@desplega.ai/agent-swarm 1.88.0 → 1.90.0

package/src/tests/metrics-http.test.ts

@@ -0,0 +1,247 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import crypto from "node:crypto";
+import { unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, getMetricVersions, initDb } from "../be/db";
+import { handleMetrics } from "../http/metrics";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import type { Metric } from "../types";
+
+const TEST_DB_PATH = "./test-metrics-http.sqlite";
+const TEST_PORT = 13083;
+const BASE = `http://localhost:${TEST_PORT}`;
+
+type MetricRunResponse = {
+  widgets: Array<{
+    widget: { id: string };
+    result: {
+      columns: string[];
+      rows: Record<string, unknown>[];
+    };
+  }>;
+  result: {
+    columns: string[];
+    rows: Record<string, unknown>[];
+  };
+};
+
+function createTestServer(): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    res.setHeader("Content-Type", "application/json");
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    const handled = await handleMetrics(req, res, pathSegments, queryParams, myAgentId);
+    if (!handled) {
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: "not found" }));
+    }
+  });
+}
+
+describe("Metrics HTTP API", () => {
+  let server: Server;
+  const agentId = crypto.randomUUID();
+  const headers = { "Content-Type": "application/json", "X-Agent-ID": agentId };
+
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+    initDb(TEST_DB_PATH);
+    server = createTestServer();
+    await new Promise<void>((resolve) => server.listen(TEST_PORT, () => resolve()));
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+  });
+
+  test("fresh DB seeds starter metrics", async () => {
+    const res = await fetch(`${BASE}/api/metrics/definitions?fields=full`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { metrics: Metric[]; total: number };
+    expect(body.total).toBeGreaterThanOrEqual(1);
+    const starter = body.metrics.find((metric) => metric.slug === "swarm-operations-overview");
+    expect(starter?.definition.widgets.map((widget) => widget.viz.type)).toContain("multi-line");
+  });
+
+  test("create, run, update snapshots prior definition", async () => {
+    const created = await fetch(`${BASE}/api/metrics/definitions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        slug: "test-count",
+        title: "Test Count",
+        description: "Counts agent rows",
+        definition: {
+          version: 1,
+          widgets: [
+            {
+              id: "agent-count",
+              title: "Agent count",
+              query: { sql: "SELECT COUNT(*) AS count FROM agents", maxRows: 10 },
+              viz: { type: "stat", value: "count", format: "integer" },
+            },
+          ],
+        },
+      }),
+    });
+    expect(created.status).toBe(201);
+    const { id } = (await created.json()) as { id: string; version: number };
+
+    const run = await fetch(`${BASE}/api/metrics/definitions/${id}/run`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ variables: {} }),
+    });
+    expect(run.status).toBe(200);
+    const runBody = (await run.json()) as MetricRunResponse;
+    expect(runBody.widgets[0]?.result.columns).toEqual(["count"]);
+    expect(runBody.widgets[0]?.result.rows[0]).toHaveProperty("count");
+
+    const updated = await fetch(`${BASE}/api/metrics/definitions/${id}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({
+        title: "Updated Count",
+        definition: {
+          version: 1,
+          widgets: [
+            {
+              id: "task-count",
+              title: "Task count",
+              query: { sql: "SELECT COUNT(*) AS count FROM agent_tasks", maxRows: 10 },
