@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/tests/script-runs-http.test.ts

@@ -24,6 +24,7 @@ import {
   clearVolatileSecretsForTesting,
   refreshSecretScrubberCache,
 } from "../utils/secret-scrubber";
+import { executeRawLlm } from "../workflows/executors/raw-llm";
 import { randomToken } from "./synthetic-secret-helpers";
 
 const TEST_DB_PATH = "./test-script-runs-http.sqlite";
@@ -661,3 +662,91 @@ describe("durable launch source with an embedded secret", () => {
     }
   });
 });
+
+describe("POST /api/internal/raw-llm failure", () => {
+  const KEY_VARS = ["NAN_API_KEY", "HELMCODE_API_NAN"] as const;
+
+  // The provider echoes the key it received; `selectCredential` sends it
+  // trimmed, so a padded config value must still be redacted.
+  async function withNanKey(
+    keyVar: (typeof KEY_VARS)[number],
+    pad: string,
+    fn: (dummy: string, calls: () => number) => Promise<void>,
+    dummy = `nan-${randomToken(32)}`,
+  ) {
+    const previous = Object.fromEntries(KEY_VARS.map((name) => [name, process.env[name]]));
+    const previousFetch = globalThis.fetch;
+    for (const name of KEY_VARS) delete process.env[name];
+    process.env[keyVar] = `${pad}${dummy}${pad}`;
+    refreshSecretScrubberCache();
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      return new Response(
+        JSON.stringify({ error: { message: `Invalid API key: ${dummy}`, type: "auth" } }),
+        { status: 401, headers: { "Content-Type": "application/json" } },
+      );
+    }) as unknown as typeof fetch;
+    try {
+      await fn(dummy, () => calls);
+    } finally {
+      globalThis.fetch = previousFetch;
+      for (const name of KEY_VARS) {
+        if (previous[name] === undefined) delete process.env[name];
+        else process.env[name] = previous[name];
+      }
+      refreshSecretScrubberCache();
+    }
+  }
+
+  for (const keyVar of KEY_VARS) {
+    for (const pad of ["", "  "]) {
+      const label = pad ? "padded" : "unpadded";
+      test(`does not echo a provider error that carries the ${label} ${keyVar} key`, async () => {
+        await withNanKey(keyVar, pad, async (dummy, calls) => {
+          const response = await dispatch("/api/internal/raw-llm", {
+            method: "POST",
+            agentId,
+            body: JSON.stringify({ prompt: "hi", model: "nan/qwen3.8-flash" }),
+          });
+          expect(calls()).toBe(1);
+          expect(response.status).toBe(500);
+          expect(response.text).not.toContain(dummy);
+          const body = (await response.json()) as { error: string };
+          expect(body.error).toContain("LLM call failed");
+          expect(body.error).toContain(`[REDACTED:${keyVar}]`);
+        });
+      });
+    }
+
+    // A random key can contain "529"; that must not read as an overload.
+    test(`a ${keyVar} key containing 529 is not mistaken for a rate limit`, async () => {
+      await withNanKey(
+        keyVar,
+        "",
+        async (dummy, calls) => {
+          const result = await executeRawLlm({ prompt: "hi", model: "nan/qwen3.8-flash" });
+          expect(calls()).toBe(1);
+          expect(result.status).toBe("failed");
+          if (result.status === "failed") expect(result.error).not.toContain(dummy);
+        },
+        `nan-5L76Mxo2D529A9S0GrqOZWIpYdfO1aIM`,
+      );
+    });
+
+    test(`scrubs the fallback-port error for a padded ${keyVar} key`, async () => {
+      await withNanKey(keyVar, "  ", async (dummy, calls) => {
+        const result = await executeRawLlm({
+          prompt: "hi",
+          model: "nan/qwen3.8-flash",
+          fallbackPort: "fallback",
+        });
+        expect(calls()).toBe(1);
+        expect(result.status).toBe("success");
+        expect(result.error).toContain("using fallback port");
+        expect(result.error).not.toContain(dummy);
+        expect(result.error).toContain(`[REDACTED:${keyVar}]`);
+      });
+    });
+  }
+});

package/src/tests/scripts-http.test.ts

@@ -242,6 +242,22 @@ describe("/api/scripts HTTP", () => {
     expect(await second.json()).toEqual({ name: "double", version: 2, contentDeduped: false });
   });
 
