@desplega.ai/agent-swarm 1.164.1 → 1.166.0

package/dist/{cli-1d3w4xm3.js → cli-4r1sjfc4.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.164.1",
+    version: "1.166.0",
     description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
     keywords: [
       "agent-swarm.dev",
@@ -102,6 +102,8 @@ var init_package = __esm(() => {
       "check:extension-schema": "bun scripts/build-extension-manifest-schema.ts --check",
       "build:extension-catalog": "bun scripts/build-extension-catalog.ts",
       "check:extension-catalog": "bun scripts/build-extension-catalog.ts --check",
+      "build:secret-rules": "bun scripts/gen-secret-rules.ts",
+      "check:secret-rules": "bun scripts/gen-secret-rules.ts --check",
       "build:cli": "bun run scripts/build-cli.ts",
       "mono:build": "turbo run build",
       "mono:test": "turbo run test",
@@ -115,7 +117,9 @@ var init_package = __esm(() => {
       "e2e:codex-oauth-blob": "bun scripts/e2e/codex-oauth-blob.ts",
       "e2e:tsc": "bun tsc --noEmit -p scripts/e2e/tsconfig.json",
       prepack: "bun run build:cli",
-      "tsc:check": "bun tsc --noEmit",
+      check: "bash scripts/check.sh",
+      "tsc:check": "tsgo --noEmit",
+      "tsc:check:tsc": "bun tsc --noEmit",
       "check:db-boundary": "bash scripts/check-db-boundary.sh",
       "check:test-spawn-sync": "bash scripts/check-test-spawn-sync.sh",
       "check:dep-graph": "depcruise src plugin/opencode-plugins packages/model-routing --config .dependency-cruiser.cjs",
@@ -158,6 +162,7 @@ var init_package = __esm(() => {
       "docker:build:api": "docker build -f Dockerfile -t agent-swarm-api:latest .",
       "docker:build:worker": "docker build -f Dockerfile.worker -t agent-swarm-worker:latest .",
       "docker:build:worker:slim": "docker build -f Dockerfile.worker --target worker-slim -t agent-swarm-worker:slim .",
+      "docker:build:ui": "docker build -f Dockerfile.ui -t agent-swarm-ui:latest .",
       "docker:run:worker": "docker run --rm -it --env-file .env.docker -p 3202:3000 -v ./logs:/logs -v ./work/shared:/workspace/shared -v ./work/worker-1:/workspace/personal agent-swarm-worker:latest",
       "docker:run:lead": "docker run --rm -it --env-file .env.docker-lead -e AGENT_ROLE=lead -p 3201:3000 -v ./logs:/logs -v ./work/shared:/workspace/shared -v ./work/lead:/workspace/personal agent-swarm-worker:latest",
       "deploy:install": "bun deploy/install.ts",
@@ -188,6 +193,7 @@ var init_package = __esm(() => {
       "@faker-js/faker": "^10.4.0",
       "@opencode-ai/plugin": "1.18.35",
       "@types/bun": "latest",
+      "@typescript/native-preview": "7.0.0-dev.20260707.2",
       "dependency-cruiser": "^18.0.0",
       konsistent: "1.0.0-beta.1",
       "openapi-typescript": "^7",
@@ -203,20 +209,21 @@ var init_package = __esm(() => {
     dependencies: {
       "@agentclientprotocol/sdk": "1.7.0",
       "@ai-sdk/openai": "^3.0.41",
-      "@anthropic-ai/claude-agent-sdk": "0.3.292",
-      "@anthropic-ai/sdk": "^0.131.0",
+      "@anthropic-ai/claude-agent-sdk": "0.3.293",
+      "@anthropic-ai/sdk": "^0.132.0",
       "@asteasolutions/zod-to-openapi": "^8.0.0",
       "@aws-sdk/client-bedrock": "3.1048.0",
-      "@cursor/sdk": "1.0.36",
+      "@cursor/sdk": "1.0.37",
       "@desplega.ai/business-use": "^0.4.2",
       "@desplega.ai/localtunnel": "^2.2.0",
       "@earendil-works/pi-agent-core": "^1.0.4",
       "@earendil-works/pi-ai": "^1.0.4",
       "@earendil-works/pi-coding-agent": "^1.0.4",
       "@inkjs/ui": "^2.0.0",
+      "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
       "@linear/sdk": "^77.0.0",
       "@modelcontextprotocol/sdk": "1.29.0",
-      "@openai/codex": "0.160.1",
+      "@openai/codex": "0.161.0",
       "@opencode-ai/sdk": "^1.18.35",
       "@openfort/openfort-node": "^0.9.1",
       "@opentelemetry/api": "^1.9.1",
@@ -240,6 +247,7 @@ var init_package = __esm(() => {
       ink: "^6.5.1",
       oauth4webapi: "^3.8.5",
       openai: "^6.22.0",
+      "quickjs-emscripten-core": "0.32.0",
       react: "19.2.3",
       "react-devtools-core": "^7.0.1",
       "sqlite-vec": "^0.1.9",

