@desplega.ai/agent-swarm 2.4.0 → 2.4.2

package/src/tests/org-website.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, test } from "bun:test";
 import { validateConfigValue } from "../be/swarm-config-guard";
 import { buildContext } from "../telemetry-context";
+import {
+  COMPANY_ACQUISITION_SOURCES,
+  COMPANY_TEAM_SIZES,
+  COMPANY_USE_CASES,
+} from "../utils/company-profile";
 import {
   isFilledOrgLogoUrl,
   normalizeOrgWebsite,
@@ -75,6 +80,48 @@ describe("websiteSuggestion", () => {
     expect(websiteSuggestion("gmail.com")).toBeNull();
     expect(websiteSuggestion(null)).toBeNull();
   });
+
+  test("never suggests a regional or single-domain free-mail provider", () => {
+    for (const domain of [
+      "hotmail.es",
+      "yahoo.co.uk",
+      "outlook.fr",
+      "web.de",
+      "gmx.net",
+      "pm.me",
+      "mail.ru",
+      "live.co.uk",
+      "live.nl",
+      "yandex.com.tr",
+      "yandex.kz",
+      "icloud.com",
+      "me.com",
+      "proton.me",
+      "protonmail.ch",
+      "aol.de",
+      "qq.com",
+      "163.com",
+      "naver.com",
+      "Hotmail.CO.UK",
+      "mail.yahoo.com",
+    ]) {
+      expect(websiteSuggestion(domain)).toBeNull();
+    }
+  });
+
+  test("keeps company domains that only look like a provider", () => {
+    for (const domain of [
+      "acme.co.uk",
+      "acme.com.br",
+      "mailchimp.com",
+      "live.acme.com",
+      "yahoo-labs.dev",
+      "proton.ai",
+      "web.dev",
+    ]) {
+      expect(websiteSuggestion(domain)).toBe(domain);
+    }
+  });
 });
 
 describe("SWARM_ORG_WEBSITE config guard", () => {
@@ -95,6 +142,21 @@ describe("SWARM_ORG_WEBSITE config guard", () => {
   });
 });
 
+describe("company profile config guards", () => {
+  for (const [key, values] of [
+    ["SWARM_ORG_TEAM_SIZE", COMPANY_TEAM_SIZES],
+    ["SWARM_ORG_USE_CASE", COMPANY_USE_CASES],
+    ["SWARM_ORG_ACQUISITION_SOURCE", COMPANY_ACQUISITION_SOURCES],
+  ] as const) {
+    test(`${key} accepts its enum or empty, and rejects other values`, () => {
+      for (const value of ["", ...values]) expect(validateConfigValue(key, value)).toBeNull();
+      for (const value of ["unknown", "OTHER", "free text", null, 1, true]) {
+        expect(validateConfigValue(key, value)).toContain(key);
+      }
+    });
+  }
+});
+
 describe("org_website in the telemetry context", () => {
   const input = {
     orgId: "org_0123456789abcdef",

package/src/tests/pi-mono-adapter.test.ts

@@ -17,6 +17,7 @@ import {
   checkPiMonoCredentials,
   createPiRuntimeAuth,
   extractPiAssistantText,
+  listPiOpencodeGoModelIds,
   PiMonoAdapter,
   resolveModel,
   type SessionModelsJson,
@@ -457,6 +458,18 @@ describe("Model name mapping", () => {
   });
 });
 
+describe("listPiOpencodeGoModelIds", () => {
+  test("every reported opencode-go id resolves, so a picked id never falls back", () => {
+    const ids = listPiOpencodeGoModelIds();
+    expect(ids).toContain("deepseek-v4.1-flash");
+    for (const id of ids) {
+      expect(resolveModel(`opencode-go/${id}`, {})?.id).toBe(id);
+    }
+    expect(ids).not.toContain("deepseek-v4-flash");
+    expect(resolveModel("opencode-go/deepseek-v4-flash", {})).toBeUndefined();
+  });
+});
+
 describe("resolveModel — OpenRouter reroute for anthropic shortnames", () => {
   // Regression coverage for task 37a4a87a: workers spawned with
   // `provider: pi` + `OPENROUTER_API_KEY` (no ANTHROPIC_API_KEY) and a task
@@ -546,6 +559,16 @@ describe("createPiRuntimeAuth", () => {
     });
   });
 