+  test("upsert saves a quickjs-incompatible script and returns advisory warnings", async () => {
+    const res = await upsert({
+      name: "uses-process",
+      // The script typings omit process, but a cast still typechecks.
+      source:
+        "export default async (): Promise<string> => (globalThis as any).process.env.HOME ?? '';",
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      name: "uses-process",
+      version: 1,
+      contentDeduped: false,
+      warnings: ["quickjs compat (process, line 1): process is not available under quickjs"],
+    });
+  });
+
   test("upsert typecheck failures return diagnostics and do not write rows", async () => {
     const res = await upsert({
       name: "bad-types",

package/src/tests/secret-scrubber.test.ts

@@ -438,6 +438,16 @@ describe("registerVolatileSecret", () => {
     expect(scrubSecrets("http://127.0.0.1:9/v1")).toBe("http://127.0.0.1:9/v1");
   });
 
+  test("padded singleton values redact their trimmed form", () => {
+    const fromEnv = `opaque${randomToken(20)}`;
+    const fromMap = `opaque${randomToken(20)}`;
+    process.env.PADDED_API_KEY = `  ${fromEnv}\n`;
+    refreshSecretScrubberCache();
+    registerEnvSecrets({ HELMCODE_API_NAN: ` ${fromMap} ` });
+    expect(scrubSecrets(`key: ${fromEnv}`)).toBe("key: [REDACTED:PADDED_API_KEY]");
+    expect(scrubSecrets(`key: ${fromMap}`)).toBe("key: [REDACTED:HELMCODE_API_NAN]");
+  });
+
   test("ignores values shorter than the minimum length", () => {
     registerVolatileSecret("short", "TOO_SHORT");
     const out = scrubSecrets("contains short somewhere");

