@desplega.ai/agent-swarm 1.151.0 → 1.152.1

package/src/tools/extension-disable.ts

@@ -0,0 +1,36 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as z from "zod";
+import { createToolRegistrar, toolOk } from "@/tools/utils";
+import {
+  coerceExtensionSummary,
+  extensionToolOutputSchema,
+  proxyExtensionsApi,
+} from "./extension-common";
+
+export const registerExtensionDisableTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "extension-disable",
+    {
+      title: "Extension Disable",
+      description:
+        "Unload and disable an installed extension. Requires a lead, operator, or dashboard user.",
+      annotations: { openWorldHint: false },
+      inputSchema: z
+        .object({
+          id: z.string().uuid().describe("Installed extension ID from extension-list."),
+        })
+        .strict(),
+      outputSchema: extensionToolOutputSchema,
+    },
+    async (args, requestInfo) =>
+      proxyExtensionsApi({
+        method: "POST",
+        path: `/api/extensions/${args.id}/disable`,
+        requestInfo,
+        success: (data) =>
+          toolOk("Extension disabled.", {
+            data: coerceExtensionSummary((data as { extension?: unknown }).extension),
+          }),
+      }),
+  );
+};

package/src/tools/extension-enable.ts

@@ -0,0 +1,36 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as z from "zod";
+import { createToolRegistrar, toolOk } from "@/tools/utils";
+import {
+  coerceExtensionSummary,
+  extensionToolOutputSchema,
+  proxyExtensionsApi,
+} from "./extension-common";
+
+export const registerExtensionEnableTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "extension-enable",
+    {
+      title: "Extension Enable",
+      description:
+        "Load and enable an installed extension. Requires a lead, operator, or dashboard user.",
+      annotations: { openWorldHint: false },
+      inputSchema: z
+        .object({
+          id: z.string().uuid().describe("Installed extension ID from extension-list."),
+        })
+        .strict(),
+      outputSchema: extensionToolOutputSchema,
+    },
+    async (args, requestInfo) =>
+      proxyExtensionsApi({
+        method: "POST",
+        path: `/api/extensions/${args.id}/enable`,
+        requestInfo,
+        success: (data) =>
+          toolOk("Extension enabled.", {
+            data: coerceExtensionSummary((data as { extension?: unknown }).extension),
+          }),
+      }),
+  );
+};

package/src/tools/extension-install.ts

@@ -9,7 +9,7 @@ import {
 } from "./extension-common";
 
 export const EXTENSION_INSTALL_DESCRIPTION =
-  "Validate and store a TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The extension remains disabled until an operator enables it.";
+  "Validate and store a TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
 
 function extensionInstallResult(data: unknown, fallbackName: string) {
   const body = data as {
@@ -21,7 +21,7 @@ function extensionInstallResult(data: unknown, fallbackName: string) {
   const version = typeof extension.version === "number" ? ` v${extension.version}` : "";
   const deduped = body.contentDeduped === true ? " Content was unchanged." : "";
   const enableInstruction =
-    "An operator must enable it from the dashboard or `POST /api/extensions/{id}/enable`.";
+    "A lead, operator, or dashboard user can enable it with `extension-enable` or `POST /api/extensions/{id}/enable`.";
 
   return toolOk(`Extension \`${name}\`${version} installed.${deduped} ${enableInstruction}`, {
     data: {

package/src/tools/store-progress.ts

@@ -167,6 +167,36 @@ export const registerStoreProgressTool = (server: McpServer) => {
           ? requestedStatus
           : undefined;
 
+      // Stock Claude occasionally puts the next tool parameter inside output.
+      // Strip the leaked tail before validation/persistence; recovered pointers
+      // must still pass the ordinary attachment schema and verification below.
+      const leakedParameter = output?.match(
+        /(?:<\/(?:output|parameter)>\s*)?<parameter name="([a-zA-Z_]+)">\s*([\s\S]*)$/,
+      );
+      if (leakedParameter) {
+        output = output?.slice(0, leakedParameter.index);
+        let recovered = false;
+        if (leakedParameter[1] === "attachments") {
+          try {
+            const parsed = z
+              .array(AttachmentInputSchema)
+              .max(20)
+              .safeParse(JSON.parse(leakedParameter[2]!.replace(/\s*<\/parameter>\s*$/, "")));
+            if (parsed.success && (attachments?.length ?? 0) + parsed.data.length <= 20) {
+              attachments = [...(attachments ?? []), ...parsed.data];
+              recovered = true;
+            }
+          } catch {
+            // Malformed JSON must not prevent saving the cleaned task result.
+          }
+        }
+        if (!recovered) {
+          console.warn(
+            `[store-progress] Stripped malformed output tail for task ${taskId}; parameter ${leakedParameter[1]} was not recovered.`,
+          );
+        }
+      }
+
       // Verify agent-fs pointers before opening the write transaction. The
       // registering agent's resolved config selects both credentials and the
       // exact org/drive; never let the provider fall back to a personal drive.

