@desplega.ai/agent-swarm 2.4.4 → 2.5.0

package/src/tests/realtime-transport.test.ts

@@ -75,9 +75,11 @@ async function createPage(
 async function launchPage(pageId: string, agentId: string): Promise<string> {
   const response = await api("POST", `/api/pages/${pageId}/launch`, { agentId });
   expect(response.status).toBe(204);
-  const cookie = response.headers.get("set-cookie")?.match(/page_session=([^;]+)/)?.[1];
+  const cookie = response.headers
+    .get("set-cookie")
+    ?.match(/page_session_[A-Za-z0-9_-]+=([^;]+)/)?.[1];
   expect(cookie).toBeTruthy();
-  return `page_session=${cookie}`;
+  return `page_session_${pageId}=${cookie}`;
 }
 
 async function createUserToken(name: string): Promise<{ id: string; token: string }> {
@@ -107,17 +109,21 @@ async function launchPageAsUser(pageId: string, token: string): Promise<string>
     headers: { Authorization: `Bearer ${token}` },
   });
   expect(response.status).toBe(204);
-  const cookie = response.headers.get("set-cookie")?.match(/page_session=([^;]+)/)?.[1];
+  const cookie = response.headers
+    .get("set-cookie")
+    ?.match(/page_session_[A-Za-z0-9_-]+=([^;]+)/)?.[1];
   expect(cookie).toBeTruthy();
-  return `page_session=${cookie}`;
+  return `page_session_${pageId}=${cookie}`;
 }
 
 async function unlockPasswordPage(pageId: string, password: string): Promise<string> {
   const response = await fetch(`${baseUrl}/p/${pageId}?key=${encodeURIComponent(password)}`);
   expect(response.status).toBe(200);
-  const cookie = response.headers.get("set-cookie")?.match(/page_session=([^;]+)/)?.[1];
+  const cookie = response.headers
+    .get("set-cookie")
+    ?.match(/page_session_[A-Za-z0-9_-]+=([^;]+)/)?.[1];
   expect(cookie).toBeTruthy();
-  return `page_session=${cookie}`;
+  return `page_session_${pageId}=${cookie}`;
 }
 
 function openSocket(
@@ -443,7 +449,7 @@ describe("realtime transport", () => {
     const passwordPage = await createPage(agentId, "password", "secret");
     expect(await socketAccepted({ Origin: baseUrl }, pageSocketUrl(passwordPage))).toBe(false);
     const passwordCookie = await unlockPasswordPage(passwordPage, "secret");
-    expect(passwordCookie).toContain("page_session=");
+    expect(passwordCookie).toContain("page_session_");
   });
 
   test("persists room state across an API restart and cascades page deletion", async () => {

package/src/tests/run-root-coverage.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { mergeLcov } from "../../scripts/run-root-coverage";
+
+describe("mergeLcov", () => {
+  test("disjoint function hits remain a conservative lower bound without FN/FNDA identities", () => {
+    // a.test.ts calls a(); b.test.ts calls b() in the same two-function module.
+    const report = "SF:src/example.ts\nFNF:2\nFNH:1\nend_of_record\n";
+    const merged = mergeLcov([report, report]);
+
+    expect(merged).toContain("FNF:2\nFNH:1\n");
+  });
+
+  test("DA hits sum across reports and LH counts lines hit in any report", () => {
+    const merged = mergeLcov([
+      "SF:src/example.ts\nDA:1,2\nDA:2,0\nDA:3,0\nend_of_record\n",
+      "SF:src/example.ts\nDA:1,3\nDA:2,1\nDA:3,0\nend_of_record\n",
+    ]);
+
+    expect(merged).toBe(
+      "TN:\nSF:src/example.ts\nFNF:0\nFNH:0\nDA:1,5\nDA:2,1\nDA:3,0\nLF:3\nLH:2\nend_of_record\n",
+    );
+  });
+
+  test("FNH never exceeds FNF when merging function totals", () => {
+    const reports = [
+      "SF:src/example.ts\nFNF:2\nFNH:2\nend_of_record\n",
+      "SF:src/example.ts\nFNF:3\nFNH:1\nend_of_record\n",
+    ];
+    for (const inputs of [reports, reports.toReversed(), [...reports, ...reports]]) {
+      const merged = mergeLcov(inputs);
+      const found = Number(merged.match(/^FNF:(\d+)$/m)![1]);
+      const hit = Number(merged.match(/^FNH:(\d+)$/m)![1]);
+
+      expect(found).toBe(3);
+      expect(hit).toBe(2);
+      expect(hit).toBeLessThanOrEqual(found);
+    }
+  });
+});

