@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/src/realtime/browser.ts

@@ -85,11 +85,11 @@ class Connection extends Events {
       };
       socket.onerror = () => reject(new Error("Realtime connection failed"));
       socket.onmessage = (event) => {
-        const message = JSON.parse(event.data) as Frame;
+        const payload = JSON.parse(event.data);
+        const message = payload as Frame;
         if (message.seq) socket.send(JSON.stringify({ ack: message.seq }));
         if (message.type === "hello") this.me = message.me;
-        if (message.type === "room")
-          this.rooms.get(message.name ?? "")?.receive(message as unknown as View);
+        if (message.type === "room") this.rooms.get(message.name ?? "")?.receive(payload as View);
         if (message.type === "presence")
           this.rooms.get(message.name ?? "")?.receivePresence(message.peers);
         if (message.type === "channel")

package/src/scheduler/scheduler.ts

@@ -15,6 +15,7 @@ import {
   getUserById,
   getWorkflow,
   getWorkflowRun,
+  recordInlineScriptRun,
   type UpdateScheduledTaskData,
   updateScheduledTask,
 } from "@/be/db";
@@ -32,6 +33,7 @@ import { startWorkflowExecution } from "@/workflows/engine";
 import type { ExecutorRegistry } from "@/workflows/executors/registry";
 import { handleScheduleTrigger } from "@/workflows/triggers";
 import { ensure } from "../utils/business-use";
+import { scrubObject, scrubSecrets } from "../utils/secret-scrubber";
 
 import {
   dispatchDeferredTaskWait,
@@ -83,23 +85,90 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
   }
 
   const agentId = schedule.createdByAgentId ?? "schedule";
-  const output = await runScript({
-    source: script.source,
-    args: schedule.scriptArgs ?? {},
-    fsMode: "none",
+  const args = schedule.scriptArgs ?? {};
+  const record = {
     agentId,
-    egressSecrets: await buildScriptCredentialBindings({ agentId }),
-    apiConnections: getScriptApiConnectionDescriptors({ agentId }),
-    mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
-    timeoutMs: 60_000,
-  });
+    scriptName: schedule.scriptName,
+    // A pointer, not a copy: script schedules fire as often as every minute and
+    // script_runs has no retention sweep, so copying the source on every fire
+    // would grow the table by tens of MB a day. script_versions keeps the text.
+    source: `// Scheduled run of '${script.name}' v${script.version} (global, contentHash ${script.contentHash}) by schedule '${schedule.name}'.\n// Full source: script_versions row for this version.\n`,
+    args,
+    startedAt: new Date().toISOString(),
+  };
+
+  let output: Awaited<ReturnType<typeof runScript>>;
+  try {
+    output = await runScript({
+      source: script.source,
+      args,
+      fsMode: "none",
+      agentId,
+      egressSecrets: await buildScriptCredentialBindings({ agentId }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
+      timeoutMs: 60_000,
+    });
+  } catch (err) {
+    await recordScheduleScriptRun({
+      ...record,
+      status: "failed",
+      error: err instanceof Error ? err.message : String(err),
+    });
+    throw err;
+  }
 
