@desplega.ai/agent-swarm 2.4.0 → 2.4.2

package/src/http/ranking.ts

@@ -3,13 +3,9 @@ import { z } from "zod";
 import { getDbClient, upsertSwarmConfig } from "../be/db";
 import {
   buildListing,
-  mintRankingClaim,
   PUBLIC_RANKING_ENABLED_KEY,
   RANKING_CATEGORIES,
-  rankingEntryFile,
   rankingFormSchema,
-  rankingLeaveUrl,
-  rankingPrUrl,
   readTelemetryRanking,
   TELEMETRY_RANKING_KEY,
   type TelemetryRanking,
@@ -23,14 +19,14 @@ import {
 } from "../utils/org-identity";
 import { ensureConfigAdmin } from "./config";
 import { scheduleIntegrationsReload } from "./core";
+import { globalConfig } from "./global-config";
 import { route } from "./route-def";
-import { globalConfig, telemetryProxyEndpoint } from "./used-by";
+import { telemetryProxyEndpoint } from "./used-by";
 
 // ─── Schemas ─────────────────────────────────────────────────────────────────
 
 const ListingSchema = z.object({
   v: z.literal(1),
-  claim: z.string(),
   name: z.string(),
   domain: z.string(),
   category: z.enum(RANKING_CATEGORIES),
@@ -49,26 +45,21 @@ const RankingStateSchema = z.object({
   name: z.string().nullable(),
   domain: z.string().nullable(),
   listing: ListingSchema.nullable(),
-  /** False when the stored listing was built for another website: a new PR is needed. */
+  /** False when the stored listing was built for another website: Get ranked again. */
   listingMatchesDomain: z.boolean(),
-  fileJson: z.string().nullable(),
-  prUrl: z.string().nullable(),
+  /** The proxy page that checks whether the domain would be ranked. */
   verifyUrl: z.string().nullable(),
 });
 export type RankingState = z.infer<typeof RankingStateSchema>;
 
 const OptInResponseSchema = z.object({
   domain: z.string(),
-  claim: z.string(),
   listing: ListingSchema,
-  fileJson: z.string(),
-  prUrl: z.string(),
   verifyUrl: z.string(),
 });
 
 const OptOutResponseSchema = z.object({
   enabled: z.literal(false),
-  leaveUrl: z.string().nullable(),
 });
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -79,7 +70,7 @@ const getRanking = route({
   pattern: ["api", "ranking"],
   summary: "Public ranking state",
   description:
-    "Whether this install can join the public agent-swarm.dev ranking (telemetry on, organization name and website set), whether it is opted in, and its stored listing. The listing carries the private ranking claim, so only a config admin can read it.",
+    "Whether this install can join the public agent-swarm.dev ranking (telemetry on, organization name and website set), whether it is opted in, and its stored listing. Only a config admin can read it.",
   tags: ["Telemetry"],
   responses: {
     200: { description: "Ranking state", schema: RankingStateSchema },
@@ -95,7 +86,7 @@ const optIn = route({
   pattern: ["api", "ranking", "opt-in"],
   summary: "Opt this install into the public ranking",
   description:
-    "Builds the telemetry_ranking listing from the organization name and website plus the chosen category, stores it, turns PUBLIC_RANKING_ENABLED on and sends ranking.opted_in. The install is ranked only after a ranking PR with the returned file is merged into desplega-ai/agent-swarm.",
+    "Builds the telemetry_ranking listing from the organization name and website plus the chosen category, stores it, turns PUBLIC_RANKING_ENABLED on and sends ranking.opted_in. That is the whole opt-in: the install shows on agent-swarm.dev/ranking at the next hourly refresh.",
   tags: ["Telemetry"],
   body: rankingFormSchema,
   responses: {
@@ -117,7 +108,7 @@ const optOut = route({
   pattern: ["api", "ranking", "opt-out"],
   summary: "Leave the public ranking",
   description:
-    "Turns PUBLIC_RANKING_ENABLED off and sends ranking.opted_out, so workers stop sending ranking.usage. Returns the GitHub page that deletes the ranking entry.",
+    "Turns PUBLIC_RANKING_ENABLED off and sends ranking.opted_out, so workers stop sending ranking.usage. The install leaves agent-swarm.dev/ranking at the next hourly refresh.",
   tags: ["Telemetry"],
   responses: {
     200: { description: "Opted out", schema: OptOutResponseSchema },
@@ -163,11 +154,17 @@ async function telemetryReady(): Promise<boolean> {
   return isTelemetryEnabled() && Boolean(await globalConfig("telemetry_installation_id"));
 }
 
