@desplega.ai/agent-swarm 2.3.0 → 2.4.0

package/src/be/session-shares.ts

@@ -0,0 +1,244 @@
+import { getDbClient } from "./db";
+
+/**
+ * Session sharing store. A session is a root task (`parentTaskId IS NULL`) and
+ * its descendants; its owner is the root's `requestedByUserId`.
+ *
+ * Rows in `session_shares` are never deleted. Revoking sets `revokedAt`, and an
+ * access change revokes the active row and inserts a new one in the same
+ * transaction, so the rows for a root are its full share history.
+ */
+
+export type SessionShareAccess = "read" | "write";
+export type SessionAccess = "owner" | SessionShareAccess | "none";
+export type SessionEveryoneAccess = SessionShareAccess | "none";
+
+export type SessionShareRow = {
+  id: string;
+  rootTaskId: string;
+  /** NULL = everyone. */
+  userId: string | null;
+  access: SessionShareAccess;
+  createdAt: string;
+  revokedAt: string | null;
+  revokedBy: string | null;
+};
+
+export type SessionRoot = { id: string; requestedByUserId: string | null };
+
+export type SessionSharesState = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess; createdAt: string }[];
+};
+
+export type DesiredSessionShares = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess }[];
+};
+
+const RANK: Record<SessionAccess, number> = { none: 0, read: 1, write: 2, owner: 3 };
+
+/** True when `access` grants at least `needed`. */
+export function hasSessionAccess(access: SessionAccess, needed: SessionAccess): boolean {
+  return RANK[access] >= RANK[needed];
+}
+
+/**
+ * The session root of any task: walk `parentTaskId` up to the topmost task
+ * that still exists. No depth cap, so a chain of any length resolves to its
+ * actual root; a corrupt parent cycle has no top and resolves to null.
+ */
+export async function getSessionRoot(taskId: string): Promise<SessionRoot | null> {
+  return (await getSessionRoots([taskId])).get(taskId) ?? null;
+}
+
+const ROOT_LOOKUP_CHUNK = 500;
+
+type AncestorRow = { id: string; parentTaskId: string | null; requestedByUserId: string | null };
+
+/** `getSessionRoot` for many tasks; unknown tasks and tasks in a cycle are absent. */
+export async function getSessionRoots(taskIds: string[]): Promise<Map<string, SessionRoot>> {
+  const ids = [...new Set(taskIds)];
+  // Every ancestor once (`UNION` drops revisits, which also ends a cycle),
+  // then resolve each chain in memory: linear in the tasks involved.
+  const tasks = new Map<string, AncestorRow>();
+  for (let start = 0; start < ids.length; start += ROOT_LOOKUP_CHUNK) {
+    const chunk = ids.slice(start, start + ROOT_LOOKUP_CHUNK).filter((id) => !tasks.has(id));
+    if (chunk.length === 0) continue;
+    const rows = await getDbClient().query<AncestorRow>(
+      `WITH RECURSIVE up(id) AS (
+           SELECT id FROM agent_tasks WHERE id IN (${chunk.map(() => "?").join(", ")})
+           UNION
+           SELECT t.parentTaskId FROM agent_tasks t JOIN up ON t.id = up.id
+           WHERE t.parentTaskId IS NOT NULL
+         )
+         SELECT t.id, t.parentTaskId, t.requestedByUserId
+         FROM up CROSS JOIN agent_tasks t ON t.id = up.id`,
+      chunk,
+    );
+    for (const row of rows) tasks.set(row.id, row);
+  }
+
+  const resolved = new Map<string, SessionRoot | null>();
+  const rootOf = (taskId: string): SessionRoot | null => {
+    const path: string[] = [];
+    const onPath = new Set<string>();
+    let current = tasks.get(taskId);
+    let root: SessionRoot | null = null;
+    while (current) {
+      const known = resolved.get(current.id);
+      if (known !== undefined) {
+        root = known;
+        break;
+      }
+      if (onPath.has(current.id)) break;
+      path.push(current.id);
+      onPath.add(current.id);
+      const parent = current.parentTaskId ? tasks.get(current.parentTaskId) : undefined;
+      if (!parent) {
+        root = { id: current.id, requestedByUserId: current.requestedByUserId };
+        break;
+      }
+      current = parent;
+    }
+    for (const id of path) resolved.set(id, root);
+    return root;
+  };
+
+  const roots = new Map<string, SessionRoot>();
+  for (const id of ids) {
+    const root = rootOf(id);
+    if (root) roots.set(id, root);
+  }
