@desplega.ai/agent-swarm 1.104.0 → 1.105.0

package/dist/{pricing-refresh-nqyf8bkb.js → pricing-refresh-dt289v11.js}

@@ -2,13 +2,13 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-w1nfskkg.js";
-import"./cli-7v4y3hyd.js";
-import"./cli-0jw6j755.js";
+} from "./cli-8y7y1vmp.js";
+import"./cli-7esh9fda.js";
+import"./cli-wztagmpk.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-yjt8a36k.js";
+import"./cli-ehcjr5vs.js";
 import"./cli-3pp1362w.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{seed-pricing-w3x550cj.js → seed-pricing-183er9b3.js}

@@ -1,12 +1,12 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-7v4y3hyd.js";
-import"./cli-0jw6j755.js";
+} from "./cli-7esh9fda.js";
+import"./cli-wztagmpk.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-yjt8a36k.js";
+import"./cli-ehcjr5vs.js";
 import"./cli-3pp1362w.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{setup-7729ktfj.js → setup-tjgsvznx.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-q5tshxd6.js";
+} from "./cli-4df7btj0.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-6n1nnzm7.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-yjt8a36k.js";
+import"./cli-ehcjr5vs.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-4ttemwhw.js → worker-nxcxk5pb.js}

@@ -1,6 +1,6 @@
 import {
   runAgent
-} from "./cli-23zk7xqy.js";
+} from "./cli-2hg6bj31.js";
 import"./cli-khe4x17a.js";
 import"./cli-p03mawph.js";
 import"./cli-4wmnp8q3.js";
@@ -15,7 +15,7 @@ import"./cli-d6n0thxw.js";
 import"./cli-hx1dcevq.js";
 import {
   getEnabledCapabilities
-} from "./cli-qvzgncd8.js";
+} from "./cli-sdf2qwkt.js";
 import"./cli-09rxrad0.js";
 import"./cli-dcfyyh3t.js";
 import"./cli-gz9sbyk3.js";
@@ -24,32 +24,32 @@ import"./cli-psrqtw2m.js";
 import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
 import"./cli-0k9dc6ks.js";
-import"./cli-2g9jf9ek.js";
-import"./cli-w1nfskkg.js";
-import"./cli-7v4y3hyd.js";
-import"./cli-s42f54ja.js";
-import"./cli-54h5daha.js";
+import"./cli-yd29d4n4.js";
+import"./cli-8y7y1vmp.js";
+import"./cli-7esh9fda.js";
+import"./cli-87fj1jk4.js";
+import"./cli-v2fb1fxf.js";
 import"./cli-f14fvzag.js";
-import"./cli-v1syqkcb.js";
-import"./cli-5pf0b84v.js";
-import"./cli-p4cj4vhc.js";
+import"./cli-0e24r2b6.js";
+import"./cli-dd6tegmp.js";
+import"./cli-634jy7sa.js";
 import"./cli-3j01d33e.js";
 import"./cli-fad8m16k.js";
-import"./cli-y9p3e94h.js";
-import"./cli-zghef0em.js";
-import"./cli-nzc0h54v.js";
-import"./cli-zaxksbgj.js";
+import"./cli-yzr0qxx1.js";
+import"./cli-gq7gvvrn.js";
+import"./cli-0n4xxmy0.js";
+import"./cli-gzmv1371.js";
 import"./cli-fete3y1e.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-yvektv79.js";
+import"./cli-yfyqsqzj.js";
 import"./cli-z92pkwzn.js";
 import"./cli-dh55d5fg.js";
-import"./cli-e7bwjntj.js";
-import"./cli-0jw6j755.js";
+import"./cli-0s37sw3k.js";
+import"./cli-wztagmpk.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-yjt8a36k.js";
+import"./cli-ehcjr5vs.js";
 import"./cli-3pp1362w.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.104.0",
+    "version": "1.105.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.104.0",
+  "version": "1.105.0",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",
@@ -124,8 +124,10 @@
     "@opencode-ai/sdk": "^1.17.11",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
     "@opentelemetry/resources": "^2.7.1",
+    "@opentelemetry/sdk-metrics": "^2.7.1",
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/semantic-conventions": "^1.41.1",
     "@slack/bolt": "^4.6.0",

package/src/http/pages-public.ts

@@ -150,6 +150,106 @@ function injectBrowserSdk(html: string): string {
   return injection + html;
 }
 
