@desplega.ai/agent-swarm 1.151.0 → 1.152.0

package/dist/{cli-s14agm5s.js → cli-gacq5hg8.js}

@@ -49,7 +49,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-zkxymas5.js";
+} from "./cli-jh9txj4n.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -7544,6 +7544,10 @@ var init_tool_config = __esm(() => {
     "launch-script-run",
     "get-script-run",
     "list-script-runs",
+    "extension-delete",
+    "extension-enable",
+    "extension-disable",
+    "extension-activate-version",
     "extension-install",
     "extension-list",
     "swarm_x",
@@ -7657,7 +7661,12 @@ var init_swarm_config_guard = __esm(() => {
   init_reaction_shortcode();
   init_types();
   init_task_tool_manifest();
-  RESERVED_KEYS = new Set(["API_KEY", "SECRETS_ENCRYPTION_KEY", "CORS_ALLOW_ANY_ORIGIN"]);
+  RESERVED_KEYS = new Set([
+    "API_KEY",
+    "SECRETS_ENCRYPTION_KEY",
+    "CORS_ALLOW_ANY_ORIGIN",
+    "EXTENSION_ALLOW_LEAD_ACTIVATION"
+  ]);
   BOOLEAN_LITERALS = ["true", "false", "1", "0"];
   DB_RETENTION_TUNING_BOUNDS = {
     DB_RETENTION_TICK_BUDGET_MS: { min: 1000, max: 300000 },
@@ -11599,7 +11608,7 @@ async function getSwarmConfigs(filters) {
 async function getInjectableGlobalConfigs() {
   const rows = await getDbClient().query(`SELECT * FROM swarm_config
        WHERE scope = 'global'
-         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN')
+         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN', 'EXTENSION_ALLOW_LEAD_ACTIVATION')
        ORDER BY key ASC`);
   return rows.map(rowToSwarmConfig);
 }

package/dist/{cli-zkxymas5.js → cli-jh9txj4n.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.151.0",
+    version: "1.152.0",
     description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
     keywords: [
       "agent-swarm.dev",

package/dist/{cli-q88st9aj.js → cli-nd5s3m4y.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-ppm4975n.js";
+} from "./cli-evgy5w3y.js";
 import {
   getDbClient,
   init_db
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-sjaae6ff.js → cli-p2hx1pxm.js}

@@ -20,10 +20,10 @@ import {
   oauthAppRowToProviderConfig,
   updateAuthorizationTokens,
   upsertAuthorization
-} from "./cli-j9xczhaq.js";
+} from "./cli-cs9z1hw3.js";
 import {
   embedScript
-} from "./cli-q88st9aj.js";
+} from "./cli-nd5s3m4y.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
@@ -45,7 +45,7 @@ import {
   normalizeDateRequired,
   placeholderForConfigKey,
   upsertSwarmConfig
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import {
   init_env_flag,
   isEnvFlagEnabled

package/dist/{cli-2tbvf1z1.js → cli-t1mykkng.js}

@@ -12,11 +12,11 @@ import {
 } from "./cli-d3p82erb.js";
 import {
   checkClaudeCredentials
-} from "./cli-3v9xhjcn.js";
+} from "./cli-8fy9dmpv.js";
 import {
   checkCodexCredentials,
   codexUserHome
-} from "./cli-vwm416m6.js";
+} from "./cli-87hdfyde.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -34,7 +34,7 @@ import {
 import {
   resolveScriptsOnlyMode,
   validateJsonSchema
-} from "./cli-5tpgq60f.js";
+} from "./cli-72vksk1n.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
@@ -58,7 +58,7 @@ import {
   startSpan,
   withSpan,
   withSpanContext
-} from "./cli-r2q6pevn.js";
+} from "./cli-cwvey7n1.js";
 import {
   buildContextPreamble,
   buildResumeContextPreamble,
@@ -83,7 +83,7 @@ import {
   init_types,
   resolveTaskModelSelection,
   telemetry
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -151,7 +151,7 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-wfp2gzvz.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-h58xqzzd.js");
       return new ClaudeAdapter;
     }
     case "pi": {
@@ -159,7 +159,7 @@ async function createProviderAdapter(provider) {
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-jjjk8w4m.js");
+      const { CodexAdapter } = await import("./codex-adapter-v3cz462q.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
@@ -175,7 +175,7 @@ async function createProviderAdapter(provider) {
       return new OpencodeAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-ex8hzjfc.js");
+      const { ACPAdapter } = await import("./acp-adapter-d05sg0q4.js");
       return new ACPAdapter;
     }
     default:

