@desplega.ai/agent-swarm 1.173.0 → 2.0.0

package/src/providers/pricing-sources.md

@@ -22,8 +22,8 @@ rate by hand should also update this file.
 - **Runtime module**: `src/be/models-catalog.ts`; route in
   `src/http/models-catalog.ts`.
 - Every successful models.dev fetch in the runtime refresh above also updates
-  an in-memory slim catalog (openrouter / anthropic / openai / amazon-bedrock
-  only, picker-relevant fields only). The UI model picker
+  an in-memory slim catalog (openrouter / anthropic / openai / amazon-bedrock /
+  nan / helmcode only, picker-relevant fields only). The UI model picker
   (`apps/ui/src/lib/agent-runtime-models.ts` via `useModelsCatalog()`) prefers
   this over its build-time snapshot, so new models appear without a deploy.
 - Pinned limited-availability entries (`PINNED_MODELSDEV_ENTRIES`) are
@@ -84,6 +84,25 @@ rate by hand should also update this file.
     `inputTokens`, clamped to zero, so fresh input is priced separately.
     Cursor's own models are not in models.dev: see
     `CURSOR_FIRST_PARTY_PRICING` below.
+  - OpenAI-compatible registry providers: NaN models (models.dev `nan`
+    section) and Helmcode models (the registry-synthesized `helmcode`
+    section, below) → rows under `provider='pi'` and
+    `provider='opencode'`, keyed `nan/<id>` and `helmcode/<id>`, at $0 input
+    and $0 output. Both providers bill a flat rate per key, so a session's
+    marginal cost is $0. `buildModelsDevSeedRows()` projects them, so the rows
+    land at boot seed and on refresh, and sessions record $0 with
+    `costSource: "pricing-table"` rather than `unpriced`.
+
+- **Registry-synthesized `helmcode` section**: Helmcode is not on models.dev.
+  Its five agent models (`deepseek-v4-flash`, `glm5.3`, `glm5.3-flash`,
+  `qwen3.6`, `gemma4`) live in the provider registry
+  (`packages/model-catalog/src/openai-compatible-providers.ts`,
+  `catalog: "registry"`). `withRegistryCatalogSections` adds the section,
+  at $0, to the snapshot loader (`loadModelsDevCache`), the worker runtime
+  catalog and the dashboard bundle, and the live catalog refills it
+  (`setLiveModelsCatalog`). Model limits are copied from Helmcode's own
+  opencode and pi config pages. Helmcode's resold Claude, GPT and Gemini
+  models are not included.
 
 - **Snapshot refresh procedure**:
   - Run `bun run scripts/refresh-modelsdev-pricing.ts` (Phase 2 — adds the
@@ -167,6 +186,18 @@ and heartbeat-classified roots are omitted, and the metrics remain separate.
   scheduled increase to $3/M input and $15/M output on 2026-09-01. Claude
   Code's bundled local rate table may be stale-high, so treat its reported USD
   as advisory and use the server-recomputed row for the canonical total.
+- **Claude 5.5 cache reads:** Opus 5.5 and Sonnet 5.5 cache hits cost 0.05x
+  input ($0.20/M and $0.10/M), not the usual 0.1x. Claude Code builds in use
+  around 2026-10-09 still priced Sonnet 5.5 hits at $0.20/M, so their
+  `harnessCostUsd` runs high by `cacheReadTokens × $0.10/M`.
+- **Claude Haiku 5.5 context tier:** a request whose prompt (input + cache
+  reads + cache writes) is over 100k tokens bills every class at 5x: $0.50/M
+  input, $0.05/M cache hit, $0.625/M 5m write, $1/M 1h write, $2.50/M output.
+  It is the only Claude 5.x model with a long-context tier; the others bill the
+  full 1M window at standard rates. The recompute prices Haiku 5.5 at the base
+  tier, so sessions with over-100k requests under-count, and the harness total
+  is the closer figure for them. Same per-request accounting gap as GPT-5.6
+  below.
 - **GPT-5.6 context tier:** above 272k context, the GPT-5.6 family bills
   2× input/cache rates and 1.5× output rates. The current recompute receives
   aggregate session token counts, not enough per-request context information

