@desplega.ai/agent-swarm 1.90.0 → 1.91.0

package/src/http/scripts.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
-import { getAgentById } from "../be/db";
+import { getAgentById, upsertKv } from "../be/db";
 import { createEvent } from "../be/events";
 import { deleteScript, getScript, upsertScriptByName } from "../be/scripts/db";
 import { searchScripts } from "../be/scripts/embeddings";
@@ -37,6 +37,7 @@ const runBodySchema = z
     intent: z.string().default(""),
     scope: ScriptScopeSchema.optional(),
     fsMode: ScriptFsModeSchema.default("none"),
+    idempotencyKey: z.string().max(200).optional(),
   })
   .refine((body) => Boolean(body.name) !== Boolean(body.source), {
     message: "Provide exactly one of name or source",
@@ -289,6 +290,27 @@ export async function handleScripts(
       agentId: agent.id,
     });
 
+    // Persist output to KV when idempotencyKey is provided and run succeeded
+    let kvSaved: { namespace: string; key: string } | undefined;
+    if (parsed.body.idempotencyKey && !output.error && output.exitCode === 0) {
+      const kvNamespace = `script:executions`;
+      const kvKey = parsed.body.idempotencyKey;
+      const kvValue = {
+        result: output.result,
+        durationMs: output.durationMs,
+        scriptName: parsed.body.name ?? null,
+        executedAt: new Date().toISOString(),
+      };
+      upsertKv({
+        namespace: kvNamespace,
+        key: kvKey,
+        value: kvValue,
+        valueType: "json",
+        expiresAt: null,
+      });
+      kvSaved = { namespace: kvNamespace, key: kvKey };
+    }
+
     let autoSaved: { slug: string; reason: string } | undefined;
     if (parsed.body.source && !output.error && output.exitCode === 0) {
       const slug = scratchSlug(parsed.body.intent, parsed.body.source);
@@ -314,6 +336,7 @@ export async function handleScripts(
       scrubObject({
         result: output.result,
         autoSaved,
+        kvSaved,
         truncated: output.truncated,
         durationMs: output.durationMs,
         stdout: output.stdout,

package/src/http/utils.ts

@@ -157,14 +157,21 @@ export function triggerSchemaErrorResponse(
  * redirect URIs). Returns a URL with no trailing slash.
  *
  * Resolution order:
- *   1. `MCP_BASE_URL` env (canonical)
- *   2. Inbound request host — `X-Forwarded-Proto`/`X-Forwarded-Host` if behind
+ *   1. `PUBLIC_MCP_BASE_URL` env — explicit public origin. Wins so split
+ *      deployments (Helm) can keep `MCP_BASE_URL` pointed at an internal
+ *      cluster address while outbound URLs use the public ingress.
+ *   2. `MCP_BASE_URL` env — canonical when public and internal hosts coincide
+ *      (e.g. an ngrok tunnel set as `MCP_BASE_URL` in local dev).
+ *   3. Inbound request host — `X-Forwarded-Proto`/`X-Forwarded-Host` if behind
  *      a proxy/tunnel (ngrok), else `Host` header. Lets the URL stay correct
- *      when MCP_BASE_URL is unset and the API is reached via an arbitrary
+ *      when neither env var is set and the API is reached via an arbitrary
  *      external hostname.
- *   3. `http://localhost:<PORT>` fallback
+ *   4. `http://localhost:<PORT>` fallback
  */
 export function deriveApiBaseUrl(req: IncomingMessage): string {
+  const publicBase = process.env.PUBLIC_MCP_BASE_URL?.trim();
+  if (publicBase) return publicBase.replace(/\/+$/, "");
+
   const envBase = process.env.MCP_BASE_URL?.trim();
   if (envBase) return envBase.replace(/\/+$/, "");
 

package/src/jira/app.ts

@@ -1,4 +1,5 @@
 import { upsertOAuthApp } from "../be/db-queries/oauth";
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { initJiraOutboundSync, teardownJiraOutboundSync } from "./outbound";
 // Side-effect import: registers all Jira event templates in the in-memory
 // registry at module load time (mirrors `src/linear/templates.ts`).
@@ -41,9 +42,7 @@ export function initJira(): boolean {
   // Atlassian. Prefer MCP_BASE_URL over the localhost dev default; in prod
   // with no JIRA_REDIRECT_URI set, this is what stops Atlassian from sending
   // the user back to localhost.
-  const apiBaseUrl =
-    process.env.MCP_BASE_URL?.trim().replace(/\/+$/, "") ||
-    `http://localhost:${process.env.PORT || "3013"}`;
+  const apiBaseUrl = getPublicMcpBaseUrl();
   const redirectUri = process.env.JIRA_REDIRECT_URI ?? `${apiBaseUrl}/api/trackers/jira/callback`;
 
   upsertOAuthApp("jira", {

package/src/jira/webhook-lifecycle.ts

@@ -1,3 +1,4 @@
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { jiraFetch } from "./client";
 import { getJiraMetadata, updateJiraMetadata } from "./metadata";
 
