@desplega.ai/agent-swarm 2.4.3 → 2.4.5

package/src/tests/script-runs-http.test.ts

@@ -11,6 +11,7 @@ import {
   getDbClient,
   getLatestScriptRunStepTaskByContextKey,
   getLatestTaskByContextKey,
+  getPendingTaskForAgent,
   initDb,
   updateScriptRun,
 } from "../be/db";
@@ -20,6 +21,7 @@ import { handleScriptRuns } from "../http/script-runs";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { localProcessScriptExecutor } from "../script-workflows/executor";
 import { setScriptRunExecutor } from "../script-workflows/supervisor";
+import type { AgentTask } from "../types";
 import {
   clearVolatileSecretsForTesting,
   refreshSecretScrubberCache,
@@ -537,6 +539,88 @@ describe("/api/script-runs HTTP", () => {
     });
   });
 
+  async function dispatchStepFor(
+    stepKey: string,
+    stepAgentId: string,
+    extra: Record<string, unknown> = {},
+  ): Promise<{ response: Promise<TestResponse>; task: AgentTask }> {
+    const created = await dispatch("/api/script-runs", {
+      method: "POST",
+      agentId,
+      body: createBody(),
+    });
+    const { id: runId } = (await created.json()) as { id: string };
+    const response = dispatch(`/api/internal/script-runs/${runId}/agent-task`, {
+      method: "POST",
+      agentId,
+      body: JSON.stringify({ stepKey, task: `do ${stepKey}`, agentId: stepAgentId, ...extra }),
+    });
+    const contextKey = `script-run:${runId}:${stepKey}`;
+    let task = await getLatestScriptRunStepTaskByContextKey(contextKey);
+    for (let i = 0; i < 50 && !task; i++) {
+      await Bun.sleep(20);
+      task = await getLatestScriptRunStepTaskByContextKey(contextKey);
+    }
+    expect(task).not.toBeNull();
+    return { response, task: task! };
+  }
+
+  test("agent-task dispatch persists dependsOn and holds the task until the dependency completes", async () => {
+    const stepAgent = await createAgent({
+      name: "deps-step-worker",
+      isLead: false,
+      status: "idle",
+    });
+    const dependency = await createTaskExtended("upstream fix", { source: "mcp" });
+
+    const { response, task } = await dispatchStepFor("after-fix", stepAgent.id, {
+      dependsOn: [dependency.id],
+    });
+
+    expect(task.dependsOn).toEqual([dependency.id]);
+    expect(await getPendingTaskForAgent(stepAgent.id)).toBeNull();
+
+    await completeTask(dependency.id, "fixed");
+    expect((await getPendingTaskForAgent(stepAgent.id))?.id).toBe(task.id);
+
+    await completeTask(task.id, "done");
+    expect((await response).status).toBe(200);
+  });
+
+  test("agent-task dispatch without dependsOn is startable at once", async () => {
+    const stepAgent = await createAgent({
+      name: "no-deps-step-worker",
+      isLead: false,
+      status: "idle",
+    });
+
+    const { response, task } = await dispatchStepFor("no-deps", stepAgent.id);
+
+    expect(task.dependsOn).toEqual([]);
+    expect((await getPendingTaskForAgent(stepAgent.id))?.id).toBe(task.id);
+
+    await completeTask(task.id, "done");
+    expect((await response).status).toBe(200);
+  });
+
+  test("agent-task dispatch rejects a dependsOn entry that is not a task UUID", async () => {
+    const created = await dispatch("/api/script-runs", {
+      method: "POST",
+      agentId,
+      body: createBody(),
+    });
+    const { id: runId } = (await created.json()) as { id: string };
+
+    const response = await dispatch(`/api/internal/script-runs/${runId}/agent-task`, {
+      method: "POST",
+      agentId,
+      body: JSON.stringify({ stepKey: "bad-deps", task: "x", dependsOn: ["not-a-uuid"] }),
+    });
+
+    expect(response.status).toBe(400);
+    expect(await getLatestScriptRunStepTaskByContextKey(`script-run:${runId}:bad-deps`)).toBeNull();
+  });
+
   test("agent-task polling returns the step output when a newer completed follow-up shares its context key", async () => {
     const created = await dispatch("/api/script-runs", {
       method: "POST",

package/src/tests/scripts-http.test.ts

@@ -785,6 +785,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
         missingIsUndefined: ctx.swarm.config.get("SCRIPT_CFG_NOT_SET") === undefined,
         fallback: read("SCRIPT_CFG_NOT_SET") ?? "fallback",
         apiOnly: read("SLACK_SIGNING_SECRET"),
+        transcriptionKey: read("TRANSCRIPTION_API_KEY"),
         proto: read("__proto__"),
       };
     };`;
@@ -798,6 +799,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
     missingIsUndefined: boolean;
     fallback: string;
     apiOnly: string | null;
+    transcriptionKey: string | null;
     proto: string | null;
   };
 
