@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/http/mcp-bridge.ts

@@ -8,8 +8,13 @@ import {
 } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import { z } from "zod";
 import { createServer } from "@/server";
+import { resolveBridgeCallOrigin } from "../extensions/dispatcher";
 import { isMcpToolAllowedForScripts } from "../scripts-runtime/sdk-allowlist";
-import { markScriptSdkRequestOrigin } from "../tools/utils";
+import {
+  markExtensionRequestOrigin,
+  markScriptSdkRequestOrigin,
+  type RequestInfo,
+} from "../tools/utils";
 import { route, runtimeInstanceHeader } from "./route-def";
 import { json, jsonError } from "./utils";
 
@@ -35,6 +40,78 @@ type RegisteredTool = {
 
 type ToolRegistry = Record<string, RegisteredTool>;
 
+export class InProcessToolInvocationError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+  ) {
+    super(message);
+    this.name = "InProcessToolInvocationError";
+  }
+}
+
+export async function invokeToolInProcess(args: {
+  toolName: string;
+  args?: unknown;
+  agentId?: string;
+  sourceTaskId?: string;
+  runtimeInstanceId?: string;
+  callOrigin: Extract<RequestInfo["callOrigin"], "script-sdk" | "extension">;
+}): Promise<unknown> {
+  if (!isMcpToolAllowedForScripts(args.toolName)) {
+    throw new InProcessToolInvocationError(
+      `Tool '${args.toolName}' is not in the SDK allowlist`,
+      403,
+    );
+  }
+
+  const server = await getBridgeServer();
+  const tools = (server as unknown as { _registeredTools: ToolRegistry })._registeredTools;
+  const tool = tools[args.toolName];
+  if (!tool) {
+    throw new InProcessToolInvocationError(
+      `Tool '${args.toolName}' not found in the MCP registry`,
+      404,
+    );
+  }
+  if (tool.enabled === false) {
+    throw new InProcessToolInvocationError(`Tool '${args.toolName}' is disabled`, 400);
+  }
+
+  const baseExtra = {
+    sessionId: args.callOrigin === "extension" ? "extension" : "mcp-bridge",
+    requestInfo: {
+      headers: {
+        "x-agent-id": args.agentId ?? "",
+        ...(args.sourceTaskId ? { "x-source-task-id": args.sourceTaskId } : {}),
+        ...(args.runtimeInstanceId ? { "x-runtime-instance-id": args.runtimeInstanceId } : {}),
+      },
+    },
+  };
+  const extra =
+    args.callOrigin === "extension"
+      ? markExtensionRequestOrigin(baseExtra)
+      : markScriptSdkRequestOrigin(baseExtra);
+
+  let handlerArgs: unknown = args.args ?? {};
+  if (tool.inputSchema) {
+    const inputObj = normalizeObjectSchema(tool.inputSchema);
+    const parseResult = await safeParseAsync(inputObj ?? tool.inputSchema, handlerArgs);
+    if (!parseResult.success) {
+      const parseError = "error" in parseResult ? parseResult.error : "Unknown error";
+      throw new InProcessToolInvocationError(
+        `Invalid arguments for tool '${args.toolName}': ${getParseErrorMessage(parseError)}`,
+        400,
+      );
+    }
+    handlerArgs = parseResult.data;
+  }
+
+  return tool.inputSchema
+    ? await Promise.resolve(tool.handler(handlerArgs, extra))
+    : await Promise.resolve(tool.handler(extra));
+}
+
 const mcpBridgeRoute = route({
   method: "post",
   path: "/api/mcp-bridge",
@@ -58,6 +135,11 @@ const mcpBridgeRoute = route({
   },
 });
 
+function headerValue(req: IncomingMessage, name: string): string | undefined {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+
 export async function handleMcpBridge(
   req: IncomingMessage,
   res: ServerResponse,
@@ -72,70 +154,22 @@ export async function handleMcpBridge(
 
   const { tool: toolName, args } = parsed.body;
 
