@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/extensions/loader.ts

@@ -1,5 +1,5 @@
 import { tmpdir } from "node:os";
-import { resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { z } from "zod";
 import { insertExtensionRun, setExtensionState } from "../be/extensions/db";
@@ -122,12 +122,18 @@ export async function removeExtensionTmpRoot(): Promise<void> {
 
 export async function loadExtension(input: LoadableExtension): Promise<LoadedExtension> {
   const { record } = input;
-  const directory = `${EXTENSIONS_TMP_ROOT}/${record.name}/${record.contentHash}`;
+  const directory = resolve(EXTENSIONS_TMP_ROOT, record.name, record.contentHash);
 
   try {
     const bundlePath = (path: string): string => {
       const filePath = resolve(directory, path);
-      if (!isSafeBundlePath(path) || !filePath.startsWith(`${directory}/`)) {
+      const relativePath = relative(directory, filePath);
+      if (
+        !isSafeBundlePath(path) ||
+        relativePath === ".." ||
+        relativePath.startsWith(`..${sep}`) ||
+        isAbsolute(relativePath)
+      ) {
         throw new Error(`Unsafe bundle file path: ${JSON.stringify(path)}`);
       }
       return filePath;
@@ -138,8 +144,7 @@ export async function loadExtension(input: LoadableExtension): Promise<LoadedExt
     );
     await Bun.$`mkdir -p ${directory}`.quiet();
     for (const [filePath, content] of files) {
-      const parent = filePath.slice(0, filePath.lastIndexOf("/"));
-      await Bun.$`mkdir -p ${parent}`.quiet();
+      await Bun.$`mkdir -p ${dirname(filePath)}`.quiet();
       await Bun.write(filePath, content);
     }
     await writeRuntimeShims(directory);

package/src/heartbeat/heartbeat.ts

@@ -43,6 +43,7 @@ import {
   releaseStaleOfferedTasksForOfflineAgents,
   releaseStaleProcessingInbox,
   releaseStaleReviewingTasks,
+  SUPERSEDED_RESUME_REPAIR_WINDOW_MS,
   settleSupersededTaskDependents,
   supersedeTask,
   updateAgentStatus,
@@ -588,7 +589,7 @@ async function detectAndRemediateStalledTasks(findings: HeartbeatFindings): Prom
 
 /** Repair window: skip in-flight supersedes, stop at a day of history. */
 const ORPHAN_SUPERSEDE_MIN_AGE_MS = 60 * 1000;
-const ORPHAN_SUPERSEDE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+const ORPHAN_SUPERSEDE_MAX_AGE_MS = SUPERSEDED_RESUME_REPAIR_WINDOW_MS;
 
 /**
  * Supersede and resume creation are separate writes. If the API process dies

package/src/http/agents.ts

@@ -28,6 +28,11 @@ import {
   updateAgentStatus,
   upsertSwarmConfig,
 } from "../be/db";
+import {
+  getModelProfileByName,
+  MODEL_PROFILE_CONFIG_KEY,
+  modelProfileRefError,
+} from "../be/db/model-profiles";
 import { createEvent } from "../be/events";
 import { setAgentHarnessCliVersion } from "../be/harness-model-support";
 import {
@@ -278,7 +283,7 @@ const updateAgentRuntimeRoute = route({
   pattern: ["api", "agents", null, "runtime"],
   summary: "Update an agent's runtime harness and default model",
   description:
-    "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it. A `model` the model catalog does not list is a 400 unless `allow_custom_model` is true. A `latest:` alias is not accepted here (aliases resolve for a task's model and for `MODEL_TIER_*` values); `reasoning_effort` must be one the harness and model support.",
+    "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it. A `model` the model catalog does not list is a 400 unless `allow_custom_model` is true. A `latest:` alias is not accepted here (aliases resolve for a task's model and for `MODEL_TIER_*` values); `reasoning_effort` must be one the harness and model support. `profile` sets the agent's default model profile (same tri-state): it must exist and run on `harness_provider`, and it cannot be sent with `model`. Sending `model`, or changing the model or effort override by any path, clears the default profile.",
   tags: ["Agents"],
   params: z.object({ id: z.string() }),
   query: z.object({ repoId: z.string().optional() }),
@@ -287,6 +292,7 @@ const updateAgentRuntimeRoute = route({
     model: z.string().trim().min(1).nullable().optional(),
     allow_custom_model: z.boolean().optional().default(false),
     reasoning_effort: ReasoningEffortSchema.nullable().optional(),
+    profile: z.string().trim().min(1).nullable().optional(),
     acp: AcpRuntimeConfigSchema.optional(),
     claude: ClaudeRuntimeConfigSchema.optional(),
   }),
@@ -1129,9 +1135,29 @@ export async function handleAgentsRest(
   if (updateAgentRuntimeRoute.match(req.method, pathSegments)) {
     const parsed = await updateAgentRuntimeRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const { harness_provider, model, allow_custom_model, reasoning_effort, acp, claude } =
+    const { harness_provider, model, allow_custom_model, reasoning_effort, profile, acp, claude } =
       parsed.body;
 