package/src/providers/reasoning-effort.ts

@@ -245,3 +245,30 @@ export function applyReasoningEffort(
     }
   }
 }
+
+const REASONING_HARNESSES: ReadonlySet<string> = new Set<ReasoningHarness>([
+  "claude",
+  "codex",
+  "pi",
+  "opencode",
+  "dsh",
+  "cursor",
+  "amp",
+  "grok",
+]);
+
+/**
+ * The effort a session on this harness and model actually runs at: `level`
+ * when the adapter applies it, null when it is unset or dropped (the harness
+ * default applies). Same decision the adapters make in `applyReasoningEffort`.
+ */
+export function effectiveReasoningEffort(
+  harness: string,
+  model: string,
+  level: ReasoningEffort | undefined,
+): ReasoningEffort | null {
+  if (!level || !REASONING_HARNESSES.has(harness)) return null;
+  return applyReasoningEffort(harness as ReasoningHarness, model, level).kind === "noop"
+    ? null
+    : level;
+}

package/src/providers/types.ts

@@ -33,7 +33,11 @@ export interface CostData {
   cacheWrite1hTokens?: number;
   /** Migration 063: codex reasoning_output_tokens (and similar) for reasoning models. */
   reasoningOutputTokens?: number;
-  /** Migration 063: claude extended-thinking tokens from CLI's `usage.thinking_input_tokens`. */
+  /**
+   * Migration 063: claude extended-thinking tokens from the result line's
+   * `usage.output_tokens_details.thinking_tokens`. Informational: they are a
+   * subset of `outputTokens` and already priced there.
+   */
   thinkingTokens?: number;
   /** Complete per-model usage, including sidechain/subagent tokens when available. */
   models?: CostModelUsage[];
@@ -263,7 +267,7 @@ export interface ProviderTraits {
    * agent never learns they exist. Defaults to true when omitted.
    */
   nativeSkillDiscovery?: boolean;
-  /** Provider runs in the local Docker container with /workspace, identity files, agent-fs, PM2, etc. */
+  /** Provider runs in the local Docker container with /workspace, identity files, agent-fs, etc. */
   hasLocalEnvironment: boolean;
   /** Live steering modes supported by this provider. Absent means none. */
   steerModes?: SteerMode[];

package/src/rbac/legacy-policy.ts

@@ -206,8 +206,9 @@ const memoryDelete: LegacyRule = {
 };
 
 /**
- * task.fs.mutate — operator OR user OR lead OR task-assignee OR task-creator
- * (src/http/fs.ts canMutateTask). Order-independent OR: today's early
+ * task.fs.mutate and task.parent.attach: operator OR user OR lead OR
+ * task-assignee OR task-creator (src/http/fs.ts canMutateTask; send-task and
+ * POST /api/tasks for a parentTaskId). Order-independent OR: today's early
  * operator/user returns short-circuit before agent identity, but no input
  * satisfies one branch while failing another, so a flat OR is equivalent
  * (plan Appendix A row 36 note).
@@ -276,6 +277,7 @@ export const LEGACY_POLICY = {
   "task.steer.own": requesterOwnsTask,
   "task.action.own": requesterOwnsTask,
   "task.fs.mutate": taskFsMutate,
+  "task.parent.attach": taskFsMutate,
   "task.progress.write": taskProgressWrite,
   "favorite.write.own": anyAuthenticated,
   "memory.learning.inject": leadOnly,
@@ -286,6 +288,10 @@ export const LEGACY_POLICY = {
   "channel.delete": leadOnly,
   "repo.merge-policy.write": leadOrOperatorOrUser,
   "integration.kapso.manage": leadOnly,
+  "integration.chat.manage": leadOnly,
+  "integration.chat.post": leadOnly,
+  "integration.chat.read": leadOnly,
+  "integration.chat.dm": leadOnly,
   "integration.slack.post": leadOnly,
   "integration.slack.read": leadOnly,
   "integration.slack.thread.start": leadOnly,

