@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/be/modelsdev-cache.json

@@ -147258,7 +147258,7 @@
         "cost": {
           "input": 2,
           "output": 10,
-          "cache_read": 0.2,
+          "cache_read": 0.1,
           "cache_write": 2.5
         },
         "limit": {
@@ -314158,23 +314158,59 @@
     "name": "NaN",
     "doc": "https://nan.builders/docs/models",
     "models": {
-      "qwen3.6": {
-        "id": "qwen3.6",
-        "name": "Qwen3.6 35B-A3B",
-        "description": "Open multimodal Qwen MoE for local agents that need vision, audio, and code",
+      "qwen-image-2.1": {
+        "id": "qwen-image-2.1",
+        "name": "Qwen-Image-2.1",
+        "description": "Unified text-to-image generation and image editing model with native RGBA transparency and reference-image editing",
         "family": "qwen",
+        "attachment": false,
+        "reasoning": false,
+        "tool_call": false,
+        "temperature": true,
+        "release_date": "2026-09-14",
+        "last_updated": "2026-09-21",
+        "modalities": {
+          "input": [
+            "text"
+          ],
+          "output": [
+            "image"
+          ]
+        },
+        "open_weights": true,
+        "limit": {
+          "context": 8192,
+          "output": 0
+        },
+        "cost": {
+          "input": 0,
+          "output": 0
+        },
+        "canonical_model_id": "alibaba/qwen-image-2.1"
+      },
+      "glm5.3-flash": {
+        "id": "glm5.3-flash",
+        "name": "GLM-5.3-Flash",
+        "description": "Native multimodal GLM model for efficient coding and long-horizon agent tasks",
+        "family": "glm-flash",
         "attachment": true,
         "reasoning": true,
         "reasoning_options": [
           {
-            "type": "toggle"
+            "type": "effort",
+            "values": [
+              "low",
+              "medium",
+              "high",
+              "max"
+            ]
           }
         ],
         "tool_call": true,
         "structured_output": true,
         "temperature": true,
-        "release_date": "2026-04-17",
-        "last_updated": "2026-04-17",
+        "release_date": "2026-08-26",
+        "last_updated": "2026-08-26",
         "modalities": {
           "input": [
             "text",
@@ -314186,31 +314222,43 @@
         },
         "open_weights": true,
         "limit": {
-          "context": 262144,
-          "output": 65536
+          "context": 1000000,
+          "output": 131072
         },
         "cost": {
           "input": 0,
           "output": 0
-        }
+        },
+        "canonical_model_id": "zhipuai/glm-5.3-flash"
       },
-      "deepseek-v4-flash": {
-        "id": "deepseek-v4-flash",
-        "name": "DeepSeek V4 Flash",
-        "description": "Fast DeepSeek V4 lane for economical reasoning, coding, and long-context work",
-        "family": "deepseek-flash",
-        "attachment": false,
+      "gemma4": {
+        "id": "gemma4",
+        "name": "Gemma 4 26B A4B IT",
+        "description": "Open Gemma instruction model for efficient chat and self-hosted deployments",
+        "family": "gemma",
+        "attachment": true,
         "reasoning": true,
-        "reasoning_options": [],
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "none",
+              "low",
+              "medium",
+              "high",
+              "max"
+            ]
+          }
+        ],
         "tool_call": true,
         "structured_output": true,
         "temperature": true,
-        "knowledge": "2025-05",
-        "release_date": "2026-04-24",
-        "last_updated": "2026-04-24",
+        "release_date": "2026-04-02",
+        "last_updated": "2026-04-02",
         "modalities": {
           "input": [
-            "text"
+            "text",
+            "image"
           ],
           "output": [
             "text"
@@ -314218,30 +314266,43 @@
         },
         "open_weights": true,
         "limit": {
-          "context": 1000000,
-          "output": 384000
+          "context": 262144,
+          "output": 32768
         },
         "cost": {
           "input": 0,
           "output": 0
-        }
+        },
+        "canonical_model_id": "google/gemma-4-26b-a4b-it"
       },
-      "glm5.2": {
-        "id": "glm5.2",
-        "name": "GLM-5.2",
-        "description": "Open flagship GLM for long-horizon coding agents, served at 500K context on the NaN premium tier",
-        "family": "glm",
-        "attachment": false,
+      "qwen3.6": {
+        "id": "qwen3.6",
+        "name": "Qwen3.6 35B-A3B",
+        "description": "Open multimodal Qwen MoE for local agents that need vision, audio, and code",
+        "family": "qwen",
+        "attachment": true,
         "reasoning": true,
-        "reasoning_options": [],
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "none",
+              "low",
+              "medium",
+              "high",
+              "max"
+            ]
+          }
+        ],
         "tool_call": true,
         "structured_output": true,
         "temperature": true,
-        "release_date": "2026-06-13",
-        "last_updated": "2026-06-13",
+        "release_date": "2026-04-17",
+        "last_updated": "2026-04-17",
