@desplega.ai/agent-swarm 2.5.3 → 2.6.0

package/src/tests/fixtures/extensions/record-blocks/manifest.json

@@ -0,0 +1,7 @@
+{
+  "name": "record-blocks",
+  "description": "Records blocked task attempts",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": { "hooks": "hooks.ts" }
+}

package/src/tests/fixtures/extensions/record-task-create/hooks.ts

@@ -0,0 +1,9 @@
+import type { SwarmExtension } from "swarm-extension";
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", async (event, ctx) => {
+    await ctx.state.set("last", event);
+  });
+};
+
+export default extension;

package/src/tests/fixtures/extensions/record-task-create/manifest.json

@@ -0,0 +1,7 @@
+{
+  "name": "record-task-create",
+  "description": "Records task creation events",
+  "version": "1.0.0",
+  "runtime": "api",
+  "assets": { "hooks": "hooks.ts" }
+}

package/src/tests/fixtures/fake-amp.ts

@@ -104,12 +104,19 @@ async function main() {
   );
 
   const sessionId = "T-fake-session";
-  const usage = {
-    input_tokens: 4,
-    output_tokens: 5,
-    cache_creation_input_tokens: 1000,
-    cache_read_input_tokens: 200,
-  };
+  // `AMP_TEST_REQUEST_USAGE`: "missing" drops per-request usage, "corrupt" sends non-numbers.
+  const requestUsage = process.env.AMP_TEST_REQUEST_USAGE;
+  const usage =
+    requestUsage === "missing"
+      ? undefined
+      : requestUsage === "corrupt"
+        ? { input_tokens: "lots", cache_creation_input_tokens: null, cache_read_input_tokens: {} }
+        : {
+            input_tokens: 4,
+            output_tokens: 5,
+            cache_creation_input_tokens: 1000,
+            cache_read_input_tokens: 200,
+          };
   // Amp runs shell commands in a session of its own, outside the process group.
   // Return only once the child has left: a group kill that lands before its
   // setsid() would take it down and hide a leak.
@@ -217,8 +224,13 @@ async function main() {
       session_id: sessionId,
     });
     turns += 1;
-    const steerTool = mode === "steer" || mode.startsWith("steer-crash");
-    if (mode === "tool" || (steerTool && index === 0)) {
+    const steerTool = mode === "steer" || mode === "steer-twice" || mode.startsWith("steer-crash");
+    const toolCalls = mode === "steer-twice" ? 2 : 1;
+    for (
+      let call = 0;
+      call < toolCalls && (mode === "tool" || (steerTool && index === 0));
+      call++
+    ) {
       assistant(
         [{ type: "tool_use", id: "TU-1", name: "code_exec", input: { code: "1+1" } }],
         "tool_use",
@@ -261,6 +273,8 @@ async function main() {
     if (mode === "success-child") await startDetachedChild();
     // A turn that thinks for a while with no tool call.
     if (mode === "steer-no-tool") await Bun.sleep(600);
+    // `AMP_TEST_POST_RESULT_DELAY_MS`: the final reply takes this long after the last tool result.
+    await Bun.sleep(Number(process.env.AMP_TEST_POST_RESULT_DELAY_MS) || 0);
     lastText = mode.startsWith("steer") ? `DONE${index + 1}` : "Done ✓";
     assistant([{ type: "text", text: lastText }], "end_turn");
   };

package/src/tests/fixtures/held-template-render.ts

@@ -0,0 +1,42 @@
+import { configureHttpResolver, resetHttpResolver } from "../../prompts/resolver";
+
+export const HELD_NOTE_TEXT = "Finish current work and complete or defer.";
+
+/**
+ * Point the prompt resolver at a local server whose template responses wait
+ * for `release()`, so a test can choose when an async note render finishes.
+ * `requested` resolves on the first render request. `stop()` releases,
+ * restores the resolver and closes the server.
+ */
+export function holdTemplateRender(): {
+  release: () => void;
+  requested: Promise<void>;
+  stop: () => void;
+} {
+  let release!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  let onRequest!: () => void;
+  const requested = new Promise<void>((resolve) => {
+    onRequest = resolve;
+  });
+  const server = Bun.serve({
+    port: 0,
+    async fetch() {
+      onRequest();
+      await gate;
+      return Response.json({ text: HELD_NOTE_TEXT, skipped: false, unresolved: [] });
+    },
+  });
+  configureHttpResolver(`http://localhost:${server.port}`, "test");
+  return {
+    release,
+    requested,
+    stop: () => {
+      release();
+      resetHttpResolver();
+      server.stop(true);
+    },
+  };
+}

