@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/src/http/scripts.ts

@@ -3,7 +3,12 @@ import { z } from "zod";
 import { resolveHttpAuditUserId } from "../be/audit-user";
 import { getAgentById, recordInlineScriptRun, upsertKv } from "../be/db";
 import { createEvent } from "../be/events";
-import { getScriptApiConnectionDescriptors, getScriptApiTypes } from "../be/script-connections";
+import {
+  getScriptApiConnectionDescriptors,
+  getScriptApiTypes,
+  getScriptMcpConnectionDescriptors,
+  getScriptMcpTypes,
+} from "../be/script-connections";
 import { buildScriptCredentialBindings } from "../be/script-credential-broker";
 import {
   createScriptApi,
@@ -23,8 +28,8 @@ import {
 import { searchScripts } from "../be/scripts/embeddings";
 import { extractArgsJsonSchema } from "../be/scripts/extract-schema";
 import {
-  SCRIPT_STDLIB_TYPES,
   scriptSdkTypesWithGeneratedApis,
+  scriptStdlibTypesWithGeneratedApis,
   typecheckScript,
 } from "../be/scripts/typecheck";
 import { can } from "../rbac";
@@ -131,6 +136,7 @@ const searchRoute = route({
     200: { description: "Matching scripts" },
     400: { description: "Validation error" },
   },
+  rbac: { permission: "script.search" },
 });
 
 const deleteRoute = route({
@@ -268,6 +274,7 @@ const createScriptApiRoute = route({
     400: { description: "Validation error or script has no owning agent" },
     404: { description: "Script not found" },
   },
+  rbac: { permission: "script.api.create" },
 });
 
 const listScriptApisRoute = route({
@@ -296,6 +303,7 @@ const revealScriptApiSecretRoute = route({
     200: { description: "Decrypted token (null when authMode is 'none')" },
     404: { description: "Endpoint not found" },
   },
+  rbac: { permission: "script.api.read.secrets" },
 });
 
 const patchScriptApiRoute = route({
@@ -311,6 +319,7 @@ const patchScriptApiRoute = route({
     200: { description: "Updated endpoint" },
     404: { description: "Endpoint not found" },
   },
+  rbac: { permission: "script.api.update" },
 });
 
 const rotateScriptApiRoute = route({
@@ -326,6 +335,7 @@ const rotateScriptApiRoute = route({
     400: { description: "Endpoint uses 'none' auth — nothing to rotate" },
     404: { description: "Endpoint not found" },
   },
+  rbac: { permission: "script.api.rotate" },
 });
 
 const deleteScriptApiRoute = route({
@@ -340,6 +350,7 @@ const deleteScriptApiRoute = route({
     200: { description: "Deleted" },
     404: { description: "Endpoint not found" },
   },
+  rbac: { permission: "script.api.delete" },
 });
 
 function requireAgent(res: ServerResponse, agentId: string | undefined) {
@@ -511,8 +522,9 @@ export async function handleScripts(
       args: parsed.body.args,
       fsMode,
       agentId: agent.id,
-      egressSecrets: buildScriptCredentialBindings({ agentId: agent.id }),
+      egressSecrets: await buildScriptCredentialBindings({ agentId: agent.id }),
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agent.id }),
     });
 
     // Persist output to KV when idempotencyKey is provided and run succeeded
@@ -667,9 +679,11 @@ export async function handleScripts(
   // Must be matched before getScriptByIdRoute — its ["api", "scripts", null]
   // pattern would otherwise swallow the literal "type-defs" segment.
   if (typeDefsRoute.match(req.method, pathSegments)) {
+    const apiTypes = getScriptApiTypes();
+    const mcpTypes = getScriptMcpTypes();
     json(res, {
-      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes()),
-      stdlibTypes: SCRIPT_STDLIB_TYPES,
+      sdkTypes: scriptSdkTypesWithGeneratedApis(apiTypes, mcpTypes),
+      stdlibTypes: scriptStdlibTypesWithGeneratedApis(apiTypes, mcpTypes),
     });
     return true;
   }
@@ -718,8 +732,14 @@ export async function handleScripts(
     json(res, {
       signature: JSON.parse(script.signatureJson),
       argsJsonSchema: script.argsJsonSchema ? (JSON.parse(script.argsJsonSchema) as unknown) : null,
-      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes({ agentId: agent.id })),
-      stdlibTypes: SCRIPT_STDLIB_TYPES,
+      sdkTypes: scriptSdkTypesWithGeneratedApis(
+        getScriptApiTypes({ agentId: agent.id }),
+        getScriptMcpTypes({ agentId: agent.id }),
+      ),
+      stdlibTypes: scriptStdlibTypesWithGeneratedApis(
+        getScriptApiTypes({ agentId: agent.id }),
+        getScriptMcpTypes({ agentId: agent.id }),
+      ),
     });
     return true;
   }