-  if (!isMcpToolAllowedForScripts(toolName)) {
-    jsonError(res, `Tool '${toolName}' is not in the SDK allowlist`, 403);
-    return true;
-  }
-
-  const server = await getBridgeServer();
-  const tools = (server as unknown as { _registeredTools: ToolRegistry })._registeredTools;
-
-  const tool = tools[toolName];
-  if (!tool) {
-    jsonError(res, `Tool '${toolName}' not found in the MCP registry`, 404);
-    return true;
-  }
-
-  if (tool.enabled === false) {
-    jsonError(res, `Tool '${toolName}' is disabled`, 400);
-    return true;
-  }
-
-  const sourceTaskId = Array.isArray(req.headers["x-source-task-id"])
-    ? req.headers["x-source-task-id"][0]
-    : (req.headers["x-source-task-id"] as string | undefined);
+  const sourceTaskId = headerValue(req, "x-source-task-id");
   // Runtime identity rides the bridge like the agent identity so the
   // work-acquisition gates in bridged tools see the invoking worker process.
-  const runtimeInstanceId = Array.isArray(req.headers["x-runtime-instance-id"])
-    ? req.headers["x-runtime-instance-id"][0]
-    : (req.headers["x-runtime-instance-id"] as string | undefined);
-
-  const extra = markScriptSdkRequestOrigin({
-    sessionId: "mcp-bridge",
-    requestInfo: {
-      headers: {
-        "x-agent-id": myAgentId ?? "",
-        ...(sourceTaskId ? { "x-source-task-id": sourceTaskId } : {}),
-        ...(runtimeInstanceId ? { "x-runtime-instance-id": runtimeInstanceId } : {}),
-      },
-    },
-  });
-
-  // Mirror the SDK's own tools/call validation (`validateToolInput` in
-  // @modelcontextprotocol/sdk server/mcp.js). The bridge bypasses the MCP
-  // transport, so without this parse raw script args reach handlers
-  // unchecked (2026-08-18 priority='high' incident) and the schema's
-  // `.default()`/`.transform()` never apply.
-  let handlerArgs: unknown = args;
-  if (tool.inputSchema) {
-    const inputObj = normalizeObjectSchema(tool.inputSchema);
-    const parseResult = await safeParseAsync(inputObj ?? tool.inputSchema, args);
-    if (!parseResult.success) {
-      const parseError = "error" in parseResult ? parseResult.error : "Unknown error";
-      jsonError(
-        res,
-        `Invalid arguments for tool '${toolName}': ${getParseErrorMessage(parseError)}`,
-        400,
-      );
-      return true;
-    }
-    handlerArgs = parseResult.data;
-  }
+  const runtimeInstanceId = headerValue(req, "x-runtime-instance-id");
 
   try {
-    const result = tool.inputSchema
-      ? await Promise.resolve(tool.handler(handlerArgs, extra))
-      : await Promise.resolve(tool.handler(extra));
+    const result = await invokeToolInProcess({
+      toolName,
+      args,
+      agentId: myAgentId,
+      sourceTaskId,
+      runtimeInstanceId,
+      // The agent header is caller-controlled; the extension origin also needs the
+      // per-process token that only the in-process extension SDK holds.
+      callOrigin: resolveBridgeCallOrigin(myAgentId, headerValue(req, "x-extension-token")),
+    });
 
     if (result && typeof result === "object" && "structuredContent" in result) {
       json(res, result.structuredContent);
@@ -155,7 +189,7 @@ export async function handleMcpBridge(
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    jsonError(res, message, 500);
+    jsonError(res, message, err instanceof InProcessToolInvocationError ? err.status : 500);
   }
   return true;
 }

package/src/http/mcp.ts

@@ -203,7 +203,7 @@ export async function handleMcp(
       const preloadEnabled = parseEnvFlag(
         configs.find((config) => config.key === "TASK_TOOL_PRELOAD_ENABLED")?.value ??
           process.env.TASK_TOOL_PRELOAD_ENABLED,
-        false,
+        true,
       );
       let preloadedTools: string[] = [];
       if (preloadEnabled) {

