@desplega.ai/agent-swarm 1.87.0 → 1.89.0

package/README.md

@@ -9,6 +9,9 @@
   <sub>Built by <a href="https://desplega.sh">desplega.sh</a> — by builders, for builders.</sub>
 </p>
 
+> [!TIP]
+> **This repo evolves every single day.** [Watch now →](https://github.com/desplega-ai/agent-swarm/subscription)
+
 <p align="center">
   <video src="https://github.com/user-attachments/assets/e220712e-c54d-4f46-b059-bac04639d229" controls muted playsinline width="720"></video>
 </p>
@@ -124,7 +127,7 @@ Check [our templates](https://templates.agent-swarm.dev) for a quick start.
 - **Workflow engine with Human-in-the-Loop** — DAG-based automation with approval gates, retries, and structured I/O. [Workflows →](https://docs.agent-swarm.dev/docs/concepts/workflows)
 - **Scheduled & recurring tasks** — cron-based automation for standing work. [Scheduling →](https://docs.agent-swarm.dev/docs/concepts/scheduling)
 - **Harness & LLM agnostic** — run with Claude Code, OpenAI Codex, pi-mono, Devin, Claude Managed Agents, raw LLMs, or opencode. [Harness config →](https://docs.agent-swarm.dev/docs/guides/harness-configuration) · [Add a new provider →](https://docs.agent-swarm.dev/docs/guides/harness-providers)
-- **Follow-up continuity across all harnesses** — child tasks inherit bounded prior-task context even on providers without native session resume, while resumable providers still reuse prior sessions when possible. [Task lifecycle →](https://docs.agent-swarm.dev/docs/concepts/task-lifecycle)
+- **Follow-up continuity across all harnesses** — child tasks inherit a bounded prior-task context preamble built from the task chain, so continuity survives restarts and works the same across every provider. [Task lifecycle →](https://docs.agent-swarm.dev/docs/concepts/task-lifecycle)
 - **Skills & MCP servers** — reusable procedural knowledge and per-agent MCP servers with scope cascade. [MCP tools →](https://docs.agent-swarm.dev/docs/reference/mcp-tools)
 - **DB-backed pages** — agents publish HTML or JSON pages (reports, dashboards, action specs) via the `create_page` MCP tool with public / authed / password modes, version history, view counters, diff helpers, and PDF export. [MCP tools → Pages](https://docs.agent-swarm.dev/docs/reference/mcp-tools#pages-tools)
 - **KV store** — Redis-like namespaced key/value store with auto-scoped context (Slack thread / PR / Linear issue / page). [MCP tools → KV](https://docs.agent-swarm.dev/docs/reference/mcp-tools#kv-tools)
@@ -222,6 +225,7 @@ bunx @desplega.ai/agent-swarm <command>
 | `api`     | Start the API + MCP HTTP server |
 | `worker`  | Run a worker agent |
 | `lead`    | Run a lead agent |
+| `e2b`     | Build E2B templates and launch/manage grouped API + lead + worker swarms |
 | `docs`    | Open documentation (`--open` to launch in browser) |
 
 ## Deployment

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.87.0",
+    "version": "1.89.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -277,6 +277,46 @@
         }
       }
     },
+    "/api/active-sessions/recover-orphaned-tasks": {
+      "post": {
+        "summary": "Recover orphaned in-progress tasks for an agent",
+        "tags": [
+          "Active Sessions"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "agentId": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "minAgeSeconds": {
+                    "type": "integer",
+                    "exclusiveMinimum": 0
+                  }
+                },
+                "required": [
+                  "agentId"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Recovery result"
+          }
+        }
+      }
+    },
     "/api/agents": {
       "post": {
         "summary": "Register or re-register an agent",
@@ -4014,6 +4054,9 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "persistMemory": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -7620,6 +7663,9 @@
                   },
                   "ownerAgentId": {
                     "type": "string"
+                  },
+                  "systemDefault": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -7703,6 +7749,9 @@
           "200": {
             "description": "Skill updated"
           },
+          "403": {
+            "description": "System-managed skills cannot be edited"
+          },
           "404": {
             "description": "Skill not found"
           }
@@ -7732,6 +7781,9 @@
           "200": {
             "description": "Skill deleted"
           },
+          "403": {
+            "description": "System-managed skills cannot be deleted"
+          },
           "404": {
             "description": "Skill not found"
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.87.0",
+  "version": "1.89.0",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",
@@ -45,6 +45,7 @@
     "tsc:check": "bun tsc --noEmit",
     "check:db-boundary": "bash scripts/check-db-boundary.sh",
     "check:api-key-boundary": "bash scripts/check-api-key-boundary.sh",
+    "check:audit-columns": "bash scripts/check-audit-columns.sh",
     "prepare-release": "bun scripts/prepare-release.ts",
     "sync-chart-version": "bun scripts/sync-chart-version.ts",
     "check-chart-version": "bun scripts/sync-chart-version.ts --check-if-package-version-changed",
@@ -111,12 +112,12 @@
     "@desplega.ai/localtunnel": "^2.2.0",
     "@inkjs/ui": "^2.0.0",
     "@linear/sdk": "^77.0.0",
-    "@earendil-works/pi-agent-core": "^0.76.0",
-    "@earendil-works/pi-ai": "^0.76.0",
-    "@earendil-works/pi-coding-agent": "^0.76.0",
+    "@earendil-works/pi-agent-core": "^0.78.0",
+    "@earendil-works/pi-ai": "^0.78.0",
+    "@earendil-works/pi-coding-agent": "^0.78.0",
     "@modelcontextprotocol/sdk": "^1.25.1",
     "@openai/codex-sdk": "^0.135.0",
-    "@opencode-ai/sdk": "^1.15.12",
+    "@opencode-ai/sdk": "^1.15.13",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",