+              viz: { type: "stat", value: "count", format: "integer" },
+            },
+          ],
+        },
+      }),
+    });
+    expect(updated.status).toBe(200);
+    expect(getMetricVersions(id)).toHaveLength(1);
+    expect(getMetricVersions(id)[0]?.snapshot.title).toBe("Test Count");
+  });
+
+  test("humans can create metrics through the UI without an agent header", async () => {
+    const created = await fetch(`${BASE}/api/metrics/definitions`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        slug: "ui-owned-count",
+        title: "UI Owned Count",
+        definition: {
+          version: 1,
+          widgets: [
+            {
+              id: "task-count",
+              title: "Task count",
+              query: { sql: "SELECT COUNT(*) AS count FROM agent_tasks", maxRows: 10 },
+              viz: { type: "stat", value: "count", format: "integer" },
+            },
+          ],
+        },
+      }),
+    });
+    expect(created.status).toBe(201);
+    const { id } = (await created.json()) as { id: string; version: number };
+
+    const run = await fetch(`${BASE}/api/metrics/definitions/${id}/run`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ variables: {} }),
+    });
+    expect(run.status).toBe(200);
+    const runBody = (await run.json()) as MetricRunResponse;
+    expect(runBody.widgets[0]?.result.rows[0]).toHaveProperty("count");
+  });
+
+  test("run binds metric variables into query params", async () => {
+    const created = await fetch(`${BASE}/api/metrics/definitions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        slug: "variable-count",
+        title: "Variable Count",
+        definition: {
+          version: 1,
+          variables: [
+            {
+              key: "status",
+              label: "Status",
+              type: "select",
+              defaultValue: "pending",
+              options: [
+                { label: "Pending", value: "pending" },
+                { label: "Completed", value: "completed" },
+              ],
+            },
+          ],
+          widgets: [
+            {
+              id: "status-count",
+              title: "Status count",
+              query: {
+                sql: "SELECT COUNT(*) AS count FROM agent_tasks WHERE status = ?",
+                params: ["{{status}}"],
+                maxRows: 10,
+              },
+              viz: { type: "stat", value: "count", format: "integer" },
+            },
+          ],
+        },
+      }),
+    });
+    expect(created.status).toBe(201);
+    const { id } = (await created.json()) as { id: string; version: number };
+
+    const run = await fetch(`${BASE}/api/metrics/definitions/${id}/run`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ variables: { status: "completed" } }),
+    });
+    expect(run.status).toBe(200);
+    const runBody = (await run.json()) as MetricRunResponse & {
+      variables: Record<string, string>;
+    };
+    expect(runBody.variables.status).toBe("completed");
+    expect(runBody.widgets[0]?.result.rows[0]).toHaveProperty("count");
+  });
+
+  test("saved metric SQL rejects writes and multiple statements", async () => {
+    for (const sql of ["DELETE FROM agent_tasks", "SELECT 1; SELECT 2"]) {
+      const res = await fetch(`${BASE}/api/metrics/definitions`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          title: "Bad Metric",
+          definition: {
+            version: 1,
+            widgets: [
+              {
+                id: "bad",
+                title: "Bad",
+                query: { sql },
+                viz: { type: "stat", value: "x" },
+              },
+            ],
+          },
+        }),
+      });
+      expect(res.status).toBe(400);
+    }
+  });
+});

