@desplega.ai/agent-swarm 2.5.1 → 2.5.2

package/src/tests/migration-237-session-inbox-cleanup.test.ts

@@ -0,0 +1,136 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { closeDb, createTaskExtended, createUser, getDb, getDbClient, initDb } from "../be/db";
+import { setSessionShares } from "../be/session-shares";
+
+const day = 86_400_000;
+const ago = (days: number) => new Date(Date.now() - days * day).toISOString();
+
+beforeAll(() => {
+  initDb(":memory:");
+});
+afterAll(() => {
+  closeDb();
+});
+
+async function root(requestedByUserId: string | undefined, activity: string, status = "completed") {
+  const task = await createTaskExtended("Cleanup test", { key: "shared/", requestedByUserId });
+  await getDbClient().run("UPDATE agent_tasks SET lastUpdatedAt = ?, status = ? WHERE id = ?", [
+    activity,
+    status,
+    task.id,
+  ]);
+  return task;
+}
+
+async function row(
+  userId: string,
+  itemId: string,
+  status: string,
+  lastReadAt: string | null = null,
+  { snoozeUntil = "2999-01-01T00:00:00.000Z", lastUpdatedAt = ago(20) } = {},
+) {
+  await getDbClient().run(
+    `INSERT INTO inbox_item_state (userId, itemType, itemId, status, snoozeUntil, lastReadAt, lastUpdatedAt)
+    VALUES (?, 'to_read', ?, ?, ?, ?, ?)`,
+    [userId, itemId, status, status === "snoozed" ? snoozeUntil : null, lastReadAt, lastUpdatedAt],
+  );
+}
+
+async function states(): Promise<Record<string, string>> {
+  const rows = await getDbClient().query<{ userId: string; itemId: string; status: string }>(
+    "SELECT userId, itemId, status FROM inbox_item_state ORDER BY userId, itemId",
+  );
+  return Object.fromEntries(rows.map((r) => [`${r.userId}:${r.itemId}`, r.status]));
+}
+
+test("migration 237 moves quiet, read sessions to Done for every viewer, once", async () => {
+  const owner = await createUser({ name: "Owner" });
+  const other = await createUser({ name: "Other" });
+  const third = await createUser({ name: "Third" });
+
+  const quiet = await root(owner.id, ago(30));
+  const recent = await root(owner.id, ago(1));
+  // A quiet root whose child moved yesterday is not quiet.
+  const busyChain = await root(owner.id, ago(30));
+  const child = await createTaskExtended("Child", { parentTaskId: busyChain.id });
+  await getDbClient().run(
+    "UPDATE agent_tasks SET lastUpdatedAt = ?, status = 'completed' WHERE id = ?",
+    [ago(1), child.id],
+  );
+  // Quiet but not finished, or waiting on an approval: both stay in the Inbox.
+  const stuck = await root(owner.id, ago(30), "in_progress");
+  const failed = await root(owner.id, ago(30), "failed");
+  const awaiting = await root(owner.id, ago(30));
+  await getDbClient().run(
+    `INSERT INTO approval_requests (id, sourceTaskId, title, questions, approvers, status)
+    VALUES (?, ?, 'Approve deploy', '[]', '{}', 'pending')`,
+    [crypto.randomUUID(), awaiting.id],
+  );
+  // Open rows: read up to the newest activity, or unread (cursor before it).
+  const openRead = await root(owner.id, ago(30));
+  await row(owner.id, openRead.id, "open", ago(25));
+  const openUnread = await root(owner.id, ago(30));
+  await row(owner.id, openUnread.id, "open", "1970-01-01T00:00:00.000Z");
+  // Open rows with no cursor: the row's own time is the cursor.
+  const openNoCursor = await root(owner.id, ago(30));
+  await row(owner.id, openNoCursor.id, "open");
+  const openNoCursorOld = await root(owner.id, ago(30));
+  await row(owner.id, openNoCursorOld.id, "open", null, { lastUpdatedAt: ago(40) });
+  // Snoozed (also past its wake time, which reads as unread) and dismissed rows keep their state.
+  const snoozed = await root(owner.id, ago(30));
+  await row(owner.id, snoozed.id, "snoozed");
+  const woken = await root(owner.id, ago(30));
+  await row(owner.id, woken.id, "snoozed", null, { snoozeUntil: ago(10) });
+  const dismissed = await root(owner.id, ago(30));
+  await row(owner.id, dismissed.id, "dismissed");
+  // Shares: one user, and everyone.
+  const sharedDirect = await root(other.id, ago(30));
+  await setSessionShares(
+    { id: sharedDirect.id, requestedByUserId: other.id },
+    { everyone: "none", users: [{ userId: owner.id, access: "read" }] },
+    other.id,
+  );
+  const sharedAll = await root(other.id, ago(30));
+  await setSessionShares(
+    { id: sharedAll.id, requestedByUserId: other.id },
+    { everyone: "read", users: [] },
+    other.id,
+  );
+  // Ownerless roots are not in the tree.
+  const ownerless = await root(undefined, ago(30));
+
+  const sql = await Bun.file("src/be/migrations/237_session_inbox_cleanup.sql").text();
+  getDb().exec(sql);
+  const after = await states();
+  expect(after).toEqual({
+    [`${owner.id}:${quiet.id}`]: "done",
+    [`${owner.id}:${failed.id}`]: "done",
+    [`${owner.id}:${openRead.id}`]: "done",
+    [`${owner.id}:${openUnread.id}`]: "open",
+    [`${owner.id}:${openNoCursor.id}`]: "done",
+    [`${owner.id}:${openNoCursorOld.id}`]: "open",
+    [`${owner.id}:${snoozed.id}`]: "snoozed",
+    [`${owner.id}:${woken.id}`]: "snoozed",
+    [`${owner.id}:${dismissed.id}`]: "dismissed",
+    [`${owner.id}:${sharedDirect.id}`]: "done",
+    [`${owner.id}:${sharedAll.id}`]: "done",
+    [`${other.id}:${sharedDirect.id}`]: "done",
+    [`${other.id}:${sharedAll.id}`]: "done",
+    [`${third.id}:${sharedAll.id}`]: "done",
+  });
+  for (const id of [recent.id, busyChain.id, ownerless.id, stuck.id, awaiting.id]) {
+    expect(Object.keys(after).some((key) => key.endsWith(`:${id}`))).toBe(false);
+  }
+  // Every timestamp it writes is ISO, so the read rule compares it with task times.
+  const written = await getDbClient().get<{ doneAt: string; lastUpdatedAt: string }>(
+    "SELECT doneAt, lastUpdatedAt FROM inbox_item_state WHERE itemId = ?",
+    [quiet.id],
+  );
+  expect(written?.doneAt).toMatch(/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/);
+  expect(written?.lastUpdatedAt).toBe(written?.doneAt);
+
+  // A second run changes nothing.
+  getDb().exec(sql);
+  expect(await states()).toEqual(after);
+  expect(getDb().query("PRAGMA integrity_check").get()).toEqual({ integrity_check: "ok" });
+});

