@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/src/workflows/resume.ts

@@ -17,6 +17,7 @@ import {
   updateWorkflowRun,
   updateWorkflowRunStep,
 } from "../be/db";
+import type { WaitStateRow } from "../types";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import {
   type ApprovalSlackClient,
@@ -26,7 +27,7 @@ import { shapeApprovalResolution } from "./approval-resolution";
 import { loadCompletedStepRouting } from "./completed-step-routing";
 import { FAILED_TASK_OUTPUT_PREFIX } from "./constants";
 import { getNextTargets } from "./definition";
-import { findReadyNodes, hasRunningStep, walkGraph } from "./engine";
+import { failRunOnUnreadableReplay, findReadyNodes, hasRunningStep, walkGraph } from "./engine";
 import type { WorkflowEventBus } from "./event-bus";
 import { workflowEventBus } from "./event-bus";
 import type { ExecutorRegistry } from "./executors/registry";
@@ -127,6 +128,23 @@ export function setupWorkflowResumeListener(
   };
 }
 
+/**
+ * Run one live resume of a waiting step. A sealed replay copy that cannot be
+ * opened fails the step and its run now, instead of logging and leaving the
+ * run `waiting` until a recovery sweep. Any other error rethrows.
+ */
+async function failClosedOnUnreadableReplay(
+  runId: string,
+  stepId: string,
+  resume: () => Promise<void>,
+): Promise<void> {
+  try {
+    await resume();
+  } catch (err) {
+    if (!(await failRunOnUnreadableReplay(runId, err, stepId))) throw err;
+  }
+}
+
 /**
  * Resume a workflow after a linked task completes.
  *
@@ -138,6 +156,15 @@ export function setupWorkflowResumeListener(
 async function resumeFromTaskCompletion(
   event: TaskEvent,
   registry: ExecutorRegistry,
+): Promise<void> {
+  await failClosedOnUnreadableReplay(event.workflowRunId!, event.workflowRunStepId!, () =>
+    resumeFromTaskCompletionUnguarded(event, registry),
+  );
+}
+
+async function resumeFromTaskCompletionUnguarded(
+  event: TaskEvent,
+  registry: ExecutorRegistry,
 ): Promise<void> {
   const run = await getWorkflowRun(event.workflowRunId!);
   if (!run || (run.status !== "waiting" && run.status !== "running")) return;
@@ -245,6 +272,17 @@ async function handleTaskFailure(
   reason: string,
   registry: ExecutorRegistry,
   options: { retryable: boolean },
+): Promise<void> {
+  await failClosedOnUnreadableReplay(event.workflowRunId!, event.workflowRunStepId!, () =>
+    handleTaskFailureUnguarded(event, reason, registry, options),
+  );
+}
+
+async function handleTaskFailureUnguarded(
+  event: TaskEvent,
+  reason: string,
+  registry: ExecutorRegistry,
+  options: { retryable: boolean },
 ): Promise<void> {
   const run = await getWorkflowRun(event.workflowRunId!);
   if (!run || (run.status !== "waiting" && run.status !== "running")) return;
@@ -541,6 +579,15 @@ export async function cancelWorkflowRunStep(
 async function resumeFromApprovalResolution(
   event: ApprovalEvent,
   registry: ExecutorRegistry,
+): Promise<void> {
+  await failClosedOnUnreadableReplay(event.workflowRunId!, event.workflowRunStepId!, () =>
+    resumeFromApprovalResolutionUnguarded(event, registry),
+  );
+}
+
+async function resumeFromApprovalResolutionUnguarded(
+  event: ApprovalEvent,
+  registry: ExecutorRegistry,
 ): Promise<void> {
   const run = await getWorkflowRun(event.workflowRunId!);
   if (!run || (run.status !== "waiting" && run.status !== "running")) return;
@@ -551,8 +598,6 @@ async function resumeFromApprovalResolution(
   const workflow = await getWorkflow(run.workflowId);
   if (!workflow) return;
 
-  const ctx = (run.context ?? {}) as Record<string, unknown>;
-
   if (event.status === "cancelled") {
     console.warn(
       `[workflows] approval ${event.requestId} is cancelled; step ${event.workflowRunStepId} stays waiting for the run cancel path`,
@@ -560,6 +605,10 @@ async function resumeFromApprovalResolution(
     return;
   }
 
