@desplega.ai/agent-swarm 2.5.3 → 2.6.0

package/src/tests/script-run-config-scope.test.ts

@@ -2,7 +2,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { createServer, type Server } from "node:http";
 import { closeDb, createAgent, initDb, upsertSwarmConfig } from "../be/db";
-import { mintScriptRunToken, revokeSessionToken } from "../be/users";
+import { mintAgentToken, mintScriptRunToken, revokeSessionToken } from "../be/users";
 import { handleConfig } from "../http/config";
 import { handleCore } from "../http/core";
 import { handleSessions } from "../http/sessions";
@@ -17,12 +17,16 @@ import { listenOnFreePort } from "./test-net";
 const API_KEY = `script-run-config-operator-${randomBytes(8).toString("hex")}`;
 const WORKER_SECRET = `worker-secret-${randomBytes(8).toString("hex")}`;
 const OTHER_SECRET = `other-secret-${randomBytes(8).toString("hex")}`;
+const GLOBAL_SECRET = `global-secret-${randomBytes(8).toString("hex")}`;
+const SHADOWED_GLOBAL = `shadowed-global-${randomBytes(8).toString("hex")}`;
+const SHADOWING_AGENT = `shadowing-agent-${randomBytes(8).toString("hex")}`;
 
 let server: Server;
 let baseUrl: string;
 let workerId: string;
 let otherId: string;
 let otherConfigId: string;
+let ownConfigId: string;
 
 function headers(bearer: string, agentId?: string): Record<string, string> {
   return {
@@ -36,11 +40,32 @@ beforeAll(async () => {
   initDb(":memory:");
   workerId = (await createAgent({ name: "script-run-worker", isLead: false, status: "idle" })).id;
   otherId = (await createAgent({ name: "script-run-other", isLead: false, status: "idle" })).id;
+  ownConfigId = (
+    await upsertSwarmConfig({
+      scope: "agent",
+      scopeId: workerId,
+      key: "OWN_SECRET",
+      value: WORKER_SECRET,
+      isSecret: true,
+    })
+  ).id;
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "GLOBAL_SECRET",
+    value: GLOBAL_SECRET,
+    isSecret: true,
+  });
+  await upsertSwarmConfig({
+    scope: "global",
+    key: "SHADOWED",
+    value: SHADOWED_GLOBAL,
+    isSecret: true,
+  });
   await upsertSwarmConfig({
     scope: "agent",
     scopeId: workerId,
-    key: "OWN_SECRET",
-    value: WORKER_SECRET,
+    key: "SHADOWED",
+    value: SHADOWING_AGENT,
     isSecret: true,
   });
   otherConfigId = (
@@ -118,3 +143,66 @@ describe("script run token is scoped to its executing agent", () => {
     }
   });
 });
+
+// `ctx.swarm.config` holds the run's resolved config (own agent over global).
+// The raw list and by-id reads must hand the run's token those same values,
+// and only those, or a script that reads a key through `config_list` gets a
+// masked placeholder and fails while the run already holds the real value.
+describe("script run token reads its held secrets on the raw config routes", () => {
+  test("list reveals the rows the run holds and masks the rest", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(res.status).toBe(200);
+      const body = await res.text();
+      expect(body).toContain(WORKER_SECRET);
+      expect(body).toContain(GLOBAL_SECRET);
+      expect(body).toContain(SHADOWING_AGENT);
+      // The run holds the agent row for SHADOWED, not the global one.
+      expect(body).not.toContain(SHADOWED_GLOBAL);
+      expect(body).not.toContain(OTHER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("by-id reveals an own row and masks another agent's row", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const own = await fetch(`${baseUrl}/api/config/${ownConfigId}?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(await own.text()).toContain(WORKER_SECRET);
+      const other = await fetch(`${baseUrl}/api/config/${otherConfigId}?includeSecrets=true`, {
+        headers: headers(run.plaintext),
+      });
+      expect(other.status).toBe(200);
+      expect(await other.text()).not.toContain(OTHER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("without includeSecrets the run token still gets masked values", async () => {
+    const run = await mintScriptRunToken(workerId, 60_000);
+    try {
+      const res = await fetch(`${baseUrl}/api/config`, { headers: headers(run.plaintext) });
+      expect(await res.text()).not.toContain(WORKER_SECRET);
+    } finally {
+      await revokeSessionToken(run.tokenId);
+    }
+  });
+
+  test("the worker's own agent token keeps the masked list", async () => {
+    const worker = await mintAgentToken(workerId);
+    const res = await fetch(`${baseUrl}/api/config?includeSecrets=true`, {
+      headers: headers(worker.plaintext),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.text();
+    expect(body).not.toContain(WORKER_SECRET);
+    expect(body).not.toContain(GLOBAL_SECRET);
+  });
+});