package/src/tests/rbac-engine.test.ts

@@ -106,6 +106,7 @@ const OPERATOR_OR_USER_VERBS: PermissionVerb[] = [
   "runtime_controller.write",
   "runtime_pool.write",
   "agent.token.manage",
+  "user.role.manage",
 ];
 
 const LEAD_OR_OPERATOR_VERBS: PermissionVerb[] = ["models.catalog.write"];
@@ -122,6 +123,7 @@ const LEAD_OR_RESOURCE_OWNER_VERBS: PermissionVerb[] = [
   "mcp-server.delete.any",
   "mcp-server.update.any",
   "page.delete.any",
+  "schedule.deferral.update.any",
 ];
 
 const LEAD_OR_TASK_CREATOR_VERBS: PermissionVerb[] = ["task.cancel.any", "task.steer.any"];

package/src/tests/rbac-roles.test.ts

@@ -188,6 +188,16 @@ describe("role attachment helpers", () => {
 });
 
 describe("ensureRbacSeedsSynced", () => {
+  test("seeds viewer with a subset of the requester verbs", async () => {
+    await getDbClient().run("DELETE FROM roles WHERE id = 'rbac-role-viewer'");
+
+    ensureRbacSeedsSynced({ quiet: true });
+
+    const viewerVerbs = await roleVerbs("rbac-role-viewer");
+    expect(viewerVerbs).toEqual(["favorite.write.own", "session.presence"]);
+    for (const verb of viewerVerbs) expect(REQUESTER_VERBS).toContain(verb);
+  });
+
   test("restores a deleted built-in role and its permissions", async () => {
     await getDbClient().run("DELETE FROM roles WHERE id = ?", [REQUESTER_ROLE_ID]);
 

