@desplega.ai/agent-swarm 1.152.2 → 1.153.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.152.2",
+  "version": "1.153.0",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -188,14 +188,14 @@
     "@aws-sdk/client-bedrock": "3.1048.0",
     "@desplega.ai/business-use": "^0.4.2",
     "@desplega.ai/localtunnel": "^2.2.0",
-    "@earendil-works/pi-agent-core": "^0.85.1",
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
     "@inkjs/ui": "^2.0.0",
     "@linear/sdk": "^77.0.0",
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@openai/codex": "0.154.0",
-    "@opencode-ai/sdk": "^1.18.31",
+    "@openai/codex": "0.156.1",
+    "@opencode-ai/sdk": "^1.18.32",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",

package/src/be/automation-preflight.ts

@@ -1,4 +1,5 @@
 import type { AutomationIntegrationId, ScheduledTask, Workflow } from "@/types";
+import { getSlackConfiguration, isSlackConfigured } from "../slack/config";
 import { getDbClient } from "./db";
 import { getOAuthApp, getOAuthTokens } from "./db-queries/oauth";
 
@@ -281,11 +282,12 @@ export async function getAutomationSetupStates(): Promise<AutomationSetupStates>
     present(process.env.GSC_SERVICE_ACCOUNT_JSON);
 
   return {
+    // Credential presence is configuration evidence, not proof that inbound
+    // Slack traffic has been observed successfully.
+    // HTTP credentials alone cannot run Slack automations before its receiver lands.
     slack:
-      enabled(process.env.SLACK_DISABLE) &&
-      present(process.env.SLACK_BOT_TOKEN) &&
-      present(process.env.SLACK_APP_TOKEN)
-        ? "verified"
+      getSlackConfiguration().mode === "socket" && isSlackConfigured()
+        ? "configured"
         : "unverified",
     github:
       present(process.env.GITHUB_WEBHOOK_SECRET) &&

package/src/be/extensions/db.ts

@@ -20,8 +20,12 @@ export type InstallExtensionArgs = {
   createdBy?: string | null;
   activate?: boolean;
   changeReason?: string | null;
+  /** HTTP worker upserts must not claim another creator's name. */
+  ownerOnly?: string;
 };
 
+export class ExtensionOwnershipError extends Error {}
+
 export type InstallExtensionResult = {
   extension: Extension;
   isNew: boolean;
@@ -60,6 +64,19 @@ export async function installExtension(
       args.manifest.name,
     ]);
     const existing = existingRow ? rowToExtension(existingRow) : null;
+    if (existing && args.ownerOnly && existing.createdByAgentId !== args.ownerOnly) {
+      throw new ExtensionOwnershipError("Forbidden: extension belongs to another owner");
+    }
+    if (
+      existing?.enabled &&
+      args.ownerOnly &&
+      ((args.config !== undefined && JSON.stringify(args.config) !== existing.configJson) ||
+        (args.priority !== undefined && args.priority !== existing.priority))
+    ) {
+      throw new ExtensionOwnershipError(
+        "Forbidden: only a lead or operator may change live extension configuration",
+      );
+    }
     const now = new Date().toISOString();
 
     if (!existing) {
@@ -313,6 +330,7 @@ export async function updateExtensionMeta(
     config?: Record<string, unknown>;
     description?: string;
     updatedBy?: string | null;
+    ownerOnly?: string;
   },
 ): Promise<Extension | null> {
   const sets: string[] = [];
@@ -329,14 +347,21 @@ export async function updateExtensionMeta(
     sets.push("description = ?");
     values.push(args.description);
   }
-  if (sets.length === 0) return getExtensionById(id);
+  if (sets.length === 0 && !args.ownerOnly) return getExtensionById(id);
 
   sets.push("updated_by = ?", "updatedAt = ?");
   values.push(args.updatedBy ?? null, new Date().toISOString(), id);
+  // The enabled check must be part of the write: a lead may enable the draft
+  // after the HTTP handler has authorized it but before this UPDATE executes.
+  const ownerCondition = args.ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : "";
+  if (args.ownerOnly) values.push(args.ownerOnly);
   const row = await getDbClient().get<ExtensionRow>(
-    `UPDATE extensions SET ${sets.join(", ")} WHERE id = ? RETURNING *`,
+    `UPDATE extensions SET ${sets.join(", ")} WHERE id = ?${ownerCondition} RETURNING *`,
     values,
   );
+  if (!row && args.ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return row ? rowToExtension(row) : null;
 }
 
@@ -401,8 +426,14 @@ export async function recordExtensionFailure(
   return row ? rowToExtension(row) : null;
 }
 
