@desplega.ai/agent-swarm 1.20.0 → 1.49.0

package/src/commands/setup.tsx

@@ -2,10 +2,13 @@
 import { Spinner, TextInput } from "@inkjs/ui";
 import { Box, Text, useApp } from "ink";
 import { useCallback, useEffect, useRef, useState } from "react";
-import pkg from "../../package.json";
+import {
+  createDefaultMcpJson,
+  createDefaultSettingsLocal,
+  createHooksConfig,
+  SERVER_NAME,
+} from "./shared/client-config.ts";
 
-const SERVER_NAME = (pkg as { config?: { name?: string } }).config?.name ?? "agent-swarm";
-const PKG_NAME = pkg.name;
 const DEFAULT_MCP_BASE_URL = "https://agent-swarm-mcp.desplega.sh";
 
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -40,41 +43,6 @@ interface SetupState {
   isGitRepo: boolean;
 }
 
-const createDefaultSettingsLocal = () => ({
-  permissions: {
-    allow: [],
-  },
-  enableAllProjectMcpServers: false,
-  enabledMcpjsonServers: [],
-  hooks: {},
-});
-
-const createDefaultMcpJson = () => ({
-  mcpServers: {},
-});
-
-const createHooksConfig = () => {
-  const hookCommand = `bunx ${PKG_NAME}@latest hook`;
-  const hookEntry = {
-    matcher: "*",
-    hooks: [
-      {
-        type: "command",
-        command: hookCommand,
-      },
-    ],
-  };
-
-  return {
-    SessionStart: [hookEntry],
-    UserPromptSubmit: [hookEntry],
-    PreToolUse: [hookEntry],
-    PostToolUse: [hookEntry],
-    PreCompact: [hookEntry],
-    Stop: [hookEntry],
-  };
-};
-
 export function Setup({ dryRun = false, restore = false, yes = false }: SetupProps) {
   const { exit } = useApp();
   const [state, setState] = useState<SetupState>({
@@ -271,6 +239,23 @@ export function Setup({ dryRun = false, restore = false, yes = false }: SetupPro
         // Ignore errors reading existing config
       }
 
+      // Try to read API_KEY from .env if not already found
+      if (!existingToken) {
+        try {
+          const envFile = Bun.file(`${cwd}/.env`);
+          if (await envFile.exists()) {
+            const envContent = await envFile.text();
+            const match = envContent.match(/^API_KEY=(.+)$/m);
+            if (match?.[1]) {
+              existingToken = match[1].trim();
+              addLog("Found API_KEY in .env");
+            }
+          }
+        } catch {
+          // Ignore errors reading .env
+        }
+      }
+
       // In non-interactive mode (yes=true), skip prompts and go directly to updating
       if (yes) {
         const token = process.env.API_KEY;

package/src/commands/shared/client-config.ts

@@ -0,0 +1,41 @@
+import pkg from "../../../package.json";
+
+const PKG_NAME = pkg.name;
+const SERVER_NAME = (pkg as { config?: { name?: string } }).config?.name ?? "agent-swarm";
+
+export { SERVER_NAME };
+
+export const createDefaultSettingsLocal = () => ({
+  permissions: {
+    allow: [] as string[],
+  },
+  enableAllProjectMcpServers: false,
+  enabledMcpjsonServers: [] as string[],
+  hooks: {} as Record<string, unknown>,
+});
+
+export const createDefaultMcpJson = () => ({
+  mcpServers: {} as Record<string, unknown>,
+});
+
+export const createHooksConfig = () => {
+  const hookCommand = `bunx ${PKG_NAME}@latest hook`;
+  const hookEntry = {
+    matcher: "*",
+    hooks: [
+      {
+        type: "command",
+        command: hookCommand,
+      },
+    ],
+  };
+
+  return {
+    SessionStart: [hookEntry],
+    UserPromptSubmit: [hookEntry],
+    PreToolUse: [hookEntry],
+    PostToolUse: [hookEntry],
+    PreCompact: [hookEntry],
+    Stop: [hookEntry],
+  };
+};

package/src/github/app.ts

@@ -16,6 +16,14 @@ export function isGitHubEnabled(): boolean {
   return !!process.env.GITHUB_WEBHOOK_SECRET;
 }
 
