@desplega.ai/agent-swarm 1.119.6 → 1.121.0

package/dist/{cli-vg1jxfqz.js → cli-3b1ayz83.js}

@@ -27,7 +27,7 @@ import {
   getTaskById,
   init_db,
   setSlackMessageTracking
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 import {
   require_receiver,
   require_sender,
@@ -55073,13 +55073,13 @@ async function initSlackApp() {
     socketMode: true,
     logLevel: import_bolt.LogLevel.DEBUG
   });
-  const { registerMessageHandler } = await import("./handlers-xvrknk8w.js");
-  const { registerCommandHandler } = await import("./commands-6xr20jbe.js");
-  const { registerActionHandlers } = await import("./actions-qe5zjcbr.js");
+  const { registerMessageHandler } = await import("./handlers-fmfe2343.js");
+  const { registerCommandHandler } = await import("./commands-cxxye5e4.js");
+  const { registerActionHandlers } = await import("./actions-mwshtkf7.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
-  const { createAssistant } = await import("./assistant-4crt9dve.js");
+  const { createAssistant } = await import("./assistant-tg7dhfj8.js");
   app.assistant(createAssistant());
   return app;
 }

package/dist/{cli-r93nz80j.js → cli-3fxqwfh3.js}

@@ -6,7 +6,7 @@ import {
   getDb,
   init_db,
   isSqliteVecAvailable
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 import {
   __esm,
   __export,

package/dist/{cli-w6rhc30s.js → cli-3jrdwnn9.js}

@@ -1,14 +1,15 @@
+import {
+  import_websocket
+} from "./cli-4w4fmq9x.js";
 import {
   require_ecdsa_sig_formatter,
   require_jws,
   require_p_retry
 } from "./cli-b0p7rfnd.js";
 import {
-  import_websocket
-} from "./cli-4w4fmq9x.js";
-import {
+  resolveJsonSchemaStrictSampling,
   transformMessages
-} from "./cli-e0y603nn.js";
+} from "./cli-x0e0yvnq.js";
 import {
   sanitizeSurrogates
 } from "./cli-y2apkfe2.js";
@@ -25227,6 +25228,10 @@ function convertTools(tools, useParameters = false) {
     }
   ];
 }
+function supportsGoogleStrictToolSampling(modelId) {
+  const majorVersion = getGeminiMajorVersion(modelId);
+  return majorVersion !== undefined && majorVersion >= 3;
+}
 function mapToolChoice(choice) {
   switch (choice) {
     case "auto":
@@ -25239,6 +25244,16 @@ function mapToolChoice(choice) {
       return FunctionCallingConfigMode.AUTO;
   }
 }
+function resolveGoogleFunctionCallingMode(tools, toolChoice, supportsStrictMode) {
+  const useStrictMode = tools.some((tool) => resolveJsonSchemaStrictSampling(tool, supportsStrictMode) === true);
+  if (toolChoice === "none" || toolChoice === "any") {
+    return mapToolChoice(toolChoice);
+  }
+  if (useStrictMode) {
+    return FunctionCallingConfigMode.VALIDATED;
+  }
+  return toolChoice ? mapToolChoice(toolChoice) : undefined;
+}
 function mapStopReason(reason) {
   switch (reason) {
     case FinishReason.STOP:
@@ -25268,4 +25283,4 @@ function mapStopReason(reason) {
   }
 }
 
-export { ThinkingLevel, ResourceScope, GoogleGenAI, isThinkingPart, retainThoughtSignature, convertMessages, convertTools, mapToolChoice, mapStopReason };
+export { ThinkingLevel, ResourceScope, GoogleGenAI, isThinkingPart, retainThoughtSignature, convertMessages, convertTools, supportsGoogleStrictToolSampling, resolveGoogleFunctionCallingMode, mapStopReason };