         "modalities": {
           "input": [
-            "text"
+            "text",
+            "image"
           ],
           "output": [
             "text"
@@ -314249,35 +314310,32 @@
         },
         "open_weights": true,
         "limit": {
-          "context": 500000,
-          "output": 131072
+          "context": 262144,
+          "output": 65536
         },
         "cost": {
           "input": 0,
           "output": 0
-        }
+        },
+        "canonical_model_id": "alibaba/qwen3.6-35b-a3b"
       },
-      "gemma4": {
-        "id": "gemma4",
-        "name": "Gemma 4 26B A4B IT",
-        "description": "Open Gemma instruction model for efficient chat and self-hosted deployments",
-        "family": "gemma",
+      "mimo-v2.6-flash": {
+        "id": "mimo-v2.6-flash",
+        "name": "MiMo-V2.6-Flash",
+        "description": "MiMo Flash model for multimodal coding agents and long-context automation",
+        "family": "mimo",
         "attachment": true,
         "reasoning": true,
-        "reasoning_options": [
-          {
-            "type": "toggle"
-          }
-        ],
+        "reasoning_options": [],
         "tool_call": true,
-        "structured_output": true,
         "temperature": true,
-        "release_date": "2026-04-02",
-        "last_updated": "2026-04-02",
+        "release_date": "2026-09-22",
+        "last_updated": "2026-09-22",
         "modalities": {
           "input": [
             "text",
-            "image"
+            "image",
+            "audio"
           ],
           "output": [
             "text"
@@ -314285,13 +314343,14 @@
         },
         "open_weights": true,
         "limit": {
-          "context": 262144,
-          "output": 32768
+          "context": 1048576,
+          "output": 131072
         },
         "cost": {
           "input": 0,
           "output": 0
-        }
+        },
+        "canonical_model_id": "xiaomi/mimo-v2.6-flash"
       },
       "qwen3.8-flash": {
         "id": "qwen3.8-flash",
@@ -314322,21 +314381,65 @@
         "cost": {
           "input": 0,
           "output": 0
-        }
+        },
+        "canonical_model_id": "alibaba/qwen3.8-flash"
       },
-      "glm5.3-flash": {
-        "id": "glm5.3-flash",
-        "name": "GLM-5.3-Flash",
-        "description": "Native multimodal GLM model for efficient coding and long-horizon agent tasks",
+      "glm5.3": {
+        "id": "glm5.3",
+        "name": "GLM-5.3",
+        "description": "Flagship GLM model for long-horizon coding, agents, and complex project delivery",
         "family": "glm",
+        "attachment": false,
+        "reasoning": true,
+        "reasoning_options": [
+          {
+            "type": "effort",
+            "values": [
+              "low",
+              "medium",
+              "high",
+              "max"
+            ]
+          }
+        ],
+        "tool_call": true,
+        "structured_output": true,
+        "temperature": true,
+        "release_date": "2026-08-14",
+        "last_updated": "2026-08-14",
+        "modalities": {
+          "input": [
+            "text"
+          ],
+          "output": [
+            "text"
+          ]
+        },
+        "open_weights": true,
+        "limit": {
+          "context": 1000000,
+          "output": 131072
+        },
+        "cost": {
+          "input": 0,
+          "output": 0
+        },
+        "canonical_model_id": "zhipuai/glm-5.3"
+      },
+      "deepseek-v4-flash": {
+        "id": "deepseek-v4-flash",
+        "name": "DeepSeek V4.1 Flash",
+        "description": "DeepSeek V4.1 Flash model for reasoning and agentic coding",
+        "family": "deepseek-flash",
         "attachment": true,
         "reasoning": true,
         "reasoning_options": [],
         "tool_call": true,
         "structured_output": true,
         "temperature": true,
-        "release_date": "2026-08-26",
-        "last_updated": "2026-08-26",
+        "knowledge": "2025-05",
+        "release_date": "2026-09-10",
+        "last_updated": "2026-09-10",
         "modalities": {
           "input": [
             "text",
@@ -314346,9 +314449,41 @@
             "text"
           ]
         },
-        "open_weights": false,
+        "open_weights": true,
         "limit": {
           "context": 1000000,
+          "output": 384000
+        },
+        "cost": {
+          "input": 0,
+          "output": 0
+        },
+        "canonical_model_id": "deepseek/deepseek-v4.1-flash"
+      },
+      "glm5.2": {
+        "id": "glm5.2",
+        "name": "GLM-5.2",
+        "description": "Open flagship GLM for long-horizon coding agents, served at 500K context on the NaN premium tier",
+        "family": "glm",
+        "attachment": false,
+        "reasoning": true,
+        "reasoning_options": [],
+        "tool_call": true,
+        "structured_output": true,
+        "temperature": true,
+        "release_date": "2026-06-13",
+        "last_updated": "2026-06-13",
+        "modalities": {
+          "input": [
+            "text"
+          ],
+          "output": [
+            "text"
+          ]
+        },
+        "open_weights": true,
+        "limit": {
+          "context": 500000,
           "output": 131072
         },
         "cost": {