@@ -23,7 +24,7 @@ let keepaliveInterval: ReturnType<typeof setInterval> | null = null;
 // ─── URL helpers ─────────────────────────────────────────────────────────────
 
 function getWebhookBaseUrl(): string {
-  return process.env.MCP_BASE_URL || `http://localhost:${process.env.PORT || "3013"}`;
+  return getPublicMcpBaseUrl();
 }
 
 function getRegisteredWebhookUrl(): string {

package/src/linear/app.ts

@@ -1,4 +1,5 @@
 import { upsertOAuthApp } from "../be/db-queries/oauth";
+import { getPublicMcpBaseUrl } from "../utils/constants";
 import { initLinearOutboundSync, teardownLinearOutboundSync } from "./outbound";
 
 let initialized = false;
@@ -31,9 +32,7 @@ export function initLinear(): boolean {
   // verbatim by the OAuth flow. Prefer MCP_BASE_URL over the localhost default
   // so prod doesn't send users back to localhost when LINEAR_REDIRECT_URI is
   // unset.
-  const apiBaseUrl =
-    process.env.MCP_BASE_URL?.trim().replace(/\/+$/, "") ||
-    `http://localhost:${process.env.PORT || "3013"}`;
+  const apiBaseUrl = getPublicMcpBaseUrl();
   const redirectUri =
     process.env.LINEAR_REDIRECT_URI ?? `${apiBaseUrl}/api/trackers/linear/callback`;
 

package/src/providers/claude-adapter.ts

@@ -336,6 +336,30 @@ export function buildClaudeCodeOtelEnv(
   return otelEnv;
 }
 
+/**
+ * Claude Code runtime defaults for ephemeral swarm harness sessions.
+ *
+ * These are plain subprocess env vars, not prompt content. They are injected
+ * after the resolved swarm config so the worker enforces the memory/privacy
+ * guardrails consistently per spawn. Statsig/DNT opt-out is intentionally
+ * separate from our Claude Code OTel export path, which is controlled by
+ * buildClaudeCodeOtelEnv.
+ */
+export function buildClaudeCodeRuntimeEnv(
+  _sourceEnv: Record<string, string | undefined>,
+): Record<string, string> {
+  return {
+    ENABLE_TOOL_SEARCH: "true",
+    CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING: "1",
+    CLAUDE_CODE_SKIP_PROMPT_HISTORY: "1",
+    CLAUDE_CODE_DISABLE_ATTACHMENTS: "1",
+    DISABLE_TELEMETRY: "1",
+    DO_NOT_TRACK: "1",
+    DISABLE_FEEDBACK_COMMAND: "1",
+    DISABLE_BUG_COMMAND: "1",
+  };
+}
+
 /**
  * Resolve the path at which the per-task system prompt is staged on disk.
  *
@@ -398,11 +422,13 @@ class ClaudeSession implements ProviderSession {
     // so the freshly-computed TRACEPARENT wins over any stale value the
     // container env might carry.
     const otelEnv = buildClaudeCodeOtelEnv(sourceEnv);
+    const runtimeEnv = buildClaudeCodeRuntimeEnv(sourceEnv);
     this.proc = Bun.spawn(cmd, {
       cwd: this.config.cwd,
       env: {
         ENABLE_PROMPT_CACHING_1H: "1",
         ...sourceEnv,
+        ...runtimeEnv,
         ...otelEnv,
         TASK_FILE: taskFilePath,
         // Belt-and-braces: TASK_FILE on disk can disappear mid-session (race

package/src/scripts-runtime/executors/native.ts

@@ -90,6 +90,7 @@ async function writeBareImportShims(tmpdir: string): Promise<void> {
     const shims: [string, string][] = [
       ["stdlib", `${runtimeDir}/stdlib.bundle.js`],
       ["swarm-sdk", `${runtimeDir}/swarm-sdk.bundle.js`],
+      ["zod", `${runtimeDir}/zod.bundle.js`],
     ];
     for (const [name, bundlePath] of shims) {
       const dir = `${tmpdir}/node_modules/${name}`;

