@desplega.ai/agent-swarm 2.3.0 → 2.4.1

package/src/http/active-sessions.ts

@@ -13,7 +13,8 @@ import {
 } from "../be/db";
 import { ActiveSessionSchema, AgentTaskSchema } from "../types";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -39,6 +40,7 @@ const createActiveSession = route({
   method: "post",
   path: "/api/active-sessions",
   pattern: ["api", "active-sessions"],
+  session: bodyTask("taskId"),
   summary: "Create a new active session",
   tags: ["Active Sessions"],
   body: z.object({
@@ -60,6 +62,7 @@ const deleteSessionByTask = route({
   method: "delete",
   path: "/api/active-sessions/by-task/{taskId}",
   pattern: ["api", "active-sessions", "by-task", null],
+  session: { taskParam: "taskId" },
   summary: "Delete active session by task ID",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -72,6 +75,7 @@ const deleteSessionById = route({
   method: "delete",
   path: "/api/active-sessions/{id}",
   pattern: ["api", "active-sessions", null],
+  session: { activeSessionParam: "id" },
   summary: "Delete active session by ID",
   tags: ["Active Sessions"],
   params: z.object({ id: z.string() }),
@@ -84,6 +88,7 @@ const heartbeatSession = route({
   method: "put",
   path: "/api/active-sessions/heartbeat/{taskId}",
   pattern: ["api", "active-sessions", "heartbeat", null],
+  session: { taskParam: "taskId" },
   summary: "Update heartbeat for an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -96,6 +101,7 @@ const updateProviderSession = route({
   method: "put",
   path: "/api/active-sessions/provider-session/{taskId}",
   pattern: ["api", "active-sessions", "provider-session", null],
+  session: { taskParam: "taskId" },
   summary: "Update provider session ID on an active session",
   tags: ["Active Sessions"],
   params: z.object({ taskId: z.string() }),
@@ -109,6 +115,7 @@ const cleanupSessions = route({
   method: "post",
   path: "/api/active-sessions/cleanup",
   pattern: ["api", "active-sessions", "cleanup"],
+  session: { agentWide: "Deletes every session of an agent, or every stale session." },
   summary: "Clean up stale sessions",
   tags: ["Active Sessions"],
   body: z
@@ -126,6 +133,7 @@ const recoverOrphanedTasks = route({
   method: "post",
   path: "/api/active-sessions/recover-orphaned-tasks",
   pattern: ["api", "active-sessions", "recover-orphaned-tasks"],
+  session: { none: "Its handler admits only the calling agent, never a user." },
   summary: "Recover orphaned in-progress tasks for an agent",
   tags: ["Active Sessions"],
   body: z.object({
@@ -153,7 +161,10 @@ export async function handleActiveSessions(
   if (listActiveSessions.match(req.method, pathSegments)) {
     const parsed = await listActiveSessions.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const sessions = await getActiveSessions(parsed.query.agentId || undefined);
+    const sessions = await getActiveSessions(
+      parsed.query.agentId || undefined,
+      readableByFor(await resolveSessionActor(req, myAgentId)),
+    );
     listActiveSessions.respond(res, 200, { sessions });
     return true;
   }

package/src/http/agents.ts

@@ -90,6 +90,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route, runtimeInstanceHeader } from "./route-def";
+import { readableByFor, resolveSessionActor } from "./session-access";
 import { agentWithCapacity, json, jsonError } from "./utils";
 
