skimpyclaw 0.3.14 → 0.4.0

package/dist/__tests__/tools.test.js

@@ -1,7 +1,8 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'fs';
 import { join } from 'path';
-import { executeTool, BUILTIN_TOOL_DEFINITIONS, BROWSER_TOOL_DEFINITION, CODE_WITH_AGENT_TOOL, CODE_WITH_TEAM_TOOL, CHECK_CODE_AGENT_TOOL, getToolDefinitions, fromClaudeCodeName, toClaudeCodeName, buildCodeAgentArgs, getActiveCodeAgents, getRecentCodeAgents, getCodeAgent, readTeamState, decomposeTask, synthesizeResults, computeWaves } from '../tools.js';
+import { executeTool, BUILTIN_TOOL_DEFINITIONS, CODE_WITH_AGENT_TOOL, CHECK_CODE_AGENT_TOOL, DELEGATE_TO_AGENT_TOOL, getToolDefinitions, fromClaudeCodeName, toClaudeCodeName, buildCodeAgentArgs, getActiveCodeAgents, getRecentCodeAgents, getCodeAgent, normalizeMcpToolArgsForExecution } from '../tools.js';
+import { registerDelegateToAgentHandler } from '../tools/agent-delegation.js';
 import { resolveModelAlias } from '../code-agents/utils.js';
 const TEST_DIR = join(process.cwd(), '__test_sandbox__');
 const OUTSIDE_DIR = join(process.cwd(), '__test_outside__');
@@ -30,14 +31,10 @@ describe('BUILTIN_TOOL_DEFINITIONS', () => {
         expect(names).toContain('Glob');
         expect(names).toContain('Bash');
     });
-    it('exports Browser tool definition separately', () => {
-        expect(BROWSER_TOOL_DEFINITION.name).toBe('Browser');
-        expect(BROWSER_TOOL_DEFINITION.input_schema).toBeDefined();
-    });
 });
 describe('getToolDefinitions', () => {
     it('returns at least the 4 built-in tools', async () => {
-        const tools = await getToolDefinitions();
+        const tools = await getToolDefinitions(undefined, { includeMcp: false });
         expect(tools.length).toBeGreaterThanOrEqual(4);
         const names = tools.map(t => t.name);
         expect(names).toContain('Read');
@@ -45,20 +42,6 @@ describe('getToolDefinitions', () => {
         expect(names).toContain('Glob');
         expect(names).toContain('Bash');
     }, 15000);
-    it('includes Browser when browser.enabled is true', async () => {
-        const config = { ...toolConfig, browser: { enabled: true } };
-        const tools = await getToolDefinitions(config);
-        expect(tools.map(t => t.name)).toContain('Browser');
-    });
-    it('excludes Browser when browser.enabled is false', async () => {
-        const config = { ...toolConfig, browser: { enabled: false } };
-        const tools = await getToolDefinitions(config);
-        expect(tools.map(t => t.name)).not.toContain('Browser');
-    });
-    it('excludes Browser when no config provided', async () => {
-        const tools = await getToolDefinitions();
-        expect(tools.map(t => t.name)).not.toContain('Browser');
-    });
     describe('tool profiles', () => {
         it('minimal returns built-in tools plus Fetch', async () => {
             const config = { ...toolConfig, toolProfile: 'minimal' };
@@ -66,23 +49,17 @@ describe('getToolDefinitions', () => {
             expect(tools).toHaveLength(5);
             expect(tools.map(t => t.name)).toEqual(['Read', 'Write', 'Glob', 'Bash', 'Fetch']);
         });
-        it('minimal excludes Browser even when browser.enabled is true', async () => {
-            const config = { ...toolConfig, toolProfile: 'minimal', browser: { enabled: true } };
-            const tools = await getToolDefinitions(config);
-            expect(tools.map(t => t.name)).not.toContain('Browser');
-        });
         it('minimal excludes MCP tools', async () => {
             const config = { ...toolConfig, toolProfile: 'minimal' };
             const tools = await getToolDefinitions(config, { includeMcp: true });
             expect(tools.every(t => !t.name.startsWith('mcp__'))).toBe(true);
         });
-        it('coding includes code_with_agent and check_code_agent but not code_with_team', async () => {
+        it('coding includes code_with_agent and check_code_agent', async () => {
             const config = { ...toolConfig, toolProfile: 'coding' };
             const tools = await getToolDefinitions(config, { includeAgentTools: true });
             const names = tools.map(t => t.name);