package/src/http/script-runs.ts

@@ -625,6 +625,11 @@ export async function handleScriptRuns(
           routingReason:
             parsed.body.routingReason ?? (parsed.body.agentId ? "human_pinned" : undefined),
           routingNote: parsed.body.routingNote,
+          routingSource: parsed.body.routingReason
+            ? "declared"
+            : parsed.body.agentId
+              ? "engine_default"
+              : undefined,
           tags: parsed.body.tags,
           priority: parsed.body.priority,
           offeredTo: parsed.body.offerMode ? parsed.body.agentId : undefined,

package/src/http/status.ts

@@ -32,6 +32,7 @@ import {
   hasFirstCompletedTask,
   listAgentsWithCredStatusByProvider,
 } from "../be/db";
+import { getEmbeddingProvider } from "../be/memory";
 import { getFileStorageProvider } from "../fs/registry";
 import { type AgentCredStatus, AutomationIntegrationIdSchema, ProviderNameSchema } from "../types";
 import { route } from "./route-def";
@@ -385,10 +386,11 @@ async function harnessMilestone(): Promise<SetupMilestone> {
 }
 
 function embeddingsMilestone(): SetupMilestone {
-  // Keep this precedence identical to OpenAIEmbeddingProvider: an explicitly
-  // empty EMBEDDING_API_KEY disables the OPENAI_API_KEY fallback.
-  const embeddingKey = process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY;
-  if (embeddingKey) {
+  // Ask the live provider rather than re-deriving key precedence here — it
+  // reflects whatever the last config reload (or boot) resolved, including
+  // an explicitly empty EMBEDDING_API_KEY disabling the OPENAI_API_KEY
+  // fallback. See OpenAIEmbeddingProvider.isConfigured().
+  if (getEmbeddingProvider().isConfigured()) {
     return {
       id: "embeddings",
       label: "Memory search",

package/src/http/tasks.ts

@@ -41,6 +41,7 @@ import {
 } from "../be/steering";
 import { findUserById } from "../be/users";
 import { can, type RbacPrincipal, type RbacResource } from "../rbac";
+import { TaskCreationBlockedError } from "../tasks/errors";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { guardTerminalTaskResultWrite } from "../tasks/terminal-result-guard";
 import { createResumeFollowUp, createWorkerTaskFollowUp } from "../tasks/worker-follow-up";
@@ -259,6 +260,13 @@ const createTask = route({
   responses: {
     201: { description: "Task created", schema: AgentTaskSchema },
     400: { description: "Validation error" },
+    422: {
+      description: "Task creation blocked by an extension",
+      schema: z.object({
+        error: z.string(),
+        extension: z.object({ id: z.string(), name: z.string() }),
+      }),
+    },
   },
 });
 