-async function verifyUrl(listing: Pick<TelemetryRanking, "domain" | "claim">): Promise<string> {
-  const params = new URLSearchParams({ domain: listing.domain, claim: listing.claim });
+async function verifyUrl(domain: string): Promise<string> {
+  const params = new URLSearchParams({ domain });
   return `${await telemetryProxyEndpoint("/v1/ranking/verify")}?${params.toString()}`;
 }
 
+/** The listing without the claim a v2.4.0 opt-in stored. */
+function withoutClaim(listing: TelemetryRanking): Omit<TelemetryRanking, "claim"> {
+  const { claim: _claim, ...rest } = listing;
+  return rest;
+}
+
 async function setEnabled(enabled: boolean): Promise<void> {
   await upsertSwarmConfig({
     scope: "global",
@@ -179,7 +176,7 @@ async function setEnabled(enabled: boolean): Promise<void> {
 function emitOptedIn(listing: TelemetryRanking): void {
   telemetry.ranking(
     "opted_in",
-    { listing: JSON.stringify(listing) },
+    { listing: JSON.stringify(withoutClaim(listing)) },
     { orgName: listing.name, orgWebsite: listing.domain },
   );
 }
@@ -204,17 +201,15 @@ export async function buildRankingState(): Promise<RankingState> {
     enabled: enabled && listingMatchesDomain,
     name: identity.name,
     domain: identity.website,
-    listing,
+    listing: listing ? withoutClaim(listing) : null,
     listingMatchesDomain,
-    fileJson: current ? rankingEntryFile(current) : null,
-    prUrl: current ? rankingPrUrl(current) : null,
-    verifyUrl: current ? await verifyUrl(current) : null,
+    verifyUrl: current ? await verifyUrl(current.domain) : null,
   };
 }
 
 /**
  * Keep the listing in step with the org identity after a global config write.
- * A renamed org rebuilds the listing with the same claim and re-sends it; a
+ * A renamed org rebuilds the listing and re-sends it; a
  * cleared or placeholder name, a changed or cleared website, or the setting
  * turned off by hand opts the install out.
  */
@@ -238,7 +233,7 @@ export async function syncRankingAfterConfigChange(
   if (identity.ok && identity.website === listing.domain) {
     if (identity.name === listing.name) return;
     try {
-      rebuilt = buildListing(identity, listing, listing.claim);
+      rebuilt = buildListing(identity, listing);
     } catch {
       // A name the listing cannot carry (over 60 characters) leaves the ranking.
     }
@@ -272,7 +267,6 @@ export async function handleRanking(
   if (getRanking.match(req.method, pathSegments)) {
     const parsed = await getRanking.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
-    // The state carries the claim and the PR that proves ownership of the listing.
     if (!(await ensureConfigAdmin(req, res, "config.write.any"))) return true;
     getRanking.respond(res, 200, await buildRankingState());
     return true;
@@ -300,16 +294,12 @@ export async function handleRanking(
       return true;
     }
 
-    const website = identity.website;
     const db = getDbClient();
-    // Read the stored claim under the write lock: two concurrent first opt-ins
-    // must return the same claim, or the one merged into community/ranking is lost.
+    // The listing and the flag land together, and the event fires only after both commit.
     const built = await db.transaction(async () => {
-      const stored = await storedListing();
-      const claim = stored?.domain === website ? stored.claim : mintRankingClaim();
       let listing: TelemetryRanking;
       try {
-        listing = buildListing(identity, parsed.body, claim);
+        listing = buildListing(identity, parsed.body);
       } catch (error) {
         return { ok: false as const, error };
       }
@@ -339,11 +329,8 @@ export async function handleRanking(
 
     optIn.respond(res, 200, {
       domain: listing.domain,
-      claim: listing.claim,
       listing,
-      fileJson: rankingEntryFile(listing),
-      prUrl: rankingPrUrl(listing),
-      verifyUrl: await verifyUrl(listing),
+      verifyUrl: await verifyUrl(listing.domain),
     });
     return true;
   }
@@ -356,10 +343,7 @@ export async function handleRanking(
     await setEnabled(false);
     if (listing) emitOptedOut(listing.domain);
     scheduleIntegrationsReload();
-    optOut.respond(res, 200, {
-      enabled: false,
-      leaveUrl: listing ? rankingLeaveUrl(listing.domain) : null,
-    });
+    optOut.respond(res, 200, { enabled: false });
     return true;
   }
 