package/src/tests/script-runs-retention.test.ts

@@ -0,0 +1,212 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { closeDb, getDbClient, initDb } from "../be/db";
+import {
+  DB_RETENTION_TABLES,
+  getDbRetentionStats,
+  resetDbRetentionForTests,
+  runDbRetentionTick,
+  sweepStatements,
+} from "../be/db-retention";
+
+const TEST_DB_PATH = "./test-script-runs-retention.sqlite";
+const DAYS_KEY = "SCRIPT_RUNS_RETENTION_DAYS";
+// With 1 day of retention the cutoff is 2026-08-22T12:00:00.000Z.
+const NOW = new Date("2026-08-23T12:00:00.000Z");
+const OLD_ISO = "2026-08-01T00:00:00.000Z";
+const OLD_SPACED = "2026-08-01 00:00:00";
+const RECENT_ISO = "2026-08-23T11:00:00.000Z";
+
+const SCRIPT_RUNS = DB_RETENTION_TABLES.find((table) => table.table === "script_runs");
+if (!SCRIPT_RUNS) throw new Error("script_runs is not in the retention allowlist");
+
+async function removeDbFiles(): Promise<void> {
+  for (const suffix of ["", "-wal", "-shm"])
+    await unlink(`${TEST_DB_PATH}${suffix}`).catch(() => undefined);
+}
+
+async function insertRun(
+  id: string,
+  status: string,
+  startedAt: string,
+  options: { kind?: "inline" | "workflow"; idempotencyKey?: string } = {},
+): Promise<void> {
+  await getDbClient().run(
+    `INSERT INTO script_runs (id, agentId, scriptName, source, args, status, startedAt, kind, idempotencyKey)
+     VALUES (?, 'agent-1', 'retention-test', 'export default () => 1', '{}', ?, ?, ?, ?)`,
+    [id, status, startedAt, options.kind ?? "inline", options.idempotencyKey ?? null],
+  );
+}
+
+async function insertJournal(runId: string, stepKey: string): Promise<void> {
+  await getDbClient().run(
+    "INSERT INTO script_run_journal (id, runId, stepKey, stepType, status) VALUES (?, ?, ?, 'tool', 'completed')",
+    [`${runId}-${stepKey}`, runId, stepKey],
+  );
+}
+
+async function runIds(): Promise<string[]> {
+  const rows = await getDbClient().query<{ id: string }>("SELECT id FROM script_runs ORDER BY id");
+  return rows.map((row) => row.id);
+}
+
+async function journalRunIds(): Promise<string[]> {
+  const rows = await getDbClient().query<{ runId: string }>(
+    "SELECT DISTINCT runId FROM script_run_journal ORDER BY runId",
+  );
+  return rows.map((row) => row.runId);
+}
+
+beforeAll(async () => {
+  closeDb();
+  await removeDbFiles();
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(async () => {
+  await resetDbRetentionForTests();
+  delete process.env[DAYS_KEY];
+  delete process.env.DB_RETENTION_DRY_RUN;
+  closeDb();
+  await removeDbFiles();
+});
+
+beforeEach(async () => {
+  await resetDbRetentionForTests();
+  delete process.env[DAYS_KEY];
+  delete process.env.DB_RETENTION_DRY_RUN;
+  await getDbClient().run("DELETE FROM script_run_journal");
+  await getDbClient().run("DELETE FROM script_runs");
+});
+
+describe("script_runs age-based retention", () => {
+  test("is opt-in: an unset key deletes nothing", async () => {
+    await insertRun("old-completed", "completed", OLD_ISO);
+
+    await runDbRetentionTick({ now: NOW });
+
+    expect(await runIds()).toEqual(["old-completed"]);
+    expect(getDbRetentionStats().scriptRuns).toBeUndefined();
+  });
+
+  test("deletes old finished runs and keeps running, paused, recent and keyed runs", async () => {
+    for (const status of ["completed", "failed", "cancelled", "aborted_limit"]) {
+      await insertRun(`old-${status}-iso`, status, OLD_ISO);
+      await insertRun(`old-${status}-spaced`, status, OLD_SPACED, { kind: "workflow" });
+    }
+    await insertRun("old-running", "running", OLD_SPACED, { kind: "workflow" });
+    await insertRun("old-paused", "paused", OLD_SPACED, { kind: "workflow" });
+    await insertRun("old-keyed", "completed", OLD_SPACED, {
+      kind: "workflow",
+      idempotencyKey: "launch-once",
+    });
+    await insertRun("recent-completed", "completed", RECENT_ISO);
+    process.env[DAYS_KEY] = "1";
+
+    await runDbRetentionTick({ now: NOW });
+
+    expect(await runIds()).toEqual(["old-keyed", "old-paused", "old-running", "recent-completed"]);
+    expect(getDbRetentionStats().scriptRuns).toMatchObject({
+      rowsDeleted: 8,
+      drained: true,
+      backlogRemaining: 0,
