@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/src/be/migrations/147_scheduled_tasks_parent_task.sql

@@ -0,0 +1,7 @@
+-- Link a one-off schedule back to the task it continues.
+-- `defer-task` completes the current task and creates a wake-up schedule for
+-- the same agent; the task that schedule creates carries this column as its
+-- `parentTaskId`, so the wake-up run receives the deferred task's context
+-- preamble (src/commands/context-preamble.ts).
+-- Nullable: every schedule created by any other path leaves it NULL.
+ALTER TABLE scheduled_tasks ADD COLUMN parentTaskId TEXT;

package/src/be/migrations/148_pages_svg.sql

@@ -0,0 +1,123 @@
+-- Allow SVG images while preserving page IDs, versions, audit fields, and asset keys.
+-- The migration runner disables foreign keys around the transactional rebuild.
+CREATE TABLE pages_new (
+  id           TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+  agentId      TEXT NOT NULL,
+  slug         TEXT NOT NULL,
+  title        TEXT NOT NULL,
+  description  TEXT,
+  contentType  TEXT NOT NULL CHECK (contentType IN ('text/html','application/json','image/svg+xml')),
+  authMode     TEXT NOT NULL DEFAULT 'authed' CHECK (authMode IN ('public','authed','password')),
+  passwordHash TEXT,
+  body         TEXT NOT NULL,
+  needsCredentials TEXT,
+  createdAt    TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updatedAt    TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  view_count   INTEGER NOT NULL DEFAULT 0,
+  created_by   TEXT REFERENCES users(id),
+  updated_by   TEXT REFERENCES users(id),
+  "key" TEXT NOT NULL DEFAULT 'shared/',
+  UNIQUE (agentId, slug)
+);
+
+INSERT INTO pages_new (
+  id,
+  agentId,
+  slug,
+  title,
+  description,
+  contentType,
+  authMode,
+  passwordHash,
+  body,
+  needsCredentials,
+  createdAt,
+  updatedAt,
+  view_count,
+  created_by,
+  updated_by,
+  "key"
+)
+SELECT
+  id,
+  agentId,
+  slug,
+  title,
+  description,
+  contentType,
+  authMode,
+  passwordHash,
+  body,
+  needsCredentials,
+  createdAt,
+  updatedAt,
+  view_count,
+  created_by,
+  updated_by,
+  "key"
+FROM pages;
+
+DROP TABLE pages;
+ALTER TABLE pages_new RENAME TO pages;
+
+CREATE INDEX IF NOT EXISTS idx_pages_agentId ON pages(agentId);
+CREATE INDEX IF NOT EXISTS idx_pages_updatedAt ON pages(updatedAt DESC);
+CREATE INDEX IF NOT EXISTS idx_pages_created_by ON pages(created_by) WHERE created_by IS NOT NULL;
+
+CREATE INDEX idx_pages_asset_key ON pages("key");
+CREATE TRIGGER validate_pages_asset_key_insert
+BEFORE INSERT ON pages
+WHEN NEW."key" IS NULL
+  OR length(NEW."key") = 0
+  OR NEW."key" != trim(NEW."key")
+  OR length(NEW."key") > 255
+  OR substr(NEW."key", -1, 1) != '/'
+  OR instr(NEW."key", char(0)) > 0
+  OR instr(NEW."key", char(92)) > 0
+  OR instr(NEW."key", '//') > 0
+  OR instr(NEW."key", '/../') > 0
+  OR instr(NEW."key", '/./') > 0
+  OR NEW."key" != lower(NEW."key")
+  OR NOT (
+    NEW."key" = 'shared/'
+    OR NEW."key" LIKE 'shared/%'
+    OR (
+      NEW."key" LIKE 'personal/%/%'
+      AND EXISTS (
+        SELECT 1 FROM users
+        WHERE id = substr(NEW."key", 10, instr(substr(NEW."key", 10), '/') - 1)
+      )
+    )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'invalid asset namespace key');
+END;
+
+CREATE TRIGGER validate_pages_asset_key_update
+BEFORE UPDATE OF "key" ON pages
+WHEN NEW."key" IS NULL
+  OR length(NEW."key") = 0
+  OR NEW."key" != trim(NEW."key")
+  OR length(NEW."key") > 255
+  OR substr(NEW."key", -1, 1) != '/'
+  OR instr(NEW."key", char(0)) > 0
+  OR instr(NEW."key", char(92)) > 0
+  OR instr(NEW."key", '//') > 0
+  OR instr(NEW."key", '/../') > 0
+  OR instr(NEW."key", '/./') > 0
+  OR NEW."key" != lower(NEW."key")
+  OR NOT (
+    NEW."key" = 'shared/'
+    OR NEW."key" LIKE 'shared/%'
+    OR (
+      NEW."key" LIKE 'personal/%/%'
+      AND EXISTS (
+        SELECT 1 FROM users
+        WHERE id = substr(NEW."key", 10, instr(substr(NEW."key", 10), '/') - 1)
+      )
+    )
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'invalid asset namespace key');
+END;
+

