@desplega.ai/agent-swarm 1.88.0 → 1.90.0

package/src/tests/system-default-skills.test.ts

@@ -36,7 +36,9 @@ describe("system-default skills", () => {
     const skills = loadSeedSkills();
     const names = skills.map((skill) => skill.name);
 
+    expect(names).toContain("attio-interaction");
     expect(names).toContain("swarm-scripts");
+    expect(skills.find((skill) => skill.name === "attio-interaction")?.systemDefault).toBe(true);
     expect(skills.find((skill) => skill.name === "swarm-scripts")?.systemDefault).toBe(true);
     expect(skills.find((skill) => skill.name === "kv-storage")?.systemDefault).toBe(true);
     expect(skills.find((skill) => skill.name === "pages")?.systemDefault).toBe(true);
@@ -45,6 +47,7 @@ describe("system-default skills", () => {
     expect(result.failed).toEqual([]);
 
     const defaults = getSystemDefaultSkills().map((skill) => skill.name);
+    expect(defaults).toContain("attio-interaction");
     expect(defaults).toContain("swarm-scripts");
     expect(defaults).toContain("kv-storage");
     expect(defaults).toContain("pages");

package/src/tests/ui-logs-parser.test.ts

@@ -0,0 +1,271 @@
+import { describe, expect, test } from "bun:test";
+import {
+  normalizeSessionLogs,
+  parseSessionLogs,
+  type SessionLogRecord,
+  unwrapResult,
+} from "../../ui/src/logs-parser";
+
+function log(
+  id: string,
+  cli: string,
+  lineNumber: number,
+  content: unknown,
+  createdAt = "2026-06-01T10:00:00.000Z",
+): SessionLogRecord {
+  return {
+    id,
+    taskId: "task-1",
+    sessionId: "session-1",
+    iteration: 1,
+    cli,
+    content: typeof content === "string" ? content : JSON.stringify(content),
+    lineNumber,
+    createdAt,
+  };
+}
+
+describe("ui logs parser", () => {
+  test("orders opencode deltas before reassembling streamed text", () => {
+    const result = normalizeSessionLogs([
+      log("delta-2", "opencode", 2, {
+        type: "message.part.delta",
+        properties: { partID: "part-1", delta: "world" },
+      }),
+      log("updated", "opencode", 3, {
+        type: "message.part.updated",
+        properties: { part: { id: "part-1", type: "text" } },
+      }),
+      log("delta-1", "opencode", 1, {
+        type: "message.part.delta",
+        properties: { partID: "part-1", delta: "Hello " },
+      }),
+    ]);
+
+    expect(result.gate).toEqual({ total: 3, ok: 3, bad: 0, passed: true });
+    expect(result.items).toHaveLength(1);
+    expect(result.items[0]?.kind).toBe("text");
+    expect(result.items[0]?.text).toBe("Hello world");
+    expect(result.items[0]?.recId).toBe("delta-1");
+  });
+
+  test("pairs codex started and completed tool events by item id", () => {
+    const result = normalizeSessionLogs([
+      log("start", "codex", 1, {
+        type: "item.started",
+        item: { id: "item-1", type: "command_execution", command: "pwd" },
+      }),
+      log("done", "codex", 2, {
+        type: "item.completed",
+        item: {
+          id: "item-1",
+          type: "command_execution",
+          aggregated_output: "/tmp\n",
+          exit_code: 0,
+        },
+      }),
+    ]);
+
+    expect(result.items.map((item) => item.kind)).toEqual(["tool_call", "tool_result"]);
+    expect(result.pairing.paired).toBe(1);
+    expect(result.pairing.orphanCalls).toEqual([]);
+    expect(result.pairing.orphanResults).toEqual([]);
+  });
+
+  test("normalizes claude-managed raw SSE events without unknown noise", () => {
+    const result = normalizeSessionLogs([
+      log("status", "claude-managed", 1, {
+        type: "session.status_running",
+        id: "evt-running",
+      }),
+      log("message", "claude-managed", 2, {
+        type: "agent.message",
+        id: "evt-message",
+        content: [{ type: "text", text: "Hello from managed agent" }],
+      }),
+      log("tool", "claude-managed", 3, {
+        type: "agent.tool_use",
+        id: "tool-1",
+        name: "read_file",
+        input: { path: "/etc/hosts" },
+      }),
+      log("result", "claude-managed", 4, {
+        type: "agent.tool_result",
+        id: "tool-result-1",
+        tool_use_id: "tool-1",
+        content: [{ type: "text", text: "127.0.0.1 localhost" }],
+        is_error: false,
+      }),
+    ]);
+
+    expect(result.items.map((item) => item.kind)).toEqual([
+      "lifecycle",
+      "text",
+      "tool_call",
+      "tool_result",
+    ]);
+    expect(result.items.some((item) => item.kind === "unknown")).toBe(false);
+    expect(result.pairing.paired).toBe(1);
+    expect(result.pairing.orphanCalls).toEqual([]);
+    expect(result.pairing.orphanResults).toEqual([]);
+  });
+
+  test("keeps parse errors visible in the compatibility message output", () => {
+    const messages = parseSessionLogs([log("bad", "claude", 1, "{not-json")]);
+    expect(messages).toHaveLength(1);