package/dist/{cli-691f2rxm.js → cli-66zh26sp.js}

@@ -13,17 +13,18 @@ import {
   getNextResumeGeneration,
   getPinCandidateAgent,
   getResumeGeneration,
+  mintToken,
   poolTaskRunsOnHarness,
   recoverIncompleteRuns,
   repointTrackerSyncBySwarmId,
   resolveLeadOnlyRecoveryAssignment
-} from "./cli-a9bw0xxt.js";
+} from "./cli-df56tqdw.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
 import {
   createApprovalFollowUpTask
-} from "./cli-j0tmc908.js";
+} from "./cli-jvj6a0cv.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -60,7 +61,7 @@ import {
   getUnassignedPoolTasks,
   hasNonTerminalResumeChild,
   hasPendingSteering,
-  init_db,
+  init_db1 as init_db,
   init_steering,
   isAgentEligibleForTask,
   isPoolAffinityEnforcementEnabled,
@@ -74,7 +75,11 @@ import {
   settleSupersededTaskDependents,
   supersedeTask,
   updateAgentStatus
-} from "./cli-0wn3ypqv.js";
+} from "./cli-yshaazs1.js";
+import {
+  TERMINAL_TASK_STATUSES,
+  init_types
+} from "./cli-xvdgasgy.js";
 import {
   init_registry,
   init_resolver,
@@ -88,7 +93,7 @@ import {
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-qt5wzq6v.js";
+} from "./cli-wt7ccy4r.js";
 
 // src/be/approval-sweeps.ts
 init_db();
@@ -157,10 +162,48 @@ async function timeoutExpiredApprovalRequests(now = new Date) {
   return { timedOut };
 }
 
+// src/be/connector-codes.ts
+init_db();
+import { createHash, randomBytes } from "node:crypto";
+var CONNECTOR_CODE_TTL_MS = 10 * 60 * 1000;
+var CONNECTOR_CODE_RETENTION_MS = 60 * 60 * 1000;
+var DEFAULT_CONNECTOR_CODE_LABEL = "ChatGPT connector";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+async function createConnectorCode(userId, label, actor, now = new Date) {
+  const code = randomBytes(32).toString("base64url");
+  const expiresAt = new Date(now.getTime() + CONNECTOR_CODE_TTL_MS).toISOString();
+  await getDbClient().run(`INSERT INTO connector_codes
+       (code_hash, user_id, label, actor_kind, actor_id, created_at, expires_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`, [sha256Hex(code), userId, label, actor.kind, actor.id, now.toISOString(), expiresAt]);
+  return { code, expiresAt };
+}
+async function exchangeConnectorCode(code, now = new Date) {
+  const nowIso = now.toISOString();
+  return getDbClient().transaction(async (tx) => {
+    const row = await tx.get(`UPDATE connector_codes SET used_at = ?
+        WHERE code_hash = ? AND used_at IS NULL AND expires_at > ?
+        RETURNING user_id, label, actor_kind, actor_id`, [nowIso, sha256Hex(code), nowIso]);
+    if (!row)
+      return null;
+    const { plaintext } = await mintToken(row.user_id, row.label, { kind: row.actor_kind, id: row.actor_id }, { source: "connector_exchange" });
+    return { token: plaintext, userId: row.user_id };
+  });
+}
+async function deleteExpiredConnectorCodes(now = new Date) {
+  const cutoff = new Date(now.getTime() - CONNECTOR_CODE_RETENTION_MS).toISOString();
+  const result = await getDbClient().run("DELETE FROM connector_codes WHERE expires_at < ?", [
+    cutoff
+  ]);
+  return result.changes;
+}
+
 // src/heartbeat/heartbeat.ts
 init_db();
 init_steering();
 init_resolver();
+init_types();
 init_env_flag();
 init_secret_scrubber();
 
