@desplega.ai/agent-swarm 2.5.3 → 2.6.0

package/src/tasks/sibling-awareness.ts

@@ -18,7 +18,7 @@ import {
   getInProgressTasksByContextKey,
 } from "../be/db";
 import { applyPreTaskCreate } from "../extensions/apply-task-create";
-import type { TaskCreateOrigin } from "../extensions/contract";
+import type { TaskCreateEvent, TaskCreateOrigin } from "../extensions/contract";
 import type { AgentTask } from "../types";
 import { TaskCreationBlockedError } from "./errors";
 import {
@@ -151,7 +151,11 @@ export type PreparedTaskCreate = { description: string; options: CreateTaskOptio
 export async function prepareTaskWithSiblingAwareness(
   description: string,
   options: CreateTaskOptions,
-  args: { origin?: TaskCreateOrigin; allowCustomModel?: boolean } = {},
+  args: {
+    origin?: TaskCreateOrigin;
+    allowCustomModel?: boolean;
+    slack?: TaskCreateEvent["slack"];
+  } = {},
 ): Promise<PreparedTaskCreate> {
   const preCreate = await applyPreTaskCreate({
     description,
@@ -159,6 +163,7 @@ export async function prepareTaskWithSiblingAwareness(
     // Preserve the plan's REST default for callers without an explicit ingress origin.
     origin: args.origin ?? "rest",
     allowCustomModel: args.allowCustomModel,
+    slack: args.slack,
   });
   if (preCreate.kind === "blocked") {
     throw new TaskCreationBlockedError(preCreate.reason, preCreate.extension);
@@ -169,7 +174,11 @@ export async function prepareTaskWithSiblingAwareness(
 export async function createTaskWithSiblingAwareness(
   description: string,
   options: CreateTaskOptions,
-  args: { origin?: TaskCreateOrigin; allowCustomModel?: boolean } = {},
+  args: {
+    origin?: TaskCreateOrigin;
+    allowCustomModel?: boolean;
+    slack?: TaskCreateEvent["slack"];
+  } = {},
 ): Promise<AgentTask> {
   const { description: d, options: o } = await prepareTaskWithSiblingAwareness(
     description,

package/src/telemetry-context.ts

@@ -12,8 +12,8 @@ import catalog from "./telemetry-contract/catalog.json";
 import {
   COMPANY_ACQUISITION_SOURCES,
   COMPANY_TEAM_SIZES,
-  COMPANY_USE_CASES,
-  USER_FUNCTIONS,
+  reportedUseCase,
+  reportedUserFunction,
 } from "./utils/company-profile";
 
 /** `org_` + 16 lowercase hex (self-host, minted here) or 27 alphanumerics (cloud). Same pattern the proxy enforces. */
@@ -115,10 +115,9 @@ export function buildContext(input: ContextInput): EventContext {
   const orgDomain = validOrgDomain(input.orgDomain);
   const orgWebsite = validOrgDomain(input.orgWebsite);
   const teamSize = COMPANY_TEAM_SIZES.find((value) => value === input.teamSize);
-  const useCase = COMPANY_USE_CASES.find((value) => value === input.useCase);
-  const userFunction = userId
-    ? USER_FUNCTIONS.find((value) => value === input.userFunction)
-    : undefined;
+  // A value the catalog does not list yet is left out, as if unset.
+  const useCase = reportedUseCase(input.useCase);
+  const userFunction = userId ? reportedUserFunction(input.userFunction) : undefined;
   return {
     org_id: input.orgId,
     org_name: orgName ? orgName : null,

package/src/telemetry-identity.ts

@@ -13,7 +13,7 @@
 import { getDbClient } from "./be/db/runtime";
 import { setTelemetryOrgDomain } from "./telemetry";
 import { emailDomain, type TelemetryUserRole } from "./telemetry-context";
-import { USER_FUNCTIONS } from "./utils/company-profile";
+import { reportedUserFunction } from "./utils/company-profile";
 
 const ROLE_TTL_MS = 60 * 60_000;
 const ROLE_CACHE_LIMIT = 1_000;
@@ -21,7 +21,7 @@ const DOMAIN_RECOMPUTE_DEBOUNCE_MS = 2_000;
 
 interface UserRoleEntry {
   role: TelemetryUserRole;
-  userFunction?: (typeof USER_FUNCTIONS)[number];
+  userFunction?: ReturnType<typeof reportedUserFunction>;
   at: number;
 }
 
