@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/dist/{cli-s4setq91.js → cli-qqy4q48b.js}

@@ -7,14 +7,14 @@ import {
 } from "./cli-w1q7h2r2.js";
 import {
   applyReasoningEffort
-} from "./cli-n5vwg842.js";
+} from "./cli-0veb92a3.js";
 import {
   swarmRuntimeInstanceId
 } from "./cli-re8z5p8p.js";
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-cgtksawx.js";
+} from "./cli-pe05f8yk.js";
 import {
   init_resolver,
   init_session_templates,
@@ -29,7 +29,7 @@ import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 import {
   cursorCatalogRef,
   init_src

package/dist/{cli-k382tshb.js → cli-r35rw5de.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "2.0.0",
+    version: "2.1.0",
     description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
     keywords: [
       "agent-swarm.dev",
@@ -186,12 +186,13 @@ var init_package = __esm(() => {
       "@desplega/model-catalog": "workspace:*",
       "@desplega/model-routing": "workspace:*",
       "@faker-js/faker": "^10.4.0",
-      "@opencode/plugin": "2.0.29",
-      "@opencode/sdk": "2.0.29",
+      "@opencode/plugin": "2.0.31",
+      "@opencode/sdk": "2.0.31",
       "@oxlint/plugins": "1.78.0",
       "@types/bun": "latest",
       "@typescript/native-preview": "7.0.0-dev.20260707.2",
       "dependency-cruiser": "^18.0.0",
+      "happy-dom": "^20.14.5",
       konsistent: "1.0.0-beta.1",
       "openapi-typescript": "^7",
       oxlint: "1.78.0",
@@ -205,10 +206,10 @@ var init_package = __esm(() => {
       bun: ">=1.3.12"
     },
     dependencies: {
-      "@agentclientprotocol/sdk": "1.8.0",
+      "@agentclientprotocol/sdk": "1.9.0",
       "@ai-sdk/openai": "^3.0.41",
-      "@anthropic-ai/claude-agent-sdk": "0.3.300",
-      "@anthropic-ai/sdk": "^0.134.0",
+      "@anthropic-ai/claude-agent-sdk": "0.3.301",
+      "@anthropic-ai/sdk": "^0.135.0",
       "@asteasolutions/zod-to-openapi": "^8.0.0",
       "@aws-sdk/client-bedrock": "3.1048.0",
       "@chat-adapter/discord": "4.41.1",
@@ -224,7 +225,7 @@ var init_package = __esm(() => {
       "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
       "@linear/sdk": "^77.0.0",
       "@modelcontextprotocol/sdk": "1.31.0",
-      "@openai/codex": "0.162.1",
+      "@openai/codex": "0.163.0",
       "@openfort/openfort-node": "^0.9.1",
       "@opentelemetry/api": "^1.9.1",
       "@opentelemetry/api-logs": "^0.218.0",

package/dist/{cli-k3dp5tpf.js → cli-r610p9bs.js}

@@ -4,7 +4,7 @@ import {
   init_db1 as init_db,
   sweepExpiredKv,
   upsertKv
-} from "./cli-ef1hg1wv.js";
+} from "./cli-y3167wt1.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
@@ -12,7 +12,7 @@ import {
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 
 // src/slack/external-channel.ts
 init_db();

package/dist/{cli-e6mpjhed.js → cli-rc6pf5kv.js}

@@ -5,7 +5,7 @@ import {
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 
 // src/providers/codex-oauth/flow.ts
 init_secret_scrubber();

package/dist/{cli-3dj8k4vy.js → cli-rdxm77k3.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-k382tshb.js";
+} from "./cli-r35rw5de.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-tqaazemc.js → cli-s69nfyeh.js}

@@ -6,7 +6,7 @@ import {
   init_secret_scrubber,
   isSensitiveKey,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 import {
   init_src,
   openAICompatibleBaseUrlVars,

package/dist/{cli-6jyj59nb.js → cli-sawv63e8.js}

@@ -13,11 +13,11 @@ import {
   parseClaudeMdPendingRecord,
   planClaudeMdSync,
   withFileLock
-} from "./cli-s2sp957d.js";
+} from "./cli-78vv7446.js";
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 
 // src/commands/claude-md-session.ts
 init_file_lock();

package/dist/{cli-q50942rs.js → cli-sg19gbf0.js}

@@ -1,7 +1,7 @@
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 
 // src/providers/devin-adapter.ts
 init_secret_scrubber();

