@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/dist/cli-52fg7s7x.js

@@ -0,0 +1,269 @@
+import {
+  PermissionVerbSchema
+} from "./cli-86fdnerz.js";
+import {
+  getDb,
+  init_db
+} from "./cli-15y7qhzp.js";
+
+// src/be/rbac-roles.ts
+init_db();
+var DEFAULT_ROLE_ID = "rbac-role-admin";
+var BUILTIN_ROLES = [
+  {
+    id: DEFAULT_ROLE_ID,
+    name: "admin",
+    description: "Full access including verb-less routes (legacy-equivalent default).",
+    isBuiltin: true,
+    grantsAll: true,
+    verbs: []
+  },
+  {
+    id: "rbac-role-requester",
+    name: "requester",
+    description: "Own-task lifecycle: what legacy policy grants user principals.",
+    isBuiltin: true,
+    grantsAll: false,
+    verbs: [
+      "task.create.own",
+      "task.read.own",
+      "task.cancel.own",
+      "task.action.own",
+      "task.fs.mutate",
+      "favorite.write.own"
+    ]
+  }
+];
+var CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
+CREATE TRIGGER IF NOT EXISTS trg_users_default_role
+AFTER INSERT ON users
+BEGIN
+  INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+  SELECT 'user', NEW.id, 'rbac-role-admin'
+  WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
+END;
+`;
+function roleRowToUserRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    isBuiltin: row.isBuiltin === 1,
+    grantsAll: row.grantsAll === 1,
+    createdAt: row.createdAt
+  };
+}
+function requireRoleId(roleName) {
+  const row = getDb().prepare("SELECT id FROM roles WHERE name = ?").get(roleName);
+  if (!row) {
+    throw new Error(`Unknown RBAC role: ${roleName}`);
+  }
+  return row.id;
+}
+function validateBuiltinVerb(roleName, verb) {
+  const parsed = PermissionVerbSchema.safeParse(verb);
+  if (!parsed.success) {
+    throw new Error(`Invalid RBAC permission verb "${verb}" in built-in role "${roleName}"`);
+  }
+  return parsed.data;
+}
+function validatedBuiltinVerbSets() {
+  const byRoleId = new Map;
+  for (const role of BUILTIN_ROLES) {
+    const verbs = new Set;
+    for (const verb of role.verbs) {
+      verbs.add(validateBuiltinVerb(role.name, verb));
+    }
+    byRoleId.set(role.id, verbs);
+  }
+  return byRoleId;
+}
+var loggedInvalidGrantVerbs = new Set;
+function parseDatabaseGrantVerb(roleId, verb) {
+  const parsed = PermissionVerbSchema.safeParse(verb);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  const logKey = `${roleId}:${verb}`;
+  if (!loggedInvalidGrantVerbs.has(logKey)) {
+    loggedInvalidGrantVerbs.add(logKey);
+    console.error(`[rbac] Ignoring invalid role_permissions verb "${verb}" for roleId="${roleId}". ` + "Invalid RBAC verbs grant nothing; remove or repair the row.");
+  }
+  return null;
+}
+function getUserGrant(userId) {
+  const rows = getDb().prepare(`SELECT r.id AS roleId, r.grantsAll, rp.verb
+       FROM principal_roles pr
+       JOIN roles r ON r.id = pr.roleId
+       LEFT JOIN role_permissions rp ON rp.roleId = r.id
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.grantsAll DESC`).all(userId);
+  if (rows.length === 0) {
+    return { grantsAll: false, verbs: new Set };
+  }
+  const verbs = new Set;
+  for (const row of rows) {
+    if (row.grantsAll === 1) {
+      return { grantsAll: true, verbs: new Set };
+    }
+    if (row.verb) {
+      const verb = parseDatabaseGrantVerb(row.roleId, row.verb);
+      if (verb) {
+        verbs.add(verb);
+      }
+    }
+  }
+  return { grantsAll: false, verbs };
+}
+function attachRole(userId, roleName) {
+  const db = getDb();
+  db.transaction(() => {
+    const roleId = requireRoleId(roleName);
+    db.prepare(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+       VALUES ('user', ?, ?)`).run(userId, roleId);
+  })();
+}
+function detachRole(userId, roleName) {
+  const db = getDb();
+  db.transaction(() => {
+    const roleId = requireRoleId(roleName);
+    db.prepare(`DELETE FROM principal_roles
+       WHERE principalType = 'user' AND principalId = ? AND roleId = ?`).run(userId, roleId);
+  })();
+}
+function listUserRoles(userId) {
+  return getDb().prepare(`SELECT r.id, r.name, r.description, r.isBuiltin, r.grantsAll, r.createdAt
+       FROM principal_roles pr
+       JOIN roles r ON r.id = pr.roleId
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.name`).all(userId).map(roleRowToUserRole);
+}
+function ensureRbacSeedsSynced(opts) {
+  const db = getDb();
+  const desiredVerbsByRoleId = validatedBuiltinVerbSets();
+  const insertRole = db.prepare(`INSERT OR IGNORE INTO roles (id, name, description, isBuiltin, grantsAll)
+     VALUES (?, ?, ?, 1, ?)`);
+  const updateRole = db.prepare(`UPDATE roles
+     SET name = ?, description = ?, isBuiltin = 1, grantsAll = ?, lastUpdatedAt = CURRENT_TIMESTAMP
+     WHERE id = ?
+       AND (
+         name <> ?
+         OR COALESCE(description, '') <> COALESCE(?, '')
+         OR isBuiltin <> 1
+         OR grantsAll <> ?
+       )`);
+  const selectRoleById = db.prepare("SELECT id, name FROM roles WHERE id = ?");
+  const selectRoleByName = db.prepare("SELECT id, name FROM roles WHERE name = ?");
