@desplega.ai/agent-swarm 2.2.0 → 2.4.0

package/src/be/session-shares.ts

@@ -0,0 +1,244 @@
+import { getDbClient } from "./db";
+
+/**
+ * Session sharing store. A session is a root task (`parentTaskId IS NULL`) and
+ * its descendants; its owner is the root's `requestedByUserId`.
+ *
+ * Rows in `session_shares` are never deleted. Revoking sets `revokedAt`, and an
+ * access change revokes the active row and inserts a new one in the same
+ * transaction, so the rows for a root are its full share history.
+ */
+
+export type SessionShareAccess = "read" | "write";
+export type SessionAccess = "owner" | SessionShareAccess | "none";
+export type SessionEveryoneAccess = SessionShareAccess | "none";
+
+export type SessionShareRow = {
+  id: string;
+  rootTaskId: string;
+  /** NULL = everyone. */
+  userId: string | null;
+  access: SessionShareAccess;
+  createdAt: string;
+  revokedAt: string | null;
+  revokedBy: string | null;
+};
+
+export type SessionRoot = { id: string; requestedByUserId: string | null };
+
+export type SessionSharesState = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess; createdAt: string }[];
+};
+
+export type DesiredSessionShares = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess }[];
+};
+
+const RANK: Record<SessionAccess, number> = { none: 0, read: 1, write: 2, owner: 3 };
+
+/** True when `access` grants at least `needed`. */
+export function hasSessionAccess(access: SessionAccess, needed: SessionAccess): boolean {
+  return RANK[access] >= RANK[needed];
+}
+
+/**
+ * The session root of any task: walk `parentTaskId` up to the topmost task
+ * that still exists. No depth cap, so a chain of any length resolves to its
+ * actual root; a corrupt parent cycle has no top and resolves to null.
+ */
+export async function getSessionRoot(taskId: string): Promise<SessionRoot | null> {
+  return (await getSessionRoots([taskId])).get(taskId) ?? null;
+}
+
+const ROOT_LOOKUP_CHUNK = 500;
+
+type AncestorRow = { id: string; parentTaskId: string | null; requestedByUserId: string | null };
+
+/** `getSessionRoot` for many tasks; unknown tasks and tasks in a cycle are absent. */
+export async function getSessionRoots(taskIds: string[]): Promise<Map<string, SessionRoot>> {
+  const ids = [...new Set(taskIds)];
+  // Every ancestor once (`UNION` drops revisits, which also ends a cycle),
+  // then resolve each chain in memory: linear in the tasks involved.
+  const tasks = new Map<string, AncestorRow>();
+  for (let start = 0; start < ids.length; start += ROOT_LOOKUP_CHUNK) {
+    const chunk = ids.slice(start, start + ROOT_LOOKUP_CHUNK).filter((id) => !tasks.has(id));
+    if (chunk.length === 0) continue;
+    const rows = await getDbClient().query<AncestorRow>(
+      `WITH RECURSIVE up(id) AS (
+           SELECT id FROM agent_tasks WHERE id IN (${chunk.map(() => "?").join(", ")})
+           UNION
+           SELECT t.parentTaskId FROM agent_tasks t JOIN up ON t.id = up.id
+           WHERE t.parentTaskId IS NOT NULL
+         )
+         SELECT t.id, t.parentTaskId, t.requestedByUserId
+         FROM up CROSS JOIN agent_tasks t ON t.id = up.id`,
+      chunk,
+    );
+    for (const row of rows) tasks.set(row.id, row);
+  }
+
+  const resolved = new Map<string, SessionRoot | null>();
+  const rootOf = (taskId: string): SessionRoot | null => {
+    const path: string[] = [];
+    const onPath = new Set<string>();
+    let current = tasks.get(taskId);
+    let root: SessionRoot | null = null;
+    while (current) {
+      const known = resolved.get(current.id);
+      if (known !== undefined) {
+        root = known;
+        break;
+      }
+      if (onPath.has(current.id)) break;
+      path.push(current.id);
+      onPath.add(current.id);
+      const parent = current.parentTaskId ? tasks.get(current.parentTaskId) : undefined;
+      if (!parent) {
+        root = { id: current.id, requestedByUserId: current.requestedByUserId };
+        break;
+      }
+      current = parent;
+    }
+    for (const id of path) resolved.set(id, root);
+    return root;
+  };
+
+  const roots = new Map<string, SessionRoot>();
+  for (const id of ids) {
+    const root = rootOf(id);
+    if (root) roots.set(id, root);
+  }
