@desplega.ai/agent-swarm 1.83.1 → 1.84.0

package/src/tests/pi-mono-adapter.test.ts

@@ -1,7 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { PiMonoAdapter, resolveModel } from "../providers/pi-mono-adapter";
+import { createPiRuntimeAuth, PiMonoAdapter, resolveModel } from "../providers/pi-mono-adapter";
 
 describe("PiMonoAdapter", () => {
   test("name is 'pi'", () => {
@@ -177,6 +177,26 @@ describe("resolveModel — OpenRouter reroute for anthropic shortnames", () => {
   });
 });
 
+describe("createPiRuntimeAuth", () => {
+  test("threads resolved OpenRouter key into pi runtime auth without process.env", async () => {
+    const { modelRegistry } = createPiRuntimeAuth({ OPENROUTER_API_KEY: "sk-or-runtime" });
+
+    await expect(modelRegistry.getApiKeyForProvider("openrouter")).resolves.toBe("sk-or-runtime");
+  });
+
+  test("supports all pi env-backed providers", async () => {
+    const { modelRegistry } = createPiRuntimeAuth({
+      ANTHROPIC_API_KEY: "sk-ant-runtime",
+      OPENAI_API_KEY: "sk-openai-runtime",
+      GOOGLE_API_KEY: "sk-google-runtime",
+    });
+
+    await expect(modelRegistry.getApiKeyForProvider("anthropic")).resolves.toBe("sk-ant-runtime");
+    await expect(modelRegistry.getApiKeyForProvider("openai")).resolves.toBe("sk-openai-runtime");
+    await expect(modelRegistry.getApiKeyForProvider("google")).resolves.toBe("sk-google-runtime");
+  });
+});
+
 describe("Pi-mono event normalization", () => {
   test("message_update with text content produces raw_log-style data", () => {
     // Simulates what PiMonoSession.handleAgentEvent does

package/src/tests/rate-limit-event.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, test } from "bun:test";
-import { SessionErrorTracker, trackErrorFromJson } from "../utils/error-tracker";
+import {
+  isRateLimitMessage,
+  MAX_RATE_LIMIT_RESET_MS,
+  parseStderrForErrors,
+  SessionErrorTracker,
+  trackErrorFromJson,
+} from "../utils/error-tracker";
 
 // Verbatim fixture from Linear CAI-1279 (session logs for task b7fbbdb9-4922-41d9-88ec-21febd6c4fec)
 const FIXTURE_REJECTED = {
@@ -25,7 +31,7 @@ describe("SessionErrorTracker — rate_limit_event processing", () => {
     expect(result).toBeDefined();
 
     // resetsAt: 1779202200 sec → 2026-05-19T14:50:00.000Z
-    // But since we clamp to [now+60s, now+6h] and this is a past timestamp,
+    // But since we clamp to [now+60s, now+7d] and this is a past timestamp,
     // the value will be clamped to now+60s. What matters is the sec→ms conversion works.
     // We verify the unit is correct by checking that 1779202200 * 1000 = ms,
     // which is NOT the same as treating it as ms (would be 1970-01-21).
@@ -125,7 +131,7 @@ describe("SessionErrorTracker — rate_limit_event processing", () => {
     expect(parsedMs).toBeLessThanOrEqual(nowMs + 65_000);
   });
 
