@desplega.ai/agent-swarm 1.119.0 → 1.119.2

package/src/be/seed/agent-fs-provision.ts

@@ -19,7 +19,7 @@ const PROVISION_HASH_KEY = "AGENT_FS_PROVISION_HASH";
 const API_KEY_CONFIG = "API_AGENT_FS_API_KEY";
 const LEGACY_SHARED_KEY_CONFIG = "AGENT_FS_API_KEY";
 
-type Role = "viewer" | "editor" | "admin";
+export type Role = "viewer" | "editor" | "admin";
 
 type AgentFsSeedItem = SeedItem & {
   apiUrl: string;
@@ -181,9 +181,49 @@ export async function ensureAgentFsSharedProvisioning(options?: {
     upsertSwarmConfig({ scope: "global", key, value, isSecret: false, description });
   }
 
+  // Export the URL and re-run provider selection: when provisioning lands
+  // lazily (first /api/fs/agent-credentials call instead of the boot seeder),
+  // the file-storage provider may already be memoized as local-fs — without
+  // this, agent-fs stays inactive until a process restart even though every
+  // credential it needs now exists. Lazy import: a static be/seed → fs edge
+  // shifts module-init order for the whole seed graph.
+  process.env.AGENT_FS_API_URL = apiUrl;
+  const { resetFileStorageProvider } = await import("../../fs/registry");
+  resetFileStorageProvider();
+
   return { apiUrl, apiKey, orgId, driveId, authHeaders };
 }
 
+/**
+ * Invite an external (non-agent) member into the shared org using the
+ * API-owned bootstrap credentials. Powers `POST /api/fs/members/invite` so
+ * callers holding the tenant API key (e.g. the cloud control plane's
+ * Connect-to-Drive flow) never need the bootstrap key itself — it is
+ * API-only and never served over HTTP.
+ */
+export async function inviteEmailToSharedOrg(
+  email: string,
+  role: Role,
+): Promise<{ orgId: string; invited: boolean }> {
+  const shared = await ensureAgentFsSharedProvisioning();
+  const currentRoles = await getCurrentOrgMemberRoles(
+    shared.apiUrl,
+    shared.authHeaders,
+    shared.orgId,
+  );
+  const currentRole = currentRoles.get(email.trim().toLowerCase());
+  if (currentRole && roleRank(currentRole) >= roleRank(role)) {
+    return { orgId: shared.orgId, invited: false };
+  }
+  await agentFsRequest(shared.apiUrl, `/orgs/${encodeURIComponent(shared.orgId)}/members/invite`, {
+    method: "POST",
+    headers: shared.authHeaders,
+    body: { email: email.trim(), role },
+    allowConflict: true,
+  });
+  return { orgId: shared.orgId, invited: true };
+}
+
 export async function ensureAgentFsCredentialsForAgent(agentId: string): Promise<{
   enabled: boolean;
   created: boolean;

package/src/fs/registry.ts

@@ -21,6 +21,18 @@ export function selectProvider(): FileStorageProvider {
   return new LocalFsProvider();
 }
 
-export function resetFileStorageProviderForTests(): void {
+/**
+ * Drop the memoized provider so the next `getFileStorageProvider()` re-runs
+ * selection against current `process.env`. Needed by the config reload path:
+ * agent-fs provisioning can land AFTER the first fs request memoized
+ * `local-fs` (e.g. cloud swarms where the boot seeder had no
+ * AGENT_FS_API_URL yet), and without a reset the process is stuck on the
+ * wrong provider until restart.
+ */
+export function resetFileStorageProvider(): void {
   memoizedProvider = null;
 }
+
+export function resetFileStorageProviderForTests(): void {
+  resetFileStorageProvider();
+}

package/src/http/core.ts

@@ -64,6 +64,14 @@ export type ReloadConfigResult = {
 export async function reloadGlobalConfigsAndIntegrations(): Promise<ReloadConfigResult> {
   const updated = loadGlobalConfigsIntoEnv(true);
 