@@ -359,7 +402,8 @@ async function codeLevelTriage() {
       staleOfferedTasks: 0,
       abandonedDraftTasks: 0,
       approvalAutoCancelled: 0,
-      approvalTimedOut: 0
+      approvalTimedOut: 0,
+      connectorCodes: 0
     }
   };
   findings.staleCleanup.staleRuntimes = (await expireStaleRuntimeInstances()).expired;
@@ -664,8 +708,8 @@ async function runRebootSweep() {
         }
         const existingRetry = await getDbClient().get(`SELECT id FROM agent_tasks
            WHERE parentTaskId = ?
-             AND status NOT IN ('completed', 'failed', 'cancelled')
-           LIMIT 1`, [task.id]);
+             AND status NOT IN (${TERMINAL_TASK_STATUSES.map(() => "?").join(", ")})
+           LIMIT 1`, [task.id, ...TERMINAL_TASK_STATUSES]);
         if (!existingRetry) {
           try {
             let preferredAgentId;
@@ -961,6 +1005,12 @@ async function cleanupStaleResources(findings) {
     console.error("[heartbeat] approval auto-cancel sweep failed:", err);
     findings.staleCleanup.approvalAutoCancelled = 0;
   }
+  try {
+    findings.staleCleanup.connectorCodes = await deleteExpiredConnectorCodes();
+  } catch (err) {
+    console.error("[heartbeat] connector code cleanup failed:", err);
+    findings.staleCleanup.connectorCodes = 0;
+  }
 }
 function isEffectivelyEmpty(content) {
   const lines = content.split(`
@@ -1122,8 +1172,8 @@ async function checkHeartbeatChecklist() {
   const existing = await getDbClient().get(`SELECT id FROM agent_tasks
        WHERE agentId = ?
          AND taskType = 'heartbeat-checklist'
-         AND status NOT IN ('completed', 'failed', 'cancelled')
-       LIMIT 1`, [lead.id]);
+         AND status NOT IN (${TERMINAL_TASK_STATUSES.map(() => "?").join(", ")})
+       LIMIT 1`, [lead.id, ...TERMINAL_TASK_STATUSES]);
   if (existing)
     return;
   const systemStatus = await gatherSystemStatus();
@@ -1170,7 +1220,8 @@ async function runHeartbeatSweep() {
           staleOfferedTasks: 0,
           abandonedDraftTasks: 0,
           approvalAutoCancelled: 0,
-          approvalTimedOut: 0
+          approvalTimedOut: 0,
+          connectorCodes: 0
         }
       };
       cleanupOnlyFindings.staleCleanup.staleRuntimes = (await expireStaleRuntimeInstances()).expired;
@@ -1220,9 +1271,10 @@ function logFindings(findings) {
     staleOfferedTasks,
     abandonedDraftTasks,
     approvalAutoCancelled,
-    approvalTimedOut
+    approvalTimedOut,
+    connectorCodes
   } = findings.staleCleanup;
-  const totalCleanup = sessions + reviewingTasks + mentionProcessing + inboxProcessing + workflowRuns + approvalAutoCancelled + approvalTimedOut;
+  const totalCleanup = sessions + reviewingTasks + mentionProcessing + inboxProcessing + workflowRuns + approvalAutoCancelled + approvalTimedOut + connectorCodes;
   if (totalCleanup > 0) {
     parts.push(`stale_cleanup=${totalCleanup}`);
   }
@@ -1267,8 +1319,8 @@ async function createBootTriageTask() {
   const existing = await getDbClient().get(`SELECT id FROM agent_tasks
        WHERE agentId = ?
          AND taskType = 'boot-triage'
-         AND status NOT IN ('completed', 'failed', 'cancelled')
-       LIMIT 1`, [lead.id]);
+         AND status NOT IN (${TERMINAL_TASK_STATUSES.map(() => "?").join(", ")})
+       LIMIT 1`, [lead.id, ...TERMINAL_TASK_STATUSES]);
   if (existing)
     return;
   const systemStatus = await gatherSystemStatus({ isBootTriage: true });
@@ -1318,4 +1370,4 @@ function stopHeartbeatChecklist() {
     console.log("[Heartbeat] Checklist stopped");
   }
 }
-export { getBootEpochMs, runRebootSweep, getRebootAffectedTasks, checkHeartbeatChecklist, runHeartbeatSweep, startHeartbeat, stopHeartbeat };
+export { DEFAULT_CONNECTOR_CODE_LABEL, createConnectorCode, exchangeConnectorCode, getBootEpochMs, runRebootSweep, getRebootAffectedTasks, checkHeartbeatChecklist, runHeartbeatSweep, startHeartbeat, stopHeartbeat };

