@desplega.ai/agent-swarm 1.173.0 → 2.0.0

package/dist/{cli-7jykv7ef.js → cli-e6mpjhed.js}

@@ -5,7 +5,7 @@ import {
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
 
 // src/providers/codex-oauth/flow.ts
 init_secret_scrubber();

package/dist/{cli-7a93cv8c.js → cli-ee9gtz70.js}

@@ -12,7 +12,7 @@ import {
   generateRandomCodeVerifier,
   generateRandomState,
   oauthAppRowToProviderConfig
-} from "./cli-w1apjecb.js";
+} from "./cli-6razj6t4.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
@@ -36,6 +36,9 @@ import {
   init_oauth,
   init_quickjs_pool_config,
   init_secret_registry,
+  init_swarm_config_guard,
+  isApiOnlyConfigKey,
+  isInternalConfigKey,
   normalizeDateRequired,
   oauthSecretName,
   placeholderForConfigKey,
@@ -46,11 +49,11 @@ import {
   updateAuthorizationTokens,
   upsertAuthorization,
   upsertSwarmConfig
-} from "./cli-fmhj1ehj.js";
+} from "./cli-ef1hg1wv.js";
 import {
   defaultAssetKey,
   init_key
-} from "./cli-hsem16hb.js";
+} from "./cli-cgtksawx.js";
 import {
   init_zod
 } from "./cli-sd0mxa3c.js";
@@ -73,6 +76,10 @@ import {
   init_node_env,
   isDevOrTestNodeEnv
 } from "./cli-p0sg24zp.js";
+import {
+  getMcpBaseUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
@@ -82,12 +89,13 @@ import {
   init_api_key
 } from "./cli-a1b9b32n.js";
 import {
+  createValueScrubber,
   init_secret_scrubber,
   refreshSecretScrubberCache,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
 import {
   __commonJS,
   __require,
@@ -175188,6 +175196,7 @@ var require_dist = __commonJS(function(exports) {
 
 // src/scripts-runtime/loader.ts
 init_api_key();
+init_constants();
 init_secret_scrubber();
 
 // src/scripts-runtime/egress-secrets.ts
@@ -175784,7 +175793,7 @@ async function buildConfigPayload(input) {
       apiKey: { value: apiKey, isSecret: true },
       agentId: { value: input.agentId, isSecret: false },
       mcpBaseUrl: {
-        value: input.mcpBaseUrl ?? process.env.MCP_BASE_URL ?? "http://localhost:3013",
+        value: input.mcpBaseUrl ?? getMcpBaseUrl(),
         isSecret: false
       },
       ...input.runtimeInstanceId ? { runtimeInstanceId: { value: input.runtimeInstanceId, isSecret: false } } : {}
@@ -175808,12 +175817,13 @@ async function runScript(input) {
       error: "executor_error"
     };
   }
+  const runSecrets = createValueScrubber(Object.entries(input.userConfig ?? {}).filter(([, entry]) => entry.isSecret).map(([key, entry]) => ({ value: entry.value, name: `config:${key}` })));
   const imports = validateScriptImports(input.source);
   if (!imports.ok) {
     return {
       result: undefined,
       stdout: "",
-      stderr: imports.diagnostic,
+      stderr: scrubSecrets(runSecrets.text(imports.diagnostic)),
       truncated: { stdout: false, stderr: false },
       durationMs: 0,
       exitCode: 1,
@@ -175844,10 +175854,10 @@ async function runScript(input) {
   }
   return {
     ...output,
-    result: scrubObject(output.result),
-    stdout: scrubSecrets(output.stdout),
-    stderr: scrubSecrets(output.stderr),
-    ...output.runtimeError ? { runtimeError: scrubObject(output.runtimeError) } : {}
+    result: scrubObject(runSecrets.object(output.result)),
+    stdout: scrubSecrets(runSecrets.text(output.stdout)),
+    stderr: scrubSecrets(runSecrets.text(output.stderr)),
+    ...output.runtimeError ? { runtimeError: scrubObject(runSecrets.object(output.runtimeError)) } : {}
   };
 }
 
@@ -178361,13 +178371,25 @@ async function resolveOAuthBindingToken(oauthAuthorizationId) {
 }
 
