@desplega.ai/agent-swarm 1.83.0 → 1.83.2

package/src/tests/resume-session.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from "bun:test";
+import { resolveResumeSession } from "../commands/resume-session";
+
+describe("resolveResumeSession", () => {
+  test("allows local Claude resume for UUID session ids", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "69dbe5a1-1130-45eb-983f-58a7a13c9c3c",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("69dbe5a1-1130-45eb-983f-58a7a13c9c3c");
+    expect(resolution.source).toBe("task");
+    expect(resolution.provider).toBe("claude");
+    expect(resolution.skipped).toEqual([]);
+  });
+
+  test("rejects non-UUID ids for local Claude resume", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "ses_19c145de3ffeD9qLlntj8SRO28",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped).toHaveLength(1);
+    expect(resolution.skipped[0]?.reason).toBe("Claude CLI --resume requires a UUID session id");
+  });
+
+  test("normalizes legacy managed Claude rows to claude-managed", () => {
+    const resolution = resolveResumeSession("claude-managed", [
+      {
+        source: "parent",
+        sessionId: "sesn_resume_xyz",
+        provider: "claude",
+        providerMeta: { managed: true },
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("sesn_resume_xyz");
+    expect(resolution.source).toBe("parent");
+    expect(resolution.provider).toBe("claude-managed");
+  });
+
+  test("skips mismatched provider sessions and falls back to parent", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "thread-codex",
+        provider: "codex",
+      },
+      {
+        source: "parent",
+        sessionId: "69dbe5a1-1130-45eb-983f-58a7a13c9c3c",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("69dbe5a1-1130-45eb-983f-58a7a13c9c3c");
+    expect(resolution.source).toBe("parent");
+    expect(resolution.skipped).toHaveLength(1);
+    expect(resolution.skipped[0]?.reason).toContain("does not match current provider");
+  });
+
+  test("rejects legacy unknown non-UUID Claude session ids", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "ses_19c145de3ffeD9qLlntj8SRO28",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped[0]?.reason).toBe("legacy Claude resume requires a UUID session id");
+  });
+
+  test("does not resume providers without runner resume support", () => {
+    const resolution = resolveResumeSession("pi", [
+      {
+        source: "task",
+        sessionId: "pi-session",
+        provider: "pi",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped[0]?.reason).toBe("provider pi does not support runner resume");
+  });
+});

