@desplega.ai/agent-swarm 1.80.0 → 1.80.2

package/src/tests/sdk-allowlist.test.ts

@@ -0,0 +1,59 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { closeDb, initDb } from "../be/db";
+import { mcpToolNameForSdkMethod, SDK_ALLOWLIST } from "../scripts-runtime/sdk-allowlist";
+import type { SwarmConfig } from "../scripts-runtime/swarm-config";
+import { createSwarmSdk } from "../scripts-runtime/swarm-sdk";
+import { createServer } from "../server";
+
+const TEST_DB_PATH = "./test-sdk-allowlist.sqlite";
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+describe("script SDK allowlist", () => {
+  let registeredTools: Record<string, unknown>;
+
+  beforeAll(async () => {
+    await removeDbFiles(TEST_DB_PATH);
+    initDb(TEST_DB_PATH);
+    const server = createServer();
+    registeredTools = (server as unknown as { _registeredTools: Record<string, unknown> })
+      ._registeredTools;
+  });
+
+  afterAll(async () => {
+    closeDb();
+    await removeDbFiles(TEST_DB_PATH);
+  });
+
+  test("every SDK allowlist entry resolves to a live MCP tool", () => {
+    const missing = SDK_ALLOWLIST.map((name) => mcpToolNameForSdkMethod(name)).filter(
+      (name) => !(name in registeredTools),
+    );
+    expect(missing).toEqual([]);
+  });
+
+  test("runtime proxy rejects non-allowlisted tools before fetch", async () => {
+    const sdk = createSwarmSdk({} as SwarmConfig);
+    await expect(sdk.join_swarm({})).rejects.toThrow(
+      "Tool 'join_swarm' is not exposed to scripts (lifecycle/cred tool)",
+    );
+  });
+
+  test("bundled swarm-sdk.d.ts exposes only allowlisted methods", async () => {
+    const types = await Bun.file("src/scripts-runtime/types/swarm-sdk.d.ts").text();
+    for (const name of SDK_ALLOWLIST) {
+      expect(types).toContain(`${name}(args`);
+    }
+    expect(types).not.toContain("join_swarm(");
+    expect(types).not.toContain("start_worker(");
+  });
+});

package/src/tests/secret-scrubber.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { refreshSecretScrubberCache, scrubSecrets } from "../utils/secret-scrubber";
+import { refreshSecretScrubberCache, scrubObject, scrubSecrets } from "../utils/secret-scrubber";
 
 // Snapshot/restore process.env between tests so env-derived cache entries
 // don't leak across cases.
@@ -266,3 +266,37 @@ describe("scrubSecrets — does not over-scrub", () => {
     expect(out).toBe("example: ghp_TOKEN and glpat-xyz (both too short)");
   });
 });
+
+describe("scrubObject", () => {
+  test("scrubs nested object and array string leaves", () => {
+    process.env.NESTED_TOKEN = "nested-secret-value-1234567890";
+    refreshSecretScrubberCache();
+
+    const out = scrubObject({
+      keep: 1,
+      nested: {
+        secret: "nested-secret-value-1234567890",
+        list: ["safe", "nested-secret-value-1234567890"],
+      },
+      nullish: null,
+      bool: true,
+    });
+
+    expect(out).toEqual({
+      keep: 1,
+      nested: {
+        secret: "[REDACTED:NESTED_TOKEN]",
+        list: ["safe", "[REDACTED:NESTED_TOKEN]"],
+      },
+      nullish: null,
+      bool: true,
+    });
+  });
+
+  test("handles circular references without recursing forever", () => {
+    const value: Record<string, unknown> = { a: "ok" };
+    value.self = value;
+
+    expect(scrubObject(value)).toEqual({ a: "ok", self: "[Circular]" });
+  });
+});