+  return roots;
+}
+
+/**
+ * What `actingUserId` may do in the session rooted at `root`.
+ *
+ * - `owner` for the root's requester, and for every user when the root has no
+ *   owner (Slack and schedule sessions stay open, as before sharing existed).
+ * - Otherwise the best active share naming the user or everyone; `none` when
+ *   there is none. A root with no rows is private to its owner.
+ *
+ * A null `actingUserId` is a viewer with no user (a guest page session): it
+ * gets ownerless roots and everyone shares only. Callers that act for no user
+ * (agents, operator-key calls with no picked dashboard user) skip this check
+ * entirely; see `resolveSessionActor`.
+ */
+export async function sessionAccessForRoot(
+  actingUserId: string | null,
+  root: SessionRoot,
+): Promise<SessionAccess> {
+  if (!root.requestedByUserId) return "owner";
+  if (actingUserId && root.requestedByUserId === actingUserId) return "owner";
+  const rows = await getDbClient().query<{ access: SessionShareAccess }>(
+    `SELECT access FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL AND (userId IS NULL OR userId = ?)`,
+    [root.id, actingUserId],
+  );
+  if (rows.some((row) => row.access === "write")) return "write";
+  return rows.length > 0 ? "read" : "none";
+}
+
+/** `sessionAccessForRoot` for any task in the session; `none` for an unknown task. */
+export async function sessionAccess(
+  actingUserId: string | null,
+  taskId: string,
+): Promise<SessionAccess> {
+  const root = await getSessionRoot(taskId);
+  return root ? sessionAccessForRoot(actingUserId, root) : "none";
+}
+
+export async function listActiveSessionShares(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+/** Every row for a root, revoked ones included, oldest first. */
+export async function listSessionShareHistory(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ?
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+export function toSessionSharesState(rows: SessionShareRow[]): SessionSharesState {
+  const everyone = rows.find((row) => row.userId === null);
+  return {
+    everyone: everyone?.access ?? "none",
+    users: rows
+      .filter((row) => row.userId !== null)
+      .map((row) => ({ userId: row.userId!, access: row.access, createdAt: row.createdAt })),
+  };
+}
+
+/**
+ * Make the active shares of `root` equal `desired`, in one write transaction.
+ * A target whose access changes has its active row revoked and a new row
+ * inserted; a target no longer listed is revoked; nothing is deleted or
+ * updated in place apart from revocation. The owner is never stored.
+ */
+export async function setSessionShares(
+  root: SessionRoot,
+  desired: DesiredSessionShares,
+  actorUserId: string | null,
+): Promise<SessionSharesState> {
+  const want = new Map<string, SessionShareAccess>();
+  if (desired.everyone !== "none") want.set("*", desired.everyone);
+  for (const user of desired.users) {
+    if (user.userId !== root.requestedByUserId) want.set(user.userId, user.access);
+  }
+
+  return getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    const active = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL`,
+      [root.id],
+    );
+    const kept = new Set<string>();
+    for (const row of active) {
+      const target = row.userId ?? "*";
+      if (want.get(target) === row.access) {
+        kept.add(target);
+        continue;
+      }
+      await tx.run(
+        "UPDATE session_shares SET revokedAt = ?, revokedBy = ?, updated_by = ? WHERE id = ?",
+        [now, actorUserId, actorUserId, row.id],
+      );
+    }
+    for (const [target, access] of want) {
+      if (kept.has(target)) continue;
+      await tx.run(
+        `INSERT INTO session_shares (id, rootTaskId, userId, access, createdAt, created_by, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [
+          crypto.randomUUID(),
+          root.id,
+          target === "*" ? null : target,
+          access,
+          now,
+          actorUserId,
+          actorUserId,
+        ],
+      );
+    }
+    const rows = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL
+       ORDER BY createdAt, rowid`,
+      [root.id],
+    );
+    return toSessionSharesState(rows);
+  });
+}

