@desplega.ai/agent-swarm 1.147.0 → 1.148.0

package/dist/{oauth-refresh-sweep-wdetky26.js → oauth-refresh-sweep-wtqgnh3c.js}

@@ -2,8 +2,8 @@ import {
   forceRefreshAuthorizationOrThrow,
   getAuthorizationById,
   listAuthorizationSweepRows
-} from "./cli-zhjmqxzh.js";
-import"./cli-ftht3zzj.js";
+} from "./cli-dcem3pr1.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -11,7 +11,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{onboard-bb5net8s.js → onboard-a4krmh46.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-n8508nre.js";
+} from "./cli-ztn0ga15.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-s2qjdd6z.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-w9kb3bk1.js";
+} from "./cli-anedxf1w.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-0w7c14ap.js → otel-impl-725kq0vp.js}

@@ -4,7 +4,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-w9kb3bk1.js";
+} from "./cli-anedxf1w.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{pricing-refresh-9nzsrgcq.js → pricing-refresh-kqxd7w9h.js}

@@ -2,9 +2,9 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-m8yrsg97.js";
-import"./cli-rw51bq3j.js";
-import"./cli-ftht3zzj.js";
+} from "./cli-hp2est46.js";
+import"./cli-0amc6myn.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -12,7 +12,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{rbac-roles-z1jrffbt.js → rbac-roles-gws5xej6.js}

@@ -5,7 +5,7 @@ import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-ftht3zzj.js";
+} from "./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -13,7 +13,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{rbac-roles-r3hqjp09.js → rbac-roles-t3wygpth.js}

@@ -7,9 +7,9 @@ import {
   getUserGrant,
   listUserRoles,
   runRbacCliCommand
-} from "./cli-8v0g1yc8.js";
+} from "./cli-hzhhrt7b.js";
 import"./cli-cmp8g3sw.js";
-import"./cli-ftht3zzj.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -17,7 +17,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{render-v2-vbr89fnb.js → render-v2-x1wxvn51.js}

@@ -9,11 +9,11 @@ import {
   processSlackRenderV2,
   renderThreadTree,
   streamOutcomeCard
-} from "./cli-b5bq9crk.js";
+} from "./cli-dk3me3qs.js";
 import"./cli-q51yprfq.js";
 import"./cli-9d8ntetj.js";
 import"./cli-yatxqynm.js";
-import"./cli-ftht3zzj.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -21,7 +21,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-pzxba7gw.js";
 import"./cli-zf8jjwex.js";

package/dist/{seed-pricing-g62hy1pk.js → seed-pricing-t6y8d0vf.js}

@@ -2,8 +2,8 @@ import {
   buildModelsDevSeedRows,
   buildPricingSeedRows,
   seedPricingFromModelsDev
-} from "./cli-rw51bq3j.js";
-import"./cli-ftht3zzj.js";
+} from "./cli-0amc6myn.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -11,7 +11,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{setup-gnfqnptp.js → setup-x50py6xg.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-n8508nre.js";
+} from "./cli-ztn0ga15.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-s2qjdd6z.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-kznxp4qm.js → worker-zsz0qfxk.js}

