@desplega.ai/agent-swarm 1.135.0 → 1.135.1

package/README.md

@@ -131,7 +131,7 @@ Check [our templates](https://templates.agent-swarm.dev) for a quick start.
 - **Mid-run task steering** — add context at the next turn boundary, request an immediate interrupt where the harness supports it, or degrade safely to a follow-up task. [Task steering →](https://docs.agent-swarm.dev/docs/guides/task-steering)
 - **Operator configuration UI** — tune non-secret feature flags, limits, integration toggles, and runtime defaults from Settings → Configuration, with source and restart-required indicators. [Configuration →](https://docs.agent-swarm.dev/docs/ui/configuration)
 - **Asset namespaces** — group tasks, workflows, schedules, pages, apps, scripts, and mapped files under canonical shared or personal keys, with inheritance, subtree filtering, audited moves, and cross-entity discovery. [Asset namespaces →](https://docs.agent-swarm.dev/docs/guides/asset-namespaces)
-- **Persistent shared files via agent-fs** — co-deploy agent-fs for shared task attachments, previews, and search; late provisioning or config reloads activate the provider without an API restart, and tenant-authenticated control planes can invite shared-org members without receiving the bootstrap key. [Co-deployment guide →](https://docs.agent-swarm.dev/docs/guides/agent-fs-co-deployment)
+- **Persistent shared files via agent-fs** — co-deploy agent-fs for shared task attachments, previews, and search; `store-progress` verifies attachment pointers before changing task state, late provisioning or config reloads activate the provider without an API restart, and tenant-authenticated control planes can invite shared-org members without receiving the bootstrap key. [Co-deployment guide →](https://docs.agent-swarm.dev/docs/guides/agent-fs-co-deployment)
 - **Durable script workflows** — launch background script runs, inspect their journals, and track them from the dashboard when a one-shot `script-run` is too small. [Guide →](https://docs.agent-swarm.dev/docs/guides/script-workflow-runs)
 - **Scripts-only MCP mode (code-mode)** — reduce the external MCP surface to eight script tools while retaining the full swarm SDK through `script-run`, cutting tool-schema context for capable coordinator models. [Guide →](https://docs.agent-swarm.dev/docs/guides/scripts-only-mode)
 - **Scripts as external APIs** — expose a saved script as a public `POST /api/x/script/<id>` endpoint with optional bearer auth, typed input validation, and per-endpoint usage tracking. [Guide →](https://docs.agent-swarm.dev/docs/guides/scripts-external-apis)

package/dist/{actions-3fpj602h.js → actions-cdtyz12q.js}

@@ -1,10 +1,10 @@
 import {
   resolveSlackUserId
-} from "./cli-crkvptsz.js";
-import"./cli-v21nahej.js";
+} from "./cli-gkfzvf7n.js";
+import"./cli-41wfr4tp.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-1gzz6pmf.js";
+} from "./cli-z3h9zvty.js";
 import {
   buildCancelledBlocks,
   ensureSlackThreadTree,
@@ -12,7 +12,7 @@ import {
   getAgentEmoji,
   getTaskLink,
   isSlackRenderV2Enabled
-} from "./cli-1gvam274.js";
+} from "./cli-6ewfzrgz.js";
 import"./cli-qf9kpsve.js";
 import"./cli-g2p9bd1z.js";
 import"./cli-5tnr64pm.js";
@@ -24,14 +24,14 @@ import {
   init_context_key,
   init_db,
   slackContextKey
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import"./cli-87zrjxdb.js";
 import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-qntkxysp.js";

package/dist/{app-12mwdsvg.js → app-bsbct708.js}

@@ -3,18 +3,18 @@ import {
   initSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-1gvam274.js";
+} from "./cli-6ewfzrgz.js";
 import"./cli-qf9kpsve.js";
 import"./cli-g2p9bd1z.js";
 import"./cli-5tnr64pm.js";
-import"./cli-prfghf4h.js";
+import"./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import"./cli-87zrjxdb.js";
 import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-qntkxysp.js";