+  const selectRolePermissions = db.prepare("SELECT verb FROM role_permissions WHERE roleId = ?");
+  const deleteRolePermission = db.prepare("DELETE FROM role_permissions WHERE roleId = ? AND verb = ?");
+  const insertRolePermission = db.prepare("INSERT OR IGNORE INTO role_permissions (roleId, verb) VALUES (?, ?)");
+  const backfillDefaultRoleForZeroRoleUsers = db.prepare(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+     SELECT 'user', u.id, ?
+     FROM users u
+     WHERE NOT EXISTS (
+       SELECT 1
+       FROM principal_roles pr
+       WHERE pr.principalType = 'user'
+         AND pr.principalId = u.id
+     )`);
+  const stats = {
+    rolesInserted: 0,
+    rolesUpdated: 0,
+    permissionsInserted: 0,
+    permissionsDeleted: 0,
+    usersBackfilled: 0
+  };
+  db.transaction(() => {
+    for (const role of BUILTIN_ROLES) {
+      const grantsAll = role.grantsAll ? 1 : 0;
+      const insertResult = insertRole.run(role.id, role.name, role.description, grantsAll);
+      stats.rolesInserted += insertResult.changes;
+      if (insertResult.changes === 0) {
+        const updateResult = updateRole.run(role.name, role.description, grantsAll, role.id, role.name, role.description, grantsAll);
+        stats.rolesUpdated += updateResult.changes;
+      }
+    }
+    for (const role of BUILTIN_ROLES) {
+      const row = selectRoleById.get(role.id);
+      if (row) {
+        continue;
+      }
+      const colliding = selectRoleByName.get(role.name);
+      if (colliding) {
+        throw new Error(`RBAC built-in role "${role.name}" (${role.id}) is missing because role ` + `"${colliding.name}" (${colliding.id}) already uses that name. ` + "Rename or remove the conflicting role, then rerun `rbac bootstrap`.");
+      }
+      throw new Error(`RBAC built-in role "${role.name}" (${role.id}) is missing after seed sync. ` + "Rerun `rbac bootstrap`; if it still fails, inspect the roles table.");
+    }
+    for (const role of BUILTIN_ROLES) {
+      const desiredVerbs = desiredVerbsByRoleId.get(role.id) ?? new Set;
+      const existingRows = selectRolePermissions.all(role.id);
+      for (const row of existingRows) {
+        if (!desiredVerbs.has(row.verb)) {
+          stats.permissionsDeleted += deleteRolePermission.run(role.id, row.verb).changes;
+        }
+      }
+      for (const verb of desiredVerbs) {
+        stats.permissionsInserted += insertRolePermission.run(role.id, verb).changes;
+      }
+    }
+    db.run(CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL);
+    stats.usersBackfilled += backfillDefaultRoleForZeroRoleUsers.run(DEFAULT_ROLE_ID).changes;
+  })();
+  if (!opts?.quiet) {
+    console.log(`[rbac] seed sync: roles inserted=${stats.rolesInserted}, updated=${stats.rolesUpdated}; permissions inserted=${stats.permissionsInserted}, deleted=${stats.permissionsDeleted}; trigger=ensured; users backfilled=${stats.usersBackfilled}`);
+  }
+  return stats;
+}
+function describeRbacFlag() {
+  const raw = process.env.RBAC_ENABLED;
+  if (raw === undefined)
+    return "unset (off)";
+  return `${raw} (${raw === "true" ? "on" : "off"})`;
+}
+function printRolesTable(rows) {
+  const tableRows = rows.map((row) => [
+    row.name,
+    row.isBuiltin === 1 ? "yes" : "no",
+    row.grantsAll === 1 ? "yes" : "no",
+    String(row.verbCount),
+    String(row.attachedUserCount)
+  ]);
+  const headers = ["name", "builtin", "grantsAll", "verbs", "attachedUsers"];
+  const widths = headers.map((header, column) => Math.max(header.length, ...tableRows.map((row) => row[column]?.length ?? 0)));
+  const format = (row) => row.map((cell, column) => cell.padEnd(widths[column] ?? cell.length)).join("  ");
+  console.log("Roles:");
+  console.log(format(headers));
+  console.log(format(widths.map((width) => "-".repeat(width))));
+  for (const row of tableRows) {
+    console.log(format(row));
+  }
+}
+function getRbacRoleSummary() {
+  return getDb().prepare(`SELECT
+         r.name,
+         r.isBuiltin,
+         r.grantsAll,
+         COUNT(DISTINCT rp.verb) AS verbCount,
+         COUNT(DISTINCT CASE WHEN pr.principalType = 'user' THEN pr.principalId END)
+           AS attachedUserCount
+       FROM roles r
+       LEFT JOIN role_permissions rp ON rp.roleId = r.id
+       LEFT JOIN principal_roles pr ON pr.roleId = r.id
+       GROUP BY r.id, r.name, r.isBuiltin, r.grantsAll
+       ORDER BY r.isBuiltin DESC, r.name`).all();
+}
+async function runRbacCliCommand(args) {
+  const subcommand = args[0];
+  if (args.length !== 1 || subcommand !== "bootstrap") {
+    throw new Error(`Unknown RBAC command: ${args.join(" ") || "(none)"}`);
+  }
+  const stats = ensureRbacSeedsSynced({ quiet: true });
+  const roles = getRbacRoleSummary();
+  console.log("RBAC bootstrap complete");
+  console.log(`RBAC_ENABLED: ${describeRbacFlag()}`);
+  console.log(`Users backfilled this run: ${stats.usersBackfilled}`);
+  console.log("");
+  printRolesTable(roles);
+}
+
+export { DEFAULT_ROLE_ID, BUILTIN_ROLES, getUserGrant, attachRole, detachRole, listUserRoles, ensureRbacSeedsSynced, runRbacCliCommand };