@@ -1,8 +1,8 @@
 import {
   runAgent
-} from "./cli-tzvk9haz.js";
+} from "./cli-9216xm24.js";
 import"./cli-0b6y7kxm.js";
-import"./cli-4nr988h6.js";
+import"./cli-v3e51x7w.js";
 import"./cli-cn6mmc7f.js";
 import"./cli-hsxj0yar.js";
 import"./cli-9b13ggd1.js";
@@ -12,11 +12,11 @@ import"./cli-r94z9p1z.js";
 import"./cli-2djtr51b.js";
 import {
   getEnabledCapabilities
-} from "./cli-atcve9y8.js";
+} from "./cli-p73drk6p.js";
 import"./cli-8fc8de14.js";
 import"./cli-j490egb5.js";
-import"./cli-719k9j2c.js";
-import"./cli-89xfd7f9.js";
+import"./cli-m1p5cysp.js";
+import"./cli-brxyat7h.js";
 import"./cli-d8brzxjb.js";
 import"./cli-b5b30yzk.js";
 import"./cli-rvqz34y5.js";
@@ -27,40 +27,40 @@ import"./cli-s25avqg9.js";
 import"./cli-eree7rnv.js";
 import"./cli-xvkmedgn.js";
 import"./cli-4yc5d8fk.js";
-import"./cli-smby5m17.js";
-import"./cli-m8yrsg97.js";
-import"./cli-rw51bq3j.js";
-import"./cli-8v0g1yc8.js";
+import"./cli-56y3hch2.js";
+import"./cli-hp2est46.js";
+import"./cli-0amc6myn.js";
+import"./cli-hzhhrt7b.js";
 import"./cli-cmp8g3sw.js";
-import"./cli-de14znh8.js";
+import"./cli-tebsjpk7.js";
 import"./cli-qgm2pfpq.js";
-import"./cli-f7dsy61y.js";
+import"./cli-3n7cbfjn.js";
 import"./cli-07jd68a1.js";
-import"./cli-yz3djrm0.js";
+import"./cli-f8j56xv2.js";
 import"./cli-1ebpar1q.js";
 import"./cli-e7d20cty.js";
 import"./cli-3dpj7atn.js";
-import"./cli-3tgwnf43.js";
+import"./cli-0er5m69z.js";
 import"./cli-epan13p1.js";
-import"./cli-hbv0kq6w.js";
-import"./cli-1th1728g.js";
+import"./cli-kzvhgvk3.js";
+import"./cli-5khqvvnq.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-m9sxbkhm.js";
-import"./cli-zhjmqxzh.js";
+import"./cli-dcem3pr1.js";
 import"./cli-fad8m16k.js";
 import"./cli-aehm1rbq.js";
 import"./cli-bsakbbkm.js";
 import"./cli-51tf7ac3.js";
-import"./cli-mmemxxdc.js";
+import"./cli-hz8xhefy.js";
 import"./cli-jsp14b6c.js";
-import"./cli-p1d5b073.js";
-import"./cli-53s590z8.js";
-import"./cli-b5bq9crk.js";
+import"./cli-xqcpg1st.js";
+import"./cli-7gn7c2af.js";
+import"./cli-dk3me3qs.js";
 import"./cli-q51yprfq.js";
 import"./cli-9d8ntetj.js";
 import"./cli-yatxqynm.js";
-import"./cli-ftht3zzj.js";
+import"./cli-6s2y152y.js";
 import"./cli-y6b6fb76.js";
 import"./cli-kpv03zhj.js";
 import"./cli-e29gmdmw.js";
@@ -68,7 +68,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-w9kb3bk1.js";
+import"./cli-anedxf1w.js";
 import"./cli-xqcq9y5e.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.147.0",
+    "version": "1.148.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.147.0",
+  "version": "1.148.0",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -111,6 +111,8 @@
     "prepare-release": "bun scripts/prepare-release.ts",
     "refresh:vendored-openapi": "bun scripts/refresh-vendored-openapi.ts",
     "sync-chart-version": "bun scripts/sync-chart-version.ts",
+    "sync-plugin-versions": "bun scripts/sync-plugin-versions.ts",
+    "check:plugin-versions": "bun scripts/sync-plugin-versions.ts --check",
     "bump:agent-fs": "bun scripts/bump-agent-fs.ts",
     "check-chart-version": "bun scripts/sync-chart-version.ts --check-if-package-version-changed",
     "cli": "bun src/cli.tsx",