+/**
+ * Self-print snippet appended to the served document when the export button
+ * opens `/p/:id?print=1`. The page prints ITSELF in the user's own browser —
+ * no server-side headless browser. We wait for `load` + webfonts + a short
+ * tick so the Tailwind Play CDN JIT pass and font swap settle before the
+ * print dialog opens, otherwise the PDF can capture an unstyled flash.
+ */
+const PRINT_AUTOTRIGGER_SCRIPT = `<script>
+  (function () {
+    function print() { setTimeout(function () { window.print(); }, 400); }
+    window.addEventListener("load", function () {
+      var fonts = document.fonts;
+      if (fonts && fonts.ready && typeof fonts.ready.then === "function") {
+        fonts.ready.then(print, print);
+      } else {
+        print();
+      }
+    });
+  })();
+</script>`;
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+}
+
+/**
+ * Standalone, self-contained HTML for printing a JSON page. JSON pages have no
+ * agent-authored HTML body (the SPA renders the tree), so `/p/:id` normally
+ * 302s to the SPA. For `?print=1` we serve this minimal light-themed document
+ * — pretty-printed JSON in a wrapping `<pre>` — and let the browser print it.
+ */
+function printableJsonPageHtml(page: Page): string {
+  let body = page.body;
+  try {
+    body = JSON.stringify(JSON.parse(page.body), null, 2);
+  } catch {
+    // Preserve the original body when the stored payload is not valid JSON.
+  }
+  const description = page.description
+    ? `<p class="description">${escapeHtml(page.description)}</p>`
+    : "";
+  return `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>${escapeHtml(page.title)}</title>
+    <style>
+      body {
+        color: #111827;
+        font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        line-height: 1.5;
+        margin: 0;
+        padding: 24px;
+      }
+      h1 {
+        font-size: 24px;
+        line-height: 1.2;
+        margin: 0 0 8px;
+      }
+      .description {
+        color: #4b5563;
+        margin: 0 0 20px;
+      }
+      pre {
+        background: #f8fafc;
+        border: 1px solid #e5e7eb;
+        border-radius: 6px;
+        color: #111827;
+        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+        font-size: 11px;
+        line-height: 1.45;
+        margin: 0;
+        overflow-wrap: anywhere;
+        padding: 16px;
+        white-space: pre-wrap;
+      }
+    </style>
+  </head>
+  <body>
+    <h1>${escapeHtml(page.title)}</h1>
+    ${description}
+    <pre>${escapeHtml(body)}</pre>
+    ${PRINT_AUTOTRIGGER_SCRIPT}
+  </body>
+</html>`;
+}
+
 /**
  * Trim `.json` off the last path segment, returning the bare id. Returns
  * `null` if the segment doesn't end in `.json` (caller should fall through
@@ -465,8 +565,28 @@ export async function handlePagesPublic(
     return true;
   }
 
+  // `?print=1` — the SPA's "Export PDF" button opens the page in a new tab
+  // with this flag so the page self-prints in the user's own browser (no
+  // server-side headless browser). HTML pages get the auto-print snippet
+  // appended; JSON pages — which normally 302 to the SPA — are served as a
+  // standalone printable document instead.
+  const wantsPrint = queryParams.get("print") === "1";
+
   // `/p/:id` — render either HTML directly or 302→SPA for JSON.
   if (page.contentType === "application/json") {
+    if (wantsPrint) {
+      const headers: Record<string, string> = {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": buildCsp(),
+        "X-Content-Type-Options": "nosniff",
+      };
+      if (inlineSetCookie) headers["Set-Cookie"] = inlineSetCookie;
+      res.writeHead(200, headers);
+      res.end(printableJsonPageHtml(page));
+      bumpViewCount(page.id);
+      return true;
+    }
     const headers: Record<string, string> = { Location: `${getAppBaseUrl()}/pages/${page.id}` };
     if (inlineSetCookie) headers["Set-Cookie"] = inlineSetCookie;
     res.writeHead(302, headers);
@@ -477,8 +597,9 @@ export async function handlePagesPublic(
     return true;
   }
 
