@desplega.ai/agent-swarm 1.89.0 → 1.91.0

package/src/jira/app.ts

@@ -1,4 +1,5 @@
 import { upsertOAuthApp } from "../be/db-queries/oauth";
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { initJiraOutboundSync, teardownJiraOutboundSync } from "./outbound";
 // Side-effect import: registers all Jira event templates in the in-memory
 // registry at module load time (mirrors `src/linear/templates.ts`).
@@ -41,9 +42,7 @@ export function initJira(): boolean {
   // Atlassian. Prefer MCP_BASE_URL over the localhost dev default; in prod
   // with no JIRA_REDIRECT_URI set, this is what stops Atlassian from sending
   // the user back to localhost.
-  const apiBaseUrl =
-    process.env.MCP_BASE_URL?.trim().replace(/\/+$/, "") ||
-    `http://localhost:${process.env.PORT || "3013"}`;
+  const apiBaseUrl = getPublicMcpBaseUrl();
   const redirectUri = process.env.JIRA_REDIRECT_URI ?? `${apiBaseUrl}/api/trackers/jira/callback`;
 
   upsertOAuthApp("jira", {

package/src/jira/webhook-lifecycle.ts

@@ -1,3 +1,4 @@
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { jiraFetch } from "./client";
 import { getJiraMetadata, updateJiraMetadata } from "./metadata";
 
@@ -23,7 +24,7 @@ let keepaliveInterval: ReturnType<typeof setInterval> | null = null;
 // ─── URL helpers ─────────────────────────────────────────────────────────────
 
 function getWebhookBaseUrl(): string {
-  return process.env.MCP_BASE_URL || `http://localhost:${process.env.PORT || "3013"}`;
+  return getPublicMcpBaseUrl();
 }
 
 function getRegisteredWebhookUrl(): string {

package/src/linear/app.ts

@@ -1,4 +1,5 @@
 import { upsertOAuthApp } from "../be/db-queries/oauth";
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { initLinearOutboundSync, teardownLinearOutboundSync } from "./outbound";
 
 let initialized = false;
@@ -31,9 +32,7 @@ export function initLinear(): boolean {
   // verbatim by the OAuth flow. Prefer MCP_BASE_URL over the localhost default
   // so prod doesn't send users back to localhost when LINEAR_REDIRECT_URI is
   // unset.
-  const apiBaseUrl =
-    process.env.MCP_BASE_URL?.trim().replace(/\/+$/, "") ||
-    `http://localhost:${process.env.PORT || "3013"}`;
+  const apiBaseUrl = getPublicMcpBaseUrl();
   const redirectUri =
     process.env.LINEAR_REDIRECT_URI ?? `${apiBaseUrl}/api/trackers/linear/callback`;
 

package/src/providers/claude-adapter.ts

@@ -336,6 +336,30 @@ export function buildClaudeCodeOtelEnv(
   return otelEnv;
 }
 
+/**
+ * Claude Code runtime defaults for ephemeral swarm harness sessions.
+ *
+ * These are plain subprocess env vars, not prompt content. They are injected
+ * after the resolved swarm config so the worker enforces the memory/privacy
+ * guardrails consistently per spawn. Statsig/DNT opt-out is intentionally
+ * separate from our Claude Code OTel export path, which is controlled by
+ * buildClaudeCodeOtelEnv.
+ */
+export function buildClaudeCodeRuntimeEnv(
+  _sourceEnv: Record<string, string | undefined>,
+): Record<string, string> {
+  return {
+    ENABLE_TOOL_SEARCH: "true",
+    CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING: "1",
+    CLAUDE_CODE_SKIP_PROMPT_HISTORY: "1",
+    CLAUDE_CODE_DISABLE_ATTACHMENTS: "1",
+    DISABLE_TELEMETRY: "1",
+    DO_NOT_TRACK: "1",
+    DISABLE_FEEDBACK_COMMAND: "1",
+    DISABLE_BUG_COMMAND: "1",
+  };
+}
+
 /**
  * Resolve the path at which the per-task system prompt is staged on disk.
  *
@@ -398,11 +422,13 @@ class ClaudeSession implements ProviderSession {
     // so the freshly-computed TRACEPARENT wins over any stale value the
     // container env might carry.
     const otelEnv = buildClaudeCodeOtelEnv(sourceEnv);
+    const runtimeEnv = buildClaudeCodeRuntimeEnv(sourceEnv);
     this.proc = Bun.spawn(cmd, {
       cwd: this.config.cwd,
       env: {
         ENABLE_PROMPT_CACHING_1H: "1",
         ...sourceEnv,
+        ...runtimeEnv,
         ...otelEnv,
         TASK_FILE: taskFilePath,
         // Belt-and-braces: TASK_FILE on disk can disappear mid-session (race

