@desplega.ai/agent-swarm 1.123.0 → 1.124.0

package/src/prompts/session-templates.ts

@@ -336,9 +336,8 @@ registerTemplate({
 You have access to agent-fs — a persistent, searchable filesystem shared across the swarm.
 Use the \`agent-fs\` CLI for all thoughts, research, plans, and shared documents.
 
-The \`agent-fs\` skill (from the agent-fs Claude Code plugin) provides a full CLI reference —
-it auto-injects on relevant Bash tool calls. You can also run \`agent-fs docs\` for
-interactive CLI documentation.
+The \`agent-fs\` skill (installed in your skills directory) provides a full CLI
+reference. You can also run \`agent-fs docs\` for interactive CLI documentation.
 
 ### Writing to your personal drive (default)
 \`\`\`bash
@@ -434,10 +433,68 @@ Use this to debug issues and propose improvements to your own infrastructure.
   category: "system",
 });
 
+/**
+ * Script authoring contract — the call convention every script must follow.
+ *
+ * Included at the top of `system.agent.script_rubric` so it reaches every
+ * composite that carries the rubric (lead, worker, worker.pi, lead.pi) without
+ * a per-composite edit. The scripts-only composite path renders after one of
+ * those composites, so it must NOT restate the signature (duplicate guidance).
+ *
+ * Facts here are derived from `src/scripts-runtime/ctx.ts` (+ the generated
+ * `types/swarm-sdk.d.ts`); do not add ctx members that don't exist.
+ */
+registerTemplate({
+  eventType: "system.agent.script_authoring_contract",
+  header: "",
+  defaultBody: `
+### Script Authoring Contract (read BEFORE writing any script)
+
+**Entry point — \`args\` FIRST, \`ctx\` SECOND.** A one-parameter \`function (ctx)\` can execute through \`script-run\`, but at runtime that parameter receives \`args\`, so every \`ctx.*\` access throws. \`script-upsert\` also rejects an untyped parameter under strict typechecking. This is the single most common cause of failed script runs.
+
+\`\`\`ts
+import type { ScriptContext } from "swarm-sdk";
+import * as z from "zod";
+
+export const argsSchema = z.object({ taskId: z.string(), limit: z.number().optional() });
+
+export default async function (args: z.infer<typeof argsSchema>, ctx: ScriptContext) {
+  const res = await ctx.swarm.task_get({ taskId: args.taskId });
+  const task = ((res as { data?: unknown }).data ?? res) as { title?: string };
+  return { title: task?.title };
+}
+\`\`\`
+
+**Typechecking:** inline source passed to \`script-run\` executes without a compile-time typecheck. \`script-upsert\` typechecks before saving, so import \`ScriptContext\` from \`"swarm-sdk"\` as shown above to make inline code promotion-safe. Use \`script-query-types\` for the authoritative SDK and stdlib declarations.
+
+**What \`ctx\` actually holds for inline/named scripts (\`script-run\` / \`script-upsert\`) — nothing else:**
+- \`ctx.swarm.*\` — the swarm SDK: \`task_get\`, \`task_send\`, \`task_storeProgress\`, \`task_action\`, \`task_list\`, \`message_post\`, \`message_read\`, \`slack_reply\`, \`memory_search\`, \`kv_get\`/\`kv_set\`/\`kv_del\`/\`kv_incr\`/\`kv_list\`, \`swarm_get\`, \`agent_info\`, and more. Responses are usually wrapped — prefer \`res?.data ?? res\`.
+- \`ctx.swarm.config\` — \`apiKey\`, \`agentId\`, \`mcpBaseUrl\`, plus \`ctx.swarm.config.get("KEY")\` for user values. All are \`Redacted\` wrappers: they stringify to \`<redacted>\`, and you must never unwrap them into a return value, log line, or request body you build by hand.
+- \`ctx.api.<slug>\` / \`ctx.mcp.<slug>\` — typed clients for connections the lead registered (\`ctx.api.<slug>.<operationId>(...)\`, \`ctx.api.<slug>.graphql(query, vars)\`, \`ctx.mcp.<slug>.<toolName>(args)\`). They exist ONLY for registered connections — introspect with \`Object.keys(ctx.api ?? {})\` / \`Object.keys(ctx.mcp ?? {})\` before assuming one is there.
+- \`ctx.stdlib\` — \`fetch\`, \`fetchJson\` (retries + 30s timeout), \`grep\`, \`glob\`, \`table\`, \`Redacted\`.
+- \`ctx.logger\` — \`log\` / \`warn\` / \`error\`.
+
+There is NO ambient task context: \`taskId\` must arrive through \`args\`. \`agentId\` IS propagated automatically (\`X-Agent-ID\` header).
+
+**Durable workflow scripts (\`launch-script-run\`) get a DIFFERENT \`ctx\`:** \`ctx.run\` (\`id\`/\`agentId\`/\`args\`), \`ctx.step.rawLlm(label, config)\` / \`ctx.step.agentTask(label, config)\` / \`ctx.step.swarmScript(label, config)\` (durable, journaled steps), plus \`ctx.swarm.*\`, \`ctx.stdlib\`, \`ctx.logger\` as above. Durable runs have NO \`ctx.api\`/\`ctx.mcp\` connection clients and no \`ctx.swarm.config\` — call connections from an inner script via \`ctx.step.swarmScript\` instead.
+
+**\`argsSchema\` convention:** export a Zod schema named \`argsSchema\` from every named script. \`script-upsert\` converts it to JSON Schema, so callers, schedules, and workflows can see the script's input contract. Without it the script's args are undocumented.
+
+**Secrets — never paste a raw value:**
+- Prefer a registered connection (\`ctx.api.<slug>\` / \`ctx.mcp.<slug>\`): its credentials are attached server-side and never enter the script.
+- Otherwise put the placeholder \`[REDACTED:<CONFIG_KEY>]\` in the header or query value (e.g. \`Authorization: Bearer [REDACTED:GITHUB_TOKEN]\`). The runtime substitutes the real value at egress, and only for that credential binding's allowed hosts.
+- NEVER bake a raw secret — or the output of \`get-config\` with \`includeSecrets: true\` — into script source, script args, a schedule's \`taskTemplate\`, or a task description. Those are stored as plaintext and replayed on every run. Use a connection or a credential binding instead.
+`,
+  variables: [],
+  category: "system",
+});
+
 registerTemplate({
   eventType: "system.agent.script_rubric",
   header: "",
   defaultBody: `
+{{@template[system.agent.script_authoring_contract]}}
+
 ### Agent Scripts — for bulk, repetitive, or data-heavy work
 