-  test("resetsAt absurdly far in future → clamped to now+6h (malformed defense)", () => {
+  test("resetsAt absurdly far in future → clamped to now+7d (malformed defense)", () => {
     const tracker = new SessionErrorTracker();
     // Year 2099 in seconds
     tracker.processRateLimitEvent({
@@ -137,8 +143,25 @@ describe("SessionErrorTracker — rate_limit_event processing", () => {
     expect(result).toBeDefined();
     const parsedMs = new Date(result!).getTime();
     const nowMs = Date.now();
-    const sixHoursMs = 6 * 60 * 60 * 1000;
-    expect(parsedMs).toBeLessThanOrEqual(nowMs + sixHoursMs + 1000); // within 6h (+1s tolerance)
+    const sevenDaysMs = MAX_RATE_LIMIT_RESET_MS;
+    expect(parsedMs).toBeLessThanOrEqual(nowMs + sevenDaysMs + 1000); // within 7d (+1s tolerance)
+  });
+
+  test("legitimate weekly reset (~2 days out) is honored, not clamped to 6h", () => {
+    const tracker = new SessionErrorTracker();
+    const twoDaysFromNowSec = Math.floor(Date.now() / 1000) + 2 * 24 * 60 * 60;
+    tracker.processRateLimitEvent({
+      type: "rate_limit_event",
+      rate_limit_info: { status: "rejected", resetsAt: twoDaysFromNowSec, rateLimitType: "weekly" },
+    });
+
+    const result = tracker.getRateLimitResetAt();
+    expect(result).toBeDefined();
+    const parsedMs = new Date(result!).getTime();
+    const nowMs = Date.now();
+    // The real reset is ~2 days out — must be honored, not capped at 6h.
+    expect(parsedMs).toBeGreaterThan(nowMs + 6 * 60 * 60 * 1000);
+    expect(parsedMs).toBeLessThanOrEqual(nowMs + 2 * 24 * 60 * 60 * 1000 + 1000);
   });
 
   test("multiple rate_limit_event lines → last rejected one wins", () => {
@@ -255,7 +278,7 @@ describe("three-tier resolver logic (unit test via clamp helper)", () => {
   function clampResetTime(isoString: string): string {
     const nowMs = Date.now();
     const minMs = nowMs + 60_000;
-    const maxMs = nowMs + 6 * 60 * 60 * 1000;
+    const maxMs = nowMs + MAX_RATE_LIMIT_RESET_MS;
     const candidateMs = new Date(isoString).getTime();
     return new Date(Math.min(Math.max(candidateMs, minMs), maxMs)).toISOString();
   }
@@ -290,3 +313,43 @@ describe("three-tier resolver logic (unit test via clamp helper)", () => {
     expect(resolvedMs).toBeLessThanOrEqual(nowMs + 6 * 60_000);
   });
 });
+
+describe("isRateLimitMessage — shared matcher (runner gate + stderr parser)", () => {
+  test.each([
+    "You've hit your weekly limit · resets May 28, 5pm (UTC)",
+    "hit your 5-hour limit",
+    "hit your limit",
+    "Claude usage limit reached",
+    "hit your daily limit",
+    "rate limit exceeded",
+    "rate_limit error",
+    "429 Too Many Requests",
+    "Error: too many requests, slow down",
+    "[rate-limit] codex prefix",
+    "[usage-limit] codex prefix",
+  ])("matches rate-limit signal: %s", (msg) => {
+    expect(isRateLimitMessage(msg)).toBe(true);
+  });
+
+  test.each([
+    "No conversation found with session ID abc",
+    "Max turns exceeded",
+    "Authentication failed: invalid token",
+    "Error during execution: file not found",
+    "Read 4290 bytes from stream",
+  ])("does NOT match non-rate-limit text: %s", (msg) => {
+    expect(isRateLimitMessage(msg)).toBe(false);
+  });
+
+  test("parseStderrForErrors flags a weekly-limit stderr line as an error", () => {
+    const tracker = new SessionErrorTracker();
+    parseStderrForErrors("You've hit your weekly limit · resets May 28, 5pm (UTC)", tracker);
+    expect(tracker.hasErrors()).toBe(true);
+  });
+
+  test("parseStderrForErrors still flags a bare 429 stderr line", () => {
+    const tracker = new SessionErrorTracker();
+    parseStderrForErrors("HTTP 429 returned by upstream", tracker);
+    expect(tracker.hasErrors()).toBe(true);
+  });
+});