+  test("passes OPENCODE_API_KEY to pi opencode-go runtime auth", async () => {
+    const modelRuntime = await createPiRuntimeAuth({
+      OPENCODE_API_KEY: "example-opencode-runtime",
+    });
+
+    await expect(modelRuntime.getAuth("opencode-go")).resolves.toMatchObject({
+      auth: { apiKey: "example-opencode-runtime" },
+    });
+  });
+
   test("passes GEMINI_API_KEY to pi google runtime auth", async () => {
     const modelRuntime = await createPiRuntimeAuth({
       GEMINI_API_KEY: "example-gemini-runtime",

package/src/tests/pr-body-leaks.test.ts

@@ -339,14 +339,18 @@ describe("parseGhPrCommands", () => {
     );
     expect(calls).toEqual([
       {
+        action: "create",
         cwd: "/tmp/wt",
         repos: ["o/r"],
+        resolvedRepos: ["o/r"],
         alsoCheckout: false,
         unknownTarget: false,
         texts: ["t"],
+        bodyTexts: [],
         bodyFiles: ["body.md"],
         unresolvedBodyFiles: [],
         opaqueBody: false,
+        externalBody: false,
       },
     ]);
   });

package/src/tests/pr-room-guard.test.ts

@@ -0,0 +1,242 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { codexPreToolUseBlock } from "../hooks/codex-hook";
+import { gitRemoteOrigin, guardGhPrRoom, type PrRoomGuardDeps } from "../hooks/pr-room-guard";
+import { expectChildOk, runChild } from "./test-proc";
+
+const ROOM_LINE = "PR room: prr-abcde23457";
+const BLOCK_REASON =
+  'This repo uses PR rooms. Create the room first with the pr-room skill (app action createRoom). Then pass the returned prBody with --body-file. The body must contain the line "PR room: prr-...".';
+
+function fakeDeps(overrides: Partial<PrRoomGuardDeps> = {}): PrRoomGuardDeps {
+  return {
+    env: { PR_ROOM_REPOS: "owner/repo" },
+    readFile: async () => "No room marker",
+    remoteOrigin: async () => "https://github.com/owner/repo.git",
+    ...overrides,
+  };
+}
+
+const check = (command: string, deps = fakeDeps()) => guardGhPrRoom({ command }, "/w", deps);
+
+describe("guardGhPrRoom", () => {
+  test.each([undefined, "", " ,  , "])("allows disabled configuration %p", async (value) => {
+    expect(
+      await check(
+        "gh pr create -R owner/repo -b plain",
+        fakeDeps({ env: { PR_ROOM_REPOS: value } }),
+      ),
+    ).toBeNull();
+  });
+
+  test("blocks a configured repo without a room marker", async () => {
+    expect(await check("gh pr create --repo owner/repo --body plain")).toBe(BLOCK_REASON);
+    expect(await check("gh pr create -Rowner/repo")).toBe(BLOCK_REASON);
+  });
+
+  test("allows a marker in the inline body", async () => {
+    expect(await check(`gh pr create -R owner/repo --body 'Summary\n${ROOM_LINE}'`)).toBeNull();
+  });
+
+  test("resolves body files relative to cd", async () => {
+    const paths: string[] = [];
+    const deps = fakeDeps({
+      readFile: async (path) => {
+        paths.push(path);
+        return ROOM_LINE;
+      },
+    });
+    expect(
+      await check("cd /checkout && gh pr create -R owner/repo --body-file body.md", deps),
+    ).toBeNull();
+    expect(paths).toEqual(["/checkout/body.md"]);
+  });
+
+  test("allows a heredoc body with a marker", async () => {
+    expect(
+      await check(`gh pr create -R owner/repo --body-file - <<'EOF'\n${ROOM_LINE}\nEOF`),
+    ).toBeNull();
+  });
+
+  test("blocks resolved files and heredocs without a marker", async () => {
+    expect(await check("gh pr create -R owner/repo -F body.md")).toBe(BLOCK_REASON);
+    expect(await check("gh pr create -R owner/repo -F - <<'EOF'\nplain\nEOF")).toBe(BLOCK_REASON);
