@desplega.ai/agent-swarm 1.80.0 → 1.80.2

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.80.0",
+    "version": "1.80.2",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -2715,7 +2715,8 @@
                       "workflow.run.end",
                       "system.boot",
                       "system.migration",
-                      "system.error"
+                      "system.error",
+                      "script.global_upsert"
                     ]
                   },
                   "status": {
@@ -2829,7 +2830,8 @@
                 "workflow.run.end",
                 "system.boot",
                 "system.migration",
-                "system.error"
+                "system.error",
+                "script.global_upsert"
               ]
             },
             "required": false,
@@ -2979,7 +2981,8 @@
                             "workflow.run.end",
                             "system.boot",
                             "system.migration",
-                            "system.error"
+                            "system.error",
+                            "script.global_upsert"
                           ]
                         },
                         "status": {
@@ -4172,6 +4175,36 @@
             "description": "Memory not found"
           }
         }
+      },
+      "get": {
+        "summary": "Get a single memory by ID",
+        "tags": [
+          "Memory"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Memory details"
+          },
+          "404": {
+            "description": "Memory not found"
+          }
+        }
       }
     },
     "/api/memory/rate": {
@@ -6695,6 +6728,68 @@
             "description": "Duplicate name"
           }
         }
+      },
+      "get": {
+        "summary": "List schedules",
+        "tags": [
+          "Schedules"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "true",
+                "false"
+              ]
+            },
+            "required": false,
+            "name": "enabled",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "name",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "recurring",
+                "one_time"
+              ]
+            },
+            "required": false,
+            "name": "scheduleType",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "true",
+                "false"
+              ]
+            },
+            "required": false,
+            "name": "hideCompleted",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "List of schedules"
+          }
+        }
       }
     },
     "/api/schedules/{id}/run": {
@@ -7726,6 +7821,296 @@
         }
       }
     },
+    "/api/scripts/upsert": {
+      "post": {
+        "operationId": "scripts_upsert",
+        "summary": "Create or update a reusable script",
+        "description": "Explicit script upserts run a TypeScript typecheck before writing.",
+        "tags": [
+          "Scripts"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "source": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": {
+                    "type": "string",
+                    "default": ""
+                  },
+                  "intent": {
+                    "type": "string",
+                    "default": ""
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": [
+                      "global",
+                      "agent"
+                    ],
+                    "default": "agent"
+                  },
+                  "fsMode": {
+                    "type": "string",
+                    "enum": [
+                      "none",
+                      "workspace-rw"
+                    ],
+                    "default": "none"
+                  }
+                },
+                "required": [
+                  "name",
+                  "source"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Script upserted"
+          },
+          "400": {
+            "description": "Validation or typecheck failure"
+          },
+          "403": {
+            "description": "Global write requires lead agent"
+          }
+        }
+      }
+    },
+    "/api/scripts/run": {
+      "post": {
+        "operationId": "scripts_run",
+        "summary": "Run a reusable or inline script",
+        "description": "Inline source skips typecheck and is auto-saved as a scratch script only on success.",
+        "tags": [
+          "Scripts"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "source": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "args": {},
+                  "intent": {
+                    "type": "string",
+                    "default": ""
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": [
+                      "global",
+                      "agent"
+                    ]
+                  },
+                  "fsMode": {
+                    "type": "string",
+                    "enum": [
+                      "none",
+                      "workspace-rw"
+                    ],
+                    "default": "none"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Script run completed"
+          },
+          "400": {
+            "description": "Validation error"
+          },
+          "404": {
+            "description": "Script not found"
+          },
+          "501": {
+            "description": "workspace-rw scripts are not supported in v1"
+          }
+        }
+      }
+    },
+    "/api/scripts/search": {
+      "post": {
+        "operationId": "scripts_search",
+        "summary": "Search reusable scripts",
+        "description": "Phase 3 search is substring-only over script name and metadata.",
+        "tags": [
+          "Scripts"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "query": {
+                    "type": "string",
+                    "default": ""
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": [
+                      "global",
+                      "agent"
+                    ]
+                  },
+                  "limit": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 100,
+                    "default": 10
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Matching scripts"
+          },
+          "400": {
+            "description": "Validation error"
+          }
+        }
+      }
+    },
+    "/api/scripts/{name}": {
+      "delete": {
+        "operationId": "scripts_delete",
+        "summary": "Delete a reusable script",
+        "tags": [
+          "Scripts"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "required": true,
+            "name": "name",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "global",
+                "agent"
