@desplega.ai/agent-swarm 2.6.0 → 2.7.0

package/src/tests/credential-check.test.ts

@@ -1323,10 +1323,12 @@ describe("NaN and Helmcode live probes", () => {
 // ─── Migration 055: report composition + opt-out ────────────────────────────
 
 describe("isCredCheckDisabled", () => {
-  test("true only when CRED_CHECK_DISABLE === '1'", () => {
+  test("true when CRED_CHECK_DISABLE is '1' or 'true' (case-insensitive)", () => {
     expect(isCredCheckDisabled({})).toBe(false);
     expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "0" })).toBe(false);
-    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "true" })).toBe(false);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "false" })).toBe(false);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "true" })).toBe(true);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "TRUE" })).toBe(true);
     expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "1" })).toBe(true);
   });
 });

package/src/tests/docs-index.test.ts

@@ -0,0 +1,135 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  collectDocsPages,
+  coverageErrors,
+  INDEX_END,
+  INDEX_START,
+  renderDocsIndex,
+  replaceIndexBlock,
+  SKILL_CONTENT_PATH,
+} from "../../scripts/build-docs-index";
+import { loadSeedSkills } from "../be/seed-skills";
+
+const page = (frontmatter: string, body = "Body.\n") => `---\n${frontmatter}\n---\n\n${body}`;
+
+describe("docs index (real docs tree)", () => {
+  test("every playbook is in the index and the coverage rules pass", async () => {
+    const pages = await collectDocsPages();
+    expect(coverageErrors(pages)).toEqual([]);
+
+    const index = renderDocsIndex(pages);
+    const playbooks = pages.filter((p) => p.path.startsWith("playbooks/"));
+    expect(playbooks.length).toBeGreaterThan(10);
+    for (const playbook of playbooks) {
+      expect(index).toContain(`(https://docs.agent-swarm.dev/docs/${playbook.slug})`);
+    }
+    // Positive control: a known playbook carries its trigger.
+    expect(index).toContain(
+      "[Open Oncall](https://docs.agent-swarm.dev/docs/playbooks/open-oncall). When: ",
+    );
+    // Negative control: opted-out pages are reference only, release notes are skipped.
+    expect(index).toContain("(https://docs.agent-swarm.dev/docs/playbooks). Reference.");
+    expect(index).not.toContain("/docs/releases/");
+  });
+
+  test("the committed skill body matches the generator", async () => {
+    const content = await Bun.file(SKILL_CONTENT_PATH).text();
+    const regenerated = replaceIndexBlock(content, renderDocsIndex(await collectDocsPages()));
+    expect(content).toBe(regenerated);
+  });
+
+  test("the generator is deterministic", async () => {
+    const first = renderDocsIndex(await collectDocsPages());
+    const second = renderDocsIndex(await collectDocsPages());
+    expect(second).toBe(first);
+  });
+
+  test("the seeded skill is a system default and carries the index", async () => {
+    const skill = (await loadSeedSkills()).find((s) => s.name === "swarm-docs");
+    expect(skill?.systemDefault).toBe(true);
+    expect(skill?.content).toContain("https://docs.agent-swarm.dev/docs/playbooks/open-oncall");
+  });
+});
+
+describe("docs index (fixture tree)", () => {
+  let root: string;
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), "docs-index-"));
+    await mkdir(join(root, "playbooks"), { recursive: true });
+    await mkdir(join(root, "guides"), { recursive: true });
+    await mkdir(join(root, "releases"), { recursive: true });
+    await Bun.write(join(root, "meta.json"), JSON.stringify({ pages: ["index", "playbooks"] }));
+    await Bun.write(join(root, "index.mdx"), page("title: Home"));
+    await Bun.write(
+      join(root, "playbooks", "meta.json"),
+      JSON.stringify({ pages: ["index", "b", "---Separator---", "a"] }),
+    );
+    await Bun.write(
+      join(root, "playbooks", "index.mdx"),
+      page("title: Playbooks\nagent:\n  offer: false"),
+    );
+    await Bun.write(
+      join(root, "playbooks", "a.mdx"),
+      page('title: A\nagent:\n  when: "Someone wants A"\n  template: "community/a"'),
+    );
+    await Bun.write(join(root, "playbooks", "b.mdx"), page("title: B"));
+    await Bun.write(
+      join(root, "guides", "g.mdx"),
+      page("title: G\nagent:\n  offer: true\n  notWhen: never"),
+    );
+    await Bun.write(join(root, "releases", "r.mdx"), page("title: R"));
+  });
+
+  afterAll(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  test("orders by meta.json, appends unlisted folders, and skips releases", async () => {
+    const pages = await collectDocsPages(root);
+    expect(pages.map((p) => p.path)).toEqual([
+      "index",
+      "playbooks/index",
+      "playbooks/b",
+      "playbooks/a",
+      "guides/g",
+    ]);
+    expect(pages.map((p) => p.slug)).toEqual([
+      "",
+      "playbooks",
+      "playbooks/b",
+      "playbooks/a",
+      "guides/g",
+    ]);
+  });
+
+  test("a playbook without when, and an offered guide without when, fail coverage", async () => {
+    const errors = coverageErrors(await collectDocsPages(root));
+    expect(errors).toEqual([
+      "playbooks/b: playbook needs agent.when (or agent.offer: false)",
+      "guides/g: agent.offer is true but agent.when is missing",
+    ]);
+  });
+
+  test("renders triggers and templates for offered pages only", async () => {
+    const index = renderDocsIndex(await collectDocsPages(root));
+    expect(index).toContain(
+      "- [A](https://docs.agent-swarm.dev/docs/playbooks/a). When: Someone wants A. Template: `community/a`.",
+    );
+    expect(index).toContain(
+      "- [Playbooks](https://docs.agent-swarm.dev/docs/playbooks). Reference.",
+    );
+    expect(index).toContain("- [Home](https://docs.agent-swarm.dev/docs)");
+  });
+
+  test("replaceIndexBlock swaps only the marked block and rejects missing markers", () => {
+    const content = `before\n${INDEX_START}\nold\n${INDEX_END}\nafter\n`;
+    expect(replaceIndexBlock(content, `${INDEX_START}\nnew\n${INDEX_END}`)).toBe(
+      `before\n${INDEX_START}\nnew\n${INDEX_END}\nafter\n`,
+    );
+    expect(() => replaceIndexBlock("no markers", "x")).toThrow();
+  });
+});

