@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/tests/self-improvement.test.ts

@@ -503,17 +503,17 @@ describe("Self-Improvement Mechanisms", () => {
     const MEMORY_SKILL_POINTER =
       "You MUST use the `memory` skill before you store, edit, or delete a memory.";
 
-    test("a worker prompt names memory-store and the memory skill", async () => {
+    test("a worker prompt points learnings at store-progress and names the memory skill", async () => {
       const prompt = await getBasePrompt({ role: "worker", agentId: workerId });
 
-      expect(prompt).toContain("`memory-store`");
+      expect(prompt).toContain("as `learning` on a `store-progress` call");
       expect(prompt).toContain(MEMORY_SKILL_POINTER);
     });
 
-    test("a lead prompt names memory-store and the memory skill", async () => {
+    test("a lead prompt points learnings at store-progress and names the memory skill", async () => {
       const prompt = await getBasePrompt({ role: "lead", agentId: leadId });
 
-      expect(prompt).toContain("`memory-store`");
+      expect(prompt).toContain("as `learning` on a `store-progress` call");
       expect(prompt).toContain(MEMORY_SKILL_POINTER);
     });
 

package/src/tests/send-task-requester-gate.test.ts

@@ -2,7 +2,8 @@
  * A task's requester drives attribution, cost reporting and admission. A non-lead agent may omit
  * `requestedByUserId` or pass the requester of its own current task. Only a lead, the operator or
  * a user may name any other registered user. Covers the send-task tool and POST /api/tasks.
- * POST /api/tasks also refuses an agent a foreign parent or a chat thread it does not own.
+ * POST /api/tasks also refuses an agent a foreign parent or a chat thread it does not own, and
+ * refuses a non-admin user a chat thread.
  */
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { unlink } from "node:fs/promises";
@@ -16,8 +17,10 @@ import {
   createUser,
   getDbClient,
   getTaskById,
+  getUserById,
   initDb,
 } from "../be/db";
+import { attachRole, detachRole } from "../be/rbac-roles";
 import { handleTasks } from "../http/tasks";
 import { chatSdkContextKey } from "../tasks/context-key";
 import { registerSendTaskTool } from "../tools/send-task";
@@ -70,7 +73,7 @@ const taskCount = async () =>
 const KEYED_REQUEST: HttpRequestAuth = { kind: "operator", fingerprint: "test-key" };
 
 async function postTask(
-  caller: { agentId?: string; sourceTaskId?: string },
+  caller: { agentId?: string; sourceTaskId?: string; userId?: string },
   body: Record<string, unknown>,
 ): Promise<{ status: number; body: { id?: string; requestedByUserId?: string } }> {
   const response = await fetch(`${routeBaseUrl}/api/tasks`, {
@@ -79,6 +82,7 @@ async function postTask(
       "Content-Type": "application/json",
       ...(caller.agentId ? { "X-Agent-ID": caller.agentId } : {}),
       ...(caller.sourceTaskId ? { "X-Source-Task-Id": caller.sourceTaskId } : {}),
+      ...(caller.userId ? { "X-Test-User-Id": caller.userId } : {}),
     },
     body: JSON.stringify({ task: "created over HTTP", ...body }),
   });
@@ -114,7 +118,10 @@ beforeAll(async () => {
   registerSendTaskTool(mcp);
 
