@desplega.ai/agent-swarm 2.4.2 → 2.4.4

package/src/http/tasks.ts

@@ -87,6 +87,7 @@ import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { bodyTask, route } from "./route-def";
 import {
   canReadSession,
+  denyParentAttach,
   readableByFor,
   resolveSessionActor,
   SESSION_READ_DENIED,
@@ -779,16 +780,6 @@ const updateTaskTitleRoute = route({
   },
 });
 
-/** True unless the request acts for a user who lacks write access to the task's session. */
-async function hasSessionWrite(
-  req: IncomingMessage,
-  myAgentId: string | undefined,
-  taskId: string,
-): Promise<boolean> {
-  const access = await sessionAccessFor(await resolveSessionActor(req, myAgentId), taskId);
-  return hasSessionAccess(access, "write");
-}
-
 async function canSteerTask(
   req: IncomingMessage,
   myAgentId: string | undefined,
@@ -1069,29 +1060,10 @@ export async function handleTasks(
       ? await getTaskById(parsed.body.parentTaskId)
       : null;
     // The child inherits the parent's thread context, so an agent caller must own or
-    // have created the parent. Operator and user callers keep their access.
+    // have created the parent, and a follow-up in someone else's session needs a
+    // write share. The same gate guards app actions that chain under a task.
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
-    if (
-      parentTask &&
-      !can({
-        principal,
-        verb: "task.parent.attach",
-        resource: {
-          kind: "task",
-          taskId: parentTask.id,
-          requestedByUserId: parentTask.requestedByUserId,
-          creatorAgentId: parentTask.creatorAgentId,
-          agentId: parentTask.agentId,
-        },
-        source: "http",
-      }).allow
-    ) {
-      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
-      return true;
-    }
-    // A follow-up in someone else's session needs a write share.
-    if (parentTask && !(await hasSessionWrite(req, myAgentId, parentTask.id))) {
-      jsonError(res, SESSION_WRITE_DENIED, 403);
+    if (parentTask && (await denyParentAttach(req, res, myAgentId, parentTask, principal))) {
       return true;
     }
     // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator

package/src/providers/acp-adapter.ts

@@ -1,15 +1,21 @@
+// `/unstable` keeps the full ACP v1 surface the 1.x default import carried:
+// turn `usage` on the prompt response is unstable, and the stable entrypoint
+// does not type it. Both entrypoints speak ACP v1 on the wire.
 import {
-  type Client,
-  ClientSideConnection,
+  client as acpClient,
+  type ClientContext,
   type McpServer,
+  methods,
   ndJsonStream,
   PROTOCOL_VERSION,
   type RequestPermissionRequest,
   type RequestPermissionResponse,
   type SessionConfigOption,
   type SessionNotification,
+  type SetSessionConfigOptionRequest,
+  type SetSessionConfigOptionResponse,
   type Usage,
-} from "@agentclientprotocol/sdk";
+} from "@agentclientprotocol/sdk/unstable";
 import pkg from "../../package.json";
 import type { AcpSessionConfigOption } from "../types";
 import { mintAcpSessionToken, revokeAcpSessionToken } from "../utils/acp-session-token";
@@ -154,7 +160,7 @@ function boundedAcpLogScalar(value: unknown): unknown {
   return typeof value === "string" ? value.slice(0, 500) : value;
 }
 
-class SwarmAcpClient implements Client {
+class SwarmAcpClient {
   /** Latest cumulative USD cost the target reported for the session. */
   reportedCostUsd: number | null = null;
 