 function singleHeaderValue(req: IncomingMessage, name: string): string | undefined {
@@ -844,7 +845,7 @@ export async function handleAgentsRest(
   res: ServerResponse,
   pathSegments: string[],
   queryParams: URLSearchParams,
-  _myAgentId: string | undefined,
+  myAgentId: string | undefined,
 ): Promise<boolean> {
   if (listAgents.match(req.method, pathSegments)) {
     const parsed = await listAgents.parse(req, res, pathSegments, queryParams);
@@ -853,7 +854,10 @@ export async function handleAgentsRest(
     // List responses default to slim (no identity markdown); `?fields=full` restores it.
     const slim = parsed.query.fields !== "full";
     const agents = includeTasks
-      ? await getAllAgentsWithTasks({ slim })
+      ? await getAllAgentsWithTasks({
+          slim,
+          readableBy: readableByFor(await resolveSessionActor(req, myAgentId)),
+        })
       : await getAllAgents({ slim });
     const [agentsWithCapacity, transports] = await Promise.all([
       Promise.all(agents.map(agentWithCapacity)),
@@ -1498,6 +1502,7 @@ export async function handleAgentsRest(
         reportedAt: parsed.body.latest_model?.reportedAt ?? parsed.body.acp!.reportedAt,
         reportKind: "post_task" as const,
         bedrock: null,
+        opencodeGo: null,
         acp: null,
       };
       finalAgent =
@@ -1537,7 +1542,10 @@ export async function handleAgentsRest(
     if (!parsed) return true;
     const includeTasks = parsed.query.include === "tasks";
     const agent = includeTasks
-      ? await getAgentWithTasks(parsed.params.id)
+      ? await getAgentWithTasks(
+          parsed.params.id,
+          readableByFor(await resolveSessionActor(req, myAgentId)),
+        )
       : await getAgentById(parsed.params.id);
 
     if (!agent) {

package/src/http/all-routes.ts

@@ -67,6 +67,7 @@ import "./task-templates";
 import "./telemetry-ui";
 import "./trackers/jira";
 import "./trackers/linear";
+import "./ranking";
 import "./used-by";
 import "./fleet-benchmark";
 import "./users";

package/src/http/api-keys.ts

@@ -20,7 +20,7 @@ import {
   SUBSCRIPTION_PLANS,
   SUBSCRIPTION_PLANS_CHECKED_AT,
 } from "../utils/subscription-plans";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { clearUsageCache } from "./usage-cache";
 import { jsonError } from "./utils";
 
@@ -36,6 +36,7 @@ const reportUsage = route({
   method: "post",
   path: "/api/keys/report-usage",
   pattern: ["api", "keys", "report-usage"],
+  session: bodyTask("taskId"),
   summary: "Record which API key was used for a task",
   tags: ["API Keys"],
   body: z.object({
@@ -82,6 +83,7 @@ const reportAuthFailure = route({
   method: "post",
   path: "/api/keys/report-auth-failure",
   pattern: ["api", "keys", "report-auth-failure"],
+  session: bodyTask("taskId"),
   summary: "Record an auth failure for a pooled key; bench it after 2 in a row",
   tags: ["API Keys"],
   body: z.object({

package/src/http/approval-requests.ts

@@ -23,7 +23,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { cancelApprovalRequest } from "../workflows/approval-cancel";
 import { createApprovalFollowUpTask } from "../workflows/approval-notifications";
 import { workflowEventBus } from "../workflows/event-bus";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
 import { jsonError } from "./utils";
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -255,6 +255,7 @@ const createRoute = route({
   method: "post",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
+  session: bodyTask("sourceTaskId"),
   summary: "Create a new approval request",
   tags: ["ApprovalRequests"],
   body: z.object({

package/src/http/apps.ts

@@ -1,5 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import * as z from "zod";
+import type { AppActionCaller } from "../apps/action-caller";
+import { runAppAction } from "../apps/action-runner";
 import {
   type AppDefinition,
   AppNameSchema,
@@ -60,14 +62,9 @@ import {
   rollbackApp,
   snapshotApp,
 } from "../apps/version";
-import { normalizeAssetKey } from "../assets/key";
-import { getAgentById, getAppVersion, getAppVersions, getLeadAgent } from "../be/db";
-import { getScriptById } from "../be/scripts/db";
-import { getSavedScriptOwnerAgentId, runSavedScriptAsAgent } from "../be/scripts/run-saved";
-import { resolveTemplate } from "../prompts/resolver";
+import { getAgentById, getAppVersion, getAppVersions } from "../be/db";
 import type { RbacPrincipal, RbacResource } from "../rbac";
 import { can } from "../rbac";
-import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { AgentTaskStatusSchema } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { scrubObject } from "../utils/secret-scrubber";
@@ -76,8 +73,8 @@ import { route } from "./route-def";
 import { BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError } from "./utils";
 