package/dist/{assistant-p87pt2b5.js → assistant-139yzd1t.js}

@@ -2,24 +2,24 @@ import {
   bufferThreadMessage,
   getBufferMessageCount,
   wasEventSeen
-} from "./cli-z6gdnbjy.js";
+} from "./cli-dntm4d6r.js";
 import {
   hasOtherUserMention
-} from "./cli-y98ry8cz.js";
+} from "./cli-x0mnesvr.js";
 import {
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-crkvptsz.js";
-import"./cli-v21nahej.js";
+} from "./cli-gkfzvf7n.js";
+import"./cli-41wfr4tp.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-1gzz6pmf.js";
+} from "./cli-z3h9zvty.js";
 import {
   ackSlackMessage,
   ensureSlackThreadTree,
   isSlackRenderV2Enabled,
   require_dist
-} from "./cli-1gvam274.js";
+} from "./cli-6ewfzrgz.js";
 import"./cli-qf9kpsve.js";
 import"./cli-g2p9bd1z.js";
 import"./cli-5tnr64pm.js";
@@ -30,7 +30,7 @@ import {
   init_context_key,
   init_db,
   slackContextKey
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import {
   init_resolver,
@@ -43,7 +43,7 @@ import {
   isEnvFlagEnabled
 } from "./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-qntkxysp.js";

package/dist/{boot-reembed-jf6gx8yr.js → boot-reembed-gdzp4g2k.js}

@@ -1,21 +1,21 @@
 import {
   embedScript,
   embeddingProvider
-} from "./cli-h9gpdrzg.js";
-import"./cli-10694wk0.js";
+} from "./cli-9nrnc45k.js";
+import"./cli-zg86g3q8.js";
 import"./cli-dr5tcz68.js";
 import"./cli-vsap7a8d.js";
 import {
   getDbClient,
   init_db
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import"./cli-87zrjxdb.js";
 import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-pq2ee5ja.js";

package/dist/{boot-reembed-vjkptm2x.js → boot-reembed-q7f385st.js}

@@ -3,20 +3,20 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   init_constants
-} from "./cli-10694wk0.js";
+} from "./cli-zg86g3q8.js";
 import"./cli-dr5tcz68.js";
 import"./cli-vsap7a8d.js";
 import {
   getDbClient,
   init_db
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import"./cli-87zrjxdb.js";
 import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-pq2ee5ja.js";

package/dist/{boot-scrub-logs-ah6bpjte.js → boot-scrub-logs-ammdkvre.js}

@@ -1,14 +1,14 @@
 import {
   getDbClient,
   init_db
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import"./cli-d2epf5ae.js";
 import"./cli-87zrjxdb.js";
 import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{claude-adapter-9ry59y9k.js → claude-adapter-h67y60dz.js}

@@ -12,8 +12,8 @@ import {
   resolveClaudeBinary,
   resolveClaudeBinaryArgv,
   resolveClaudeBridgeEnabled
-} from "./cli-8ca5b9j9.js";
-import"./cli-a2brkr6h.js";
+} from "./cli-pnqdak88.js";
+import"./cli-mgnrknyg.js";
 import"./cli-a3pkfpqs.js";
 import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
@@ -35,7 +35,7 @@ import"./cli-a1rrkrb4.js";
 import"./cli-qt5bt3vk.js";
 import"./cli-nanaxrz6.js";
 import"./cli-s35981d0.js";
-import"./cli-w4ezqgkj.js";
+import"./cli-j6fpcrdk.js";
 import"./cli-mkq1rk7b.js";
 import"./cli-pqv5gvyf.js";
 import"./cli-darcwax3.js";