+  return roots;
+}
+
+/**
+ * What `actingUserId` may do in the session rooted at `root`.
+ *
+ * - `owner` for the root's requester, and for every user when the root has no
+ *   owner (Slack and schedule sessions stay open, as before sharing existed).
+ * - Otherwise the best active share naming the user or everyone; `none` when
+ *   there is none. A root with no rows is private to its owner.
+ *
+ * A null `actingUserId` is a viewer with no user (a guest page session): it
+ * gets ownerless roots and everyone shares only. Callers that act for no user
+ * (agents, operator-key calls with no picked dashboard user) skip this check
+ * entirely; see `resolveSessionActor`.
+ */
+export async function sessionAccessForRoot(
+  actingUserId: string | null,
+  root: SessionRoot,
+): Promise<SessionAccess> {
+  if (!root.requestedByUserId) return "owner";
+  if (actingUserId && root.requestedByUserId === actingUserId) return "owner";
+  const rows = await getDbClient().query<{ access: SessionShareAccess }>(
+    `SELECT access FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL AND (userId IS NULL OR userId = ?)`,
+    [root.id, actingUserId],
+  );
+  if (rows.some((row) => row.access === "write")) return "write";
+  return rows.length > 0 ? "read" : "none";
+}
+
+/** `sessionAccessForRoot` for any task in the session; `none` for an unknown task. */
+export async function sessionAccess(
+  actingUserId: string | null,
+  taskId: string,
+): Promise<SessionAccess> {
+  const root = await getSessionRoot(taskId);
+  return root ? sessionAccessForRoot(actingUserId, root) : "none";
+}
+
+export async function listActiveSessionShares(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+/** Every row for a root, revoked ones included, oldest first. */
+export async function listSessionShareHistory(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ?
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+export function toSessionSharesState(rows: SessionShareRow[]): SessionSharesState {
+  const everyone = rows.find((row) => row.userId === null);
+  return {
+    everyone: everyone?.access ?? "none",
+    users: rows
+      .filter((row) => row.userId !== null)
+      .map((row) => ({ userId: row.userId!, access: row.access, createdAt: row.createdAt })),
+  };
+}
+
+/**
+ * Make the active shares of `root` equal `desired`, in one write transaction.
+ * A target whose access changes has its active row revoked and a new row
+ * inserted; a target no longer listed is revoked; nothing is deleted or
+ * updated in place apart from revocation. The owner is never stored.
+ */
+export async function setSessionShares(
+  root: SessionRoot,
+  desired: DesiredSessionShares,
+  actorUserId: string | null,
+): Promise<SessionSharesState> {
+  const want = new Map<string, SessionShareAccess>();
+  if (desired.everyone !== "none") want.set("*", desired.everyone);
+  for (const user of desired.users) {
+    if (user.userId !== root.requestedByUserId) want.set(user.userId, user.access);
+  }
+
+  return getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    const active = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL`,
+      [root.id],
+    );
+    const kept = new Set<string>();
+    for (const row of active) {
+      const target = row.userId ?? "*";
+      if (want.get(target) === row.access) {
+        kept.add(target);
+        continue;
+      }
+      await tx.run(
+        "UPDATE session_shares SET revokedAt = ?, revokedBy = ?, updated_by = ? WHERE id = ?",
+        [now, actorUserId, actorUserId, row.id],
+      );
+    }
+    for (const [target, access] of want) {
+      if (kept.has(target)) continue;
+      await tx.run(
+        `INSERT INTO session_shares (id, rootTaskId, userId, access, createdAt, created_by, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [
+          crypto.randomUUID(),
+          root.id,
+          target === "*" ? null : target,
+          access,
+          now,
+          actorUserId,
+          actorUserId,
+        ],
+      );
+    }
+    const rows = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL
+       ORDER BY createdAt, rowid`,
+      [root.id],
+    );
+    return toSessionSharesState(rows);
+  });
+}