+    if (typeof profile === "string") {
+      if (model !== undefined) {
+        jsonError(res, "Send `profile` or `model`, not both", 400);
+        return true;
+      }
+      const picked = await getModelProfileByName(profile);
+      if (!picked) {
+        jsonError(res, `Unknown model profile "${profile}"`, 400);
+        return true;
+      }
+      if (picked.harness !== harness_provider) {
+        jsonError(
+          res,
+          `Model profile "${profile}" runs on the ${picked.harness} harness, not ${harness_provider}`,
+          400,
+        );
+        return true;
+      }
+    }
+
     if (acp && harness_provider !== "acp") {
       jsonError(res, "ACP configuration requires harness_provider=acp", 400);
       return true;
@@ -1250,6 +1276,22 @@ export async function handleAgentsRest(
           });
         }
 
+        // Written after the overrides above: changing either of them clears
+        // MODEL_PROFILE, so a stale default never beats a fresh override.
+        if (model !== undefined || profile === null) {
+          await deleteSwarmConfigByKey("agent", parsed.params.id, MODEL_PROFILE_CONFIG_KEY);
+        } else if (profile !== undefined) {
+          await upsertSwarmConfig({
+            scope: "agent",
+            scopeId: parsed.params.id,
+            key: MODEL_PROFILE_CONFIG_KEY,
+            value: profile,
+            description: "Default model profile, set via PATCH /api/agents/{id}/runtime",
+            // Read by the API at claim only; workers never need it in their env.
+            exportToEnv: false,
+          });
+        }
+
         if (claude?.transport === null) {
           await deleteSwarmConfigByKey("agent", parsed.params.id, "CLAUDE_TRANSPORT");
         } else if (claude?.transport !== undefined) {
@@ -1341,6 +1383,11 @@ export async function handleAgentsRest(
         jsonError(res, error.message, 400);
         return true;
       }
+      // The profile was deleted between the check above and this write.
+      if (modelProfileRefError(error) === "missing") {
+        jsonError(res, `Unknown model profile "${profile}"`, 400);
+        return true;
+      }
       throw error;
     }
 

package/src/http/all-routes.ts

@@ -33,6 +33,7 @@ import "./integrations";
 import "./kv";
 import "./memory";
 import "./metrics";
+import "./model-profiles";
 import "./models-catalog";
 import "./oauth-locks";
 import "./oauth-callback";

package/src/http/apps.ts

@@ -12,6 +12,7 @@ import {
   parseAppDefinition,
   SORTABLE_SYSTEM_DATE_COLUMNS,
   SYSTEM_COLUMN_KINDS,
+  scriptCompatWarnings,
 } from "../apps/definition";
 import {
   type AppRow,
@@ -227,9 +228,14 @@ const AppUserConfigFieldSchema = z.object({
 /** Mirrors an app definition's `userConfig` declaration map. */
 const AppUserConfigSchema = z.record(AppNameSchema, AppUserConfigFieldSchema);
 
+const compatWarningsSchema = z
+  .array(z.string())
+  .optional()
+  .describe("Advisory quickjs-executor compatibility findings for the app's scripts.");
 const appWriteResponseSchema = z.object({
   app: AppRecordSchema,
   migration: AppMigrationReportSchema,
+  warnings: compatWarningsSchema,
 });
 const userConfigBodySchema = z.object({ values: z.record(z.string(), z.unknown()) }).strict();
 
