@desplega.ai/agent-swarm 2.4.2 → 2.4.4

package/src/tests/grok-adapter.test.ts

@@ -30,6 +30,7 @@ import {
 } from "../providers/grok-adapter";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
 import { getModelAwareCredentialVars } from "../utils/credentials";
+import { ACP_SDK_PATH, serveFakeAcpAgent } from "./acp-fake-agent";
 
 /**
  * Recorded from a live `grok agent stdio` session (Grok CLI 1.0.46,
@@ -39,7 +40,6 @@ import { getModelAwareCredentialVars } from "../utils/credentials";
  */
 const FIXTURE = join(import.meta.dir, "fixtures", "grok", "acp-updates-recorded.jsonl");
 const PROMPT_META = join(import.meta.dir, "fixtures", "grok", "prompt-response-meta.json");
-const SDK_PATH = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
 
 const tmpDirs: string[] = [];
 
@@ -129,7 +129,7 @@ function writeFakeGrok(
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { Readable, Writable } from "node:stream";
-import { AgentSideConnection, PROTOCOL_VERSION, RequestError, ndJsonStream } from "${SDK_PATH}";
+import { PROTOCOL_VERSION, RequestError, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
 const home = process.env.GROK_HOME ?? "";
 const read = (name) => (existsSync(join(home, name)) ? readFileSync(join(home, name), "utf8") : null);
 const capture = {
@@ -160,7 +160,7 @@ class FakeGrok {
   }
   async cancel() { this.cancelled?.(); }
 }
-new AgentSideConnection((c) => new FakeGrok(c), ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin)));
+${serveFakeAcpAgent("FakeGrok")}
 `,
   );
   const binPath = join(dir, "grok");

package/src/tests/heartbeat-jev-gate.test.ts

@@ -261,6 +261,29 @@ describe("heartbeat-jev-gate with a provider", () => {
     });
   });
 
+  test("only a bare MM-DD counts as a due tracked item", async () => {
+    const mocked = Date.now;
+    Date.now = () => Date.parse("2026-10-20T09:30:00.000Z");
+    try {
+      const { ctx } = fakeCtx({
+        configs: { TYPESAFE_API_KEY: "x" },
+        heartbeatMd: [
+          "- **2026-10-20 ~10:45Z (heartbeat 2026-10-20):** re-verified, nothing pending",
+          "- Watch: 10-20s retry window closed, nothing pending",
+          "- Watch: session 4a12-10-20-9e2f finished cleanly, nothing pending",
+          "- Watch: release on 10-20 — lift after ship",
+        ].join("\n"),
+        jev: jevSays(0.9),
+      });
+      const verdict = await run(ctx, { dryRun: true });
+      expect(verdict.state.tracked_items_mentioning_today_or_past_delete_date).toEqual([
+        "- Watch: release on 10-20 — lift after ship",
+      ]);
+    } finally {
+      Date.now = mocked;
+    }
+  });
+
   for (const ordersFirst of [true, false]) {
     test(`previous failures are not new with standing orders ${ordersFirst ? "before" : "after"} status`, async () => {
       const failures =

