Merge web changes from brandon/base-lite branch

- Rename jest.config.js to jest.config.cjs with additional module mapping
- Add next-auth mocking to prevent SessionProvider requirements in tests
- Implement comprehensive subagent resolution functionality with validation
- Add extensive test coverage for subagent resolution logic

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

Author: brandonkachen

web/jest.config.js web/jest.config.cjsweb/jest.config.js renamed to web/jest.config.cjs

@@ -11,6 +11,7 @@ const config = {
   moduleNameMapper: {
     '^@/(.*)$': '<rootDir>/src/$1',
     '^common/(.*)$': '<rootDir>/../common/src/$1',
+    '^@codebuff/internal/xml-parser$': '<rootDir>/src/test-stubs/xml-parser.ts',
   },
 }
 

web/src/__tests__/unit/home.spec.tsx

@@ -1,5 +1,10 @@
 import { render, screen } from '@testing-library/react'
 
+// Mock next-auth session to avoid requiring a SessionProvider
+jest.mock('next-auth/react', () => ({
+  useSession: () => ({ data: null, status: 'unauthenticated' }),
+}))
+
 import Home from '../../app/page'
 
 // Mock window.matchMedia

web/src/app/api/agents/publish/__tests__/subagent-resolution.test.ts

@@ -0,0 +1,93 @@
+import { resolveAndValidateSubagents, SubagentResolutionError, type AgentVersionEntry } from '../subagent-resolution'
+
+describe('resolveAndValidateSubagents', () => {
+  const requestedPublisherId = 'me'
+
+  function makeAgents(entries: { id: string; version: string; spawnableAgents?: string[] }[]): AgentVersionEntry[] {
+    return entries.map((e) => ({ id: e.id, version: e.version, data: { id: e.id, version: e.version, spawnableAgents: e.spawnableAgents } }))
+  }
+
+  test('simple same-publisher id resolves to batch version when present', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['file-picker'] },
+      { id: 'file-picker', version: '1.0.11' },
+    ])
+
+    const exists = (full: string) => full === 'me/file-picker@1.0.11' || full === 'me/file-explorer@1.0.10'
+    const latest = async () => null
+
+    await resolveAndValidateSubagents({
+      agents,
+      requestedPublisherId,
+      existsInSamePublisher: exists,
+      getLatestPublishedVersion: latest,
+    })
+
+    expect(agents[0].data.spawnableAgents).toEqual(['me/file-picker@1.0.11'])
+  })
+
+  test('simple same-publisher id resolves to latest published when not in batch', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['file-picker'] },
+    ])
+
+    const exists = (full: string) => full === 'me/file-explorer@1.0.10' || full === 'me/file-picker@1.0.9'
+    const latest = async (pub: string, id: string) => (pub === 'me' && id === 'file-picker' ? '1.0.9' : null)
+
+    await resolveAndValidateSubagents({ agents, requestedPublisherId, existsInSamePublisher: exists, getLatestPublishedVersion: latest })
+
+    expect(agents[0].data.spawnableAgents).toEqual(['me/file-picker@1.0.9'])
+  })
+
+  test('fully-qualified same-publisher refs are kept and validated', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['me/file-picker@1.0.8'] },
+    ])
+
+    const exists = (full: string) => full === 'me/file-picker@1.0.8' || full === 'me/file-explorer@1.0.10'
+    const latest = async () => null
+
+    await resolveAndValidateSubagents({ agents, requestedPublisherId, existsInSamePublisher: exists, getLatestPublishedVersion: latest })
+
+    expect(agents[0].data.spawnableAgents).toEqual(['me/file-picker@1.0.8'])
+  })
+
+  test('cross-publisher simple refs resolve to latest without same-publisher validation', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['other/file-picker'] },
+    ])
+
+    const exists = (full: string) => full === 'me/file-explorer@1.0.10'
+    const latest = async (pub: string, id: string) => (pub === 'other' && id === 'file-picker' ? '2.0.1' : null)
+
+    await resolveAndValidateSubagents({ agents, requestedPublisherId, existsInSamePublisher: exists, getLatestPublishedVersion: latest })
+
+    expect(agents[0].data.spawnableAgents).toEqual(['other/file-picker@2.0.1'])
+  })
+
+  test('throws when simple ref has no published versions', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['missing'] },
+    ])
+
+    const exists = (full: string) => full === 'me/file-explorer@1.0.10'
+    const latest = async () => null
+
+    await expect(
+      resolveAndValidateSubagents({ agents, requestedPublisherId, existsInSamePublisher: exists, getLatestPublishedVersion: latest })
+    ).rejects.toBeInstanceOf(SubagentResolutionError)
+  })
+
+  test('throws when fully-qualified same-publisher ref does not exist', async () => {
+    const agents = makeAgents([
+      { id: 'file-explorer', version: '1.0.10', spawnableAgents: ['me/file-picker@1.0.0'] },
+    ])
+
+    const exists = (full: string) => full === 'me/file-explorer@1.0.10' // not the picker
+    const latest = async () => null
+
+    await expect(
+      resolveAndValidateSubagents({ agents, requestedPublisherId, existsInSamePublisher: exists, getLatestPublishedVersion: latest })
+    ).rejects.toBeInstanceOf(SubagentResolutionError)
+  })
+})