   routeServer = createServer(async (req, res) => {
-    setRequestAuth(req, KEYED_REQUEST);
+    // A test user id header stands in for an aswt_ user token.
+    const testUserId = req.headers["x-test-user-id"] as string | undefined;
+    const user = testUserId ? await getUserById(testUserId) : null;
+    setRequestAuth(req, user ? { kind: "user", userId: user.id, user } : KEYED_REQUEST);
     const url = req.url ?? "/";
     const handled = await handleTasks(
       req,
@@ -316,3 +323,57 @@ describe("POST /api/tasks parent and chat-thread binding for an agent caller", (
     ).toBe(201);
   });
 });
+
+describe("POST /api/tasks chat-thread and context binding for a user caller", () => {
+  test("a Requester cannot bind a new task to a chat thread by contextKey", async () => {
+    const requester = await createUser({ name: "Chat Requester", email: "chat-req@example.com" });
+    // A new user starts as admin. Make this one a Requester only.
+    await attachRole(requester.id, "requester");
+    await detachRole(requester.id, "admin");
+    const before = await taskCount();
+    const result = await postTask(
+      { userId: requester.id },
+      { source: "chat", contextKey: chatSdkContextKey("telegram:556666") },
+    );
+    expect(result.status).toBe(403);
+    expect(await taskCount()).toBe(before);
+
+    // A page session key is not a chat thread: the Requester keeps it.
+    const page = await postTask({ userId: requester.id }, { contextKey: "home:abc123" });
+    expect(page.status).toBe(201);
+  });
+
+  test("a Requester cannot name the context of another user's open task", async () => {
+    const requester = await createUser({ name: "Context Requester", email: "ctx-req@example.com" });
+    await attachRole(requester.id, "requester");
+    await detachRole(requester.id, "admin");
+    await createTaskExtended("private case notes", {
+      agentId: LEAD_ID,
+      contextKey: "case:private-1",
+      requestedByUserId: userAId,
+    });
+    const before = await taskCount();
+    const foreign = await postTask({ userId: requester.id }, { contextKey: "case:private-1" });
+    expect(foreign.status).toBe(403);
+    expect(await taskCount()).toBe(before);
+
+    // The context of the Requester's own open task stays usable.
+    await createTaskExtended("my case notes", {
+      agentId: LEAD_ID,
+      contextKey: "case:mine-1",
+      requestedByUserId: requester.id,
+    });
+    const own = await postTask({ userId: requester.id }, { contextKey: "case:mine-1" });
+    expect(own.status).toBe(201);
+  });
+
+  test("an admin user may bind a task to a chat thread", async () => {
+    const admin = await createUser({ name: "Chat Admin", email: "chat-admin@example.com" });
+    await attachRole(admin.id, "admin");
+    const result = await postTask(
+      { userId: admin.id },
+      { source: "chat", contextKey: chatSdkContextKey("telegram:557777") },
+    );
+    expect(result.status).toBe(201);
+  });
+});

package/src/tests/sessions-move.test.ts

@@ -16,10 +16,11 @@ import {
   upsertInboxState,
 } from "../be/db";
 import * as sessionMoves from "../be/db/session-moves";
+import { attachRole, detachRole, ensureRbacSeedsSynced } from "../be/rbac-roles";
 import { setSessionShares } from "../be/session-shares";
 import * as assets from "../http/assets";
 import { handleAssets } from "../http/assets";
-import { SESSION_READ_DENIED } from "../http/session-access";
+import { NOT_YOUR_TASK_DENIED, SESSION_READ_DENIED } from "../http/session-access";
 import { handleSessions } from "../http/sessions";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { chatSdkContextKey } from "../tasks/context-key";
@@ -705,3 +706,40 @@ test("old route denies read-only sharees with and without cascade and admits wri
     200,
   );
 });
+
+// Regression: the session wall reads an ownerless root as everyone's, so with
+// RBAC on a requester could re-key Slack, schedule and operator sessions.
+test("with RBAC on, a requester cannot move an ownerless session; an admin user still can", async () => {
+  const previous = process.env.RBAC_ENABLED;
+  process.env.RBAC_ENABLED = "true";
+  try {
+    await ensureRbacSeedsSynced();
+    const requester = (await createUser({ name: "Move Requester" })).id;
+    await detachRole(requester, "admin");
+    await attachRole(requester, "requester");
+    const ownerless = await createTaskExtended("ownerless root", { key: "shared/slack/", agentId });
+    const own = await session("shared/requester-own/", requester);
+
+    const denied = await call(
+      "session-moves",
+      { rootTaskIds: [ownerless.id, own.root.id], groupKey: "shared/requester-moved/" },
+      requester,
+    );
+    expect(denied.status).toBe(200);
+    expect(denied.body.moved).toEqual([own.root.id]);
+    expect(denied.body.skipped).toEqual([
+      { rootTaskId: ownerless.id, reason: NOT_YOUR_TASK_DENIED },
+    ]);
+    expect((await getTaskById(ownerless.id))?.key).toBe("shared/slack/");
+
+    const admin = await call(
+      "session-moves",
+      { rootTaskIds: [ownerless.id], groupKey: "shared/admin-moved/" },
+      owner,
+    );
+    expect(admin.body.moved).toEqual([ownerless.id]);
+  } finally {
+    if (previous === undefined) delete process.env.RBAC_ENABLED;
+    else process.env.RBAC_ENABLED = previous;
+  }
+});