   if (output.exitCode !== 0 || output.error) {
-    throw new Error(
+    const message =
       output.stderr ||
-        `Script '${schedule.scriptName}' exited with code ${output.exitCode}${
-          output.error ? ` (${output.error})` : ""
-        }`,
+      `Script '${schedule.scriptName}' exited with code ${output.exitCode}${
+        output.error ? ` (${output.error})` : ""
+      }`;
+    await recordScheduleScriptRun({
+      ...record,
+      status: "failed",
+      output: output.result,
+      error: message,
+    });
+    throw new Error(message);
+  }
+
+  await recordScheduleScriptRun({ ...record, status: "completed", output: output.result });
+}
+
+/**
+ * Persist a scheduled script fire as a terminal `script_runs` row, so script
+ * audits see schedule-driven runs the same way as POST /api/scripts/run.
+ * Best effort: a persistence error never changes the schedule's outcome.
+ */
+async function recordScheduleScriptRun(run: {
+  agentId: string;
+  scriptName: string;
+  source: string;
+  args: unknown;
+  startedAt: string;
+  status: "completed" | "failed";
+  output?: unknown;
+  error?: string;
+}): Promise<void> {
+  try {
+    await recordInlineScriptRun({
+      id: crypto.randomUUID(),
+      agentId: run.agentId,
+      scriptName: run.scriptName,
+      source: run.source,
+      args: scrubObject(run.args),
+      status: run.status,
+      output: scrubObject(run.output),
+      error: run.error === undefined ? undefined : scrubSecrets(run.error),
+      startedAt: run.startedAt,
+      finishedAt: new Date().toISOString(),
+    });
+  } catch (err) {
+    console.warn(
+      `[scheduler] could not record script run for '${run.scriptName}': ${scrubSecrets(
+        err instanceof Error ? err.message : String(err),
+      )}`,
     );
   }
 }

package/src/scripts-runtime/executors/quickjs-pool-config.ts

@@ -0,0 +1,26 @@
+export const DEFAULT_QUICKJS_POOL_SIZE = 4;
+export const MAX_QUICKJS_POOL_SIZE = 32;
+
+/** Shared by config writes and the executor's deployment-env check. */
+export function validateQuickJSPoolSize(value: unknown): string | null {
+  const error = `Invalid SCRIPT_QUICKJS_POOL_SIZE (must be an integer between 1 and ${MAX_QUICKJS_POOL_SIZE})`;
+  if (typeof value !== "string" && typeof value !== "number") return error;
+  const text = String(value).trim();
+  const size = Number(text);
+  if (
+    !/^\d+$/.test(text) ||
+    !Number.isSafeInteger(size) ||
+    size < 1 ||
+    size > MAX_QUICKJS_POOL_SIZE
+  ) {
+    return error;
+  }
+  return null;
+}
+
+export function resolveQuickJSPoolSize(value: string | undefined): number {
+  if (value === undefined) return DEFAULT_QUICKJS_POOL_SIZE;
+  const error = validateQuickJSPoolSize(value);
+  if (error) throw new Error(error);
+  return Number(value);
+}

package/src/scripts-runtime/executors/quickjs.ts

@@ -1,3 +1,4 @@
+import { resolveQuickJSPoolSize } from "./quickjs-pool-config";
 import type { QuickJSWorkerMessage, QuickJSWorkerRequest } from "./quickjs-worker";
 import type { ExecutorInput, ExecutorOutput, ScriptExecutor, ScriptExecutorError } from "./types";
 
@@ -14,7 +15,7 @@ import type { ExecutorInput, ExecutorOutput, ScriptExecutor, ScriptExecutorError
 
 // Each worker keeps one QuickJS WASM module (~25 ms to load) and runs one job
 // at a time. Jobs beyond the pool size wait in a queue.
-const POOL_SIZE = 4;
+// Size is read when the shared pool is first created; changing it needs an API restart.
 // The worker enforces the wall clock itself. This margin only catches a
 // worker that stopped answering, for example a host call that never settles.
 const UNRESPONSIVE_GRACE_MS = 5_000;
@@ -121,7 +122,13 @@ export class QuickJSScriptExecutor implements ScriptExecutor {
     }
     if (input.signal?.aborted) return emptyOutput("killed");
 
-    sharedPool ??= new QuickJSWorkerPool(POOL_SIZE);
+    try {
+      sharedPool ??= new QuickJSWorkerPool(
+        resolveQuickJSPoolSize(process.env.SCRIPT_QUICKJS_POOL_SIZE),
+      );
+    } catch (error) {
+      return emptyOutput("executor_error", error instanceof Error ? error.message : String(error));
+    }
     const pool = sharedPool;
     const slot = await pool.acquire();
     if (input.signal?.aborted) {

package/src/scripts-runtime/executors/registry.ts

@@ -8,7 +8,7 @@ const EXECUTORS: Record<string, () => ScriptExecutor> = {
 };
 
 export function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native"): ScriptExecutor {
-  const factory = EXECUTORS[name];
+  const factory = EXECUTORS[name.trim()];
   if (!factory) {
     throw new Error(
       `Unknown SCRIPT_EXECUTOR: ${name}. Available: ${Object.keys(EXECUTORS).join(", ")}`,

package/src/server.ts

@@ -323,6 +323,7 @@ function resolveToolAllowlist(value: string | undefined): string[] | undefined {
 
