@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/dist/{cli-wby1xnnb.js → cli-f1wky6zp.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-e06a8a7y.js";
+} from "./cli-zkxymas5.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-zvz62chv.js → cli-fm4ytsdk.js}

@@ -1,22 +1,22 @@
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl
-} from "./cli-9d8ntetj.js";
+} from "./cli-2658f6at.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   init_identity_field_budget,
   init_templates
-} from "./cli-08b07b4r.js";
+} from "./cli-ht5rs63n.js";
 import {
   init_resolver,
   init_steering_enabled,
   isSteeringEnabled,
   resolveTemplateAsync
-} from "./cli-3apbzgyk.js";
+} from "./cli-z61ykvam.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   init_constants
-} from "./cli-e29gmdmw.js";
+} from "./cli-dv6cdjs2.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-tg8qj8ee.js → cli-frcta2w4.js}

@@ -1,10 +1,10 @@
 import {
   materializeClaudeMd,
   stopClaudeMd
-} from "./cli-4wtq5jjv.js";
+} from "./cli-wbyk465z.js";
 import {
   summarizeSession
-} from "./cli-jecc01cb.js";
+} from "./cli-j4nv2wqy.js";
 import {
   checkToolLoop,
   clearToolHistory
@@ -15,7 +15,7 @@ import {
   fetchRetrievalsForTask,
   isLlmRaterEnabled,
   postRatings
-} from "./cli-xvkmedgn.js";
+} from "./cli-4wppfkcm.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -26,16 +26,16 @@ import {
   init_profile_sync,
   readIdentityBaselines,
   warnProfileFileTooLarge
-} from "./cli-zvz62chv.js";
+} from "./cli-fm4ytsdk.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getMcpBaseUrl,
   init_constants
-} from "./cli-e29gmdmw.js";
+} from "./cli-dv6cdjs2.js";
 import {
   init_package,
   package_default
-} from "./cli-e06a8a7y.js";
+} from "./cli-zkxymas5.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-7xx10h0a.js → cli-g69fdc9g.js}

@@ -1,14 +1,14 @@
 import {
   buildModelsDevSeedRows,
   loadModelsDevCache
-} from "./cli-5m0qmvdp.js";
+} from "./cli-0qb1z6s2.js";
 import {
   createLogEntry,
   getActivePricingRow,
   getDbClient,
   init_db,
   insertPricingRow
-} from "./cli-qgd4sqz5.js";
+} from "./cli-s14agm5s.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-cmp8g3sw.js → cli-gbfwcd3k.js}

@@ -9,6 +9,18 @@ import {
   _enum
 } from "./cli-w5e1d1vv.js";
 