-export async function deleteExtension(id: string): Promise<boolean> {
-  const result = await getDbClient().run("DELETE FROM extensions WHERE id = ?", [id]);
+export async function deleteExtension(id: string, ownerOnly?: string): Promise<boolean> {
+  const result = await getDbClient().run(
+    `DELETE FROM extensions WHERE id = ?${ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : ""}`,
+    ownerOnly ? [id, ownerOnly] : [id],
+  );
+  if (result.changes === 0 && ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return result.changes > 0;
 }
 

package/src/be/models-catalog.ts

@@ -34,6 +34,8 @@ export type CatalogProviderId = (typeof CATALOG_PROVIDER_IDS)[number];
  * of the picker between models.dev listing gaps.
  */
 export const PINNED_MODELSDEV_ENTRIES = [
+  // Official launch metadata; retain until models.dev catches up. Verified 2026-09-22.
+  "anthropic/claude-opus-5-5",
   "anthropic/claude-mythos-5",
   "anthropic/claude-sonnet-5",
   "amazon-bedrock/anthropic.claude-sonnet-5",

package/src/be/modelsdev-cache.json

@@ -147175,6 +147175,33 @@
     "name": "Anthropic",
     "doc": "https://docs.anthropic.com/en/docs/about-claude/models",
     "models": {
+      "claude-opus-5-5": {
+        "id": "claude-opus-5-5",
+        "name": "Claude Opus 5.5",
+        "reasoning": true,
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "low",
+              "medium",
+              "high",
+              "xhigh",
+              "max"
+            ]
+          }
+        ],
+        "cost": {
+          "input": 4,
+          "output": 20,
+          "cache_read": 0.2,
+          "cache_write": 5
+        },
+        "limit": {
+          "context": 1000000,
+          "output": 128000
+        }
+      },
       "claude-sonnet-4-6": {
         "id": "claude-sonnet-4-6",
         "name": "Claude Sonnet 4.6",
@@ -285334,6 +285361,192 @@
           "output": 40,
           "cache_read": 2.5
         }
+      },
+      "gpt-6-sol": {
+        "id": "gpt-6-sol",
+        "name": "GPT-6 Sol",
+        "description": "OpenAI model for complex coding and agentic workflows",
+        "family": "gpt-sol",
+        "attachment": true,
+        "reasoning": true,
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "none",
+              "low",
+              "medium",
+              "high",
+              "xhigh",
+              "max"
+            ]
+          }
+        ],
+        "tool_call": true,
+        "structured_output": true,
+        "temperature": false,
+        "knowledge": "2026-04-20",
+        "release_date": "2026-09-22",
+        "last_updated": "2026-09-22",
+        "modalities": {
+          "input": [
+            "text",
+            "image",
+            "pdf"
+          ],
+          "output": [
+            "text"
+          ]
+        },
+        "open_weights": false,
+        "limit": {
+          "context": 1050000,
+          "input": 922000,
+          "output": 128000
+        },
+        "experimental": {
+          "modes": {
+            "fast": {
+              "cost": {
+                "input": 4,
+                "output": 20,
+                "cache_read": 0.4,
+                "cache_write": 5
+              },
+              "provider": {
+                "body": {
+                  "service_tier": "priority"
+                }
+              }
+            },
+            "pro": {
+              "provider": {
+                "body": {
+                  "reasoning": {
+                    "mode": "pro"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "cost": {
+          "input": 2,
+          "output": 10,
+          "cache_read": 0.2,
+          "cache_write": 2.5,
+          "tiers": [
+            {
+              "input": 4,
+              "output": 15,
+              "cache_read": 0.4,
+              "cache_write": 5,
+              "tier": {
+                "type": "context",
+                "size": 272000
+              }
+            }
+          ],
+          "context_over_200k": {
+            "input": 4,
+            "output": 15,
+            "cache_read": 0.4,
+            "cache_write": 5
+          }
+        }
+      },
+      "gpt-6-luna": {
+        "id": "gpt-6-luna",
+        "name": "GPT-6 Luna",
+        "description": "OpenAI's most efficient model for focused, high-volume tasks",
+        "family": "gpt-luna",
+        "attachment": true,
+        "reasoning": true,
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "none",
+              "low",
+              "medium",
+              "high",
+              "xhigh",
+              "max"
+            ]
+          }
+        ],
+        "tool_call": true,
+        "structured_output": true,
+        "temperature": false,
+        "knowledge": "2026-05-18",
+        "release_date": "2026-09-22",
+        "last_updated": "2026-09-22",
+        "modalities": {
+          "input": [
+            "text",
+            "image",
+            "pdf"
+          ],
+          "output": [
+            "text"
+          ]
+        },
+        "open_weights": false,
+        "limit": {
+          "context": 1050000,
+          "input": 922000,
+          "output": 128000
+        },
+        "experimental": {
+          "modes": {
+            "fast": {
+              "cost": {
+                "input": 0.2,
+                "output": 1,
+                "cache_read": 0.02,
+                "cache_write": 0.25
+              },
+              "provider": {
+                "body": {
+                  "service_tier": "priority"
+                }
+              }
+            },
+            "pro": {
+              "provider": {
+                "body": {
+                  "reasoning": {
+                    "mode": "pro"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "cost": {
+          "input": 0.1,
+          "output": 0.5,
+          "cache_read": 0.01,
+          "cache_write": 0.125,
+          "tiers": [
+            {
+              "input": 0.2,
+              "output": 0.75,
+              "cache_read": 0.02,
+              "cache_write": 0.25,
+              "tier": {
+                "type": "context",
+                "size": 272000
+              }
+            }
+          ],
+          "context_over_200k": {
+            "input": 0.2,
+            "output": 0.75,
+            "cache_read": 0.02,
+            "cache_write": 0.25
+          }
+        }
       }
     }
   },

