@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/src/tests/internal-ai/complete-structured.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { Type } from "typebox";
 import { z } from "zod";
 import { SummaryWithRatingsSchema } from "../../be/memory/raters/llm.js";
@@ -501,6 +501,42 @@ describe("completeStructured", () => {
 });
 
 describe("defaultSpawnClaudeCli", () => {
+  for (const mirrored of [false, true]) {
+    test(`selects single credentials before CLI spawn (mirror=${mirrored})`, async () => {
+      const keys = [
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "AGENT_SWARM_CLAUDE_OAUTH_TOKEN",
+        "ANTHROPIC_API_KEY",
+      ];
+      const saved = Object.fromEntries(keys.map((key) => [key, process.env[key]]));
+      process.env.CLAUDE_CODE_OAUTH_TOKEN = mirrored ? "" : "example-first,example-second";
+      process.env.AGENT_SWARM_CLAUDE_OAUTH_TOKEN = "example-first,example-second";
+      process.env.ANTHROPIC_API_KEY = "example-first,example-second";
+      let capturedEnv: Record<string, string | undefined> | undefined;
+      const spawn = spyOn(Bun, "spawn").mockImplementation(((
+        ...args: Parameters<typeof Bun.spawn>
+      ) => {
+        const options = args[0] as Bun.SpawnOptions.OptionsObject;
+        capturedEnv = options.env;
+        throw new Error("test stops before CLI spawn");
+      }) as typeof Bun.spawn);
+      try {
+        await expect(defaultSpawnClaudeCli("prompt", "haiku")).rejects.toThrow(
+          "test stops before CLI spawn",
+        );
+        for (const key of ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]) {
+          expect(["example-first", "example-second"]).toContain(capturedEnv?.[key]);
+        }
+      } finally {
+        spawn.mockRestore();
+        for (const [key, value] of Object.entries(saved)) {
+          if (value === undefined) delete process.env[key];
+          else process.env[key] = value;
+        }
+      }
+    });
+  }
+
   test("sets SKIP_SESSION_SUMMARY=1 in the child env (Stop-hook recursion guard)", async () => {
     // Without this guard, the spawned `claude -p` summarizer session fires the
     // same global Stop hook on exit, which spawns another summarizer claude,

package/src/tests/internal-ai/credentials.test.ts

@@ -25,6 +25,29 @@ function makeOpts(
 }
 
 describe("resolveCredential", () => {
+  for (const [keyVar, kind] of [
+    ["OPENROUTER_API_KEY", "openrouter"],
+    ["ANTHROPIC_API_KEY", "anthropic"],
+    ["OPENAI_API_KEY", "openai"],
+  ] as const) {
+    for (const source of ["env", "fallback"] as const) {
+      test(`${keyVar} selects one pool member from ${source}`, async () => {
+        const pool = "example-first, example-second";
+        const cred = await resolveCredential(
+          makeOpts({
+            env: source === "env" ? { [keyVar]: pool } : {},
+            _getEnvApiKey: (provider) =>
+              source === "fallback" && provider === kind ? pool : undefined,
+          }),
+        );
+        expect(cred?.kind).toBe(kind);
+        expect(
+          cred && "apiKey" in cred && ["example-first", "example-second"].includes(cred.apiKey),
+        ).toBe(true);
+      });
+    }
+  }
+
   test("OPENROUTER_API_KEY wins", async () => {
     const cred = await resolveCredential(makeOpts({ env: { OPENROUTER_API_KEY: "or-1" } }));
     expect(cred).not.toBeNull();

package/src/tests/kv-http.test.ts

@@ -362,6 +362,38 @@ describe("/api/kv REST — auth on writes", () => {
     expect(intruderWrite.status).toBe(403);
   });
 
+  test("session source labels are private: generic callers cannot read, list, or write them", async () => {
+    const namespace = "session-labels";
+    const key = encodeURIComponent("shared/slack/d0private1/");
+    await upsertKv({
+      namespace,
+      key: "shared/slack/d0private1/",
+      value: "DM · Lena",
+      valueType: "string",
+    });
+    for (const as of [agentId, leadAgentId]) {
+      expect((await authedFetch(`/api/kv/_/${namespace}/${key}`, { agentId: as })).status).toBe(
+        403,
+      );
+      expect((await authedFetch(`/api/kv/_/${namespace}`, { agentId: as })).status).toBe(403);
+      for (const method of ["PUT", "DELETE"]) {
+        const res = await authedFetch(`/api/kv/_/${namespace}/${key}`, {
+          method,
+          body:
+            method === "PUT" ? JSON.stringify({ value: "forged", valueType: "string" }) : undefined,
+          agentId: as,
+        });
+        expect(res.status).toBe(403);
+      }
+    }
+    expect(
+      await getDbClient().get<{ value: string }>(
+        "SELECT value FROM kv_entries WHERE namespace = ? AND key = ?",
+        [namespace, "shared/slack/d0private1/"],
+      ),
+    ).toEqual({ value: "DM · Lena" });
+  });
+
   test("403 when writing to task:page:* without an X-Page-Id header", async () => {
     const ns = "task:page:abc";
     const res = await authedFetch(`/api/kv/_/${encodeURIComponent(ns)}/k`, {