 /** Drop every registered tool the allowlist does not name; warn on unknown names. */
 function applyToolAllowlist(server: McpServer, allowlist: readonly string[]): void {
+  // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- the MCP SDK keeps its tool registry private.
   const tools = (server as unknown as { _registeredTools: Record<string, { remove(): void }> })
     ._registeredTools;
   const allowed = new Set(allowlist);

package/src/slack/actions.ts

@@ -5,6 +5,7 @@ import { slackContextKey } from "../tasks/context-key";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { buildCancelledBlocks, getTaskLink } from "./blocks";
 import { resolveSlackUserId } from "./enrich";
+import { ignoreSlackInbound, noteSlackInboundSideEffect } from "./inbound-dispatch";
 import { ensureSlackThreadTree, isSlackRenderV2Enabled } from "./render-v2";
 import { getAgentDisplayName, getAgentEmoji } from "./responses";
 
@@ -70,10 +71,12 @@ export function registerActionHandlers(app: App): void {
     const taskId = view.private_metadata;
     const followUpText = view.state.values.follow_up_input?.follow_up_text?.value || "";
 
-    if (!taskId || !followUpText) return;
+    if (!taskId || !followUpText) return ignoreSlackInbound("empty_follow_up");
 
     const originalTask = await getTaskById(taskId);
-    if (!originalTask || !originalTask.slackChannelId) return;
+    if (!originalTask || !originalTask.slackChannelId) {
+      return ignoreSlackInbound("follow_up_target_missing");
+    }
 
     const lead = await getLeadAgent();
     // Resolve via the shared cascade. Sample context = the modal callback ID
@@ -82,6 +85,7 @@ export function registerActionHandlers(app: App): void {
       sampleEventType: "view_submission",
       sampleContext: view.callback_id || "follow_up_submit",
     });
+    noteSlackInboundSideEffect("task_created");
     const followUpTask = await createTaskWithSiblingAwareness(
       followUpText,
       {

package/src/slack/app.ts

@@ -3,6 +3,7 @@ import { emitBuiltInIntegrationConnectedOnce, ensureSlackRenderV2Activation } fr
 import { getSlackConfiguration } from "./config";
 import { type SlackConnectionState, setSlackConnectionState } from "./connection-state";
 import { installSlackEgressScrub } from "./egress-scrub";
+import { slackInboundOutcomeMiddleware } from "./inbound-dispatch";
 import { getSlackSocketModeBlockReason, SLACK_DEV_SOCKET_MODE_OPT_IN } from "./socket-mode-guard";
 import { startTaskWatcher, stopTaskWatcher } from "./watcher";
 
@@ -103,6 +104,10 @@ export async function initSlackApp(): Promise<App | null> {
   // Failed validation must remain retryable without requiring stopSlackApp().
   initialized = true;
 
+  // First global middleware: every handler below runs inside it, so each
+  // delivery resolves to an explicit processed/ignored/failed/uncertain outcome.
+  app.use(slackInboundOutcomeMiddleware());
+
   // Register handlers
   const { registerMessageHandler } = await import("./handlers");
   const { registerCommandHandler } = await import("./commands");

package/src/slack/assistant.ts

@@ -6,6 +6,12 @@ import { ackSlackMessage, reactionName } from "./ack";
 import { resolveSlackUserId, rewriteSlackMentions } from "./enrich";
 import { wasEventSeen } from "./event-dedup";
 import type { SlackFile } from "./files";
+import {
+  ignoreSlackInbound,
+  isAdmittedSlackDelivery,
+  noteSlackInboundSideEffect,
+  reportSlackInboundFailure,
+} from "./inbound-dispatch";
 import {
   buildEffectiveText,
   createSlackTaskWithFiles,
@@ -47,6 +53,7 @@ export function createAssistant(): Assistant {
         });
       } catch (error) {
         console.error("[Slack] Assistant threadStarted error:", error);
+        reportSlackInboundFailure("assistant_thread_started_error");
       }
     },
 
