@desplega.ai/agent-swarm 2.4.5 → 2.5.1

package/src/tests/preload.ts

@@ -22,6 +22,27 @@ import { startHangWatchdog } from "./hang-watchdog";
 
 startHangWatchdog();
 
+// Worker deployments configure Slack rendering, links, and organization defaults.
+// Start tests from the same unset defaults as CI; suites can still opt in by
+// setting their own values after the preload runs.
+for (const key of Object.keys(process.env)) {
+  if (
+    key.startsWith("SLACK_") ||
+    [
+      "COMB_ENABLED",
+      "APP_URL",
+      "AGENT_FS_API_URL",
+      "AGENT_FS_LIVE_URL",
+      "AGENT_FS_DEFAULT_ORG_ID",
+      "AGENT_FS_DEFAULT_DRIVE_ID",
+      "SWARM_ORG_NAME",
+      "SWARM_ORG_WEBSITE",
+    ].includes(key)
+  ) {
+    delete process.env[key];
+  }
+}
+
 // The API drain (src/be/api-drain.ts) is off unless API_DRAIN_MAX_MS is set,
 // but a shell can inherit it (a swarm worker container gets the deploy's value).
 // Test servers are stopped with SIGTERM and their fixtures leave in_progress rows

package/src/tests/prompt-template-remaining.test.ts

@@ -6,6 +6,7 @@ import { resolveTemplate } from "../prompts/resolver";
 
 // Side-effect imports: register all templates from each source
 import "../gitlab/templates";
+import "../bitbucket/templates";
 import "../agentmail/templates";
 import "../linear/templates";
 import "../heartbeat/templates";
@@ -28,6 +29,7 @@ async function ensureTemplatesRegistered(): Promise<void> {
   // module state across parallel test files, a single-template check is racy.
   const ts = Date.now();
   await import(`../gitlab/templates?t=${ts}`);
+  await import(`../bitbucket/templates?t=${ts}`);
   await import(`../agentmail/templates?t=${ts}`);
   await import(`../linear/templates?t=${ts}`);
   await import(`../heartbeat/templates?t=${ts}`);
@@ -94,6 +96,42 @@ describe("template registration — all sources", () => {
     expect(eventTypes).toContain("gitlab.pipeline.failed");
   });
 
+  test("Bitbucket templates are registered (2 common + 3 event)", () => {
+    const eventTypes = getAllTemplateDefinitions().map((d) => d.eventType);
+    expect(eventTypes).toContain("common.delegation_instruction.bitbucket");
+    expect(eventTypes).toContain("common.command_suggestions.bitbucket_pr");
+    expect(eventTypes).toContain("bitbucket.pull_request.opened");
+    expect(eventTypes).toContain("bitbucket.pull_request.review_requested");
+    expect(eventTypes).toContain("bitbucket.comment.mentioned");
+  });
+
+  test("Bitbucket templates resolve with no unresolved variables", () => {
+    const shared = {
+      pr_id: 42,
+      pr_title: "Fix retry",
+      repo: "acme-ws/widgets",
+      username: "Dana",
+      pr_url: "https://bitbucket.org/acme-ws/widgets/pull-requests/42",
+    };
+    const pr = { ...shared, source_branch: "feat", target_branch: "main", context_section: "" };
+    for (const id of ["bitbucket.pull_request.opened", "bitbucket.pull_request.review_requested"]) {
+      const result = resolveTemplate(id, pr);
+      expect(result.skipped).toBe(false);
+      expect(result.unresolved).toEqual([]);
+      expect(result.text).toContain("[Bitbucket PR #42]");
+      expect(result.text).toContain("api.bitbucket.org/2.0/repositories/acme-ws/widgets");
+    }
+    const comment = resolveTemplate("bitbucket.comment.mentioned", {
+      ...shared,
+      location_section: "File: src/a.ts:3\n",
+      context: "please fix",
+      existing_task_note: "",
+    });
+    expect(comment.unresolved).toEqual([]);
+    expect(comment.text).toContain("File: src/a.ts:3");
+    expect(comment.text).toContain("please fix");
+  });
+
   test("AgentMail templates are registered (5 event)", () => {
     const all = getAllTemplateDefinitions();
     const eventTypes = all.map((d) => d.eventType);