@@ -199,7 +205,7 @@ class ACPSession implements ProviderSession {
   private ephemeralTokenId: string | null = null;
 
   constructor(
-    private readonly connection: ClientSideConnection,
+    private readonly agent: ClientContext,
     private readonly client: SwarmAcpClient,
     private readonly process: Bun.Subprocess<"pipe", "pipe", "pipe">,
     private readonly config: ProviderSessionConfig,
@@ -234,7 +240,7 @@ class ACPSession implements ProviderSession {
     if (this.aborted) return;
     this.aborted = true;
     try {
-      await this.connection.cancel({ sessionId: this.sessionId });
+      await this.agent.notify(methods.agent.session.cancel, { sessionId: this.sessionId });
       await Promise.race([this.completionPromise, Bun.sleep(ACP_CANCEL_SETTLE_MS)]);
     } catch (err) {
       this.emit({
@@ -282,7 +288,7 @@ class ACPSession implements ProviderSession {
   private async runPrompt(): Promise<void> {
     let result: ProviderResult;
     try {
-      const response = await this.connection.prompt({
+      const response = await this.agent.request(methods.agent.session.prompt, {
         sessionId: this.sessionId,
         prompt: [{ type: "text", text: this.config.prompt }],
       });
@@ -441,11 +447,16 @@ export class ACPAdapter implements ProviderAdapter {
       else preSessionEvents.push(event);
     }, target);
     const stream = ndJsonStream(fileSinkWritableStream(proc.stdin), proc.stdout);
-    const connection = new ClientSideConnection(() => client, stream);
+    const agent = acpClient()
+      .onRequest(methods.client.session.requestPermission, ({ params }) =>
+        client.requestPermission(params),
+      )
+      .onNotification(methods.client.session.update, ({ params }) => client.sessionUpdate(params))
+      .connect(stream).agent;
 
     let ephemeralToken: { tokenId: string; plaintext: string } | null = null;
     try {
-      await connection.initialize({
+      await agent.request(methods.agent.initialize, {
         protocolVersion: PROTOCOL_VERSION,
         clientInfo: { name: "agent-swarm", version: pkg.version },
         clientCapabilities: { session: { configOptions: { boolean: {} } } },
@@ -473,7 +484,7 @@ export class ACPAdapter implements ProviderAdapter {
       // shape for an ACP agent with no network route to the swarm API. Gated on
       // `mcpCapabilities.acp` and UNSTABLE; not adopted here.
       const sessionMeta = target.sessionMeta?.(config);
-      const newSession = await connection.newSession({
+      const newSession = await agent.request(methods.agent.session.new, {
         ...(sessionMeta ? { _meta: sessionMeta } : {}),
         cwd: config.cwd,
         mcpServers: [
@@ -491,13 +502,16 @@ export class ACPAdapter implements ProviderAdapter {
         ],
       });
       const configOptions = await applyConfiguredOptions(
-        connection,
+        {
+          setSessionConfigOption: (params) =>
+            agent.request(methods.agent.session.setConfigOption, params),
+        },
         newSession.sessionId,
         newSession.configOptions ?? [],
         target.configuredOptions(config),
       );
       session = new ACPSession(
-        connection,
+        agent,
         client,
         proc,
         config,
@@ -537,8 +551,14 @@ export class ACPAdapter implements ProviderAdapter {
   }
 }
 
+export interface AcpConfigOptionSetter {
+  setSessionConfigOption(
+    params: SetSessionConfigOptionRequest,
+  ): Promise<SetSessionConfigOptionResponse>;
+}
+
 export async function applyConfiguredOptions(
-  connection: Pick<ClientSideConnection, "setSessionConfigOption">,
+  connection: AcpConfigOptionSetter,
   sessionId: string,
   advertised: SessionConfigOption[],
   configured: Record<string, string | boolean>,

package/src/providers/acp-swarm-events.ts

@@ -3,7 +3,7 @@ import type {
   SessionNotification,
   SessionUpdate,
   ToolCallUpdate,
-} from "@agentclientprotocol/sdk";
+} from "@agentclientprotocol/sdk/unstable";
 import type { ProviderEvent } from "./types";
 
 function contentToText(content: ContentBlock): string {

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792411243-gb8cffc";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792506219-g025e7e";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/providers/codex-adapter.ts