 // src/be/script-credential-broker.ts
+init_swarm_config_guard();
+
 class RelationalCredentialBindingStore {
   listActiveBindings(context) {
     return listRelationalCredentialBindings(context);
   }
 }
+function toScriptUserConfig(configs) {
+  const exposed = configs.filter((config) => !isApiOnlyConfigKey(config.key) && !isInternalConfigKey(config.key));
+  for (const config of exposed) {
+    if (config.isSecret && config.value) {
+      registerVolatileSecret(config.value, `config:${config.key}`);
+    }
+  }
+  return Object.fromEntries(exposed.map((config) => [config.key, { value: config.value, isSecret: config.isSecret }]));
+}
 async function buildScriptCredentialBindingsWithFailures(input) {
   const resolvedConfigs = await getResolvedConfig(input.agentId, input.repoId);
+  const userConfig = toScriptUserConfig(resolvedConfigs);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
   const broker = new CredentialBroker(new RelationalCredentialBindingStore, (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS, (oauthAuthorizationId) => resolveOAuthBindingToken(oauthAuthorizationId));
   const { resolved, failed } = await broker.resolveBindingsWithFailures({
@@ -178377,10 +178399,11 @@ async function buildScriptCredentialBindingsWithFailures(input) {
   for (const binding of resolved) {
     registerVolatileSecret(binding.value, binding.configKey);
   }
-  return { egressSecrets: resolved, failedBindings: failed };
-}
-async function buildScriptCredentialBindings(input) {
-  return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
+  return {
+    egressSecrets: resolved,
+    failedBindings: failed,
+    userConfig
+  };
 }
 
 // src/be/scripts/run-saved.ts
@@ -178407,6 +178430,7 @@ async function runSavedScriptAsAgent(args, deps = {}) {
     agentId: args.agentId,
     egressSecrets: credentials.egressSecrets,
     failedBindings: credentials.failedBindings,
+    userConfig: credentials.userConfig,
     apiConnections: getScriptApiConnectionDescriptors({ agentId: args.agentId }),
     mcpConnections: getScriptMcpConnectionDescriptors({ agentId: args.agentId }),
     ...args.timeoutMs ? { timeoutMs: args.timeoutMs } : {},
@@ -183517,10 +183541,10 @@ export interface SwarmSdk {
   // --- slack ---
   slack_read(args?: { inboxMessageId?: string; taskId?: string; channelId?: string; threadTs?: string; limit?: number; includeFiles?: boolean }): Promise<unknown>;
   slack_listChannels(args?: { types?: Array<"public" | "private" | "dm" | "mpim">; limit?: number }): Promise<unknown>;
+  // --- chat sdk ---
+  chat_readThread(args: { threadId: string; limit?: number }): Promise<unknown>;
   // --- messaging ---
   message_read(args?: { channel?: string; limit?: number; since?: string; unreadOnly?: boolean; mentionsOnly?: boolean; markAsRead?: boolean }): Promise<unknown>;
-  // --- services ---
-  service_list(args?: { agentId?: string; name?: string; status?: "starting" | "healthy" | "unhealthy" | "stopped"; includeOwn?: boolean }): Promise<unknown>;
   // --- context / profiles ---
   context_history(args?: { agentId?: string; field?: "soulMd" | "identityMd" | "toolsMd" | "claudeMd" | "setupScript"; limit?: number }): Promise<unknown>;
   context_diff(args: { versionId: string; compareToVersionId?: string }): Promise<unknown>;
@@ -183563,7 +183587,7 @@ export interface SwarmSdk {
   task_action(args: Record<string, unknown>): Promise<unknown>;
 
   // --- write: config ---
-  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean }): Promise<unknown>;
+  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean; exportToEnv?: boolean }): Promise<unknown>;
   config_delete(args: { id: string }): Promise<unknown>;
 
   // --- write: model catalog ---
@@ -183593,17 +183617,19 @@ export interface SwarmSdk {
   slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
   slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
 