package/src/http/skills.ts

@@ -103,6 +103,7 @@ const bulkUpsertSkillFilesRoute = route({
   summary: "Bulk upsert bundled files for a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: z.object({ id: z.string() }),
   body: z.object({
     files: z.array(skillFileWithPathSchema).max(100),
@@ -137,6 +138,7 @@ const upsertSkillFileRoute = route({
   summary: "Upsert a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: z.object({ id: z.string(), path: z.string() }),
   body: skillFileBodySchema,
   responses: {
@@ -154,6 +156,7 @@ const deleteSkillFileRoute = route({
   summary: "Delete a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: z.object({ id: z.string(), path: z.string() }),
   responses: {
     200: { description: "Skill file deleted" },
@@ -168,6 +171,7 @@ const createSkillRoute = route({
   summary: "Create a new skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.create.swarm" },
   body: z.object({
     content: z.string().min(1),
     type: z.string().optional(),
@@ -188,6 +192,7 @@ const updateSkillRoute = route({
   summary: "Update a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: z.object({ id: z.string() }),
   body: z.record(z.string(), z.unknown()),
   responses: {
@@ -204,6 +209,7 @@ const deleteSkillRoute = route({
   summary: "Delete a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.delete.any" },
   params: z.object({ id: z.string() }),
   responses: {
     200: { description: "Skill deleted" },
@@ -219,6 +225,7 @@ const installSkillRoute = route({
   summary: "Install skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.any" },
   params: z.object({ id: z.string() }),
   body: z.object({
     agentId: z.string(),
@@ -236,6 +243,7 @@ const uninstallSkillRoute = route({
   summary: "Uninstall skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.uninstall.any" },
   params: z.object({ id: z.string(), agentId: z.string() }),
   responses: {
     200: { description: "Skill uninstalled" },
@@ -249,6 +257,7 @@ const installRemoteRoute = route({
   summary: "Install a remote skill from GitHub",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.global" },
   body: z.object({
     sourceRepo: z.string(),
     sourcePath: z.string().optional(),
@@ -268,6 +277,7 @@ const syncRemoteRoute = route({
   summary: "Trigger remote skill sync",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   body: z.object({
     skillId: z.string().optional(),
     force: z.boolean().optional(),
@@ -284,6 +294,7 @@ const syncFilesystemRoute = route({
   summary: "Sync installed skills to agent filesystem",
   tags: ["Skills"],
   auth: { apiKey: true, agentId: true },
+  rbac: { ungated: "self-scoped: syncs the caller's own agent FS" },
   responses: {
     200: { description: "Filesystem sync results" },
   },

package/src/http/tasks.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { ensure } from "@desplega.ai/business-use";
 import { z } from "zod";
+import { resolveHttpAuditUserId } from "../be/audit-user";
 import {
   backfillSupersedeTaskResumeTaskId,
   cancelTask,
@@ -14,7 +15,6 @@ import {
   getTaskAttachments,
   getTaskById,
   getTasksCount,
-  getUserById,
   pauseTask,
   resumeTask,
   supersedeTask,
@@ -23,6 +23,7 @@ import {
   updateTaskProgress,
   updateTaskVcs,
 } from "../be/db";
+import { findUserById } from "../be/users";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { createResumeFollowUp, createWorkerTaskFollowUp } from "../tasks/worker-follow-up";
 import {
@@ -37,7 +38,6 @@ import {
   ResumeReasonSchema,
   splitLegacyModelAlias,
 } from "../types";
-import { getRequestAuth } from "../utils/request-auth-context";
 import { route } from "./route-def";
 import { json, jsonError } from "./utils";
 
