@desplega.ai/agent-swarm 2.5.3 → 2.5.4

package/src/tests/script-run-config-scope.test.ts

@@ -2,7 +2,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { createServer, type Server } from "node:http";
 import { closeDb, createAgent, initDb, upsertSwarmConfig } from "../be/db";
-import { mintScriptRunToken, revokeSessionToken } from "../be/users";
+import { mintAgentToken, mintScriptRunToken, revokeSessionToken } from "../be/users";
 import { handleConfig } from "../http/config";
 import { handleCore } from "../http/core";
 import { handleSessions } from "../http/sessions";
@@ -17,12 +17,16 @@ import { listenOnFreePort } from "./test-net";
 const API_KEY = `script-run-config-operator-${randomBytes(8).toString("hex")}`;
 const WORKER_SECRET = `worker-secret-${randomBytes(8).toString("hex")}`;
 const OTHER_SECRET = `other-secret-${randomBytes(8).toString("hex")}`;
+const GLOBAL_SECRET = `global-secret-${randomBytes(8).toString("hex")}`;
+const SHADOWED_GLOBAL = `shadowed-global-${randomBytes(8).toString("hex")}`;
+const SHADOWING_AGENT = `shadowing-agent-${randomBytes(8).toString("hex")}`;
 
 let server: Server;
 let baseUrl: string;
 let workerId: string;
 let otherId: string;
 let otherConfigId: string;
+let ownConfigId: string;
 
 function headers(bearer: string, agentId?: string): Record<string, string> {
   return {
@@ -36,11 +40,32 @@ beforeAll(async () => {
   initDb(":memory:");
   workerId = (await createAgent({ name: "script-run-worker", isLead: false, status: "idle" })).id;
   otherId = (await createAgent({ name: "script-run-other", isLead: false, status: "idle" })).id;
+  ownConfigId = (
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: workerId,
+      key: "OWN_SECRET",
+      value: WORKER_SECRET,
+      isSecret: true,
+    })
+  ).id;
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "GLOBAL_SECRET",
+    value: GLOBAL_SECRET,
+    isSecret: true,
+  });
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "SHADOWED",
+    value: SHADOWED_GLOBAL,
+    isSecret: true,
+  });
   await upsertSwarmConfig({
     scope: "agent",
     scopeId: workerId,
-    key: "OWN_SECRET",
-    value: WORKER_SECRET,
+    key: "SHADOWED",
+    value: SHADOWING_AGENT,
     isSecret: true,
   });
   otherConfigId = (
@@ -118,3 +143,66 @@ describe("script run token is scoped to its executing agent", () => {
     }
   });
 });
+
+// `ctx.swarm.config` holds the run's resolved config (own agent over global).
+// The raw list and by-id reads must hand the run's token those same values,
+// and only those, or a script that reads a key through `config_list` gets a
+// masked placeholder and fails while the run already holds the real value.
+describe("script run token reads its held secrets on the raw config routes", () => {
+  test("list reveals the rows the run holds and masks the rest", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(res.status).toBe(200);
+      const body = await res.text();
+      expect(body).toContain(WORKER_SECRET);
+      expect(body).toContain(GLOBAL_SECRET);
+      expect(body).toContain(SHADOWING_AGENT);
+      // The run holds the agent row for SHADOWED, not the global one.
+      expect(body).not.toContain(SHADOWED_GLOBAL);
+      expect(body).not.toContain(OTHER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("by-id reveals an own row and masks another agent's row", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const own = await fetch(`${baseUrl}/api/config/${ownConfigId}?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(await own.text()).toContain(WORKER_SECRET);
+      const other = await fetch(`${baseUrl}/api/config/${otherConfigId}?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(other.status).toBe(200);
+      expect(await other.text()).not.toContain(OTHER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("without includeSecrets the run token still gets masked values", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config`, { headers: headers(run.plaintext) });
+      expect(await res.text()).not.toContain(WORKER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("the worker's own agent token keeps the masked list", async () => {
+    const worker = await mintAgentToken(workerId);
+    const res = await fetch(`${baseUrl}/api/config?includeSecrets=true`, {
+      headers: headers(worker.plaintext),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).not.toContain(WORKER_SECRET);
+    expect(body).not.toContain(GLOBAL_SECRET);
+  });
+});

