@desplega.ai/agent-swarm 2.7.2 → 2.7.3

package/src/tests/agent-slack-icon.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import {
+  defaultSlackEmoji,
+  parseSlackIconInput,
+  slackEmojiGlyph,
+} from "../../apps/ui/src/lib/slack-icon";
+import { getAgentEmoji } from "../slack/responses";
+import { type Agent, AgentSlackIconSchema } from "../types";
+
+function agent(overrides: Partial<Agent> = {}): Agent {
+  return { id: "a1", name: "Owl Worker", isLead: false, status: "idle", ...overrides } as Agent;
+}
+
+// Each raw input, the icon the server receives for it, and whether both the
+// zod schema and the dashboard parser accept it.
+const PARITY_CASES: Array<[string, boolean]> = [
+  [":owl:", true],
+  [":+1:", true],
+  [":bee-lgtm:", true],
+  [":thumbs_up:", true],
+  ["https://example.com/owl.png", true],
+  ["https://example.com/owl.png?size=64", true],
+  ["http://example.com/owl.png", false],
+  ["https://", false],
+  ["https://exa mple.com/owl.png", false],
+  ["https://[::1", false],
+  ["https://user:pass@example.com/owl.png", false],
+  ["https://user@example.com/owl.png", false],
+  [`https://example.com/${"a".repeat(2048)}`, false],
+  ["javascript:alert(1)", false],
+  [":owl face:", false],
+  [":wave::skin-tone-3:", false],
+  [`:${"a".repeat(101)}:`, false],
+];
+
+function asIcon(raw: string) {
+  return /^https?:/i.test(raw) ? { type: "url", url: raw } : { type: "emoji", emoji: raw };
+}
+
+describe("Slack icon validation parity", () => {
+  for (const [raw, accepted] of PARITY_CASES) {
+    test(`${raw.slice(0, 48)} is ${accepted ? "accepted" : "rejected"} by both`, () => {
+      expect(AgentSlackIconSchema.safeParse(asIcon(raw)).success).toBe(accepted);
+      const parsed = parseSlackIconInput(raw);
+      expect(parsed.ok).toBe(accepted);
+      if (parsed.ok) expect(parsed.icon).toEqual(asIcon(raw) as never);
+    });
+  }
+
+  test("the schema rejects shortcodes the dashboard would normalise", () => {
+    expect(AgentSlackIconSchema.safeParse({ type: "emoji", emoji: "owl" }).success).toBe(false);
+    expect(AgentSlackIconSchema.safeParse({ type: "emoji", emoji: ":Owl:" }).success).toBe(false);
+  });
+
+  test("the dashboard normalises bare and capitalised shortcodes, and blank resets", () => {
+    expect(parseSlackIconInput(" owl ")).toEqual({
+      ok: true,
+      icon: { type: "emoji", emoji: ":owl:" },
+    });
+    expect(parseSlackIconInput(":Owl:")).toEqual({
+      ok: true,
+      icon: { type: "emoji", emoji: ":owl:" },
+    });
+    expect(parseSlackIconInput("  ")).toEqual({ ok: true, icon: null });
+    expect(parseSlackIconInput("http://example.com/owl.png")).toEqual({
+      ok: false,
+      error: "Use an https URL.",
+    });
+  });
+});
+
+describe("default emoji parity", () => {
+  test("the dashboard picks the same default as getAgentEmoji", () => {
+    const agents = [
+      agent({ isLead: true, name: "Neo" }),
+      ...["Owl Worker", "Coder", "Reviewer", "Mobile Coder", "e2e-worker-a", "Ω", ""].map((name) =>
+        agent({ name }),
+      ),
+    ];
+    for (const a of agents) {
+      expect(defaultSlackEmoji(a)).toBe(getAgentEmoji(a));
+      expect(slackEmojiGlyph(getAgentEmoji(a))).not.toBeNull();
+    }
+  });
+});

package/src/tests/approval-cancellation-migration.test.ts

@@ -24,6 +24,8 @@ describe("migration 140 approval cancellation lifecycle", () => {
       runMigrations(db);
       db.run("DELETE FROM approval_requests");
       db.run("DROP TRIGGER cancel_approval_request_after_workflow_step_cancel");
+      // Reads approval_requests from another table, so the rebuild's rename would fail.
+      db.run("DROP TRIGGER session_summary_recompute_apply");
       db.run("DROP TABLE approval_requests");
       db.run(`CREATE TABLE approval_requests (
         id TEXT PRIMARY KEY,

package/src/tests/asset-key-migration.test.ts

@@ -20,7 +20,23 @@ async function removeDb(path: string): Promise<void> {
   }
 }
 