package/src/tests/dsh-adapter.test.ts

@@ -376,7 +376,7 @@ describe("dsh harness", () => {
     await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
     config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
     await expect(new DshAdapter().createSession(config)).rejects.toThrow(
-      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-rc.3",
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-rc.4",
     );
     expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
   });

package/src/tests/fetch-resolved-env.test.ts

@@ -41,8 +41,12 @@ const defaultMockResponse: MockResponse = {
 const mockResponsesByAgentId = new Map<string, MockResponse>();
 const requestedRepoIds = new Map<string, string | null>();
 const requestedTaskIds = new Map<string, string | null>();
-/** Every `GET /api/keys/available` query string observed by the mock server, most recent last. */
+/**
+ * Every `GET /api/keys/available` query string observed by the mock server,
+ * most recent last, without `keySuffixes` (recorded in `keysAvailableSuffixes`).
+ */
 const keysAvailableRequests: string[] = [];
+const keysAvailableSuffixes: Array<string | null> = [];
 
 beforeAll(() => {
   server = Bun.serve({
@@ -63,7 +67,10 @@ beforeAll(() => {
       }
 
       if (url.pathname === "/api/keys/available") {
-        keysAvailableRequests.push(url.search);
+        const params = new URLSearchParams(url.search);
+        keysAvailableSuffixes.push(params.get("keySuffixes"));
+        params.delete("keySuffixes");
+        keysAvailableRequests.push(`?${params}`);
         const totalKeys = Number(url.searchParams.get("totalKeys") ?? "1");
         const availableIndices = Array.from({ length: totalKeys }, (_, i) => i);
         return Response.json({ success: true, availableIndices, totalKeys });
@@ -455,6 +462,13 @@ describe("fetchResolvedEnv", () => {
       expect(keysAvailableRequests).toEqual([
         "?keyType=CLAUDE_CODE_OAUTH_TOKEN&totalKeys=32&model=fable",
       ]);
+      // The pool's own suffixes, in order, so status is matched by key (issue #2425).
+      expect(keysAvailableSuffixes.at(-1)).toBe(
+        Object.values(envWithOauthPool(32))[0]!
+          .split(",")
+          .map((key) => key.slice(-5))
+          .join(","),
+      );
     });
 