 Use **scripts** (\`script-upsert\` + \`script-run\`) when a task involves repetitive SDK calls, large data processing, or deterministic multi-step pipelines. Scripts run out-of-process and return only their final result.
@@ -479,13 +536,7 @@ registerTemplate({
 
 This swarm runs in **scripts-only mode**. The ONLY swarm MCP tools available are the script tools: \`script-search\`, \`script-run\`, \`script-upsert\`, \`script-delete\`, \`script-query-types\`, \`launch-script-run\`, \`get-script-run\`, \`list-script-runs\` (your harness may expose them under a prefix, e.g. \`mcp__agent-swarm__script-run\` — use the exact registered tool id). They are already loaded. Named tools like \`store-progress\`, \`send-task\`, \`post-message\`, \`memory-search\` do NOT exist here — do not search for them.
 
-**Script entry signature (memorize — args FIRST, ctx SECOND):**
-
-\`\`\`ts
-export default async function (args: any, ctx: any) { /* ... */ }
-\`\`\`
-
-The full SDK is \`ctx.swarm.*\` — task lifecycle (\`task_get\`, \`task_send\`, \`task_storeProgress\`, \`task_action\`, \`task_list\`), messaging (\`message_post\`, \`message_read\`), Slack (\`slack_reply\`, \`slack_post\`, \`slack_read\`), memory, kv, swarm info (\`swarm_get\`, \`agent_info\`), and more. Responses are usually wrapped — prefer \`res?.data ?? res\`.
+The script authoring contract above (entry signature, \`ctx\` shape, secret handling) applies here unchanged. The full SDK is \`ctx.swarm.*\` — task lifecycle (\`task_get\`, \`task_send\`, \`task_storeProgress\`, \`task_action\`, \`task_list\`), messaging (\`message_post\`, \`message_read\`), Slack (\`slack_reply\`, \`slack_post\`, \`slack_read\`), memory, kv, swarm info (\`swarm_get\`, \`agent_info\`), and more. Responses are usually wrapped — prefer \`res?.data ?? res\`.
 