package/dist/{cli-hjhvekf4.js → cli-65ekje01.js}

@@ -1,18 +1,21 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-bgvskydy.js";
+} from "./cli-tffvrh6j.js";
 import {
   getSlackApp,
   registerTreeMessage
-} from "./cli-trmapn9k.js";
+} from "./cli-pet3aev6.js";
+import {
+  rewriteSlackMentions
+} from "./cli-cchksf5q.js";
 import {
   buildBufferFlushBlocks
-} from "./cli-6xd0bvf8.js";
+} from "./cli-ma04faw5.js";
 import {
   createTaskWithSiblingAwareness,
   slackContextKey
-} from "./cli-y4ycrnjc.js";
+} from "./cli-k3y4z3h5.js";
 import {
   getLatestActiveTaskInThread,
   getLeadAgent,
@@ -20,7 +23,7 @@ import {
   init_db,
   init_registry,
   registerTemplate
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 
 // src/slack/event-dedup.ts
 var DEFAULT_TTL_MS = 300000;
@@ -164,7 +167,7 @@ async function getThreadContextForBuffer(channelId, threadTs) {
       return `<@${m.user}>: ${text}`;
     }).join(`
 `);
-    return formatted;
+    return rewriteSlackMentions(formatted);
   } catch (error) {
     console.error("[Slack] Failed to fetch thread context for buffer:", error);
     return "";
@@ -181,9 +184,9 @@ async function slackFlush(items, key, immediate) {
   const { channelId, threadTs } = split;
   const originalRequesterId = items[0].userId;
   console.log(`[Slack] Flushing buffer: ${key} (${items.length} messages, immediate=${immediate})`);
-  const combinedText = items.map((m) => m.text).join(`
+  const combinedText = rewriteSlackMentions(items.map((m) => m.text).join(`
 ---
-`);
+`));
   const description = `[Thread follow-up — ${items.length} message(s) buffered]
 