package/src/scripts-runtime/sdk-allowlist.ts

@@ -1,19 +1,140 @@
 export const SDK_TOOL_NAME_MAP = {
+  // ── memory ──
   memory_search: "memory-search",
   memory_get: "memory-get",
   memory_rate: "memory_rate",
+  memory_delete: "memory-delete", // destructive
+  inject_learning: "inject-learning",
+
+  // ── tasks ──
   task_list: "get-tasks",
   task_get: "get-task-details",
   task_storeProgress: "store-progress",
+  task_poll: "poll-task",
+  task_send: "send-task",
+  task_cancel: "cancel-task", // destructive
+  task_action: "task-action",
+
+  // ── kv ──
   kv_get: "kv-get",
   kv_set: "kv-set",
   kv_del: "kv-delete",
   kv_incr: "kv-incr",
   kv_list: "kv-list",
+
+  // ── repos ──
   repo_list: "get-repos",
+  repo_update: "update-repo",
+
+  // ── schedules ──
   schedule_list: "list-schedules",
+  schedule_create: "create-schedule",
+  schedule_update: "update-schedule",
+  schedule_delete: "delete-schedule", // destructive
+  schedule_runNow: "run-schedule-now",
+
+  // ── scripts ──
   script_search: "script-search",
   script_run: "script-run",
+  script_upsert: "script-upsert",
+  script_delete: "script-delete", // destructive
+  script_queryTypes: "script-query-types",
+
+  // ── swarm / agent ──
+  swarm_get: "get-swarm",
+  agent_info: "my-agent-info",
+  agent_join: "join-swarm",
+  metrics_get: "get-metrics",
+  user_resolve: "resolve-user",
+  user_manage: "manage-user",
+  db_query: "db-query",
+
+  // ── config ──
+  config_get: "get-config",
+  config_list: "list-config",
+  config_set: "set-config",
+  config_delete: "delete-config", // destructive
+
+  // ── slack ──
+  slack_read: "slack-read",
+  slack_listChannels: "slack-list-channels",
+  slack_post: "slack-post", // external: sends to Slack
+  slack_reply: "slack-reply", // external: sends to Slack
+  slack_startThread: "slack-start-thread", // external: sends to Slack
+  slack_uploadFile: "slack-upload-file", // external: sends to Slack
+  slack_downloadFile: "slack-download-file",
+
+  // ── messaging (internal) ──
+  message_read: "read-messages",
+  message_post: "post-message",
+
+  // ── profiles ──
+  profile_update: "update-profile",
+
+  // ── context / profiles ──
+  context_history: "context-history",
+  context_diff: "context-diff",
+
+  // ── services ──
+  service_list: "list-services",
+  service_register: "register-service",
+  service_unregister: "unregister-service", // destructive
+  service_updateStatus: "update-service-status",
+
+  // ── workflows ──
+  workflow_list: "list-workflows",
+  workflow_get: "get-workflow",
+  workflow_create: "create-workflow",
+  workflow_update: "update-workflow",
+  workflow_patch: "patch-workflow",
+  workflow_patchNode: "patch-workflow-node",
+  workflow_delete: "delete-workflow", // destructive
+  workflow_trigger: "trigger-workflow",
+  workflow_listRuns: "list-workflow-runs",
+  workflow_getRun: "get-workflow-run",
+  workflow_retryRun: "retry-workflow-run",
+  workflow_cancelRun: "cancel-workflow-run", // destructive
+
+  // ── prompt templates ──
+  prompt_list: "list-prompt-templates",
+  prompt_get: "get-prompt-template",
+  prompt_set: "set-prompt-template",
+  prompt_delete: "delete-prompt-template", // destructive
+  prompt_preview: "preview-prompt-template",
+
+  // ── tracker ──
+  tracker_status: "tracker-status",
+  tracker_syncStatus: "tracker-sync-status",
+  tracker_linkTask: "tracker-link-task",
+  tracker_unlink: "tracker-unlink", // destructive
+  tracker_mapAgent: "tracker-map-agent",
+
+  // ── skills ──
+  skill_list: "skill-list",
+  skill_get: "skill-get",
+  skill_search: "skill-search",
+  skill_create: "skill-create",
+  skill_update: "skill-update",
+  skill_delete: "skill-delete", // destructive
+  skill_install: "skill-install",
+  skill_uninstall: "skill-uninstall", // destructive
+  skill_publish: "skill-publish",
+
+  // ── mcp servers ──
+  mcpServer_list: "mcp-server-list",
+  mcpServer_get: "mcp-server-get",
+  mcpServer_create: "mcp-server-create",
+  mcpServer_update: "mcp-server-update",
+  mcpServer_delete: "mcp-server-delete", // destructive
+  mcpServer_install: "mcp-server-install",
+  mcpServer_uninstall: "mcp-server-uninstall", // destructive
+
+  // ── pages & metrics ──
+  page_create: "create_page",
+  metric_create: "create_metric",
+
+  // ── human input ──
+  request_humanInput: "request-human-input",
 } as const;
 