package/src/tests/opencode-adapter.test.ts

@@ -48,7 +48,7 @@ let lastCreateOpencodeConfig: unknown;
 async function driveSession(
   events: OpencodeEvent[],
   cfg: ProviderSessionConfig = testConfig(),
-): Promise<{ emitted: ProviderEvent[]; result: ProviderResult }> {
+): Promise<{ emitted: ProviderEvent[]; result: ProviderResult; serverCloseCalls: () => number }> {
   const emitted: ProviderEvent[] = [];
 
   // Build the fake client/server pair used by the mock
@@ -68,7 +68,8 @@ async function driveSession(
     },
   };
 
-  const fakeServer = { url: "http://127.0.0.1:12345", close: mock(() => {}) };
+  const closeServer = mock(() => {});
+  const fakeServer = { url: "http://127.0.0.1:12345", close: closeServer };
 
   // Install mock BEFORE importing the adapter (Bun hoists mock.module)
   mock.module("@opencode-ai/sdk", () => ({
@@ -88,7 +89,54 @@ async function driveSession(
   await new Promise((r) => setTimeout(r, 0));
 
   const result = await session.waitForCompletion();
-  return { emitted, result };
+  return { emitted, result, serverCloseCalls: () => closeServer.mock.calls.length };
+}
+
+async function inspectSessionBeforeIdle(
+  cfg: ProviderSessionConfig,
+  inspect: () => Promise<void>,
+): Promise<void> {
+  const fakeSessionId = "sess-abc-123";
+  let releaseIdle!: () => void;
+  const idleReleased = new Promise<void>((resolve) => {
+    releaseIdle = resolve;
+  });
+
+  const fakeClient = {
+    session: {
+      create: async () => ({ data: { id: fakeSessionId }, error: undefined }),
+      prompt: async (args: unknown) => {
+        lastPromptArgs = args;
+        return { data: {}, error: undefined };
+      },
+    },
+    event: {
+      subscribe: async () => ({
+        stream: (async function* (): AsyncGenerator<OpencodeEvent> {
+          await idleReleased;
+          yield { type: "session.idle", properties: { sessionID: fakeSessionId } };
+        })(),
+      }),
+    },
+  };
+
+  const fakeServer = { url: "http://127.0.0.1:12345", close: mock(() => {}) };
+
+  mock.module("@opencode-ai/sdk", () => ({
+    createOpencode: async (opts: unknown) => {
+      lastCreateOpencodeConfig = opts;
+      return { client: fakeClient, server: fakeServer };
+    },
+  }));
+
+  const { OpencodeAdapter } = await import("../providers/opencode-adapter");
+  const adapter = new OpencodeAdapter();
+  const session = await adapter.createSession(cfg);
+  session.onEvent(() => {});
+  await new Promise((r) => setTimeout(r, 0));
+  await inspect();
+  releaseIdle();
+  await session.waitForCompletion();
 }
 
 // ── tests ─────────────────────────────────────────────────────────────────────
@@ -106,7 +154,7 @@ describe("OpencodeSession — SSE→ProviderEvent mapping", () => {
         properties: { sessionID: "sess-abc-123" },
       },
     ];
-    const { emitted, result } = await driveSession(events);
+    const { emitted, result, serverCloseCalls } = await driveSession(events);
 
     const resultEvent = emitted.find((e) => e.type === "result");
     expect(resultEvent).toBeDefined();
@@ -118,6 +166,21 @@ describe("OpencodeSession — SSE→ProviderEvent mapping", () => {
     expect(result.isError).toBe(false);
     expect(result.exitCode).toBe(0);
     expect(result.sessionId).toBe("sess-abc-123");
+    expect(serverCloseCalls()).toBe(1);
+  });
+
+  test("session.idle closes the server and drops later heartbeat events", async () => {
+    const events: OpencodeEvent[] = [
+      { type: "session.idle", properties: { sessionID: "sess-abc-123" } },
+      { type: "server.heartbeat", properties: {} } as OpencodeEvent,
+    ];
+    const { emitted, serverCloseCalls } = await driveSession(events);
+
+    expect(serverCloseCalls()).toBe(1);
+    const rawLogContents = emitted
+      .filter((e): e is Extract<ProviderEvent, { type: "raw_log" }> => e.type === "raw_log")
+      .map((e) => e.content);
+    expect(rawLogContents.some((content) => content.includes("server.heartbeat"))).toBe(false);
   });
 
   test("session.error → emits error event and fails result", async () => {
@@ -130,7 +193,7 @@ describe("OpencodeSession — SSE→ProviderEvent mapping", () => {
         },
       },
     ];
-    const { emitted, result } = await driveSession(events);
+    const { emitted, result, serverCloseCalls } = await driveSession(events);
 
     const errorEvent = emitted.find((e) => e.type === "error");
     expect(errorEvent).toBeDefined();
@@ -140,6 +203,7 @@ describe("OpencodeSession — SSE→ProviderEvent mapping", () => {
     expect(result.isError).toBe(true);
     expect(result.exitCode).toBe(1);
     expect(result.failureReason).toContain("provider overloaded");
+    expect(serverCloseCalls()).toBe(1);
   });
 
   test("prompt Model not found refreshes OpenRouter cache and retries once", async () => {
@@ -600,42 +664,38 @@ describe("OpencodeAdapter — per-task isolation (DES-300)", () => {
   });
 