package/dist/{cli-et8wdyqh.js → cli-68r1j4sg.js}

@@ -4,17 +4,17 @@ import {
 import {
   clampContextPercent,
   getContextWindowSize
-} from "./cli-6behs2bt.js";
+} from "./cli-32bca7nr.js";
 import {
   applyReasoningEffort
-} from "./cli-cn53e7vc.js";
+} from "./cli-ttbsse3f.js";
 import {
   swarmRuntimeInstanceId
 } from "./cli-re8z5p8p.js";
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-v0e7jpr5.js";
+} from "./cli-xvdgasgy.js";
 import {
   init_session_templates
 } from "./cli-g5erf0zt.js";
@@ -30,12 +30,12 @@ import {
 import {
   cursorCatalogRef,
   init_src
-} from "./cli-g3qgrzck.js";
+} from "./cli-zsh093hk.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubSecrets
-} from "./cli-qt5wzq6v.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -50,7 +50,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 init_env_flag();
 init_secret_scrubber();
-var CURSOR_SDK_VERSION = "1.0.36";
+var CURSOR_SDK_VERSION = "1.0.37";
 var CURSOR_MCP_SERVER_NAME = "agent-swarm";
 var NATIVE_SYSTEM_PROMPT_ENV = "CURSOR_NATIVE_SYSTEM_PROMPT";
 var FIRST_MESSAGE_TEMPLATE = "system.agent.cursor.first_message";
@@ -58,7 +58,7 @@ function checkCursorCredentials(env) {
   return env.CURSOR_API_KEY?.trim() ? { ready: true, missing: [], satisfiedBy: "env" } : { ready: false, missing: ["CURSOR_API_KEY"], hint: "Set CURSOR_API_KEY for cursor." };
 }
 async function liveTestCursorKey(apiKey) {
-  const { Cursor } = await import("./index-fdk1t4d6.js");
+  const { Cursor } = await import("./index-n0rxa4ca.js");
   try {
     await Cursor.me({ apiKey });
     return { ok: true };
@@ -78,7 +78,7 @@ async function listCursorModels(apiKey) {
   if (modelListCache?.key === apiKey && Date.now() - modelListCache.at < MODEL_LIST_TTL_MS) {
     return modelListCache.models;
   }
-  const { Cursor } = await import("./index-fdk1t4d6.js");
+  const { Cursor } = await import("./index-n0rxa4ca.js");
   const models = await Cursor.models.list({ apiKey });
   modelListCache = { key: apiKey, at: Date.now(), models };
   return models;
@@ -452,7 +452,7 @@ class CursorAdapter {
     if (!apiKey)
       throw new Error("cursor requires CURSOR_API_KEY");
     registerVolatileSecret(apiKey, "CURSOR_API_KEY");
-    const { Agent, JsonlLocalAgentStore } = await import("./index-fdk1t4d6.js");
+    const { Agent, JsonlLocalAgentStore } = await import("./index-n0rxa4ca.js");
     const modelId = config.model || DEFAULT_MODEL_TIER_MAP.cursor.regular;
     const effort = applyReasoningEffort("cursor", modelId, config.reasoningEffort);
     const requested = effort.kind === "cursor-effort" ? effort.reasoningEffort : undefined;