package/src/be/migrations/149_session_tokens.sql

@@ -0,0 +1,24 @@
+-- Session-scoped ephemeral bearer tokens (prefix: aseph_) minted per ACP
+-- provider session. The ACP adapter hands this token to the target process
+-- in the swarm MCP server's Authorization header instead of the full operator
+-- key. The token is revoked when the session ends (finish / abort) and also
+-- carries an expiresAt ceiling so a leaked bearer cannot be used indefinitely.
+--
+-- Schema mirrors user_tokens but is separate so the two lifecycles cannot
+-- interfere: user tokens are long-lived and manually revoked; session tokens
+-- are programmatically minted and revoked, and always carry expiresAt.
+
+CREATE TABLE IF NOT EXISTS session_tokens (
+  id           TEXT PRIMARY KEY,
+  tokenHash    TEXT NOT NULL UNIQUE,
+  tokenPreview TEXT NOT NULL,
+  agentId      TEXT NOT NULL,
+  taskId       TEXT NOT NULL,
+  expiresAt    TEXT NOT NULL,
+  revokedAt    TEXT,
+  createdAt    TEXT NOT NULL DEFAULT (datetime('now')),
+  lastUsedAt   TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_session_tokens_agentId
+  ON session_tokens(agentId);

package/src/be/scripts/typecheck.ts

@@ -138,6 +138,7 @@ export interface SwarmSdk {
   task_list(args?: Record<string, unknown>): Promise<unknown>;
   task_get(args: { taskId: string }): Promise<unknown>;
   task_storeProgress(args: Record<string, unknown>): Promise<unknown>;
+  task_defer(args: { taskId: string; delayMs?: number; runAt?: string; summary: string; note: string; checks?: string[] }): Promise<unknown>;
   task_poll(args?: Record<string, unknown>): Promise<unknown>;
   // --- kv ---
   kv_get<T = unknown>(args: { key: string; namespace?: string }): Promise<KvSdkResponse<KvEntry<T>>>;

package/src/be/seed-pricing.ts

@@ -261,6 +261,18 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
   return rows;
 }
 
+/** Build the exact provider rows inserted by the boot-time pricing seeder. */
+export function buildPricingSeedRows(cache: ModelsDevCache | null): PricingSeedRow[] {
+  const modelsdevRows = cache ? buildModelsDevSeedRows(cache) : [];
+  const manualRows = MANUAL_PRICING_OVERRIDES.map((override) => ({
+    provider: override.provider,
+    model: override.model,
+    tokenClass: override.tokenClass,
+    pricePerMillionUsd: override.pricePerMillionUsd,
+  }));
+  return [...modelsdevRows, ...manualRows];
+}
+
 /**
  * Phase 2 entrypoint. Idempotent — safe to call on every boot. Logs a one-line
  * summary so operators can tell whether the boot picked up new rates.
@@ -271,14 +283,7 @@ export function seedPricingFromModelsDev(opts?: { quiet?: boolean }): {
 } {
   const db = getDb();
   const cache = loadModelsDevCache();
-  const modelsdevRows = cache ? buildModelsDevSeedRows(cache) : [];
-  const manualRows = MANUAL_PRICING_OVERRIDES.map((o) => ({
-    provider: o.provider,
-    model: o.model,
-    tokenClass: o.tokenClass,
-    pricePerMillionUsd: o.pricePerMillionUsd,
-  }));
-  const allRows = [...modelsdevRows, ...manualRows];
+  const allRows = buildPricingSeedRows(cache);
 
   const insert = db.prepare<null, [string, string, string, number]>(
     `INSERT OR IGNORE INTO pricing

package/src/be/seed-scripts/catalog/ops-catalog-audit.inline.ts

@@ -38,7 +38,7 @@ const CONTRADICTORY_RE =
   /\b(do not|don't|never)\b[\s\S]{0,240}\b(always|must|required)\b|\b(always|must|required)\b[\s\S]{0,240}\b(do not|don't|never)\b/i;
 
