@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/tests/api-key-status-by-suffix.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Key status is matched by key suffix when the caller sends its pool
+ * (`GET /api/keys/available?keySuffixes=`), so two agent-scoped pools with
+ * different keys at the same index do not bench each other (issue #2425).
+ */
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { createServer as createHttpServer, type Server } from "node:http";
+import {
+  closeDb,
+  getAvailableKeyIndices,
+  initDb,
+  markKeyRateLimited,
+  recordKeyRateLimitWindows,
+} from "../be/db";
+import { recordKeyValidation } from "../be/db/api-keys";
+import { handleApiKeys } from "../http/api-keys";
+import { resolveCredentialPools } from "../utils/credentials";
+import { listenOnFreePort } from "./test-net";
+
+const TEST_DB = `./test-api-key-status-by-suffix-${Date.now()}.sqlite`;
+const FUTURE = () => new Date(Date.now() + 3_600_000).toISOString();
+
+// Agent A and agent B each pool two keys; index 1 differs between them.
+const POOL_A = ["example-key-shared", "example-key-aaaa1"];
+const POOL_B = ["example-key-shared", "example-key-bbbb2"];
+const suffixes = (pool: string[]) => pool.map((key) => key.slice(-5));
+
+describe("key status by suffix", () => {
+  let server: Server;
+  let baseUrl = "";
+
+  const getAvailable = async (query: string) => {
+    const res = await fetch(`${baseUrl}/api/keys/available?${query}`);
+    return { status: res.status, body: (await res.json()) as Record<string, unknown> };
+  };
+
+  beforeAll(async () => {
+    process.env.DB_PATH = TEST_DB;
+    initDb(TEST_DB);
+    server = createHttpServer(async (req, res) => {
+      const url = new URL(req.url || "/", "http://localhost");
+      const pathSegments = url.pathname.split("/").filter(Boolean);
+      const handled = await handleApiKeys(req, res, pathSegments, url.searchParams);
+      if (!handled) {
+        res.writeHead(404);
+        res.end();
+      }
+    });
+    const port = await listenOnFreePort(server);
+    baseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    closeDb();
+    await unlink(TEST_DB).catch(() => {});
+    await unlink(`${TEST_DB}-wal`).catch(() => {});
+    await unlink(`${TEST_DB}-shm`).catch(() => {});
+  });
+
+  test("a rate limit on agent A's key at index 1 does not bench agent B's key at index 1", async () => {
+    // Workers report at global scope, by suffix and index.
+    await markKeyRateLimited("OPENAI_API_KEY", "aaaa1", 1, FUTURE());
+
+    const a = await getAvailableKeyIndices("OPENAI_API_KEY", 2, "global", null, undefined, [
+      ...suffixes(POOL_A),
+    ]);
+    const b = await getAvailableKeyIndices("OPENAI_API_KEY", 2, "global", null, undefined, [
+      ...suffixes(POOL_B),
+    ]);
+    expect(a.availableIndices).toEqual([0]);
+    expect(b.availableIndices).toEqual([0, 1]);
+
+    // Control: the index read (no suffixes) still benches index 1 for everyone.
+    const legacy = await getAvailableKeyIndices("OPENAI_API_KEY", 2);
+    expect(legacy.availableIndices).toEqual([0]);
+  });
+
+  test("a rejection on agent A's key does not bench agent B's key at the same index", async () => {
+    await recordKeyValidation(
+      "GEMINI_API_KEY",
+      [{ keyIndex: 1, keySuffix: "aaaa1", ok: false, httpStatus: 401 }],
+      "global",
+      null,
+      { retireAbsent: false },
+    );
+
+    const a = await getAvailable(
+      `keyType=GEMINI_API_KEY&totalKeys=2&keySuffixes=${suffixes(POOL_A).join(",")}`,
+    );
+    const b = await getAvailable(
+      `keyType=GEMINI_API_KEY&totalKeys=2&keySuffixes=${suffixes(POOL_B).join(",")}`,
+    );
+    expect(a.body).toMatchObject({ availableIndices: [0], rejectedIndices: [1] });
+    expect(b.body).toMatchObject({ availableIndices: [0, 1], rejectedIndices: [] });
+  });
+
+  test("one key in two scopes has one state, at each pool's own position", async () => {
+    // The shared key sits at index 0 for A and B, and at index 2 in a third pool.
+    await markKeyRateLimited("ANTHROPIC_API_KEY", "hared", 0, FUTURE());
+    // A row of the same key in an agent scope (for example a dashboard check) also counts.
+    await recordKeyValidation(
+      "ANTHROPIC_API_KEY",
+      [{ keyIndex: 0, keySuffix: "hared", ok: false, httpStatus: 401 }],
+      "agent",
+      "agent-b",
+      { retireAbsent: false },
+    );
+
+    const b = await getAvailableKeyIndices("ANTHROPIC_API_KEY", 2, "global", null, undefined, [
+      ...suffixes(POOL_B),
+    ]);
+    expect(b.availableIndices).toEqual([1]);
+    expect(b.rejectedIndices).toEqual([0]);
+
+    const reordered = ["example-key-ccccc", "example-key-ddddd", "example-key-shared"];
+    const c = await getAvailableKeyIndices("ANTHROPIC_API_KEY", 3, "global", null, undefined, [