@@ -836,36 +844,45 @@ export async function handleTasks(
     }
 
     try {
-      const task = await createTaskWithSiblingAwareness(parsed.body.task, {
-        key: assetKey,
-        agentId: defaultAgentId,
-        routingReason:
-          parsed.body.routingReason ??
-          (defaultAgentId
-            ? parentTask?.agentId === defaultAgentId
-              ? "continuity"
-              : "skill"
-            : undefined),
-        routingNote: parsed.body.routingNote,
-        creatorAgentId: myAgentId || undefined,
-        taskType: parsed.body.taskType || undefined,
-        tags: parsed.body.tags || undefined,
-        priority: parsed.body.priority,
-        dependsOn: parsed.body.dependsOn || undefined,
-        offeredTo: parsed.body.offeredTo || undefined,
-        dir: parsed.body.dir || undefined,
-        parentTaskId: parsed.body.parentTaskId || undefined,
-        source: parsed.body.source || "api",
-        outputSchema: parsed.body.outputSchema || undefined,
-        contextKey: parsed.body.contextKey || undefined,
-        requestedByUserId,
-        status: parsed.body.draft ? "draft" : undefined,
-        ...splitLegacyModelAlias({
-          model: parsed.body.model,
-          modelTier: parsed.body.modelTier,
-        }),
-        effort: parsed.body.effort,
-      });
+      const task = await createTaskWithSiblingAwareness(
+        parsed.body.task,
+        {
+          key: assetKey,
+          agentId: defaultAgentId,
+          routingReason:
+            parsed.body.routingReason ??
+            (defaultAgentId
+              ? parentTask?.agentId === defaultAgentId
+                ? "continuity"
+                : "skill"
+              : undefined),
+          routingSource: parsed.body.routingReason
+            ? "declared"
+            : defaultAgentId
+              ? "engine_default"
+              : undefined,
+          routingNote: parsed.body.routingNote,
+          creatorAgentId: myAgentId || undefined,
+          taskType: parsed.body.taskType || undefined,
+          tags: parsed.body.tags || undefined,
+          priority: parsed.body.priority,
+          dependsOn: parsed.body.dependsOn || undefined,
+          offeredTo: parsed.body.offeredTo || undefined,
+          dir: parsed.body.dir || undefined,
+          parentTaskId: parsed.body.parentTaskId || undefined,
+          source: parsed.body.source || "api",
+          outputSchema: parsed.body.outputSchema || undefined,
+          contextKey: parsed.body.contextKey || undefined,
+          requestedByUserId,
+          status: parsed.body.draft ? "draft" : undefined,
+          ...splitLegacyModelAlias({
+            model: parsed.body.model,
+            modelTier: parsed.body.modelTier,
+          }),
+          effort: parsed.body.effort,
+        },
+        { origin: "rest" },
+      );
 
       ensure({
         id: "created",
@@ -885,6 +902,10 @@ export async function handleTasks(
 
       createTask.respond(res, 201, task);
     } catch (error) {
+      if (error instanceof TaskCreationBlockedError) {
+        createTask.respond(res, 422, { error: error.reason, extension: error.extension });
+        return true;
+      }
       console.error("[HTTP] Failed to create task:", error);
       jsonError(res, "Failed to create task", 500);
     }

package/src/integrations/kapso/inbound.ts

@@ -152,16 +152,21 @@ export async function routeKapsoInbound(payload: KapsoWebhookPayload): Promise<K
     return { kind: "workflow", workflowId: mapping.workflowId };
   }
 
-  const task = await createTaskWithSiblingAwareness(await buildTaskDescription(payload), {
-    agentId: mapping.agentId ?? null,
-    routingReason: mapping.agentId ? "human_pinned" : undefined,
-    source: "system",
-    taskType: "kapso-inbound",
-    tags: ["kapso-whatsapp", "inbound"],
-    priority: 70,
-    requestedByUserId: await resolveKapsoRequestedByUserId(payload),
-    contextKey: `kapso:conversation:${payload.conversation?.id ?? messageId}`,
-  });
+  const task = await createTaskWithSiblingAwareness(
+    await buildTaskDescription(payload),
+    {
+      agentId: mapping.agentId ?? null,
+      routingReason: mapping.agentId ? "human_pinned" : undefined,
+      routingSource: mapping.agentId ? "engine_default" : undefined,
+      source: "system",
+      taskType: "kapso-inbound",
+      tags: ["kapso-whatsapp", "inbound"],
+      priority: 70,
+      requestedByUserId: await resolveKapsoRequestedByUserId(payload),
+      contextKey: `kapso:conversation:${payload.conversation?.id ?? messageId}`,
+    },
+    { origin: "webhook" },
+  );
 
   return { kind: "task", taskId: task.id };
 }

package/src/jira/sync.ts

@@ -580,14 +580,19 @@ async function createInitialJiraTask(input: {
     return;
   }
 