     test("model: 'claude-fable-5-1' issues the same model=fable", async () => {

package/src/tests/heartbeat-checklist.test.ts

@@ -24,6 +24,7 @@ import {
   upsertSwarmConfig,
 } from "../be/db";
 import { getScript, upsertScriptByName } from "../be/scripts/db";
+import * as savedScriptRunner from "../be/scripts/run-saved";
 import { runSavedScriptAsAgent } from "../be/scripts/run-saved";
 import {
   checkHeartbeatChecklist,
@@ -624,6 +625,66 @@ describe("Heartbeat Checklist", () => {
       });
     });
 
+    for (const quiet of [true, false]) {
+      test(`healthy probe preserves the saved gate quiet=${quiet} verdict`, async () => {
+        process.env.HEARTBEAT_CHECKLIST_GATE_MODE = "enforce";
+        await saveGlobalGateScript("quiet-gate", "export default () => ({ quiet: true });");
+        const saved = spyOn(savedScriptRunner, "runSavedScriptAsAgent").mockResolvedValue({
+          exitCode: 0,
+          result: { quiet, reason: "existing verdict" },
+          stdout: "",
+          stderr: "",
+          durationMs: 1,
+          truncated: { stdout: false, stderr: false },
+        });
+        try {
+          setChecklistGateRunnerForTests((name, agentId, signal) =>
+            defaultChecklistGateRunner(name, agentId, signal, { probe: async () => null }),
+          );
+          await seedLead();
+          await checkHeartbeatChecklist();
+          expect(saved).toHaveBeenCalledTimes(1);
+          const tasks = await checklistTasks();
+          expect(tasks).toHaveLength(quiet ? 0 : 1);
+          if (!quiet) expect(tasks[0]!.tags).toContain("heartbeat-gate:wake");
+        } finally {
+          saved.mockRestore();
+        }
+      });
+    }
+
+    for (const mode of ["shadow", "enforce"] as const) {
+      test(`${mode}: an unhealthy probe produces a wake checklist`, async () => {
+        process.env.HEARTBEAT_CHECKLIST_GATE_MODE = mode;
+        setChecklistGateRunnerForTests((name, agentId, signal) =>
+          defaultChecklistGateRunner(name, agentId, signal, {
+            probe: async () => ({ quiet: false, reason: "script-runner-unhealthy: timeout" }),
+          }),
+        );
+        await seedLead();
+        await checkHeartbeatChecklist();
+        const tasks = await checklistTasks();
+        expect(tasks).toHaveLength(1);
+        expect(tasks[0]!.tags).toContain("heartbeat-gate:wake");
+      });
+    }
+
+    test("a bug in the probe produces wake rather than error", async () => {
+      process.env.HEARTBEAT_CHECKLIST_GATE_MODE = "enforce";
+      setChecklistGateRunnerForTests((name, agentId, signal) =>
+        defaultChecklistGateRunner(name, agentId, signal, {
+          probe: async () => {
+            throw new Error("probe bug");
+          },
+        }),
+      );
+      await seedLead();
+      await checkHeartbeatChecklist();
+      const tasks = await checklistTasks();
+      expect(tasks).toHaveLength(1);
+      expect(tasks[0]!.tags).toContain("heartbeat-gate:wake");
+    });
+
     test("shadow mode (default): a quiet verdict still creates the task, tagged quiet", async () => {
       useGate({ quiet: true, reason: "no change", summary: "nothing moved" });
       const lead = await seedLead();
@@ -703,6 +764,9 @@ describe("Heartbeat Checklist", () => {
     test("enforce mode: a missing global script fails open through the real runner", async () => {
       process.env.HEARTBEAT_CHECKLIST_GATE_MODE = "enforce";
       process.env.HEARTBEAT_CHECKLIST_GATE_SCRIPT = "no-such-gate-script";
+      setChecklistGateRunnerForTests((name, agentId, signal) =>
+        defaultChecklistGateRunner(name, agentId, signal, { probe: async () => null }),
+      );
       await seedLead();
 