 ${combinedText}`;

package/dist/{cli-h3k622d0.js → cli-6aq8xhvm.js}

@@ -1,7 +1,10 @@
 import {
   getDb,
-  init_db
-} from "./cli-ncfgsqbd.js";
+  getKv,
+  incrKv,
+  init_db,
+  upsertKv
+} from "./cli-15y7qhzp.js";
 
 // src/be/users.ts
 init_db();
@@ -51,6 +54,18 @@ function findUserByEmail(email) {
   }
   return null;
 }
+function findUsersByName(name) {
+  const trimmed = name.trim();
+  if (!trimmed)
+    return [];
+  const db = getDb();
+  const exact = db.prepare("SELECT * FROM users WHERE LOWER(name) = LOWER(?)").all(trimmed);
+  if (exact.length > 0)
+    return exact.map(rowToUser);
+  const firstToken = trimmed.split(/\s+/)[0] ?? trimmed;
+  const prefixed = db.prepare("SELECT * FROM users WHERE LOWER(name) LIKE LOWER(?) || '%'").all(firstToken);
+  return prefixed.map(rowToUser);
+}
 function getUserIdentities(userId) {
   return getDb().prepare("SELECT kind, externalId FROM user_external_ids WHERE userId = ? ORDER BY kind, externalId").all(userId);
 }
@@ -179,4 +194,76 @@ function fingerprintApiKey(rawKey) {
   return `op:${sha256Hex(rawKey).slice(0, 16)}`;
 }
 
-export { findUserById, findUserByExternalId, findUserByEmail, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, fingerprintApiKey };
+// src/be/identity.ts
+function resolveIdentity(kind, externalId) {
+  const user = findUserByExternalId(kind, externalId);
+  if (!user) {
+    return { status: "unknown", kind, externalId };
+  }
+  return {
+    status: "resolved",
+    kind,
+    externalId,
+    userId: user.id,
+    name: user.name,
+    email: user.email
+  };
+}
+function resolveIdentityByEmail(email) {
+  const user = findUserByEmail(email);
+  if (!user) {
+    return { status: "unknown", kind: "email", externalId: email };
+  }
+  return {
+    status: "resolved",
+    kind: "email",
+    externalId: email,
+    userId: user.id,
+    name: user.name,
+    email: user.email
+  };
+}
+function renderIdentity(resolution) {
+  const pair = `${resolution.kind}:${resolution.externalId}`;
+  if (resolution.status === "resolved") {
+    return `${resolution.name} (${pair})`;
+  }
+  return `${pair} (unknown user)`;
+}
+
+// src/be/unmapped-identities.ts
+init_db();
+var TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function namespace(kind) {
+  return `integration:unmapped:${kind}`;
+}
+function recordUnmappedIdentity(kind, externalId, meta) {
+  const ns = namespace(kind);
+  const now = new Date().toISOString();
+  const expiresAt = Date.now() + TTL_MS;
+  const countKey = `${externalId}:count`;
+  const countBefore = getKv(ns, countKey);
+  upsertKv({
+    namespace: ns,
+    key: `${externalId}:meta`,
+    value: {
+      lastSeenAt: now,
+      sampleEventType: meta.sampleEventType,
+      sampleContext: meta.sampleContext.slice(0, 100)
+    },
+    valueType: "json",
+    expiresAt
+  });
+  const incremented = incrKv(ns, countKey, 1);
+  if (countBefore === null) {
+    upsertKv({
+      namespace: ns,
+      key: countKey,
+      value: Number(incremented.value),
+      valueType: "integer",
+      expiresAt
+    });
+  }
+}
+
+export { findUserById, findUserByExternalId, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, fingerprintApiKey, resolveIdentity, resolveIdentityByEmail, renderIdentity, recordUnmappedIdentity };

package/dist/{cli-f3qa069v.js → cli-7xje5amz.js}

@@ -6,7 +6,7 @@ import {
   getDb,
   init_db,
   isSqliteVecAvailable
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 import {
   __esm,
   __export,