 **Built-in coordination scripts — USE THESE FIRST (\`script-run\` with \`name\` + \`args\`):**
 - \`delegate\` {agentName, task, parentTaskId?} → subtask for an agent by name; returns {taskId}
@@ -535,6 +586,18 @@ You have access to the \`context-mode\` MCP tools (\`batch_execute\`, \`execute\
 
 {{@template[system.agent.script_rubric]}}
 
+{{@template[system.agent.scheduling]}}
+`,
+  variables: [],
+  category: "system",
+});
+
+// Standalone so the pi composites (which drop `system.agent.context_mode` and
+// its ctx_* tool advertisement) can still include the scheduling rules.
+registerTemplate({
+  eventType: "system.agent.scheduling",
+  header: "",
+  defaultBody: `
 ### Scheduling — Pick the Right targetType
 
 When creating a schedule, match \`targetType\` to the work being fired:
@@ -807,8 +870,9 @@ registerTemplate({
 // Pi-specific worker composite. Identical to `system.session.worker` except it
 // omits only the `system.agent.context_mode` MCP-tool block — pi has no
 // context-mode MCP wiring yet, so advertising the `ctx_*` tools would point at
-// phantom tools. It still includes the shared script rubric and seed-script
-// guidance so pi sessions get the same bulk-work decision policy (DES-514).
+// phantom tools. It still includes the shared script rubric, scheduling rules,
+// and seed-script guidance so pi sessions get the same bulk-work decision
+// policy (DES-514).
 registerTemplate({
   eventType: "system.session.worker.pi",
   header: "",
@@ -819,6 +883,36 @@ registerTemplate({
 {{@template[system.agent.filesystem]}}
 {{@template[system.agent.self_awareness]}}
 {{@template[system.agent.script_rubric]}}
+{{@template[system.agent.scheduling]}}
+{{@template[system.agent.seed_scripts]}}
+
+{{@template[system.agent.system]}}
+{{@template[system.agent.share_urls]}}
+{{@template[system.agent.code_quality]}}`,
+  variables: [
+    { name: "role", description: "The agent's role" },
+    { name: "agentId", description: "The agent's unique identifier" },
+  ],
+  category: "session",
+});
+
+// Pi-specific lead composite. Identical to `system.session.lead` except it
+// omits only the `system.agent.context_mode` MCP-tool block — pi has no
+// context-mode MCP wiring, so a pi lead would otherwise be told about `ctx_*`
+// tools that don't exist. It still includes the shared script rubric (which
+// carries the script authoring contract), scheduling rules, and seed-script
+// guidance.
+registerTemplate({
+  eventType: "system.session.lead.pi",
+  header: "",
+  defaultBody: `{{@template[system.agent.role]}}
+
+{{@template[system.agent.register]}}
+{{@template[system.agent.lead]}}
+{{@template[system.agent.filesystem]}}
+{{@template[system.agent.self_awareness]}}
+{{@template[system.agent.script_rubric]}}
+{{@template[system.agent.scheduling]}}
 {{@template[system.agent.seed_scripts]}}
 
 {{@template[system.agent.system]}}

package/src/providers/pi-mono-adapter.ts

@@ -287,8 +287,12 @@ function jsonSchemaToTypeBox(schema: Record<string, unknown>): TSchema {
   return Type.Unsafe(schema);
 }
 
-/** Convert MCP tools to pi-mono ToolDefinition objects */
-function mcpToolsToDefinitions(
+/**
+ * Convert MCP tools to pi-mono ToolDefinition objects.
+ * Exported for the isError-propagation conformance test — pi-agent-core
+ * derives a tool result's error flag solely from execute() throwing.
+ */
+export function mcpToolsToDefinitions(
   mcpClient: McpHttpClient,
   tools: Array<{ name: string; description?: string; inputSchema: Record<string, unknown> }>,
 ): ToolDefinition[] {
@@ -303,6 +307,12 @@ function mcpToolsToDefinitions(
         .map((c) => c.text ?? "")
         .filter(Boolean)
         .join("\n");
+      // Propagate MCP isError: pi-agent-core derives a tool result's error flag
+      // from whether execute() throws, so a resolved return would silently
+      // report failed tool calls as successes to the model.
+      if (result.isError) {
+        throw new Error(text || `Tool ${tool.name} failed with no error message`);
+      }
       return {
         content: [{ type: "text" as const, text: text || "(no output)" }],
         details: undefined,