package/src/http/status.ts

@@ -197,7 +197,7 @@ export type AutomationStatus = z.infer<typeof AutomationStatusSchema>;
  * - `broken`  — harness or workers blocking (creds missing, no live workers ever).
  * - `degraded` — at least one optional integration `unverified`/`configured`
  *                 while another is configured, OR harness creds present but
- *                 never tested (`configured`).
+ *                 the latest live test failed or never ran (`configured`).
  * - `ok`       — harness + workers `verified`; no integration left in
  *                 `configured` state.
  */
@@ -237,12 +237,12 @@ export const TestConnectionResponseSchema = z.object({
 /**
  * Read all worker reports for a given harness provider and reduce them to a
  * single milestone-grade rollup. Reports are joined from `agents.cred_status`
- * (migration 055) — no provider-adapter code runs here.
+ * (migration 055) — no provider-adapter code runs here. Offline agents are
+ * excluded: `workers` and `reports` count online agents only.
  *
- * `verified` ⇐ at least one worker has `liveTest.ok === true` and the test
- *   is fresher than `getCredVerifyTtlMs()`.
+ * `verified` ⇐ the provider's most recent live test passed, whatever its age.
  * `configured` ⇐ at least one worker has `ready: true` (presence check
- *   passed) but no fresh passing live test.
+ *   passed) but the latest live test failed or none ever ran.
  * `unverified` ⇐ no worker reported, or all reporting workers have
  *   `ready: false`.
  */
@@ -258,14 +258,6 @@ export interface CredRollup {
   oldestReportAgeMs: number | null;
 }
 
-function getCredVerifyTtlMs(): number {
-  const raw = process.env.SWARM_VERIFY_TTL_MS;
-  if (!raw) return 3_600_000; // 1h default — matches pre-refactor behavior.
-  const parsed = Number.parseInt(raw, 10);
-  if (Number.isNaN(parsed) || parsed <= 0) return 3_600_000;
-  return parsed;
-}
-
 /**
  * Compatibility stub. The pre-refactor in-memory test-connection cache is
  * gone — credential state now lives on agent rows. Tests still call this
@@ -276,7 +268,11 @@ export function _resetTestConnectionCache(): void {
 }
 
 export async function rollupCredStatusForProvider(provider: string): Promise<CredRollup> {
-  const agents = await listAgentsWithCredStatusByProvider(provider);
+  // An offline agent keeps its last cred_status after `/close`, so only online
+  // agents decide the rollup; a stale failure must not override a live pass.
+  const agents = (await listAgentsWithCredStatusByProvider(provider)).filter(
+    (a) => a.status !== "offline",
+  );
   const reports = agents.map((a) => a.credStatus).filter((s): s is AgentCredStatus => s != null);
 
   if (reports.length === 0) {
@@ -291,23 +287,19 @@ export async function rollupCredStatusForProvider(provider: string): Promise<Cre
     };
   }
 
-  // Pick the most-recent passing live test, if any, then fall back to
-  // most-recent live test of any kind.
-  const ttl = getCredVerifyTtlMs();
+  // The provider's latest live test decides, whatever its age. Workers run the
+  // test at boot and re-run it only when credentials change, so an old pass is
+  // the normal state of a long-running worker, not a missing check.
   const now = Date.now();
-  const isFreshPassingReport = (report: AgentCredStatus): boolean =>
-    report.liveTest?.ok === true && now - (report.liveTest?.testedAt ?? 0) < ttl;
-  const passing = reports
-    .filter(isFreshPassingReport)
-    .sort((a, b) => (b.liveTest?.testedAt ?? 0) - (a.liveTest?.testedAt ?? 0));
+  const passing = reports.filter((r) => r.liveTest?.ok === true);
   const anyLive = reports
     .filter((r) => r.liveTest != null)
     .sort((a, b) => (b.liveTest?.testedAt ?? 0) - (a.liveTest?.testedAt ?? 0));
-  const latestLiveTest = passing[0]?.liveTest ?? anyLive[0]?.liveTest ?? null;
+  const latestLiveTest = anyLive[0]?.liveTest ?? null;
 
   const anyReady = reports.some((r) => r.ready);
   const state: CredRollupState =
-    passing.length > 0 ? "verified" : anyReady ? "configured" : "unverified";
+    latestLiveTest?.ok === true ? "verified" : anyReady ? "configured" : "unverified";
 