web/src/app/api/agents/publish/route.ts

@@ -8,18 +8,23 @@ import {
   stringifyVersion,
   versionExists,
 } from '@codebuff/internal'
-import { eq, and, or } from 'drizzle-orm'
+import { eq, and, or, desc } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
 import { getServerSession } from 'next-auth'
 
+import { logger } from '@/util/logger'
+
+import {
+  resolveAndValidateSubagents,
+  SubagentResolutionError,
+  type AgentVersionEntry,
+} from './subagent-resolution'
 import { authOptions } from '../../auth/[...nextauth]/auth-options'
 
 import type { DynamicAgentTemplate } from '@codebuff/common/types/dynamic-agent-template'
 import type { Version } from '@codebuff/internal'
 import type { NextRequest } from 'next/server'
 
-import { logger } from '@/util/logger'
-
 async function getPublishedAgentIds(publisherId: string) {
   const agents = await db
     .select({
@@ -228,34 +233,57 @@ export async function POST(request: NextRequest) {
     )
     const publishedAgentIds = await getPublishedAgentIds(requestedPublisherId)
 
-    for (const agent of agents) {
-      if (agent.spawnableAgents) {
-        for (const subagent of agent.spawnableAgents) {
-          const versionMatch = subagent.match(/^([^/]+)\/(.+)@(.+)$/)
-          if (!versionMatch) {
-            return NextResponse.json(
-              {
-                error: 'Invalid spawnable agent format',
-                details: `Agent '${agent.id}' references spawnable agent '${subagent}' with an invalid format. Expected format: {publisherId}/{agentId}@{version}`,
-              },
-              { status: 400 }
-            )
-          }
-
-          if (
-            !publishingAgentIds.has(subagent) &&
-            !publishedAgentIds.has(subagent)
-          ) {
-            return NextResponse.json(
-              {
-                error: 'Invalid spawnable agent',
-                details: `Agent '${agent.id}' references spawnable agent '${subagent}' which is not published and not included in this request.`,
-              },
-              { status: 400 }
-            )
-          }
-        }
+    const existsInSamePublisher = (full: string) =>
+      publishingAgentIds.has(full) || publishedAgentIds.has(full)
+
+    async function getLatestPublishedVersion(
+      publisherId: string,
+      agentId: string
+    ): Promise<string | null> {
+      const latest = await db
+        .select({ version: schema.agentConfig.version })
+        .from(schema.agentConfig)
+        .where(
+          and(
+            eq(schema.agentConfig.publisher_id, publisherId),
+            eq(schema.agentConfig.id, agentId)
+          )
+        )
+        .orderBy(
+          desc(schema.agentConfig.major),
+          desc(schema.agentConfig.minor),
+          desc(schema.agentConfig.patch)
+        )
+        .limit(1)
+        .then((rows) => rows[0])
+      return latest?.version ?? null
+    }
+
+    const agentEntries: AgentVersionEntry[] = agentVersions.map((av) => ({
+      id: av.id,
+      version: stringifyVersion(av.version),
+      data: av.data,
+    }))
+
+    try {
+      await resolveAndValidateSubagents({
+        agents: agentEntries,
+        requestedPublisherId,
+        existsInSamePublisher,
+        getLatestPublishedVersion,
+      })
+    } catch (err) {
+      if (err instanceof SubagentResolutionError) {
+        return NextResponse.json(
+          {
+            error: 'Invalid spawnable agent',
+            details: err.message,
+            hint: "To fix this, also publish the referenced agent (include it in the same request's data array, or publish it first for the same publisher).",
+          },
+          { status: 400 }
+        )
       }
+      throw err
     }
 