 export const SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP) as Array<

package/src/scripts-runtime/swarm-sdk.ts

@@ -1,6 +1,6 @@
 import { scrubObject } from "../utils/secret-scrubber";
 import { Redacted } from "./redacted";
-import { isSdkToolAllowed } from "./sdk-allowlist";
+import { isSdkToolAllowed, mcpToolNameForSdkMethod } from "./sdk-allowlist";
 import type { SwarmConfig } from "./swarm-config";
 
 type BridgeRequest = {
@@ -43,9 +43,14 @@ function kvPath(args: Record<string, unknown>, keyRequired = true): string {
   return key ? `/api/kv/${encodeURIComponent(key)}` : "/api/kv";
 }
 
-function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
+/**
+ * Maps SDK method names to specific REST endpoints where they exist.
+ * Returns null for tools that should fall through to the generic MCP bridge.
+ */
+function bridgeRequestFor(name: string, args: unknown): BridgeRequest | null {
   const body = argsRecord(args);
   switch (name) {
+    // ── memory ──
     case "memory_search":
       return { method: "POST", path: "/api/memory/search", body };
     case "memory_get": {
@@ -67,6 +72,13 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
       };
       return { method: "POST", path: "/api/memory/rate", body: { events: [event] } };
     }
+    case "memory_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("memory_delete requires string `id`");
+      return { method: "DELETE", path: `/api/memory/${encodeURIComponent(id)}` };
+    }
+
+    // ── tasks ──
     case "task_list":
       return { method: "GET", path: appendQuery("/api/tasks", body) };
     case "task_get": {
@@ -94,6 +106,13 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
         body: { progress: body.progress ?? "" },
       };
     }
+    case "task_cancel": {
+      const taskId = typeof body.taskId === "string" ? body.taskId : undefined;
+      if (!taskId) throw new Error("task_cancel requires string `taskId`");
+      return { method: "POST", path: `/api/tasks/${encodeURIComponent(taskId)}/cancel` };
+    }
+
+    // ── kv ──
     case "kv_get":
       return { method: "GET", path: kvPath(body) };
     case "kv_set":
@@ -119,11 +138,15 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
           offset: body.offset,
         }),
       };
+
+    // ── repos ──
     case "repo_list":
       return {
         method: "GET",
         path: appendQuery("/api/repos", { autoClone: body.autoClone, name: body.name }),
       };
+
+    // ── schedules ──
     case "schedule_list":
       return {
         method: "GET",
@@ -134,12 +157,164 @@ function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
           hideCompleted: body.hideCompleted,
         }),
       };
+
+    // ── scripts ──
     case "script_search":
       return { method: "POST", path: "/api/scripts/search", body };
     case "script_run":
       return { method: "POST", path: "/api/scripts/run", body };
+
+    // ── swarm / agent ──
+    case "db_query":
+      return { method: "POST", path: "/api/db-query", body };
+    case "swarm_get":
+      return {
+        method: "GET",
+        path: appendQuery("/api/agents", {
+          fields: body.includeFull ? "full" : "slim",
+        }),
+      };
+    case "agent_info":
+      return { method: "GET", path: "/me" };
+    case "metrics_get":
+      return { method: "GET", path: "/api/metrics" };
+    case "task_poll":
+      return { method: "GET", path: "/api/poll" };
+
+    // ── config ──
+    case "config_get":
+      return {
+        method: "GET",
+        path: appendQuery("/api/config/resolved", {
+          agentId: body.agentId,
+          repoId: body.repoId,
+          key: body.key,
+          includeSecrets: body.includeSecrets,
+        }),
+      };
+    case "config_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/config", {
+          scope: body.scope,
+          scopeId: body.scopeId,
+          key: body.key,
+          includeSecrets: body.includeSecrets,
+        }),
+      };
+    case "config_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("config_delete requires string `id`");
+      return { method: "DELETE", path: `/api/config/${encodeURIComponent(id)}` };
+    }
+
+    // ── services ──
+    case "service_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/services", {
+          agentId: body.agentId,
+          name: body.name,
+          status: body.status,
+        }),
+      };
+
+    // ── workflows ──
