@desplega.ai/agent-swarm 2.5.2 → 2.5.4

package/src/tests/extensions-pre-task.test.ts

@@ -22,9 +22,12 @@ import * as dbClient from "../be/db-client";
 import type { InstallExtensionArgs as ExtensionInstallBody } from "../be/extensions/db";
 import { installExtension, listExtensionRuns } from "../be/extensions/db";
 import { getCatalogEntry } from "../extensions/catalog";
+import type { TaskBlockedEvent } from "../extensions/contract";
 import { disableExtension, enableExtension, stopExtensionRuntime } from "../extensions/lifecycle";
+import { initExtensionPostBridge, teardownExtensionPostBridge } from "../extensions/post-bridge";
 import { handleTasks } from "../http/tasks";
 import { dispatchScheduleTarget } from "../scheduler/scheduler";
+import { bufferThreadMessage, instantFlush } from "../slack/thread-buffer";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { createWorkerTaskFollowUp } from "../tasks/worker-follow-up";
 import { registerSendTaskTool, sendTaskHandler } from "../tools/send-task";
@@ -145,6 +148,276 @@ describe("extension task boundaries", () => {
     await client.run("DELETE FROM agents");
   });
 
+  describe("post.task.blocked", () => {
+    const events: unknown[] = [];
+    const capture = (event: unknown) => {
+      events.push(event);
+    };
+
+    beforeAll(() => {
+      initExtensionPostBridge();
+      workflowEventBus.on("task.create_blocked", capture);
+    });
+
+    afterAll(() => {
+      workflowEventBus.off("task.create_blocked", capture);
+      teardownExtensionPostBridge();
+    });
+
+    beforeEach(() => {
+      events.length = 0;
+    });
+
+    async function waitForCounter(
+      extension: Awaited<ReturnType<typeof installAndEnable>>,
+      key: string,
+      count = 1,
+    ): Promise<void> {
+      const deadline = Date.now() + 3_000;
+      while (Date.now() < deadline) {
+        const entry = await getKv(`task:agent:${extension.agentId}`, key);
+        if (entry?.value === count) return;
+        await Bun.sleep(10);
+      }
+      throw new Error(`post.task.blocked was not recorded ${count} time(s)`);
+    }
+
+    async function recordedBlock(
+      extension: Awaited<ReturnType<typeof installAndEnable>>,
+      count = 1,
+    ): Promise<TaskBlockedEvent> {
+      await waitForCounter(extension, "ext:record-blocks:count", count);
+      return (await getKv(`task:agent:${extension.agentId}`, "ext:record-blocks:last"))
+        ?.value as TaskBlockedEvent;
+    }
+
+    test.each([
+      "rest",
+      "mcp",
+      "slack",
+      "schedule",
+    ] as const)("%s delivers one blocked event with its source and requester", async (origin) => {
+      const blocker = await installAndEnable("block-tasks-from-source", { source: origin });
+      const recorder = await installAndEnable("record-blocks");
+      let requester: TaskBlockedEvent["requester"] = {};
+      let scheduleId: string | undefined;
+
+      if (origin === "rest") {
+        const user = await createUser({ name: "Blocked REST requester" });
+        requester = { userId: user.id };
+        expect(
+          (await postTask({ task: "blocked REST task", requestedByUserId: user.id })).status,
+        ).toBe(422);
+      } else if (origin === "mcp") {
+        const caller = await createAgent({ name: "blocked-mcp-caller", status: "idle" });
+        requester = { agentId: caller.id };
+        const server = new McpServer({ name: "blocked-event-send", version: "1.0.0" });
+        registerSendTaskTool(server);
+        const result = await registeredSendTask(server).handler(sendTaskArgs("blocked MCP task"), {
+          sessionId: "blocked-event",
+          requestInfo: { headers: { "x-agent-id": caller.id } },
+        });
+        expect(result.isError).toBe(true);
+      } else if (origin === "slack") {
+        requester = { slackUserId: "U_BLOCKED_EVENT" };
+        await createAgent({ name: "blocked-slack-lead", isLead: true, status: "idle" });
+        bufferThreadMessage(
+          "C_BLOCKED_EVENT",
+          "1000.0001",
+          "blocked Slack task",
+          "U_BLOCKED_EVENT",
+          "1000.0002",
+        );
+        await instantFlush("C_BLOCKED_EVENT:1000.0001");
+      } else {
+        const schedule = await createScheduledTask({
+          name: "blocked-event-schedule",
+          taskTemplate: "blocked schedule task",
+          intervalMs: 60_000,
+        });
+        scheduleId = schedule.id;
+        await expect(dispatchScheduleTarget(schedule)).rejects.toThrow(
+          "Task source schedule is blocked",
+        );
+      }
+
+      const event = await recordedBlock(recorder);
+      expect(events).toHaveLength(1);
+      expect(event).toMatchObject({
+        extension: { id: blocker.id, name: "block-tasks-from-source" },
+        origin,
+        source: origin === "rest" ? "api" : origin,
+        requester,
+      });
+      expect(event.requester).toEqual(requester);
+      if (scheduleId) expect(event.context?.scheduleId).toBe(scheduleId);
+      expect(event).not.toHaveProperty("task");
+      expect(event).not.toHaveProperty("taskId");
+    });
+
+    test("scrubs and bounds the payload, preserving correlation on each retry", async () => {
+      const secret = `ghp_${"Z".repeat(36)}`;
+      await installSource(
+        "secret-blocker",
+        `
+import { block, type SwarmExtension } from "swarm-extension";
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => block(${JSON.stringify(`Ticket required: ${secret}`)}));
+};
+export default extension;
+`,
+      );
+      const recorder = await installAndEnable("record-blocks");
+      const context = {
+        contextKey: "github:acme/project:7",
+        scheduleId: crypto.randomUUID(),
+        workflowRunId: crypto.randomUUID(),
+        workflowRunStepId: crypto.randomUUID(),
+        parentTaskId: crypto.randomUUID(),
+        vcsRepo: "acme/project",
+        vcsNumber: 7,
+        slackChannelId: "C_CORRELATED_BLOCK",
