@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/src/scripts-runtime/extract-args-schema.ts

@@ -10,7 +10,7 @@
 import { pathToFileURL } from "node:url";
 import { toJSONSchema } from "zod";
 
-async function createShims(tmpdir: string): Promise<void> {
+async function createShims(moduleDir: string): Promise<void> {
   const runtimeDir = process.env.SCRIPT_RUNTIME_DIR;
   const shims: [string, URL][] = [
     [
@@ -35,7 +35,7 @@ async function createShims(tmpdir: string): Promise<void> {
     ]),
   ];
   for (const [name, url] of shims) {
-    const dir = `${tmpdir}/node_modules/${name}`;
+    const dir = `${moduleDir}/node_modules/${name}`;
     await Bun.$`mkdir -p ${dir}`.quiet();
     await Bun.write(`${dir}/package.json`, JSON.stringify({ type: "module", main: "index.ts" }));
     await Bun.write(`${dir}/index.ts`, `export * from ${JSON.stringify(url.href)};\n`);
@@ -52,14 +52,15 @@ if (!sourceFile || !resultFile || !tmpdir) {
 }
 
 try {
-  await createShims(tmpdir);
+  // Subdirectory, not the tmpdir itself: this harness runs with cwd = tmpdir,
+  // and Bun (>= 1.3.12) snapshots the cwd listing at startup — a file or
+  // node_modules written into cwd after launch is invisible to the module
+  // resolver. See the same fix in eval-harness.ts.
+  const moduleDir = `${tmpdir}/user-module`;
+  await createShims(moduleDir);
 
   const source = await Bun.file(sourceFile).text();
-  // Subdirectory, not the tmpdir itself: this harness runs with cwd = tmpdir,
-  // and Bun (>= 1.3.12) snapshots the cwd listing at startup — a file written
-  // into cwd after launch is invisible to the module resolver. See the same
-  // fix in eval-harness.ts.
-  const userModulePath = `${tmpdir}/user-module/user-script.ts`;
+  const userModulePath = `${moduleDir}/user-script.ts`;
   await Bun.write(userModulePath, source);
 
   let mod: Record<string, unknown>;