       await checkHeartbeatChecklist();
@@ -739,6 +803,7 @@ describe("Heartbeat Checklist", () => {
         let run: Promise<unknown> | undefined;
         setChecklistGateRunnerForTests((scriptName, leadAgentId, signal) => {
           run = defaultChecklistGateRunner(scriptName, leadAgentId, signal, {
+            probe: async () => null,
             buildCredentials: () => {
               setupStarted.resolve();
               return new Promise((resolve) => {
@@ -798,6 +863,9 @@ describe("Heartbeat Checklist", () => {
         "export default async function run() { await new Promise((r) => setTimeout(r, 30_000)); return { quiet: true }; }",
       );
       setChecklistGateTimeoutMsForTests(1_500);
+      setChecklistGateRunnerForTests((name, agentId, signal) =>
+        defaultChecklistGateRunner(name, agentId, signal, { probe: async () => null }),
+      );
       await seedLead();
 
       const started = Date.now();
@@ -808,6 +876,27 @@ describe("Heartbeat Checklist", () => {
       expect(tasks).toHaveLength(1);
       expect(tasks[0]!.tags).toContain("heartbeat-gate:error");
     });
+
+    test("enforce mode: the real probe passes with no swarm API key, using the Lead's run token", async () => {
+      process.env.HEARTBEAT_CHECKLIST_GATE_MODE = "enforce";
+      await saveGlobalGateScript("quiet-gate", "export default () => ({ quiet: true });");
+      const savedKeys = { swarm: process.env.AGENT_SWARM_API_KEY, legacy: process.env.API_KEY };
+      process.env.AGENT_SWARM_API_KEY = "";
+      process.env.API_KEY = "";
+      try {
+        await seedLead();
+        await checkHeartbeatChecklist();
+        expect(await checklistTasks()).toHaveLength(0);
+      } finally {
+        for (const [name, value] of [
+          ["AGENT_SWARM_API_KEY", savedKeys.swarm],
+          ["API_KEY", savedKeys.legacy],
+        ] as const) {
+          if (value === undefined) delete process.env[name];
+          else process.env[name] = value;
+        }
+      }
+    });
   });
 
   // ==========================================================================

package/src/tests/heartbeat-script-runner-probe.test.ts

@@ -0,0 +1,83 @@
+import { afterEach, describe, expect, mock, spyOn, test } from "bun:test";
+import { probeScriptRunner } from "../heartbeat/script-runner-probe";
+import type { RunScriptOutput } from "../scripts-runtime/loader";
+
+const ok: RunScriptOutput = {
+  result: true,
+  stdout: "",
+  stderr: "",
+  truncated: { stdout: false, stderr: false },
+  durationMs: 1,
+  exitCode: 0,
+};
+
+afterEach(() => mock.restore());
+
+describe("heartbeat script runner probe", () => {
+  test("success leaves the gate verdict unchanged and clears its deadline", async () => {
+    const clear = spyOn(globalThis, "clearTimeout");
+    const runner = mock(async () => ok);
+    expect(await probeScriptRunner("lead", runner)).toBeNull();
+    expect(runner).toHaveBeenCalledWith({
+      source: "export default async function () { return true; }",
+      agentId: "lead",
+      fsMode: "none",
+      timeoutMs: 10_000,
+      signal: expect.any(AbortSignal),
+    });
+    expect(clear).toHaveBeenCalledTimes(1);
+  });
+
+  test("timeout wakes without waiting for a stalled runner and aborts it", async () => {
+    let expire: (() => void) | undefined;
+    spyOn(globalThis, "setTimeout").mockImplementation(((callback: () => void, ms: number) => {
+      expect(ms).toBe(10_000);
+      expire = callback;
+      return 1;
+    }) as typeof setTimeout);
+    const clear = spyOn(globalThis, "clearTimeout").mockImplementation(() => {});
+    let signal: AbortSignal | undefined;
+    let rejectRun: ((error: Error) => void) | undefined;
+    const result = probeScriptRunner("lead", async (input) => {
+      signal = input.signal;
+      return new Promise<RunScriptOutput>((_, reject) => {
+        rejectRun = reject;
+      });
+    });
+    expire!();
+    expect(await result).toEqual({
+      quiet: false,
+      reason: "script-runner-unhealthy: timeout after 10000ms",
+    });
+    expect(signal?.aborted).toBe(true);
+    expect(clear).toHaveBeenCalledTimes(1);
+    // A runner that rejects after the deadline remains handled by Promise.race.
+    rejectRun!(new Error("late rejection"));
+    await Promise.resolve();
+  });
+
+  test("a thrown runner error wakes", async () => {
+    expect(
+      await probeScriptRunner("lead", async () => {
+        throw new Error("ECONNRESET");
+      }),
+    ).toEqual({
+      quiet: false,
+      reason: "script-runner-unhealthy: ECONNRESET",
+    });
+  });
+
+  for (const [label, failure, reason] of [
+    ["nonzero exit", { exitCode: 1 }, "script exited with code 1"],
+    ["runner error", { error: "killed" }, "killed"],
+    ["runtime error", { runtimeError: { message: "runtime failed" } }, "runtime failed"],
+  ] as const) {
+    test(`${label} wakes`, async () => {
+      const result = await probeScriptRunner(
+        "lead",
+        async () => ({ ...ok, ...failure }) as RunScriptOutput,
+      );
+      expect(result).toEqual({ quiet: false, reason: `script-runner-unhealthy: ${reason}` });
+    });
+  }
+});