package/dist/{cli-xb7kyanp.js → cli-8kgvmkak.js}

@@ -1,12 +1,12 @@
 import {
   PermissionVerbSchema,
   init_rbac
-} from "./cli-1wd1n2ya.js";
+} from "./cli-rfphkzh5.js";
 import {
   getDb,
   getDbClient,
-  init_db
-} from "./cli-0wn3ypqv.js";
+  init_db1 as init_db
+} from "./cli-yshaazs1.js";
 import {
   init_env_flag,
   isEnvFlagEnabled

package/dist/{cli-fdpkw8vk.js → cli-8t229cmr.js}

@@ -17,10 +17,10 @@ import {
   CONTEXT_FORMULA,
   clampContextPercent,
   computeContextUsedUnified
-} from "./cli-6behs2bt.js";
+} from "./cli-32bca7nr.js";
 import {
   summarizeSession
-} from "./cli-bz1gbac9.js";
+} from "./cli-p4ztb80h.js";
 import {
   hasCodexOAuthPoolSlots
 } from "./cli-bqjfjex4.js";
@@ -29,7 +29,7 @@ import {
 } from "./cli-2pdaysab.js";
 import {
   applyReasoningEffort
-} from "./cli-cn53e7vc.js";
+} from "./cli-ttbsse3f.js";
 import {
   buildRatingsFromLlm,
   fetchRetrievalsForTask,
@@ -51,24 +51,24 @@ import {
   CodexOAuthRefreshError,
   credentialsToAuthJson,
   getValidCodexOAuth
-} from "./cli-2c8eky5y.js";
+} from "./cli-feh3dkah.js";
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-v0e7jpr5.js";
+} from "./cli-xvdgasgy.js";
 import {
   init_runtime_model_catalog,
   init_src,
   runtimeCatalogModel
-} from "./cli-g3qgrzck.js";
+} from "./cli-zsh093hk.js";
 import {
   init_package,
   package_default
-} from "./cli-1d3w4xm3.js";
+} from "./cli-4r1sjfc4.js";
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-qt5wzq6v.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __require
 } from "./cli-bc05qbss.js";

package/dist/{cli-gc54qc0p.js → cli-aqcey741.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-1d3w4xm3.js";
+} from "./cli-4r1sjfc4.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-4q4cmr4t.js → cli-cpfmqz3n.js}

@@ -5,12 +5,12 @@ import {
   instantFlush,
   requestSlackThreadSteering,
   wasEventSeen
-} from "./cli-xfb7333f.js";
+} from "./cli-dw2q9f7g.js";
 import {
   enrichSlackUserEmail,
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-4cn19jvn.js";
+} from "./cli-x7kpr72a.js";
 import {
   TaskCreationBlockedError,
   broadcastMatches,
@@ -23,14 +23,14 @@ import {
   hasOtherUserMention,
   notifySlackFileFailures,
   routeMessage
-} from "./cli-a9bw0xxt.js";
+} from "./cli-df56tqdw.js";
 import {
   ackSlackMessage,
   buildTreeBlocks,
   ensureSlackThreadTree,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-4drstbb9.js";
+} from "./cli-ecknp7p1.js";
 import {
   getAgentById,
   getAgentWorkingOnThread,
@@ -39,11 +39,11 @@ import {
   getMostRecentTaskInThread,
   getTasksByAgentId,
   init_context_key,
-  init_db,
+  init_db1 as init_db,
   isExtensionAgent,
   reactionName,
   slackContextKey
-} from "./cli-0wn3ypqv.js";
+} from "./cli-yshaazs1.js";
 import {
   init_resolver,
   resolveTemplate
@@ -61,11 +61,11 @@ import {
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-xxz89c2n.js";
+} from "./cli-mb75wpxf.js";
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-qt5wzq6v.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __callDispose,
   __using