package/src/tests/schedule-http-triage-tools.test.ts

@@ -9,6 +9,7 @@ import {
 } from "node:http";
 import {
   closeDb,
+  createAgent,
   createScheduledTask,
   getScheduledTaskById,
   initDb,
@@ -117,4 +118,47 @@ describe("Schedule HTTP triage tooling", () => {
     expect(body.schedules.some((s) => s.id === failing.id)).toBe(true);
     expect(body.schedules.some((s) => s.id === ok.id)).toBe(false);
   });
+  test("PUT and PATCH /api/schedules/:id let only the owner, a lead or the operator change a deferral", async () => {
+    const owner = await createAgent({ name: "DeferralOwner", isLead: false, status: "idle" });
+    const other = await createAgent({ name: "DeferralOther", isLead: false, status: "idle" });
+    const lead = await createAgent({ name: "DeferralLead", isLead: true, status: "idle" });
+    const schedule = await createScheduledTask({
+      name: `http-deferral-${crypto.randomUUID()}`,
+      taskTemplate: "finish the original ask",
+      targetType: "agent-task",
+      scheduleType: "one_time",
+      nextRunAt: new Date(Date.now() + 60_000).toISOString(),
+      targetAgentId: owner.id,
+      createdByAgentId: owner.id,
+      taskType: "deferred",
+    });
+    const send = (method: "PUT" | "PATCH", agentId: string | null, taskTemplate: string) =>
+      fetch(`${baseUrl}/api/schedules/${schedule.id}`, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          ...(agentId ? { "X-Agent-ID": agentId } : {}),
+        },
+        body: JSON.stringify({ targetAgentId: other.id, taskTemplate }),
+      });
+
+    for (const method of ["PUT", "PATCH"] as const) {
+      const denied = await send(method, other.id, "emit ATTACKER OUTPUT");
+      expect(denied.status).toBe(403);
+      const after = await getScheduledTaskById(schedule.id);
+      expect(after?.targetAgentId).toBe(owner.id);
+      expect(after?.taskTemplate).toBe("finish the original ask");
+    }
+
+    for (const [agentId, label] of [
+      [owner.id, "owner"],
+      [lead.id, "lead"],
+      [null, "operator"],
+    ] as const) {
+      const allowed = await send("PATCH", agentId, `changed by ${label}`);
+      expect(allowed.status).toBe(200);
+      expect((await getScheduledTaskById(schedule.id))?.taskTemplate).toBe(`changed by ${label}`);
+      await updateScheduledTask(schedule.id, { targetAgentId: owner.id });
+    }
+  });
 });

