@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/src/tests/gitlab-vcs-db.test.ts

@@ -100,7 +100,7 @@ describe("findTaskByVcs", () => {
       agentId: "vcs-lead-001",
     });
 
-    const found = await findTaskByVcs("findme/gh-repo", 100);
+    const found = await findTaskByVcs("findme/gh-repo", 100, "github");
     expect(found).not.toBeNull();
     expect(found?.vcsProvider).toBe("github");
   });
@@ -114,7 +114,7 @@ describe("findTaskByVcs", () => {
       agentId: "vcs-lead-001",
     });
 
-    const found = await findTaskByVcs("findme/gl-project", 200);
+    const found = await findTaskByVcs("findme/gl-project", 200, "gitlab");
     expect(found).not.toBeNull();
     expect(found?.vcsProvider).toBe("gitlab");
   });
@@ -133,12 +133,12 @@ describe("findTaskByVcs", () => {
     await db.startTask(task.id);
     await db.completeTask(task.id, "Done");
 
-    const found = await findTaskByVcs("findme/completed", 300);
+    const found = await findTaskByVcs("findme/completed", 300, "gitlab");
     expect(found).toBeNull();
   });
 
   test("returns null for non-existent repo/number", async () => {
-    const found = await findTaskByVcs("nonexistent/repo", 9999);
+    const found = await findTaskByVcs("nonexistent/repo", 9999, "github");
     expect(found).toBeNull();
   });
 });

package/src/tests/integration-disable-flags.test.ts

@@ -12,6 +12,8 @@
  */
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { initAgentMail, isAgentMailEnabled, resetAgentMail } from "../agentmail/app";
+import { validateConfigValue } from "../be/swarm-config-guard";
+import { isBitbucketEnabled, resetBitbucket } from "../bitbucket/auth";
 import { initGitHub, isGitHubEnabled, resetGitHub } from "../github/app";
 import { isJiraEnabled, resetJira } from "../jira/app";
 import { isLinearEnabled, resetLinear } from "../linear/app";
@@ -28,6 +30,8 @@ const ENV_KEYS = [
   "LINEAR_ENABLED",
   "AGENTMAIL_DISABLE",
   "AGENTMAIL_WEBHOOK_SECRET",
+  "BITBUCKET_DISABLE",
+  "BITBUCKET_WEBHOOK_SECRET",
 ] as const;
 const originalEnv = new Map(ENV_KEYS.map((key) => [key, process.env[key]]));
 
@@ -45,6 +49,7 @@ afterEach(() => {
   resetAgentMail();
   resetJira();
   resetLinear();
+  resetBitbucket();
   for (const key of ENV_KEYS) {
     const value = originalEnv.get(key);
     if (value === undefined) delete process.env[key];
@@ -185,6 +190,37 @@ describe("AgentMail AGENTMAIL_DISABLE", () => {
   });
 });
 
+describe("Bitbucket BITBUCKET_DISABLE", () => {
+  test("every truthy spelling disables the integration", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "secret";
+    for (const spelling of TRUTHY_SPELLINGS) {
+      process.env.BITBUCKET_DISABLE = spelling;
+      expect(isBitbucketEnabled()).toBe(false);
+    }
+  });
+
+  test("non-disabling values keep the integration enabled", () => {
+    process.env.BITBUCKET_WEBHOOK_SECRET = "secret";
+    for (const value of NON_DISABLING) {
+      if (value === undefined) delete process.env.BITBUCKET_DISABLE;
+      else process.env.BITBUCKET_DISABLE = value;
+      expect(isBitbucketEnabled()).toBe(true);
+    }
+  });
+
+  test("stays disabled without a webhook secret", () => {
+    expect(isBitbucketEnabled()).toBe(false);
+  });
+
+  test("the config guard validates BITBUCKET_DISABLE as a boolean like GITLAB_DISABLE", () => {
+    for (const key of ["BITBUCKET_DISABLE", "GITLAB_DISABLE"]) {
+      expect(validateConfigValue(key, "true")).toBeNull();
+      expect(validateConfigValue(key, "false")).toBeNull();
+      expect(validateConfigValue(key, "maybe")).not.toBeNull();
+    }
+  });
+});
+
 describe("Slack SLACK_DISABLE", () => {
   test("every truthy spelling reports disabled", () => {
     for (const spelling of TRUTHY_SPELLINGS) {