package/src/tests/fixtures/workflow-idempotency-trigger.child.ts

@@ -0,0 +1,73 @@
+/**
+ * One keyed workflow trigger on its own DB connection, for
+ * `workflow-idempotency.test.ts`. Runs the HTTP handler's sequence: look the
+ * key up, then start the run with the key recorded in the run's transaction,
+ * and answer from the record when a concurrent process took the key first.
+ *
+ * Barrier: after the lookup finds nothing it creates `<dir>/looked-<n>` and
+ * waits for `<dir>/go`, so the parent can release every child only once all
+ * of them are past the lookup and about to race for the write lock.
+ *
+ * Prints one JSON line: `{ runId, replayed }`.
+ */
+import { join } from "node:path";
+import { getWorkflow, initDb } from "../../be/db";
+import {
+  findAcceptedWorkflowOperation,
+  IdempotencyKeyTakenError,
+  recordAcceptedWorkflowOperation,
+  type WorkflowIdempotencyClaim,
+  workflowRequestFingerprint,
+} from "../../be/db/workflow-idempotency";
+import { getExecutorRegistry, startWorkflowExecution } from "../../workflows";
+
+const [dbPath, workflowId, key, barrierDir, n] = process.argv.slice(2);
+if (!dbPath || !workflowId || !key || !barrierDir || !n) {
+  console.error("usage: workflow-idempotency-trigger.child <db> <workflowId> <key> <dir> <n>");
+  process.exit(2);
+}
+
+const realLog = console.log;
+console.log = () => {};
+console.debug = () => {};
+console.warn = () => {};
+
+initDb(dbPath);
+const workflow = await getWorkflow(workflowId);
+if (!workflow) throw new Error(`workflow ${workflowId} not found`);
+
+const body = { n: 1 };
+const claim: WorkflowIdempotencyClaim = {
+  principal: "agent:concurrency-test",
+  operation: "workflow.trigger",
+  targetId: workflowId,
+  key,
+  fingerprint: workflowRequestFingerprint("workflow.trigger", body),
+};
+
+if (await findAcceptedWorkflowOperation(claim)) throw new Error("key already accepted");
+await Bun.write(join(barrierDir, `looked-${n}`), "");
+const go = Bun.file(join(barrierDir, "go"));
+while (!(await go.exists())) await Bun.sleep(5);
+
+let result: { runId: string; replayed: boolean };
+try {
+  const runId = await startWorkflowExecution(workflow, body, getExecutorRegistry(), {
+    triggerType: "api",
+    accept: (run) =>
+      recordAcceptedWorkflowOperation(claim, {
+        workflowId,
+        runId: run.runId,
+        status: 201,
+        body: run,
+      }),
+  });
+  result = { runId, replayed: false };
+} catch (err) {
+  if (!(err instanceof IdempotencyKeyTakenError)) throw err;
+  const accepted = await findAcceptedWorkflowOperation(claim);
+  result = { runId: (accepted?.body as { runId: string }).runId, replayed: true };
+}
+
+realLog(JSON.stringify(result));
+process.exit(0);

package/src/tests/fleet-benchmark.test.ts

@@ -326,6 +326,14 @@ describe("GET /api/fleet-benchmark", () => {
     expect(fetched).toHaveLength(1);
   });
 