   test("per-task agent file is written with system prompt", async () => {
-    const events: OpencodeEvent[] = [
-      { type: "session.idle", properties: { sessionID: "sess-abc-123" } },
-    ];
     const cwd = `/tmp/opencode-test-agent-${Date.now()}`;
     await Bun.$`mkdir -p ${cwd}`.quiet();
     const cfg = testConfig({ taskId: "task-agent-file", systemPrompt: "be a coder", cwd });
-    await driveSession(events, cfg);
+    await inspectSessionBeforeIdle(cfg, async () => {
+      const agentFile = Bun.file(join(cwd, ".opencode", "agents", "swarm-task-agent-file.md"));
+      const exists = await agentFile.exists();
+      expect(exists).toBe(true);
+      if (exists) {
+        const content = await agentFile.text();
+        expect(content).toContain("be a coder");
+      }
+    });
 
-    const agentFile = Bun.file(join(cwd, ".opencode", "agents", "swarm-task-agent-file.md"));
-    const exists = await agentFile.exists();
-    expect(exists).toBe(true);
-    if (exists) {
-      const content = await agentFile.text();
-      expect(content).toContain("be a coder");
-    }
     // Cleanup
     await Bun.$`rm -rf ${cwd}`.quiet().nothrow();
   });
 
   test("per-task config file is written as valid JSON", async () => {
-    const events: OpencodeEvent[] = [
-      { type: "session.idle", properties: { sessionID: "sess-abc-123" } },
-    ];
     const cfg = testConfig({ taskId: "task-cfg-json" });
-    await driveSession(events, cfg);
+    await inspectSessionBeforeIdle(cfg, async () => {
+      const configFile = Bun.file("/tmp/opencode-task-cfg-json.json");
+      const exists = await configFile.exists();
+      expect(exists).toBe(true);
+      if (exists) {
+        const text = await configFile.text();
+        expect(() => JSON.parse(text)).not.toThrow();
+        const parsed = JSON.parse(text) as { mcp?: unknown; permission?: unknown };
+        expect(parsed.mcp).toBeDefined();
+        expect(parsed.permission).toBeDefined();
+      }
+    });
 
-    const configFile = Bun.file("/tmp/opencode-task-cfg-json.json");
-    const exists = await configFile.exists();
-    expect(exists).toBe(true);
-    if (exists) {
-      const text = await configFile.text();
-      expect(() => JSON.parse(text)).not.toThrow();
-      const parsed = JSON.parse(text) as { mcp?: unknown; permission?: unknown };
-      expect(parsed.mcp).toBeDefined();
-      expect(parsed.permission).toBeDefined();
-    }
     // Cleanup
     await Bun.$`rm -f /tmp/opencode-task-cfg-json.json`.quiet().nothrow();
     await Bun.$`rm -rf /tmp/opencode-data-task-cfg-json`.quiet().nothrow();