+      ...suffixes(reordered),
+    ]);
+    expect(c.availableIndices).toEqual([0, 1]);
+    expect(c.rejectedIndices).toEqual([2]);
+  });
+
+  test("model window blocks map to the caller's positions", async () => {
+    const resetsAt = Math.floor(Date.now() / 1000) + 3600;
+    await recordKeyRateLimitWindows("CLAUDE_CODE_OAUTH_TOKEN", "aaaa1", 1, {
+      seven_day_opus: { status: "rejected", resetsAt, lastSeenAt: new Date().toISOString() },
+    });
+
+    const a = await getAvailableKeyIndices(
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      2,
+      "global",
+      null,
+      "opus",
+      suffixes(POOL_A),
+    );
+    const b = await getAvailableKeyIndices(
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      2,
+      "global",
+      null,
+      "opus",
+      suffixes(POOL_B),
+    );
+    expect(a.availableIndices).toEqual([0]);
+    expect(a.modelBlockedIndices).toEqual([1]);
+    expect(b.availableIndices).toEqual([0, 1]);
+    expect(b.modelBlockedIndices).toEqual([]);
+  });
+
+  test("two pool keys with the same suffix keep the index read: one bench does not bench both", async () => {
+    // a-same1 and b-same1 share one status row; a rate limit at index 0 must leave index 1.
+    await markKeyRateLimited("MISTRAL_API_KEY", "same1", 0, FUTURE());
+
+    const res = await getAvailable("keyType=MISTRAL_API_KEY&totalKeys=2&keySuffixes=same1,same1");
+    expect(res.body).toMatchObject({ availableIndices: [1] });
+    // Control: the index read gives the same answer.
+    const legacy = await getAvailableKeyIndices("MISTRAL_API_KEY", 2);
+    expect(legacy.availableIndices).toEqual([1]);
+  });
+
+  test("validation success and a rate-limit clear at global scope reach the key's agent-scoped rows", async () => {
+    const post = (path: string, body: unknown) =>
+      fetch(`${baseUrl}/api/keys/${path}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+    const available = () =>
+      getAvailable(
+        `keyType=DEEPSEEK_API_KEY&totalKeys=2&keySuffixes=${suffixes(POOL_A).join(",")}`,
+      );
+
+    // 401 for aaaa1 at agent scope, then OK at global scope.
+    const keys = (ok: boolean) => [
+      { keyIndex: 1, keySuffix: "aaaa1", ok, ...(ok ? {} : { httpStatus: 401 }) },
+    ];
+    expect(
+      (
+        await post("report-validation", {
+          keyType: "DEEPSEEK_API_KEY",
+          keys: keys(false),
+          scope: "agent",
+          scopeId: "agent-a",
+        })
+      ).status,
+    ).toBe(200);
+    expect((await available()).body).toMatchObject({ rejectedIndices: [1] });
+    expect(
+      (await post("report-validation", { keyType: "DEEPSEEK_API_KEY", keys: keys(true) })).status,
+    ).toBe(200);
+    expect((await available()).body).toMatchObject({
+      availableIndices: [0, 1],
+      rejectedIndices: [],
+    });
+
+    // A rate limit on the agent-scoped row, cleared by the worker's global-scope recheck.
+    await markKeyRateLimited("DEEPSEEK_API_KEY", "aaaa1", 1, FUTURE(), "agent", "agent-a");
+    expect((await available()).body).toMatchObject({ availableIndices: [0] });
+    const clear = await post("clear-rate-limit", {
+      keyType: "DEEPSEEK_API_KEY",
+      keySuffix: "aaaa1",
+    });
+    expect(((await clear.json()) as { cleared: boolean }).cleared).toBe(true);
+    expect((await available()).body).toMatchObject({ availableIndices: [0, 1] });
+  });
+
+  test("the route rejects a suffix list that does not match totalKeys", async () => {
+    const res = await getAvailable("keyType=OPENAI_API_KEY&totalKeys=3&keySuffixes=hared,aaaa1");
+    expect(res.status).toBe(400);
+  });
+
+  test("worker key selection skips its own benched key and keeps the other pool's", async () => {
+    await markKeyRateLimited("OPENROUTER_API_KEY", "aaaa1", 1, FUTURE());
+    await markKeyRateLimited("OPENROUTER_API_KEY", "hared", 0, FUTURE());
+
+    for (let i = 0; i < 10; i++) {
+      const envA: Record<string, string | undefined> = { OPENROUTER_API_KEY: POOL_A.join(",") };
+      const [selA] = await resolveCredentialPools(envA, {
+        apiUrl: baseUrl,
+        apiKey: "test",
+        provider: "opencode",
+        model: "google/gemini-3-flash-preview",
+      });
+      // Both of A's keys are benched: best-effort fallback.
+      expect(selA!.isRateLimitFallback).toBe(true);
+
+      const envB: Record<string, string | undefined> = { OPENROUTER_API_KEY: POOL_B.join(",") };
+      const [selB] = await resolveCredentialPools(envB, {
+        apiUrl: baseUrl,
+        apiKey: "test",
+        provider: "opencode",
+        model: "google/gemini-3-flash-preview",
+      });
+      expect(selB!.isRateLimitFallback).toBe(false);
+      expect(selB!.index).toBe(1);
+      expect(envB.OPENROUTER_API_KEY).toBe("example-key-bbbb2");
+    }
+  });
+});

