@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.152.2",
+    "version": "1.154.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -391,6 +391,10 @@
             "type": "boolean",
             "default": false
           },
+          "deferredAt": {
+            "type": "string",
+            "format": "date-time"
+          },
           "compactionCount": {
             "type": "integer",
             "minimum": 0
@@ -429,7 +433,8 @@
               "devin",
               "claude-managed",
               "opencode",
-              "acp"
+              "acp",
+              "dsh"
             ]
           },
           "providerMeta": {
@@ -499,7 +504,8 @@
               "devin",
               "claude-managed",
               "opencode",
-              "acp"
+              "acp",
+              "dsh"
             ]
           },
           "capabilities": {
@@ -646,6 +652,7 @@
               "claude-managed",
               "opencode",
               "acp",
+              "dsh",
               null
             ],
             "default": null
@@ -976,7 +983,8 @@
               "devin",
               "claude-managed",
               "opencode",
-              "acp"
+              "acp",
+              "dsh"
             ]
           },
           "harnessProvider": {
@@ -992,6 +1000,7 @@
               "claude-managed",
               "opencode",
               "acp",
+              "dsh",
               null
             ]
           },
@@ -4202,6 +4211,9 @@
               "api"
             ]
           },
+          "senderLabel": {
+            "type": "string"
+          },
           "createdByKind": {
             "type": "string",
             "enum": [
@@ -9400,7 +9412,8 @@
                       "devin",
                       "claude-managed",
                       "opencode",
-                      "acp"
+                      "acp",
+                      "dsh"
                     ]
                   },
                   "harness_provider": {
@@ -9412,7 +9425,8 @@
                       "devin",
                       "claude-managed",
                       "opencode",
-                      "acp"
+                      "acp",
+                      "dsh"
                     ]
                   },
                   "runtimeInstanceId": {
@@ -9546,7 +9560,7 @@
       },
       "get": {
         "summary": "List all agents",
-        "description": "Returns agents WITHOUT the six identity-markdown blobs (`claudeMd`/`soulMd`/`identityMd`/`toolsMd`/`heartbeatMd`/`setupScript`) by default — they bloat the list by ~16 KB/agent and the overview never renders them. Pass `fields=full` to restore them, or fetch a single agent via `GET /api/agents/{id}`.",
+        "description": "Returns agents WITHOUT the six identity-markdown blobs (`claudeMd`/`soulMd`/`identityMd`/`toolsMd`/`heartbeatMd`/`setupScript`) by default — they bloat the list by ~16 KB/agent and the overview never renders them. Pass `fields=full` to restore them, or fetch a single agent via `GET /api/agents/{id}`. Extension identities (`ext:<name>`, role `extension`) are never listed; they are API principals, not workers.",
         "tags": [
           "Agents"
         ],
@@ -9687,7 +9701,8 @@
                       "devin",
                       "claude-managed",
                       "opencode",
-                      "acp"
+                      "acp",
+                      "dsh"
                     ]
                   }
                 },
@@ -9902,7 +9917,8 @@
                       "codex",
                       "pi",
                       "opencode",
-                      "acp"
+                      "acp",
+                      "dsh"
                     ]
                   },
                   "model": {
@@ -10921,6 +10937,7 @@
                         "claude-managed",
                         "opencode",
                         "acp",
+                        "dsh",
                         null
                       ]
                     },
@@ -10937,6 +10954,7 @@
                         "claude-managed",
                         "opencode",
                         "acp",
+                        "dsh",
                         null
                       ]
                     },
@@ -11055,6 +11073,7 @@
                               "claude-managed",
                               "opencode",
                               "acp",
+                              "dsh",
                               null
                             ]
                           },
@@ -11071,6 +11090,7 @@
                               "claude-managed",
                               "opencode",
                               "acp",
+                              "dsh",
                               null
                             ]
                           },
@@ -15976,6 +15996,7 @@
       "post": {
         "operationId": "extensions_install",
         "summary": "Validate and install an extension bundle",
+        "description": "Any authenticated agent can install a disabled draft owned by its agent ID. Workers can update only their own bundles; activation remains lead/operator-only.",
         "tags": [
           "Extensions"
         ],
@@ -16167,6 +16188,7 @@
       "patch": {
         "operationId": "extensions_update",
         "summary": "Update extension priority, config, or description",
+        "description": "Workers may edit their own disabled extensions. Leads, operators, and dashboard users retain access to all extensions.",
         "tags": [
           "Extensions"
         ],
@@ -16262,6 +16284,7 @@
       "delete": {
         "operationId": "extensions_delete",
         "summary": "Uninstall a disabled extension",
+        "description": "Workers may uninstall their own disabled extensions. Leads, operators, and dashboard users retain access to all extensions.",
         "tags": [
           "Extensions"
         ],
@@ -26676,6 +26699,14 @@
                     "parentTaskId": {
                       "type": "string"
                     },
+                    "requestedDelayMs": {
+                      "type": "integer",
+                      "exclusiveMinimum": 0
+                    },
+                    "requestedRunAt": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
                     "timezone": {
                       "type": "string",
                       "default": "UTC"
@@ -27033,6 +27064,14 @@
                               "parentTaskId": {
                                 "type": "string"
                               },
+                              "requestedDelayMs": {
+                                "type": "integer",
+                                "exclusiveMinimum": 0
+                              },
+                              "requestedRunAt": {
+                                "type": "string",
+                                "format": "date-time"
+                              },