package/src/be/modelsdev-cache.ts

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
+import { withRegistryCatalogSections } from "@desplega/model-catalog";
 
 export interface ModelsDevCostBlock {
   input?: number;
@@ -53,6 +54,11 @@ const parsedCaches = new Map<string, WeakRef<ModelsDevCache>>();
  * fetches the live catalog from `GET /api/models-catalog`
  * (`src/be/models-catalog.ts`) and only falls back to its bundled copy of
  * this snapshot when that request hasn't resolved.
+ *
+ * The result also carries the sections of the OpenAI-compatible registry
+ * providers models.dev does not list (`helmcode`), synthesized from the
+ * registry (`withRegistryCatalogSections`), so every snapshot consumer
+ * (catalog, pricing seed, tier resolution) sees them like any other section.
  */
 export function loadModelsDevCache(): ModelsDevCache | null {
   const explicitPath = process.env.MODELSDEV_CACHE_PATH;
@@ -67,7 +73,9 @@ export function loadModelsDevCache(): ModelsDevCache | null {
     const memoized = parsedCaches.get(candidate)?.deref();
     if (memoized) return memoized;
     try {
-      const parsed = JSON.parse(readFileSync(candidate, "utf-8")) as ModelsDevCache;
+      const parsed = withRegistryCatalogSections(
+        JSON.parse(readFileSync(candidate, "utf-8")) as ModelsDevCache,
+      );
       parsedCaches.set(candidate, new WeakRef(parsed));
       return parsed;
     } catch {

package/src/be/script-credential-broker.ts

@@ -11,6 +11,7 @@ import { registerVolatileSecret } from "@/utils/secret-scrubber";
 import { getResolvedConfig } from "./db";
 import { resolveOAuthBindingToken } from "./oauth-credential-bindings";
 import { listRelationalCredentialBindings } from "./script-connections";
+import { isApiOnlyConfigKey, isInternalConfigKey } from "./swarm-config-guard";
 
 // Relational-only credential binding store. The legacy SCRIPT_CREDENTIAL_BINDINGS
 // swarm-config JSON blob is retired (migrated to relational rows at boot), so
@@ -22,6 +23,32 @@ class RelationalCredentialBindingStore implements CredentialBindingStore {
   }
 }
 
+export type ScriptUserConfig = Record<string, { value: string; isSecret: boolean }>;
+
+/**
+ * The values behind `ctx.swarm.config.get(KEY)`: the invoking agent's resolved
+ * config (agent over global, plus repo when given), minus the keys the
+ * `/api/config/resolved` route never hands out. A script's own SDK bearer
+ * already reads every one of these through `ctx.swarm.config_get`, so this
+ * widens nothing; it only makes the documented accessor return them. Secret
+ * values are registered with the scrubber so they never leave in run output.
+ */
+function toScriptUserConfig(configs: Awaited<ReturnType<typeof getResolvedConfig>>) {
+  const exposed = configs.filter(
+    (config) => !isApiOnlyConfigKey(config.key) && !isInternalConfigKey(config.key),
+  );
+  for (const config of exposed) {
+    if (config.isSecret && config.value) {
+      registerVolatileSecret(config.value, `config:${config.key}`);
+    }
+  }
+  // fromEntries defines own properties, so a `__proto__` key survives
+  // (assigning it into `{}` would hit the prototype setter instead).
+  return Object.fromEntries(
+    exposed.map((config) => [config.key, { value: config.value, isSecret: config.isSecret }]),
+  ) as ScriptUserConfig;
+}
+
 /**
  * Resolve credential bindings for a script run, partitioning OAuth bindings
  * whose refresh failed into `failedBindings` (surfaced to the sandbox so the
@@ -32,8 +59,14 @@ class RelationalCredentialBindingStore implements CredentialBindingStore {
 export async function buildScriptCredentialBindingsWithFailures(input: {
   agentId?: string;
   repoId?: string;
-}): Promise<{ egressSecrets: EgressSecretEntry[]; failedBindings: FailedCredentialBinding[] }> {
+}): Promise<{
+  egressSecrets: EgressSecretEntry[];
+  failedBindings: FailedCredentialBinding[];
+  userConfig: ScriptUserConfig;
+}> {
   const resolvedConfigs = await getResolvedConfig(input.agentId, input.repoId);
+  // Before the binding loop below, so a binding's own scrubber label wins.
+  const userConfig = toScriptUserConfig(resolvedConfigs);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
   const broker = new CredentialBroker(
     new RelationalCredentialBindingStore(),
@@ -49,7 +82,11 @@ export async function buildScriptCredentialBindingsWithFailures(input: {
   for (const binding of resolved) {
     registerVolatileSecret(binding.value, binding.configKey);
   }
-  return { egressSecrets: resolved, failedBindings: failed };
+  return {
+    egressSecrets: resolved,
+    failedBindings: failed,
+    userConfig,
+  };
 }
 
