@desplega.ai/agent-swarm 1.80.0 → 1.80.2

package/src/tests/scripts-mcp-e2e.test.ts

@@ -0,0 +1,269 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { closeDb, createAgent, getDb, initDb } from "../be/db";
+import { setScriptEmbeddingProviderForTests } from "../be/scripts/embeddings";
+import { handleCore } from "../http/core";
+import { handleScripts } from "../http/scripts";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { registerScriptDeleteTool } from "../tools/script-delete";
+import { registerScriptRunTool } from "../tools/script-run";
+import { registerScriptSearchTool } from "../tools/script-search";
+import { registerScriptUpsertTool } from "../tools/script-upsert";
+import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
+
+const TEST_DB_PATH = "./test-scripts-mcp-e2e.sqlite";
+const API_KEY = "test-scripts-mcp-key-1234567890";
+
+function fakeEmbedding(text: string): Float32Array {
+  const lower = text.toLowerCase();
+  return new Float32Array([
+    lower.includes("multiply") ? 1 : 0,
+    lower.includes("seven") ? 1 : 0,
+    lower.includes("memory") ? 1 : 0,
+    lower.includes("typed") ? 1 : 0,
+  ]);
+}
+
+const fakeEmbeddingProvider = {
+  name: "test/fake-script-embedding",
+  dimensions: 4,
+  async embed(text: string) {
+    return fakeEmbedding(text);
+  },
+  async embedBatch(texts: string[]) {
+    return Promise.all(texts.map(fakeEmbedding));
+  },
+};
+
+type RegisteredTool = {
+  handler: (args: unknown, extra: unknown) => Promise<unknown>;
+};
+
+type StructuredResult<T> = {
+  structuredContent: {
+    success: boolean;
+    status: number;
+    data?: T;
+    error?: string;
+  };
+};
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function buildToolServer() {
+  const server = new McpServer({ name: "scripts-mcp-e2e", version: "1.0.0" });
+  registerScriptSearchTool(server);
+  registerScriptRunTool(server);
+  registerScriptUpsertTool(server);
+  registerScriptDeleteTool(server);
+  const registered = (server as unknown as { _registeredTools: Record<string, RegisteredTool> })
+    ._registeredTools;
+  return {
+    search: registered["script-search"]!,
+    run: registered["script-run"]!,
+    upsert: registered["script-upsert"]!,
+    del: registered["script-delete"]!,
+  };
+}
+
+function meta(agentId?: string) {
+  const headers: Record<string, string> = {};
+  if (agentId) headers["x-agent-id"] = agentId;
+  return { sessionId: "scripts-mcp-e2e", requestInfo: { headers } };
+}
+
+function headersRecord(headers: HeadersInit | undefined): Record<string, string> {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  if (Array.isArray(headers)) return Object.fromEntries(headers);
+  return headers as Record<string, string>;
+}
+
+async function dispatchScriptsApi(url: string, init: RequestInit = {}): Promise<Response> {
+  const parsedUrl = new URL(url);
+  const headers = Object.fromEntries(
+    Object.entries(headersRecord(init.headers)).map(([key, value]) => [
+      key.toLowerCase(),
+      String(value),
+    ]),
+  );
+  const body = init.body === undefined ? undefined : String(init.body);
+  const req = Readable.from(body ? [Buffer.from(body)] : []) as IncomingMessage;
+  req.method = init.method ?? "GET";
+  req.url = `${parsedUrl.pathname}${parsedUrl.search}`;
+  req.headers = headers;
+
+  let status = 200;
+  let text = "";
+  const res = {
+    headersSent: false,
+    writableEnded: false,
+    setHeader() {},
+    writeHead(code: number) {
+      status = code;
+      this.headersSent = true;
+      return this;
+    },
+    end(chunk?: unknown) {
+      if (chunk !== undefined) text += String(chunk);
+      this.writableEnded = true;
+      return this;
+    },
+  } as unknown as ServerResponse;
+
+  const agentId = headers["x-agent-id"];
+  if (!(await handleCore(req, res, agentId, API_KEY))) {
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    if (!(await handleScripts(req, res, pathSegments, queryParams, agentId))) {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  }
+
+  return new Response(text, {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+let workerId: string;
+let savedEnv: NodeJS.ProcessEnv;
+let savedFetch: typeof globalThis.fetch;
+
+beforeAll(async () => {
+  savedEnv = { ...process.env };
+  savedFetch = globalThis.fetch;
+  await removeDbFiles(TEST_DB_PATH);
+  initDb(TEST_DB_PATH);
+  process.env.AGENT_SWARM_API_KEY = API_KEY;
+  delete process.env.API_KEY;
+  refreshSecretScrubberCache();
+  setScriptEmbeddingProviderForTests(fakeEmbeddingProvider);