     // If we get here, all agents can be published. Insert them all in a transaction

web/src/app/api/agents/publish/subagent-resolution.ts

@@ -0,0 +1,115 @@
+export class SubagentResolutionError extends Error {}
+
+export type AgentVersionEntry = {
+  id: string
+  version: string // stringified
+  data: any // must contain optional `spawnableAgents?: string[]`
+}
+
+// Resolves subagent references to fully-qualified form and validates them.
+// Behavior parity with existing route logic:
+// - For already fully-qualified refs (publisher/id@version):
+//   - Validate only for same-publisher via `existsInSamePublisher`, else error
+// - For simple refs ("id" or "publisher/id"):
+//   - Prefer batch version for same publisher
+//   - Otherwise resolve to latest published via `getLatestPublishedVersion`
+//   - For same-publisher, validate existence via `existsInSamePublisher`
+export async function resolveAndValidateSubagents(params: {
+  agents: AgentVersionEntry[]
+  requestedPublisherId: string
+  // Returns latest published version string or null if none
+  getLatestPublishedVersion: (
+    publisherId: string,
+    agentId: string
+  ) => Promise<string | null>
+  // Checks if a fully-qualified ref exists within the same publisher context
+  existsInSamePublisher: (fullyQualifiedRef: string) => boolean
+}): Promise<void> {
+  const {
+    agents,
+    requestedPublisherId,
+    getLatestPublishedVersion,
+    existsInSamePublisher,
+  } = params
+
+  const publishingVersionsById = new Map<string, string>(
+    agents.map(({ id, version }) => [id, version])
+  )
+
+  const fqRegex = /^([^/]+)\/(.+)@(.+)$/
+  const publisherIdRegex = /^([^/]+)\/(.+)$/
+
+  for (const agentEntry of agents) {
+    const agent = agentEntry.data
+
+    // Determine input list with backward-compat (prefer spawnableAgents)
+    const inputList: string[] = (agent?.spawnableAgents ??
+      agent?.subagents ??
+      []) as string[]
+    if (!inputList || inputList.length === 0) continue
+
+    const transformed: string[] = []
+    // Iterate over normalized list (supports spawnableAgents or legacy subagents)
+    for (const sub of inputList) {
+      const fqMatch = sub.match(fqRegex)
+      if (fqMatch) {
+        const fullKey = sub
+        // Validate only for same publisher (to match existing behavior)
+        const [pub] = fullKey.split('/')
+        if (pub === requestedPublisherId) {
+          if (!existsInSamePublisher(fullKey)) {
+            throw new SubagentResolutionError(
+              `Invalid spawnable agent: '${sub}' is not published and not included in this request.`
+            )
+          }
+        }
+        transformed.push(fullKey)
+        continue
+      }
+
+      // Handle simple refs: 'id' or 'publisher/id'
+      let targetPublisher = requestedPublisherId
+      let targetId = sub
+      const pubMatch = sub.match(publisherIdRegex)
+      if (pubMatch) {
+        targetPublisher = pubMatch[1]!
+        targetId = pubMatch[2]!
+      }
+
+      // Prefer batch version for same publisher
+      let resolvedVersion: string | null = null
+      if (
+        targetPublisher === requestedPublisherId &&
+        publishingVersionsById.has(targetId)
+      ) {
+        resolvedVersion = publishingVersionsById.get(targetId)!
+      } else {
+        resolvedVersion = await getLatestPublishedVersion(
+          targetPublisher,
+          targetId
+        )
+      }
+
+      if (!resolvedVersion) {
+        throw new SubagentResolutionError(
+          `Invalid spawnable agent: '${sub}' has no published versions to resolve to.`
+        )
+      }
+
+      const full = `${targetPublisher}/${targetId}@${resolvedVersion}`
+
+      if (
+        targetPublisher === requestedPublisherId &&
+        !existsInSamePublisher(full)
+      ) {
+        throw new SubagentResolutionError(
+          `Invalid spawnable agent: '${sub}' resolves to '${full}' but is not published and not included in this request.`
+        )
+      }
+
+      transformed.push(full)
+    }
+
+    agent.spawnableAgents = transformed
+  }
+}