package/src/tests/swarm-config.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+import type { SwarmConfigPayload } from "../scripts-runtime/executors/types";
+import { Redacted } from "../scripts-runtime/redacted";
+import { SwarmConfig } from "../scripts-runtime/swarm-config";
+
+const payload: SwarmConfigPayload = {
+  system: {
+    apiKey: { value: "test-api-key", isSecret: true },
+    agentId: { value: "agent-1", isSecret: false },
+    mcpBaseUrl: { value: "http://localhost:3013", isSecret: false },
+  },
+  user: {
+    "user-key": { value: "user-value", isSecret: true },
+  },
+};
+
+describe("SwarmConfig", () => {
+  test("hydrates system values as Redacted values with metadata", () => {
+    const config = new SwarmConfig(payload);
+    expect(Redacted.value(config.apiKey)).toBe("test-api-key");
+    expect(Redacted.meta(config.apiKey)).toEqual({ type: "system", isSecret: true });
+    expect(Redacted.value(config.agentId)).toBe("agent-1");
+    expect(Redacted.meta(config.mcpBaseUrl)).toEqual({ type: "system", isSecret: false });
+  });
+
+  test("returns user-set config values", () => {
+    const config = new SwarmConfig(payload);
+    const value = config.get("user-key");
+    expect(value).toBeDefined();
+    expect(Redacted.value(value!)).toBe("user-value");
+    expect(Redacted.meta(value!)).toEqual({ type: "user", isSecret: true });
+  });
+
+  test("missing user keys return undefined", () => {
+    const config = new SwarmConfig(payload);
+    expect(config.get("missing")).toBeUndefined();
+  });
+});

package/src/tests/tool-annotations.test.ts

@@ -323,9 +323,9 @@ describe("Tool Annotations & Classification", () => {
   test("registered tool count matches expected total", () => {
     const count = Object.keys(tools).length;
     // We expect all tools to be registered when all capabilities are enabled (default)
-    // Includes 11 skill tools and 7 MCP server tools
+    // Includes 11 skill tools, 7 MCP server tools, and reusable script tools
     expect(count).toBeGreaterThanOrEqual(45);
-    expect(count).toBeLessThanOrEqual(95);
+    expect(count).toBeLessThanOrEqual(100);
   });
 
   test("core tools are fewer than deferred tools", () => {

package/src/tests/tool-call-progress.test.ts

@@ -151,6 +151,31 @@ describe("toolCallToProgress", () => {
     expect(result).toBe("💬 Posting to Slack");
   });
 
+  test("agent-swarm:script-search has pretty label", () => {
+    const result = toolCallToProgress("mcp__agent-swarm__script-search", {});
+    expect(result).toBe("📜 Searching scripts");
+  });
+
+  test("agent-swarm:script-run has pretty label", () => {
+    const result = toolCallToProgress("mcp__agent-swarm__script-run", {});
+    expect(result).toBe("📜 Running script");
+  });
+
+  test("agent-swarm:script-upsert has pretty label", () => {
+    const result = toolCallToProgress("mcp__agent-swarm__script-upsert", {});
+    expect(result).toBe("📜 Saving script");
+  });
+
+  test("agent-swarm:script-delete has pretty label", () => {
+    const result = toolCallToProgress("mcp__agent-swarm__script-delete", {});
+    expect(result).toBe("📜 Deleting script");
+  });
+
+  test("agent-swarm:script-query-types has pretty label", () => {
+    const result = toolCallToProgress("mcp__agent-swarm__script-query-types", {});
+    expect(result).toBe("📜 Reading script types");
+  });
+
   // --- Agent-swarm MCP tool NOT in lookup (humanized fallback) ---
 
   test("unknown agent-swarm tool gets humanized fallback", () => {
@@ -191,6 +216,11 @@ describe("toolCallToProgress", () => {
     expect(result).toBe("🗃️ Querying database");
   });
 
+  test("bare agent-swarm script-run has pretty label", () => {
+    const result = toolCallToProgress("script-run", {});
+    expect(result).toBe("📜 Running script");
+  });
+
   test("codex MCP args with agent-swarm server use pretty labels", () => {
     const result = toolCallToProgress("send-task", {
       server: "agent-swarm",