package/src/be/swarm-config-guard.ts

@@ -1,4 +1,5 @@
 import { validateChatSdkAdaptersValue } from "../integrations/chat-sdk/schema";
+import { parseTelemetryRanking, TELEMETRY_RANKING_KEY } from "../ranking/telemetry-ranking";
 import { validateQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-pool-config";
 import { normalizeSlackReactionShortcode } from "../slack/reaction-shortcode";
 import { ProviderNameSchema } from "../types";
@@ -69,15 +70,24 @@ export function isApiOnlyConfigKey(key: string): boolean {
 }
 
 /** Config rows owned by dedicated API surfaces, not the generic config API. */
-export const INTERNAL_CONFIG_KEYS = new Set(["onboarding_state", "runtime_owner_id"]);
+export const INTERNAL_CONFIG_KEYS = new Set([
+  "onboarding_state",
+  "runtime_owner_id",
+  TELEMETRY_RANKING_KEY,
+]);
 
 export function isInternalConfigKey(key: string): boolean {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
 }
 
 export function internalConfigKeyError(key: string): Error {
+  const lower = key.toLowerCase();
   const owner =
-    key.toLowerCase() === "runtime_owner_id" ? "the runtime supervisor" : "/api/onboarding";
+    lower === "runtime_owner_id"
+      ? "the runtime supervisor"
+      : lower === TELEMETRY_RANKING_KEY
+        ? "/api/ranking"
+        : "/api/onboarding";
   return new Error(`Key '${key}' is managed by ${owner}`);
 }
 
@@ -301,6 +311,16 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
       return "Invalid TASK_TOOL_MANIFESTS (expected JSON with taskTypes and/or schedules maps, each selecting at most 16 known swarm tools)";
     }
   },
+  // Owned by /api/ranking (an internal key); parsed here as defense in depth.
+  [TELEMETRY_RANKING_KEY.toUpperCase()]: (value) => {
+    try {
+      if (typeof value !== "string") throw new Error("Expected JSON string");
+      parseTelemetryRanking(value);
+      return null;
+    } catch {
+      return "Invalid telemetry_ranking (expected the v1 ranking listing JSON)";
+    }
+  },
   // MCP tool allowlist: comma-separated names or a JSON array of strings.
   // Unknown names are accepted here and warned about at session init.
   SWARM_ENABLED_TOOLS: (value) => {
@@ -405,6 +425,7 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   },
   ...booleanValidators([
     "SWARM_USED_BY_CONSENT",
+    "PUBLIC_RANKING_ENABLED",
     "SWARM_DEV_MODE",
     "MULTI_RUNTIME_ENABLED",
     "STEERING_ENABLED",

package/src/commands/runner.ts

@@ -55,6 +55,7 @@ import {
   skillFromToolArgs,
 } from "../providers/skill-invoke.ts";
 import type { SteerDeliveryResult } from "../providers/types.ts";
+import { rankingUsageProps } from "../ranking/usage.ts";
 import { WorkerRealtimeClient } from "../realtime/worker-client";
 import { resumedTaskModelSelection, type TaskModelPinFields } from "../tasks/model-pin.ts";
 import { initTelemetry, telemetry } from "../telemetry.ts";
@@ -1228,6 +1229,10 @@ export const RELOADABLE_ENV_KEYS: ReadonlySet<string> = new Set([
   "TEMPLATE_REGISTRY_URL",
   "SLACK_DISABLE",
   "SWARM_ORG_NAME",
+  // Gate the public-ranking `ranking.usage` emit, so clearing the website or
+  // turning the setting off stops it on running workers.
+  "SWARM_ORG_WEBSITE",
+  "PUBLIC_RANKING_ENABLED",
   // pi reads these from process.env for its traits and its session.
   "PI_TOOL_DEFERRAL",
   "PI_CODEMODE",
@@ -4923,6 +4928,12 @@ async function spawnProviderProcess(
             },
             { userId: opts.requestedByUserId ?? null },
           );
+          // Public ranking: token counts only, while the install is opted in.
+          const rankingUsage = rankingUsageProps(result.cost, {
+            model: result.cost.model,
+            provider: result.cost.provider ?? opts.harnessProvider,
+          });
+          if (rankingUsage) telemetry.ranking("usage", rankingUsage);
         }
 