+export function resetGitHub(): void {
+  initialized = false;
+  webhookSecret = null;
+  appId = null;
+  privateKey = null;
+  tokenCache.clear();
+}
+
 export function initGitHub(): boolean {
   // Prevent double initialization
   if (initialized) {

package/src/github/handlers.ts

@@ -1,4 +1,4 @@
-import { createTaskExtended, failTask, findTaskByGitHub, getAllAgents } from "../be/db";
+import { createTaskExtended, failTask, findTaskByVcs, getAllAgents } from "../be/db";
 import { detectMention, extractMentionContext, GITHUB_BOT_NAME, isBotAssignee } from "./mentions";
 import { addIssueReaction, addReaction } from "./reactions";
 import type {
@@ -105,12 +105,13 @@ export async function handlePullRequest(
     const task = createTaskExtended(taskDescription, {
       agentId: lead?.id ?? "",
       source: "github",
+      vcsProvider: "github",
       taskType: "github-pr",
-      githubRepo: repository.full_name,
-      githubEventType: "pull_request",
-      githubNumber: pr.number,
-      githubAuthor: sender.login,
-      githubUrl: pr.html_url,
+      vcsRepo: repository.full_name,
+      vcsEventType: "pull_request",
+      vcsNumber: pr.number,
+      vcsAuthor: sender.login,
+      vcsUrl: pr.html_url,
     });
 
     if (lead) {
@@ -138,7 +139,7 @@ export async function handlePullRequest(
     }
 
     // Find the related task
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (!task) {
       console.log(`[GitHub] No active task found for PR #${pr.number} to cancel`);
       return { created: false };
@@ -167,23 +168,30 @@ export async function handlePullRequest(
       return { created: false };
     }
 
-    // Check if there's an existing task for this PR (e.g., bot created it)
-    const existingTask = findTaskByGitHub(repository.full_name, pr.number);
+    // Check if there's an existing active task for this PR — skip duplicate review tasks
+    const existingTask = findTaskByVcs(repository.full_name, pr.number);
+    if (existingTask) {
+      console.log(
+        `[GitHub] Skipping review task for PR #${pr.number} — active task ${existingTask.id} already exists`,
+      );
+      return { created: false };
+    }
 
     // Create review task
     const lead = findLeadAgent();
     const suggestions = getCommandSuggestions("github-pr");
-    const taskDescription = `[GitHub PR #${pr.number}] ${pr.title}\n\nReview requested from: @${GITHUB_BOT_NAME}\nFrom: ${sender.login}\nRepo: ${repository.full_name}\nBranch: ${pr.head.ref} → ${pr.base.ref}\nURL: ${pr.html_url}\n\nContext:\n${pr.body || pr.title}\n\n---\n${existingTask ? `Related task: ${existingTask.id}\n🔀 Consider routing to the same agent working on the related task.\n` : ""}${DELEGATION_INSTRUCTION}\n${suggestions}`;
+    const taskDescription = `[GitHub PR #${pr.number}] ${pr.title}\n\nReview requested from: @${GITHUB_BOT_NAME}\nFrom: ${sender.login}\nRepo: ${repository.full_name}\nBranch: ${pr.head.ref} → ${pr.base.ref}\nURL: ${pr.html_url}\n\nContext:\n${pr.body || pr.title}\n\n---\n${DELEGATION_INSTRUCTION}\n${suggestions}`;
 