+      dryRun: false,
+    });
+  });
+
+  test("journal rows leave with their run and stay with a surviving one", async () => {
+    await insertRun("old-done", "completed", OLD_SPACED, { kind: "workflow" });
+    await insertRun("old-paused", "paused", OLD_SPACED, { kind: "workflow" });
+    for (const step of ["a", "b", "c"]) {
+      await insertJournal("old-done", step);
+      await insertJournal("old-paused", step);
+    }
+    process.env[DAYS_KEY] = "1";
+
+    await runDbRetentionTick({ now: NOW });
+
+    expect(await runIds()).toEqual(["old-paused"]);
+    expect(await journalRunIds()).toEqual(["old-paused"]);
+    const journal = await getDbClient().get<{ n: number }>(
+      "SELECT COUNT(*) AS n FROM script_run_journal",
+    );
+    expect(journal?.n).toBe(3);
+  });
+
+  test("never deletes a row early across the two stored timestamp formats", async () => {
+    // Cutoff: 2026-08-22T12:00:00.000Z, compared as '2026-08-22 12:00:00'.
+    await insertRun("spaced-before", "completed", "2026-08-22 11:59:59", { kind: "workflow" });
+    await insertRun("spaced-at", "completed", "2026-08-22 12:00:00", { kind: "workflow" });
+    await insertRun("iso-previous-day", "completed", "2026-08-21T23:59:59.999Z");
+    // Older than the cutoff, but on the cutoff's own date: kept until a later tick.
+    await insertRun("iso-cutoff-day", "completed", "2026-08-22T11:00:00.000Z");
+    await insertRun("iso-after", "completed", "2026-08-22T12:00:00.001Z");
+    process.env[DAYS_KEY] = "1";
+
+    await runDbRetentionTick({ now: NOW });
+
+    expect(await runIds()).toEqual(["iso-after", "iso-cutoff-day", "spaced-at"]);
+
+    // A day later every one of them is past the cutoff's date.
+    await runDbRetentionTick({ now: new Date("2026-08-24T00:00:00.000Z") });
+
+    expect(await runIds()).toEqual([]);
+  });
+
+  test("dry run counts the would-delete rows without deleting", async () => {
+    await insertRun("old-completed", "completed", OLD_ISO);
+    await insertRun("old-failed", "failed", OLD_SPACED, { kind: "workflow" });
+    await insertRun("old-running", "running", OLD_SPACED, { kind: "workflow" });
+    process.env[DAYS_KEY] = "1";
+    process.env.DB_RETENTION_DRY_RUN = "true";
+
+    await runDbRetentionTick({ now: NOW });
+
+    expect(await runIds()).toHaveLength(3);
+    expect(getDbRetentionStats().scriptRuns).toMatchObject({
+      rowsDeleted: 0,
+      backlogRemaining: 2,
+      dryRun: true,
+    });
+  });
+
+  test("drains a backlog larger than one batch within the batch ceiling", async () => {
+    await getDbClient().run(
+      `WITH RECURSIVE n(v) AS (SELECT 1 UNION ALL SELECT v + 1 FROM n WHERE v < 1200)
+       INSERT INTO script_runs (id, agentId, source, status, startedAt)
+       SELECT 'bulk-' || v, 'agent-1', 'x', 'completed', ? FROM n`,
+      [OLD_ISO],
+    );
+    process.env[DAYS_KEY] = "1";
+
+    await runDbRetentionTick({ now: NOW });
+
+    const stats = getDbRetentionStats().scriptRuns;
+    expect(await runIds()).toEqual([]);
+    expect(stats?.rowsDeleted).toBe(1200);
+    expect(stats?.batches).toBeGreaterThan(1);
+    expect(stats?.batchSize).toBeLessThanOrEqual(500);
+  });
+
+  test("the delete, the backlog count and the journal cascade all use an index", async () => {
+    const statements = sweepStatements(SCRIPT_RUNS, 30, NOW);
+    const client = getDbClient();
+
+    for (const [sql, params] of [
+      [statements.deleteSql, [...statements.params, 100]],
+      [statements.backlogSql, statements.params],
+    ] as const) {
+      const plan = await client.query<{ detail: string }>(`EXPLAIN QUERY PLAN ${sql}`, [...params]);
+      const detail = plan.map((row) => row.detail).join("\n");
+      expect(detail).toContain("USING COVERING INDEX idx_script_runs_status_startedAt");
+      expect(detail).not.toMatch(/SCAN script_runs(?! USING)/);
+    }
+
+    // ON DELETE CASCADE looks up journal rows of every deleted run by runId.
+    const fkPlan = await client.query<{ detail: string }>(
+      "EXPLAIN QUERY PLAN SELECT rowid FROM script_run_journal WHERE runId = ?",
+      ["x"],
+    );
+    expect(fkPlan.map((row) => row.detail).join("\n")).toContain("idx_srj_runId");
+  });
+});