package/src/tests/kv-tool.test.ts

@@ -133,6 +133,31 @@ describe("kv MCP tools", () => {
     ).toBeNull();
   });
 
+  test("kv-get, kv-list, and kv-set refuse the private session-labels namespace, even for lead", async () => {
+    const namespace = "session-labels";
+    const key = "shared/slack/d0private1/";
+    await getDbClient().run(
+      `INSERT INTO kv_entries (namespace, key, value, value_type, created_at, updated_at)
+       VALUES (?, ?, 'DM · Lena', 'string', 0, 0)`,
+      [namespace, key],
+    );
+    const tools = buildServer();
+    for (const result of [
+      await tools.get.handler({ namespace, key }, meta(lead)),
+      await tools.list.handler({ namespace }, meta(lead)),
+      await tools.set.handler({ namespace, key, value: "forged" }, meta(lead)),
+    ] as StructuredResult<{ success: boolean; message: string }>[]) {
+      expect(result.structuredContent.success).toBe(false);
+      expect(result.structuredContent.message).toContain("reserved for session source labels");
+    }
+    expect(
+      await getDbClient().get("SELECT value FROM kv_entries WHERE namespace = ? AND key = ?", [
+        namespace,
+        key,
+      ]),
+    ).toEqual({ value: "DM · Lena" });
+  });
+
   test("kv-get returns entry=null for missing keys", async () => {
     const tools = buildServer();
     const getRes = (await tools.get.handler({ key: "nope" }, meta(agentA))) as StructuredResult<{

package/src/tests/multi-runtime-registration.test.ts

@@ -2995,11 +2995,19 @@ describe("post-task credential recovery without a restart", () => {
         ready: true,
         lastRefreshAt: 0,
         inFlight: false,
+        fingerprint: null,
+        rejectedKeys: 0,
       };
       const check = spyOn(CREDENTIAL_PROVIDER_CHECKERS, "claude");
       const originalOAuth = process.env.CLAUDE_CODE_OAUTH_TOKEN;
-      // The real Claude checker and live-test use OAuth presence, no upstream I/O.
       process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-credential-recovery";
+      // The subscription live test calls Anthropic's OAuth profile: answer it locally.
+      const realFetch = globalThis.fetch;
+      globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+        const url = input instanceof Request ? input.url : String(input);
+        if (url.startsWith("https://api.anthropic.com/")) return new Response("{}");
+        return realFetch(input, init);
+      }) as typeof fetch;
       try {
         // A live provider swap produces a real not-ready post-task snapshot.
         await refreshCredentialStatus(api, refresh, "claude", {}, 1);
@@ -3021,6 +3029,8 @@ describe("post-task credential recovery without a restart", () => {
         await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
         expect(check).toHaveBeenCalledTimes(2);
         expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        // Credentials resolve. A changed credential is checked at once, inside
+        // the retry throttle. Same runner state, provider, and runtime identity.
         const env = { CLAUDE_CODE_OAUTH_TOKEN: "test-credential-recovery" };
         await refreshCredentialStatus(
           api,
@@ -3029,17 +3039,6 @@ describe("post-task credential recovery without a restart", () => {
           env,
           2 * CREDENTIAL_RETRY_INTERVAL_MS,
         );
-        expect(check).toHaveBeenCalledTimes(2);
-        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
-
-        // Credentials resolve. Same runner state, provider, and runtime identity.
-        await refreshCredentialStatus(
-          api,
-          refresh,
-          "claude",
-          env,
-          2 * CREDENTIAL_RETRY_INTERVAL_MS + 1,
-        );
         expect(check).toHaveBeenCalledTimes(3);
         expect((await getAgentById(id))?.status).toBe("idle");
         expect((await getAgentById(id))?.credStatus?.ready).toBe(true);
@@ -3058,6 +3057,7 @@ describe("post-task credential recovery without a restart", () => {
         );
         expect(check).toHaveBeenCalledTimes(3);
       } finally {
+        globalThis.fetch = realFetch;
         check.mockRestore();
         if (originalOAuth === undefined) delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
         else process.env.CLAUDE_CODE_OAUTH_TOKEN = originalOAuth;