 const MAX_APP_BODY_BYTES = 5 * 1024 * 1024;
-const MAX_APP_ROW_BODY_BYTES = 1 * 1024 * 1024;
-const MAX_APP_BULK_ROWS_BODY_BYTES = 10 * 1024 * 1024;
+export const MAX_APP_ROW_BODY_BYTES = 1 * 1024 * 1024;
+export const MAX_APP_BULK_ROWS_BODY_BYTES = 10 * 1024 * 1024;
 const MAX_USER_CONFIG_BODY_BYTES = 64 * 1024;
 const MAX_USER_CONFIG_VALUES_BYTES = 16 * 1024;
 const DECIMAL_NUMBER_PATTERN = /^[+-]?\d+(?:\.\d+)?$/;
@@ -660,45 +657,64 @@ const syncAppRoute = route({
 });
 
 /**
- * RBAC-gate an app operation and resolve the acting principal's stable actor id
- * (`user:<id>`, `agent:<id>`, or `operator`) for row provenance. Returns null
- * (after writing the 403) when the write is denied.
+ * Check app permissions and resolve server-verified identity for action input
+ * and row provenance. Return null after a 403 response when access is denied.
  */
-async function authorizeApp(
+async function authorizeAppCaller(
   req: IncomingMessage,
   res: ServerResponse,
   myAgentId: string | undefined,
   verb: "app.manage" | "app.use",
   resource: RbacResource,
-): Promise<string | null> {
+): Promise<{ actor: string; caller: AppActionCaller } | null> {
   const auth = getRequestAuth(req);
   let principal: RbacPrincipal;
   let actor: string;
+  let caller: AppActionCaller;
   if (auth?.kind === "operator") {
     principal = { kind: "operator" };
-    actor = "operator";
+    // Page sessions never act as an agent, even if a header names one.
+    const agent = myAgentId && !auth.page ? await getAgentById(myAgentId) : null;
+    actor = agent ? `agent:${agent.id}` : "operator";
+    caller = agent
+      ? { kind: "agent", id: agent.id, name: agent.name }
+      : { kind: "operator", id: null };
   } else if (auth?.kind === "user") {
     principal = { kind: "user", userId: auth.userId };
     actor = `user:${auth.userId}`;
-  } else if (auth?.kind === "guest") {
+    caller = { kind: "user", id: auth.userId, name: auth.user.name };
+  } else if (auth?.kind === "guest" || auth?.kind === "controller") {
     principal = { kind: "guest" };
     actor = "guest";
+    caller = { kind: "guest", id: null };
   } else {
     const agent = myAgentId ? await getAgentById(myAgentId) : null;
     principal = { kind: "agent", agentId: myAgentId ?? "", isLead: agent?.isLead ?? false };
     actor = myAgentId ? `agent:${myAgentId}` : "agent";
+    caller = { kind: "agent", id: myAgentId ?? null, name: agent?.name };
   }
+  if (auth?.page) caller.pageId = auth.page.id;
   const decision = can({
     principal,
     verb,
     resource,
     source: "http",
   });
-  if (decision.allow) return actor;
+  if (decision.allow) return { actor, caller };
   jsonError(res, decision.reason, 403);
   return null;
 }
 
+async function authorizeApp(
+  req: IncomingMessage,
+  res: ServerResponse,
+  myAgentId: string | undefined,
+  verb: "app.manage" | "app.use",
+  resource: RbacResource,
+): Promise<string | null> {
+  return (await authorizeAppCaller(req, res, myAgentId, verb, resource))?.actor ?? null;
+}
+
 async function authorizeAppManage(
   req: IncomingMessage,
   res: ServerResponse,
@@ -736,17 +752,6 @@ function definitionNeedsRepair(
   return true;
 }
 