     const task = createTaskExtended(taskDescription, {
       agentId: lead?.id ?? "",
       source: "github",
+      vcsProvider: "github",
       taskType: "github-pr",
-      githubRepo: repository.full_name,
-      githubEventType: "pull_request",
-      githubNumber: pr.number,
-      githubAuthor: sender.login,
-      githubUrl: pr.html_url,
+      vcsRepo: repository.full_name,
+      vcsEventType: "pull_request",
+      vcsNumber: pr.number,
+      vcsAuthor: sender.login,
+      vcsUrl: pr.html_url,
     });
 
     if (lead) {
@@ -211,7 +219,7 @@ export async function handlePullRequest(
     }
 
     // Find the related task
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (!task) {
       console.log(`[GitHub] No active task found for PR #${pr.number} to cancel`);
       return { created: false };
@@ -232,7 +240,7 @@ export async function handlePullRequest(
   // Handle closed action - PR was merged or closed without merge
   if (action === "closed") {
     // Find the related task
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (!task) {
       // No task for this PR, nothing to notify
       return { created: false };
@@ -255,12 +263,13 @@ export async function handlePullRequest(
     const notifyTask = createTaskExtended(taskDescription, {
       agentId: lead?.id ?? "",
       source: "github",
+      vcsProvider: "github",
       taskType: "github-pr-status",
-      githubRepo: repository.full_name,
-      githubEventType: "pull_request",
-      githubNumber: pr.number,
-      githubAuthor: sender.login,
-      githubUrl: pr.html_url,
+      vcsRepo: repository.full_name,
+      vcsEventType: "pull_request",
+      vcsNumber: pr.number,
+      vcsAuthor: sender.login,
+      vcsUrl: pr.html_url,
     });
 
     console.log(
@@ -273,7 +282,7 @@ export async function handlePullRequest(
   // Handle synchronize action - new commits pushed to PR
   if (action === "synchronize") {
     // Find the related task
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (!task) {
       // No task for this PR, nothing to notify
       return { created: false };
@@ -291,12 +300,13 @@ export async function handlePullRequest(
     const notifyTask = createTaskExtended(taskDescription, {
       agentId: lead?.id ?? "",
       source: "github",
+      vcsProvider: "github",
       taskType: "github-pr-update",
-      githubRepo: repository.full_name,
-      githubEventType: "pull_request",
-      githubNumber: pr.number,
-      githubAuthor: sender.login,
-      githubUrl: pr.html_url,
+      vcsRepo: repository.full_name,
+      vcsEventType: "pull_request",
+      vcsNumber: pr.number,
+      vcsAuthor: sender.login,
+      vcsUrl: pr.html_url,
     });
 
     console.log(
@@ -335,12 +345,13 @@ export async function handlePullRequest(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-pr",
-    githubRepo: repository.full_name,
-    githubEventType: "pull_request",
-    githubNumber: pr.number,
-    githubAuthor: sender.login,
-    githubUrl: pr.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "pull_request",
+    vcsNumber: pr.number,
+    vcsAuthor: sender.login,
+    vcsUrl: pr.html_url,
   });
 
   if (lead) {
@@ -388,12 +399,13 @@ export async function handleIssue(
     const task = createTaskExtended(taskDescription, {
       agentId: lead?.id ?? "",
       source: "github",
+      vcsProvider: "github",
       taskType: "github-issue",
-      githubRepo: repository.full_name,
-      githubEventType: "issues",
-      githubNumber: issue.number,
-      githubAuthor: sender.login,
-      githubUrl: issue.html_url,
+      vcsRepo: repository.full_name,
+      vcsEventType: "issues",
+      vcsNumber: issue.number,
+      vcsAuthor: sender.login,
+      vcsUrl: issue.html_url,
     });
 