package/src/tests/seed-model-profiles.test.ts

@@ -0,0 +1,174 @@
+// The shipped `<harness>-<tier>` seeds, and migration 220's profiles made from
+// agents' MODEL_OVERRIDE + REASONING_EFFORT_OVERRIDE.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { unlink } from "node:fs/promises";
+import { join } from "node:path";
+import {
+  closeDb,
+  createAgent,
+  getDb,
+  getDbClient,
+  getSwarmConfigs,
+  initDb,
+  upsertSwarmConfig,
+} from "../be/db";
+import { getModelProfileByName, listModelProfiles } from "../be/db/model-profiles";
+import { recordClaimModelResolution } from "../be/model-tier-resolution";
+import { seedModelProfiles } from "../be/seed-model-profiles";
+import { DEFAULT_MODEL_TIER_MAP, type MODEL_TIERS, type ProviderName } from "../types";
+
+const TEST_DB_PATH = "./test-seed-model-profiles.sqlite";
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    try {
+      await unlink(path + suffix);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+/** The part of migration 220 that turns agent overrides into profiles. */
+function agentOverrideMigrationSql(): string {
+  const sql = readFileSync(
+    join(import.meta.dir, "../be/migrations/220_model_profiles.sql"),
+    "utf8",
+  );
+  return sql.slice(sql.indexOf("CREATE TEMP TABLE _model_profile_overrides"));
+}
+
+beforeAll(async () => {
+  await removeDbFiles(TEST_DB_PATH);
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  closeDb();
+  await removeDbFiles(TEST_DB_PATH);
+});
+
+beforeEach(async () => {
+  const client = getDbClient();
+  // References first: migration 220's triggers refuse deleting a named profile.
+  await client.run("DELETE FROM agent_tasks");
+  await client.run("DELETE FROM swarm_config");
+  await client.run("DELETE FROM swarm_repos");
+  await client.run("DELETE FROM agents");
+  await client.run("DELETE FROM model_profiles");
+});
+
+describe("tier seeds", () => {
+  test("one profile per harness and tier, copied from the tier map; none for acp", async () => {
+    expect(await seedModelProfiles()).toBe(40);
+    const profiles = await listModelProfiles();
+    expect(profiles).toHaveLength(40);
+    expect(profiles.some((p) => p.harness === "acp")).toBe(false);
+    for (const profile of profiles) {
+      const tier = profile.seededFrom?.replace("tier:", "") as (typeof MODEL_TIERS)[number];
+      expect(profile.name).toBe(`${profile.harness}-${tier}`);
+      expect(profile.model).toBe(DEFAULT_MODEL_TIER_MAP[profile.harness as ProviderName][tier]);
+      expect(profile.effort).toBeNull();
+    }
+    expect((await getModelProfileByName("claude-smart"))?.model).toBe("opus");
+    expect((await getModelProfileByName("codex-ultra"))?.model).toBe("gpt-5.6-sol");
+  });
+
+  test("a global MODEL_TIER row overrides the seed's model; reseeding never overwrites", async () => {
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "MODEL_TIER_CLAUDE_SMART",
+      value: "claude-opus-5-5",
+    });
+    await seedModelProfiles();
+    expect((await getModelProfileByName("claude-smart"))?.model).toBe("claude-opus-5-5");
+
+    await getDbClient().run(
+      "UPDATE model_profiles SET model = 'edited' WHERE name = 'claude-regular'",
+    );
+    expect(await seedModelProfiles()).toBe(0);
+    expect((await getModelProfileByName("claude-regular"))?.model).toBe("edited");
+  });
+});
+
+describe("migration 220: profiles from agent overrides", () => {
+  async function agentWith(
+    name: string,
+    harnessProvider: ProviderName,
+    model?: string,
+    effort?: string,
+  ): Promise<string> {
+    const agent = await createAgent({ name, isLead: false, status: "idle", harnessProvider });
+    if (model) {
+      await upsertSwarmConfig({
+        scope: "agent",
+        scopeId: agent.id,
+        key: "MODEL_OVERRIDE",
+        value: model,
+      });
+    }
+    if (effort) {
+      await upsertSwarmConfig({
+        scope: "agent",
+        scopeId: agent.id,
+        key: "REASONING_EFFORT_OVERRIDE",
+        value: effort,
+      });
+    }
+    return agent.id;
+  }
+
+  test("dedupes by (harness, model, effort) and makes each the agent's default", async () => {
+    const a = await agentWith("m-a", "claude", "claude-opus-5-5", "high");
+    const b = await agentWith("m-b", "claude", "claude-opus-5-5", "high");
+    const c = await agentWith("m-c", "codex", "gpt-6.1-sol", "xhigh");
+    const d = await agentWith("m-d", "claude", "openrouter/vendor/model:free");
+    const skipped = [
+      await agentWith("m-acp", "acp", "some-acp-model"),
+      await agentWith("m-alias", "claude", "latest:anthropic/opus"),
+      await agentWith("m-none", "claude"),
+    ];
+
+    getDb().exec(agentOverrideMigrationSql());
+
+    const profiles = await listModelProfiles();
+    expect(profiles.map((p) => [p.name, p.harness, p.model, p.effort])).toEqual([
+      ["claude-openrouter-vendor-model-free", "claude", "openrouter/vendor/model:free", null],
+      ["claude-opus-5-5-high", "claude", "claude-opus-5-5", "high"],
+      ["codex-gpt-6.1-sol-xhigh", "codex", "gpt-6.1-sol", "xhigh"],
+    ]);
+    expect(profiles.every((p) => p.seededFrom === "agent-config" && p.allowCustomModel)).toBe(true);
+
+    const defaults = await getSwarmConfigs({ scope: "agent", key: "MODEL_PROFILE" });
+    expect(Object.fromEntries(defaults.map((row) => [row.scopeId, row.value]))).toEqual({
+      [a]: "claude-opus-5-5-high",
+      [b]: "claude-opus-5-5-high",
+      [c]: "codex-gpt-6.1-sol-xhigh",
+      [d]: "claude-openrouter-vendor-model-free",
+    });
+    expect(defaults.every((row) => row.exportToEnv === false)).toBe(true);
+    expect(defaults.some((row) => skipped.includes(row.scopeId ?? ""))).toBe(false);
+  });
+
+  test("an overridden agent's untiered task resolves to the same model and effort as before", async () => {
+    const id = await agentWith("m-same", "codex", "gpt-6.1-sol", "xhigh");
+    getDb().exec(agentOverrideMigrationSql());
+    const task = await getDbClient().get<{ id: string }>(
+      `INSERT INTO agent_tasks (id, agentId, task, status, source, createdAt, lastUpdatedAt)
+       VALUES ('t-same', ?, 'work', 'pending', 'mcp', '2026-01-01', '2026-01-01') RETURNING id`,
+      [id],
+    );
+    const fields = await recordClaimModelResolution(
+      { id: task?.id ?? "" },
+      { id, harnessProvider: "codex" },
+    );
+    expect(fields).toMatchObject({
+      resolvedModel: "gpt-6.1-sol",
+      modelSource: "profile:agent-default",
+      resolvedProfile: "codex-gpt-6.1-sol-xhigh",
+      effort: "xhigh",
+    });
+  });
+});

package/src/tests/seed-scripts.test.ts

@@ -56,8 +56,8 @@ afterAll(async () => {
 });
 
