@desplega.ai/agent-swarm 1.152.0 → 1.152.2

package/dist/{onboard-fv7ezvwx.js → onboard-br5j1kch.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-wp7cejrg.js";
+} from "./cli-jbmc0r7r.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-s2qjdd6z.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-jh9txj4n.js";
+} from "./cli-zvkq5csn.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-6vbb568y.js → otel-impl-vdqge2nt.js}

@@ -4,7 +4,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-jh9txj4n.js";
+} from "./cli-zvkq5csn.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{pricing-refresh-nmm949an.js → pricing-refresh-hb3691fd.js}

@@ -2,9 +2,9 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-5bqt4gwa.js";
-import"./cli-zdcdh02m.js";
-import"./cli-gacq5hg8.js";
+} from "./cli-b9dd0h3k.js";
+import"./cli-2nnd56zt.js";
+import"./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -12,7 +12,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{rbac-roles-0fz5qryx.js → rbac-roles-jh280k9g.js}

@@ -7,9 +7,9 @@ import {
   getUserGrant,
   listUserRoles,
   runRbacCliCommand
-} from "./cli-t6axtdcg.js";
+} from "./cli-r84ctdxn.js";
 import"./cli-zfzznn7c.js";
-import"./cli-gacq5hg8.js";
+import"./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -17,7 +17,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{rbac-roles-xtp05syf.js → rbac-roles-t78xt39b.js}

@@ -5,7 +5,7 @@ import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-gacq5hg8.js";
+} from "./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -16,7 +16,7 @@ import {
 } from "./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{render-v2-fpb8whme.js → render-v2-7p8r2ymg.js}

@@ -9,11 +9,11 @@ import {
   processSlackRenderV2,
   renderThreadTree,
   streamOutcomeCard
-} from "./cli-cwvey7n1.js";
+} from "./cli-qn042eh7.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
 import"./cli-2658f6at.js";
-import"./cli-gacq5hg8.js";
+import"./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -21,7 +21,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-zf8jjwex.js";

package/dist/{seed-pricing-zwa8bs3t.js → seed-pricing-hf889enh.js}

@@ -2,8 +2,8 @@ import {
   buildModelsDevSeedRows,
   buildPricingSeedRows,
   seedPricingFromModelsDev
-} from "./cli-zdcdh02m.js";
-import"./cli-gacq5hg8.js";
+} from "./cli-2nnd56zt.js";
+import"./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -11,7 +11,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{setup-3ybwbdpd.js → setup-w6mb03jv.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-wp7cejrg.js";
+} from "./cli-jbmc0r7r.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-s2qjdd6z.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import {
   Box_default,
   Spinner,

package/dist/{work-objects-rmayxcx7.js → work-objects-nt8gy1kj.js}

@@ -1,34 +1,34 @@
 import {
   isUserAllowed
-} from "./cli-5p007m2q.js";
-import"./cli-4fqn2vpg.js";
-import"./cli-awb59f08.js";
-import"./cli-72vksk1n.js";
+} from "./cli-ckz5t2hb.js";
+import"./cli-jvy9qgjs.js";
+import"./cli-3bpzj8me.js";
+import"./cli-z3wkng35.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-5bqt4gwa.js";
-import"./cli-t6axtdcg.js";
+import"./cli-b9dd0h3k.js";
+import"./cli-r84ctdxn.js";
 import"./cli-zfzznn7c.js";
-import"./cli-p2hx1pxm.js";
+import"./cli-fmy65jdn.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-cs9z1hw3.js";
-import"./cli-zdcdh02m.js";
+import"./cli-56h18ng2.js";
+import"./cli-2nnd56zt.js";
 import"./cli-bsakbbkm.js";
-import"./cli-nd5s3m4y.js";
+import"./cli-gpqcs935.js";
 import"./cli-51tf7ac3.js";
 import {
   getTaskUrl,
   slackTaskOutput
-} from "./cli-cwvey7n1.js";
+} from "./cli-qn042eh7.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-evgy5w3y.js";
+import"./cli-jew3jda5.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
@@ -37,7 +37,7 @@ import {
   getAgentById,
   getTaskById,
   init_db
-} from "./cli-gacq5hg8.js";
+} from "./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -48,7 +48,7 @@ import {
 } from "./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/dist/{worker-rng4jhnh.js → worker-dwy617t0.js}