package/src/providers/pi-mono-extension.ts

@@ -165,31 +165,6 @@ async function syncSetupScriptToServer(
   }
 }
 
-/**
- * Check if a path is under the agent's own subdirectory on the shared disk.
- * Shared disk categories: thoughts, memory, downloads, misc.
- * Each agent can only write to /workspace/shared/{category}/{agentId}/
- */
-function isOwnedSharedPath(path: string, agentId: string): boolean {
-  const sharedCategories = ["thoughts", "memory", "downloads", "misc"];
-  return sharedCategories.some((cat) => path.startsWith(`/workspace/shared/${cat}/${agentId}/`));
-}
-
-/**
- * Build the shared disk write warning message for a given agent ID.
- */
-function sharedDiskWriteWarning(agentId: string): string {
-  return (
-    `⚠️ This write will fail: You don't have write access to this directory.\n\n` +
-    `On shared workspaces, each agent can only write to their own directories:\n` +
-    `- /workspace/shared/thoughts/${agentId}/\n` +
-    `- /workspace/shared/memory/${agentId}/\n` +
-    `- /workspace/shared/downloads/${agentId}/\n` +
-    `- /workspace/shared/misc/${agentId}/\n\n` +
-    `You CAN read any file on the shared disk. For writes, use your own subdirectory.`
-  );
-}
-
 /** Auto-index a file written to memory directory */
 async function autoIndexMemoryFile(config: SwarmHooksConfig, editedPath: string): Promise<void> {
   try {
@@ -505,24 +480,6 @@ export function createSwarmHooksExtension(config: SwarmHooksConfig): ExtensionFa
         }
       }
 
-      // Shared disk write prevention (Archil only — skip in local dev)
-      if (process.env.ARCHIL_MOUNT_TOKEN) {
-        // Pi-mono uses lowercase tool names: "write", "edit"
-        if (event.toolName === "write" || event.toolName === "edit") {
-          const toolInput =
-            "input" in event
-              ? (event.input as { file_path?: string; path?: string } | undefined)
-              : undefined;
-          const targetPath = toolInput?.file_path || toolInput?.path || "";
-          if (
-            targetPath.startsWith("/workspace/shared/") &&
-            !isOwnedSharedPath(targetPath, config.agentId)
-          ) {
-            console.log(sharedDiskWriteWarning(config.agentId));
-          }
-        }
-      }
-
       return undefined;
     });
 
@@ -562,27 +519,6 @@ export function createSwarmHooksExtension(config: SwarmHooksConfig): ExtensionFa
         }
       }
 
-      // Shared disk write failure detection (Archil only — safety net)
-      if (process.env.ARCHIL_MOUNT_TOKEN) {
-        // Pi-mono uses lowercase tool names
-        if (event.toolName === "write" || event.toolName === "edit" || event.toolName === "bash") {
-          const resultStr = JSON.stringify(event.content ?? []);
-          if (resultStr.includes("Read-only file system")) {
-            const resultInput = event.input as { file_path?: string; path?: string } | undefined;
-            const resultPath = resultInput?.file_path || resultInput?.path || "";
-            if (
-              resultPath.startsWith("/workspace/shared/") &&
-              !isOwnedSharedPath(resultPath, config.agentId)
-            ) {
-              console.log(sharedDiskWriteWarning(config.agentId));
-            } else if (!resultPath) {
-              // Bash tool — no file_path, just warn generically
-              console.log(sharedDiskWriteWarning(config.agentId));
-            }
-          }
-        }
-      }
-
       // File sync: check if tool wrote to identity files or memory dirs
       // Pi-mono uses tool names: "write", "edit" (lowercase, unlike Claude's "Write", "Edit")
       const toolName = event.toolName;

package/src/providers/pricing-sources.md

@@ -17,6 +17,20 @@ rate by hand should also update this file.
 - **Pinned local entries**: safe by construction. The runtime refresh only adds
   pricing rows; it does not rewrite or delete the committed snapshot.
 