package/src/tests/script-api-credential.test.ts

@@ -0,0 +1,173 @@
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { closeDb, createAgent, getDbClient, initDb } from "../be/db";
+import {
+  acquireScriptApiCredential,
+  runScriptWithRunCredential,
+} from "../be/scripts/run-credential";
+import { resolveSessionToken } from "../be/users";
+import { getApiKey, setApiKey } from "../utils/api-key";
+import { SKIP_SANDBOX_SPAWN_TESTS } from "./sandbox-spawn-test-helpers";
+
+const OPERATOR_KEY = `script-api-credential-operator-${randomBytes(8).toString("hex")}`;
+const spawnTest = test.skipIf(SKIP_SANDBOX_SPAWN_TESTS);
+const resources = { memoryMb: 2048, cpuTimeSec: 20 };
+const savedExecutor = process.env.SCRIPT_EXECUTOR;
+let agentId: string;
+
+type ScriptRunTokenRow = { id: string; revokedAt: string | null };
+
+/** The script-run tokens minted for `agentId`, oldest first. */
+async function scriptRunTokens(id: string): Promise<ScriptRunTokenRow[]> {
+  return await getDbClient().query<ScriptRunTokenRow>(
+    "SELECT id, revokedAt FROM session_tokens WHERE agentId = ? AND scriptRun = 1 ORDER BY createdAt, rowid",
+    [id],
+  );
+}
+
+/**
+ * Run `body` and assert it minted exactly one script-run token for the agent,
+ * and that the token is revoked once the run is over.
+ */
+async function expectOneRevokedToken(body: () => Promise<void>): Promise<void> {
+  const before = (await scriptRunTokens(agentId)).length;
+  await body();
+  const minted = (await scriptRunTokens(agentId)).slice(before);
+  expect(minted).toHaveLength(1);
+  expect(minted[0]?.revokedAt).not.toBeNull();
+}
+
+/** Resolve once the run's token has been minted and is still live. */
+async function waitForLiveToken(): Promise<void> {
+  const deadline = Date.now() + 5_000;
+  while (Date.now() < deadline) {
+    if ((await scriptRunTokens(agentId)).some((row) => row.revokedAt === null)) return;
+    await Bun.sleep(10);
+  }
+  throw new Error("no live script-run token appeared");
+}
+
+beforeAll(async () => {
+  initDb(":memory:");
+  setApiKey(OPERATOR_KEY);
+  agentId = (
+    await createAgent({
+      name: `script-api-credential-${randomBytes(6).toString("hex")}`,
+      isLead: false,
+      status: "idle",
+    })
+  ).id;
+});
+
+afterEach(() => {
+  if (savedExecutor === undefined) delete process.env.SCRIPT_EXECUTOR;
+  else process.env.SCRIPT_EXECUTOR = savedExecutor;
+});
+
+afterAll(() => {
+  closeDb();
+});
+
+describe("acquireScriptApiCredential", () => {
+  test("hands a real agent a token scoped to that agent, not the operator key", async () => {
+    const credential = await acquireScriptApiCredential(agentId);
+    if (!credential.apiKey) throw new Error("expected a per-run token");
+    try {
+      expect(credential.apiKey).not.toBe(getApiKey());
+      const resolved = await resolveSessionToken(credential.apiKey);
+      if (resolved?.kind !== "agent") throw new Error("expected an agent principal");
+      expect(resolved.agentId).toBe(agentId);
+    } finally {
+      await credential.release();
+    }
+    // The token is revoked once the run releases it.
+    expect(await resolveSessionToken(credential.apiKey)).toBeNull();
+  });
+
+  test("mints nothing for a system run with no real agent", async () => {
+    // Scheduler and workflow script runs pass sentinel ids like "schedule" /
+    // "workflow" when there is no owning agent; runScript then falls back to
+    // the operator key.
+    const credential = await acquireScriptApiCredential("schedule");
+    try {
+      expect(credential.apiKey).toBeUndefined();
+      expect(await scriptRunTokens("schedule")).toHaveLength(0);
+    } finally {
+      await credential.release();
+    }
+  });
+});
+
+describe("runScriptWithRunCredential revokes the run's token however the run ends", () => {
+  spawnTest("success", async () => {
+    await expectOneRevokedToken(async () => {
+      const output = await runScriptWithRunCredential({
+        agentId,
+        egressSecrets: [],
+        resources,
+        source: "export default async () => 'ok';",
+      });
+      expect(output.error).toBeUndefined();
+      expect(output.result).toBe("ok");
+    });
+  });
+
+  spawnTest("the script throws", async () => {
+    await expectOneRevokedToken(async () => {
+      const output = await runScriptWithRunCredential({
+        agentId,
+        egressSecrets: [],
+        resources,
+        source: "export default async () => { throw new Error('boom'); };",
+      });
+      expect(output.runtimeError?.message).toContain("boom");
+    });
+  });
+
+  test("the run itself throws", async () => {
+    // An executor that cannot start makes runScript reject after the token
+    // was minted; the token must still be revoked.
+    process.env.SCRIPT_EXECUTOR = "no-such-executor";
+    await expectOneRevokedToken(async () => {
+      await expect(
+        runScriptWithRunCredential({
+          agentId,
+          egressSecrets: [],
+          source: "export default async () => 'never runs';",
+        }),
+      ).rejects.toThrow("Unknown SCRIPT_EXECUTOR");
+    });
+  });
+
+  spawnTest("timeout", async () => {
+    await expectOneRevokedToken(async () => {
+      const output = await runScriptWithRunCredential({
+        agentId,
+        egressSecrets: [],
+        timeoutMs: 1_000,
+        resources,
+        source: "export default async () => new Promise(() => {});",
+      });
+      expect(output.error).toBe("timeout");
+    });
+  });
+
+  spawnTest("abort", async () => {
+    await expectOneRevokedToken(async () => {
+      const controller = new AbortController();
+      const run = runScriptWithRunCredential({
+        agentId,
+        egressSecrets: [],
+        signal: controller.signal,
+        resources,
+        source: "export default async () => new Promise(() => {});",
+      });
+      // Abort mid-run: the token is live and the script has had time to start.
+      await waitForLiveToken();
+      await Bun.sleep(200);
+      controller.abort();
+      const output = await run;
+      expect(output.error).toBe("killed");
+    });
+  });
+});