package/src/tests/runner-skills-refresh.test.ts

@@ -0,0 +1,200 @@
+/**
+ * Coverage for the worker-side `refreshSkillsIfChanged()` helper. The helper
+ * is exercised against a Bun.serve() stub that mimics the signature + list
+ * + sync-filesystem endpoints. Cases lock down its contract: cheap probe on
+ * no-change, full refresh on hash drift, inactive/disabled filtering,
+ * transient 5xx swallowed.
+ */
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { refreshSkillsIfChanged, type SkillsRefreshContext } from "../utils/skills-refresh";
+
+// ── Bun.serve() stub backing fake signature/list/sync endpoints ──────────────
+
+type StubState = {
+  signatureHash: string;
+  signatureStatus: number;
+  syncStatus: number;
+  skillsBody: {
+    skills: { name: string; description: string; isActive: boolean; isEnabled: boolean }[];
+    signature: string;
+  };
+  calls: { signature: number; list: number; sync: number };
+};
+
+const state: StubState = {
+  signatureHash: "hash-v1",
+  signatureStatus: 200,
+  syncStatus: 200,
+  skillsBody: {
+    skills: [
+      { name: "alpha", description: "first skill", isActive: true, isEnabled: true },
+      { name: "beta", description: "second skill", isActive: true, isEnabled: true },
+    ],
+    signature: "hash-v1",
+  },
+  calls: { signature: 0, list: 0, sync: 0 },
+};
+
+let server: ReturnType<typeof Bun.serve> | null = null;
+let baseUrl = "";
+
+describe("refreshSkillsIfChanged", () => {
+  beforeAll(() => {
+    server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        const url = new URL(req.url);
+        if (url.pathname.endsWith("/skills/signature")) {
+          state.calls.signature++;
+          if (state.signatureStatus !== 200) {
+            return new Response("err", { status: state.signatureStatus });
+          }
+          return Response.json({
+            hash: state.signatureHash,
+            count: state.skillsBody.skills.length,
+            generatedAt: new Date().toISOString(),
+          });
+        }
+        if (url.pathname.match(/\/api\/agents\/[^/]+\/skills$/)) {
+          state.calls.list++;
+          return Response.json({
+            skills: state.skillsBody.skills,
+            total: state.skillsBody.skills.length,
+            signature: state.skillsBody.signature,
+          });
+        }
+        if (url.pathname === "/api/skills/sync-filesystem") {
+          state.calls.sync++;
+          if (state.syncStatus !== 200) {
+            return new Response("sync err", { status: state.syncStatus });
+          }
+          return Response.json({ synced: 2, removed: 0, errors: [] });
+        }
+        return new Response("not found", { status: 404 });
+      },
+    });
+    baseUrl = `http://localhost:${server.port}`;
+  });
+
+  afterAll(() => {
+    server?.stop(true);
+  });
+
+  function makeCtx(): SkillsRefreshContext {
+    return {
+      apiUrl: baseUrl,
+      swarmUrl: baseUrl,
+      apiKey: "test-key",
+      agentId: "agent-1",
+      role: "worker",
+    };
+  }
+
+  test("first call populates summary and updates the cached hash", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.signatureHash = "hash-v1";
+    state.skillsBody.signature = "hash-v1";
+
+    const lastHash = { current: null as string | null };
+    const result = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    expect(result.changed).toBe(true);
+    expect(result.summary).toEqual([
+      { name: "alpha", description: "first skill" },
+      { name: "beta", description: "second skill" },
+    ]);
+    expect(lastHash.current).toBe("hash-v1");
+    expect(state.calls).toEqual({ signature: 1, list: 1, sync: 1 });
+  });
+
+  test("subsequent call with unchanged hash skips list + sync", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    const lastHash = { current: "hash-v1" };
+
+    const result = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    expect(result.changed).toBe(false);
+    expect(result.summary).toBeUndefined();
+    expect(lastHash.current).toBe("hash-v1");
+    expect(state.calls).toEqual({ signature: 1, list: 0, sync: 0 });
+  });
+
+  test("hash drift refetches list and updates cached hash to the list's snapshot", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.signatureHash = "hash-v2";
+    state.skillsBody.signature = "hash-v2";
+    state.skillsBody.skills = [
+      { name: "alpha", description: "first skill", isActive: true, isEnabled: true },
+      { name: "beta", description: "second skill", isActive: true, isEnabled: true },
+      { name: "gamma", description: "third skill", isActive: true, isEnabled: true },
+    ];
+
+    const lastHash = { current: "hash-v1" };
+    const result = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    expect(result.changed).toBe(true);
+    expect(result.summary).toHaveLength(3);
+    expect(lastHash.current).toBe("hash-v2");
+    expect(state.calls).toEqual({ signature: 1, list: 1, sync: 1 });
+  });
+
+  test("filters out inactive or disabled skills from the summary", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.signatureHash = "hash-v3";
+    state.skillsBody.signature = "hash-v3";
+    state.skillsBody.skills = [
+      { name: "active", description: "kept", isActive: true, isEnabled: true },
+      { name: "disabled", description: "dropped", isActive: true, isEnabled: false },
+      { name: "inactive", description: "dropped", isActive: false, isEnabled: true },
+    ];
+
+    const lastHash = { current: "hash-v2" };
+    const result = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    expect(result.changed).toBe(true);
+    expect(result.summary).toEqual([{ name: "active", description: "kept" }]);
+  });
+
+  test("transient 5xx on signature endpoint returns changed:false without touching list/sync", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.signatureStatus = 503;
+
+    const lastHash = { current: "hash-v3" };
+    const result = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    expect(result.changed).toBe(false);
+    expect(lastHash.current).toBe("hash-v3");
+    expect(state.calls).toEqual({ signature: 1, list: 0, sync: 0 });
+
+    state.signatureStatus = 200; // restore for any later tests
+  });
+
+  test("sync-filesystem failure leaves cached hash unchanged so the next poll retries", async () => {
+    // Server-side state: a new hash + skill set, sync endpoint failing.
+    state.signatureHash = "hash-v4";
+    state.skillsBody.signature = "hash-v4";
+    state.skillsBody.skills = [
+      { name: "alpha", description: "first", isActive: true, isEnabled: true },
+    ];
+    state.syncStatus = 503;
+    state.calls = { signature: 0, list: 0, sync: 0 };
+
+    const lastHash = { current: "hash-prev" };
+    const first = await refreshSkillsIfChanged(makeCtx(), lastHash);
+
+    // Summary still returns (the list call succeeded), but the cached
+    // hash must NOT advance — otherwise the next signature probe would
+    // short-circuit and the FS would stay stale forever.
+    expect(first.changed).toBe(true);
+    expect(first.summary).toEqual([{ name: "alpha", description: "first" }]);
+    expect(lastHash.current).toBe("hash-prev");
+    expect(state.calls).toEqual({ signature: 1, list: 1, sync: 1 });
+
+    // Sync recovers — next poll retries because cached hash still differs.
+    state.syncStatus = 200;
+    const second = await refreshSkillsIfChanged(makeCtx(), lastHash);
+    expect(second.changed).toBe(true);
+    expect(lastHash.current).toBe("hash-v4");
+    expect(state.calls).toEqual({ signature: 2, list: 2, sync: 2 });
+  });
+});