package/src/tests/mcp-tools.test.ts

@@ -52,7 +52,7 @@ describe("script MCP tools", () => {
       "script-upsert":
         'Typecheck and persist a TypeScript script to the swarm catalog under your agent scope (or global if you\'re a lead). Import `ScriptContext` from "swarm-sdk" for a real context type. Other agents and workflow nodes will be able to find and run it. For local-only scripts, use code-mode `save`.',
       "script-delete":
-        "Remove a swarm-shared script from the catalog. Versions table preserves history.",
+        "Permanently remove a swarm-shared script and all its versions from the catalog. This cannot be undone.",
       "script-query-types":
         // Updated for the frozen SwarmToolResult contract refactor: `name` is
         // now optional — omit it to get the swarm-wide type surface instead

package/src/tests/onboarding.test.ts

@@ -34,6 +34,7 @@ const ENV_KEYS = [
   "EMBEDDING_MODEL",
   "GITHUB_TOKEN",
   "GITLAB_TOKEN",
+  "BITBUCKET_TOKEN",
   "SLACK_BOT_TOKEN",
   "SLACK_APP_TOKEN",
   "SLACK_MODE",
@@ -380,6 +381,17 @@ describe("onboarding state", () => {
     expect(body.state.steps.integrations).toMatchObject({ status: "done", method: "github" });
   });
 
+  test("GET derives the Bitbucket integration from BITBUCKET_TOKEN", async () => {
+    process.env.BITBUCKET_TOKEN = "example-bitbucket-token";
+    const body = (await (await request("/api/onboarding")).json()) as {
+      state: OnboardingState;
+      signals: { integrations: Record<string, boolean> };
+    };
+
+    expect(body.signals.integrations.bitbucket).toBe(true);
+    expect(body.state.steps.integrations).toMatchObject({ status: "done", method: "bitbucket" });
+  });
+
   test("the selected first task completes onboarding after that task completes", async () => {
     // Onboarding starts before the first task exists (the task alone would mark an existing install).
     await request("/api/onboarding");

package/src/tests/pi-codemode.test.ts

@@ -340,8 +340,14 @@ describe("bounded codemode", () => {
         undefined,
         fakeCtx().ctx,
       );
-      expect(Date.now() - started).toBeLessThan(5_000);
-      expect(textOf(result)).toContain("Codemode worker limit reached");
+      const elapsed = Date.now() - started;
+      expect(elapsed).toBeGreaterThanOrEqual(250);
+      expect(elapsed).toBeLessThan(5_000);
+      // pi 1.4 queues the script for a worker; our deadline ends the wait.
+      expect(textOf(result)).toContain(
+        "Script aborted: Codemode script exceeded its 300 ms deadline",
+      );
+      expect(textOf(result)).toContain("The script did not start.");
     } finally {
       holders.abort(new Error("test done"));
       await Promise.all(holding);

package/src/tests/preload-env.test.ts

@@ -0,0 +1,57 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
+
+test(
+  "preload clears inherited worker configuration before test files load",
+  async () => {
+    const directory = await mkdtemp(join(tmpdir(), "swarm-preload-env-"));
+    const fixture = join(directory, "worker-env.test.ts");
+    const keys = [
+      "SLACK_RENDER_V2",
+      "SLACK_STATUS_ICON_COMPLETED",
+      "SLACK_FUTURE_SETTING",
+      "COMB_ENABLED",
+      "APP_URL",
+      "AGENT_FS_API_URL",
+      "AGENT_FS_LIVE_URL",
+      "AGENT_FS_DEFAULT_ORG_ID",
+      "AGENT_FS_DEFAULT_DRIVE_ID",
+      "SWARM_ORG_NAME",
+      "SWARM_ORG_WEBSITE",
+    ];
+    try {
+      await Bun.write(
+        fixture,
+        `import { expect, test } from "bun:test";
+const inherited = ${JSON.stringify(keys)}.filter(key => process.env[key] !== undefined);
+test("worker defaults are cleared before module evaluation", () => {
+  expect(inherited).toEqual([]);
+  expect(process.env.PRELOAD_ENV_CONTROL).toBe("preserved");
+  process.env.SLACK_STATUS_ICON_COMPLETED = "test-icon";
+});
+test("suite configuration survives between tests", () => {
+  expect(process.env.SLACK_STATUS_ICON_COMPLETED).toBe("test-icon");
+});
+`,
+      );
+      const result = expectChildOk(
+        await runChild([process.execPath, "test", fixture], {
+          cwd: join(import.meta.dir, "../.."),
+          env: {
+            ...process.env,
+            ...Object.fromEntries(keys.map((key) => [key, "inherited-worker-setting"])),
+            PRELOAD_ENV_CONTROL: "preserved",
+          },
+        }),
+        "test runner with inherited worker env",
+      );
+      expect(result.stderr).toContain("2 pass");
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  },
+  CHILD_PROCESS_TEST_BUDGET_MS,
+);

package/src/tests/preload.ts

@@ -22,6 +22,27 @@ import { startHangWatchdog } from "./hang-watchdog";
 
 startHangWatchdog();
 