                               "timezone": {
                                 "type": "string",
                                 "default": "UTC"
@@ -27217,6 +27256,14 @@
                               "parentTaskId": {
                                 "type": "string"
                               },
+                              "requestedDelayMs": {
+                                "type": "integer",
+                                "exclusiveMinimum": 0
+                              },
+                              "requestedRunAt": {
+                                "type": "string",
+                                "format": "date-time"
+                              },
                               "timezone": {
                                 "type": "string",
                                 "default": "UTC"
@@ -27444,6 +27491,14 @@
                         "parentTaskId": {
                           "type": "string"
                         },
+                        "requestedDelayMs": {
+                          "type": "integer",
+                          "exclusiveMinimum": 0
+                        },
+                        "requestedRunAt": {
+                          "type": "string",
+                          "format": "date-time"
+                        },
                         "timezone": {
                           "type": "string",
                           "default": "UTC"
@@ -27686,6 +27741,14 @@
                     "parentTaskId": {
                       "type": "string"
                     },
+                    "requestedDelayMs": {
+                      "type": "integer",
+                      "exclusiveMinimum": 0
+                    },
+                    "requestedRunAt": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
                     "timezone": {
                       "type": "string",
                       "default": "UTC"
@@ -28048,6 +28111,14 @@
                     "parentTaskId": {
                       "type": "string"
                     },
+                    "requestedDelayMs": {
+                      "type": "integer",
+                      "exclusiveMinimum": 0
+                    },
+                    "requestedRunAt": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
                     "timezone": {
                       "type": "string",
                       "default": "UTC"
@@ -28431,6 +28502,14 @@
                     "parentTaskId": {
                       "type": "string"
                     },
+                    "requestedDelayMs": {
+                      "type": "integer",
+                      "exclusiveMinimum": 0
+                    },
+                    "requestedRunAt": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
                     "timezone": {
                       "type": "string",
                       "default": "UTC"
@@ -35819,7 +35898,8 @@
                                       "devin",
                                       "claude-managed",
                                       "opencode",
-                                      "acp"
+                                      "acp",
+                                      "dsh"
                                     ]
                                   },
                                   "requestedByUserId": {
@@ -40126,6 +40206,14 @@
                           "parentTaskId": {
                             "type": "string"
                           },
+                          "requestedDelayMs": {
+                            "type": "integer",
+                            "exclusiveMinimum": 0
+                          },
+                          "requestedRunAt": {
+                            "type": "string",
+                            "format": "date-time"
+                          },
                           "timezone": {
                             "type": "string",
                             "default": "UTC"
@@ -40525,7 +40613,8 @@
                               "devin",
                               "claude-managed",
                               "opencode",
-                              "acp"
+                              "acp",
+                              "dsh"
                             ]
                           },
                           "providers": {
@@ -40542,7 +40631,8 @@
                                     "devin",
                                     "claude-managed",
                                     "opencode",
-                                    "acp"
+                                    "acp",
+                                    "dsh"
                                   ]
                                 },
                                 "state": {
@@ -40813,7 +40903,8 @@
                       "devin",
                       "claude-managed",
                       "opencode",
-                      "acp"
+                      "acp",
+                      "dsh"
                     ]
                   }
                 },
@@ -41188,7 +41279,8 @@
                                   "devin",
                                   "claude-managed",
                                   "opencode",
-                                  "acp"
+                                  "acp",
+                                  "dsh"
                                 ]
                               },
                               "requestedByUserId": {
@@ -41401,7 +41493,7 @@
             }
           },
           "400": {
-            "description": "Validation error",
+            "description": "Validation error, or agentId/offeredTo targets an extension identity",
             "content": {
               "application/json": {
                 "schema": {
@@ -41584,7 +41676,8 @@
                           "pi",
                           "claude-managed",
                           "opencode",
-                          "acp"
+                          "acp",
+                          "dsh"
                         ]
                       },
                       "model": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.152.2",
+  "version": "1.154.0",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -41,6 +41,7 @@
     "plugin/commands/",
     "plugin/agents/",
     "plugin/pi-skills/",
+    "plugin/opencode-plugins/lib/memory-raters.ts",
     "templates/",
     "vendored-openapi/",
     "openapi.json"
@@ -188,14 +189,14 @@
     "@aws-sdk/client-bedrock": "3.1048.0",
     "@desplega.ai/business-use": "^0.4.2",
     "@desplega.ai/localtunnel": "^2.2.0",
-    "@earendil-works/pi-agent-core": "^0.85.1",
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
     "@inkjs/ui": "^2.0.0",
     "@linear/sdk": "^77.0.0",
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@openai/codex": "0.154.0",
-    "@opencode-ai/sdk": "^1.18.31",
+    "@openai/codex": "0.156.1",
+    "@opencode-ai/sdk": "^1.18.32",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",

