@desplega.ai/agent-swarm 2.5.1 → 2.5.3

package/src/tests/skill-search-long-content.test.ts

@@ -0,0 +1,193 @@
+import { Database } from "bun:sqlite";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import {
+  closeDb,
+  createSkill,
+  deleteSkill,
+  getDb,
+  initDb,
+  searchSkills,
+  updateSkill,
+} from "../be/db";
+
+// Natural-language probes that missed on the live catalog: the obvious skill
+// has a long SKILL.md body, and a shorter skill repeats the query words in
+// its content. bm25 over the whole row buried the name/description hit.
+const TEST_DB_PATH = `./test-skill-search-long-content-${process.pid}.sqlite`;
+
+async function removeDbFiles(path: string): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"]) {
+    await unlink(path + suffix).catch(() => {});
+  }
+}
+
+async function topNames(query: string): Promise<string[]> {
+  return (await searchSkills(query, 10, false)).map((skill) => skill.name);
+}
+
+// A long body of words that no probe uses, like a full SKILL.md.
+const longBody = (topic: string) =>
+  `${topic}\n${"Each step lists its inputs, outputs and the checks to run afterwards. ".repeat(60)}`;
+
+describe("searchSkills on long skill bodies", () => {
+  beforeAll(async () => {
+    await removeDbFiles(TEST_DB_PATH);
+    initDb(TEST_DB_PATH);
+
+    const fixture = [
+      {
+        name: "pages",
+        description: "Publish hosted HTML pages with share links for outside readers.",
+        content: longBody("Hosted artifacts."),
+      },
+      {
+        name: "newsletter-sources",
+        description: "Weekly AI newsletter source list and reading picks.",
+        content: "Publish a short note for a page you read, then publish the page list. ".repeat(6),
+      },
+      {
+        name: "browser-interaction",
+        description: "Drive a headless browser.",
+        content: "Open a page, wait for a page to load, then read a page. ".repeat(6),
+      },
+      {
+        name: "scheduling",
+        description: "Recurring jobs with cron expressions: create, pause or resume a schedule.",
+        content: longBody("Cron jobs."),
+      },
+      {
+        name: "social-content",
+        description: "Draft social posts for the brand accounts.",
+        content: "How do I create a post? Create a draft, then schedule a post for a slot. ".repeat(
+          6,
+        ),
+      },
+      {
+        name: "code-quality",
+        description: "Checks to run before you push or open a pull request, and how to review one.",
+        content: longBody("Pre-push gate."),
+      },
+      {
+        name: "customer-ops",
+        description: "Operations runbook for one customer deployment.",
+        content:
+          "Open a pull request, ask a reviewer, review a pull request, request a fix. ".repeat(6),
+      },
+      // "get" is a stopword, and "aaa-get-helper" sorts first by name.
+      { name: "get", description: "Fetch API resources.", content: "fetch resources" },
+      { name: "aaa-get-helper", description: "Get helper instructions", content: "get content" },
+      { name: "what is it", description: "Release notes digest.", content: "notes" },
+      { name: "aaa-what-is-it", description: "What is it for, in short.", content: "notes" },
+    ];
+    for (const skill of fixture) await createSkill({ ...skill, scope: "swarm" });
+  });
+
+  afterAll(async () => {
+    closeDb();
+    await removeDbFiles(TEST_DB_PATH);
+  });
+
+  test.each([
+    ["publish a page", "pages"],
+    ["how do I create a schedule", "scheduling"],
+    ["how do I review a pull request", "code-quality"],