package/dist/{cli-pasyk3vc.js → cli-46etyprn.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.119.6",
+    version: "1.121.0",
     description: "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
     license: "MIT",
     author: "desplega.sh <contact@desplega.sh>",
@@ -37,6 +37,7 @@ var init_package = __esm(() => {
       "plugin/skills/",
       "plugin/pi-skills/",
       "templates/",
+      "vendored-openapi/",
       "openapi.json"
     ],
     module: "src/http.ts",
@@ -65,6 +66,7 @@ var init_package = __esm(() => {
     ],
     scripts: {
       "build:pi-skills": "bun run plugin/build-pi-skills.ts",
+      "build:script-types": "bun scripts/bundle-script-types.ts",
       "build:cli": "bun run scripts/build-cli.ts",
       "mono:build": "turbo run build",
       "mono:test": "turbo run test",
@@ -75,10 +77,13 @@ var init_package = __esm(() => {
       "check:db-boundary": "bash scripts/check-db-boundary.sh",
       "check:dep-graph": "depcruise src plugin/opencode-plugins --config .dependency-cruiser.cjs",
       "check:api-key-boundary": "bash scripts/check-api-key-boundary.sh",
+      "check:vendored-openapi": "bun scripts/check-vendored-openapi.ts",
       "check:rbac-coverage": "bun scripts/check-rbac-coverage.ts",
+      "check:script-types": "bash scripts/check-script-types-freshness.sh",
       "check:audit-columns": "bash scripts/check-audit-columns.sh",
       "lint:structure": "konsistent check",
       "prepare-release": "bun scripts/prepare-release.ts",
+      "refresh:vendored-openapi": "bun scripts/refresh-vendored-openapi.ts",
       "sync-chart-version": "bun scripts/sync-chart-version.ts",
       "check-chart-version": "bun scripts/sync-chart-version.ts --check-if-package-version-changed",
       cli: "bun src/cli.tsx",
@@ -147,14 +152,14 @@ var init_package = __esm(() => {
       "@aws-sdk/client-bedrock": "3.1048.0",
       "@desplega.ai/business-use": "^0.4.2",
       "@desplega.ai/localtunnel": "^2.2.0",
-      "@earendil-works/pi-agent-core": "^0.81.1",
-      "@earendil-works/pi-ai": "^0.81.1",
-      "@earendil-works/pi-coding-agent": "^0.81.1",
+      "@earendil-works/pi-agent-core": "^0.82.1",
+      "@earendil-works/pi-ai": "^0.82.1",
+      "@earendil-works/pi-coding-agent": "^0.82.1",
       "@inkjs/ui": "^2.0.0",
       "@linear/sdk": "^77.0.0",
       "@modelcontextprotocol/sdk": "^1.25.1",
       "@openai/codex-sdk": "^0.145.0",
-      "@opencode-ai/sdk": "^1.18.4",
+      "@opencode-ai/sdk": "^1.18.5",
       "@openfort/openfort-node": "^0.9.1",
       "@opentelemetry/api": "^1.9.1",
       "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",

package/dist/{cli-433c0f4b.js → cli-4pfweq4x.js}

@@ -1,17 +1,17 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-d1reabed.js";
-import {
-  getSlackApp,
-  registerTreeMessage
-} from "./cli-vg1jxfqz.js";
+} from "./cli-g9vva2qh.js";
 import {
   rewriteSlackMentions
-} from "./cli-gdqdkr3j.js";
+} from "./cli-nf7sadev.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-q8dway4w.js";
+} from "./cli-s8bdcke2.js";
+import {
+  getSlackApp,
+  registerTreeMessage
+} from "./cli-3b1ayz83.js";
 import {
   buildBufferFlushBlocks
 } from "./cli-ma04faw5.js";
@@ -24,7 +24,7 @@ import {
   init_registry,
   registerTemplate,
   slackContextKey
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 
 // src/slack/event-dedup.ts
 var DEFAULT_TTL_MS = 300000;

package/dist/{cli-2r7s8jhp.js → cli-5c4327dx.js}

@@ -15,7 +15,7 @@ import {
   clampContextPercent,
   computeContextUsedUnified,
   getContextWindowSize
-} from "./cli-tghre7g6.js";
+} from "./cli-cw70hymf.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -26,6 +26,12 @@ init_secret_scrubber();
 