package/src/tests/runner-bitbucket-vcs.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Worker-side Bitbucket PR linking. There is no Bitbucket CLI in the worker
+ * image, so `detectVcsForTask` asks the Bitbucket REST API (via `fetch`) for an
+ * open PR on the current branch and PATCHes `/api/tasks/:id/vcs` when it finds
+ * one. Both calls go through `globalThis.fetch`, which these tests stub, so no
+ * server or port is involved. The git side runs against a real temp repo.
+ */
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { detectVcsForTask, findBitbucketOpenPullRequest } from "../commands/runner";
+import { expectChildOk, runChild } from "./test-proc";
+
+const API_URL = "http://swarm.invalid";
+const BRANCH = "feature/bb-link";
+const PR_HTML = "https://bitbucket.org/acme-ws/web.app/pull-requests/17";
+
+type Call = { url: string; method: string; headers: Headers; body: string };
+type BitbucketReply = { status: number; body: unknown } | "throw";
+
+const originalFetch = globalThis.fetch;
+const originalToken = process.env.BITBUCKET_TOKEN;
+let calls: Call[] = [];
+let bitbucketReply: BitbucketReply = { status: 200, body: { values: [] } };
+let repoDir = "";
+let taskSeq = 0;
+
+function nextTaskId(): string {
+  taskSeq += 1;
+  return `00000000-0000-4000-8000-${String(taskSeq).padStart(12, "0")}`;
+}
+
+async function git(args: string[]): Promise<void> {
+  expectChildOk(await runChild(["git", "-C", repoDir, ...args]), `git ${args.join(" ")}`);
+}
+
+function stubFetch(): void {
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    calls.push({
+      url,
+      method: init?.method ?? "GET",
+      headers: new Headers(init?.headers),
+      body: typeof init?.body === "string" ? init.body : "",
+    });
+    if (url.startsWith("https://api.bitbucket.org/")) {
+      if (bitbucketReply === "throw") throw new TypeError("network down");
+      return new Response(JSON.stringify(bitbucketReply.body), {
+        status: bitbucketReply.status,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    return new Response("{}", { status: 200, headers: { "Content-Type": "application/json" } });
+  }) as typeof fetch;
+}
+
+const bitbucketCalls = () => calls.filter((c) => c.url.startsWith("https://api.bitbucket.org/"));
+const patchCalls = () => calls.filter((c) => c.method === "PATCH");
+
+beforeAll(async () => {
+  repoDir = await mkdtemp(join(tmpdir(), "runner-bb-vcs-"));
+  await git(["init", "--quiet"]);
+  await git(["checkout", "--quiet", "-b", BRANCH]);
+  await git(["remote", "add", "origin", "https://bitbucket.org/acme-ws/web.app.git"]);
+});
+
+afterAll(async () => {
+  await rm(repoDir, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  calls = [];
+  bitbucketReply = { status: 200, body: { values: [] } };
+  process.env.BITBUCKET_TOKEN = "example-bb-token";
+  stubFetch();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  if (originalToken === undefined) delete process.env.BITBUCKET_TOKEN;
+  else process.env.BITBUCKET_TOKEN = originalToken;
+});
+
+describe("detectVcsForTask on a Bitbucket remote", () => {
+  test("an open PR for the branch links the task", async () => {
+    bitbucketReply = {
+      status: 200,
+      body: { values: [{ id: 17, links: { html: { href: PR_HTML } } }] },
+    };
+    const taskId = nextTaskId();
+    await detectVcsForTask(API_URL, "swarm-key", taskId, repoDir);
+
+    const [lookup] = bitbucketCalls();
+    expect(lookup).toBeDefined();
+    const lookupUrl = new URL(lookup!.url);
+    expect(lookupUrl.pathname).toBe("/2.0/repositories/acme-ws/web.app/pullrequests");
+    expect(lookupUrl.searchParams.get("q")).toBe(`source.branch.name="${BRANCH}" AND state="OPEN"`);
+    expect(lookupUrl.searchParams.get("pagelen")).toBe("1");
+    expect(lookup!.headers.get("authorization")).toBe("Bearer example-bb-token");
+
+    const patches = patchCalls();
+    expect(patches).toHaveLength(1);
+    expect(patches[0]!.url).toBe(`${API_URL}/api/tasks/${taskId}/vcs`);
+    expect(patches[0]!.headers.get("authorization")).toBe("Bearer swarm-key");
+    expect(JSON.parse(patches[0]!.body)).toEqual({
+      vcsProvider: "bitbucket",
+      vcsRepo: "acme-ws/web.app",
+      vcsNumber: 17,
+      vcsUrl: PR_HTML,
+    });
+  });
+
+  test("no open PR sends no PATCH", async () => {
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a non-200 answer is swallowed and sends no PATCH", async () => {
+    bitbucketReply = { status: 401, body: { type: "error", error: { message: "Unauthorized" } } };
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a network failure is swallowed and sends no PATCH", async () => {
+    bitbucketReply = "throw";
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("without BITBUCKET_TOKEN it calls nothing", async () => {
+    delete process.env.BITBUCKET_TOKEN;
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(calls).toHaveLength(0);
+  });
+});
+
+describe("findBitbucketOpenPullRequest", () => {
+  test("escapes quotes in the branch name inside the BBQL query", async () => {
+    let seen = "";
+    const fetchImpl = (async (input: string | URL | Request) => {
+      seen = String(input);
+      return new Response(JSON.stringify({ values: [] }), { status: 200 });
+    }) as typeof fetch;
+    await findBitbucketOpenPullRequest("git@bitbucket.org:ws/repo.git", 'we"ird', {
+      token: "t",
+      fetchImpl,
+    });
+    expect(new URL(seen).searchParams.get("q")).toBe(
+      'source.branch.name="we\\"ird" AND state="OPEN"',
+    );
+  });
+
+  test("rejects a reply without a numeric id or an html link", async () => {
+    for (const values of [
+      [{ id: "17", links: { html: { href: PR_HTML } } }],
+      [{ id: 17, links: {} }],
+      [{}],
+    ]) {
+      const fetchImpl = (async () =>
+        new Response(JSON.stringify({ values }), { status: 200 })) as unknown as typeof fetch;
+      expect(
+        await findBitbucketOpenPullRequest("https://bitbucket.org/ws/repo", "b", {
+          token: "t",
+          fetchImpl,
+        }),
+      ).toBeNull();
+    }
+  });
+
+  test("returns null for a non-Bitbucket remote without calling fetch", async () => {
+    let called = false;
+    const fetchImpl = (async () => {
+      called = true;
+      return new Response("{}");
+    }) as unknown as typeof fetch;
+    expect(
+      await findBitbucketOpenPullRequest("https://github.com/ws/repo", "b", {
+        token: "t",
+        fetchImpl,
+      }),
+    ).toBeNull();
+    expect(called).toBe(false);
+  });
+});

