@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/tests/workflow-swarm-script.test.ts

@@ -208,6 +208,110 @@ describe("SwarmScriptExecutor", () => {
     expect(result.output?.scriptName).toBe("add-one");
   });
 
+  test("named script source with an interpolation token fails with the node and token named", async () => {
+    await saveScript(
+      "unresolved-source",
+      `export default async () => ({ value: "{{trigger.payload}}" });`,
+    );
+
+    const executor = new SwarmScriptExecutor(deps);
+    const wf = makeWorkflow({ nodes: [] });
+    const result = await executor.run({
+      config: { scriptName: "unresolved-source", args: { payload: "safe-argv-data" } },
+      context: { trigger: { payload: "must-not-enter-source" } },
+      meta: {
+        runId: crypto.randomUUID(),
+        stepId: crypto.randomUUID(),
+        nodeId: "named-script-node",
+        workflowId: wf.id,
+        dryRun: false,
+      },
+    });
+
+    expect(result.status).toBe("failed");
+    expect(result.error).toContain('node "named-script-node"');
+    expect(result.error).toContain("{{trigger.payload}}");
+    expect(result.error).toContain("config.args");
+    expect(result.output).toBeUndefined();
+  });
+
+  test("named script source may contain literal mustache template data", async () => {
+    await saveScript(
+      "literal-mustache-source",
+      `export default async () => ({ template: "Hello {{customer_name}}" });`,
+    );
+
+    const executor = new SwarmScriptExecutor(deps);
+    const wf = makeWorkflow({ nodes: [] });
+    const result = await executor.run({
+      config: { scriptName: "literal-mustache-source" },
+      context: {},
+      meta: {
+        runId: crypto.randomUUID(),
+        stepId: crypto.randomUUID(),
+        nodeId: "literal-template-node",
+        workflowId: wf.id,
+        dryRun: false,
+      },
+    });
+
+    expect(result.status).toBe("success");
+    expect(result.output?.result).toEqual({ template: "Hello {{customer_name}}" });
+  });
+
+  test("unrelated upstream node names do not turn literal source templates into workflow tokens", async () => {
+    await saveScript(
+      "literal-upstream-name",
+      `export default async () => ({ template: "Hello {{customer.name}}" });`,
+    );
+    const wf = makeWorkflow({
+      nodes: [
+        { id: "customer", type: "echo", config: { value: "Ada" }, next: "script" },
+        {
+          id: "script",
+          type: "swarm-script",
+          config: { scriptName: "literal-upstream-name" },
+        },
+      ],
+    });
+
+    const runId = await startWorkflowExecution(wf, {}, registry);
+    const run = getWorkflowRun(runId);
+    const steps = getWorkflowRunStepsByRunId(runId);
+    const scriptStep = steps.find((step) => step.nodeId === "script");
+
+    expect(run?.status).toBe("completed");
+    expect(scriptStep?.status).toBe("completed");
+    expect(scriptStep?.output).toMatchObject({
+      result: { template: "Hello {{customer.name}}" },
+    });
+  });
+
+  test("declared input aliases still identify workflow tokens in named script source", async () => {
+    await saveScript(
+      "declared-alias-source",
+      `export default async () => ({ value: "{{customer.name}}" });`,
+    );
+
+    const executor = new SwarmScriptExecutor(deps);
+    const wf = makeWorkflow({ nodes: [] });
+    const result = await executor.run({
+      config: { scriptName: "declared-alias-source" },
+      context: { upstream: { name: "Ada" } },
+      meta: {
+        runId: crypto.randomUUID(),
+        stepId: crypto.randomUUID(),
+        nodeId: "declared-alias-node",
+        workflowId: wf.id,
+        dryRun: false,
+        inputCtx: { customer: { name: "Ada" } },
+      },
+    });
+
+    expect(result.status).toBe("failed");
+    expect(result.error).toContain("{{customer.name}}");
+  });
+
   test("swarm-script executor includes API connection descriptors in ctx.api", async () => {
     await upsertScriptConnection({
       slug: "workflowVendor",

package/src/tools/app-get.ts

@@ -2,6 +2,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as z from "zod";
 import { type AppRow, listAppRows } from "@/apps/row-store";
 import { getApp } from "@/apps/store";
+import { collectAppSyncStatus } from "@/apps/sync";
 import { getAgentById } from "@/be/db";
 import { AppQueryParamsError, applyQuery } from "@/http/apps";
 import { can } from "@/rbac";
@@ -55,9 +56,16 @@ export const registerAppGetTool = (server: McpServer) => {
       const app = getApp(appId);
       if (!app) return toolErr(`App ${appId} not found.`);
 
