId).toBeUndefined();
+    expect(out.siblings).toEqual([]);
+  });
+});
+
+describe("applySiblingAwareness — with siblings", () => {
+  test("prepends sibling block when an in-flight sibling exists", () => {
+    const agent = createAgent({
+      name: "sib-agent-1",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const key = slackContextKey({
+      channelId: "C_SIB_1",
+      threadTs: "1700000000.000002",
+    });
+    const existing = createTaskExtended("First task that the user already sent", {
+      agentId: agent.id,
+      contextKey: key,
+    });
+
+    const result = applySiblingAwareness({
+      description: "Follow-up body",
+      contextKey: key,
+      currentAgentId: agent.id,
+    });
+
+    expect(result.description).toContain("<sibling_tasks_in_progress>");
+    expect(result.description).toContain(`contextKey: ${key}`);
+    expect(result.description).toContain(`task:${existing.id}`);
+    expect(result.description).toContain(`agent:${agent.name}`);
+    expect(result.description.endsWith("Follow-up body")).toBe(true);
+    expect(result.siblings.map((s) => s.id)).toContain(existing.id);
+  });
+
+  test("auto-wires parentTaskId when sibling is on the same agent", () => {
+    const agent = createAgent({
+      name: "sib-agent-2",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const key = slackContextKey({
+      channelId: "C_SIB_2",
+      threadTs: "1700000000.000003",
+    });
+    const existing = createTaskExtended("Original", {
+      agentId: agent.id,
+      contextKey: key,
+    });
+
+    const result = applySiblingAwareness({
+      description: "Follow-up",
+      contextKey: key,
+      currentAgentId: agent.id,
+    });
+    expect(result.parentTaskId).toBe(existing.id);
+  });
+
+  test("does NOT auto-wire parentTaskId when sibling is on a different agent", () => {
+    const agentA = createAgent({
+      name: "sib-agent-3A",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const agentB = createAgent({
+      name: "sib-agent-3B",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const key = slackContextKey({
+      channelId: "C_SIB_3",
+      threadTs: "1700000000.000004",
+    });
+    createTaskExtended("Task on A", { agentId: agentA.id, contextKey: key });
+
+    // New task is destined for agentB — no resume wiring.
+    const result = applySiblingAwareness({
+      description: "Body",
+      contextKey: key,
+      currentAgentId: agentB.id,
+    });
+    expect(result.parentTaskId).toBeUndefined();
+    // But the sibling block is still included so agentB sees what's in flight.
+    expect(result.description).toContain("<sibling_tasks_in_progress>");
+    expect(result.description).toContain(`agent:${agentA.name}`);
+  });
+
+  test("does NOT auto-wire parentTaskId when currentAgentId is undefined", () => {
+    const agent = createAgent({
+      name: "sib-agent-4",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const key = slackContextKey({
+      channelId: "C_SIB_4",
+      threadTs: "1700000000.000005",
+    });
+    createTaskExtended("Existing", { agentId: agent.id, contextKey: key });
+
+    const result = applySiblingAwareness({ description: "Body", contextKey: key });
+    expect(result.parentTaskId).toBeUndefined();
+    // Block still included — useful for the worker that eventually picks it up.
+    expect(result.description).toContain("<sibling_tasks_in_progress>");
+  });
+
+  test("excludes terminal tasks (completed) from sibling results", () => {
+    const agent = createAgent({
+      name: "sib-agent-5",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+    const key = slackContextKey({
+      channelId: "C_SIB_5",
+      threadTs: "1700000000.000006",
+    });
+    const done = createTaskExtended("Done", { agentId: agent.id, contextKey: key });
+    completeTask(done.id, "ok");
+
+    const result = applySiblingAwareness({
+      description: "Body",
+      contextKey: key,
+      currentAgentId: agent.id,
+    });
+    expect(result.siblings).toEqual([]);
+    expect(result.description).toBe("Body");
+    expect(result.parentTaskId).toBeUndefined();
+  });
+});