+## Live UI catalog: GET /api/models-catalog
+
+- **Runtime module**: `src/be/models-catalog.ts`; route in
+  `src/http/models-catalog.ts`.
+- Every successful models.dev fetch in the runtime refresh above also updates
+  an in-memory slim catalog (openrouter / anthropic / openai / amazon-bedrock
+  only, picker-relevant fields only). The UI model picker
+  (`apps/ui/src/lib/agent-runtime-models.ts` via `useModelsCatalog()`) prefers
+  this over its build-time snapshot, so new models appear without a deploy.
+- Pinned limited-availability entries (`PINNED_MODELSDEV_ENTRIES`) are
+  re-merged from the vendored snapshot when models.dev doesn't list them yet.
+- Until the first successful fetch (or when models.dev is unreachable) the
+  endpoint serves the vendored snapshot with `source: "snapshot"`.
+
 ## Fallback/UI catalog: vendored models.dev snapshot
 
 - **Fallback path**: `src/be/modelsdev-cache.json`
@@ -26,7 +40,8 @@ rate by hand should also update this file.
   `seedPricingFromModelsDev()`,
   called from `src/server.ts` after `initDb`.
 - **Role**: cold-start fallback seed for pricing when models.dev is unavailable,
-  plus the UI model-picker source for names, labels, and context windows.
+  plus the fallback for the UI model picker while `GET /api/models-catalog`
+  hasn't resolved (names, labels, and context windows).
 - **Projection rules** (see the same module for code-level detail):
   - Anthropic models → rows under `provider='claude'` AND `provider='claude-managed'`.
     Shortnames (`opus`, `sonnet`, `haiku`) ALSO get rows keyed by the current

package/src/scripts-runtime/eval-harness.ts

@@ -17,8 +17,17 @@ type StructuredError = {
   userFrames: StackFrame[];
   userScriptLine?: number;
   userScriptColumn?: number;
+  ctxSignatureHint?: string;
 };
 
+// Matches runtime errors that look like a swapped/misused (args, ctx) signature,
+// e.g. destructuring `ctx.api`/`ctx.kv`/`ctx.fetchJson`/`ctx.log` off `undefined`/`null`
+// because the script read them off `args` instead.
+const CTX_UNDEFINED_ACCESS_RE = /cannot read propert(?:y|ies)(?: .*)? of (?:undefined|null)/i;
+const CTX_MEMBER_RE = /\b(api|kv|fetchJson|log)\b/i;
+const CTX_SIGNATURE_HINT =
+  "Hint: swarm scripts export default async function (args, ctx) — args comes first, ctx second.";
+
 function buildStructuredError(err: unknown, userModulePath: string): StructuredError {
   const errObj = err instanceof Error ? err : new Error(String(err));
   const name = errObj.name || "Error";
@@ -48,6 +57,11 @@ function buildStructuredError(err: unknown, userModulePath: string): StructuredE
     }
   }
 
+  const ctxSignatureHint =
+    CTX_UNDEFINED_ACCESS_RE.test(message) && CTX_MEMBER_RE.test(message)
+      ? CTX_SIGNATURE_HINT
+      : undefined;
+
   return {
     name,
     message,
@@ -55,6 +69,7 @@ function buildStructuredError(err: unknown, userModulePath: string): StructuredE
     userFrames,
     userScriptLine: userFrames[0]?.line,
     userScriptColumn: userFrames[0]?.column,
+    ...(ctxSignatureHint ? { ctxSignatureHint } : {}),
   };
 }
 
@@ -103,7 +118,9 @@ try {
 
   const mod = await import(userModulePath);
   if (typeof mod.default !== "function") {
-    throw new Error("Swarm script must export a default function");
+    throw new Error(
+      "Swarm script must export a default function. Script must export default async function (args, ctx) — args FIRST, ctx second.",
+    );
   }
 
   let validatedArgs = parsedArgs;

