@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/tests/request-composition-derive.test.ts

@@ -0,0 +1,329 @@
+import { describe, expect, test } from "bun:test";
+import {
+  type CompositionCall,
+  type CompositionManifest,
+  compositionCallsOf,
+  deriveCallCompositions,
+  staticTokens,
+} from "../../apps/ui/src/lib/request-composition";
+import type { CallUsage, NormalizedItem } from "../../apps/ui/src/logs-parser/types";
+
+const T0 = Date.parse("2026-10-26T10:00:00.000Z");
+
+function manifest(overrides: Partial<CompositionManifest> = {}): CompositionManifest {
+  return {
+    id: "m-0",
+    taskId: "task-1",
+    agentId: "agent-1",
+    sessionId: "s-1",
+    seq: 0,
+    provider: "claude",
+    model: null,
+    source: "worker",
+    parts: [
+      {
+        kind: "system_section",
+        id: "system.agent.role",
+        label: "role",
+        chars: 4000,
+        estTokens: 1000,
+        fidelity: "exact",
+      },
+      {
+        kind: "persona",
+        id: "persona",
+        label: "persona",
+        chars: 8000,
+        estTokens: 2000,
+        fidelity: "exact",
+      },
+      {
+        kind: "tool_schemas",
+        id: "mcp:agent-swarm",
+        label: "tools",
+        chars: 40000,
+        estTokens: 10000,
+        fidelity: "estimate",
+      },
+      {
+        kind: "skills_listing",
+        id: "skills_listing",
+        label: "skills",
+        chars: 4000,
+        estTokens: 1000,
+        fidelity: "estimate",
+      },
+      {
+        kind: "task_prompt",
+        id: "task_prompt",
+        label: "task",
+        chars: 2000,
+        estTokens: 500,
+        fidelity: "exact",
+      },
+      {
+        kind: "memories",
+        id: "memories",
+        label: "memories",
+        chars: 2000,
+        estTokens: 500,
+        fidelity: "exact",
+      },
+    ],
+    staticEstTokens: 15000,
+    tokenRatio: 1,
+    createdAt: new Date(T0 - 1000).toISOString(),
+    ...overrides,
+  };
+}
+
+function call(
+  callId: string,
+  promptTokens: number,
+  offsetMs: number,
+  extra: Partial<CallUsage> = {},
+  sessionId = "s-1",
+): CompositionCall {
+  return {
+    sessionId,
+    t: T0 + offsetMs,
+    usage: {
+      callId,
+      promptTokens,
+      cacheReadTokens: 0,
+      cacheWriteTokens: 0,
+      uncachedInputTokens: promptTokens,
+      outputTokens: 10,
+      sidechain: false,
+      harness: "claude",
+      reportedAt: "start",
+      ...extra,
+    },
+  };
+}
+
+function sum(tokens: { tokens: number }[]): number {
+  return tokens.reduce((acc, s) => acc + s.tokens, 0);
+}
+
+function tokensOf(segments: { group: string; tokens: number }[], group: string): number {
+  return segments.find((s) => s.group === group)?.tokens ?? 0;
+}
+
+describe("deriveCallCompositions", () => {
+  test("segments sum to each call's prompt tokens", () => {
+    const { byCall } = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 52_000, 1000), call("c3", 90_000, 2000)],
+      [manifest()],
+    );
+    for (const [id, prompt] of [
+      ["c1", 40_000],
+      ["c2", 52_000],
+      ["c3", 90_000],
+    ] as const) {
+      const comp = byCall.get(id);
+      expect(comp).toBeDefined();
+      expect(sum(comp!.segments)).toBeCloseTo(prompt, 6);
+      expect(comp!.scaled).toBe(false);
+    }
+  });
+
+  test("the first main call anchors the harness base; later calls add history", () => {