package/src/tests/sdk-allowlist.test.ts

@@ -98,6 +98,45 @@ describe("script SDK allowlist", () => {
     }
   });
 
+  test("workflow_getRun forwards fields to the run route and rejects an unknown value", async () => {
+    const requests: URL[] = [];
+    const httpServer = Bun.serve({
+      port: 0,
+      fetch(req) {
+        requests.push(new URL(req.url));
+        return Response.json({ run: { id: "run-1" }, steps: [] });
+      },
+    });
+    const config = new SwarmConfig({
+      system: {
+        apiKey: { value: "sdk-test-key", isSecret: true },
+        agentId: { value: "sdk-test-agent", isSecret: false },
+        mcpBaseUrl: { value: `http://127.0.0.1:${httpServer.port}`, isSecret: false },
+      },
+      user: {},
+    });
+    const sdk = createSwarmSdk(config);
+
+    try {
+      await sdk.workflow_getRun({ id: "run-1", fields: "slim" });
+      await sdk.workflow_getRun({ id: "run-1" });
+      expect(requests.map((url) => url.pathname)).toEqual([
+        "/api/workflow-runs/run-1",
+        "/api/workflow-runs/run-1",
+      ]);
+      expect(requests[0]?.searchParams.get("fields")).toBe("slim");
+      // Omitted `fields` sends no query, so the route keeps its full default.
+      expect(requests[1]?.search).toBe("");
+
+      await expect(sdk.workflow_getRun({ id: "run-1", fields: "tiny" })).rejects.toThrow(
+        '`fields` must be "full" or "slim"',
+      );
+      expect(requests).toHaveLength(2);
+    } finally {
+      httpServer.stop(true);
+    }
+  });
+
   test("approval_cancel posts to the cancel route with the reason", async () => {
     let request: { method: string; path: string; body: unknown } | undefined;
     const httpServer = Bun.serve({