package/src/scripts-runtime/quickjs-compat.ts

@@ -0,0 +1,464 @@
+import ts from "typescript";
+
+/**
+ * Flags script source that would fail, or silently differ, under the quickjs
+ * executor. It is advisory: callers attach the findings as warnings and never
+ * reject on them.
+ */
+export type QuickJSCompatRule =
+  | "bunGlobal"
+  | "process"
+  | "fsStdlib"
+  | "require"
+  | "workspaceRw"
+  | "unsupportedGlobal"
+  | "cryptoSubtle"
+  | "responseBody"
+  | "localeFormat"
+  | "hostCredential"
+  | "privateHost";
+
+export type QuickJSCompatFinding = {
+  rule: QuickJSCompatRule;
+  message: string;
+  /** 1-based line in the script source, when the finding has one. */
+  line?: number;
+};
+
+export type QuickJSCompatReport = {
+  compatible: boolean;
+  findings: QuickJSCompatFinding[];
+};
+
+// Globals that Bun provides and the quickjs sandbox does not (measured against
+// the QuickJS build plus quickjs-prelude.ts and quickjs-web-shims.ts).
+const UNSUPPORTED_GLOBALS = new Set([
+  "AbortController",
+  "AbortSignal",
+  "Blob",
+  "Buffer",
+  "Event",
+  "EventTarget",
+  "File",
+  "FormData",
+  "Intl",
+  "ReadableStream",
+  "Request",
+  "TransformStream",
+  "WebSocket",
+  "WritableStream",
+  "clearImmediate",
+  "navigator",
+  "performance",
+  "queueMicrotask",
+  "setImmediate",
+  "structuredClone",
+]);
+const RESPONSE_BODY_METHODS = new Set(["arrayBuffer", "blob", "formData", "bytes"]);
+const LOCALE_METHODS = new Set(["toLocaleString", "toLocaleDateString", "toLocaleTimeString"]);
+const FS_STDLIB = new Set(["glob", "grep"]);
+// ctx.swarm.config values that quickjs keeps host-side (see quickjs-runner.ts).
+const HOST_ONLY_CONFIG = new Set(["apiKey", "runtimeInstanceId"]);
+const MAX_FINDINGS = 20;
+
+const SCRIPT_FILE = "user-script.ts";
+
+/** The initializer of the `const` binding a name reads; null for anything else. */
+type ConstInitializer = (node: ts.Identifier) => ts.Expression | null;
+// Follows at most this many consts, as in `const API = "..."; const url = `${API}/x``.
+const MAX_CONST_DEPTH = 4;
+
+/** True inside a `declare` statement, namespace or global block. */
+function isAmbient(node: ts.Node): boolean {
+  for (let current: ts.Node | undefined = node; current; current = current.parent) {
+    if (
+      ts.canHaveModifiers(current) &&
+      ts.getModifiers(current)?.some((modifier) => modifier.kind === ts.SyntaxKind.DeclareKeyword)
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Parses and binds the script with the TypeScript checker (no lib, no imports),
+ * so a name resolves by lexical scope: a `Buffer` parameter in one function does
+ * not hide a global `Buffer` read in another. A name declared only with
+ * `declare` (ambient) still counts as a global, because nothing defines it at run time.
+ */
+function createScope(source: string): {
+  sourceFile: ts.SourceFile;
+  isLocal: (node: ts.Identifier) => boolean;
+  constInitializer: ConstInitializer;
+} {
+  const sourceFile = ts.createSourceFile(SCRIPT_FILE, source, ts.ScriptTarget.Latest, true);
+  const host: ts.CompilerHost = {
+    getSourceFile: (name) => (name === SCRIPT_FILE ? sourceFile : undefined),
+    getDefaultLibFileName: () => "lib.d.ts",
+    writeFile: () => {},
+    getCurrentDirectory: () => "/",
+    getCanonicalFileName: (name) => name,
+    useCaseSensitiveFileNames: () => true,
+    getNewLine: () => "\n",
+    fileExists: (name) => name === SCRIPT_FILE,
+    readFile: () => undefined,
+  };
+  const program = ts.createProgram({
+    rootNames: [SCRIPT_FILE],
+    options: { noLib: true, noResolve: true, types: [], target: ts.ScriptTarget.Latest },
+    host,
+  });
+  const checker = program.getTypeChecker();
+  const isLocal = (node: ts.Identifier) => {
+    const symbol =
+      ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node
+        ? checker.getShorthandAssignmentValueSymbol(node.parent)
+        : checker.getSymbolAtLocation(node);
+    return Boolean(
+      symbol?.declarations?.some(
+        (declaration) => declaration.getSourceFile() === sourceFile && !isAmbient(declaration),
+      ),
+    );
+  };
+  const constInitializer: ConstInitializer = (node) => {
+    const declaration = checker.getSymbolAtLocation(node)?.valueDeclaration;
+    if (!declaration || !ts.isVariableDeclaration(declaration) || !declaration.initializer) {