package/dist/{cli-yd6vqt1x.js → cli-0rgbgtft.js}

@@ -6,7 +6,7 @@ import {
 } from "./cli-epan13p1.js";
 import {
   embedScript
-} from "./cli-h9gpdrzg.js";
+} from "./cli-9nrnc45k.js";
 import {
   calculatePKCECodeChallenge,
   ensureAuthorizationTokenOrThrow,
@@ -18,7 +18,7 @@ import {
   oauthAppRowToProviderConfig,
   updateAuthorizationTokens,
   upsertAuthorization
-} from "./cli-3m4mkyqy.js";
+} from "./cli-h8htvhk5.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
@@ -39,7 +39,7 @@ import {
   normalizeDateRequired,
   placeholderForConfigKey,
   upsertSwarmConfig
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
@@ -171825,6 +171825,7 @@ var DEFAULT_SCRIPT_RESOURCES = {
 var import_typescript = __toESM(require_typescript(), 1);
 var ALLOWED_BARE_IMPORTS = new Set(["swarm-sdk", "stdlib", "zod"]);
 var FORBIDDEN_HINTS = new Set(["node:", "bun:", "fs", "child_process", "crypto", "bun:sqlite"]);
+var ALLOWLIST_REMEDY = 'Allowed imports are "swarm-sdk", "stdlib", "zod", and relative paths ("./" or "../").';
 function isRelative(specifier) {
   return specifier.startsWith("./") || specifier.startsWith("../");
 }
@@ -171883,7 +171884,8 @@ function validateScriptImports(source) {
     return { ok: true };
   const hint = rejected.find((specifier) => FORBIDDEN_HINTS.has(specifier) || specifier.startsWith("node:"));
   const reason = hint ? `Import '${hint}' is not allowed in swarm scripts` : `Import '${rejected[0]}' is not on the swarm script allowlist`;
-  return { ok: false, diagnostic: reason, imports: rejected };
+  const remedy = hint === "crypto" || hint === "node:crypto" ? "The global crypto object already provides randomUUID, getRandomValues, and subtle.digest; delete the import and use crypto directly." : ALLOWLIST_REMEDY;
+  return { ok: false, diagnostic: `${reason}. ${remedy}`, imports: rejected };
 }
 
 // src/scripts-runtime/loader.ts

package/dist/{cli-wzmeara2.js → cli-17e3ydca.js}

@@ -1,12 +1,12 @@
 import {
   SYSTEM_COLUMN_KINDS,
   listAppRecords
-} from "./cli-f2tgry1v.js";
+} from "./cli-47d0y52n.js";
 import {
   getScriptApiTypes,
   getScriptMcpTypes,
   require_typescript
-} from "./cli-yd6vqt1x.js";
+} from "./cli-0rgbgtft.js";
 import {
   deleteSwarmConfigByKey,
   getAgentById,
@@ -15,7 +15,7 @@ import {
   getSwarmConfigs,
   init_db,
   upsertSwarmConfig
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -127,7 +127,7 @@ async function ensureAgentFsSharedProvisioning(options) {
     await upsertSwarmConfig({ scope: "global", key, value, isSecret: false, description });
   }
   process.env.AGENT_FS_API_URL = apiUrl;
-  const { resetFileStorageProvider } = await import("./registry-2g6d2p3n.js");
+  const { resetFileStorageProvider } = await import("./registry-6nvn6bj0.js");
   resetFileStorageProvider();
   return { apiUrl, apiKey, orgId, driveId, authHeaders };
 }

package/dist/{cli-9kekm9yz.js → cli-3ad3q6j0.js}

@@ -1,14 +1,14 @@
 import {
   buildModelsDevSeedRows,
   loadModelsDevCache
-} from "./cli-w3xch1b8.js";
+} from "./cli-ysehve35.js";
 import {
   createLogEntry,
   getActivePricingRow,
   getDbClient,
   init_db,
   insertPricingRow
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-v21nahej.js → cli-41wfr4tp.js}