+  // Opens the sealed replay context: after the cancelled bail-out, which leaves
+  // the step to the run cancel path.
+  const ctx = (run.context ?? {}) as Record<string, unknown>;
+
   // Output and port for the approval status. A step parked by an executor other
   // than human-in-the-loop shapes its own (see shapeApprovalResolution).
   const { output: stepOutput, nextPort } = shapeApprovalResolution(
@@ -643,7 +692,17 @@ export async function resumeWaitState(
   if (!result.updated || !result.row) return;
 
   const waitRow = result.row;
+  await failClosedOnUnreadableReplay(waitRow.workflowRunId, waitRow.workflowRunStepId, () =>
+    resumeClaimedWait(waitRow, status, cappedPayload, registry),
+  );
+}
 
+async function resumeClaimedWait(
+  waitRow: WaitStateRow,
+  status: "fired" | "timeout",
+  cappedPayload: unknown,
+  registry: ExecutorRegistry,
+): Promise<void> {
   // 2. Load the surrounding run + step. If anything has moved on (cancelled,
   // failed, retried, etc.), stay quiet.
   const run = await getWorkflowRun(waitRow.workflowRunId);

package/src/workflows/retry-poller.ts

@@ -11,6 +11,7 @@ import { checkpointStep, checkpointStepFailure, checkpointStepWaiting } from "./
 import { getSuccessors, resolveValidationPort } from "./definition";
 import {
   buildNodeInterpolationCtx,
+  failRunOnUnreadableReplay,
   holdWorkflowRun,
   interpolateNodeConfig,
   rehydrateCompletedStepOutputs,
@@ -200,11 +201,13 @@ export function startRetryPoller(registry: ExecutorRegistry, intervalMs = 5000):
             }
           } catch (err) {
             // Execution threw — treat as failure
+            if (await failRunOnUnreadableReplay(run.id, err, step.id)) continue;
             const errorMsg = err instanceof Error ? err.message : String(err);
             const retryPolicy = node.retry || executor.retryPolicy;
             await checkpointStepFailure(run.id, step.id, errorMsg, step.retryCount, retryPolicy);
           }
         } catch (err) {
+          if (await failRunOnUnreadableReplay(step.runId, err, step.id)) continue;
           console.error(`[workflows] Retry failed for step ${step.id}:`, err);
         } finally {
           release?.();

package/templates/skills/agent-browser/SKILL.md

@@ -47,6 +47,8 @@ agent-browser close
 
 ## Recording
 
+Pass `record start` an absolute path (`/tmp/<topic>/raw.webm`). A relative path resolves against the agent-browser daemon's cwd, not yours, and fails with `ffmpeg write failed: Broken pipe` while `doctor` stays green.
+
 Default: record with `--cursor`, drive every supported pointer action (`click`, `mouse move`, `drag`) with `--human`, and ship the **1.5x video**. Keep the 1x original only if a reviewer asks for it. Human pointer movement follows an eased curve; use `--seed <n>` on `mouse move` to make the take reproducible instead of using a bare move.
 
 Open the page first, then record the interaction:

package/templates/skills/agent-browser/content.md

@@ -42,6 +42,8 @@ agent-browser close
 
 ## Recording
 
+Pass `record start` an absolute path (`/tmp/<topic>/raw.webm`). A relative path resolves against the agent-browser daemon's cwd, not yours, and fails with `ffmpeg write failed: Broken pipe` while `doctor` stays green.
+
 Default: record with `--cursor`, drive every supported pointer action (`click`, `mouse move`, `drag`) with `--human`, and ship the **1.5x video**. Keep the 1x original only if a reviewer asks for it. Human pointer movement follows an eased curve; use `--seed <n>` on `mouse move` to make the take reproducible instead of using a bare move.
 
 Open the page first, then record the interaction:

package/templates/skills/code-quality/content.md

@@ -38,6 +38,7 @@ The Repository Guidelines carry `allowMerge` and `mergeChecks`.
 