 // src/providers/claude-managed-models.ts
 var CLAUDE_MANAGED_MODEL_PRICING = {
+  "claude-opus-5": {
+    inputPerMillion: 5,
+    outputPerMillion: 25,
+    cacheReadPerMillion: 0.5,
+    cacheWritePerMillion: 6.25
+  },
   "claude-fable-5": {
     inputPerMillion: 10,
     outputPerMillion: 50,

package/dist/{cli-4s84mw72.js → cli-5hpvd15x.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-r93nz80j.js";
+} from "./cli-3fxqwfh3.js";
 import {
   getDb,
   init_db
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-branks1w.js → cli-6s3ytc5x.js}

@@ -17,7 +17,7 @@ import {
   CONTEXT_FORMULA,
   clampContextPercent,
   getContextWindowSize
-} from "./cli-tghre7g6.js";
+} from "./cli-cw70hymf.js";
 import {
   applyReasoningEffort
 } from "./cli-e61fs2hp.js";

package/dist/{cli-da3x3btq.js → cli-7pt9sc83.js}

@@ -6,7 +6,7 @@ import {
 } from "./cli-r94z9p1z.js";
 import {
   summarizeSession
-} from "./cli-n61x2aph.js";
+} from "./cli-dmzv0986.js";
 import {
   readPkgVersion
 } from "./cli-d6n0thxw.js";
@@ -31,7 +31,7 @@ import {
   CONTEXT_FORMULA,
   clampContextPercent,
   computeContextUsedUnified
-} from "./cli-tghre7g6.js";
+} from "./cli-cw70hymf.js";
 import {
   applyReasoningEffort
 } from "./cli-e61fs2hp.js";

package/dist/{cli-2gv8ygwr.js → cli-7pzae66m.js}

@@ -1,10 +1,10 @@
 import {
   PermissionVerbSchema
-} from "./cli-86fdnerz.js";
+} from "./cli-wwsaj97q.js";
 import {
   getDb,
   init_db
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 
 // src/be/rbac-roles.ts
 init_db();

package/dist/{cli-qs7nb3zn.js → cli-8wrympd7.js}

@@ -73,4 +73,30 @@ function createAssistantMessageEventStream() {
   return new AssistantMessageEventStream;
 }
 
-export { EventStream, AssistantMessageEventStream, createAssistantMessageEventStream };
+// node_modules/@earendil-works/pi-ai/dist/utils/diagnostics.js
+function formatThrownValue(value) {
+  if (value instanceof Error)
+    return value.message || value.name;
+  if (typeof value === "string")
+    return value;
+  return String(value);
+}
+function extractDiagnosticError(error) {
+  if (!(error instanceof Error))
+    return { name: "ThrownValue", message: formatThrownValue(error) };
+  const code = error.code;
+  return {
+    name: error.name || undefined,
+    message: error.message || error.name,
+    stack: error.stack,
+    code: typeof code === "string" || typeof code === "number" ? code : undefined
+  };
+}
+function createAssistantMessageDiagnostic(type, error, details) {
+  return { type, timestamp: Date.now(), error: extractDiagnosticError(error), details };
+}
+function appendAssistantMessageDiagnostic(message, diagnostic) {
+  message.diagnostics = [...message.diagnostics ?? [], diagnostic];
+}
+
+export { EventStream, AssistantMessageEventStream, createAssistantMessageEventStream, formatThrownValue, extractDiagnosticError, createAssistantMessageDiagnostic, appendAssistantMessageDiagnostic };