package/src/tests/migration-232-agent-session-tokens.test.ts

@@ -0,0 +1,67 @@
+import { Database } from "bun:sqlite";
+import { expect, test } from "bun:test";
+
+test("migration 232 preserves every token kind and adds agent-only tokens", async () => {
+  const db = new Database(":memory:");
+  try {
+    db.exec(await Bun.file("src/be/migrations/149_session_tokens.sql").text());
+    db.exec(await Bun.file("src/be/migrations/207_runtime_session_tokens.sql").text());
+    const seed = db.query(
+      `INSERT INTO session_tokens
+       (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, controllerId,
+        expiresAt, revokedAt, createdAt, lastUsedAt)
+       VALUES (?, ?, 'view', 'agent', ?, ?, ?, ?, '2030-01-01', NULL, '2025-01-01', '2025-12-01')`,
+    );
+    seed.run("acp", "acp", "task", null, null, null);
+    seed.run("runtime", "runtime", null, "runtime", null, null);
+    seed.run("child", "child", "task", null, "runtime", null);
+    seed.run("controller", "controller", null, null, null, "ctrl");
+    const before = db.query("SELECT * FROM session_tokens ORDER BY id").all();
+
+    db.exec(await Bun.file("src/be/migrations/232_agent_session_tokens.sql").text());
+
+    // prepare, not query: query() caches the statement and its pre-migration column list.
+    expect(db.prepare("SELECT * FROM session_tokens ORDER BY id").all()).toEqual(
+      before.map((row) => ({ ...(row as object), parentTokenId: null })),
+    );
+    const insert = db.query(
+      `INSERT INTO session_tokens
+       (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, controllerId,
+        parentTokenId, expiresAt)
+       VALUES (?, ?, 'view', 'agent', ?, ?, ?, ?, ?, '2030-01-01')`,
+    );
+    insert.run("worker", "worker", null, null, null, null, null);
+    insert.run("worker-child", "worker-child", "task", null, null, null, "worker");
+    expect(() => insert.run("mixed", "mixed", "task", "runtime", null, null, null)).toThrow();
+    expect(() =>
+      insert.run("two-parents", "two-parents", "task", null, "rt", null, "worker"),
+    ).toThrow();
+    expect(() =>
+      insert.run("runtime-parent-token", "runtime-parent-token", null, "rt", null, null, "worker"),
+    ).toThrow();
+    expect(() =>
+      insert.run("controller-parent", "controller-parent", null, null, null, "ctrl", "worker"),
+    ).toThrow();
+    expect(() =>
+      insert.run("agent-parent-runtime", "agent-parent-runtime", null, null, "rt", null, null),
+    ).toThrow();
+    expect(() =>
+      insert.run("agent-with-parent", "agent-with-parent", null, null, null, null, "worker"),
+    ).toThrow();
+    const indexes = db
+      .query<{ name: string }, []>("PRAGMA index_list(session_tokens)")
+      .all()
+      .map((row) => row.name);
+    for (const name of [
+      "idx_session_tokens_agentId",
+      "idx_session_tokens_runtimeId",
+      "idx_session_tokens_parentRuntimeId",
+      "idx_session_tokens_parentTokenId",
+    ]) {
+      expect(indexes).toContain(name);
+    }
+    expect(db.query("PRAGMA integrity_check").get()).toEqual({ integrity_check: "ok" });
+  } finally {
+    db.close();
+  }
+});

package/src/tests/rbac-engine.test.ts

@@ -105,6 +105,7 @@ const OPERATOR_OR_USER_VERBS: PermissionVerb[] = [
   "approval.respond",
   "runtime_controller.write",
   "runtime_pool.write",
+  "agent.token.manage",
 ];
 
 const LEAD_OR_OPERATOR_VERBS: PermissionVerb[] = ["models.catalog.write"];

package/src/tests/runtime-child-token-cleanup.test.ts

@@ -9,6 +9,7 @@ import { handleSessions } from "../http/sessions";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { ACPAdapter } from "../providers/acp-adapter";
 import { setRequestAuth } from "../utils/request-auth-context";
+import { ACP_SDK_PATH, serveFakeAcpAgent } from "./acp-fake-agent";
 import { listenOnFreePort } from "./test-net";
 import { CHILD_PROCESS_TEST_BUDGET_MS } from "./test-proc";
 
