@desplega.ai/agent-swarm 1.88.0 → 1.90.0

package/src/http/poll.ts

@@ -86,6 +86,10 @@ const pollTriggers = route({
 const CHANNEL_ACTIVITY_INTERVAL_MS = 60_000; // Check at most once per 60s
 let lastChannelActivityCheckAt = 0;
 
+function getRequesterNotes(notes: string | undefined): string | undefined {
+  return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
+}
+
 // ─── Cursor Commit Endpoint ─────────────────────────────────────────────────
 
 const commitCursorsRoute = route({
@@ -256,6 +260,7 @@ export async function handlePoll(
             const requestedByUser = pendingTask.requestedByUserId
               ? getUserById(pendingTask.requestedByUserId)
               : undefined;
+            const requestedByNotes = getRequesterNotes(requestedByUser?.notes);
 
             return {
               trigger: {
@@ -263,7 +268,12 @@ export async function handlePoll(
                 taskId: pendingTask.id,
                 task: { ...pendingTask, status: "in_progress" },
                 ...(requestedByUser && {
-                  requestedBy: { name: requestedByUser.name, email: requestedByUser.email },
+                  requestedBy: {
+                    name: requestedByUser.name,
+                    email: requestedByUser.email,
+                    role: requestedByUser.role,
+                    notes: requestedByNotes,
+                  },
                 }),
               },
             };

package/src/http/tasks.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { ensure } from "@desplega.ai/business-use";
 import { z } from "zod";
 import {
+  backfillSupersedeTaskResumeTaskId,
   cancelTask,
   completeTask,
   failTask,
@@ -34,6 +35,7 @@ import {
   ProviderNameSchema,
   ResumeReasonSchema,
 } from "../types";
+import { getRequestAuth } from "../utils/request-auth-context";
 import { route } from "./route-def";
 import { json, jsonError } from "./utils";
 
@@ -354,7 +356,9 @@ export async function handleTasks(
     // Tolerant `requestedByUserId`: prevent the deleted-user race from
     // becoming a 500 — if the referenced user doesn't exist, log and drop
     // the field rather than letting the FK fail at INSERT.
-    let requestedByUserId = parsed.body.requestedByUserId || undefined;
+    const auth = getRequestAuth(req);
+    let requestedByUserId =
+      auth?.kind === "user" ? auth.userId : parsed.body.requestedByUserId || undefined;
     if (requestedByUserId && !getUserById(requestedByUserId)) {
       console.warn(
         `[tasks] requestedByUserId ${requestedByUserId} does not exist — coercing to NULL`,
@@ -902,6 +906,7 @@ export async function handleTasks(
     }
 
     const resumeTaskId = followUp.task.id;
+    backfillSupersedeTaskResumeTaskId(parsed.params.id, resumeTaskId);
 
     ensure({
       id: "task.superseded",

package/src/http/workflows.ts

@@ -21,6 +21,7 @@ import {
   WorkflowPatchSchema,
   WorkflowRunStatusSchema,
 } from "../types";
+import { getRequestAuth } from "../utils/request-auth-context";
 import { getExecutorRegistry, startWorkflowExecution } from "../workflows";
 import { applyDefinitionPatch, generateEdges, validateDefinition } from "../workflows/definition";
 import { TriggerSchemaError } from "../workflows/engine";
@@ -645,10 +646,13 @@ export async function handleWorkflows(
       return true;
     }
     const body = await parseBody<Record<string, unknown>>(req);
+    const auth = getRequestAuth(req);
 
     let runId: string;
     try {
-      runId = await startWorkflowExecution(workflow, body, getExecutorRegistry());
+      runId = await startWorkflowExecution(workflow, body, getExecutorRegistry(), {
+        requestedByUserId: auth?.kind === "user" ? auth.userId : undefined,
+      });
     } catch (err) {
       if (err instanceof TriggerSchemaError) {
         triggerSchemaErrorResponse(res, err.message, err.validationErrors);

package/src/metrics/version.ts

@@ -0,0 +1,26 @@
+import { createMetricVersion, getMetric, getMetricVersions } from "../be/db";
+import type { MetricSnapshot, MetricVersion } from "../types";
+
+export function snapshotMetric(metricId: string, changedByAgentId?: string): MetricVersion {
+  const metric = getMetric(metricId);
+  if (!metric) {
+    throw new Error(`Metric ${metricId} not found — cannot create snapshot`);
+  }
+
+  const existingVersions = getMetricVersions(metricId);
+  const maxVersion = existingVersions.length > 0 ? existingVersions[0]!.version : 0;
+  const nextVersion = maxVersion + 1;
+
+  const snapshot: MetricSnapshot = {
+    title: metric.title,
+    description: metric.description,
+    definition: metric.definition,
+  };
+
+  return createMetricVersion({
+    metricId,
+    version: nextVersion,
+    snapshot,
+    changedByAgentId,
+  });
+}