+      return null;
+    }
+    return ts.getCombinedNodeFlags(declaration) & ts.NodeFlags.Const
+      ? declaration.initializer
+      : null;
+  };
+  return { sourceFile, isLocal, constInitializer };
+}
+
+/** True when `node` is read as a value, not as a property name or declaration. */
+function isValueReference(node: ts.Identifier): boolean {
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.name === node) return false;
+  if (ts.isShorthandPropertyAssignment(parent)) return true;
+  if ("name" in parent && (parent as { name?: ts.Node }).name === node) return false;
+  if (ts.isTypeOfExpression(parent)) return false;
+  return true;
+}
+
+function isTypeOnly(node: ts.Node): boolean {
+  return (
+    ts.isTypeNode(node) ||
+    ts.isInterfaceDeclaration(node) ||
+    ts.isTypeAliasDeclaration(node) ||
+    (ts.isImportDeclaration(node) && Boolean(node.importClause?.isTypeOnly))
+  );
+}
+
+function stdlibImportNames(node: ts.ImportDeclaration): string[] {
+  if (!ts.isStringLiteral(node.moduleSpecifier) || node.moduleSpecifier.text !== "stdlib")
+    return [];
+  const bindings = node.importClause?.namedBindings;
+  if (!bindings || !ts.isNamedImports(bindings)) return [];
+  return bindings.elements
+    .map((element) => (element.propertyName ?? element.name).text)
+    .filter((name) => FS_STDLIB.has(name));
+}
+
+/** Strips parentheses, `as`, `!` and `satisfies`: `(globalThis as any)` is `globalThis`. */
+function unwrap(node: ts.Expression): ts.Expression {
+  let current = node;
+  while (
+    ts.isParenthesizedExpression(current) ||
+    ts.isAsExpression(current) ||
+    ts.isNonNullExpression(current) ||
+    ts.isTypeAssertionExpression(current) ||
+    ts.isSatisfiesExpression(current)
+  ) {
+    current = current.expression;
+  }
+  return current;
+}
+
+function isGlobalThis(node: ts.Expression): boolean {
+  const inner = unwrap(node);
+  return ts.isIdentifier(inner) && inner.text === "globalThis";
+}
+
+/** `globalThis.X` or `X` (free), as the global's name; otherwise null. */
+function globalName(node: ts.Expression, isLocal: (node: ts.Identifier) => boolean): string | null {
+  const inner = unwrap(node);
+  if (ts.isIdentifier(inner)) return isLocal(inner) ? null : inner.text;
+  if (ts.isPropertyAccessExpression(inner) && isGlobalThis(inner.expression)) {
+    return inner.name.text;
+  }
+  return null;
+}
+
+function isPrivateIPv4([a = 0, b = 0, c = 0]: number[]): boolean {
+  return (
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 168) ||
+    (a === 192 && b === 0 && c === 0) ||
+    (a === 198 && (b === 18 || b === 19)) ||
+    a >= 224
+  );
+}
+
+// `text` is a WHATWG-serialized IPv6 address without brackets: hex groups, at most one "::".
+function isPrivateIPv6(text: string): boolean {
+  const [head = "", tail = ""] = text.split("::");
+  const left = head ? head.split(":") : [];
+  const right = text.includes("::") && tail ? tail.split(":") : [];
+  const fill = text.includes("::") ? 8 - left.length - right.length : 0;
+  const g = [...left, ...Array<string>(fill).fill("0"), ...right].map((part) => parseInt(part, 16));
+  const g0 = g[0] ?? 0;
+  if (g.slice(0, 6).every((part) => part === 0)) return true; // ::/96: ::, ::1
+  if (g.slice(0, 5).every((part) => part === 0) && g[5] === 0xffff) {
+    const [g6 = 0, g7 = 0] = g.slice(6);
+    return isPrivateIPv4([g6 >> 8, g6 & 255, g7 >> 8]); // IPv4-mapped
+  }
+  return (
+    (g0 & 0xfe00) === 0xfc00 || // fc00::/7 unique local
+    (g0 & 0xffc0) === 0xfe80 || // fe80::/10 link-local
+    (g0 & 0xffc0) === 0xfec0 || // fec0::/10 site-local
+    (g0 & 0xff00) === 0xff00 // ff00::/8 multicast
+  );
+}
+
+/**
+ * How the default egress policy sees a parsed URL hostname, statically:
+ * "private" for loopback names and private, link-local or reserved IP literals,
+ * "single-label" for a name with no dot (usually an internal service name that
+ * resolves to a private address). Null for anything else, including public names
+ * that resolve privately: only the runtime check sees DNS.
+ */
+function staticHostClass(hostname: string): "private" | "single-label" | null {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (host === "localhost" || host.endsWith(".localhost")) return "private";
+  if (host.startsWith("[")) return isPrivateIPv6(host.slice(1, -1)) ? "private" : null;