+  ])("%p ranks %p first over content that repeats the query words", async (query, expected) => {
+    expect((await topNames(query))[0]).toBe(expected);
+  });
+
+  test("stopwords do not match every skill", async () => {
+    // Every fixture body contains "a"; only skills about pages may match.
+    expect(await topNames("publish a page")).not.toContain("code-quality");
+  });
+
+  test("a query of only stopwords falls back to the substring match", async () => {
+    const names = await topNames("how do I");
+    expect(names).toContain("social-content");
+    expect(names).not.toContain("pages");
+  });
+
+  test.each([
+    "get",
+    "GET",
+    " Get ",
+  ])("an exact-name query of only stopwords (%p) ranks that skill first", async (query) => {
+    expect((await searchSkills(query, 1, false)).map((skill) => skill.name)).toEqual(["get"]);
+    expect((await topNames(query)).slice(0, 2)).toEqual(["get", "aaa-get-helper"]);
+  });
+
+  test("a multi-word exact name of only stopwords ranks first", async () => {
+    expect((await searchSkills("What Is It", 1, false)).map((skill) => skill.name)).toEqual([
+      "what is it",
+    ]);
+  });
+
+  test("keeps the name/description index in sync on update and delete", async () => {
+    const skill = await createSkill({
+      name: "meta-sync-probe",
+      description: "Starts with gammaword.",
+      content: "",
+      scope: "swarm",
+    });
+    const metaRows = (term: string) =>
+      getDb()
+        .query<{ skill_id: string }, [string]>(
+          "SELECT skill_id FROM skills_meta_fts WHERE skills_meta_fts MATCH ?",
+        )
+        .all(`"${term}"`)
+        .map((row) => row.skill_id);
+    expect(metaRows("gammaword")).toEqual([skill.id]);
+
+    await updateSkill(skill.id, { description: "Now about deltaword." });
+    expect(metaRows("gammaword")).toEqual([]);
+    expect(metaRows("deltaword")).toEqual([skill.id]);
+
+    await deleteSkill(skill.id);
+    expect(metaRows("deltaword")).toEqual([]);
+  });
+
+  test("migrated schema carries the name/description sync triggers", () => {
+    const triggers = getDb()
+      .query<{ name: string }, []>(
+        "SELECT name FROM sqlite_master WHERE type = 'trigger' AND tbl_name = 'skills' AND name LIKE 'skills_meta_fts_%' ORDER BY name",
+      )
+      .all()
+      .map((row) => row.name);
+    expect(triggers).toEqual([
+      "skills_meta_fts_delete",
+      "skills_meta_fts_insert",
+      "skills_meta_fts_update",
+    ]);
+  });
+});
+
+test("migration 241 backfills skills that existed before it ran", async () => {
+  const db = new Database(":memory:");
+  try {
+    db.exec(await Bun.file("src/be/migrations/019_skills.sql").text());
+    db.run(
+      "INSERT INTO skills (id, name, description, content, type, scope, createdAt, lastUpdatedAt) VALUES ('s1', 'legacy-skill', 'Old description', 'old body', 'remote', 'swarm', '2026-01-01', '2026-01-01')",
+    );
+    const migration = await Bun.file("src/be/migrations/241_skills_meta_fts.sql").text();
+    db.exec(migration);
+
+    const match = (term: string) =>
+      db
+        .query<{ skill_id: string }, [string]>(
+          "SELECT skill_id FROM skills_meta_fts WHERE skills_meta_fts MATCH ?",
+        )
+        .all(term)
+        .map((row) => row.skill_id);
+    expect(match('"description"')).toEqual(["s1"]);
+    // Content is not indexed here.
+    expect(match('"body"')).toEqual([]);
+
+    // Re-running the migration does not duplicate backfilled rows.
+    db.exec(migration);
+    expect(db.query<{ n: number }, []>("SELECT count(*) AS n FROM skills_meta_fts").get()?.n).toBe(
+      1,
+    );
+  } finally {
+    db.close();
+  }
+});