+  workerId = createAgent({ name: "scripts-mcp-worker", isLead: false, status: "idle" }).id;
+  process.env.MCP_BASE_URL = "http://scripts-mcp-e2e.test";
+  globalThis.fetch = (async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    if (url.startsWith("http://scripts-mcp-e2e.test/api/scripts/")) {
+      return dispatchScriptsApi(url, init);
+    }
+    return savedFetch(input, init);
+  }) as typeof globalThis.fetch;
+});
+
+afterAll(async () => {
+  globalThis.fetch = savedFetch;
+  setScriptEmbeddingProviderForTests(null);
+  closeDb();
+  await removeDbFiles(TEST_DB_PATH);
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  refreshSecretScrubberCache();
+});
+
+beforeEach(() => {
+  getDb().run("DELETE FROM scripts");
+});
+
+describe("script_ MCP HTTP proxy tools", () => {
+  test("exercise script-upsert -> script-search -> script-run -> script-delete", async () => {
+    const tools = buildToolServer();
+    const source = `export default async (args: { value: number }) => ({ result: args.value * 7 });`;
+
+    const upsert = (await tools.upsert.handler(
+      { name: "times-seven", source, description: "Multiply", intent: "MCP E2E" },
+      meta(workerId),
+    )) as StructuredResult<{ name: string; version: number }>;
+    expect(upsert.structuredContent.success).toBe(true);
+    expect(upsert.structuredContent.data?.name).toBe("times-seven");
+
+    const search = (await tools.search.handler(
+      { query: "seven", limit: 5 },
+      meta(workerId),
+    )) as StructuredResult<{ results: Array<{ name: string }> }>;
+    expect(search.structuredContent.success).toBe(true);
+    expect(search.structuredContent.data?.results.map((item) => item.name)).toContain(
+      "times-seven",
+    );
+
+    const run = (await tools.run.handler(
+      { name: "times-seven", args: { value: 6 }, intent: "MCP run" },
+      meta(workerId),
+    )) as StructuredResult<{ result: { result: number } }>;
+    expect(run.structuredContent.success).toBe(true);
+    expect(run.structuredContent.data?.result).toEqual({ result: 42 });
+
+    const del = (await tools.del.handler(
+      { name: "times-seven", scope: "agent" },
+      meta(workerId),
+    )) as StructuredResult<{ deleted: boolean }>;
+    expect(del.structuredContent.success).toBe(true);
+    expect(del.structuredContent.data?.deleted).toBe(true);
+  });
+
+  test("stdio-style missing agent identity short-circuits clearly", async () => {
+    const tools = buildToolServer();
+    const result = (await tools.search.handler({ query: "anything" }, meta())) as StructuredResult<{
+      error: string;
+    }>;
+    expect(result.structuredContent.success).toBe(false);
+    expect(result.structuredContent.error).toContain("HTTP MCP transport");
+  });
+
+  test("typed SDK fixture passes upsert typecheck and wrong arg type fails", async () => {
+    const tools = buildToolServer();
+    const source = `
+      import type { ScriptContext, SwarmSdk } from "swarm-sdk";
+      const compileOnly = (swarm: SwarmSdk) => swarm.memory_search({ query: "foo" });
+      export default async (_args: unknown, ctx: ScriptContext) => {
+        void compileOnly;
+        return { hasMemorySearch: typeof ctx.swarm.memory_search === "function" };
+      };
+    `;
+
+    const upsert = (await tools.upsert.handler(
+      { name: "typed-sdk", source, description: "Typed SDK fixture", intent: "typecheck" },
+      meta(workerId),
+    )) as StructuredResult<{ name: string }>;
+    expect(upsert.structuredContent.success).toBe(true);
+
+    const run = (await tools.run.handler(
+      { name: "typed-sdk", args: {}, intent: "typed SDK run" },
+      meta(workerId),
+    )) as StructuredResult<{ result: { hasMemorySearch: boolean } }>;
+    expect(run.structuredContent.success).toBe(true);
+    expect(run.structuredContent.data?.result).toEqual({ hasMemorySearch: true });
+
+    const bad = (await tools.upsert.handler(
+      {
+        name: "typed-sdk-bad",
+        source: `
+          import type { ScriptContext } from "swarm-sdk";
+          export default async (_args: unknown, ctx: ScriptContext) =>
+            ctx.swarm.memory_search({ query: 123 });
+        `,
+        description: "Bad SDK fixture",
+        intent: "typecheck",
+      },
+      meta(workerId),
+    )) as StructuredResult<{ diagnostics: string[] }>;
+    expect(bad.structuredContent.success).toBe(false);
+    expect(bad.structuredContent.error).toBe("typecheck_failed");
+  });
+});