package/src/tests/runner-skills-refresh.test.ts

@@ -34,6 +34,9 @@ type StubState = {
   };
   calls: { signature: number; list: number; sync: number };
   skillFilesStatus: number;
+  /** 404 by default so the legacy list path stays covered; bundle tests opt in. */
+  bundleStatus: number;
+  bundleCalls: number;
 };
 
 const FAKE_HOME = join(tmpdir(), `runner-refresh-test-${process.pid}`);
@@ -67,6 +70,8 @@ const state: StubState = {
     signature: "hash-v1",
   },
   calls: { signature: 0, list: 0, sync: 0 },
+  bundleStatus: 404,
+  bundleCalls: 0,
 };
 
 let server: ReturnType<typeof Bun.serve> | null = null;
@@ -91,6 +96,22 @@ describe("refreshSkillsIfChanged", () => {
             generatedAt: new Date().toISOString(),
           });
         }
+        if (url.pathname.endsWith("/skills/bundle")) {
+          state.bundleCalls++;
+          if (state.bundleStatus !== 200) {
+            return new Response("not found", { status: state.bundleStatus });
+          }
+          return Response.json({
+            skills: state.skillsBody.skills.map((skill) => ({
+              ...skill,
+              files: skill.isComplex
+                ? [{ path: "refs/notes.md", content: "bundled note", isBinary: false }]
+                : [],
+            })),
+            total: state.skillsBody.skills.length,
+            signature: state.skillsBody.signature,
+          });
+        }
         if (url.pathname.match(/\/api\/agents\/[^/]+\/skills$/)) {
           state.calls.list++;
           if (state.listStatus !== 200) {
@@ -337,6 +358,43 @@ describe("refreshSkillsIfChanged", () => {
     rmSync(cleanHome, { recursive: true, force: true });
   });
 