package/src/tests/store-progress-learning.test.ts

@@ -0,0 +1,381 @@
+import { afterAll, beforeAll, describe, expect, type Mock, spyOn, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ZodType } from "zod";
+import {
+  closeDb,
+  createAgent,
+  createTaskExtended,
+  getDb,
+  getTaskById,
+  initDb,
+  startTask,
+} from "../be/db";
+import { getEmbeddingProvider, getMemoryStore } from "../be/memory";
+import { EMBEDDING_DIMENSIONS } from "../be/memory/constants";
+import { registerStoreProgressTool } from "../tools/store-progress";
+
+interface ToolResult {
+  isError?: boolean;
+  structuredContent?: Record<string, unknown>;
+}
+
+const agentId = "dddd0000-0000-4000-8000-000000000b01";
+
+const server = new McpServer({ name: "store-progress-learning", version: "1.0.0" });
+registerStoreProgressTool(server);
+const tool = (
+  server as unknown as {
+    _registeredTools: Record<
+      string,
+      {
+        inputSchema: ZodType;
+        handler: (args: unknown, meta: unknown) => Promise<ToolResult>;
+      }
+    >;
+  }
+)._registeredTools["store-progress"]!;
+
+async function call(args: Record<string, unknown>) {
+  return tool.handler(tool.inputSchema.parse(args), {
+    sessionId: "store-progress-learning-session",
+    requestInfo: { headers: { "x-agent-id": agentId } },
+  });
+}
+
+async function task(vcsRepo?: string) {
+  const row = await createTaskExtended("learning capture", {
+    agentId,
+    source: "system",
+    followUpConfig: { disabled: true },
+    ...(vcsRepo ? { vcsRepo } : {}),
+  });
+  await startTask(row.id);
+  return row;
+}
+
+interface MemoryRow {
+  id: string;
+  agentId: string | null;
+  key: string;
+  name: string;
+  scope: string;
+  source: string;
+  sourceTaskId: string;
+  tags: string;
+  content: string;
+}
+
+function learningRows(taskId: string): MemoryRow[] {
+  return getDb()
+    .query<MemoryRow, [string]>(
+      "SELECT id, agentId, key, name, scope, source, sourceTaskId, tags, content FROM agent_memory WHERE sourceTaskId = ? AND key LIKE '/learnings/%' ORDER BY createdAt",
+    )
+    .all(taskId);
+}
+
+function learningData(result: ToolResult) {
+  return result.structuredContent?.learning as
+    | { status: string; key?: string; memoryId?: string; similarity?: number; error?: string }
+    | undefined;
+}
+
+function message(result: ToolResult) {
+  return String(result.structuredContent?.message);
+}
+
+const originalEmbeddingKey = process.env.EMBEDDING_API_KEY;
+const originalOpenAiKey = process.env.OPENAI_API_KEY;
+beforeAll(async () => {
+  process.env.EMBEDDING_API_KEY = "";
+  process.env.OPENAI_API_KEY = "";
+  initDb(":memory:");
+  await createAgent({ id: agentId, name: "Learner", isLead: false, status: "idle" });
+});
+afterAll(() => {
+  closeDb();
+  if (originalEmbeddingKey === undefined) delete process.env.EMBEDDING_API_KEY;
+  else process.env.EMBEDDING_API_KEY = originalEmbeddingKey;
+  if (originalOpenAiKey === undefined) delete process.env.OPENAI_API_KEY;
+  else process.env.OPENAI_API_KEY = originalOpenAiKey;
+});
+
+describe("store-progress learning", () => {
+  test("stores a swarm manual memory under the explicit workstream", async () => {
+    const t = await task("desplega-ai/agent-swarm");
+    const result = await call({
+      taskId: t.id,
+      progress: "found the cause",
+      learning: {
+        text: "SQLite BUSY needs BEGIN IMMEDIATE\nA deferred BEGIN that reads first fails with BUSY_SNAPSHOT.",
+        workstream: "DB Runtime",
+        tags: ["SQLite", "gotcha", "learning"],
+      },
+    });
+
+    expect(result.isError).toBeFalsy();
+    expect(learningData(result)?.status).toBe("stored");