@@ -56,11 +63,12 @@ export function createAssistant(): Assistant {
 
     userMessage: async ({ message, body, say, setStatus, setTitle, getThreadContext, client }) => {
       // Slack retries deliveries on 3s timeout / 5xx. Drop duplicates before
-      // any task-creation work runs (DES-293).
+      // any task-creation work runs (DES-293). A delivery admitted from a
+      // durable receipt was already deduplicated by its unique key.
       const eventId = body?.event_id;
-      if (wasEventSeen(eventId)) {
+      if (!isAdmittedSlackDelivery() && wasEventSeen(eventId)) {
         console.log(`[Slack] dropping Slack retry: event_id=${eventId}`);
-        return;
+        return ignoreSlackInbound("duplicate_event");
       }
 
       // Wrap setStatus/setTitle to swallow all errors gracefully.
@@ -94,7 +102,7 @@ export function createAssistant(): Assistant {
 
       try {
         // Cast to access fields — Bolt's message union type is complex
-        const msg = message as unknown as Record<string, unknown>;
+        const msg: Record<string, unknown> = { ...message };
         const threadTs = (msg.thread_ts as string) || message.ts;
         const channelId = message.channel;
         statusThread = { channelId, threadTs };
@@ -123,7 +131,7 @@ export function createAssistant(): Assistant {
             console.log(
               `[Slack] assistant: skipping message in ${channelId}/${threadTs} — mentions another user, not us`,
             );
-            return;
+            return ignoreSlackInbound("other_user_mention");
           }
         }
 
@@ -142,6 +150,7 @@ export function createAssistant(): Assistant {
 
         // Follow-up message → buffer text and file metadata until the flush.
         if (workingAgent && workingAgent.status !== "offline" && isAdditiveSlack()) {
+          noteSlackInboundSideEffect("thread_buffer");
           bufferThreadMessage(
             channelId,
             threadTs,
@@ -282,6 +291,7 @@ export function createAssistant(): Assistant {
         // setStatus shows typing indicator — watcher will post final result when done
       } catch (error) {
         console.error("[Slack] Assistant userMessage error:", error);
+        reportSlackInboundFailure("assistant_user_message_error");
       }
     },
   });

package/src/slack/egress-scrub.ts

@@ -64,7 +64,7 @@ const INSTALLED = Symbol.for("agent-swarm.slack-egress-scrub");
 
 type PatchableProto = {
   apiCall: (method: string, options?: Args) => Promise<unknown>;
-  filesUploadV2: (options: object) => Promise<unknown>;
+  filesUploadV2: (options: Args) => Promise<unknown>;
   [INSTALLED]?: true;
 };
 
@@ -73,6 +73,7 @@ type PatchableProto = {
  * Call it before the Bolt `App` (and its receiver) are constructed.
  */
 export function installSlackEgressScrub(): void {
+  // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- we patch private WebClient prototype methods.
   const proto = webApi.WebClient.prototype as unknown as PatchableProto;
   if (proto[INSTALLED]) return;
   const originalApiCall = proto.apiCall;
@@ -80,7 +81,7 @@ export function installSlackEgressScrub(): void {
   proto.apiCall = function (this: unknown, method: string, options?: Args) {
     return originalApiCall.call(this, method, scrubSlackWriteArgs(method, options));
   };
-  proto.filesUploadV2 = function (this: unknown, options: object) {
+  proto.filesUploadV2 = function (this: unknown, options: Args) {
     return originalUpload.call(this, scrubSlackUploadArgs(options));
   };
   proto[INSTALLED] = true;