package/src/be/rbac-audit.ts

@@ -74,6 +74,8 @@ function resourceIdOf(resource: RbacCheck["resource"]): string | null {
       return resource.agentId;
     case "kv-namespace":
       return resource.namespace;
+    case "extension":
+      return resource.extensionId ?? null;
     case "app":
       return resource.appId;
     case "owned":

package/src/be/seed-pricing.ts

@@ -89,13 +89,15 @@ const MANUAL_PRICING_OVERRIDES: Array<{
 const ANTHROPIC_SHORTNAME_TO_MODELSDEV: Record<string, string> = {
   fable: "claude-fable-5-1",
   mythos: "claude-mythos-5-1",
-  opus: "claude-opus-5",
+  opus: "claude-opus-5-5",
   sonnet: "claude-sonnet-5",
   haiku: "claude-haiku-4-5",
 };
 
 /** Official rates used until a newly released model reaches the vendored models.dev snapshot. */
 const ANTHROPIC_SHORTNAME_PRICING_FALLBACKS: Record<string, ModelsDevCostBlock> = {
+  // https://platform.claude.com/docs/en/about-claude/pricing (verified 2026-09-22)
+  "claude-opus-5-5": { input: 4, output: 20, cache_read: 0.2, cache_write: 5 },
   "claude-fable-5-1": { input: 10, output: 50, cache_read: 0.25, cache_write: 12.5 },
   "claude-mythos-5-1": { input: 10, output: 50, cache_read: 0.25, cache_write: 12.5 },
 };

package/src/be/swarm-config-guard.ts

@@ -290,6 +290,7 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
     "DB_QUERY_BOUNDED_ENABLED",
     "DB_RETENTION_DRY_RUN",
   ]),
+  ...enumValidator("SLACK_MODE", ["socket", "http"]),
   ...enumValidator("SLACK_THREAD_STEERING", ["off", "lead", "all"]),
   ...enumValidator("SLACK_THREAD_STEERING_MODE", ["steer", "queue"]),
   ...shortcodeValidators([

package/src/commands/onboard/compose-generator.ts

@@ -23,6 +23,10 @@ const ENV_SLACK_BOT_TOKEN = "      - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN}";
 // biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
 const ENV_SLACK_APP_TOKEN = "      - SLACK_APP_TOKEN=${SLACK_APP_TOKEN}";
 // biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
+const ENV_SLACK_SIGNING_SECRET = "      - SLACK_SIGNING_SECRET=${SLACK_SIGNING_SECRET}";
+// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
+const ENV_SLACK_MODE = "      - SLACK_MODE=${SLACK_MODE:-socket}";
+// biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
 const ENV_CLAUDE_OAUTH = "      - CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN}";
 // biome-ignore lint/suspicious/noTemplateCurlyInString: Docker Compose env var syntax
 const ENV_ANTHROPIC_KEY = "      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}";
@@ -142,8 +146,9 @@ export function generateCompose(state: OnboardState): string {
 
   if (state.integrations.slack) {
     lines.push("      - SLACK_DISABLE=false");
+    lines.push(ENV_SLACK_MODE);
     lines.push(ENV_SLACK_BOT_TOKEN);
-    lines.push(ENV_SLACK_APP_TOKEN);
+    lines.push(state.slackMode === "http" ? ENV_SLACK_SIGNING_SECRET : ENV_SLACK_APP_TOKEN);
   }
 