package/src/tests/schedule-validation-helper.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+import { mergeScheduleTiming, validateRecurringTiming } from "../be/schedules/validate";
+
+describe("mergeScheduleTiming", () => {
+  test("explicit null overrides existing", () => {
+    const result = mergeScheduleTiming(
+      { cronExpression: "0 * * * *", intervalMs: null },
+      { cronExpression: null },
+    );
+    expect(result).toEqual({ mergedCron: null, mergedInterval: null });
+  });
+
+  test("undefined preserves existing", () => {
+    const result = mergeScheduleTiming({ cronExpression: "0 * * * *", intervalMs: null }, {});
+    expect(result).toEqual({ mergedCron: "0 * * * *", mergedInterval: null });
+  });
+
+  test("explicit value overrides existing", () => {
+    const result = mergeScheduleTiming(
+      { cronExpression: "0 * * * *", intervalMs: null },
+      { cronExpression: "0 2 * * *" },
+    );
+    expect(result).toEqual({ mergedCron: "0 2 * * *", mergedInterval: null });
+  });
+});
+
+describe("validateRecurringTiming", () => {
+  test("cron-only existing + { cronExpression: null } patch → both-null error", () => {
+    const merged = mergeScheduleTiming(
+      { cronExpression: "0 * * * *", intervalMs: null },
+      { cronExpression: null },
+    );
+    expect(validateRecurringTiming(merged)).toEqual({ kind: "both-null" });
+  });
+
+  test("cron-only existing + { cronExpression: null, intervalMs: 60000 } → valid", () => {
+    const merged = mergeScheduleTiming(
+      { cronExpression: "0 * * * *", intervalMs: null },
+      { cronExpression: null, intervalMs: 60000 },
+    );
+    expect(validateRecurringTiming(merged)).toBeNull();
+  });
+
+  test("both existing populated, patch nulls both → both-null error", () => {
+    const merged = mergeScheduleTiming(
+      { cronExpression: "0 * * * *", intervalMs: 60000 },
+      { cronExpression: null, intervalMs: null },
+    );
+    expect(validateRecurringTiming(merged)).toEqual({ kind: "both-null" });
+  });
+});

package/src/tests/skill-sync.test.ts

@@ -1,11 +1,13 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { closeDb, createAgent, createSkill, initDb, installSkill } from "../be/db";
 import { syncSkillsToFilesystem } from "../be/skill-sync";
 