package/src/tests/run-root-coverage.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { mergeLcov } from "../../scripts/run-root-coverage";
+
+describe("mergeLcov", () => {
+  test("disjoint function hits remain a conservative lower bound without FN/FNDA identities", () => {
+    // a.test.ts calls a(); b.test.ts calls b() in the same two-function module.
+    const report = "SF:src/example.ts\nFNF:2\nFNH:1\nend_of_record\n";
+    const merged = mergeLcov([report, report]);
+
+    expect(merged).toContain("FNF:2\nFNH:1\n");
+  });
+
+  test("DA hits sum across reports and LH counts lines hit in any report", () => {
+    const merged = mergeLcov([
+      "SF:src/example.ts\nDA:1,2\nDA:2,0\nDA:3,0\nend_of_record\n",
+      "SF:src/example.ts\nDA:1,3\nDA:2,1\nDA:3,0\nend_of_record\n",
+    ]);
+
+    expect(merged).toBe(
+      "TN:\nSF:src/example.ts\nFNF:0\nFNH:0\nDA:1,5\nDA:2,1\nDA:3,0\nLF:3\nLH:2\nend_of_record\n",
+    );
+  });
+
+  test("FNH never exceeds FNF when merging function totals", () => {
+    const reports = [
+      "SF:src/example.ts\nFNF:2\nFNH:2\nend_of_record\n",
+      "SF:src/example.ts\nFNF:3\nFNH:1\nend_of_record\n",
+    ];
+    for (const inputs of [reports, reports.toReversed(), [...reports, ...reports]]) {
+      const merged = mergeLcov(inputs);
+      const found = Number(merged.match(/^FNF:(\d+)$/m)![1]);
+      const hit = Number(merged.match(/^FNH:(\d+)$/m)![1]);
+
+      expect(found).toBe(3);
+      expect(hit).toBe(2);
+      expect(hit).toBeLessThanOrEqual(found);
+    }
+  });
+});