package/src/tools/tool-config.ts

@@ -197,13 +197,17 @@ export const DEFERRED_TOOLS = new Set([
   "room-reset",
   "room-decode",
 
-  // Reusable scripts and extensions (8)
+  // Reusable scripts and extensions (12)
   "script-upsert",
   "script-delete",
   "script-apis",
   "launch-script-run",
   "get-script-run",
   "list-script-runs",
+  "extension-delete",
+  "extension-enable",
+  "extension-disable",
+  "extension-activate-version",
   "extension-install",
   "extension-list",
 

package/templates/skills/agent-browser/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: agent-browser
+description: "Drive a real browser with the agent-browser CLI (headless Chromium over CDP). Use for any browser task: verifying a UI change, taking a screenshot, walking a web page, filling a form, extracting page text, reproducing a frontend bug, or attaching UI evidence to a PR, issue, Linear comment, or Slack thread. Starts with a `command -v agent-browser` check and falls back to manual QA on the slim worker image. Screenshots are shared through agent-fs signed URLs. This is the only browser automation tool; do not use qa-use."
+---
+
+# agent-browser
+
+`agent-browser` (vercel-labs) is the swarm's browser-automation CLI. It drives a headless Chromium over CDP and returns accessibility-tree snapshots with compact `@eN` refs. Use it for any browser task: verify a UI change, take a screenshot, walk a page, fill a form, extract page text, reproduce a frontend bug, or attach UI evidence to a PR, issue, Linear comment, or Slack thread.
+
+Do not use `qa-use`. It is not installed in the worker image any more.
+
+## Step 0: check that the CLI is present
+
+The full worker image (`agent-swarm-worker:latest`) ships `agent-browser` and a headless Chromium. The slim image (`:slim`) has neither. The first command of any browser work is:
+
+```bash
+command -v agent-browser
+```
+
+If it prints nothing, you are on the slim image. Say so in your progress report ("agent-browser is not available on this worker image") and fall back to manual QA: write the exact steps a human should run and mark the browser test cases as **Blocked**, not failed. Do not install a browser or the CLI yourself.
+
+## Step 1: load the version-matched guide
+
+The CLI bundles its own usage guide. Load it once per task before the first browser command. Do not guess flags from memory.
+
+```bash
+agent-browser skills get core          # overview + common patterns
+agent-browser skills get core --full   # adds the full command reference
+agent-browser skills list              # specialized guides (dogfood, electron, slack, ...)
+```
+
+## Step 2: the core loop
+
+```bash
+agent-browser open <url>
+agent-browser snapshot -i              # accessibility tree, interactive elements only, @eN refs
+agent-browser click @e12               # act on refs from the snapshot
+agent-browser fill @e7 "text"
+agent-browser screenshot /tmp/<name>.png
+agent-browser close
+```
+
+- Re-run `snapshot` after every navigation or state change. Refs are only valid for the snapshot that produced them.
+- Run one browser session at a time. Call `store-progress` between page batches so the heartbeat watchdog sees you.
+- The browser is headless. Local servers inside the worker container are reachable at `http://localhost:<port>`.
+- The image launches Chromium with `--no-sandbox,--disable-dev-shm-usage` through `AGENT_BROWSER_ARGS`. If you pass your own `--args`, include `--no-sandbox` again or Chrome will not start.
+
+## Recording
+
+Default: record with `--cursor`, drive every supported pointer action (`click`, `mouse move`, `drag`) with `--human`, and ship the **1.5x video**. Keep the 1x original only if a reviewer asks for it. Human pointer movement follows an eased curve; use `--seed <n>` on `mouse move` to make the take reproducible instead of using a bare move.
+
+Open the page first, then record the interaction:
+
+```bash
+agent-browser record start ./in.mp4 --cursor
+agent-browser snapshot -i
+agent-browser mouse move 600 400 --human --seed 42 --duration 1400
+agent-browser click @e3 --human          # use a ref from the current snapshot
+# Perform the remaining QA steps; use --human for drag actions too.
+agent-browser record stop
+ffmpeg -y -i in.mp4 -filter:v "setpts=PTS/1.5,fps=30" -an \
+  -c:v libx264 -preset veryfast -crf 23 -pix_fmt yuv420p out-1.5x.mp4
+```
+
+Speed-up is a post-process step: `record start` has no speed or human flag. Keep `fps=30` to preserve a steady 30 fps output rather than uneven frame drops at an inferred rate. `-an` disables audio because agent-browser recordings carry no audio track. The worker ships only `ffmpeg`, not `ffprobe`; inspect duration with `ffmpeg -i out-1.5x.mp4 2>&1 | grep Duration`.
+
+Add `--contact-sheet` to the start command for a timestamped PNG summary of visual changes. Recording needs `ffmpeg` on PATH; check `agent-browser doctor` before starting. Stop the recording before closing the browser so the video is saved. Upload the 1.5x file through the same agent-fs QA path and signed-URL steps as screenshots below, and link it in the PR body.
+
+## Step 3: share the screenshot through agent-fs
+
+Screenshots on the worker disk disappear with the task. Upload them to agent-fs under the qa path convention and share the signed URL. `--file` is binary-safe. `--content` is text-only and mangles PNGs.
+
+```bash
+agent-fs write thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png \
+  --file /tmp/<name>.png -m "<what it shows>"
+agent-fs stat thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json        # confirm size > 0
+agent-fs signed-url thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json  # 24h default, --expires-in up to 7d
+```
+
+- Embed the URL as `![caption](<url>)` in the PR body, review comment, Linear comment, or Slack message.
+- In `store-progress`, list the upload in the `attachments` field with `kind: "agent-fs"` and the path, and paste the signed URL in the progress text.
+- If `agent-fs auth whoami` fails, report the local path, say the upload was skipped, and continue.
+
+The `artifacts` skill holds the full agent-fs recipe and the naming conventions.