@@ -829,11 +831,17 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
       value: `signing-${randomToken(24)}`,
       isSecret: true,
     });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "TRANSCRIPTION_API_KEY",
+      value: `stt-${randomToken(24)}`,
+      isSecret: true,
+    });
   });
 
   afterAll(async () => {
     await getDbClient().run(
-      "DELETE FROM swarm_config WHERE key LIKE 'SCRIPT_CFG_%' OR key IN ('SLACK_SIGNING_SECRET', '__proto__')",
+      "DELETE FROM swarm_config WHERE key LIKE 'SCRIPT_CFG_%' OR key IN ('SLACK_SIGNING_SECRET', 'TRANSCRIPTION_API_KEY', '__proto__')",
     );
     clearVolatileSecretsForTesting();
   });
@@ -862,6 +870,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
         missingIsUndefined: true,
         fallback: "fallback",
         apiOnly: null,
+        transcriptionKey: null,
         proto: "proto-global",
       });
       // The unwrapped secret is scrubbed from everything the run returns.

package/src/tests/session-route-posture.test.ts

@@ -25,6 +25,7 @@ import "../http/all-routes";
 import { handleActiveSessions } from "../http/active-sessions";
 import { handleApiKeys } from "../http/api-keys";
 import { handleApprovalRequests } from "../http/approval-requests";
+import { handleApps } from "../http/apps";
 import { handleContext } from "../http/context";
 import { handleCore } from "../http/core";
 import { handleEvents } from "../http/events";
@@ -76,6 +77,7 @@ const HANDLERS: Handler[] = [
   handleFs,
   handleActiveSessions,
   handleSessions,
+  handleApps,
   (req, res, segments, query) => handleApprovalRequests(req, res, segments, query),
   (req, res, segments, query) => handleApiKeys(req, res, segments, query),
   (req, res, segments, query) => handleScriptRuns(req, res, segments, query),

package/src/tests/swarm-config-export-to-env.test.ts

@@ -7,7 +7,11 @@ import { closeDb, createAgent, getSwarmConfigs, initDb, upsertSwarmConfig } from
 import { handleConfig } from "../http/config";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { registerSetConfigTool } from "../tools/swarm-config/set-config";
-import { ENV_EXPORT_RESTRICTED_KEYS, envExportRestrictedError } from "../utils/config-env-export";
+import {
+  ENV_EXPORT_RESTRICTED_KEYS,
+  effectiveExportToEnv,
+  envExportRestrictedError,
+} from "../utils/config-env-export";
 import { setRequestAuth } from "../utils/request-auth-context";
 import { clearVolatileSecretsForTesting } from "../utils/secret-scrubber";
 import { listenOnFreePort } from "./test-net";
@@ -153,6 +157,16 @@ describe("swarm_config exportToEnv", () => {
     expect(row?.exportToEnv).toBe(false);
   });
 
+  test("the speech-to-text key never exports, even from an older stored true", async () => {
+    const key = "TRANSCRIPTION_API_KEY";
+    const stored = await upsertSwarmConfig({ scope: "global", key, value: "t", isSecret: true });
+    expect(stored.exportToEnv).toBe(false);
+    await expect(
+      upsertSwarmConfig({ scope: "global", key, value: "t", isSecret: true, exportToEnv: true }),
+    ).rejects.toThrow(envExportRestrictedError(key));
+    expect(effectiveExportToEnv(key, true)).toBe(false);
+  });
+
   test("the config API and /api/config/resolved carry the flag", async () => {
     const put = await fetch(`${baseUrl}/api/config`, {
       method: "PUT",
@@ -231,6 +245,11 @@ describe("migration 215", () => {
     "X_CLIENT_SECRET",
     "connection.example.secret",
   ];
+  // Restricted after migration 215 shipped. Row readers force the flag off
+  // (effectiveExportToEnv), so an older stored true never reaches an agent.
+  const RESTRICTED_AT_215 = [...ENV_EXPORT_RESTRICTED_KEYS].filter(
+    (key) => key !== "TRANSCRIPTION_API_KEY",
+  );
 