package/src/tests/skill-search.test.ts

@@ -1,6 +1,15 @@
+import { Database } from "bun:sqlite";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
-import { closeDb, createSkill, initDb, searchSkills } from "../be/db";
+import {
+  closeDb,
+  createSkill,
+  deleteSkill,
+  getDb,
+  initDb,
+  searchSkills,
+  updateSkill,
+} from "../be/db";
 
 const TEST_DB_PATH = `./test-skill-search-${process.pid}.sqlite`;
 
@@ -10,22 +19,69 @@ async function removeDbFiles(path: string): Promise<void> {
   }
 }
 
+async function topNames(query: string, limit?: number): Promise<string[]> {
+  return (await searchSkills(query, limit)).map((skill) => skill.name);
+}
+
 describe("searchSkills", () => {
   beforeAll(async () => {
     await removeDbFiles(TEST_DB_PATH);
     initDb(TEST_DB_PATH);
 
+    const fixture = [
+      {
+        name: "pr-review-fix-loop",
+        description: "Run review fix rounds on a pull request until CI is green.",
+        content: "Reply to each review thread, push the fix, wait for checks.",
+      },
+      {
+        name: "code-quality",
+        description: "Pre-push checklist for any code change.",
+        content: "Run lint, typecheck and tests, then read the diff as a reviewer would.",
+      },
+      {
+        name: "swarm-scripts",
+        description: "Author and run reusable TypeScript in the swarm.",
+        content: "script-upsert, script-run, credential bindings and secrets stay server-side.",
+      },
+      {
+        name: "agent-fs",
+        description: "Shared drive for documents between agents and people.",
+        content: "Upload markdown and create share links for outside readers.",
+      },
+      {
+        name: "scheduling",
+        description: "Create recurring jobs with cron expressions.",
+        content: "Pick a timezone, set the next run, pause or resume a schedule.",
+      },
+      {
+        name: "schedule-audit",
+        description: "Audit scheduling drift and missed schedules.",
+        content: "Compare each schedule's last run with its cron.",
+      },
+      {
+        name: "memory",
+        description: "Store, search and rate learnings from past sessions.",
+        content: "Use memory-store for a fix that will come back.",
+      },
+      {
+        name: "call-time-trap-placement",
+        description: "Decide where operational rules belong.",
+        content: "Use toolsMd and claudeMd to document the delivery surface.",
+      },
+      {
+        name: "content-search-example",
+        description: "A skill with a content-only term.",
+        content: "This body contains the needle-token.",
+      },
+    ];
+    for (const skill of fixture) await createSkill({ ...skill, scope: "swarm" });
     await createSkill({
-      name: "call-time-trap-placement",
-      description: "Decide where operational rules belong.",
-      content: "Use toolsMd and claudeMd to document the delivery surface.",
-      scope: "swarm",
-    });
-    await createSkill({
-      name: "content-search-example",
-      description: "A skill with a content-only term.",
-      content: "This body contains the needle-token.",
+      name: "disabled-cron-helper",
+      description: "Recurring cron jobs, the old way.",
+      content: "cron cron cron schedule",
       scope: "swarm",
+      isEnabled: false,
     });
   });
 
@@ -34,27 +90,122 @@ describe("searchSkills", () => {
     await removeDbFiles(TEST_DB_PATH);
   });
 
-  test("matches every whitespace-separated token across searchable fields", async () => {
-    const skills = await searchSkills("call-time trap placement toolsMd claudeMd delivery surface");
+  test("ranks a name match first", async () => {
+    expect((await topNames("scheduling"))[0]).toBe("scheduling");
+    expect((await topNames("code quality"))[0]).toBe("code-quality");
+  });
+
+  test("ranks a description-only match first", async () => {
+    expect((await topNames("recurring cron jobs"))[0]).toBe("scheduling");
+  });
+
+  test("ranks a content-only match first", async () => {
+    expect((await topNames("credential bindings"))[0]).toBe("swarm-scripts");
+    expect(await topNames("needle-token")).toEqual(["content-search-example"]);
+  });
+
+  test("ranks natural-language queries by relevance instead of requiring every word", async () => {
+    expect((await topNames("how do I review a pull request"))[0]).toBe("pr-review-fix-loop");
+    expect((await topNames("where to share a document with people"))[0]).toBe("agent-fs");
+  });
 
-    expect(skills.map((skill) => skill.name)).toContain("call-time-trap-placement");
+  test("a query equal to a skill name ranks that skill first", async () => {
+    // On bm25 alone schedule-audit outscores scheduling for this query: its
+    // name and description both stem to "schedul". The exact-name boost wins.
+    expect((await topNames("Scheduling")).slice(0, 2)).toEqual(["scheduling", "schedule-audit"]);
+    expect((await topNames("MEMORY"))[0]).toBe("memory");
+    expect((await topNames("call-time-trap-placement"))[0]).toBe("call-time-trap-placement");
   });
 
-  test("matches terms that appear only in content", async () => {
-    const skills = await searchSkills("needle-token");
+  test("quotes FTS5 syntax in user text instead of executing it", async () => {
+    for (const query of [
+      '"',
+      "*",
+      "NEAR",
+      "-",
+      'cron" OR "x',
+      "cron NEAR/2 jobs",
+      "-cron",
+      "name:cron",
+      "cron*",
+    ]) {
+      await expect(searchSkills(query)).resolves.toBeArray();
+    }
+    expect((await topNames('timezone" OR "x'))[0]).toBe("scheduling");
+    expect((await topNames("-timezone"))[0]).toBe("scheduling");
+    // As a column filter, name:timezone would match nothing: "timezone" is
+    // only in the scheduling skill's content.
+    expect((await topNames("name:timezone"))[0]).toBe("scheduling");
+  });
 