package/src/tests/runner-bitbucket-vcs.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Worker-side Bitbucket PR linking. There is no Bitbucket CLI in the worker
+ * image, so `detectVcsForTask` asks the Bitbucket REST API (via `fetch`) for an
+ * open PR on the current branch and PATCHes `/api/tasks/:id/vcs` when it finds
+ * one. Both calls go through `globalThis.fetch`, which these tests stub, so no
+ * server or port is involved. The git side runs against a real temp repo.
+ */
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { detectVcsForTask, findBitbucketOpenPullRequest } from "../commands/runner";
+import { expectChildOk, runChild } from "./test-proc";
+
+const API_URL = "http://swarm.invalid";
+const BRANCH = "feature/bb-link";
+const PR_HTML = "https://bitbucket.org/acme-ws/web.app/pull-requests/17";
+
+type Call = { url: string; method: string; headers: Headers; body: string };
+type BitbucketReply = { status: number; body: unknown } | "throw";
+
+const originalFetch = globalThis.fetch;
+const originalToken = process.env.BITBUCKET_TOKEN;
+let calls: Call[] = [];
+let bitbucketReply: BitbucketReply = { status: 200, body: { values: [] } };
+let repoDir = "";
+let taskSeq = 0;
+
+function nextTaskId(): string {
+  taskSeq += 1;
+  return `00000000-0000-4000-8000-${String(taskSeq).padStart(12, "0")}`;
+}
+
+async function git(args: string[]): Promise<void> {
+  expectChildOk(await runChild(["git", "-C", repoDir, ...args]), `git ${args.join(" ")}`);
+}
+
+function stubFetch(): void {
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    calls.push({
+      url,
+      method: init?.method ?? "GET",
+      headers: new Headers(init?.headers),
+      body: typeof init?.body === "string" ? init.body : "",
+    });
+    if (url.startsWith("https://api.bitbucket.org/")) {
+      if (bitbucketReply === "throw") throw new TypeError("network down");
+      return new Response(JSON.stringify(bitbucketReply.body), {
+        status: bitbucketReply.status,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    return new Response("{}", { status: 200, headers: { "Content-Type": "application/json" } });
+  }) as typeof fetch;
+}
+
+const bitbucketCalls = () => calls.filter((c) => c.url.startsWith("https://api.bitbucket.org/"));
+const patchCalls = () => calls.filter((c) => c.method === "PATCH");
+
+beforeAll(async () => {
+  repoDir = await mkdtemp(join(tmpdir(), "runner-bb-vcs-"));
+  await git(["init", "--quiet"]);
+  await git(["checkout", "--quiet", "-b", BRANCH]);
+  await git(["remote", "add", "origin", "https://bitbucket.org/acme-ws/web.app.git"]);
+});
+
+afterAll(async () => {
+  await rm(repoDir, { recursive: true, force: true });
+});
+
+beforeEach(() => {
+  calls = [];
+  bitbucketReply = { status: 200, body: { values: [] } };
+  process.env.BITBUCKET_TOKEN = "example-bb-token";
+  stubFetch();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  if (originalToken === undefined) delete process.env.BITBUCKET_TOKEN;
+  else process.env.BITBUCKET_TOKEN = originalToken;
+});
+
+describe("detectVcsForTask on a Bitbucket remote", () => {
+  test("an open PR for the branch links the task", async () => {
+    bitbucketReply = {
+      status: 200,
+      body: { values: [{ id: 17, links: { html: { href: PR_HTML } } }] },
+    };
+    const taskId = nextTaskId();
+    await detectVcsForTask(API_URL, "swarm-key", taskId, repoDir);
+
+    const [lookup] = bitbucketCalls();
+    expect(lookup).toBeDefined();
+    const lookupUrl = new URL(lookup!.url);
+    expect(lookupUrl.pathname).toBe("/2.0/repositories/acme-ws/web.app/pullrequests");
+    expect(lookupUrl.searchParams.get("q")).toBe(`source.branch.name="${BRANCH}" AND state="OPEN"`);
+    expect(lookupUrl.searchParams.get("pagelen")).toBe("1");
+    expect(lookup!.headers.get("authorization")).toBe("Bearer example-bb-token");
+
+    const patches = patchCalls();
+    expect(patches).toHaveLength(1);
+    expect(patches[0]!.url).toBe(`${API_URL}/api/tasks/${taskId}/vcs`);
+    expect(patches[0]!.headers.get("authorization")).toBe("Bearer swarm-key");
+    expect(JSON.parse(patches[0]!.body)).toEqual({
+      vcsProvider: "bitbucket",
+      vcsRepo: "acme-ws/web.app",
+      vcsNumber: 17,
+      vcsUrl: PR_HTML,
+    });
+  });
+
+  test("no open PR sends no PATCH", async () => {
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a non-200 answer is swallowed and sends no PATCH", async () => {
+    bitbucketReply = { status: 401, body: { type: "error", error: { message: "Unauthorized" } } };
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(bitbucketCalls()).toHaveLength(1);
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("a network failure is swallowed and sends no PATCH", async () => {
+    bitbucketReply = "throw";
+    await expect(
+      detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir),
+    ).resolves.toBeUndefined();
+    expect(patchCalls()).toHaveLength(0);
+  });
+
+  test("without BITBUCKET_TOKEN it calls nothing", async () => {
+    delete process.env.BITBUCKET_TOKEN;
+    await detectVcsForTask(API_URL, "swarm-key", nextTaskId(), repoDir);
+    expect(calls).toHaveLength(0);
+  });
+});
+
+describe("findBitbucketOpenPullRequest", () => {
+  test("escapes quotes in the branch name inside the BBQL query", async () => {
+    let seen = "";
+    const fetchImpl = (async (input: string | URL | Request) => {
+      seen = String(input);
+      return new Response(JSON.stringify({ values: [] }), { status: 200 });
+    }) as typeof fetch;
+    await findBitbucketOpenPullRequest("git@bitbucket.org:ws/repo.git", 'we"ird', {
+      token: "t",
+      fetchImpl,
+    });
+    expect(new URL(seen).searchParams.get("q")).toBe(
+      'source.branch.name="we\\"ird" AND state="OPEN"',
+    );
+  });
+
+  test("rejects a reply without a numeric id or an html link", async () => {
+    for (const values of [
+      [{ id: "17", links: { html: { href: PR_HTML } } }],
+      [{ id: 17, links: {} }],
+      [{}],
+    ]) {
+      const fetchImpl = (async () =>
+        new Response(JSON.stringify({ values }), { status: 200 })) as unknown as typeof fetch;
+      expect(
+        await findBitbucketOpenPullRequest("https://bitbucket.org/ws/repo", "b", {
+          token: "t",
+          fetchImpl,
+        }),
+      ).toBeNull();
+    }
+  });
+
+  test("returns null for a non-Bitbucket remote without calling fetch", async () => {
+    let called = false;
+    const fetchImpl = (async () => {
+      called = true;
+      return new Response("{}");
+    }) as unknown as typeof fetch;
+    expect(
+      await findBitbucketOpenPullRequest("https://github.com/ws/repo", "b", {
+        token: "t",
+        fetchImpl,
+      }),
+    ).toBeNull();
+    expect(called).toBe(false);
+  });
+});