   test("backfills true and turns off only the deny list", () => {
     const db = new Database(":memory:");
@@ -243,7 +262,7 @@ describe("migration 215", () => {
       const insert = db.prepare(
         "INSERT INTO swarm_config (id, scope, key, value, isSecret, createdAt, lastUpdatedAt) VALUES (?, 'global', ?, 'v', 1, 'now', 'now')",
       );
-      const keys = [...MUST_STAY_EXPORTED, ...DENY_ONLY, ...ENV_EXPORT_RESTRICTED_KEYS];
+      const keys = [...MUST_STAY_EXPORTED, ...DENY_ONLY, ...RESTRICTED_AT_215];
       for (const key of keys) insert.run(crypto.randomUUID(), key);
 
       db.exec(readFileSync(MIGRATION, "utf8"));
@@ -257,7 +276,7 @@ describe("migration 215", () => {
           .map((row) => [row.key, row.exportToEnv]),
       );
       for (const key of MUST_STAY_EXPORTED) expect([key, flags[key]]).toEqual([key, 1]);
-      for (const key of [...DENY_ONLY, ...ENV_EXPORT_RESTRICTED_KEYS]) {
+      for (const key of [...DENY_ONLY, ...RESTRICTED_AT_215]) {
         expect([key, flags[key]]).toEqual([key, 0]);
       }
     } finally {