+    expect(messages[0]?.role).toBe("system");
+    expect(messages[0]?.content[0]).toEqual({
+      type: "provider_meta",
+      kind: "parse_error",
+      provider: "claude",
+      data: { raw: "{not-json" },
+    });
+  });
+
+  test("classifies claude runtime noise as internal or helper metadata", () => {
+    const messages = parseSessionLogs([
+      log("rate", "claude", 1, {
+        type: "rate_limit_event",
+        rate_limit_info: { status: "rejected", resetsAt: 1779202200 },
+      }),
+      log("think", "claude", 2, {
+        type: "system",
+        subtype: "thinking_tokens",
+        estimated_tokens: 150,
+        estimated_tokens_delta: 100,
+      }),
+      log("hook", "claude", 3, {
+        type: "system",
+        subtype: "hook_response",
+        hook_id: "hook-1",
+        hook_event: "SessionStart",
+        outcome: "success",
+      }),
+    ]);
+
+    expect(messages.map((message) => message.content[0])).toEqual([
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "internal",
+        data: expect.objectContaining({ internalType: "rate_limit" }),
+      }),
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "helper",
+        data: expect.objectContaining({ helperType: "thinking_tokens" }),
+      }),
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "internal",
+        data: expect.objectContaining({ internalType: "hook" }),
+      }),
+    ]);
+  });
+
+  test("classifies codex and opencode lifecycle rows for shared rendering", () => {
+    const codex = parseSessionLogs([
+      log("turn", "codex", 1, {
+        type: "turn.completed",
+        usage: { input_tokens: 100, cached_input_tokens: 50, output_tokens: 10 },
+      }),
+    ]);
+    const opencode = parseSessionLogs([
+      log("context", "opencode", 1, {
+        type: "context_usage",
+        contextUsedTokens: 25_000,
+        contextTotalTokens: 200_000,
+        contextPercent: 12.5,
+      }),
+      log("session", "opencode", 2, {
+        type: "session_init",
+        sessionId: "ses_1",
+        provider: "opencode",
+      }),
+      log("heartbeat", "opencode", 3, { type: "server.heartbeat", properties: {} }),
+      log("connected", "opencode", 4, { type: "server.connected", properties: {} }),
+      log("result", "opencode", 5, {
+        type: "result",
+        cost: { totalCostUsd: 0.12, inputTokens: 100, outputTokens: 20 },
+        isError: false,
+      }),
+    ]);
+
+    expect(codex[0]?.content[0]).toEqual(
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "helper",
+        data: expect.objectContaining({ helperType: "turn_usage" }),
+      }),
+    );
+    expect(opencode.map((message) => message.content[0])).toEqual([
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "helper",
+        data: expect.objectContaining({ helperType: "context_usage" }),
+      }),
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "internal",
+        data: expect.objectContaining({ internalType: "runtime" }),
+      }),
+      expect.objectContaining({ type: "provider_meta", kind: "result" }),
+    ]);
+  });
+
+  test("keeps devin provider meta and transcript messages on the generic path", () => {
+    const messages = parseSessionLogs([
+      log("status", "devin", 1, {
+        type: "system",
+        message: { role: "system", content: "" },
+        provider_meta: { provider: "devin", kind: "status", status: "running" },
+      }),
+      log("message", "devin", 2, {
+        type: "assistant",
+        message: { role: "assistant", content: "Devin update" },
+      }),
+    ]);
+
+    expect(messages.map((message) => message.content[0])).toEqual([
+      expect.objectContaining({
+        type: "provider_meta",
+        kind: "status",
+        provider: "devin",
+        data: expect.objectContaining({ status: "running" }),
+      }),
+      { type: "text", text: "Devin update" },
+    ]);
+  });
+
+  test("unwraps prose followed by embedded JSON", () => {
+    expect(unwrapResult('Created file\n\n{"ok":true,"path":"a.ts"}')).toEqual({
+      prose: "Created file",
+      json: { ok: true, path: "a.ts" },
+    });
+  });
+
+  test("unwraps pi tool result content text wrappers", () => {
+    const messages = parseSessionLogs([
+      log("pi-result", "pi", 1, {
+        type: "assistant",
+        message: {
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: "functions.memory-get:1",
+              content: JSON.stringify({
+                content: [{ type: "text", text: 'Memory retrieved.\n\n{"ok":true}' }],
+              }),
+            },
+          ],
+        },
+      }),
+    ]);
+
+    expect(messages[0]?.content[0]).toEqual(
+      expect.objectContaining({
+        type: "tool_result",
+        content: 'Memory retrieved.\n\n{\n  "ok": true\n}',
+      }),
+    );
+  });
+});