+    const { byCall, anchors } = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 52_000, 1000)],
+      [manifest()],
+    );
+    const first = byCall.get("c1")!;
+    expect(tokensOf(first.segments, "harness")).toBe(25_000);
+    expect(tokensOf(first.segments, "history")).toBe(0);
+    expect(tokensOf(first.segments, "task")).toBe(1000);
+    const second = byCall.get("c2")!;
+    expect(tokensOf(second.segments, "harness")).toBe(25_000);
+    expect(tokensOf(second.segments, "history")).toBe(12_000);
+    expect(anchors.get("m-0")).toEqual({
+      callId: "c1",
+      promptTokens: 40_000,
+      residualTokens: 25_000,
+    });
+  });
+
+  test("sub-agent calls are never the anchor and get no composition", () => {
+    const { byCall, anchors } = deriveCallCompositions(
+      [call("sub", 5_000, 0, { sidechain: true }), call("c1", 40_000, 1000)],
+      [manifest()],
+    );
+    expect(byCall.has("sub")).toBe(false);
+    expect(anchors.get("m-0")?.callId).toBe("c1");
+    expect(tokensOf(byCall.get("c1")!.segments, "harness")).toBe(25_000);
+  });
+
+  test("a compaction starts a new anchor whose harness base never grows", () => {
+    const compactions = [{ sessionId: "s-1", t: T0 + 1500 }];
+    // Post-compaction prompt carries a 6k summary: it is history, not harness.
+    const grown = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 120_000, 1000), call("c3", 46_000, 2000)],
+      [manifest()],
+      compactions,
+    );
+    const post = grown.byCall.get("c3")!;
+    expect(tokensOf(post.segments, "harness")).toBe(25_000);
+    expect(tokensOf(post.segments, "history")).toBe(6_000);
+    // The rail's "first call" stays the session's first call.
+    expect(grown.anchors.get("m-0")?.callId).toBe("c1");
+
+    // The harness dropped part of its base after compacting: the base shrinks.
+    const shrunk = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c3", 30_000, 2000), call("c4", 33_000, 3000)],
+      [manifest()],
+      compactions,
+    );
+    expect(tokensOf(shrunk.byCall.get("c3")!.segments, "harness")).toBe(15_000);
+    expect(tokensOf(shrunk.byCall.get("c4")!.segments, "history")).toBe(3_000);
+    // Control: without the compaction, the base stays at the first call's.
+    const control = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c3", 30_000, 2000)],
+      [manifest()],
+    );
+    expect(tokensOf(control.byCall.get("c3")!.segments, "harness")).toBe(
+      25_000 * (30_000 / 40_000),
+    );
+  });
+
+  test("nothing goes negative when the estimates overshoot the prompt", () => {
+    const { byCall } = deriveCallCompositions(
+      [call("c1", 9_000, 0), call("c2", 7_500, 1000)],
+      [manifest()],
+    );
+    for (const id of ["c1", "c2"]) {
+      const comp = byCall.get(id)!;
+      expect(comp.scaled).toBe(true);
+      for (const seg of comp.segments) expect(seg.tokens).toBeGreaterThan(0);
+      expect(tokensOf(comp.segments, "harness")).toBe(0);
+      expect(tokensOf(comp.segments, "history")).toBe(0);
+    }
+    expect(sum(byCall.get("c1")!.segments)).toBeCloseTo(9_000, 6);
+    expect(sum(byCall.get("c2")!.segments)).toBeCloseTo(7_500, 6);
+  });
+
+  test("the token ratio scales the static parts", () => {
+    const m = manifest({ tokenRatio: 1.2 });
+    expect(staticTokens(m)).toBeCloseTo(18_000, 6);
+    const { byCall } = deriveCallCompositions([call("c1", 40_000, 0)], [m]);
