@desplega.ai/agent-swarm 1.150.0 → 1.152.0

package/src/scripts-runtime/import-allowlist.ts

@@ -1,9 +1,14 @@
 import ts from "typescript";
 
-const ALLOWED_BARE_IMPORTS = new Set(["swarm-sdk", "stdlib", "zod"]);
+const SCRIPT_ALLOWED_BARE_IMPORTS = ["swarm-sdk", "stdlib", "zod"] as const;
 const FORBIDDEN_HINTS = new Set(["node:", "bun:", "fs", "child_process", "crypto", "bun:sqlite"]);
-const ALLOWLIST_REMEDY =
-  'Allowed imports are "swarm-sdk", "stdlib", "zod", and relative paths ("./" or "../").';
+
+export type ImportAllowlistOptions = {
+  allowedBare: readonly string[];
+  allowRelative: boolean;
+  // Extensions need strict dynamic imports because they run in-process without a sandbox.
+  strictDynamic?: boolean;
+};
 
 export type ImportAllowlistResult =
   | { ok: true }
@@ -13,11 +18,18 @@ function isRelative(specifier: string): boolean {
   return specifier.startsWith("./") || specifier.startsWith("../");
 }
 
-function isAllowed(specifier: string): boolean {
-  return isRelative(specifier) || ALLOWED_BARE_IMPORTS.has(specifier);
+function isAllowed(specifier: string, options: ImportAllowlistOptions): boolean {
+  return (
+    (options.allowRelative && isRelative(specifier)) || options.allowedBare.includes(specifier)
+  );
 }
 
-function collectImportSpecifiers(source: string): string[] {
+type CollectedImports = {
+  imports: string[];
+  unsupportedSyntax: "import()" | "require()" | "import-equals" | null;
+};
+
+function collectImportSpecifiers(source: string, strictDynamic = false): CollectedImports {
   const sourceFile = ts.createSourceFile(
     "user-script.ts",
     source,
@@ -26,6 +38,7 @@ function collectImportSpecifiers(source: string): string[] {
     ts.ScriptKind.TS,
   );
   const imports: string[] = [];
+  let unsupportedSyntax: CollectedImports["unsupportedSyntax"] = null;
 
   const visit = (node: ts.Node) => {
     if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
@@ -34,19 +47,42 @@ function collectImportSpecifiers(source: string): string[] {
         imports.push(moduleSpecifier.text);
     }
 
+    if (
+      strictDynamic &&
+      ts.isImportEqualsDeclaration(node) &&
+      ts.isExternalModuleReference(node.moduleReference)
+    ) {
+      const specifier = node.moduleReference.expression;
+      if (specifier && ts.isStringLiteralLike(specifier)) imports.push(specifier.text);
+      else unsupportedSyntax ??= "import-equals";
+    }
+
     if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
       const [arg] = node.arguments;
-      if (arg && ts.isStringLiteral(arg)) imports.push(arg.text);
+      if (arg && (ts.isStringLiteral(arg) || (strictDynamic && ts.isStringLiteralLike(arg))))
+        imports.push(arg.text);
+      else if (strictDynamic) unsupportedSyntax ??= "import()";
+    }
+
+    if (
+      strictDynamic &&
+      ts.isCallExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === "require"
+    ) {
+      const [arg] = node.arguments;
+      if (arg && ts.isStringLiteralLike(arg)) imports.push(arg.text);
+      else unsupportedSyntax ??= "require()";
     }
 
     ts.forEachChild(node, visit);
   };
 
   visit(sourceFile);
-  return imports;
+  return { imports, unsupportedSyntax };
 }
 
-function findForbiddenDynamicCode(source: string): string | null {
+function findForbiddenDynamicCode(source: string, subject: string): string | null {
   const sourceFile = ts.createSourceFile(
     "user-script.ts",
     source,
@@ -64,7 +100,7 @@ function findForbiddenDynamicCode(source: string): string | null {
       node.expression.kind === ts.SyntaxKind.Identifier &&
       node.expression.getText(sourceFile) === "eval"
     ) {
-      diagnostic = "eval is not allowed in swarm scripts";
+      diagnostic = `eval is not allowed in ${subject}`;
       return;
     }
 
@@ -73,7 +109,7 @@ function findForbiddenDynamicCode(source: string): string | null {
       node.expression.kind === ts.SyntaxKind.Identifier &&
       node.expression.getText(sourceFile) === "Function"
     ) {
-      diagnostic = "Function constructor is not allowed in swarm scripts";
+      diagnostic = `Function constructor is not allowed in ${subject}`;
       return;
     }
 
@@ -82,7 +118,7 @@ function findForbiddenDynamicCode(source: string): string | null {
       node.expression.kind === ts.SyntaxKind.Identifier &&
       node.expression.getText(sourceFile) === "Function"
     ) {
-      diagnostic = "Function constructor is not allowed in swarm scripts";
+      diagnostic = `Function constructor is not allowed in ${subject}`;
       return;
     }
 
@@ -93,23 +129,47 @@ function findForbiddenDynamicCode(source: string): string | null {
   return diagnostic;
 }
 