package/src/scripts-runtime/swarm-sdk.ts

@@ -270,10 +270,20 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest | null {
     case "workflow_listRuns": {
       const wfId = typeof body.workflowId === "string" ? body.workflowId : undefined;
       if (!wfId) throw new Error("workflow_listRuns requires string `workflowId`");
+      const limit = body.limit === undefined ? 20 : body.limit;
+      const offset = body.offset === undefined ? 0 : body.offset;
+      if (!Number.isInteger(limit) || (limit as number) < 1 || (limit as number) > 100) {
+        throw new Error("workflow_listRuns `limit` must be an integer between 1 and 100");
+      }
+      if (!Number.isInteger(offset) || (offset as number) < 0) {
+        throw new Error("workflow_listRuns `offset` must be a non-negative integer");
+      }
       return {
         method: "GET",
         path: appendQuery(`/api/workflows/${encodeURIComponent(wfId)}/runs`, {
           status: body.status,
+          limit,
+          offset,
         }),
       };
     }

package/src/scripts-runtime/types/stdlib.d.ts

@@ -182,6 +182,8 @@ declare module "swarm-sdk" {
     workflow_listRuns(args: {
       workflowId: string;
       status?: "running" | "waiting" | "completed" | "failed" | "skipped" | "cancelled";
+      limit?: number;
+      offset?: number;
     }): Promise<unknown>;
     workflow_getRun(args: { id: string }): Promise<unknown>;
     // --- prompt templates ---
@@ -438,6 +440,17 @@ declare module "swarm-sdk" {
     logger: ScriptLogger;
   }
 
+  /**
+   * A swarm script's default export. `args` comes FIRST, `ctx` second — never swap them.
+   *
+   * @example
+   * import type { ScriptContext } from "swarm-sdk";
+   *
+   * export default async function (args: { name: string }, ctx: ScriptContext) {
+   *   await ctx.logger.log(`hello ${args.name}`);
+   *   return { ok: true };
+   * }
+   */
   // biome-ignore lint/suspicious/noExplicitAny: scripts may narrow their args type at the entrypoint.
   export type ScriptMain = (args: any, ctx: ScriptContext) => unknown | Promise<unknown>;
 }

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -164,6 +164,8 @@ declare module "swarm-sdk" {
     workflow_listRuns(args: {
       workflowId: string;
       status?: "running" | "waiting" | "completed" | "failed" | "skipped" | "cancelled";
+      limit?: number;
+      offset?: number;
     }): Promise<unknown>;
     workflow_getRun(args: { id: string }): Promise<unknown>;
     // --- prompt templates ---
@@ -420,6 +422,17 @@ declare module "swarm-sdk" {
     logger: ScriptLogger;
   }
 
+  /**
+   * A swarm script's default export. `args` comes FIRST, `ctx` second — never swap them.
+   *
+   * @example
+   * import type { ScriptContext } from "swarm-sdk";
+   *
+   * export default async function (args: { name: string }, ctx: ScriptContext) {
+   *   await ctx.logger.log(`hello ${args.name}`);
+   *   return { ok: true };
+   * }
+   */
   // biome-ignore lint/suspicious/noExplicitAny: scripts may narrow their args type at the entrypoint.
   export type ScriptMain = (args: any, ctx: ScriptContext) => unknown | Promise<unknown>;
 

package/src/server-user.ts

@@ -1,5 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { CallToolResult, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import * as z from "zod";
 import pkg from "../package.json";
 import { enqueueAdmissionRow } from "./be/rbac-audit";
@@ -33,7 +33,7 @@ import {
   taskActionOutputSchema,
 } from "./tools/task-action";
 import { userCtx } from "./tools/task-tool-ctx";
-import { createToolRegistrar } from "./tools/utils";
+import { createToolRegistrar, type SwarmToolResult, toolErr } from "./tools/utils";
 import { ModelTierSchema, type User } from "./types";
 import { isSteeringEnabled } from "./utils/steering-enabled";
 
@@ -66,7 +66,7 @@ async function maybeDenyUserToolAdmission(
   user: User,
   toolName: string,
   config: UserToolAdmissionConfig,
-): Promise<CallToolResult | undefined> {
+): Promise<SwarmToolResult | undefined> {
   if (!isRbacEnabled()) return undefined;
 
   const grant = getUserGrant(user.id);
@@ -86,10 +86,7 @@ async function maybeDenyUserToolAdmission(
 
   if (decision.allow) return undefined;
 