package/src/rbac/permissions.ts

@@ -79,6 +79,11 @@ export const PERMISSIONS = {
     description: "Mutate a task's filesystem artifacts and attachments.",
     namespace: "task",
   },
+  "task.parent.attach": {
+    description:
+      "Create a task under an existing parent task. The child inherits the parent's thread context (contextKey, Slack thread, requester).",
+    namespace: "task",
+  },
   "task.progress.write": {
     description:
       "Write a task's progress, status, or output (its assignee, a lead, a human, or anyone while unassigned).",
@@ -124,6 +129,22 @@ export const PERMISSIONS = {
     description: "Register or unregister a Kapso inbound number.",
     namespace: "integration",
   },
+  "integration.chat.manage": {
+    description: "Register or unregister a Chat SDK channel route.",
+    namespace: "integration",
+  },
+  "integration.chat.post": {
+    description: "Post to a Chat SDK thread or channel other than the thread of the current task.",
+    namespace: "integration",
+  },
+  "integration.chat.read": {
+    description: "Read a Chat SDK thread other than the thread of the current task.",
+    namespace: "integration",
+  },
+  "integration.chat.dm": {
+    description: "Open a direct-message thread with a user on a Chat SDK adapter.",
+    namespace: "integration",
+  },
   "integration.slack.post": {
     description: "Post to a direct Slack channel.",
     namespace: "integration",

package/src/scheduler/scheduler.ts

@@ -23,7 +23,7 @@ import {
   getScriptApiConnectionDescriptors,
   getScriptMcpConnectionDescriptors,
 } from "@/be/script-connections";
-import { buildScriptCredentialBindings } from "@/be/script-credential-broker";
+import { buildScriptCredentialBindingsWithFailures } from "@/be/script-credential-broker";
 import { getScript } from "@/be/scripts/db";
 import { runScript } from "@/scripts-runtime/loader";
 import { telemetry } from "@/telemetry";
@@ -99,12 +99,14 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
 
   let output: Awaited<ReturnType<typeof runScript>>;
   try {
+    const credentials = await buildScriptCredentialBindingsWithFailures({ agentId });
     output = await runScript({
       source: script.source,
       args,
       fsMode: "none",
       agentId,
-      egressSecrets: await buildScriptCredentialBindings({ agentId }),
+      egressSecrets: credentials.egressSecrets,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId }),
       timeoutMs: 60_000,

package/src/scripts-runtime/loader.ts

@@ -1,5 +1,6 @@
 import { getApiKey } from "../utils/api-key";
-import { scrubObject, scrubSecrets } from "../utils/secret-scrubber";
+import { getMcpBaseUrl } from "../utils/constants";
+import { createValueScrubber, scrubObject, scrubSecrets } from "../utils/secret-scrubber";
 import type { ScriptApiConnectionDescriptor, ScriptMcpConnectionDescriptor } from "./api-types";
 import type { FailedCredentialBinding } from "./credential-broker";
 import { buildEgressSecrets } from "./egress-secrets";
@@ -66,7 +67,7 @@ async function buildConfigPayload(input: RunScriptInput): Promise<SwarmConfigPay
       apiKey: { value: apiKey, isSecret: true },
       agentId: { value: input.agentId, isSecret: false },
       mcpBaseUrl: {
-        value: input.mcpBaseUrl ?? process.env.MCP_BASE_URL ?? "http://localhost:3013",
+        value: input.mcpBaseUrl ?? getMcpBaseUrl(),
         isSecret: false,
       },
       ...(input.runtimeInstanceId
@@ -94,12 +95,21 @@ export async function runScript(input: RunScriptInput): Promise<RunScriptOutput>
     };
   }
 