@@ -40,7 +40,7 @@ async function loadUserRole(userId: string): Promise<UserRoleEntry | undefined>
     );
     return {
       role,
-      userFunction: USER_FUNCTIONS.find((value) => value === user?.jobFunction),
+      userFunction: reportedUserFunction(user?.jobFunction),
       at: Date.now(),
     };
   } catch {

package/src/tests/amp-adapter.test.ts

@@ -8,6 +8,7 @@ import {
   validateProviderCredentials,
 } from "../commands/provider-credentials";
 import { recomputeSessionCost } from "../http/session-cost-recompute";
+import { renderContextBoundNote } from "../prompts/context-bound-note";
 import { createProviderAdapter } from "../providers";
 import {
   AMP_PACKAGE,
@@ -31,6 +32,7 @@ import { getModelAwareCredentialVars } from "../utils/credentials";
 import { resolveHarnessProvider } from "../utils/harness-provider";
 import { clearVolatileSecretsForTesting } from "../utils/secret-scrubber";
 import { ampPricingLookup } from "./amp-pricing-helpers";
+import { holdTemplateRender } from "./fixtures/held-template-render";
 
 const KEY = "sgamp_test_credential_value";
 
@@ -769,6 +771,101 @@ describe("amp session", () => {
   }, 20_000);
 });
 
+describe("amp context-bound note", () => {
+  // Each fake request is 4 input + 200 cache read + 1000 cache write = 1204 tokens.
+  async function toolResults(
+    mode: string,
+    env: Record<string, string>,
+    overrides: Partial<ProviderSessionConfig> = {},
+  ) {
+    const { config } = await fixture(mode, overrides, env);
+    const { events, result } = await runToCompletion(config);
+    const results = events.flatMap((e) => (e.type === "tool_end" ? [e.result] : []));
+    return { results, result };
+  }
+
+  test("queues the note into the first tool result at the threshold, then never again", async () => {
+    const { results, result } = await toolResults("steer-twice", {
+      CONTEXT_BOUND_NOTE_TOKENS: "1204",
+    });
+    expect(results).toEqual([`2\n\n${await renderContextBoundNote(1204)}`, "2"]);
+    // Carried inside the turn: no extra turn replays it.
+    expect(result).toMatchObject({ isError: false, output: "DONE1" });
+    expect(result.cost?.numTurns).toBe(1);
+  });
+
+  test("a pinned model gets the window share; a mode names no model and gets none", async () => {
+    const pin = "anthropic/claude-sonnet-4-6";
+    const pinned = await toolResults(
+      "steer-twice",
+      { CONTEXT_BOUND_NOTE_TOKENS: "1204" },
+      { model: pin },
+    );
+    const note = await renderContextBoundNote(1204, pin);
+    expect(note).toContain("of the 1,000,000-token window)");
+    expect(pinned.results).toEqual([`2\n\n${note}`, "2"]);
+    const mode = await toolResults("steer-twice", { CONTEXT_BOUND_NOTE_TOKENS: "1204" });
+    expect(mode.results[0]).not.toContain("token window");
+  });
+
+  test("no-op below the threshold and when disabled at 0", async () => {
+    for (const threshold of ["1205", "0"]) {
+      const { results } = await toolResults("steer-twice", {
+        CONTEXT_BOUND_NOTE_TOKENS: threshold,
+      });
+      expect(results).toEqual(["2", "2"]);
+    }
+  });
+
+  test("fails open on missing or corrupt request usage", async () => {
+    for (const usage of ["missing", "corrupt"]) {
+      const { results, result } = await toolResults("steer", {
+        CONTEXT_BOUND_NOTE_TOKENS: "1",
+        AMP_TEST_REQUEST_USAGE: usage,
+      });
+      expect(results).toEqual(["2"]);
+      expect(result).toMatchObject({ isError: false, output: "DONE1" });
+    }
+  });
+
+  test("a final reply with no tool call never queues it, so no new turn starts", async () => {
+    const { results, result } = await toolResults("steer-no-tool", {
+      CONTEXT_BOUND_NOTE_TOKENS: "1",
+    });
+    expect(results).toEqual([]);
+    expect(result).toMatchObject({ isError: false, output: "DONE1" });
+    expect(result.cost?.numTurns).toBe(1);
+  });
+
+  test("a note rendered after the last tool result is dropped, not replayed as a new turn", async () => {
+    const held = holdTemplateRender();
+    try {
+      const { config } = await fixture(
+        "steer",
+        {},
+        {
+          CONTEXT_BOUND_NOTE_TOKENS: "1204",
+          AMP_TEST_POST_RESULT_DELAY_MS: "150",
+        },
+      );
+      const session = await new AmpAdapter().createSession(config);
+      const results: unknown[] = [];
+      session.onEvent((event) => {
+        if (event.type !== "tool_end") return;
+        results.push(event.result);
+        // Ready while the final reply is pending.
+        held.release();
+      });
+      const result = await session.waitForCompletion();
+      expect(results).toEqual(["2"]);
+      expect(result).toMatchObject({ isError: false, output: "DONE1" });
+      expect(result.cost?.numTurns).toBe(1);
+    } finally {
+      held.stop();
+    }
+  });
+});
+
 describe("amp live test", () => {
   const env = async (mode: string) => {
     const { config } = await fixture(mode);