package/plugin/opencode-plugins/lib/memory-raters.ts

@@ -0,0 +1,7 @@
+/** Unset enables citation ratings and self-rating hints; an explicitly empty value disables all raters. */
+export function getMemoryRaterNames(): string[] {
+  return (process.env.MEMORY_RATERS ?? "implicit-citation,explicit-self")
+    .split(",")
+    .map((name) => name.trim())
+    .filter(Boolean);
+}

package/src/be/automation-preflight.ts

@@ -1,4 +1,5 @@
 import type { AutomationIntegrationId, ScheduledTask, Workflow } from "@/types";
+import { getSlackConfiguration, isSlackConfigured } from "../slack/config";
 import { getDbClient } from "./db";
 import { getOAuthApp, getOAuthTokens } from "./db-queries/oauth";
 
@@ -281,11 +282,12 @@ export async function getAutomationSetupStates(): Promise<AutomationSetupStates>
     present(process.env.GSC_SERVICE_ACCOUNT_JSON);
 
   return {
+    // Credential presence is configuration evidence, not proof that inbound
+    // Slack traffic has been observed successfully.
+    // HTTP credentials alone cannot run Slack automations before its receiver lands.
     slack:
-      enabled(process.env.SLACK_DISABLE) &&
-      present(process.env.SLACK_BOT_TOKEN) &&
-      present(process.env.SLACK_APP_TOKEN)
-        ? "verified"
+      getSlackConfiguration().mode === "socket" && isSlackConfigured()
+        ? "configured"
         : "unverified",
     github:
       present(process.env.GITHUB_WEBHOOK_SECRET) &&

package/src/be/db/agents.ts

@@ -206,8 +206,79 @@ export async function getAgentById(id: string): Promise<Agent | null> {
   return row ? rowToAgent(row) : null;
 }
 