package/src/tests/workflow-e2e.test.ts

@@ -0,0 +1,218 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createAgent,
+  createWorkflow,
+  getDb,
+  getTaskByWorkflowRunStepId,
+  getWorkflowRun,
+  getWorkflowRunStepsByRunId,
+  initDb,
+} from "../be/db";
+import { upsertScriptByName } from "../be/scripts/db";
+import { setScriptEmbeddingProviderForTests } from "../be/scripts/embeddings";
+import type { Workflow, WorkflowDefinition } from "../types";
+import { startWorkflowExecution } from "../workflows/engine";
+import { InProcessEventBus } from "../workflows/event-bus";
+import { AgentTaskExecutor } from "../workflows/executors/agent-task";
+import type { ExecutorDependencies } from "../workflows/executors/base";
+import { ExecutorRegistry } from "../workflows/executors/registry";
+import { SwarmScriptExecutor } from "../workflows/executors/swarm-script";
+import { setupWorkflowResumeListener } from "../workflows/resume";
+import { interpolate } from "../workflows/template";
+
+const TEST_DB_PATH = "./test-workflow-e2e.sqlite";
+const API_KEY = "test-workflow-e2e-key-1234567890";
+
+const noOpEmbeddingProvider = {
+  name: "test/noop-workflow-e2e-embedding",
+  dimensions: 1,
+  async embed() {
+    return null;
+  },
+  async embedBatch(texts: string[]) {
+    return texts.map(() => null);
+  },
+};
+
+const signatureJson = JSON.stringify({
+  args: { type: "object" },
+  result: { type: "object" },
+});
+
+let savedEnv: NodeJS.ProcessEnv;
+let agentId: string;
+let eventBus: InProcessEventBus;
+let registry: ExecutorRegistry;
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(TEST_DB_PATH + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function makeWorkflow(def: WorkflowDefinition): Workflow {
+  return createWorkflow({
+    name: `workflow-e2e-${crypto.randomUUID()}`,
+    definition: def,
+    createdByAgentId: agentId,
+  });
+}
+
+async function saveScript(name: string, source: string) {
+  return upsertScriptByName({
+    name,
+    scope: "agent",
+    scopeId: agentId,
+    source,
+    description: `${name} e2e script`,
+    intent: "workflow swarm-script e2e fixture",
+    signatureJson,
+    agentId,
+    typeChecked: true,
+  });
+}
+
+async function waitForRunStatus(runId: string, status: string): Promise<void> {
+  const deadline = Date.now() + 5_000;
+  while (Date.now() < deadline) {
+    if (getWorkflowRun(runId)?.status === status) return;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  throw new Error(`Timed out waiting for workflow run ${runId} to reach ${status}`);
+}
+
+beforeAll(async () => {
+  savedEnv = { ...process.env };
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+  process.env.AGENT_SWARM_API_KEY = API_KEY;
+  delete process.env.API_KEY;
+  setScriptEmbeddingProviderForTests(noOpEmbeddingProvider);
+
+  const agent = createAgent({ name: "workflow-e2e-agent", isLead: true, status: "idle" });
+  agentId = agent.id;
+
+  eventBus = new InProcessEventBus();
+  const db = await import("../be/db");
+  const deps: ExecutorDependencies = {
+    db,
+    eventBus,
+    interpolate: (template, ctx) => interpolate(template, ctx).result,
+  };
+  registry = new ExecutorRegistry();
+  registry.register(new SwarmScriptExecutor(deps));
+  registry.register(new AgentTaskExecutor(deps));
+  setupWorkflowResumeListener(eventBus, registry);
+});
+
+afterAll(async () => {
+  setScriptEmbeddingProviderForTests(null);
+  closeDb();
+  await removeDbFiles();
+  for (const key of Object.keys(process.env)) {
+    if (!(key in savedEnv)) delete process.env[key];
+  }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(() => {
+  getDb().run("DELETE FROM workflow_run_steps");
+  getDb().run("DELETE FROM workflow_runs");
+  getDb().run("DELETE FROM scripts");
+  getDb().run("DELETE FROM agent_tasks");
+  getDb().run("DELETE FROM workflows");
+});
+
+describe("workflow e2e swarm-script", () => {
+  test("swarm-script full workflow run executes through the engine", async () => {
+    await saveScript(
+      "square",
+      `export default async (args: { value: number }) => ({ squared: args.value * args.value });`,
+    );
+    const workflow = makeWorkflow({
+      nodes: [
+        {
+          id: "script",
+          type: "swarm-script",
+          config: { scriptName: "square", args: { value: 4 } },
+        },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    const run = getWorkflowRun(runId);
+    const steps = getWorkflowRunStepsByRunId(runId);
+
+    expect(run?.status).toBe("completed");
+    expect(steps).toHaveLength(1);
+    expect(steps[0]?.output).toMatchObject({ result: { squared: 16 } });
+  });
+
+  test("swarm-script  agent-task interleave", async () => {
+    await saveScript(
+      "first-script",
+      `export default async (args: { value: number }) => ({ value: args.value + 1 });`,
+    );
+    await saveScript(
+      "second-script",
+      `export default async (args: { value: string }) => ({ final: Number(args.value) + 1 });`,
+    );
+    const workflow = makeWorkflow({
+      nodes: [
+        {
+          id: "first",
+          type: "swarm-script",
+          config: { scriptName: "first-script", args: { value: 1 } },
+          next: "task",
+        },
+        {
+          id: "task",
+          type: "agent-task",
+          inputs: { first: "first.result.value" },
+          config: { template: "Use {{first}}" },
+          next: "second",
+        },
+        {
+          id: "second",
+          type: "swarm-script",
+          inputs: { taskValue: "task.taskOutput.value" },
+          config: { scriptName: "second-script", args: { value: "{{taskValue}}" } },
+        },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(workflow, {}, registry);
+    expect(getWorkflowRun(runId)?.status).toBe("waiting");
+
+    const waitingSteps = getWorkflowRunStepsByRunId(runId);
+    const taskStep = waitingSteps.find((step) => step.nodeId === "task");
+    expect(taskStep?.status).toBe("waiting");
+    const task = getTaskByWorkflowRunStepId(taskStep!.id);
+    expect(task?.task).toBe("Use 2");
+
+    eventBus.emit("task.completed", {
+      taskId: task!.id,
+      output: JSON.stringify({ value: 41 }),
+      workflowRunId: runId,
+      workflowRunStepId: taskStep!.id,
+    });
+
+    await waitForRunStatus(runId, "completed");
+    const completedSteps = getWorkflowRunStepsByRunId(runId);
+    expect(completedSteps).toHaveLength(3);
+    expect(completedSteps.find((step) => step.nodeId === "first")?.status).toBe("completed");
+    expect(completedSteps.find((step) => step.nodeId === "task")?.status).toBe("completed");
+    expect(completedSteps.find((step) => step.nodeId === "second")?.output).toMatchObject({
+      result: { final: 42 },
+    });
+  });
+});