+  // The global scrubber skips values under its length floor, so this run's own
+  // secret config is redacted here at any length before the global pass. Built
+  // before the import check: its diagnostic quotes source, which can hold a value.
+  const runSecrets = createValueScrubber(
+    Object.entries(input.userConfig ?? {})
+      .filter(([, entry]) => entry.isSecret)
+      .map(([key, entry]) => ({ value: entry.value, name: `config:${key}` })),
+  );
+
   const imports = validateScriptImports(input.source);
   if (!imports.ok) {
     return {
       result: undefined,
       stdout: "",
-      stderr: imports.diagnostic,
+      stderr: scrubSecrets(runSecrets.text(imports.diagnostic)),
       truncated: { stdout: false, stderr: false },
       durationMs: 0,
       exitCode: 1,
@@ -133,9 +143,11 @@ export async function runScript(input: RunScriptInput): Promise<RunScriptOutput>
 
   return {
     ...output,
-    result: scrubObject(output.result),
-    stdout: scrubSecrets(output.stdout),
-    stderr: scrubSecrets(output.stderr),
-    ...(output.runtimeError ? { runtimeError: scrubObject(output.runtimeError) } : {}),
+    result: scrubObject(runSecrets.object(output.result)),
+    stdout: scrubSecrets(runSecrets.text(output.stdout)),
+    stderr: scrubSecrets(runSecrets.text(output.stderr)),
+    ...(output.runtimeError
+      ? { runtimeError: scrubObject(runSecrets.object(output.runtimeError)) }
+      : {}),
   };
 }

package/src/scripts-runtime/sdk-allowlist.ts

@@ -104,6 +104,14 @@ export const SDK_TOOL_NAME_MAP = {
   slack_delete: "slack-delete", // external: mutates Slack, destructive
   slack_update: "slack-update", // external: mutates Slack
 
+  // ── chat sdk ──
+  chat_reply: "chat-reply", // external: sends to the task's chat thread
+  chat_post: "chat-post", // external: sends to a chat platform
+  chat_openDm: "chat-open-dm", // external: opens a platform DM
+  chat_readThread: "chat-read-thread",
+  chat_registerChannel: "register-chat-channel",
+  chat_unregisterChannel: "unregister-chat-channel", // destructive
+
   // ── messaging (internal) ──
   message_read: "read-messages",
   message_post: "post-message",
@@ -115,12 +123,6 @@ export const SDK_TOOL_NAME_MAP = {
   context_history: "context-history",
   context_diff: "context-diff",
 
-  // ── services ──
-  service_list: "list-services",
-  service_register: "register-service",
-  service_unregister: "unregister-service", // destructive
-  service_updateStatus: "update-service-status",
-
   // ── workflows ──
   workflow_list: "list-workflows",
   workflow_get: "get-workflow",

package/src/scripts-runtime/swarm-sdk.ts

@@ -280,17 +280,6 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest | null {
       return { method: "DELETE", path: `/api/config/${encodeURIComponent(id)}` };
     }
 
-    // ── services ──
-    case "service_list":
-      return {
-        method: "GET",
-        path: appendQuery("/api/services", {
-          agentId: body.agentId,
-          name: body.name,
-          status: body.status,
-        }),
-      };
-
     // ── workflows ──
     case "workflow_list":
       return {

package/src/scripts-runtime/types/stdlib.d.ts

@@ -342,6 +342,8 @@ declare module "swarm-sdk" {
       types?: Array<"public" | "private" | "dm" | "mpim">;
       limit?: number;
     }): Promise<unknown>;
+    // --- chat sdk ---
+    chat_readThread(args: { threadId: string; limit?: number }): Promise<unknown>;
     // --- messaging ---
     message_read(args?: {
       channel?: string;
@@ -351,13 +353,6 @@ declare module "swarm-sdk" {
       mentionsOnly?: boolean;
       markAsRead?: boolean;
     }): Promise<unknown>;
-    // --- services ---
-    service_list(args?: {
-      agentId?: string;
-      name?: string;
-      status?: "starting" | "healthy" | "unhealthy" | "stopped";
-      includeOwn?: boolean;
-    }): Promise<unknown>;
     // --- context / profiles ---
     context_history(args?: {
       agentId?: string;
@@ -452,6 +447,7 @@ declare module "swarm-sdk" {
       scope?: "global" | "agent" | "repo";
       scopeId?: string;
       isSecret?: boolean;
+      exportToEnv?: boolean;
     }): Promise<unknown>;
     config_delete(args: { id: string }): Promise<unknown>;
 