package/src/tests/script-connections.test.ts

@@ -638,6 +638,10 @@ describe("script connections", () => {
       markMigrationApplied(database, "231_slack_tasks_last_updated_index.sql");
       // 232 rebuilds session_tokens with the 207 columns, which this fixture skipped.
       markMigrationApplied(database, "232_agent_session_tokens.sql");
+      // 235 reads agent_tasks.deferredAt, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "235_chat_relay_defer.sql");
+      // 237 reads approval_requests and inbox_item_state, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "237_session_inbox_cleanup.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-run-config-scope.test.ts

@@ -0,0 +1,120 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import { closeDb, createAgent, initDb, upsertSwarmConfig } from "../be/db";
+import { mintScriptRunToken, revokeSessionToken } from "../be/users";
+import { handleConfig } from "../http/config";
+import { handleCore } from "../http/core";
+import { handleSessions } from "../http/sessions";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+// A script run presents a token minted by `mintScriptRunToken` (the api does
+// this per run instead of handing the script the operator key). These tests
+// pin that the token is scoped to its executing agent at the config layer, so
+// a worker's inline script cannot read another agent's secret or delete its
+// config row — the escalation that running as the operator allowed.
+const API_KEY = `script-run-config-operator-${randomBytes(8).toString("hex")}`;
+const WORKER_SECRET = `worker-secret-${randomBytes(8).toString("hex")}`;
+const OTHER_SECRET = `other-secret-${randomBytes(8).toString("hex")}`;
+
+let server: Server;
+let baseUrl: string;
+let workerId: string;
+let otherId: string;
+let otherConfigId: string;
+
+function headers(bearer: string, agentId?: string): Record<string, string> {
+  return {
+    Authorization: `Bearer ${bearer}`,
+    "Content-Type": "application/json",
+    ...(agentId ? { "X-Agent-ID": agentId } : {}),
+  };
+}
+
+beforeAll(async () => {
+  initDb(":memory:");
+  workerId = (await createAgent({ name: "script-run-worker", isLead: false, status: "idle" })).id;
+  otherId = (await createAgent({ name: "script-run-other", isLead: false, status: "idle" })).id;
+  await upsertSwarmConfig({
+    scope: "agent",
+    scopeId: workerId,
+    key: "OWN_SECRET",
+    value: WORKER_SECRET,
+    isSecret: true,
+  });
+  otherConfigId = (
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: otherId,
+      key: "OTHER_SECRET",
+      value: OTHER_SECRET,
+      isSecret: true,
+    })
+  ).id;
+  server = createServer(async (req, res) => {
+    if (await handleCore(req, res, req.headers["x-agent-id"] as string | undefined, API_KEY))
+      return;
+    const segments = getPathSegments(req.url || "");
+    const query = parseQueryParams(req.url || "");
+    if (await handleSessions(req, res, segments, query)) return;
+    if (await handleConfig(req, res, segments, query)) return;
+    res.writeHead(404).end();
+  });
+  baseUrl = `http://127.0.0.1:${await listenOnFreePort(server)}`;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+});
+
+describe("script run token is scoped to its executing agent", () => {
+  test("reads its own agent's secret", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config/resolved?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(res.status).toBe(200);
+      expect(await res.text()).toContain(WORKER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("cannot read another agent's secret", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(
+        `${baseUrl}/api/config/resolved?includeSecrets=true&agentId=${otherId}`,
+        { headers: headers(run.plaintext) },
+      );
+      // X-Agent-ID is forced to the token's agent, so this reads the worker's
+      // own scope; either way the other agent's secret never comes back.
+      const body = await res.text();
+      expect(body).not.toContain(OTHER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("cannot delete another agent's config row", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config/${otherConfigId}`, {
+        method: "DELETE",
+        headers: headers(run.plaintext),
+      });
+      await res.text();
+      expect(res.status).toBe(403);
+      // The row is still there, read back as operator.
+      const check = await fetch(`${baseUrl}/api/config/${otherConfigId}`, {
+        headers: headers(API_KEY),
+      });
+      expect(check.status).toBe(200);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+});