-export async function getAllAgents(opts?: { slim?: boolean }): Promise<Agent[]> {
-  const rows = await getDbClient().query<AgentRow>("SELECT * FROM agents ORDER BY name");
+/**
+ * Role stamped on the `ext:<name>` agent row an extension authenticates as
+ * (`src/extensions/identity.ts`). These rows are API identities, not workers:
+ * they are hidden from agent listings and can never be assigned, offered, or
+ * claim tasks. The rows themselves are kept so the extension can keep calling
+ * the API and re-enabling it finds the same identity.
+ */
+export const EXTENSION_AGENT_ROLE = "extension";
+
+/** SQL predicate that drops extension-identity rows from an `agents` scan. */
+export const NOT_EXTENSION_AGENT_SQL = `COALESCE(role, '') != '${EXTENSION_AGENT_ROLE}'`;
+
+export function isExtensionAgent(agent: Pick<Agent, "role"> | null | undefined): boolean {
+  return agent?.role === EXTENSION_AGENT_ROLE;
+}
+
+export function extensionAgentAssignmentError(agent: Pick<Agent, "id" | "name">): string {
+  return `Agent "${agent.name}" (${agent.id}) is an extension identity and cannot be assigned, offered, or scheduled tasks. Target a worker or lead agent instead.`;
+}
+
+/**
+ * Thrown when an ordinary registration or profile update tries to grant the
+ * reserved extension role, or to strip it from an extension identity. Only
+ * `ensureExtensionAgent` may set it.
+ */
+export class ReservedAgentRoleError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ReservedAgentRoleError";
+  }
+}
+
+/**
+ * Returns the reason a role change is refused, or null when it is allowed.
+ * `allowExtensionRole` is passed only by the extension identity lifecycle.
+ */
+export function reservedRoleViolation(
+  currentRole: string | null | undefined,
+  nextRole: string | undefined,
+  opts?: { allowExtensionRole?: boolean },
+): string | null {
+  if (nextRole === undefined || nextRole === currentRole) return null;
+  if (currentRole === EXTENSION_AGENT_ROLE) {
+    return `Extension identities keep the "${EXTENSION_AGENT_ROLE}" role; it cannot be changed.`;
+  }
+  if (nextRole === EXTENSION_AGENT_ROLE && !opts?.allowExtensionRole) {
+    return `Role "${EXTENSION_AGENT_ROLE}" is reserved for extension identities.`;
+  }
+  return null;
+}
+
+/** Thrown by task creation when the assignee or offer target is an extension identity. */
+export class ExtensionAgentAssignmentError extends Error {
+  constructor(agent: Pick<Agent, "id" | "name">) {
+    super(extensionAgentAssignmentError(agent));
+    this.name = "ExtensionAgentAssignmentError";
+  }
+}
+
+/**
+ * Lists agents ordered by name. Extension identities are excluded unless
+ * `includeExtensions` is set; only the extension identity lifecycle and
+ * name-collision checks need them.
+ */
+export async function getAllAgents(opts?: {
+  slim?: boolean;
+  includeExtensions?: boolean;
+}): Promise<Agent[]> {
+  const rows = await getDbClient().query<AgentRow>(
+    opts?.includeExtensions
+      ? "SELECT * FROM agents ORDER BY name"
+      : `SELECT * FROM agents WHERE ${NOT_EXTENSION_AGENT_SQL} ORDER BY name`,
+  );
   return rows.map((row) => rowToAgent(row, opts?.slim ?? false));
 }
 
@@ -529,6 +600,8 @@ export function isAgentEligibleForTask(
   agent: Pick<Agent, "id" | "isLead" | "role" | "capabilities">,
   task: Pick<AgentTask, "routingAffinity" | "routingAffinityInvalid">,
 ): boolean {
+  // Extension identities are API principals, never task executors.
+  if (isExtensionAgent(agent)) return false;
   const affinity = task.routingAffinity;
   // A malformed persisted blob is a security boundary failure, not an
   // untagged task. Quarantine it from every assignment/claim path.

package/src/be/db/tasks/read.ts

@@ -103,6 +103,7 @@ export type AgentTaskRow = {
   peakContextTokens: number | null;
   contextWindowSize: number | null;
   was_paused: number;
+  deferredAt: string | null;
   credentialKeySuffix: string | null;
   credentialKeyType: string | null;
   requestedByUserId: string | null;
@@ -228,6 +229,7 @@ export function rowToAgentTask(row: AgentTaskRow): AgentTask {
     output: row.output ?? undefined,
     progress: row.progress ?? undefined,
     wasPaused: !!row.was_paused,
+    deferredAt: row.deferredAt ?? undefined,
     credentialKeySuffix: row.credentialKeySuffix ?? undefined,
     credentialKeyType: row.credentialKeyType ?? undefined,
     requestedByUserId: row.requestedByUserId ?? undefined,

package/src/be/db/tasks/write.ts

@@ -326,7 +326,7 @@ export async function updateTaskTitle(
 export async function completeTask(
   id: string,
   output?: string,
-  options?: { addTags?: string[] },
+  options?: { addTags?: string[]; deferredAt?: string },
 ): Promise<AgentTask | null> {
   const oldTask = await getTaskById(id);
   if (!oldTask) return null;
@@ -364,6 +364,12 @@ export async function completeTask(
         [JSON.stringify(nextTags), id],
       );
     }
+    if (completed && options?.deferredAt) {
+      completed = await getDbClient().get<AgentTaskRow>(
+        "UPDATE agent_tasks SET deferredAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *",
+        [options.deferredAt, id],
+      );
+    }
     if (completed) {
       await dependencies.reconcileTaskPullRequestAttachments(id, completed.agentId, [
         completed.output,