package/src/tests/session-logs.test.ts

@@ -5,6 +5,7 @@ import {
   closeDb,
   createSessionLogs,
   createTaskExtended,
+  getDbClient,
   getSessionLogsBySession,
   getSessionLogsByTaskId,
   getTaskById,
@@ -226,6 +227,75 @@ describe("Session Logs API", () => {
       expect(logs[3]?.iteration).toBe(2);
       expect(logs[3]?.lineNumber).toBe(1);
     });
+
+    test("keeps write order across many flushes of one iteration", async () => {
+      const task = await createTaskExtended("Task for multi-flush ordering");
+      // The runner flushes every 50 lines or 5s, so one iteration arrives as
+      // many POSTs. Each POST used to restart lineNumber at 0.
+      const written: string[] = [];
+      for (let flush = 0; flush < 3; flush++) {
+        const lines = [0, 1, 2, 3].map((i) => `flush${flush}-line${i}`);
+        written.push(...lines);
+        await createSessionLogs({
+          taskId: task.id,
+          sessionId: "multi-flush-session",
+          iteration: 1,
+          cli: "claude",
+          lines,
+        });
+      }
+
+      const all = await getSessionLogsByTaskId(task.id);
+      expect(all.map((l) => l.content)).toEqual(written);
+      expect(all.map((l) => l.lineNumber)).toEqual(written.map((_, i) => i));
+
+      const tail = await getSessionLogsByTaskId(task.id, 5);
+      expect(tail.map((l) => l.content)).toEqual(written.slice(-5));
+
+      const bySession = await getSessionLogsBySession("multi-flush-session", 1);
+      expect(bySession.map((l) => l.content)).toEqual(written);
+    });
+
+    test("reads rows stored with per-flush lineNumbers in write order", async () => {
+      const task = await createTaskExtended("Task with legacy session log rows");
+      // Rows written before the fix: lineNumber restarts per POST, and
+      // createdAt ties inside one POST.
+      const legacy = [
+        ["a0", 0],
+        ["a1", 1],
+        ["a2", 2],
+        ["b0", 0],
+        ["b1", 1],
+        ["c0", 0],
+      ] as const;
+      await getDbClient().transaction(async (tx) => {
+        for (const [content, lineNumber] of legacy) {
+          await tx.run(
+            `INSERT INTO session_logs (id, taskId, sessionId, iteration, cli, content, lineNumber, createdAt)
+             VALUES (?, ?, 'legacy-session', 1, 'claude', ?, ?, '2026-10-01T00:00:00.000Z')`,
+            [crypto.randomUUID(), task.id, content, lineNumber],
+          );
+        }
+      });
+      // A flush after deploy lands behind the legacy rows.
+      await createSessionLogs({
+        taskId: task.id,
+        sessionId: "legacy-session",
+        iteration: 1,
+        cli: "claude",
+        lines: ["d0", "d1"],
+      });
+
+      const written = ["a0", "a1", "a2", "b0", "b1", "c0", "d0", "d1"];
+      const all = await getSessionLogsByTaskId(task.id);
+      expect(all.map((l) => l.content)).toEqual(written);
+
+      const tail = await getSessionLogsByTaskId(task.id, 4);
+      expect(tail.map((l) => l.content)).toEqual(["b1", "c0", "d0", "d1"]);
+
+      const bySession = await getSessionLogsBySession("legacy-session", 1);
+      expect(bySession.map((l) => l.content)).toEqual(written);
+    });
   });
 
   describe("POST /api/session-logs", () => {

package/src/tests/sessions-tree.test.ts

@@ -4,6 +4,8 @@ import { keyPrefixRange, sessionGroupKey } from "../assets/key";
 import {
   closeDb,
   countSessions,
+  createAgent,
+  createSessionCost,
   createSteeringMessage,
   createTaskExtended,
   createUser,
@@ -605,6 +607,41 @@ test("session detail carries the viewer's read state with the list rule", async
   expect(bypass.lastActivityAt).toBeUndefined();
 });
 
+test("session detail carries each chain task's cost, so the header can total the whole session", async () => {
+  const agent = await createAgent({ name: "cost-agent", isLead: false, status: "idle" });
+  const root = await task();
+  const child = await task("shared/a/", { parentTaskId: root.id });
+  const grandchild = await task("shared/a/", { parentTaskId: child.id });
+  const followUp = await task("shared/a/", { parentTaskId: root.id });
+  const noCost = await task("shared/a/", { parentTaskId: root.id });
+  const spend = async (taskId: string, totalCostUsd: number) =>
+    createSessionCost({
+      sessionId: crypto.randomUUID(),
+      taskId,
+      agentId: agent.id,
+      totalCostUsd,
+      durationMs: 1_000,
+      numTurns: 1,
+      model: "test-model",
+    });
+  await spend(root.id, 0.2);
+  await spend(root.id, 0.0051);
+  await spend(child.id, 0.5);
+  await spend(grandchild.id, 0.25);
+  await spend(followUp.id, 0.335);
+
+  const res = await fetch(`${baseUrl}/api/sessions/${root.id}`);
+  const body = (await res.json()) as { chain: { id: string; totalCostUsd?: number }[] };
+  const costs = Object.fromEntries(body.chain.map((t) => [t.id, t.totalCostUsd]));
+  expect(costs[root.id]).toBeCloseTo(0.2051, 6);
+  expect(costs[child.id]).toBeCloseTo(0.5, 6);
+  expect(costs[grandchild.id]).toBeCloseTo(0.25, 6);
+  expect(costs[followUp.id]).toBeCloseTo(0.335, 6);
+  expect(costs[noCost.id]).toBeUndefined();
+  const total = body.chain.reduce((sum, t) => sum + (t.totalCostUsd ?? 0), 0);
+  expect(total).toBeCloseTo(1.2901, 6);
+});
+
 test("limit clamps to 200 and count without chain filters does not recurse", async () => {
   await getDbClient().transaction(async () => {
     for (let i = 0; i < 205; i++)