package/src/tests/oauth-refresh-sweep.test.ts

@@ -8,7 +8,11 @@ import {
   storeOAuthTokens,
   upsertOAuthApp,
 } from "../be/db-queries/oauth";
-import { sweepOAuthTokenRefresh } from "../be/oauth-refresh-sweep";
+import {
+  startOAuthRefreshSweep,
+  stopOAuthRefreshSweep,
+  sweepOAuthTokenRefresh,
+} from "../be/oauth-refresh-sweep";
 
 async function authorizationStatus(provider: string): Promise<string | undefined> {
   const id = await getDefaultAuthorizationIdForProvider(provider);
@@ -242,3 +246,32 @@ describe("sweepOAuthTokenRefresh", () => {
     expect((await getOAuthTokens("vendor_a"))?.accessToken).toBe("example-new-access-token");
   });
 });
+
+describe("startOAuthRefreshSweep", () => {
+  const originalDisable = process.env.OAUTH_REFRESH_SWEEP_DISABLE;
+
+  afterAll(async () => {
+    await stopOAuthRefreshSweep();
+    if (originalDisable === undefined) {
+      delete process.env.OAUTH_REFRESH_SWEEP_DISABLE;
+    } else {
+      process.env.OAUTH_REFRESH_SWEEP_DISABLE = originalDisable;
+    }
+  });
+
+  for (const val of ["true", "1", "TRUE"]) {
+    test(`does not start when OAUTH_REFRESH_SWEEP_DISABLE=${val}`, async () => {
+      process.env.OAUTH_REFRESH_SWEEP_DISABLE = val;
+      const logs: string[] = [];
+      const origLog = console.log;
+      console.log = (...args: unknown[]) => logs.push(args.map(String).join(" "));
+      try {
+        startOAuthRefreshSweep();
+      } finally {
+        console.log = origLog;
+        await stopOAuthRefreshSweep();
+      }
+      expect(logs).toEqual(["[oauth-refresh-sweep] Disabled via OAUTH_REFRESH_SWEEP_DISABLE"]);
+    });
+  }
+});

package/src/tests/onboard-compose.test.ts

@@ -136,6 +136,26 @@ describe("generateCompose", () => {
     expect(yaml).not.toContain("pull_policy: always");
   });
 