package/src/tests/base-prompt.test.ts

@@ -34,6 +34,10 @@ const ENV_KEYS = [
   "SLACK_SIGNING_SECRET",
   "STEERING_ENABLED",
   "AGENT_FS_API_URL",
+  "AGENT_FS_LINK_TARGET",
+  "AGENT_FS_LIVE_URL",
+  "APP_URL",
+  "DASHBOARD_URL",
   "SCRIPTS_ONLY_MCP",
 ] as const;
 
@@ -495,6 +499,47 @@ describe("getBasePrompt: outputs section", () => {
     expect(result).not.toContain(NO_AGENT_FS_LINE);
   });
 
+  test("AGENT_FS_LINK_TARGET=dashboard with APP_URL links people to <APP_URL>/file/~/", async () => {
+    process.env.AGENT_FS_API_URL = "http://localhost:8787";
+    process.env.AGENT_FS_LINK_TARGET = "dashboard";
+    process.env.APP_URL = "http://localhost:5274/";
+    const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
+    expect(result).toContain(
+      "Give people the live app link `http://localhost:5274/file/~/<org>/<drive>/<path>`.",
+    );
+    expect(result).not.toContain("AGENT_FS_LIVE_URL}/file/~/");
+  });
+
+  test("AGENT_FS_LINK_TARGET=dashboard without APP_URL falls back to the live base", async () => {
+    process.env.AGENT_FS_API_URL = "http://localhost:8787";
+    process.env.AGENT_FS_LINK_TARGET = "dashboard";
+    process.env.AGENT_FS_LIVE_URL = "https://live.example.test/";
+    const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
+    expect(result).toContain(
+      "Give people the live app link `https://live.example.test/file/~/<org>/<drive>/<path>`.",
+    );
+  });
+
+  test("AGENT_FS_LINK_TARGET=live uses the default live host", async () => {
+    process.env.AGENT_FS_API_URL = "http://localhost:8787";
+    process.env.AGENT_FS_LINK_TARGET = "live";
+    process.env.APP_URL = "http://localhost:5274";
+    const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
+    expect(result).toContain(
+      "Give people the live app link `https://live.agent-fs.dev/file/~/<org>/<drive>/<path>`.",
+    );
+  });
+
+  test("an invalid AGENT_FS_LINK_TARGET keeps the exact old sentence", async () => {
+    process.env.AGENT_FS_API_URL = "http://localhost:8787";
+    process.env.AGENT_FS_LINK_TARGET = "Dashboard2";
+    process.env.APP_URL = "http://localhost:5274";
+    const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
+    expect(result).toContain(
+      `Give people the live app link \`\${AGENT_FS_LIVE_URL}/file/~/<org>/<drive>/<path>\`. Make an \`agent-fs share-create\` link only when the requester asks for one or the reader has no agent-fs login.`,
+    );
+  });
+
   test("uses the no_agent_fs variant when AGENT_FS_API_URL is unset", async () => {
     const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
     expect(result).toContain("## Outputs");
@@ -787,12 +832,78 @@ describe("getBasePrompt: tools and skills section", () => {
     );
   });
 