package/src/be/swarm-config-guard.ts

@@ -1,4 +1,5 @@
 import { validateChatSdkAdaptersValue } from "../integrations/chat-sdk/schema";
+import { parseTelemetryRanking, TELEMETRY_RANKING_KEY } from "../ranking/telemetry-ranking";
 import { validateQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-pool-config";
 import { normalizeSlackReactionShortcode } from "../slack/reaction-shortcode";
 import { ProviderNameSchema } from "../types";
@@ -69,15 +70,24 @@ export function isApiOnlyConfigKey(key: string): boolean {
 }
 
 /** Config rows owned by dedicated API surfaces, not the generic config API. */
-export const INTERNAL_CONFIG_KEYS = new Set(["onboarding_state", "runtime_owner_id"]);
+export const INTERNAL_CONFIG_KEYS = new Set([
+  "onboarding_state",
+  "runtime_owner_id",
+  TELEMETRY_RANKING_KEY,
+]);
 
 export function isInternalConfigKey(key: string): boolean {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
 }
 
 export function internalConfigKeyError(key: string): Error {
+  const lower = key.toLowerCase();
   const owner =
-    key.toLowerCase() === "runtime_owner_id" ? "the runtime supervisor" : "/api/onboarding";
+    lower === "runtime_owner_id"
+      ? "the runtime supervisor"
+      : lower === TELEMETRY_RANKING_KEY
+        ? "/api/ranking"
+        : "/api/onboarding";
   return new Error(`Key '${key}' is managed by ${owner}`);
 }
 
@@ -301,6 +311,16 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
       return "Invalid TASK_TOOL_MANIFESTS (expected JSON with taskTypes and/or schedules maps, each selecting at most 16 known swarm tools)";
     }
   },
+  // Owned by /api/ranking (an internal key); parsed here as defense in depth.
+  [TELEMETRY_RANKING_KEY.toUpperCase()]: (value) => {
+    try {
+      if (typeof value !== "string") throw new Error("Expected JSON string");
+      parseTelemetryRanking(value);
+      return null;
+    } catch {
+      return "Invalid telemetry_ranking (expected the v1 ranking listing JSON)";
+    }
+  },
   // MCP tool allowlist: comma-separated names or a JSON array of strings.
   // Unknown names are accepted here and warned about at session init.
   SWARM_ENABLED_TOOLS: (value) => {
@@ -405,6 +425,7 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   },
   ...booleanValidators([
     "SWARM_USED_BY_CONSENT",
+    "PUBLIC_RANKING_ENABLED",
     "SWARM_DEV_MODE",
     "MULTI_RUNTIME_ENABLED",
     "STEERING_ENABLED",