+        slackThreadTs: "2000.0001",
+      };
+      const requester = {
+        userId: crypto.randomUUID(),
+        agentId: crypto.randomUUID(),
+        slackUserId: "U_CORRELATED_BLOCK",
+      };
+      for (const attempt of [1, 2]) {
+        await expect(
+          createTaskWithSiblingAwareness(
+            `${"x".repeat(480)} ${secret}`,
+            {
+              ...context,
+              source: "github",
+              requestedByUserId: requester.userId,
+              creatorAgentId: requester.agentId,
+              slackUserId: requester.slackUserId,
+            },
+            { origin: "webhook" },
+          ),
+        ).rejects.toThrow("Ticket required:");
+        const event = await recordedBlock(recorder, attempt);
+        expect(events).toHaveLength(attempt);
+        expect(event.reason).toContain("[REDACTED:");
+        expect(event.reason).not.toContain(secret);
+        expect(event.description).toHaveLength(500);
+        expect(event.description).not.toContain("ghp_");
+        expect(event.context).toEqual(context);
+        expect(event.requester).toEqual(requester);
+      }
+    });
+
+    test("a rejected model rewrite emits a block attributed to its editor", async () => {
+      const codex = await createAgent({
+        name: "blocked-rewrite-codex",
+        harnessProvider: "codex",
+        status: "idle",
+      });
+      const editor = await installSource(
+        "incompatible-model",
+        `
+import { modify, type SwarmExtension } from "swarm-extension";
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => modify({ model: "claude-opus-5-5" }));
+};
+export default extension;
+`,
+      );
+      const recorder = await installAndEnable("record-blocks");
+      const result = await postTask({
+        task: "incompatible rewrite",
+        agentId: codex.id,
+        routingReason: "human_pinned",
+      });
+      expect(result.status).toBe(422);
+      const event = await recordedBlock(recorder);
+      expect(events).toHaveLength(1);
+      expect(event.extension).toEqual({ id: editor.id, name: "incompatible-model" });
+      expect(event.reason).toContain("rewrite");
+      expect(event.reason).toContain("codex");
+    });
+
+    test("the creator is skipped while the blocking extension receives its own block", async () => {
+      const creator = await installAndEnable("record-blocks");
+      const blocker = await installSource(
+        "blocking-recorder",
+        `
+import { block, type SwarmExtension } from "swarm-extension";
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", () => block("blocked by recorder"));
+  api.on("post.task.blocked", async (_event, ctx) => { await ctx.state.incr("count"); });
+};
+export default extension;
+`,
+      );
+      const observerBundle = await loadBundleFixture("record-blocks");
+      const installedObserver = await installExtension({
+        ...observerBundle,
+        manifest: { ...observerBundle.manifest, name: "last-block-observer" },
+        priority: 1_000,
+      });
+      const observer = await enableExtension(installedObserver.extension.id);
+      const server = new McpServer({ name: "extension-blocked-event", version: "1.0.0" });
+      registerSendTaskTool(server);
+      const result = await registeredSendTask(server).handler(
+        sendTaskArgs("extension task"),
+        markExtensionRequestOrigin({
+          sessionId: "blocked-extension",
+          requestInfo: { headers: { "x-agent-id": creator.agentId! } },
+        }),
+      );
+      expect(result.isError).toBe(true);
+      // The final subscriber acknowledges only after every earlier recipient has finished.
+      await waitForCounter(observer, "ext:last-block-observer:count");
+      expect(
+        (await getKv(`task:agent:${blocker.agentId}`, "ext:blocking-recorder:count"))?.value,
+      ).toBe(1);
+      expect(events).toHaveLength(1);
+      expect(events[0]).toMatchObject({ origin: "extension:record-blocks" });
+      expect(await getKv(`task:agent:${creator.agentId}`, "ext:record-blocks:count")).toBeNull();
+      expect(await listExtensionRuns(creator.id)).toEqual([]);
+      const runs = await listExtensionRuns(blocker.id);
+      expect(runs).toContainEqual(
+        expect.objectContaining({
+          event: "post.task.blocked",
+          agentId: creator.agentId,
+          subject: "extension:record-blocks: blocking-recorder",
+        }),
+      );
+    });
+
+    test("continue and valid rewrites emit no blocked event", async () => {
+      const recorder = await installAndEnable("record-blocks");
+      expect((await postTask({ task: "continued task" })).status).toBe(201);
+      await installAndEnable("rewrite-task-priority");
+      const modified = await postTask({ task: "rewritten task" });
+      expect(modified.status).toBe(201);
+      expect(modified.body.priority).toBe(1);
+      expect(events).toEqual([]);
+      expect(await getKv(`task:agent:${recorder.agentId}`, "ext:record-blocks:count")).toBeNull();
+    });
+
+    test("a throwing bus observer does not replace the blocked response", async () => {
+      await installAndEnable("block-tasks-from-source", { source: "rest" });
+      let calls = 0;
+      const observer = () => {
+        calls++;
+        throw new Error("broken block observer");
+      };
+      const error = spyOn(console, "error").mockImplementation(() => {});
+      workflowEventBus.on("task.create_blocked", observer);
+      try {
+        expect((await postTask({ task: "still blocked" })).status).toBe(422);
+        expect(calls).toBe(1);
+      } finally {
+        workflowEventBus.off("task.create_blocked", observer);
+        error.mockRestore();
+      }
+    });
+  });
+
   test("REST task creation applies rewrites and reports blocks as 422", async () => {
     const rewrite = await installAndEnable("rewrite-task-priority");
     const created = await postTask({ task: "rewrite this task" });