+// src/rbac/elevated-agents.ts
+var leadEquivalentAgentIds = new Set;
+function grantLeadEquivalence(agentId) {
+  leadEquivalentAgentIds.add(agentId);
+}
+function revokeLeadEquivalence(agentId) {
+  leadEquivalentAgentIds.delete(agentId);
+}
+function hasLeadEquivalence(agentId) {
+  return !!agentId && leadEquivalentAgentIds.has(agentId);
+}
+
 // src/rbac/permissions.ts
 init_zod();
 var PERMISSIONS = {
@@ -251,6 +263,14 @@ var PERMISSIONS = {
   "script.api.delete": {
     description: "Delete an external script API endpoint.",
     namespace: "script"
+  },
+  "extension.write": {
+    description: "Install, update, or uninstall a swarm extension.",
+    namespace: "extension"
+  },
+  "extension.activate": {
+    description: "Enable, disable, or activate a version of a swarm extension.",
+    namespace: "extension"
   }
 };
 var PERMISSION_VERBS = Object.keys(PERMISSIONS);
@@ -259,7 +279,7 @@ var PermissionVerbSchema = _enum(PERMISSION_VERBS);
 // src/rbac/admission.ts
 init_env_flag();
 function isRbacEnabled() {
-  return isEnvFlagEnabled("RBAC_ENABLED", false);
+  return isEnvFlagEnabled("RBAC_ENABLED", true);
 }
 function decideAdmission(input) {
   if (input.grant.grantsAll) {
@@ -295,10 +315,23 @@ function decideToolAdmission(input) {
   return { allow: false, reason: "admission: tool has no permission verb (operator-only)" };
 }
 // src/rbac/legacy-policy.ts
+function actsAsLead(principal) {
+  return principal.kind === "agent" && (principal.isLead || hasLeadEquivalence(principal.agentId));
+}
 var leadOnly = {
   name: "lead-only",
   denyReason: "requires lead agent",
-  evaluate: (principal) => principal.kind === "agent" && principal.isLead
+  evaluate: (principal) => actsAsLead(principal)
+};
+var operatorOrUser = {
+  name: "operator-or-user",
+  denyReason: "requires operator or user authentication",
+  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user"
+};
+var leadOrOperatorOrUser = {
+  name: "lead-or-operator-or-user",
+  denyReason: "requires lead agent, operator, or user authentication",
+  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal)
 };
 var leadOrTaskCreator = {
   name: "lead-or-task-creator",
@@ -306,7 +339,7 @@ var leadOrTaskCreator = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return resource?.kind === "task" && resource.creatorAgentId != null && resource.creatorAgentId === principal.agentId;
   }
@@ -317,7 +350,7 @@ var leadOrResourceOwner = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return resource?.kind === "owned" && resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId;
   }
@@ -328,7 +361,7 @@ var leadOrOwnNamespace = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return principal.agentId !== "" && resource?.kind === "kv-namespace" && resource.namespace === `task:agent:${principal.agentId}`;
   }
@@ -355,7 +388,7 @@ var memoryOwnerOrLeadSwarm = {
       return false;
     if (resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId)
       return true;
-    return principal.isLead && resource.scope === "swarm";
+    return actsAsLead(principal) && resource.scope === "swarm";
   }
 };
 var taskFsMutate = {
@@ -364,7 +397,7 @@ var taskFsMutate = {
   evaluate: (principal, resource) => {
     if (principal.kind === "operator" || principal.kind === "user")
       return true;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     if (resource?.kind !== "task")
       return false;
@@ -431,7 +464,9 @@ var LEGACY_POLICY = {
   "script.api.create": leadOnly,
   "script.api.update": leadOnly,
   "script.api.rotate": leadOnly,
-  "script.api.delete": leadOnly
+  "script.api.delete": leadOnly,
+  "extension.write": leadOrOperatorOrUser,
+  "extension.activate": operatorOrUser
 };
 
 // src/rbac/can.ts
@@ -452,4 +487,4 @@ function can(check) {
   }
   return decision;
 }
-export { isRbacEnabled, decideAdmission, decideToolAdmission, setAuditSink, clearAuditSink, can, PermissionVerbSchema };
+export { isRbacEnabled, decideAdmission, decideToolAdmission, grantLeadEquivalence, revokeLeadEquivalence, setAuditSink, clearAuditSink, can, PermissionVerbSchema };