package/src/tests/api-keys-validation.test.ts

@@ -0,0 +1,170 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { Readable } from "node:stream";
+import {
+  closeDb,
+  getAvailableKeyIndices,
+  getDbClient,
+  getKeyStatuses,
+  initDb,
+  recordKeyValidation,
+} from "../be/db";
+import { handleApiKeys } from "../http/api-keys";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+
+const TEST_DB = "./test-api-keys-validation.sqlite";
+const keyType = "ANTHROPIC_API_KEY";
+const rejected = { keyIndex: 0, keySuffix: "aaa11", ok: false, httpStatus: 401 };
+
+async function call(method: string, url: string, body?: unknown) {
+  const req = Readable.from(body === undefined ? [] : [Buffer.from(JSON.stringify(body))]);
+  Object.assign(req, { method, url, headers: { "content-type": "application/json" } });
+  let statusCode = 200;
+  let responseBody = "";
+  const res = {
+    setHeader: () => {},
+    writeHead: (code: number) => {
+      statusCode = code;
+    },
+    end: (chunk?: string) => {
+      responseBody += chunk ?? "";
+    },
+  };
+  const handled = await handleApiKeys(
+    req as never,
+    res as never,
+    getPathSegments(url),
+    parseQueryParams(url),
+  );
+  return { handled, statusCode, body: JSON.parse(responseBody) };
+}
+
+describe("pooled key validation", () => {
+  beforeAll(() => {
+    initDb(TEST_DB);
+  });
+  beforeEach(async () => {
+    await getDbClient().run("DELETE FROM api_key_status");
+  });
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      await Bun.file(TEST_DB + suffix)
+        .delete()
+        .catch(() => {});
+    }
+  });
+
+  test("HTTP 401 marks the key as rejected", async () => {
+    await recordKeyValidation(keyType, [{ ...rejected, httpStatus: 401 }]);
+    const [row] = await getKeyStatuses(keyType);
+    expect(row).toMatchObject({
+      keyIndex: 0,
+      keySuffix: "aaa11",
+      provider: "claude",
+      lastValidationError: "HTTP 401",
+    });
+    expect(row!.lastValidationFailedAt).not.toBeNull();
+  });
+
+  test("a pass clears rejection and updates the index", async () => {
+    await recordKeyValidation(keyType, [rejected]);
+    await recordKeyValidation(keyType, [{ ...rejected, keyIndex: 2, ok: true }]);
+    expect((await getKeyStatuses(keyType))[0]).toMatchObject({
+      keyIndex: 2,
+      lastValidationError: null,
+      lastValidationFailedAt: null,
+    });
+  });
+
+  // 403 included: a valid key can lack the scope of the list endpoint.
+  test.each([
+    403,
+    500,
+    429,
+    undefined,
+  ])("failure with status %s preserves existing state", async (httpStatus) => {
+    await recordKeyValidation(keyType, [rejected]);
+    const before = await getKeyStatuses(keyType);
+    await recordKeyValidation(keyType, [{ ...rejected, keyIndex: 3, httpStatus }]);
+    expect(await getKeyStatuses(keyType)).toEqual(before);
+    await recordKeyValidation("OPENAI_API_KEY", [{ ...rejected, httpStatus }]);
+    expect(await getKeyStatuses("OPENAI_API_KEY")).toEqual([]);
+  });
+
+  test("a removed suffix cannot block a replacement at the same index", async () => {
+    await recordKeyValidation(keyType, [rejected]);
+    await recordKeyValidation(keyType, [{ keyIndex: 0, keySuffix: "bbb22", ok: true }]);
+    const rows = await getKeyStatuses(keyType);
+    expect(rows.find((row) => row.keySuffix === "aaa11")).toMatchObject({
+      lastValidationError: null,
+      lastValidationFailedAt: null,
+    });
+    expect((await getAvailableKeyIndices(keyType, 1)).availableIndices).toEqual([0]);
+  });
+
+  test("rejections and removed-suffix cleanup stay within their scope and key type", async () => {