 export async function buildScriptCredentialBindings(input: {

package/src/be/scripts/run-saved.ts

@@ -52,6 +52,7 @@ export async function runSavedScriptAsAgent(
         agentId: args.agentId,
         egressSecrets: credentials.egressSecrets,
         failedBindings: credentials.failedBindings,
+        userConfig: credentials.userConfig,
         apiConnections: getScriptApiConnectionDescriptors({ agentId: args.agentId }),
         mcpConnections: getScriptMcpConnectionDescriptors({ agentId: args.agentId }),
         ...(args.timeoutMs ? { timeoutMs: args.timeoutMs } : {}),

package/src/be/scripts/typecheck.ts

@@ -232,13 +232,15 @@ export interface SwarmSdk {
   // --- config ---
   config_get(args?: { agentId?: string; repoId?: string; key?: string; includeSecrets?: boolean }): Promise<unknown>;
   config_list(args?: { scope?: "global" | "agent" | "repo"; scopeId?: string; key?: string; includeSecrets?: boolean }): Promise<unknown>;
+  // --- model profiles ---
+  modelProfile_list(args?: { harness?: string }): Promise<unknown>;
   // --- slack ---
   slack_read(args?: { inboxMessageId?: string; taskId?: string; channelId?: string; threadTs?: string; limit?: number; includeFiles?: boolean }): Promise<unknown>;
   slack_listChannels(args?: { types?: Array<"public" | "private" | "dm" | "mpim">; limit?: number }): Promise<unknown>;
+  // --- chat sdk ---
+  chat_readThread(args: { threadId: string; limit?: number }): Promise<unknown>;
   // --- messaging ---
   message_read(args?: { channel?: string; limit?: number; since?: string; unreadOnly?: boolean; mentionsOnly?: boolean; markAsRead?: boolean }): Promise<unknown>;
-  // --- services ---
-  service_list(args?: { agentId?: string; name?: string; status?: "starting" | "healthy" | "unhealthy" | "stopped"; includeOwn?: boolean }): Promise<unknown>;
   // --- context / profiles ---
   context_history(args?: { agentId?: string; field?: "soulMd" | "identityMd" | "toolsMd" | "claudeMd" | "setupScript"; limit?: number }): Promise<unknown>;
   context_diff(args: { versionId: string; compareToVersionId?: string }): Promise<unknown>;
@@ -281,7 +283,7 @@ export interface SwarmSdk {
   task_action(args: Record<string, unknown>): Promise<unknown>;
 
   // --- write: config ---
-  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean }): Promise<unknown>;
+  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean; exportToEnv?: boolean }): Promise<unknown>;
   config_delete(args: { id: string }): Promise<unknown>;
 
   // --- write: model catalog ---
@@ -311,17 +313,19 @@ export interface SwarmSdk {
   slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
   slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
 
+  // --- write: chat sdk ---
+  chat_reply(args: { text: string }): Promise<unknown>;
+  chat_post(args: { adapter: "telegram" | "slack" | "discord" | "teams"; threadId?: string; channelId?: string; text: string }): Promise<unknown>;
+  chat_openDm(args: { adapter: "telegram" | "slack" | "discord" | "teams"; userId: string }): Promise<unknown>;
+  chat_registerChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string; agentId?: string; workflowId?: string; name?: string }): Promise<unknown>;
+  chat_unregisterChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string }): Promise<unknown>;
+
   // --- write: messaging (internal) ---
   message_post(args: { channel?: string; content: string; to?: string }): Promise<unknown>;
 