+  test("a use case the catalog does not list yet compares against the whole fleet", async () => {
+    await addTasks(10, "completed", 1);
+    await setProfile("2-10", "content");
+    const response = await buildFleetBenchmarkResponse(NOW);
+    expect(response).toMatchObject({ state: "ready", level: "full", peerGroup: null });
+    expect(fetched).toEqual(["http://proxy.test/v1/fleet/benchmarks?window=30d"]);
+  });
+
   test("full profile tolerates absent or null peer_group from the proxy", async () => {
     await addTasks(10, "completed", 1);
     await setProfile();

package/src/tests/get-workflow-run-tool.test.ts

@@ -0,0 +1,98 @@
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  closeDb,
+  createWorkflow,
+  createWorkflowRun,
+  createWorkflowRunStep,
+  initDb,
+  updateWorkflowRun,
+  updateWorkflowRunStep,
+} from "../be/db";
+import { registerGetWorkflowRunTool } from "../tools/workflows/get-workflow-run";
+
+const dbPath = `./test-get-workflow-run-tool-${process.pid}.sqlite`;
+
+type ToolResult = {
+  isError?: boolean;
+  structuredContent: {
+    message: string;
+    run?: Record<string, unknown>;
+    steps?: Array<Record<string, unknown>>;
+  };
+};
+let handler: (args: unknown, extra: unknown) => Promise<ToolResult>;
+let runId: string;
+
+async function removeDb() {
+  for (const suffix of ["", "-wal", "-shm"]) await unlink(dbPath + suffix).catch(() => undefined);
+}
+
+beforeAll(async () => {
+  await removeDb();
+  initDb(dbPath);
+  const workflow = await createWorkflow({
+    name: "get-workflow-run-tool",
+    definition: { nodes: [{ id: "poll", type: "notify", config: { template: "x" } }] },
+  });
+  runId = crypto.randomUUID();
+  await createWorkflowRun({ id: runId, workflowId: workflow.id });
+  const context = { poll: { attempts: 2 }, blob: "x".repeat(2_000) };
+  for (let i = 0; i < 2; i++) {
+    const step = await createWorkflowRunStep({
+      id: crypto.randomUUID(),
+      runId,
+      nodeId: "poll",
+      nodeType: "notify",
+      input: { ...context, iteration: i },
+    });
+    await updateWorkflowRunStep(step.id, {
+      status: "completed",
+      output: { iteration: i },
+      retryCount: i,
+      finishedAt: new Date().toISOString(),
+    });
+  }
+  await updateWorkflowRun(runId, { status: "completed", context });
+
+  const server = new McpServer({ name: "get-workflow-run-tool", version: "1.0.0" });
+  registerGetWorkflowRunTool(server);
+  handler = (server as unknown as { _registeredTools: Record<string, { handler: typeof handler }> })
+    ._registeredTools["get-workflow-run"]!.handler;
+});
+
+afterAll(async () => {
+  closeDb();
+  await removeDb();
+});
+
+const extra = { sessionId: "get-workflow-run-tool", requestInfo: { headers: {} } };
+
+test("defaults to the full run with context and step inputs", async () => {
+  const result = await handler({ id: runId }, extra);
+  expect(result.isError).not.toBe(true);
+  const { run, steps } = result.structuredContent;
+  expect(run?.context).toBeDefined();
+  expect(steps).toHaveLength(2);
+  for (const step of steps!) expect(step.input).toBeDefined();
+});
+
+test("fields=slim drops context and step inputs, keeps outputs and retry fields", async () => {
+  const result = await handler({ id: runId, fields: "slim" }, extra);
+  expect(result.isError).not.toBe(true);
+  const { run, steps } = result.structuredContent;
+  expect(run?.status).toBe("completed");
+  expect(run?.context).toBeUndefined();
+  expect(steps).toHaveLength(2);
+  for (const step of steps!) {
+    expect(step.input).toBeUndefined();
+    expect(step.output).toBeDefined();
+    expect(typeof step.retryCount).toBe("number");
+  }
+});
+
+test("fields=slim reports a missing run as an error", async () => {
+  const result = await handler({ id: crypto.randomUUID(), fields: "slim" }, extra);
+  expect(result.isError).toBe(true);
+});