package/src/scripts-runtime/executors/native.ts

@@ -90,6 +90,7 @@ async function writeBareImportShims(tmpdir: string): Promise<void> {
     const shims: [string, string][] = [
       ["stdlib", `${runtimeDir}/stdlib.bundle.js`],
       ["swarm-sdk", `${runtimeDir}/swarm-sdk.bundle.js`],
+      ["zod", `${runtimeDir}/zod.bundle.js`],
     ];
     for (const [name, bundlePath] of shims) {
       const dir = `${tmpdir}/node_modules/${name}`;

package/src/scripts-runtime/sdk-allowlist.ts

@@ -1,19 +1,140 @@
 export const SDK_TOOL_NAME_MAP = {
+  // ── memory ──
   memory_search: "memory-search",
   memory_get: "memory-get",
   memory_rate: "memory_rate",
+  memory_delete: "memory-delete", // destructive
+  inject_learning: "inject-learning",
+
+  // ── tasks ──
   task_list: "get-tasks",
   task_get: "get-task-details",
   task_storeProgress: "store-progress",
+  task_poll: "poll-task",
+  task_send: "send-task",
+  task_cancel: "cancel-task", // destructive
+  task_action: "task-action",
+
+  // ── kv ──
   kv_get: "kv-get",
   kv_set: "kv-set",
   kv_del: "kv-delete",
   kv_incr: "kv-incr",
   kv_list: "kv-list",
+
+  // ── repos ──
   repo_list: "get-repos",
+  repo_update: "update-repo",
+
+  // ── schedules ──
   schedule_list: "list-schedules",
+  schedule_create: "create-schedule",
+  schedule_update: "update-schedule",
+  schedule_delete: "delete-schedule", // destructive
+  schedule_runNow: "run-schedule-now",
+
+  // ── scripts ──
   script_search: "script-search",
   script_run: "script-run",
+  script_upsert: "script-upsert",
+  script_delete: "script-delete", // destructive
+  script_queryTypes: "script-query-types",
+
+  // ── swarm / agent ──
+  swarm_get: "get-swarm",
+  agent_info: "my-agent-info",
+  agent_join: "join-swarm",
+  metrics_get: "get-metrics",
+  user_resolve: "resolve-user",
+  user_manage: "manage-user",
+  db_query: "db-query",
+
+  // ── config ──
+  config_get: "get-config",
+  config_list: "list-config",
+  config_set: "set-config",
+  config_delete: "delete-config", // destructive
+
+  // ── slack ──
+  slack_read: "slack-read",
+  slack_listChannels: "slack-list-channels",
+  slack_post: "slack-post", // external: sends to Slack
+  slack_reply: "slack-reply", // external: sends to Slack
+  slack_startThread: "slack-start-thread", // external: sends to Slack
+  slack_uploadFile: "slack-upload-file", // external: sends to Slack
+  slack_downloadFile: "slack-download-file",
+
+  // ── messaging (internal) ──
+  message_read: "read-messages",
+  message_post: "post-message",
+
+  // ── profiles ──
+  profile_update: "update-profile",
+
+  // ── context / profiles ──
+  context_history: "context-history",
+  context_diff: "context-diff",
+
+  // ── services ──
+  service_list: "list-services",
+  service_register: "register-service",
+  service_unregister: "unregister-service", // destructive
+  service_updateStatus: "update-service-status",
+
+  // ── workflows ──
+  workflow_list: "list-workflows",
+  workflow_get: "get-workflow",
+  workflow_create: "create-workflow",
+  workflow_update: "update-workflow",
+  workflow_patch: "patch-workflow",
+  workflow_patchNode: "patch-workflow-node",
+  workflow_delete: "delete-workflow", // destructive
+  workflow_trigger: "trigger-workflow",
+  workflow_listRuns: "list-workflow-runs",
+  workflow_getRun: "get-workflow-run",
+  workflow_retryRun: "retry-workflow-run",
+  workflow_cancelRun: "cancel-workflow-run", // destructive
+
+  // ── prompt templates ──
+  prompt_list: "list-prompt-templates",
+  prompt_get: "get-prompt-template",
+  prompt_set: "set-prompt-template",
+  prompt_delete: "delete-prompt-template", // destructive
+  prompt_preview: "preview-prompt-template",
+
+  // ── tracker ──
+  tracker_status: "tracker-status",
+  tracker_syncStatus: "tracker-sync-status",
+  tracker_linkTask: "tracker-link-task",
+  tracker_unlink: "tracker-unlink", // destructive
+  tracker_mapAgent: "tracker-map-agent",
+
+  // ── skills ──
+  skill_list: "skill-list",
+  skill_get: "skill-get",
+  skill_search: "skill-search",
+  skill_create: "skill-create",
+  skill_update: "skill-update",
+  skill_delete: "skill-delete", // destructive
+  skill_install: "skill-install",
+  skill_uninstall: "skill-uninstall", // destructive
+  skill_publish: "skill-publish",
+
+  // ── mcp servers ──
+  mcpServer_list: "mcp-server-list",
+  mcpServer_get: "mcp-server-get",
+  mcpServer_create: "mcp-server-create",
+  mcpServer_update: "mcp-server-update",
+  mcpServer_delete: "mcp-server-delete", // destructive
+  mcpServer_install: "mcp-server-install",
+  mcpServer_uninstall: "mcp-server-uninstall", // destructive
+
+  // ── pages & metrics ──
+  page_create: "create_page",
+  metric_create: "create_metric",
+
+  // ── human input ──
+  request_humanInput: "request-human-input",
 } as const;
 