 ## Review a PR
 
+0. Re-review check. If you reviewed this PR before, compare `gh pr view <number> --json headRefOid --jq .headRefOid` with the `commit_id` of your last review (`gh api repos/<owner>/<repo>/pulls/<number>/reviews`). Same SHA: reuse that verdict, link it and stop. New SHA: review the diff since that commit, then run the full list below. If the new head merged or rebased main, also read every conflict resolution (files both sides touched), check migration numbering and order against main, grep for stale migration numbers, and confirm CI is green at the exact head you review.
 1. CI status first, including the fork checks below before treating CI as evidence. Failing CI is a REQUEST_CHANGES. Name the failing checks in the review.
 2. Detect a GitHub fork PR with `gh pr view <number> --json isCrossRepository --jq .isCrossRepository`.
 3. For a GitHub fork PR, inspect held runs with `SHA=$(gh pr view <number> --json headRefOid --jq .headRefOid); gh api --paginate "repos/<owner>/<repo>/actions/runs?head_sha=$SHA" --jq '.workflow_runs[] | "\(.conclusion // .status)|\(.name)"'`; `gh pr checks` and `statusCheckRollup` can omit them.

package/templates/skills/heartbeat-runbook/content.md

@@ -27,7 +27,7 @@ Two kinds of sections:
 
 ## Handle a heartbeat-checklist task
 
-0. Quiet check. Take the fast path when three things hold: the system status shows no failed, stalled or reboot-interrupted task; no mention has gone unanswered since the last heartbeat; and no tracked item in the task's runbook snapshot is at or past its date. On the fast path, run the two step 3 scripts. If both are clean, complete with one line that names the zero counts and skip steps 1, 2 and 4-7. Anything non-zero means continue at step 1.
+0. Quiet check. Take the fast path when three things hold: every failed, stalled or reboot-interrupted task in the system status was already named in the previous heartbeat-checklist task's output (newest completed one via `get-tasks`); no mention has gone unanswered since the last heartbeat; and no tracked item in the task's runbook snapshot is at or past its date. On the fast path, run the two step 3 scripts. If they report nothing the previous heartbeat had not already triaged, complete with one line citing the previous heartbeat task id and the counts, and skip steps 1, 2 and 4-7. Anything new means continue at step 1.
 1. Read the latest runbook. The snapshot in the task may be stale.
 2. Prune first. Check every tracked item against its lift trigger. Remove resolved, stale, and past-date items.
 3. Run the seeded scripts: `script-run` with name `schedule-health`, then `task-failure-audit`, both with `args: { days: 1, publishPage: false }`. They report failing schedules and failure clusters. Check any other standing order in the runbook yourself.

package/templates/skills/work-on-task/SKILL.md

@@ -13,4 +13,8 @@ When the task names a skill (`researching`, `planning`, `implementing`), use it.
 
 Finish the task with one of the four endings in your operating contract: `completed`, `defer-task`, `request-human-input`, or `failed`. Then stop.
 
+Resuming (a resume task, or work cut by a graceful shutdown): read the parent's last progress line, then re-read live state once (PR state and head SHA, branch, `git status`) before new work. Re-run controls only if the head moved. Never redo a pushed commit or open a second PR for the same branch. Store a progress line with branch, PR number and head SHA each time you push.
+
+Write times in replies, outputs and defer notes in the requester's timezone when the Requester Profile names one, never raw UTC.
+
 If the user interrupts, follow their instructions. To resume, call `/work-on-task <taskId>` again.

package/templates/skills/work-on-task/content.md

@@ -8,4 +8,8 @@ When the task names a skill (`researching`, `planning`, `implementing`), use it.
 
 Finish the task with one of the four endings in your operating contract: `completed`, `defer-task`, `request-human-input`, or `failed`. Then stop.
 