@@ -1,16 +1,16 @@
 import {
   runAgent
-} from "./cli-t1mykkng.js";
+} from "./cli-qd65dvr6.js";
 import"./cli-pgj4a5fb.js";
 import"./cli-kj76p1ez.js";
 import"./cli-9b13ggd1.js";
 import"./cli-d3p82erb.js";
-import"./cli-8fy9dmpv.js";
-import"./cli-f1f9n77e.js";
+import"./cli-xw7vak96.js";
+import"./cli-4ahpr4sw.js";
 import"./cli-wbyk465z.js";
 import"./cli-tng3131n.js";
 import"./cli-5bfdm1ah.js";
-import"./cli-87hdfyde.js";
+import"./cli-xy1cchaf.js";
 import"./cli-hsxj0yar.js";
 import"./cli-r94z9p1z.js";
 import"./cli-b5b30yzk.js";
@@ -25,34 +25,34 @@ import"./cli-eree7rnv.js";
 import"./cli-4yc5d8fk.js";
 import {
   getEnabledCapabilities
-} from "./cli-72vksk1n.js";
+} from "./cli-z3wkng35.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-5bqt4gwa.js";
-import"./cli-t6axtdcg.js";
+import"./cli-b9dd0h3k.js";
+import"./cli-r84ctdxn.js";
 import"./cli-zfzznn7c.js";
-import"./cli-p2hx1pxm.js";
+import"./cli-fmy65jdn.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-cs9z1hw3.js";
-import"./cli-zdcdh02m.js";
+import"./cli-56h18ng2.js";
+import"./cli-2nnd56zt.js";
 import"./cli-bsakbbkm.js";
-import"./cli-nd5s3m4y.js";
+import"./cli-gpqcs935.js";
 import"./cli-51tf7ac3.js";
-import"./cli-cwvey7n1.js";
+import"./cli-qn042eh7.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-evgy5w3y.js";
+import"./cli-jew3jda5.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-gacq5hg8.js";
+import"./cli-zvgj5zg8.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -60,7 +60,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-jh9txj4n.js";
+import"./cli-zvkq5csn.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.152.0",
+    "version": "1.152.2",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -46581,7 +46581,7 @@
             }
           },
           "503": {
-            "description": "AgentMail integration not configured",
+            "description": "AgentMail integration not configured or inbound archive unavailable",
             "content": {
               "application/json": {
                 "schema": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.152.0",
+  "version": "1.152.2",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",