@@ -60,8 +60,12 @@ const listTasks = route({
     includeHeartbeat: z.enum(["true", "false"]).optional(),
     /** ISO 8601 — return only tasks created on/after this timestamp. */
     createdAfter: z.string().datetime().optional(),
+    /** ISO 8601 — return only tasks created before this timestamp. */
+    createdBefore: z.string().datetime().optional(),
     /** Comma-separated source filter (e.g. `ui,slack`). Omit to include all. */
     source: z.string().optional(),
+    /** `createdAt` enables stable time-axis paging; default preserves table freshness ordering. */
+    orderBy: z.enum(["lastUpdatedAt", "createdAt"]).optional(),
     limit: z.coerce.number().int().optional(),
     offset: z.coerce.number().int().optional(),
     /** `full` restores the legacy shape (full `task` text + all fields); default is slim. */
@@ -343,7 +347,9 @@ export async function handleTasks(
       search: parsed.query.search || undefined,
       includeHeartbeat: parsed.query.includeHeartbeat === "true" || undefined,
       createdAfter: parsed.query.createdAfter || undefined,
+      createdBefore: parsed.query.createdBefore || undefined,
       source,
+      orderBy: parsed.query.orderBy,
       limit: parsed.query.limit,
       offset: parsed.query.offset,
     };
@@ -360,17 +366,25 @@ export async function handleTasks(
     const parsed = await createTask.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
 
-    // Tolerant `requestedByUserId`: prevent the deleted-user race from
-    // becoming a 500 — if the referenced user doesn't exist, log and drop
-    // the field rather than letting the FK fail at INSERT.
-    const auth = getRequestAuth(req);
-    let requestedByUserId =
-      auth?.kind === "user" ? auth.userId : parsed.body.requestedByUserId || undefined;
-    if (requestedByUserId && !getUserById(requestedByUserId)) {
-      console.warn(
-        `[tasks] requestedByUserId ${requestedByUserId} does not exist — coercing to NULL`,
-      );
-      requestedByUserId = undefined;
+    // Prefer trusted server-side identity: an authenticated request user, or
+    // the caller's own ownership-gated task context (`X-Source-Task-Id` /
+    // ambient current task) — same as every other audited write site. This
+    // is the upstream #939 anti-spoofing behavior and stays the default.
+    //
+    // Fork-specific opt-in: in a single-tenant deployment where every caller
+    // shares ONE operator key (so `auth.kind` is never "user" and there's no
+    // way to bind a caller to a user), TRUST_BODY_REQUESTED_BY_USER_ID=true
+    // re-enables a body-supplied `requestedByUserId` as a last resort, after
+    // validating it names a real user. This is safe ONLY because every
+    // holder of that shared key is already trusted org-wide — it must stay
+    // off (default) anywhere callers of the shared/global key are not all
+    // equally trusted, since it lets any such caller attribute a task to any
+    // user. Must NOT be upstreamed as a default-on behavior.
+    let requestedByUserId = resolveHttpAuditUserId(req, myAgentId) ?? undefined;
+    const trustBodyRequestedByUserId = process.env.TRUST_BODY_REQUESTED_BY_USER_ID === "true";
+    if (trustBodyRequestedByUserId && !requestedByUserId && parsed.body.requestedByUserId) {
+      const candidate = findUserById(parsed.body.requestedByUserId);
+      if (candidate) requestedByUserId = candidate.id;
     }
 