package/templates/skills/agent-browser/content.md

@@ -40,6 +40,27 @@ agent-browser close
 - The browser is headless. Local servers inside the worker container are reachable at `http://localhost:<port>`.
 - The image launches Chromium with `--no-sandbox,--disable-dev-shm-usage` through `AGENT_BROWSER_ARGS`. If you pass your own `--args`, include `--no-sandbox` again or Chrome will not start.
 
+## Recording
+
+Default: record with `--cursor`, drive every supported pointer action (`click`, `mouse move`, `drag`) with `--human`, and ship the **1.5x video**. Keep the 1x original only if a reviewer asks for it. Human pointer movement follows an eased curve; use `--seed <n>` on `mouse move` to make the take reproducible instead of using a bare move.
+
+Open the page first, then record the interaction:
+
+```bash
+agent-browser record start ./in.mp4 --cursor
+agent-browser snapshot -i
+agent-browser mouse move 600 400 --human --seed 42 --duration 1400
+agent-browser click @e3 --human          # use a ref from the current snapshot
+# Perform the remaining QA steps; use --human for drag actions too.
+agent-browser record stop
+ffmpeg -y -i in.mp4 -filter:v "setpts=PTS/1.5,fps=30" -an \
+  -c:v libx264 -preset veryfast -crf 23 -pix_fmt yuv420p out-1.5x.mp4
+```
+
+Speed-up is a post-process step: `record start` has no speed or human flag. Keep `fps=30` to preserve a steady 30 fps output rather than uneven frame drops at an inferred rate. `-an` disables audio because agent-browser recordings carry no audio track. The worker ships only `ffmpeg`, not `ffprobe`; inspect duration with `ffmpeg -i out-1.5x.mp4 2>&1 | grep Duration`.
+
+Add `--contact-sheet` to the start command for a timestamped PNG summary of visual changes. Recording needs `ffmpeg` on PATH; check `agent-browser doctor` before starting. Stop the recording before closing the browser so the video is saved. Upload the 1.5x file through the same agent-fs QA path and signed-URL steps as screenshots below, and link it in the PR body.
+
 ## Step 3: share the screenshot through agent-fs
 
 Screenshots on the worker disk disappear with the task. Upload them to agent-fs under the qa path convention and share the signed URL. `--file` is binary-safe. `--content` is text-only and mangles PNGs.