+  // File-storage provider selection reads process.env once and memoizes; the
+  // env we just (re)hydrated may flip it (local-fs → agent-fs after late
+  // provisioning, or a rotated bootstrap key). Reset so the next fs request
+  // re-selects — provider construction is cheap and stateless. Lazy import
+  // keeps http/core out of the fs module-init graph.
+  const { resetFileStorageProvider } = await import("../fs/registry");
+  resetFileStorageProvider();
+
   const integrations: string[] = [];
 
   resetAgentMail();

package/src/http/fs.ts

@@ -8,7 +8,10 @@ import {
   getTaskById,
   insertTaskAttachment,
 } from "../be/db";
-import { ensureAgentFsCredentialsForAgent } from "../be/seed/agent-fs-provision";
+import {
+  ensureAgentFsCredentialsForAgent,
+  inviteEmailToSharedOrg,
+} from "../be/seed/agent-fs-provision";
 import { type FileObject, type FileScope, FilesError, normalizeFilesError } from "../fs/provider";
 import { getFileStorageProvider } from "../fs/registry";
 import { can, type RbacPrincipal, type RbacResource } from "../rbac";
@@ -63,6 +66,30 @@ const ensureAgentCredentialsRoute = route({
   auth: { apiKey: true, agentId: true },
 });
 
+const inviteMemberRoute = route({
+  method: "post",
+  path: "/api/fs/members/invite",
+  pattern: ["api", "fs", "members", "invite"],
+  summary: "Invite an external member into the agent-fs shared org",
+  description:
+    "The API server performs the invite with its own bootstrap credentials (which are API-only and never served over HTTP), provisioning the shared org/drive first when needed. Intended for the cloud control plane's Connect-to-Drive flow. No keys are returned; the invitee obtains their own key via agent-fs registration.",
+  tags: ["FS"],
+  body: z.object({
+    email: z.email(),
+    role: z.enum(["viewer", "editor", "admin"]).default("editor"),
+  }),
+  responses: {
+    200: { description: "Invite state ({ orgId, invited })" },
+    400: { description: "Invalid body" },
+    500: { description: "Provisioning or invite failed" },
+  },
+  auth: { apiKey: true },
+  rbac: {
+    ungated:
+      "Tenant API key is the org-owner credential; the invite runs under the API server's own bootstrap identity, no per-agent principal applies.",
+  },
+});
+
 const listTaskFilesRoute = route({
   method: "get",
   path: "/api/fs/tasks/{taskId}/files",
@@ -182,6 +209,19 @@ export async function handleFs(
     return true;
   }
 
+  if (inviteMemberRoute.match(req.method, pathSegments)) {
+    const parsed = await inviteMemberRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    try {
+      const result = await inviteEmailToSharedOrg(parsed.body.email, parsed.body.role);
+      json(res, result);
+    } catch (error) {
+      const message = scrubSecrets(error instanceof Error ? error.message : String(error));
+      jsonError(res, `Failed to invite member to agent-fs shared org: ${message}`, 500);
+    }
+    return true;
+  }
+
   if (downloadTaskFileRoute.match(req.method, pathSegments)) {
     const parsed = await downloadTaskFileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;

package/src/tests/agent-fs-provision-seeder.test.ts

@@ -12,9 +12,11 @@ import { runSeeder } from "../be/seed";
 import {
   agentFsProvisionSeeder,
   ensureAgentFsCredentialsForAgent,
+  inviteEmailToSharedOrg,
   resetAgentFsProvisionFetchForTests,
   setAgentFsProvisionFetchForTests,
 } from "../be/seed/agent-fs-provision";
+import { getFileStorageProvider, resetFileStorageProviderForTests } from "../fs/registry";
 
 const TEST_DB_PATH = `./test-agent-fs-provision-seeder-${process.pid}.sqlite`;
 const ORIGINAL_ENV = {
@@ -143,6 +145,11 @@ describe("agent-fs provisioning seeder", () => {
   afterEach(() => {
     resetAgentFsProvisionFetchForTests();
     restoreEnv();
+    // ensureAgentFsSharedProvisioning now resets the fs-provider memo as a
+    // side effect; re-select under the restored env so no provider state
+    // leaks into later test files.
+    resetFileStorageProviderForTests();
+    getFileStorageProvider();
   });
 