package/src/tests/resume-session.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, test } from "bun:test";
+import { resolveResumeSession } from "../commands/resume-session";
+
+describe("resolveResumeSession", () => {
+  test("allows local Claude resume for UUID session ids", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "69dbe5a1-1130-45eb-983f-58a7a13c9c3c",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("69dbe5a1-1130-45eb-983f-58a7a13c9c3c");
+    expect(resolution.source).toBe("task");
+    expect(resolution.provider).toBe("claude");
+    expect(resolution.skipped).toEqual([]);
+  });
+
+  test("rejects non-UUID ids for local Claude resume", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "ses_19c145de3ffeD9qLlntj8SRO28",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped).toHaveLength(1);
+    expect(resolution.skipped[0]?.reason).toBe("Claude CLI --resume requires a UUID session id");
+  });
+
+  test("normalizes legacy managed Claude rows to claude-managed", () => {
+    const resolution = resolveResumeSession("claude-managed", [
+      {
+        source: "parent",
+        sessionId: "sesn_resume_xyz",
+        provider: "claude",
+        providerMeta: { managed: true },
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("sesn_resume_xyz");
+    expect(resolution.source).toBe("parent");
+    expect(resolution.provider).toBe("claude-managed");
+  });
+
+  test("skips mismatched provider sessions and falls back to parent", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "thread-codex",
+        provider: "codex",
+      },
+      {
+        source: "parent",
+        sessionId: "69dbe5a1-1130-45eb-983f-58a7a13c9c3c",
+        provider: "claude",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBe("69dbe5a1-1130-45eb-983f-58a7a13c9c3c");
+    expect(resolution.source).toBe("parent");
+    expect(resolution.skipped).toHaveLength(1);
+    expect(resolution.skipped[0]?.reason).toContain("does not match current provider");
+  });
+
+  test("rejects legacy unknown non-UUID Claude session ids", () => {
+    const resolution = resolveResumeSession("claude", [
+      {
+        source: "task",
+        sessionId: "ses_19c145de3ffeD9qLlntj8SRO28",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped[0]?.reason).toBe("legacy Claude resume requires a UUID session id");
+  });
+
+  test("does not resume providers without runner resume support", () => {
+    const resolution = resolveResumeSession("pi", [
+      {
+        source: "task",
+        sessionId: "pi-session",
+        provider: "pi",
+      },
+    ]);
+
+    expect(resolution.resumeSessionId).toBeUndefined();
+    expect(resolution.skipped[0]?.reason).toBe("provider pi does not support runner resume");
+  });
+});

package/src/tests/task-tools-ctx.test.ts

@@ -0,0 +1,100 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { closeDb, createTaskExtended, createUser, getTaskById, initDb } from "../be/db";
+import { getTasksHandler } from "../tools/get-tasks";
+import { sendTaskHandler } from "../tools/send-task";
+import { assertOwnsTask, ownerCtx, userCtx } from "../tools/task-tool-ctx";
+
+const TEST_DB_PATH = "./test-task-tools-ctx.sqlite";
+
+beforeAll(async () => {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(`${TEST_DB_PATH}${suffix}`);
+    } catch {}
+  }
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  closeDb();
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(`${TEST_DB_PATH}${suffix}`);
+    } catch {}
+  }
+});
+
+describe("task tool ctx", () => {
+  test("sendTaskHandler with user ctx writes requestedByUserId", async () => {
+    const user = createUser({ name: "MCP User" });
+
+    const result = await sendTaskHandler(userCtx(user), {
+      task: "user requested task",
+      offerMode: false,
+      allowDuplicate: false,
+    });
+
+    const structured = result.structuredContent as {
+      success: boolean;
+      task: { id: string; requestedByUserId?: string };
+    };
+    expect(structured.success).toBe(true);
+    expect(structured.task.requestedByUserId).toBe(user.id);
+
+    const stored = getTaskById(structured.task.id);
+    expect(stored?.creatorAgentId).toBeUndefined();
+    expect(stored?.requestedByUserId).toBe(user.id);
+  });
+
+  test("getTasksHandler with user ctx only returns that user's tasks", async () => {
+    const userA = createUser({ name: "List User A" });
+    const userB = createUser({ name: "List User B" });
+
+    const a1 = createTaskExtended("owned task one", { requestedByUserId: userA.id });
+    const a2 = createTaskExtended("owned task two", { requestedByUserId: userA.id });
+    const b1 = createTaskExtended("foreign task", { requestedByUserId: userB.id });
+    createTaskExtended("owner-only task");
+
+    const result = await getTasksHandler(userCtx(userA), {
+      includeFull: true,
+      includeHeartbeat: true,
+      limit: 50,
+      mineOnly: true,
+      offeredToMe: true,
+    });
+
+    const structured = result.structuredContent as {
+      tasks: Array<{ id: string; task?: string }>;
+    };
+    const ids = structured.tasks.map((task) => task.id);
+    expect(ids).toContain(a1.id);
+    expect(ids).toContain(a2.id);
+    expect(ids).not.toContain(b1.id);
+    expect(structured.tasks.every((task) => task.task?.startsWith("owned task"))).toBe(true);
+  });
+
+  test("assertOwnsTask gates user tasks and allows owned or owner ctx", () => {
+    const owner = createUser({ name: "Task Owner" });
+    const foreignUser = createUser({ name: "Foreign User" });
+    const ownedTask = createTaskExtended("owned", { requestedByUserId: owner.id });
+
+    expect(assertOwnsTask(userCtx(owner), ownedTask)).toBeNull();
+    expect(
+      assertOwnsTask(
+        ownerCtx({
+          agentId: "00000000-0000-4000-8000-000000000001",
+          sourceTaskId: undefined,
+          sessionId: "session-1",
+        }),
+        ownedTask,
+      ),
+    ).toBeNull();
+
+    const forbidden = assertOwnsTask(userCtx(foreignUser), ownedTask);
+    expect(forbidden?.isError).toBe(true);
+    expect(forbidden?.content[0]?.type).toBe("text");
+    expect(forbidden?.content[0]?.text).toContain("this task is not yours");
+    expect((forbidden?.structuredContent as { code?: string })?.code).toBe("forbidden");
+  });
+});