-/**
- * One `error` string for a sync result, or undefined when every pass succeeded.
- * Each failed pair is named so a multi-pair sync says which one broke; the pass
- * list in `result.passes` carries the rest.
- */
-function syncPassError(sync: Awaited<ReturnType<typeof runAppSync>>): string | undefined {
-  const failed = sync.passes.filter((pass) => pass.error !== undefined);
-  if (failed.length === 0) return undefined;
-  return failed.map((pass) => `${pass.model}.${pass.source}: ${pass.error}`).join("; ");
-}
-
 function snapshotFailure(res: ServerResponse): void {
   jsonError(res, "failed to snapshot app", 500);
 }
@@ -971,6 +976,10 @@ function rowValue(row: AppRow, column: string): unknown {
   return Object.hasOwn(row, column) ? row[column] : undefined;
 }
 
+export function rowMatchesFilters(row: AppRow, filters: RowFilter[]): boolean {
+  return filters.every((filter) => rowValue(row, filter.column) === filter.value);
+}
+
 export function applyQuery(
   rows: AppRow[],
   query: AppQueryDef,
@@ -999,6 +1008,59 @@ export function applyQuery(
   return selected.slice(0, query.limit ?? 200);
 }
 
+export async function selectAppRows(
+  appId: string,
+  modelName: string,
+  model: ModelDef,
+  filters: RowFilter[],
+  sortRaw?: string,
+  limit = 200,
+  systemColumns = false,
+) {
+  // SQL narrows the scan; the `===` re-check keeps the exact filter semantics.
+  const rows = (
+    await listAppRows(
+      appId,
+      modelName,
+      filters.flatMap((filter) =>
+        typeof filter.value === "string" ||
+        typeof filter.value === "number" ||
+        typeof filter.value === "boolean"
+          ? [{ column: filter.column, value: filter.value }]
+          : [],
+      ),
+    )
+  ).filter((row) => rowMatchesFilters(row, filters));
+
+  if (sortRaw) {
+    const [column, dir, extra] = sortRaw.split(":");
+    if (
+      extra !== undefined ||
+      !column ||
+      (dir !== "asc" && dir !== "desc") ||
+      (!SORTABLE_SYSTEM_DATE_COLUMNS.has(column) &&
+        !(systemColumns && Object.hasOwn(SYSTEM_COLUMN_KINDS, column)) &&
+        (!Object.hasOwn(model.columns, column) || model.columns[column]!.hidden === true))
+    ) {
+      throw new AppRowValidationError([
+        { path: "sort", message: "must be <column>:<asc|desc> for a known column" },
+      ]);
+    }
+    rows.sort((a, b) => {
+      const result = compareValues(
+        rowValue(a, column),
+        rowValue(b, column),
+        dir,
+        SORTABLE_SYSTEM_DATE_COLUMNS.has(column) ||
+          (Object.hasOwn(model.columns, column) && model.columns[column]!.kind === "date"),
+      );
+      return result;
+    });
+  }
+  const total = rows.length;
+  return { rows: rows.slice(0, limit), total };
+}
+
 export async function handleApps(
   req: IncomingMessage,
   res: ServerResponse,
@@ -1169,55 +1231,23 @@ export async function handleApps(
       json(res, { error: "invalid row query", issues }, 400);
       return true;
     }
-    // SQL narrows the scan; the `===` re-check keeps the exact filter semantics.
-    const rows = (
-      await listAppRows(
-        parsed.params.id,
-        parsed.params.model,
-        filters.flatMap((filter) =>
-          typeof filter.value === "string" ||
-          typeof filter.value === "number" ||
-          typeof filter.value === "boolean"
-            ? [{ column: filter.column, value: filter.value }]
-            : [],
+    try {
+      listRowsRoute.respond(
+        res,
+        200,
+        await selectAppRows(
+          parsed.params.id,
+          parsed.params.model,
+          resolved.model,
+          filters,
+          parsed.query.sort,
+          parsed.query.limit,
         ),
-      )
-    ).filter((row) => filters.every((filter) => rowValue(row, filter.column) === filter.value));
-    const sortRaw = parsed.query.sort;
-    if (sortRaw) {
-      const [column, dir, extra] = sortRaw.split(":");
-      if (
-        extra !== undefined ||
-        !column ||
-        (dir !== "asc" && dir !== "desc") ||
-        (!SORTABLE_SYSTEM_DATE_COLUMNS.has(column) &&
-          (!Object.hasOwn(resolved.model.columns, column) ||
-            resolved.model.columns[column]!.hidden === true))
-      ) {
-        json(
-          res,
-          {
-            error: "invalid sort",
-            issues: [{ path: "sort", message: "must be <column>:<asc|desc> for a known column" }],
-          },
-          400,
-        );
-        return true;
-      }
-      rows.sort((a, b) => {
-        const result = compareValues(
-          rowValue(a, column),
-          rowValue(b, column),
-          dir,
-          SORTABLE_SYSTEM_DATE_COLUMNS.has(column) ||
-            (Object.hasOwn(resolved.model.columns, column) &&
-              resolved.model.columns[column]!.kind === "date"),
-        );
-        return result;
-      });
+      );
+    } catch (error) {
+      if (!(error instanceof AppRowValidationError)) throw error;
+      json(res, { error: "invalid sort", issues: error.issues }, 400);
     }
-    const total = rows.length;
-    listRowsRoute.respond(res, 200, { rows: rows.slice(0, parsed.query.limit ?? 200), total });
     return true;
   }
 