   afterAll(async () => {
@@ -491,4 +498,37 @@ describe("agent-fs provisioning seeder", () => {
     expect(second.created).toBe(false);
     expect(records).toEqual([]);
   });
+
+  test("invites an external email into the shared org with the requested role", async () => {
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+
+    const records: RequestRecord[] = [];
+    setAgentFsProvisionFetchForTests(createFetchStub(records));
+
+    const result = await inviteEmailToSharedOrg("Customer@Example.test ", "admin");
+
+    expect(result).toEqual({ orgId: "shared-org", invited: true });
+    const invite = records.find((r) => r.path === "/orgs/shared-org/members/invite");
+    expect(invite?.method).toBe("POST");
+    expect(invite?.body).toEqual({ email: "Customer@Example.test", role: "admin" });
+    expect(invite?.authorization).toBe("Bearer afs-admin-key");
+  });
+
+  test("does not re-invite an external email whose current role already covers the request", async () => {
+    process.env.AGENT_FS_API_URL = "https://agent-fs.example.test/";
+    process.env.AGENT_FS_REGISTER_EMAIL = "admin@example.test";
+
+    const records: RequestRecord[] = [];
+    setAgentFsProvisionFetchForTests(
+      createFetchStub(records, {
+        members: [{ email: "customer@example.test", role: "admin" }],
+      }),
+    );
+
+    const result = await inviteEmailToSharedOrg("customer@example.test", "editor");
+
+    expect(result).toEqual({ orgId: "shared-org", invited: false });
+    expect(records.filter((r) => r.path === "/orgs/shared-org/members/invite")).toEqual([]);
+  });
 });

package/src/tests/preload.ts

@@ -1,7 +1,28 @@
 import { Database } from "bun:sqlite";
+import { afterEach } from "bun:test";
 import { existsSync } from "node:fs";
 import { closeDb, getDb, initDb } from "../be/db";
 
+// @hono/node-server (pulled in transitively by @modelcontextprotocol/sdk's
+// streamableHttp transport) replaces globalThis.Response/Request with its own
+// lightweight Node-adapter classes the first time getRequestListener() runs.
+// Bun.serve rejects those ("Expected a Response object, but received
+// '_Response'"), so every suite that constructs a `new Response()` AFTER an
+// MCP-HTTP test fails — but only under file orders where the MCP tests run
+// first, which is why this bites Linux CI and not macOS (bun's test-file order
+// is platform-dependent and not controllable via CLI args). Pin the natives
+// back after every test.
+const nativeResponse = globalThis.Response;
+const nativeRequest = globalThis.Request;
+afterEach(() => {
+  if (globalThis.Response !== nativeResponse) {
+    globalThis.Response = nativeResponse;
+  }
+  if (globalThis.Request !== nativeRequest) {
+    globalThis.Request = nativeRequest;
+  }
+});
+
 // macOS ships a system libsqlite3 compiled WITHOUT dynamic extension loading, so
 // `require("sqlite-vec").load(db)` throws and the hybrid-search vector arm is
 // silently disabled — the memory-hybrid tests then see retrievalSource "fts"

package/src/tests/prompt-template-resolver.test.ts

@@ -9,6 +9,7 @@ import {
   registerTemplate,
 } from "../prompts/registry";
 import { resolveTemplate } from "../prompts/resolver";
+import { restoreAllTemplateDefinitions } from "./template-registry-helpers";
 
 const TEST_DB_PATH = "./test-prompt-resolver.sqlite";
 
@@ -36,6 +37,11 @@ describe("Prompt Template Resolver", () => {
         // File doesn't exist
       }
     }
+    // This file clears the process-wide registry; heal it so later test files
+    // (whose import graphs already evaluated the template modules) don't
+    // resolve empty templates. CI(Linux)-only breakage otherwise — see
+    // template-registry-helpers.ts.
+    await restoreAllTemplateDefinitions();
   });
 