 export const SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP) as Array<

package/src/scripts-runtime/swarm-sdk.ts

@@ -1,6 +1,6 @@
 import { scrubObject } from "../utils/secret-scrubber";
 import { Redacted } from "./redacted";
-import { isSdkToolAllowed } from "./sdk-allowlist";
+import { isSdkToolAllowed, mcpToolNameForSdkMethod } from "./sdk-allowlist";
 import type { SwarmConfig } from "./swarm-config";
 
 type BridgeRequest = {
@@ -43,9 +43,14 @@ function kvPath(args: Record<string, unknown>, keyRequired = true): string {
   return key ? `/api/kv/${encodeURIComponent(key)}` : "/api/kv";
 }
 
-function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
+/**
+ * Maps SDK method names to specific REST endpoints where they exist.
+ * Returns null for tools that should fall through to the generic MCP bridge.
+ */
+function bridgeRequestFor(name: string, args: unknown): BridgeRequest | null {
   const body = argsRecord(args);
   switch (name) {
+    // ── memory ──
     case "memory_search":
       return { method: "POST", path: "/api/memory/search", body };
     case "memory_get": {
@@ -67,6 +72,13 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
       };
       return { method: "POST", path: "/api/memory/rate", body: { events: [event] } };
     }
+    case "memory_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("memory_delete requires string `id`");
+      return { method: "DELETE", path: `/api/memory/${encodeURIComponent(id)}` };
+    }
+
+    // ── tasks ──
     case "task_list":
       return { method: "GET", path: appendQuery("/api/tasks", body) };
     case "task_get": {
@@ -94,6 +106,13 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
         body: { progress: body.progress ?? "" },
       };
     }
+    case "task_cancel": {
+      const taskId = typeof body.taskId === "string" ? body.taskId : undefined;
+      if (!taskId) throw new Error("task_cancel requires string `taskId`");
+      return { method: "POST", path: `/api/tasks/${encodeURIComponent(taskId)}/cancel` };
+    }
+
+    // ── kv ──
     case "kv_get":
       return { method: "GET", path: kvPath(body) };
     case "kv_set":
@@ -119,11 +138,15 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
           offset: body.offset,
         }),
       };
+
+    // ── repos ──
     case "repo_list":
       return {
         method: "GET",
         path: appendQuery("/api/repos", { autoClone: body.autoClone, name: body.name }),
       };
+
+    // ── schedules ──
     case "schedule_list":
       return {
         method: "GET",
@@ -134,12 +157,164 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
           hideCompleted: body.hideCompleted,
         }),
       };
+
+    // ── scripts ──
     case "script_search":
       return { method: "POST", path: "/api/scripts/search", body };
     case "script_run":
       return { method: "POST", path: "/api/scripts/run", body };
+
+    // ── swarm / agent ──
+    case "db_query":
+      return { method: "POST", path: "/api/db-query", body };
+    case "swarm_get":
+      return {
+        method: "GET",
+        path: appendQuery("/api/agents", {
+          fields: body.includeFull ? "full" : "slim",
+        }),
+      };
+    case "agent_info":
+      return { method: "GET", path: "/me" };
+    case "metrics_get":
+      return { method: "GET", path: "/api/metrics" };
+    case "task_poll":
+      return { method: "GET", path: "/api/poll" };
+
+    // ── config ──
+    case "config_get":
+      return {
+        method: "GET",
+        path: appendQuery("/api/config/resolved", {
+          agentId: body.agentId,
+          repoId: body.repoId,
+          key: body.key,
+          includeSecrets: body.includeSecrets,
+        }),
+      };
+    case "config_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/config", {
+          scope: body.scope,
+          scopeId: body.scopeId,
+          key: body.key,
+          includeSecrets: body.includeSecrets,
+        }),
+      };
+    case "config_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("config_delete requires string `id`");
+      return { method: "DELETE", path: `/api/config/${encodeURIComponent(id)}` };
+    }
+
+    // ── services ──
+    case "service_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/services", {
+          agentId: body.agentId,
+          name: body.name,
+          status: body.status,
+        }),
+      };
+
+    // ── workflows ──