package/src/tests/session-logs.test.ts

@@ -5,6 +5,7 @@ import {
   closeDb,
   createSessionLogs,
   createTaskExtended,
+  getDbClient,
   getSessionLogsBySession,
   getSessionLogsByTaskId,
   getTaskById,
@@ -226,6 +227,75 @@ describe("Session Logs API", () => {
       expect(logs[3]?.iteration).toBe(2);
       expect(logs[3]?.lineNumber).toBe(1);
     });
+
+    test("keeps write order across many flushes of one iteration", async () => {
+      const task = await createTaskExtended("Task for multi-flush ordering");
+      // The runner flushes every 50 lines or 5s, so one iteration arrives as
+      // many POSTs. Each POST used to restart lineNumber at 0.
+      const written: string[] = [];
+      for (let flush = 0; flush < 3; flush++) {
+        const lines = [0, 1, 2, 3].map((i) => `flush${flush}-line${i}`);
+        written.push(...lines);
+        await createSessionLogs({
+          taskId: task.id,
+          sessionId: "multi-flush-session",
+          iteration: 1,
+          cli: "claude",
+          lines,
+        });
+      }
+
+      const all = await getSessionLogsByTaskId(task.id);
+      expect(all.map((l) => l.content)).toEqual(written);
+      expect(all.map((l) => l.lineNumber)).toEqual(written.map((_, i) => i));
+
+      const tail = await getSessionLogsByTaskId(task.id, 5);
+      expect(tail.map((l) => l.content)).toEqual(written.slice(-5));
+
+      const bySession = await getSessionLogsBySession("multi-flush-session", 1);
+      expect(bySession.map((l) => l.content)).toEqual(written);
+    });
+
+    test("reads rows stored with per-flush lineNumbers in write order", async () => {
+      const task = await createTaskExtended("Task with legacy session log rows");
+      // Rows written before the fix: lineNumber restarts per POST, and
+      // createdAt ties inside one POST.
+      const legacy = [
+        ["a0", 0],
+        ["a1", 1],
+        ["a2", 2],
+        ["b0", 0],
+        ["b1", 1],
+        ["c0", 0],
+      ] as const;
+      await getDbClient().transaction(async (tx) => {
+        for (const [content, lineNumber] of legacy) {
+          await tx.run(
+            `INSERT INTO session_logs (id, taskId, sessionId, iteration, cli, content, lineNumber, createdAt)
+             VALUES (?, ?, 'legacy-session', 1, 'claude', ?, ?, '2026-10-01T00:00:00.000Z')`,
+            [crypto.randomUUID(), task.id, content, lineNumber],
+          );
+        }
+      });
+      // A flush after deploy lands behind the legacy rows.
+      await createSessionLogs({
+        taskId: task.id,
+        sessionId: "legacy-session",
+        iteration: 1,
+        cli: "claude",
+        lines: ["d0", "d1"],
+      });
+
+      const written = ["a0", "a1", "a2", "b0", "b1", "c0", "d0", "d1"];
+      const all = await getSessionLogsByTaskId(task.id);
+      expect(all.map((l) => l.content)).toEqual(written);
+
+      const tail = await getSessionLogsByTaskId(task.id, 4);
+      expect(tail.map((l) => l.content)).toEqual(["b1", "c0", "d0", "d1"]);
+
+      const bySession = await getSessionLogsBySession("legacy-session", 1);
+      expect(bySession.map((l) => l.content)).toEqual(written);
+    });
   });
 
   describe("POST /api/session-logs", () => {