         // Post completion context usage snapshot

package/src/http/active-sessions.ts

@@ -13,7 +13,8 @@ import {
 } from "../be/db";
 import { ActiveSessionSchema, AgentTaskSchema } from "../types";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -39,6 +40,7 @@ const createActiveSession = route({
   method: "post",
   path: "/api/active-sessions",
   pattern: ["api", "active-sessions"],
+  session: bodyTask("taskId"),
   summary: "Create a new active session",
   tags: ["Active Sessions"],
   body: z.object({
@@ -60,6 +62,7 @@ const deleteSessionByTask = route({
   method: "delete",
   path: "/api/active-sessions/by-task/{taskId}",
   pattern: ["api", "active-sessions", "by-task", null],
+  session: { taskParam: "taskId" },
   summary: "Delete active session by task ID",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -72,6 +75,7 @@ const deleteSessionById = route({
   method: "delete",
   path: "/api/active-sessions/{id}",
   pattern: ["api", "active-sessions", null],
+  session: { activeSessionParam: "id" },
   summary: "Delete active session by ID",
   tags: ["Active Sessions"],
   params: z.object({ id: z.string() }),
@@ -84,6 +88,7 @@ const heartbeatSession = route({
   method: "put",
   path: "/api/active-sessions/heartbeat/{taskId}",
   pattern: ["api", "active-sessions", "heartbeat", null],
+  session: { taskParam: "taskId" },
   summary: "Update heartbeat for an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -96,6 +101,7 @@ const updateProviderSession = route({
   method: "put",
   path: "/api/active-sessions/provider-session/{taskId}",
   pattern: ["api", "active-sessions", "provider-session", null],
+  session: { taskParam: "taskId" },
   summary: "Update provider session ID on an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -109,6 +115,7 @@ const cleanupSessions = route({
   method: "post",
   path: "/api/active-sessions/cleanup",
   pattern: ["api", "active-sessions", "cleanup"],
+  session: { agentWide: "Deletes every session of an agent, or every stale session." },
   summary: "Clean up stale sessions",
   tags: ["Active Sessions"],
   body: z
@@ -126,6 +133,7 @@ const recoverOrphanedTasks = route({
   method: "post",
   path: "/api/active-sessions/recover-orphaned-tasks",
   pattern: ["api", "active-sessions", "recover-orphaned-tasks"],
+  session: { none: "Its handler admits only the calling agent, never a user." },
   summary: "Recover orphaned in-progress tasks for an agent",
   tags: ["Active Sessions"],
   body: z.object({
@@ -153,7 +161,10 @@ export async function handleActiveSessions(
   if (listActiveSessions.match(req.method, pathSegments)) {
     const parsed = await listActiveSessions.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const sessions = await getActiveSessions(parsed.query.agentId || undefined);
+    const sessions = await getActiveSessions(
+      parsed.query.agentId || undefined,
+      readableByFor(await resolveSessionActor(req, myAgentId)),
+    );
     listActiveSessions.respond(res, 200, { sessions });
     return true;
   }

package/src/http/agents.ts

@@ -90,6 +90,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route, runtimeInstanceHeader } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { agentWithCapacity, json, jsonError } from "./utils";
 