package/dist/{cli-p1x85d2t.js → cli-shk7r5cs.js}

@@ -2316,6 +2316,15 @@ function computeIsSensitiveKey(key) {
     return true;
   return false;
 }
+function credentialCandidates(value) {
+  const candidates = new Set([value, value.trim()]);
+  if (value.includes(",")) {
+    for (const member of value.split(","))
+      candidates.add(member.trim());
+  }
+  candidates.delete("");
+  return [...candidates];
+}
 function buildCache() {
   const entries = [];
   const seen = new Set;
@@ -2324,10 +2333,7 @@ function buildCache() {
       continue;
     if (!isSensitiveKey(key))
       continue;
-    const candidates = rawValue.includes(",") ? [rawValue, ...rawValue.split(",").map((s) => s.trim())] : [rawValue];
-    for (const candidate of candidates) {
-      if (!candidate)
-        continue;
+    for (const candidate of credentialCandidates(rawValue)) {
       if (candidate.length < MIN_VALUE_LENGTH)
         continue;
       for (const form of escapedForms(candidate)) {
@@ -2507,11 +2513,8 @@ function registerEnvSecrets(env) {
   for (const [key, value] of Object.entries(env)) {
     if (!value || !isSensitiveKey(key))
       continue;
-    registerVolatileSecret(value, key);
-    if (!value.includes(","))
-      continue;
-    for (const member of value.split(","))
-      registerVolatileSecret(member.trim(), key);
+    for (const candidate of credentialCandidates(value))
+      registerVolatileSecret(candidate, key);
   }
 }
 function unregisterVolatileSecret(name) {

package/dist/{cli-przpmdgr.js → cli-sksetb2q.js}

@@ -224,6 +224,10 @@ var init_permissions = __esm(() => {
       description: "Record whether a pinned harness CLI version accepts a model (a worker reports its own probe results; the operator may correct any row).",
       namespace: "models"
     },
+    "models.profiles.write": {
+      description: "Create, update, or delete model profiles (named harness + model + effort). Operator (shared API key) only.",
+      namespace: "models"
+    },
     "config.read.secrets": {
       description: "Read unmasked secret config values.",
       namespace: "config"
@@ -414,7 +418,7 @@ var init_admission = __esm(() => {
 function actsAsLead(principal) {
   return principal.kind === "agent" && (principal.isLead || hasLeadEquivalence(principal.agentId));
 }
-var leadOnly, operatorOrUser, leadOrOperatorOrUser, leadOrOperator, agentOrOperator, extensionWrite, extensionActivation, leadOrTaskCreator, leadOrResourceOwner, humanOrLeadOrResourceOwner, leadOrOwnNamespace, anyAuthenticated, requesterOwnsTask, memoryDelete, taskFsMutate, taskProgressWrite, LEGACY_RULES, LEGACY_POLICY;
+var leadOnly, operatorOrUser, operatorOnly, leadOrOperatorOrUser, leadOrOperator, agentOrOperator, extensionWrite, extensionActivation, leadOrTaskCreator, leadOrResourceOwner, humanOrLeadOrResourceOwner, leadOrOwnNamespace, anyAuthenticated, requesterOwnsTask, memoryDelete, taskFsMutate, taskProgressWrite, LEGACY_RULES, LEGACY_POLICY;
 var init_legacy_policy = __esm(() => {
   init_env_flag();
   init_elevated_agents();
@@ -428,6 +432,11 @@ var init_legacy_policy = __esm(() => {
     denyReason: "requires operator or user authentication",
     evaluate: (principal) => principal.kind === "operator" || principal.kind === "user"
   };
+  operatorOnly = {
+    name: "operator-only",
+    denyReason: "requires operator authentication",
+    evaluate: (principal) => principal.kind === "operator"
+  };
   leadOrOperatorOrUser = {
     name: "lead-or-operator-or-user",
     denyReason: "requires lead agent, operator, or user authentication",
@@ -618,6 +627,7 @@ var init_legacy_policy = __esm(() => {
     "config.read.secrets": leadOnly,
     "models.catalog.write": leadOrOperator,
     "models.harness-support.write": agentOrOperator,
+    "models.profiles.write": operatorOnly,
     "skill.create.swarm": leadOnly,
     "skill.install.any": leadOnly,
     "skill.install.global": leadOnly,

package/dist/{cli-d2qr7aj4.js → cli-t02z59f2.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_E2B_API_BASE,
   init_env,
   redactWithEnv
-} from "./cli-tqaazemc.js";
+} from "./cli-s69nfyeh.js";
 import {
   __esm,
   __require,