+const SWARM_MARKER = ".swarm-managed";
+
 const TEST_DB_PATH = `./test-skill-sync-${process.pid}.sqlite`;
 const FAKE_HOME = join(tmpdir(), `skill-sync-test-${process.pid}`);
 
@@ -80,20 +82,40 @@ describe("syncSkillsToFilesystem", () => {
     expect(readFileSync(skillFile, "utf-8")).toContain("Test body.");
   });
 
-  test("syncs to both claude and pi when harnessType is 'both'", () => {
+  test("syncs simple skills to codex directory", () => {
+    const result = syncSkillsToFilesystem(agentId, "codex", FAKE_HOME);
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.synced).toBeGreaterThanOrEqual(1);
+
+    const skillFile = join(FAKE_HOME, ".codex", "skills", "test-skill", "SKILL.md");
+    expect(existsSync(skillFile)).toBe(true);
+    expect(readFileSync(skillFile, "utf-8")).toContain("Test body.");
+
+    // Verify claude and pi paths were NOT written when targeting codex only
+    const claudeOnlyFile = join(FAKE_HOME, ".claude", "skills", "codex-only-marker", "SKILL.md");
+    const piOnlyFile = join(FAKE_HOME, ".pi", "agent", "skills", "codex-only-marker", "SKILL.md");
+    expect(existsSync(claudeOnlyFile)).toBe(false);
+    expect(existsSync(piOnlyFile)).toBe(false);
+  });
+
+  test("syncs to claude, pi, and codex when harnessType is 'all'", () => {
     // Clean up first to get accurate count
     rmSync(join(FAKE_HOME, ".claude"), { recursive: true, force: true });
     rmSync(join(FAKE_HOME, ".pi"), { recursive: true, force: true });
+    rmSync(join(FAKE_HOME, ".codex"), { recursive: true, force: true });
 
-    const result = syncSkillsToFilesystem(agentId, "both", FAKE_HOME);
+    const result = syncSkillsToFilesystem(agentId, "all", FAKE_HOME);
 
     expect(result.errors).toHaveLength(0);
-    expect(result.synced).toBe(2); // 1 skill × 2 dirs
+    expect(result.synced).toBe(3); // 1 skill × 3 dirs
 
     const claudeFile = join(FAKE_HOME, ".claude", "skills", "test-skill", "SKILL.md");
     const piFile = join(FAKE_HOME, ".pi", "agent", "skills", "test-skill", "SKILL.md");
+    const codexFile = join(FAKE_HOME, ".codex", "skills", "test-skill", "SKILL.md");
     expect(existsSync(claudeFile)).toBe(true);
     expect(existsSync(piFile)).toBe(true);
+    expect(existsSync(codexFile)).toBe(true);
   });
 
   test("skips complex skills", () => {
@@ -103,9 +125,11 @@ describe("syncSkillsToFilesystem", () => {
     expect(existsSync(complexDir)).toBe(false);
   });
 
-  test("removes stale skill directories", () => {
+  test("removes stale swarm-managed skill directories", () => {
+    // Mark this stale dir as swarm-managed (mirrors what an earlier sync would have done)
     const staleDir = join(FAKE_HOME, ".claude", "skills", "old-removed-skill");
     mkdirSync(staleDir, { recursive: true });
+    writeFileSync(join(staleDir, SWARM_MARKER), "");
     expect(existsSync(staleDir)).toBe(true);
 
     const result = syncSkillsToFilesystem(agentId, "claude", FAKE_HOME);
@@ -114,21 +138,61 @@ describe("syncSkillsToFilesystem", () => {
     expect(existsSync(staleDir)).toBe(false);
   });
 