+  test("pi with deferral points installed MCP servers at tool search", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      provider: "pi",
+      traits: { ...localTraits, hasToolSearch: true },
+      mcpServers: ["linear"],
+    });
+    expect(result).toContain(
+      "Connected MCP servers: linear. Load their tools with your harness tool search.",
+    );
+    expect(result).not.toContain("Their tools are in your tool list.");
+  });
+
+  test("pi without deferral keeps installed MCP servers in the tool list", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      provider: "pi",
+      traits: { ...localTraits, hasToolSearch: false },
+      mcpServers: ["linear"],
+    });
+    expect(result).toContain("Connected MCP servers: linear. Their tools are in your tool list.");
+  });
+
   test("omits the MCP server line for an empty list", async () => {
     const result = await getBasePrompt({ ...minimalArgs, mcpServers: [] });
     expect(result).not.toContain("Connected MCP servers");
   });
 });
 
+describe("getBasePrompt: lead docs pointer", () => {
+  const DOCS_LINE =
+    "Load the `swarm-docs` skill only when a person asks for something no skill, workflow, schedule or memory of yours covers, or asks where something is documented. Then follow its offer rules.";
+  const withDocs = [
+    { name: "commit", description: "Create a commit" },
+    { name: "swarm-docs", description: "docs index" },
+  ];
+
+  test("renders for a lead that has the swarm-docs skill", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      role: "lead",
+      traits: localTraits,
+      skillsSummary: withDocs,
+    });
+    expect(result).toContain(DOCS_LINE);
+  });
+
+  test("drops the line when swarm-docs is disabled for the lead", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      role: "lead",
+      traits: localTraits,
+      skillsSummary: [{ name: "commit", description: "Create a commit" }],
+    });
+    expect(result).not.toContain(DOCS_LINE);
+  });
+
+  test("renders when the skill list is unknown (claude-managed)", async () => {
+    const result = await getBasePrompt({ ...minimalArgs, role: "lead", traits: managedTraits });
+    expect(result).toContain(DOCS_LINE);
+  });
+
+  test("never renders for a worker", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      traits: localTraits,
+      skillsSummary: withDocs,
+    });
+    expect(result).not.toContain(DOCS_LINE);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // 10. Repository
 // ---------------------------------------------------------------------------
@@ -1015,14 +1126,16 @@ describe("getBasePrompt: size budget", () => {
     expect(result.length).toBeLessThan(5_750);
   });
 
-  test("a fresh claude lead stays under 5,900 characters", async () => {
+  // The lead ceiling includes the swarm-docs pointer (~190 chars), which renders
+  // while the skill list is still unknown.
+  test("a fresh claude lead stays under 6,100 characters", async () => {
     const result = await getBasePrompt({
       ...minimalArgs,
       role: "lead",
       name: "Cora",
       traits: localTraits,
     });
-    expect(result.length).toBeLessThan(5_900);
+    expect(result.length).toBeLessThan(6_100);
   });
 
   test("Picateclas spawn-OOM hardening: the kitchen sink stays below MAX_ARG_STRLEN", async () => {
@@ -1125,9 +1238,7 @@ describe("getBasePrompt: harness tool discovery", () => {
 
   test.each([
     "pi",
-    "codex",
     "claude-managed",
-    "opencode",
     "acp",
   ])("%s without tool search gets direct-tool guidance", async (provider) => {
     const result = await getBasePrompt({
@@ -1152,6 +1263,30 @@ describe("getBasePrompt: harness tool discovery", () => {
     expect(result).toContain('import { store_progress } from "agent-swarm"');
   });
 