@@ -69,12 +70,11 @@ for (const setupFails of [false, true]) {
       const api = await startApi(resolveRevoke);
       const script = join(tmpdir(), `runtime-child-${crypto.randomUUID()}.ts`);
       const capture = `${script}.auth`;
-      const sdk = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
       await Bun.write(
         script,
         `
 import { Readable, Writable } from "node:stream";
-import { AgentSideConnection, PROTOCOL_VERSION, ndJsonStream } from ${JSON.stringify(sdk)};
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from ${JSON.stringify(ACP_SDK_PATH)};
 class Agent {
   async initialize() {
     return { protocolVersion: PROTOCOL_VERSION, agentCapabilities: { loadSession: false } };
@@ -89,7 +89,7 @@ class Agent {
   async prompt() { return { stopReason: "end_turn" }; }
   async cancel() {}
 }
-new AgentSideConnection(() => new Agent(), ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin)));
+${serveFakeAcpAgent("Agent")}
 `,
       );
       try {

package/src/tests/script-connections.test.ts

@@ -634,6 +634,10 @@ describe("script connections", () => {
       markMigrationApplied(database, "220_model_profiles.sql");
       // 227 alters inbox_item_state, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "227_inbox_item_state_last_read_at.sql");
+      // 231 indexes agent_tasks columns that this fixture's id-only agent_tasks lacks.
+      markMigrationApplied(database, "231_slack_tasks_last_updated_index.sql");
+      // 232 rebuilds session_tokens with the 207 columns, which this fixture skipped.
+      markMigrationApplied(database, "232_agent_session_tokens.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/session-route-posture.test.ts

@@ -25,6 +25,7 @@ import "../http/all-routes";
 import { handleActiveSessions } from "../http/active-sessions";
 import { handleApiKeys } from "../http/api-keys";
 import { handleApprovalRequests } from "../http/approval-requests";
+import { handleApps } from "../http/apps";
 import { handleContext } from "../http/context";
 import { handleCore } from "../http/core";
 import { handleEvents } from "../http/events";
@@ -76,6 +77,7 @@ const HANDLERS: Handler[] = [
   handleFs,
   handleActiveSessions,
   handleSessions,
+  handleApps,
   (req, res, segments, query) => handleApprovalRequests(req, res, segments, query),
   (req, res, segments, query) => handleApiKeys(req, res, segments, query),
   (req, res, segments, query) => handleScriptRuns(req, res, segments, query),

package/src/tests/skill-script-refs.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test";
+import { join, relative } from "node:path";