     // Default agent for ingress-created tasks: when no explicit `agentId` is

package/src/http/x.ts

@@ -2,7 +2,10 @@ import { timingSafeEqual } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { recordInlineScriptRun } from "../be/db";
-import { getScriptApiConnectionDescriptors } from "../be/script-connections";
+import {
+  getScriptApiConnectionDescriptors,
+  getScriptMcpConnectionDescriptors,
+} from "../be/script-connections";
 import { buildScriptCredentialBindings } from "../be/script-credential-broker";
 import {
   getScriptApiById,
@@ -204,8 +207,9 @@ export async function handleX(
     // timeout, so an external caller can't use a long X-Swarm-Timeout-Ms to
     // burn proportionally more CPU per request.
     timeoutMs,
-    egressSecrets: buildScriptCredentialBindings({ agentId: endpoint.agentId }),
+    egressSecrets: await buildScriptCredentialBindings({ agentId: endpoint.agentId }),
     apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId }),
+    mcpConnections: getScriptMcpConnectionDescriptors({ agentId: endpoint.agentId }),
   });
 
   const ok = output.exitCode === 0 && !output.error && !output.runtimeError;

package/src/integrations/kapso/inbound.ts

@@ -2,8 +2,8 @@ import { resolveTemplate } from "@/prompts/resolver";
 import { createTaskWithSiblingAwareness } from "@/tasks/sibling-awareness";
 import { workflowEventBus } from "@/workflows/event-bus";
 import "@/tools/templates";
+import { type IdentityResolution, renderIdentity, resolveIdentity } from "@/be/identity";
 import { recordUnmappedIdentity } from "@/be/unmapped-identities";
-import { findUserByExternalId } from "@/be/users";
 import { getKapsoNumberMapping, markKapsoMessageSeen } from "./config";
 
 const KAPSO_IDENTITY_KIND = "kapso";
@@ -44,11 +44,15 @@ function extractText(message: NonNullable<KapsoWebhookPayload["message"]>): stri
 function buildTaskDescription(payload: KapsoWebhookPayload): string {
   const message = payload.message ?? {};
   const conversation = payload.conversation ?? {};
+  const externalId = normalizeKapsoSender(payload);
+  const contactDisplay = externalId
+    ? renderIdentity(resolveKapsoIdentity(externalId))
+    : "(unknown user)";
   return resolveTemplate("kapso.message.received", {
     conversation_id: conversation.id ?? "unknown",
     inbound_wamid: message.id ?? "unknown",
     sender_phone: message.from ?? conversation.phone_number ?? "unknown",
-    contact_name: conversation.contact_name ?? "unknown",
+    contact_name: contactDisplay,
     phone_number_id: payload.phone_number_id ?? "unknown",
     test_note: payload.test ? "\n- test: true (do NOT send a real WhatsApp reply)" : "",
     message_text: extractText(message),
@@ -61,14 +65,27 @@ function normalizeKapsoSender(payload: KapsoWebhookPayload): string | null {
   return digits || null;
 }
 
+/**
+ * Reverse-lookup a phone-number externalId across both identity kinds this
+ * integration writes (`kapso`, `whatsapp` — see the dual-kind note on
+ * `resolveKapsoRequestedByUserId`). Never a provider profile label.
+ */
+function resolveKapsoIdentity(externalId: string): IdentityResolution {
+  const kapsoResolution = resolveIdentity(KAPSO_IDENTITY_KIND, externalId);
+  if (kapsoResolution.status === "resolved") return kapsoResolution;
+  const whatsappResolution = resolveIdentity(WHATSAPP_IDENTITY_KIND, externalId);
+  if (whatsappResolution.status === "resolved") return whatsappResolution;
+  // Both unknown — report under the `kapso` kind for consistency with
+  // resolveKapsoRequestedByUserId's unmapped-tracker recording.
+  return kapsoResolution;
+}
+
 function resolveKapsoRequestedByUserId(payload: KapsoWebhookPayload): string | undefined {
   const externalId = normalizeKapsoSender(payload);
   if (!externalId) return undefined;
 
