@desplega.ai/agent-swarm 1.79.4 → 1.80.1

package/src/tests/workflow-e2e.test.ts

@@ -0,0 +1,218 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createAgent,
+  createWorkflow,
+  getDb,
+  getTaskByWorkflowRunStepId,
+  getWorkflowRun,
+  getWorkflowRunStepsByRunId,
+  initDb,
+} from "../be/db";
+import { upsertScriptByName } from "../be/scripts/db";
+import { setScriptEmbeddingProviderForTests } from "../be/scripts/embeddings";
+import type { Workflow, WorkflowDefinition } from "../types";
+import { startWorkflowExecution } from "../workflows/engine";
+import { InProcessEventBus } from "../workflows/event-bus";
+import { AgentTaskExecutor } from "../workflows/executors/agent-task";
+import type { ExecutorDependencies } from "../workflows/executors/base";
+import { ExecutorRegistry } from "../workflows/executors/registry";
+import { SwarmScriptExecutor } from "../workflows/executors/swarm-script";
+import { setupWorkflowResumeListener } from "../workflows/resume";
+import { interpolate } from "../workflows/template";
+
+const TEST_DB_PATH = "./test-workflow-e2e.sqlite";
+const API_KEY = "test-workflow-e2e-key-1234567890";
+
+const noOpEmbeddingProvider = {
+  name: "test/noop-workflow-e2e-embedding",
+  dimensions: 1,
+  async embed() {
+    return null;
+  },
+  async embedBatch(texts: string[]) {
+    return texts.map(() => null);
+  },
+};
+
+const signatureJson = JSON.stringify({
+  args: { type: "object" },
+  result: { type: "object" },
+});
+
+let savedEnv: NodeJS.ProcessEnv;
+let agentId: string;
+let eventBus: InProcessEventBus;
+let registry: ExecutorRegistry;
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(TEST_DB_PATH + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function makeWorkflow(def: WorkflowDefinition): Workflow {
+  return createWorkflow({
+    name: `workflow-e2e-${crypto.randomUUID()}`,
+    definition: def,
+    createdByAgentId: agentId,
+  });
+}
+
+async function saveScript(name: string, source: string) {
+  return upsertScriptByName({
+    name,
+    scope: "agent",
+    scopeId: agentId,
+    source,
+    description: `${name} e2e script`,
+    intent: "workflow swarm-script e2e fixture",
+    signatureJson,
+    agentId,
+    typeChecked: true,
+  });
+}
+
+async function waitForRunStatus(runId: string, status: string): Promise<void> {
+  const deadline = Date.now() + 5_000;
+  while (Date.now() < deadline) {
+    if (getWorkflowRun(runId)?.status === status) return;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  throw new Error(`Timed out waiting for workflow run ${runId} to reach ${status}`);
+}
+
+beforeAll(async () => {
+  savedEnv = { ...process.env };
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  process.env.AGENT_SWARM_API_KEY = API_KEY;
+  delete process.env.API_KEY;
+  setScriptEmbeddingProviderForTests(noOpEmbeddingProvider);
+
+  const agent = createAgent({ name: "workflow-e2e-agent", isLead: true, status: "idle" });
+  agentId = agent.id;
+
+  eventBus = new InProcessEventBus();
+  const db = await import("../be/db");
+  const deps: ExecutorDependencies = {
+    db,
+    eventBus,
+    interpolate: (template, ctx) => interpolate(template, ctx).result,
+  };
+  registry = new ExecutorRegistry();
+  registry.register(new SwarmScriptExecutor(deps));
+  registry.register(new AgentTaskExecutor(deps));
+  setupWorkflowResumeListener(eventBus, registry);
+});
+
+afterAll(async () => {
+  setScriptEmbeddingProviderForTests(null);
+  closeDb();
+  await removeDbFiles();
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(() => {
+  getDb().run("DELETE FROM workflow_run_steps");
+  getDb().run("DELETE FROM workflow_runs");
+  getDb().run("DELETE FROM scripts");
+  getDb().run("DELETE FROM agent_tasks");
+  getDb().run("DELETE FROM workflows");
+});
+
+describe("workflow e2e swarm-script", () => {
+  test("swarm-script full workflow run executes through the engine", async () => {
+    await saveScript(
+      "square",
+      `export default async (args: { value: number }) => ({ squared: args.value * args.value });`,
+    );
+    const workflow = makeWorkflow({
+      nodes: [
+        {
+          id: "script",
+          type: "swarm-script",
+          config: { scriptName: "square", args: { value: 4 } },
+        },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    const run = getWorkflowRun(runId);
+    const steps = getWorkflowRunStepsByRunId(runId);
+
+    expect(run?.status).toBe("completed");
+    expect(steps).toHaveLength(1);
+    expect(steps[0]?.output).toMatchObject({ result: { squared: 16 } });
+  });
+
+  test("swarm-script  agent-task interleave", async () => {
+    await saveScript(
+      "first-script",
+      `export default async (args: { value: number }) => ({ value: args.value + 1 });`,
+    );
+    await saveScript(
+      "second-script",
+      `export default async (args: { value: string }) => ({ final: Number(args.value) + 1 });`,
+    );
+    const workflow = makeWorkflow({
+      nodes: [
+        {
+          id: "first",
+          type: "swarm-script",
+          config: { scriptName: "first-script", args: { value: 1 } },
+          next: "task",
+        },
+        {
+          id: "task",
+          type: "agent-task",
+          inputs: { first: "first.result.value" },
+          config: { template: "Use {{first}}" },
+          next: "second",
+        },
+        {
+          id: "second",
+          type: "swarm-script",
+          inputs: { taskValue: "task.taskOutput.value" },
+          config: { scriptName: "second-script", args: { value: "{{taskValue}}" } },
+        },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    expect(getWorkflowRun(runId)?.status).toBe("waiting");
+
+    const waitingSteps = getWorkflowRunStepsByRunId(runId);
+    const taskStep = waitingSteps.find((step) => step.nodeId === "task");
+    expect(taskStep?.status).toBe("waiting");
+    const task = getTaskByWorkflowRunStepId(taskStep!.id);
+    expect(task?.task).toBe("Use 2");
+
+    eventBus.emit("task.completed", {
+      taskId: task!.id,
+      output: JSON.stringify({ value: 41 }),
+      workflowRunId: runId,
+      workflowRunStepId: taskStep!.id,
+    });
+
+    await waitForRunStatus(runId, "completed");
+    const completedSteps = getWorkflowRunStepsByRunId(runId);
+    expect(completedSteps).toHaveLength(3);
+    expect(completedSteps.find((step) => step.nodeId === "first")?.status).toBe("completed");
+    expect(completedSteps.find((step) => step.nodeId === "task")?.status).toBe("completed");
+    expect(completedSteps.find((step) => step.nodeId === "second")?.output).toMatchObject({
+      result: { final: 42 },
+    });
+  });
+});