+  test.each([
+    "docker",
+    "podman",
+  ] as const)("%s agent services mount volumes where the worker reads and writes", (containerEngine) => {
+    const doc = Bun.YAML.parse(generateCompose({ ...devState, containerEngine })) as {
+      services: Record<string, { volumes?: string[] }>;
+    };
+    const agents = Object.entries(doc.services).filter(([name]) => name !== "swarm-api");
+
+    expect(agents.map(([name]) => name)).toEqual(["lead", "worker-coder-1", "worker-coder-2"]);
+    for (const [name, service] of agents) {
+      expect(service.volumes).toEqual([
+        "swarm_logs:/logs",
+        "swarm_shared:/workspace/shared",
+        `swarm_${name.replaceAll("-", "_")}:/workspace/personal`,
+      ]);
+    }
+    expect(doc.services["swarm-api"]?.volumes).toEqual(["swarm_data:/app/data"]);
+  });
+
   test("dev preset produces 3 agent services + 1 API service", () => {
     const yaml = generateCompose(devState);
     // Only count service definitions in the services section (before volumes:)

package/src/tests/opencode-adapter.test.ts

@@ -675,7 +675,7 @@ describe("OpencodeSession — persisted rows render in the dashboard", () => {
     const { items } = normalizeSessionLogs(rows);
 
     const visible = items
-      .filter((item) => item.kind !== "lifecycle")
+      .filter((item) => item.kind !== "lifecycle" && item.kind !== "call_usage")
       .map((item) =>
         item.kind === "text"
           ? `${item.role} text: ${item.text}`
@@ -695,6 +695,7 @@ describe("OpencodeSession — persisted rows render in the dashboard", () => {
       "system text: opencode error: provider overloaded",
     ]);
     expect(items.some((item) => item.kind === "unknown")).toBe(false);
+    expect(items.filter((item) => item.kind === "call_usage")).toHaveLength(1);
   });
 });
 