 describe("seed-scripts catalog", () => {
-  test("manifest holds 27 unique, well-described scripts", () => {
-    expect(SEED_SCRIPTS.length).toBe(27);
+  test("manifest holds 28 unique, well-described scripts", () => {
+    expect(SEED_SCRIPTS.length).toBe(28);
     const names = SEED_SCRIPTS.map((s) => s.name);
     expect(new Set(names).size).toBe(names.length);
     for (const s of SEED_SCRIPTS) {

package/src/tests/skill-invocations.test.ts

@@ -78,6 +78,7 @@ afterAll(async () => {
 });
 
 describe("migration 196 skill invocations", () => {
+  // The full migration chain on a fresh DB can be slow under CI shard load.
   test("fresh DB has the counter columns and the invocations table", () => {
     const db = new Database(MIGRATION_DB_PATH, { create: true });
     try {
@@ -109,8 +110,9 @@ describe("migration 196 skill invocations", () => {
     } finally {
       db.close();
     }
-  });
+  }, 30_000);
 
+  // The full migration chain on a fresh DB can be slow under CI shard load.
   test("existing DB keeps its skills and starts them at zero", async () => {
     await removeDb(MIGRATION_DB_PATH);
     const db = new Database(MIGRATION_DB_PATH, { create: true });
@@ -143,7 +145,7 @@ describe("migration 196 skill invocations", () => {
     } finally {
       db.close();
     }
-  });
+  }, 30_000);
 });
 
 describe("skill.invoke ingestion", () => {

package/src/tests/slack-blocks.test.ts

@@ -192,6 +192,42 @@ describe("buildCompletedBlocks", () => {
   });
 });
 
+describe("completed status icon override", () => {
+  test("buildCompletedBlocks and tree lines use SLACK_STATUS_ICON_COMPLETED", () => {
+    process.env.SLACK_STATUS_ICON_COMPLETED = "bee-lgtm";
+    try {
+      const card = buildCompletedBlocks({
+        agentName: "Alpha",
+        taskId: "abcdef12-3456-7890-abcd-ef1234567890",
+        body: "Task output here",
+      });
+      expect(card[0].text.text.startsWith(":bee-lgtm: *Alpha*")).toBe(true);
+
+      const tree = buildTreeBlocks([
+        {
+          taskId: makeTaskId("icon0001"),
+          agentName: "Lead",
+          status: "completed",
+          children: [
+            {
+              taskId: makeTaskId("icon0002"),
+              agentName: "Worker",
+              status: "failed",
+              children: [],
+            },
+          ],
+        },
+      ]);
+      const text = tree[0].text.text;
+      expect(text).toContain(":bee-lgtm: *Lead*");
+      expect(text).toContain("❌ *Worker*");
+      expect(text).not.toContain("✅");
+    } finally {
+      delete process.env.SLACK_STATUS_ICON_COMPLETED;
+    }
+  });
+});
+
 describe("buildFailedBlocks", () => {
   test("returns single-line header + error section", () => {
     const blocks = buildFailedBlocks({

package/src/tests/slack-inline-output.test.ts

@@ -71,4 +71,18 @@ describe("Slack inline completion output", () => {
     expect(text).toContain("|`abcdef12`>");
     expect(text).toContain(finalMarker);
   });
+
+  test("the inline output header uses SLACK_STATUS_ICON_COMPLETED", () => {
+    process.env.SLACK_STATUS_ICON_COMPLETED = ":bee-lgtm:";
+    try {
+      const [first] = formatInlineCompletionOutputChunks({
+        agentName: "Analyst",
+        taskId: TASK_ID,
+        output: "Done.",
+      });
+      expect(first?.startsWith(":bee-lgtm: *Analyst* completed with output")).toBe(true);
+    } finally {
+      delete process.env.SLACK_STATUS_ICON_COMPLETED;
+    }
+  });
 });

package/src/tests/slack-reaction-config.test.ts

@@ -2,6 +2,7 @@ import { afterAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import * as otelModule from "../otel";
 import { ackSlackMessage, finalizeSlackMessageReaction } from "../slack/ack";
 import {
+  completedStatusIcon,
   normalizeSlackReactionShortcode,
   reactionName,
   SLACK_REACTION_CONFIG_KEYS,
@@ -114,6 +115,25 @@ describe("reaction-shortcode.ts", () => {
     expect(normalizeSlackReactionShortcode("thumbsup::skin-tone-6::skin-tone-6")).toBeNull();
   });
 