+  });
+
+  test("allows another repo without reading its body", async () => {
+    expect(await check("gh pr create -R other/repo -b plain")).toBeNull();
+  });
+
+  test.each([
+    "GH_REPO=owner/repo gh pr create -b plain",
+    "export GH_REPO=owner/repo && gh pr create -b plain",
+  ])("checks command targeting: %s", async (command) => {
+    expect(await check(command)).toBe(BLOCK_REASON);
+  });
+
+  test("allows an ambiguous target unless every candidate is configured", async () => {
+    const otherCheckout = fakeDeps({ remoteOrigin: async () => "https://github.com/other/repo" });
+    expect(await check("GH_REPO=owner/repo && gh pr create -b plain", otherCheckout)).toBeNull();
+    expect(await check("GH_REPO=owner/repo && gh pr create -b plain")).toBe(BLOCK_REASON);
+    expect(await check("gh pr create -R owner/repo -R other/repo -b plain")).toBeNull();
+  });
+
+  test("checks inherited GH_REPO and honors an explicit override", async () => {
+    const deps = fakeDeps({ env: { PR_ROOM_REPOS: "owner/repo", GH_REPO: "owner/repo" } });
+    expect(await check("gh pr create -b plain", deps)).toBe(BLOCK_REASON);
+    expect(await check("gh pr create -R other/repo -b plain", deps)).toBeNull();
+  });
+
+  test("trims configured repos and matches case insensitively", async () => {
+    const deps = fakeDeps({ env: { PR_ROOM_REPOS: " other/repo, OWNER/REPO , " } });
+    expect(await check("gh -R Owner/Repo pr create -b plain", deps)).toBe(BLOCK_REASON);
+  });
+
+  test("allows edits and unrelated commands", async () => {
+    expect(await check("gh pr edit 123 -R owner/repo -b plain")).toBeNull();
+    expect(await check("gh pr view 123 -R owner/repo")).toBeNull();
+    expect(await guardGhPrRoom(undefined, "/w", fakeDeps())).toBeNull();
+  });
+
+  test.each([
+    "https://github.com/Owner/Repo.git",
+    "https://github.com/Owner/Repo",
+    "git@github.com:Owner/Repo.git",
+    "ssh://git@github.com/Owner/Repo.git",
+  ])("resolves checkout remote %s", async (remote) => {
+    const lookups: string[] = [];
+    const deps = fakeDeps({
+      remoteOrigin: async (cwd) => {
+        lookups.push(cwd);
+        return remote;
+      },
+    });
+    expect(await check("cd /checkout && gh pr create -b plain", deps)).toBe(BLOCK_REASON);
+    expect(lookups).toEqual(["/checkout"]);
+  });
+
+  test("allows failed remote lookup and unsupported remote forms", async () => {
+    expect(
+      await check("gh pr create -b plain", fakeDeps({ remoteOrigin: async () => "local/path" })),
+    ).toBeNull();
+    expect(
+      await check(
+        "gh pr create -b plain",
+        fakeDeps({
+          remoteOrigin: async () => {
+            throw new Error("no checkout");
+          },
+        }),
+      ),
+    ).toBeNull();
+  });
+
+  // git exports GIT_DIR to a pre-push hook in a linked worktree. The lookup then reads that repo.
+  test.skipIf(process.env.GIT_DIR !== undefined)(
+    "allows a checkout remote lookup that does not finish",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "pr-room-fifo-"));
+      try {
+        expectChildOk(await runChild(["git", "init", "-q", dir]), "git init");
+        await rm(join(dir, ".git", "config"));
+        expectChildOk(await runChild(["mkfifo", join(dir, ".git", "config")]), "mkfifo");
+        await expect(gitRemoteOrigin(dir, 200)).rejects.toThrow();
+        const deps = fakeDeps({ remoteOrigin: (cwd) => gitRemoteOrigin(cwd, 200) });
+        expect(await guardGhPrRoom({ command: "gh pr create -b plain" }, dir, deps)).toBeNull();