+  test("codex gets exec guidance with the normalized tool name", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      provider: "codex",
+      traits: { ...localTraits, hasToolSearch: false },
+    });
+    expect(result).not.toContain(deferred);
+    expect(result).not.toContain("already in your tool list");
+    expect(result).toContain("await tools.mcp__agent_swarm__store_progress({ ... })");
+    expect(result).toContain("`ALL_TOOLS`");
+  });
+
+  test("opencode gets execute guidance with the bracketed tool path", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      provider: "opencode",
+      traits: { ...localTraits, hasToolSearch: false },
+    });
+    expect(result).not.toContain(deferred);
+    expect(result).not.toContain("already in your tool list");
+    expect(result).toContain('await tools.swarm["store-progress"]({ ... })');
+    expect(result).toContain("`search({ query })`");
+  });
+
   test("omitted tool-search capability defaults to direct tools", async () => {
     const result = await getBasePrompt({ ...minimalArgs, traits: localTraits });
     expect(result).not.toContain(deferred);

package/src/tests/codex-adapter.test.ts

@@ -34,6 +34,7 @@ import {
   resolveCodexModel,
 } from "../providers/codex-models";
 import type { ProviderEvent, ProviderResult, ProviderSessionConfig } from "../providers/types";
+import { isCodexAuthFailureReason } from "../utils/codex-auth-failure";
 import { HELD_NOTE_TEXT, holdTemplateRender } from "./fixtures/held-template-render";
 
 /**
@@ -1177,23 +1178,38 @@ describe("CodexSession event mapping", () => {
     expect(result.failureReason).toContain("[rate-limit]");
   });
 
-  test("turn.failed with auth error rewrites + sets errorCategory=authentication_failed", async () => {
+  test.each([
+    undefined,
+    0,
+    2,
+  ])("turn.failed auth error identifies pool slot %p", async (codexSlot) => {
+    const raw = "Request failed: HTTP 401 Unauthorized — Invalid API key provided.";
     const events: ThreadEvent[] = [
       { type: "thread.started", thread_id: "thread-auth" },
       { type: "turn.started" },
       {
         type: "turn.failed",
-        error: { message: "Request failed: HTTP 401 Unauthorized — Invalid API key provided." },
+        error: { message: raw },
       },
     ];
 
     const { emitted, result } = await runSessionWithFakeThread(
       events,
-      testConfig({ logFile: join(tmpLogDir, "auth.log"), cwd: "" }),
+      testConfig({
+        logFile: join(tmpLogDir, "auth.log"),
+        cwd: "",
+        codexSlot,
+        apiUrl: "",
+        apiKey: "",
+      }),
     );
 
+    const expected =
+      codexSlot === undefined
+        ? `[auth-error] Codex authentication failed — check OPENAI_API_KEY or ChatGPT login. Original error: ${raw}`
+        : `[auth-error] Codex pool slot ${codexSlot} authentication failed — re-run agent-swarm codex-login --slot ${codexSlot}. Original error: ${raw}`;
     const errorEvent = emitted.find((e) => e.type === "error");
-    expect(errorEvent?.type === "error" && errorEvent.message).toContain("[auth-error]");
+    expect(errorEvent?.type === "error" && errorEvent.message).toBe(expected);
 
     const resultEvent = emitted.findLast((e) => e.type === "result");
     expect(resultEvent?.type === "result" && resultEvent.errorCategory).toBe(
@@ -1201,7 +1217,8 @@ describe("CodexSession event mapping", () => {
     );
 
     expect(result.isError).toBe(true);
-    expect(result.failureReason).toContain("[auth-error]");
+    expect(result.failureReason).toBe(expected);
+    expect(isCodexAuthFailureReason(result.failureReason)).toBe(true);
   });
 
   test("abort() resolves the session with cancelled result", async () => {
@@ -2517,7 +2534,9 @@ describe("CodexSession — rate-limit error preservation", () => {
     expect(resetMs).toBeGreaterThan(Date.now());
   });
 
-  test("revoked-while-valid OAuth pool failure ('Failed to refresh token') classifies as [auth-error]/authentication_failed", async () => {
+  test.each([
+    0, 2,
+  ])("revoked-while-valid OAuth failure identifies pool slot %i after transport exit", async (codexSlot) => {
     // A credential revoked server-side while its access token is still
     // unexpired never enters getValidCodexOAuth (the token looks fresh, it
     // fast-returns) — the spawned Codex CLI self-refreshes straight from the
@@ -2534,13 +2553,32 @@ describe("CodexSession — rate-limit error preservation", () => {
     ];
     const sdkThrow = new Error("Codex Exec exited with code 1: Reading prompt from stdin");
 
