@desplega.ai/agent-swarm 1.169.0 → 1.171.1

package/src/http/agents.ts

@@ -44,6 +44,7 @@ import {
   setRuntimeCredentialReady,
   upsertRuntimeInstance,
 } from "../be/multi-runtime";
+import { getPoolForAgent, resolvePoolDelivery } from "../be/runtime-pools/db";
 import { ACP_TARGET_IDS } from "../providers/acp-target-catalog";
 import { reasoningCapability } from "../providers/reasoning-effort";
 import { ALL_CAPABILITIES, getEnabledCapabilities } from "../server";
@@ -57,6 +58,7 @@ import {
   AgentSchema,
   AgentStatusSchema,
   AgentWithTasksSchema,
+  DeliveryModeSchema,
   type ProfileSyncConflict,
   type ProviderName,
   ProviderNameSchema,
@@ -77,7 +79,10 @@ import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
 } from "../utils/identity-field-budget";
+import { isLeadChannelMonitoringEnabled } from "../utils/lead-monitor-channels";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
+import { getRequestAuth } from "../utils/request-auth-context";
+import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route, runtimeInstanceHeader } from "./route-def";
 import { agentWithCapacity, json, jsonError } from "./utils";
@@ -116,6 +121,8 @@ const AgentWithCapacityAndTasksSchema = AgentWithTasksSchema.extend({
 /** POST /api/agents response: the agent row plus the server's capability flags. */
 const RegisterAgentResponseSchema = AgentSchema.extend({
   enabledCapabilities: z.array(CapabilitySchema),
+  deliveryMode: DeliveryModeSchema,
+  pollRequired: z.boolean().optional(),
 });
 
 /** Shape shared by the single- and bulk- credential-status endpoints. */
@@ -634,6 +641,14 @@ export async function handleAgentRegister(
     }
 
     const agentId = myAgentId || crypto.randomUUID();
+    const auth = getRequestAuth(req);
+    if (auth?.kind === "agent") {
+      parsed.body = { ...parsed.body, isLead: (await getAgentById(auth.agentId))?.isLead ?? false };
+      if (auth.runtimeId && parsed.body.runtimeInstanceId !== auth.runtimeId) {
+        jsonError(res, "runtimeInstanceId does not match token", 403);
+        return true;
+      }
+    }
     // Read once so one mode applies consistently even if a config reload
     // flips the flag mid-request.
     const multiRuntime = isMultiRuntimeEnabled();
@@ -802,9 +817,15 @@ export async function handleAgentRegister(
     // transaction right after confirming the row exists — it cannot actually
     // be null here. (Same value as before; this only affects the compile-time
     // type used to check the response schema.)
+    const pollRequired = result.agent!.isLead && isLeadChannelMonitoringEnabled();
     registerAgent.respond(res, result.created ? 201 : 200, {
       ...result.agent!,
       enabledCapabilities: getEnabledCapabilities(),
+      pollRequired,
+      deliveryMode:
+        !pollRequired && isRuntimePoolsEnabled()
+          ? resolvePoolDelivery((await getPoolForAgent(agentId)) ?? { delivery: null })
+          : "poll",
     });
     return true;
   }

package/src/http/all-routes.ts

@@ -64,10 +64,16 @@ import "./stats";
 import "./status";
 import "./tasks";
 import "./task-templates";
+import "./telemetry-ui";
 import "./trackers/jira";
 import "./trackers/linear";
+import "./used-by";
+import "./fleet-benchmark";
 import "./users";
 import "./webhooks";
 import "./workflow-events";
 import "./workflows";
 import "./x";
+
+import "./runtime-pools";
+import "./controllers-connect";