package/src/tests/workflow-executors.test.ts

@@ -516,6 +516,34 @@ describe("ScriptExecutor", () => {
     const valid = ScriptOutputSchema.safeParse({ exitCode: 0, stdout: "hi", stderr: "" });
     expect(valid.success).toBe(true);
   });
+
+  test("keeps raw {exitCode, stdout, stderr} when stdout is not valid JSON", async () => {
+    const result = await executor.run(
+      input({ runtime: "bash", script: "echo 'not-json {at all'" }, {}),
+    );
+    expect(result.status).toBe("success");
+    const out = result.output as { exitCode: number; stdout: string; stderr: string } & {
+      parsed?: unknown;
+    };
+    expect(out.exitCode).toBe(0);
+    expect(out.stdout).toBe("not-json {at all");
+    expect(out.stderr).toBe("");
+    // No parsed key merged in — only the raw three fields are present.
+    expect(Object.keys(out).sort()).toEqual(["exitCode", "stderr", "stdout"]);
+  });
+
+  test("populates structured output on timeout instead of leaving it null", async () => {
+    const result = await executor.run(
+      input({ runtime: "bash", script: "sleep 5", timeout: 1000 }, {}),
+    );
+    expect(result.status).toBe("failed");
+    expect(result.error).toContain("Script timed out after 1000ms");
+    const out = result.output as { exitCode: number; stdout: string; stderr: string };
+    expect(out).toBeDefined();
+    expect(out.exitCode).toBe(-1);
+    expect(out.stdout).toBe("");
+    expect(out.stderr).toContain("Script timed out after 1000ms");
+  });
 });
 
 // ─── VCS Executor ────────────────────────────────────────────
@@ -706,7 +734,7 @@ describe("ValidateExecutor", () => {
 // ─── Registry Wiring ─────────────────────────────────────────
 
 describe("createExecutorRegistry", () => {
-  test("registers all 10 executors (7 instant + 3 async)", () => {
+  test("registers all 11 executors (8 instant + 3 async)", () => {
     const registry = createExecutorRegistry(mockDeps);
     const types = registry.types();
 
