@desplega.ai/agent-swarm 1.131.1 → 1.134.0

package/src/commands/onboard/steps/harness-credentials.tsx

@@ -55,7 +55,7 @@ export function HarnessCredentialsStep({ goToNext, addLog }: StepProps) {
         setCliError(msg);
         setSubStep("manual_oauth");
       }
-    })();
+    })().catch((err) => addLog(`Harness credential setup failed: ${err}`));
 
     return () => {
       cancelled = true;

package/src/commands/onboard/steps/health-check.tsx

@@ -92,7 +92,7 @@ export function HealthCheckStep({ state, addLog, goToNext }: StepProps) {
       }
     };
 
-    poll();
+    poll().catch((err) => addLog(`Health poll failed: ${err}`));
     return () => {
       cancelled = true;
     };

package/src/commands/onboard/steps/start.tsx

@@ -35,7 +35,7 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
       }
     };
 
-    run();
+    run().catch((err) => addLog(`Start failed: ${err}`));
   }, [state.outputDir, addLog]);
 
   useEffect(() => {

package/src/commands/profile-sync-audit.ts

@@ -0,0 +1,56 @@
+#!/usr/bin/env bun
+
+import { getApiKey } from "../utils/api-key.ts";
+import { getMcpBaseUrl } from "../utils/constants.ts";
+import { scrubSecrets } from "../utils/secret-scrubber.ts";
+import {
+  auditProfileDivergences,
+  type FileReader,
+  type ProfileDivergence,
+} from "./profile-sync.ts";
+
+export interface ProfileSyncAuditConfig {
+  agentId: string;
+  apiUrl: string;
+  apiKey: string;
+  claudeMdPath?: string;
+}
+
+export async function runProfileSyncAudit(
+  config: ProfileSyncAuditConfig,
+  deps: { fetchImpl?: typeof fetch; readFile?: FileReader } = {},
+): Promise<{ agentId: string; divergences: ProfileDivergence[] }> {
+  const divergences = await auditProfileDivergences(
+    { ...config, fetchImpl: deps.fetchImpl },
+    deps.readFile,
+  );
+  return { agentId: config.agentId, divergences };
+}
+
+export function profileSyncAuditExitCode(divergences: ProfileDivergence[]): 0 | 2 {
+  return divergences.length > 0 ? 2 : 0;
+}
+
+if (import.meta.main) {
+  const agentId = process.env.AGENT_ID;
+  const apiUrl = getMcpBaseUrl();
+  const apiKey = getApiKey();
+  if (!agentId || !apiUrl || !apiKey) {
+    console.error("profile-sync-audit requires AGENT_ID, MCP_BASE_URL, and an API key");
+    process.exit(1);
+  }
+
+  try {
+    const result = await runProfileSyncAudit({
+      agentId,
+      apiUrl,
+      apiKey,
+    });
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(profileSyncAuditExitCode(result.divergences));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(scrubSecrets(`profile-sync-audit failed: ${message}`));
+    process.exit(1);
+  }
+}

package/src/commands/profile-sync.ts

@@ -2,7 +2,7 @@
  * Harness-agnostic FS → DB profile sync (worker-side, HTTP-only).
  *
  * Persists an agent's self-editable identity / config files back to the API:
- *   - SOUL.md / IDENTITY.md / TOOLS.md / HEARTBEAT.md  (bundled identity POST)
+ *   - SOUL.md / IDENTITY.md / TOOLS.md / HEARTBEAT.md  (independent POSTs)
  *   - ~/.claude/CLAUDE.md                              (claude POST)
  *   - /workspace/start-up.sh (agent-managed section)   (setup POST)
  *
@@ -27,8 +27,15 @@
  * but it must be VISIBLE.
  */
 
+import { resolveTemplateAsync } from "../prompts/resolver.ts";
+import type { Agent, SwarmEvent } from "../types.ts";
 import { MAX_PROFILE_FILE_LENGTH } from "../utils/constants.ts";
+import {
+  type BudgetedIdentityField,
+  IDENTITY_FIELD_BUDGETS,
+} from "../utils/identity-field-budget.ts";
 import { scrubSecrets } from "../utils/secret-scrubber.ts";
+import "./templates.ts";
 
 export const SOUL_MD_PATH = "/workspace/SOUL.md";
 export const IDENTITY_MD_PATH = "/workspace/IDENTITY.md";
@@ -56,6 +63,223 @@ export function contentSha256(content: string): string {
   return new Bun.CryptoHasher("sha256").update(content).digest("hex");
 }
 