             expect(names).toContain('code_with_agent');
             expect(names).toContain('check_code_agent');
-            expect(names).not.toContain('code_with_team');
         });
         it('coding excludes MCP tools', async () => {
             const config = { ...toolConfig, toolProfile: 'coding' };
@@ -90,8 +67,8 @@ describe('getToolDefinitions', () => {
             expect(tools.every(t => !t.name.startsWith('mcp__'))).toBe(true);
         });
         it('full profile behaves like default (no profile set)', async () => {
-            const defaultTools = await getToolDefinitions(toolConfig);
-            const fullTools = await getToolDefinitions({ ...toolConfig, toolProfile: 'full' });
+            const defaultTools = await getToolDefinitions(toolConfig, { includeMcp: false });
+            const fullTools = await getToolDefinitions({ ...toolConfig, toolProfile: 'full' }, { includeMcp: false });
             expect(fullTools.map(t => t.name)).toEqual(defaultTools.map(t => t.name));
         }, 15000);
     });
@@ -132,6 +109,27 @@ describe('MCP tool name parsing', () => {
         expect(result).toContain('Error:');
         expect(result).not.toContain('Unknown tool');
     });
+    it('normalizes context-a8c execute-tool parameter aliases', () => {
+        expect(normalizeMcpToolArgsForExecution('context-a8c', 'context-a8c-execute-tool', {
+            provider: 'zendesk',
+            tool: 'search',
+            parameters: { query: 'jetpack search' },
+        })).toEqual({
+            provider: 'zendesk',
+            tool: 'search',
+            params: { query: 'jetpack search' },
+        });
+        expect(normalizeMcpToolArgsForExecution('context-a8c', 'context-a8c-execute-tool', {
+            provider: 'slack',
+            tool: 'search',
+            query: 'jetpack search',
+            limit: 10,
+        })).toEqual({
+            provider: 'slack',
+            tool: 'search',
+            params: { query: 'jetpack search', limit: 10 },
+        });
+    });
 });
 describe('read_file', () => {
     it('reads a file within allowed paths', async () => {
@@ -164,13 +162,13 @@ describe('write_file', () => {
     it('writes a new file', async () => {
         const path = join(TEST_DIR, 'new.txt');
         const result = await executeTool('Write', { path, content: 'new content' }, toolConfig);
-        expect(result).toContain('Written');
+        expect(result).toBe('OK');
         expect(readFileSync(path, 'utf-8')).toBe('new content');
     });
     it('creates parent directories', async () => {
         const path = join(TEST_DIR, 'sub', 'deep', 'file.txt');
         const result = await executeTool('Write', { path, content: 'deep' }, toolConfig);
-        expect(result).toContain('Written');
+        expect(result).toBe('OK');
         expect(readFileSync(path, 'utf-8')).toBe('deep');
     });
     it('rejects writes outside allowed paths', async () => {
@@ -199,6 +197,14 @@ describe('bash', () => {
         const result = await executeTool('Bash', { command: 'echo hello' }, toolConfig);
         expect(result.trim()).toBe('hello');
     });
+    it('blocks shell command chaining to prevent injection patterns', async () => {
+        const result = await executeTool('Bash', { command: 'echo hello; uname -a' }, toolConfig);
+        expect(result).toContain('Shell control operators are blocked');
+    });
+    it('blocks shell pipe operators to avoid implicit shell mode', async () => {
+        const result = await executeTool('Bash', { command: 'echo hello | cat' }, toolConfig);
+        expect(result).toContain('Shell control operators are blocked');
+    });
     it('blocks dangerous commands via exec approval', async () => {
         const result = await executeTool('Bash', { command: `rm -rf ${TEST_DIR}` }, toolConfig);
         expect(result).toContain('⛔');
@@ -257,83 +263,6 @@ describe('bash', () => {
         });
     });
 });
-describe('browser', () => {
-    const browserDisabledConfig = {
-        ...toolConfig,
-        browser: { enabled: false },
-    };
-    const browserEnabledConfig = {
-        ...toolConfig,
-        browser: { enabled: true },
-    };