package/dist/{cli-7tgcstn2.js → cli-t6axtdcg.js}

@@ -1,11 +1,11 @@
 import {
   PermissionVerbSchema
-} from "./cli-gbfwcd3k.js";
+} from "./cli-zfzznn7c.js";
 import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import {
   init_env_flag,
   isEnvFlagEnabled

package/dist/{cli-f1wky6zp.js → cli-wp7cejrg.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-zkxymas5.js";
+} from "./cli-jh9txj4n.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-0qb1z6s2.js → cli-zdcdh02m.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 
 // src/be/seed-pricing.ts
 init_db();

package/dist/{cli-gbfwcd3k.js → cli-zfzznn7c.js}

@@ -315,6 +315,7 @@ function decideToolAdmission(input) {
   return { allow: false, reason: "admission: tool has no permission verb (operator-only)" };
 }
 // src/rbac/legacy-policy.ts
+init_env_flag();
 function actsAsLead(principal) {
   return principal.kind === "agent" && (principal.isLead || hasLeadEquivalence(principal.agentId));
 }
@@ -323,16 +324,16 @@ var leadOnly = {
   denyReason: "requires lead agent",
   evaluate: (principal) => actsAsLead(principal)
 };
-var operatorOrUser = {
-  name: "operator-or-user",
-  denyReason: "requires operator or user authentication",
-  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user"
-};
 var leadOrOperatorOrUser = {
   name: "lead-or-operator-or-user",
   denyReason: "requires lead agent, operator, or user authentication",
   evaluate: (principal) => principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal)
 };
+var extensionActivation = {
+  name: "extension-activation",
+  denyReason: "requires operator/user authentication, or a lead with EXTENSION_ALLOW_LEAD_ACTIVATION enabled",
+  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal) && isEnvFlagEnabled("EXTENSION_ALLOW_LEAD_ACTIVATION", true)
+};
 var leadOrTaskCreator = {
   name: "lead-or-task-creator",
   denyReason: "requires lead agent or task creator",
@@ -466,7 +467,7 @@ var LEGACY_POLICY = {
   "script.api.rotate": leadOnly,
   "script.api.delete": leadOnly,
   "extension.write": leadOrOperatorOrUser,
-  "extension.activate": operatorOrUser
+  "extension.activate": extensionActivation
 };
 