+// Worker deployments configure Slack rendering, links, and organization defaults.
+// Start tests from the same unset defaults as CI; suites can still opt in by
+// setting their own values after the preload runs.
+for (const key of Object.keys(process.env)) {
+  if (
+    key.startsWith("SLACK_") ||
+    [
+      "COMB_ENABLED",
+      "APP_URL",
+      "AGENT_FS_API_URL",
+      "AGENT_FS_LIVE_URL",
+      "AGENT_FS_DEFAULT_ORG_ID",
+      "AGENT_FS_DEFAULT_DRIVE_ID",
+      "SWARM_ORG_NAME",
+      "SWARM_ORG_WEBSITE",
+    ].includes(key)
+  ) {
+    delete process.env[key];
+  }
+}
+
 // The API drain (src/be/api-drain.ts) is off unless API_DRAIN_MAX_MS is set,
 // but a shell can inherit it (a swarm worker container gets the deploy's value).
 // Test servers are stopped with SIGTERM and their fixtures leave in_progress rows

package/src/tests/prompt-template-remaining.test.ts

@@ -6,6 +6,7 @@ import { resolveTemplate } from "../prompts/resolver";
 
 // Side-effect imports: register all templates from each source
 import "../gitlab/templates";
+import "../bitbucket/templates";
 import "../agentmail/templates";
 import "../linear/templates";
 import "../heartbeat/templates";
@@ -28,6 +29,7 @@ async function ensureTemplatesRegistered(): Promise<void> {
   // module state across parallel test files, a single-template check is racy.
   const ts = Date.now();
   await import(`../gitlab/templates?t=${ts}`);
+  await import(`../bitbucket/templates?t=${ts}`);
   await import(`../agentmail/templates?t=${ts}`);
   await import(`../linear/templates?t=${ts}`);
   await import(`../heartbeat/templates?t=${ts}`);
@@ -94,6 +96,42 @@ describe("template registration — all sources", () => {
     expect(eventTypes).toContain("gitlab.pipeline.failed");
   });
 
+  test("Bitbucket templates are registered (2 common + 3 event)", () => {
+    const eventTypes = getAllTemplateDefinitions().map((d) => d.eventType);
+    expect(eventTypes).toContain("common.delegation_instruction.bitbucket");
+    expect(eventTypes).toContain("common.command_suggestions.bitbucket_pr");
+    expect(eventTypes).toContain("bitbucket.pull_request.opened");
+    expect(eventTypes).toContain("bitbucket.pull_request.review_requested");
+    expect(eventTypes).toContain("bitbucket.comment.mentioned");
+  });
+
+  test("Bitbucket templates resolve with no unresolved variables", () => {
+    const shared = {
+      pr_id: 42,
+      pr_title: "Fix retry",
+      repo: "acme-ws/widgets",
+      username: "Dana",
+      pr_url: "https://bitbucket.org/acme-ws/widgets/pull-requests/42",
+    };
+    const pr = { ...shared, source_branch: "feat", target_branch: "main", context_section: "" };
+    for (const id of ["bitbucket.pull_request.opened", "bitbucket.pull_request.review_requested"]) {
+      const result = resolveTemplate(id, pr);
+      expect(result.skipped).toBe(false);
+      expect(result.unresolved).toEqual([]);
+      expect(result.text).toContain("[Bitbucket PR #42]");
+      expect(result.text).toContain("api.bitbucket.org/2.0/repositories/acme-ws/widgets");
+    }
+    const comment = resolveTemplate("bitbucket.comment.mentioned", {
+      ...shared,
+      location_section: "File: src/a.ts:3\n",
+      context: "please fix",
+      existing_task_note: "",
+    });
+    expect(comment.unresolved).toEqual([]);
+    expect(comment.text).toContain("File: src/a.ts:3");
+    expect(comment.text).toContain("please fix");
+  });
+
   test("AgentMail templates are registered (5 event)", () => {
     const all = getAllTemplateDefinitions();
     const eventTypes = all.map((d) => d.eventType);