package/src/tests/oauth-refresh-sweep.test.ts

@@ -8,7 +8,11 @@ import {
   storeOAuthTokens,
   upsertOAuthApp,
 } from "../be/db-queries/oauth";
-import { sweepOAuthTokenRefresh } from "../be/oauth-refresh-sweep";
+import {
+  startOAuthRefreshSweep,
+  stopOAuthRefreshSweep,
+  sweepOAuthTokenRefresh,
+} from "../be/oauth-refresh-sweep";
 
 async function authorizationStatus(provider: string): Promise<string | undefined> {
   const id = await getDefaultAuthorizationIdForProvider(provider);
@@ -242,3 +246,32 @@ describe("sweepOAuthTokenRefresh", () => {
     expect((await getOAuthTokens("vendor_a"))?.accessToken).toBe("example-new-access-token");
   });
 });
+
+describe("startOAuthRefreshSweep", () => {
+  const originalDisable = process.env.OAUTH_REFRESH_SWEEP_DISABLE;
+
+  afterAll(async () => {
+    await stopOAuthRefreshSweep();
+    if (originalDisable === undefined) {
+      delete process.env.OAUTH_REFRESH_SWEEP_DISABLE;
+    } else {
+      process.env.OAUTH_REFRESH_SWEEP_DISABLE = originalDisable;
+    }
+  });
+
+  for (const val of ["true", "1", "TRUE"]) {
+    test(`does not start when OAUTH_REFRESH_SWEEP_DISABLE=${val}`, async () => {
+      process.env.OAUTH_REFRESH_SWEEP_DISABLE = val;
+      const logs: string[] = [];
+      const origLog = console.log;
+      console.log = (...args: unknown[]) => logs.push(args.map(String).join(" "));
+      try {
+        startOAuthRefreshSweep();
+      } finally {
+        console.log = origLog;
+        await stopOAuthRefreshSweep();
+      }
+      expect(logs).toEqual(["[oauth-refresh-sweep] Disabled via OAUTH_REFRESH_SWEEP_DISABLE"]);
+    });
+  }
+});

package/src/tests/onboard-compose.test.ts

@@ -136,6 +136,26 @@ describe("generateCompose", () => {
     expect(yaml).not.toContain("pull_policy: always");
   });
 
+  test.each([
+    "docker",
+    "podman",
+  ] as const)("%s agent services mount volumes where the worker reads and writes", (containerEngine) => {
+    const doc = Bun.YAML.parse(generateCompose({ ...devState, containerEngine })) as {
+      services: Record<string, { volumes?: string[] }>;
+    };
+    const agents = Object.entries(doc.services).filter(([name]) => name !== "swarm-api");
+
+    expect(agents.map(([name]) => name)).toEqual(["lead", "worker-coder-1", "worker-coder-2"]);
+    for (const [name, service] of agents) {
+      expect(service.volumes).toEqual([
+        "swarm_logs:/logs",
+        "swarm_shared:/workspace/shared",
+        `swarm_${name.replaceAll("-", "_")}:/workspace/personal`,
+      ]);
+    }
+    expect(doc.services["swarm-api"]?.volumes).toEqual(["swarm_data:/app/data"]);
+  });
+
   test("dev preset produces 3 agent services + 1 API service", () => {
     const yaml = generateCompose(devState);
     // Only count service definitions in the services section (before volumes:)

package/src/tests/onboarding.test.ts

@@ -362,7 +362,14 @@ describe("onboarding state", () => {
       signals: { providers: Array<Record<string, unknown>> };
     };
     expect(body.signals.providers).toEqual([
-      { provider: "claude", state: "verified", workers: 2, verifiedWorkers: 2 },
+      {
+        provider: "claude",
+        state: "verified",
+        workers: 2,
+        verifiedWorkers: 2,
+        error: null,
+        warning: null,
+      },
     ]);
     expect(body.state.steps.ai).toMatchObject({
       status: "done",
@@ -370,6 +377,57 @@ describe("onboarding state", () => {
     });
   });
 