+  test("completedStatusIcon defaults to ✅ and renders a configured name as :name:", () => {
+    const previous = process.env.SLACK_STATUS_ICON_COMPLETED;
+    try {
+      delete process.env.SLACK_STATUS_ICON_COMPLETED;
+      expect(completedStatusIcon()).toBe("✅");
+      for (const value of ["bee-lgtm", ":bee-lgtm:", "  :Bee-LGTM: "]) {
+        process.env.SLACK_STATUS_ICON_COMPLETED = value;
+        expect(completedStatusIcon()).toBe(":bee-lgtm:");
+      }
+      for (const bad of ["", "::", "bee lgtm", "✅", "bee:lgtm"]) {
+        process.env.SLACK_STATUS_ICON_COMPLETED = bad;
+        expect(completedStatusIcon()).toBe("✅");
+      }
+    } finally {
+      if (previous === undefined) delete process.env.SLACK_STATUS_ICON_COMPLETED;
+      else process.env.SLACK_STATUS_ICON_COMPLETED = previous;
+    }
+  });
+
   test("no Slack source file outside ack.ts names a reaction shortcode or calls reactions.add", async () => {
     const glob = new Bun.Glob("*.ts");
     const dir = new URL("../slack/", import.meta.url);

package/src/tests/slack-render-v2.test.ts

@@ -1116,6 +1116,43 @@ describe("Slack renderer v2", () => {
     expect(doneText.startsWith("🧵 ✅ done")).toBe(true);
   });
 
+  test("the completed glyph follows SLACK_STATUS_ICON_COMPLETED in tree, header and cards", async () => {
+    const lead = await createAgent({ name: "Icon Lead", isLead: true, status: "idle" });
+    const ask = await createTaskExtended("icon ask", { agentId: lead.id, source: "slack" });
+    const now = new Date();
+    const done = {
+      ...ask,
+      status: "completed" as const,
+      output: "Shipped.",
+      lastUpdatedAt: now.toISOString(),
+      finishedAt: now.toISOString(),
+    };
+
+    const defaultTree = await renderThreadTree([done], new Map(), now);
+    expect(defaultTree.startsWith("🧵 ✅ done")).toBe(true);
+    expect(defaultTree).toContain("↳ ✅ ");
+    expect(await childOutcomeContent(done, false)).toBe("↳ ✅ Icon Lead — result: Shipped.");
+
+    process.env.SLACK_STATUS_ICON_COMPLETED = ":bee-lgtm:";
+    try {
+      const tree = await renderThreadTree([done], new Map(), now);
+      expect(tree.startsWith("🧵 :bee-lgtm: done")).toBe(true);
+      expect(tree).toContain("↳ :bee-lgtm: ");
+      expect(tree).not.toContain("✅");
+      expect(await childOutcomeContent(done, false)).toBe(
+        "↳ :bee-lgtm: Icon Lead — result: Shipped.",
+      );
+      expect(await childOutcomeContent(done, true)).toBe("↳ :bee-lgtm: Icon Lead completed");
+
+      // Only the completed glyph moves; failure keeps its own icon.
+      expect(
+        await childOutcomeContent({ ...done, status: "failed", failureReason: "boom" }, false),
+      ).toBe("↳ ❌ Icon Lead — failed: boom");
+    } finally {
+      delete process.env.SLACK_STATUS_ICON_COMPLETED;
+    }
+  });
+
   test("a parked deferral reads waiting, and done once its wake-up settles", async () => {
     const lead = await createAgent({ name: "Parked Header Lead", isLead: true, status: "idle" });
     const ask = await createTaskExtended("parked header ask", {

package/src/tests/slack-thread-buffer.test.ts

@@ -1,16 +1,21 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { unlinkSync } from "node:fs";
 import {
   closeDb,
   createAgent,
   createTaskExtended,
   createUser,
+  getDbClient,
   getLatestActiveTaskInThread,
   getMostRecentTaskInThread,
   getSlackTasksInThread,
   initDb,
 } from "../be/db";
+import { installExtension, setExtensionState } from "../be/extensions/db";
 import { type IdentityActor, linkIdentity } from "../be/users";
+import { registerLoaded, unregister } from "../extensions/dispatcher";
+import { ensureExtensionAgent } from "../extensions/identity";
+import { cleanExtensionTmpRoot, loadExtension } from "../extensions/loader";
 import { registerMessageHandler } from "../slack/handlers";
 import {
   bufferThreadMessage,
@@ -18,6 +23,7 @@ import {
   instantFlush,
   isThreadBuffered,
 } from "../slack/thread-buffer";
+import { loadBundleFixture } from "./fixtures/extensions/load";
 
 process.env.SLACK_RENDER_V2 = "false";
 
