@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/src/http/config.ts

@@ -10,12 +10,13 @@ import {
   maskSecrets,
   upsertSwarmConfig,
 } from "../be/db";
+import { getUserGrant } from "../be/rbac-roles";
 import {
   isReservedConfigKey,
   reservedKeyError,
   validateConfigValue,
 } from "../be/swarm-config-guard";
-import { can, type PermissionVerb } from "../rbac";
+import { can, isRbacEnabled, type PermissionVerb } from "../rbac";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
@@ -23,6 +24,8 @@ import { route } from "./route-def";
 import { json, jsonError } from "./utils";
 
 const MAX_ENV_PRESENCE_KEYS = 200;
+const SECRETS_FORCE_MASK_NOTE =
+  " (secret values masked: reading unmasked secrets requires the lead agent)";
 
 // Config keys the API server owns for its own use and must NEVER hand out over
 // HTTP — workers/entrypoints read config to build their env, and the agent-fs
@@ -40,6 +43,25 @@ function singleHeader(req: IncomingMessage, name: string): string | undefined {
   return Array.isArray(raw) ? raw[0] : raw;
 }
 
+function userMayReadSecrets(req: IncomingMessage): boolean {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator") return true;
+  // Agent/no-user HTTP reads keep their pre-RBAC behavior; MCP get-config has
+  // the per-agent config.read.secrets gate.
+  if (auth?.kind !== "user") return true;
+  if (!isRbacEnabled()) return true;
+
+  const grant = getUserGrant(auth.userId);
+  return grant.grantsAll || grant.verbs.has("config.read.secrets");
+}
+
+function resolveSecretsRead(req: IncomingMessage, includeSecrets: boolean) {
+  if (!includeSecrets || userMayReadSecrets(req)) {
+    return { effectiveIncludeSecrets: includeSecrets, secretsNote: "" };
+  }
+  return { effectiveIncludeSecrets: false, secretsNote: SECRETS_FORCE_MASK_NOTE };
+}
+
 /**
  * Gate a config write/delete over HTTP (DES-445 follow-up).
  *
@@ -213,18 +235,22 @@ export async function handleConfig(
     const parsed = await getResolvedConfigRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(
       getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined),
     );
-    const result = includeSecrets ? configs : maskSecrets(configs);
-    if (includeSecrets) {
+    const result = effectiveIncludeSecrets ? configs : maskSecrets(configs);
+    if (effectiveIncludeSecrets) {
       for (const c of result) {
         if (c.isSecret && c.value) {
           registerVolatileSecret(c.value, `config:${c.key}`);
         }
       }
     }
-    json(res, { configs: result });
+    json(res, {
+      configs: result,
+      ...(secretsNote ? { message: `Found ${result.length} config(s).${secretsNote}` } : {}),
+    });
     return true;
   }
 
@@ -271,11 +297,15 @@ export async function handleConfig(
       jsonError(res, "Config not found", 404);
       return true;
     }
-    const singleResult = includeSecrets ? config : maskSecrets([config])[0]!;
-    if (includeSecrets && singleResult.isSecret && singleResult.value) {
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
+    const singleResult = effectiveIncludeSecrets ? config : maskSecrets([config])[0]!;
+    if (effectiveIncludeSecrets && singleResult.isSecret && singleResult.value) {
       registerVolatileSecret(singleResult.value, `config:${singleResult.key}`);
     }
-    json(res, singleResult);
+    json(res, {
+      ...singleResult,
+      ...(secretsNote ? { message: `Found 1 config(s).${secretsNote}` } : {}),
+    });
     return true;
   }
 
@@ -283,21 +313,25 @@ export async function handleConfig(
     const parsed = await listConfig.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(
       getSwarmConfigs({
         scope: parsed.query.scope || undefined,
         scopeId: parsed.query.scopeId || undefined,
       }),
     );
-    const listResult = includeSecrets ? configs : maskSecrets(configs);
-    if (includeSecrets) {
+    const listResult = effectiveIncludeSecrets ? configs : maskSecrets(configs);
+    if (effectiveIncludeSecrets) {
       for (const c of listResult) {
         if (c.isSecret && c.value) {
           registerVolatileSecret(c.value, `config:${c.key}`);
         }
       }
     }
-    json(res, { configs: listResult });
+    json(res, {
+      configs: listResult,
+      ...(secretsNote ? { message: `Found ${listResult.length} config(s).${secretsNote}` } : {}),
+    });
     return true;
   }
 