package/src/prompts/base-prompt.ts

@@ -72,6 +72,7 @@ export type BasePromptArgs = {
     claudeMd?: string | null;
     clonePath: string;
     warning?: string | null;
+    autoStashes?: { ref: string; message: string }[];
     guidelines?: {
       prChecks: string[];
       mergeChecks: string[];
@@ -197,6 +198,13 @@ export const getBasePrompt = async (args: BasePromptArgs): Promise<string> => {
       } else if (!args.repoContext.warning) {
         prompt += `Repository is cloned at \`${args.repoContext.clonePath}\` but has no CLAUDE.md file.\n`;
       }
+
+      if (args.repoContext.autoStashes && args.repoContext.autoStashes.length > 0) {
+        const stashes = args.repoContext.autoStashes
+          .map((stash) => `- ${stash.ref}: ${stash.message}`)
+          .join("\n");
+        prompt += `\nPending auto-stashed work exists in this repo:\n${stashes}\nRestore if relevant with \`git stash apply <ref>\` or \`git stash pop <ref>\`.\n`;
+      }
     }
 
     // Inject repo guidelines

package/src/prompts/session-templates.ts

@@ -565,6 +565,29 @@ When working in a repository, your system prompt may include a **Repository Guid
   category: "system",
 });
 
+// ============================================================================
+// Per-task prompt templates (category: "task_lifecycle")
+// ============================================================================
+
+registerTemplate({
+  eventType: "task.requester.profile",
+  header: "",
+  defaultBody: `
+## Requester Profile
+This task was requested by {{requester_name}}{{requester_role_suffix}}.{{requester_notes_section}}
+Honor this requester profile in tone, depth, and format where it doesn't conflict with correctness or your operating rules.
+`,
+  variables: [
+    { name: "requester_name", description: "The requesting user's display name" },
+    { name: "requester_role_suffix", description: "Formatted role suffix, including parentheses" },
+    {
+      name: "requester_notes_section",
+      description: "Formatted notes section sourced from users.notes, or empty string",
+    },
+  ],
+  category: "task_lifecycle",
+});
+
 // ============================================================================
 // Composite session templates (category: "session")
 // ============================================================================

package/src/providers/opencode-adapter.ts

@@ -219,6 +219,7 @@ export class OpencodeSession implements ProviderSession {
   private completionPromise: Promise<ProviderResult>;
   private server: { url: string; close(): void };
   private aborted = false;
+  private completed = false;
 
   // Running cost accumulators
   private totalCostUsd = 0;
@@ -273,6 +274,10 @@ export class OpencodeSession implements ProviderSession {
     return this._sessionId;
   }
 
+  get isFinished(): boolean {
+    return this.completed;
+  }
+
   /** Emit the synthetic session_init event. Called by the adapter immediately
    * after construction; buffers if no listener is attached yet. */
   emitSessionInit(provider: "opencode"): void {
@@ -358,7 +363,7 @@ export class OpencodeSession implements ProviderSession {
 
   /** Process a single opencode SSE event */
   handleOpencodeEvent(ev: OpencodeEvent): void {
-    if (this.aborted) return;
+    if (this.aborted || this.completed) return;
 
     // Always emit the raw event as a scrubbed raw_log
     const rawContent = scrubSecrets(JSON.stringify(ev));
@@ -471,7 +476,7 @@ export class OpencodeSession implements ProviderSession {
         for (const l of this.listeners) l(resultEvent);
         const raw = scrubSecrets(JSON.stringify(resultEvent));
         this.emitDirect({ type: "raw_log", content: raw });
-        this.completionResolve({
+        void this.finish({
           exitCode: 0,
           sessionId: this._sessionId,
           cost,
@@ -515,7 +520,7 @@ export class OpencodeSession implements ProviderSession {
     const raw = scrubSecrets(JSON.stringify(errorEvent));
     this.emitDirect({ type: "raw_log", content: raw });
     const cost = this.buildCostData(true);
-    this.completionResolve({
+    void this.finish({
       exitCode: 1,
       sessionId: this._sessionId,
       cost,
@@ -546,12 +551,22 @@ export class OpencodeSession implements ProviderSession {
     return this.completionPromise;
   }
 