 const CODE_REGISTRY_EVENTS =
-  "agentmail.email.followup agentmail.email.mapped_lead agentmail.email.mapped_worker agentmail.email.no_agent agentmail.email.unmapped common.command_suggestions.github_comment_issue common.command_suggestions.github_comment_pr common.command_suggestions.github_issue common.command_suggestions.github_pr common.command_suggestions.gitlab_issue common.command_suggestions.gitlab_mr common.delegation_instruction common.delegation_instruction.gitlab github.check_run.failed github.check_suite.failed github.comment.mentioned github.issue.assigned github.issue.labeled github.issue.mentioned github.pull_request.assigned github.pull_request.closed github.pull_request.labeled github.pull_request.mentioned github.pull_request.review_requested github.pull_request.review_submitted github.pull_request.synchronize github.workflow_run.failed gitlab.comment.mentioned gitlab.issue.assigned gitlab.merge_request.opened gitlab.pipeline.failed heartbeat.boot-triage heartbeat.checklist jira.issue.assigned jira.issue.commented jira.issue.followup kapso.message.received linear.issue.assigned linear.issue.followup linear.issue.reassigned slack.assistant.greeting slack.assistant.offline slack.assistant.suggested_prompts slack.message.thread_context system.agent.communication system.agent.lead system.agent.memory system.agent.memory.remote system.agent.outputs system.agent.outputs.no_agent_fs system.agent.repository system.agent.role system.agent.secrets system.agent.slack system.agent.tools_skills system.agent.worker system.agent.worker.remote system.agent.workspace system.agent.workspace.remote system.session.lead system.session.lead.managed system.session.worker system.session.worker.managed system.session.worker.remote task.budget.refused task.requester.profile task.worker.completed task.worker.failed".split(
+  "agentmail.email.followup agentmail.email.mapped_lead agentmail.email.mapped_worker agentmail.email.no_agent agentmail.email.unmapped common.command_suggestions.github_comment_issue common.command_suggestions.github_comment_pr common.command_suggestions.github_issue common.command_suggestions.github_pr common.command_suggestions.gitlab_issue common.command_suggestions.gitlab_mr common.delegation_instruction common.delegation_instruction.gitlab github.check_run.failed github.check_suite.failed github.comment.mentioned github.issue.assigned github.issue.labeled github.issue.mentioned github.pull_request.assigned github.pull_request.closed github.pull_request.labeled github.pull_request.mentioned github.pull_request.review_requested github.pull_request.review_submitted github.pull_request.synchronize github.workflow_run.failed gitlab.comment.mentioned gitlab.issue.assigned gitlab.merge_request.opened gitlab.pipeline.failed heartbeat.boot-triage heartbeat.checklist jira.issue.assigned jira.issue.commented jira.issue.followup kapso.message.received linear.issue.assigned linear.issue.followup linear.issue.reassigned slack.assistant.greeting slack.assistant.offline slack.assistant.suggested_prompts slack.message.attachment_failed slack.message.thread_context system.agent.communication system.agent.lead system.agent.memory system.agent.memory.remote system.agent.outputs system.agent.outputs.no_agent_fs system.agent.repository system.agent.role system.agent.secrets system.agent.slack system.agent.tools_skills system.agent.worker system.agent.worker.remote system.agent.workspace system.agent.workspace.remote system.session.lead system.session.lead.managed system.session.worker system.session.worker.managed system.session.worker.remote task.budget.refused task.requester.profile task.worker.completed task.worker.failed".split(
     " ",
   );
 

package/src/be/seed-scripts/catalog/ops-catalog-audit.ts

@@ -38,7 +38,7 @@ const CONTRADICTORY_RE =
   /\b(do not|don't|never)\b[\s\S]{0,240}\b(always|must|required)\b|\b(always|must|required)\b[\s\S]{0,240}\b(do not|don't|never)\b/i;
 