-    const browserWithFileConfig = {
-        ...toolConfig,
-        browser: { enabled: true, allowFile: true },
-    };
-    it('returns error when browser is disabled', async () => {
-        const result = await executeTool('Browser', { action: 'open', url: 'https://example.com' }, browserDisabledConfig);
-        expect(result).toContain('Error: Browser tool is disabled');
-    });
-    it('returns error when browser config is missing', async () => {
-        const result = await executeTool('Browser', { action: 'open', url: 'https://example.com' }, toolConfig);
-        expect(result).toContain('Error: Browser tool is disabled');
-    });
-    it('blocks file:// URLs when allowFile is false', async () => {
-        const result = await executeTool('Browser', { action: 'open', url: 'file:///etc/passwd' }, browserEnabledConfig);
-        expect(result).toContain('Error: file:// URLs are blocked');
-    });
-    it('validates file:// URLs with new URL() parsing', async () => {
-        // file://localhost/etc/passwd should parse to /etc/passwd, which is outside allowedPaths
-        const result = await executeTool('Browser', { action: 'open', url: 'file://localhost/etc/passwd' }, browserWithFileConfig);
-        expect(result).toContain('Error: file:// URLs are blocked');
-    });
-    it('returns error for unknown action', async () => {
-        const result = await executeTool('Browser', { action: 'destroy' }, browserEnabledConfig);
-        expect(result).toContain('Error: Unknown browser action "destroy"');
-    });
-    it('requires url for open action', async () => {
-        const result = await executeTool('Browser', { action: 'open' }, browserEnabledConfig);
-        expect(result).toContain('Error: url is required');
-    });
-    it('requires selector for click action', async () => {
-        const result = await executeTool('Browser', { action: 'click' }, browserEnabledConfig);
-        expect(result).toContain('Error: Browser not open');
-    });
-    it('requires selector and text for type action', async () => {
-        const result = await executeTool('Browser', { action: 'type', selector: '#input' }, browserEnabledConfig);
-        expect(result).toContain('Error: Browser not open');
-    });
-    it('requires script for evaluate action', async () => {
-        const result = await executeTool('Browser', { action: 'evaluate' }, browserEnabledConfig);
-        expect(result).toContain('Error: Browser not open');
-    });
-    it('requires selector for hover action', async () => {
-        const result = await executeTool('Browser', { action: 'hover' }, browserEnabledConfig);
-        expect(result).toContain('Error: Browser not open');
-    });
-    it('requires selector and text for select action', async () => {
-        const result = await executeTool('Browser', { action: 'select' }, browserEnabledConfig);
-        expect(result).toContain('Error: Browser not open');
-    });
-    it('returns "Browser not open" for actions before open', async () => {
-        for (const action of ['click', 'type', 'waitfor', 'screenshot', 'evaluate', 'gettext', 'scroll', 'select', 'hover']) {
-            const result = await executeTool('Browser', { action }, browserEnabledConfig);
-            expect(result).toContain('Error: Browser not open');
-        }
-    });
-    it('handles close when browser is not open', async () => {
-        const result = await executeTool('Browser', { action: 'close' }, browserEnabledConfig);
-        expect(result).toBe('Browser closed.');
-    });
-    it('handles case-insensitive actions', async () => {
-        const result = await executeTool('Browser', { action: 'OPEN' }, browserEnabledConfig);
-        expect(result).toContain('Error: url is required');
-    });
-    it('maps Browser name correctly', () => {
-        expect(fromClaudeCodeName('Browser')).toBe('browser');
-        expect(toClaudeCodeName('browser')).toBe('Browser');
-    });
-});
 describe('code_with_agent', () => {
     describe('tool definition', () => {
         it('has correct name and required fields', () => {
@@ -344,17 +273,15 @@ describe('code_with_agent', () => {