-    const { result } = await runSessionWithThrowingThread(
+    const { emitted, result } = await runSessionWithThrowingThread(
       events,
       sdkThrow,
-      testConfig({ logFile: join(tmpLogDir, "authfail-preserve.log"), cwd: "" }),
+      testConfig({
+        logFile: join(tmpLogDir, "authfail-preserve.log"),
+        cwd: "",
+        codexSlot,
+        apiUrl: "",
+        apiKey: "",
+      }),
     );
 
     expect(result.failureReason).toMatch(/\[auth-error\]/);
+    expect(result.failureReason).toContain(`pool slot ${codexSlot}`);
+    expect(result.failureReason).toContain(`agent-swarm codex-login --slot ${codexSlot}`);
+    expect(result.failureReason).toContain(refreshFailMsg);
+    expect(isCodexAuthFailureReason(result.failureReason)).toBe(true);
+    const errorEvents = emitted.filter((e) => e.type === "error");
+    expect(errorEvents.length).toBeGreaterThan(0);
+    for (const event of errorEvents) {
+      expect(event.message).toBe(result.failureReason);
+    }
+    const resultEvent = emitted.findLast((e) => e.type === "result");
+    expect(resultEvent?.type === "result" && resultEvent.errorCategory).toBe(
+      "authentication_failed",
+    );
     expect(result.isError).toBe(true);
   });
 

package/src/tests/codex-oauth-device.test.ts

@@ -1,7 +1,14 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { createServer, type Server } from "node:http";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../be/crypto";
-import { closeDb, getDbClient, getSwarmConfigs, initDb, upsertSwarmConfig } from "../be/db";
+import {
+  closeDb,
+  getDbClient,
+  getKeyStatuses,
+  getSwarmConfigs,
+  initDb,
+  upsertSwarmConfig,
+} from "../be/db";
 import { getCodexDeviceFlow, upsertCodexDeviceFlow } from "../be/db/codex-oauth-device-flows";
 import type { OnboardingState } from "../be/onboarding";
 import { handleCodexOAuthDevice } from "../http/codex-oauth-device";
@@ -92,6 +99,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await getDbClient().run("DELETE FROM codex_oauth_device_flows");
   await getDbClient().run("DELETE FROM swarm_config");
+  await getDbClient().run("DELETE FROM api_key_status");
   fetchImpl = async () => {
     throw new Error("Unexpected fetch");
   };
@@ -231,6 +239,9 @@ describe("Codex device HTTP routes", () => {
     const onboarding = await getSwarmConfigs({ scope: "global", key: "onboarding_state" });
     const state = JSON.parse(onboarding[0]!.value) as OnboardingState;
     expect(state.steps.ai).toMatchObject({ status: "done", method: "codex_device" });
+    // The sign-in itself checks the account: the account list says "Signed in".
+    const statuses = await getKeyStatuses("CODEX_OAUTH", "global", null);
+    expect(statuses.map((s) => [s.keySuffix, s.keyIndex])).toEqual([["-full", 1]]);
   });
 
   test("throttles upstream polling to the requested interval", async () => {

package/src/tests/comb-config-guard.test.ts

@@ -11,6 +11,15 @@ describe("Comb config keys", () => {
     }
   });
 
+  test("AGENT_FS_PROXY accepts boolean literals only", () => {
+    for (const value of ["true", "false", "1", "0", " TRUE "]) {
+      expect(validateConfigValue("AGENT_FS_PROXY", value)).toBeNull();
+    }
+    for (const value of ["yes", "on", ""]) {
+      expect(validateConfigValue("AGENT_FS_PROXY", value)).toContain("Invalid AGENT_FS_PROXY");
+    }
+  });
+
   test("AGENT_FS_PUBLIC_URL accepts blank or an http(s) base URL", () => {
     for (const value of ["", "http://localhost:7433", "https://agent-fs.example.com/base"]) {
       expect(validateConfigValue("AGENT_FS_PUBLIC_URL", value)).toBeNull();
@@ -28,6 +37,17 @@ describe("Comb config keys", () => {
     }
   });
 
+  test("AGENT_FS_LINK_TARGET accepts dashboard, live, or blank", () => {
+    for (const value of ["dashboard", "live", "", " live "]) {
+      expect(validateConfigValue("AGENT_FS_LINK_TARGET", value)).toBeNull();
+    }
+    for (const value of ["Dashboard2", "comb", true]) {
+      expect(validateConfigValue("AGENT_FS_LINK_TARGET", value)).toContain(
+        "Invalid AGENT_FS_LINK_TARGET",
+      );
+    }
+  });
+
   test("OPENROUTER_BASE_URL keeps its rules after sharing the URL validator", () => {
     expect(validateConfigValue("OPENROUTER_BASE_URL", "")).toBeNull();
     expect(validateConfigValue("OPENROUTER_BASE_URL", "https://api.example.com/v1")).toBeNull();