@@ -1326,8 +1356,12 @@ export async function handleApps(
     if (enforceContentLengthCap(req, res, MAX_APP_ROW_BODY_BYTES) === BODY_TOO_LARGE) return true;
     const parsed = await runActionRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    const actor = await authorizeAppUse(req, res, myAgentId, parsed.params.id);
-    if (!actor) return true;
+    const identity = await authorizeAppCaller(req, res, myAgentId, "app.use", {
+      kind: "app",
+      appId: parsed.params.id,
+    });
+    if (!identity) return true;
+    const { actor, caller } = identity;
 
     const app = await getApp(parsed.params.id);
     if (!app) {
@@ -1335,121 +1369,15 @@ export async function handleApps(
       return true;
     }
     if (definitionNeedsRepair(res, app)) return true;
-    const actions = app.definition.actions;
-    if (!actions || !Object.hasOwn(actions, parsed.params.name)) {
-      jsonError(res, "app action not found", 404);
-      return true;
-    }
-
-    const action = actions[parsed.params.name]!;
-    const input = parsed.body.input ?? {};
-    if (action.kind === "script") {
-      const script = await getScriptById(action.scriptId);
-      if (!script) {
-        json(
-          res,
-          {
-            error: "invalid app action",
-            issues: [
-              {
-                path: `actions.${parsed.params.name}.scriptId`,
-                message: `script "${action.scriptId}" no longer exists`,
-              },
-            ],
-          },
-          400,
-        );
-        return true;
-      }
-
-      // Script actions run with the OWNER's bindings by design: wiring a script
-      // into an app is the owner's delegation. parseAppDefinition enforces at
-      // write time that an agent may only wire scripts it owns (or global ones),
-      // so a foreign script id cannot be smuggled in here. Invoker-brokered
-      // credentials remain a possible future tightening.
-      const runAsAgentId = getSavedScriptOwnerAgentId(script);
-      if (!runAsAgentId) {
-        jsonError(res, "agentId is required: this script has no owning agent to run as", 400);
-        return true;
-      }
-
-      const output = await runSavedScriptAsAgent({
-        script,
-        input: { ...action.args, ...input, app: { id: app.id } },
-        agentId: runAsAgentId,
-      });
-      const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
-      const error = ok
-        ? undefined
-        : output.runtimeError
-          ? `${output.runtimeError.name}: ${output.runtimeError.message}`
-          : (output.error ?? `Script exited with code ${output.exitCode}`);
-      runActionRoute.respond(
-        res,
-        200,
-        scrubObject({
-          ok,
-          result: output.result,
-          stdout: output.stdout,
-          ...(error === undefined ? {} : { error }),
-          durationMs: output.durationMs,
-        }),
-      );
-      return true;
-    }
-
-    if (action.kind === "sync") {
-      const startedAt = Date.now();
-      const sync = await runAppSync({
-        appId: app.id,
-        ...(action.model === undefined ? {} : { model: action.model }),
-        ...(action.source === undefined ? {} : { source: action.source }),
-        invokedBy: actor,
-      });
-      const durationMs = Date.now() - startedAt;
-      if (sync.issues && sync.issues.length > 0) {
-        json(res, { error: "invalid sync action", issues: sync.issues }, 400);