+    expect(tokensOf(byCall.get("c1")!.segments, "tools")).toBeCloseTo(12_000, 6);
+    expect(tokensOf(byCall.get("c1")!.segments, "harness")).toBeCloseTo(22_000, 6);
+  });
+
+  test("each session uses its own manifest; a later seq applies from its write time", () => {
+    const s2 = manifest({ id: "m-s2", sessionId: "s-2", parts: manifest().parts.slice(0, 1) });
+    const seq1 = manifest({
+      id: "m-1",
+      seq: 1,
+      createdAt: new Date(T0 + 1500).toISOString(),
+      parts: manifest().parts.slice(0, 2),
+    });
+    const { byCall } = deriveCallCompositions(
+      [
+        call("c1", 40_000, 0),
+        call("c2", 41_000, 2000),
+        call("d1", 20_000, 0, {}, "s-2"),
+        call("x1", 20_000, 0, {}, "s-unknown"),
+      ],
+      [manifest(), seq1, s2],
+    );
+    expect(byCall.get("c1")!.manifest.id).toBe("m-0");
+    expect(byCall.get("c2")!.manifest.id).toBe("m-1");
+    expect(byCall.get("d1")!.manifest.id).toBe("m-s2");
+    expect(tokensOf(byCall.get("d1")!.segments, "harness")).toBe(19_000);
+    expect(byCall.has("x1")).toBe(false);
+    for (const comp of byCall.values())
+      expect(sum(comp.segments)).toBeCloseTo(comp.promptTokens, 6);
+  });
+
+  test("a hook manifest after the first call keeps later growth as history", () => {
+    // The worker manifest (15k static) anchors c1. The harness hook then posts
+    // exact parts worth 40k, the whole first prompt. c2's extra 12k is history.
+    const hook = manifest({
+      id: "m-hook",
+      seq: 1,
+      source: "harness-hook",
+      createdAt: new Date(T0 + 500).toISOString(),
+      parts: [{ ...manifest().parts[0]!, estTokens: 40_000, fidelity: "exact" }],
+    });
+    const { byCall, anchors } = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 52_000, 1000)],
+      [manifest(), hook],
+    );
+    const second = byCall.get("c2")!;
+    expect(second.manifest.id).toBe("m-hook");
+    expect(tokensOf(second.segments, "harness")).toBe(0);
+    expect(tokensOf(second.segments, "history")).toBe(12_000);
+    expect(sum(second.segments)).toBeCloseTo(52_000, 6);
+    expect(anchors.get("m-hook")).toEqual({
+      callId: "c1",
+      promptTokens: 40_000,
+      residualTokens: 0,
+    });
+    // After a compaction the re-split base still caps the harness base: the
+    // 6k summary is history.
+    const compacted = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 52_000, 1000), call("c3", 46_000, 2000)],
+      [manifest(), hook],
+      [{ sessionId: "s-1", t: T0 + 1500 }],
+    );
+    expect(tokensOf(compacted.byCall.get("c3")!.segments, "harness")).toBe(0);
+    expect(tokensOf(compacted.byCall.get("c3")!.segments, "history")).toBe(6_000);
+    // A hook manifest smaller than the first prompt leaves the rest as harness.
+    const partial = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 52_000, 1000)],
+      [manifest(), { ...hook, parts: [{ ...hook.parts[0]!, estTokens: 30_000 }] }],
+    );
+    expect(tokensOf(partial.byCall.get("c2")!.segments, "harness")).toBe(10_000);
+    expect(tokensOf(partial.byCall.get("c2")!.segments, "history")).toBe(12_000);
+  });
+
+  test("a later worker manifest keeps the harness base and swaps only the static parts", () => {
+    // m-0 has 15k static, so c1 (40k) measures a 25k harness base. A worker
+    // manifest then re-estimates the static parts as 16k. c2's history is
+    // 55k − 16k − 25k = 14k.