package/src/tests/runner-skills-refresh.test.ts

@@ -34,6 +34,9 @@ type StubState = {
   };
   calls: { signature: number; list: number; sync: number };
   skillFilesStatus: number;
+  /** 404 by default so the legacy list path stays covered; bundle tests opt in. */
+  bundleStatus: number;
+  bundleCalls: number;
 };
 
 const FAKE_HOME = join(tmpdir(), `runner-refresh-test-${process.pid}`);
@@ -67,6 +70,8 @@ const state: StubState = {
     signature: "hash-v1",
   },
   calls: { signature: 0, list: 0, sync: 0 },
+  bundleStatus: 404,
+  bundleCalls: 0,
 };
 
 let server: ReturnType<typeof Bun.serve> | null = null;
@@ -91,6 +96,22 @@ describe("refreshSkillsIfChanged", () => {
             generatedAt: new Date().toISOString(),
           });
         }
+        if (url.pathname.endsWith("/skills/bundle")) {
+          state.bundleCalls++;
+          if (state.bundleStatus !== 200) {
+            return new Response("not found", { status: state.bundleStatus });
+          }
+          return Response.json({
+            skills: state.skillsBody.skills.map((skill) => ({
+              ...skill,
+              files: skill.isComplex
+                ? [{ path: "refs/notes.md", content: "bundled note", isBinary: false }]
+                : [],
+            })),
+            total: state.skillsBody.skills.length,
+            signature: state.skillsBody.signature,
+          });
+        }
         if (url.pathname.match(/\/api\/agents\/[^/]+\/skills$/)) {
           state.calls.list++;
           if (state.listStatus !== 200) {
@@ -337,6 +358,43 @@ describe("refreshSkillsIfChanged", () => {
     rmSync(cleanHome, { recursive: true, force: true });
   });
 
+  test("bundle endpoint replaces the list call and the per-file fan-out", async () => {
+    state.calls = { signature: 0, list: 0, sync: 0 };
+    state.bundleCalls = 0;
+    state.bundleStatus = 200;
+    state.signatureHash = "hash-bundle";
+    state.skillsBody.signature = "hash-bundle";
+    state.skillsBody.skills = [
+      {
+        id: "skill-complex",
+        name: "complex-skill",
+        description: "has bundled files",
+        content: "---\nname: complex-skill\n---\n\nComplex body.",
+        isComplex: true,
+        isActive: true,
+        isEnabled: true,
+      },
+    ];
+
+    const home = join(FAKE_HOME, "bundle-home");
+    mkdirSync(home, { recursive: true });
+    const lastHash = { current: null as string | null };
+    const result = await refreshWithHome(makeCtx(), lastHash, home);
+
+    expect(result.changed).toBe(true);
+    expect(lastHash.current).toBe("hash-bundle");
+    // One signature probe + one bundle call. No list call, no manifest and no
+    // per-file fetches.
+    expect(state.bundleCalls).toBe(1);
+    expect(state.calls).toEqual({ signature: 1, list: 0, sync: 0 });
+    expect(
+      readFileSync(join(home, ".claude", "skills", "complex-skill", "refs", "notes.md"), "utf-8"),
+    ).toBe("bundled note");
+
+    state.bundleStatus = 404;
+    rmSync(home, { recursive: true, force: true });
+  });
+
   test("list fetch failure after signature drift leaves pre-existing skills on disk and does not advance hash", async () => {
     // Arrange: fresh isolated home with a pre-existing swarm-managed skill
     const isolatedHome = join(FAKE_HOME, "list-fail-home");

package/src/tests/secret-scrubber.test.ts

@@ -74,6 +74,21 @@ describe("scrubSecrets — env-based replacement", () => {
     expect(out).toBe("Authorization: Bearer [REDACTED:GITHUB_TOKEN] end");
   });
 
+  test("redacts the Bitbucket token and webhook secret as exact keys", () => {
+    const values = {
+      BITBUCKET_TOKEN: `example-bitbucket-${randomToken(24)}`,
+      BITBUCKET_WEBHOOK_SECRET: `example-bbhook-${randomToken(24)}`,
+    };
+    for (const [name, value] of Object.entries(values)) process.env[name] = value;
+    refreshSecretScrubberCache();
+    for (const [name, value] of Object.entries(values)) {
+      expect(isSensitiveKey(name)).toBe(true);
+      expect(scrubSecrets(`Authorization: Bearer ${value} end`)).toBe(
+        `Authorization: Bearer [REDACTED:${name}] end`,
+      );
+    }
+  });
+
   test("redacts any key with _API_KEY suffix", () => {
     process.env.FOO_SERVICE_API_KEY = "example-supersecretFooApiKey_longerthan12chars";
     refreshSecretScrubberCache();