package/src/tests/integrations-http.test.ts

@@ -21,6 +21,7 @@ const TEST_DB_PATH = "./test-integrations-http.sqlite";
 
 interface FakeClientLog {
   retrieveCalls: string[];
+  apiKeys: string[];
   retrieveResult?: { name?: string | null; model?: string | null };
   retrieveError?: Error;
 }
@@ -60,7 +61,7 @@ async function clearManagedConfigRows() {
 describe("POST /api/integrations/claude-managed/test", () => {
   let server: Server;
   let baseUrl = "";
-  const log: FakeClientLog = { retrieveCalls: [] };
+  const log: FakeClientLog = { retrieveCalls: [], apiKeys: [] };
   const savedEnv = {
     ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
     MANAGED_AGENT_ID: process.env.MANAGED_AGENT_ID,
@@ -71,7 +72,10 @@ describe("POST /api/integrations/claude-managed/test", () => {
     initDb(TEST_DB_PATH);
 
     const handler = createIntegrationsHandler({
-      buildClient: () => buildFakeClient(log),
+      buildClient: (apiKey) => {
+        log.apiKeys.push(apiKey);
+        return buildFakeClient(log);
+      },
     });
 
     server = createHttpServer(async (req, res) => {
@@ -101,6 +105,7 @@ describe("POST /api/integrations/claude-managed/test", () => {
 
   beforeEach(async () => {
     log.retrieveCalls = [];
+    log.apiKeys = [];
     log.retrieveResult = undefined;
     log.retrieveError = undefined;
     await clearManagedConfigRows();
@@ -138,6 +143,31 @@ describe("POST /api/integrations/claude-managed/test", () => {
     expect(log.retrieveCalls).toEqual(["agent_abc123"]);
   });
 
+  test("a comma pool sends one key to Anthropic", async () => {
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "ANTHROPIC_API_KEY",
+      value: "sk-ant-first,sk-ant-second",
+      isSecret: true,
+    });
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "MANAGED_AGENT_ID",
+      value: "agent_abc123",
+      isSecret: false,
+    });
+
+    const res = await fetch(`${baseUrl}/api/integrations/claude-managed/test`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{}",
+    });
+
+    expect((await res.json()) as { ok: boolean }).toMatchObject({ ok: true });
+    expect(log.apiKeys).toHaveLength(1);
+    expect(["sk-ant-first", "sk-ant-second"]).toContain(log.apiKeys[0]);
+  });
+
   test("missing-config path — returns ok:false with helpful error", async () => {
     // No swarm_config rows, no env. resolveConfigValue should return null
     // for both keys and short-circuit before calling Anthropic.

package/src/tests/internal-ai/complete-structured.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { Type } from "typebox";
 import { z } from "zod";
 import { SummaryWithRatingsSchema } from "../../be/memory/raters/llm.js";
@@ -501,6 +501,42 @@ describe("completeStructured", () => {
 });
 
 describe("defaultSpawnClaudeCli", () => {
+  for (const mirrored of [false, true]) {
+    test(`selects single credentials before CLI spawn (mirror=${mirrored})`, async () => {
+      const keys = [
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "AGENT_SWARM_CLAUDE_OAUTH_TOKEN",
+        "ANTHROPIC_API_KEY",
+      ];
+      const saved = Object.fromEntries(keys.map((key) => [key, process.env[key]]));
+      process.env.CLAUDE_CODE_OAUTH_TOKEN = mirrored ? "" : "example-first,example-second";
+      process.env.AGENT_SWARM_CLAUDE_OAUTH_TOKEN = "example-first,example-second";
+      process.env.ANTHROPIC_API_KEY = "example-first,example-second";
+      let capturedEnv: Record<string, string | undefined> | undefined;
+      const spawn = spyOn(Bun, "spawn").mockImplementation(((
+        ...args: Parameters<typeof Bun.spawn>
+      ) => {
+        const options = args[0] as Bun.SpawnOptions.OptionsObject;
+        capturedEnv = options.env;
+        throw new Error("test stops before CLI spawn");
+      }) as typeof Bun.spawn);
+      try {
+        await expect(defaultSpawnClaudeCli("prompt", "haiku")).rejects.toThrow(
+          "test stops before CLI spawn",
+        );
+        for (const key of ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]) {
+          expect(["example-first", "example-second"]).toContain(capturedEnv?.[key]);
+        }
+      } finally {
+        spawn.mockRestore();
+        for (const [key, value] of Object.entries(saved)) {
+          if (value === undefined) delete process.env[key];
+          else process.env[key] = value;
+        }
+      }
+    });
+  }
+
   test("sets SKIP_SESSION_SUMMARY=1 in the child env (Stop-hook recursion guard)", async () => {
     // Without this guard, the spawned `claude -p` summarizer session fires the
     // same global Stop hook on exit, which spawns another summarizer claude,