package/src/tests/mcp-input-ergonomics.test.ts

@@ -0,0 +1,386 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ZodType } from "zod";
+import {
+  closeDb,
+  createAgent,
+  createSteeringMessage,
+  createTaskExtended,
+  createUser,
+  getAgentById,
+  getDbClient,
+  getSteeringMessageById,
+  getTaskById,
+  initDb,
+  markSteeringDelivered,
+  startTask,
+} from "../be/db";
+import { getMemoryStore } from "../be/memory";
+import { registerAcceptSteerTool } from "../tools/accept-steer";
+import { getTaskDetailsInputSchema } from "../tools/get-task-details";
+import { registerMemoryGetTool } from "../tools/memory-get";
+import { registerMemoryRateTool } from "../tools/memory-rate";
+import { registerMemorySearchTool } from "../tools/memory-search";
+import { registerMemoryStoreTool } from "../tools/memory-store";
+import { registerSendTaskTool, sendTaskInputSchema } from "../tools/send-task";
+import { registerStoreProgressTool } from "../tools/store-progress";
+import type { SwarmToolResult } from "../tools/utils";
+
+const agentId = "aaaa0000-0000-4000-8000-000000000901";
+const otherId = "bbbb0000-0000-4000-8000-000000000902";
+const server = new McpServer({ name: "input-regressions", version: "1.0.0" });
+for (const register of [
+  registerAcceptSteerTool,
+  registerMemoryGetTool,
+  registerMemoryRateTool,
+  registerMemorySearchTool,
+  registerMemoryStoreTool,
+  registerSendTaskTool,
+  registerStoreProgressTool,
+]) {
+  register(server);
+}
+const registered = (
+  server as unknown as {
+    _registeredTools: Record<
+      string,
+      {
+        inputSchema: ZodType;
+        handler: (args: unknown, meta: unknown) => Promise<SwarmToolResult>;
+      }
+    >;
+  }
+)._registeredTools;
+
+async function call(name: string, args: unknown, sourceTaskId?: string, callerId = agentId) {
+  const tool = registered[name]!;
+  // Exercise the real registered schema before invoking the handler, as MCP does.
+  return tool.handler(tool.inputSchema.parse(args), {
+    sessionId: "input-regressions-session",
+    requestInfo: {
+      headers: {
+        "x-agent-id": callerId,
+        ...(sourceTaskId ? { "x-source-task-id": sourceTaskId } : {}),
+      },
+    },
+  });
+}
+async function task(owner = agentId) {
+  const row = await createTaskExtended("input schema regression", {
+    agentId: owner,
+    source: "system",
+    followUpConfig: { disabled: true },
+  });
+  await startTask(row.id);
+  return row;
+}
+const originalEmbeddingKey = process.env.EMBEDDING_API_KEY;
+const originalOpenAiKey = process.env.OPENAI_API_KEY;
+beforeAll(async () => {
+  process.env.EMBEDDING_API_KEY = "";
+  process.env.OPENAI_API_KEY = "";
+  initDb(":memory:");
+  await createAgent({ id: agentId, name: "Schema worker", isLead: false, status: "idle" });
+  await createAgent({ id: otherId, name: "Other schema worker", isLead: false, status: "idle" });
+});
+afterAll(() => {
+  closeDb();
+  if (originalEmbeddingKey === undefined) delete process.env.EMBEDDING_API_KEY;
+  else process.env.EMBEDDING_API_KEY = originalEmbeddingKey;
+  if (originalOpenAiKey === undefined) delete process.env.OPENAI_API_KEY;
+  else process.env.OPENAI_API_KEY = originalOpenAiKey;
+});
+
+describe("store-progress input recovery", () => {
+  for (const status of ["pending", "in_progress"]) {
+    test(`${status} stores progress without finishing or requeueing`, async () => {
+      const row = await task();
+      const result = await call("store-progress", {
+        taskId: row.id,
+        status,
+        progress: status,
+        output: "must not complete",
+        failureReason: "must not fail",
+      });
+      expect(result.structuredContent?.success).toBe(true);
+      const updated = await getTaskById(row.id);
+      expect(updated?.progress).toBe(status);
+      expect(updated?.status).toBe("in_progress");
+      expect(updated?.finishedAt).toBeUndefined();
+      expect(updated?.output).toBeUndefined();
+      expect((await getAgentById(agentId))?.status).toBe("busy");
+      expect(result.structuredContent?.message).not.toContain("marked as");
+    });
+  }
+  test("omitted taskId uses only the caller-owned source task", async () => {
+    const row = await task();
+    expect(
+      (await call("store-progress", { progress: "context works" }, row.id)).structuredContent
+        ?.success,
+    ).toBe(true);
+    expect((await getTaskById(row.id))?.progress).toBe("context works");
+  });
+  test("omitted taskId with no context returns actionable failure", async () => {
+    const result = await call("store-progress", { progress: "lost" });
+    expect(result.structuredContent?.success).toBe(false);
+    expect(result.structuredContent?.message).toContain("full task UUID");
+  });
+  test("omitted taskId cannot borrow another agent's source task", async () => {
+    const row = await task(otherId);
+    expect(
+      (await call("store-progress", { status: "completed" }, row.id)).structuredContent?.success,
+    ).toBe(false);