   if (state.integrations.github) {

package/src/commands/onboard/env-generator.ts

@@ -92,8 +92,13 @@ export function generateEnv(state: OnboardState): string {
   if (state.integrations.slack) {
     lines.push("");
     lines.push("# Slack");
+    lines.push(`SLACK_MODE=${state.slackMode}`);
     lines.push(`SLACK_BOT_TOKEN=${state.slackBotToken}`);
-    lines.push(`SLACK_APP_TOKEN=${state.slackAppToken}`);
+    if (state.slackMode === "http") {
+      lines.push(`SLACK_SIGNING_SECRET=${state.slackSigningSecret}`);
+    } else {
+      lines.push(`SLACK_APP_TOKEN=${state.slackAppToken}`);
+    }
     lines.push("SLACK_DISABLE=false");
   } else {
     lines.push("SLACK_DISABLE=true");

package/src/commands/onboard/manifest.ts

@@ -32,6 +32,7 @@ export function generateManifest(state: OnboardState): object {
       gitlab: state.integrations.gitlab,
       sentry: state.integrations.sentry,
     },
+    slackMode: state.slackMode,
     composePath: "./docker-compose.yml",
     envPath: "./.env",
     apiUrl: `http://localhost:${state.apiPort || 3013}`,

package/src/commands/onboard/steps/integration-slack.tsx

@@ -1,9 +1,10 @@
 import { Select, TextInput } from "@inkjs/ui";
 import { Box, Text } from "ink";
 import { useState } from "react";
+import type { SlackMode } from "../../../slack/config.ts";
 import type { StepProps } from "../types.ts";
 
-type SubStep = "manifest_options" | "app_created" | "bot_token" | "app_token";
+type SubStep = "manifest_options" | "app_created" | "mode" | "bot_token" | "credential";
 
 const MANIFEST_URL =
   "https://raw.githubusercontent.com/desplega-ai/agent-swarm/main/slack-manifest.json";
@@ -21,6 +22,7 @@ export function IntegrationSlackStep({ goToNext }: StepProps) {
   const [subStep, setSubStep] = useState<SubStep>("manifest_options");
   const [copied, setCopied] = useState(false);
   const [botToken, setBotToken] = useState("");
+  const [mode, setMode] = useState<SlackMode>("socket");
   const [error, setError] = useState("");
 
   return (
@@ -53,7 +55,7 @@ export function IntegrationSlackStep({ goToNext }: StepProps) {
                   setCopied(false);
                   setSubStep("app_created");
                 } else {
-                  setSubStep("bot_token");
+                  setSubStep("mode");
                 }
               }}
             />
@@ -89,7 +91,28 @@ export function IntegrationSlackStep({ goToNext }: StepProps) {
           <Box marginTop={1}>
             <Select
               options={[{ label: "Continue — I've created the app", value: "continue" }]}
-              onChange={() => setSubStep("bot_token")}
+              onChange={() => setSubStep("mode")}
+            />
+          </Box>
+        </Box>
+      )}
+
+      {subStep === "mode" && (
+        <Box marginTop={1} flexDirection="column">
+          <Text>Select the Slack transport:</Text>
+          <Box marginTop={1}>
+            <Select
+              options={[
+                { label: "Socket Mode (default)", value: "socket" },
+                {
+                  label: "HTTP (configuration only; receiver not installed yet)",
+                  value: "http",
+                },
+              ]}
+              onChange={(value) => {
+                setMode(value as SlackMode);
+                setSubStep("bot_token");
+              }}
             />
           </Box>
         </Box>
@@ -118,42 +141,59 @@ export function IntegrationSlackStep({ goToNext }: StepProps) {
                 }
                 setError("");
                 setBotToken(trimmed);
-                setSubStep("app_token");
+                setSubStep("credential");
               }}
             />
           </Box>
         </Box>
       )}
 