+      const syncStatus = collectAppSyncStatus(app.id);
+      const hasSyncStatus = Object.keys(syncStatus).length > 0;
+      // Supplying `details` suppresses the registrar's JSON-data fallback, so
+      // text-only harnesses must get the sync freshness surface here too.
+      const details = hasSyncStatus
+        ? `${JSON.stringify(app, null, 2)}\n\nSync status (model:source):\n${JSON.stringify(syncStatus, null, 2)}`
+        : JSON.stringify(app, null, 2);
       return toolOk(`App "${app.name}" (${app.id}).`, {
-        details: JSON.stringify(app, null, 2),
-        data: { app },
+        details,
+        data: { app, ...(hasSyncStatus ? { syncStatus } : {}) },
       });
     },
   );

package/src/tools/app-rollback.ts

@@ -65,6 +65,7 @@ export const registerAppRollbackTool = (server: McpServer) => {
           migration,
           forceElementBreak,
           changedByAgentId: requestInfo.agentId,
+          writerAgentId: requestInfo.agentId,
         });
         const url = `/apps/${rolledBack.app.id}`;
         return toolOk(`App "${rolledBack.app.name}" rolled back to v${version}.`, {

package/src/tools/app-sync.ts

@@ -0,0 +1,112 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as z from "zod";
+import { AppNameSchema } from "@/apps/definition";
+import { getApp } from "@/apps/store";
+import { runAppSync, type SyncPassResult } from "@/apps/sync";
+import { getAgentById } from "@/be/db";
+import { can } from "@/rbac";
+import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
+
+function cell(value: unknown): string {
+  return String(value ?? "—")
+    .replaceAll("\\", "\\\\")
+    .replaceAll("|", "\\|")
+    .replace(/\r\n|\r|\n/g, "<br>");
+}
+
+/** One row per pass: what it wrote, and why it did not, if it failed. */
+function renderPasses(passes: SyncPassResult[]): string {
+  if (passes.length === 0) return "No sync passes ran.";
+  const header = "| model | source | created | updated | refreshed | stale | error |";
+  const separator = "| --- | --- | --- | --- | --- | --- | --- |";
+  const body = passes.map((pass) =>
+    [
+      cell(pass.model),
+      cell(pass.source),
+      cell(pass.created),
+      cell(pass.updated),
+      cell(pass.refreshed),
+      cell(pass.markedStale),
+      cell(pass.error ?? (pass.skipped ? "skipped: already running" : undefined)),
+    ]
+      .map((value) => ` ${value} `)
+      .join("|"),
+  );
+  const warnings = passes.flatMap((pass) =>
+    pass.warnings.map((warning) => `- ${pass.model}.${pass.source}: ${warning}`),
+  );
+  return [header, separator, ...body.map((row) => `|${row}|`), ...warnings].join("\n");
+}
+
+export const registerAppSyncTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "app-sync",
+    {
+      title: "Sync an app's sources",
+      description:
+        "Refresh an app's declared sources: pull each selected (model x source) pair and reconcile its rows.",
+      // Writes rows, but only ever projects the source's own view onto them.
+      annotations: { destructiveHint: false },
+      rbac: { permission: "app.use" },
+      inputSchema: z.object({
+        appId: z.string().min(1).describe("App ID whose sources should sync."),
+        model: AppNameSchema.optional().describe("Limit the sync to one model."),
+        source: AppNameSchema.optional().describe("Limit the sync to one declared source name."),
+      }),
+      outputSchema: swarmToolOutputSchema({
+        passes: z.array(z.looseObject({})).optional(),
+        ok: z.boolean().optional(),
+      }),
+    },
+    async ({ appId, model, source }, requestInfo) => {
+      if (!requestInfo.agentId) return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+      const agent = getAgentById(requestInfo.agentId);
+      const decision = can({
+        principal: { kind: "agent", agentId: requestInfo.agentId, isLead: agent?.isLead ?? false },
+        verb: "app.use",
+        resource: { kind: "app", appId },
+        source: "mcp",
+      });
+      if (!decision.allow) return toolErr(decision.reason);
+      const app = getApp(appId);
+      if (!app) return toolErr(`App ${appId} not found.`);
+
+      const result = await runAppSync({
+        appId,
+        ...(model === undefined ? {} : { model }),
+        ...(source === undefined ? {} : { source }),
+        invokedBy: `agent:${requestInfo.agentId}`,
+      });
+
+      if (result.issues && result.issues.length > 0) {
+        // Covers both "no matching pair" and "definition needs repair".
+        return toolErr(`Cannot sync app "${app.name}" (${app.id}).`, {
+          details: result.issues.map((issue) => `${issue.path}: ${issue.message}`).join("\n"),
+          data: { ok: false },
+        });
+      }
+
+      const totals = result.passes.reduce(
+        (sum, pass) => ({
+          created: sum.created + pass.created,
+          updated: sum.updated + pass.updated,
+          refreshed: sum.refreshed + pass.refreshed,
+          markedStale: sum.markedStale + pass.markedStale,
+        }),
+        { created: 0, updated: 0, refreshed: 0, markedStale: 0 },
+      );
+      const summary =
+        `${result.passes.length} pass(es): ${totals.created} created, ${totals.updated} updated, ` +
+        `${totals.refreshed} refreshed, ${totals.markedStale} marked stale.`;
+      const details = renderPasses(result.passes);
+      const data = { ok: result.ok, passes: result.passes };
+      if (!result.ok) {
+        return toolErr(`Sync failed for app "${app.name}" (${app.id}) — ${summary}`, {
+          details,
+          data,
+        });
+      }
+      return toolOk(`Synced app "${app.name}" (${app.id}) — ${summary}`, { details, data });
+    },
+  );
+};