package/src/tests/fetch-resolved-env.test.ts

@@ -14,6 +14,7 @@ import {
   fetchResolvedEnv,
   RELOADABLE_ENV_KEYS,
 } from "../commands/runner";
+import { contextBoundNoteThreshold } from "../hooks/context-bound-note";
 import { checkCodexCredentials } from "../providers/codex-adapter";
 import { MASKED_SECRET_VALUE } from "../utils/config-secrets";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
@@ -795,6 +796,22 @@ describe("agent-scoped PI_CODEMODE_MODELS reaches the worker env", () => {
   });
 });
 
+describe("agent-scoped CONTEXT_BOUND_NOTE_TOKENS turns the note on for one agent", () => {
+  // Each session's env is this agent's /api/config/resolved result (global,
+  // then agent, then repo rows), and every adapter reads the threshold from it.
+  test("the agent with the row gets the threshold; an agent without it stays off", async () => {
+    mockResponsesByAgentId.set("bound-note-pilot", {
+      status: 200,
+      body: { configs: [{ key: "CONTEXT_BOUND_NOTE_TOKENS", value: "150000" }] },
+    });
+    const baseEnv: Record<string, string | undefined> = {};
+    const pilot = await fetchResolvedEnv(testUrl, "key", "bound-note-pilot", baseEnv);
+    const other = await fetchResolvedEnv(testUrl, "key", "bound-note-other", baseEnv);
+    expect(contextBoundNoteThreshold(pilot.env)).toBe(150_000);
+    expect(contextBoundNoteThreshold(other.env)).toBe(0);
+  });
+});
+
 describe("deleting a reloadable config row", () => {
   // One key per test: the runner remembers each overridden key's boot value
   // for the life of the process.