+  test("GET carries the latest live test error and the pool warning", async () => {
+    const report = (liveTest: {
+      ok: boolean;
+      error: string | null;
+      latency_ms: number;
+      testedAt: number;
+      warning?: string;
+    }) => ({
+      ready: true,
+      missing: [],
+      satisfiedBy: "env" as const,
+      hint: null,
+      liveTest,
+      reportedAt: Date.now(),
+      reportKind: "boot" as const,
+    });
+    const failing = await createAgent({ name: "codex-worker", isLead: false, status: "idle" });
+    await setAgentHarnessProvider(failing.id, "codex");
+    await updateAgentCredStatus(
+      failing.id,
+      report({ ok: false, error: "HTTP 401: bad key", latency_ms: 5, testedAt: Date.now() }),
+    );
+    const warned = await createAgent({ name: "pi-worker", isLead: false, status: "idle" });
+    await setAgentHarnessProvider(warned.id, "pi");
+    await updateAgentCredStatus(
+      warned.id,
+      report({
+        ok: true,
+        error: null,
+        latency_ms: 5,
+        testedAt: Date.now(),
+        warning: "1 of 2 keys failed: key ending abcde (HTTP 401).",
+      }),
+    );
+
+    const body = (await (await request("/api/onboarding")).json()) as {
+      signals: { providers: Array<Record<string, unknown>> };
+    };
+    const byProvider = Object.fromEntries(body.signals.providers.map((p) => [p.provider, p]));
+    expect(byProvider.codex).toMatchObject({
+      state: "configured",
+      error: "HTTP 401: bad key",
+      warning: null,
+    });
+    expect(byProvider.pi).toMatchObject({
+      state: "verified",
+      error: null,
+      warning: "1 of 2 keys failed: key ending abcde (HTTP 401).",
+    });
+  });
+
   test("GET derives integrations from environment configuration", async () => {
     process.env.GITHUB_TOKEN = "example-github-token";
     const body = (await (await request("/api/onboarding")).json()) as {
@@ -853,6 +911,55 @@ describe("onboarding memory probe", () => {
     expect((await getState()).steps.memory.status).toBe("todo");
   });
 
+  test("probes and saves the first member of a reused OpenAI pool", async () => {
+    const originalFetch = globalThis.fetch;
+    let authorization: string | null = null;
+    process.env.OPENAI_API_KEY = "example-first, example-second";
+    globalThis.fetch = (async (input, init) => {
+      const req = new Request(input, init);
+      if (new URL(req.url).hostname !== "api.openai.com") return originalFetch(input, init);
+      authorization = req.headers.get("authorization");
+      return embeddingResponse(512);
+    }) as typeof fetch;
+    try {
+      const response = await request("/api/onboarding/memory", {
+        method: "POST",
+        body: { preset: "openai", reuseKey: "OPENAI_API_KEY" },
+      });
+      expect(await response.json()).toMatchObject({ ok: true, dimensions: 512 });
+      expect(authorization).toBe("Bearer example-first");
+      const configs = await getSwarmConfigs({ scope: "global", key: "EMBEDDING_API_KEY" });
+      expect(configs[0]?.value).toBe("example-first");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  for (const keyVar of ["EMBEDDING_API_KEY", "OPENAI_API_KEY"]) {
+    test(`existing memory probes the first member of ${keyVar}`, async () => {
+      const originalFetch = globalThis.fetch;
+      let authorization: string | null = null;
+      process.env[keyVar] = "example-first, example-second";
+      process.env.EMBEDDING_API_BASE_URL = "https://api.openai.com/v1";
+      globalThis.fetch = (async (input, init) => {
+        const req = new Request(input, init);
+        if (new URL(req.url).hostname !== "api.openai.com") return originalFetch(input, init);
+        authorization = req.headers.get("authorization");
+        return embeddingResponse(512);
+      }) as typeof fetch;
+      try {
+        const response = await request("/api/onboarding/memory", {
+          method: "POST",
+          body: { preset: "existing" },
+        });
+        expect(await response.json()).toMatchObject({ ok: true, dimensions: 512 });
+        expect(authorization).toBe("Bearer example-first");
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
+    });
+  }
+
   test("does not send a reused OpenAI key to another host", async () => {
     let hits = 0;
     const fake = startEmbeddingServer(() => {