+import { SEED_SCRIPTS } from "../be/seed-scripts";
+
+// A shipped skill that tells agents to `script-run` a named script must name a
+// script this repo ships in SEED_SCRIPTS. Otherwise the skill works only on a
+// swarm that happens to hold that script in its catalog, and every other
+// deployment hits "Script not found" at that step.
+
+const REPO_ROOT = join(import.meta.dir, "../..");
+// Seeded skills, baked plugin commands/agents/skills, and public operator skills.
+const SKILL_DIRS = ["templates/skills", "plugin", "skills"].map((d) => join(REPO_ROOT, d));
+
+// `script-run name="x"` and the prose forms "`script-run` with name `x`" / "`script-run` on `x`".
+const REF_PATTERNS = [
+  /script-run\s+name=["']([a-z0-9][a-z0-9-]*)["']/g,
+  /`script-run`\s+(?:with\s+name|on)\s+`([a-z0-9][a-z0-9-]*)`/g,
+];
+
+function findScriptRefs(text: string): string[] {
+  const names = new Set<string>();
+  for (const re of REF_PATTERNS) {
+    for (const m of text.matchAll(re)) if (m[1]) names.add(m[1]);
+  }
+  return [...names];
+}
+
+async function collectRefs(): Promise<{ file: string; name: string }[]> {
+  const refs: { file: string; name: string }[] = [];
+  for (const dir of SKILL_DIRS) {
+    for await (const path of new Bun.Glob("**/*.md").scan({ cwd: dir, absolute: true })) {
+      const text = await Bun.file(path).text();
+      for (const name of findScriptRefs(text)) refs.push({ file: relative(REPO_ROOT, path), name });
+    }
+  }
+  return refs;
+}
+
+describe("shipped skills only script-run scripts the repo ships", () => {
+  test("the reference scanner matches each call form and ignores prose", () => {
+    expect(
+      findScriptRefs(
+        [
+          'Run `script-run name="internal-only-gate" scope="global" args=<draft>`.',
+          "Run `script-run` with name `boot-triage`.",
+          "Preview with `script-run` on `heartbeat-jev-gate`.",
+          "Seed scripts (`script-run` with `name` and `args`):",
+          "Inline `script-run` for a one-off.",
+        ].join("\n"),
+      ).sort(),
+    ).toEqual(["boot-triage", "heartbeat-jev-gate", "internal-only-gate"]);
+  });
+
+  test("every script-run name in a shipped skill is in SEED_SCRIPTS", async () => {
+    const refs = await collectRefs();
+    // Positive control: the scan must see heartbeat-runbook's boot-triage reference, or it is blind.
+    expect(refs.some((r) => r.name === "boot-triage")).toBe(true);
+
+    const shipped = new Set(SEED_SCRIPTS.map((s) => s.name));
+    const missing = refs.filter((r) => !shipped.has(r.name)).map((r) => `${r.file}: ${r.name}`);
+    expect(missing).toEqual([]);
+  });
+});