+/** Migration 253's triggers read agent_tasks."key", so a pre-115 fixture predates them too. */
+function dropMigration253ForHistoricalFixture(): void {
+  const db = getDb();
+  const triggers = db
+    .prepare<{ name: string }, []>(
+      "SELECT name FROM sqlite_master WHERE type = 'trigger' AND name LIKE 'session\\_%' ESCAPE '\\'",
+    )
+    .all();
+  for (const trigger of triggers) db.run(`DROP TRIGGER "${trigger.name}"`);
+  db.run("DROP VIEW session_summary_recompute");
+  db.run("DROP TABLE session_summaries");
+  db.run("DROP TABLE session_members");
+  db.run("DELETE FROM _migrations WHERE version = 253");
+}
+
 function dropMigration115ForHistoricalFixture(): void {
+  dropMigration253ForHistoricalFixture();
   const db = getDb();
   const triggers = db
     .prepare<{ name: string }, []>(
@@ -482,6 +498,16 @@ describe("asset namespace key migrations", () => {
     expect(getDb().query('SELECT "key" FROM agent_tasks WHERE id = ?').get(taskId)).toEqual({
       key: "shared/",
     });
+    // The rebuild keeps the session summary triggers, including the ones on other tables.
+    expect(
+      getDb()
+        .query(
+          `SELECT
+            (SELECT COUNT(*) FROM sqlite_master WHERE type = 'trigger' AND name = 'session_task_insert') AS onTasks,
+            (SELECT COUNT(*) FROM sqlite_master WHERE type = 'trigger' AND name = 'session_summary_recompute_apply') AS recompute`,
+        )
+        .get(),
+    ).toEqual({ onTasks: 1, recompute: 1 });
     expect(
       getDb()
         .prepare<