package/src/tests/openai-embedding-credentials.test.ts

@@ -0,0 +1,35 @@
+import { expect, test } from "bun:test";
+import { OpenAIEmbeddingProvider } from "../be/memory/providers/openai-embedding";
+
+for (const source of ["config", "EMBEDDING_API_KEY", "OPENAI_API_KEY"] as const) {
+  test(`embedding selects one key from ${source}`, async () => {
+    const originalFetch = globalThis.fetch;
+    const saved = {
+      EMBEDDING_API_KEY: process.env.EMBEDDING_API_KEY,
+      OPENAI_API_KEY: process.env.OPENAI_API_KEY,
+    };
+    delete process.env.EMBEDDING_API_KEY;
+    delete process.env.OPENAI_API_KEY;
+    const pool = "example-first, example-second";
+    if (source !== "config") process.env[source] = pool;
+    let authorization: string | null = null;
+    globalThis.fetch = (async (input, init) => {
+      authorization = new Request(input, init).headers.get("authorization");
+      return Response.json({ data: [{ embedding: [0.5] }] });
+    }) as typeof fetch;
+    try {
+      const provider = new OpenAIEmbeddingProvider({
+        dimensions: 1,
+        ...(source === "config" ? { apiKey: pool } : {}),
+      });
+      expect(await provider.embed("test input")).toEqual(new Float32Array([0.5]));
+      expect(["Bearer example-first", "Bearer example-second"]).toContain(authorization);
+    } finally {
+      globalThis.fetch = originalFetch;
+      for (const [key, value] of Object.entries(saved)) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  });
+}

package/src/tests/opencode-adapter.test.ts

@@ -675,7 +675,7 @@ describe("OpencodeSession — persisted rows render in the dashboard", () => {
     const { items } = normalizeSessionLogs(rows);
 
     const visible = items
-      .filter((item) => item.kind !== "lifecycle")
+      .filter((item) => item.kind !== "lifecycle" && item.kind !== "call_usage")
       .map((item) =>
         item.kind === "text"
           ? `${item.role} text: ${item.text}`
@@ -695,6 +695,7 @@ describe("OpencodeSession — persisted rows render in the dashboard", () => {
       "system text: opencode error: provider overloaded",
     ]);
     expect(items.some((item) => item.kind === "unknown")).toBe(false);
+    expect(items.filter((item) => item.kind === "call_usage")).toHaveLength(1);
   });
 });
 

package/src/tests/openrouter-attribution-call-sites.test.ts

@@ -164,12 +164,12 @@ describe("workflow raw-llm and validate nodes", () => {
   });
 });
 
-describe("OpenRouter credential check (GET /models)", () => {
+describe("OpenRouter credential check (GET /key)", () => {
   for (const c of CASES) {
     test(`${c.name}`, async () => {
       setEnv(c.env);
       await validateProviderCredentials("grok", { OPENROUTER_API_KEY: "example-or-key" });
-      expect(requests[0]?.url.endsWith("/models")).toBe(true);
+      expect(requests[0]?.url.endsWith("/key")).toBe(true);
       expectAttribution(requests[0]?.headers, c.attributed);
     });
   }

package/src/tests/org-website.test.ts

@@ -5,6 +5,8 @@ import {
   COMPANY_ACQUISITION_SOURCES,
   COMPANY_TEAM_SIZES,
   COMPANY_USE_CASES,
+  reportedUseCase,
+  reportedUserFunction,
 } from "../utils/company-profile";
 import {
   isFilledOrgLogoUrl,
@@ -157,6 +159,40 @@ describe("company profile config guards", () => {
   }
 });
 
+describe("profile values the telemetry catalog does not list yet", () => {
+  const input = {
+    orgId: "org_0123456789abcdef",
+    installationId: "install_0123456789abcdef",
+    isCloud: false,
+    isE2b: false,
+    swarmVersion: "1.0.0",
+    actor: { userId: "user-1" },
+  };
+
+  test("the config guards accept them", () => {
+    for (const value of ["content", "research", "seo", "admin"]) {
+      expect(validateConfigValue("SWARM_ORG_USE_CASE", value)).toBeNull();
+    }
+  });
+
+  test("stay out of the telemetry context, as if unset", () => {
+    for (const useCase of ["content", "research", "seo", "admin"]) {
+      expect(reportedUseCase(useCase)).toBeUndefined();
+      expect(buildContext({ ...input, useCase })).not.toHaveProperty("use_case");
+    }
+    for (const userFunction of ["marketing", "sales", "research"]) {
+      expect(reportedUserFunction(userFunction)).toBeUndefined();
+      expect(buildContext({ ...input, userFunction })).not.toHaveProperty("user_function");
+    }
+  });
+
+  test("the catalog values still report", () => {
+    const context = buildContext({ ...input, useCase: "docs", userFunction: "founder" });
+    expect(context.use_case).toBe("docs");
+    expect(context.user_function).toBe("founder");
+  });
+});
+
 describe("org_website in the telemetry context", () => {
   const input = {
     orgId: "org_0123456789abcdef",