 // src/rbac/can.ts

package/dist/cli.js

@@ -65,7 +65,7 @@ var import_react = __toESM(require_react(), 1);
 // package.json
 var package_default = {
   name: "@desplega.ai/agent-swarm",
-  version: "1.151.0",
+  version: "1.152.0",
   description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   keywords: [
     "agent-swarm.dev",
@@ -742,7 +742,7 @@ function McpServer({ port, apiKey, dbPath }) {
     if (dbPath) {
       process.env.DATABASE_PATH = dbPath;
     }
-    import("./http-ecsar8ez.js").then(() => {
+    import("./http-7grttjfq.js").then(() => {
       setStatus("running");
     }).catch((err) => {
       setStatus("error");
@@ -828,7 +828,7 @@ function WorkerRunner({
 }) {
   const { exit } = use_app_default();
   import_react.useEffect(() => {
-    import("./worker-p2mr422x.js").then(({ runWorker }) => runWorker({
+    import("./worker-rng4jhnh.js").then(({ runWorker }) => runWorker({
       prompt: prompt || undefined,
       yolo,
       systemPrompt: systemPrompt || undefined,
@@ -845,7 +845,7 @@ function WorkerRunner({
 function LeadRunner({ prompt, yolo, systemPrompt, systemPromptFile, additionalArgs }) {
   const { exit } = use_app_default();
   import_react.useEffect(() => {
-    import("./lead-xbfr7fvt.js").then(({ runLead }) => runLead({
+    import("./lead-a1hpjt0a.js").then(({ runLead }) => runLead({
       prompt: prompt || undefined,
       yolo,
       systemPrompt: systemPrompt || undefined,
@@ -885,8 +885,8 @@ function LazyComponent({
   }
   return import_react.createElement(Component, props);
 }
-var loadOnboard = () => import("./onboard-drskd386.js").then(({ Onboard }) => Onboard);
-var loadConnect = () => import("./setup-4pks0vfk.js").then(({ Setup }) => Setup);
+var loadOnboard = () => import("./onboard-fv7ezvwx.js").then(({ Onboard }) => Onboard);
+var loadConnect = () => import("./setup-3ybwbdpd.js").then(({ Setup }) => Setup);
 function UnknownCommand({ command }) {
   const { exit } = use_app_default();
   import_react.useEffect(() => {
@@ -1007,14 +1007,14 @@ ${binName} docs \u2014 v${package_default.version}
   }
   process.exit(0);
 } else if (args.command === "hook") {
-  const { runHook } = await import("./hook-123e2scb.js");
+  const { runHook } = await import("./hook-fgjv62k5.js");
   await runHook();
 } else if (args.command === "codex-hook") {
   const { handleCodexHook } = await import("./codex-hook-8jexc34x.js");
   await handleCodexHook();
   process.exit(0);
 } else if (args.command === "session-summary-stdin") {
-  const { runSessionSummaryFromStdin } = await import("./hook-sxe3r349.js");
+  const { runSessionSummaryFromStdin } = await import("./hook-9skye8zd.js");
   await runSessionSummaryFromStdin();
   process.exit(process.exitCode ?? 0);
 } else if (args.command === "artifact") {
@@ -1035,7 +1035,7 @@ ${binName} docs \u2014 v${package_default.version}
     printHelp("scripts");
     process.exit(scriptsArgs[0] === "reembed" || args.showHelp ? 0 : 1);
   }
-  const { runScriptsMaintenanceCommand } = await import("./maintenance-qma55qvw.js");
+  const { runScriptsMaintenanceCommand } = await import("./maintenance-tngjzqdq.js");
   await runScriptsMaintenanceCommand(scriptsArgs);
   console.log("Scripts re-embedded.");
 } else if (args.command === "rbac") {
@@ -1045,14 +1045,14 @@ ${binName} docs \u2014 v${package_default.version}
     printHelp("rbac");
     process.exit(args.showHelp ? 0 : 1);
   }
-  const { runRbacCliCommand } = await import("./rbac-roles-78baecqd.js");
+  const { runRbacCliCommand } = await import("./rbac-roles-xtp05syf.js");
   await runRbacCliCommand(rbacArgs);
 } else if (args.command === "codex-login") {
   const { runCodexLogin } = await import("./codex-login-vx7ghkzj.js");
   const codexLoginArgs = process.argv.slice(process.argv.indexOf("codex-login") + 1);
   await runCodexLogin(codexLoginArgs);
 } else if (args.command === "codex-session-runner") {
-  const { runCodexSessionRunner } = await import("./codex-session-runner-nd6ayxkx.js");
+  const { runCodexSessionRunner } = await import("./codex-session-runner-de1a5g5z.js");
   await runCodexSessionRunner();
 } else if (args.command === "claude-managed-setup") {
   const { runClaudeManagedSetup } = await import("./claude-managed-setup-48dwg9bv.js");

package/dist/{codex-adapter-jjjk8w4m.js → codex-adapter-v3cz462q.js}

@@ -6,7 +6,7 @@ import {
   createInProcessCodexSession,
   resolveCodexAuthMode,
   resolveCodexRunnerArgv
-} from "./cli-vwm416m6.js";
+} from "./cli-87hdfyde.js";
 import"./cli-hsxj0yar.js";
 import"./cli-r94z9p1z.js";
 import"./cli-b5b30yzk.js";
@@ -26,7 +26,7 @@ import"./cli-bsakbbkm.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-knd276ed.js";
 import"./cli-c4eeb5q2.js";

package/dist/{codex-session-runner-nd6ayxkx.js → codex-session-runner-de1a5g5z.js}

@@ -1,6 +1,6 @@
 import {
   createInProcessCodexSession
-} from "./cli-vwm416m6.js";
+} from "./cli-87hdfyde.js";
 import"./cli-hsxj0yar.js";
 import"./cli-r94z9p1z.js";
 import"./cli-b5b30yzk.js";
@@ -20,7 +20,7 @@ import"./cli-bsakbbkm.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{commands-9v4psyq1.js → commands-wfqqpn95.js}