package/dist/{cli-j0pfptdp.js → cli-v7g551te.js}

@@ -1,28 +1,28 @@
 import {
   checkGrokCredentials
-} from "./cli-kt6zqg0e.js";
+} from "./cli-xczsgshn.js";
 import {
   renderSteeringDelivery
 } from "./cli-19njxg5g.js";
 import {
   checkClaudeManagedCredentials
-} from "./cli-29jc5q7w.js";
+} from "./cli-ksphgh48.js";
 import {
   checkDevinCredentials
-} from "./cli-q50942rs.js";
+} from "./cli-sg19gbf0.js";
 import {
   checkOpencodeCredentials
-} from "./cli-vatyhshy.js";
+} from "./cli-mz5as5ha.js";
 import {
   checkDshCredentials
-} from "./cli-3fbmmawm.js";
+} from "./cli-7n6s5man.js";
 import {
   checkAmpCredentials,
   liveTestAmpCredentials
-} from "./cli-vdach5a9.js";
+} from "./cli-qmzsbkvy.js";
 import {
   checkCursorCredentials
-} from "./cli-s4setq91.js";
+} from "./cli-qqy4q48b.js";
 import {
   createSkillInvokeTracker,
   isSkillLoaderCall,
@@ -31,10 +31,10 @@ import {
 import {
   checkCodexCredentials,
   codexUserHome
-} from "./cli-03gedhng.js";
+} from "./cli-5twdke5x.js";
 import {
   checkClaudeCredentials
-} from "./cli-q0ke1yww.js";
+} from "./cli-nm1p8jfr.js";
 import {
   getContextWindowSize
 } from "./cli-w1q7h2r2.js";
@@ -64,25 +64,25 @@ import {
 } from "./cli-2pdaysab.js";
 import {
   effectiveReasoningEffort
-} from "./cli-n5vwg842.js";
+} from "./cli-0veb92a3.js";
 import {
   canonicalAzureDevOpsRepoUrl,
   isAzureDevOpsUrl,
   parseAzureDevOpsRepoUrl,
   resolveScriptsOnlyMode,
   resumedTaskModelSelection
-} from "./cli-bzszjf2p.js";
+} from "./cli-vgqzp4em.js";
 import {
   terminateRegisteredProcessGroups
 } from "./cli-zt3w1cn1.js";
 import {
   validateJsonSchema
-} from "./cli-1e4b6bzh.js";
+} from "./cli-naqzr17j.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
   loadAllCodexOAuthSlots
-} from "./cli-e6mpjhed.js";
+} from "./cli-rc6pf5kv.js";
 import {
   ensure,
   initOtel,
@@ -92,7 +92,7 @@ import {
   startSpan,
   withSpan,
   withSpanContext
-} from "./cli-skxvvpap.js";
+} from "./cli-cvv9k0hh.js";
 import {
   MASKED_SECRET_VALUE,
   initTelemetry,
@@ -102,12 +102,15 @@ import {
   init_config_secrets,
   init_telemetry,
   init_telemetry_context,
+  init_vcs_repo_match,
   isApiDrainingResponse,
   isCodexAuthFailureReason,
   isEnvExportRestrictedKey,
   mapTriggerSurface,
-  telemetry
-} from "./cli-ef1hg1wv.js";
+  telemetry,
+  vcsRepoName,
+  vcsRepoUrlMatches
+} from "./cli-y3167wt1.js";
 import {
   ProviderNameSchema,
   WorkerNudgeSchema,
@@ -115,7 +118,7 @@ import {
   isTerminalTaskStatus,
   parseWorkerModelTierOverrides,
   resolveTaskModelSelection
-} from "./cli-cgtksawx.js";
+} from "./cli-pe05f8yk.js";
 import {
   WORKSPACE_CLAUDE_MD_PATH,
   buildContextPreamble,
@@ -139,7 +142,7 @@ import {
   taskAttachmentFetchCommand,
   writeIdentityBaselines,
   writeProfileFileFromDb
-} from "./cli-s2sp957d.js";
+} from "./cli-78vv7446.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
@@ -150,7 +153,7 @@ import {
   init_credentials,
   normalizeProviderKeyAliases,
   resolveCredentialPools
-} from "./cli-5hkm7whv.js";
+} from "./cli-x1r545x8.js";
 import {
   init_templates
 } from "./cli-mvzyxwg3.js";
@@ -196,7 +199,7 @@ import {
   registerEnvSecrets,
   registerSensitiveKeyName,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 import {
   harnessModelMismatch,
   init_src,
@@ -241,47 +244,47 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-9vmvpvgd.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-4mqd3r6r.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-9n2ya240.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-xxy47q4v.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-y81sssk0.js");
+      const { CodexAdapter } = await import("./codex-adapter-4z16v9n0.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-k9qae05j.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-9wswb52m.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
-      const { DevinAdapter } = await import("./devin-adapter-x1022qb1.js");
+      const { DevinAdapter } = await import("./devin-adapter-zeq8b9gz.js");
       return new DevinAdapter;
     }
     case "opencode": {
-      const { OpencodeAdapter } = await import("./opencode-adapter-nm42wwj8.js");
+      const { OpencodeAdapter } = await import("./opencode-adapter-13dcatgq.js");
       return new OpencodeAdapter;
     }
     case "dsh": {
-      const { DshAdapter } = await import("./dsh-adapter-3epjm3af.js");
+      const { DshAdapter } = await import("./dsh-adapter-47ztej36.js");
       return new DshAdapter;
     }
     case "amp": {
-      const { AmpAdapter } = await import("./amp-adapter-ad8ft89x.js");
+      const { AmpAdapter } = await import("./amp-adapter-7h7wdt8q.js");
       return new AmpAdapter;
     }
     case "cursor": {
-      const { CursorAdapter } = await import("./cursor-adapter-cehv1qns.js");
+      const { CursorAdapter } = await import("./cursor-adapter-98gbhyzn.js");
       return new CursorAdapter;
     }
     case "grok": {
-      const { GrokAdapter } = await import("./grok-adapter-0d4x7gkx.js");
+      const { GrokAdapter } = await import("./grok-adapter-s9ncp9vy.js");
       return new GrokAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-sj2g0m84.js");
+      const { ACPAdapter } = await import("./acp-adapter-kr4abrsk.js");
       return new ACPAdapter;
     }
     default:
@@ -908,6 +911,7 @@ function guardSpawnModel(input) {
 // src/commands/runner.ts
 init_steering_enabled();
 init_template();
+init_vcs_repo_match();
 