     if (lead) {
@@ -421,7 +433,7 @@ export async function handleIssue(
     }
 
     // Find the related task
-    const task = findTaskByGitHub(repository.full_name, issue.number);
+    const task = findTaskByVcs(repository.full_name, issue.number);
     if (!task) {
       console.log(`[GitHub] No active task found for issue #${issue.number} to cancel`);
       return { created: false };
@@ -466,12 +478,13 @@ export async function handleIssue(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-issue",
-    githubRepo: repository.full_name,
-    githubEventType: "issues",
-    githubNumber: issue.number,
-    githubAuthor: sender.login,
-    githubUrl: issue.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "issues",
+    vcsNumber: issue.number,
+    vcsAuthor: sender.login,
+    vcsUrl: issue.html_url,
   });
 
   if (lead) {
@@ -526,7 +539,7 @@ export async function handleComment(
   const targetUrl = target?.html_url ?? comment.html_url;
 
   // Check if there's an existing task for this PR/Issue
-  const existingTask = targetNumber ? findTaskByGitHub(repository.full_name, targetNumber) : null;
+  const existingTask = targetNumber ? findTaskByVcs(repository.full_name, targetNumber) : null;
 
   // Build task description
   const context = extractMentionContext(comment.body);
@@ -537,13 +550,14 @@ export async function handleComment(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-comment",
-    githubRepo: repository.full_name,
-    githubEventType: eventType,
-    githubNumber: targetNumber,
-    githubCommentId: comment.id,
-    githubAuthor: sender.login,
-    githubUrl: targetUrl,
+    vcsRepo: repository.full_name,
+    vcsEventType: eventType,
+    vcsNumber: targetNumber,
+    vcsCommentId: comment.id,
+    vcsAuthor: sender.login,
+    vcsUrl: targetUrl,
   });
 
   if (lead) {
@@ -613,7 +627,7 @@ export async function handlePullRequestReview(
   }
 
   // Find any existing task for this PR
-  const existingTask = findTaskByGitHub(repository.full_name, pr.number);
+  const existingTask = findTaskByVcs(repository.full_name, pr.number);
 
   // Only notify for PRs where bot is creator or already has a task
   const isBotCreator = isBotAssignee(pr.user.login);
@@ -642,12 +656,13 @@ export async function handlePullRequestReview(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-review",
-    githubRepo: repository.full_name,
-    githubEventType: "pull_request_review",
-    githubNumber: pr.number,
-    githubAuthor: sender.login,
-    githubUrl: review.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "pull_request_review",
+    vcsNumber: pr.number,
+    vcsAuthor: sender.login,
+    vcsUrl: review.html_url,
   });
 
   if (lead) {
@@ -723,7 +738,7 @@ export async function handleCheckRun(
   let relatedTask = null;
   let prNumber = 0;
   for (const pr of check_run.pull_requests) {
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (task) {
       relatedTask = task;
       prNumber = pr.number;
@@ -754,12 +769,13 @@ export async function handleCheckRun(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-ci",
-    githubRepo: repository.full_name,
-    githubEventType: "check_run",
-    githubNumber: prNumber,
-    githubAuthor: "",
-    githubUrl: check_run.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "check_run",
+    vcsNumber: prNumber,
+    vcsAuthor: "",
+    vcsUrl: check_run.html_url,
   });
 
   console.log(
@@ -799,7 +815,7 @@ export async function handleCheckSuite(
   let relatedTask = null;
   let prNumber = 0;
   for (const pr of check_suite.pull_requests) {
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (task) {
       relatedTask = task;
       prNumber = pr.number;
@@ -827,12 +843,13 @@ export async function handleCheckSuite(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-ci",
-    githubRepo: repository.full_name,
-    githubEventType: "check_suite",
-    githubNumber: prNumber,
-    githubAuthor: "",
-    githubUrl: repository.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "check_suite",
+    vcsNumber: prNumber,
+    vcsAuthor: "",
+    vcsUrl: repository.html_url,
   });
 