+  private async finish(result: ProviderResult): Promise<void> {
+    if (this.completed) return;
+    this.completed = true;
+    try {
+      this.server.close();
+    } catch {
+      // best-effort
+    }
+    await this.cleanupFiles();
+    this.completionResolve(result);
+  }
+
   async abort(): Promise<void> {
     if (this.aborted) return;
     this.aborted = true;
-    this.server.close();
-    await this.cleanupFiles();
-    this.completionResolve({
+    await this.finish({
       exitCode: 1,
       sessionId: this._sessionId,
       isError: true,
@@ -760,6 +775,7 @@ export class OpencodeAdapter implements ProviderAdapter {
       .then(async ({ stream }) => {
         for await (const event of stream) {
           session.handleOpencodeEvent(event as OpencodeEvent);
+          if (session.isFinished) break;
         }
         // Stream ended without session.idle — treat as completion
       })

package/src/server.ts

@@ -6,6 +6,7 @@ import { registerCancelTaskTool } from "./tools/cancel-task";
 import { registerContextDiffTool } from "./tools/context-diff";
 import { registerContextHistoryTool } from "./tools/context-history";
 import { registerCreateChannelTool } from "./tools/create-channel";
+import { registerCreateMetricTool } from "./tools/create-metric";
 import { registerCreatePageTool } from "./tools/create-page";
 import { registerDbQueryTool } from "./tools/db-query";
 import { registerDeleteChannelTool } from "./tools/delete-channel";
@@ -109,6 +110,7 @@ import {
   registerListConfigTool,
   registerSetConfigTool,
 } from "./tools/swarm-config";
+import { registerSwarmXTool } from "./tools/swarm-x";
 // Task pool capability
 import { registerTaskActionTool } from "./tools/task-action";
 // Tracker capability
@@ -146,7 +148,7 @@ import {
 // Capability-based feature flags
 // Default: all capabilities enabled
 const DEFAULT_CAPABILITIES =
-  "core,task-pool,profiles,services,scheduling,memory,workflows,pages,kv";
+  "core,task-pool,profiles,services,scheduling,memory,workflows,pages,metrics,kv";
 const CAPABILITIES = new Set(
   (process.env.CAPABILITIES || DEFAULT_CAPABILITIES).split(",").map((s) => s.trim()),
 );
@@ -226,6 +228,9 @@ export function createServer() {
   registerScriptDeleteTool(server);
   registerScriptQueryTypesTool(server);
 
+  // External command routes - mirrors the `agent-swarm x ...` CLI surface.
+  registerSwarmXTool(server);
+
   // Slack integration tools (always registered, will no-op if Slack not configured)
   registerSlackReplyTool(server);
   registerSlackReadTool(server);
@@ -338,6 +343,10 @@ export function createServer() {
     registerCreatePageTool(server);
   }
 
+  if (hasCapability("metrics")) {
+    registerCreateMetricTool(server);
+  }
+
   // KV capability — namespaced Redis-like key/value (see src/be/migrations/061_kv_store.sql).
   // Enabled by default; opt out via `CAPABILITIES=...` without `kv`.
   if (hasCapability("kv")) {

package/src/tasks/worker-follow-up.ts

@@ -22,6 +22,20 @@ export const WORKER_LIVENESS_WINDOW_SECONDS = Number(
   process.env.WORKER_LIVENESS_WINDOW_SECONDS || "30",
 );
 
+export const RESUME_GENERATION_TAG_PREFIX = "resume-generation:";
+
+export function getResumeGeneration(task: Pick<AgentTask, "tags">): number {
+  const tag = task.tags.find((value) => value.startsWith(RESUME_GENERATION_TAG_PREFIX));
+  if (!tag) return 0;
+
+  const parsed = Number(tag.slice(RESUME_GENERATION_TAG_PREFIX.length));
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 0;
+}
+
+export function getNextResumeGeneration(parent: Pick<AgentTask, "tags">): number {
+  return getResumeGeneration(parent) + 1;
+}
+
 function attachmentPointer(a: TaskAttachment): string {
   switch (a.kind) {
     case "url":
@@ -205,7 +219,11 @@ export function createResumeFollowUp(args: {
   ].join("\n");
 
   const priority = Math.min(100, (parent.priority ?? 50) + 10);
-  const tags = ["auto-resume", `reason:${args.reason}`];
+  const tags = [
+    "auto-resume",
+    `reason:${args.reason}`,
+    `${RESUME_GENERATION_TAG_PREFIX}${getNextResumeGeneration(parent)}`,
+  ];
 