 const CODE_REGISTRY_EVENTS =
-  "agentmail.email.followup agentmail.email.mapped_lead agentmail.email.mapped_worker agentmail.email.no_agent agentmail.email.unmapped common.command_suggestions.github_comment_issue common.command_suggestions.github_comment_pr common.command_suggestions.github_issue common.command_suggestions.github_pr common.command_suggestions.gitlab_issue common.command_suggestions.gitlab_mr common.delegation_instruction common.delegation_instruction.gitlab github.check_run.failed github.check_suite.failed github.comment.mentioned github.issue.assigned github.issue.labeled github.issue.mentioned github.pull_request.assigned github.pull_request.closed github.pull_request.labeled github.pull_request.mentioned github.pull_request.review_requested github.pull_request.review_submitted github.pull_request.synchronize github.workflow_run.failed gitlab.comment.mentioned gitlab.issue.assigned gitlab.merge_request.opened gitlab.pipeline.failed heartbeat.boot-triage heartbeat.checklist jira.issue.assigned jira.issue.commented jira.issue.followup kapso.message.received linear.issue.assigned linear.issue.followup linear.issue.reassigned slack.assistant.greeting slack.assistant.offline slack.assistant.suggested_prompts slack.message.thread_context system.agent.communication system.agent.lead system.agent.memory system.agent.memory.remote system.agent.outputs system.agent.outputs.no_agent_fs system.agent.repository system.agent.role system.agent.secrets system.agent.slack system.agent.tools_skills system.agent.worker system.agent.worker.remote system.agent.workspace system.agent.workspace.remote system.session.lead system.session.lead.managed system.session.worker system.session.worker.managed system.session.worker.remote task.budget.refused task.requester.profile task.worker.completed task.worker.failed".split(
+  "agentmail.email.followup agentmail.email.mapped_lead agentmail.email.mapped_worker agentmail.email.no_agent agentmail.email.unmapped common.command_suggestions.github_comment_issue common.command_suggestions.github_comment_pr common.command_suggestions.github_issue common.command_suggestions.github_pr common.command_suggestions.gitlab_issue common.command_suggestions.gitlab_mr common.delegation_instruction common.delegation_instruction.gitlab github.check_run.failed github.check_suite.failed github.comment.mentioned github.issue.assigned github.issue.labeled github.issue.mentioned github.pull_request.assigned github.pull_request.closed github.pull_request.labeled github.pull_request.mentioned github.pull_request.review_requested github.pull_request.review_submitted github.pull_request.synchronize github.workflow_run.failed gitlab.comment.mentioned gitlab.issue.assigned gitlab.merge_request.opened gitlab.pipeline.failed heartbeat.boot-triage heartbeat.checklist jira.issue.assigned jira.issue.commented jira.issue.followup kapso.message.received linear.issue.assigned linear.issue.followup linear.issue.reassigned slack.assistant.greeting slack.assistant.offline slack.assistant.suggested_prompts slack.message.attachment_failed slack.message.thread_context system.agent.communication system.agent.lead system.agent.memory system.agent.memory.remote system.agent.outputs system.agent.outputs.no_agent_fs system.agent.repository system.agent.role system.agent.secrets system.agent.slack system.agent.tools_skills system.agent.worker system.agent.worker.remote system.agent.workspace system.agent.workspace.remote system.session.lead system.session.lead.managed system.session.worker system.session.worker.managed system.session.worker.remote task.budget.refused task.requester.profile task.worker.completed task.worker.failed".split(
     " ",
   );
 