package/src/tests/comb-default.test.ts

@@ -0,0 +1,159 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { getCombConfig } from "../comb/config";
+import { getCombState, isBrowserReachableUrl, isCombEnabled } from "../utils/constants";
+
+const ENV_KEYS = [
+  "COMB_ENABLED",
+  "AGENT_FS_API_URL",
+  "AGENT_FS_PUBLIC_URL",
+  "AGENT_FS_PROXY",
+  "MCP_BASE_URL",
+  "PUBLIC_MCP_BASE_URL",
+];
+const saved = new Map<string, string | undefined>();
+
+beforeEach(() => {
+  for (const key of ENV_KEYS) {
+    saved.set(key, process.env[key]);
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const value = saved.get(key);
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+describe("isBrowserReachableUrl", () => {
+  test("public hosts and addresses are reachable", () => {
+    for (const url of [
+      "https://fs.example.com",
+      "https://fs.example.com:7433/",
+      "http://8.8.8.8:7433",
+      "http://172.32.0.1",
+      "http://172.15.0.1",
+      "http://[2001:db8::1]:7433",
+      "http://[2606:4700::1111]:7433",
+      "http://[::ffff:8.8.8.8]:7433",
+      "http://[::ffff:7f00:1]:7433",
+    ]) {
+      expect(isBrowserReachableUrl(url)).toBe(true);
+    }
+  });
+
+  test("loopback is reachable: a localhost URL is the local dev setup", () => {
+    for (const url of ["http://localhost:7433", "http://127.0.0.1:7433", "http://[::1]:7433"]) {
+      expect(isBrowserReachableUrl(url)).toBe(true);
+    }
+  });
+
+  test("single-label docker hosts are not", () => {
+    for (const url of ["http://agent-fs:7433", "http://agent-fs", "http://swarm-agent-fs:7433"]) {
+      expect(isBrowserReachableUrl(url)).toBe(false);
+    }
+  });
+
+  test("internal suffixes are not", () => {
+    for (const url of [
+      "http://agent-fs.railway.internal:7433",
+      "http://agent-fs.internal",
+      "http://agent-fs.default.svc:7433",
+      "http://agent-fs.default.svc.cluster.local:7433",
+      "http://agent-fs.internal.:7433",
+    ]) {
+      expect(isBrowserReachableUrl(url)).toBe(false);
+    }
+  });
+
+  test("private, link-local and unique-local addresses are not", () => {
+    for (const url of [
+      "http://10.0.0.5:7433",
+      "http://172.16.0.1",
+      "http://172.31.255.255",
+      "http://192.168.1.10:7433",
+      "http://169.254.169.254",
+      "http://[fd00::1]:7433",
+      "http://[fe80::1]:7433",
+      "http://[::ffff:10.0.0.5]:7433",
+      "http://[::ffff:192.168.1.10]:7433",
+      "http://[::ffff:172.16.0.1]:7433",
+      "http://[::ffff:169.254.169.254]",
+      "http://[::]:7433",
+      "http://[ff02::1]:7433",
+      "http://[ff00::1]:7433",
+    ]) {
+      expect(isBrowserReachableUrl(url)).toBe(false);
+    }
+  });
+
+  test("an unparseable value is not reachable", () => {
+    expect(isBrowserReachableUrl("agent-fs:7433")).toBe(false);
+    expect(isBrowserReachableUrl("")).toBe(false);
+  });
+});
+
+describe("getCombState", () => {
+  test("nothing set: off, agent-fs missing", () => {
+    expect(getCombState()).toEqual({
+      enabled: false,
+      explicit: false,
+      reason: "AGENT_FS_API_URL is not set.",
+    });
+  });
+
+  test("explicit true still needs AGENT_FS_API_URL, but not a browser-reachable one", () => {
+    process.env.COMB_ENABLED = "true";
+    expect(isCombEnabled()).toBe(false);
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    expect(getCombState()).toEqual({ enabled: true, explicit: true, reason: null });
+  });
+
+  test("explicit false wins over every reachable URL", () => {
+    process.env.COMB_ENABLED = "false";
+    process.env.AGENT_FS_API_URL = "https://fs.example.com";
+    process.env.AGENT_FS_PUBLIC_URL = "https://fs.example.com";
+    process.env.AGENT_FS_PROXY = "true";
+    expect(getCombState()).toMatchObject({ enabled: false, explicit: true });
+  });
+
+  test("unset: the reachable-URL conditions decide", () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    expect(isCombEnabled()).toBe(false);
+    process.env.AGENT_FS_PROXY = "true";
+    expect(getCombState()).toMatchObject({ enabled: true, explicit: false });
+    delete process.env.AGENT_FS_PROXY;
+    process.env.AGENT_FS_PUBLIC_URL = "  ";
+    expect(isCombEnabled()).toBe(false);
+    process.env.AGENT_FS_PUBLIC_URL = "https://fs.example.com";
+    expect(isCombEnabled()).toBe(true);
+  });
+
+  test("unset with the proxy on: the public API URL decides, not AGENT_FS_API_URL", () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    process.env.AGENT_FS_PROXY = "true";
+    process.env.MCP_BASE_URL = "http://api:3013";
+    const state = getCombState();
+    expect(state).toMatchObject({ enabled: false, explicit: false });
+    expect(state.reason).toContain("PUBLIC_MCP_BASE_URL");
+    expect(getCombConfig()).toMatchObject({ enabled: false, apiUrl: "http://api:3013/agentfs" });
+    process.env.PUBLIC_MCP_BASE_URL = "https://swarm.example.com";
+    expect(getCombState()).toMatchObject({ enabled: true, explicit: false });
+    expect(getCombConfig().apiUrl).toBe("https://swarm.example.com/agentfs");
+    delete process.env.PUBLIC_MCP_BASE_URL;
+    process.env.MCP_BASE_URL = "http://[::ffff:10.0.0.5]:3013";
+    expect(isCombEnabled()).toBe(false);
+    process.env.COMB_ENABLED = "true";
+    expect(isCombEnabled()).toBe(true);
+  });
+
+  test("an unrecognized COMB_ENABLED counts as unset", () => {
+    process.env.COMB_ENABLED = "treu";
+    process.env.AGENT_FS_API_URL = "http://localhost:7433";
+    expect(getCombState()).toMatchObject({ enabled: true, explicit: false });
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    expect(getCombState()).toMatchObject({ enabled: false, explicit: false });
+  });
+});