 function singleHeaderValue(req: IncomingMessage, name: string): string | undefined {
@@ -844,7 +845,7 @@ export async function handleAgentsRest(
   res: ServerResponse,
   pathSegments: string[],
   queryParams: URLSearchParams,
-  _myAgentId: string | undefined,
+  myAgentId: string | undefined,
 ): Promise<boolean> {
   if (listAgents.match(req.method, pathSegments)) {
     const parsed = await listAgents.parse(req, res, pathSegments, queryParams);
@@ -853,7 +854,10 @@ export async function handleAgentsRest(
     // List responses default to slim (no identity markdown); `?fields=full` restores it.
     const slim = parsed.query.fields !== "full";
     const agents = includeTasks
-      ? await getAllAgentsWithTasks({ slim })
+      ? await getAllAgentsWithTasks({
+          slim,
+          readableBy: readableByFor(await resolveSessionActor(req, myAgentId)),
+        })
       : await getAllAgents({ slim });
     const [agentsWithCapacity, transports] = await Promise.all([
       Promise.all(agents.map(agentWithCapacity)),
@@ -1537,7 +1541,10 @@ export async function handleAgentsRest(
     if (!parsed) return true;
     const includeTasks = parsed.query.include === "tasks";
     const agent = includeTasks
-      ? await getAgentWithTasks(parsed.params.id)
+      ? await getAgentWithTasks(
+          parsed.params.id,
+          readableByFor(await resolveSessionActor(req, myAgentId)),
+        )
       : await getAgentById(parsed.params.id);
 
     if (!agent) {

package/src/http/all-routes.ts

@@ -67,6 +67,7 @@ import "./task-templates";
 import "./telemetry-ui";
 import "./trackers/jira";
 import "./trackers/linear";
+import "./ranking";
 import "./used-by";
 import "./fleet-benchmark";
 import "./users";

package/src/http/api-keys.ts

@@ -20,7 +20,7 @@ import {
   SUBSCRIPTION_PLANS,
   SUBSCRIPTION_PLANS_CHECKED_AT,
 } from "../utils/subscription-plans";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { clearUsageCache } from "./usage-cache";
 import { jsonError } from "./utils";
 
@@ -36,6 +36,7 @@ const reportUsage = route({
   method: "post",
   path: "/api/keys/report-usage",
   pattern: ["api", "keys", "report-usage"],
+  session: bodyTask("taskId"),
   summary: "Record which API key was used for a task",
   tags: ["API Keys"],
   body: z.object({
@@ -82,6 +83,7 @@ const reportAuthFailure = route({
   method: "post",
   path: "/api/keys/report-auth-failure",
   pattern: ["api", "keys", "report-auth-failure"],
+  session: bodyTask("taskId"),
   summary: "Record an auth failure for a pooled key; bench it after 2 in a row",
   tags: ["API Keys"],
   body: z.object({

package/src/http/approval-requests.ts

@@ -23,7 +23,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { cancelApprovalRequest } from "../workflows/approval-cancel";
 import { createApprovalFollowUpTask } from "../workflows/approval-notifications";
 import { workflowEventBus } from "../workflows/event-bus";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -255,6 +255,7 @@ const createRoute = route({
   method: "post",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
+  session: bodyTask("sourceTaskId"),
   summary: "Create a new approval request",
   tags: ["ApprovalRequests"],
   body: z.object({

package/src/http/apps.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import * as z from "zod";
+import type { AppActionCaller } from "../apps/action-caller";
 import {
   type AppDefinition,
   AppNameSchema,
@@ -660,45 +661,64 @@ const syncAppRoute = route({
 });
 