package/src/http/core.ts

@@ -10,17 +10,20 @@ import {
   shouldBlockPolling,
   updateAgentStatus,
 } from "../be/db";
+import { enqueueAdmissionRow } from "../be/rbac-audit";
+import { getUserGrant } from "../be/rbac-roles";
 import { initGitHub, resetGitHub } from "../github";
 import { initJira, resetJira } from "../jira";
 import { initLinear, resetLinear } from "../linear";
+import { decideAdmission, isRbacEnabled } from "../rbac";
 import { startSlackApp, stopSlackApp } from "../slack";
 import type { AgentStatus } from "../types";
 import { setRequestAuth } from "../utils/request-auth-context";
 import { refreshSecretScrubberCache } from "../utils/secret-scrubber";
 import { resolveHttpRequestAuth } from "./auth";
 import { generateOpenApiSpec, SCALAR_HTML } from "./openapi";
-import { isPublicRoute } from "./route-def";
-import { agentWithCapacity, getPathSegments, parseQueryParams } from "./utils";
+import { findRoute, isPublicRoute } from "./route-def";
+import { agentWithCapacity, getPathSegments, jsonError, parseQueryParams } from "./utils";
 
 /**
  * Load global swarm_config entries into process.env.
@@ -243,12 +246,13 @@ export async function handleCore(
   // either the global swarm key or an active user-bound `aswt_` token.
   const pathSegments = getPathSegments(req.url || "");
   const isUserMcpRoute = req.url === "/mcp-user";
+  let auth = null as ReturnType<typeof resolveHttpRequestAuth>;
   // `/mcp-user` runs its own `aswt_`-token auth in `handleMcpUser`; the swarm
   // API key must not gate it.
   if (isUserMcpRoute || isPublicRoute(req.method, pathSegments)) {
     setRequestAuth(req, null);
   } else {
-    const auth = resolveHttpRequestAuth(req, apiKey);
+    auth = resolveHttpRequestAuth(req, apiKey);
 
     if (!auth) {
       setRequestAuth(req, null);
@@ -259,6 +263,29 @@ export async function handleCore(
     setRequestAuth(req, auth);
   }
 
+  if (auth?.kind === "user" && isRbacEnabled()) {
+    const grant = getUserGrant(auth.userId);
+    if (!grant.grantsAll) {
+      const def = findRoute(req.method, pathSegments);
+      const decision = decideAdmission({
+        method: req.method ?? "",
+        rbac: def?.rbac,
+        routeKnown: def !== undefined,
+        grant,
+      });
+      enqueueAdmissionRow({
+        userId: auth.userId,
+        decision,
+        method: req.method,
+        route: def?.path ?? pathSegments.join("/"),
+      });
+      if (!decision.allow) {
+        jsonError(res, `Forbidden: ${decision.reason}`, 403);
+        return true;
+      }
+    }
+  }
+
   // POST /internal/reload-config — re-read swarm_config into process.env and re-init integrations
   if (req.method === "POST" && req.url === "/internal/reload-config") {
     try {

package/src/http/favorites.ts

@@ -28,11 +28,7 @@ const putFavorite = route({
   pattern: ["api", "favorites"],
   summary: "Set favorite state for an item",
   tags: ["Favorites"],
-  // Self-scoped write: the row is keyed to the authenticated user
-  // (resolveHttpAuditUserId), never a body-supplied id, so there is no
-  // cross-principal authorization to gate — a user can only favorite for
-  // themselves.
-  rbac: { ungated: "self-scoped to the authenticated user; no cross-principal access" },
+  rbac: { permission: "favorite.write.own" },
   body: z.object({
     itemType: FavoriteItemTypeSchema,
     itemId: z.string().min(1),