+    case "workflow_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/workflows", {
+          fields: body.includeFull ? "full" : "slim",
+        }),
+      };
+    case "workflow_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_get requires string `id`");
+      return { method: "GET", path: `/api/workflows/${encodeURIComponent(id)}` };
+    }
+    case "workflow_listRuns": {
+      const wfId = typeof body.workflowId === "string" ? body.workflowId : undefined;
+      if (!wfId) throw new Error("workflow_listRuns requires string `workflowId`");
+      return {
+        method: "GET",
+        path: appendQuery(`/api/workflows/${encodeURIComponent(wfId)}/runs`, {
+          status: body.status,
+        }),
+      };
+    }
+    case "workflow_getRun": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_getRun requires string `id`");
+      return { method: "GET", path: `/api/workflow-runs/${encodeURIComponent(id)}` };
+    }
+    case "workflow_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_delete requires string `id`");
+      return { method: "DELETE", path: `/api/workflows/${encodeURIComponent(id)}` };
+    }
+
+    // ── prompt templates ──
+    case "prompt_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/prompt-templates", {
+          eventType: body.eventType,
+          scope: body.scope,
+          scopeId: body.scopeId,
+          isDefault: body.isDefault,
+        }),
+      };
+    case "prompt_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("prompt_get requires string `id`");
+      return { method: "GET", path: `/api/prompt-templates/${encodeURIComponent(id)}` };
+    }
+    case "prompt_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("prompt_delete requires string `id`");
+      return { method: "DELETE", path: `/api/prompt-templates/${encodeURIComponent(id)}` };
+    }
+
+    // ── skills ──
+    case "skill_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/skills", {
+          scope: body.scope,
+          scopeId: body.scopeId,
+          includeBuiltin: body.includeBuiltin,
+        }),
+      };
+    case "skill_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("skill_get requires string `id`");
+      return { method: "GET", path: `/api/skills/${encodeURIComponent(id)}` };
+    }
+    case "skill_search":
+      return { method: "POST", path: "/api/skills/search", body };
+    case "skill_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("skill_delete requires string `id`");
+      return { method: "DELETE", path: `/api/skills/${encodeURIComponent(id)}` };
+    }
+
+    // ── mcp servers ──
+    case "mcpServer_list":
+      return { method: "GET", path: "/api/mcp-servers" };
+    case "mcpServer_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("mcpServer_get requires string `id`");
+      return { method: "GET", path: `/api/mcp-servers/${encodeURIComponent(id)}` };
+    }
+    case "mcpServer_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("mcpServer_delete requires string `id`");
+      return { method: "DELETE", path: `/api/mcp-servers/${encodeURIComponent(id)}` };
+    }
+
+    // ── fallthrough: proxy via generic MCP bridge ──
     default:
-      throw new Error(`Tool '${name}' is not exposed through the scripts SDK bridge`);
+      return null;
   }
 }
 
@@ -152,6 +327,26 @@ async function callBridgeApi(
   const baseUrl = Redacted.value(config.mcpBaseUrl).replace(/\/$/, "");
   const request = bridgeRequestFor(name, args);
 
+  // Tools without a specific REST route go through the generic MCP bridge
+  if (!request) {
+    const mcpToolName = mcpToolNameForSdkMethod(name);
+    const res = await fetch(`${baseUrl}/api/mcp-bridge`, {
+      method: "POST",
+      headers: headers(config),
+      body: JSON.stringify({ tool: mcpToolName, args: args ?? {} }),
+    });
+    const text = await res.text();
+    const data = text ? JSON.parse(text) : {};
+    if (!res.ok && options.throwOnError) {
+      const message =
+        data && typeof data === "object" && "error" in data
+          ? String((data as { error: unknown }).error)
+          : `api failed with ${res.status}`;
+      throw new Error(`swarm-sdk: ${name} failed with ${res.status}: ${message}`);
+    }
+    return scrubObject({ success: res.ok, status: res.status, data });
+  }
+
   const res = await fetch(`${baseUrl}${request.path}`, {
     method: request.method,
     headers: headers(config),