   // ============================================================================

package/src/tests/prompt-template-session.test.ts

@@ -7,6 +7,7 @@ import {
   getTemplateDefinition,
 } from "../prompts/registry";
 import { resolveTemplate } from "../prompts/resolver";
+import { restoreAllTemplateDefinitions } from "./template-registry-helpers";
 
 // Side-effect import: register session + system templates
 import "../prompts/session-templates";
@@ -43,6 +44,11 @@ afterAll(async () => {
       // File doesn't exist
     }
   }
+  // This file clears the process-wide registry; heal it so later test files
+  // (whose import graphs already evaluated the template modules) don't
+  // resolve empty templates. CI(Linux)-only breakage otherwise — see
+  // template-registry-helpers.ts.
+  await restoreAllTemplateDefinitions();
 });
 
 // ============================================================================

package/src/tests/template-registry-helpers.ts

@@ -0,0 +1,29 @@
+/**
+ * Restore the process-wide prompt-template registry after a test file has
+ * called clearTemplateDefinitions().
+ *
+ * Template modules register their definitions as a module-load side effect,
+ * and bun caches modules per process — so once a file clears the registry,
+ * every later test file whose import graph already evaluated the template
+ * modules silently resolves empty templates (empty task bodies, no visible
+ * throw). Which files run "later" depends on bun's platform-specific file
+ * order, so the breakage is typically CI(Linux)-only. Cache-busted dynamic
+ * imports re-run the registerTemplate() side effects unconditionally.
+ *
+ * Call this from afterAll in any file that clears the registry; victims of
+ * historical leaks also call it defensively from beforeAll/beforeEach (see
+ * agentmail-handlers, heartbeat-checklist, prompt-template-remaining).
+ */
+export async function restoreAllTemplateDefinitions(): Promise<void> {
+  const ts = Date.now();
+  await import(`../agentmail/templates?t=${ts}`);
+  await import(`../commands/templates?t=${ts}`);
+  await import(`../github/templates?t=${ts}`);
+  await import(`../gitlab/templates?t=${ts}`);
+  await import(`../heartbeat/templates?t=${ts}`);
+  await import(`../jira/templates?t=${ts}`);
+  await import(`../linear/templates?t=${ts}`);
+  await import(`../prompts/session-templates?t=${ts}`);
+  await import(`../slack/templates?t=${ts}`);
+  await import(`../tools/templates?t=${ts}`);
+}

package/dist/{azure-openai-responses-gm1ejtmn.js → azure-openai-responses-f57n5qy7.js}

@@ -10,14 +10,14 @@ import {
 import {
   AzureOpenAI
 } from "./cli-sajgpkqg.js";
-import {
-  formatProviderError,
-  normalizeProviderError
-} from "./cli-pscrc6tw.js";
 import"./cli-zyxs93y9.js";
 import {
   getProviderEnvValue
 } from "./cli-4wgngmwv.js";
+import {
+  formatProviderError,
+  normalizeProviderError
+} from "./cli-pscrc6tw.js";
 import {
   buildBaseOptions
 } from "./cli-bsyka9ta.js";

package/dist/{claude-managed-setup-cm05wtek.js → claude-managed-setup-eac00cqn.js}

@@ -1,10 +1,10 @@
-import"./cli-tk9vyqzh.js";
 import {
   Anthropic,
   BadRequestError,
   ConflictError,
   toFile
 } from "./cli-gz9sbyk3.js";
+import"./cli-tk9vyqzh.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";

package/dist/{cli-6b4wwmm8.js → cli-0qy7bk86.js}

@@ -9,15 +9,15 @@ import {
   require_dist,
   require_dist1 as require_dist2
 } from "./cli-hv2fndhm.js";
-import {
-  normalizeProviderError
-} from "./cli-pscrc6tw.js";
 import {
   parseStreamingJson
 } from "./cli-zyxs93y9.js";
 import {
   getProviderEnvValue
 } from "./cli-4wgngmwv.js";
+import {
+  normalizeProviderError
+} from "./cli-pscrc6tw.js";
 import {
   adjustMaxTokensForThinking,
   buildBaseOptions,