package/src/tests/internal-ai/credentials.test.ts

@@ -25,6 +25,29 @@ function makeOpts(
 }
 
 describe("resolveCredential", () => {
+  for (const [keyVar, kind] of [
+    ["OPENROUTER_API_KEY", "openrouter"],
+    ["ANTHROPIC_API_KEY", "anthropic"],
+    ["OPENAI_API_KEY", "openai"],
+  ] as const) {
+    for (const source of ["env", "fallback"] as const) {
+      test(`${keyVar} selects one pool member from ${source}`, async () => {
+        const pool = "example-first, example-second";
+        const cred = await resolveCredential(
+          makeOpts({
+            env: source === "env" ? { [keyVar]: pool } : {},
+            _getEnvApiKey: (provider) =>
+              source === "fallback" && provider === kind ? pool : undefined,
+          }),
+        );
+        expect(cred?.kind).toBe(kind);
+        expect(
+          cred && "apiKey" in cred && ["example-first", "example-second"].includes(cred.apiKey),
+        ).toBe(true);
+      });
+    }
+  }
+
   test("OPENROUTER_API_KEY wins", async () => {
     const cred = await resolveCredential(makeOpts({ env: { OPENROUTER_API_KEY: "or-1" } }));
     expect(cred).not.toBeNull();

package/src/tests/kv-http.test.ts

@@ -362,6 +362,38 @@ describe("/api/kv REST — auth on writes", () => {
     expect(intruderWrite.status).toBe(403);
   });
 
+  test("session source labels are private: generic callers cannot read, list, or write them", async () => {
+    const namespace = "session-labels";
+    const key = encodeURIComponent("shared/slack/d0private1/");
+    await upsertKv({
+      namespace,
+      key: "shared/slack/d0private1/",
+      value: "DM · Lena",
+      valueType: "string",
+    });
+    for (const as of [agentId, leadAgentId]) {
+      expect((await authedFetch(`/api/kv/_/${namespace}/${key}`, { agentId: as })).status).toBe(
+        403,
+      );
+      expect((await authedFetch(`/api/kv/_/${namespace}`, { agentId: as })).status).toBe(403);
+      for (const method of ["PUT", "DELETE"]) {
+        const res = await authedFetch(`/api/kv/_/${namespace}/${key}`, {
+          method,
+          body:
+            method === "PUT" ? JSON.stringify({ value: "forged", valueType: "string" }) : undefined,
+          agentId: as,
+        });
+        expect(res.status).toBe(403);
+      }
+    }
+    expect(
+      await getDbClient().get<{ value: string }>(
+        "SELECT value FROM kv_entries WHERE namespace = ? AND key = ?",
+        [namespace, "shared/slack/d0private1/"],
+      ),
+    ).toEqual({ value: "DM · Lena" });
+  });
+
   test("403 when writing to task:page:* without an X-Page-Id header", async () => {
     const ns = "task:page:abc";
     const res = await authedFetch(`/api/kv/_/${encodeURIComponent(ns)}/k`, {

package/src/tests/kv-tool.test.ts

@@ -133,6 +133,31 @@ describe("kv MCP tools", () => {
     ).toBeNull();
   });
 