package/src/tests/comb-review-batch.test.ts

@@ -29,7 +29,8 @@ import {
   upsertPromptTemplate,
 } from "../be/db";
 import { installExtension } from "../be/extensions/db";
-import { mintToken } from "../be/users";
+import { findUserByExternalId, linkIdentity, mintToken } from "../be/users";
+import { AGENT_FS_IDENTITY_KIND } from "../comb/requester";
 import {
   REVIEW_BATCH_MAX,
   REVIEW_BATCH_READ_CONCURRENCY,
@@ -39,7 +40,11 @@ import {
   sendReviewBatch,
 } from "../comb/review-batch";
 import { enableExtension, stopExtensionRuntime } from "../extensions/lifecycle";
-import type { AgentFsComment, AgentFsFileVersion } from "../fs/agent-fs-provider";
+import type {
+  AgentFsComment,
+  AgentFsDriveMember,
+  AgentFsFileVersion,
+} from "../fs/agent-fs-provider";
 import { resetFileStorageProvider } from "../fs/registry";
 import { handleComb } from "../http/comb";
 import { handleCore } from "../http/core";
@@ -67,20 +72,27 @@ const ENV_KEYS = [
   "AGENT_FS_REQUEST_TIMEOUT_MS",
   "APP_URL",
   "RBAC_ENABLED",
+  "TRUST_BODY_REQUESTED_BY_USER_ID",
 ];
 const savedEnv = new Map<string, string | undefined>();
 
 /**
  * An in-memory agent-fs behind a real HTTP server: `/auth/me`, `comment-get`,
- * `log`, and `comment-add` replies. The swarm reaches it through the registry
+ * `log`, `drive-members`, and `comment-add` replies. The swarm reaches it through the registry
  * provider (env), like production.
  */
 class FakeAgentFs {
   comments = new Map<string, AgentFsComment>();
   /** `log` answers, by stored version path (exact match, like agent-fs). */
   versions = new Map<string, AgentFsFileVersion[]>();
+  /** `drive-members` answer. */
+  members: AgentFsDriveMember[] = [];
   failReplies = false;
   failGets = false;
+  failMembers = false;
+  failAuthMe = false;
+  /** `drive-members` calls. */
+  memberReads = 0;
   /** `comment-get` calls: total, in flight now, the most in flight at once, and a delay per call. */
   gets = 0;
   getsInFlight = 0;
@@ -111,7 +123,10 @@ class FakeAgentFs {
       return Response.json({ error: "UNAUTHORIZED" }, { status: 401 });
     }
     const url = new URL(request.url);
-    if (url.pathname === "/auth/me") return Response.json({ userId: SERVICE_USER });
+    if (url.pathname === "/auth/me") {
+      if (this.failAuthMe) return Response.json({ error: "DOWN" }, { status: 500 });
+      return Response.json({ userId: SERVICE_USER });
+    }
     if (url.pathname !== `/orgs/${ORG}/ops` || request.method !== "POST") {
       return new Response("not found", { status: 404 });
     }
@@ -128,6 +143,11 @@ class FakeAgentFs {
       if (!comment) return Response.json({ error: "NOT_FOUND" }, { status: 404 });
       return Response.json({ comment, replies: this.repliesTo(comment.id) });
     }
+    if (body.op === "drive-members") {
+      this.memberReads++;
+      if (this.failMembers) return Response.json({ error: "INTERNAL" }, { status: 500 });
+      return Response.json({ members: this.members });
+    }
     if (body.op === "log") {
       return Response.json({ versions: this.versions.get(body.path as string) ?? [] });
     }
@@ -238,8 +258,12 @@ afterAll(async () => {
 beforeEach(async () => {
   fake.comments.clear();
   fake.versions.clear();
+  fake.members = [];
+  fake.memberReads = 0;
   fake.failReplies = false;
   fake.failGets = false;
+  fake.failMembers = false;
+  fake.failAuthMe = false;
   fake.gets = 0;
   fake.maxGetsInFlight = 0;
   fake.getDelayMs = 0;
@@ -650,6 +674,170 @@ describe("sendReviewBatch", () => {
   });
 });
 