+export const PROFILE_MARKDOWN_FIELDS = [
+  "soulMd",
+  "identityMd",
+  "claudeMd",
+  "toolsMd",
+  "heartbeatMd",
+] as const;
+
+export type ProfileMarkdownField = (typeof PROFILE_MARKDOWN_FIELDS)[number];
+export type ProfileMarkdownSnapshot = Partial<
+  Record<ProfileMarkdownField, string | null | undefined>
+>;
+
+export interface ProfileDivergence {
+  field: ProfileMarkdownField;
+  diskSize: number | null;
+  dbSize: number;
+  budget: number | null;
+  delta: number | null;
+  diskHash: string | null;
+  dbHash: string;
+  diskMissing: boolean;
+}
+
+/** Pure disk-vs-DB comparison used by local profile-sync audits. */
+export function findProfileDivergences(
+  disk: ProfileMarkdownSnapshot,
+  db: ProfileMarkdownSnapshot,
+): ProfileDivergence[] {
+  const divergences: ProfileDivergence[] = [];
+
+  for (const field of PROFILE_MARKDOWN_FIELDS) {
+    const diskValue = disk[field];
+    const dbValue = db[field] ?? "";
+    const budget =
+      field === "heartbeatMd" ? null : IDENTITY_FIELD_BUDGETS[field as BudgetedIdentityField];
+    if (diskValue === undefined || diskValue === null) {
+      if (dbValue.length === 0) continue;
+      divergences.push({
+        field,
+        diskSize: null,
+        dbSize: dbValue.length,
+        budget,
+        delta: null,
+        diskHash: null,
+        dbHash: contentSha256(dbValue),
+        diskMissing: true,
+      });
+      continue;
+    }
+    if (diskValue === dbValue) continue;
+
+    divergences.push({
+      field,
+      diskSize: diskValue.length,
+      dbSize: dbValue.length,
+      budget,
+      delta: diskValue.length - dbValue.length,
+      diskHash: contentSha256(diskValue),
+      dbHash: contentSha256(dbValue),
+      diskMissing: false,
+    });
+  }
+
+  return divergences;
+}
+
+const PROFILE_FIELD_DETAILS: Record<
+  BudgetedIdentityField,
+  { label: string; recoveryGuidance: string }
+> = {
+  soulMd: {
+    label: `soulMd (${SOUL_MD_PATH})`,
+    recoveryGuidance: `Inspect and shrink the live ${SOUL_MD_PATH} first, moving durable tail content into memory. After a worker restart, use ${SOUL_MD_PATH}.pre-boot-<timestamp>.bak as the fallback copy of the rejected content.`,
+  },
+  identityMd: {
+    label: `identityMd (${IDENTITY_MD_PATH})`,
+    recoveryGuidance: `Inspect and shrink the live ${IDENTITY_MD_PATH} first, moving durable tail content into memory. After a worker restart, use ${IDENTITY_MD_PATH}.pre-boot-<timestamp>.bak as the fallback copy of the rejected content.`,
+  },
+  claudeMd: {
+    label:
+      "claudeMd (/workspace/CLAUDE.md for non-Claude harnesses; ~/.claude/CLAUDE.md for Claude)",
+    recoveryGuidance:
+      "Inspect and shrink the live CLAUDE.md source first, moving durable tail content into memory. After a worker restart, non-Claude harnesses can use /workspace/CLAUDE.md.pre-boot-<timestamp>.bak as the fallback copy; Claude's native ~/.claude/CLAUDE.md source is not archived by that boot step.",
+  },
+  toolsMd: {
+    label: `toolsMd (${TOOLS_MD_PATH})`,
+    recoveryGuidance: `Inspect and shrink the live ${TOOLS_MD_PATH} first, moving durable tail content into memory. After a worker restart, use ${TOOLS_MD_PATH}.pre-boot-<timestamp>.bak as the fallback copy of the rejected content.`,
+  },
+};
+
+/** Render one persisted sync rejection through the prompt-template registry. */
+export async function renderProfileSyncRejectionBanner(event: SwarmEvent): Promise<string | null> {
+  const data = event.data;
+  const field = data?.field;
+  const diskSize = data?.diskSize;
+  const dbSize = data?.dbSize;
+  const budget = data?.budget;
+  const delta = data?.delta;
+  if (
+    typeof field !== "string" ||
+    !(field in PROFILE_FIELD_DETAILS) ||
+    typeof diskSize !== "number" ||
+    typeof dbSize !== "number" ||
+    typeof budget !== "number" ||
+    typeof delta !== "number"
+  ) {
+    return null;
+  }
+
+  const details = PROFILE_FIELD_DETAILS[field as BudgetedIdentityField];
+  const result = await resolveTemplateAsync("task.profile_sync_rejection", {
+    timestamp: event.createdAt,
+    field_label: details.label,
+    disk_size: diskSize,
+    db_size: dbSize,
+    budget,
+    delta: delta >= 0 ? `+${delta}` : String(delta),
+    event_id: event.id,