+    await recordKeyValidation(keyType, [rejected], "agent", "agent-a");
+    await recordKeyValidation(keyType, [rejected], "agent", "agent-b");
+    await recordKeyValidation("OPENAI_API_KEY", [rejected], "agent", "agent-a");
+    await recordKeyValidation(
+      keyType,
+      [{ keyIndex: 0, keySuffix: "bbb22", ok: true }],
+      "agent",
+      "agent-a",
+    );
+    expect((await getAvailableKeyIndices(keyType, 1, "agent", "agent-a")).availableIndices).toEqual(
+      [0],
+    );
+    expect((await getAvailableKeyIndices(keyType, 1, "agent", "agent-b")).availableIndices).toEqual(
+      [],
+    );
+    expect(
+      (await getAvailableKeyIndices("OPENAI_API_KEY", 1, "agent", "agent-a")).availableIndices,
+    ).toEqual([]);
+  });
+
+  test("availability excludes rejected keys and reports their indices", async () => {
+    await recordKeyValidation(keyType, [rejected, { keyIndex: 1, keySuffix: "bbb22", ok: true }]);
+    expect(await getAvailableKeyIndices(keyType, 3)).toMatchObject({
+      availableIndices: [1, 2],
+      rejectedIndices: [0],
+    });
+  });
+
+  test("availability is empty when every key is rejected", async () => {
+    await recordKeyValidation(keyType, [
+      rejected,
+      { ...rejected, keyIndex: 1, keySuffix: "bbb22" },
+    ]);
+    expect(await getAvailableKeyIndices(keyType, 2)).toMatchObject({
+      availableIndices: [],
+      rejectedIndices: [0, 1],
+    });
+  });
+
+  test("the report handler records validation and exposes it in reads", async () => {
+    expect(
+      await call("POST", "/api/keys/report-validation", { keyType, keys: [rejected] }),
+    ).toEqual({
+      handled: true,
+      statusCode: 200,
+      body: { success: true, message: "Key validation recorded" },
+    });
+    expect(
+      (await call("GET", `/api/keys/available?keyType=${keyType}&totalKeys=2`)).body,
+    ).toMatchObject({
+      availableIndices: [1],
+      rejectedIndices: [0],
+    });
+    const status = await call("GET", `/api/keys/status?keyType=${keyType}`);
+    expect(status.body.keys[0]).toMatchObject({ lastValidationError: "HTTP 401" });
+    expect(status.body.keys[0].lastValidationFailedAt).not.toBeNull();
+  });
+
+  test("the report handler rejects an empty pool", async () => {
+    expect(
+      (await call("POST", "/api/keys/report-validation", { keyType, keys: [] })).statusCode,
+    ).toBe(400);
+    expect(await getKeyStatuses(keyType)).toEqual([]);
+  });
+});

package/src/tests/approval-requests.test.ts

@@ -418,7 +418,7 @@ describe("Approval Requests", () => {
       expect(result).toBeNull();
     });
 
-    test("does not resolve a workflow approval after its run and HITL step are cancelled", async () => {
+    test("does not resolve a workflow approval after its run is cancelled", async () => {
       const workflow = await createWorkflow({
         name: `approval-cancel-${crypto.randomUUID()}`,
         definition: { nodes: [] },
@@ -432,11 +432,12 @@ describe("Approval Requests", () => {
         nodeId: "approval",
         nodeType: "human-in-the-loop",
       });
-      await updateWorkflowRun(runId, { status: "cancelled" });
-      await updateWorkflowRunStep(stepId, { status: "cancelled" });
+      // Asked while the run was live; the run was cancelled after, leaving
+      // the request pending (a cancelled step's trigger would close it).
       const approval = await createApprovalRequest(
         makeApprovalData({ workflowRunId: runId, workflowRunStepId: stepId }),
       );
+      await updateWorkflowRun(runId, { status: "cancelled" });
 