+    const part = manifest().parts[0]!;
+    const first = manifest({ parts: [{ ...part, estTokens: 15_000 }] });
+    const second = manifest({
+      id: "m-1",
+      seq: 1,
+      createdAt: new Date(T0 + 500).toISOString(),
+      parts: [{ ...part, estTokens: 16_000 }],
+    });
+    const { byCall, anchors } = deriveCallCompositions(
+      [call("c1", 40_000, 0), call("c2", 55_000, 1000)],
+      [first, second],
+    );
+    const c2 = byCall.get("c2")!;
+    expect(c2.manifest.id).toBe("m-1");
+    expect(tokensOf(c2.segments, "harness")).toBe(25_000);
+    expect(tokensOf(c2.segments, "history")).toBe(14_000);
+    expect(sum(c2.segments)).toBeCloseTo(55_000, 6);
+    expect(anchors.get("m-1")).toEqual({
+      callId: "c1",
+      promptTokens: 40_000,
+      residualTokens: 25_000,
+    });
+  });
+
+  test("no manifests means no compositions", () => {
+    expect(deriveCallCompositions([call("c1", 40_000, 0)], []).byCall.size).toBe(0);
+  });
+});
+
+describe("compositionCallsOf", () => {
+  test("keeps call_usage items whose record has a session", () => {
+    const base = { fileIndex: 0, iteration: 1, lineNumber: 1, createdAt: "", t: T0, cli: "claude" };
+    const usage = call("c1", 100, 0).usage;
+    const items: NormalizedItem[] = [
+      { ...base, recId: "r1", kind: "call_usage", usage },
+      { ...base, recId: "r2", kind: "call_usage", usage: { ...usage, callId: "c2" } },
+      { ...base, recId: "r1", kind: "text", text: "hi" },
+    ];
+    const calls = compositionCallsOf(items, (recId) => (recId === "r1" ? "s-1" : undefined));
+    expect(calls).toEqual([{ usage, sessionId: "s-1", t: T0 }]);
+  });
+});

package/src/tests/script-connections.test.ts

@@ -653,6 +653,8 @@ describe("script connections", () => {
       markMigrationApplied(database, "241_skills_meta_fts.sql");
       // 244 alters api_key_status, which this migration-112-only fixture does not create.
       markMigrationApplied(database, "244_api_key_validation.sql");
+      // 245 alters scripts, which this migration-112-only fixture does not create.
+      markMigrationApplied(database, "245_script_executor.sql");
 
       const id = crypto.randomUUID();
       const now = new Date().toISOString();

package/src/tests/script-executor-conformance.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, describe, expect, test } from "bun:test";
+import { afterAll, describe, expect, spyOn, test } from "bun:test";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -402,6 +402,41 @@ describe("native-only executor behavior", () => {
     expect(output.error).toBe("killed");
   });
 
+  // Before the fix the abort listener was added after the file writes, so an
+  // abort that landed during them was missed and the script ran to the end.
+  test.skipIf(SKIP_SANDBOX_SPAWN_TESTS)(
+    "an abort while args.json is written kills the run before the script starts",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "native-abort-"));
+      const marker = join(dir, "side-effect.marker");
+      const controller = new AbortController();
+      const write = Bun.write;
+      const spy = spyOn(Bun, "write").mockImplementation((async (
+        ...writeArgs: Parameters<typeof Bun.write>
+      ) => {
+        const written = await write(...writeArgs);
+        if (String(writeArgs[0]).endsWith("/args.json")) controller.abort();
+        return written;
+      }) as typeof Bun.write);
+      try {
+        const output = await new NativeScriptExecutor().run(
+          input({
+            source: `export default async () => { await Bun.write(${JSON.stringify(marker)}, "ran"); return "ran"; };`,
+            signal: controller.signal,
+            resources: { ...DEFAULT_SCRIPT_RESOURCES, memoryMb: 2048, wallClockMs: 10_000 },
+          }),
+        );
+        expect(output.error).toBe("killed");
+        expect(output.result).toBeUndefined();
+        expect(await Bun.file(marker).exists()).toBe(false);
+      } finally {
+        spy.mockRestore();
+        await rm(dir, { recursive: true, force: true });
+      }
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+
   // PR #1326 review finding: exit 134 (SIGABRT) was classified `capacity_exceeded`
   // — and therefore retried by `runScript` — purely from the exit code, with no
   // evidence about *when* the abort happened. A script that causes a side effect

package/src/tests/script-executor-quickjs-pool.test.ts

@@ -104,3 +104,53 @@ describe("QuickJS pool configuration", () => {
     );
   }
 });
+
+// A fresh pool spawns its first worker, so the run waits on the worker's boot
+// (`slot.ready`) when the abort lands. The server counts the script's fetch.