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    },
+  );
+
+  test.each([
+    'gh pr create -R "$UNKNOWN" -b plain',
+    'gh pr create -R owner/repo -b "$UNKNOWN"',
+    'gh pr create -R owner/repo -F "$UNKNOWN"',
+    "cd - && gh pr create -R owner/repo -b plain",
+    'cd "$UNKNOWN" && gh pr create -b plain',
+    "read GH_REPO && gh pr create -b plain",
+  ])("allows unresolved inputs: %s", async (command) => {
+    expect(await check(command)).toBeNull();
+  });
+
+  test("allows unreadable body files", async () => {
+    const deps = fakeDeps({
+      readFile: async () => {
+        throw new Error("unreadable");
+      },
+    });
+    expect(await check("gh pr create -R owner/repo -F missing.md", deps)).toBeNull();
+  });
+
+  test("resolves known variables without changing leak guard texts", async () => {
+    expect(await check('REPO=owner/repo && gh pr create -R "$REPO" -b plain')).toBe(BLOCK_REASON);
+    expect(await check(`BODY='${ROOM_LINE}' && gh pr create -R owner/repo -b "$BODY"`)).toBeNull();
+  });
+
+  test.each([
+    "cat room.md | gh pr create -R owner/repo -F -",
+    "printf plain | gh pr create -R owner/repo -F -",
+    "gh pr create -R owner/repo -b $(cat room.md)",
+    "gh pr create -R owner/repo --fill",
+    "gh pr create -R owner/repo -f",
+    "gh pr create -R owner/repo --fill-first",
+    "gh pr create -R owner/repo --fill-verbose",
+    "gh pr create -R owner/repo -T template.md -b plain",
+    "gh pr create -R owner/repo --template=template.md",
+    "gh pr create -R owner/repo -dw -b plain",
+    "gh pr create -R owner/repo --web",
+    "gh pr create -R owner/repo -e",
+    "gh pr create -R owner/repo --editor",
+    "gh pr create -R owner/repo --recover input.json",
+  ])("allows a body the guard cannot read: %s", async (command) => {
+    expect(await check(command)).toBeNull();
+  });
+
+  test.each([
+    "PR room: prr-abcde2345",
+    "PR room: prr-abcde234578",
+    "PR room: prr-ABCDE23457",
+    "prefix PR room: prr-abcde23457",
+  ])("rejects an invalid marker: %s", async (line) => {
+    expect(await check(`gh pr create -R owner/repo -b '${line}'`)).toBe(BLOCK_REASON);
+  });
+
+  test("does not accept a marker only in the title", async () => {
+    expect(await check(`gh pr create -R owner/repo -t '${ROOM_LINE}' -b plain`)).toBe(BLOCK_REASON);
+  });
+
+  test("checks every create invocation", async () => {
+    expect(await check(`gh pr edit 1 -b plain && gh pr create -R owner/repo -b plain`)).toBe(
+      BLOCK_REASON,
+    );
+  });
+
+  test("Codex runs the room guard after the leak guard, including app-server sessions", async () => {
+    const roomDeps = fakeDeps();
+    const leakDeps = {
+      env: { SWARM_CODEX_APP_SERVER: "1" },
+      readFile: roomDeps.readFile,
+      repoVisibility: async () => "PUBLIC",
+    };
+    const msg = {
+      hook_event_name: "PreToolUse",
+      cwd: "/w",
+      tool_input: { command: "gh pr create -R owner/repo -b plain" },
+    };
+    expect(await codexPreToolUseBlock(msg, leakDeps, roomDeps)).toBe(BLOCK_REASON);
+    const leaky = {
+      ...msg,
+      tool_input: {
+        command:
+          "gh pr create -R owner/repo -b 'https://acme.slack.com/archives/C01234567/p1700000000000000'",
+      },
+    };
+    expect(await codexPreToolUseBlock(leaky, leakDeps, roomDeps)).toContain("PR body leak check:");
+    expect(
+      await codexPreToolUseBlock({ ...msg, hook_event_name: "PostToolUse" }, leakDeps, roomDeps),
+    ).toBeNull();
+  });
+});