package/src/tests/user-token-rest-auth.test.ts

@@ -0,0 +1,129 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlinkSync } from "node:fs";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, createAgent, createUser, getDb, initDb } from "../be/db";
+import { type IdentityActor, mintToken, revokeToken } from "../be/users";
+import { handleCore } from "../http/core";
+import { handleTasks } from "../http/tasks";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+
+const TEST_DB_PATH = "./test-user-token-rest-auth.sqlite";
+const API_KEY = "test-api-key";
+const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
+
+function createTestServer(): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+
+    if (await handleCore(req, res, myAgentId, API_KEY)) return;
+    if (await handleTasks(req, res, pathSegments, queryParams, myAgentId)) return;
+
+    res.writeHead(404);
+    res.end("Not Found");
+  });
+}
+
+async function listen(server: Server): Promise<number> {
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  const addr = server.address();
+  if (!addr || typeof addr === "string") throw new Error("no port");
+  return addr.port;
+}
+
+function cleanupDb() {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      unlinkSync(`${TEST_DB_PATH}${suffix}`);
+    } catch {}
+  }
+}
+
+describe("normal REST API user-bound token auth", () => {
+  let server: Server;
+  let port: number;
+
+  beforeAll(async () => {
+    cleanupDb();
+    initDb(TEST_DB_PATH);
+    createAgent({ name: "Lead", isLead: true, status: "idle" });
+    server = createTestServer();
+    port = await listen(server);
+  });
+
+  afterAll(() => {
+    server.close();
+    closeDb();
+    cleanupDb();
+  });
+
+  test("POST /api/tasks accepts active user token and forces requester/audit user", async () => {
+    const user = createUser({ name: "Token REST User" });
+    const other = createUser({ name: "Other User" });
+    const { plaintext } = mintToken(user.id, "rest", ACTOR);
+
+    const res = await fetch(`http://localhost:${port}/api/tasks`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${plaintext}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        task: "created through user token",
+        requestedByUserId: other.id,
+      }),
+    });
+
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { id: string; requestedByUserId?: string };
+    expect(body.requestedByUserId).toBe(user.id);
+
+    const row = getDb()
+      .prepare<
+        { requestedByUserId: string | null; created_by: string | null; updated_by: string | null },
+        string
+      >("SELECT requestedByUserId, created_by, updated_by FROM agent_tasks WHERE id = ?")
+      .get(body.id);
+    expect(row?.requestedByUserId).toBe(user.id);
+    expect(row?.created_by).toBe(user.id);
+    expect(row?.updated_by).toBe(user.id);
+  });
+
+  test("global API key still creates unattributed tasks by default", async () => {
+    const res = await fetch(`http://localhost:${port}/api/tasks`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${API_KEY}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ task: "created through global key" }),
+    });
+
+    expect(res.status).toBe(201);
+    const body = (await res.json()) as { id: string; requestedByUserId?: string };
+    expect(body.requestedByUserId).toBeUndefined();
+  });
+
+  test("revoked user token is unauthorized for normal API", async () => {
+    const user = createUser({ name: "Revoked REST User" });
+    const { tokenId, plaintext } = mintToken(user.id, "revoked", ACTOR);
+    revokeToken(tokenId, ACTOR);
+
+    const res = await fetch(`http://localhost:${port}/api/tasks`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${plaintext}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ task: "should not be created" }),
+    });
+
+    expect(res.status).toBe(401);
+  });
+});

package/src/tests/workflow-async-v2.test.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import {
   closeDb,
   completeTask,
+  createUser,
   createWorkflow,
   deleteWorkflow,
   getTaskByWorkflowRunStepId,
@@ -151,6 +152,28 @@ describe("Workflow Async v2 (Phase 4)", () => {
       expect(task!.task).toBe("Do the thing");
     });
 