+  const v4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(host);
+  if (v4) return isPrivateIPv4(v4.slice(1).map(Number)) ? "private" : null;
+  return host !== "" && !host.includes(".") ? "single-label" : null;
+}
+
+/** The fetch-like call this callee names: fetch, globalThis.fetch, ctx.stdlib.fetch or fetchJson. */
+function fetchCallName(callee: ts.Expression): string | null {
+  const inner = unwrap(callee);
+  if (ts.isIdentifier(inner)) {
+    return inner.text === "fetch" || inner.text === "fetchJson" ? inner.text : null;
+  }
+  if (!ts.isPropertyAccessExpression(inner)) return null;
+  const method = inner.name.text;
+  if (method !== "fetch" && method !== "fetchJson") return null;
+  const owner = unwrap(inner.expression);
+  if (method === "fetch" && isGlobalThis(owner)) return "fetch";
+  const ownerName = ts.isIdentifier(owner)
+    ? owner.text
+    : ts.isPropertyAccessExpression(owner)
+      ? owner.name.text
+      : null;
+  return ownerName === "stdlib" ? `ctx.stdlib.${method}` : null;
+}
+
+/**
+ * The fixed start of a URL argument: a literal, a const holding one, or a
+ * template or `+` concatenation that starts with them, through up to
+ * MAX_CONST_DEPTH consts. `cut` is true when the
+ * text stops at a dynamic part that could still extend the host, as in
+ * `http://intra${suffix}`; a dynamic part right after a const value cannot.
+ */
+function staticPrefix(
+  node: ts.Expression,
+  resolve: ConstInitializer,
+  depth = 0,
+): { text: string; cut: boolean } | null {
+  const inner = unwrap(node);
+  if (ts.isStringLiteral(inner) || ts.isNoSubstitutionTemplateLiteral(inner)) {
+    return { text: inner.text, cut: false };
+  }
+  if (ts.isIdentifier(inner)) {
+    const initializer = depth < MAX_CONST_DEPTH ? resolve(inner) : null;
+    return initializer ? staticPrefix(initializer, resolve, depth + 1) : null;
+  }
+  if (ts.isTemplateExpression(inner)) {
+    let text = inner.head.text;
+    let boundary = false;
+    for (const span of inner.templateSpans) {
+      const part = staticPrefix(span.expression, resolve, depth);
+      if (part === null) return { text, cut: !boundary || text === "" };
+      if (part.cut) return { text: text + part.text, cut: true };
+      text += part.text + span.literal.text;
+      boundary = span.literal.text === "";
+    }
+    return { text, cut: false };
+  }
+  if (ts.isBinaryExpression(inner) && inner.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    const left = staticPrefix(inner.left, resolve, depth);
+    if (left === null || left.cut) return left;
+    const right = staticPrefix(inner.right, resolve, depth);
+    if (right === null) return { text: left.text, cut: !ts.isIdentifier(unwrap(inner.left)) };
+    return { text: left.text + right.text, cut: right.cut };
+  }
+  return null;
+}
+
+/** The URL argument's host when the source fixes it, parsed with the host URL parser. */
+function literalUrl(arg: ts.Expression | undefined, resolve: ConstInitializer): URL | null {
+  if (!arg) return null;
+  const prefix = staticPrefix(arg, resolve);
+  if (!prefix) return null;
+  // A cut prefix fixes the host only once the authority has ended.
+  if (prefix.cut && !/^[a-z][a-z0-9+.-]*:\/\/[^/?#]*[/?#]/i.test(prefix.text)) return null;
+  try {
+    return new URL(prefix.text);
+  } catch {
+    return null;
+  }
+}
+
+export function checkQuickJSCompat(
+  source: string,
+  options: { fsMode?: string } = {},
+): QuickJSCompatReport {
+  const findings: QuickJSCompatFinding[] = [];
+  const seen = new Set<string>();
+  const { sourceFile, isLocal, constInitializer } = createScope(source);
+  const add = (rule: QuickJSCompatRule, message: string, node?: ts.Node) => {
+    if (seen.has(`${rule}:${message}`)) return;
+    seen.add(`${rule}:${message}`);
+    const line = node
+      ? sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1
+      : undefined;
+    findings.push(line === undefined ? { rule, message } : { rule, message, line });
+  };
+
+  if (options.fsMode === "workspace-rw") {
+    add("workspaceRw", "fsMode workspace-rw is not available under quickjs");
+  }
+
+  const reportGlobal = (name: string, node: ts.Node) => {
+    if (name === "Bun") add("bunGlobal", "Bun.* is not available under quickjs", node);