package/src/tests/ranking-listing.test.ts

@@ -2,12 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { isInternalConfigKey, validateConfigValue } from "../be/swarm-config-guard";
-import {
-  buildListing,
-  mintRankingClaim,
-  parseTelemetryRanking,
-  rankingEntryFile,
-} from "../ranking/telemetry-ranking";
+import { buildListing, parseTelemetryRanking } from "../ranking/telemetry-ranking";
 import { RANKING_TAXONOMY } from "../telemetry-contract/ranking-taxonomy.gen";
 import { orgIdentityStatus } from "../utils/org-identity";
 
@@ -41,7 +36,6 @@ describe("telemetry_ranking contract fixtures", () => {
 
 describe("buildListing", () => {
   const identity = orgIdentityStatus({ SWARM_ORG_NAME: "Acme", SWARM_ORG_WEBSITE: "acme.dev" });
-  const claim = mintRankingClaim();
 
   test("copies the name and domain from the org identity and blanks to null", () => {
     const listing = buildListing(
@@ -52,12 +46,10 @@ describe("buildListing", () => {
         description: "  ",
         sourceCodeUrl: null,
       },
-      claim,
       new Date("2026-10-18T10:00:00Z"),
     );
     expect(listing).toEqual({
       v: 1,
-      claim,
       name: "Acme",
       domain: "acme.dev",
       category: "engineering",
@@ -66,29 +58,22 @@ describe("buildListing", () => {
       sourceCodeUrl: null,
       updatedAt: "2026-10-18T10:00:00.000Z",
     });
-    expect(JSON.parse(rankingEntryFile(listing))).toEqual({
-      $schema: "./schema.json",
-      domain: "acme.dev",
-      claim,
-    });
   });
 
   test("refuses a missing identity and an http source URL", () => {
     expect(() =>
-      buildListing(
-        orgIdentityStatus({ SWARM_ORG_NAME: "Swarm", SWARM_ORG_WEBSITE: "acme.dev" }),
-        { category: "other" },
-        claim,
-      ),
+      buildListing(orgIdentityStatus({ SWARM_ORG_NAME: "Swarm", SWARM_ORG_WEBSITE: "acme.dev" }), {
+        category: "other",
+      }),
     ).toThrow("SWARM_ORG_NAME");
     expect(() =>
-      buildListing(identity, { category: "other", sourceCodeUrl: "http://github.com/acme" }, claim),
+      buildListing(identity, { category: "other", sourceCodeUrl: "http://github.com/acme" }),
     ).toThrow();
   });
 
-  test("mints rk_ + 32 hex claims", () => {
-    expect(mintRankingClaim()).toMatch(/^rk_[0-9a-f]{32}$/);
-    expect(mintRankingClaim()).not.toBe(mintRankingClaim());
+  test("a v2.4.0 listing with a claim still parses", () => {
+    const legacy = { ...JSON.parse(read("valid", "full.json")), claim: `rk_${"0".repeat(32)}` };
+    expect(parseTelemetryRanking(JSON.stringify(legacy)).claim).toBe(legacy.claim);
   });
 