+              ],
+              "default": "agent"
+            },
+            "required": false,
+            "name": "scope",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Delete result"
+          },
+          "400": {
+            "description": "Validation error"
+          },
+          "403": {
+            "description": "Global delete requires lead agent"
+          }
+        }
+      }
+    },
+    "/api/scripts/{name}/types": {
+      "get": {
+        "operationId": "scripts_types",
+        "summary": "Get script signature and authoring types",
+        "tags": [
+          "Scripts"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "required": true,
+            "name": "name",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "global",
+                "agent"
+              ]
+            },
+            "required": false,
+            "name": "scope",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Script signature and type blobs"
+          },
+          "404": {
+            "description": "Script not found"
+          }
+        }
+      }
+    },
     "/api/mcp-oauth/{mcpServerId}/metadata": {
       "get": {
         "summary": "Probe OAuth metadata (PRMD + AS) for an MCP server",
@@ -10423,7 +10808,7 @@
                             },
                             "type": {
                               "type": "string",
-                              "description": "Executor type: 'agent-task', 'script', 'raw-llm', 'validate', 'property-match'"
+                              "description": "Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'validate', 'property-match'"
                             },
                             "label": {
                               "type": "string",
@@ -10432,7 +10817,7 @@
                             "config": {
                               "type": "object",
                               "additionalProperties": {},
-                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
+                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
                             },
                             "next": {
                               "anyOf": [
@@ -10761,7 +11146,7 @@
                             },
                             "type": {
                               "type": "string",
-                              "description": "Executor type: 'agent-task', 'script', 'raw-llm', 'validate', 'property-match'"
+                              "description": "Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'validate', 'property-match'"
                             },
                             "label": {
                               "type": "string",
@@ -10770,7 +11155,7 @@
                             "config": {
                               "type": "object",
                               "additionalProperties": {},
-                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
+                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
                             },
                             "next": {
                               "anyOf": [
@@ -11079,7 +11464,7 @@
                           "properties": {
                             "type": {
                               "type": "string",
-                              "description": "Executor type: 'agent-task', 'script', 'raw-llm', 'validate', 'property-match'"
+                              "description": "Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'validate', 'property-match'"
                             },
                             "label": {
                               "type": "string",
@@ -11088,7 +11473,7 @@
                             "config": {
                               "type": "object",
                               "additionalProperties": {},
-                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
+                              "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
                             },
                             "next": {
                               "anyOf": [
@@ -11234,7 +11619,7 @@
                         },
                         "type": {
                           "type": "string",
-                          "description": "Executor type: 'agent-task', 'script', 'raw-llm', 'validate', 'property-match'"
+                          "description": "Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'validate', 'property-match'"
                         },
                         "label": {
                           "type": "string",
@@ -11243,7 +11628,7 @@
                         "config": {
                           "type": "object",
                           "additionalProperties": {},
-                          "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
+                          "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
                         },
                         "next": {
                           "anyOf": [
@@ -11469,7 +11854,7 @@
                 "properties": {
                   "type": {
                     "type": "string",
-                    "description": "Executor type: 'agent-task', 'script', 'raw-llm', 'validate', 'property-match'"
+                    "description": "Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'validate', 'property-match'"
                   },
                   "label": {
                     "type": "string",
@@ -11478,7 +11863,7 @@
                   "config": {
                     "type": "object",
                     "additionalProperties": {},
-                    "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
+                    "description": "Executor-specific config. For agent-task: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }. For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode? }. Values support {{interpolation}} from the node's inputs context. NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."
                   },
                   "next": {
                     "anyOf": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.80.0",
+  "version": "1.80.2",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",
@@ -42,8 +42,10 @@
   },
   "scripts": {
     "build:pi-skills": "bun run plugin/build-pi-skills.ts",
+    "build:script-types": "bun run scripts/bundle-script-types.ts",
     "tsc:check": "bun tsc --noEmit",
     "check:db-boundary": "bash scripts/check-db-boundary.sh",
+    "check:api-key-boundary": "bash scripts/check-api-key-boundary.sh",
     "cli": "bun src/cli.tsx",
     "hook": "bun src/hooks/hook.ts",
     "claude": "bun src/cli.tsx claude",