package/src/tests/fixtures/extensions/record-blocks/hooks.ts

@@ -0,0 +1,10 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("post.task.blocked", async (event, ctx) => {
+    await ctx.state.set("last", event);
+    await ctx.state.incr("count");
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/record-blocks/manifest.json

@@ -0,0 +1,7 @@
+{
+  "name": "record-blocks",
+  "description": "Records blocked task attempts",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": { "hooks": "hooks.ts" }
+}

package/src/tests/fixtures/fake-amp.ts

@@ -104,12 +104,19 @@ async function main() {
   );
 
   const sessionId = "T-fake-session";
-  const usage = {
-    input_tokens: 4,
-    output_tokens: 5,
-    cache_creation_input_tokens: 1000,
-    cache_read_input_tokens: 200,
-  };
+  // `AMP_TEST_REQUEST_USAGE`: "missing" drops per-request usage, "corrupt" sends non-numbers.
+  const requestUsage = process.env.AMP_TEST_REQUEST_USAGE;
+  const usage =
+    requestUsage === "missing"
+      ? undefined
+      : requestUsage === "corrupt"
+        ? { input_tokens: "lots", cache_creation_input_tokens: null, cache_read_input_tokens: {} }
+        : {
+            input_tokens: 4,
+            output_tokens: 5,
+            cache_creation_input_tokens: 1000,
+            cache_read_input_tokens: 200,
+          };
   // Amp runs shell commands in a session of its own, outside the process group.
   // Return only once the child has left: a group kill that lands before its
   // setsid() would take it down and hide a leak.
@@ -217,8 +224,13 @@ async function main() {
       session_id: sessionId,
     });
     turns += 1;
-    const steerTool = mode === "steer" || mode.startsWith("steer-crash");
-    if (mode === "tool" || (steerTool && index === 0)) {
+    const steerTool = mode === "steer" || mode === "steer-twice" || mode.startsWith("steer-crash");
+    const toolCalls = mode === "steer-twice" ? 2 : 1;
+    for (
+      let call = 0;
+      call < toolCalls && (mode === "tool" || (steerTool && index === 0));
+      call++
+    ) {
       assistant(
         [{ type: "tool_use", id: "TU-1", name: "code_exec", input: { code: "1+1" } }],
         "tool_use",
@@ -261,6 +273,8 @@ async function main() {
     if (mode === "success-child") await startDetachedChild();
     // A turn that thinks for a while with no tool call.
     if (mode === "steer-no-tool") await Bun.sleep(600);
+    // `AMP_TEST_POST_RESULT_DELAY_MS`: the final reply takes this long after the last tool result.
+    await Bun.sleep(Number(process.env.AMP_TEST_POST_RESULT_DELAY_MS) || 0);
     lastText = mode.startsWith("steer") ? `DONE${index + 1}` : "Done ✓";
     assistant([{ type: "text", text: lastText }], "end_turn");
   };

package/src/tests/fixtures/held-template-render.ts

@@ -0,0 +1,42 @@
+import { configureHttpResolver, resetHttpResolver } from "../../prompts/resolver";
+
+export const HELD_NOTE_TEXT = "Finish current work and complete or defer.";
+
+/**
+ * Point the prompt resolver at a local server whose template responses wait
+ * for `release()`, so a test can choose when an async note render finishes.
+ * `requested` resolves on the first render request. `stop()` releases,
+ * restores the resolver and closes the server.
+ */
+export function holdTemplateRender(): {
+  release: () => void;
+  requested: Promise<void>;
+  stop: () => void;
+} {
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let onRequest!: () => void;
+  const requested = new Promise<void>((resolve) => {
+    onRequest = resolve;
+  });
+  const server = Bun.serve({
+    port: 0,
+    async fetch() {
+      onRequest();
+      await gate;
+      return Response.json({ text: HELD_NOTE_TEXT, skipped: false, unresolved: [] });
+    },
+  });
+  configureHttpResolver(`http://localhost:${server.port}`, "test");
+  return {
+    release,
+    requested,
+    stop: () => {
+      release();
+      resetHttpResolver();
+      server.stop(true);
+    },
+  };
+}