+describe("requester from the comment authors", () => {
+  /** A swarm user plus the agent-fs drive member with the same email. */
+  async function member(name: string): Promise<{ userId: string; author: string; email: string }> {
+    const email = `${name.toLowerCase()}-${crypto.randomUUID()}@example.test`;
+    const user = await createUser({ name, email });
+    const author = `af-${crypto.randomUUID()}`;
+    fake.members.push({ userId: author, email, displayName: name });
+    return { userId: user.id, author, email };
+  }
+
+  /** A swarm user linked to the swarm service account's agent-fs id, once per file. */
+  async function linkServiceAccount(): Promise<void> {
+    if (await findUserByExternalId(AGENT_FS_IDENTITY_KIND, SERVICE_USER)) return;
+    const service = await createUser({
+      name: "Service",
+      email: `svc-${crypto.randomUUID()}@x.test`,
+    });
+    await linkIdentity(service.id, AGENT_FS_IDENTITY_KIND, SERVICE_USER, {
+      kind: "system",
+      id: "test",
+    });
+  }
+
+  test("one author: the swarm user with the agent-fs member's email", async () => {
+    const ana = await member("Ana");
+    const a = fake.add({ body: "@swarm a", author: ana.author });
+    const b = fake.add({ body: "@swarm b", author: ana.author });
+
+    const result = await sendReviewBatch(batch([a.id, b.id]));
+
+    const task = await getTaskById(result.taskId as string);
+    expect(task?.requestedByUserId).toBe(ana.userId);
+    expect(task?.task).toContain(`Requested by: Ana <${ana.email}>`);
+    expect(fake.memberReads).toBe(1);
+  });
+
+  test("a linked agent-fs identity maps without reading the drive members", async () => {
+    const user = await createUser({
+      name: "Linked",
+      email: `linked-${crypto.randomUUID()}@x.test`,
+    });
+    const author = `af-${crypto.randomUUID()}`;
+    await linkIdentity(user.id, AGENT_FS_IDENTITY_KIND, author, { kind: "system", id: "test" });
+    const a = fake.add({ body: "@swarm a", author });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    expect((await getTaskById(result.taskId as string))?.requestedByUserId).toBe(user.id);
+    expect(fake.memberReads).toBe(0);
+  });
+
+  test("several authors: the author of the newest mapped comment", async () => {
+    const ana = await member("Ana");
+    const bo = await member("Bo");
+    const older = fake.add({ body: "@swarm a", author: bo.author });
+    const newest = fake.add({ body: "@swarm b", author: ana.author });
+    const middle = fake.add({ body: "@swarm c", author: bo.author });
+    middle.createdAt = new Date(Date.parse(older.createdAt) + 1).toISOString();
+    newest.createdAt = new Date(Date.parse(older.createdAt) + 60_000).toISOString();
+    // The newest comment of all has an author with no swarm user: skipped.
+    const stranger = fake.add({
+      body: "@swarm d",
+      author: "af-stranger",
+      createdAt: new Date(Date.parse(older.createdAt) + 120_000).toISOString(),
+    });
+
+    // Bo is first, last mapped, and the majority: only "newest" picks Ana.
+    const result = await sendReviewBatch(batch([middle.id, newest.id, older.id, stranger.id]));
+
+    const task = await getTaskById(result.taskId as string);
+    expect(task?.requestedByUserId).toBe(ana.userId);
+    expect(task?.task).toContain("Requested by: Ana <");
+  });
+
+  test("no author maps: no requester, as before", async () => {
+    const a = fake.add({ body: "@swarm a", author: "af-stranger" });
+    fake.members.push({ userId: "af-stranger", email: "nobody-here@example.test" });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    const task = await getTaskById(result.taskId as string);
+    expect(task?.requestedByUserId).toBeUndefined();
+    expect(task?.task).toContain("Requested by: an operator (swarm API key)");
+  });
+
+  test("a failed drive-members read leaves the requester empty and still sends", async () => {
+    const ana = await member("Ana");
+    fake.failMembers = true;
+    const a = fake.add({ body: "@swarm a", author: ana.author });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    expect(result.sent).toEqual([a.id]);
+    expect((await getTaskById(result.taskId as string))?.requestedByUserId).toBeUndefined();
+  });
+
+  test("the swarm service account is never the requester", async () => {
+    await linkServiceAccount();
+    const a = fake.add({ body: "@swarm a", author: SERVICE_USER });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    expect((await getTaskById(result.taskId as string))?.requestedByUserId).toBeUndefined();
+  });
+
+  test("an unknown service identity leaves the requester empty and still sends", async () => {
+    await linkServiceAccount();
+    fake.failAuthMe = true;
+    const a = fake.add({ body: "@swarm a", author: SERVICE_USER });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    expect(result.sent).toEqual([a.id]);
+    expect((await getTaskById(result.taskId as string))?.requestedByUserId).toBeUndefined();
+    expect(fake.memberReads).toBe(0);
+  });
+
+  test("TRUST_BODY_REQUESTED_BY_USER_ID=false: no author requester, and the send still works", async () => {
+    process.env.TRUST_BODY_REQUESTED_BY_USER_ID = "false";
+    const ana = await member("Ana");
+    const a = fake.add({ body: "@swarm a", author: ana.author });
+
+    const result = await sendReviewBatch(batch([a.id]));
+
+    expect(result.sent).toEqual([a.id]);
+    expect((await getTaskById(result.taskId as string))?.requestedByUserId).toBeUndefined();
+    expect(fake.memberReads).toBe(0);
+  });
+
+  test("an authenticated sender wins, and the body cannot name a requester", async () => {
+    const ana = await member("Ana");
+    const sender = await createUser({
+      name: "Sender",
+      email: `sender-${crypto.randomUUID()}@x.test`,
+    });
+    const { plaintext } = await mintToken(sender.id, "comb-test", { kind: "system", id: "test" });
+    const a = fake.add({ body: "@swarm a", author: ana.author });
+    const b = fake.add({ body: "@swarm b", author: ana.author });
+
+    const asUser = await post(
+      { orgId: ORG, driveId: DRIVE, commentIds: [a.id], scopePath: "/" },
+      { Authorization: `Bearer ${plaintext}` },
+    );
+    expect(asUser.status).toBe(201);
+    const userTask = await getTaskById(((await asUser.json()) as ReviewBatchResult).taskId ?? "");
+    expect(userTask?.requestedByUserId).toBe(sender.id);
+    expect(fake.memberReads).toBe(0);
+
+    // Operator key: a requestedByUserId in the body is dropped, the author maps.
+    const asOperator = await post({
+      orgId: ORG,
+      driveId: DRIVE,
+      commentIds: [b.id],
+      scopePath: "/",
+      requestedByUserId: sender.id,
+    });
+    expect(asOperator.status).toBe(201);
+    const operatorTask = await getTaskById(
+      ((await asOperator.json()) as ReviewBatchResult).taskId ?? "",
+    );
+    expect(operatorTask?.requestedByUserId).toBe(ana.userId);
+  });
+});
+
 describe("POST /api/comb/review-batches", () => {
   test("the dashboard batch cap and note limit match the server's", () => {
     expect(COMB_BATCH_MAX).toBe(REVIEW_BATCH_MAX);