@@ -4,7 +4,7 @@ import {
   incrKv,
   init_db,
   upsertKv
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 
 // src/be/users.ts
 init_db();

package/dist/{cli-f2tgry1v.js → cli-47d0y52n.js}

@@ -7,14 +7,14 @@ import {
   restoreScratchScriptLastUsedIfUnchanged,
   runScript,
   touchScratchScriptLastUsed
-} from "./cli-yd6vqt1x.js";
+} from "./cli-0rgbgtft.js";
 import {
   defaultAssetKey,
   getDbClient,
   getLeadAgent,
   init_db,
   init_key
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_zod
 } from "./cli-s35981d0.js";

package/dist/{cli-269pdgm4.js → cli-5vmvkwey.js}

@@ -5,7 +5,7 @@ import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 
 // src/be/rbac-roles.ts
 init_db();

package/dist/{cli-1gvam274.js → cli-6ewfzrgz.js}

@@ -37,7 +37,7 @@ import {
   setSlackMessageTracking,
   slackContextKey,
   updateSlackMessageRecord
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   getAppUrl,
   init_constants
@@ -53977,6 +53977,17 @@ init_types();
 init_db();
 var import_bolt = __toESM(require_dist7(), 1);
 
+// src/slack/socket-mode-guard.ts
+init_env_flag();
+var SLACK_DEV_SOCKET_MODE_OPT_IN = "SLACK_ALLOW_DEV_SOCKET_MODE";
+function getSlackSocketModeBlockReason(env) {
+  if (env.NODE_ENV !== "development")
+    return null;
+  if (isEnvFlagEnabled(SLACK_DEV_SOCKET_MODE_OPT_IN, false, env))
+    return null;
+  return "NODE_ENV=development marks this as a dev/throwaway run";
+}
+
 // src/slack/watcher.ts
 init_db();
 
@@ -55160,19 +55171,24 @@ async function initSlackApp() {
     console.log("[Slack] Missing SLACK_BOT_TOKEN or SLACK_APP_TOKEN, Slack integration disabled");
     return null;
   }
+  const socketModeBlockReason = getSlackSocketModeBlockReason(process.env);
+  if (socketModeBlockReason) {
+    console.error(`[Slack] SOCKET MODE BLOCKED: ${socketModeBlockReason}. Set ${SLACK_DEV_SOCKET_MODE_OPT_IN}=true to opt in explicitly.`);
+    return null;
+  }
   app = new import_bolt.App({
     token: botToken,
     appToken,
     socketMode: true,
     logLevel: import_bolt.LogLevel.DEBUG
   });
-  const { registerMessageHandler } = await import("./handlers-58k0e9mc.js");
-  const { registerCommandHandler } = await import("./commands-kg7cm1jz.js");
-  const { registerActionHandlers } = await import("./actions-3fpj602h.js");
+  const { registerMessageHandler } = await import("./handlers-cpratgdt.js");
+  const { registerCommandHandler } = await import("./commands-zhm1v98e.js");
+  const { registerActionHandlers } = await import("./actions-cdtyz12q.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
-  const { createAssistant } = await import("./assistant-p87pt2b5.js");
+  const { createAssistant } = await import("./assistant-139yzd1t.js");
   app.assistant(createAssistant());
   return app;
 }
@@ -55181,7 +55197,7 @@ async function startSlackApp() {
     await initSlackApp();
   }
   if (app) {
-    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-k7h2sbmp.js");
+    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-41schhkc.js");
     if (isSlackRenderV2Enabled2())
       await ensureSlackRenderV2Activation();
     await app.start();

package/dist/{cli-md759nb0.js → cli-6t91v11y.js}

@@ -10,14 +10,14 @@ import {
   getPinCandidateAgent,
   getResumeGeneration,
   repointTrackerSyncBySwarmId
-} from "./cli-dphm5tyw.js";
+} from "./cli-t46mkxd2.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-qh4sqfws.js";
 import {
   getExecutorRegistry,
   recoverIncompleteRuns
-} from "./cli-j2p3bfs3.js";
+} from "./cli-pbatxkne.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -58,7 +58,7 @@ import {
   releaseStaleReviewingTasks,
   supersedeTask,
   updateAgentStatus
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_registry,
   init_resolver,