+    recovery_guidance: details.recoveryGuidance,
+  });
+  return result.skipped ? null : result.text;
+}
+
+/** Fetch every field's latest unresolved rejection before a provider session. */
+export async function fetchProfileSyncRejectionBanner(
+  config: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey" | "claudeMdPath">,
+  fetchImpl: typeof fetch = fetch,
+  readFile: FileReader = readFileIfExists,
+): Promise<string> {
+  try {
+    const responses = await Promise.all(
+      (Object.keys(IDENTITY_FIELD_BUDGETS) as BudgetedIdentityField[]).map(async (field) => {
+        const fetchLatestEvent = async (event: SwarmEvent["event"]): Promise<SwarmEvent | null> => {
+          const query = new URLSearchParams({
+            event,
+            agentId: config.agentId,
+            dataField: field,
+            limit: "1",
+          });
+          const response = await fetchImpl(`${config.apiUrl}/api/events?${query}`, {
+            headers: {
+              Authorization: `Bearer ${config.apiKey}`,
+              "X-Agent-ID": config.agentId,
+            },
+          });
+          if (!response.ok) return null;
+          const payload = (await response.json()) as { events?: SwarmEvent[] };
+          return payload.events?.[0] ?? null;
+        };
+        const [rejection, reconciliation] = await Promise.all([
+          fetchLatestEvent("system.profile_sync_rejected"),
+          fetchLatestEvent("system.profile_sync_reconciled"),
+        ]);
+        return { rejection, reconciliation };
+      }),
+    );
+    const latestEvents = responses.flatMap(({ rejection, reconciliation }) =>
+      rejection ? [{ rejection, reconciliation }] : [],
+    );
+    if (latestEvents.length === 0) return "";
+
+    let profile: Record<string, unknown> | null = null;
+    const profileResponse = await fetchImpl(`${config.apiUrl}/me`, {
+      headers: {
+        Authorization: `Bearer ${config.apiKey}`,
+        "X-Agent-ID": config.agentId,
+      },
+    });
+    if (profileResponse.ok) {
+      profile = (await profileResponse.json()) as Record<string, unknown>;
+    }
+
+    let disk: Partial<Record<BudgetedIdentityField, string | undefined>> | null = null;
+    if (config.claudeMdPath) {
+      disk = {
+        soulMd: await readFile(SOUL_MD_PATH),
+        identityMd: await readFile(IDENTITY_MD_PATH),
+        claudeMd: await readFile(config.claudeMdPath),
+        toolsMd: await readFile(TOOLS_MD_PATH),
+      };
+    }
+
+    const unresolved = latestEvents.flatMap(({ rejection, reconciliation }) => {
+      if (reconciliation && reconciliation.createdAt > rejection.createdAt) return [];
+      const event = rejection;
+      const field = event.data?.field;
+      const rejectedDbHash = event.data?.dbHash;
+      const currentValue = typeof field === "string" ? profile?.[field] : undefined;
+      const diskValue =
+        typeof field === "string" ? disk?.[field as BudgetedIdentityField] : undefined;
+      if (typeof currentValue === "string" && diskValue === currentValue) return [];
+      return !(
+        typeof rejectedDbHash === "string" &&
+        typeof currentValue === "string" &&
+        contentSha256(currentValue) !== rejectedDbHash
+      )
+        ? [event]
+        : [];
+    });
+    const banners = await Promise.all(unresolved.map(renderProfileSyncRejectionBanner));
+    return banners.filter((banner): banner is string => banner !== null).join("");
+  } catch {
+    return "";
+  }
+}
+
+export async function prependProfileSyncRejectionBanner(
+  prompt: string,
+  config: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey" | "claudeMdPath">,
+  fetchImpl: typeof fetch = fetch,
+  readFile: FileReader = readFileIfExists,
+): Promise<{ prompt: string; injected: boolean }> {
+  const banner = await fetchProfileSyncRejectionBanner(config, fetchImpl, readFile);
+  return banner ? { prompt: banner + prompt, injected: true } : { prompt, injected: false };
+}
+
 export async function writeIdentityBaselines(baselines: IdentityBaselines): Promise<void> {
   await Bun.write(IDENTITY_BASELINES_PATH, JSON.stringify(baselines));
 }
@@ -168,9 +392,23 @@ export function resolveClaudeMdPath(completedProviders: readonly string[]): stri
 }
 