package/src/artifact-sdk/server.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { serveStatic } from "hono/bun";
+import { getApiKey } from "../utils/api-key";
 import { BROWSER_SDK_JS } from "./browser-sdk";
 import { getAvailablePort } from "./port";
 import { createTunnel } from "./tunnel";
@@ -23,7 +24,7 @@ export interface ArtifactServer {
 
 export function createArtifactServer(opts: ArtifactServerOptions): ArtifactServer {
   const agentId = process.env.AGENT_ID || "unknown";
-  const apiKey = process.env.API_KEY || "";
+  const apiKey = getApiKey();
   const mcpBaseUrl = process.env.MCP_BASE_URL || `http://localhost:${process.env.PORT || "3013"}`;
 
   const app = new Hono();

package/src/be/db.ts

@@ -362,7 +362,7 @@ function ensureAgentProfileColumns(database: Database): void {
   }
 }
 
-function computeContentHash(content: string): string {
+export function computeContentHash(content: string): string {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(content);
   return hasher.digest("hex");

package/src/be/migrations/064_scripts.sql

@@ -0,0 +1,39 @@
+CREATE TABLE scripts (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  scope TEXT NOT NULL CHECK(scope IN ('global', 'agent')),
+  scopeId TEXT,
+  source TEXT NOT NULL,
+  description TEXT NOT NULL,
+  intent TEXT NOT NULL,
+  signatureJson TEXT NOT NULL,
+  contentHash TEXT NOT NULL,
+  version INTEGER NOT NULL DEFAULT 1,
+  isScratch INTEGER NOT NULL DEFAULT 0,
+  typeChecked INTEGER NOT NULL DEFAULT 0,
+  fsMode TEXT NOT NULL DEFAULT 'none' CHECK(fsMode IN ('none', 'workspace-rw')),
+  createdByAgentId TEXT,
+  createdAt TEXT NOT NULL DEFAULT (datetime('now')),
+  updatedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE UNIQUE INDEX idx_scripts_name_scope ON scripts(name, scope, COALESCE(scopeId, ''));
+CREATE INDEX idx_scripts_scope ON scripts(scope, scopeId);
+CREATE INDEX idx_scripts_scratch ON scripts(isScratch, createdAt);
+
+CREATE TABLE script_versions (
+  id TEXT PRIMARY KEY,
+  scriptId TEXT NOT NULL REFERENCES scripts(id) ON DELETE CASCADE,
+  version INTEGER NOT NULL,
+  source TEXT NOT NULL,
+  description TEXT NOT NULL,
+  intent TEXT NOT NULL,
+  signatureJson TEXT NOT NULL,
+  contentHash TEXT NOT NULL,
+  changedByAgentId TEXT,
+  changedAt TEXT NOT NULL DEFAULT (datetime('now')),
+  changeReason TEXT,
+  UNIQUE(scriptId, version)
+);
+
+CREATE INDEX idx_script_versions_hash ON script_versions(contentHash);

package/src/be/migrations/065_script_embeddings.sql

@@ -0,0 +1,7 @@
+CREATE TABLE script_embeddings (
+  scriptId TEXT PRIMARY KEY REFERENCES scripts(id) ON DELETE CASCADE,
+  embedding BLOB NOT NULL,
+  embeddingModel TEXT NOT NULL,
+  embeddedText TEXT NOT NULL,
+  embeddedAt TEXT NOT NULL DEFAULT (datetime('now'))
+);

package/src/be/migrations/066_scripts_args_json_schema.sql

@@ -0,0 +1 @@
+ALTER TABLE scripts ADD COLUMN argsJsonSchema TEXT;