+    else if (name === "process") add("process", "process is not available under quickjs", node);
+    else if (UNSUPPORTED_GLOBALS.has(name)) {
+      add("unsupportedGlobal", `${name} is not available under quickjs`, node);
+    }
+  };
+
+  const visit = (node: ts.Node) => {
+    if (isTypeOnly(node)) return;
+
+    if (
+      ts.isIdentifier(node) &&
+      (node.text === "Bun" || node.text === "process" || UNSUPPORTED_GLOBALS.has(node.text)) &&
+      isValueReference(node) &&
+      !isLocal(node)
+    ) {
+      reportGlobal(node.text, node);
+    }
+
+    if (ts.isPropertyAccessExpression(node)) {
+      const member = node.name.text;
+      const owner = globalName(node.expression, isLocal);
+      if (isGlobalThis(node.expression) && !ts.isTypeOfExpression(node.parent)) {
+        reportGlobal(member, node);
+      }
+      const parent = unwrap(node.expression);
+      if (
+        HOST_ONLY_CONFIG.has(member) &&
+        ts.isPropertyAccessExpression(parent) &&
+        parent.name.text === "config"
+      ) {
+        add(
+          "hostCredential",
+          `ctx.swarm.config.${member} is host-only under quickjs; ctx.swarm calls use it for you`,
+          node,
+        );
+      }
+      if (member === "subtle" && owner === "crypto") {
+        add("cryptoSubtle", "crypto.subtle is not available under quickjs", node);
+      }
+      if (
+        FS_STDLIB.has(member) &&
+        ts.isPropertyAccessExpression(unwrap(node.expression)) &&
+        (unwrap(node.expression) as ts.PropertyAccessExpression).name.text === "stdlib"
+      ) {
+        add("fsStdlib", `ctx.stdlib.${member} needs filesystem access, which quickjs lacks`, node);
+      }
+    }
+
+    if (ts.isImportDeclaration(node)) {
+      for (const name of stdlibImportNames(node)) {
+        add("fsStdlib", `stdlib ${name} needs filesystem access, which quickjs lacks`, node);
+      }
+    }
+
+    if (
+      ts.isVariableDeclaration(node) &&
+      ts.isObjectBindingPattern(node.name) &&
+      node.initializer &&
+      ts.isPropertyAccessExpression(node.initializer) &&
+      node.initializer.name.text === "stdlib"
+    ) {
+      for (const element of node.name.elements) {
+        const name = (element.propertyName ?? element.name).getText(sourceFile);
+        if (FS_STDLIB.has(name)) {
+          add("fsStdlib", `ctx.stdlib.${name} needs filesystem access, which quickjs lacks`, node);
+        }
+      }
+    }
+
+    if (ts.isCallExpression(node)) {
+      const callee = node.expression;
+      const fetchName = fetchCallName(callee);
+      const url = fetchName ? literalUrl(node.arguments[0], constInitializer) : null;
+      const hostClass =
+        url && (url.protocol === "http:" || url.protocol === "https:")
+          ? staticHostClass(url.hostname)
+          : null;
+      if (url && hostClass) {
+        add(
+          "privateHost",
+          `${fetchName} to ${url.host} (${hostClass} host) depends on the egress policy: quickjs refuses private hosts unless the operator allows them`,
+          node,
+        );
+      }
+      if (ts.isIdentifier(callee) && callee.text === "require" && !isLocal(callee)) {
+        add("require", "require() is not supported; use an import", node);
+      }
+      if (ts.isPropertyAccessExpression(callee)) {
+        const method = callee.name.text;
+        if (RESPONSE_BODY_METHODS.has(method) && node.arguments.length === 0) {
+          add(
+            "responseBody",
+            `.${method}() on a fetch Response is not available under quickjs (text() and json() are)`,
+            node,
+          );
+        }
+        if (LOCALE_METHODS.has(method) && node.arguments.length > 0) {
+          add(
+            "localeFormat",
+            `${method}(locale, options) ignores its arguments under quickjs (no Intl)`,
+            node,
+          );
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+
+  return { compatible: findings.length === 0, findings: findings.slice(0, MAX_FINDINGS) };
+}
+
+/** One human-readable line per finding, for `warnings` arrays. */
+export function quickJSCompatWarnings(report: QuickJSCompatReport, label?: string): string[] {
+  const prefix = label ? `${label}: ` : "";
+  return report.findings.map(
+    (finding) =>
+      `${prefix}quickjs compat (${finding.rule}${finding.line ? `, line ${finding.line}` : ""}): ${finding.message}`,
+  );
+}