package/src/tests/task-audio-transcription.test.ts

@@ -0,0 +1,299 @@
+/**
+ * Audio a user sends from the sessions UI or Slack gets its transcript in the
+ * task text, through the same `transcribeAudio` helper as the Chat SDK path.
+ * No provider configured, or a failed call: one line says so and the task is
+ * still created.
+ */
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtemp, rm, unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  getTaskAttachments,
+  getTaskById,
+  initDb,
+} from "../be/db";
+import { resetFileStorageProviderForTests } from "../fs/registry";
+import { handleCore } from "../http/core";
+import { handleFs } from "../http/fs";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import type { SlackFile } from "../slack/files";
+import {
+  buildEffectiveText,
+  createSlackTaskWithFiles,
+  fetchSlackFiles,
+} from "../slack/inbound-files";
+import { NOT_TRANSCRIBED_NOTE, TRANSCRIPTION_ENV_KEYS } from "../utils/transcription";
+import { listenOnFreePort } from "./test-net";
+
+const TEST_DB_PATH = "./test-task-audio-transcription.sqlite";
+const API_KEY = "example-task-audio-key";
+const BOT_TOKEN = "example-task-audio-slack-token";
+const AUDIO = new Uint8Array([0x1a, 0x45, 0xdf, 0xa3, 1, 2, 3, 4, 5]);
+const NO_PROVIDER = NOT_TRANSCRIBED_NOTE;
+const savedEnv = new Map(TRANSCRIPTION_ENV_KEYS.map((key) => [key, process.env[key]]));
+
+let api: Server;
+let apiPort: number;
+let slackHost: ReturnType<typeof Bun.serve>;
+let stt: ReturnType<typeof Bun.serve>;
+let sttMode: "ok" | "fail" = "ok";
+let sttFilenames: string[] = [];
+let fsDir: string;
+let agentId: string;
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) await unlink(TEST_DB_PATH + suffix).catch(() => {});
+}
+
+function useTranscription(): void {
+  process.env.TRANSCRIPTION_API_KEY = "stt-task-audio-key";
+  process.env.TRANSCRIPTION_BASE_URL = `http://127.0.0.1:${stt.port}/v1`;
+}
+
+beforeAll(async () => {
+  await removeDbFiles();
+  fsDir = await mkdtemp(join(tmpdir(), "task-audio-"));
+  process.env.AGENT_FS_LOCAL_DIR = fsDir;
+  delete process.env.AGENT_FS_API_URL;
+  resetFileStorageProviderForTests();
+  initDb(TEST_DB_PATH);
+
+  stt = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(req) {
+      const file = (await req.formData()).get("file") as File;
+      sttFilenames.push(file.name);
+      if (sttMode === "fail") {
+        return Response.json({ error: { message: "upstream overloaded" } }, { status: 503 });
+      }
+      return Response.json({ text: " Ship the release notes today. " });
+    },
+  });
+  slackHost = Bun.serve({
+    port: 0,
+    fetch: (req) =>
+      req.headers.get("authorization") === `Bearer ${BOT_TOKEN}`
+        ? new Response(AUDIO, { headers: { "content-type": "audio/webm" } })
+        : new Response("forbidden", { status: 403 }),
+  });
+  api = createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    if (await handleCore(req, res, myAgentId, API_KEY)) return;
+    const ok = await handleFs(
+      req,
+      res,
+      getPathSegments(req.url || ""),
+      parseQueryParams(req.url || ""),
+      myAgentId,
+    );
+    if (!ok) {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  });
+  apiPort = await listenOnFreePort(api);
+  agentId = (await createAgent({ name: "task-audio-lead", isLead: true, status: "idle" })).id;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => api.close(() => resolve()));
+  stt.stop(true);
+  slackHost.stop(true);
+  closeDb();
+  await removeDbFiles();
+  await rm(fsDir, { recursive: true, force: true });
+  delete process.env.AGENT_FS_LOCAL_DIR;
+  resetFileStorageProviderForTests();
+  for (const [key, value] of savedEnv) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(() => {
+  sttMode = "ok";
+  sttFilenames = [];
+  // A provider key in the shell (OPENAI_API_KEY, ...) would switch transcription on.
+  for (const key of TRANSCRIPTION_ENV_KEYS) delete process.env[key];
+});
+
+/** The composer's upload: raw body, `name` query, the file's own content type. */
+function upload(taskId: string, name: string, contentType: string): Promise<Response> {
+  return fetch(
+    `http://localhost:${apiPort}/api/fs/tasks/${taskId}/files?name=${encodeURIComponent(name)}&intent=user-upload`,
+    {
+      method: "POST",
+      body: AUDIO,
+      headers: { Authorization: `Bearer ${API_KEY}`, "Content-Type": contentType },
+    },
+  );
+}
+
+async function draftTask(text: string): Promise<string> {
+  return (await createTaskExtended(text, { agentId, source: "ui", status: "draft" })).id;
+}
+
+describe("sessions UI upload", () => {
+  test("a recorded webm clip uploaded to a draft puts its transcript in the task text", async () => {
+    useTranscription();
+    const taskId = await draftTask("what did I say?");
+
+    // What the composer's mic button uploads in Chrome and Firefox.
+    const name = "recording-2026-10-21-143005.webm";
+    const res = await upload(taskId, name, "audio/webm;codecs=opus");
+
+    expect(res.status).toBe(201);
+    expect(sttFilenames).toEqual([name]);
+    expect((await getTaskById(taskId))!.task).toBe(
+      `what did I say?\n\n[File: ${name} (audio/webm)]\n[Transcript of ${name}]\nShip the release notes today.`,
+    );
+    expect(await getTaskAttachments(taskId)).toHaveLength(1);
+  });
+