             const props = Object.keys(CODE_WITH_AGENT_TOOL.input_schema.properties);
             expect(props).toContain('task');
             expect(props).toContain('agent');
-            expect(props).toContain('workdir');
-            expect(props).toContain('model');
-            expect(props).toContain('max_turns');
-            expect(props).toContain('validate');
+            expect(props).toContain('worktree');
+            // workdir, model, max_turns, validate — omitted from schema to save tokens (executor still accepts them)
         });
         it('is included in getToolDefinitions when includeSpawnSubagent is true', async () => {
-            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true });
+            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true, includeMcp: false });
             expect(tools.map(t => t.name)).toContain('code_with_agent');
         });
         it('is excluded from getToolDefinitions when includeSpawnSubagent is false', async () => {
-            const tools = await getToolDefinitions(toolConfig);
+            const tools = await getToolDefinitions(toolConfig, { includeMcp: false });
             expect(tools.map(t => t.name)).not.toContain('code_with_agent');
         });
     });
@@ -371,10 +298,10 @@ describe('code_with_agent', () => {
             expect(args[args.length - 1]).toBe('fix the bug');
         });
         it('builds claude args with model override', () => {
-            const { cmd, args } = buildCodeAgentArgs({ task: 'fix it', model: 'opus' });
+            const { cmd, args } = buildCodeAgentArgs({ task: 'fix it', model: 'claude-opus-4-7' });
             expect(cmd).toContain('claude');
             expect(args).toContain('--model');
-            expect(args).toContain('opus');
+            expect(args).toContain('claude-opus-4-7');
         });
         it('builds claude args with custom max_turns', () => {
             const { args } = buildCodeAgentArgs({ task: 'fix it', max_turns: 10 });
@@ -386,6 +313,7 @@ describe('code_with_agent', () => {
             expect(cmd).toContain('codex');
             expect(args[0]).toBe('exec');
             expect(args).toContain('--full-auto');
+            expect(args).toContain('--skip-git-repo-check');
             expect(args).toContain('--json');
             expect(args).toContain('--color');
             expect(args).toContain('never');
@@ -401,6 +329,11 @@ describe('code_with_agent', () => {
             expect(args).toContain('-m');
             expect(args).toContain('gpt-5.3-codex');
         });
+        it('builds codex args with effort override', () => {
+            const { args } = buildCodeAgentArgs({ task: 'fix it', agent: 'codex', effort: 'xhigh' });
+            expect(args).toContain('-c');
+            expect(args).toContain('model_reasoning_effort=xhigh');
+        });
         it('does not include --allowedTools for codex', () => {
             const { args } = buildCodeAgentArgs({ task: 'fix it', agent: 'codex' });
             expect(args).not.toContain('--allowedTools');
@@ -438,6 +371,9 @@ describe('code_with_agent', () => {
             expect(resolveModelAlias('claude-sonnet-4-5', {})).toBe('claude-sonnet-4-5');
             expect(resolveModelAlias('gpt-4.1', {})).toBe('gpt-4.1');
         });
+        it('normalizes dotted claude opus 4.6 model id', () => {
+            expect(resolveModelAlias('anthropic/claude-opus-4.6', {})).toBe('claude-opus-4-6');
+        });
     });
     describe('executeTool routing', () => {
         it('rejects workdir outside allowed paths', async () => {
@@ -465,14 +401,61 @@ describe('code_with_agent', () => {
             expect(CHECK_CODE_AGENT_TOOL.input_schema.properties).toHaveProperty('id');
         });
         it('is included in getToolDefinitions when includeSpawnSubagent is true', async () => {
-            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true });
+            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true, includeMcp: false });
             expect(tools.map(t => t.name)).toContain('check_code_agent');
         });
         it('is excluded from getToolDefinitions when includeSpawnSubagent is false', async () => {