package/src/http/index.ts

@@ -29,7 +29,7 @@ import {
   withRemoteContext,
   withSpanContext,
 } from "../otel";
-import { clearAuditSink, setAuditSink } from "../rbac";
+import { clearAuditSink, isRbacEnabled, setAuditSink } from "../rbac";
 import { startScriptRunSupervisor, stopScriptRunSupervisor } from "../script-workflows/supervisor";
 import { getServerSessionsProcessed } from "../server-runtime-counters";
 import { startSlackApp, stopSlackApp } from "../slack";
@@ -69,6 +69,7 @@ import { handleMcpServers } from "./mcp-servers";
 import { closeIdleMcpUserTransports, handleMcpUser } from "./mcp-user";
 import { handleMemory, startMemoryGc, stopMemoryGc } from "./memory";
 import { handleMetrics } from "./metrics";
+import { handleGenericOAuth } from "./oauth-generic";
 import { handleOAuthLocks } from "./oauth-locks";
 import { handlePageProxy } from "./page-proxy";
 import { handlePages } from "./pages";
@@ -79,6 +80,8 @@ import { handlePromptTemplates } from "./prompt-templates";
 import { handleRepos } from "./repos";
 import { describeRequestRoute } from "./route-def";
 import { handleSchedules } from "./schedules";
+import { handleScriptConnectionProxy } from "./script-connection-proxy";
+import { handleScriptConnections } from "./script-connections";
 import { handleScriptRuns } from "./script-runs";
 import { handleScripts } from "./scripts";
 import { handleSessionData } from "./session-data";
@@ -323,6 +326,8 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleMetrics(req, res, pathSegments, queryParams, myAgentId),
         () => handleRepos(req, res, pathSegments, queryParams),
         () => handleSkills(req, res, pathSegments, queryParams, myAgentId),
+        () => handleScriptConnections(req, res, pathSegments, queryParams, myAgentId),
+        () => handleScriptConnectionProxy(req, res, pathSegments, queryParams, myAgentId),
         () => handleScriptRuns(req, res, pathSegments, queryParams, myAgentId),
         () => handleScripts(req, res, pathSegments, queryParams, myAgentId),
         () => handleX(req, res, pathSegments),
@@ -331,6 +336,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleMcpOAuth(req, res, pathSegments, queryParams),
         () => handleMemory(req, res, pathSegments, myAgentId),
         () => handleOAuthLocks(req, res, pathSegments, queryParams),
+        () => handleGenericOAuth(req, res, pathSegments, queryParams),
         () => handleCodexOAuthKeepWarm(req, res, pathSegments),
         () => handlePagesPublic(req, res, pathSegments, queryParams),
         () => handlePageProxy(req, res),
@@ -504,6 +510,16 @@ try {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 
+try {
+  const { ensureRbacSeedsSynced } = await import("../be/rbac-roles");
+  ensureRbacSeedsSynced();
+} catch (err) {
+  console.error("[startup] Failed to sync RBAC seed rows:", err);
+  // RBAC flag-on must fail closed; flag-off deployments should not be bricked
+  // by role-catalog drift for a disabled security feature.
+  if (isRbacEnabled()) throw err;
+}
+
 // Seed the built-in entity catalog (scripts today; more kinds later) so
 // `script-search` & co. return useful hits from a fresh DB. Idempotent and
 // version-aware: a pristine entity updates when its source changes, a
@@ -611,6 +627,14 @@ httpServer
       startOAuthKeepalive();
     }
 
+    // Start generic OAuth token refresh sweep (all oauth_apps providers,
+    // 15-min tick, first run ~1 min after boot). Complements the tracker-only
+    // keepalive above — see src/be/oauth-refresh-sweep.ts.
+    if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
+      const { startOAuthRefreshSweep } = await import("../be/oauth-refresh-sweep");
+      startOAuthRefreshSweep();
+    }
+
     // Start MCP OAuth pending-session garbage collector (5-min tick)
     startMcpOAuthPendingGc();
 

package/src/http/mcp-oauth.ts

@@ -192,6 +192,7 @@ const authorizeRoute = route({
     userId: z.string().optional(),
     scopes: z.string().optional(),
   }),
+  rbac: { permission: "mcp-oauth.authorize.any" },
   responses: {
     302: { description: "Redirect to authorization server" },
     400: { description: "MCP has no URL / does not require OAuth" },
@@ -213,6 +214,7 @@ const authorizeUrlRoute = route({
     userId: z.string().optional(),
     scopes: z.string().optional(),
   }),
+  rbac: { permission: "mcp-oauth.authorize.any" },
   responses: {
     200: { description: "{ providerUrl: string }" },
     400: { description: "MCP has no URL / does not require OAuth" },

package/src/http/mcp-servers.ts

@@ -11,7 +11,11 @@ import {
   uninstallMcpServer,
   updateMcpServer,
 } from "../be/db";
+import { enqueueAdmissionRow } from "../be/rbac-audit";
+import { getUserGrant } from "../be/rbac-roles";
 import { ensureMcpToken } from "../oauth/ensure-mcp-token";
+import { isRbacEnabled, type PermissionVerb } from "../rbac";
+import { getRequestAuth } from "../utils/request-auth-context";
 import { route } from "./route-def";
 import { json, jsonError } from "./utils";
 