package/src/http/apps.ts

@@ -1698,7 +1698,9 @@ export async function handleApps(
     }
     if (definitionNeedsRepair(res, app)) return true;
     const schema = app.definition.userConfig ?? {};
-    const owner = await resolveHttpFavoriteOwner(req, myAgentId);
+    // App settings stay in the shared operator scope for dashboard tabs; only
+    // favorites follow the picked dashboard user.
+    const owner = await resolveHttpFavoriteOwner(req, myAgentId, { dashboardUser: false });
     const stored = owner ? await getAppUserConfigValues(app.id, owner.scope) : {};
     getUserConfigRoute.respond(res, 200, { values: mergeUserConfigValues(schema, stored), schema });
     return true;
@@ -1730,7 +1732,7 @@ export async function handleApps(
       jsonError(res, "app does not define userConfig", 400);
       return true;
     }
-    const owner = await resolveHttpFavoriteOwner(req, myAgentId);
+    const owner = await resolveHttpFavoriteOwner(req, myAgentId, { dashboardUser: false });
     if (!owner) {
       jsonError(res, "userConfig is per-user; agents have no user scope", 403);
       return true;

package/src/http/auth.ts

@@ -3,7 +3,7 @@ import { getPage } from "../be/db";
 import {
   findUserById,
   fingerprintApiKey,
-  resolveBySessionToken,
+  resolveSessionToken,
   resolveUserByToken,
 } from "../be/users";
 import type { User } from "../types";
@@ -13,8 +13,7 @@ import type { HttpRequestAuth } from "../utils/request-auth-context";
 function extractBearer(req: IncomingMessage): string | null {
   const raw = req.headers.authorization;
   const header = Array.isArray(raw) ? raw[0] : raw;
-  if (!header?.startsWith("Bearer ")) return null;
-  return header.slice("Bearer ".length).trim();
+  return header?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim() ?? null;
 }
 
 function singleHeader(req: IncomingMessage, name: string): string | null {
@@ -26,6 +25,7 @@ function singleHeader(req: IncomingMessage, name: string): string | null {
 export async function resolveHttpRequestAuth(
   req: IncomingMessage,
   apiKey: string | undefined,
+  options: { touchSessionToken?: boolean } = {},
 ): Promise<HttpRequestAuth | null> {
   const bearer = extractBearer(req);
   if (!bearer) return null;
@@ -61,10 +61,7 @@ export async function resolveHttpRequestAuth(
   }
 
   if (bearer.startsWith("aseph_")) {
-    const principal = await resolveBySessionToken(bearer);
-    if (principal) {
-      return { kind: "agent", agentId: principal.agentId, taskId: principal.taskId };
-    }
+    return await resolveSessionToken(bearer, { touch: options.touchSessionToken });
   }
 
   return null;

package/src/http/config.ts

@@ -14,6 +14,7 @@ import {
   resetAgentMaxTasksMirror,
   upsertSwarmConfigWithPolicyMirror,
 } from "../be/multi-runtime";
+import { fillOrgLogoFromWebsite } from "../be/org-profile";
 import { getUserGrant } from "../be/rbac-roles";
 import {
   internalConfigKeyError,
@@ -28,11 +29,11 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
 import { route } from "./route-def";
-import { jsonError } from "./utils";
+import { duplicateGuardedQueryKey, jsonError } from "./utils";
 
 const MAX_ENV_PRESENCE_KEYS = 200;
 const SECRETS_FORCE_MASK_NOTE =
-  " (secret values masked: reading unmasked secrets requires the lead agent)";
+  " (secret values masked: this token cannot read secrets in this scope)";
 
 // Config keys the API server owns for its own use and must NEVER hand out over
 // HTTP — workers/entrypoints read config to build their env, and the agent-fs
@@ -52,32 +53,47 @@ function singleHeader(req: IncomingMessage, name: string): string | undefined {
   return Array.isArray(raw) ? raw[0] : raw;
 }
 