package/src/be/seed-scripts/catalog/star-history-refresh.ts

@@ -0,0 +1,101 @@
+import type { ScriptContext } from "swarm-sdk";
+import * as z from "zod";
+import { renderChart } from "./star-history-renderer";
+
+export const argsSchema = z.object({
+  dryRun: z.boolean().default(false),
+  authenticated: z.boolean().default(true),
+});
+
+const repository = "desplega-ai/agent-swarm";
+const namespace = "star-history:desplega-ai/agent-swarm";
+const cacheSchema = z.object({
+  fetchedAt: z.string(),
+  pages: z.array(z.object({ etag: z.string().nullable(), timestamps: z.array(z.number().finite()) })),
+});
+type Cache = z.infer<typeof cacheSchema>;
+
+/** Refresh the light and dark star-history images, retaining the last-known series on GitHub failure. */
+export default async function main(args: z.input<typeof argsSchema>, ctx: ScriptContext) {
+  const options = argsSchema.parse(args ?? {});
+  const entry = await ctx.swarm.kv_getOrNull({ namespace, key: "series" });
+  const parsed = cacheSchema.safeParse(entry?.value);
+  const cached = parsed.success ? parsed.data : undefined;
+  let series: Cache;
+  let stale = false;
+  let fetchError: string | undefined;
+  let requests = 0;
+  let notModified = 0;
+  try {
+    const pages: Cache["pages"] = [];
+    const deadline = Date.now() + 12000;
+    // Bound the job so a pagination error cannot consume the entire API budget.
+    for (let page = 1; page <= 50; page++) {
+      if (Date.now() > deadline) throw new Error("GitHub refresh budget exhausted");
+      const previous = cached?.pages[page - 1];
+      const headers: Record<string, string> = {
+        Accept: "application/vnd.github.star+json",
+        "User-Agent": "agent-swarm-star-history-generator",
+        "X-GitHub-Api-Version": "2022-11-28",
+      };
+      if (options.authenticated) headers.Authorization = "Bearer [REDACTED:GITHUB_TOKEN]";
+      if (previous?.etag) headers["If-None-Match"] = previous.etag;
+      requests++;
+      const response = await ctx.stdlib.fetch(
+        `https://api.github.com/repos/${repository}/stargazers?per_page=100&page=${page}`,
+        { headers, signal: AbortSignal.timeout(1500) },
+      );
+      let current: Cache["pages"][number];
+      if (response.status === 304 && previous) {
+        current = previous;
+        notModified++;
+      } else {
+        if (!response.ok) throw new Error(`GitHub stargazers HTTP ${response.status}`);
+        const rows = z.array(z.object({ starred_at: z.string() })).parse(await response.json());
+        const timestamps = rows.map((row) => Date.parse(row.starred_at));
+        if (timestamps.some((timestamp) => !Number.isFinite(timestamp))) {
+          throw new Error("GitHub returned invalid star timestamps");
+        }
+        current = { etag: response.headers.get("etag"), timestamps };
+      }
+      pages.push(current);
+      if (current.timestamps.length < 100) break;
+      if (page === 50) throw new Error("Stargazer pagination exceeded 50 pages");
+    }
+    if (!pages.some((page) => page.timestamps.length)) throw new Error("No stargazers returned");
+    series = { fetchedAt: new Date().toISOString(), pages };
+    await ctx.swarm.kv_set({ namespace, key: "series", value: series });
+  } catch (error) {
+    if (!cached?.pages.some((page) => page.timestamps.length)) {
+      throw new Error("GitHub fetch failed and no cached series exists; no pages published");
+    }
+    series = cached;
+    stale = true;
+    // Avoid transporting fetch exception text, which may include request details.
+    fetchError = error instanceof Error && error.message.startsWith("GitHub stargazers HTTP")
+      ? error.message : "GitHub refresh failed; using last-known series";
+  }
+
+  const timestamps = series.pages.flatMap((page) => page.timestamps).sort((a, b) => a - b);
+  const pages = [];
+  for (const theme of ["light", "dark"] as const) {
+    const body = renderChart(repository, timestamps, theme);
+    const slug = `star-history-${theme}`;
+    if (options.dryRun) {
+      pages.push({ slug, bytes: new TextEncoder().encode(body).length });
+      continue;
+    }
+    const response = await ctx.swarm.page_create({
+      slug, title: `Star history (${theme})`, body,
+      description: `GitHub stars for ${repository}; fetched ${series.fetchedAt}`,
+      contentType: "image/svg+xml", authMode: "public",
+    }) as { data?: { id?: string; api_url?: string }; id?: string; api_url?: string };
+    const page = response.data ?? response;
+    if (!page.id || !page.api_url) throw new Error(`Failed to publish ${slug}`);
+    pages.push({ slug, id: page.id, apiUrl: page.api_url });
+  }
+  return {
+    repository, stars: timestamps.length, fetchedAt: series.fetchedAt, stale, fetchError,
+    authenticated: options.authenticated, requests, notModified, dryRun: options.dryRun, pages,
+  };
+}