+  // --- write: chat sdk ---
+  chat_reply(args: { text: string }): Promise<unknown>;
+  chat_post(args: { adapter: "telegram" | "slack" | "discord" | "teams"; threadId?: string; channelId?: string; text: string }): Promise<unknown>;
+  chat_openDm(args: { adapter: "telegram" | "slack" | "discord" | "teams"; userId: string }): Promise<unknown>;
+  chat_registerChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string; agentId?: string; workflowId?: string; name?: string }): Promise<unknown>;
+  chat_unregisterChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string }): Promise<unknown>;
+
   // --- write: messaging (internal) ---
   message_post(args: { channel?: string; content: string; to?: string }): Promise<unknown>;
 
   // --- write: profiles ---
   profile_update(args: Record<string, unknown>): Promise<unknown>;
 
-  // --- write: services ---
-  service_register(args: Record<string, unknown>): Promise<unknown>;
-  service_unregister(args: { name: string }): Promise<unknown>;
-  service_updateStatus(args: { name: string; status: "starting" | "healthy" | "unhealthy" | "stopped" }): Promise<unknown>;
-
   // --- write: schedules ---
   schedule_create(args: Record<string, unknown>): Promise<unknown>;
   schedule_update(args: Record<string, unknown>): Promise<unknown>;
@@ -184349,4 +184375,53 @@ void _scriptMain;
   });
 }
 
-export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, mcpOAuthSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, resolveSqlDsn, runReadOnlyQuery, listVendoredOpenapiEntries, ConnectionAuthInputSchema, SqlDsnInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, deleteScriptConnection, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript };
+// src/be/skill-parser.ts
+function parseSkillContent(content) {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith("---")) {
+    throw new Error("Skill content must start with YAML frontmatter (---). No frontmatter found.");
+  }
+  const secondDelimiter = trimmed.indexOf("---", 3);
+  if (secondDelimiter === -1) {
+    throw new Error("Skill content has unterminated frontmatter. Missing closing ---.");
+  }
+  const frontmatterRaw = trimmed.slice(3, secondDelimiter).trim();
+  const body = trimmed.slice(secondDelimiter + 3).trim();
+  const metadata = {};
+  for (const line of frontmatterRaw.split(`
+`)) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1)
+      continue;
+    const key = line.slice(0, colonIdx).trim();
+    let value = line.slice(colonIdx + 1).trim();
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      try {
+        value = JSON.parse(value);
+      } catch {}
+    }
+    if (key && value) {
+      metadata[key] = value;
+    }
+  }
+  if (!metadata.name) {
+    throw new Error('Skill frontmatter is missing required field: "name"');
+  }
+  if (!metadata.description) {
+    throw new Error('Skill frontmatter is missing required field: "description"');
+  }
+  return {
+    name: metadata.name,
+    description: metadata.description,
+    allowedTools: metadata["allowed-tools"] || undefined,
+    model: metadata.model || undefined,
+    effort: metadata.effort || undefined,
+    context: metadata.context || undefined,
+    agent: metadata.agent || undefined,
+    disableModelInvocation: metadata["disable-model-invocation"] === "true" ? true : undefined,
+    userInvocable: metadata["user-invocable"] !== undefined ? metadata["user-invocable"] !== "false" : undefined,
+    body
+  };
+}
+
+export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, mcpOAuthSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, resolveSqlDsn, runReadOnlyQuery, listVendoredOpenapiEntries, ConnectionAuthInputSchema, SqlDsnInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, deleteScriptConnection, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript, parseSkillContent };

package/dist/{cli-3nxdmjrc.js → cli-eejsgvm4.js}

@@ -1,7 +1,7 @@
 import {
   createRuntimeProvider,
   init_runtime_providers
-} from "./cli-cd0hv9nh.js";
+} from "./cli-ra0xzggj.js";
 import {
   createAgent,
   decryptSecret,
@@ -22,7 +22,7 @@ import {
   upsertSwarmConfig,
   validateControllerTokenTtlDays,
   validateRuntimeTokenTtlHours
-} from "./cli-fmhj1ehj.js";
+} from "./cli-ef1hg1wv.js";
 import {
   RuntimeControllerCreateSchema,
   RuntimeControllerUpdateSchema,
@@ -30,13 +30,13 @@ import {
   RuntimePoolCreateSchema,
   RuntimePoolUpdateSchema,
   init_types
-} from "./cli-hsem16hb.js";
+} from "./cli-cgtksawx.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubSecrets,
   unregisterVolatileSecret
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";