+    expect(message(result)).toContain(
+      "Learning stored at /learnings/db-runtime/sqlite-busy-needs-begin-immediate.",
+    );
+    const [row, ...rest] = learningRows(t.id);
+    expect(rest).toHaveLength(0);
+    expect(row).toMatchObject({
+      agentId,
+      key: "/learnings/db-runtime/sqlite-busy-needs-begin-immediate",
+      name: "SQLite BUSY needs BEGIN IMMEDIATE",
+      scope: "swarm",
+      source: "manual",
+      sourceTaskId: t.id,
+    });
+    expect(JSON.parse(row!.tags)).toEqual(["learning", "sqlite", "gotcha"]);
+    expect((await getTaskById(t.id))?.progress).toBe("found the cause");
+  });
+
+  test("string form falls back to the repo name, then to general", async () => {
+    const withRepo = await task("desplega-ai/agent-swarm");
+    await call({ taskId: withRepo.id, learning: "Run lint before tsc" });
+    expect(learningRows(withRepo.id)[0]?.key).toBe("/learnings/agent-swarm/run-lint-before-tsc");
+
+    const withoutRepo = await task();
+    const result = await call({ taskId: withoutRepo.id, learning: { text: "Prefer scripts" } });
+    expect(learningData(result)).toMatchObject({ status: "stored", workstream: "general" });
+    expect(learningRows(withoutRepo.id)[0]?.key).toBe("/learnings/general/prefer-scripts");
+  });
+
+  test("a taken key gets a short suffix instead of failing", async () => {
+    const first = await task();
+    const second = await task();
+    await call({ taskId: first.id, learning: "Same title\nfirst body" });
+    const result = await call({ taskId: second.id, learning: "Same title\nsecond body" });
+
+    expect(learningData(result)?.status).toBe("stored");
+    expect(learningRows(first.id)[0]?.key).toBe("/learnings/general/same-title");
+    expect(learningRows(second.id)[0]?.key).toMatch(
+      /^\/learnings\/general\/same-title-[0-9a-f]{6}$/,
+    );
+  });
+
+  test("an exact replay on the same task is skipped", async () => {
+    const t = await task();
+    await call({ taskId: t.id, learning: "Replay me" });
+    const replay = await call({ taskId: t.id, progress: "again", learning: "Replay me" });
+
+    expect(learningData(replay)).toMatchObject({
+      status: "replayed",
+      key: "/learnings/general/replay-me",
+    });
+    expect(learningRows(t.id)).toHaveLength(1);
+  });
+
+  test("overlapping calls with the same learning store it once", async () => {
+    const t = await task();
+    const learning = "Concurrent replay\nKeep exactly one copy of this lesson.";
+    const results = await Promise.all([
+      call({ taskId: t.id, learning }),
+      call({ taskId: t.id, learning }),
+    ]);
+
+    expect(learningRows(t.id)).toHaveLength(1);
+    expect(results.map((result) => learningData(result)?.status).sort()).toEqual([
+      "replayed",
+      "stored",
+    ]);
+  });
+
+  // Synthetic token, built at runtime so no literal credential sits in the repo.
+  const token = `ghp_${"abcd1234".repeat(5)}`;
+  const kebabToken = token.replace("_", "-");
+
+  test("a secret in the title, workstream or tags never reaches the key or tags", async () => {
+    const t = await task();
+    const result = await call({
+      taskId: t.id,
+      learning: {
+        text: `${token}\nKeep credentials out of memory.`,
+        workstream: token,
+        tags: [token],
+      },
+    });
+
+    expect(learningData(result)?.status).toBe("stored");
+    const [row] = learningRows(t.id);
+    for (const field of [row!.key, row!.name, row!.tags, row!.content, learningData(result)?.key]) {
+      expect(field).not.toContain(token);
+      expect(field).not.toContain(kebabToken);
+    }
+    expect(row!.content).toContain("[REDACTED:");
+  });
+