package/src/tests/run-root-coverage.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { mergeLcov } from "../../scripts/run-root-coverage";
+
+describe("mergeLcov", () => {
+  test("disjoint function hits remain a conservative lower bound without FN/FNDA identities", () => {
+    // a.test.ts calls a(); b.test.ts calls b() in the same two-function module.
+    const report = "SF:src/example.ts\nFNF:2\nFNH:1\nend_of_record\n";
+    const merged = mergeLcov([report, report]);
+
+    expect(merged).toContain("FNF:2\nFNH:1\n");
+  });
+
+  test("DA hits sum across reports and LH counts lines hit in any report", () => {
+    const merged = mergeLcov([
+      "SF:src/example.ts\nDA:1,2\nDA:2,0\nDA:3,0\nend_of_record\n",
+      "SF:src/example.ts\nDA:1,3\nDA:2,1\nDA:3,0\nend_of_record\n",
+    ]);
+
+    expect(merged).toBe(
+      "TN:\nSF:src/example.ts\nFNF:0\nFNH:0\nDA:1,5\nDA:2,1\nDA:3,0\nLF:3\nLH:2\nend_of_record\n",
+    );
+  });
+
+  test("FNH never exceeds FNF when merging function totals", () => {
+    const reports = [
+      "SF:src/example.ts\nFNF:2\nFNH:2\nend_of_record\n",
+      "SF:src/example.ts\nFNF:3\nFNH:1\nend_of_record\n",
+    ];
+    for (const inputs of [reports, reports.toReversed(), [...reports, ...reports]]) {
+      const merged = mergeLcov(inputs);
+      const found = Number(merged.match(/^FNF:(\d+)$/m)![1]);
+      const hit = Number(merged.match(/^FNH:(\d+)$/m)![1]);
+
+      expect(found).toBe(3);
+      expect(hit).toBe(2);
+      expect(hit).toBeLessThanOrEqual(found);
+    }
+  });
+});