package/src/agentmail/inbound-archive.ts

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+import { claimKv, sweepExpiredKv } from "../be/db";
+import { scrubSecrets } from "../utils/secret-scrubber";
+import type { AgentMailWebhookPayload } from "./types";
+
+export const INBOUND_ARCHIVE_NAMESPACE = "agentmail-inbound";
+export const INBOUND_ARCHIVE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const text = (value: unknown, limit: number) =>
+  typeof value === "string" ? scrubSecrets(value).slice(0, limit) : "";
+
+export const inboundArchiveKey = (inboxId: string, messageId: string) =>
+  createHash("sha256")
+    .update(JSON.stringify([inboxId, messageId]))
+    .digest("hex");
+
+/** Persist verified deliveries before ACK, independent of task-routing filters.
+ * One minimized entry per message for 30 days from capture. Live retries preserve
+ * the first delivery and its expiry; a replay after expiry starts a new window.
+ * This is a delivery archive, not proof of historical completeness.
+ */
+export async function archiveInboundMessage(payload: AgentMailWebhookPayload): Promise<void> {
+  if (
+    ![
+      "message.received",
+      "message.received.unauthenticated",
+      "message.received.blocked",
+      "message.received.spam",
+    ].includes(payload.event_type)
+  )
+    return;
+  const message = payload.message;
+  if (!message?.inbox_id || !message.message_id || !message.thread_id) {
+    throw new Error("Inbound webhook missing inbox, message or thread ID");
+  }
+  const now = Date.now();
+  // Remove expired payloads on traffic as well as the KV point-read lazy sweep.
+  await sweepExpiredKv(INBOUND_ARCHIVE_NAMESPACE, now);
+  const minimized = {
+    event_type: payload.event_type,
+    message: {
+      inbox_id: message.inbox_id,
+      message_id: message.message_id,
+      thread_id: message.thread_id,
+      from_: text(Array.isArray(message.from_) ? message.from_.join(", ") : message.from_, 1500),
+      reply_to: Array.isArray(message.reply_to)
+        ? message.reply_to.slice(0, 20).map((value) => text(value, 1500))
+        : undefined,
+      subject: text(message.subject, 300),
+      text: text(message.text, 16000),
+      html: text(message.html, 16000),
+      timestamp: text(message.timestamp || message.created_at, 100),
+      labels: Array.isArray(message.labels)
+        ? message.labels.filter((label) => label === "unauthenticated")
+        : [],
+      attachments: Array.isArray(message.attachments)
+        ? message.attachments.map((attachment) => ({
+            filename: text(attachment.filename, 1500),
+            content_type: text(attachment.content_type, 200),
+            size: typeof attachment.size === "number" ? attachment.size : null,
+          }))
+        : undefined,
+    },
+  };
+  await claimKv({
+    namespace: INBOUND_ARCHIVE_NAMESPACE,
+    key: inboundArchiveKey(message.inbox_id, message.message_id),
+    value: { version: 1, capturedAt: new Date(now).toISOString(), payload: minimized },
+    expiresAt: now + INBOUND_ARCHIVE_TTL_MS,
+    valueType: "json",
+  });
+}

package/src/agentmail/types.ts

@@ -44,6 +44,8 @@ export interface AgentMailWebhookPayload {
 export type AgentMailEventType =
   | "message.received"
   | "message.received.unauthenticated"
+  | "message.received.blocked"
+  | "message.received.spam"
   | "message.sent"
   | "message.delivered"
   | "message.bounced"

package/src/http/webhooks.ts

@@ -8,6 +8,7 @@ import {
   isSenderAllowed,
   verifyAgentMailWebhook,
 } from "../agentmail";
+import { archiveInboundMessage } from "../agentmail/inbound-archive";
 import type {
   CheckRunEvent,
   CheckSuiteEvent,
@@ -109,7 +110,7 @@ const agentmailWebhook = route({
   responses: {
     200: { description: "Event received", schema: z.object({ received: z.literal(true) }) },
     401: { description: "Invalid signature" },
-    503: { description: "AgentMail integration not configured" },
+    503: { description: "AgentMail integration not configured or inbound archive unavailable" },
   },
 });
 
@@ -486,11 +487,18 @@ export async function handleWebhooks(
       return true;
     }
 
-    // Return 200 immediately — Svix best practice to avoid retries.
-    // Processing happens asynchronously below; dedup is handled in handlers.ts.
-    agentmailWebhook.respond(res, 200, { received: true });
-
     const payload = verified as AgentMailWebhookPayload;
+    try {
+      await archiveInboundMessage(payload);
+    } catch (err) {
+      console.error("[AgentMail] Inbound archive failed; requesting webhook retry", err);
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Inbound archive unavailable" }));
+      return true;
+    }
+    // Only acknowledge received events after durable capture. Task routing below
+    // remains independent: rejected senders and routing failures stay discoverable.
+    agentmailWebhook.respond(res, 200, { received: true });
 
     if (
       payload.message &&

package/src/slack/assistant.ts

@@ -129,7 +129,15 @@ export function createAssistant(): Assistant {
 
         // Follow-up message → buffer text and file metadata until the flush.
         if (workingAgent && workingAgent.status !== "offline" && isAdditiveSlack()) {
-          bufferThreadMessage(channelId, threadTs, messageText, userId, message.ts, files);
+          bufferThreadMessage(
+            channelId,
+            threadTs,
+            messageText,
+            userId,
+            message.ts,
+            files,
+            cachedBotUserId ?? undefined,
+          );
           const count = getBufferMessageCount(`${channelId}:${threadTs}`);
           const event = count === 1 ? "accepted" : "buffered";
           await ackSlackMessage(client, channelId, message.ts, reactionName(event), event);
@@ -147,6 +155,7 @@ export function createAssistant(): Assistant {
         // raw `messageText`, not this rendered copy.
         const renderedMessageText = await rewriteSlackMentions(
           buildEffectiveText(messageText, inbound.files, inbound.failed),
+          cachedBotUserId ?? undefined,
         );
 