 /** A single profile-update POST body, tagged with a label for logging. */
-interface ProfilePayload {
+export interface ProfilePayload {
   label: string;
-  body: Record<string, unknown>;
+  body: Record<string, string>;
+}
+
+/**
+ * Keep identity-file sync independent: one rejected ratcheting-budget write
+ * must not discard valid edits to other files from the same session.
+ */
+export function buildIndependentIdentityPayloads(
+  updates: Record<string, string>,
+  changeSource: ProfileChangeSource,
+): ProfilePayload[] {
+  return Object.entries(updates).map(([field, value]) => ({
+    label: `identity.${field}`,
+    body: { [field]: value, changeSource },
+  }));
 }
 
 /**
@@ -229,8 +467,6 @@ export function buildIdentityPayload(
     const content = files.soulMd;
     if (baselines?.soulMd && contentSha256(content) === baselines.soulMd) {
       // File unchanged during session — skip to preserve Lead's DB edits
-    } else if (content.length > MAX_PROFILE_FILE_LENGTH) {
-      warnProfileFileTooLarge(agentId, "soulMd", content.length);
     } else if (content.trim()) {
       if (content.length < IDENTITY_FILE_MIN_LENGTH) {
         console.error(
@@ -246,8 +482,6 @@ export function buildIdentityPayload(
     const content = files.identityMd;
     if (baselines?.identityMd && contentSha256(content) === baselines.identityMd) {
       // File unchanged during session — skip to preserve Lead's DB edits
-    } else if (content.length > MAX_PROFILE_FILE_LENGTH) {
-      warnProfileFileTooLarge(agentId, "identityMd", content.length);
     } else if (content.trim()) {
       if (content.length < IDENTITY_FILE_MIN_LENGTH) {
         console.error(
@@ -263,8 +497,6 @@ export function buildIdentityPayload(
     const content = files.toolsMd;
     if (baselines?.toolsMd && contentSha256(content) === baselines.toolsMd) {
       // File unchanged during session — skip
-    } else if (content.length > MAX_PROFILE_FILE_LENGTH) {
-      warnProfileFileTooLarge(agentId, "toolsMd", content.length);
     } else if (content.trim()) {
       updates.toolsMd = content;
     }
@@ -298,6 +530,50 @@ async function readFileIfExists(path: string): Promise<string | undefined> {
   }
 }
 
+/**
+ * Compare the five local profile markdown files with the authenticated agent's
+ * stored DB values. This must run inside the agent's local environment; a
+ * central script cannot read another worker container's `/workspace` files.
+ */
+export async function auditProfileDivergences(
+  opts: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey" | "claudeMdPath" | "fetchImpl">,
+  readFile: FileReader = readFileIfExists,
+): Promise<ProfileDivergence[]> {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const response = await doFetch(`${opts.apiUrl}/me`, {
+    headers: {
+      Authorization: `Bearer ${opts.apiKey}`,
+      "X-Agent-ID": opts.agentId,
+    },
+  });
+  if (!response.ok) {
+    throw new Error(`Profile divergence audit failed: HTTP ${response.status}`);
+  }
+
+  const stored = (await response.json()) as Agent;
+  const claudeMdPath =
+    opts.claudeMdPath ??
+    (stored.harnessProvider
+      ? stored.harnessProvider === "claude"
+        ? CLAUDE_MD_PATH
+        : WORKSPACE_CLAUDE_MD_PATH
+      : null);
+  if (!claudeMdPath) {
+    throw new Error(
+      "Profile divergence audit requires a registered harness provider or an explicit claudeMdPath",
+    );
+  }
+  const disk: ProfileMarkdownSnapshot = {
+    soulMd: await readFile(SOUL_MD_PATH),
+    identityMd: await readFile(IDENTITY_MD_PATH),
+    claudeMd: await readFile(claudeMdPath),
+    toolsMd: await readFile(TOOLS_MD_PATH),
+    heartbeatMd: await readFile(HEARTBEAT_MD_PATH),
+  };
+
+  return findProfileDivergences(disk, stored);
+}
+
 /**
  * Collect the profile-update POST bodies to send. Each entry is one POST.
  * `fields` selects which groups to include. The file reader is injectable so
@@ -331,16 +607,12 @@ export async function collectProfilePayloads(
       baselines,
       agentId,
     );
-    if (Object.keys(updates).length > 0) {
-      payloads.push({ label: "identity", body: { ...updates, changeSource } });
-    }
+    payloads.push(...buildIndependentIdentityPayloads(updates, changeSource));
   }
 