package/src/tests/scripts-runtime-secret-egress.test.ts

@@ -0,0 +1,44 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { runScript } from "../scripts-runtime/loader";
+import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
+
+const savedEnv = { ...process.env };
+
+beforeEach(() => {
+  process.env.AGENT_SWARM_API_KEY = "runtime-egress-secret-1234567890";
+  refreshSecretScrubberCache();
+});
+
+afterEach(() => {
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  refreshSecretScrubberCache();
+});
+
+describe("runtime secret egress", () => {
+  test("scrubObject catches unwrapped returned config secrets", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      resources: { memoryMb: 2048 },
+      source:
+        "export default async (_args, ctx) => ({ leaked: ctx.stdlib.Redacted.value(ctx.swarm.config.apiKey) });",
+    });
+
+    expect(output.result).toEqual({ leaked: "[REDACTED:AGENT_SWARM_API_KEY]" });
+  });
+
+  test("wrapped config values stringify to redacted in the result file", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      resources: { memoryMb: 2048 },
+      source: "export default async (_args, ctx) => ({ wrapped: ctx.swarm.config.apiKey });",
+    });
+
+    expect(output.result).toEqual({ wrapped: "<redacted>" });
+  });
+});

package/src/tests/scripts-runtime.test.ts

@@ -0,0 +1,344 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { runScript } from "../scripts-runtime/loader";
+import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
+
+const savedEnv = { ...process.env };
+const resources = { memoryMb: 2048, cpuTimeSec: 20, maxStdoutBytes: 1_048_576 };
+
+beforeEach(() => {
+  process.env.AGENT_SWARM_API_KEY = "runtime-test-secret-1234567890";
+  delete process.env.API_KEY;
+  process.env.MCP_BASE_URL = "http://localhost:3013";
+  refreshSecretScrubberCache();
+});
+
+afterEach(() => {
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  refreshSecretScrubberCache();
+});
+
+describe("runScript", () => {
+  test("runs a trivial transform", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      args: { x: 1 },
+      resources,
+      source: "export default async (args) => args.x + 1;",
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toBe(2);
+    expect(output.exitCode).toBe(0);
+  });
+
+  test("ctx.stdlib.fetch returns a Response and fetchJson returns parsed JSON", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      args: { url: 'data:application/json,{"ok":true}' },
+      resources,
+      source: `
+        export default async (args, ctx) => {
+          const response = await ctx.stdlib.fetch(args.url);
+          const parsed = await ctx.stdlib.fetchJson(args.url);
+          return { status: response.status, parsed };
+        };
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toEqual({ status: 200, parsed: { ok: true } });
+  });
+
+  test("ctx.swarm bridge round-trips kv_set then kv_get", async () => {
+    const entries = new Map<string, unknown>();
+    const server = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        expect(req.headers.get("authorization")).toBe("Bearer runtime-test-secret-1234567890");
+        expect(req.headers.get("x-agent-id")).toBe("agent-1");
+
+        const url = new URL(req.url);
+        if (req.method === "PUT" && url.pathname.startsWith("/api/kv/")) {
+          const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
+          const body = (await req.json()) as { value: unknown };
+          entries.set(key, body.value);
+          return Response.json({ key, value: body.value });
+        }
+        if (req.method === "GET" && url.pathname.startsWith("/api/kv/")) {
+          const key = decodeURIComponent(url.pathname.slice("/api/kv/".length));
+          return Response.json({ key, value: entries.get(key) ?? null });
+        }
+        return Response.json({ error: "not found" }, { status: 404 });
+      },
+    });
+
+    try {
+      const output = await runScript({
+        agentId: "agent-1",
+        mcpBaseUrl: `http://127.0.0.1:${server.port}`,
+        resources,
+        source: `
+          export default async (_args, ctx) => {
+            await ctx.swarm.kv_set({ key: "bridge-smoke", value: { ok: true } });
+            return await ctx.swarm.kv_get({ key: "bridge-smoke" });
+          };
+        `,
+      });
+
+      expect(output.error).toBeUndefined();
+      expect(output.result).toEqual({
+        success: true,
+        status: 200,
+        data: { key: "bridge-smoke", value: { ok: true } },
+      });