+    expect((await getTaskById(row.id))?.status).toBe("in_progress");
+  });
+  test("explicit target wins over source task", async () => {
+    const source = await task();
+    const target = await task();
+    await call("store-progress", { taskId: target.id, progress: "explicit" }, source.id);
+    expect((await getTaskById(source.id))?.progress).toBeUndefined();
+    expect((await getTaskById(target.id))?.progress).toBe("explicit");
+  });
+  test("terminal calls still finish, and progress aliases cannot revive them", async () => {
+    for (const status of ["completed", "failed"]) {
+      const row = await task();
+      const result = await call("store-progress", {
+        taskId: row.id,
+        status,
+        output: "done",
+        failureReason: "failed",
+      });
+      expect(result.structuredContent?.success).toBe(true);
+      const finished = await getTaskById(row.id);
+      expect(finished?.status).toBe(status);
+      await call("store-progress", { taskId: row.id, status: "pending", progress: "revive" });
+      expect((await getTaskById(row.id))?.status).toBe(status);
+      expect((await getTaskById(row.id))?.finishedAt).toBe(finished?.finishedAt);
+    }
+  });
+  test("malformed explicit IDs and unsupported statuses stay invalid", () => {
+    const schema = registered["store-progress"]!.inputSchema;
+    expect(schema.safeParse({ taskId: "deadbeef" }).success).toBe(false);
+    expect(schema.safeParse({ status: "cancelled" }).success).toBe(false);
+  });
+});
+
+describe("memory input recovery", () => {
+  test("search without intent returns a memory and records honest null intent", async () => {
+    const row = await task();
+    const memory = await getMemoryStore().store({
+      agentId,
+      scope: "agent",
+      name: "needlequartz",
+      content: "needlequartz",
+      source: "manual",
+    });
+    const result = await call("memory-search", { query: "needlequartz" }, row.id);
+    expect(result.structuredContent?.success).toBe(true);
+    const retrieval = await getDbClient().get<{ intent: string | null }>(
+      "SELECT intent FROM memory_retrieval WHERE memoryId = ? AND taskId = ?",
+      [memory.id, row.id],
+    );
+    expect(retrieval).toBeDefined();
+    expect(retrieval?.intent).toBeNull();
+  });
+  for (const field of ["id", "memoryId"]) {
+    test(`get accepts ${field} without intent and preserves access control`, async () => {
+      const row = await task();
+      const memory = await getMemoryStore().store({
+        agentId,
+        scope: "agent",
+        name: "private",
+        content: "private fact",
+        source: "manual",
+      });
+      expect(
+        (await call("memory-get", { [field]: memory.id }, row.id)).structuredContent?.success,
+      ).toBe(true);
+      expect(
+        (await call("memory-get", { [field]: memory.id }, undefined, otherId)).structuredContent
+          ?.success,
+      ).toBe(false);
+      expect(
+        (
+          await getDbClient().get<{ intent: string | null }>(
+            "SELECT intent FROM memory_retrieval WHERE memoryId = ? AND taskId = ?",
+            [memory.id, row.id],
+          )
+        )?.intent,
+      ).toBeNull();
+    });
+  }
+  for (const name of ["memory-get", "memory_rate"]) {
+    test(`${name} rejects missing and conflicting identifiers`, async () => {
+      expect((await call(name, { useful: true })).structuredContent?.success).toBe(false);
+      expect(
+        (await call(name, { id: agentId, memoryId: otherId, useful: true })).structuredContent
+          ?.success,
+      ).toBe(false);
+    });
+  }
+  test("rating aliases and long notes reach the endpoint within its 500-character limit", async () => {
+    const originalFetch = globalThis.fetch;
+    const events: Array<{ memoryId: string; reasoning: string }> = [];
+    globalThis.fetch = (async (_input, init) => {
+      events.push(JSON.parse(String(init?.body)).events[0]);
+      return new Response("{}", { status: 200 });
+    }) as typeof fetch;
+    try {
+      for (const field of ["id", "memoryId"]) {
+        expect(
+          (
+            await call(
+              "memory_rate",
+              { [field]: agentId, useful: true, note: "n".repeat(700) },
+              otherId,
+            )
+          ).structuredContent?.success,
+        ).toBe(true);
+      }
+      const aliasResult = await call("memory_rate", { memoryId: agentId, useful: true }, otherId);
+      expect(aliasResult.structuredContent?.message).toBe(`Memory ${agentId} rated as useful.`);
+      expect(
+        events.slice(0, 2).map(({ memoryId, reasoning }) => ({ memoryId, reasoning })),
+      ).toEqual([
+        { memoryId: agentId, reasoning: "n".repeat(500) },
+        { memoryId: agentId, reasoning: "n".repeat(500) },
+      ]);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+  test("store derives missing title and normalizes comma-separated tags", async () => {
+    const result = await call("memory-store", {
+      content: "\n  Useful title  \nBody",