-  // text/html — inject SDK + serve.
-  const html = injectBrowserSdk(page.body);
+  // text/html — inject SDK + serve. Append the self-print snippet when the
+  // export button requested it.
+  const html = injectBrowserSdk(page.body) + (wantsPrint ? PRINT_AUTOTRIGGER_SCRIPT : "");
   const headers: Record<string, string> = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",

package/src/http/session-data.ts

@@ -14,6 +14,7 @@ import {
   getTaskById,
 } from "../be/db";
 import { normalizeModelKey } from "../be/pricing-normalize";
+import { recordSessionCost } from "../otel";
 import { incrementServerSessionsProcessed } from "../server-runtime-counters";
 import type { SessionCost, SessionCostSource } from "../types";
 import { route } from "./route-def";
@@ -291,6 +292,21 @@ export async function handleSessionData(
         isError: parsed.body.isError ?? false,
         costSource,
       });
+      recordSessionCost({
+        totalCostUsd,
+        harness: parsed.body.provider ?? "unknown",
+        model,
+        costSource,
+        isError: parsed.body.isError ?? false,
+        tokens: {
+          input: inputTokens,
+          output: outputTokens,
+          cacheRead: cachedInputTokens,
+          cacheWrite: parsed.body.cacheWriteTokens ?? 0,
+          reasoning: parsed.body.reasoningOutputTokens ?? 0,
+          thinking: parsed.body.thinkingTokens ?? 0,
+        },
+      });
       incrementServerSessionsProcessed();
       json(res, { success: true, cost }, 201);
     } catch (error) {

package/src/otel-impl.ts

@@ -1,11 +1,14 @@
 import {
+  type Counter,
   context,
+  metrics,
   propagation,
   ROOT_CONTEXT,
   type Span,
   SpanStatusCode,
   trace,
 } from "@opentelemetry/api";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
 import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
 import {
   hostDetector,
@@ -13,6 +16,7 @@ import {
   processDetector,
   resourceFromAttributes,
 } from "@opentelemetry/resources";
+import { PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
 import { NodeSDK } from "@opentelemetry/sdk-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import pkg from "../package.json";
@@ -23,9 +27,12 @@ type AttributeValue = string | number | boolean | string[] | number[] | boolean[
 type Attributes = Record<string, AttributeValue | undefined>;
 
 const TRACER_NAME = "agent-swarm";
+const METER_NAME = "agent-swarm";
 const RAW_SPAN = Symbol("agent-swarm.raw-span");
 
 let sdk: NodeSDK | undefined;
+let costCounter: Counter | undefined;
+let tokenCounter: Counter | undefined;
 
 function decodeResourceAttributeValue(value: string): string {
   try {
@@ -158,6 +165,14 @@ export async function boot(serviceRole: string): Promise<void> {
     // parsed `OTEL_RESOURCE_ATTRIBUTES`) then stays authoritative.
     resourceDetectors: [hostDetector, osDetector, processDetector],
     traceExporter: new OTLPTraceExporter(),
+    // Metrics: export on the same OTLP pipeline as traces so both signals share
+    // the same resource (service.name, agentswarm.service.role, etc.). Temporality
+    // is intentionally NOT hardcoded — operators should set
+    // OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE=delta for Datadog.
+    metricReader: new PeriodicExportingMetricReader({
+      exporter: new OTLPMetricExporter(),
+      exportIntervalMillis: 60_000,
+    }),
   });
 