-            const tools = await getToolDefinitions(toolConfig);
+            const tools = await getToolDefinitions(toolConfig, { includeMcp: false });
             expect(tools.map(t => t.name)).not.toContain('check_code_agent');
         });
     });
+    describe('delegate_to_agent tool', () => {
+        afterEach(() => {
+            registerDelegateToAgentHandler(null);
+        });
+        it('has expected tool definition', () => {
+            expect(DELEGATE_TO_AGENT_TOOL.name).toBe('delegate_to_agent');
+            expect(DELEGATE_TO_AGENT_TOOL.input_schema.required).toEqual(['alias', 'task']);
+        });
+        it('is included in getToolDefinitions when agent tools are enabled', async () => {
+            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true, includeMcp: false });
+            expect(tools.map(t => t.name)).toContain('delegate_to_agent');
+        });
+        it('rejects non-Discord contexts', async () => {
+            const result = await executeTool('delegate_to_agent', {
+                alias: 'reviewer',
+                task: 'review this',
+            }, toolConfig, {
+                fullConfig: { agents: { default: 'main', list: {} } },
+                channel: 'telegram',
+            });
+            expect(result).toContain('Discord-only');
+        });
+        it('calls the registered delegation handler for Discord', async () => {
+            registerDelegateToAgentHandler(async (input) => `delegated ${input.alias}: ${input.task}`);
+            const result = await executeTool('delegate_to_agent', {
+                alias: '@Reviewer',
+                task: 'review this',
+            }, toolConfig, {
+                fullConfig: { agents: { default: 'main', list: {} } },
+                channel: 'discord',
+                channelTargetId: '123',
+            });
+            expect(result).toBe('delegated reviewer: review this');
+        });
+        it('blocks self delegation', async () => {
+            registerDelegateToAgentHandler(async () => 'should not run');
+            const result = await executeTool('delegate_to_agent', {
+                alias: 'reviewer',
+                task: 'review this',
+            }, toolConfig, {
+                fullConfig: { agents: { default: 'main', list: {} } },
+                channel: 'discord',
+                threadAgentAlias: 'reviewer',
+            });
+            expect(result).toContain('cannot delegate to itself');
+        });
+    });
     describe('multi-agent tracking', () => {
         it('getActiveCodeAgents returns empty array initially', () => {
             // Active agents are those currently running — initially none
@@ -498,161 +481,3 @@ describe('code_with_agent', () => {
         });
     });
 });
-describe('code_with_team', () => {
-    describe('tool definition', () => {
-        it('has correct name and required fields', () => {
-            expect(CODE_WITH_TEAM_TOOL.name).toBe('code_with_team');
-            expect(CODE_WITH_TEAM_TOOL.input_schema.required).toEqual(['task']);
-        });
-        it('has expected properties in schema (no max_turns)', () => {
-            const props = Object.keys(CODE_WITH_TEAM_TOOL.input_schema.properties);
-            expect(props).toContain('task');
-            expect(props).toContain('team_size');
-            expect(props).toContain('workdir');
-            expect(props).toContain('agent');
-            expect(props).toContain('model');
-            expect(props).toContain('timeout_minutes');
-            expect(props).toContain('validate');
-            // max_turns removed — not relevant for parallel agents
-            expect(props).not.toContain('max_turns');
-        });
-        it('is included in getToolDefinitions when includeSpawnSubagent is true', async () => {
-            const tools = await getToolDefinitions(toolConfig, { includeAgentTools: true });
-            expect(tools.map(t => t.name)).toContain('code_with_team');
-        });
-        it('is excluded from getToolDefinitions when includeSpawnSubagent is false', async () => {
-            const tools = await getToolDefinitions(toolConfig);