@@ -74,6 +78,7 @@ const createMcpServerRoute = route({
     201: { description: "MCP server created" },
     400: { description: "Validation error" },
   },
+  rbac: { permission: "mcp-server.create.swarm" },
 });
 
 const updateMcpServerRoute = route({
@@ -89,6 +94,7 @@ const updateMcpServerRoute = route({
     200: { description: "MCP server updated" },
     404: { description: "MCP server not found" },
   },
+  rbac: { permission: "mcp-server.update.any" },
 });
 
 const deleteMcpServerRoute = route({
@@ -103,6 +109,7 @@ const deleteMcpServerRoute = route({
     200: { description: "MCP server deleted" },
     404: { description: "MCP server not found" },
   },
+  rbac: { permission: "mcp-server.delete.any" },
 });
 
 const installMcpServerRoute = route({
@@ -120,6 +127,7 @@ const installMcpServerRoute = route({
     200: { description: "MCP server installed" },
     404: { description: "MCP server not found" },
   },
+  rbac: { permission: "mcp-server.install.any" },
 });
 
 const uninstallMcpServerRoute = route({
@@ -133,6 +141,7 @@ const uninstallMcpServerRoute = route({
   responses: {
     200: { description: "MCP server uninstalled" },
   },
+  rbac: { permission: "mcp-server.uninstall.any" },
 });
 
 const getAgentMcpServersRoute = route({
@@ -153,6 +162,30 @@ const getAgentMcpServersRoute = route({
 
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
+function canResolveMcpSecretsForHttpUser(req: IncomingMessage): boolean {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user") return true;
+  if (!isRbacEnabled()) return true;
+
+  const verb: PermissionVerb = "mcp-server.read.secrets";
+  const grant = getUserGrant(auth.userId);
+  const decision =
+    grant.grantsAll || grant.verbs.has(verb)
+      ? ({ allow: true, verb } as const)
+      : ({
+          allow: false,
+          reason: `admission: missing permission '${verb}'`,
+          verb,
+        } as const);
+  enqueueAdmissionRow({
+    userId: auth.userId,
+    decision,
+    method: req.method,
+    route: getAgentMcpServersRoute.def.path,
+  });
+  return decision.allow;
+}
+
 export async function handleMcpServers(
   req: IncomingMessage,
   res: ServerResponse,
@@ -168,6 +201,11 @@ export async function handleMcpServers(
     const resolveSecrets = parsed.query.resolveSecrets === "true";
 
     if (resolveSecrets) {
+      if (!canResolveMcpSecretsForHttpUser(req)) {
+        jsonError(res, "Forbidden: admission: missing permission 'mcp-server.read.secrets'", 403);
+        return true;
+      }
+
       const configs = getResolvedConfig(parsed.params.id);
       const configMap = new Map(configs.map((c) => [c.key, c.value]));
 
@@ -408,12 +446,15 @@ export async function handleMcpServers(
     const parsed = await deleteMcpServerRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
 
-    const deleted = deleteMcpServer(parsed.params.id);
-    if (!deleted) {
+    const result = deleteMcpServer(parsed.params.id);
+    if (!result.deleted) {
       jsonError(res, "MCP server not found", 404);
       return true;
     }
-    json(res, { success: true });
+    json(res, {
+      success: true,
+      deletedScriptConnectionCount: result.deletedScriptConnectionCount,
+    });
     return true;
   }
 