 /**
- * RBAC-gate an app operation and resolve the acting principal's stable actor id
- * (`user:<id>`, `agent:<id>`, or `operator`) for row provenance. Returns null
- * (after writing the 403) when the write is denied.
+ * Check app permissions and resolve server-verified identity for action input
+ * and row provenance. Return null after a 403 response when access is denied.
  */
-async function authorizeApp(
+async function authorizeAppCaller(
   req: IncomingMessage,
   res: ServerResponse,
   myAgentId: string | undefined,
   verb: "app.manage" | "app.use",
   resource: RbacResource,
-): Promise<string | null> {
+): Promise<{ actor: string; caller: AppActionCaller } | null> {
   const auth = getRequestAuth(req);
   let principal: RbacPrincipal;
   let actor: string;
+  let caller: AppActionCaller;
   if (auth?.kind === "operator") {
     principal = { kind: "operator" };
-    actor = "operator";
+    // Page sessions never act as an agent, even if a header names one.
+    const agent = myAgentId && !auth.page ? await getAgentById(myAgentId) : null;
+    actor = agent ? `agent:${agent.id}` : "operator";
+    caller = agent
+      ? { kind: "agent", id: agent.id, name: agent.name }
+      : { kind: "operator", id: null };
   } else if (auth?.kind === "user") {
     principal = { kind: "user", userId: auth.userId };
     actor = `user:${auth.userId}`;
-  } else if (auth?.kind === "guest") {
+    caller = { kind: "user", id: auth.userId, name: auth.user.name };
+  } else if (auth?.kind === "guest" || auth?.kind === "controller") {
     principal = { kind: "guest" };
     actor = "guest";
+    caller = { kind: "guest", id: null };
   } else {
     const agent = myAgentId ? await getAgentById(myAgentId) : null;
     principal = { kind: "agent", agentId: myAgentId ?? "", isLead: agent?.isLead ?? false };
     actor = myAgentId ? `agent:${myAgentId}` : "agent";
+    caller = { kind: "agent", id: myAgentId ?? null, name: agent?.name };
   }
+  if (auth?.page) caller.pageId = auth.page.id;
   const decision = can({
     principal,
     verb,
     resource,
     source: "http",
   });
-  if (decision.allow) return actor;
+  if (decision.allow) return { actor, caller };
   jsonError(res, decision.reason, 403);
   return null;
 }
 
+async function authorizeApp(
+  req: IncomingMessage,
+  res: ServerResponse,
+  myAgentId: string | undefined,
+  verb: "app.manage" | "app.use",
+  resource: RbacResource,
+): Promise<string | null> {
+  return (await authorizeAppCaller(req, res, myAgentId, verb, resource))?.actor ?? null;
+}
+
 async function authorizeAppManage(
   req: IncomingMessage,
   res: ServerResponse,
@@ -1326,8 +1346,12 @@ export async function handleApps(
     if (enforceContentLengthCap(req, res, MAX_APP_ROW_BODY_BYTES) === BODY_TOO_LARGE) return true;
     const parsed = await runActionRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const actor = await authorizeAppUse(req, res, myAgentId, parsed.params.id);
-    if (!actor) return true;
+    const identity = await authorizeAppCaller(req, res, myAgentId, "app.use", {
+      kind: "app",
+      appId: parsed.params.id,
+    });
+    if (!identity) return true;
+    const { actor, caller } = identity;
 
     const app = await getApp(parsed.params.id);
     if (!app) {
@@ -1375,7 +1399,7 @@ export async function handleApps(
 
       const output = await runSavedScriptAsAgent({
         script,
-        input: { ...action.args, ...input, app: { id: app.id } },
+        input: { ...action.args, ...input, app: { id: app.id }, caller },
         agentId: runAsAgentId,
       });
       const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
@@ -1434,6 +1458,7 @@ export async function handleApps(
       app_id: app.id,
       action_name: parsed.params.name,
       input_json: JSON.stringify(input),
+      caller_json: JSON.stringify(caller),
     });
     const task = await createTaskWithSiblingAwareness(
       taskPrompt.text,

package/src/http/config.ts

@@ -31,6 +31,7 @@ import { SwarmConfigSchema } from "../types";
 import { getRequestAuth, type HttpRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
+import { syncRankingAfterConfigChange } from "./ranking";
 import { route } from "./route-def";
 import { duplicateGuardedQueryKey, jsonError } from "./utils";
 
@@ -527,6 +528,7 @@ export async function handleConfig(
       if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
         await fillOrgLogoFromWebsite(String(value));
       }
+      if (scope === "global") await syncRankingAfterConfigChange(key, String(value));
       if (scope === "global") {
         scheduleIntegrationsReload();
       }
@@ -561,6 +563,7 @@ export async function handleConfig(
       return true;
     }
     if (existing.scope === "global") {
+      await syncRankingAfterConfigChange(existing.key, null);
       scheduleIntegrationsReload();
     }
     if (

package/src/http/context.ts

@@ -43,6 +43,7 @@ const postContext = route({
   method: "post",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Record a context usage snapshot for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -72,6 +73,7 @@ const getContext = route({
   method: "get",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Get context usage history for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),