-    expect(skills.map((skill) => skill.name)).toEqual(["content-search-example"]);
+  test("excludes disabled skills", async () => {
+    expect(await topNames("cron")).not.toContain("disabled-cron-helper");
+    expect(await topNames("disabled-cron-helper")).not.toContain("disabled-cron-helper");
   });
 
-  test("returns no results when any token matches nothing", async () => {
-    const skills = await searchSkills("call-time nonexistent-token");
+  test("respects the limit and the includeContent flag", async () => {
+    expect(await topNames("the", 2)).toHaveLength(2);
+    const slim = await searchSkills("scheduling", 5, false);
+    expect(slim[0]?.name).toBe("scheduling");
+    expect(slim[0]?.content).toBe("");
+  });
 
-    expect(skills).toEqual([]);
+  test("keeps the substring fallback for partial words", async () => {
+    expect(await topNames("needle-tok")).toEqual(["content-search-example"]);
   });
 
-  test("keeps single-word searches working", async () => {
-    const skills = await searchSkills("call-time");
+  test("keeps the index in sync on update and delete", async () => {
+    const skill = await createSkill({
+      name: "sync-probe",
+      description: "Starts with alphaword.",
+      content: "",
+      scope: "swarm",
+    });
+    expect(await topNames("alphaword")).toEqual(["sync-probe"]);
+
+    await updateSkill(skill.id, { description: "Now about betaword." });
+    expect(await topNames("betaword")).toEqual(["sync-probe"]);
+    expect(await topNames("alphaword")).toEqual([]);
+
+    await deleteSkill(skill.id);
+    expect(await topNames("betaword")).toEqual([]);
+    const ftsRows = getDb()
+      .query<{ n: number }, [string]>("SELECT count(*) AS n FROM skills_fts WHERE skill_id = ?")
+      .get(skill.id);
+    expect(ftsRows?.n).toBe(0);
+  });
 
-    expect(skills.map((skill) => skill.name)).toContain("call-time-trap-placement");
+  test("migrated schema carries the sync triggers", () => {
+    const triggers = getDb()
+      .query<{ name: string }, []>(
+        "SELECT name FROM sqlite_master WHERE type = 'trigger' AND tbl_name = 'skills' AND name LIKE 'skills_fts_%' ORDER BY name",
+      )
+      .all()
+      .map((row) => row.name);
+    expect(triggers).toEqual(["skills_fts_delete", "skills_fts_insert", "skills_fts_update"]);
   });
 });
+
+test("migration 239 backfills skills that existed before it ran", async () => {
+  const db = new Database(":memory:");
+  try {
+    db.exec(await Bun.file("src/be/migrations/019_skills.sql").text());
+    db.run(
+      "INSERT INTO skills (id, name, description, content, type, scope, createdAt, lastUpdatedAt) VALUES ('s1', 'legacy-skill', 'Old description', 'old body', 'remote', 'swarm', '2026-01-01', '2026-01-01')",
+    );
+    db.exec(await Bun.file("src/be/migrations/239_skills_fts.sql").text());
+
+    const rows = db
+      .query<{ skill_id: string }, [string]>(
+        "SELECT skill_id FROM skills_fts WHERE skills_fts MATCH ?",
+      )
+      .all('"body"');
+    expect(rows.map((row) => row.skill_id)).toEqual(["s1"]);
+
+    // Re-running the migration does not duplicate backfilled rows.
+    db.exec(await Bun.file("src/be/migrations/239_skills_fts.sql").text());
+    expect(db.query<{ n: number }, []>("SELECT count(*) AS n FROM skills_fts").get()?.n).toBe(1);
+  } finally {
+    db.close();
+  }
+});