+  test("kv-get, kv-list, and kv-set refuse the private session-labels namespace, even for lead", async () => {
+    const namespace = "session-labels";
+    const key = "shared/slack/d0private1/";
+    await getDbClient().run(
+      `INSERT INTO kv_entries (namespace, key, value, value_type, created_at, updated_at)
+       VALUES (?, ?, 'DM · Lena', 'string', 0, 0)`,
+      [namespace, key],
+    );
+    const tools = buildServer();
+    for (const result of [
+      await tools.get.handler({ namespace, key }, meta(lead)),
+      await tools.list.handler({ namespace }, meta(lead)),
+      await tools.set.handler({ namespace, key, value: "forged" }, meta(lead)),
+    ] as StructuredResult<{ success: boolean; message: string }>[]) {
+      expect(result.structuredContent.success).toBe(false);
+      expect(result.structuredContent.message).toContain("reserved for session source labels");
+    }
+    expect(
+      await getDbClient().get("SELECT value FROM kv_entries WHERE namespace = ? AND key = ?", [
+        namespace,
+        key,
+      ]),
+    ).toEqual({ value: "DM · Lena" });
+  });
+
   test("kv-get returns entry=null for missing keys", async () => {
     const tools = buildServer();
     const getRes = (await tools.get.handler({ key: "nope" }, meta(agentA))) as StructuredResult<{

package/src/tests/multi-runtime-registration.test.ts

@@ -2995,11 +2995,19 @@ describe("post-task credential recovery without a restart", () => {
         ready: true,
         lastRefreshAt: 0,
         inFlight: false,
+        fingerprint: null,
+        rejectedKeys: 0,
       };
       const check = spyOn(CREDENTIAL_PROVIDER_CHECKERS, "claude");
       const originalOAuth = process.env.CLAUDE_CODE_OAUTH_TOKEN;
-      // The real Claude checker and live-test use OAuth presence, no upstream I/O.
       process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-credential-recovery";
+      // The subscription live test calls Anthropic's OAuth profile: answer it locally.
+      const realFetch = globalThis.fetch;
+      globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+        const url = input instanceof Request ? input.url : String(input);
+        if (url.startsWith("https://api.anthropic.com/")) return new Response("{}");
+        return realFetch(input, init);
+      }) as typeof fetch;
       try {
         // A live provider swap produces a real not-ready post-task snapshot.
         await refreshCredentialStatus(api, refresh, "claude", {}, 1);
@@ -3021,6 +3029,8 @@ describe("post-task credential recovery without a restart", () => {
         await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
         expect(check).toHaveBeenCalledTimes(2);
         expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        // Credentials resolve. A changed credential is checked at once, inside
+        // the retry throttle. Same runner state, provider, and runtime identity.
         const env = { CLAUDE_CODE_OAUTH_TOKEN: "test-credential-recovery" };
         await refreshCredentialStatus(
           api,
@@ -3029,17 +3039,6 @@ describe("post-task credential recovery without a restart", () => {
           env,
           2 * CREDENTIAL_RETRY_INTERVAL_MS,
         );
-        expect(check).toHaveBeenCalledTimes(2);
-        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
-
-        // Credentials resolve. Same runner state, provider, and runtime identity.
-        await refreshCredentialStatus(
-          api,
-          refresh,
-          "claude",
-          env,
-          2 * CREDENTIAL_RETRY_INTERVAL_MS + 1,
-        );
         expect(check).toHaveBeenCalledTimes(3);
         expect((await getAgentById(id))?.status).toBe("idle");
         expect((await getAgentById(id))?.credStatus?.ready).toBe(true);
@@ -3058,6 +3057,7 @@ describe("post-task credential recovery without a restart", () => {
         );
         expect(check).toHaveBeenCalledTimes(3);
       } finally {
+        globalThis.fetch = realFetch;
         check.mockRestore();
         if (originalOAuth === undefined) delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
         else process.env.CLAUDE_CODE_OAUTH_TOKEN = originalOAuth;