package/src/scripts-runtime/sdk-allowlist.ts

@@ -89,6 +89,7 @@ export const SDK_TOOL_NAME_MAP = {
   // ── model catalog ──
   modelCatalog_refresh: "model-catalog-refresh", // external: fetches models.dev
   modelCatalog_overlayUpsert: "model-catalog-overlay-upsert",
+  modelProfile_list: "list-model-profiles",
 
   // ── slack ──
   slack_read: "slack-read",
@@ -189,6 +190,9 @@ export const SDK_TOOL_NAME_MAP = {
   // ── human input ──
   request_humanInput: "request-human-input",
   approval_cancel: "cancel-approval-request", // destructive
+
+  // ── decisions ──
+  systemOne_decide: "system-one-decide",
 } as const;
 
 export const SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP) as Array<

package/src/scripts-runtime/types/stdlib.d.ts

@@ -329,6 +329,8 @@ declare module "swarm-sdk" {
       key?: string;
       includeSecrets?: boolean;
     }): Promise<unknown>;
+    // --- model profiles ---
+    modelProfile_list(args?: { harness?: string }): Promise<unknown>;
     // --- slack ---
     slack_read(args?: {
       inboxMessageId?: string;
@@ -678,6 +680,16 @@ declare module "swarm-sdk" {
     // --- human input ---
     request_humanInput(args: Record<string, unknown>): Promise<unknown>;
     approval_cancel(args: { requestId: string; reason?: string }): Promise<unknown>;
+
+    // --- decisions ---
+    systemOne_decide(args: {
+      provider?: "typesafe" | "openrouter" | "laya" | "openai" | "cloudflare";
+      model?: string;
+      state: string | string[] | Record<string, unknown>;
+      questions: Record<string, Record<string, unknown>>;
+      timeoutMs?: number;
+      maxRetries?: number;
+    }): Promise<unknown>;
   }
 
   export interface ScriptStdlib {

package/src/scripts-runtime/types/swarm-extension.d.ts

@@ -60,6 +60,7 @@ declare module "swarm-extension" {
     model?: string | undefined;
     modelTier?: "smol" | "regular" | "smart" | "ultra" | undefined;
     effort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+    profile?: string | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | undefined;
     workflowRunStepId?: string | undefined;
@@ -194,6 +195,8 @@ declare module "swarm-extension" {
     modelSource?: string | undefined;
     modelAlias?: string | undefined;
     resolvedEffort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+    profile?: string | undefined;
+    resolvedProfile?: string | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | null | undefined;
     workflowRunStepId?: string | null | undefined;

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -311,6 +311,8 @@ declare module "swarm-sdk" {
       key?: string;
       includeSecrets?: boolean;
     }): Promise<unknown>;
+    // --- model profiles ---
+    modelProfile_list(args?: { harness?: string }): Promise<unknown>;
     // --- slack ---
     slack_read(args?: {
       inboxMessageId?: string;
@@ -660,6 +662,16 @@ declare module "swarm-sdk" {
     // --- human input ---
     request_humanInput(args: Record<string, unknown>): Promise<unknown>;
     approval_cancel(args: { requestId: string; reason?: string }): Promise<unknown>;
+
+    // --- decisions ---
+    systemOne_decide(args: {
+      provider?: "typesafe" | "openrouter" | "laya" | "openai" | "cloudflare";
+      model?: string;
+      state: string | string[] | Record<string, unknown>;
+      questions: Record<string, Record<string, unknown>>;
+      timeoutMs?: number;
+      maxRetries?: number;
+    }): Promise<unknown>;
   }
 