package/src/tests/pages-frame-ancestors.test.ts

@@ -0,0 +1,162 @@
+/**
+ * `PAGES_FRAME_ANCESTORS` widens `frame-ancestors` on `/p/:id` for PUBLIC
+ * pages only, so an outside site (for example a blog) can iframe a chart.
+ * Authed and password pages keep the app-origin-only header, and an unset
+ * env leaves every header unchanged.
+ */
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import crypto from "node:crypto";
+import { unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, initDb } from "../be/db";
+import { handlePages } from "../http/pages";
+import { getPageFrameAncestors, handlePagesPublic } from "../http/pages-public";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { signPageSession } from "../utils/page-session";
+import { listenOnFreePort } from "./test-net";
+
+const TEST_DB_PATH = "./test-pages-frame-ancestors.sqlite";
+const EMBEDDERS = "https://www.agent-swarm.dev https://agent-swarm.dev";
+let BASE = "";
+
+function createTestServer(): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    if (await handlePagesPublic(req, res, pathSegments, queryParams)) return;
+    if (await handlePages(req, res, pathSegments, queryParams, myAgentId)) return;
+    res.writeHead(404);
+    res.end("not found");
+  });
+}
+
+function frameAncestors(res: Response): string {
+  const csp = res.headers.get("content-security-policy") ?? "";
+  return csp.split(";").find((d) => d.trim().startsWith("frame-ancestors ")) ?? "";
+}
+
+describe("PAGES_FRAME_ANCESTORS on /p/:id", () => {
+  let server: Server;
+  const agentId = crypto.randomUUID();
+  const headers = { "Content-Type": "application/json", "X-Agent-ID": agentId };
+  const ORIG = {
+    PAGES_FRAME_ANCESTORS: process.env.PAGES_FRAME_ANCESTORS,
+    APP_URL: process.env.APP_URL,
+    DASHBOARD_URL: process.env.DASHBOARD_URL,
+    PAGE_SESSION_SECRET: process.env.PAGE_SESSION_SECRET,
+  };
+
+  function restore(key: keyof typeof ORIG): void {
+    if (ORIG[key] === undefined) delete process.env[key];
+    else process.env[key] = ORIG[key];
+  }
+
+  async function createPage(
+    slug: string,
+    authMode: "public" | "authed" | "password",
+  ): Promise<string> {
+    const post = await fetch(`${BASE}/api/pages`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        slug,
+        title: slug,
+        contentType: "text/html",
+        authMode,
+        ...(authMode === "password" ? { password: "swordfish" } : {}),
+        body: "<!doctype html><html><head></head><body><h1>chart</h1></body></html>",
+      }),
+    });
+    expect(post.status).toBe(201);
+    const { id } = (await post.json()) as { id: string };
+    return id;
+  }
+
+  beforeAll(async () => {
+    process.env.PAGE_SESSION_SECRET = "example-test-frame-ancestors-secret";
+    process.env.APP_URL = "https://app.example.test";
+    delete process.env.DASHBOARD_URL;
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+    initDb(TEST_DB_PATH);
+    server = createTestServer();
+    const port = await listenOnFreePort(server);
+    BASE = `http://localhost:${port}`;
+  });
+
+  afterEach(() => restore("PAGES_FRAME_ANCESTORS"));
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    closeDb();
+    for (const key of Object.keys(ORIG) as (keyof typeof ORIG)[]) restore(key);
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+  });
+
+  test("public page gets the configured origins", async () => {
+    process.env.PAGES_FRAME_ANCESTORS = EMBEDDERS;
+    const id = await createPage("public-embed", "public");
+    const res = await fetch(`${BASE}/p/${id}`);
+    expect(res.status).toBe(200);
+    const fa = frameAncestors(res);
+    expect(fa).toContain("'self'");
+    expect(fa).toContain("https://app.example.test");
+    expect(fa).toContain("https://www.agent-swarm.dev");
+    expect(fa).toContain("https://agent-swarm.dev");
+  });
+
+  test("authed page keeps the app-origin-only header", async () => {
+    const id = await createPage("authed-embed", "authed");
+    const exp = Math.floor(Date.now() / 1000) + 3600;
+    const cookie = `page_session_${id}=${await signPageSession({ pageId: id, exp })}`;
+
+    const before = frameAncestors(await fetch(`${BASE}/p/${id}`, { headers: { cookie } }));
+    process.env.PAGES_FRAME_ANCESTORS = EMBEDDERS;
+    const res = await fetch(`${BASE}/p/${id}`, { headers: { cookie } });
+    expect(res.status).toBe(200);
+    expect(frameAncestors(res)).toBe(before);
+    expect(frameAncestors(res)).not.toContain("agent-swarm.dev");
+  });
+
+  test("password page keeps the app-origin-only header", async () => {
+    process.env.PAGES_FRAME_ANCESTORS = EMBEDDERS;
+    const id = await createPage("password-embed", "password");
+    const res = await fetch(`${BASE}/p/${id}?key=swordfish`);
+    expect(res.status).toBe(200);
+    expect(frameAncestors(res)).not.toContain("agent-swarm.dev");
+  });
+
+  test("unset env leaves the public header unchanged", async () => {
+    const id = await createPage("public-unset", "public");
+    delete process.env.PAGES_FRAME_ANCESTORS;
+    const unset = frameAncestors(await fetch(`${BASE}/p/${id}`));
+    process.env.PAGES_FRAME_ANCESTORS = "";
+    const blank = frameAncestors(await fetch(`${BASE}/p/${id}`));
+    expect(unset).toContain("https://app.example.test");
+    expect(unset).not.toContain("agent-swarm.dev");
+    expect(blank).toBe(unset);
+  });
+
+  test("parser accepts comma or space lists and drops invalid entries", () => {
+    process.env.PAGES_FRAME_ANCESTORS =
+      "https://www.agent-swarm.dev/, https://*.example.com:8443 blog.example.org,* 'none' https://evil.test;script-src javascript:alert(1) https://x.test/path";
+    expect(getPageFrameAncestors()).toEqual([
+      "https://www.agent-swarm.dev",
+      "https://*.example.com:8443",
+      "blog.example.org",
+    ]);
+  });
+});

package/src/tests/pi-codemode.test.ts

@@ -104,7 +104,8 @@ describe("PiMonoAdapter.createSession — codemode", () => {
     process.env.OPENROUTER_BASE_URL = "http://127.0.0.1:9/api/v1";
     delete process.env.PI_CODEMODE;
     delete process.env.PI_CODEMODE_MODELS;
-    delete process.env.PI_TOOL_DEFERRAL;
+    // Deferral off, so every swarm tool shows up as an active tool name.
+    process.env.PI_TOOL_DEFERRAL = "false";
   });
   afterEach(() => {
     for (const key of envKeys) {