@@ -307,7 +313,10 @@ const createAppRoute = route({
     forceElementBreak: ForceElementBreakSchema.optional(),
   }),
   responses: {
-    201: { description: "Created app", schema: z.object({ app: AppRecordSchema }) },
+    201: {
+      description: "Created app",
+      schema: z.object({ app: AppRecordSchema, warnings: compatWarningsSchema }),
+    },
     400: { description: "Invalid app definition" },
     403: { description: "Permission denied" },
   },
@@ -1020,12 +1029,14 @@ export async function handleApps(
       invalidDefinition(res, definition.issues);
       return true;
     }
+    const warnings = await scriptCompatWarnings(definition.definition);
     createAppRoute.respond(res, 201, {
       app: await createApp({
         name: parsed.body.name,
         description: parsed.body.description,
         definition: definition.definition,
       }),
+      ...(warnings.length > 0 ? { warnings } : {}),
     });
     return true;
   }
@@ -1482,6 +1493,7 @@ export async function handleApps(
     }
     let app: Awaited<ReturnType<typeof updateApp>> = null;
     let migration!: AppMigrationReport;
+    let writtenDefinition: unknown;
     let responseHandled = false;
     try {
       await withAppDefinitionLock(parsed.params.id, async () => {
@@ -1513,6 +1525,7 @@ export async function handleApps(
           responseHandled = true;
           return;
         }
+        if (parsed.body.definition !== undefined) writtenDefinition = definition.definition;
         const migrated = await migrateAppSchema({
           appId: parsed.params.id,
           previousDefinition: existing.definition,
@@ -1553,7 +1566,13 @@ export async function handleApps(
       jsonError(res, "app not found", 404);
       return true;
     }
-    patchAppRoute.respond(res, 200, { app, migration });
+    const warnings =
+      writtenDefinition === undefined ? [] : await scriptCompatWarnings(writtenDefinition);
+    patchAppRoute.respond(res, 200, {
+      app,
+      migration,
+      ...(warnings.length > 0 ? { warnings } : {}),
+    });
     return true;
   }
 
@@ -1568,6 +1587,7 @@ export async function handleApps(
     }
     let app: Awaited<ReturnType<typeof updateApp>> = null;
     let migration!: AppMigrationReport;
+    let writtenDefinition: unknown;
     let responseHandled = false;
     try {
       await withAppDefinitionLock(parsed.params.id, async () => {
@@ -1597,6 +1617,7 @@ export async function handleApps(
           return;
         }
         const nextDefinition = definition ?? existing.definition;
+        writtenDefinition = definition;
         const migrated = await migrateAppSchema({
           appId: parsed.params.id,
           previousDefinition: appDefinitionNeedsRepair(existing) ? undefined : existing.definition,
@@ -1637,7 +1658,13 @@ export async function handleApps(
       jsonError(res, "app not found", 404);
       return true;
     }
-    updateAppRoute.respond(res, 200, { app, migration });
+    const warnings =
+      writtenDefinition === undefined ? [] : await scriptCompatWarnings(writtenDefinition);
+    updateAppRoute.respond(res, 200, {
+      app,
+      migration,
+      ...(warnings.length > 0 ? { warnings } : {}),
+    });
     return true;
   }
 

package/src/http/config.ts

@@ -9,6 +9,7 @@ import {
   getSwarmConfigs,
   maskSecrets,
 } from "../be/db";
+import { modelProfileRefError } from "../be/db/model-profiles";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   resetAgentMaxTasksMirror,
@@ -27,7 +28,7 @@ import {
 } from "../be/swarm-config-guard";
 import { can, isRbacEnabled, type PermissionVerb } from "../rbac";
 import { SwarmConfigSchema } from "../types";
-import { getRequestAuth } from "../utils/request-auth-context";
+import { getRequestAuth, type HttpRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
 import { route } from "./route-def";
@@ -48,6 +49,25 @@ function singleHeader(req: IncomingMessage, name: string): string | undefined {
   return Array.isArray(raw) ? raw[0] : raw;
 }
 