   export interface ScriptStdlib {

package/src/server.ts

@@ -1,6 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import pkg from "../package.json";
-import { ensurePricingSeeded, ensureRbacSeeded } from "./be/boot-seeds";
+import { ensureModelProfilesSeeded, ensurePricingSeeded, ensureRbacSeeded } from "./be/boot-seeds";
 import { initDb } from "./be/db";
 import { startPricingRefreshLoop } from "./be/pricing-refresh";
 import { isSteeringEnabled } from "./be/steering";
@@ -81,6 +81,7 @@ import {
   registerModelCatalogOverlayUpsertTool,
   registerModelCatalogRefreshTool,
 } from "./tools/model-catalog";
+import { registerListModelProfilesTool } from "./tools/model-profiles/list-model-profiles";
 import { registerMyAgentInfoTool } from "./tools/my-agent-info";
 import { registerGetOauthAccessTokenTool } from "./tools/oauth-access-token";
 import { registerPollTaskTool } from "./tools/poll-task";
@@ -176,6 +177,7 @@ import {
 } from "./tools/swarm-config";
 import { registerSwarmXTool } from "./tools/swarm-x";
 // Task pool capability
+import { registerSystemOneDecideTool } from "./tools/system-one-decide";
 import { registerTaskActionTool } from "./tools/task-action";
 // Tracker capability
 import {
@@ -414,6 +416,11 @@ export async function createServer(
   // manual-override constants for runtime-fee / ACU pricing.
   ensurePricingSeeded();
   startPricingRefreshLoop();
+  try {
+    await ensureModelProfilesSeeded();
+  } catch (err) {
+    console.error("[server] Failed to seed model profiles:", err);
+  }
 
   try {
     ensureRbacSeeded();
@@ -477,6 +484,7 @@ export async function createServer(
     registerGetTasksTool(server);
     registerGetMetricsTool(server);
     registerSendTaskTool(server);
+    registerListModelProfilesTool(server);
     registerGetTaskDetailsTool(server);
     registerStoreProgressTool(server);
     registerMyAgentInfoTool(server);
@@ -611,6 +619,7 @@ export async function createServer(
     registerGetWorkflowRunTool(server);
     registerRetryWorkflowRunTool(server);
     registerCancelWorkflowRunTool(server);
+    registerSystemOneDecideTool(server);
     registerRequestHumanInputTool(server);
     registerCancelApprovalRequestTool(server);
   }

package/src/slack/blocks.ts

@@ -8,6 +8,7 @@
 import type { AgentTaskStatus, TaskAttachment } from "../types";
 import { getAppUrl } from "../utils/constants";
 import { taskAttachmentDisplayUrl } from "../utils/task-attachment-links";
+import { completedStatusIcon } from "./reaction-shortcode";
 
 // Slack limits section text to 3000 chars; we use 2900 for safety.
 export const MAX_SECTION_LENGTH = 2900;
@@ -294,7 +295,7 @@ export function buildCompletedBlocks(opts: {
   trailer?: string;
 }): SlackBlock[] {
   const taskLink = getTaskLink(opts.taskId);
-  let line = `✅ *${opts.agentName}* (${taskLink})`;
+  let line = `${completedStatusIcon()} *${opts.agentName}* (${taskLink})`;
   if (opts.duration) line += ` · ${opts.duration}`;
 
   const blocks: SlackBlock[] = [sectionBlock(line)];
@@ -479,7 +480,8 @@ export function isTreeOutputTruncated(text: string): boolean {
  * Render a single node line: icon + bold name + task link + optional duration.
  */
 function renderNodeLine(node: TreeNode): string {
-  const icon = STATUS_ICON[node.status] ?? "•";
+  const icon =
+    node.status === "completed" ? completedStatusIcon() : (STATUS_ICON[node.status] ?? "•");
   const taskLink = getTaskLink(node.taskId);
   let line = `${icon} *${node.agentName}* (${taskLink})`;
   if (node.duration) line += ` · ${node.duration}`;

package/src/slack/reaction-shortcode.ts

@@ -43,3 +43,17 @@ export function reactionName(event: SlackReactionEvent): string {
   const normalized = normalizeSlackReactionShortcode(raw);
   return normalized ?? SLACK_REACTION_DEFAULTS[event];
 }
+
+export const SLACK_STATUS_ICON_COMPLETED_KEY = "SLACK_STATUS_ICON_COMPLETED";
+export const SLACK_STATUS_ICON_COMPLETED_DEFAULT = "✅";
+
+/**
+ * The "done" glyph in thread text (task tree, thread header, outcome cards).
+ * Read per call so a global config write, which reloads `process.env`, takes
+ * effect without a restart. Unlike a reaction there is no `invalid_name`
+ * fallback in text: a name the workspace lacks renders as literal `:name:`.
+ */
+export function completedStatusIcon(): string {
+  const normalized = normalizeSlackReactionShortcode(process.env[SLACK_STATUS_ICON_COMPLETED_KEY]);
+  return normalized ? `:${normalized}:` : SLACK_STATUS_ICON_COMPLETED_DEFAULT;
+}