+  test("a replay of a secret-bearing learning is still detected", async () => {
+    const t = await task();
+    const learning = `Redact diagnostic tokens\nExample token: ${token}`;
+    await call({ taskId: t.id, learning });
+    const replay = await call({ taskId: t.id, learning });
+
+    expect(learningData(replay)?.status).toBe("replayed");
+    expect(learningRows(t.id)).toHaveLength(1);
+  });
+
+  test("a failed learning write leaves the progress write intact", async () => {
+    const t = await task();
+    getDb().run(
+      "CREATE TEMP TRIGGER fail_learning BEFORE INSERT ON agent_memory WHEN NEW.key LIKE '/learnings/%' BEGIN SELECT RAISE(ABORT, 'learning insert refused'); END",
+    );
+    try {
+      const result = await call({
+        taskId: t.id,
+        progress: "progress survives",
+        status: "completed",
+        output: "done",
+        learning: "This write fails",
+      });
+      expect(result.isError).toBeFalsy();
+      expect(learningData(result)).toMatchObject({ status: "failed" });
+      expect(learningData(result)?.error).toContain("learning insert refused");
+      expect(message(result)).toContain("Learning not stored:");
+    } finally {
+      getDb().run("DROP TRIGGER fail_learning");
+    }
+    const stored = await getTaskById(t.id);
+    expect(stored?.progress).toBe("progress survives");
+    expect(stored?.status).toBe("completed");
+    expect(learningRows(t.id)).toHaveLength(0);
+  });
+
+  test("invalid learnings are reported without blocking progress", async () => {
+    const t = await task();
+    const tooManyTags = await call({
+      taskId: t.id,
+      progress: "still stored",
+      learning: { text: "Tagged", tags: ["a", "b", "c", "d", "e", "f"] },
+    });
+    expect(learningData(tooManyTags)).toMatchObject({
+      status: "failed",
+      error: "learning takes at most 5 tags",
+    });
+    const tooLong = await call({ taskId: t.id, learning: "x".repeat(2001) });
+    expect(learningData(tooLong)?.status).toBe("failed");
+    expect((await getTaskById(t.id))?.progress).toBe("still stored");
+    expect(learningRows(t.id)).toHaveLength(0);
+  });
+
+  test("a learning on the completing call is stored", async () => {
+    const t = await task();
+    const result = await call({
+      taskId: t.id,
+      status: "completed",
+      output: "done",
+      learning: "Ship on the completing call",
+    });
+    expect(learningData(result)?.status).toBe("stored");
+    expect((await getTaskById(t.id))?.status).toBe("completed");
+  });
+
+  test("a call on a finished task stores nothing", async () => {
+    const t = await task();
+    await call({ taskId: t.id, status: "completed", output: "done" });
+    const late = await call({
+      taskId: t.id,
+      status: "completed",
+      output: "done",
+      learning: "Too late",
+    });
+    expect(late.structuredContent).toMatchObject({ wasNoOp: true });
+    expect(learningData(late)?.status).toBe("failed");
+
+    const progressOnly = await call({ taskId: t.id, learning: "Still too late" });
+    expect(learningData(progressOnly)?.status).toBe("failed");
+    expect(learningRows(t.id)).toHaveLength(0);
+  });
+});
+
+describe("store-progress learning near-duplicate guard", () => {
+  const vectors = new Map<string, Float32Array>();
+  let embedSpy: Mock<(text: string) => Promise<Float32Array | null>>;
+
+  /** Unit vector on `axis`, tilted toward `axis + 1` so its cosine to the bare axis is `cos`. */
+  function vector(axis: number, cos = 1): Float32Array {
+    const v = new Float32Array(EMBEDDING_DIMENSIONS);
+    v[axis] = cos;
+    v[axis + 1] = Math.sqrt(1 - cos ** 2);
+    return v;