@@ -715,12 +743,13 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("notify");
     expect(types).toContain("raw-llm");
     expect(types).toContain("script");
+    expect(types).toContain("swarm-script");
     expect(types).toContain("vcs");
     expect(types).toContain("validate");
     expect(types).toContain("agent-task");
     expect(types).toContain("human-in-the-loop");
     expect(types).toContain("wait");
-    expect(types).toHaveLength(10);
+    expect(types).toHaveLength(11);
   });
 
   test("instant executors have mode instant, async executors have mode async", () => {
@@ -731,6 +760,7 @@ describe("createExecutorRegistry", () => {
       "notify",
       "raw-llm",
       "script",
+      "swarm-script",
       "vcs",
       "validate",
     ];

package/src/tests/workflow-input-redaction.test.ts

@@ -0,0 +1,232 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { z } from "zod";
+import {
+  closeDb,
+  createWorkflow,
+  deleteWorkflow,
+  getWorkflowRunStepsByRunId,
+  initDb,
+  upsertSwarmConfig,
+} from "../be/db";
+import type { WorkflowDefinition } from "../types";
+import { startWorkflowExecution } from "../workflows/engine";
+import {
+  BaseExecutor,
+  type ExecutorDependencies,
+  type ExecutorResult,
+} from "../workflows/executors/base";
+import { ExecutorRegistry } from "../workflows/executors/registry";
+import {
+  getSecretInputKeys,
+  REDACTED_SECRET_VALUE,
+  redactSecretsForStorage,
+  resolveInputs,
+} from "../workflows/input";
+
+const TEST_DB_PATH = "./test-workflow-input-redaction.sqlite";
+
+// Captures the input it was invoked with so we can assert what the executor
+// actually receives (real value, not redacted).
+class CaptureExecutor extends BaseExecutor<
+  typeof CaptureExecutor.schema,
+  typeof CaptureExecutor.outSchema
+> {
+  static readonly schema = z.object({ tokenSeen: z.string().optional() });
+  static readonly outSchema = z.object({ ok: z.boolean() });
+
+  readonly type = "capture";
+  readonly mode = "instant" as const;
+  readonly configSchema = CaptureExecutor.schema;
+  readonly outputSchema = CaptureExecutor.outSchema;
+
+  static lastTokenSeen: string | undefined = undefined;
+
+  protected async execute(
+    config: z.infer<typeof CaptureExecutor.schema>,
+  ): Promise<ExecutorResult<z.infer<typeof CaptureExecutor.outSchema>>> {
+    CaptureExecutor.lastTokenSeen = config.tokenSeen;
+    return { status: "success", output: { ok: true } };
+  }
+}
+
+describe("getSecretInputKeys", () => {
+  test("flags secret.* references", () => {
+    const keys = getSecretInputKeys({ GITHUB_TOKEN: "secret.GITHUB_TOKEN" });
+    expect(keys.has("GITHUB_TOKEN")).toBe(true);
+    expect(keys.size).toBe(1);
+  });
+
+  test("flags sensitive env-var references", () => {
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+    const keys = getSecretInputKeys({ GH: "${GITHUB_TOKEN}" });
+    expect(keys.has("GH")).toBe(true);
+  });
+
+  test("does not flag non-sensitive env-var references", () => {
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+    const keys = getSecretInputKeys({ branch: "${GIT_BRANCH}", url: "${MCP_BASE_URL}" });
+    expect(keys.size).toBe(0);
+  });
+
+  test("does not flag literal strings", () => {
+    const keys = getSecretInputKeys({ name: "literal", count: "42" });
+    expect(keys.size).toBe(0);
+  });
+
+  test("handles undefined input", () => {
+    const keys = getSecretInputKeys(undefined);
+    expect(keys.size).toBe(0);
+  });
+
+  test("flags all sensitive-suffix env names", () => {
+    const keys = getSecretInputKeys({
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+      a: "${FOO_TOKEN}",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+      b: "${BAR_API_KEY}",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+      c: "${BAZ_SECRET}",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+      d: "${QUX_PASSWORD}",
+    });
+    expect(keys.size).toBe(4);
+  });
+});
+
+describe("redactSecretsForStorage", () => {
+  test("returns ctx unchanged when no secret keys", () => {
+    const ctx = { input: { foo: "bar" } };
+    const out = redactSecretsForStorage(ctx, new Set());
+    expect(out).toBe(ctx);
+  });
+
+  test("redacts only declared secret keys in ctx.input", () => {