package/plugin/skills/composio/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: composio
+description: Use Composio from Agent Swarm via the `agent-swarm x composio` CLI route or the `swarm_x` MCP tool. Trigger when a task needs connected third-party app tools such as Gmail, GitHub, Slack, Notion, or HubSpot through Composio Tool Router sessions, Connect Links, or connected accounts.
+---
+
+# Composio
+
+Use this skill when a task needs Composio-managed third-party app access.
+The current supported surface is the Agent Swarm `x` route:
+
+- CLI: `agent-swarm x composio <method> <path> [options]`
+- MCP: `swarm_x` with `target: "composio"`
+
+## Core Model
+
+- `COMPOSIO_API_KEY` is deployment-scoped and injected by the CLI/API process.
+- `user_id` is the app user whose connected accounts should be used.
+- Connected accounts persist under that `user_id` across sessions.
+- Tool Router sessions are task/conversation runtime contexts. Store and reuse
+  the `session_id` for follow-up turns; create a new session if the user,
+  toolkit set, auth config, or pinned connected account changes.
+- Sessions do not expire, but Connect Links and incomplete connection attempts
+  expire quickly. If a connection is missing or expired, initiate a new link.
+
+## Workflow
+
+1. Create or reuse a Tool Router session for the target user and toolkit set.
+2. Search before executing. Use `/search` to get the current tool slug, schema,
+   plan, pitfalls, and connection status.
+3. If Composio reports no active connection, execute
+   `COMPOSIO_MANAGE_CONNECTIONS` for the exact toolkit names it returned.
+4. Share the returned Connect Link with the user and pause until they complete
+   auth.
+5. Retry the app tool only after the toolkit shows an active connected account.
+6. Prefer metadata-first reads (`include_payload:false`, `verbose:false`) unless
+   the user explicitly needs bodies, attachments, or full records.
+7. Paginate when Composio returns `nextPageToken`, cursors, or continuation
+   fields.
+
+## CLI Examples
+
+Create a Gmail-scoped session:
+
+```bash
+agent-swarm x composio POST /tool_router/session \
+  --body '{"user_id":"swarm-user-id","toolkits":{"enable":["gmail"]},"workbench":{"enable":false}}'
+```
+
+Search for the right Gmail tool:
+
+```bash
+agent-swarm x composio POST /tool_router/session/$SESSION_ID/search \
+  --body '{"queries":[{"use_case":"Check recent emails in Gmail and return metadata only."}]}'
+```
+
+Connect Gmail if needed:
+
+```bash
+agent-swarm x composio POST /tool_router/session/$SESSION_ID/execute \
+  --body '{"tool_slug":"COMPOSIO_MANAGE_CONNECTIONS","arguments":{"toolkits":["gmail"]}}'
+```
+
+Fetch lightweight email metadata after connection:
+
+```bash
+agent-swarm x composio POST /tool_router/session/$SESSION_ID/execute \
+  --body '{"tool_slug":"GMAIL_FETCH_EMAILS","arguments":{"user_id":"me","max_results":5,"include_payload":false,"verbose":false}}'
+```
+
+## MCP Example
+
+```jsonc
+// Tool call: swarm_x
+{
+  "target": "composio",
+  "method": "POST",
+  "path": "/tool_router/session/$SESSION_ID/execute",
+  "body": {
+    "tool_slug": "GMAIL_FETCH_EMAILS",
+    "arguments": {
+      "user_id": "me",
+      "max_results": 5,
+      "include_payload": false,
+      "verbose": false
+    }
+  }
+}
+```
+
+## Guardrails
+
+- Never invent tool slugs or argument shapes. Use `/search` and returned schemas.
+- Never pass absolute URLs as Composio paths. Use relative API paths only.
+- Do not expose `COMPOSIO_API_KEY`; server-side code injects it.
+- Do not fetch email bodies, attachments, or destructive tool actions unless the
+  task explicitly requires them.
+- If multiple accounts exist for a toolkit, ask which account to use or pin the
+  specific connected account/session account according to the task.