   // For UI hints, pick the most-recent missing[] from a not-ready report.
   const latestNotReady = reports
@@ -349,23 +341,19 @@ function buildIdentity(): StatusIdentity {
 // ─── Setup milestones ────────────────────────────────────────────────────────
 
 /**
- * Compose a one-line, per-provider description for the milestone hint.
- * Examples:
- *   "1 worker · live test ok"
- *   "2 workers · presence ok, awaiting live test"
- *   "missing: OPENAI_API_KEY"
+ * One short phrase for a provider that needs attention, e.g. "live test
+ * failed" or "missing: OPENAI_API_KEY". A verified provider gets none.
  */
-function describeRoll(roll: CredRollup): string {
+function describeRoll(roll: CredRollup): string | null {
+  if (roll.state === "verified") return null;
   if (roll.workers === 0) return "no workers";
-  if (roll.reports === 0) {
-    return `${roll.workers} ${roll.workers === 1 ? "worker" : "workers"}, none reported`;
+  if (roll.reports === 0) return "no credential report";
+  if (roll.state === "configured") {
+    return roll.latestLiveTest?.ok === false ? "live test failed" : "not live-tested";
   }
-  const w = `${roll.workers} ${roll.workers === 1 ? "worker" : "workers"}`;
-  if (roll.state === "verified") return `${w} · live test ok`;
-  if (roll.state === "configured") return `${w} · presence ok, awaiting live test`;
   return roll.latestMissing.length > 0
     ? `missing: ${roll.latestMissing.join(", ")}`
-    : "creds blocked";
+    : "credentials blocked";
 }
 
 /**
@@ -375,7 +363,7 @@ function describeRoll(roll: CredRollup): string {
  * workers via migration 054/055), runs the cred-status rollup per provider,
  * and aggregates:
  *
- *   `verified`  — every provider in the fleet has a fresh passing live test.
+ *   `verified`  — every provider's latest live test passed.
  *   `configured` — every provider has at least `configured`, ≥1 not verified.
  *   `unverified` — any provider has `unverified` (no reports OR all-blocked).
  *
@@ -398,13 +386,25 @@ async function harnessMilestone(): Promise<SetupMilestone> {
   }
 
   const perProvider: { provider: z.infer<typeof ProviderNameSchema>; roll: CredRollup }[] = [];
+  let recognised = 0;
   for (const { provider } of fleet) {
     const parsed = ProviderNameSchema.safeParse(provider);
     if (!parsed.success) continue;
-    perProvider.push({
-      provider: parsed.data,
-      roll: await rollupCredStatusForProvider(parsed.data),
-    });
+    recognised++;
+    const roll = await rollupCredStatusForProvider(parsed.data);
+    // A provider whose agents are all offline has nothing live to judge.
+    if (roll.workers === 0) continue;
+    perProvider.push({ provider: parsed.data, roll });
+  }
+
+  if (recognised > 0 && perProvider.length === 0) {
+    return {
+      id: "harness",
+      label: "Harness configured",
+      state: "unverified",
+      hint: "No agents online. Start a worker to run a live credential test.",
+      action_url: "/agents",
+    };
   }
 
   if (perProvider.length === 0) {
@@ -424,7 +424,13 @@ async function harnessMilestone(): Promise<SetupMilestone> {
       ? "configured"
       : "unverified";
 
-  const hint = perProvider.map((p) => `${p.provider}: ${describeRoll(p.roll)}`).join(" · ");
+  const hint =
+    perProvider
+      .flatMap((p) => {
+        const phrase = describeRoll(p.roll);
+        return phrase ? [`${p.provider}: ${phrase}`] : [];
+      })
+      .join(" · ") || undefined;
   const singleProvider = perProvider.length === 1 ? perProvider[0]?.provider : undefined;
 
   return {
@@ -848,7 +854,7 @@ export async function handleStatus(
     if (roll.workers === 0) {
       json(res, {
         ok: false,
-        error: `No workers registered with HARNESS_PROVIDER=${provider}. Start a worker — its boot loop will run a live test and report it here.`,
+        error: `No online workers with HARNESS_PROVIDER=${provider}. Start a worker — its boot loop will run a live test and report it here.`,
         latency_ms: 0,
       });
       return true;