package/src/be/seed-scripts/catalog/star-history-renderer.ts

@@ -0,0 +1,119 @@
+const themes = {
+  light: {
+    background: "#ffffff",
+    border: "#e5e7eb",
+    grid: "#e5e7eb",
+    text: "#111827",
+    muted: "#6b7280",
+    accent: "#f59e0b",
+  },
+  dark: {
+    background: "#0d1117",
+    border: "#30363d",
+    grid: "#21262d",
+    text: "#f0f6fc",
+    muted: "#8b949e",
+    accent: "#f59e0b",
+  },
+};
+
+function escapeXml(value: string) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+
+function niceStep(maximum: number, targetTickCount = 6) {
+  const roughStep = maximum / targetTickCount;
+  const power = 10 ** Math.floor(Math.log10(roughStep));
+  const normalized = roughStep / power;
+  const multiplier = normalized <= 1 ? 1 : normalized <= 2 ? 2 : normalized <= 5 ? 5 : 10;
+  return multiplier * power;
+}
+
+export function renderChart(repository: string, timestamps: number[], themeName: keyof typeof themes) {
+  const theme = themes[themeName];
+  const width = 960;
+  const height = 520;
+  const margin = { top: 96, right: 34, bottom: 62, left: 76 };
+  const plotWidth = width - margin.left - margin.right;
+  const plotHeight = height - margin.top - margin.bottom;
+  const firstStar = timestamps[0]!;
+  const lastStar = timestamps.at(-1)!;
+  const timeRange = Math.max(lastStar - firstStar, 1);
+  const yStep = niceStep(timestamps.length);
+  const yMaximum = Math.ceil(timestamps.length / yStep) * yStep;
+  const plotBottom = margin.top + plotHeight;
+
+  const x = (timestamp: number) => margin.left + ((timestamp - firstStar) / timeRange) * plotWidth;
+  const y = (stars: number) => margin.top + plotHeight - (stars / yMaximum) * plotHeight;
+
+  const points = timestamps.map((timestamp, index) => ({
+    x: x(timestamp),
+    y: y(index + 1),
+  }));
+  const linePath = points
+    .map((point, index) => `${index === 0 ? "M" : "L"} ${point.x.toFixed(1)} ${point.y.toFixed(1)}`)
+    .join(" ");
+  const areaPath = `M ${points[0]!.x.toFixed(1)} ${plotBottom.toFixed(1)} ${linePath.replace(/^M/, "L")} L ${points.at(-1)!.x.toFixed(1)} ${plotBottom.toFixed(1)} Z`;
+
+  const yTicks = [];
+  for (let stars = 0; stars <= yMaximum; stars += yStep) {
+    const tickY = y(stars);
+    yTicks.push(`
+      <line x1="${margin.left}" y1="${tickY.toFixed(1)}" x2="${width - margin.right}" y2="${tickY.toFixed(1)}" stroke="${theme.grid}" />
+      <text x="${margin.left - 14}" y="${(tickY + 5).toFixed(1)}" text-anchor="end" fill="${theme.muted}" font-size="13">${stars}</text>`);
+  }
+
+  const dateFormatter = new Intl.DateTimeFormat("en-US", {
+    month: "short",
+    year: "numeric",
+    timeZone: "UTC",
+  });
+  const updatedFormatter = new Intl.DateTimeFormat("en-US", {
+    day: "numeric",
+    month: "short",
+    year: "numeric",
+    timeZone: "UTC",
+  });
+  const xTicks = Array.from({ length: 7 }, (_, index) => {
+    const fraction = index / 6;
+    const timestamp = firstStar + timeRange * fraction;
+    const tickX = margin.left + plotWidth * fraction;
+    return `
+      <line x1="${tickX.toFixed(1)}" y1="${margin.top}" x2="${tickX.toFixed(1)}" y2="${plotBottom}" stroke="${theme.grid}" />
+      <text x="${tickX.toFixed(1)}" y="${plotBottom + 30}" text-anchor="middle" fill="${theme.muted}" font-size="13">${dateFormatter.format(timestamp)}</text>`;
+  });
+
+  const escapedRepository = escapeXml(repository);
+  const lastPoint = points.at(-1)!;
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="960" height="520" viewBox="0 0 960 520" role="img" aria-labelledby="title description">
+  <title id="title">Star history for ${escapedRepository}</title>
+  <desc id="description">${timestamps.length} cumulative GitHub stars from ${updatedFormatter.format(firstStar)} through ${updatedFormatter.format(lastStar)}.</desc>
+  <defs>
+    <linearGradient id="star-area" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="${theme.accent}" stop-opacity="0.24" />
+      <stop offset="100%" stop-color="${theme.accent}" stop-opacity="0.02" />
+    </linearGradient>
+    <filter id="point-shadow" x="-100%" y="-100%" width="300%" height="300%">
+      <feDropShadow dx="0" dy="1" stdDeviation="2" flood-color="${theme.accent}" flood-opacity="0.35" />
+    </filter>
+  </defs>
+  <rect x="0.5" y="0.5" width="959" height="519" rx="12" fill="${theme.background}" stroke="${theme.border}" />
+  <g font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif">
+    <text x="${margin.left}" y="43" fill="${theme.text}" font-size="21" font-weight="600">${escapedRepository}</text>
+    <text x="${margin.left}" y="69" fill="${theme.muted}" font-size="13">Cumulative GitHub stars · updated ${updatedFormatter.format(lastStar)}</text>
+    <g transform="translate(${width - margin.right - 118}, 34)">
+      <text x="0" y="17" fill="${theme.accent}" font-size="19">★</text>
+      <text x="27" y="17" fill="${theme.text}" font-size="16" font-weight="600">${timestamps.length} stars</text>
+    </g>
+    ${yTicks.join("").trim()}
+    ${xTicks.join("").trim()}
+    <path d="${areaPath}" fill="url(#star-area)" />
+    <path d="${linePath}" fill="none" stroke="${theme.accent}" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" />
+    <circle cx="${lastPoint.x.toFixed(1)}" cy="${lastPoint.y.toFixed(1)}" r="5" fill="${theme.background}" stroke="${theme.accent}" stroke-width="3" filter="url(#point-shadow)" />
+    <text x="20" y="${margin.top + plotHeight / 2}" transform="rotate(-90 20 ${margin.top + plotHeight / 2})" text-anchor="middle" fill="${theme.muted}" font-size="13">GitHub stars</text>
+  </g>
+</svg>
+`;
+}
+