package/src/tests/task-tools-ownership.test.ts

@@ -0,0 +1,167 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  createUser,
+  getDb,
+  getTaskById,
+  initDb,
+} from "../be/db";
+import { cancelTaskHandler } from "../tools/cancel-task";
+import { getTaskDetailsHandler } from "../tools/get-task-details";
+import { taskActionHandler } from "../tools/task-action";
+import { ownerCtx, userCtx } from "../tools/task-tool-ctx";
+
+const TEST_DB_PATH = "./test-task-tools-ownership.sqlite";
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch {}
+  }
+}
+
+beforeAll(async () => {
+  await removeDbFiles(TEST_DB_PATH);
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  closeDb();
+  await removeDbFiles(TEST_DB_PATH);
+});
+
+beforeEach(() => {
+  const db = getDb();
+  db.prepare("DELETE FROM agent_tasks").run();
+  db.prepare("DELETE FROM agents").run();
+  db.prepare("DELETE FROM users").run();
+});
+
+function expectForbidden(result: Awaited<ReturnType<typeof getTaskDetailsHandler>>): void {
+  expect(result.isError).toBe(true);
+  expect(result.content[0]?.type).toBe("text");
+  expect(result.content[0]?.text).toContain("this task is not yours");
+  expect((result.structuredContent as { code?: string })?.code).toBe("forbidden");
+}
+
+describe("ownership-gated task tools", () => {
+  test("getTaskDetailsHandler gates user ctx and leaves owner ctx visible", async () => {
+    const owner = createUser({ name: "Task Owner" });
+    const foreignUser = createUser({ name: "Foreign User" });
+    const task = createTaskExtended("owned details", { requestedByUserId: owner.id });
+
+    expectForbidden(await getTaskDetailsHandler(userCtx(foreignUser), { taskId: task.id }));
+
+    const userResult = await getTaskDetailsHandler(userCtx(owner), { taskId: task.id });
+    expect(
+      (userResult.structuredContent as { success: boolean; task?: { id: string } }).success,
+    ).toBe(true);
+    expect((userResult.structuredContent as { task?: { id: string } }).task?.id).toBe(task.id);
+
+    const ownerResult = await getTaskDetailsHandler(
+      ownerCtx({
+        agentId: "00000000-0000-4000-8000-000000000001",
+      }),
+      { taskId: task.id },
+    );
+    expect((ownerResult.structuredContent as { success: boolean }).success).toBe(true);
+  });
+
+  test("cancelTaskHandler gates user ctx and preserves owner lead permission", async () => {
+    const owner = createUser({ name: "Cancel Owner" });
+    const foreignUser = createUser({ name: "Cancel Foreign" });
+    const task = createTaskExtended("owned cancellation", { requestedByUserId: owner.id });
+
+    expectForbidden(
+      await cancelTaskHandler(userCtx(foreignUser), {
+        taskId: task.id,
+        reason: "foreign attempt",
+      }),
+    );
+    expect(getTaskById(task.id)?.status).toBe("unassigned");
+
+    const userResult = await cancelTaskHandler(userCtx(owner), {
+      taskId: task.id,
+      reason: "owned cancel",
+    });
+    expect(
+      (userResult.structuredContent as { success: boolean; task?: { status: string } }).success,
+    ).toBe(true);
+    expect((userResult.structuredContent as { task?: { status: string } }).task?.status).toBe(
+      "cancelled",
+    );
+
+    const lead = createAgent({ name: "lead", isLead: true, status: "idle", maxTasks: 1 });
+    const leadTask = createTaskExtended("lead cancellation");