-  return {
-    isError: true,
-    content: [{ type: "text", text: `Forbidden: ${decision.reason}` }],
-  };
+  return toolErr(`Forbidden: ${decision.reason}`);
 }
 
 export function createUserServer(user: User): McpServer {

package/src/slack/blocks.ts

@@ -394,15 +394,28 @@ const MAX_OUTPUT_LENGTH = 120;
 /**
  * Truncate output to the first sentence or MAX_OUTPUT_LENGTH, whichever is shorter.
  */
-function truncateOutput(text: string): string {
+function truncateOutput(text: string): { text: string; truncated: boolean } {
   // Find first sentence boundary (. followed by space or end)
   const sentenceEnd = text.search(/\.\s/);
-  const firstSentence = sentenceEnd !== -1 ? text.slice(0, sentenceEnd + 1) : text;
-  if (firstSentence.length <= MAX_OUTPUT_LENGTH) return firstSentence;
-  const boundary = text.lastIndexOf(" ", MAX_OUTPUT_LENGTH);
-  const cut = boundary >= MAX_OUTPUT_LENGTH / 2 ? boundary : MAX_OUTPUT_LENGTH;
+  const sentenceCut = sentenceEnd !== -1 ? sentenceEnd + 1 : text.length;
+  if (sentenceCut === text.length && text.length <= MAX_OUTPUT_LENGTH) {
+    return { text, truncated: false };
+  }
+
+  let cut = Math.min(sentenceCut, MAX_OUTPUT_LENGTH);
+  if (cut === MAX_OUTPUT_LENGTH) {
+    const boundary = text.lastIndexOf(" ", MAX_OUTPUT_LENGTH);
+    cut = boundary >= MAX_OUTPUT_LENGTH / 2 ? boundary : MAX_OUTPUT_LENGTH;
+  }
   const omitted = text.length - cut;
-  return `${text.slice(0, cut).trimEnd()}… (${omitted} more chars; full output in thread)`;
+  return {
+    text: `${text.slice(0, cut).trimEnd()}… (${omitted} more chars; open task for full output)`,
+    truncated: true,
+  };
+}
+
+export function isTreeOutputTruncated(text: string): boolean {
+  return truncateOutput(text).truncated;
 }
 
 /**
@@ -433,7 +446,7 @@ function renderChildDetail(node: TreeNode, indent: string): string[] {
   }
 
   if (node.status === "completed" && !node.slackReplySent && node.output) {
-    lines.push(`${indent}${truncateOutput(markdownToSlack(node.output))}`);
+    lines.push(`${indent}${truncateOutput(markdownToSlack(node.output)).text}`);
   }
 
   return lines;
@@ -457,7 +470,7 @@ function renderTree(root: TreeNode): string {
       lines.push(`    Error: ${root.failureReason}`);
     }
     if (root.status === "completed" && !root.slackReplySent && root.output) {
-      lines.push(`    ${truncateOutput(markdownToSlack(root.output))}`);
+      lines.push(`    ${truncateOutput(markdownToSlack(root.output)).text}`);
     }
     return lines.join("\n");
   }

package/src/slack/responses.ts

@@ -1,6 +1,6 @@
 import type { WebClient } from "@slack/web-api";
-import { getAgentById, getTaskAttachments } from "../be/db";
-import type { Agent, AgentTask, TaskAttachment } from "../types";
+import { getAgentById, getTaskAttachments, markTaskSlackReplySent } from "../be/db";
+import type { Agent, AgentTask } from "../types";
 import { getSlackApp } from "./app";
 import {
   buildCancelledBlocks,
@@ -11,6 +11,7 @@ import {
   formatAttachmentsBlockForSlack,
   formatDuration,
   getTaskLink,
+  isTreeOutputTruncated,
   markdownToSlack,
   splitSlackSectionText,
 } from "./blocks";
@@ -33,16 +34,9 @@ function classifySlackUpdateError(error: unknown): SlackUpdateResult {
 }
 
 const isDev = process.env.ENV === "development";
-const MIN_INLINE_OUTPUT_LENGTH = 20;
-export const MAX_INLINE_OUTPUT_MESSAGE_LENGTH = 4000;
-const INLINE_OUTPUT_FALLBACKS = new Set([
-  "done",
-  "completed",
-  "complete",
-  "task completed",
-  "process completed successfully",
-  "process completed successfully (no output captured)",
-]);
+// Ten 2,900-char sections keep each message's fallback text below Slack's
+// 40,000-char message cap while allowing arbitrarily long output in batches.
+const MAX_INLINE_OUTPUT_BLOCKS_PER_MESSAGE = 10;
 