-  const task = await createTaskWithSiblingAwareness(result.text, {
-    agentId: lead?.id ?? "",
-    routingReason: lead ? "skill" : undefined,
-    source: "jira",
-    taskType: "jira-issue",
-    requestedByUserId: input.requestedByUserId,
-    contextKey: buildJiraContextKey(input.issueKey),
-  });
+  const task = await createTaskWithSiblingAwareness(
+    result.text,
+    {
+      agentId: lead?.id ?? "",
+      routingReason: lead ? "skill" : undefined,
+      routingSource: lead ? "engine_default" : undefined,
+      source: "jira",
+      taskType: "jira-issue",
+      requestedByUserId: input.requestedByUserId,
+      contextKey: buildJiraContextKey(input.issueKey),
+    },
+    { origin: "webhook" },
+  );
 
   await updateTrackerSyncSwarmId(input.syncRowId, task.id);
 
@@ -626,14 +631,19 @@ async function createCommentMentionTask(input: {
     return;
   }
 
-  const task = await createTaskWithSiblingAwareness(result.text, {
-    agentId: lead?.id ?? "",
-    routingReason: lead ? "skill" : undefined,
-    source: "jira",
-    taskType: "jira-issue",
-    requestedByUserId: input.requestedByUserId,
-    contextKey: buildJiraContextKey(input.issueKey),
-  });
+  const task = await createTaskWithSiblingAwareness(
+    result.text,
+    {
+      agentId: lead?.id ?? "",
+      routingReason: lead ? "skill" : undefined,
+      routingSource: lead ? "engine_default" : undefined,
+      source: "jira",
+      taskType: "jira-issue",
+      requestedByUserId: input.requestedByUserId,
+      contextKey: buildJiraContextKey(input.issueKey),
+    },
+    { origin: "webhook" },
+  );
 
   await updateTrackerSyncSwarmId(input.syncRowId, task.id);
 

package/src/linear/sync.ts

@@ -612,14 +612,19 @@ export async function handleAgentSessionEvent(event: Record<string, unknown>): P
     return;
   }
 
-  const task = await createTaskWithSiblingAwareness(templateResult.text, {
-    agentId: lead?.id ?? "",
-    routingReason: lead ? "skill" : undefined,
-    source: "linear",
-    taskType: "linear-issue",
-    requestedByUserId,
-    contextKey,
-  });
+  const task = await createTaskWithSiblingAwareness(
+    templateResult.text,
+    {
+      agentId: lead?.id ?? "",
+      routingReason: lead ? "skill" : undefined,
+      routingSource: lead ? "engine_default" : undefined,
+      source: "linear",
+      taskType: "linear-issue",
+      requestedByUserId,
+      contextKey,
+    },
+    { origin: "webhook" },
+  );
 
   // Delete old tracker_sync before creating new one (UNIQUE constraint)
   if (existing) {
@@ -896,14 +901,19 @@ export async function handleAgentSessionPrompted(event: Record<string, unknown>)
     return;
   }
 
-  const task = await createTaskWithSiblingAwareness(followupResult.text, {
-    agentId: lead?.id ?? "",
-    routingReason: lead ? "skill" : undefined,
-    source: "linear",
-    taskType: "linear-issue",
-    requestedByUserId: promptedRequestedByUserId,
-    contextKey,
-  });
+  const task = await createTaskWithSiblingAwareness(
+    followupResult.text,
+    {
+      agentId: lead?.id ?? "",
+      routingReason: lead ? "skill" : undefined,
+      routingSource: lead ? "engine_default" : undefined,
+      source: "linear",
+      taskType: "linear-issue",
+      requestedByUserId: promptedRequestedByUserId,
+      contextKey,
+    },
+    { origin: "webhook" },
+  );
 
   // Repoint the existing tracker_sync to the new follow-up task (can't create a
   // duplicate due to UNIQUE(provider, entityType, externalId) constraint)

package/src/prompts/session-templates.ts

@@ -72,10 +72,12 @@ Choose the path by the shape of the work:
 - Everything else: tools, directly.
 