package/src/tests/runner-repo-autostash.test.ts

@@ -0,0 +1,117 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { ensureRepoForTask } from "../commands/runner";
+
+const execFileAsync = promisify(execFile);
+
+let tempRoot = "";
+
+async function git(cwd: string, args: string[]): Promise<string> {
+  const { stdout } = await execFileAsync("git", ["-C", cwd, ...args]);
+  return stdout;
+}
+
+async function gitRaw(args: string[]): Promise<void> {
+  await execFileAsync("git", args);
+}
+
+async function commitAll(cwd: string, message: string): Promise<void> {
+  await git(cwd, ["add", "."]);
+  await git(cwd, ["commit", "-m", message]);
+}
+
+async function configureIdentity(cwd: string): Promise<void> {
+  await git(cwd, ["config", "user.email", "test@example.com"]);
+  await git(cwd, ["config", "user.name", "Test User"]);
+}
+
+describe("ensureRepoForTask auto-stash refresh", () => {
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(join(tmpdir(), "swarm-runner-autostash-"));
+  });
+
+  afterEach(async () => {
+    if (tempRoot) {
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  test("stashes dirty work with a swarm-autostash name before refreshing from origin", async () => {
+    const remotePath = join(tempRoot, "remote.git");
+    const upstreamPath = join(tempRoot, "upstream");
+    const clonePath = join(tempRoot, "clone");
+
+    await gitRaw(["init", "--bare", remotePath]);
+    await mkdir(upstreamPath);
+    await git(upstreamPath, ["init", "-b", "main"]);
+    await configureIdentity(upstreamPath);
+    await writeFile(join(upstreamPath, "README.md"), "initial\n");
+    await commitAll(upstreamPath, "initial commit");
+    await git(upstreamPath, ["remote", "add", "origin", remotePath]);
+    await git(upstreamPath, ["push", "-u", "origin", "main"]);
+
+    await gitRaw(["clone", "--branch", "main", remotePath, clonePath]);
+    await configureIdentity(clonePath);
+    await writeFile(join(clonePath, "README.md"), "local dirty change\n");
+    await writeFile(join(clonePath, "untracked.txt"), "local untracked\n");
+
+    await writeFile(join(upstreamPath, "remote.txt"), "remote change\n");
+    await commitAll(upstreamPath, "remote update");
+    await git(upstreamPath, ["push", "origin", "main"]);
+
+    const result = await ensureRepoForTask(
+      { url: remotePath, name: "repo", clonePath, defaultBranch: "main" },
+      "test",
+    );
+
+    expect(result.warning).toBeNull();
+    expect(result.autoStashes).toHaveLength(1);
+    expect(result.autoStashes[0]?.ref).toMatch(/^stash@\{\d+\}$/);
+    expect(result.autoStashes[0]?.message).toContain("swarm-autostash main ");
+    expect(await readFile(join(clonePath, "remote.txt"), "utf8")).toBe("remote change\n");
+    expect((await git(clonePath, ["status", "--porcelain"])).trim()).toBe("");
+
+    const stashList = await git(clonePath, ["stash", "list"]);
+    expect(stashList).toContain("swarm-autostash main ");
+    expect(stashList).toContain("On main:");
+  });
+
+  test("merges a clean divergent checkout with origin without hard reset", async () => {
+    const remotePath = join(tempRoot, "remote.git");
+    const upstreamPath = join(tempRoot, "upstream");
+    const clonePath = join(tempRoot, "clone");
+
+    await gitRaw(["init", "--bare", remotePath]);
+    await mkdir(upstreamPath);
+    await git(upstreamPath, ["init", "-b", "main"]);
+    await configureIdentity(upstreamPath);
+    await writeFile(join(upstreamPath, "README.md"), "initial\n");
+    await commitAll(upstreamPath, "initial commit");
+    await git(upstreamPath, ["remote", "add", "origin", remotePath]);
+    await git(upstreamPath, ["push", "-u", "origin", "main"]);
+
+    await gitRaw(["clone", "--branch", "main", remotePath, clonePath]);
+    await configureIdentity(clonePath);
+    await writeFile(join(clonePath, "local.txt"), "local commit\n");
+    await commitAll(clonePath, "local commit");
+
+    await writeFile(join(upstreamPath, "remote.txt"), "remote commit\n");
+    await commitAll(upstreamPath, "remote commit");
+    await git(upstreamPath, ["push", "origin", "main"]);
+
+    const result = await ensureRepoForTask(
+      { url: remotePath, name: "repo", clonePath, defaultBranch: "main" },
+      "test",
+    );
+
+    expect(result.warning).toBeNull();
+    expect(result.autoStashes).toEqual([]);
+    expect(await readFile(join(clonePath, "local.txt"), "utf8")).toBe("local commit\n");
+    expect(await readFile(join(clonePath, "remote.txt"), "utf8")).toBe("remote commit\n");
+    expect((await git(clonePath, ["status", "--porcelain"])).trim()).toBe("");
+  });
+});