   test("the taxonomy comes from the vendored contract", () => {

package/src/tests/ranking-route.test.ts

@@ -163,22 +163,15 @@ describe("ranking routes", () => {
   test("opt-in stores the listing, turns the setting on and emits it with a matching envelope", async () => {
     const result = await call("POST", "/api/ranking/opt-in", form);
     expect(result.statusCode).toBe(200);
-    const claim = String(result.json.claim);
-    expect(claim).toMatch(/^rk_[0-9a-f]{32}$/);
+    // Opting in is the whole flow: no claim, no entry file, no PR page.
+    expect(Object.keys(result.json).sort()).toEqual(["domain", "listing", "verifyUrl"]);
     expect(result.json.domain).toBe("acme.dev");
-    expect(String(result.json.prUrl)).toContain("filename=community%2Franking%2Facme.dev.json");
-    expect(JSON.parse(String(result.json.fileJson))).toEqual({
-      $schema: "./schema.json",
-      domain: "acme.dev",
-      claim,
-    });
     expect(String(result.json.verifyUrl)).toBe(
-      `https://proxy.desplega.sh/v1/ranking/verify?domain=acme.dev&claim=${claim}`,
+      "https://proxy.desplega.sh/v1/ranking/verify?domain=acme.dev",
     );
 
     const stored = parseTelemetryRanking(String(await configValue("telemetry_ranking")));
     expect(stored).toMatchObject({
-      claim,
       name: "Acme",
       domain: "acme.dev",
       category: "engineering",
@@ -186,6 +179,7 @@ describe("ranking routes", () => {
       description: "QA",
       sourceCodeUrl: null,
     });
+    expect(stored).not.toHaveProperty("claim");
     expect(await configValue("PUBLIC_RANKING_ENABLED")).toBe("true");
 
     expect(sent.map((event) => event.event)).toEqual(["ranking.opted_in"]);
@@ -193,10 +187,6 @@ describe("ranking routes", () => {
     expect(listing).toEqual(stored);
     expect(sent[0]?.context).toMatchObject({ org_name: "Acme", org_website: "acme.dev" });
 
-    // A second opt-in for the same domain keeps the claim.
-    const again = await call("POST", "/api/ranking/opt-in", { category: "other" });
-    expect(again.json.claim).toBe(claim);
-
     const state = await call("GET", "/api/ranking");
     expect(state.json).toMatchObject({
       eligible: true,
@@ -204,10 +194,12 @@ describe("ranking routes", () => {
       missing: [],
       listingMatchesDomain: true,
     });
+    expect(state.json).not.toHaveProperty("prUrl");
+    expect(state.json).not.toHaveProperty("fileJson");
   });
 
-  test("only a config admin reads the ranking state and its claim", async () => {
-    const claim = String((await call("POST", "/api/ranking/opt-in", form)).json.claim);
+  test("only a config admin reads the ranking state", async () => {
+    await call("POST", "/api/ranking/opt-in", form);
     const worker: HttpRequestAuth = {
       kind: "agent",
       agentId: crypto.randomUUID(),
@@ -220,42 +212,49 @@ describe("ranking routes", () => {
     for (const auth of [worker, guest]) {
       const denied = await call("GET", "/api/ranking", undefined, handleRanking, auth);
       expect(denied.statusCode).toBe(403);
-      expect(JSON.stringify(denied.json)).not.toContain(claim);
     }
-    const state = await call("GET", "/api/ranking");
-    expect(state.statusCode).toBe(200);
-    expect((state.json.listing as { claim: string }).claim).toBe(claim);
+    expect((await call("GET", "/api/ranking")).statusCode).toBe(200);
   });
 