+  test("bundle endpoint replaces the list call and the per-file fan-out", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.bundleCalls = 0;
+    state.bundleStatus = 200;
+    state.signatureHash = "hash-bundle";
+    state.skillsBody.signature = "hash-bundle";
+    state.skillsBody.skills = [
+      {
+        id: "skill-complex",
+        name: "complex-skill",
+        description: "has bundled files",
+        content: "---\nname: complex-skill\n---\n\nComplex body.",
+        isComplex: true,
+        isActive: true,
+        isEnabled: true,
+      },
+    ];
+
+    const home = join(FAKE_HOME, "bundle-home");
+    mkdirSync(home, { recursive: true });
+    const lastHash = { current: null as string | null };
+    const result = await refreshWithHome(makeCtx(), lastHash, home);
+
+    expect(result.changed).toBe(true);
+    expect(lastHash.current).toBe("hash-bundle");
+    // One signature probe + one bundle call. No list call, no manifest and no
+    // per-file fetches.
+    expect(state.bundleCalls).toBe(1);
+    expect(state.calls).toEqual({ signature: 1, list: 0, sync: 0 });
+    expect(
+      readFileSync(join(home, ".claude", "skills", "complex-skill", "refs", "notes.md"), "utf-8"),
+    ).toBe("bundled note");
+
+    state.bundleStatus = 404;
+    rmSync(home, { recursive: true, force: true });
+  });
+
   test("list fetch failure after signature drift leaves pre-existing skills on disk and does not advance hash", async () => {
     // Arrange: fresh isolated home with a pre-existing swarm-managed skill
     const isolatedHome = join(FAKE_HOME, "list-fail-home");

package/src/tests/script-runs-http.test.ts

@@ -11,6 +11,7 @@ import {
   getDbClient,
   getLatestScriptRunStepTaskByContextKey,
   getLatestTaskByContextKey,
+  getPendingTaskForAgent,
   initDb,
   updateScriptRun,
 } from "../be/db";
@@ -20,6 +21,7 @@ import { handleScriptRuns } from "../http/script-runs";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { localProcessScriptExecutor } from "../script-workflows/executor";
 import { setScriptRunExecutor } from "../script-workflows/supervisor";
+import type { AgentTask } from "../types";
 import {
   clearVolatileSecretsForTesting,
   refreshSecretScrubberCache,
@@ -537,6 +539,88 @@ describe("/api/script-runs HTTP", () => {
     });
   });
 
+  async function dispatchStepFor(
+    stepKey: string,
+    stepAgentId: string,
+    extra: Record<string, unknown> = {},
+  ): Promise<{ response: Promise<TestResponse>; task: AgentTask }> {
+    const created = await dispatch("/api/script-runs", {
+      method: "POST",
+      agentId,
+      body: createBody(),
+    });
+    const { id: runId } = (await created.json()) as { id: string };
+    const response = dispatch(`/api/internal/script-runs/${runId}/agent-task`, {
+      method: "POST",
+      agentId,
+      body: JSON.stringify({ stepKey, task: `do ${stepKey}`, agentId: stepAgentId, ...extra }),
+    });
+    const contextKey = `script-run:${runId}:${stepKey}`;
+    let task = await getLatestScriptRunStepTaskByContextKey(contextKey);
+    for (let i = 0; i < 50 && !task; i++) {
+      await Bun.sleep(20);
+      task = await getLatestScriptRunStepTaskByContextKey(contextKey);
+    }
+    expect(task).not.toBeNull();
+    return { response, task: task! };
+  }
+
+  test("agent-task dispatch persists dependsOn and holds the task until the dependency completes", async () => {
+    const stepAgent = await createAgent({
+      name: "deps-step-worker",
+      isLead: false,
+      status: "idle",
+    });
+    const dependency = await createTaskExtended("upstream fix", { source: "mcp" });
+
+    const { response, task } = await dispatchStepFor("after-fix", stepAgent.id, {
+      dependsOn: [dependency.id],
+    });
+
+    expect(task.dependsOn).toEqual([dependency.id]);
+    expect(await getPendingTaskForAgent(stepAgent.id)).toBeNull();
+
+    await completeTask(dependency.id, "fixed");
+    expect((await getPendingTaskForAgent(stepAgent.id))?.id).toBe(task.id);
+
+    await completeTask(task.id, "done");
+    expect((await response).status).toBe(200);
+  });
+
+  test("agent-task dispatch without dependsOn is startable at once", async () => {
+    const stepAgent = await createAgent({
+      name: "no-deps-step-worker",
+      isLead: false,
+      status: "idle",
+    });
+
+    const { response, task } = await dispatchStepFor("no-deps", stepAgent.id);
+
+    expect(task.dependsOn).toEqual([]);
+    expect((await getPendingTaskForAgent(stepAgent.id))?.id).toBe(task.id);
+
+    await completeTask(task.id, "done");
+    expect((await response).status).toBe(200);
+  });
+
+  test("agent-task dispatch rejects a dependsOn entry that is not a task UUID", async () => {
+    const created = await dispatch("/api/script-runs", {
+      method: "POST",
+      agentId,
+      body: createBody(),
+    });
+    const { id: runId } = (await created.json()) as { id: string };
+
+    const response = await dispatch(`/api/internal/script-runs/${runId}/agent-task`, {
+      method: "POST",
+      agentId,
+      body: JSON.stringify({ stepKey: "bad-deps", task: "x", dependsOn: ["not-a-uuid"] }),
+    });
+
+    expect(response.status).toBe(400);
+    expect(await getLatestScriptRunStepTaskByContextKey(`script-run:${runId}:bad-deps`)).toBeNull();
+  });
+
   test("agent-task polling returns the step output when a newer completed follow-up shares its context key", async () => {
     const created = await dispatch("/api/script-runs", {
       method: "POST",