   // --- write: profiles ---
   profile_update(args: Record<string, unknown>): Promise<unknown>;
 
-  // --- write: services ---
-  service_register(args: Record<string, unknown>): Promise<unknown>;
-  service_unregister(args: { name: string }): Promise<unknown>;
-  service_updateStatus(args: { name: string; status: "starting" | "healthy" | "unhealthy" | "stopped" }): Promise<unknown>;
-
   // --- write: schedules ---
   schedule_create(args: Record<string, unknown>): Promise<unknown>;
   schedule_update(args: Record<string, unknown>): Promise<unknown>;
@@ -437,6 +441,16 @@ export interface SwarmSdk {
   // --- human input ---
   request_humanInput(args: Record<string, unknown>): Promise<unknown>;
   approval_cancel(args: { requestId: string; reason?: string }): Promise<unknown>;
+
+  // --- decisions ---
+  systemOne_decide(args: {
+    provider?: "typesafe" | "openrouter" | "laya" | "openai" | "cloudflare";
+    model?: string;
+    state: string | string[] | Record<string, unknown>;
+    questions: Record<string, Record<string, unknown>>;
+    timeoutMs?: number;
+    maxRetries?: number;
+  }): Promise<unknown>;
 }
 
 export interface ScriptStdlib {

package/src/be/secret-registry.ts

@@ -77,8 +77,12 @@ export function encodedForms(value: string): string[] {
 /** Register a stored secret value, plus its encoded forms, with the scrubber. */
 export function registerStoredSecret(value: string | null | undefined, name: string): void {
   if (!value) return;
-  registerVolatileSecret(value, name);
-  for (const form of encodedForms(value)) registerVolatileSecret(form, name);
+  // Config values are hydrated verbatim but consumed trimmed.
+  for (const candidate of new Set([value, value.trim()])) {
+    if (!candidate) continue;
+    registerVolatileSecret(candidate, name);
+    for (const form of encodedForms(candidate)) registerVolatileSecret(form, name);
+  }
 }
 
 export interface SecretRegistryLoadResult {

package/src/be/seed/runner.ts

@@ -22,6 +22,7 @@ export async function runSeeder(seeder: Seeder, opts?: SeederRunOptions): Promis
     updated: 0,
     skippedUnchanged: 0,
     skippedUserModified: 0,
+    retired: 0,
     failed: [],
   };
 
@@ -77,11 +78,22 @@ export async function runSeeder(seeder: Seeder, opts?: SeederRunOptions): Promis
     }
   }
 
+  if (seeder.retire) {
+    try {
+      result.retired = (await seeder.retire()).length;
+    } catch (err) {
+      result.failed.push({
+        key: "(retire)",
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
   if (!opts?.quiet) {
     console.log(
       `[seed:${result.kind}] created=${result.created} updated=${result.updated} ` +
         `unchanged=${result.skippedUnchanged} preserved=${result.skippedUserModified} ` +
-        `failed=${result.failed.length}`,
+        `retired=${result.retired} failed=${result.failed.length}`,
     );
     for (const f of result.failed) {
       console.error(`[seed:${result.kind}] FAILED ${f.key}: ${f.error}`);

package/src/be/seed/state-db.ts

@@ -36,3 +36,8 @@ export async function recordSeedState(
     [kind, key, seededHash, new Date().toISOString()],
   );
 }
+
+/** Forget `(kind, key)`, e.g. after the seeder retires the entity it seeded. */
+export async function deleteSeedState(kind: string, key: string): Promise<void> {
+  await getDbClient().run("DELETE FROM seed_state WHERE kind = ? AND key = ?", [kind, key]);
+}

package/src/be/seed/types.ts

@@ -53,6 +53,11 @@ export interface Seeder<TItem extends SeedItem = SeedItem> {
   upstreamHash(item: TItem): string | null | Promise<string | null>;
   /** Create or update the upstream entity so it matches the source definition. */
   apply(item: TItem, action: "create" | "update", opts?: SeederRunOptions): void | Promise<void>;
+  /**
+   * Optional: remove upstream entities for keys the source no longer ships.
+   * Must leave user-modified entities in place. Returns the removed keys.
+   */
+  retire?(): Promise<string[]>;
 }
 
 export type SeederResult = {
@@ -61,5 +66,6 @@ export type SeederResult = {
   updated: number;
   skippedUnchanged: number;
   skippedUserModified: number;
+  retired: number;
   failed: Array<{ key: string; error: string }>;
 };