package/src/tests/comb-status.test.ts

@@ -62,11 +62,67 @@ afterEach(() => {
 });
 
 describe("/status agent_fs.comb", () => {
-  test("is off by default", async () => {
+  test("unset and AGENT_FS_API_URL is a docker-internal host: off, and says what is missing", async () => {
     process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
     const result = await comb();
     expect(result.enabled).toBe(false);
     expect(result.api_url).toBe("http://agent-fs:7433");
+    expect(result.reason).toContain("AGENT_FS_PUBLIC_URL or AGENT_FS_PROXY=true");
+  });
+
+  test("unset and AGENT_FS_PROXY on: on, through the API", async () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    process.env.PUBLIC_MCP_BASE_URL = "https://swarm.example.com";
+    process.env.AGENT_FS_PROXY = "true";
+    const result = await comb();
+    expect(result.enabled).toBe(true);
+    expect(result.reason).toBeNull();
+    expect(result.api_url).toBe("https://swarm.example.com/agentfs");
+  });
+
+  test("unset, AGENT_FS_PROXY on and an internal API address: off, and names PUBLIC_MCP_BASE_URL", async () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    process.env.MCP_BASE_URL = "http://api:3013";
+    process.env.AGENT_FS_PROXY = "true";
+    const result = await comb();
+    expect(result.enabled).toBe(false);
+    expect(result.reason).toContain("PUBLIC_MCP_BASE_URL");
+  });
+
+  test("unset and an IPv4-mapped private IPv6 AGENT_FS_API_URL: off", async () => {
+    process.env.AGENT_FS_API_URL = "http://[::ffff:10.0.0.5]:7433";
+    const result = await comb();
+    expect(result.enabled).toBe(false);
+    expect(result.reason).toContain("not reachable from a browser");
+  });
+
+  test("unset and AGENT_FS_PUBLIC_URL set: on", async () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    process.env.AGENT_FS_PUBLIC_URL = "https://fs.example.com";
+    const result = await comb();
+    expect(result.enabled).toBe(true);
+    expect(result.api_url).toBe("https://fs.example.com");
+  });
+
+  test("unset and a browser-reachable AGENT_FS_API_URL: on", async () => {
+    process.env.AGENT_FS_API_URL = "https://fs.example.com";
+    expect((await comb()).enabled).toBe(true);
+  });
+
+  test("COMB_ENABLED=false wins over a reachable URL", async () => {
+    process.env.AGENT_FS_API_URL = "http://agent-fs:7433";
+    process.env.AGENT_FS_PUBLIC_URL = "https://fs.example.com";
+    process.env.COMB_ENABLED = "false";
+    const result = await comb();
+    expect(result.enabled).toBe(false);
+    expect(result.reason).toBe("COMB_ENABLED is false.");
+  });
+
+  test("unset and no AGENT_FS_API_URL: off, and says so", async () => {
+    process.env.AGENT_FS_PUBLIC_URL = "https://fs.example.com";
+    const result = await comb();
+    expect(result.enabled).toBe(false);
+    expect(result.reason).toBe("AGENT_FS_API_URL is not set.");
   });
 