package/src/tests/slack-render-v2-query-plans.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  getDb,
+  getDbClient,
+  getResolvableDeferralOutcomes,
+  initDb,
+  recordSlackMessage,
+} from "../be/db";
+import { getSlackTasksMissingTree } from "../be/db/tasks/read";
+import { completeTask, startTask } from "../be/db/tasks/write";
+
+// Both queries run on every Slack watcher tick. The DB has no sqlite_stat1, so
+// the planner works from heuristics; these pin the plans that keep each tick
+// proportional to Slack rows instead of every task.
+
+async function capturedSql(run: () => Promise<unknown>): Promise<string> {
+  const client = getDbClient();
+  const seen: string[] = [];
+  const original = client.query.bind(client);
+  const spy = spyOn(client, "query").mockImplementation(((sql: string, params?: unknown[]) => {
+    seen.push(sql);
+    return original(sql, params);
+  }) as typeof client.query);
+  try {
+    await run();
+  } finally {
+    spy.mockRestore();
+  }
+  expect(seen).toHaveLength(1);
+  return seen[0]!;
+}
+
+function plan(sql: string, params: unknown[] = []): string {
+  return getDb()
+    .query<{ detail: string }, any[]>(`EXPLAIN QUERY PLAN ${sql}`)
+    .all(...params)
+    .map((row) => row.detail)
+    .join("\n");
+}
+
+async function deferredAsk(label: string, leadId: string) {
+  const ask = await createTaskExtended(`ask ${label}`, {
+    agentId: leadId,
+    source: "slack",
+    slackChannelId: `C_${label}`,
+    slackThreadTs: `${label}.0`,
+  });
+  await startTask(ask.id);
+  await completeTask(ask.id, "Checking back later", {
+    addTags: ["deferred"],
+    deferredAt: new Date().toISOString(),
+  });
+  const card = await recordSlackMessage({
+    contextKey: `slack:C_${label}:${label}.0`,
+    channelId: `C_${label}`,
+    threadTs: `${label}.0`,
+    ts: `${label}.1`,
+    kind: "outcome",
+    taskId: ask.id,
+    finalized: true,
+  });
+  return { ask, card };
+}
+
+async function wake(parentTaskId: string, leadId: string, opts: { deferAgain?: boolean } = {}) {
+  await Bun.sleep(2);
+  const task = await createTaskExtended("wake", {
+    agentId: leadId,
+    parentTaskId,
+    taskType: "deferred",
+  });
+  await startTask(task.id);
+  await completeTask(
+    task.id,
+    "done",
+    opts.deferAgain ? { deferredAt: new Date().toISOString() } : {},
+  );
+  return task;
+}
+
+describe("slack render-v2 watcher queries", () => {
+  beforeEach(() => {
+    initDb(":memory:");
+    getDb().run(
+      "INSERT OR IGNORE INTO slack_render_v2_state (id, activated_at) VALUES (1, '2000-01-01T00:00:00.000Z')",
+    );
+  });
+
+  afterEach(() => {
+    closeDb();
+  });
+
+  test("deferral resolution drives from the chain, not from every task", async () => {
+    const sql = await capturedSql(() => getResolvableDeferralOutcomes());
+    const detail = plan(sql, [50]);
+    expect(detail).toContain(
+      "SEARCH wake USING INDEX idx_agent_tasks_parentTaskId (parentTaskId=?)",
+    );
+    expect(detail).not.toContain("idx_agent_tasks_taskType");
+    expect(detail).not.toContain("idx_agent_tasks_status_last_updated");
+  });
+
+  test("missing-tree scan reads only Slack tasks", async () => {
+    const sql = await capturedSql(() => getSlackTasksMissingTree());
+    const detail = plan(sql);
+    expect(detail).toContain("SCAN task USING INDEX idx_agent_tasks_slack_last_updated");
+    expect(detail).not.toContain("idx_agent_tasks_last_updated");
+  });
+
+  test("deferral resolution returns the latest terminal wake of each open chain", async () => {
+    const lead = await createAgent({ name: "Plan Lead", isLead: true, status: "idle" });
+
+    const single = await deferredAsk("SINGLE", lead.id);
+    const singleWake = await wake(single.ask.id, lead.id);
+
+    const chained = await deferredAsk("CHAIN", lead.id);
+    const firstWake = await wake(chained.ask.id, lead.id, { deferAgain: true });
+    const lastWake = await wake(firstWake.id, lead.id);
+
+    const pending = await deferredAsk("PENDING", lead.id);
+    const running = await createTaskExtended("still running", {
+      agentId: lead.id,
+      parentTaskId: pending.ask.id,
+      taskType: "deferred",
+    });
+    await startTask(running.id);
+
+    const plainChild = await deferredAsk("PLAIN", lead.id);
+    const notDeferred = await createTaskExtended("ordinary child", {
+      agentId: lead.id,
+      parentTaskId: plainChild.ask.id,
+    });
+    await startTask(notDeferred.id);
+    await completeTask(notDeferred.id, "done");
+
+    const rows = await getResolvableDeferralOutcomes();
+    expect(rows.map((row) => [row.card.id, row.deferredTaskId, row.wakeTaskId]).sort()).toEqual(
+      [
+        [single.card.id, single.ask.id, singleWake.id],
+        [chained.card.id, chained.ask.id, lastWake.id],
+      ].sort(),
+    );
+  });
+});