+    const ownerResult = await cancelTaskHandler(ownerCtx({ agentId: lead.id }), {
+      taskId: leadTask.id,
+      reason: "lead cancel",
+    });
+    expect((ownerResult.structuredContent as { success: boolean }).success).toBe(true);
+  });
+
+  test("taskActionHandler gates user backlog moves and rejects agent-only actions", async () => {
+    const owner = createUser({ name: "Backlog Owner" });
+    const foreignUser = createUser({ name: "Backlog Foreign" });
+    const task = createTaskExtended("owned backlog move", { requestedByUserId: owner.id });
+
+    expectForbidden(
+      await taskActionHandler(userCtx(foreignUser), {
+        action: "to_backlog",
+        taskId: task.id,
+      }),
+    );
+    expect(getTaskById(task.id)?.status).toBe("unassigned");
+
+    const toBacklog = await taskActionHandler(userCtx(owner), {
+      action: "to_backlog",
+      taskId: task.id,
+    });
+    expect(
+      (toBacklog.structuredContent as { success: boolean; task?: { status: string } }).success,
+    ).toBe(true);
+    expect((toBacklog.structuredContent as { task?: { status: string } }).task?.status).toBe(
+      "backlog",
+    );
+
+    const fromBacklog = await taskActionHandler(userCtx(owner), {
+      action: "from_backlog",
+      taskId: task.id,
+    });
+    expect(
+      (fromBacklog.structuredContent as { success: boolean; task?: { status: string } }).success,
+    ).toBe(true);
+    expect((fromBacklog.structuredContent as { task?: { status: string } }).task?.status).toBe(
+      "unassigned",
+    );
+
+    const rejected = await taskActionHandler(userCtx(owner), {
+      action: "create",
+      task: "duplicate create path",
+    });
+    expect(rejected.isError).toBe(true);
+    expect(rejected.content[0]?.type).toBe("text");
+    expect(rejected.content[0]?.text).toContain("only available to worker agents");
+  });
+
+  test("taskActionHandler owner ctx preserves worker release behavior", async () => {
+    const worker = createAgent({ name: "worker", isLead: false, status: "idle", maxTasks: 1 });
+    const task = createTaskExtended("assigned task", { agentId: worker.id });
+
+    const result = await taskActionHandler(ownerCtx({ agentId: worker.id }), {
+      action: "release",
+      taskId: task.id,
+    });
+
+    expect(
+      (result.structuredContent as { success: boolean; task?: { status: string } }).success,
+    ).toBe(true);
+    expect((result.structuredContent as { task?: { status: string } }).task?.status).toBe(
+      "unassigned",
+    );
+  });
+});

package/src/tests/tool-annotations.test.ts

@@ -323,9 +323,10 @@ describe("Tool Annotations & Classification", () => {
   test("registered tool count matches expected total", () => {
     const count = Object.keys(tools).length;
     // We expect all tools to be registered when all capabilities are enabled (default)
-    // Includes 11 skill tools, 7 MCP server tools, and reusable script tools
+    // Includes 11 skill tools, 7 MCP server tools, reusable script tools, and the
+    // native Kapso/WhatsApp tools (register/unregister number + send/reply message).
     expect(count).toBeGreaterThanOrEqual(45);
-    expect(count).toBeLessThanOrEqual(100);
+    expect(count).toBeLessThanOrEqual(120);
   });
 
   test("core tools are fewer than deferred tools", () => {