+const abortDuringBootProbe = `
+import { QuickJSScriptExecutor } from "./src/scripts-runtime/executors/quickjs";
+import { DEFAULT_SCRIPT_RESOURCES } from "./src/scripts-runtime/executors/types";
+let hits = 0;
+const server = Bun.serve({ port: 0, fetch() { hits++; return new Response("ran"); } });
+try {
+  const controller = new AbortController();
+  const run = new QuickJSScriptExecutor().run({
+    source: 'export default async (args) => (await fetch(args.url)).text();',
+    args: { url: "http://127.0.0.1:" + server.port },
+    configPayload: { system: {
+      apiKey: { value: "pool-test", isSecret: true },
+      agentId: { value: crypto.randomUUID(), isSecret: false },
+      mcpBaseUrl: { value: "http://127.0.0.1:" + server.port, isSecret: false },
+    }, user: {} },
+    resources: DEFAULT_SCRIPT_RESOURCES,
+    fsMode: "none", network: "open", signal: controller.signal,
+  });
+  // One macrotask: the run has its slot and awaits the worker's boot.
+  await Bun.sleep(0);
+  controller.abort();
+  const output = await run;
+  await Bun.sleep(200);
+  console.log(JSON.stringify({ error: output.error ?? null, result: output.result ?? null, hits }));
+} finally {
+  server.stop(true);
+}
+`;
+
+describe("QuickJS abort while the worker boots", () => {
+  test(
+    "an abort before the worker is ready kills the run and the script never runs",
+    async () => {
+      const result = expectChildOk(
+        await runChild([process.execPath, "--eval", abortDuringBootProbe], { env: process.env }),
+        "QuickJS abort-during-boot probe",
+      );
+      const out = JSON.parse(result.stdout.trim()) as {
+        error: string | null;
+        result: string | null;
+        hits: number;
+      };
+      expect(out).toEqual({ error: "killed", result: null, hits: 0 });
+    },
+    CHILD_PROCESS_TEST_BUDGET_MS,
+  );
+});

package/src/tests/script-executor-quickjs.test.ts

@@ -640,3 +640,143 @@ describe("quickjs egress policy", () => {
     expect(JSON.stringify(output)).not.toContain("quickjs-test-secret");
   });
 });
+
+describe("quickjs hostValidatedArgs (#2011)", () => {
+  const countedStructuralScript = `
+import { z } from "zod";
+export const argsSchema = z.object({
+  value: z.number(),
+  label: z.string().optional(),
+});
+let parseCalls = 0;
+const origParse = argsSchema.parse.bind(argsSchema);
+argsSchema.parse = ((v: unknown) => {
+  parseCalls++;
+  return origParse(v);
+}) as typeof argsSchema.parse;
+
+export default async function (args: z.infer<typeof argsSchema>) {
+  return { doubled: args.value * 2, label: args.label ?? null, parseCalls };
+}
+`;
+
+  test("skips duplicate argsSchema.parse when hostValidatedArgs is true and schema is structural", async () => {
+    const out = await executor.run(
+      input(countedStructuralScript, {
+        args: { value: 21, label: "ok" },
+        hostValidatedArgs: true,
+      }),
+    );
+    expect(out.exitCode).toBe(0);
+    expect(out.error).toBeUndefined();
+    expect(out.result).toEqual({ doubled: 42, label: "ok", parseCalls: 0 });
+  });
+
+  test("still runs argsSchema.parse when hostValidatedArgs is omitted or false", async () => {
+    const out = await executor.run(input(countedStructuralScript, { args: { value: 21 } }));
+    expect(out.exitCode).toBe(0);
+    expect(out.result).toEqual({ doubled: 42, label: null, parseCalls: 1 });