   sdk.start();
@@ -228,3 +243,61 @@ export function injectTraceContext(headers: Record<string, string>): Record<stri
   propagation.inject(context.active(), headers);
   return headers;
 }
+
+export interface SessionCostMetric {
+  totalCostUsd: number;
+  harness: string;
+  model: string;
+  costSource: string;
+  isError: boolean;
+  tokens: {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    reasoning: number;
+    thinking: number;
+  };
+}
+
+function ensureInstruments(): void {
+  if (costCounter) return;
+  const meter = metrics.getMeter(METER_NAME);
+  costCounter = meter.createCounter("agentswarm.cost.usd", {
+    description: "USD cost per finalized cost record",
+    unit: "{usd}",
+  });
+  tokenCounter = meter.createCounter("agentswarm.tokens", {
+    description: "Tokens per finalized cost record",
+    unit: "{token}",
+  });
+}
+
+export function recordSessionCost(m: SessionCostMetric): void {
+  ensureInstruments();
+  // Scrub all free-form string attributes before they reach the OTLP exporter.
+  // `model` comes from the /api/session-costs request body and may contain
+  // arbitrary operator-supplied text; scrubbing prevents accidental secret egress.
+  const attrs = {
+    harness: scrubSecrets(m.harness || "unknown"),
+    model: scrubSecrets(m.model || "unknown"),
+    cost_source: scrubSecrets(m.costSource || "unknown"),
+    is_error: m.isError,
+  };
+  if (Number.isFinite(m.totalCostUsd) && m.totalCostUsd > 0) {
+    costCounter!.add(m.totalCostUsd, attrs);
+  }
+  for (const [token_type, n] of Object.entries(m.tokens)) {
+    if (Number.isFinite(n) && n > 0) {
+      tokenCounter!.add(n, { ...attrs, token_type });
+    }
+  }
+}
+
+export function _injectCountersForTests(
+  cost: Counter | undefined,
+  token: Counter | undefined,
+): void {
+  costCounter = cost;
+  tokenCounter = token;
+}

package/src/otel.ts

@@ -15,6 +15,10 @@ export type SwarmSpan = {
   end: () => void;
 };
 
+// eslint-disable-next-line import/no-duplicates -- type-only import, no side-effects
+import type { SessionCostMetric } from "./otel-impl";
+export type { SessionCostMetric };
+
 const enabled = Boolean(process.env.OTEL_EXPORTER_OTLP_ENDPOINT);
 
 const NOOP_SPAN: SwarmSpan = {
@@ -43,6 +47,7 @@ let realInjectTraceContext:
   | ((headers: Record<string, string>) => Record<string, string>)
   | undefined;
 let realShutdown: (() => Promise<void>) | undefined;
+let realRecordSessionCost: ((m: SessionCostMetric) => void) | undefined;
 
 export function isOtelEnabled(): boolean {
   return enabled;
@@ -66,6 +71,7 @@ export async function initOtel(serviceRole = process.env.AGENT_ROLE || "api"): P
     realWithSpanContext = impl.withSpanContext;
     realInjectTraceContext = impl.injectTraceContext;
     realShutdown = impl.shutdown;
+    realRecordSessionCost = impl.recordSessionCost;
     console.log(`[OTel] enabled for ${impl.resolveServiceName(serviceRole)} (${serviceRole})`);
   } catch (error) {
     console.warn(`[OTel] disabled after initialization failure: ${error}`);
@@ -119,6 +125,11 @@ export async function shutdownOtel(): Promise<void> {
   await realShutdown();
 }
 
+export function recordSessionCost(m: SessionCostMetric): void {
+  if (!enabled || !realRecordSessionCost) return;
+  realRecordSessionCost(m);
+}
+
 export function _resetOtelForTests() {
   initialized = false;
   realWithSpan = undefined;
@@ -127,4 +138,5 @@ export function _resetOtelForTests() {
   realWithSpanContext = undefined;
   realInjectTraceContext = undefined;
   realShutdown = undefined;
+  realRecordSessionCost = undefined;
 }

package/src/tests/otel-impl-secret-scrubbing.test.ts

@@ -1,9 +1,107 @@
-import { describe, expect, test } from "bun:test";
-import { scrubOtelException, scrubOtelStatus } from "../otel-impl";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import type { Counter } from "@opentelemetry/api";
+import {
+  _injectCountersForTests,
+  recordSessionCost,
+  scrubOtelException,
+  scrubOtelStatus,
+} from "../otel-impl";
 
 const SECRET = "ghp_1234567890abcdefghijklmnopqrstuv";
 