+Resuming (a resume task, or work cut by a graceful shutdown): read the parent's last progress line, then re-read live state once (PR state and head SHA, branch, `git status`) before new work. Re-run controls only if the head moved. Never redo a pushed commit or open a second PR for the same branch. Store a progress line with branch, PR number and head SHA each time you push.
+
+Write times in replies, outputs and defer notes in the requester's timezone when the Requester Profile names one, never raw UTC.
+
 If the user interrupts, follow their instructions. To resume, call `/work-on-task <taskId>` again.

package/templates/skills/workflow-iterate/content.md

@@ -173,6 +173,15 @@ Afterwards, a `warnings` entry on `create-workflow` or a patch tool means the ke
 - Do not set `retry` or `validation.retry` on a `system-one-decision` node. It retries connection errors, 408, 429, and 5xx itself (`config.maxRetries`, 0 to 3, default 2) inside `config.timeoutMs` (default 30000). A 401, a 422, or an answer that fails validation ends after one attempt.
 - The node reads its provider's key (`TYPESAFE_API_KEY`, `OPENROUTER_API_KEY`, `LAYA_API_KEY`, `OPENAI_DECISIONS_API_KEY`, or `CLOUDFLARE_API_TOKEN`, plus `LAYA_URL` for `laya` and `CLOUDFLARE_ACCOUNT_ID` for `cloudflare`) server-side. The key never appears in the definition, the step output, or an error. A run whose key or `LAYA_URL` is missing fails before any node executes, and a 401 or 403 fails the step as `<KEY> was rejected`. An unresolved `{{token}}` fails the step before any request.
 