 Store progress with \`store-progress\` at each milestone. A milestone is a result the lead could act on.
-The task is done when \`store-progress\` carries status \`completed\` and an \`output\` that names the result and every artifact link. On failure, status \`failed\` and a \`failureReason\` that names what you tried.
-When the task carries an \`outputSchema\`, \`output\` is JSON that matches it.
+Complete with \`store-progress\`: status \`completed\`, and \`output\` naming the result and every artifact link. On failure: status \`failed\`, with \`failureReason\` naming what you tried.
+Free-text \`output\`: under 120 words by default, with the exceptions in How you write. Link documents instead of inlining them; omit process narration.
+For a task with \`outputSchema\`, return matching JSON in \`output\`.
 When you are blocked after real effort, store the blocker with \`store-progress\` and keep working on what you can.
-The task has four endings. When you are done: \`completed\`. When the answer needs time (a build, a deploy, a reply): \`defer-task\` with a summary of what you did, when to wake up, and what to check. It completes the task now; the wake-up task continues it. When a person must decide: \`request-human-input\`. When nothing else is possible: \`failed\` with the blocker.
+The task has four endings. When you are done: \`completed\`. When the answer needs time (a build, a deploy, a reply): \`defer-task\` with a summary, \`delayMs\` or \`runAt\`, and checks. It completes the task now; the wake-up task continues it. When a person must decide: \`request-human-input\`. When nothing else is possible: \`failed\` with the blocker.
+For task waits, add \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\`; the displayed time is a ceiling, not a fixed wake-up.
 `,
   variables: [],
   category: "system",
@@ -90,15 +92,15 @@ registerTemplate({
 Your output is delegation and review. Workers implement, research, analyze, and write. Data gathering, even a quick query, goes to a worker. You answer simple factual questions yourself.
 
 \`get-swarm\` is the roster. Route by capability and load.
-\`send-task\`: include \`routingReason\` with \`agentId\`. Read results via \`get-task-details\`.
+\`send-task\`: include \`routingReason\` and \`routingNote\` (at least 10 characters after trim, maximum 200) with \`agentId\`. Read results via \`get-task-details\`.
 A task states the goal, the repo URL when there is one, and the constraints. Workers know git, the skills, and \`store-progress\`.
 Delegate by the shape of the work: a workflow for multi-step or fan-out work, a schedule for recurring work, a script for bulk data, an inline \`script-run\` for a one-off bulk job you can run yourself. The \`workflow-iterate\`, \`scheduling\`, and \`swarm-scripts\` skills build them.
 Research or exploration: tell the worker to use the \`researching\` skill. A large feature: a task for the \`planning\` skill first, then a task for the \`implementing\` skill with \`parentTaskId\`. A small fix: direct implementation.
 A follow-up that continues earlier work carries \`parentTaskId\`. The worker receives the prior context.
 
-Worker completion/failure triggers a follow-up by default. For longer work, \`defer-task\` with a wake-up or complete this task. Review the worker's answer and complete the follow-up. Escalate only failures needing a person.
+Worker completion/failure triggers a follow-up by default; review the result and complete it. Escalate only failures needing a person. For longer task waits, complete this task or \`defer-task\` with \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\` alongside \`delayMs\` or \`runAt\`. The displayed time is a ceiling, not a fixed wake-up.
 
-Wait inline via \`wait-for-task\` only for an essential result expected within ~1 minute. Set \`send-task.followUpConfig.disabled=true\`; cap all waits at ~1 minute total. If still running, \`defer-task\` with a wake-up.
+For an essential result expected within ~1 minute, set \`send-task.followUpConfig.disabled=true\` and use \`wait-for-task\` for at most ~1 minute total, then \`defer-task\` with \`wakeOn\` if still running.
 