+    case "workflow_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/workflows", {
+          fields: body.includeFull ? "full" : "slim",
+        }),
+      };
+    case "workflow_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_get requires string `id`");
+      return { method: "GET", path: `/api/workflows/${encodeURIComponent(id)}` };
+    }
+    case "workflow_listRuns": {
+      const wfId = typeof body.workflowId === "string" ? body.workflowId : undefined;
+      if (!wfId) throw new Error("workflow_listRuns requires string `workflowId`");
+      return {
+        method: "GET",
+        path: appendQuery(`/api/workflows/${encodeURIComponent(wfId)}/runs`, {
+          status: body.status,
+        }),
+      };
+    }
+    case "workflow_getRun": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_getRun requires string `id`");
+      return { method: "GET", path: `/api/workflow-runs/${encodeURIComponent(id)}` };
+    }
+    case "workflow_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("workflow_delete requires string `id`");
+      return { method: "DELETE", path: `/api/workflows/${encodeURIComponent(id)}` };
+    }
+
+    // ── prompt templates ──
+    case "prompt_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/prompt-templates", {
+          eventType: body.eventType,
+          scope: body.scope,
+          scopeId: body.scopeId,
+          isDefault: body.isDefault,
+        }),
+      };
+    case "prompt_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("prompt_get requires string `id`");
+      return { method: "GET", path: `/api/prompt-templates/${encodeURIComponent(id)}` };
+    }
+    case "prompt_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("prompt_delete requires string `id`");
+      return { method: "DELETE", path: `/api/prompt-templates/${encodeURIComponent(id)}` };
+    }
+
+    // ── skills ──
+    case "skill_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/skills", {
+          scope: body.scope,
+          scopeId: body.scopeId,
+          includeBuiltin: body.includeBuiltin,
+        }),
+      };
+    case "skill_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("skill_get requires string `id`");
+      return { method: "GET", path: `/api/skills/${encodeURIComponent(id)}` };
+    }
+    case "skill_search":
+      return { method: "POST", path: "/api/skills/search", body };
+    case "skill_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("skill_delete requires string `id`");
+      return { method: "DELETE", path: `/api/skills/${encodeURIComponent(id)}` };
+    }
+
+    // ── mcp servers ──
+    case "mcpServer_list":
+      return { method: "GET", path: "/api/mcp-servers" };
+    case "mcpServer_get": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("mcpServer_get requires string `id`");
+      return { method: "GET", path: `/api/mcp-servers/${encodeURIComponent(id)}` };
+    }
+    case "mcpServer_delete": {
+      const id = typeof body.id === "string" ? body.id : undefined;
+      if (!id) throw new Error("mcpServer_delete requires string `id`");
+      return { method: "DELETE", path: `/api/mcp-servers/${encodeURIComponent(id)}` };
+    }
+
+    // ── fallthrough: proxy via generic MCP bridge ──
     default:
-      throw new Error(`Tool '${name}' is not exposed through the scripts SDK bridge`);
+      return null;
   }
 }
 
@@ -152,6 +327,26 @@ async function callBridgeApi(
   const baseUrl = Redacted.value(config.mcpBaseUrl).replace(/\/$/, "");
   const request = bridgeRequestFor(name, args);
 
+  // Tools without a specific REST route go through the generic MCP bridge
+  if (!request) {
+    const mcpToolName = mcpToolNameForSdkMethod(name);
+    const res = await fetch(`${baseUrl}/api/mcp-bridge`, {
+      method: "POST",
+      headers: headers(config),
+      body: JSON.stringify({ tool: mcpToolName, args: args ?? {} }),
+    });
+    const text = await res.text();
+    const data = text ? JSON.parse(text) : {};
+    if (!res.ok && options.throwOnError) {
+      const message =
+        data && typeof data === "object" && "error" in data
+          ? String((data as { error: unknown }).error)
+          : `api failed with ${res.status}`;
+      throw new Error(`swarm-sdk: ${name} failed with ${res.status}: ${message}`);
+    }
+    return scrubObject({ success: res.ok, status: res.status, data });
+  }
+
   const res = await fetch(`${baseUrl}${request.path}`, {
     method: request.method,
     headers: headers(config),