+      tags: "bun, typescript, ,schema",
+    });
+    expect(result.structuredContent?.success).toBe(true);
+    const ids = result.structuredContent?.memoryIds as string[];
+    const memory = await getMemoryStore().peek(ids[0]!);
+    expect(memory?.name).toBe("Useful title");
+    expect(memory?.tags).toEqual(["bun", "typescript", "schema"]);
+  });
+  test("store keeps explicit title and array tags, bounds derived titles", async () => {
+    for (const name of [undefined, "Explicit title"]) {
+      const result = await call("memory-store", {
+        content: "a".repeat(300),
+        name,
+        tags: ["one,two"],
+      });
+      const memory = await getMemoryStore().peek(
+        (result.structuredContent?.memoryIds as string[])[0]!,
+      );
+      expect(memory?.name).toBe(name ?? "a".repeat(200));
+      expect(memory?.tags).toEqual(["one,two"]);
+    }
+  });
+  test("invalid field types and empty content/query remain invalid", () => {
+    expect(registered["memory-store"]!.inputSchema.safeParse({ content: "" }).success).toBe(false);
+    expect(
+      registered["memory-store"]!.inputSchema.safeParse({ content: "body", tags: [2] }).success,
+    ).toBe(false);
+    expect(registered["memory-search"]!.inputSchema.safeParse({ query: "" }).success).toBe(false);
+    expect(registered["memory-get"]!.inputSchema.safeParse({ id: "deadbeef" }).success).toBe(false);
+  });
+});
+
+test("accept-steer stores long notes and still requires task ownership", async () => {
+  const row = await task();
+  const steering = await createSteeringMessage({
+    taskId: row.id,
+    body: "adjust scope",
+    mode: "queue",
+    source: "api",
+    createdByKind: "system",
+  });
+  await markSteeringDelivered(steering.id, "queue");
+  const note = "Accepted scope. ".repeat(100);
+  expect(
+    (await call("accept-steer", { steeringMessageId: steering.id, note }, undefined, otherId))
+      .structuredContent?.success,
+  ).toBe(false);
+  expect(
+    (await call("accept-steer", { steeringMessageId: steering.id, note })).structuredContent
+      ?.success,
+  ).toBe(true);
+  expect((await getSteeringMessageById(steering.id))?.handledNote).toBe(note);
+});
+
+test("send-task accepts actual registry user IDs without UUID hyphens", async () => {
+  const user = await createUser({
+    name: "Schema requester",
+    email: "schema-requester@example.test",
+  });
+  expect(user.id).toMatch(/^[a-f0-9]{32}$/);
+  const result = await call("send-task", {
+    task: "requester preservation",
+    requestedByUserId: user.id,
+    allowDuplicate: true,
+  });
+  expect(result.structuredContent?.success).toBe(true);
+  const created = result.structuredContent?.task as { id: string };
+  expect((await getTaskById(created.id))?.requestedByUserId).toBe(user.id);
+});
+
+test("send-task rejects unknown requester IDs without creating a task", async () => {
+  const before = await getDbClient().get<{ count: number }>(
+    "SELECT COUNT(*) AS count FROM agent_tasks",
+  );
+  const result = await call("send-task", {
+    task: "unknown requester",
+    requestedByUserId: "f".repeat(32),
+    allowDuplicate: true,
+  });
+  expect(result.structuredContent?.success).toBe(false);
+  expect(result.structuredContent?.message).toContain("existing registered user");
+  expect(
+    await getDbClient().get<{ count: number }>("SELECT COUNT(*) AS count FROM agent_tasks"),
+  ).toEqual(before);
+});
+
+test("send-task preserves inherited attribution when explicit requester is omitted", async () => {
+  const { id: requesterId } = await createUser({
+    name: "Inherited requester",
+    email: "inherited-requester@example.test",
+  });
+  const parent = await createTaskExtended("historical requester", {
+    agentId,
+    requestedByUserId: requesterId,
+  });
+  await startTask(parent.id);
+  const result = await call(
+    "send-task",
+    { task: "inherit requester", allowDuplicate: true, offerMode: true },
+    parent.id,
+  );
+  expect(result.structuredContent?.success).toBe(true);
+  const created = result.structuredContent?.task as { id: string };
+  expect((await getTaskById(created.id))?.requestedByUserId).toBe(requesterId);
+});
+
+test("send-task requester format rejects arbitrary strings and hyphenated UUIDs", () => {
+  for (const requestedByUserId of [
+    "requester",
+    agentId,
+    "A".repeat(32),
+    "x".repeat(32),
+    "",
+    "f".repeat(31),
+  ]) {
+    expect(
+      sendTaskInputSchema.safeParse({ task: "invalid requester", requestedByUserId }).success,
+    ).toBe(false);
+  }
+});
+
+test("task UUIDs, parent references, and asset namespaces remain strict", () => {
+  expect(
+    getTaskDetailsInputSchema.safeParse({ taskId: "00dd3d42-0000-0000-0000-000000000000" }).success,
+  ).toBe(false);
+  expect(
+    sendTaskInputSchema.safeParse({ task: "invalid parent", parentTaskId: "deadbeef" }).success,
+  ).toBe(false);
+  expect(
+    sendTaskInputSchema.safeParse({ task: "invalid namespace", key: "probe:never" }).success,
+  ).toBe(false);
+});