package/src/http/oauth-generic.ts

@@ -0,0 +1,105 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { z } from "zod";
+import { getOAuthProviderConfig } from "@/be/oauth-credential-bindings";
+import { exchangeCode } from "@/oauth/wrapper";
+import { route } from "./route-def";
+import { jsonError } from "./utils";
+
+const DEDICATED_CALLBACK_PROVIDERS = new Set(["linear"]);
+
+const genericOAuthCallbackRoute = route({
+  method: "get",
+  path: "/api/oauth/{provider}/callback",
+  pattern: ["api", "oauth", null, "callback"],
+  operationId: "oauth_generic_callback",
+  summary: "Generic OAuth redirect target for script credential bindings",
+  tags: ["OAuth"],
+  auth: { apiKey: false },
+  params: z.object({
+    provider: z
+      .string()
+      .min(1)
+      .max(255)
+      .regex(/^[A-Za-z0-9_-]+$/),
+  }),
+  query: z.object({
+    code: z.string().optional(),
+    state: z.string().optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+  }),
+  responses: {
+    200: { description: "OAuth authorization completed" },
+    400: { description: "Missing or invalid OAuth callback parameters" },
+    404: { description: "OAuth app not configured" },
+    409: { description: "Provider has a dedicated OAuth callback" },
+    502: { description: "Token exchange failed" },
+  },
+});
+
+function sendAuthorizedHtml(res: ServerResponse, provider: string): void {
+  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(`<!DOCTYPE html>
+<html>
+<head><title>OAuth Authorized</title></head>
+<body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;">
+  <main style="text-align: center;">
+    <h1>${provider} authorized</h1>
+    <p>You can close this tab.</p>
+  </main>
+</body>
+</html>`);
+}
+
+export async function handleGenericOAuth(
+  req: IncomingMessage,
+  res: ServerResponse,
+  pathSegments: string[],
+  queryParams: URLSearchParams,
+): Promise<boolean> {
+  if (!genericOAuthCallbackRoute.match(req.method, pathSegments)) return false;
+
+  const parsed = await genericOAuthCallbackRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed) return true;
+
+  const { provider } = parsed.params;
+  if (DEDICATED_CALLBACK_PROVIDERS.has(provider)) {
+    jsonError(
+      res,
+      "Provider linear uses the dedicated OAuth flow at /api/trackers/linear/authorize and /api/trackers/linear/callback.",
+      409,
+    );
+    return true;
+  }
+
+  if (parsed.query.error) {
+    jsonError(res, parsed.query.error_description ?? parsed.query.error, 400);
+    return true;
+  }
+
+  if (!parsed.query.code || !parsed.query.state) {
+    jsonError(res, "Missing code or state parameter", 400);
+    return true;
+  }
+
+  const config = getOAuthProviderConfig(provider);
+  if (!config) {
+    jsonError(res, `OAuth app ${provider} is not configured`, 404);
+    return true;
+  }
+
+  try {
+    await exchangeCode(config, parsed.query.code, parsed.query.state);
+    sendAuthorizedHtml(res, provider);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const status = message.includes("Invalid or expired OAuth state") ? 400 : 502;
+    jsonError(
+      res,
+      status === 400 ? "Invalid or expired OAuth state" : `Token exchange failed: ${message}`,
+      status,
+    );
+  }
+
+  return true;
+}

package/src/http/poll.ts

@@ -18,13 +18,14 @@ import {
   getPendingTaskForAgent,
   getTaskAttachments,
   getTaskById,
-  getUnassignedTaskIds,
+  getUnassignedTaskIdsForAgent,
   getUserById,
   hasCapacity,
   recordBudgetRefusalNotification,
   startTask,
   upsertChannelActivityCursor,
 } from "../be/db";
+import { renderIdentity, resolveIdentity } from "../be/identity";
 import { fetchChannelActivity } from "../slack/channel-activity";
 import { telemetry } from "../telemetry";
 import { route } from "./route-def";
@@ -274,11 +275,19 @@ export async function handlePoll(
               agentId: myAgentId,
             });
 
-            // Resolve requesting user if available
+            // Resolve requesting user if available. If the task carries a
+            // machine-recorded external id (today: the Slack user field) but
+            // no requestedByUserId, render the explicit UNKNOWN sentinel
+            // instead of silently omitting the section — never a substituted
+            // human (Rule 33 / provenance-or-silence).
             const requestedByUser = pendingTask.requestedByUserId
               ? getUserById(pendingTask.requestedByUserId)
               : undefined;
             const requestedByNotes = getRequesterNotes(requestedByUser?.notes);
+            const requestedByUnknownName =
+              !requestedByUser && pendingTask.slackUserId
+                ? renderIdentity(resolveIdentity("slack", pendingTask.slackUserId))
+                : undefined;
 
             return {
               trigger: {
@@ -297,6 +306,9 @@ export async function handlePoll(
                     notes: requestedByNotes,
                   },
                 }),
+                ...(requestedByUnknownName && {
+                  requestedBy: { name: requestedByUnknownName },
+                }),
               },
             };
           }
@@ -333,8 +345,13 @@ export async function handlePoll(
           // one worker wins if multiple poll simultaneously.
           // This ensures session logs are correctly associated with the real task ID
           // from the start (no reassociation needed).
+          //
+          // Routing affinity: `getUnassignedTaskIdsForAgent` (not the plain
+          // `getUnassignedTaskIds`) pre-filters candidates through
+          // `isAgentEligibleForTask`, so an ineligible task is never even
+          // offered to the budget gate below or the claim loop.
           if (hasCapacity(myAgentId)) {
-            const unassignedIds = getUnassignedTaskIds(5);
+            const unassignedIds = getUnassignedTaskIdsForAgent(myAgentId, 5);
             // Budget admission gate (Phase 3). Pool path is workers-only —
             // per-agent budgets matter most here, but we still check global.
             // Only run the gate when there's at least one candidate task; an