package/dist/{google-vertex-8bs2pzgn.js → google-vertex-9hhq68sw.js}

@@ -12,13 +12,13 @@ import {
 import"./cli-b0p7rfnd.js";
 import"./cli-4w4fmq9x.js";
 import"./cli-e15jhafb.js";
+import {
+  getProviderEnvValue
+} from "./cli-4wgngmwv.js";
 import {
   formatProviderError,
   normalizeProviderError
 } from "./cli-pscrc6tw.js";
-import {
-  getProviderEnvValue
-} from "./cli-4wgngmwv.js";
 import {
   buildBaseOptions
 } from "./cli-bsyka9ta.js";

package/dist/{mistral-conversations-7gqnz2wt.js → mistral-conversations-tn4sj5qv.js}

@@ -1,6 +1,3 @@
-import {
-  shortHash
-} from "./cli-5m9j2spm.js";
 import {
   BuiltInConnectors$inboundSchema,
   BuiltInConnectors$outboundSchema,
@@ -37,6 +34,9 @@ import {
   smartUnion,
   unwrapAsync
 } from "./cli-1yjrbg1f.js";
+import {
+  shortHash
+} from "./cli-5m9j2spm.js";
 import"./cli-sq7f72d6.js";
 import {
   ZodFirstPartyTypeKind

package/dist/{openai-codex-responses-3nkvje79.js → openai-codex-responses-bex0bpn6.js}

@@ -16,12 +16,12 @@ import {
 import {
   resolveHttpProxyUrlForTarget
 } from "./cli-cwy5hqbq.js";
+import"./cli-zyxs93y9.js";
+import"./cli-4wgngmwv.js";
 import {
   formatProviderError,
   normalizeProviderError
 } from "./cli-pscrc6tw.js";
-import"./cli-zyxs93y9.js";
-import"./cli-4wgngmwv.js";
 import {
   buildBaseOptions
 } from "./cli-bsyka9ta.js";

package/dist/{openai-completions-0asftkwg.js → openai-completions-gygw5cxt.js}

@@ -1,23 +1,23 @@
+import {
+  buildCopilotDynamicHeaders,
+  hasCopilotVisionInput
+} from "./cli-67bad0ze.js";
 import {
   clampOpenAIPromptCacheKey
 } from "./cli-mrptpp86.js";
 import {
   OpenAI
 } from "./cli-sajgpkqg.js";
-import {
-  buildCopilotDynamicHeaders,
-  hasCopilotVisionInput
-} from "./cli-67bad0ze.js";
-import {
-  formatProviderError,
-  normalizeProviderError
-} from "./cli-pscrc6tw.js";
 import {
   parseStreamingJson
 } from "./cli-zyxs93y9.js";
 import {
   getProviderEnvValue
 } from "./cli-4wgngmwv.js";
+import {
+  formatProviderError,
+  normalizeProviderError
+} from "./cli-pscrc6tw.js";
 import {
   buildBaseOptions,
   transformMessages

package/dist/{openai-responses-pmatek45.js → openai-responses-8c0dgmty.js}

@@ -4,24 +4,24 @@ import {
   processResponsesStream
 } from "./cli-sdpnhajn.js";
 import"./cli-5m9j2spm.js";
+import {
+  buildCopilotDynamicHeaders,
+  hasCopilotVisionInput
+} from "./cli-67bad0ze.js";
 import {
   clampOpenAIPromptCacheKey
 } from "./cli-mrptpp86.js";
 import {
   OpenAI
 } from "./cli-sajgpkqg.js";
+import"./cli-zyxs93y9.js";
 import {
-  buildCopilotDynamicHeaders,
-  hasCopilotVisionInput
-} from "./cli-67bad0ze.js";
+  getProviderEnvValue
+} from "./cli-4wgngmwv.js";
 import {
   formatProviderError,
   normalizeProviderError
 } from "./cli-pscrc6tw.js";
-import"./cli-zyxs93y9.js";
-import {
-  getProviderEnvValue
-} from "./cli-4wgngmwv.js";
 import {
   buildBaseOptions
 } from "./cli-bsyka9ta.js";