package/dist/{handlers-nsg0bcye.js → cli-gjyvhmmh.js}

@@ -5,39 +5,36 @@ import {
   instantFlush,
   requestSlackThreadSteering,
   wasEventSeen
-} from "./cli-1c94wvcw.js";
+} from "./cli-a1z3h107.js";
 import {
-  bufferedFileFailures,
+  enrichSlackUserEmail,
+  resolveSlackUserId,
+  rewriteSlackMentions
+} from "./cli-czjtgfys.js";
+import {
+  TaskCreationBlockedError,
+  broadcastMatches,
   buildEffectiveText,
   createSlackTaskWithFiles,
+  dispatchPre,
   extractSlackMessageText,
   extractTaskFromMessage,
   fetchSlackFiles,
   hasOtherUserMention,
   notifySlackFileFailures,
   routeMessage
-} from "./cli-sdzq01t9.js";
-import"./cli-jsp14b6c.js";
-import {
-  enrichSlackUserEmail,
-  resolveSlackUserId,
-  rewriteSlackMentions
-} from "./cli-9br8ypfv.js";
-import"./cli-j4d4f6hv.js";
-import"./cli-ayvy5kde.js";
+} from "./cli-5tpgq60f.js";
 import {
   ackSlackMessage,
   buildTreeBlocks,
   ensureSlackThreadTree,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-3sysyjve.js";
-import"./cli-q51yprfq.js";
-import"./cli-9d8ntetj.js";
-import"./cli-yatxqynm.js";
+} from "./cli-r2q6pevn.js";
 import {
   getAgentById,
   getAgentWorkingOnThread,
+  getAllAgents,
   getLeadAgent,
   getMostRecentTaskInThread,
   getTasksByAgentId,
@@ -45,40 +42,49 @@ import {
   init_db,
   reactionName,
   slackContextKey
-} from "./cli-qgd4sqz5.js";
-import"./cli-08b07b4r.js";
+} from "./cli-s14agm5s.js";
 import {
   init_resolver,
   resolveTemplate
-} from "./cli-3apbzgyk.js";
-import"./cli-e29gmdmw.js";
-import"./cli-c2mk1kgf.js";
+} from "./cli-z61ykvam.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
 } from "./cli-ej6gbxfb.js";
-import"./cli-sd0mxa3c.js";
-import"./cli-w5e1d1vv.js";
-import"./cli-e06a8a7y.js";
-import"./cli-r2ap2czm.js";
-import"./cli-pzxba7gw.js";
+import {
+  init_zod
+} from "./cli-sd0mxa3c.js";
+import {
+  exports_external
+} from "./cli-w5e1d1vv.js";
+import {
+  init_secret_scrubber,
+  scrubSecrets
+} from "./cli-r2ap2czm.js";
 import {
   init_event_bus,
   workflowEventBus
 } from "./cli-f7kvq46p.js";
-import"./cli-zf8jjwex.js";
-import"./cli-bd957dgb.js";
 import {
   __callDispose,
   __using
 } from "./cli-bc05qbss.js";
 