-  test("defaults to 'both' when no harnessType provided", () => {
+  test("removes stale swarm-managed codex skill directories", () => {
+    const staleCodexDir = join(FAKE_HOME, ".codex", "skills", "old-codex-skill");
+    mkdirSync(staleCodexDir, { recursive: true });
+    writeFileSync(join(staleCodexDir, SWARM_MARKER), "");
+    expect(existsSync(staleCodexDir)).toBe(true);
+
+    const result = syncSkillsToFilesystem(agentId, "codex", FAKE_HOME);
+
+    expect(result.removed).toBeGreaterThanOrEqual(1);
+    expect(existsSync(staleCodexDir)).toBe(false);
+  });
+
+  test("leaves foreign (unmarked) skill directories alone — local-dev safety", () => {
+    // Simulate a user-installed codex skill in their personal ~/.codex/skills
+    // that the swarm did NOT create. The cleanup pass MUST NOT remove it.
+    const foreignDir = join(FAKE_HOME, ".codex", "skills", "user-personal-skill");
+    mkdirSync(foreignDir, { recursive: true });
+    writeFileSync(join(foreignDir, "SKILL.md"), "user's own skill — keep me");
+    // No SWARM_MARKER file → not ours to manage.
+    expect(existsSync(foreignDir)).toBe(true);
+
+    syncSkillsToFilesystem(agentId, "codex", FAKE_HOME);
+
+    expect(existsSync(foreignDir)).toBe(true);
+    expect(readFileSync(join(foreignDir, "SKILL.md"), "utf-8")).toBe("user's own skill — keep me");
+  });
+
+  test("written skill directories carry the swarm-managed marker", () => {
+    // Clean up first
+    rmSync(join(FAKE_HOME, ".claude"), { recursive: true, force: true });
+
+    syncSkillsToFilesystem(agentId, "claude", FAKE_HOME);
+
+    const marker = join(FAKE_HOME, ".claude", "skills", "test-skill", SWARM_MARKER);
+    expect(existsSync(marker)).toBe(true);
+  });
+
+  test("defaults to 'all' when no harnessType provided", () => {
     // Clean up first
     rmSync(join(FAKE_HOME, ".claude"), { recursive: true, force: true });
     rmSync(join(FAKE_HOME, ".pi"), { recursive: true, force: true });
+    rmSync(join(FAKE_HOME, ".codex"), { recursive: true, force: true });
 
-    // Use 'both' explicitly with homeOverride (default harnessType would use real home)
-    const result = syncSkillsToFilesystem(agentId, "both", FAKE_HOME);
+    // Use 'all' explicitly with homeOverride (default harnessType would use real home)
+    const result = syncSkillsToFilesystem(agentId, "all", FAKE_HOME);
 
     expect(result.errors).toHaveLength(0);
-    expect(result.synced).toBe(2);
+    expect(result.synced).toBe(3);
 
     const claudeFile = join(FAKE_HOME, ".claude", "skills", "test-skill", "SKILL.md");
     const piFile = join(FAKE_HOME, ".pi", "agent", "skills", "test-skill", "SKILL.md");
+    const codexFile = join(FAKE_HOME, ".codex", "skills", "test-skill", "SKILL.md");
     expect(existsSync(claudeFile)).toBe(true);
     expect(existsSync(piFile)).toBe(true);
+    expect(existsSync(codexFile)).toBe(true);
   });
 