-async function requestMayReadSecrets(req: IncomingMessage): Promise<boolean> {
+async function requestSecretReadScope(
+  req: IncomingMessage,
+  resolvedScope?: { agentId?: string; repoId?: string },
+): Promise<"all" | "self" | "none"> {
   const auth = getRequestAuth(req);
-  if (auth?.kind === "operator") return true;
+  if (auth?.kind === "operator") return "all";
   if (auth?.kind === "agent") {
     const agent = await getAgentById(auth.agentId);
-    return can({
-      principal: { kind: "agent", agentId: auth.agentId, isLead: agent?.isLead ?? false },
-      verb: "config.read.secrets",
-      resource: { kind: "none" },
-      source: "http",
-    }).allow;
+    if (
+      can({
+        principal: { kind: "agent", agentId: auth.agentId, isLead: agent?.isLead ?? false },
+        verb: "config.read.secrets",
+        resource: { kind: "none" },
+        source: "http",
+      }).allow
+    )
+      return "all";
+    if (!auth.runtimeId || resolvedScope?.agentId !== auth.agentId) return "none";
+    return "self";
   }
-  if (auth?.kind === "guest") return false;
+  if (auth?.kind === "guest") return "none";
   // Preserve legacy reads without a user or session-token principal.
-  if (auth?.kind !== "user") return true;
-  if (!isRbacEnabled()) return true;
+  if (auth?.kind !== "user") return "all";
+  if (!isRbacEnabled()) return "all";
 
   const grant = await getUserGrant(auth.userId);
-  return grant.grantsAll || grant.verbs.has("config.read.secrets");
+  return grant.grantsAll || grant.verbs.has("config.read.secrets") ? "all" : "none";
 }
 
-async function resolveSecretsRead(req: IncomingMessage, includeSecrets: boolean) {
-  if (!includeSecrets || (await requestMayReadSecrets(req))) {
-    return { effectiveIncludeSecrets: includeSecrets, secretsNote: "" };
-  }
-  return { effectiveIncludeSecrets: false, secretsNote: SECRETS_FORCE_MASK_NOTE };
+async function resolveSecretsRead(
+  req: IncomingMessage,
+  includeSecrets: boolean,
+  resolvedScope?: { agentId?: string; repoId?: string },
+) {
+  const scope = await requestSecretReadScope(req, resolvedScope);
+  const auth = getRequestAuth(req);
+  return {
+    effectiveIncludeSecrets: includeSecrets && scope !== "none",
+    includeRepoSecrets: !(auth?.kind === "agent" && auth.runtimeId && scope !== "all"),
+    secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : "",
+  };
 }
 
 /**
@@ -293,16 +309,34 @@ export async function handleConfig(
   pathSegments: string[],
   queryParams: URLSearchParams,
 ): Promise<boolean> {
+  if (getRequestAuth(req)?.kind === "agent") {
+    const duplicate = duplicateGuardedQueryKey(queryParams);
+    if (duplicate) {
+      jsonError(res, `Duplicate query parameter: ${duplicate}`, 400);
+      return true;
+    }
+  }
   if (getResolvedConfigRoute.match(req.method, pathSegments)) {
     const parsed = await getResolvedConfigRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
-    const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
     const key = parsed.query.key;
+    const auth = getRequestAuth(req);
+    const resolvedScope = {
+      agentId:
+        parsed.query.agentId ||
+        (auth?.kind === "agent" && auth.runtimeId ? auth.agentId : undefined),
+      repoId: parsed.query.repoId || undefined,
+    };
+    const { effectiveIncludeSecrets, includeRepoSecrets, secretsNote } = await resolveSecretsRead(
+      req,
+      includeSecrets,
+      resolvedScope,
+    );
     // Filter by key before masking and before any secret is registered, so a
     // caller asking for one key never receives the rest (matches get-config).
     const configs = stripApiOnlyKeys(
-      await getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined),
+      await getResolvedConfig(resolvedScope.agentId, resolvedScope.repoId, { includeRepoSecrets }),
     ).filter((c) => !key || c.key === key);
     const result = effectiveIncludeSecrets ? configs : maskSecrets(configs);
     if (effectiveIncludeSecrets) {
@@ -451,6 +485,9 @@ export async function handleConfig(
       // (CLI, automation, dashboard) don't have to remember to hit /reload.
       // Debounced to coalesce sequential single-key upserts from the dashboard
       // batch save (no bulk endpoint exists).
+      if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
+        await fillOrgLogoFromWebsite(String(value));
+      }
       if (scope === "global") {
         scheduleIntegrationsReload();
       }