 // src/slack/handlers.ts
+init_zod();
 init_db();
 init_resolver();
 init_context_key();
+init_secret_scrubber();
 init_event_bus();
 init_env_flag();
+var SlackRouteModifySchema = exports_external.object({
+  target: exports_external.discriminatedUnion("kind", [
+    exports_external.object({ kind: exports_external.literal("agent"), agentId: exports_external.string().min(1) }).strict(),
+    exports_external.object({ kind: exports_external.literal("lead") }).strict(),
+    exports_external.object({ kind: exports_external.literal("broadcast") }).strict()
+  ])
+}).strict();
 var allowedEmailDomains = (process.env.SLACK_ALLOWED_EMAIL_DOMAINS || "").split(",").map((d) => d.trim().toLowerCase()).filter(Boolean);
 var allowedUserIds = (process.env.SLACK_ALLOWED_USER_IDS || "").split(",").map((id) => id.trim()).filter(Boolean);
 var filteringEnabled = allowedEmailDomains.length > 0 || allowedUserIds.length > 0;
@@ -291,8 +297,10 @@ function registerMessageHandler(app) {
       });
       workflowEventBus.emit("slack.message", {
         channel: msg.channel,
+        channelId: msg.channel,
         text: msg.text,
         user: msg.user,
+        userId: msg.user,
         ts: msg.ts,
         threadTs: msg.thread_ts
       });
@@ -308,18 +316,16 @@ function registerMessageHandler(app) {
       const additiveSlack = isEnvFlagEnabled("ADDITIVE_SLACK", false);
       const requireMentionForThreadFollowup = isEnvFlagEnabled("SLACK_THREAD_FOLLOWUP_REQUIRE_MENTION", false);
       if (additiveSlack && msg.thread_ts) {
-        const unattached2 = bufferedFileFailures(msg.files);
-        const stripped = buildEffectiveText(msg.text, msg.files, unattached2).replace(/<@[A-Z0-9]+>/g, "").trim();
+        const stripped = (msg.text ?? "").replace(/<@[A-Z0-9]+>/g, "").trim();
         if (stripped.startsWith("!now") && await hasSwarmThreadActivity(client, msg.channel, msg.thread_ts)) {
           const nowMessage = stripped.replace(/^!now\s*/, "").trim();
           const threadKey = `${msg.channel}:${msg.thread_ts}`;
           console.log(`[Slack] !now command detected in thread ${threadKey}${nowMessage ? ` with message: "${nowMessage}"` : ""}`);
-          if (nowMessage) {
-            bufferThreadMessage(msg.channel, msg.thread_ts, nowMessage, msg.user, msg.ts);
+          if (nowMessage || msg.files?.length) {
+            bufferThreadMessage(msg.channel, msg.thread_ts, nowMessage, msg.user, msg.ts, msg.files);
           }
           await instantFlush(threadKey);
           await ackSlackMessage(client, msg.channel, msg.ts, reactionName("now"), "now");
-          await notifySlackFileFailures(client, msg.channel, msg.thread_ts, unattached2);
           return;
         }
       }
@@ -331,20 +337,56 @@ function registerMessageHandler(app) {
         const hasSwarmActivity = await hasSwarmThreadActivity(client, msg.channel, msg.thread_ts);
         if (hasSwarmActivity) {
           const threadKey = `${msg.channel}:${msg.thread_ts}`;
-          const unattached2 = bufferedFileFailures(msg.files);
-          bufferThreadMessage(msg.channel, msg.thread_ts, buildEffectiveText(msg.text, msg.files, unattached2), msg.user, msg.ts);
+          bufferThreadMessage(msg.channel, msg.thread_ts, msg.text ?? "", msg.user, msg.ts, msg.files);
           const count = getBufferMessageCount(threadKey);
           const event2 = count === 1 ? "accepted" : "buffered";
           const name = reactionName(event2);
           console.log(`[Slack] Additive buffer: ${threadKey} (message #${count}, reaction: ${name})`);
           await ackSlackMessage(client, msg.channel, msg.ts, name, event2);
-          await notifySlackFileFailures(client, msg.channel, msg.thread_ts, unattached2);
           return;
         }
       }
       const routingText = msg.text || effectiveText;
       const routingThreadContext = msg.thread_ts ? { channelId: msg.channel, threadTs: msg.thread_ts } : undefined;
-      const matches = await routeMessage(routingText, botUserId, botMentioned || isImplicitMention, routingThreadContext);
+      const routeResult = await dispatchPre("pre.slack.route", {
+        channelId: msg.channel,
+        userId: msg.user,
+        text: routingText,
+        ...msg.thread_ts ? { threadTs: msg.thread_ts } : {},
+        botMentioned: botMentioned || isImplicitMention,
+        ...routingThreadContext ? { threadContext: routingThreadContext } : {}
+      }, {
+        validateModify: (data) => {
+          const parsed = SlackRouteModifySchema.safeParse(data);
+          return parsed.success ? { success: true, data: parsed.data } : { success: false, error: new Error(parsed.error.message) };
+        }
+      });
+      if (routeResult.action === "block") {
+        console.info("[Slack] Extension blocked message routing:", scrubSecrets(routeResult.reason));
+        return;
+      }