+    const ctx = {
+      trigger: { topic: "tuxedo" },
+      input: { GITHUB_TOKEN: "ghp_real_value_xxx", branch: "main" },
+    };
+    const out = redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
+    expect((out.input as Record<string, unknown>).GITHUB_TOKEN).toBe(REDACTED_SECRET_VALUE);
+    expect((out.input as Record<string, unknown>).branch).toBe("main");
+    // Trigger block untouched
+    expect(out.trigger).toEqual({ topic: "tuxedo" });
+  });
+
+  test("does not mutate the original ctx (executor still sees real value)", () => {
+    const ctx = { input: { GITHUB_TOKEN: "ghp_real" } };
+    redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
+    expect((ctx.input as Record<string, unknown>).GITHUB_TOKEN).toBe("ghp_real");
+  });
+
+  test("no-ops when ctx has no input block", () => {
+    const ctx = { trigger: {} };
+    const out = redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
+    expect(out).toBe(ctx);
+  });
+
+  test("no-ops when secret key isn't actually present in ctx.input", () => {
+    const ctx = { input: { unrelated: "x" } };
+    const out = redactSecretsForStorage(ctx, new Set(["GITHUB_TOKEN"]));
+    expect(out).toBe(ctx);
+  });
+});
+
+describe("end-to-end — workflow step persistence redacts secrets", () => {
+  beforeAll(() => {
+    initDb(TEST_DB_PATH);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    try {
+      await unlink(TEST_DB_PATH);
+    } catch {
+      // ignore
+    }
+  });
+
+  let workflowId: string | null = null;
+
+  beforeEach(() => {
+    CaptureExecutor.lastTokenSeen = undefined;
+  });
+
+  afterEach(() => {
+    if (workflowId) {
+      try {
+        deleteWorkflow(workflowId);
+      } catch {
+        // ignore
+      }
+      workflowId = null;
+    }
+  });
+
+  test("ctx.input[secretKey] is redacted in workflow_run_steps but real value reaches the executor", async () => {
+    // Seed swarm config with a "secret" value
+    const SECRET_VALUE = "ghp_supersecret_token_value_abc123";
+    upsertSwarmConfig({
+      scope: "global",
+      key: "TEST_REDACTION_GITHUB_TOKEN",
+      value: SECRET_VALUE,
+      isSecret: true,
+    });
+
+    const def: WorkflowDefinition = {
+      nodes: [
+        {
+          id: "capture-node",
+          type: "capture",
+          config: { tokenSeen: "{{input.GITHUB_TOKEN}}" },
+        },
+      ],
+    };
+    const workflow = createWorkflow({
+      name: `redaction-test-${Date.now()}`,
+      definition: def,
+      triggers: [],
+      input: {
+        GITHUB_TOKEN: "secret.TEST_REDACTION_GITHUB_TOKEN",
+        plain: "not-a-secret",
+      },
+    });
+    workflowId = workflow.id;
+
+    const registry = new ExecutorRegistry();
+    const deps: ExecutorDependencies = {
+      db: {} as typeof import("../be/db"),
+      eventBus: { emit: () => {}, on: () => {}, off: () => {} },
+      interpolate: (t: string) => t,
+    };
+    registry.register(new CaptureExecutor(deps));
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    expect(runId).toBeDefined();
+
+    // Executor must see the REAL secret value (interpolated from live ctx)
+    expect(CaptureExecutor.lastTokenSeen).toBe(SECRET_VALUE);
+
+    // Persisted step.input must have the secret redacted
+    const steps = getWorkflowRunStepsByRunId(runId);
+    expect(steps.length).toBe(1);
+    const persistedInput = steps[0]!.input as Record<string, unknown>;
+    const persistedInputBlock = persistedInput.input as Record<string, unknown>;
+    expect(persistedInputBlock.GITHUB_TOKEN).toBe(REDACTED_SECRET_VALUE);
+    // Non-secret key untouched
+    expect(persistedInputBlock.plain).toBe("not-a-secret");
+    // The real secret string must NOT appear anywhere in the persisted JSON
+    const serialized = JSON.stringify(steps[0]);
+    expect(serialized.includes(SECRET_VALUE)).toBe(false);
+  });
+});
+
+describe("resolveInputs (unchanged behavior)", () => {
+  test("still resolves env-var references", () => {
+    process.env.TEST_REDACT_VAR = "resolved";
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: testing env-var syntax
+    const out = resolveInputs({ x: "${TEST_REDACT_VAR}" });
+    expect(out.x).toBe("resolved");
+    delete process.env.TEST_REDACT_VAR;
+  });
+});