-      {subStep === "app_token" && (
+      {subStep === "credential" && (
         <Box marginTop={1} flexDirection="column">
           <Text dimColor>Bot Token: {botToken.slice(0, 10)}...</Text>
           <Box marginTop={1} flexDirection="column">
-            <Text>
-              Find your App-Level Token under <Text bold>Basic Information → App-Level Tokens</Text>
-              .
-            </Text>
-            <Text dimColor>Create one with connections:write scope if you don't have one.</Text>
+            {mode === "socket" ? (
+              <>
+                <Text>
+                  Find your App-Level Token under{" "}
+                  <Text bold>Basic Information → App-Level Tokens</Text>.
+                </Text>
+                <Text dimColor>Create one with connections:write scope if you don't have one.</Text>
+              </>
+            ) : (
+              <Text>
+                Find your Signing Secret under <Text bold>Basic Information → App Credentials</Text>
+                .
+              </Text>
+            )}
           </Box>
           <Box marginTop={1} flexDirection="column">
-            <Text bold>App Token (SLACK_APP_TOKEN):</Text>
+            <Text bold>
+              {mode === "socket"
+                ? "App Token (SLACK_APP_TOKEN):"
+                : "Signing Secret (SLACK_SIGNING_SECRET):"}
+            </Text>
             <TextInput
-              key="slack-app-token"
-              placeholder="xapp-..."
+              key={`slack-${mode}-credential`}
+              placeholder={mode === "socket" ? "xapp-..." : "signing secret"}
               onSubmit={(value) => {
                 const trimmed = value.trim();
                 if (!trimmed) {
-                  setError("App token is required. Please enter it above.");
+                  setError(
+                    `${mode === "socket" ? "App token" : "Signing secret"} is required. Please enter it above.`,
+                  );
                   return;
                 }
-                if (!trimmed.startsWith("xapp-")) {
+                if (mode === "socket" && !trimmed.startsWith("xapp-")) {
                   setError("App token should start with xapp- — please check and re-enter.");
                   return;
                 }
                 setError("");
                 goToNext({
                   slackBotToken: botToken,
-                  slackAppToken: trimmed,
+                  slackMode: mode,
+                  slackAppToken: mode === "socket" ? trimmed : "",
+                  slackSigningSecret: mode === "http" ? trimmed : "",
                 });
               }}
             />

package/src/commands/onboard/steps/review.tsx

@@ -51,6 +51,11 @@ export function ReviewStep({ state, dryRun, goToNext, goToStep }: StepProps) {
             {enabledIntegrations.length > 0 ? enabledIntegrations.join(", ") : "none"}
           </Text>
         </Text>
+        {state.integrations.slack ? (
+          <Text>
+            Slack transport: <Text color="cyan">{state.slackMode}</Text>
+          </Text>
+        ) : null}
         <Text>
           Output directory: <Text color="cyan">{state.outputDir}</Text>
         </Text>

package/src/commands/onboard/types.ts

@@ -1,3 +1,5 @@
+import type { SlackMode } from "../../slack/config";
+
 export type OnboardStep =
   | "welcome"
   | "deploy_type"
@@ -79,6 +81,8 @@ export interface OnboardState {
   githubName: string;
   slackBotToken: string;
   slackAppToken: string;
+  slackSigningSecret: string;
+  slackMode: SlackMode;
   gitlabToken: string;
   gitlabEmail: string;
   sentryToken: string;
@@ -192,6 +196,8 @@ export const INITIAL_STATE: OnboardState = {
   githubName: "",
   slackBotToken: "",
   slackAppToken: "",
+  slackSigningSecret: "",
+  slackMode: "socket",
   gitlabToken: "",
   gitlabEmail: "",
   sentryToken: "",

package/src/commands/onboard.tsx

@@ -3,6 +3,7 @@ import { Select } from "@inkjs/ui";
 import { Box, Text, useApp, useInput } from "ink";
 import { useCallback, useEffect, useRef, useState } from "react";
 import pkg from "../../package.json";
+import { getSlackConfiguration, isSlackConfigured } from "../slack/config.ts";
 import { getApiKey } from "../utils/api-key.ts";
 import { buildOnboardDashboardUrl } from "./onboard/dashboard-url.ts";
 import {
@@ -189,9 +190,10 @@ export function Onboard({
       }
     }
 
+    const slackConfig = getSlackConfiguration(process.env);
     const integrations = {
       github: !!process.env.GITHUB_TOKEN,
-      slack: !!process.env.SLACK_BOT_TOKEN,
+      slack: isSlackConfigured(process.env),
       gitlab: !!process.env.GITLAB_TOKEN,
       sentry: !!process.env.SENTRY_AUTH_TOKEN,
     };
@@ -223,6 +225,8 @@ export function Onboard({
       githubName: process.env.GITHUB_NAME || "",
       slackBotToken: process.env.SLACK_BOT_TOKEN || "",
       slackAppToken: process.env.SLACK_APP_TOKEN || "",
+      slackSigningSecret: process.env.SLACK_SIGNING_SECRET || "",
+      slackMode: slackConfig.mode ?? "socket",
       gitlabToken: process.env.GITLAB_TOKEN || "",
       gitlabEmail: process.env.GITLAB_EMAIL || "",
       sentryToken: process.env.SENTRY_AUTH_TOKEN || "",