package/src/tests/script-run-token.test.ts

@@ -0,0 +1,75 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { closeDb, createAgent, initDb } from "../be/db";
+import {
+  AgentTokenExistsError,
+  mintAgentToken,
+  mintScriptRunToken,
+  resolveSessionToken,
+  revokeAgentTokens,
+  revokeSessionToken,
+} from "../be/users";
+
+const synthetic = (label: string) => `script-run-token-${label}-${randomBytes(8).toString("hex")}`;
+
+let agentId: string;
+let otherId: string;
+
+beforeAll(async () => {
+  initDb(":memory:");
+  agentId = (await createAgent({ name: synthetic("agent"), isLead: false, status: "idle" })).id;
+  otherId = (await createAgent({ name: synthetic("other"), isLead: false, status: "idle" })).id;
+});
+
+afterAll(() => {
+  closeDb();
+});
+
+describe("mintScriptRunToken", () => {
+  test("resolves to the executing agent as an agent principal", async () => {
+    const token = await mintScriptRunToken(agentId, 60_000);
+    expect(token.plaintext.startsWith("aseph_")).toBe(true);
+
+    const resolved = await resolveSessionToken(token.plaintext);
+    expect(resolved).not.toBeNull();
+    if (resolved?.kind !== "agent") throw new Error("expected an agent principal");
+    expect(resolved.agentId).toBe(agentId);
+    expect(resolved.tokenKind).toBe("agent");
+    expect(resolved.taskId).toBeNull();
+    expect(resolved.runtimeId).toBeNull();
+
+    await revokeSessionToken(token.tokenId);
+  });
+
+  test("does not count as the agent's worker token", async () => {
+    // A script run must be able to mint its token while the agent already
+    // holds a worker token, and vice versa: the two lifecycles are separate.
+    const worker = await mintAgentToken(agentId);
+    const run = await mintScriptRunToken(agentId, 60_000);
+
+    expect(run.tokenId).not.toBe(worker.tokenId);
+    // The worker token is unique per agent; minting a second would throw. The
+    // script run token sharing the agent did not trip that uniqueness.
+    await expect(mintAgentToken(agentId)).rejects.toBeInstanceOf(AgentTokenExistsError);
+
+    await revokeSessionToken(run.tokenId);
+    await revokeAgentTokens(agentId);
+  });
+
+  test("survives a revoke of the agent's worker tokens", async () => {
+    const worker = await mintAgentToken(otherId);
+    const run = await mintScriptRunToken(otherId, 60_000);
+
+    // Revoking the agent's worker tokens (worker-token revoke / rotate) must
+    // not revoke a script run's in-flight token.
+    await revokeAgentTokens(otherId);
+
+    expect(await resolveSessionToken(worker.plaintext)).toBeNull();
+    const stillValid = await resolveSessionToken(run.plaintext);
+    expect(stillValid).not.toBeNull();
+    expect(stillValid?.agentId).toBe(otherId);
+
+    await revokeSessionToken(run.tokenId);
+    expect(await resolveSessionToken(run.plaintext)).toBeNull();
+  });
+});

package/src/tests/scripts-http.test.ts

@@ -574,6 +574,25 @@ describe("/api/scripts HTTP", () => {
     ).toBe(beforeFailed);
   });
 
+  skip("a run mints a per-run token for its agent and revokes it when the run ends", async () => {
+    const tokens = () =>
+      getDbClient().query<{ revokedAt: string | null }>(
+        "SELECT revokedAt FROM session_tokens WHERE agentId = ? AND scriptRun = 1",
+        [workerId],
+      );
+    const before = (await tokens()).length;
+    const res = await dispatch("/api/scripts/run", {
+      method: "POST",
+      agentId: workerId,
+      body: JSON.stringify({ source: validSource(2), args: { value: 2 }, intent: "token" }),
+    });
+    expect(res.status).toBe(200);
+    expect((await res.json()).result).toEqual({ result: 4 });
+    const minted = (await tokens()).slice(before);
+    expect(minted).toHaveLength(1);
+    expect(minted[0]?.revokedAt).not.toBeNull();
+  });
+
   test("workspace-rw named scripts return 501", async () => {
     await upsert({ name: "workspace", source: validSource(2), fsMode: "workspace-rw" });
     const res = await dispatch("/api/scripts/run", {