package/src/be/seed-scripts/index.ts

@@ -44,6 +44,9 @@ import reportProgressSrc from "./catalog/report-progress.ts" with { type: "text"
 import scheduleHealthSrc from "./catalog/schedule-health.ts" with { type: "text" };
 import slackThreadFlattenSrc from "./catalog/slack-thread-flatten.ts" with { type: "text" };
 import smartRecallSrc from "./catalog/smart-recall.ts" with { type: "text" };
+import starHistoryRefreshSrc from "./catalog/star-history-refresh.ts" with { type: "text" };
+// @ts-expect-error Bun text imports synthesize a default string for this helper.
+import starHistoryRendererSrc from "./catalog/star-history-renderer.ts" with { type: "text" };
 import swarmOverviewSrc from "./catalog/swarm-overview.ts" with { type: "text" };
 import taskContextGatheringSrc from "./catalog/task-context-gathering.ts" with { type: "text" };
 import taskFailureAuditSrc from "./catalog/task-failure-audit.ts" with { type: "text" };
@@ -71,6 +74,20 @@ function bundleCatalogReport(source: string): string {
 }
 
 export const SEED_SCRIPTS: SeedScript[] = [
+  {
+    name: "star-history-refresh",
+    description:
+      "Refresh stable public light/dark SVG star-history pages from GitHub with ETags and a last-known KV series.",
+    intent:
+      "Run hourly under the same page-owning agent identity; dryRun validates rendering before SVG page support deploys.",
+    source:
+      asText(starHistoryRendererSrc) +
+      "\n" +
+      asText(starHistoryRefreshSrc).replace(
+        'import { renderChart } from "./star-history-renderer";',
+        "",
+      ),
+  },
   {
     name: "gh-pr-snapshot",
     description:

package/src/be/seed-skills/index.ts

@@ -154,6 +154,12 @@ import researchingConfig from "../../../templates/skills/researching/config.json
 import researchingContent from "../../../templates/skills/researching/content.md" with {
   type: "text",
 };
+import reviewOfferedTaskConfig from "../../../templates/skills/review-offered-task/config.json" with {
+  type: "text",
+};
+import reviewOfferedTaskContent from "../../../templates/skills/review-offered-task/content.md" with {
+  type: "text",
+};
 import reviewingConfig from "../../../templates/skills/reviewing/config.json" with { type: "text" };
 import reviewingContent from "../../../templates/skills/reviewing/content.md" with { type: "text" };
 import scheduledTaskResilienceConfig from "../../../templates/skills/scheduled-task-resilience/config.json" with {
@@ -230,6 +236,12 @@ import vPlanningContent from "../../../templates/skills/v-planning/content.md" w
 };
 import verifyingConfig from "../../../templates/skills/verifying/config.json" with { type: "text" };
 import verifyingContent from "../../../templates/skills/verifying/content.md" with { type: "text" };
+import workOnTaskConfig from "../../../templates/skills/work-on-task/config.json" with {
+  type: "text",
+};
+import workOnTaskContent from "../../../templates/skills/work-on-task/content.md" with {
+  type: "text",
+};
 import workflowIterateConfig from "../../../templates/skills/workflow-iterate/config.json" with {
   type: "text",
 };
@@ -328,6 +340,7 @@ const BUILT_IN_SKILL_SOURCES = [
   { config: qaConfig, body: qaContent },
   { config: questioningConfig, body: questioningContent },
   { config: researchingConfig, body: researchingContent },
+  { config: reviewOfferedTaskConfig, body: reviewOfferedTaskContent },
   { config: reviewingConfig, body: reviewingContent },
   { config: scheduledTaskResilienceConfig, body: scheduledTaskResilienceContent },
   { config: schedulingConfig, body: schedulingContent },
@@ -342,6 +355,7 @@ const BUILT_IN_SKILL_SOURCES = [
   { config: vImplementingConfig, body: vImplementingContent },
   { config: vPlanningConfig, body: vPlanningContent },
   { config: verifyingConfig, body: verifyingContent },
+  { config: workOnTaskConfig, body: workOnTaskContent },
   { config: workflowIterateConfig, body: workflowIterateContent },
   { config: workflowStructuredOutputConfig, body: workflowStructuredOutputContent },
   { config: wtsExpertConfig, body: wtsExpertContent },