-        return true;
-      }
-      // Deliberately the SCRIPT-action response shape, minus `taskId`:
-      // app-surface.tsx branches on `taskId` first, so omitting it gives the
-      // dashboard running -> ok/error + refetchAll() with zero UI changes.
-      const error = syncPassError(sync);
-      runActionRoute.respond(
-        res,
-        200,
-        scrubObject({
-          ok: sync.ok,
-          result: { passes: sync.passes },
-          ...(error === undefined ? {} : { error }),
-          durationMs,
-        }),
-      );
-      return true;
-    }
-
-    const lead = action.agentId ? null : await getLeadAgent();
-    const taskPrompt = resolveTemplate("task.app.action", {
-      prompt: action.prompt,
-      app_id: app.id,
-      action_name: parsed.params.name,
-      input_json: JSON.stringify(input),
+    const output = await runAppAction({
+      app,
+      name: parsed.params.name,
+      input: parsed.body.input,
+      caller,
+      actor,
     });
-    const task = await createTaskWithSiblingAwareness(
-      taskPrompt.text,
-      {
-        source: "api",
-        agentId: action.agentId ?? lead?.id,
-        routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
-        routingSource: action.agentId || lead ? "engine_default" : undefined,
-        // App-spawned tasks group under the app's asset namespace so a
-        // swarm-tasks source can pull them back via config.assetKey.
-        key: normalizeAssetKey(`shared/app:${app.id}/action:${parsed.params.name}/`),
-        ...(actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}),
-      },
-      { origin: "app" },
-    );
-    runActionRoute.respond(res, 200, { ok: true, taskId: task.id, status: task.status });
+    if (output.status === 200) runActionRoute.respond(res, 200, output.body);
+    else json(res, output.body, output.status);
     return true;
   }
 

package/src/http/config.ts

@@ -31,6 +31,7 @@ import { SwarmConfigSchema } from "../types";
 import { getRequestAuth, type HttpRequestAuth } from "../utils/request-auth-context";
 import { registerVolatileSecret } from "../utils/secret-scrubber";
 import { reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload } from "./core";
+import { syncRankingAfterConfigChange } from "./ranking";
 import { route } from "./route-def";
 import { duplicateGuardedQueryKey, jsonError } from "./utils";
 
@@ -527,6 +528,7 @@ export async function handleConfig(
       if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
         await fillOrgLogoFromWebsite(String(value));
       }
+      if (scope === "global") await syncRankingAfterConfigChange(key, String(value));
       if (scope === "global") {
         scheduleIntegrationsReload();
       }
@@ -561,6 +563,7 @@ export async function handleConfig(
       return true;
     }
     if (existing.scope === "global") {
+      await syncRankingAfterConfigChange(existing.key, null);
       scheduleIntegrationsReload();
     }
     if (

package/src/http/context.ts

@@ -43,6 +43,7 @@ const postContext = route({
   method: "post",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Record a context usage snapshot for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -72,6 +73,7 @@ const getContext = route({
   method: "get",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Get context usage history for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),