 // src/vcs/index.ts
 function detectVcsProvider(url) {
@@ -1173,7 +1177,7 @@ var CREDENTIAL_PROVIDER_CHECKERS = {
   devin: (env) => checkDevinCredentials(env),
   opencode: (env, opts) => checkOpencodeCredentials(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-9n2ya240.js");
+    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-xxy47q4v.js");
     return checkPiMonoCredentials(env, opts);
   },
   acp: (env) => {
@@ -1442,7 +1446,7 @@ async function validateProviderCredentials(provider, env = process.env, presence
             latency_ms: Date.now() - startedAt
           };
         }
-        const { liveTestCursorKey } = await import("./cursor-adapter-cehv1qns.js");
+        const { liveTestCursorKey } = await import("./cursor-adapter-98gbhyzn.js");
         const result = await liveTestCursorKey(apiKey);
         return result.ok ? { ok: true, latency_ms: Date.now() - startedAt } : { ok: false, error: result.error, latency_ms: Date.now() - startedAt };
       }
@@ -1977,8 +1981,7 @@ function scheduleRunnerGc(reason) {
 }
 async function fetchRepoConfig(apiUrl, apiKey, vcsRepo, requireExactMatch = false) {
   try {
-    const requested = vcsRepo.trim().replace(/\/+$/, "").replace(/\.git$/, "");
-    const repoName = requested.split("/").pop() || requested;
+    const repoName = vcsRepoName(vcsRepo);
     const resp = await fetch(`${apiUrl}/api/repos?name=${encodeURIComponent(repoName)}`, {
       headers: { Authorization: `Bearer ${apiKey}` }
     });
@@ -1986,14 +1989,7 @@ async function fetchRepoConfig(apiUrl, apiKey, vcsRepo, requireExactMatch = fals
       return null;
     const data = await resp.json();
     if (requireExactMatch) {
-      return data.repos.find((r) => {
-        const normalized = r.url.trim().replace(/\/+$/, "").replace(/\.git$/, "");
-        if (normalized === requested)
-          return true;
-        if (requested.includes(":"))
-          return false;
-        return normalized.endsWith(`/${requested}`) || normalized.endsWith(`:${requested}`);
-      }) ?? null;
+      return data.repos.find((r) => vcsRepoUrlMatches(r.url, vcsRepo)) ?? null;
     }
     return data.repos.find((r) => r.url.includes(vcsRepo)) ?? data.repos[0] ?? null;
   } catch {