-            expect(tools.map(t => t.name)).not.toContain('code_with_team');
-        });
-    });
-    describe('executeTool routing', () => {
-        it('rejects workdir outside allowed paths', async () => {
-            const result = await executeTool('code_with_team', {
-                task: 'refactor auth',
-                workdir: '/tmp/not-allowed',
-            }, toolConfig);
-            expect(result).toContain('Error: Working directory not allowed');
-        });
-        it('returns error when task is missing', async () => {
-            const result = await executeTool('code_with_team', {}, toolConfig);
-            expect(result).toContain('Error: task is required');
-        });
-        it('returns error when agent is invalid', async () => {
-            const result = await executeTool('code_with_team', {
-                task: 'refactor auth',
-                agent: 'not-a-real-agent',
-            }, toolConfig);
-            expect(result).toContain('Error: Invalid agent');
-        });
-    });
-});
-describe('decomposeTask', () => {
-    it('falls back to numbered subtasks with DecomposedSubtask format on error', async () => {
-        // decomposeTask with no valid config will fail the model call and use fallback
-        const mockConfig = {
-            agents: { list: {} },
-        };
-        const subtasks = await decomposeTask('fix everything', 3, mockConfig);
-        expect(subtasks).toHaveLength(3);
-        expect(subtasks[0].description).toContain('Part 1 of 3');
-        expect(subtasks[1].description).toContain('Part 2 of 3');
-        expect(subtasks[2].description).toContain('Part 3 of 3');
-        expect(subtasks[0].description).toContain('fix everything');
-        // Fallback produces all-independent subtasks
-        expect(subtasks[0].dependsOn).toEqual([]);
-        expect(subtasks[1].dependsOn).toEqual([]);
-        expect(subtasks[2].dependsOn).toEqual([]);
-    });
-});
-describe('computeWaves', () => {
-    it('puts all independent subtasks in a single wave', () => {
-        const subtasks = [
-            { description: 'task A', dependsOn: [] },
-            { description: 'task B', dependsOn: [] },
-            { description: 'task C', dependsOn: [] },
-        ];
-        const waves = computeWaves(subtasks);
-        expect(waves).toHaveLength(1);
-        expect(waves[0]).toEqual([0, 1, 2]);
-    });
-    it('creates sequential waves for a dependency chain', () => {
-        const subtasks = [
-            { description: 'schema', dependsOn: [] },
-            { description: 'queries', dependsOn: [0] },
-            { description: 'tests', dependsOn: [1] },
-        ];
-        const waves = computeWaves(subtasks);
-        expect(waves).toHaveLength(3);
-        expect(waves[0]).toEqual([0]);
-        expect(waves[1]).toEqual([1]);
-        expect(waves[2]).toEqual([2]);
-    });
-    it('groups tasks with shared dependency into the same wave', () => {
-        const subtasks = [
-            { description: 'schema', dependsOn: [] },
-            { description: 'API endpoints', dependsOn: [0] },
-            { description: 'admin endpoints', dependsOn: [0] },
-            { description: 'integration tests', dependsOn: [1, 2] },
-        ];
-        const waves = computeWaves(subtasks);
-        expect(waves).toHaveLength(3);
-        expect(waves[0]).toEqual([0]);
-        expect(waves[1].sort()).toEqual([1, 2]);
-        expect(waves[2]).toEqual([3]);
-    });
-    it('handles mixed independent and dependent tasks', () => {
-        const subtasks = [
-            { description: 'setup types', dependsOn: [] },
-            { description: 'write docs', dependsOn: [] },
-            { description: 'implement using types', dependsOn: [0] },
-        ];
-        const waves = computeWaves(subtasks);
-        expect(waves).toHaveLength(2);
-        expect(waves[0].sort()).toEqual([0, 1]);
-        expect(waves[1]).toEqual([2]);
-    });
-    it('handles dependency cycles by forcing remaining into current wave', () => {
-        const subtasks = [
-            { description: 'A depends on B', dependsOn: [1] },
-            { description: 'B depends on A', dependsOn: [0] },