+    } finally {
+      server.stop(true);
+    }
+  });
+
+  test("bare stdlib imports resolve through runtime shims", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      resources,
+      source: `
+        import { table } from "stdlib";
+        export default async () => table([{ a: 1 }]);
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toContain("a");
+    expect(output.result).toContain("1");
+  });
+
+  test("timeout kills a running script", async () => {
+    const started = Date.now();
+    const output = await runScript({
+      agentId: "agent-1",
+      timeoutMs: 150,
+      resources: { ...resources, wallClockMs: 150 },
+      source: "export default async () => new Promise(() => {});",
+    });
+
+    expect(output.error).toBe("timeout");
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+
+  test("stdout is capped and marked truncated", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      resources: { ...resources, maxStdoutBytes: 128 },
+      source: "export default async () => { console.log('x'.repeat(2048)); return 'ok'; };",
+    });
+
+    expect(output.result).toBe("ok");
+    expect(output.truncated.stdout).toBe(true);
+    expect(output.stdout.length).toBeLessThanOrEqual(128);
+  });
+
+  test("AbortSignal aborts a running script", async () => {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 50);
+    const started = Date.now();
+
+    const output = await runScript({
+      agentId: "agent-1",
+      signal: controller.signal,
+      resources,
+      source: "export default async () => new Promise(() => {});",
+    });
+
+    expect(output.error).toBe("killed");
+    expect(Date.now() - started).toBeLessThan(1000);
+  });
+
+  test("subprocess env is stripped to the explicit allowlist", async () => {
+    process.env.API_KEY = "legacy-secret-that-must-not-leak";
+    process.env.AGENT_SWARM_API_KEY = "preferred-secret-that-must-not-leak";
+    refreshSecretScrubberCache();
+
+    const output = await runScript({
+      agentId: "agent-1",
+      resources,
+      source: `
+        export default async () => ({
+          keys: Object.keys(process.env).sort(),
+          apiKey: process.env.API_KEY,
+          agentSwarmApiKey: process.env.AGENT_SWARM_API_KEY,
+        });
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toEqual({
+      keys: [
+        "HOME",
+        "LANG",
+        "LC_ALL",
+        "PATH",
+        "SWARM_SCRIPT_ARGS_FILE",
+        "SWARM_SCRIPT_RESULT_FILE",
+        "SWARM_SCRIPT_SOURCE_FILE",
+        "SWARM_SCRIPT_TMPDIR",
+        "TMPDIR",
+      ],
+    });
+  });
+
+  test("workspace-rw is rejected in v1", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      fsMode: "workspace-rw",
+      source: "export default async () => true;",
+    });
+
+    expect(output.error).toBe("executor_error");
+    expect(output.stderr).toContain("workspace-rw");
+  });
+
+  test("SCRIPT_RUNTIME_DIR bundle path works (compiled binary mode regression)", async () => {
+    // Simulate compiled binary mode: pre-build bundles to a temp dir and set
+    // SCRIPT_RUNTIME_DIR so the executor uses them instead of import.meta.url paths.
+    const tmpdir = `${process.env.TMPDIR ?? "/tmp"}/script-runtime-test-${crypto.randomUUID()}`;
+    await Bun.$`mkdir -p ${tmpdir}`;
+    try {
+      const runtimeSrc = new URL("../scripts-runtime", import.meta.url).pathname;
+      await Bun.$`bun build ${runtimeSrc}/eval-harness.ts --target bun --no-splitting --outfile ${tmpdir}/eval-harness.bundle.js`.quiet();
+      await Bun.$`bun build ${runtimeSrc}/stdlib/index.ts --target bun --no-splitting --outfile ${tmpdir}/stdlib.bundle.js`.quiet();
+      await Bun.$`bun build ${runtimeSrc}/swarm-sdk.ts --target bun --no-splitting --outfile ${tmpdir}/swarm-sdk.bundle.js`.quiet();
+
+      process.env.SCRIPT_RUNTIME_DIR = tmpdir;
+
+      const output = await runScript({
+        agentId: "agent-1",
+        args: { x: 42 },
+        resources,
+        source: "export default async (args) => args.x * 2;",
+      });
+
+      expect(output.error).toBeUndefined();
+      expect(output.result).toBe(84);
+      expect(output.exitCode).toBe(0);
+    } finally {
+      delete process.env.SCRIPT_RUNTIME_DIR;
+      await Bun.$`rm -rf ${tmpdir}`;
+    }
+  });
+
+  test("args arrives as a parsed object, not a JSON string", async () => {
+    // Regression: eval-harness must deliver a parsed object to user code even
+    // when the caller serializes args as a JSON string (double-serialization).