package/src/tests/runner-bitbucket-vcs.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Worker-side Bitbucket PR linking. There is no Bitbucket CLI in the worker
+ * image, so `detectVcsForTask` asks the Bitbucket REST API (via `fetch`) for an
+ * open PR on the current branch and PATCHes `/api/tasks/:id/vcs` when it finds
+ * one. Both calls go through `globalThis.fetch`, which these tests stub, so no
+ * server or port is involved. The git side runs against a real temp repo.
+ */
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { detectVcsForTask, findBitbucketOpenPullRequest } from "../commands/runner";
+import { expectChildOk, runChild } from "./test-proc";
+
+const API_URL = "http://swarm.invalid";
+const BRANCH = "feature/bb-link";
+const PR_HTML = "https://bitbucket.org/acme-ws/web.app/pull-requests/17";
+
+type Call = { url: string; method: string; headers: Headers; body: string };
+type BitbucketReply = { status: number; body: unknown } | "throw";
+
+const originalFetch = globalThis.fetch;
+const originalToken = process.env.BITBUCKET_TOKEN;
+let calls: Call[] = [];
+let bitbucketReply: BitbucketReply = { status: 200, body: { values: [] } };
+let repoDir = "";
+let taskSeq = 0;
+
+function nextTaskId(): string {
+  taskSeq += 1;
+  return `00000000-0000-4000-8000-${String(taskSeq).padStart(12, "0")}`;
+}
+
+async function git(args: string[]): Promise<void> {
+  expectChildOk(await runChild(["git", "-C", repoDir, ...args]), `git ${args.join(" ")}`);
+}
+
+function stubFetch(): void {
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    calls.push({
+      url,
+      method: init?.method ?? "GET",
+      headers: new Headers(init?.headers),
+      body: typeof init?.body === "string" ? init.body : "",
+    });
+    if (url.startsWith("https://api.bitbucket.org/")) {
+      if (bitbucketReply === "throw") throw new TypeError("network down");
+      return new Response(JSON.stringify(bitbucketReply.body), {
+        status: bitbucketReply.status,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    return new Response("{}", { status: 200, headers: { "Content-Type": "application/json" } });
+  }) as typeof fetch;
+}
+
+const bitbucketCalls = () => calls.filter((c) => c.url.startsWith("https://api.bitbucket.org/"));
+const patchCalls = () => calls.filter((c) => c.method === "PATCH");
+
+beforeAll(async () => {
+  repoDir = await mkdtemp(join(tmpdir(), "runner-bb-vcs-"));
+  await git(["init", "--quiet"]);
+  await git(["checkout", "--quiet", "-b", BRANCH]);
+  await git(["remote", "add", "origin", "https://bitbucket.org/acme-ws/web.app.git"]);
+});
+
+afterAll(async () => {
+  await rm(repoDir, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  calls = [];
+  bitbucketReply = { status: 200, body: { values: [] } };
+  process.env.BITBUCKET_TOKEN = "example-bb-token";
+  stubFetch();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  if (originalToken === undefined) delete process.env.BITBUCKET_TOKEN;
+  else process.env.BITBUCKET_TOKEN = originalToken;
+});
+
+describe("detectVcsForTask on a Bitbucket remote", () => {
+  test("an open PR for the branch links the task", async () => {
+    bitbucketReply = {
+      status: 200,
+      body: { values: [{ id: 17, links: { html: { href: PR_HTML } } }] },
+    };
+    const taskId = nextTaskId();
+    await detectVcsForTask(API_URL, "swarm-key", taskId, repoDir);
+
+    const [lookup] = bitbucketCalls();
+    expect(lookup).toBeDefined();
+    const lookupUrl = new URL(lookup!.url);
+    expect(lookupUrl.pathname).toBe("/2.0/repositories/acme-ws/web.app/pullrequests");
+    expect(lookupUrl.searchParams.get("q")).toBe(`source.branch.name="${BRANCH}" AND state="OPEN"`);
+    expect(lookupUrl.searchParams.get("pagelen")).toBe("1");
+    expect(lookup!.headers.get("authorization")).toBe("Bearer example-bb-token");
+
+    const patches = patchCalls();
+    expect(patches).toHaveLength(1);
+    expect(patches[0]!.url).toBe(`${API_URL}/api/tasks/${taskId}/vcs`);
+    expect(patches[0]!.headers.get("authorization")).toBe("Bearer swarm-key");
+    expect(JSON.parse(patches[0]!.body)).toEqual({
+      vcsProvider: "bitbucket",
+      vcsRepo: "acme-ws/web.app",
+      vcsNumber: 17,
+      vcsUrl: PR_HTML,
+    });
+  });
+
+  test("no open PR sends no PATCH", async () => {
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a non-200 answer is swallowed and sends no PATCH", async () => {
+    bitbucketReply = { status: 401, body: { type: "error", error: { message: "Unauthorized" } } };
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a network failure is swallowed and sends no PATCH", async () => {
+    bitbucketReply = "throw";
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("without BITBUCKET_TOKEN it calls nothing", async () => {
+    delete process.env.BITBUCKET_TOKEN;
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(calls).toHaveLength(0);
+  });
+});
+
+describe("findBitbucketOpenPullRequest", () => {
+  test("escapes quotes in the branch name inside the BBQL query", async () => {
+    let seen = "";
+    const fetchImpl = (async (input: string | URL | Request) => {
+      seen = String(input);
+      return new Response(JSON.stringify({ values: [] }), { status: 200 });
+    }) as typeof fetch;
+    await findBitbucketOpenPullRequest("git@bitbucket.org:ws/repo.git", 'we"ird', {
+      token: "t",
+      fetchImpl,
+    });
+    expect(new URL(seen).searchParams.get("q")).toBe(
+      'source.branch.name="we\\"ird" AND state="OPEN"',
+    );
+  });
+
+  test("rejects a reply without a numeric id or an html link", async () => {
+    for (const values of [
+      [{ id: "17", links: { html: { href: PR_HTML } } }],
+      [{ id: 17, links: {} }],
+      [{}],
+    ]) {
+      const fetchImpl = (async () =>
+        new Response(JSON.stringify({ values }), { status: 200 })) as unknown as typeof fetch;
+      expect(
+        await findBitbucketOpenPullRequest("https://bitbucket.org/ws/repo", "b", {
+          token: "t",
+          fetchImpl,
+        }),
+      ).toBeNull();
+    }
+  });
+
+  test("returns null for a non-Bitbucket remote without calling fetch", async () => {
+    let called = false;
+    const fetchImpl = (async () => {
+      called = true;
+      return new Response("{}");
+    }) as unknown as typeof fetch;
+    expect(
+      await findBitbucketOpenPullRequest("https://github.com/ws/repo", "b", {
+        token: "t",
+        fetchImpl,
+      }),
+    ).toBeNull();
+    expect(called).toBe(false);
+  });
+});