-        ];
-        const waves = computeWaves(subtasks);
-        // Both should end up in a wave despite the cycle
-        const allIndices = waves.flat().sort();
-        expect(allIndices).toEqual([0, 1]);
-    });
-    it('handles single subtask', () => {
-        const subtasks = [
-            { description: 'only task', dependsOn: [] },
-        ];
-        const waves = computeWaves(subtasks);
-        expect(waves).toHaveLength(1);
-        expect(waves[0]).toEqual([0]);
-    });
-    it('handles empty subtask list', () => {
-        const waves = computeWaves([]);
-        expect(waves).toHaveLength(0);
-    });
-});
-describe('synthesizeResults', () => {
-    it('falls back to mechanical summary on error', async () => {
-        const mockConfig = {
-            agents: { list: {} },
-        };
-        const results = [
-            { subtask: 'fix auth', status: 'completed', output: 'done' },
-            { subtask: 'fix tests', status: 'failed', error: 'timeout' },
-        ];
-        const summary = await synthesizeResults('fix everything', results, mockConfig);
-        expect(summary).toContain('1/2 subtasks succeeded');
-        expect(summary).toContain('1 failed');
-        expect(summary).toContain('fix auth');
-        expect(summary).toContain('fix tests');
-    });
-});
-describe('readTeamState (deprecated)', () => {
-    it('always returns null', () => {
-        const state = readTeamState();
-        expect(state).toBeNull();
-    });
-});

package/dist/__tests__/utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/utils.test.js

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import { validateBearerToken } from '../utils.js';
+describe('validateBearerToken', () => {
+    it('accepts valid bearer token', () => {
+        expect(validateBearerToken('abc123', 'Bearer abc123')).toBe(true);
+    });
+    it('rejects invalid bearer token', () => {
+        expect(validateBearerToken('abc123', 'Bearer nope')).toBe(false);
+    });
+    it('rejects missing or malformed auth headers', () => {
+        expect(validateBearerToken('abc123', undefined)).toBe(false);
+        expect(validateBearerToken('abc123', 'Basic abc123')).toBe(false);
+    });
+});

package/dist/__tests__/voice.test.js

@@ -3,6 +3,9 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 const { mockAudioSpeechCreate } = vi.hoisted(() => ({
     mockAudioSpeechCreate: vi.fn(),
 }));
+const { mockSpawnSync } = vi.hoisted(() => ({
+    mockSpawnSync: vi.fn(() => ({ status: 0, stdout: '', stderr: '' })),
+}));
 // Mock openai — use a class so `new OpenAI()` works correctly in ESM mocking context
 vi.mock('openai', () => ({
     default: class MockOpenAI {
@@ -17,6 +20,7 @@ vi.mock('openai', () => ({
 // Mock child_process — execSync used by macOS say provider
 vi.mock('child_process', () => ({
     execSync: vi.fn(() => Buffer.from('')),
+    spawnSync: (...args) => mockSpawnSync(...args),
 }));
 // Mock fs to avoid actual disk I/O
 vi.mock('fs', async (importOriginal) => {
@@ -183,6 +187,23 @@ describe('synthesizeSpeech', () => {
             Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true });
         }
     });
+    it('uses non-shell args for macOS say + ffmpeg', async () => {
+        const originalPlatform = process.platform;
+        Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+        try {
+            const config = {
+                ...baseVoiceConfig,
+                providers: { macos: { tts: { voice: "Bad'Voice; rm -rf /" } } },
+            };
+            const result = await synthesizeSpeech("hello'; say hacked", config);
+            expect(result.format).toBe('ogg');
+            expect(mockSpawnSync).toHaveBeenNthCalledWith(1, 'say', ['-v', "Bad'Voice; rm -rf /", '-o', expect.stringContaining('.aiff'), "hello'; say hacked"], expect.any(Object));
+            expect(mockSpawnSync).toHaveBeenNthCalledWith(2, 'ffmpeg', ['-i', expect.stringContaining('.aiff'), '-c:a', 'libopus', expect.stringContaining('.ogg'), '-y'], expect.any(Object));
+        }
+        finally {
+            Object.defineProperty(process, 'platform', { value: originalPlatform, configurable: true });