package/dist/{cli-qw1ccvxm.js → cli-95rbe11h.js}

@@ -2,30 +2,31 @@ import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
-  ensureTokenOrThrow,
-  getOAuthApp,
-  getOAuthTokens,
-  isTokenExpiringSoon,
+  ensureAuthorizationTokenOrThrow,
   oauthAppRowToProviderConfig
-} from "./cli-8hhms4hp.js";
+} from "./cli-tv7vekye.js";
 import {
-  CredentialBroker,
-  DEFAULT_CREDENTIAL_BINDINGS,
-  SwarmConfigCredentialBindingStore,
   getScript,
   getScriptApiConnectionDescriptors,
   getScriptMcpConnectionDescriptors,
   getScriptVersion,
   listRelationalCredentialBindings,
   validateScriptImports
-} from "./cli-bpvgs2y6.js";
+} from "./cli-072t49hf.js";
+import {
+  getAuthorizationById,
+  getOAuthApp,
+  getOAuthAppById
+} from "./cli-1728qh70.js";
 import {
   withSiblingAwareness
-} from "./cli-q8dway4w.js";
+} from "./cli-s8bdcke2.js";
 import {
   getAppUrl
 } from "./cli-dh55d5fg.js";
 import {
+  CredentialBroker,
+  DEFAULT_CREDENTIAL_BINDINGS,
   FollowUpConfigSchema,
   ModelTierSchema,
   ReasoningEffortSchema,
@@ -60,6 +61,7 @@ import {
   getWorkflowVersions,
   getWorkflowsByScheduleId,
   init_context_key,
+  init_credential_broker,
   init_db,
   init_telemetry,
   init_template,
@@ -72,13 +74,7 @@ import {
   updateWorkflowRun,
   updateWorkflowRunStep,
   workflowContextKey
-} from "./cli-g6qz2kts.js";
-import {
-  init_zod
-} from "./cli-bw80ck94.js";
-import {
-  exports_external
-} from "./cli-xz9aq0rf.js";
+} from "./cli-0df2g86x.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -86,6 +82,12 @@ import {
   scrubObject,
   scrubSecrets
 } from "./cli-4j2mrzag.js";
+import {
+  init_zod
+} from "./cli-bw80ck94.js";
+import {
+  exports_external
+} from "./cli-xz9aq0rf.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -2618,7 +2620,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp } = await import("./app-31x7k3vj.js");
+          const { getSlackApp } = await import("./app-skbty91x.js");
           const slackApp = getSlackApp();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -2732,7 +2734,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-31x7k3vj.js");
+        const { getSlackApp } = await import("./app-skbty91x.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -3027,60 +3029,71 @@ class ScriptExecutor extends BaseExecutor {
 init_zod();
 
 // src/be/script-credential-broker.ts
+init_credential_broker();
 init_secret_scrubber();
 init_db();
 
 // src/be/oauth-credential-bindings.ts
 var OAUTH_BINDING_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+function oauthAppToProviderConfig(app) {
+  return oauthAppRowToProviderConfig(app);
+}
 function getOAuthProviderConfig(provider) {
   const app = getOAuthApp(provider);
   return app ? oauthAppRowToProviderConfig(app) : null;
 }
-function getOAuthBindingTokenStatus(provider) {
-  if (!getOAuthApp(provider))
-    return "missing";
-  if (!getOAuthTokens(provider))
+function getOAuthBindingTokenStatus(oauthAuthorizationId) {
+  const authorization = getAuthorizationById(oauthAuthorizationId);
+  const app = authorization ? getOAuthAppById(authorization.appId) : null;
+  if (!authorization || !app || app.mcpServerId !== null) {
     return "missing";
-  return isTokenExpiringSoon(provider, OAUTH_BINDING_REFRESH_BUFFER_MS) ? "expiring" : "ok";
-}
-async function resolveOAuthBindingToken(provider) {
-  if (!getOAuthApp(provider))
+  }
+  if (authorization.status === "revoked")
+    return "revoked";
+  if (authorization.status === "refresh-failed")
+    return "refresh-failed";
+  if (!authorization.expiresAt)
+    return "ok";
+  const expiresAt = new Date(authorization.expiresAt).getTime();
+  return Number.isNaN(expiresAt) || expiresAt - Date.now() < OAUTH_BINDING_REFRESH_BUFFER_MS ? "expiring" : "ok";
+}
+async function resolveOAuthBindingToken(oauthAuthorizationId) {
+  const initial = getAuthorizationById(oauthAuthorizationId);
+  if (!initial)
     return;
-  const initialTokens = getOAuthTokens(provider);
-  if (!initialTokens)
+  const app = getOAuthAppById(initial.appId);
+  if (!app || app.mcpServerId !== null)
     return;
-  if (isTokenExpiringSoon(provider, OAUTH_BINDING_REFRESH_BUFFER_MS)) {
-    await ensureTokenOrThrow(provider, OAUTH_BINDING_REFRESH_BUFFER_MS);
+  if (initial.status === "revoked")
+    return;
+  const status = getOAuthBindingTokenStatus(oauthAuthorizationId);
+  if (status === "expiring" || status === "refresh-failed") {
+    await ensureAuthorizationTokenOrThrow(oauthAuthorizationId, OAUTH_BINDING_REFRESH_BUFFER_MS);
   }
-  return getOAuthTokens(provider)?.accessToken;
+  return getAuthorizationById(oauthAuthorizationId)?.accessToken;
 }
 