package/src/commands/runner.ts

@@ -55,6 +55,7 @@ import {
   skillFromToolArgs,
 } from "../providers/skill-invoke.ts";
 import type { SteerDeliveryResult } from "../providers/types.ts";
+import { rankingUsageProps } from "../ranking/usage.ts";
 import { WorkerRealtimeClient } from "../realtime/worker-client";
 import { resumedTaskModelSelection, type TaskModelPinFields } from "../tasks/model-pin.ts";
 import { initTelemetry, telemetry } from "../telemetry.ts";
@@ -1228,6 +1229,10 @@ export const RELOADABLE_ENV_KEYS: ReadonlySet<string> = new Set([
   "TEMPLATE_REGISTRY_URL",
   "SLACK_DISABLE",
   "SWARM_ORG_NAME",
+  // Gate the public-ranking `ranking.usage` emit, so clearing the website or
+  // turning the setting off stops it on running workers.
+  "SWARM_ORG_WEBSITE",
+  "PUBLIC_RANKING_ENABLED",
   // pi reads these from process.env for its traits and its session.
   "PI_TOOL_DEFERRAL",
   "PI_CODEMODE",
@@ -4923,6 +4928,12 @@ async function spawnProviderProcess(
             },
             { userId: opts.requestedByUserId ?? null },
           );
+          // Public ranking: token counts only, while the install is opted in.
+          const rankingUsage = rankingUsageProps(result.cost, {
+            model: result.cost.model,
+            provider: result.cost.provider ?? opts.harnessProvider,
+          });
+          if (rankingUsage) telemetry.ranking("usage", rankingUsage);
         }
 
         // Post completion context usage snapshot

package/src/heartbeat/heartbeat.ts

@@ -48,6 +48,7 @@ import {
   settleSupersededTaskDependents,
   supersedeTask,
   updateAgentStatus,
+  upsertKv,
 } from "../be/db";
 import { repointTrackerSyncBySwarmId } from "../be/db-queries/tracker";
 import { poolTaskRunsOnHarness } from "../be/model-validation";
@@ -1461,7 +1462,10 @@ export function isEffectivelyEmpty(content: string): boolean {
 /**
  * Gather current system status as a markdown string for the lead's checklist task.
  */
-export async function gatherSystemStatus(options?: { isBootTriage?: boolean }): Promise<string> {
+export async function gatherSystemStatus(options?: {
+  isBootTriage?: boolean;
+  reportedFailures?: Array<{ id: string; line: string }>;
+}): Promise<string> {
   const stats = await getTaskStats();
   const stalledTasks = await getStalledInProgressTasks(stallThresholdMinutes());
   const agents = await getAllAgents();
@@ -1494,6 +1498,7 @@ export async function gatherSystemStatus(options?: { isBootTriage?: boolean }):
 
   // Recent failures with reasons and pattern detection (last 6 hours)
   const recentFailures = await getRecentFailedTasks(6);
+  const renderedFailures = recentFailures.slice(0, 10);
   if (recentFailures.length > 0) {
     sections.push("");
     sections.push("## Recent Failures (last 6h) [auto-generated]");
@@ -1520,12 +1525,12 @@ export async function gatherSystemStatus(options?: { isBootTriage?: boolean }):
 
     // List individual failures (max 10)
     sections.push("");
-    for (const task of recentFailures.slice(0, 10)) {
+    for (const task of renderedFailures) {
       const agentSlice = task.agentId?.slice(0, 8) ?? "unassigned";
       const reason = task.failureReason?.slice(0, 100) ?? "no reason";
-      sections.push(
-        `- [${task.id.slice(0, 8)}] "${task.task.slice(0, 50)}" — agent: ${agentSlice}, reason: ${reason}, at: ${task.finishedAt}`,
-      );
+      const line = `- [${task.id.slice(0, 8)}] "${task.task.slice(0, 50)}" — agent: ${agentSlice}, reason: ${reason}, at: ${task.finishedAt}`;
+      sections.push(line);
+      options?.reportedFailures?.push({ id: task.id, line });
     }
     if (recentFailures.length > 10) {
       sections.push(`- ... and ${recentFailures.length - 10} more`);
@@ -1786,7 +1791,8 @@ export async function checkHeartbeatChecklist(): Promise<void> {
     return;
   }
 