package/src/tests/scripts-http.test.ts

@@ -785,6 +785,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
         missingIsUndefined: ctx.swarm.config.get("SCRIPT_CFG_NOT_SET") === undefined,
         fallback: read("SCRIPT_CFG_NOT_SET") ?? "fallback",
         apiOnly: read("SLACK_SIGNING_SECRET"),
+        transcriptionKey: read("TRANSCRIPTION_API_KEY"),
         proto: read("__proto__"),
       };
     };`;
@@ -798,6 +799,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
     missingIsUndefined: boolean;
     fallback: string;
     apiOnly: string | null;
+    transcriptionKey: string | null;
     proto: string | null;
   };
 
@@ -829,11 +831,17 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
       value: `signing-${randomToken(24)}`,
       isSecret: true,
     });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "TRANSCRIPTION_API_KEY",
+      value: `stt-${randomToken(24)}`,
+      isSecret: true,
+    });
   });
 
   afterAll(async () => {
     await getDbClient().run(
-      "DELETE FROM swarm_config WHERE key LIKE 'SCRIPT_CFG_%' OR key IN ('SLACK_SIGNING_SECRET', '__proto__')",
+      "DELETE FROM swarm_config WHERE key LIKE 'SCRIPT_CFG_%' OR key IN ('SLACK_SIGNING_SECRET', 'TRANSCRIPTION_API_KEY', '__proto__')",
     );
     clearVolatileSecretsForTesting();
   });
@@ -862,6 +870,7 @@ describe("ctx.swarm.config.get through POST /api/scripts/run", () => {
         missingIsUndefined: true,
         fallback: "fallback",
         apiOnly: null,
+        transcriptionKey: null,
         proto: "proto-global",
       });
       // The unwrapped secret is scrubbed from everything the run returns.

package/src/tests/secret-scrubber.test.ts

@@ -74,6 +74,21 @@ describe("scrubSecrets — env-based replacement", () => {
     expect(out).toBe("Authorization: Bearer [REDACTED:GITHUB_TOKEN] end");
   });
 
+  test("redacts the Bitbucket token and webhook secret as exact keys", () => {
+    const values = {
+      BITBUCKET_TOKEN: `example-bitbucket-${randomToken(24)}`,
+      BITBUCKET_WEBHOOK_SECRET: `example-bbhook-${randomToken(24)}`,
+    };
+    for (const [name, value] of Object.entries(values)) process.env[name] = value;
+    refreshSecretScrubberCache();
+    for (const [name, value] of Object.entries(values)) {
+      expect(isSensitiveKey(name)).toBe(true);
+      expect(scrubSecrets(`Authorization: Bearer ${value} end`)).toBe(
+        `Authorization: Bearer [REDACTED:${name}] end`,
+      );
+    }
+  });
+
   test("redacts any key with _API_KEY suffix", () => {
     process.env.FOO_SERVICE_API_KEY = "example-supersecretFooApiKey_longerthan12chars";
     refreshSecretScrubberCache();