+  test("parallel audio uploads each keep their block", async () => {
+    useTranscription();
+    const taskId = await draftTask("two notes");
+
+    const responses = await Promise.all([
+      upload(taskId, "a.m4a", "audio/mp4"),
+      upload(taskId, "b.m4a", "audio/mp4"),
+    ]);
+
+    expect(responses.map((r) => r.status)).toEqual([201, 201]);
+    const text = (await getTaskById(taskId))!.task;
+    expect(text).toContain("[Transcript of a.m4a]");
+    expect(text).toContain("[Transcript of b.m4a]");
+  });
+
+  test("without a transcription provider the task gets one line saying so", async () => {
+    const taskId = await draftTask("listen to this");
+
+    const res = await upload(taskId, "memo.ogg", "audio/ogg");
+
+    expect(res.status).toBe(201);
+    expect(sttFilenames).toEqual([]);
+    expect((await getTaskById(taskId))!.task).toBe(
+      `listen to this\n\n[File: memo.ogg (audio/ogg)]\n${NO_PROVIDER}`,
+    );
+  });
+
+  test("a failed transcription still stores the upload and says why", async () => {
+    useTranscription();
+    sttMode = "fail";
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    const taskId = await draftTask("listen to this");
+    try {
+      const res = await upload(taskId, "memo.ogg", "audio/ogg");
+      expect(res.status).toBe(201);
+    } finally {
+      warn.mockRestore();
+    }
+
+    expect((await getTaskById(taskId))!.task).toContain(
+      "[File: memo.ogg (audio/ogg)]\n(transcription failed: upstream overloaded)",
+    );
+    expect(await getTaskAttachments(taskId)).toHaveLength(1);
+  });
+
+  test("a task out of draft and a non-audio file are left as they are", async () => {
+    useTranscription();
+    const running = (await createTaskExtended("already dispatched", { agentId, source: "ui" })).id;
+    const draft = await draftTask("a picture");
+
+    expect((await upload(running, "late.ogg", "audio/ogg")).status).toBe(201);
+    expect((await upload(draft, "shot.png", "image/png")).status).toBe(201);
+
+    expect(sttFilenames).toEqual([]);
+    expect((await getTaskById(running))!.task).toBe("already dispatched");
+    expect((await getTaskById(draft))!.task).toBe("a picture");
+  });
+});
+
+describe("Slack inbound files", () => {
+  function slackFile(id: string, name: string, extra: Partial<SlackFile> = {}): SlackFile {
+    return {
+      id,
+      name,
+      mimetype: "audio/webm",
+      filetype: "webm",
+      size: AUDIO.byteLength,
+      url_private: `${slackHost.url}files-pri/T0TEAM-${id}/${name}`,
+      url_private_download: `${slackHost.url}files-pri/T0TEAM-${id}/download/${name}`,
+      ...extra,
+    };
+  }
+  const client = { token: BOT_TOKEN } as never;
+
+  /** What the Slack handlers do: fetch, build the task text, create the task. */
+  async function slackTask(text: string, files: SlackFile[]) {
+    await using inbound = await fetchSlackFiles(client, files, { transcribe: true });
+    const description = buildEffectiveText(text, inbound.files, inbound.failed, inbound.notes);
+    return (await createSlackTaskWithFiles(description, { agentId, source: "slack" }, inbound))
+      .task;
+  }
+
+  test("a voice clip gets its transcript under its file line and stays attached", async () => {
+    useTranscription();
+    // Slack voice clips are `slack_audio`, whatever their MIME type says.
+    const clip = slackFile("F0CLIP0001", "audio_message.mp4", {
+      mimetype: "video/mp4",
+      subtype: "slack_audio",
+    });
+
+    const task = await slackTask("please do this", [clip]);
+
+    expect(task.task).toBe(
+      `please do this\n\n[File: audio_message.mp4 (video/mp4, 9 B) id=F0CLIP0001]\n[Transcript of audio_message.mp4]\nShip the release notes today.`,
+    );
+    expect((await getTaskById(task.id))!.status).toBe("pending");
+    expect(await getTaskAttachments(task.id)).toHaveLength(1);
+  });
+
+  test("an audio file without a provider gets one line saying so", async () => {
+    const task = await slackTask("", [slackFile("F0AUDIO002", "memo.webm")]);
+
+    expect(task.task).toBe(`[File: memo.webm (audio/webm, 9 B) id=F0AUDIO002]\n${NO_PROVIDER}`);
+    expect(sttFilenames).toEqual([]);
+    expect(await getTaskAttachments(task.id)).toHaveLength(1);
+  });
+
+  test("a failed transcription never blocks the task", async () => {
+    useTranscription();
+    sttMode = "fail";
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    let task: Awaited<ReturnType<typeof slackTask>>;
+    try {
+      task = await slackTask("hi", [slackFile("F0AUDIO003", "memo.webm")]);
+    } finally {
+      warn.mockRestore();
+    }
+
+    expect(task.task).toContain(
+      "[File: memo.webm (audio/webm, 9 B) id=F0AUDIO003]\n(transcription failed: upstream overloaded)",
+    );
+    expect((await getTaskById(task.id))!.status).toBe("pending");
+  });
+
+  test("an agent's own file fetch and non-audio files are not transcribed", async () => {
+    useTranscription();
+    await using fetched = await fetchSlackFiles(client, [slackFile("F0AUDIO004", "memo.webm")]);
+    expect(fetched.notes).toBeUndefined();
+
+    const task = await slackTask("see image", [
+      slackFile("F0IMAGE005", "shot.png", { mimetype: "image/png", filetype: "png" }),
+    ]);
+    expect(task.task).not.toContain("Transcript");
+    expect(sttFilenames).toEqual([]);
+  });
+});