package/src/tests/user-roles-http.test.ts

@@ -0,0 +1,204 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { closeDb, createAgent, createUser, getDbClient, initDb } from "../be/db";
+import { ensureRbacSeedsSynced, listUserRoles, setUserRoles } from "../be/rbac-roles";
+import { type IdentityActor, listUserEvents, mintToken } from "../be/users";
+import { handleApprovalRequests } from "../http/approval-requests";
+import { handleCore } from "../http/core";
+import { handleTasks } from "../http/tasks";
+import { handleUserRoles } from "../http/user-roles";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+const key = `user-roles-test-${crypto.randomUUID()}`;
+const ACTOR: IdentityActor = { kind: "operator", id: "user-roles-test" };
+let server: Server;
+let baseUrl: string;
+let leadId: string;
+
+async function request(
+  path: string,
+  bearer: string,
+  options: { method?: string; body?: unknown; headers?: Record<string, string> } = {},
+) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: options.method ?? (options.body === undefined ? "GET" : "POST"),
+    headers: {
+      Authorization: `Bearer ${bearer}`,
+      "Content-Type": "application/json",
+      ...options.headers,
+    },
+    body: options.body === undefined ? undefined : JSON.stringify(options.body),
+  });
+  const text = await res.text();
+  let body: any = text;
+  try {
+    body = JSON.parse(text);
+  } catch {}
+  return { status: res.status, text, body };
+}
+
+const putRoles = (userId: string, bearer: string, roles: string[], headers = {}) =>
+  request(`/api/users/${userId}/roles`, bearer, { method: "PUT", body: { roles }, headers });
+
+async function newUser(name: string, roles?: string[]) {
+  const user = await createUser({ name });
+  if (roles) await setUserRoles(user.id, roles, null);
+  const token = (await mintToken(user.id, name, ACTOR)).plaintext;
+  return { id: user.id, token };
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse) {
+  const id = req.headers["x-agent-id"] as string | undefined;
+  if (await handleCore(req, res, id, key)) return;
+  const segments = getPathSegments(req.url ?? "");
+  const query = parseQueryParams(req.url ?? "");
+  if (await handleUserRoles(req, res, segments, query)) return;
+  if (await handleApprovalRequests(req, res, segments, query)) return;
+  if (await handleTasks(req, res, segments, query, id)) return;
+  res.writeHead(404).end();
+}
+
+beforeAll(async () => {
+  initDb(":memory:");
+  ensureRbacSeedsSynced({ quiet: true });
+  leadId = (await createAgent({ name: "roles-lead", isLead: true, status: "idle" })).id;
+  server = createServer((req, res) => {
+    void dispatch(req, res).catch(() => res.writeHead(500).end());
+  });
+  baseUrl = `http://127.0.0.1:${await listenOnFreePort(server)}`;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+});
+
+describe("PUT /api/users/{id}/roles", () => {
+  test("a role change changes what the user may do", async () => {
+    await newUser("keeper-admin");
+    const alice = await newUser("alice");
+    const task = { task: "do a thing" };
+    expect((await request("/api/tasks", alice.token, { body: task })).status).not.toBe(403);
+
+    const set = await putRoles(alice.id, key, ["viewer"]);
+    expect(set.status).toBe(200);
+    expect(set.body.roles.map((r: { name: string }) => r.name)).toEqual(["viewer"]);
+    expect((await request("/api/tasks", alice.token, { body: task })).status).toBe(403);
+    expect((await request("/api/tasks", alice.token)).status).not.toBe(403);
+
+    expect((await putRoles(alice.id, key, ["admin"])).status).toBe(200);
+    expect((await request("/api/tasks", alice.token, { body: task })).status).not.toBe(403);
+  });
+
+  test("a demoted user can no longer answer approvals", async () => {
+    const bob = await newUser("bob", ["requester"]);
+    const res = await request(`/api/approval-requests/${crypto.randomUUID()}/respond`, bob.token, {
+      body: { responses: {} },
+    });
+    expect(res.status).toBe(403);
+    expect(res.text).toContain("approval.respond");
+  });
+
+  test("only an operator or a grant-all user may change roles", async () => {
+    const target = await newUser("target");
+    const requester = await newUser("requester-user", ["requester"]);
+    const viewer = await newUser("viewer-user", ["viewer"]);
+    const admin = await newUser("admin-user");
+    expect((await putRoles(target.id, requester.token, ["viewer"])).status).toBe(403);
+    expect((await putRoles(target.id, viewer.token, ["viewer"])).status).toBe(403);
+    // The shared key acting as an agent is not the operator.
+    expect((await putRoles(target.id, key, ["viewer"], { "X-Agent-ID": leadId })).status).toBe(403);
+    expect((await putRoles(target.id, admin.token, ["requester"])).status).toBe(200);
+  });