-describe("otel-impl secret scrubbing", () => {
+// Fake counter that records every add() call so tests can assert on the args.
+const addSpy = mock((..._args: unknown[]) => {});
+const fakeCounter = { add: addSpy } as unknown as Counter;
+
+describe("otel-impl metric attribute scrubbing", () => {
+  beforeEach(() => {
+    addSpy.mockClear();
+    _injectCountersForTests(fakeCounter, fakeCounter);
+  });
+
+  test("scrubs a token-like model value before Counter.add()", () => {
+    // Simulate a model field that accidentally contains a GitHub PAT.
+    // The token must not be preceded by a word char for the regex to match.
+    const secretModel = `model/${SECRET}`; // '/' is non-word → regex fires
+    recordSessionCost({
+      totalCostUsd: 0.01,
+      harness: "claude",
+      model: secretModel,
+      costSource: "harness",
+      isError: false,
+      tokens: { input: 1, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, thinking: 0 },
+    });
+
+    expect(addSpy).toHaveBeenCalled();
+    for (const call of addSpy.mock.calls) {
+      const attrs = call[1] as Record<string, unknown>;
+      expect(String(attrs.model)).not.toContain(SECRET);
+      expect(String(attrs.model)).toContain("[REDACTED:");
+    }
+  });
+
+  test("scrubs a token-like harness value before Counter.add()", () => {
+    recordSessionCost({
+      totalCostUsd: 0.01,
+      harness: `Bearer ${SECRET}`,
+      model: "claude-opus-4",
+      costSource: "pricing-table",
+      isError: false,
+      tokens: { input: 1, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, thinking: 0 },
+    });
+
+    expect(addSpy).toHaveBeenCalled();
+    for (const call of addSpy.mock.calls) {
+      const attrs = call[1] as Record<string, unknown>;
+      expect(String(attrs.harness)).not.toContain(SECRET);
+    }
+  });
+
+  test("zero totalCostUsd skips cost counter but still records tokens", () => {
+    recordSessionCost({
+      totalCostUsd: 0,
+      harness: "codex",
+      model: "gpt-4o",
+      costSource: "unpriced",
+      isError: false,
+      tokens: { input: 100, output: 50, cacheRead: 0, cacheWrite: 0, reasoning: 0, thinking: 0 },
+    });
+
+    // Two tokenCounter.add() calls (input + output), zero costCounter.add()
+    expect(addSpy.mock.calls.length).toBe(2);
+    const tokenTypes = addSpy.mock.calls.map((c) => (c[1] as Record<string, unknown>).token_type);
+    expect(tokenTypes).toContain("input");
+    expect(tokenTypes).toContain("output");
+  });
+
+  test("all six token_type values are emitted when non-zero", () => {
+    recordSessionCost({
+      totalCostUsd: 0.1,
+      harness: "claude",
+      model: "claude-sonnet-4-6",
+      costSource: "pricing-table",
+      isError: false,
+      tokens: {
+        input: 100,
+        output: 50,
+        cacheRead: 10,
+        cacheWrite: 5,
+        reasoning: 20,
+        thinking: 15,
+      },
+    });
+
+    const tokenCalls = addSpy.mock.calls.filter(
+      (c) => (c[1] as Record<string, unknown>).token_type !== undefined,
+    );
+    const emittedTypes = tokenCalls.map((c) => (c[1] as Record<string, unknown>).token_type);
+    expect(emittedTypes.sort()).toEqual(
+      ["cacheRead", "cacheWrite", "input", "output", "reasoning", "thinking"].sort(),
+    );
+  });
+});
+
+describe("otel-impl exception / status scrubbing", () => {
   test("scrubs Error messages and stacks before recording exceptions", () => {
     const error = new Error(`request failed with token ${SECRET}`);
     error.stack = `Error: request failed with token ${SECRET}\n    at fake`;