   if (fields.includes("claude")) {
     const raw = await readFile(claudeMdPath);
-    if (raw && raw.length > MAX_PROFILE_FILE_LENGTH) {
-      warnProfileFileTooLarge(agentId, "claudeMd", raw.length);
-    } else if (raw?.trim()) {
+    if (raw?.trim()) {
       if (baselines?.claudeMd && contentSha256(raw) === baselines.claudeMd) {
         // CLAUDE.md unchanged during session — skip to preserve Lead's DB edits
       } else {

package/src/commands/provider-credentials.ts

@@ -444,35 +444,62 @@ export async function buildCredStatusReport(
 }
 
 /**
- * Fire-and-forget POST of a `cred_status` snapshot to the API. Used by the
- * worker boot path (`runner.ts` after `awaitCredentials`) and the post-task
- * cache-miss path (also in `runner.ts`). Failures are logged, not thrown —
- * a stale dashboard is acceptable; blocking the worker is not.
+ * Strict PUT of credential readiness to the API: propagates network errors
+ * and non-2xx responses. The post-credential-wait boot path uses this — after
+ * a stale-runtime revival this write is the only transition out of
+ * `waiting_for_credentials`, so the caller must be able to observe (and
+ * retry) a failure instead of proceeding as though it landed.
  *
  * Posts to the existing `PUT /api/agents/:id/credential-status` endpoint
- * which (per migration 055) now accepts an optional `cred_status` field.
- * `ready` and `missing` are also included so legacy `agents.credentialMissing`
- * and `agents.status='waiting_for_credentials'` keep tracking.
+ * which (per migration 055) accepts an optional `cred_status` field. `ready`
+ * and `missing` are always included so legacy `agents.credentialMissing` and
+ * `agents.status='waiting_for_credentials'` keep tracking; the snapshot is
+ * optional so a hiccup while building it cannot lose the transition.
+ */
+export async function sendCredStatusReport(
+  apiUrl: string,
+  apiKey: string,
+  agentId: string,
+  runtimeInstanceId: string | undefined,
+  report: { ready: boolean; missing: string[]; credStatus?: AgentCredStatus },
+): Promise<void> {
+  const res = await fetch(`${apiUrl}/api/agents/${encodeURIComponent(agentId)}/credential-status`, {
+    method: "PUT",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "X-Agent-ID": agentId,
+      ...(runtimeInstanceId ? { "X-Runtime-Instance-ID": runtimeInstanceId } : {}),
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      ready: report.ready,
+      missing: report.missing,
+      ...(report.credStatus ? { cred_status: report.credStatus } : {}),
+    }),
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`credential-status report failed: ${res.status} ${body}`.trim());
+  }
+}
+
+/**
+ * Fire-and-forget wrapper around {@link sendCredStatusReport}. Used by the
+ * post-task cache-miss path (`runner.ts`), where a stale dashboard is
+ * acceptable and blocking the worker is not.
  */
 export async function reportCredStatus(
   apiUrl: string,
   apiKey: string,
   agentId: string,
+  runtimeInstanceId: string | undefined,
   credStatus: AgentCredStatus,
 ): Promise<void> {
   try {
-    await fetch(`${apiUrl}/api/agents/${encodeURIComponent(agentId)}/credential-status`, {
-      method: "PUT",
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        "X-Agent-ID": agentId,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        ready: credStatus.ready,
-        missing: credStatus.missing,
-        cred_status: credStatus,
-      }),
+    await sendCredStatusReport(apiUrl, apiKey, agentId, runtimeInstanceId, {
+      ready: credStatus.ready,
+      missing: credStatus.missing,
+      credStatus,
     });
   } catch (err) {
     console.warn(`[cred-status] POST failed (non-fatal): ${err}`);