 /**
  * Get the display name for an agent, with (dev) prefix if in development mode.
@@ -51,45 +45,23 @@ function getAgentDisplayName(agent: Agent): string {
   return isDev ? `(dev) ${agent.name}` : agent.name;
 }
 
-export function shouldPostInlineCompletionOutput(
-  task: AgentTask,
-  attachments: readonly TaskAttachment[],
-): boolean {
+export function shouldPostInlineCompletionOutput(task: AgentTask): boolean {
   if (task.status !== "completed") return false;
   if (!task.slackChannelId || !task.slackThreadTs) return false;
   if (task.slackReplySent) return false;
 
   const output = task.output?.trim();
-  if (!output || output.length < MIN_INLINE_OUTPUT_LENGTH) return false;
-  if (INLINE_OUTPUT_FALLBACKS.has(output.toLowerCase())) return false;
-
-  return !attachments.some((attachment) => attachment.isPrimary);
+  return !!output && isTreeOutputTruncated(markdownToSlack(output));
 }
 
-export function formatInlineCompletionOutputText(opts: {
+export function formatInlineCompletionOutputChunks(opts: {
   agentName: string;
   taskId: string;
   output: string;
-}): string {
+}): string[] {
   const header = `✅ *${opts.agentName}* completed with output (${getTaskLink(opts.taskId)}):\n\n`;
-  const tail = `\n\n…(full output in task ${getTaskLink(opts.taskId)})`;
   const slackOutput = markdownToSlack(opts.output.trim());
-  const maxBodyLength = MAX_INLINE_OUTPUT_MESSAGE_LENGTH - header.length;
-
-  if (slackOutput.length <= maxBodyLength) {
-    return header + slackOutput;
-  }
-
-  const maxTruncatedBodyLength = Math.max(0, maxBodyLength - tail.length);
-  let cut = slackOutput.lastIndexOf("\n", maxTruncatedBodyLength);
-  if (cut < maxTruncatedBodyLength / 2) {
-    cut = slackOutput.lastIndexOf(" ", maxTruncatedBodyLength);
-  }
-  if (cut < maxTruncatedBodyLength / 2) {
-    cut = maxTruncatedBodyLength;
-  }
-
-  return header + slackOutput.slice(0, cut).trimEnd() + tail;
+  return splitSlackSectionText(header + slackOutput);
 }
 
 export async function sendInlineTaskOutput(task: AgentTask): Promise<boolean> {
@@ -104,24 +76,28 @@ export async function sendInlineTaskOutput(task: AgentTask): Promise<boolean> {
     return false;
   }
 
-  const text = formatInlineCompletionOutputText({
+  const chunks = formatInlineCompletionOutputChunks({
     agentName: agent.name,
     taskId: task.id,
     output: task.output,
   });
 
   try {
-    await sendWithPersona(app.client, {
-      channel: task.slackChannelId,
-      thread_ts: task.slackThreadTs,
-      text,
-      username: getAgentDisplayName(agent),
-      icon_emoji: getAgentEmoji(agent),
-      blocks: splitSlackSectionText(text).map((chunk) => ({
-        type: "section",
-        text: { type: "mrkdwn", text: chunk },
-      })),
-    });
+    for (let i = 0; i < chunks.length; i += MAX_INLINE_OUTPUT_BLOCKS_PER_MESSAGE) {
+      const batch = chunks.slice(i, i + MAX_INLINE_OUTPUT_BLOCKS_PER_MESSAGE);
+      await sendWithPersona(app.client, {
+        channel: task.slackChannelId,
+        thread_ts: task.slackThreadTs,
+        text: batch.join("\n\n"),
+        username: getAgentDisplayName(agent),
+        icon_emoji: getAgentEmoji(agent),
+        blocks: batch.map((chunk) => ({
+          type: "section",
+          text: { type: "mrkdwn", text: chunk },
+        })),
+      });
+    }
+    markTaskSlackReplySent(task.id);
     return true;
   } catch (error) {
     console.error(`[Slack] Failed to send inline output for task ${task.id}:`, error);