-  test("concurrent first opt-ins share one claim, and leave then rejoin keeps it", async () => {
-    const [first, second] = await Promise.all([
-      call("POST", "/api/ranking/opt-in", form),
-      call("POST", "/api/ranking/opt-in", form),
-    ]);
-    expect(first.statusCode).toBe(200);
-    expect(second.statusCode).toBe(200);
-    // Either response may be the one merged into community/ranking.
-    const merged = String(first.json.claim);
-    expect(second.json.claim).toBe(merged);
-    expect(parseTelemetryRanking(String(await configValue("telemetry_ranking")))?.claim).toBe(
-      merged,
-    );
+  test("a v2.4.0 listing keeps working and its claim is never served or re-sent", async () => {
+    const claim = `rk_${"0".repeat(32)}`;
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "telemetry_ranking",
+      value: JSON.stringify({
+        v: 1,
+        claim,
+        name: "Acme",
+        domain: "acme.dev",
+        category: "other",
+        subcategory: null,
+        description: null,
+        sourceCodeUrl: null,
+        updatedAt: "2026-10-18T10:00:00.000Z",
+      }),
+    });
+    await upsertSwarmConfig({ scope: "global", key: "PUBLIC_RANKING_ENABLED", value: "true" });
+    const state = await call("GET", "/api/ranking");
+    expect(state.json).toMatchObject({ enabled: true, listingMatchesDomain: true });
+    expect(JSON.stringify(state.json)).not.toContain(claim);
 
-    expect((await call("POST", "/api/ranking/opt-out")).statusCode).toBe(200);
-    const rejoin = await call("POST", "/api/ranking/opt-in", form);
-    expect(rejoin.json.claim).toBe(merged);
+    const put = await call(
+      "PUT",
+      "/api/config",
+      { scope: "global", key: "SWARM_ORG_NAME", value: "Acme Labs" },
+      handleConfig,
+    );
+    expect(put.statusCode).toBe(200);
+    expect(sent.map((event) => event.event)).toEqual(["ranking.opted_in"]);
+    expect(String(sent[0]?.properties.listing)).not.toContain("claim");
   });
 
-  test("opt-out stores false, emits ranking.opted_out and returns the delete page", async () => {
+  test("opt-out stores false and emits ranking.opted_out", async () => {
     await call("POST", "/api/ranking/opt-in", form);
     sent = [];
     const result = await call("POST", "/api/ranking/opt-out");
     expect(result.statusCode).toBe(200);
-    expect(result.json).toEqual({
-      enabled: false,
-      leaveUrl:
-        "https://github.com/desplega-ai/agent-swarm/delete/main/community/ranking/acme.dev.json",
-    });
+    expect(result.json).toEqual({ enabled: false });
     expect(await configValue("PUBLIC_RANKING_ENABLED")).toBe("false");
     expect(sent.map((event) => [event.event, event.properties.domain])).toEqual([
       ["ranking.opted_out", "acme.dev"],
@@ -273,8 +272,8 @@ describe("ranking routes", () => {
     expect(String(result.json.error)).toContain("/api/ranking");
   });
 
-  test("renaming the org re-emits the listing with the same claim", async () => {
-    const optIn = await call("POST", "/api/ranking/opt-in", form);
+  test("renaming the org re-emits the listing", async () => {
+    await call("POST", "/api/ranking/opt-in", form);
     sent = [];
     const put = await call(
       "PUT",
@@ -287,7 +286,6 @@ describe("ranking routes", () => {
     const listing = parseTelemetryRanking(String(sent[0]?.properties.listing));
     expect(listing).toMatchObject({
       name: "Acme Labs",
-      claim: optIn.json.claim,
       subcategory: "qa-testing",
     });
     // The envelope carries the new name before the config reload reaches process.env.
@@ -312,8 +310,12 @@ describe("ranking routes", () => {
         ["ranking.opted_out", "acme.dev"],
       ]);
     }
-    // After the last case (a new website) the old listing needs a new PR.
+    // After the last case (a new website) the old listing needs a new opt-in.
     const state = await call("GET", "/api/ranking");
-    expect(state.json).toMatchObject({ enabled: false, listingMatchesDomain: false, prUrl: null });
+    expect(state.json).toMatchObject({
+      enabled: false,
+      listingMatchesDomain: false,
+      verifyUrl: null,
+    });
   });
 });