   // Identity-shaped fields (dir, VCS provider/repo/number/url/etc.,
   // outputSchema, slack channel/thread/user, agentmail, mention, contextKey,

package/src/tests/base-prompt.test.ts

@@ -272,6 +272,41 @@ describe("getBasePrompt — repoContext", () => {
     expect(result).toContain("Repository Guidelines (MANDATORY)");
     expect(result).toContain("Auto-merge: Allowed");
   });
+
+  test("surfaces swarm-autostash entries when present", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      repoContext: {
+        claudeMd: "Rules",
+        clonePath: "/workspace/my-repo",
+        autoStashes: [
+          {
+            ref: "stash@{0}",
+            message: "On main: swarm-autostash main 2026-06-01T13:00:00.000Z",
+          },
+        ],
+      },
+    });
+
+    expect(result).toContain("Pending auto-stashed work exists in this repo");
+    expect(result).toContain("stash@{0}: On main: swarm-autostash main");
+    expect(result).toContain("git stash apply <ref>");
+    expect(result).toContain("git stash pop <ref>");
+  });
+
+  test("does not mention auto-stashed work when no swarm-autostash entries exist", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      repoContext: {
+        claudeMd: "Rules",
+        clonePath: "/workspace/my-repo",
+        autoStashes: [],
+      },
+    });
+
+    expect(result).not.toContain("Pending auto-stashed work exists in this repo");
+    expect(result).not.toContain("git stash apply <ref>");
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/tests/budget-claim-gate.test.ts

@@ -11,6 +11,7 @@ import {
   createAgent,
   createSessionCost,
   createTaskExtended,
+  createUser,
   getAgentById,
   getDb,
   incrementEmptyPollCount,
@@ -129,6 +130,31 @@ describe("Phase 3 — /api/poll budget admission gate", () => {
     expect((body.trigger as { taskId: string }).taskId).toBe(task.id);
   });
 
+  test("pending task trigger includes requester role and notes", async () => {
+    const worker = createAgent({ name: "w-requester", isLead: false, status: "idle", maxTasks: 1 });
+    const requester = createUser({
+      name: "Requester One",
+      email: "requester@example.com",
+      role: "engineering manager",
+      notes: "Include implementation detail and test coverage.",
+    });
+    createTaskExtended("profile-aware task", {
+      agentId: worker.id,
+      requestedByUserId: requester.id,
+    });
+
+    const { status, body } = await callPoll(worker.id);
+    expect(status).toBe(200);
+    if ("error" in body) throw new Error("unexpected error response");
+    expect(body.trigger?.type).toBe("task_assigned");
+    expect(body.trigger?.requestedBy).toEqual({
+      name: "Requester One",
+      email: "requester@example.com",
+      role: "engineering manager",
+      notes: "Include implementation detail and test coverage.",
+    });
+  });
+
   test("no budgets configured + no work → trigger=null", async () => {
     const worker = createAgent({ name: "w-empty", isLead: false, status: "idle", maxTasks: 1 });
     const { status, body } = await callPoll(worker.id);

package/src/tests/core-auth.test.ts

@@ -135,8 +135,15 @@ describe("handleCore auth middleware (no API_KEY configured)", () => {
     server.close();
   });
 
-  test("authed routes pass without Bearer when API_KEY is empty", async () => {
+  test("authed routes fail closed without Bearer when API_KEY is empty", async () => {
     const res = await fetch(`http://localhost:${port}/api/mcp-oauth/some-id/status`);
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  test("public routes still pass when API_KEY is empty", async () => {
+    const res = await fetch(`http://localhost:${port}/api/mcp-oauth/callback`);
     expect(res.status).not.toBe(401);
   });
 });

package/src/tests/events-http.test.ts

@@ -5,6 +5,7 @@ import type { Subprocess } from "bun";
 const TEST_PORT = 13033;
 const TEST_DB_PATH = `/tmp/test-events-http-${Date.now()}.sqlite`;
 const BASE = `http://localhost:${TEST_PORT}`;
+const TEST_API_KEY = "test-events-http-key";
 
 let serverProc: Subprocess;
 
@@ -15,7 +16,10 @@ async function api(
 ): Promise<{ status: number; body: Record<string, unknown> }> {
   const res = await fetch(`${BASE}${path}`, {
     method,
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${TEST_API_KEY}`,
+    },
     body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
   });
   const text = await res.text();
@@ -54,7 +58,7 @@ beforeAll(async () => {
       ...process.env,
       PORT: String(TEST_PORT),
       DATABASE_PATH: TEST_DB_PATH,
-      API_KEY: "",
+      API_KEY: TEST_API_KEY,
       CAPABILITIES: "core",
       SLACK_BOT_TOKEN: "",
       GITHUB_WEBHOOK_SECRET: "",