package/dist/{cli-2ecesrtw.js → cli-7vk1ztap.js}

@@ -2,17 +2,17 @@ import {
   getExecutorRegistry,
   handleScheduleTrigger,
   startWorkflowExecution
-} from "./cli-j2p3bfs3.js";
+} from "./cli-pbatxkne.js";
 import {
   buildScriptCredentialBindings,
   getScript,
   getScriptApiConnectionDescriptors,
   getScriptMcpConnectionDescriptors,
   runScript
-} from "./cli-yd6vqt1x.js";
+} from "./cli-0rgbgtft.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-1gzz6pmf.js";
+} from "./cli-z3h9zvty.js";
 import {
   getDbClient,
   getDueScheduledTasks,
@@ -25,7 +25,7 @@ import {
   scheduleContextKey,
   telemetry,
   updateScheduledTask
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   __commonJS,
   __require,

package/dist/{cli-bynsg176.js → cli-96sytm77.js}

@@ -206,7 +206,8 @@ var CodexExec = class {
   pathDirs;
   envOverride;
   configOverrides;
-  constructor(executablePath = null, env, configOverrides) {
+  rawConfigOverrides;
+  constructor(executablePath = null, env, configOverrides, rawConfigOverrides) {
     if (executablePath) {
       this.executablePath = executablePath;
       this.pathDirs = [];
@@ -217,6 +218,7 @@ var CodexExec = class {
     }
     this.envOverride = env;
     this.configOverrides = configOverrides;
+    this.rawConfigOverrides = rawConfigOverrides;
   }
   async* run(args) {
     const commandArgs = ["exec", "--experimental-json"];
@@ -225,6 +227,11 @@ var CodexExec = class {
         commandArgs.push("--config", override);
       }
     }
+    if (this.rawConfigOverrides) {
+      for (const override of this.rawConfigOverrides) {
+        commandArgs.push("--config", override);
+      }
+    }
     if (args.baseUrl) {
       commandArgs.push("--config", `openai_base_url=${toTomlValue(args.baseUrl, "openai_base_url")}`);
     }
@@ -545,8 +552,8 @@ var Codex = class {
   exec;
   options;
   constructor(options = {}) {
-    const { codexPathOverride, env, config } = options;
-    this.exec = new CodexExec(codexPathOverride, env, config);
+    const { codexPathOverride, env, config, configOverrides } = options;
+    this.exec = new CodexExec(codexPathOverride, env, config, configOverrides);
     this.options = options;
   }
   startThread(options = {}) {

package/dist/{cli-h9gpdrzg.js → cli-9nrnc45k.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-10694wk0.js";
+} from "./cli-zg86g3q8.js";
 import {
   getDbClient,
   init_db
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-z6gdnbjy.js → cli-dntm4d6r.js}

@@ -1,13 +1,13 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-y98ry8cz.js";
+} from "./cli-x0mnesvr.js";
 import {
   rewriteSlackMentions
-} from "./cli-crkvptsz.js";
+} from "./cli-gkfzvf7n.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-1gzz6pmf.js";
+} from "./cli-z3h9zvty.js";
 import {
   buildBufferFlushBlocks,
   ensureSlackThreadTree,
@@ -16,7 +16,7 @@ import {
   getSlackApp,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-1gvam274.js";
+} from "./cli-6ewfzrgz.js";
 import {
   createLogEntry,
   getAgentById,
@@ -29,7 +29,7 @@ import {
   init_steering,
   requestSteering,
   slackContextKey
-} from "./cli-prfghf4h.js";
+} from "./cli-q46hkq2p.js";
 import {
   init_registry,
   init_steering_enabled,