package/src/slack/handlers.ts

@@ -21,6 +21,12 @@ import { buildTreeBlocks, type TreeNode } from "./blocks";
 import { enrichSlackUserEmail, resolveSlackUserId, rewriteSlackMentions } from "./enrich";
 import { wasEventSeen } from "./event-dedup";
 import type { SlackFile } from "./files";
+import {
+  ignoreSlackInbound,
+  isAdmittedSlackDelivery,
+  noteSlackInboundSideEffect,
+  reportSlackInboundFailure,
+} from "./inbound-dispatch";
 import {
   buildEffectiveText,
   createSlackTaskWithFiles,
@@ -409,17 +415,18 @@ export function registerMessageHandler(app: App): void {
   // Handle all message events
   app.event("message", async ({ event, body, client, say }) => {
     // Slack retries deliveries on 3s timeout / 5xx. Drop the duplicates
-    // before any task-creation work runs (DES-293).
+    // before any task-creation work runs (DES-293). A delivery admitted from a
+    // durable receipt was already deduplicated by its unique key.
     const eventId = body?.event_id;
-    if (wasEventSeen(eventId)) {
+    if (!isAdmittedSlackDelivery() && wasEventSeen(eventId)) {
       console.log(`[Slack] dropping Slack retry: event_id=${eventId}`);
-      return;
+      return ignoreSlackInbound("duplicate_event");
     }
 
     const msg = event as MessageEvent;
 
     // Ignore message_changed events
-    if (msg.subtype === "message_changed") return;
+    if (msg.subtype === "message_changed") return ignoreSlackInbound("message_changed");
 
     // Cache bot user ID on first message (avoids calling auth.test on every event)
     if (!cachedBotUserId) {
@@ -438,24 +445,26 @@ export function registerMessageHandler(app: App): void {
     // causing agent completion messages to be misidentified as human messages
     // and triggering duplicate task creation.
     if (isBotMessage(msg, cachedBotUserId)) {
-      return;
+      return ignoreSlackInbound("bot_message");
     }
     const hasText = !!msg.text?.trim();
     const hasFiles = !!(msg.files && msg.files.length > 0);
 
     // Require either text or files, and always require a user
-    if ((!hasText && !hasFiles) || !msg.user) return;
+    if ((!hasText && !hasFiles) || !msg.user) return ignoreSlackInbound("empty_message");
 
-    // Deduplicate events (Slack can send same event twice)
+    // Deduplicate events (Slack can send same event twice). An admitted
+    // delivery skips this cache too: a retry of a receipt released after a
+    // pre-side-effect failure must not be dropped as its own duplicate.
     const messageKey = `${msg.channel}:${msg.ts}`;
-    if (isMessageProcessed(messageKey)) {
-      return;
+    if (!isAdmittedSlackDelivery() && isMessageProcessed(messageKey)) {
+      return ignoreSlackInbound("duplicate_message");
     }
 
     // Check user authorization
     if (!(await isUserAllowed(client, msg.user))) {
       console.log(`[Slack] Ignoring message from unauthorized user ${msg.user}`);
-      return;
+      return ignoreSlackInbound("unauthorized_user");
     }
 
     // Resolve canonical user identity via the three-step cascade:
@@ -468,6 +477,7 @@ export function registerMessageHandler(app: App): void {
     });
 
     // Keep channel/user for legacy consumers and channelId/userId for the extension contract.
+    noteSlackInboundSideEffect("workflow_event");
     workflowEventBus.emit("slack.message", {
       channel: msg.channel,
       channelId: msg.channel,
@@ -486,7 +496,7 @@ export function registerMessageHandler(app: App): void {
       console.error(
         "[Slack] Bot user ID unavailable — skipping message to avoid silent misbehavior",
       );
-      return;
+      return reportSlackInboundFailure("bot_user_unavailable");
     }
     const botUserId = cachedBotUserId;
 