   console.log(
@@ -875,7 +892,7 @@ export async function handleWorkflowRun(
   let relatedTask = null;
   let prNumber = 0;
   for (const pr of workflow_run.pull_requests) {
-    const task = findTaskByGitHub(repository.full_name, pr.number);
+    const task = findTaskByVcs(repository.full_name, pr.number);
     if (task) {
       relatedTask = task;
       prNumber = pr.number;
@@ -902,12 +919,13 @@ export async function handleWorkflowRun(
   const task = createTaskExtended(taskDescription, {
     agentId: lead?.id ?? "",
     source: "github",
+    vcsProvider: "github",
     taskType: "github-ci",
-    githubRepo: repository.full_name,
-    githubEventType: "workflow_run",
-    githubNumber: prNumber,
-    githubAuthor: "",
-    githubUrl: workflow_run.html_url,
+    vcsRepo: repository.full_name,
+    vcsEventType: "workflow_run",
+    vcsNumber: prNumber,
+    vcsAuthor: "",
+    vcsUrl: workflow_run.html_url,
   });
 
   console.log(

package/src/github/index.ts

@@ -5,6 +5,7 @@ export {
   initGitHub,
   isGitHubEnabled,
   isReactionsEnabled,
+  resetGitHub,
   verifyWebhookSignature,
 } from "./app";
 export {

package/src/github/types.ts

@@ -17,6 +17,7 @@ export interface PullRequestEvent extends GitHubWebhookEvent {
     base: { ref: string };
     merged: boolean;
     merged_by?: { login: string };
+    changed_files?: number;
   };
   requested_reviewer?: { login: string; id: number }; // Added for review_requested/review_request_removed events
 }

package/src/gitlab/auth.ts

@@ -0,0 +1,63 @@
+/**
+ * GitLab Authentication & Webhook Verification
+ *
+ * GitLab uses a simple shared-secret token for webhook verification
+ * (X-Gitlab-Token header) and PAT/Group Access Token for API calls.
+ */
+
+let initialized = false;
+let webhookSecret: string | null = null;
+let apiToken: string | null = null;
+let gitlabUrl: string = "https://gitlab.com";
+
+export function isGitLabEnabled(): boolean {
+  return !!process.env.GITLAB_WEBHOOK_SECRET && process.env.GITLAB_DISABLE !== "true";
+}
+
+export function initGitLab(): void {
+  if (initialized) return;
+  if (!isGitLabEnabled()) {
+    console.log("[GitLab] Integration disabled (GITLAB_WEBHOOK_SECRET not set)");
+    return;
+  }
+
+  webhookSecret = process.env.GITLAB_WEBHOOK_SECRET!;
+  apiToken = process.env.GITLAB_TOKEN ?? null;
+  gitlabUrl = process.env.GITLAB_URL ?? "https://gitlab.com";
+  initialized = true;
+
+  console.log(`[GitLab] Integration initialized (url: ${gitlabUrl})`);
+}
+
+/**
+ * Verify a GitLab webhook request.
+ * GitLab uses simple string comparison of X-Gitlab-Token header against the configured secret.
+ */
+export function verifyGitLabWebhook(tokenHeader: string | undefined): boolean {
+  if (!webhookSecret) return false;
+  if (!tokenHeader) return false;
+  // timingSafeEqual throws on different lengths, so guard first
+  if (tokenHeader.length !== webhookSecret.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(tokenHeader), Buffer.from(webhookSecret));
+}
+
+/** Get the GitLab API token for making API calls. */
+export function getGitLabToken(): string | null {
+  return apiToken;
+}
+
+/** Get the configured GitLab base URL. */
+export function getGitLabUrl(): string {
+  return gitlabUrl;
+}
+
+/** Bot name for mention detection. */
+export const GITLAB_BOT_NAME = process.env.GITLAB_BOT_NAME ?? "agent-swarm-bot";
+
+/** Reset state for testing. */
+export function resetGitLab(): void {
+  initialized = false;
+  webhookSecret = null;
+  apiToken = null;
+  gitlabUrl = "https://gitlab.com";
+}