@@ -2,7 +2,7 @@ import {
   getAllAgents,
   getAllTasks,
   init_db
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -13,7 +13,7 @@ import {
 } from "./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{db-wnt58tpe.js → db-9zzv5y05.js}

@@ -455,7 +455,7 @@ import {
   upsertSkillFiles,
   upsertSwarmConfig,
   withFavoriteFlags
-} from "./cli-s14agm5s.js";
+} from "./cli-gacq5hg8.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -468,7 +468,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{dispatcher-05jh1aqk.js → dispatcher-hfm1jbgx.js}

@@ -11,34 +11,34 @@ import {
   resolveBridgeCallOrigin,
   runContext,
   unregister
-} from "./cli-5tpgq60f.js";
+} from "./cli-72vksk1n.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-g69fdc9g.js";
-import"./cli-7tgcstn2.js";
-import"./cli-gbfwcd3k.js";
-import"./cli-sjaae6ff.js";
+import"./cli-5bqt4gwa.js";
+import"./cli-t6axtdcg.js";
+import"./cli-zfzznn7c.js";
+import"./cli-p2hx1pxm.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-j9xczhaq.js";
-import"./cli-0qb1z6s2.js";
+import"./cli-cs9z1hw3.js";
+import"./cli-zdcdh02m.js";
 import"./cli-bsakbbkm.js";
-import"./cli-q88st9aj.js";
+import"./cli-nd5s3m4y.js";
 import"./cli-51tf7ac3.js";
-import"./cli-r2q6pevn.js";
+import"./cli-cwvey7n1.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-ppm4975n.js";
+import"./cli-evgy5w3y.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-s14agm5s.js";
+import"./cli-gacq5hg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -46,7 +46,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/dist/{handlers-tw90pkh5.js → handlers-wrrhsack.js}

@@ -5,37 +5,37 @@ import {
   isUserAllowed,
   registerMessageHandler,
   resetSlackHandlerCachesForTesting
-} from "./cli-gjyvhmmh.js";
-import"./cli-a1z3h107.js";
-import"./cli-czjtgfys.js";
-import"./cli-5tpgq60f.js";
+} from "./cli-5p007m2q.js";
+import"./cli-4fqn2vpg.js";
+import"./cli-awb59f08.js";
+import"./cli-72vksk1n.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-g69fdc9g.js";
-import"./cli-7tgcstn2.js";
-import"./cli-gbfwcd3k.js";
-import"./cli-sjaae6ff.js";
+import"./cli-5bqt4gwa.js";
+import"./cli-t6axtdcg.js";
+import"./cli-zfzznn7c.js";
+import"./cli-p2hx1pxm.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-j9xczhaq.js";
-import"./cli-0qb1z6s2.js";
+import"./cli-cs9z1hw3.js";
+import"./cli-zdcdh02m.js";
 import"./cli-bsakbbkm.js";
-import"./cli-q88st9aj.js";
+import"./cli-nd5s3m4y.js";
 import"./cli-51tf7ac3.js";
-import"./cli-r2q6pevn.js";
+import"./cli-cwvey7n1.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-ppm4975n.js";
+import"./cli-evgy5w3y.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-s14agm5s.js";
+import"./cli-gacq5hg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -43,7 +43,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/dist/{hook-sxe3r349.js → hook-9skye8zd.js}

@@ -45,7 +45,7 @@ import"./cli-w5e1d1vv.js";
 import {
   init_package,
   package_default
-} from "./cli-zkxymas5.js";
+} from "./cli-jh9txj4n.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{hook-123e2scb.js → hook-fgjv62k5.js}

@@ -1,6 +1,6 @@
 import {
   handleHook
-} from "./cli-frcta2w4.js";
+} from "./cli-f1f9n77e.js";
 import"./cli-wbyk465z.js";
 import"./cli-j4nv2wqy.js";
 import"./cli-hp1n6zq3.js";
@@ -17,7 +17,7 @@ import"./cli-dv6cdjs2.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-jh9txj4n.js";
 import"./cli-r2ap2czm.js";
 import"./cli-c4eeb5q2.js";
 import"./cli-rgvp6r2x.js";