package/src/http/tasks.ts

@@ -20,6 +20,7 @@ import {
   getSteeringMessagesForTask,
   getTaskAttachments,
   getTaskById,
+  getTaskLineage,
   getTasksCount,
   markSteeringDelivered,
   markSteeringHandled,
@@ -29,6 +30,7 @@ import {
   resumeTask,
   settleSupersededTaskDependents,
   supersedeTask,
+  TASK_LINEAGE_LIMITS,
   updateAgentStatusFromCapacity,
   updateTaskClaudeSessionId,
   updateTaskProgress,
@@ -73,6 +75,7 @@ import {
   SteeringSourceSchema,
   SteerModeSchema,
   SteerResultSchema,
+  SUPERSEDED_WORKFLOW_TASK_REASON,
   splitLegacyModelAlias,
   TaskAttachmentSchema,
 } from "../types";
@@ -577,6 +580,33 @@ const getTask = route({
   },
 });
 
+const getTaskLineageRoute = route({
+  method: "get",
+  path: "/api/tasks/{id}/lineage",
+  pattern: ["api", "tasks", null, "lineage"],
+  session: { taskParam: "id" },
+  summary: "Get the tree a task belongs to (ancestors and descendants)",
+  description: `Follows \`parentTaskId\` up to the topmost ancestor, then returns every descendant of that root as slim task rows, the task's own subtree first. Bounded: at most ${TASK_LINEAGE_LIMITS.maxAncestors} hops up, \`maxDepth\` levels down and about twice \`maxNodes\` rows; \`truncated\` is true when any task in the tree is missing from the response.`,
+  tags: ["Tasks"],
+  params: z.object({ id: z.string() }),
+  query: z.object({
+    maxNodes: z.coerce.number().int().min(1).max(TASK_LINEAGE_LIMITS.maxNodes).optional(),
+    maxDepth: z.coerce.number().int().min(1).max(TASK_LINEAGE_LIMITS.maxDepth).optional(),
+  }),
+  responses: {
+    200: {
+      description: "The lineage tree as a flat list linked by `parentTaskId`",
+      schema: z.object({
+        rootTaskId: z.string(),
+        tasks: z.array(AgentTaskSummarySchema.extend({ workflowRunId: z.string().optional() })),
+        truncated: z.boolean(),
+      }),
+    },
+    403: { description: "A user caller cannot read the task's session" },
+    404: { description: "Task not found" },
+  },
+});
+
 const updateTaskProgressRoute = route({
   method: "post",
   path: "/api/tasks/{id}/progress",
@@ -1120,6 +1150,8 @@ export async function handleTasks(
           offeredTo: parsed.body.offeredTo || undefined,
           dir: parsed.body.dir || undefined,
           parentTaskId: parsed.body.parentTaskId || undefined,
+          // Human chat starts a new output contract; agent children keep inheriting.
+          inheritParentOutputSchema: principal.kind === "agent",
           source: parsed.body.source || "api",
           outputSchema: parsed.body.outputSchema || undefined,
           contextKey: parsed.body.contextKey || undefined,
@@ -1614,6 +1646,22 @@ export async function handleTasks(
     return true;
   }
 
+  if (getTaskLineageRoute.match(req.method, pathSegments)) {
+    const parsed = await getTaskLineageRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    // Every task in the tree shares the session root, so the path posture covers them all.
+    const lineage = await getTaskLineage(parsed.params.id, {
+      maxNodes: parsed.query.maxNodes,
+      maxDepth: parsed.query.maxDepth,
+    });
+    if (!lineage) {
+      jsonError(res, "Task not found", 404);
+      return true;
+    }
+    getTaskLineageRoute.respond(res, 200, lineage);
+    return true;
+  }
+
   if (updateTaskProgressRoute.match(req.method, pathSegments)) {
     const parsed = await updateTaskProgressRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
@@ -2014,7 +2062,7 @@ export async function handleTasks(
     // Check this BEFORE the supersede UPDATE so we don't leave a workflow
     // step in `superseded` if the engine expects `failed`.
     if (task.workflowRunStepId != null) {
-      const failed = await failTask(parsed.params.id, "superseded_workflow_task");
+      const failed = await failTask(parsed.params.id, SUPERSEDED_WORKFLOW_TASK_REASON);
       ensure({
         id: "task.workflow_step_failed_on_supersede",
         flow: "task",