+### `human-in-the-loop` (how approvals render)
+
+The same rules apply to a standalone `request-human-input` call.
+
+- **Dashboard card.** `title` is plain text. Each question's `label` is its heading and renders as markdown. `description` renders as full markdown and is the only field that shows images, so put drafts, diffs, and logs there.
+- **Code.** Fence code, logs, and JSON with a language (```` ```json ````): the block keeps its lines and scrolls. Fence a prose draft with no language: it wraps. A single newline outside a fence becomes a paragraph break.
+- **Images.** Put an `http(s)` URL ending in `.png`, `.jpg`, `.jpeg`, `.gif`, or `.webp` alone on its own line in `description`, or use `![alt](url)`. The link must outlive the request: an expired presigned URL shows an "image unavailable" note.
+- **Slack.** A node's `notifications` post the title, the question labels (each collapsed to one line, capped at 3000 characters in total), a Review button, and the timeout. Descriptions, options, code, and images are not shown, so the title and labels must make sense alone. `request-human-input` posts nothing to Slack: share the returned URL yourself.
+
 ### `swarm-script`
 
 ```json

package/dist/acp-adapter-w6zws6me.js

@@ -1,23 +0,0 @@
-import {
-  ACPAdapter,
-  applyConfiguredOptions,
-  sanitizeAcpConfigOptions,
-  toAcpMcpServers
-} from "./cli-5anb0ev3.js";
-import"./cli-32bca7nr.js";
-import"./cli-tng3131n.js";
-import"./cli-fw6vdcq5.js";
-import"./cli-ttbsse3f.js";
-import"./cli-dpvkp2et.js";
-import"./cli-zt3w1cn1.js";
-import"./cli-zsh093hk.js";
-import"./cli-w5e1d1vv.js";
-import"./cli-1kzfvd1z.js";
-import"./cli-h1spv8v4.js";
-import"./cli-bc05qbss.js";
-export {
-  ACPAdapter,
-  applyConfiguredOptions,
-  sanitizeAcpConfigOptions,
-  toAcpMcpServers
-};

package/dist/boot-scrub-logs-246yn076.js

@@ -1,99 +0,0 @@
-import {
-  getDbClient,
-  init_db
-} from "./cli-qdv8kgz7.js";
-import"./cli-9s3h836g.js";
-import"./cli-3qhyh31j.js";
-import"./cli-3a4m1aws.js";
-import"./cli-7mm2r1kp.js";
-import"./cli-g5erf0zt.js";
-import"./cli-dmtrxqhg.js";
-import"./cli-tadfgd0t.js";
-import"./cli-ywybs5as.js";
-import"./cli-gd4favx9.js";
-import"./cli-agamgm0p.js";
-import"./cli-5c2j5yvx.js";
-import"./cli-1a2j50m0.js";
-import"./cli-f9w1semm.js";
-import"./cli-ej6gbxfb.js";
-import"./cli-zsh093hk.js";
-import"./cli-sd0mxa3c.js";
-import"./cli-w5e1d1vv.js";
-import"./cli-1kzfvd1z.js";
-import"./cli-zf8jjwex.js";
-import {
-  init_secret_scrubber,
-  scrubSecrets
-} from "./cli-h1spv8v4.js";
-import"./cli-bc05qbss.js";
-
-// src/be/boot-scrub-logs.ts
-init_secret_scrubber();
-init_db();
-var SCRUB_KEY = "boot-scrub-logs-v2";
-var CURSOR_KEY = "boot-scrub-logs-v2-cursor";
-var BATCH_SIZE = 200;
-var yieldTick = () => new Promise((r) => setTimeout(r, 5));
-async function runBootScrubLogs() {
-  const done = await getDbClient().get("SELECT key FROM seed_state WHERE kind = ? AND key = ?", ["maintenance", SCRUB_KEY]);
-  if (done)
-    return;
-  const savedCursor = (await getDbClient().get("SELECT seededHash FROM seed_state WHERE kind = ? AND key = ?", ["maintenance", CURSOR_KEY]))?.seededHash ?? "";
-  const lastProcessedId = savedCursor || "";
-  const totalRemaining = (await getDbClient().get(`SELECT COUNT(*) as count FROM session_logs
-         WHERE id > ?
-           AND (content LIKE '%lin!_oauth!_%' ESCAPE '!'
-             OR content LIKE '%lin!_api!_%' ESCAPE '!'
-             OR content LIKE '%npm!_%' ESCAPE '!'
-             OR content LIKE '%ATATT%')`, [lastProcessedId]))?.count ?? 0;
-  if (totalRemaining === 0) {
-    await markDone();
-    return;
-  }
-  console.log(`[boot-scrub-logs] starting: ${totalRemaining} candidate rows remaining` + (lastProcessedId ? ` (resuming from cursor ${lastProcessedId.slice(0, 8)}…)` : ""));
-  const saveCursorSql = `INSERT INTO seed_state (kind, key, seededHash, seededAt)
-     VALUES ('maintenance', '${CURSOR_KEY}', ?, datetime('now'))
-     ON CONFLICT (kind, key) DO UPDATE SET seededHash = ?, seededAt = datetime('now')`;
-  let scrubbed = 0;
-  let scanned = 0;
-  let cursor = lastProcessedId;
-  for (;; ) {
-    const rows = await getDbClient().query(`SELECT id, content FROM session_logs
-       WHERE id > ?
-         AND (content LIKE '%lin!_oauth!_%' ESCAPE '!'
-           OR content LIKE '%lin!_api!_%' ESCAPE '!'
-           OR content LIKE '%npm!_%' ESCAPE '!'
-           OR content LIKE '%ATATT%')
-       ORDER BY id ASC
-       LIMIT ${BATCH_SIZE}`, [cursor]);
-    if (rows.length === 0)
-      break;
-    const batchLastId = rows[rows.length - 1].id;
-    await getDbClient().transaction(async (tx) => {
-      for (const row of rows) {
-        const cleaned = scrubSecrets(row.content);
-        if (cleaned !== row.content) {
-          await tx.run("UPDATE session_logs SET content = ? WHERE id = ?", [cleaned, row.id]);
-          scrubbed++;
-        }
-      }
-      await tx.run(saveCursorSql, [batchLastId, batchLastId]);
-    });
-    scanned += rows.length;
-    cursor = batchLastId;
-    await yieldTick();
-  }
-  await markDone();
-  await getDbClient().run("DELETE FROM seed_state WHERE kind = 'maintenance' AND key = ?", [
-    CURSOR_KEY
-  ]);
-  console.log(`[boot-scrub-logs] complete: scanned=${scanned} scrubbed=${scrubbed}`);
-}
-async function markDone() {
-  await getDbClient().run(`INSERT INTO seed_state (kind, key, seededHash, seededAt)
-     VALUES ('maintenance', ?, 'done', datetime('now'))
-     ON CONFLICT (kind, key) DO UPDATE SET seededHash = 'done', seededAt = datetime('now')`, [SCRUB_KEY]);
-}
-export {
-  runBootScrubLogs
-};