package/src/tests/runner-skills-refresh.test.ts

@@ -34,6 +34,9 @@ type StubState = {
   };
   calls: { signature: number; list: number; sync: number };
   skillFilesStatus: number;
+  /** 404 by default so the legacy list path stays covered; bundle tests opt in. */
+  bundleStatus: number;
+  bundleCalls: number;
 };
 
 const FAKE_HOME = join(tmpdir(), `runner-refresh-test-${process.pid}`);
@@ -67,6 +70,8 @@ const state: StubState = {
     signature: "hash-v1",
   },
   calls: { signature: 0, list: 0, sync: 0 },
+  bundleStatus: 404,
+  bundleCalls: 0,
 };
 
 let server: ReturnType<typeof Bun.serve> | null = null;
@@ -91,6 +96,22 @@ describe("refreshSkillsIfChanged", () => {
             generatedAt: new Date().toISOString(),
           });
         }
+        if (url.pathname.endsWith("/skills/bundle")) {
+          state.bundleCalls++;
+          if (state.bundleStatus !== 200) {
+            return new Response("not found", { status: state.bundleStatus });
+          }
+          return Response.json({
+            skills: state.skillsBody.skills.map((skill) => ({
+              ...skill,
+              files: skill.isComplex
+                ? [{ path: "refs/notes.md", content: "bundled note", isBinary: false }]
+                : [],
+            })),
+            total: state.skillsBody.skills.length,
+            signature: state.skillsBody.signature,
+          });
+        }
         if (url.pathname.match(/\/api\/agents\/[^/]+\/skills$/)) {
           state.calls.list++;
           if (state.listStatus !== 200) {
@@ -337,6 +358,43 @@ describe("refreshSkillsIfChanged", () => {
     rmSync(cleanHome, { recursive: true, force: true });
   });
 
+  test("bundle endpoint replaces the list call and the per-file fan-out", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.bundleCalls = 0;
+    state.bundleStatus = 200;
+    state.signatureHash = "hash-bundle";
+    state.skillsBody.signature = "hash-bundle";
+    state.skillsBody.skills = [
+      {
+        id: "skill-complex",
+        name: "complex-skill",
+        description: "has bundled files",
+        content: "---\nname: complex-skill\n---\n\nComplex body.",
+        isComplex: true,
+        isActive: true,
+        isEnabled: true,
+      },
+    ];
+
+    const home = join(FAKE_HOME, "bundle-home");
+    mkdirSync(home, { recursive: true });
+    const lastHash = { current: null as string | null };
+    const result = await refreshWithHome(makeCtx(), lastHash, home);
+
+    expect(result.changed).toBe(true);
+    expect(lastHash.current).toBe("hash-bundle");
+    // One signature probe + one bundle call. No list call, no manifest and no
+    // per-file fetches.
+    expect(state.bundleCalls).toBe(1);
+    expect(state.calls).toEqual({ signature: 1, list: 0, sync: 0 });
+    expect(
+      readFileSync(join(home, ".claude", "skills", "complex-skill", "refs", "notes.md"), "utf-8"),
+    ).toBe("bundled note");
+
+    state.bundleStatus = 404;
+    rmSync(home, { recursive: true, force: true });
+  });
+
   test("list fetch failure after signature drift leaves pre-existing skills on disk and does not advance hash", async () => {
     // Arrange: fresh isolated home with a pre-existing swarm-managed skill
     const isolatedHome = join(FAKE_HOME, "list-fail-home");

package/src/tests/secret-scrubber.test.ts

@@ -74,6 +74,21 @@ describe("scrubSecrets — env-based replacement", () => {
     expect(out).toBe("Authorization: Bearer [REDACTED:GITHUB_TOKEN] end");
   });
 
+  test("redacts the Bitbucket token and webhook secret as exact keys", () => {
+    const values = {
+      BITBUCKET_TOKEN: `example-bitbucket-${randomToken(24)}`,
+      BITBUCKET_WEBHOOK_SECRET: `example-bbhook-${randomToken(24)}`,
+    };
+    for (const [name, value] of Object.entries(values)) process.env[name] = value;
+    refreshSecretScrubberCache();
+    for (const [name, value] of Object.entries(values)) {
+      expect(isSensitiveKey(name)).toBe(true);
+      expect(scrubSecrets(`Authorization: Bearer ${value} end`)).toBe(
+        `Authorization: Bearer [REDACTED:${name}] end`,
+      );
+    }
+  });
+
   test("redacts any key with _API_KEY suffix", () => {
     process.env.FOO_SERVICE_API_KEY = "example-supersecretFooApiKey_longerthan12chars";
     refreshSecretScrubberCache();