@@ -523,6 +533,7 @@ export function registerMessageHandler(app: App): void {
           `[Slack] !now command detected in thread ${threadKey}${nowMessage ? ` with message: "${nowMessage}"` : ""}`,
         );
 
+        noteSlackInboundSideEffect("thread_flush");
         if (nowMessage || msg.files?.length) {
           bufferThreadMessage(
             msg.channel,
@@ -553,7 +564,7 @@ export function registerMessageHandler(app: App): void {
         console.log(
           `[Slack] Skipping ADDITIVE buffer in ${msg.channel}/${msg.thread_ts}: message mentions another user`,
         );
-        return;
+        return ignoreSlackInbound("other_user_mention");
       }
       // Treat the thread as having swarm activity if either:
       //  - a Slack task is already linked to it (someone started it via @mention), or
@@ -565,6 +576,7 @@ export function registerMessageHandler(app: App): void {
 
       if (hasSwarmActivity) {
         const threadKey = `${msg.channel}:${msg.thread_ts}`;
+        noteSlackInboundSideEffect("thread_buffer");
         bufferThreadMessage(
           msg.channel,
           msg.thread_ts,
@@ -614,7 +626,7 @@ export function registerMessageHandler(app: App): void {
     );
     if (routeResult.action === "block") {
       console.info("[Slack] Extension blocked message routing:", scrubSecrets(routeResult.reason));
-      return;
+      return ignoreSlackInbound("extension_blocked");
     }
 
     let matches: AgentMatch[] | undefined;
@@ -658,7 +670,7 @@ export function registerMessageHandler(app: App): void {
     );
 
     if (matches.length === 0) {
-      if (!botMentioned && !isImplicitMention) return;
+      if (!botMentioned && !isImplicitMention) return ignoreSlackInbound("not_addressed");
 
       // Bot was mentioned (or message is in assistant thread) but no online agents matched — queue the request
       if (!checkRateLimit(msg.user)) {
@@ -668,7 +680,7 @@ export function registerMessageHandler(app: App): void {
             thread_ts: msg.thread_ts || msg.ts,
           });
         }
-        return;
+        return ignoreSlackInbound("rate_limited");
       }
 
       await using inbound = await fetchSlackFiles(client, msg.files);
@@ -683,7 +695,7 @@ export function registerMessageHandler(app: App): void {
             thread_ts: msg.thread_ts || msg.ts,
           });
         }
-        return;
+        return ignoreSlackInbound("empty_task");
       }
 
       const threadTs = msg.thread_ts || msg.ts;
@@ -743,7 +755,7 @@ export function registerMessageHandler(app: App): void {
           thread_ts: msg.thread_ts || msg.ts,
         });
       }
-      return;
+      return ignoreSlackInbound("rate_limited");
     }
 
     // Extract task description (the text plus a `[File: …]` line per attachment)
@@ -759,7 +771,7 @@ export function registerMessageHandler(app: App): void {
           thread_ts: msg.thread_ts || msg.ts,
         });
       }
-      return;
+      return ignoreSlackInbound("empty_task");
     }
 
     // Create tasks for each matched agent
@@ -803,6 +815,7 @@ export function registerMessageHandler(app: App): void {
         if (agent.isLead) {
           // Steering only carries text into the running session; a message with
           // files becomes a follow-up task so the files land as attachments.
+          if (msg.thread_ts && inbound.files.length === 0) noteSlackInboundSideEffect("steering");
           const steering =
             msg.thread_ts && inbound.files.length === 0
               ? await requestSlackThreadSteering({
@@ -882,6 +895,11 @@ export function registerMessageHandler(app: App): void {
           results.assigned.push({ agentName: agent.name, taskId: task.id });
         }
       } catch (error) {
+        // A policy block is an answered outcome; anything else is a failure the
+        // user sees as "could not assign" and the dispatcher must not call success.
+        if (!(error instanceof TaskCreationBlockedError)) {
+          reportSlackInboundFailure("task_creation_error");
+        }
         results.failed.push({
           agentName: agent.name,
           reason: error instanceof TaskCreationBlockedError ? error.reason : "error",