+/**
+ * Whether this caller's `/api/config/resolved` carries secret repo rows (the
+ * `includeRepoSecrets` of {@link resolveSecretsRead}): a runtime-token agent
+ * gets them only with `config.read.secrets`. Claim uses it so an agent's
+ * default profile yields only to repo rows that worker's env really gets.
+ */
+export function readsRepoSecrets(
+  auth: HttpRequestAuth | null,
+  agent: { isLead?: boolean } | null | undefined,
+): boolean {
+  if (auth?.kind !== "agent" || !auth.runtimeId) return true;
+  return can({
+    principal: { kind: "agent", agentId: auth.agentId, isLead: agent?.isLead ?? false },
+    verb: "config.read.secrets",
+    resource: { kind: "none" },
+    source: "http",
+  }).allow;
+}
+
 async function requestSecretReadScope(
   req: IncomingMessage,
   resolvedScope?: { agentId?: string; repoId?: string },
@@ -512,7 +532,11 @@ export async function handleConfig(
       }
       const result = includeSecrets || !config.isSecret ? config : maskSecrets([config])[0]!;
       upsertConfig.respond(res, 200, result);
-    } catch (_error) {
+    } catch (error) {
+      if (modelProfileRefError(error) === "missing") {
+        jsonError(res, `Unknown model profile "${String(value)}"`, 400);
+        return true;
+      }
       jsonError(res, "Failed to upsert config", 500);
     }
     return true;

package/src/http/core.ts

@@ -3,9 +3,11 @@ import { z } from "zod";
 import { initAgentMail, resetAgentMail } from "../agentmail";
 import {
   initAzureDevOps,
+  initAzureDevOpsOutbound,
   isAzureDevOpsEnabled,
   resetAzureDevOps,
   resetAzureDevOpsBotIdCache,
+  teardownAzureDevOpsOutbound,
 } from "../azure-devops";
 import {
   getAgentById,
@@ -235,6 +237,8 @@ async function reloadGlobalConfigsAndIntegrationsInner(): Promise<ReloadConfigRe
   resetAzureDevOpsBotIdCache();
   initAzureDevOps();
   if (isAzureDevOpsEnabled()) integrations.push("azure-devops");
+  teardownAzureDevOpsOutbound();
+  if (isAzureDevOpsEnabled()) initAzureDevOpsOutbound();
 
   resetLinear();
   if (await initLinear()) integrations.push("linear");

package/src/http/index.ts

@@ -7,7 +7,7 @@ import {
 import type { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getEnabledCapabilities, hasCapability } from "@/server";
 import { initAgentMail } from "../agentmail";
-import { initAzureDevOps } from "../azure-devops";
+import { initAzureDevOps, initAzureDevOpsOutbound } from "../azure-devops";
 import { drainApi, isApiDraining } from "../be/api-drain";
 import {
   closeDb,
@@ -104,6 +104,7 @@ import { handleMcpServers } from "./mcp-servers";
 import { closeIdleMcpUserTransports, handleMcpUser } from "./mcp-user";
 import { handleMemory, startMemoryGc, stopMemoryGc } from "./memory";
 import { handleMetrics } from "./metrics";
+import { handleModelProfiles } from "./model-profiles";
 import { handleModelsCatalog } from "./models-catalog";
 import { handleOAuthCallback, startOAuthPendingGc, stopOAuthPendingGc } from "./oauth-callback";
 import { handleGenericOAuth } from "./oauth-generic";
@@ -376,6 +377,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleDbQuery(req, res, pathSegments, queryParams),
         () => handleMetrics(req, res, pathSegments, queryParams, myAgentId),
         () => handleModelsCatalog(req, res, pathSegments, queryParams),
+        () => handleModelProfiles(req, res, pathSegments, queryParams, myAgentId),
         () => handleRepos(req, res, pathSegments, queryParams, myAgentId),
         () => handleSkills(req, res, pathSegments, queryParams, myAgentId),
         () => handleScriptConnections(req, res, pathSegments, queryParams, myAgentId),
@@ -665,6 +667,13 @@ try {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 
+try {
+  const { ensureModelProfilesSeeded } = await import("../be/boot-seeds");
+  await ensureModelProfilesSeeded();
+} catch (err) {
+  console.error("[startup] Failed to seed model profiles:", err);
+}
+
 try {
   const { ensureRbacSeeded } = await import("../be/boot-seeds");
   ensureRbacSeeded();
@@ -785,6 +794,7 @@ httpServer
 
     // Initialize Azure DevOps service-hook handler (if configured)
     initAzureDevOps();
+    initAzureDevOpsOutbound();
 
     // Initialize AgentMail webhook handler (if configured)
     initAgentMail();