       const result = await resolveApprovalRequest(
         approval.id,
@@ -1864,15 +1865,17 @@ describe("Approval Requests", () => {
 
     test("cancel on a waiting run cancels the run, its step, and its task", async () => {
       const { runId, stepId, approvalId } = await makeRun("waiting");
+      // Linked directly: the engine binds a step's task while the step is
+      // still running, and this step is already parked.
       const task = await createTaskExtended("step task", {
         agentId: owner.id,
         source: "mcp",
         workflowRunId: runId,
-        workflowRunStepId: stepId,
       });
-      await getDbClient().run("UPDATE agent_tasks SET status = 'in_progress' WHERE id = ?", [
-        task.id,
-      ]);
+      await getDbClient().run(
+        "UPDATE agent_tasks SET status = 'in_progress', workflowRunStepId = ? WHERE id = ?",
+        [stepId, task.id],
+      );
 
       const res = await post(
         `/api/approval-requests/${approvalId}/cancel`,

package/src/tests/approval-sweeps.test.ts

@@ -223,15 +223,17 @@ describe("approval sweeps", () => {
 
     test("cancels the waiting run, its step, and its linked task", async () => {
       const { runId, stepId } = await makeRun("waiting");
+      // Linked directly: the engine binds a step's task while the step is
+      // still running, and this step is already parked.
       const task = await createTaskExtended("step task", {
         agentId,
         source: "mcp",
         workflowRunId: runId,
-        workflowRunStepId: stepId,
       });
-      await getDbClient().run("UPDATE agent_tasks SET status = 'in_progress' WHERE id = ?", [
-        task.id,
-      ]);
+      await getDbClient().run(
+        "UPDATE agent_tasks SET status = 'in_progress', workflowRunStepId = ? WHERE id = ?",
+        [stepId, task.id],
+      );
       const id = await makeRequest({ ageDays: 8, workflowRunId: runId, workflowRunStepId: stepId });
 
       const result = await autoCancelStaleApprovalRequests();
@@ -300,8 +302,10 @@ describe("approval sweeps", () => {
     });
 
     test("leaves a failed run as it is", async () => {
-      const { runId, stepId } = await makeRun("failed");
+      // The request was asked while the run was live; the run failed after.
+      const { runId, stepId } = await makeRun("waiting");
       const id = await makeRequest({ ageDays: 8, workflowRunId: runId, workflowRunStepId: stepId });
+      await updateWorkflowRun(runId, { status: "failed" });
 
       const result = await autoCancelStaleApprovalRequests();
 
@@ -415,13 +419,15 @@ describe("approval sweeps", () => {
     });
 
     test("times out a request on a completed run", async () => {
-      const { runId, stepId } = await makeRun("completed");
+      // The request was asked while the run was live; the run completed after.
+      const { runId, stepId } = await makeRun("waiting");
       const id = await makeRequest({
         ageDays: 0,
         expiresInMs: -60_000,
         workflowRunId: runId,
         workflowRunStepId: stepId,
       });
+      await updateWorkflowRun(runId, { status: "completed" });
       await timeoutExpiredApprovalRequests();
       expect((await getApprovalRequestById(id))!.status).toBe("timeout");
     });

package/src/tests/base-prompt.test.ts

@@ -490,7 +490,7 @@ describe("getBasePrompt: outputs section", () => {
     expect(result).toContain("## Outputs");
     expect(result).toContain(AGENT_FS_LINE);
     expect(result).toContain(
-      "For a file anyone outside the swarm opens, use an `agent-fs share-create` link; `AGENT_FS_LIVE_URL` links are for signed-in teammates.",
+      `Give people the live app link \`\${AGENT_FS_LIVE_URL}/file/~/<org>/<drive>/<path>\`. Make an \`agent-fs share-create\` link only when the requester asks for one or the reader has no agent-fs login.`,
     );
     expect(result).not.toContain(NO_AGENT_FS_LINE);
   });

package/src/tests/claude-hook-output.test.ts

@@ -82,7 +82,11 @@ afterAll(async () => {
   await rm(projectDir, { recursive: true, force: true });
 });
 