package/src/http/telemetry-ui.ts

@@ -43,7 +43,7 @@ const enableTelemetry = route({
   description:
     "Stores `ANONYMIZED_TELEMETRY=true` and applies it to the running server: the install ID is minted if needed and `telemetry.enabled` is sent once, so no restart is needed.",
   tags: ["Telemetry"],
-  body: z.object({ via: z.enum(["banner", "settings"]).default("banner") }),
+  body: z.object({ via: z.enum(["banner", "settings", "benchmark"]).default("banner") }),
   responses: {
     200: {
       description: "Telemetry is on",

package/src/http/used-by.ts

@@ -1,12 +1,14 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
-import { getSwarmConfigs, upsertSwarmConfig } from "../be/db";
+import { getDbClient, upsertSwarmConfig } from "../be/db";
 import { isTelemetryEnabled, trackRelayed } from "../telemetry";
+import { USER_FUNCTIONS } from "../utils/company-profile";
 import { orgIdentityStatus } from "../utils/org-identity";
 import { normalizeOrgWebsite, TELEMETRY_PROXY_ORIGIN } from "../utils/org-website";
 import { ensureConfigAdmin } from "./config";
 import { scheduleIntegrationsReload } from "./core";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
+import { globalConfig } from "./global-config";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -16,6 +18,9 @@ const CONSENT_AT_KEY = "SWARM_USED_BY_CONSENT_AT";
 // still reaches the proxy after the name or website is changed or cleared.
 const GRANTED_NAME_KEY = "SWARM_USED_BY_ORG_NAME";
 const GRANTED_WEBSITE_KEY = "SWARM_USED_BY_ORG_WEBSITE";
+const CONTACT_EMAIL_KEY = "SWARM_USED_BY_CONTACT_EMAIL";
+const CONTACT_FUNCTION_KEY = "SWARM_USED_BY_CONTACT_FUNCTION";
+const QUOTE_KEY = "SWARM_USED_BY_QUOTE";
 const TIMEOUT_MS = 10_000;
 
 // ─── Route Definitions ───────────────────────────────────────────────────────
@@ -26,17 +31,30 @@ const usedBy = route({
   pattern: ["api", "used-by"],
   summary: "Grant or revoke the 'used by' logo consent",
   description:
-    "Records whether agent-swarm.dev may show this organization's logo as a company that uses Agent Swarm. Sends the organization name and website to the telemetry proxy, where a person approves each logo by hand. An explicit admin action, so it is not gated by the telemetry opt-out.",
+    "Records consent to show the organization's logo on agent-swarm.dev. A grant requires a valid contact email. It sends organization identity, contact details, and an optional quote to the proxy for manual review. This explicit admin action works when telemetry is off. A revoke clears the stored contact details and quote.",
   tags: ["Telemetry"],
-  body: z.object({ granted: z.boolean() }),
+  body: z
+    .object({
+      granted: z.boolean(),
+      contactEmail: z
+        .string()
+        .max(320, "Contact email must be at most 320 characters")
+        .email("Contact email must be a valid email address")
+        .optional(),
+      contactFunction: z.enum(USER_FUNCTIONS).optional(),
+      quote: z.string().max(280).optional(),
+    })
+    .refine((body) => !body.granted || body.contactEmail !== undefined, {
+      path: ["contactEmail"],
+      message: "Contact email is required when granting logo consent",
+    }),
   responses: {
     200: {
       description: "Consent recorded",
       schema: z.object({ granted: z.boolean(), changedAt: z.string() }),
     },
     400: {
-      description:
-        "Organization name or website is not set (a revoke falls back to the identity of the last grant)",
+      description: "Invalid contact details, or missing organization name or website",
     },
     401: { description: "Unauthorized" },
     403: { description: "Only a config admin can change the consent" },
@@ -47,12 +65,6 @@ const usedBy = route({
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
-/** A global config value, falling back to the process env. */
-export async function globalConfig(key: string): Promise<string | undefined> {
-  const stored = (await getSwarmConfigs({ scope: "global", key }))?.[0]?.value?.trim();
-  return stored || process.env[key]?.trim() || undefined;
-}
-
 /** A proxy path next to the configured `/v1/feedback` endpoint, so a stubbed proxy gets every route. */
 export async function telemetryProxyEndpoint(path: `/v1/${string}`): Promise<string> {
   const feedback = await globalConfig("feedback_endpoint");
@@ -80,7 +92,7 @@ export async function handleUsedBy(
   if (!parsed) return true;
   if (!(await ensureConfigAdmin(req, res, "config.write.any"))) return true;
 