package/src/tools/script-common.ts

@@ -42,6 +42,15 @@ function apiBaseUrl(): string {
   return getMcpBaseUrl();
 }
 
+/** `{path, message}` renders as one `path: message` line; anything else verbatim. */
+function renderIssue(issue: unknown): string {
+  if (typeof issue === "string") return issue;
+  if (isRecord(issue) && typeof issue.message === "string") {
+    return typeof issue.path === "string" ? `${issue.path}: ${issue.message}` : issue.message;
+  }
+  return JSON.stringify(issue);
+}
+
 type ScriptFailure = { message: string; details?: string };
 
 /**
@@ -86,6 +95,17 @@ function describeScriptFailure(
       };
     }
 
+    // Path-bearing rejections (e.g. a delete blocked by an app that still
+    // wires this script): without this branch the paths never reach the text
+    // channel and the model cannot see what to unwire.
+    const issues = body && Array.isArray(body.issues) ? (body.issues as unknown[]) : undefined;
+    if (issues && issues.length > 0) {
+      return {
+        message: `${error ?? `Scripts API request failed with ${status}`} — ${issues.length} issue(s)`,
+        details: capDetails(issues.map(renderIssue).join("\n")),
+      };
+    }
+
     return { message: error ?? `Scripts API request failed with ${status}` };
   }
 

package/src/tools/tool-config.ts

@@ -163,11 +163,12 @@ export const DEFERRED_TOOLS = new Set([
   "resolve-user",
   "manage-user",
 
-  // Pages and apps (10)
+  // Pages and apps (11)
   "app-get",
   "app-list",
   "app-patch",
   "app-query",
+  "app-sync",
   "app-upsert",
   "app-history",
   "app-diff",

package/src/tools/utils.ts

@@ -261,6 +261,17 @@ export const NUDGES: Record<string, (result: SwarmToolResult) => string | undefi
       ? "Rate memories that help or mislead you with memory_rate."
       : undefined;
   },
+  "app-get": (r) => {
+    if (!r.ok) return undefined;
+    const definition = (
+      r.data as { app?: { definition?: { queries?: object; actions?: object } } | null } | undefined
+    )?.app?.definition;
+    const hasQueries = Object.keys(definition?.queries ?? {}).length > 0;
+    const hasActions = Object.keys(definition?.actions ?? {}).length > 0;
+    return hasQueries || hasActions
+      ? "This app's callable surface is `definition.queries` (run with `app-query`, passing any `$param` values) and `definition.actions` (invoke with `POST /api/apps/<id>/actions/<name>`; `sync` actions refresh sources)."
+      : undefined;
+  },
   // kv-get is spill-exempt (retrieval path), so oversized values reach the
   // harness whole and get natively truncated there. Steer big-value work
   // toward scripts, where the full value stays out of the model's context.

package/src/tools/workflows/create-workflow.ts

@@ -31,7 +31,10 @@ export const registerCreateWorkflowTool = (server: McpServer) => {
         "- Nodes are linked via 'next' (string or port-based record).\n" +
         "- CROSS-NODE DATA: To use output from an upstream node, you MUST declare an 'inputs' mapping on the downstream node. " +
         'Example: inputs: { "cityData": "generate-city" } → then use {{cityData.taskOutput.field}} in config templates. ' +
-        "Without 'inputs', only 'trigger' and workflow-level 'input' are available for interpolation.\n" +
+        "Without 'inputs', built-in trigger/input/workflow/swarm/run context remains available, but upstream outputs do not. " +
+        "Agent-task templates may interpolate trigger and declared upstream aliases. SECURITY: executable source for script/swarm-script nodes does not: " +
+        "inline script source allows only input/workflow/swarm/run values, while named swarm-script source is not workflow-interpolated. " +
+        "Pass dynamic trigger or upstream values through config.args (argv for inline scripts; the args object for swarm-script).\n" +
         "- STRUCTURED OUTPUT: For agent-task nodes, put outputSchema inside 'config' to validate the agent's raw JSON output. " +
         "Node-level outputSchema validates the executor's return ({taskId, taskOutput}), which is different.\n" +
         "- Agent-task config: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }.\n" +