-async function runHook(event: Record<string, unknown>, taskId: string) {
+async function runHook(
+  event: Record<string, unknown>,
+  taskId: string,
+  extraEnv: Record<string, string> = {},
+) {
   const taskFile = join(projectDir, `task-${taskId}.json`);
   await Bun.write(
     taskFile,
@@ -92,6 +96,8 @@ async function runHook(event: Record<string, unknown>, taskId: string) {
     ...process.env,
     CLAUDE_PROJECT_DIR: projectDir,
     TASK_FILE: taskFile,
+    CONTEXT_BOUND_NOTE_TOKENS: undefined,
+    ...extraEnv,
   };
   return runChild(["bun", HOOK_PATH], {
     cwd: projectDir,
@@ -107,6 +113,9 @@ function parseSoleJson(stdout: string): Record<string, unknown> {
   return JSON.parse(trimmed) as Record<string, unknown>;
 }
 
+/** The note is off unless CONTEXT_BOUND_NOTE_TOKENS is set. */
+const noteOn = { CONTEXT_BOUND_NOTE_TOKENS: "200000" };
+
 const bashTouch = {
   tool_name: "Bash",
   tool_input: { command: "touch /tmp/probe" },
@@ -230,4 +239,73 @@ describe("claude hook stdout", () => {
     },
     CHILD_PROCESS_TEST_BUDGET_MS,
   );
+
+  test(
+    "worker context-bound note fires once as PostToolUse additionalContext",
+    async () => {
+      Object.assign(state, { isLead: false, cancelledTaskId: null, shouldBlockPolling: false });
+      const taskId = crypto.randomUUID();
+      await Bun.write(
+        join(projectDir, `task-${taskId}.json.context.json`),
+        JSON.stringify({ contextTokens: 250_000, model: "claude-opus-5-5" }),
+      );
+      const event = { hook_event_name: "PostToolUse", ...bashTouch, tool_response: {} };
+
+      const first = await runHook(event, taskId, noteOn);
+      const out = parseSoleJson(first.stdout) as { hookSpecificOutput: Record<string, string> };
+      expect(out.hookSpecificOutput.hookEventName).toBe("PostToolUse");
+      expect(out.hookSpecificOutput.additionalContext).toStartWith(
+        "Context is 250,000 tokens (25% of the 1,000,000-token window). Keep this task bounded",
+      );
+
+      const second = await runHook(event, taskId, noteOn);
+      expect(second.exitCode).toBe(0);
+      expect(second.stdout.trim()).toBe("");
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS * 2,
+  );
+
+  test(
+    "a subagent tool call does not consume the context-bound note",
+    async () => {
+      Object.assign(state, { isLead: false, cancelledTaskId: null, shouldBlockPolling: false });
+      const taskId = crypto.randomUUID();
+      await Bun.write(
+        join(projectDir, `task-${taskId}.json.context.json`),
+        JSON.stringify({ contextTokens: 250_000, model: "made-up-model" }),
+      );
+      const event = { hook_event_name: "PostToolUse", ...bashTouch, tool_response: {} };
+
+      const child = await runHook({ ...event, agent_id: "child" }, taskId, noteOn);
+      expect(child.exitCode).toBe(0);
+      expect(child.stdout.trim()).toBe("");
+
+      // Unknown model: no window share rather than a percent of the 200k fallback.
+      const main = await runHook(event, taskId, noteOn);
+      const out = parseSoleJson(main.stdout) as { hookSpecificOutput: Record<string, string> };
+      expect(out.hookSpecificOutput.additionalContext).toStartWith(
+        "Context is 250,000 tokens. Keep this task bounded",
+      );
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS * 2,
+  );
+
+  test(
+    "the context-bound note is off when CONTEXT_BOUND_NOTE_TOKENS is unset",
+    async () => {
+      Object.assign(state, { isLead: false, cancelledTaskId: null, shouldBlockPolling: false });
+      const taskId = crypto.randomUUID();
+      await Bun.write(
+        join(projectDir, `task-${taskId}.json.context.json`),
+        JSON.stringify({ contextTokens: 900_000, model: "claude-opus-5-5" }),
+      );
+      const result = await runHook(
+        { hook_event_name: "PostToolUse", ...bashTouch, tool_response: {} },
+        taskId,
+      );
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout.trim()).toBe("");
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
 });