package/src/tests/runner-requester-profile.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "bun:test";
+import { buildRequesterProfilePrompt } from "../commands/runner";
+
+describe("runner requester profile prompt", () => {
+  test("omits requester profile when no role or notes are set", async () => {
+    await expect(
+      buildRequesterProfilePrompt({ name: "Taras", email: "t@example.com" }),
+    ).resolves.toBe("");
+  });
+
+  test("formats requester role and free-text notes", async () => {
+    const prompt = await buildRequesterProfilePrompt({
+      name: "Taras",
+      email: "t@example.com",
+      role: "CEO",
+      notes: "Lead with the answer; keep updates terse.",
+    });
+
+    expect(prompt).toContain("## Requester Profile");
+    expect(prompt).toContain("This task was requested by Taras (CEO).");
+    expect(prompt).toContain("Their stated notes for how you should respond and act:");
+    expect(prompt).toContain("Lead with the answer; keep updates terse.");
+    expect(prompt).toContain("where it doesn't conflict with correctness or your operating rules");
+  });
+});

package/src/tests/runner-skills-refresh.test.ts

@@ -83,7 +83,7 @@ describe("refreshSkillsIfChanged", () => {
   function makeCtx(): SkillsRefreshContext {
     return {
       apiUrl: baseUrl,
-      swarmUrl: baseUrl,
+      swarmUrl: "app.agent-swarm.dev",
       apiKey: "test-key",
       agentId: "agent-1",
       role: "worker",

package/src/tests/swarm-x-tool.test.ts

@@ -0,0 +1,90 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerSwarmXTool } from "../tools/swarm-x";
+import { clearVolatileSecretsForTesting } from "../utils/secret-scrubber";
+
+type RegisteredTool = {
+  handler: (args: unknown, extra: unknown) => Promise<unknown>;
+};
+
+const originalFetch = globalThis.fetch;
+const originalComposioKey = process.env.COMPOSIO_API_KEY;
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function buildTool() {
+  const server = new McpServer({ name: "swarm-x-test", version: "1.0.0" });
+  registerSwarmXTool(server);
+  const registered = (server as unknown as { _registeredTools: Record<string, RegisteredTool> })
+    ._registeredTools;
+  const tool = registered.swarm_x;
+  if (!tool) throw new Error("swarm_x tool not registered");
+  return tool;
+}
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  if (originalComposioKey === undefined) delete process.env.COMPOSIO_API_KEY;
+  else process.env.COMPOSIO_API_KEY = originalComposioKey;
+  clearVolatileSecretsForTesting();
+});
+
+describe("swarm_x MCP tool", () => {
+  test("routes composio requests with server-side auth and scrubbed output", async () => {
+    process.env.COMPOSIO_API_KEY = "ck_tool_secret_value";
+    const fetchMock = mock(async (url: string | URL | Request, init?: RequestInit) => {
+      expect(String(url)).toBe("https://backend.composio.dev/api/v3.1/tools?limit=1");
+      expect(init?.method).toBe("GET");
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("ck_tool_secret_value");
+      return jsonResponse({ ok: true, token: "ck_tool_secret_value" });
+    });
+    globalThis.fetch = fetchMock;
+
+    const tool = buildTool();
+    const result = (await tool.handler(
+      {
+        target: "composio",
+        method: "GET",
+        path: "/tools",
+        query: { limit: 1 },
+      },
+      { sessionId: "s", requestInfo: { headers: {} } },
+    )) as {
+      isError?: boolean;
+      structuredContent: { ok: boolean; response: unknown; responseText: string };
+    };
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(result.isError).toBe(false);
+    expect(result.structuredContent.ok).toBe(true);
+    expect(JSON.stringify(result.structuredContent.response)).toContain(
+      "[REDACTED:COMPOSIO_API_KEY]",
+    );
+    expect(result.structuredContent.responseText).not.toContain("ck_tool_secret_value");
+  });
+
+  test("rejects absolute composio paths", async () => {
+    process.env.COMPOSIO_API_KEY = "ck_tool_secret_value";
+    const fetchMock = mock(async () => jsonResponse({ ok: true }));
+    globalThis.fetch = fetchMock;
+
+    const tool = buildTool();
+    const result = (await tool.handler(
+      {
+        target: "composio",
+        method: "GET",
+        path: "https://evil.example/tools",
+      },
+      { sessionId: "s", requestInfo: { headers: {} } },
+    )) as { isError?: boolean; structuredContent: { message: string } };
+
+    expect(result.isError).toBe(true);
+    expect(result.structuredContent.message).toContain("endpoint must be a Composio API path");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});