-  const mapped =
-    findUserByExternalId(KAPSO_IDENTITY_KIND, externalId) ??
-    findUserByExternalId(WHATSAPP_IDENTITY_KIND, externalId);
-  if (mapped) return mapped.id;
+  const resolution = resolveKapsoIdentity(externalId);
+  if (resolution.status === "resolved") return resolution.userId;
 
   recordUnmappedIdentity(KAPSO_IDENTITY_KIND, externalId, {
     sampleEventType: "kapso.message.received",

package/src/jira/sync.ts

@@ -21,6 +21,14 @@ import {
   getTrackerSyncByExternalId,
   updateTrackerSyncSwarmId,
 } from "../be/db-queries/tracker";
+import { renderIdentity, resolveIdentity } from "../be/identity";
+import { recordUnmappedIdentity } from "../be/unmapped-identities";
+import {
+  findOrCreateUserByEmail,
+  findUserByExternalId,
+  type IdentityActor,
+  linkIdentity,
+} from "../be/users";
 import { ensureToken, ensureTokenOrThrow } from "../oauth/ensure-token";
 import { resolveTemplate } from "../prompts/resolver";
 import { buildJiraContextKey } from "../tasks/context-key";
@@ -31,6 +39,66 @@ import { getJiraMetadata } from "./metadata";
 // Side-effect import: registers all Jira event templates in the prompt registry
 import "./templates";
 
+// ─── Actor resolution (mirrors resolveLinearActor / resolveSlackUserId) ────
+
+/** Audit-trail actor for the Jira auto-link cascade. */
+const JIRA_WEBHOOK_ACTOR: IdentityActor = { kind: "system", id: "webhook:jira" };
+
+/**
+ * Map a Jira Atlassian `accountId` to a canonical `users.id`:
+ *   1. Existing `(jira, accountId)` mapping — fast path.
+ *   2. No mapping + an email is present on the payload (privacy settings
+ *      permitting) → `findOrCreateUserByEmail` + `linkIdentity`.
+ *   3. No mapping + no email → record into the kv unmapped tracker; caller
+ *      proceeds without a `requestedByUserId`.
+ *
+ * Returns `undefined` when no mapping could be established.
+ */
+function resolveJiraActor(
+  accountId: string | undefined,
+  email: string | undefined,
+  name: string | undefined,
+  sampleEventType: string,
+  sampleContext: string,
+): string | undefined {
+  if (!accountId) return undefined;
+
+  const existing = findUserByExternalId("jira", accountId);
+  if (existing) return existing.id;
+
+  const trimmedEmail = typeof email === "string" ? email.trim() : "";
+  if (trimmedEmail !== "") {
+    const { user } = findOrCreateUserByEmail(
+      trimmedEmail,
+      { name: name?.trim() || undefined },
+      JIRA_WEBHOOK_ACTOR,
+    );
+    try {
+      linkIdentity(user.id, "jira", accountId, JIRA_WEBHOOK_ACTOR);
+    } catch (error) {
+      console.warn(
+        `[Jira Sync] linkIdentity('jira', ${accountId}) failed — likely a concurrent enroll`,
+        error,
+      );
+    }
+    return user.id;
+  }
+
+  recordUnmappedIdentity("jira", accountId, { sampleEventType, sampleContext });
+  return undefined;
+}
+
+/**
+ * Render a Jira actor for agent-visible text: the resolved canonical name or
+ * the explicit UNKNOWN sentinel — never the raw Jira `displayName`. Falls
+ * back to a bare "(unknown user)" when the payload carries no `accountId` at
+ * all (malformed/legacy webhook shape).
+ */
+function renderJiraIdentity(accountId: string | undefined): string {
+  if (!accountId) return "(unknown user)";
+  return renderIdentity(resolveIdentity("jira", accountId));
+}
+
 // ─── Bot identity (Atlassian accountId) ────────────────────────────────────
 
 // Cache the bot's Atlassian accountId on globalThis (not a module-level `let`)
@@ -171,7 +239,7 @@ type IssueShape = {
   fields?: {
     summary?: string;
     description?: unknown;
-    reporter?: { displayName?: string; accountId?: string } | null;
+    reporter?: { displayName?: string; accountId?: string; emailAddress?: string } | null;
   };
 };
 