 // src/be/script-credential-broker.ts
-class RelationalCredentialBindingStore extends SwarmConfigCredentialBindingStore {
+class RelationalCredentialBindingStore {
   listActiveBindings(context) {
-    const relational = listRelationalCredentialBindings(context);
-    if (relational.length > 0)
-      return relational;
-    return super.listActiveBindings(context);
+    return listRelationalCredentialBindings(context);
   }
 }
-async function buildScriptCredentialBindings(input) {
+async function buildScriptCredentialBindingsWithFailures(input) {
   const resolvedConfigs = getResolvedConfig(input.agentId, input.repoId);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
-  const broker = new CredentialBroker(new RelationalCredentialBindingStore((filters) => getSwarmConfigs(filters)), (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS, async (provider) => {
-    try {
-      return await resolveOAuthBindingToken(provider);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      console.warn(`[script-credential-broker] skipping OAuth provider ${provider}: ${scrubSecrets(message)}`);
-      return;
-    }
+  const broker = new CredentialBroker(new RelationalCredentialBindingStore, (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS, (oauthAuthorizationId) => resolveOAuthBindingToken(oauthAuthorizationId));
+  const { resolved, failed } = await broker.resolveBindingsWithFailures({
+    agentId: input.agentId,
+    repoId: input.repoId
   });
-  const bindings = await broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
-  for (const binding of bindings) {
+  for (const binding of resolved) {
     registerVolatileSecret(binding.value, binding.configKey);
   }
-  return bindings;
+  return { egressSecrets: resolved, failedBindings: failed };
+}
+async function buildScriptCredentialBindings(input) {
+  return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
 }
 
 // src/scripts-runtime/executors/types.ts
@@ -3098,6 +3111,7 @@ var DEFAULT_SCRIPT_RESOURCES = {
 init_secret_scrubber();
 
 // src/scripts-runtime/egress-secrets.ts
+init_credential_broker();
 async function buildEgressSecrets() {
   const broker = new CredentialBroker({ listActiveBindings: () => [] }, (configKey) => process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS);
   return await broker.resolveBindings({});
@@ -3349,6 +3363,7 @@ async function buildConfigPayload(input) {
     },
     user: input.userConfig ?? {},
     egressSecrets: input.egressSecrets ?? await buildEgressSecrets(),
+    failedBindings: input.failedBindings ?? [],
     apiConnections: input.apiConnections ?? [],
     mcpConnections: input.mcpConnections ?? []
   };
@@ -3441,12 +3456,16 @@ class SwarmScriptExecutor extends BaseExecutor {
     if (!resolved.ok) {
       return { status: "failed", error: resolved.error };
     }
+    const credentials = await buildScriptCredentialBindingsWithFailures({
+      agentId: agentId ?? undefined
+    });
     const output = await runScript({
       source: resolved.source,
       args: config.args,
       fsMode: "none",
       agentId: agentId ?? "workflow",
-      egressSecrets: await buildScriptCredentialBindings({ agentId: agentId ?? undefined }),
+      egressSecrets: credentials.egressSecrets,
+      failedBindings: credentials.failedBindings,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agentId ?? undefined }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs
@@ -3806,4 +3825,4 @@ function initWorkflows() {
   initWaitBusSubscriptions(_registry);
 }
 
-export { getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindings, runScript, generateEdges, findEntryNodes, getSuccessors, validateDefinition, applyDefinitionPatch, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, getExecutorRegistry, initWorkflows };
+export { oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings, runScript, generateEdges, findEntryNodes, getSuccessors, validateDefinition, applyDefinitionPatch, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, getExecutorRegistry, initWorkflows };

package/dist/{cli-6rvm3jkk.js → cli-agdrxyex.js}

@@ -18,7 +18,7 @@ import {
   init_templates1 as init_templates,
   normalizeDateRequired,
   resolveTemplate
-} from "./cli-g6qz2kts.js";
+} from "./cli-0df2g86x.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();