-export function validateScriptImports(source: string): ImportAllowlistResult {
-  const dynamicDiagnostic = findForbiddenDynamicCode(source);
+export function checkImportAllowlist(
+  source: string,
+  options: ImportAllowlistOptions,
+): ImportAllowlistResult {
+  const isExtension = options.allowedBare.includes("swarm-extension");
+  const subject = isExtension ? "swarm extensions" : "swarm scripts";
+  const dynamicDiagnostic = findForbiddenDynamicCode(source, subject);
   if (dynamicDiagnostic) return { ok: false, diagnostic: dynamicDiagnostic, imports: [] };
 
-  const imports = collectImportSpecifiers(source);
-  const rejected = imports.filter((specifier) => !isAllowed(specifier));
+  const collected = collectImportSpecifiers(source, options.strictDynamic);
+  if (collected.unsupportedSyntax) {
+    return {
+      ok: false,
+      diagnostic: `Computed ${collected.unsupportedSyntax} is not allowed in ${subject}. Use a string literal from the import allowlist.`,
+      imports: collected.imports,
+    };
+  }
+  const imports = collected.imports;
+  const rejected = imports.filter((specifier) => !isAllowed(specifier, options));
   if (rejected.length === 0) return { ok: true };
 
   const hint = rejected.find(
     (specifier) => FORBIDDEN_HINTS.has(specifier) || specifier.startsWith("node:"),
   );
   const reason = hint
-    ? `Import '${hint}' is not allowed in swarm scripts`
-    : `Import '${rejected[0]}' is not on the swarm script allowlist`;
+    ? `Import '${hint}' is not allowed in ${subject}`
+    : `Import '${rejected[0]}' is not on the ${subject} allowlist`;
+  const listed = options.allowedBare.map((specifier) => `"${specifier}"`).join(", ");
+  const allowlistRemedy = options.allowRelative
+    ? `Allowed imports are ${listed}, and relative paths ("./" or "../").`
+    : `Allowed imports are ${listed}. Relative imports are not allowed.`;
   const remedy =
     hint === "crypto" || hint === "node:crypto"
       ? "The global crypto object already provides randomUUID, getRandomValues, and subtle.digest; delete the import and use crypto directly."
-      : ALLOWLIST_REMEDY;
+      : allowlistRemedy;
   return { ok: false, diagnostic: `${reason}. ${remedy}`, imports: rejected };
 }
+
+export function validateScriptImports(source: string): ImportAllowlistResult {
+  return checkImportAllowlist(source, {
+    allowedBare: SCRIPT_ALLOWED_BARE_IMPORTS,
+    allowRelative: true,
+  });
+}

package/src/scripts-runtime/sdk-allowlist.ts

@@ -56,6 +56,14 @@ export const SDK_TOOL_NAME_MAP = {
   script_getRun: "get-script-run",
   script_listRuns: "list-script-runs",
 
+  // ── extensions ──
+  extension_delete: "extension-delete",
+  extension_enable: "extension-enable",
+  extension_disable: "extension-disable",
+  extension_activate_version: "extension-activate-version",
+  extension_install: "extension-install",
+  extension_list: "extension-list",
+
   // ── swarm / agent ──
   swarm_get: "get-swarm",
   agent_info: "my-agent-info",

package/src/scripts-runtime/swarm-config.ts

@@ -7,6 +7,8 @@ export class SwarmConfig {
   readonly mcpBaseUrl: RedactedValue<string>;
   /** Per-boot runtime identity of the invoking worker; system context, never script input. */
   readonly runtimeInstanceId: RedactedValue<string> | undefined;
+  /** Per-process extension bridge secret; present only for in-process extension SDKs. */
+  readonly extensionToken: RedactedValue<string> | undefined;
 
   private readonly userValues: Map<string, RedactedValue<string>>;
 
@@ -29,6 +31,12 @@ export class SwarmConfig {
           isSecret: payload.system.runtimeInstanceId.isSecret,
         })
       : undefined;
+    this.extensionToken = payload.system.extensionToken
+      ? Redacted.make(payload.system.extensionToken.value, {
+          type: "system",
+          isSecret: payload.system.extensionToken.isSecret,
+        })
+      : undefined;
     this.userValues = new Map(
       Object.entries(payload.user ?? {}).map(([key, value]) => [
         key,

package/src/scripts-runtime/swarm-sdk.ts

@@ -20,6 +20,9 @@ function headers(config: SwarmConfig): Record<string, string> {
     ...(config.runtimeInstanceId
       ? { "X-Runtime-Instance-ID": Redacted.value(config.runtimeInstanceId) }
       : {}),
+    ...(config.extensionToken
+      ? { "X-Extension-Token": Redacted.value(config.extensionToken) }
+      : {}),
     "Content-Type": "application/json",
   };
 }

package/src/scripts-runtime/types/stdlib.d.ts

@@ -517,6 +517,19 @@ declare module "swarm-sdk" {
       offset?: number;
     }): Promise<unknown>;
 
+    // --- write: extensions ---
+    extension_install(args: {
+      manifest: Record<string, unknown>;
+      files: Record<string, string>;
+      priority?: number;
+      config?: Record<string, unknown>;
+    }): Promise<unknown>;
+    extension_list(args?: { enabledOnly?: boolean }): Promise<unknown>;
+    extension_delete(args: { id: string }): Promise<unknown>;
+    extension_enable(args: { id: string }): Promise<unknown>;
+    extension_disable(args: { id: string }): Promise<unknown>;
+    extension_activate_version(args: { id: string; version: number }): Promise<unknown>;
+
     // --- write: repos ---
     repo_update(args: Record<string, unknown>): Promise<unknown>;