+        }
+    });
     it('resolves API key from environment variable syntax', async () => {
         const fakeBuffer = Buffer.from('fake-audio');
         mockAudioSpeechCreate.mockResolvedValueOnce({

package/dist/agent.js

@@ -80,6 +80,12 @@ export function appendToMemory(agentId, entry) {
 // Langfuse app tagging
 const LANGFUSE_APP_NAME = 'skimpyclaw';
 const LANGFUSE_APP_TAG = 'app:skimpyclaw';
+const THINKING_LEVELS = new Set(['none', 'low', 'medium', 'high', 'xhigh']);
+function metadataThinking(value) {
+    return typeof value === 'string' && THINKING_LEVELS.has(value)
+        ? value
+        : undefined;
+}
 export async function runAgentTurn(agentId, userMessage, config, modelOverride, toolConfig, history, context) {
     const agentConfig = config.agents.list[agentId];
     if (!agentConfig) {
@@ -94,11 +100,27 @@ export async function runAgentTurn(agentId, userMessage, config, modelOverride,
     // Inject channel-specific formatting context
     if (context?.channel) {
         const channelHints = {
-            telegram: `\n\n## Output Channel: Telegram\nTelegram does NOT render markdown. Use plain text only.\n- No **bold**, _italic_, or \`code blocks\`\n- Use CAPS or spacing for emphasis\n- Use plain dashes for lists\n- Include full URLs as plain text (no markdown links)`,
-            discord: `\n\n## Output Channel: Discord\nDiscord renders markdown. Use it for formatting.\n- Use **bold**, *italic*, \`code\`, and \`\`\`code blocks\`\`\`\n- Use markdown links: [text](url)\n- Use bullet lists and headers`,
+            telegram: `\n\n## Channel: Telegram\nPlain text only. No markdown. Use CAPS for emphasis, plain URLs.`,
+            discord: `\n\n## Channel: Discord\nUse markdown: **bold**, *italic*, \`code\`, \`\`\`blocks\`\`\`, [links](url).`,
         };
         systemPrompt += channelHints[context.channel] || '';
     }
+    const metadata = context?.metadata;
+    const threadAgentAlias = typeof metadata?.threadAgentAlias === 'string'
+        ? metadata.threadAgentAlias.trim()
+        : '';
+    const threadAgentPrompt = typeof metadata?.threadAgentPromptOverlay === 'string'
+        ? metadata.threadAgentPromptOverlay.trim()
+        : '';
+    if (threadAgentAlias || threadAgentPrompt) {
+        systemPrompt += `\n\n## Discord Thread Agent`;
+        if (threadAgentAlias) {
+            systemPrompt += `\nAlias: ${threadAgentAlias}`;
+        }
+        if (threadAgentPrompt) {
+            systemPrompt += `\nFollow this additional thread-specific prompt:\n${threadAgentPrompt}`;
+        }
+    }
     // Build user content — support both string and content arrays (for images)
     let userContent;
     let sanitizedMessage;
@@ -123,7 +145,10 @@ export async function runAgentTurn(agentId, userMessage, config, modelOverride,
         { role: 'user', content: userContent },
     ];
     const model = modelOverride || agentConfig.model;
-    const chatOptions = { model, thinking: agentConfig.thinking };
+    const thinking = metadataThinking(metadata?.threadAgentThinking)
+        ?? metadataThinking(metadata?.thinkingOverride)
+        ?? agentConfig.thinking;
+    const chatOptions = { model, thinking };
     const route = resolveProviderRoute(model, config);
     const { resolvedModel, provider, modelId } = route;
     let response = '';
@@ -152,9 +177,15 @@ export async function runAgentTurn(agentId, userMessage, config, modelOverride,
         channelTargetId,
         approverUserId: context?.userId,
         approverUsername: context?.metadata?.username,
-        sandboxConfig: config.sandbox,
         sessionId: context?.sessionId || String(chatIdNum ?? 'default'),
         isCronJob: context?.metadata?.isCronJob === true,
+        discordThreadId: context?.metadata?.discordThreadId,
+        discordChannelId: context?.metadata?.discordChannelId,
+        isDm: context?.metadata?.isDm === true,
+        threadAgentAlias,
+        delegationDepth: typeof context?.metadata?.delegationDepth === 'number'
+            ? (context?.metadata).delegationDepth
+            : 0,
     };
     const runTurn = async () => {
         if (toolConfig?.enabled) {