 A task from an unknown user: register them with \`manage-user\`, then continue.
 Your heartbeat runbook is the \`heartbeatMd\` profile field. Edit it with \`update-profile\`. You MUST use the \`heartbeat-runbook\` skill when you handle a heartbeat checklist task.
@@ -118,6 +120,7 @@ registerTemplate({
 The lead assigns your tasks and reviews your output. Your task is in your first message, with memories from past sessions.
 
 Your final message is the task output. It names the result, every link (a PR, a file, a page), and, on failure, what you tried and what blocked you.
+Free-text task output: under 120 words by default, with the exceptions in How you write. Link documents instead of inlining them; omit process narration.
 `,
   variables: [],
   category: "system",
@@ -230,14 +233,14 @@ registerTemplate({
   defaultBody: `
 ## How you write
 
-For human-facing replies and artifacts: lead with the result. Use plain words, active voice, one idea per sentence, and sentence case headings.
+For replies, task output (\`output\` or a remote final message), and artifacts: lead with the result. Use plain words, active voice, one idea per sentence, and sentence case headings.
 State blockers and reasons. Preserve meaningful uncertainty.
 Omit em dashes, filler, sign-offs, praise, repetition, step narration, and generic offers to elaborate.
 
-Simple replies: one to three sentences. Routine replies: under 120 words, using short paragraphs or up to three bullets.
-Use more detail for requested depth or essential evidence, caveats, or instructions.
-Include context only when it changes understanding or action. Link extensive supporting material when useful, but make the reply self-contained.
-Do not shorten investigation, required artifacts, or schema-defined output to meet reply limits.
+Simple replies: one to three sentences. Routine replies and free-text task output: under 120 words by default, in short paragraphs or up to three bullets.
+Exceed for requested depth, enumerated results, essential evidence, caveats, instructions, or longer output required by the task's \`outputSchema\`.
+Keep replies and task output self-contained; link documents instead of inlining them.
+Preserve investigation and required artifacts. Schema exemptions apply to \`outputSchema\`-constrained completions; free-text \`output\` follows the target.
 
 Follow the current request and Requester Profile for language, tone, depth, and format. Correctness wins over style.
 Use the \`comms\` skill when available for requested simplification or clarity rewrites. Ordinary replies need no skill invocation.
@@ -278,6 +281,7 @@ registerTemplate({
 ## Slack
 
 The engine posts the thread tree and the outcome card. You post at most one message per task, and only when you have something the card will not carry. Progress, receipts, and relayed worker output stay out of Slack.
+The outcome card publishes your \`output\` verbatim. Keep free-text \`output\` under 120 words by default, with the exceptions in How you write.
 A Slack task from an unknown user: register them with \`manage-user\` first.
 You MUST use the \`slack-interaction\` skill before you post to Slack.
 `,
@@ -400,8 +404,8 @@ This swarm runs in **scripts-only mode**. The ONLY swarm MCP tools available are
 The script authoring contract in the \`swarm-scripts\` skill (entry signature, \`ctx\` shape, secret handling) applies here unchanged. The full SDK is \`ctx.swarm.*\`: task lifecycle (\`task_get\`, \`task_send\`, \`task_storeProgress\`, \`task_action\`, \`task_list\`), Slack (\`slack_reply\`, \`slack_post\`, \`slack_read\`), memory, kv, swarm info (\`swarm_get\`, \`agent_info\`), and more. Responses are usually wrapped; prefer \`res?.data ?? res\`.
 