package/src/tests/fixtures/workflow-idempotency-trigger.child.ts

@@ -0,0 +1,73 @@
+/**
+ * One keyed workflow trigger on its own DB connection, for
+ * `workflow-idempotency.test.ts`. Runs the HTTP handler's sequence: look the
+ * key up, then start the run with the key recorded in the run's transaction,
+ * and answer from the record when a concurrent process took the key first.
+ *
+ * Barrier: after the lookup finds nothing it creates `<dir>/looked-<n>` and
+ * waits for `<dir>/go`, so the parent can release every child only once all
+ * of them are past the lookup and about to race for the write lock.
+ *
+ * Prints one JSON line: `{ runId, replayed }`.
+ */
+import { join } from "node:path";
+import { getWorkflow, initDb } from "../../be/db";
+import {
+  findAcceptedWorkflowOperation,
+  IdempotencyKeyTakenError,
+  recordAcceptedWorkflowOperation,
+  type WorkflowIdempotencyClaim,
+  workflowRequestFingerprint,
+} from "../../be/db/workflow-idempotency";
+import { getExecutorRegistry, startWorkflowExecution } from "../../workflows";
+
+const [dbPath, workflowId, key, barrierDir, n] = process.argv.slice(2);
+if (!dbPath || !workflowId || !key || !barrierDir || !n) {
+  console.error("usage: workflow-idempotency-trigger.child <db> <workflowId> <key> <dir> <n>");
+  process.exit(2);
+}
+
+const realLog = console.log;
+console.log = () => {};
+console.debug = () => {};
+console.warn = () => {};
+
+initDb(dbPath);
+const workflow = await getWorkflow(workflowId);
+if (!workflow) throw new Error(`workflow ${workflowId} not found`);
+
+const body = { n: 1 };
+const claim: WorkflowIdempotencyClaim = {
+  principal: "agent:concurrency-test",
+  operation: "workflow.trigger",
+  targetId: workflowId,
+  key,
+  fingerprint: workflowRequestFingerprint("workflow.trigger", body),
+};
+
+if (await findAcceptedWorkflowOperation(claim)) throw new Error("key already accepted");
+await Bun.write(join(barrierDir, `looked-${n}`), "");
+const go = Bun.file(join(barrierDir, "go"));
+while (!(await go.exists())) await Bun.sleep(5);
+
+let result: { runId: string; replayed: boolean };
+try {
+  const runId = await startWorkflowExecution(workflow, body, getExecutorRegistry(), {
+    triggerType: "api",
+    accept: (run) =>
+      recordAcceptedWorkflowOperation(claim, {
+        workflowId,
+        runId: run.runId,
+        status: 201,
+        body: run,
+      }),
+  });
+  result = { runId, replayed: false };
+} catch (err) {
+  if (!(err instanceof IdempotencyKeyTakenError)) throw err;
+  const accepted = await findAcceptedWorkflowOperation(claim);
+  result = { runId: (accepted?.body as { runId: string }).runId, replayed: true };
+}
+
+realLog(JSON.stringify(result));
+process.exit(0);

package/src/tests/list-endpoint-slimming.test.ts

@@ -266,6 +266,39 @@ describe("list-endpoint slimming", () => {
     }
   });
 
+  test("getAllTasks — the preview starts after a leading sibling block", async () => {
+    // `prependSiblingBlock` output: a long block, a blank line, then the ask.
+    const agentId = "preview-sibling-agent";
+    const sibling = (n: number) =>
+      `- [in_progress] task:${n} — agent:Picateclas — started 2m ago, last active 10s ago\n  "${"é".repeat(190)}"`;
+    const block = `<sibling_tasks_in_progress>\nThe following tasks are already running in the same context (contextKey: slack:C1:1.2). The user has submitted new input while they were in flight — coordinate with them, do not duplicate:\n\n${[1, 2, 3].map(sibling).join("\n")}\n</sibling_tasks_in_progress>`;
+    const ask = `also bump the version ${"v".repeat(400)}`;
+    const texts = [
+      `${block}\n\n${ask}`,
+      `${block}\nno blank line`,
+      // No closing tag: nothing to skip.
+      `<sibling_tasks_in_progress>\n${"x".repeat(400)}`,
+      // Not at the start: nothing to skip.
+      `lead in\n\n${block}\n\nask`,
+    ];
+    for (const text of texts) await createTaskExtended(text, { agentId });
+
+    const expected = [
+      `${ask.slice(0, 300)}…`,
+      "\nno blank line",
+      `<sibling_tasks_in_progress>\n${"x".repeat(272)}…`,
+      `${`lead in\n\n${block}\n\nask`.slice(0, 300)}…`,
+    ].sort();
+    for (const opts of [{ slim: true }, { fields: "timeline" as const }]) {
+      const rows = await getAllTasks({ agentId, limit: 50 }, opts);
+      expect(rows.map((t) => t.task).sort()).toEqual(expected);
+    }
+    // Session roots map the full text, so the JS skip must agree with the SQL one.
+    const sessions = await listRecentSessions({ limit: 200, slim: true });
+    const roots = sessions.filter((s) => s.root.agentId === agentId).map((s) => s.root.task);
+    expect(roots.sort()).toEqual(expected);
+  });
+
   test("getAllTasks — slim and full pages hold the same rows in the same order", async () => {
     for (let i = 0; i < 12; i++) {
       await createTaskExtended(`page-parity ${i}`, { agentId: "slim-agent-1" });