+    // Before the fix, property access like args.foo would always be undefined.
+    const output = await runScript({
+      agentId: "agent-1",
+      args: { foo: "bar" },
+      resources,
+      source: `
+        export default async (args) => {
+          if (typeof args !== "object" || args === null) throw new Error("args is not an object: " + typeof args);
+          if (args.foo !== "bar") throw new Error("args.foo expected 'bar', got: " + args.foo);
+          return { ok: true, foo: args.foo };
+        };
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toEqual({ ok: true, foo: "bar" });
+    expect(output.exitCode).toBe(0);
+  });
+
+  test("args parsed correctly in compiled binary mode (SCRIPT_RUNTIME_DIR)", async () => {
+    // Same regression exercised through the compiled-binary (SCRIPT_RUNTIME_DIR) code path.
+    const tmpdir = `${process.env.TMPDIR ?? "/tmp"}/script-runtime-test-${crypto.randomUUID()}`;
+    await Bun.$`mkdir -p ${tmpdir}`;
+    try {
+      const runtimeSrc = new URL("../scripts-runtime", import.meta.url).pathname;
+      await Bun.$`bun build ${runtimeSrc}/eval-harness.ts --target bun --no-splitting --outfile ${tmpdir}/eval-harness.bundle.js`.quiet();
+      await Bun.$`bun build ${runtimeSrc}/stdlib/index.ts --target bun --no-splitting --outfile ${tmpdir}/stdlib.bundle.js`.quiet();
+      await Bun.$`bun build ${runtimeSrc}/swarm-sdk.ts --target bun --no-splitting --outfile ${tmpdir}/swarm-sdk.bundle.js`.quiet();
+
+      process.env.SCRIPT_RUNTIME_DIR = tmpdir;
+
+      const output = await runScript({
+        agentId: "agent-1",
+        args: { foo: "bar" },
+        resources,
+        source: `
+          export default async (args) => {
+            if (typeof args !== "object" || args === null) throw new Error("args is not an object: " + typeof args);
+            if (args.foo !== "bar") throw new Error("args.foo expected 'bar', got: " + args.foo);
+            return { ok: true, foo: args.foo };
+          };
+        `,
+      });
+
+      expect(output.error).toBeUndefined();
+      expect(output.result).toEqual({ ok: true, foo: "bar" });
+      expect(output.exitCode).toBe(0);
+    } finally {
+      delete process.env.SCRIPT_RUNTIME_DIR;
+      await Bun.$`rm -rf ${tmpdir}`;
+    }
+  });
+
+  test("argsSchema rejects invalid args with a formatted Zod error", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      args: {},
+      resources,
+      source: `
+        import { z } from "zod";
+        export const argsSchema = z.object({
+          repo: z.string(),
+        });
+        export default async (args: z.infer<typeof argsSchema>) => ({ repo: args.repo });
+      `,
+    });
+
+    expect(output.error).toBeDefined();
+    expect(output.exitCode).not.toBe(0);
+    expect(output.stderr).toContain("argsSchema validation failed");
+    expect(output.stderr).toContain("repo");
+  });
+
+  test("argsSchema applies .default() values when fields are omitted", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      args: { repo: "owner/name" },
+      resources,
+      source: `
+        import { z } from "zod";
+        export const argsSchema = z.object({
+          repo: z.string(),
+          limit: z.number().default(10),
+        });
+        export default async (args: z.infer<typeof argsSchema>) => ({ repo: args.repo, limit: args.limit });
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toEqual({ repo: "owner/name", limit: 10 });
+    expect(output.exitCode).toBe(0);
+  });
+
+  test("script without argsSchema still works (backward-compat)", async () => {
+    const output = await runScript({
+      agentId: "agent-1",
+      args: { value: 42 },
+      resources,
+      source: `
+        export default async (args: { value: number }) => ({ doubled: args.value * 2 });
+      `,
+    });
+
+    expect(output.error).toBeUndefined();
+    expect(output.result).toEqual({ doubled: 84 });
+    expect(output.exitCode).toBe(0);
+  });
+});