-  const { granted } = parsed.body;
+  const { granted, contactEmail, contactFunction, quote } = parsed.body;
   // The shared identity reader. The grant keeps its own rule (any non-empty
   // name), so it does not apply the ranking's placeholder-name check.
   const current = orgIdentityStatus({
@@ -116,6 +128,9 @@ export async function handleUsedBy(
         org_website: orgWebsite,
         ...(orgDomain ? { org_domain: orgDomain } : {}),
         granted,
+        ...(granted
+          ? { contact_email: contactEmail, contact_function: contactFunction, quote }
+          : {}),
         changed_at: changedAt,
       }),
       signal: AbortSignal.timeout(TIMEOUT_MS),
@@ -129,18 +144,39 @@ export async function handleUsedBy(
     return true;
   }
 
-  await upsertSwarmConfig({ scope: "global", key: CONSENT_KEY, value: String(granted) });
-  await upsertSwarmConfig({ scope: "global", key: CONSENT_AT_KEY, value: changedAt });
-  if (granted) {
-    await upsertSwarmConfig({ scope: "global", key: GRANTED_NAME_KEY, value: orgName });
-    await upsertSwarmConfig({ scope: "global", key: GRANTED_WEBSITE_KEY, value: orgWebsite });
-  }
+  await getDbClient().transaction(async () => {
+    await upsertSwarmConfig({ scope: "global", key: CONSENT_KEY, value: String(granted) });
+    await upsertSwarmConfig({ scope: "global", key: CONSENT_AT_KEY, value: changedAt });
+    if (granted) {
+      await upsertSwarmConfig({ scope: "global", key: GRANTED_NAME_KEY, value: orgName });
+      await upsertSwarmConfig({ scope: "global", key: GRANTED_WEBSITE_KEY, value: orgWebsite });
+    }
+    // Contact details stay out of agent env. The email is also a secret row,
+    // so `GET /api/config` masks it for every reader.
+    for (const [key, value, isSecret] of [
+      [CONTACT_EMAIL_KEY, contactEmail, true],
+      [CONTACT_FUNCTION_KEY, contactFunction, false],
+      [QUOTE_KEY, quote, false],
+    ] as const) {
+      await upsertSwarmConfig({
+        scope: "global",
+        key,
+        value: granted ? (value ?? "") : "",
+        isSecret,
+        exportToEnv: false,
+      });
+    }
+  });
   scheduleIntegrationsReload();
 
   const owner = await resolveHttpFavoriteOwner(req, myAgentId);
   trackRelayed(
     "used_by.consent_changed",
-    { granted },
+    {
+      granted,
+      has_quote: granted && Boolean(quote),
+      has_function: granted && Boolean(contactFunction),
+    },
     { actor: owner?.userId ? { userId: owner.userId } : undefined, emitter: "ui" },
   );
   usedBy.respond(res, 200, { granted, changedAt });

package/src/http/users.ts

@@ -205,7 +205,7 @@ const createUserRoute = route({
   tags: ["Users"],
   body: z.object({
     name: z.string().min(1),
-    email: z.string().optional(),
+    email: z.string().email("Email must be a valid email address").optional(),
     role: z.string().optional(),
     notes: z.string().optional(),
     emailAliases: z.array(z.string()).optional(),
@@ -307,7 +307,7 @@ const updateUserRoute = route({
   body: z
     .object({
       name: z.string().min(1).optional(),
-      email: z.string().optional(),
+      email: z.string().email("Email must be a valid email address").nullable().optional(),
       role: z.string().optional(),
       notes: z.string().optional(),
       emailAliases: z.array(z.string()).optional(),

package/src/providers/acp-targets.ts

@@ -359,7 +359,7 @@ const copilotTargetProfile: AcpTargetProfile = {
   },
 };
 
-/** Qwen Code's `--auth-type` choices (0.25.2). `qwen-oauth` needs a browser, so it is left out. */
+/** Qwen Code's `--auth-type` choices (0.25.3). `qwen-oauth` needs a browser, so it is left out. */
 const QWEN_AUTH_TYPES = ["openai", "openai-responses", "anthropic", "gemini", "vertex-ai"] as const;
 
 // Qwen Code is a Gemini CLI fork: QWEN_SYSTEM_MD replaces its built-in prompt

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792324855-g9c86a5";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792411243-gb8cffc";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";