package/src/be/swarm-config-guard.ts

@@ -11,10 +11,13 @@ import { ProviderNameSchema } from "../types";
  *   - `SECRETS_ENCRYPTION_KEY` is required to decrypt secrets stored in
  *     swarm_config, so it cannot itself be stored encrypted there.
  *
+ * `CORS_ALLOW_ANY_ORIGIN` is deployment-only: runtime config must not
+ * re-enable unrestricted credentialed CORS.
+ *
  * Matching is case-insensitive so `api_key`, `Api_Key`, etc. are all
  * rejected at every write path (DB helpers, HTTP routes, MCP tools).
  */
-const RESERVED_KEYS = new Set(["API_KEY", "SECRETS_ENCRYPTION_KEY"]);
+const RESERVED_KEYS = new Set(["API_KEY", "SECRETS_ENCRYPTION_KEY", "CORS_ALLOW_ANY_ORIGIN"]);
 
 export function isReservedConfigKey(key: string): boolean {
   return RESERVED_KEYS.has(key.toUpperCase());
@@ -223,7 +226,7 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   },
   // AWS credential mode for the Bedrock path on the pi harness.
   //   sdk    — AWS SDK default credential chain (env, ~/.aws/*, SSO, IMDS, …)
-  //   bearer — explicit bearer token via AWS_BEARER_TOKEN_BEDROCK (future/Mantle)
+  //   bearer — explicit Bedrock API key via AWS_BEARER_TOKEN_BEDROCK (required in this mode)
   // When absent the worker infers the mode from MODEL_OVERRIDE (sdk semantics).
   BEDROCK_AUTH_MODE: (value) => {
     if (value === "sdk" || value === "bearer") return null;

package/src/be/task-attachment-store.ts

@@ -0,0 +1,70 @@
+import type { FileObject, FileScope, FileStorageProvider } from "../fs/provider";
+import type { TaskAttachment } from "../types";
+import { scrubSecrets } from "../utils/secret-scrubber";
+import { insertTaskAttachment } from "./db";
+
+/** Per-file cap for every path that stores a blob as a task attachment. */
+export const MAX_TASK_ATTACHMENT_BYTES = 50 * 1024 * 1024;
+
+export type RecordTaskAttachmentUploadInput = {
+  provider: FileStorageProvider;
+  scope: FileScope;
+  /** What `provider.upload(scope, body, …)` returned. */
+  uploaded: FileObject;
+  /** Size and sha256 of the body that was uploaded. */
+  sizeBytes: number;
+  sha256: string;
+  contentType: string;
+  agentId: string | null;
+  intent?: string;
+  description?: string;
+  isPrimary?: boolean;
+  createdBy?: string;
+};
+
+/**
+ * Record a blob the active provider just stored as a `task_attachments` row.
+ * If the row can't be written the blob is deleted, so a failed insert never
+ * leaves an orphan in storage, and the insert error is rethrown.
+ */
+export async function recordTaskAttachmentUpload(
+  input: RecordTaskAttachmentUploadInput,
+): Promise<TaskAttachment> {
+  const { provider, scope, uploaded, contentType } = input;
+  try {
+    return await insertTaskAttachment({
+      taskId: scope.taskId,
+      agentId: input.agentId,
+      name: scope.name,
+      kind: provider.id === "agent-fs" ? "agent-fs" : "shared-fs",
+      path: uploaded.key,
+      providerId: provider.id,
+      providerKey: uploaded.key,
+      capabilities: {
+        ...provider.capabilities,
+        version: uploaded.version,
+        etag: uploaded.etag,
+      },
+      mimeType: uploaded.contentType ?? contentType,
+      sizeBytes: uploaded.sizeBytes ?? input.sizeBytes,
+      sha256: uploaded.sha256 ?? input.sha256,
+      intent: input.intent,
+      description: input.description,
+      isPrimary: input.isPrimary ?? false,
+      createdBy: input.createdBy,
+    });
+  } catch (error) {
+    try {
+      await provider.delete(scope);
+    } catch (cleanupError) {
+      console.warn(
+        scrubSecrets(
+          `[fs] upload metadata insert failed and blob cleanup failed: ${
+            cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
+          }`,
+        ),
+      );
+    }
+    throw error;
+  }
+}