+  });
+
+  test("still runs argsSchema.parse when args contain extra keys that Zod strips", async () => {
+    const out = await executor.run(
+      input(countedStructuralScript, {
+        args: { value: 21, extra: "stripped-by-zod" },
+        hostValidatedArgs: true,
+      }),
+    );
+    expect(out.exitCode).toBe(0);
+    expect(out.result).toEqual({ doubled: 42, label: null, parseCalls: 1 });
+  });
+
+  test("still runs argsSchema.parse when schema uses defaults, transforms, or refinements", async () => {
+    const scriptWithDefaultsAndTransforms = `
+import { z } from "zod";
+export const argsSchema = z.object({
+  value: z.number().default(10),
+  tag: z.string().transform((s) => s.toUpperCase()),
+});
+let parseCalls = 0;
+const origParse = argsSchema.parse.bind(argsSchema);
+argsSchema.parse = ((v: unknown) => {
+  parseCalls++;
+  return origParse(v);
+}) as typeof argsSchema.parse;
+
+export default async function (args: z.infer<typeof argsSchema>) {
+  return { value: args.value, tag: args.tag, parseCalls };
+}
+`;
+    const out = await executor.run(
+      input(scriptWithDefaultsAndTransforms, {
+        args: { tag: "hello" },
+        hostValidatedArgs: true,
+      }),
+    );
+    expect(out.exitCode).toBe(0);
+    expect(out.result).toEqual({ value: 10, tag: "HELLO", parseCalls: 1 });
+  });
+
+  test("caller-supplied args payload cannot spoof the trusted host validation marker", async () => {
+    const out = await executor.run(
+      input(countedStructuralScript, {
+        args: {
+          value: 7,
+          hostValidatedArgs: true,
+          __swarm_host_validated_args: true,
+        },
+      }),
+    );
+    expect(out.exitCode).toBe(0);
+    expect(out.result).toEqual({ doubled: 14, label: null, parseCalls: 1 });
+  });
+
+  test("retains Zod property semantics on inherited Object.prototype keys (constructor, toString) and reverse numeric enum keys", async () => {
+    for (const propName of ["constructor", "toString"] as const) {
+      const protoScript = `
+import { z } from "zod";
+export const argsSchema = z.object({
+  ${propName}: z.string().nullable().optional(),
+});
+export default async function (args: z.infer<typeof argsSchema>) {
+  return { val: args.${propName} ?? null };
+}
+`;
+      const out = await executor.run(
+        input(protoScript, {
+          args: {},
+          hostValidatedArgs: true,
+        }),
+      );
+      expect(out.exitCode).toBe(1);
+      expect(out.stderr).toContain("argsSchema validation failed");
+    }
+
+    const numericEnumScript = `
+import { z } from "zod";
+export const argsSchema = z.object({
+  mode: z.enum({ 0: "Read", Read: 0 }).nullable(),
+});
+export default async function (args: z.infer<typeof argsSchema>) {
+  return { mode: args.mode };
+}
+`;
+    const rejected = await executor.run(
+      input(numericEnumScript, {
+        args: { mode: "Read" },
+        hostValidatedArgs: true,
+      }),
+    );
+    expect(rejected.exitCode).toBe(1);
+    expect(rejected.stderr).toContain("argsSchema validation failed");
+
+    const accepted = await executor.run(
+      input(numericEnumScript, {
+        args: { mode: 0 },
+        hostValidatedArgs: true,
+      }),
+    );
+    expect(accepted.exitCode).toBe(0);
+    expect(accepted.result).toEqual({ mode: 0 });
+  });
+});