package/src/tests/worker-token-cli.test.ts

@@ -0,0 +1,76 @@
+import { expect, test } from "bun:test";
+import { parseWorkerTokenArgs, runWorkerToken } from "../commands/worker-token";
+
+const env = { MCP_BASE_URL: "http://swarm.test", AGENT_SWARM_API_KEY: "operator-key-for-test" };
+
+function fakeFetch(agents: { id: string; name: string }[]) {
+  const calls: { url: string; method: string; body?: unknown }[] = [];
+  const impl = (async (url: string, init?: RequestInit) => {
+    calls.push({
+      url,
+      method: init?.method ?? "GET",
+      body: init?.body ? JSON.parse(String(init.body)) : undefined,
+    });
+    if (url.endsWith("/api/agents")) return Response.json({ agents });
+    if (init?.method === "DELETE") return Response.json({ revoked: 1 });
+    return Response.json({ plaintext: "minted-value", expiresAt: null, agentCreated: true });
+  }) as unknown as typeof fetch;
+  return { calls, impl };
+}
+
+function capture() {
+  const out: string[] = [];
+  const err: string[] = [];
+  return { out, err, stdout: (l: string) => out.push(l), stderr: (l: string) => err.push(l) };
+}
+
+test("argument parsing requires one action and exactly one agent selector", () => {
+  expect(parseWorkerTokenArgs(["create", "--name", "w"]).error).toBeUndefined();
+  expect(parseWorkerTokenArgs(["create"]).error).toContain("exactly one");
+  expect(parseWorkerTokenArgs(["create", "--name", "w", "--agent-id", "a"]).error).toContain(
+    "exactly one",
+  );
+  expect(parseWorkerTokenArgs(["--name", "w"]).error).toContain("Missing action");
+  expect(parseWorkerTokenArgs(["create", "--name", "w", "--ttl-days", "0"]).error).toContain(
+    "--ttl-days",
+  );
+  expect(parseWorkerTokenArgs(["create", "--bogus"]).error).toContain("Unknown argument");
+});
+
+test("create by an unused name makes the agent and prints only the token to stdout", async () => {
+  const { calls, impl } = fakeFetch([]);
+  const io = capture();
+  const code = await runWorkerToken(["create", "--name", "w1", "--ttl-days", "2"], {
+    env,
+    fetch: impl,
+    ...io,
+  });
+  expect(code).toBe(0);
+  expect(io.out).toEqual(["minted-value"]);
+  expect(io.err.join("\n")).not.toContain("minted-value");
+  const mint = calls[1]!;
+  expect(mint.method).toBe("POST");
+  expect(mint.url).toMatch(/^http:\/\/swarm\.test\/api\/agents\/[0-9a-f-]{36}\/token$/);
+  expect(mint.body).toEqual({ name: "w1", ttlMs: 2 * 86_400_000 });
+});
+
+test("rotate and revoke resolve an existing name; an ambiguous name fails", async () => {
+  const agents = [{ id: "agent-1", name: "w1" }];
+  for (const [action, method, suffix] of [
+    ["rotate", "POST", "/rotate"],
+    ["revoke", "DELETE", ""],
+  ] as const) {
+    const { calls, impl } = fakeFetch(agents);
+    expect(await runWorkerToken([action, "--name", "w1"], { env, fetch: impl, ...capture() })).toBe(
+      0,
+    );
+    expect(calls[1]).toMatchObject({
+      method,
+      url: `http://swarm.test/api/agents/agent-1/token${suffix}`,
+    });
+  }
+  const { impl } = fakeFetch([...agents, { id: "agent-2", name: "w1" }]);
+  const io = capture();
+  expect(await runWorkerToken(["rotate", "--name", "w1"], { env, fetch: impl, ...io })).toBe(1);
+  expect(io.err.join("\n")).toContain("Several agents");
+});

package/src/tests/workflow-executors.test.ts

@@ -984,7 +984,7 @@ describe("ValidateExecutor", () => {
 // ─── Registry Wiring ─────────────────────────────────────────
 
 describe("createExecutorRegistry", () => {
-  test("registers all 14 executors (9 instant + 5 async)", () => {
+  test("registers all 15 executors (10 instant + 5 async)", () => {
     const registry = createExecutorRegistry(mockDeps);
     const types = registry.types();
 
@@ -993,6 +993,7 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("notify");
     expect(types).toContain("raw-llm");
     expect(types).toContain("system-one-decision");
+    expect(types).toContain("system-one-extraction");
     expect(types).toContain("script");
     expect(types).toContain("swarm-script");
     expect(types).toContain("vcs");
@@ -1002,7 +1003,7 @@ describe("createExecutorRegistry", () => {
     expect(types).toContain("human-in-the-loop");
     expect(types).toContain("wait");
     expect(types).toContain("sub-workflow");
-    expect(types).toHaveLength(14);
+    expect(types).toHaveLength(15);
   });
 
   test("instant executors have mode instant, async executors have mode async", () => {
@@ -1012,6 +1013,7 @@ describe("createExecutorRegistry", () => {
       "code-match",
       "notify",
       "raw-llm",
+      "system-one-extraction",
       "script",
       "swarm-script",
       "vcs",