+    test("inherits requestedByUserId from workflow execution options", async () => {
+      const user = createUser({ name: "Workflow Requester" });
+      const workflow = makeWorkflow({
+        nodes: [
+          {
+            id: "task1",
+            type: "agent-task",
+            config: { template: "Do attributed workflow work" },
+          },
+        ],
+      });
+
+      const runId = await startWorkflowExecution(workflow, { test: true }, registry, {
+        requestedByUserId: user.id,
+      });
+      const steps = getWorkflowRunStepsByRunId(runId);
+      const task = getTaskByWorkflowRunStepId(steps[0]!.id);
+
+      expect(task).toBeTruthy();
+      expect(task!.requestedByUserId).toBe(user.id);
+    });
+
     test("workflow pauses at waiting when hitting async executor", async () => {
       const workflow = makeWorkflow({
         nodes: [

package/src/tests/x-composio.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, mock, test } from "bun:test";
+
+import { parseComposioArgs, runComposioCommand, runXCommand } from "../commands/x";
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("parseComposioArgs", () => {
+  test("parses method, path, body, query, and base url", () => {
+    const parsed = parseComposioArgs(
+      [
+        "POST",
+        "/tools/execute/GITHUB_CREATE_AN_ISSUE",
+        "--body",
+        '{"arguments":{"title":"demo"}}',
+        "--query",
+        "preview=true",
+        "--base-url",
+        "https://example.test/api",
+      ],
+      {},
+    );
+
+    expect(parsed.method).toBe("POST");
+    expect(parsed.endpoint).toBe("/tools/execute/GITHUB_CREATE_AN_ISSUE");
+    expect(parsed.body).toEqual({ arguments: { title: "demo" } });
+    expect(parsed.query).toEqual([["preview", "true"]]);
+    expect(parsed.baseUrl).toBe("https://example.test/api");
+  });
+
+  test("rejects absolute endpoint URLs so API keys are not routed elsewhere", () => {
+    expect(() => parseComposioArgs(["GET", "https://evil.example/tools"], {})).toThrow(
+      "endpoint must be a Composio API path",
+    );
+  });
+});
+
+describe("runComposioCommand", () => {
+  test("routes request to Composio with x-api-key auth and pretty JSON output", async () => {
+    const out: string[] = [];
+    const fetchMock = mock(async (url: string | URL | Request, init?: RequestInit) => {
+      expect(String(url)).toBe("https://backend.composio.dev/api/v3.1/tools?limit=10");
+      expect(init?.method).toBe("GET");
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBe("ck_test_secret");
+      return jsonResponse({ ok: true, token: "ck_test_secret" });
+    });
+
+    await runComposioCommand(["GET", "/tools", "--query", "limit=10"], {
+      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      fetch: fetchMock,
+      log: (message) => out.push(message),
+      error: (message) => out.push(message),
+      exit: () => {
+        throw new Error("should not exit");
+      },
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(out.join("\n")).toContain('"ok": true');
+    expect(out.join("\n")).toContain("[REDACTED:COMPOSIO_API_KEY]");
+    expect(out.join("\n")).not.toContain("ck_test_secret");
+  });
+
+  test("uses org key header when --org is passed", async () => {
+    const fetchMock = mock(async (_url: string | URL | Request, init?: RequestInit) => {
+      expect((init?.headers as Record<string, string>)["x-org-api-key"]).toBe("org_secret_value");
+      expect((init?.headers as Record<string, string>)["x-api-key"]).toBeUndefined();
+      return jsonResponse({ ok: true });
+    });
+
+    await runComposioCommand(["GET", "/org/projects", "--org"], {
+      env: { COMPOSIO_ORG_API_KEY: "org_secret_value" },
+      fetch: fetchMock,
+      log: () => {},
+      error: () => {},
+      exit: () => {
+        throw new Error("should not exit");
+      },
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("exits before fetch when COMPOSIO_API_KEY is missing", async () => {
+    const err: string[] = [];
+    const exit = mock(() => undefined);
+    const fetchMock = mock(async () => jsonResponse({ ok: true }));
+
+    await runComposioCommand(["GET", "/tools"], {
+      env: {},
+      fetch: fetchMock,
+      log: () => {},
+      error: (message) => err.push(message),
+      exit,
+    });
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(exit).toHaveBeenCalledWith(1);
+    expect(err.join("\n")).toContain("COMPOSIO_API_KEY is required");
+  });
+});
+
+describe("runXCommand", () => {
+  test("dispatches to composio target", async () => {
+    const fetchMock = mock(async () => jsonResponse({ ok: true }));
+    await runXCommand(["composio", "GET", "/tools"], {
+      env: { COMPOSIO_API_KEY: "ck_test_secret" },
+      fetch: fetchMock,
+      log: () => {},
+      error: () => {},
+      exit: () => {
+        throw new Error("should not exit");
+      },
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});