-  let systemStatus = await gatherSystemStatus();
+  const reportedFailures: Array<{ id: string; line: string }> = [];
+  let systemStatus = await gatherSystemStatus({ reportedFailures });
   // Shadow mode leaves the prompt untouched so the Lead's own quiet/non-quiet
   // outcome stays an independent check on the gate's verdict.
   if (gateMode === "enforce" && gate?.verdict === "wake" && gate.summary) {
@@ -1803,7 +1809,7 @@ export async function checkHeartbeatChecklist(): Promise<void> {
 
   if (result.skipped) return;
 
-  await createTaskExtended(result.text, {
+  const task = await createTaskExtended(result.text, {
     agentId: lead.id,
     routingReason: "skill",
     routingSource: "engine_default",
@@ -1815,6 +1821,18 @@ export async function checkHeartbeatChecklist(): Promise<void> {
     priority: 60,
   });
 
+  try {
+    await upsertKv({
+      namespace: "heartbeat-checklist:reported-failures",
+      key: task.id,
+      value: reportedFailures.filter(({ line }) => result.text.includes(line)).map(({ id }) => id),
+      valueType: "json",
+      expiresAt: Date.now() + 7 * 24 * 3600e3,
+    });
+  } catch (err) {
+    console.error(`[Heartbeat] Failed to save reported failures for checklist ${task.id}:`, err);
+  }
+
   console.log(`[Heartbeat] Checklist task created for lead ${lead.name}`);
 }
 

package/src/http/active-sessions.ts

@@ -13,7 +13,8 @@ import {
 } from "../be/db";
 import { ActiveSessionSchema, AgentTaskSchema } from "../types";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -39,6 +40,7 @@ const createActiveSession = route({
   method: "post",
   path: "/api/active-sessions",
   pattern: ["api", "active-sessions"],
+  session: bodyTask("taskId"),
   summary: "Create a new active session",
   tags: ["Active Sessions"],
   body: z.object({
@@ -60,6 +62,7 @@ const deleteSessionByTask = route({
   method: "delete",
   path: "/api/active-sessions/by-task/{taskId}",
   pattern: ["api", "active-sessions", "by-task", null],
+  session: { taskParam: "taskId" },
   summary: "Delete active session by task ID",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -72,6 +75,7 @@ const deleteSessionById = route({
   method: "delete",
   path: "/api/active-sessions/{id}",
   pattern: ["api", "active-sessions", null],
+  session: { activeSessionParam: "id" },
   summary: "Delete active session by ID",
   tags: ["Active Sessions"],
   params: z.object({ id: z.string() }),
@@ -84,6 +88,7 @@ const heartbeatSession = route({
   method: "put",
   path: "/api/active-sessions/heartbeat/{taskId}",
   pattern: ["api", "active-sessions", "heartbeat", null],
+  session: { taskParam: "taskId" },
   summary: "Update heartbeat for an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -96,6 +101,7 @@ const updateProviderSession = route({
   method: "put",
   path: "/api/active-sessions/provider-session/{taskId}",
   pattern: ["api", "active-sessions", "provider-session", null],
+  session: { taskParam: "taskId" },
   summary: "Update provider session ID on an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -109,6 +115,7 @@ const cleanupSessions = route({
   method: "post",
   path: "/api/active-sessions/cleanup",
   pattern: ["api", "active-sessions", "cleanup"],
+  session: { agentWide: "Deletes every session of an agent, or every stale session." },
   summary: "Clean up stale sessions",
   tags: ["Active Sessions"],
   body: z
@@ -126,6 +133,7 @@ const recoverOrphanedTasks = route({
   method: "post",
   path: "/api/active-sessions/recover-orphaned-tasks",
   pattern: ["api", "active-sessions", "recover-orphaned-tasks"],
+  session: { none: "Its handler admits only the calling agent, never a user." },
   summary: "Recover orphaned in-progress tasks for an agent",
   tags: ["Active Sessions"],
   body: z.object({
@@ -153,7 +161,10 @@ export async function handleActiveSessions(
   if (listActiveSessions.match(req.method, pathSegments)) {
     const parsed = await listActiveSessions.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const sessions = await getActiveSessions(parsed.query.agentId || undefined);
+    const sessions = await getActiveSessions(
+      parsed.query.agentId || undefined,
+      readableByFor(await resolveSessionActor(req, myAgentId)),
+    );
     listActiveSessions.respond(res, 200, { sessions });
     return true;
   }