+
+  test("a custom role holding user.role.manage cannot grant admin", async () => {
+    const target = await newUser("grant-target");
+    const manager = await newUser("manager", ["viewer"]);
+    const client = getDbClient();
+    await client.run(
+      "INSERT INTO roles (id, name, description, isBuiltin, grantsAll) VALUES ('role-rm', 'role-manager', 'x', 0, 0)",
+    );
+    await client.run(
+      "INSERT INTO role_permissions (roleId, verb) VALUES ('role-rm', 'user.role.manage')",
+    );
+    await client.run(
+      "INSERT INTO principal_roles (principalType, principalId, roleId) VALUES ('user', ?, 'role-rm')",
+      [manager.id],
+    );
+    expect((await putRoles(target.id, manager.token, ["admin"])).status).toBe(403);
+  });
+
+  test("last-admin guard", async () => {
+    const client = getDbClient();
+    await client.run("UPDATE users SET status = 'suspended'");
+    const sole = await newUser("sole-admin");
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(409);
+    expect((await listUserRoles(sole.id)).map((r) => r.name)).toEqual(["admin"]);
+
+    const second = await newUser("second-admin");
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(200);
+    // second is now the sole active admin; a suspended admin may still be demoted.
+    await client.run("UPDATE users SET status = 'suspended' WHERE id = ?", [second.id]);
+    const third = await newUser("third");
+    await client.run("UPDATE users SET status = 'suspended' WHERE id = ?", [third.id]);
+    expect((await putRoles(third.id, key, ["requester"])).status).toBe(200);
+    await client.run("UPDATE users SET status = 'active'");
+  });
+
+  test("validation", async () => {
+    const user = await newUser("validated");
+    for (const roles of [[], ["nope"], ["admin", "viewer"]]) {
+      expect((await putRoles(user.id, key, roles)).status).toBe(400);
+    }
+    expect((await putRoles("missing-user", key, ["viewer"])).status).toBe(404);
+    expect((await listUserRoles(user.id)).map((r) => r.name)).toEqual(["admin"]);
+  });
+
+  test("agent rows in principal_roles are neither listed nor counted as admins", async () => {
+    const client = getDbClient();
+    await client.run("UPDATE users SET status = 'suspended'");
+    const sole = await newUser("sole-with-agent-twin");
+    await client.run(
+      `INSERT INTO principal_roles (principalType, principalId, roleId)
+       VALUES ('agent', 'agent-twin', 'rbac-role-admin')`,
+    );
+    const twin = await client.get<{ id: string }>("SELECT id FROM users WHERE id = ?", [sole.id]);
+    await client.run("UPDATE principal_roles SET principalId = ? WHERE principalType = 'agent'", [
+      twin!.id,
+    ]);
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(409);
+    const roles = await request(`/api/users/${sole.id}/roles`, key);
+    expect(roles.body.roles.map((r: { name: string }) => r.name)).toEqual(["admin"]);
+    await client.run("DELETE FROM principal_roles WHERE principalType = 'agent'");
+    await client.run("UPDATE users SET status = 'active'");
+  });
+
+  test("audit event and role catalog", async () => {
+    const user = await newUser("audited");
+    await putRoles(user.id, key, ["requester"]);
+    const events = await listUserEvents(user.id);
+    const change = events.find((e) => e.eventType === "profile_changed");
+    expect(JSON.stringify(change)).toContain("requester");
+    expect(JSON.stringify(change)).toContain("admin");
+
+    const catalog = await request("/api/rbac/roles", key);
+    const primary = catalog.body.roles.filter((r: { primary: boolean }) => r.primary);
+    expect(primary.map((r: { name: string }) => r.name).sort()).toEqual([
+      "admin",
+      "requester",
+      "viewer",
+    ]);
+  });
+
+  test("persists with RBAC disabled", async () => {
+    process.env.RBAC_ENABLED = "false";
+    try {
+      const user = await newUser("rbac-off");
+      expect((await putRoles(user.id, key, ["viewer"])).status).toBe(200);
+      expect((await listUserRoles(user.id)).map((r) => r.name)).toEqual(["viewer"]);
+    } finally {
+      delete process.env.RBAC_ENABLED;
+    }
+  });
+});

package/src/tests/workflow-hitl-dynamic-questions.test.ts

@@ -11,6 +11,7 @@ import {
   initDb,
 } from "../be/db";
 import type { WorkflowDefinition } from "../types";
+import { buildSlackQuestionsSummary } from "../workflows/approval-notifications";
 import { validateDefinition } from "../workflows/definition";
 import { interpolateNodeConfig, startWorkflowExecution } from "../workflows/engine";
 import { InProcessEventBus } from "../workflows/event-bus";
@@ -20,7 +21,6 @@ import {
   type ExecutorResult,
 } from "../workflows/executors/base";
 import {
-  buildSlackQuestionsSummary,
   HumanInTheLoopExecutor,
   MAX_HITL_QUESTIONS,
   resolveHitlQuestions,