+  }
+
+  /** Store a learning and give it its embedding now, not in the background. */
+  async function seed(text: string, embedding: Float32Array, workstream = "seeded") {
+    vectors.set(text, embedding);
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: { text, workstream } });
+    const memoryId = learningData(result)!.memoryId!;
+    await getMemoryStore().updateEmbedding(memoryId, embedding, "test-embedding");
+    return { task: t, memoryId, key: learningData(result)!.key! };
+  }
+
+  beforeAll(() => {
+    embedSpy = spyOn(getEmbeddingProvider(), "embed").mockImplementation(
+      async (text: string) => vectors.get(text) ?? null,
+    );
+  });
+  afterAll(() => embedSpy.mockRestore());
+
+  test("a near duplicate in another workstream is not stored and rates the existing row", async () => {
+    const existing = await seed("Upsert scripts from file bytes\nPOST the raw file.", vector(10));
+    const text = "Byte-exact script upsert from a local file\nPOST it to the API.";
+    vectors.set(text, vector(10, 0.9));
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: { text, workstream: "other" } });
+
+    expect(learningData(result)).toMatchObject({
+      status: "duplicate",
+      memoryId: existing.memoryId,
+      key: existing.key,
+    });
+    expect(learningData(result)?.similarity).toBeCloseTo(0.9, 2);
+    expect(message(result)).toContain(`Learning not stored: it matches ${existing.key}`);
+    expect(String(result.structuredContent?.nudge)).toContain(`memory-edit that memory instead`);
+    expect(String(result.structuredContent?.nudge)).toContain(existing.memoryId);
+    expect(learningRows(t.id)).toHaveLength(0);
+    const ratings = getDb()
+      .query<{ source: string; signal: number; taskId: string }, [string]>(
+        "SELECT source, signal, taskId FROM memory_rating WHERE memoryId = ?",
+      )
+      .all(existing.memoryId);
+    expect(ratings).toEqual([{ source: "learning-duplicate", signal: 1, taskId: t.id }]);
+  });
+
+  test("a related learning below the threshold is stored", async () => {
+    await seed("Retry flaky pushes once\nThe pre-push hook is slow.", vector(20));
+    const text = "Pre-push hooks take five minutes\nLet them finish.";
+    vectors.set(text, vector(20, 0.7));
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: text });
+
+    expect(learningData(result)?.status).toBe("stored");
+    expect(learningRows(t.id)).toHaveLength(1);
+  });
+
+  test("a failed search falls through to the normal insert", async () => {
+    await seed("Kebab keys only\nSlugs are lowercase.", vector(30));
+    const text = "Keys are kebab case\nSlugs stay lowercase.";
+    vectors.set(text, vector(30, 0.95));
+    const searchSpy = spyOn(getMemoryStore(), "search").mockRejectedValue(new Error("vec down"));
+    try {
+      const t = await task();
+      const result = await call({ taskId: t.id, progress: "kept", learning: text });
+      expect(learningData(result)?.status).toBe("stored");
+      expect(learningRows(t.id)).toHaveLength(1);
+      expect((await getTaskById(t.id))?.progress).toBe("kept");
+    } finally {
+      searchSpy.mockRestore();
+    }
+  });
+
+  test("an exact replay on the same task is replayed, not a duplicate", async () => {
+    const text = "Replay before similarity\nThe same task retrying is not a duplicate.";
+    const seeded = await seed(text, vector(40));
+    const replay = await call({ taskId: seeded.task.id, learning: { text, workstream: "seeded" } });
+
+    expect(learningData(replay)).toMatchObject({ status: "replayed", memoryId: seeded.memoryId });
+    expect(learningRows(seeded.task.id)).toHaveLength(1);
+  });
+});