package/src/http/controllers-connect.ts

@@ -0,0 +1,206 @@
+import type { IncomingMessage, Server } from "node:http";
+import type { Duplex } from "node:stream";
+import { type WebSocket, WebSocketServer } from "ws";
+import { getDbClient } from "../be/db";
+import { ensureRuntimeOwnerId, reconcileRemoteProvisions } from "../be/runtime-pools/controllers";
+import { getRuntimeController } from "../be/runtime-pools/db";
+import {
+  installRemoteController,
+  RemoteController,
+  remoteControllerSession,
+  removeRemoteController,
+} from "../be/runtime-pools/remote-controller";
+import { reconcileControllerOrphans } from "../be/runtime-pools/supervisor";
+import {
+  CONTROLLER_PING_INTERVAL_MS,
+  CONTROLLER_PROTOCOL_VERSION,
+  ControllerClientMessageSchema,
+} from "../runtime-providers/controller-protocol";
+import { getApiKey } from "../utils/api-key";
+import type { HttpRequestAuth } from "../utils/request-auth-context";
+import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
+import { scrubSecrets } from "../utils/secret-scrubber";
+import { registerSessionTokenConnection } from "../utils/session-token-connections";
+import { resolveHttpRequestAuth } from "./auth";
+import { route } from "./route-def";
+
+const connectRoute = route({
+  method: "get",
+  path: "/api/controllers/connect",
+  pattern: ["api", "controllers", "connect"],
+  summary: "Connect a remote runtime controller",
+  description:
+    "Requires a controller token and a WebSocket upgrade. Accepts one session per controller.",
+  tags: ["Runtime pools"],
+  responses: {
+    101: { description: "Controller socket connected" },
+    401: { description: "Controller token required" },
+    404: { description: "Runtime pools disabled" },
+  },
+});
+
+type ControllerAuth = Extract<HttpRequestAuth, { kind: "controller" }>;
+class ControllerAuthError extends Error {}
+
+async function reconcileHandles(controller: RemoteController): Promise<void> {
+  const ownerId = await ensureRuntimeOwnerId();
+  const handles = await controller.list(ownerId);
+  await reconcileRemoteProvisions(controller.id, handles, ownerId);
+  await reconcileControllerOrphans(controller.id, controller, ownerId, new Date(), handles);
+}
+
+export function attachControllerTransport(
+  server: Server,
+  options: { commandTimeoutMs?: number; provisionTimeoutMs?: number } = {},
+): () => void {
+  const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 });
+  let closing = false;
+  const onUpgrade = (req: IncomingMessage, socket: Duplex, head: Buffer) => {
+    if (!connectRoute.match(req.method, (req.url?.split("?")[0] ?? "").split("/").filter(Boolean)))
+      return;
+    if (closing || !isRuntimePoolsEnabled()) {
+      socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+      return;
+    }
+    void resolveHttpRequestAuth(req, getApiKey(), { touchSessionToken: false })
+      .then((auth) => {
+        if (auth?.kind !== "controller") throw new Error("Controller token required");
+        if (closing || socket.destroyed) return;
+        wss.handleUpgrade(req, socket, head, (ws) => connect(ws, req, auth));
+      })
+      .catch(() => socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n"));
+  };
+  server.on("upgrade", onUpgrade);
+
+  function connect(ws: WebSocket, req: IncomingMessage, auth: ControllerAuth): void {
+    let session: RemoteController | undefined;
+    let closed = false;
+    let helloReceived = false;
+    let online = false;
+    let alive = true;
+    const unregister = registerSessionTokenConnection(auth.tokenId, () =>
+      ws.close(1008, "Controller token revoked"),
+    );
+    const reportError = (error: unknown) =>
+      console.error("[runtime-controller]", scrubSecrets(String(error)));
+    const closeOnError = (error: unknown) => {
+      const detail = scrubSecrets(String(error));
+      void getDbClient()
+        .run(
+          "UPDATE runtime_controllers SET last_error = ?, last_error_at = ?, status = CASE WHEN status = 'online' THEN status ELSE 'offline' END WHERE id = ?",
+          [detail, new Date().toISOString(), auth.controllerId],
+        )
+        .catch(reportError)