+      let matches;
+      if (routeResult.action === "modify") {
+        const { target } = routeResult.data;
+        if (target.kind === "agent") {
+          const agent = await getAgentById(target.agentId);
+          if (agent) {
+            matches = [{ agent, matchedText: "extension" }];
+          } else {
+            console.warn("[Slack] Extension selected an unknown agent. Using the built-in router:", scrubSecrets(target.agentId));
+          }
+        } else if (target.kind === "lead") {
+          const leadAgent = await getLeadAgent();
+          if (leadAgent) {
+            matches = [{ agent: leadAgent, matchedText: "extension" }];
+          } else {
+            console.warn(scrubSecrets("[Slack] Extension selected the lead, but no lead exists. Using the built-in router."));
+          }
+        } else {
+          matches = broadcastMatches(await getAllAgents());
+        }
+      }
+      matches ??= await routeMessage(routingText, botUserId, botMentioned || isImplicitMention, routingThreadContext);
       if (matches.length === 0) {
         let __stack = [];
         try {
@@ -388,6 +430,7 @@ ${taskDescription2}`;
           const { task, unattached: unattached2 } = await createSlackTaskWithFiles(fullTaskDescription2, {
             agentId: lead?.id,
             routingReason: lead ? "skill" : undefined,
+            routingSource: lead ? "engine_default" : undefined,
             source: "slack",
             slackChannelId: msg.channel,
             slackThreadTs: threadTs2,
@@ -476,6 +519,7 @@ ${taskDescription}`;
             const created2 = await createSlackTaskWithFiles(fullTaskDescription, {
               agentId: agent.id,
               routingReason: "human_pinned",
+              routingSource: "engine_default",
               source: "slack",
               slackChannelId: msg.channel,
               slackThreadTs: threadTs,
@@ -494,6 +538,7 @@ ${taskDescription}`;
           const created = await createSlackTaskWithFiles(fullTaskDescription, {
             agentId: agent.id,
             routingReason: "human_pinned",
+            routingSource: "engine_default",
             source: "slack",
             slackChannelId: msg.channel,
             slackThreadTs: threadTs,
@@ -512,8 +557,11 @@ ${taskDescription}`;
           } else {
             results.assigned.push({ agentName: agent.name, taskId: task.id });
           }
-        } catch {
-          results.failed.push({ agentName: agent.name, reason: "error" });
+        } catch (error) {
+          results.failed.push({
+            agentName: agent.name,
+            reason: error instanceof TaskCreationBlockedError ? error.reason : "error"
+          });
         }
       }
       if (results.assigned.length + results.queued.length > 0) {
@@ -525,6 +573,15 @@ ${taskDescription}`;
         if (isSlackRenderV2Enabled()) {
           if (successfulTaskIds.length > 0)
             await ensureSlackThreadTree(successfulTaskIds);
+          if (results.failed.length > 0) {
+            const failedLines = results.failed.map((f) => `⚠️ Could not assign to: *${f.agentName}* — ${f.reason}`).join(`
+`);
+            await say({
+              text: `Could not assign to: ${results.failed.map((f) => f.agentName).join(", ")}`,
+              blocks: [{ type: "context", elements: [{ type: "mrkdwn", text: failedLines }] }],
+              thread_ts: msg.thread_ts || msg.ts
+            });
+          }
         } else {
           const initialNodes = results.assigned.map(({ agentName, taskId }) => ({
             taskId,
@@ -597,10 +654,5 @@ ${taskDescription}`;
     console.log(`[Slack] App mentioned in channel ${event.channel}`);
   });
 }
-export {
-  checkUserAccess,
-  isBotMessage,
-  isSwarmThreadRoot,
-  registerMessageHandler,
-  resetSlackHandlerCachesForTesting
-};
+
+export { checkUserAccess, isUserAllowed, isBotMessage, resetSlackHandlerCachesForTesting, isSwarmThreadRoot, registerMessageHandler };

package/dist/{cli-08b07b4r.js → cli-ht5rs63n.js}

@@ -6,7 +6,7 @@ import {
   isSteeringEnabled,
   registerTemplate,
   resolveTemplateAsync
-} from "./cli-3apbzgyk.js";
+} from "./cli-z61ykvam.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/dist/{cli-jecc01cb.js → cli-j4nv2wqy.js}

@@ -1,15 +1,13 @@
 import {
   BASE_SUMMARIZE_PROMPT,
   SummaryWithRatingsSchema,
-  buildSummaryWithRatingsPrompt
-} from "./cli-xvkmedgn.js";
-import {
+  buildSummaryWithRatingsPrompt,
   complete,
   exports_typebox,
   getBuiltinModel,
   parseModelStr,
   resolveCredential
-} from "./cli-1ebpar1q.js";
+} from "./cli-4wppfkcm.js";
 import {
   DEFAULT_OPENROUTER_BASE_URL,
   getOpenRouterBaseUrl

package/dist/{cli-cd60fv6j.js → cli-j9xczhaq.js}

@@ -7,7 +7,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-qgd4sqz5.js";
+} from "./cli-s14agm5s.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,