package/src/http/agents.ts

@@ -90,6 +90,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route, runtimeInstanceHeader } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { agentWithCapacity, json, jsonError } from "./utils";
 
 function singleHeaderValue(req: IncomingMessage, name: string): string | undefined {
@@ -844,7 +845,7 @@ export async function handleAgentsRest(
   res: ServerResponse,
   pathSegments: string[],
   queryParams: URLSearchParams,
-  _myAgentId: string | undefined,
+  myAgentId: string | undefined,
 ): Promise<boolean> {
   if (listAgents.match(req.method, pathSegments)) {
     const parsed = await listAgents.parse(req, res, pathSegments, queryParams);
@@ -853,7 +854,10 @@ export async function handleAgentsRest(
     // List responses default to slim (no identity markdown); `?fields=full` restores it.
     const slim = parsed.query.fields !== "full";
     const agents = includeTasks
-      ? await getAllAgentsWithTasks({ slim })
+      ? await getAllAgentsWithTasks({
+          slim,
+          readableBy: readableByFor(await resolveSessionActor(req, myAgentId)),
+        })
       : await getAllAgents({ slim });
     const [agentsWithCapacity, transports] = await Promise.all([
       Promise.all(agents.map(agentWithCapacity)),
@@ -1537,7 +1541,10 @@ export async function handleAgentsRest(
     if (!parsed) return true;
     const includeTasks = parsed.query.include === "tasks";
     const agent = includeTasks
-      ? await getAgentWithTasks(parsed.params.id)
+      ? await getAgentWithTasks(
+          parsed.params.id,
+          readableByFor(await resolveSessionActor(req, myAgentId)),
+        )
       : await getAgentById(parsed.params.id);
 
     if (!agent) {

package/src/http/all-routes.ts

@@ -67,6 +67,7 @@ import "./task-templates";
 import "./telemetry-ui";
 import "./trackers/jira";
 import "./trackers/linear";
+import "./ranking";
 import "./used-by";
 import "./fleet-benchmark";
 import "./users";

package/src/http/api-keys.ts

@@ -20,7 +20,7 @@ import {
   SUBSCRIPTION_PLANS,
   SUBSCRIPTION_PLANS_CHECKED_AT,
 } from "../utils/subscription-plans";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { clearUsageCache } from "./usage-cache";
 import { jsonError } from "./utils";
 
@@ -36,6 +36,7 @@ const reportUsage = route({
   method: "post",
   path: "/api/keys/report-usage",
   pattern: ["api", "keys", "report-usage"],
+  session: bodyTask("taskId"),
   summary: "Record which API key was used for a task",
   tags: ["API Keys"],
   body: z.object({
@@ -82,6 +83,7 @@ const reportAuthFailure = route({
   method: "post",
   path: "/api/keys/report-auth-failure",
   pattern: ["api", "keys", "report-auth-failure"],
+  session: bodyTask("taskId"),
   summary: "Record an auth failure for a pooled key; bench it after 2 in a row",
   tags: ["API Keys"],
   body: z.object({

package/src/http/approval-requests.ts

@@ -23,7 +23,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { cancelApprovalRequest } from "../workflows/approval-cancel";
 import { createApprovalFollowUpTask } from "../workflows/approval-notifications";
 import { workflowEventBus } from "../workflows/event-bus";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -255,6 +255,7 @@ const createRoute = route({
   method: "post",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
+  session: bodyTask("sourceTaskId"),
   summary: "Create a new approval request",
   tags: ["ApprovalRequests"],
   body: z.object({