+        .finally(() =>
+          ws.close(
+            error instanceof ControllerAuthError ? 1008 : 1011,
+            error instanceof ControllerAuthError
+              ? "Controller access rejected"
+              : "controller operation failed",
+          ),
+        );
+    };
+    const checkAuth = async () => {
+      const current = await resolveHttpRequestAuth(req, getApiKey(), { touchSessionToken: false });
+      if (current?.kind !== "controller" || current.tokenId !== auth.tokenId)
+        throw new ControllerAuthError("Controller token revoked or expired");
+      if (!isRuntimePoolsEnabled()) throw new Error("Runtime pools disabled");
+    };
+    const hello = async (
+      message: Extract<ReturnType<typeof ControllerClientMessageSchema.parse>, { type: "hello" }>,
+    ) => {
+      await checkAuth();
+      const row = await getRuntimeController(auth.controllerId);
+      if (!row || message.controllerId !== auth.controllerId || message.kind !== row.kind) {
+        throw new ControllerAuthError("Controller identity or kind does not match");
+      }
+      if (closed) return;
+      await getDbClient().run("UPDATE runtime_controllers SET status = 'unknown' WHERE id = ?", [
+        row.id,
+      ]);
+      if (closed) return;
+      session = new RemoteController(
+        row.id,
+        ws,
+        message.traits,
+        row.config.WORKER_API_URL,
+        options,
+      );
+      installRemoteController(session);
+      await reconcileHandles(session);
+      await checkAuth();
+      if (closed || remoteControllerSession(row.id) !== session) return;
+      await getDbClient().run(
+        "UPDATE runtime_controllers SET status = 'online', last_seen_at = ?, updated_at = ?, last_error = NULL, last_error_at = NULL WHERE id = ?",
+        [new Date().toISOString(), new Date().toISOString(), row.id],
+      );
+      online = true;
+    };
+    ws.on("message", (data) => {
+      try {
+        const message = ControllerClientMessageSchema.parse(JSON.parse(data.toString()));
+        if (message.type === "result") {
+          session?.result(message);
+          return;
+        }
+        if (helloReceived) throw new Error("Controller already sent hello");
+        helloReceived = true;
+        void hello(message).catch(closeOnError);
+      } catch {
+        ws.close(1002, "Invalid controller message");
+      }
+    });
+    ws.on("pong", () => {
+      alive = true;
+    });
+    ws.on("error", () => ws.close(1011, "Controller connection failed"));
+    const timer = setInterval(() => {
+      if (!alive || !helloReceived) {
+        ws.terminate();
+        return;
+      }
+      alive = false;
+      ws.ping();
+      void (async () => {
+        await checkAuth();
+        if (online && session && remoteControllerSession(auth.controllerId) === session)
+          await getDbClient().run("UPDATE runtime_controllers SET last_seen_at = ? WHERE id = ?", [
+            new Date().toISOString(),
+            auth.controllerId,
+          ]);
+      })().catch(closeOnError);
+    }, CONTROLLER_PING_INTERVAL_MS);
+    timer.unref();
+    ws.on("close", () => {
+      closed = true;
+      clearInterval(timer);
+      unregister();
+      session?.disconnect("Controller disconnected");
+      if (!session || !removeRemoteController(session)) return;
+      const disconnectedAt = new Date().toISOString();
+      void getDbClient()
+        .run(
+          online
+            ? "UPDATE runtime_controllers SET status = 'offline', updated_at = ?, last_seen_at = ? WHERE id = ?"
+            : "UPDATE runtime_controllers SET status = 'offline' WHERE id = ?",
+          online ? [disconnectedAt, disconnectedAt, auth.controllerId] : [auth.controllerId],
+        )
+        .catch(reportError);
+    });
+    ws.send(
+      JSON.stringify({
+        type: "welcome",
+        controllerId: auth.controllerId,
+        version: CONTROLLER_PROTOCOL_VERSION,
+      }),
+    );
+    void checkAuth().catch(closeOnError);
+  }
+
+  return () => {
+    closing = true;
+    server.off("upgrade", onUpgrade);
+    for (const ws of wss.clients) ws.terminate();
+    wss.close();
+  };
+}