         if (workingAgent && workingAgent.status !== "offline") {

package/src/slack/handlers.ts

@@ -523,7 +523,15 @@ export function registerMessageHandler(app: App): void {
         );
 
         if (nowMessage || msg.files?.length) {
-          bufferThreadMessage(msg.channel, msg.thread_ts, nowMessage, msg.user, msg.ts, msg.files);
+          bufferThreadMessage(
+            msg.channel,
+            msg.thread_ts,
+            nowMessage,
+            msg.user,
+            msg.ts,
+            msg.files,
+            botUserId,
+          );
         }
 
         // Instant flush — no dependency
@@ -563,6 +571,7 @@ export function registerMessageHandler(app: App): void {
           msg.user,
           msg.ts,
           msg.files,
+          botUserId,
         );
 
         // Slack feedback: react with the accepted reaction on first buffer, buffered on appends

package/src/slack/thread-buffer.ts

@@ -30,6 +30,7 @@ interface BufferedMessage {
   channelId: string;
   threadTs: string;
   files?: SlackFile[];
+  botUserId?: string;
 }
 
 const BUFFER_TIMEOUT_MS = Number(process.env.ADDITIVE_SLACK_BUFFER_MS) || 10_000;
@@ -62,6 +63,7 @@ export function bufferThreadMessage(
   userId: string,
   ts: string,
   files?: SlackFile[],
+  botUserId?: string,
 ): void {
   slackBuffer.enqueue(makeKey(channelId, threadTs), {
     text,
@@ -70,6 +72,7 @@ export function bufferThreadMessage(
     channelId,
     threadTs,
     files,
+    botUserId,
   });
 }
 
@@ -98,7 +101,11 @@ export async function instantFlush(key: string): Promise<void> {
 /**
  * Fetch thread context from Slack for the buffer flush task description.
  */
-async function getThreadContextForBuffer(channelId: string, threadTs: string): Promise<string> {
+async function getThreadContextForBuffer(
+  channelId: string,
+  threadTs: string,
+  botUserId?: string,
+): Promise<string> {
   const app = getSlackApp();
   if (!app) return "";
 
@@ -126,7 +133,7 @@ async function getThreadContextForBuffer(channelId: string, threadTs: string): P
       })
       .join("\n");
 
-    return await rewriteSlackMentions(formatted);
+    return await rewriteSlackMentions(formatted, botUserId);
   } catch (error) {
     console.error("[Slack] Failed to fetch thread context for buffer:", error);
     return "";
@@ -153,6 +160,9 @@ async function slackFlush(
   // Buffer is guaranteed to have at least one item — the first carries the
   // original requester's userId (same semantics as the pre-refactor version).
   const originalRequesterId = items[0]!.userId;
+  // Every buffered item is resolved from the same bot's auth.test() cache —
+  // any item carrying it is representative of the whole flush.
+  const botUserId = items.find((item) => item.botUserId)?.botUserId;
 
   console.log(`[Slack] Flushing buffer: ${key} (${items.length} messages, immediate=${immediate})`);
 
@@ -182,6 +192,7 @@ async function slackFlush(
         ),
       )
       .join("\n---\n"),
+    botUserId,
   );
   const description = `[Thread follow-up — ${items.length} message(s) buffered]\n\n${combinedText}`;
 
@@ -234,7 +245,7 @@ async function slackFlush(
   const lead = await getLeadAgent();
 
   // Thread context for the task
-  const threadContext = await getThreadContextForBuffer(channelId, threadTs);
+  const threadContext = await getThreadContextForBuffer(channelId, threadTs, botUserId);
   const fullDescription = threadContext
     ? `<thread_context>\n${threadContext}\n</thread_context>\n\n${description}`
     : description;