   test("returns empty result for agent with no skills", () => {

package/src/tests/skills-signature.test.ts

@@ -0,0 +1,141 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createAgent,
+  createSkill,
+  initDb,
+  installSkill,
+  toggleAgentSkill,
+  uninstallSkill,
+  updateSkill,
+} from "../be/db";
+import { computeAgentSkillsSignature } from "../be/skill-sync";
+
+const TEST_DB_PATH = `./test-skills-signature-${process.pid}.sqlite`;
+
+describe("computeAgentSkillsSignature", () => {
+  let agentId: string;
+  let otherAgentId: string;
+  let skill1Id: string;
+  let skill2Id: string;
+
+  beforeAll(() => {
+    initDb(TEST_DB_PATH);
+
+    const agent = createAgent({
+      name: "Signature Test Worker",
+      description: "Test agent",
+      role: "worker",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+      capabilities: [],
+    });
+    agentId = agent.id;
+
+    const otherAgent = createAgent({
+      name: "Signature Test Other",
+      description: "Independent agent",
+      role: "worker",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+      capabilities: [],
+    });
+    otherAgentId = otherAgent.id;
+
+    const skill1 = createSkill({
+      name: "sig-skill-1",
+      description: "First skill",
+      content: "---\nname: sig-skill-1\ndescription: First skill\n---\nBody 1.",
+      type: "personal",
+      scope: "agent",
+    });
+    skill1Id = skill1.id;
+
+    const skill2 = createSkill({
+      name: "sig-skill-2",
+      description: "Second skill",
+      content: "---\nname: sig-skill-2\ndescription: Second skill\n---\nBody 2.",
+      type: "personal",
+      scope: "agent",
+    });
+    skill2Id = skill2.id;
+
+    installSkill(agentId, skill1Id);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    await unlink(TEST_DB_PATH).catch(() => {});
+    await unlink(`${TEST_DB_PATH}-wal`).catch(() => {});
+    await unlink(`${TEST_DB_PATH}-shm`).catch(() => {});
+  });
+
+  test("returns identical hash across no-op calls (deterministic)", () => {
+    const sig1 = computeAgentSkillsSignature(agentId);
+    const sig2 = computeAgentSkillsSignature(agentId);
+    expect(sig1.hash).toBe(sig2.hash);
+    expect(sig1.count).toBe(sig2.count);
+    expect(sig1.hash).toHaveLength(64); // sha256 hex
+  });
+
+  test("hash changes when a new skill is installed", () => {
+    const before = computeAgentSkillsSignature(agentId);
+    installSkill(agentId, skill2Id);
+    const after = computeAgentSkillsSignature(agentId);
+    expect(after.hash).not.toBe(before.hash);
+    expect(after.count).toBe(before.count + 1);
+  });
+
+  test("hash changes when a skill is uninstalled", () => {
+    const before = computeAgentSkillsSignature(agentId);
+    uninstallSkill(agentId, skill2Id);
+    const after = computeAgentSkillsSignature(agentId);
+    expect(after.hash).not.toBe(before.hash);
+    expect(after.count).toBe(before.count - 1);
+  });
+
+  test("hash changes when a skill is toggled inactive", () => {
+    installSkill(agentId, skill2Id);
+    const before = computeAgentSkillsSignature(agentId);
+    toggleAgentSkill(agentId, skill2Id, false);
+    const after = computeAgentSkillsSignature(agentId);
+    expect(after.hash).not.toBe(before.hash);
+    // Toggling inactive removes it from the active+enabled view used by getAgentSkills
+    expect(after.count).toBe(before.count - 1);
+
+    // Re-activate so subsequent tests have a known state
+    toggleAgentSkill(agentId, skill2Id, true);
+  });
+
+  test("hash changes when updateSkill mutates a skill (via lastUpdatedAt bump)", async () => {
+    const before = computeAgentSkillsSignature(agentId);
+    // updateSkill always bumps lastUpdatedAt — even an isEnabled no-op flip back is enough.
+    // Wait 5ms to guarantee a different ISO timestamp.
+    await new Promise((r) => setTimeout(r, 5));
+    updateSkill(skill1Id, { description: "First skill (updated)" });
+    const after = computeAgentSkillsSignature(agentId);
+    expect(after.hash).not.toBe(before.hash);
+    expect(after.count).toBe(before.count);
+  });
+
+  test("agent A's signature is independent of mutations to agent B's skills", () => {
+    installSkill(otherAgentId, skill1Id);
+    const aBefore = computeAgentSkillsSignature(agentId);
+    const bBefore = computeAgentSkillsSignature(otherAgentId);
+
+    // Mutate agent B: install another skill, toggle, uninstall
+    installSkill(otherAgentId, skill2Id);
+    toggleAgentSkill(otherAgentId, skill1Id, false);
+    uninstallSkill(otherAgentId, skill2Id);
+
+    const aAfter = computeAgentSkillsSignature(agentId);
+    const bAfter = computeAgentSkillsSignature(otherAgentId);
+
+    expect(aAfter.hash).toBe(aBefore.hash);
+    expect(aAfter.count).toBe(aBefore.count);
+    expect(bAfter.hash).not.toBe(bBefore.hash);
+  });
+});