@@ -218,7 +286,14 @@ export async function handleIssueEvent(event: Record<string, unknown>): Promise<
   const issueId = issue.id;
   const issueKey = issue.key;
   const summary = issue.fields?.summary ?? "(no summary)";
-  const reporterName = issue.fields?.reporter?.displayName ?? "";
+  const reporterAccountId = issue.fields?.reporter?.accountId;
+  const requestedByUserId = resolveJiraActor(
+    reporterAccountId,
+    issue.fields?.reporter?.emailAddress,
+    issue.fields?.reporter?.displayName,
+    "issue_updated",
+    `${issueKey}: ${summary}`,
+  );
   const descriptionText = extractText(issue.fields?.description);
   const issueUrl = buildIssueUrl(issueKey);
 
@@ -241,7 +316,8 @@ export async function handleIssueEvent(event: Record<string, unknown>): Promise<
     await createInitialJiraTask({
       issueKey,
       summary,
-      reporterName,
+      reporterAccountId,
+      requestedByUserId,
       descriptionText,
       issueUrl,
       syncRowId: claim.sync.id,
@@ -265,7 +341,8 @@ export async function handleIssueEvent(event: Record<string, unknown>): Promise<
   await createInitialJiraTask({
     issueKey,
     summary,
-    reporterName,
+    reporterAccountId,
+    requestedByUserId,
     descriptionText,
     issueUrl,
     syncRowId: claim.sync.id,
@@ -280,8 +357,8 @@ export async function handleIssueEvent(event: Record<string, unknown>): Promise<
 type CommentShape = {
   id?: string;
   body?: unknown;
-  author?: { accountId?: string; displayName?: string } | null;
-  updateAuthor?: { accountId?: string; displayName?: string } | null;
+  author?: { accountId?: string; displayName?: string; emailAddress?: string } | null;
+  updateAuthor?: { accountId?: string; displayName?: string; emailAddress?: string } | null;
 };
 
 /**
@@ -345,7 +422,14 @@ export async function handleCommentEvent(event: Record<string, unknown>): Promis
   const summary = issue.fields?.summary ?? "(no summary)";
   const descriptionText = extractText(issue.fields?.description);
   const commentText = extractText(comment.body);
-  const commentAuthor = comment.author?.displayName ?? "";
+  const commentAuthorAccountId = comment.author?.accountId ?? comment.updateAuthor?.accountId;
+  const requestedByUserId = resolveJiraActor(
+    commentAuthorAccountId,
+    comment.author?.emailAddress ?? comment.updateAuthor?.emailAddress,
+    comment.author?.displayName ?? comment.updateAuthor?.displayName,
+    "comment_created",
+    `${issueKey}: ${commentText.slice(0, 80)}`,
+  );
   const issueUrl = buildIssueUrl(issueKey);
 
   if (!existing) {
@@ -372,7 +456,8 @@ export async function handleCommentEvent(event: Record<string, unknown>): Promis
         summary,
         descriptionText,
         commentText,
-        commentAuthor,
+        commentAuthorAccountId,
+        requestedByUserId,
         issueUrl,
         syncRowId: claim.sync.id,
       });
@@ -384,7 +469,8 @@ export async function handleCommentEvent(event: Record<string, unknown>): Promis
       summary,
       issueUrl,
       commentText,
-      commentAuthor,
+      commentAuthorAccountId,
+      requestedByUserId,
       syncRow: claim.sync,
     });
   }
@@ -394,7 +480,8 @@ export async function handleCommentEvent(event: Record<string, unknown>): Promis
     summary,
     issueUrl,
     commentText,
-    commentAuthor,
+    commentAuthorAccountId,
+    requestedByUserId,
     syncRow: existing,
   });
 }
@@ -404,7 +491,8 @@ async function routeCommentOnExistingSync(input: {
   summary: string;
   issueUrl: string;
   commentText: string;
-  commentAuthor: string;
+  commentAuthorAccountId: string | undefined;
+  requestedByUserId: string | undefined;
   syncRow: { id: string; swarmId: string };
 }): Promise<void> {
   const priorTask = input.syncRow.swarmId ? getTaskById(input.syncRow.swarmId) : null;
@@ -417,15 +505,17 @@ async function routeCommentOnExistingSync(input: {
   }
 