package/src/tests/migration-240-workflow-run-parent-step-attempt.test.ts

@@ -0,0 +1,55 @@
+import { Database } from "bun:sqlite";
+import { expect, test } from "bun:test";
+
+test("migration 240 hands each legacy child to the attempt that owns it now", async () => {
+  const db = new Database(":memory:");
+  try {
+    db.exec("CREATE TABLE workflow_runs (id TEXT PRIMARY KEY, workflowId TEXT, status TEXT)");
+    db.exec(
+      `CREATE TABLE workflow_run_steps (
+         id TEXT PRIMARY KEY, status TEXT, retryCount INTEGER NOT NULL DEFAULT 0, nextRetryAt TEXT
+       )`,
+    );
+    db.exec(await Bun.file("src/be/migrations/203_workflow_run_parent_step.sql").text());
+    const step = db.query(
+      "INSERT INTO workflow_run_steps (id, status, retryCount, nextRetryAt) VALUES (?, ?, ?, ?)",
+    );
+    // Created on attempt 1 (attempt 0 failed before any child existed) and parked.
+    step.run("parked-retry", "waiting", 1, null);
+    // Its child failed; attempt 2 is queued and must start a new child.
+    step.run("queued-retry", "failed", 2, "2030-01-01T00:00:00.000Z");
+    step.run("first-attempt", "completed", 0, null);
+    step.run("exhausted", "failed", 3, null);
+    const run = db.query(
+      "INSERT INTO workflow_runs (id, workflowId, status, parentStepId) VALUES (?, 'wf', ?, ?)",
+    );
+    run.run("child-parked", "waiting", "parked-retry");
+    run.run("child-queued", "failed", "queued-retry");
+    run.run("child-first", "completed", "first-attempt");
+    run.run("child-exhausted", "failed", "exhausted");
+    run.run("child-orphan", "completed", "missing-step");
+    run.run("top-level", "completed", null);
+
+    db.exec(await Bun.file("src/be/migrations/240_workflow_run_parent_step_attempt.sql").text());
+
+    expect(
+      db.prepare("SELECT id, parentStepAttempt AS attempt FROM workflow_runs ORDER BY id").all(),
+    ).toEqual([
+      { id: "child-exhausted", attempt: 3 },
+      { id: "child-first", attempt: 0 },
+      { id: "child-orphan", attempt: 0 },
+      { id: "child-parked", attempt: 1 },
+      { id: "child-queued", attempt: 1 },
+      { id: "top-level", attempt: 0 },
+    ]);
+    // One child per attempt: a second child for the parked attempt is rejected,
+    // one for the queued attempt is the new invocation.
+    const insert = db.query(
+      "INSERT INTO workflow_runs (id, workflowId, status, parentStepId, parentStepAttempt) VALUES (?, 'wf', 'running', ?, ?)",
+    );
+    expect(() => insert.run("dup", "parked-retry", 1)).toThrow();
+    insert.run("next", "queued-retry", 2);
+  } finally {
+    db.close();
+  }
+});

package/src/tests/openapi-route-headers.test.ts

@@ -75,6 +75,8 @@ describe("runtime identity header in OpenAPI", () => {
       "GET /api/poll",
       "POST /api/mcp-bridge",
       "POST /api/scripts/run",
+      "POST /api/workflows",
+      "POST /api/workflows/{id}/trigger",
       "POST /close",
       "POST /ping",
       "PUT /api/agents/{id}/credential-status",