@@ -73,6 +79,27 @@ afterAll(() => {
   }
 });
 
+async function loadBlockingExtension(reason: string) {
+  const bundle = await loadBundleFixture("minimal");
+  const name = "slack-buffer-block-test";
+  bundle.manifest = { ...bundle.manifest, name };
+  bundle.files[bundle.manifest.assets.hooks] = `
+import { block, type SwarmExtension } from "swarm-extension";
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => block(${JSON.stringify(reason)}));
+};
+export default extension;
+`;
+  const installed = await installExtension(bundle);
+  const record = await setExtensionState(installed.extension.id, {
+    agentId: await ensureExtensionAgent(name),
+  });
+  if (!record) throw new Error("Failed to load the blocking Slack test extension");
+  const loaded = await loadExtension({ record, ...bundle });
+  registerLoaded(loaded);
+  return loaded;
+}
+
 describe("Slack thread buffer", () => {
   describe("ADDITIVE_SLACK thread ingress", () => {
     const originalAdditiveSlack = process.env.ADDITIVE_SLACK;
@@ -612,4 +639,74 @@ describe("Slack thread buffer", () => {
       expect(task!.task).toContain("solo message");
     });
   });
+
+  test(
+    "logs a blocked pre-task.create once at info level with its reason scrubbed",
+    async () => {
+      const secret = `ghp_${"Z".repeat(36)}`;
+      const extensionName = "slack-buffer-block-test";
+      const loaded = await loadBlockingExtension(`Ticket required: ${secret}`);
+      const info = spyOn(console, "info").mockImplementation(() => {});
+      const error = spyOn(console, "error").mockImplementation(() => {});
+      const channelId = "C_BLOCKED_FLUSH";
+      const threadTs = "14000.0001";
+
+      try {
+        bufferThreadMessage(channelId, threadTs, "follow-up", "U1", "14000.0002");
+        await instantFlush(`${channelId}:${threadTs}`);
+
+        expect(info).toHaveBeenCalledTimes(1);
+        expect(info.mock.calls[0]?.[0]).toBe("[Slack] pre.task.create blocked:");
+        expect(info.mock.calls[0]?.[1]).toBe(extensionName);
+        expect(String(info.mock.calls[0]?.[2])).toContain("[REDACTED:");
+        expect(String(info.mock.calls[0]?.[2])).not.toContain(secret);
+        expect(error).not.toHaveBeenCalled();
+        expect(await getMostRecentTaskInThread(channelId, threadTs)).toBeNull();
+      } finally {
+        unregister(loaded.record.id);
+        await loaded.dispose();
+        info.mockRestore();
+        error.mockRestore();
+        await cleanExtensionTmpRoot();
+      }
+    },
+    { timeout: 15_000 },
+  );
+
+  test(
+    "does not treat unexpected task creation errors as blocked",
+    async () => {
+      const triggerName = "fail_slack_buffer_task_creation";
+      const failure = "simulated Slack task creation failure";
+      const channelId = "C_UNEXPECTED_FLUSH";
+      const threadTs = "14000.0003";
+      const info = spyOn(console, "info").mockImplementation(() => {});
+      const error = spyOn(console, "error").mockImplementation(() => {});
+
+      try {
+        await getDbClient().run(`DROP TRIGGER IF EXISTS ${triggerName}`);
+        await getDbClient().run(`
+          CREATE TRIGGER ${triggerName}
+          BEFORE INSERT ON agent_tasks
+          WHEN NEW.slackChannelId = '${channelId}'
+          BEGIN
+            SELECT RAISE(ABORT, '${failure}');
+          END
+        `);
+
+        bufferThreadMessage(channelId, threadTs, "follow-up", "U1", "14000.0004");
+        await instantFlush(`${channelId}:${threadTs}`);
+
+        expect(info).not.toHaveBeenCalled();
+        expect(error).toHaveBeenCalledTimes(1);
+        expect(String(error.mock.calls[0]?.[1])).toContain(failure);
+        expect(await getMostRecentTaskInThread(channelId, threadTs)).toBeNull();
+      } finally {
+        await getDbClient().run(`DROP TRIGGER IF EXISTS ${triggerName}`);
+        info.mockRestore();
+        error.mockRestore();
+      }
+    },
+    { timeout: 15_000 },
+  );
 });