   // Terminal or orphan sync row → follow-up.
+  const commentAuthorDisplay = renderJiraIdentity(input.commentAuthorAccountId);
   await createInitialJiraTask({
     issueKey: input.issueKey,
     summary: input.summary,
-    reporterName: input.commentAuthor,
+    reporterAccountId: input.commentAuthorAccountId,
+    requestedByUserId: input.requestedByUserId,
     descriptionText: "",
     issueUrl: input.issueUrl,
     syncRowId: input.syncRow.id,
     followup: true,
-    followupTrigger: `New comment from ${input.commentAuthor || "user"}`,
+    followupTrigger: `New comment from ${commentAuthorDisplay}`,
     followupMessage: input.commentText,
   });
 }
@@ -453,7 +543,8 @@ export async function handleIssueDeleteEvent(event: Record<string, unknown>): Pr
 async function createInitialJiraTask(input: {
   issueKey: string;
   summary: string;
-  reporterName: string;
+  reporterAccountId: string | undefined;
+  requestedByUserId: string | undefined;
   descriptionText: string;
   issueUrl: string;
   syncRowId: string;
@@ -479,7 +570,7 @@ async function createInitialJiraTask(input: {
         issue_key: input.issueKey,
         issue_summary: input.summary,
         issue_url: input.issueUrl,
-        reporter: input.reporterName,
+        reporter: renderJiraIdentity(input.reporterAccountId),
         description_section: descriptionSection,
       };
 
@@ -493,6 +584,7 @@ async function createInitialJiraTask(input: {
     agentId: lead?.id ?? "",
     source: "jira",
     taskType: "jira-issue",
+    requestedByUserId: input.requestedByUserId,
     contextKey: buildJiraContextKey(input.issueKey),
   });
 
@@ -509,7 +601,8 @@ async function createCommentMentionTask(input: {
   summary: string;
   descriptionText: string;
   commentText: string;
-  commentAuthor: string;
+  commentAuthorAccountId: string | undefined;
+  requestedByUserId: string | undefined;
   issueUrl: string;
   syncRowId: string;
 }): Promise<void> {
@@ -522,7 +615,7 @@ async function createCommentMentionTask(input: {
     issue_key: input.issueKey,
     issue_summary: input.summary,
     issue_url: input.issueUrl,
-    comment_author: input.commentAuthor,
+    comment_author: renderJiraIdentity(input.commentAuthorAccountId),
     description_section: descriptionSection,
     comment_text: input.commentText,
   });
@@ -536,6 +629,7 @@ async function createCommentMentionTask(input: {
     agentId: lead?.id ?? "",
     source: "jira",
     taskType: "jira-issue",
+    requestedByUserId: input.requestedByUserId,
     contextKey: buildJiraContextKey(input.issueKey),
   });
 

package/src/jira/templates.ts

@@ -23,7 +23,11 @@ Reporter: {{reporter}}
     { name: "issue_key", description: "Jira issue key (e.g. ENG-123)" },
     { name: "issue_summary", description: "Issue summary / title" },
     { name: "issue_url", description: "Issue URL on the Jira site" },
-    { name: "reporter", description: "Reporter display name (or empty string)" },
+    {
+      name: "reporter",
+      description:
+        "Reporter identity — resolved canonical name (e.g. 'Luis (jira:<accountId>)') or the UNKNOWN sentinel",
+    },
     {
       name: "description_section",
       description: "Description section (extracted from ADF) or empty string",
@@ -46,7 +50,11 @@ Comment:
     { name: "issue_key", description: "Jira issue key (e.g. ENG-123)" },
     { name: "issue_summary", description: "Issue summary / title" },
     { name: "issue_url", description: "Issue URL on the Jira site" },
-    { name: "comment_author", description: "Comment author display name" },
+    {
+      name: "comment_author",
+      description:
+        "Comment author identity — resolved canonical name (e.g. 'Luis (jira:<accountId>)') or the UNKNOWN sentinel",
+    },
     {
       name: "description_section",
       description: "Description section (extracted from ADF) or empty string",