@@ -492,20 +488,36 @@ declare module "swarm-sdk" {
     slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
     slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
 
+    // --- write: chat sdk ---
+    chat_reply(args: { text: string }): Promise<unknown>;
+    chat_post(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      threadId?: string;
+      channelId?: string;
+      text: string;
+    }): Promise<unknown>;
+    chat_openDm(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      userId: string;
+    }): Promise<unknown>;
+    chat_registerChannel(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      channelId: string;
+      agentId?: string;
+      workflowId?: string;
+      name?: string;
+    }): Promise<unknown>;
+    chat_unregisterChannel(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      channelId: string;
+    }): Promise<unknown>;
+
     // --- write: messaging (internal) ---
     message_post(args: { channel?: string; content: string; to?: string }): Promise<unknown>;
 
     // --- write: profiles ---
     profile_update(args: Record<string, unknown>): Promise<unknown>;
 
-    // --- write: services ---
-    service_register(args: Record<string, unknown>): Promise<unknown>;
-    service_unregister(args: { name: string }): Promise<unknown>;
-    service_updateStatus(args: {
-      name: string;
-      status: "starting" | "healthy" | "unhealthy" | "stopped";
-    }): Promise<unknown>;
-
     // --- write: schedules ---
     schedule_create(args: Record<string, unknown>): Promise<unknown>;
     schedule_update(args: Record<string, unknown>): Promise<unknown>;

package/src/scripts-runtime/types/swarm-extension.d.ts

@@ -19,6 +19,7 @@ declare module "swarm-extension" {
       | "linear"
       | "jira"
       | "comb"
+      | "chat"
       | undefined;
     routingReason?:
       | "skill"
@@ -132,7 +133,8 @@ declare module "swarm-extension" {
       | "system"
       | "linear"
       | "jira"
-      | "comb";
+      | "comb"
+      | "chat";
     tags: string[];
     priority: number;
     dependsOn: string[];
@@ -191,6 +193,7 @@ declare module "swarm-extension" {
     resolvedModel?: string | undefined;
     modelSource?: string | undefined;
     modelAlias?: string | undefined;
+    resolvedEffort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | null | undefined;
     workflowRunStepId?: string | null | undefined;
@@ -467,6 +470,43 @@ declare module "swarm-extension" {
           kind: "broadcast";
         };
   }
+  /** A Chat SDK message after its thread buffer flushed, before routing. */
+  export interface ChatRouteEvent {
+    /** Adapter name, such as `telegram` or `slack`. */
+    adapter: string;
+    channelId: string;
+    /** The Chat SDK thread id, prefixed with the adapter name. */
+    threadId: string;
+    /** The first buffered sender. */
+    userId: string;
+    userName?: string;
+    /** The buffered messages, joined. */
+    text: string;
+    botMentioned: boolean;
+    isDirectMessage: boolean;
+    /** Set when earlier swarm tasks exist in this thread. */
+    threadContext?: {
+      adapter: string;
+      threadId: string;
+    };
+  }
+  export interface ChatRouteModify {
+    target:
+      | {
+          kind: "agent";
+          agentId: string;
+        }
+      | {
+          kind: "lead";
+        }
+      | {
+          kind: "broadcast";
+        }
+      | {
+          kind: "workflow";
+          workflowId: string;
+        };
+  }
   export type HeartbeatClassification = "no-session" | "stale-session" | "fresh-stalled";
   export type HeartbeatAction = "supersede-resume" | "fail" | "record";
   export interface HeartbeatRemediateEvent {
@@ -511,6 +551,18 @@ declare module "swarm-extension" {
     threadTs?: string;
     taskId?: string;
   }
+  /** A Chat SDK message the swarm received or sent. */
+  export interface ChatMessageEvent {
+    adapter: string;
+    channelId: string;
+    threadId: string;
+    /** The sender, for an inbound message. */
+    userId?: string;
+    text: string;
+    direction: "inbound" | "outbound";
+    taskId?: string;
+    messageId?: string;
+  }
   /**
    * A person answered an approval request. Fires for workflow and standalone
    * requests. Timeouts and cancellations do not emit it today.
@@ -619,6 +671,11 @@ declare module "swarm-extension" {
       modify: SlackRouteModify;
       result: PreResult<SlackRouteModify>;
     };
+    "pre.chat.route": {
+      event: ChatRouteEvent;
+      modify: ChatRouteModify;
+      result: PreResult<ChatRouteModify>;
+    };
     "pre.heartbeat.remediate": {
       event: HeartbeatRemediateEvent;
       modify: HeartbeatRemediateModify;
@@ -664,6 +721,11 @@ declare module "swarm-extension" {
       modify: never;
       result: void;
     };
+    "post.chat.message": {
+      event: ChatMessageEvent;
+      modify: never;
+      result: void;
+    };
     "post.approval.resolved": {
       event: ApprovalResolvedEvent;
       modify: never;