package/src/tests/workflow-executors.test.ts

@@ -516,6 +516,34 @@ describe("ScriptExecutor", () => {
     const valid = ScriptOutputSchema.safeParse({ exitCode: 0, stdout: "hi", stderr: "" });
     expect(valid.success).toBe(true);
   });
+
+  test("keeps raw {exitCode, stdout, stderr} when stdout is not valid JSON", async () => {
+    const result = await executor.run(
+      input({ runtime: "bash", script: "echo 'not-json {at all'" }, {}),
+    );
+    expect(result.status).toBe("success");
+    const out = result.output as { exitCode: number; stdout: string; stderr: string } & {
+      parsed?: unknown;
+    };
+    expect(out.exitCode).toBe(0);
+    expect(out.stdout).toBe("not-json {at all");
+    expect(out.stderr).toBe("");
+    // No parsed key merged in — only the raw three fields are present.
+    expect(Object.keys(out).sort()).toEqual(["exitCode", "stderr", "stdout"]);
+  });
+
+  test("populates structured output on timeout instead of leaving it null", async () => {
+    const result = await executor.run(
+      input({ runtime: "bash", script: "sleep 5", timeout: 1000 }, {}),
+    );
+    expect(result.status).toBe("failed");
+    expect(result.error).toContain("Script timed out after 1000ms");
+    const out = result.output as { exitCode: number; stdout: string; stderr: string };
+    expect(out).toBeDefined();
+    expect(out.exitCode).toBe(-1);
+    expect(out.stdout).toBe("");
+    expect(out.stderr).toContain("Script timed out after 1000ms");
+  });
 });
 
 // ─── VCS Executor ────────────────────────────────────────────
@@ -706,7 +734,7 @@ describe("ValidateExecutor", () => {
 // ─── Registry Wiring ─────────────────────────────────────────
 
 describe("createExecutorRegistry", () => {
-  test("registers all 10 executors (7 instant + 3 async)", () => {
+  test("registers all 11 executors (8 instant + 3 async)", () => {
     const registry = createExecutorRegistry(mockDeps);
     const types = registry.types();
 
@@ -715,12 +743,13 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("notify");
     expect(types).toContain("raw-llm");
     expect(types).toContain("script");
+    expect(types).toContain("swarm-script");
     expect(types).toContain("vcs");
     expect(types).toContain("validate");
     expect(types).toContain("agent-task");
     expect(types).toContain("human-in-the-loop");
     expect(types).toContain("wait");
-    expect(types).toHaveLength(10);
+    expect(types).toHaveLength(11);
   });
 
   test("instant executors have mode instant, async executors have mode async", () => {
@@ -731,6 +760,7 @@ describe("createExecutorRegistry", () => {
       "notify",
       "raw-llm",
       "script",
+      "swarm-script",
       "vcs",
       "validate",
     ];