   test("stays off with the flag on but no AGENT_FS_API_URL", async () => {
@@ -81,7 +137,12 @@ describe("/status agent_fs.comb", () => {
       process.env.COMB_ENABLED = value;
       expect((await comb()).enabled).toBe(true);
     }
-    for (const value of ["false", "0", "yes", ""]) {
+    for (const value of ["false", "0", " FALSE "]) {
+      process.env.COMB_ENABLED = value;
+      expect((await comb()).enabled).toBe(false);
+    }
+    // Unrecognized or blank means unset: the docker-internal URL keeps it off.
+    for (const value of ["yes", ""]) {
       process.env.COMB_ENABLED = value;
       expect((await comb()).enabled).toBe(false);
     }
@@ -150,6 +211,7 @@ describe("/status agent_fs.comb", () => {
     result = await comb();
     expect(result).toEqual({
       enabled: true,
+      reason: null,
       api_url: "http://agent-fs:7433",
       live_url: "https://live.example.com",
       org_id: "org-1",
@@ -177,6 +239,7 @@ describe("/status agent_fs.comb", () => {
       process.env.AGENT_FS_DEFAULT_DRIVE_ID = "drive-1";
 
       // Comb off: no lookup.
+      process.env.COMB_ENABLED = "false";
       expect((await comb()).service_user_id).toBeNull();
       expect(meCalls).toBe(0);
 

package/src/tests/db-agents.test.ts

@@ -77,6 +77,7 @@ test("unmoved profile and idle-worker callers share agent mapping defaults", asy
     credStatus: null,
     harnessProvider: null,
     avatar: null,
+    slackIcon: null,
   });
   const updated = await db.updateAgentProfile(agent.id, {
     role: "coder",
@@ -89,3 +90,15 @@ test("unmoved profile and idle-worker callers share agent mapping defaults", asy
     .run("UPDATE agents SET avatar = ? WHERE id = ?", ["invalid json", agent.id]);
   expect((await db.getAgentById(agent.id))?.avatar).toBeNull();
 });
+
+test("slackIcon is set, kept when omitted, reset by null, and parsed safely", async () => {
+  const agent = await db.createAgent(worker);
+  const owl = { type: "emoji" as const, emoji: ":owl:" };
+  expect((await db.updateAgentProfile(agent.id, { slackIcon: owl }))?.slackIcon).toEqual(owl);
+  expect((await db.updateAgentProfile(agent.id, { role: "coder" }))?.slackIcon).toEqual(owl);
+  expect((await db.updateAgentProfile(agent.id, { slackIcon: null }))?.slackIcon).toBeNull();
+  await db
+    .getDbClient()
+    .run("UPDATE agents SET slack_icon = ? WHERE id = ?", ["invalid json", agent.id]);
+  expect((await db.getAgentById(agent.id))?.slackIcon).toBeNull();
+});