 **Built-in coordination scripts, USE THESE FIRST (\`script-run\` with \`name\` + \`args\`):**
-- \`delegate\` {agentName, task, routingReason, parentTaskId?} → subtask for an agent by name; returns {taskId}
-- \`wait-for-task\` {taskId} → waits up to ~25s for a terminal state; returns {done, status, output}; only for a child expected to finish within about a minute whose result the answer requires. Bound all calls to about a minute total; if still done=false, use \`defer-task\` with a wake-up to collect the result.
+- \`delegate\` {agentName, task, routingReason, routingNote, parentTaskId?} → subtask for an agent by name; returns {taskId}
+- \`wait-for-task\` {taskId} → waits up to ~25s for a terminal state; returns {done, status, output}; only for a child expected to finish within about a minute whose result the answer requires. Bound all calls to about a minute total; if still done=false, use \`defer-task\` with \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\` alongside \`delayMs\` or \`runAt\`. The displayed time is a ceiling; matching task outcomes wake you sooner.
 - \`get-child-outputs\` {parentTaskId} → all children with status+output
 - \`complete-task\` {taskId, output} → THE way to finish your assigned task
 - \`report-progress\` {taskId, note} → progress update
@@ -426,6 +430,7 @@ registerTemplate({
 ## Slack (scripts-only)
 
 This task originated from Slack (channel: \`{{slackChannelId}}\`). The engine maintains the thread tree and publishes the top-level outcome card. Post at most one distinct agent-authored message per task, concrete, sized to what the user asked for. Progress, start, completion, failure, acknowledgment messages, and relayed raw task output stay out of Slack. Named Slack tools are not exposed in scripts-only mode, so use \`script-run\` with inline source calling \`ctx.swarm.slack_reply({ taskId, message })\` (your taskId carries the thread context).
+The outcome card publishes your \`output\` verbatim. Keep free-text \`output\` under 120 words by default, with the exceptions in How you write.
 `,
   variables: [
     { name: "slackChannelId", description: "The Slack channel ID for the originating thread" },

package/src/providers/claude-adapter.ts

@@ -96,6 +96,8 @@ export function parseClaudeBinary(raw: string | undefined): string[] {
 }
 
 const MIN_CLAUDE_QUEUE_STEERING_VERSION = [2, 1, 205] as const;
+const CLAUDE_VERSION_PROBE_TIMEOUT_MS = 1_000;
+const CLAUDE_VERSION_PROBE_MAX_BUFFER_BYTES = 64 * 1024;
 
 /**
  * Operator kill-switch for the stream-json invocation path.
@@ -1157,14 +1159,25 @@ export class ClaudeAdapter implements ProviderAdapter {
     const queueSteeringOverride = resolveClaudeQueueSteeringOverride(sourceEnv);
     let harnessVersion: string | undefined;
     try {
-      const result = Bun.spawnSync([...effectiveClaudeBinaryArgv, "--version"], {
-        env: sourceEnv,
-        stdout: "pipe",
-        stderr: "pipe",
-      });
-      if (result.success) {
-        const trimmed =
-          `${result.stdout?.toString() ?? ""}\n${result.stderr?.toString() ?? ""}`.trim();
+      const probe = registerProcessGroup(
+        Bun.spawn([...effectiveClaudeBinaryArgv, "--version"], {
+          detached: detachedProcessGroup,
+          env: sourceEnv,
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+          timeout: CLAUDE_VERSION_PROBE_TIMEOUT_MS,
+          killSignal: "SIGKILL",
+          maxBuffer: CLAUDE_VERSION_PROBE_MAX_BUFFER_BYTES,
+        }),
+      );
+      const exitCode = await probe.exited.finally(() => terminateProcessGroup(probe.pid));
+      const [stdout, stderr] = await Promise.all([
+        new Response(probe.stdout).text(),
+        new Response(probe.stderr).text(),
+      ]);
+      if (exitCode === 0) {
+        const trimmed = `${stdout}\n${stderr}`.trim();
         if (trimmed) {
           harnessVersion = trimmed;
           harnessVariantMeta = { version: trimmed };

package/src/rbac/admission.ts

@@ -15,7 +15,7 @@ export type AdmissionDecision =
   | { allow: false; reason: string; verb?: PermissionVerb };
 
 export function isRbacEnabled(): boolean {
-  return isEnvFlagEnabled("RBAC_ENABLED", false);
+  return isEnvFlagEnabled("RBAC_ENABLED", true);
 }
 
 export function decideAdmission(input: {