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -324,6 +324,8 @@ declare module "swarm-sdk" {
       types?: Array<"public" | "private" | "dm" | "mpim">;
       limit?: number;
     }): Promise<unknown>;
+    // --- chat sdk ---
+    chat_readThread(args: { threadId: string; limit?: number }): Promise<unknown>;
     // --- messaging ---
     message_read(args?: {
       channel?: string;
@@ -333,13 +335,6 @@ declare module "swarm-sdk" {
       mentionsOnly?: boolean;
       markAsRead?: boolean;
     }): Promise<unknown>;
-    // --- services ---
-    service_list(args?: {
-      agentId?: string;
-      name?: string;
-      status?: "starting" | "healthy" | "unhealthy" | "stopped";
-      includeOwn?: boolean;
-    }): Promise<unknown>;
     // --- context / profiles ---
     context_history(args?: {
       agentId?: string;
@@ -434,6 +429,7 @@ declare module "swarm-sdk" {
       scope?: "global" | "agent" | "repo";
       scopeId?: string;
       isSecret?: boolean;
+      exportToEnv?: boolean;
     }): Promise<unknown>;
     config_delete(args: { id: string }): Promise<unknown>;
 
@@ -474,20 +470,36 @@ declare module "swarm-sdk" {
     slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
     slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
 
+    // --- write: chat sdk ---
+    chat_reply(args: { text: string }): Promise<unknown>;
+    chat_post(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      threadId?: string;
+      channelId?: string;
+      text: string;
+    }): Promise<unknown>;
+    chat_openDm(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      userId: string;
+    }): Promise<unknown>;
+    chat_registerChannel(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      channelId: string;
+      agentId?: string;
+      workflowId?: string;
+      name?: string;
+    }): Promise<unknown>;
+    chat_unregisterChannel(args: {
+      adapter: "telegram" | "slack" | "discord" | "teams";
+      channelId: string;
+    }): Promise<unknown>;
+
     // --- write: messaging (internal) ---
     message_post(args: { channel?: string; content: string; to?: string }): Promise<unknown>;
 
     // --- write: profiles ---
     profile_update(args: Record<string, unknown>): Promise<unknown>;
 
-    // --- write: services ---
-    service_register(args: Record<string, unknown>): Promise<unknown>;
-    service_unregister(args: { name: string }): Promise<unknown>;
-    service_updateStatus(args: {
-      name: string;
-      status: "starting" | "healthy" | "unhealthy" | "stopped";
-    }): Promise<unknown>;
-
     // --- write: schedules ---
     schedule_create(args: Record<string, unknown>): Promise<unknown>;
     schedule_update(args: Record<string, unknown>): Promise<unknown>;