@@ -37,7 +37,7 @@ import {
   clampContextPercent,
   computeContextUsedUnified,
 } from "../utils/context-window";
-import { isEnvFlagEnabled } from "../utils/env-flag";
+import { isEnvFlagEnabled, isSessionSummarySkipped } from "../utils/env-flag";
 import { SessionErrorTracker } from "../utils/error-tracker";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
 import { getMemoryRaterNames } from "../utils/memory-raters";
@@ -1739,8 +1739,8 @@ export class CodexSession implements ProviderSession {
     } finally {
       // Session-end summarization. Pure addition for codex — no behavior to
       // preserve. Wrapped in its own try/catch so summary failure must NOT
-      // block the existing log/AGENTS.md cleanup below. Gate `SKIP_SESSION_SUMMARY=1`
-      // matches the parity convention used by the claude Stop hook + pi/opencode.
+      // block the existing log/AGENTS.md cleanup below. `SKIP_SESSION_SUMMARY` is
+      // read with `isSessionSummarySkipped`, the same as the claude Stop hook + pi/opencode.
       //
       // Skip the summary entirely when the session was aborted. The transcript
       // is incomplete, the LLM call would retry 3× through openrouter and
@@ -1751,7 +1751,7 @@ export class CodexSession implements ProviderSession {
         this.aborted ||
         this.abortController?.signal.aborted === true ||
         this.pendingResult?.exitCode === 130;
-      if (process.env.SKIP_SESSION_SUMMARY !== "1" && !sessionWasAborted) {
+      if (!isSessionSummarySkipped() && !sessionWasAborted) {
         try {
           await this.summarizeAtEnd();
         } catch (err) {

package/src/providers/codex-oauth/storage.ts

@@ -364,7 +364,7 @@ export async function persistCodexOAuth(
  * once it was issued more than that long ago (see {@link isStaleByAge}) — on
  * top of the near-expiry skew above, not instead of it. This is how the
  * locked keep-warm sweep (`POST /api/oauth/keep-warm/codex`) reuses this same
- * function to refresh slots proactively (~weekly, `maxAgeMs` ≈ 7 days) rather
+ * function to refresh slots proactively (`maxAgeMs` default 5 days) rather
  * than waiting for a task to draw a slot within `REFRESH_SKEW_MS` of expiry.
  * Default behavior (opts omitted) is unchanged.
  *

package/src/providers/opencode-adapter.ts

@@ -31,7 +31,7 @@ import {
   splitCredentialPool,
   validateOpencodeCredentials,
 } from "../utils/credentials";
-import { isEnvFlagEnabled } from "../utils/env-flag";
+import { isEnvFlagEnabled, isSessionSummarySkipped } from "../utils/env-flag";
 import { fetchInstalledMcpServers } from "../utils/mcp-server-fetcher";
 import { swarmRuntimeInstanceId } from "../utils/multi-runtime";
 import {
@@ -797,7 +797,7 @@ export class OpencodeSession implements ProviderSession {
   /** Identity sync, session summary, and session close (Stop-hook parity). */
   private async runSessionEnd(signal: AbortSignal): Promise<void> {
     await sessionHooks.syncIdentity(this.swarm, "session_sync", signal);
-    if (process.env.SKIP_SESSION_SUMMARY) {
+    if (isSessionSummarySkipped()) {
       console.debug("session_summary skipped (opencode): SKIP_SESSION_SUMMARY is set");
     } else {
       const transcript = this.transcript.join("\n").slice(-TRANSCRIPT_TAIL_CHARS);

package/src/providers/pi-mono-extension.ts

@@ -10,6 +10,7 @@ import type { ExtensionFactory, McpServerConfig } from "@earendil-works/pi-codin
 import { buildRatingsFromLlm, fetchRetrievalsForTask, postRatings } from "../be/memory/raters/llm";
 import { checkToolLoop, clearToolHistory } from "../hooks/tool-loop-detection";
 import { renderGoalReminder } from "../prompts/goal-reminder";
+import { isSessionSummarySkipped } from "../utils/env-flag";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
 import { getMemoryRaterNames } from "../utils/memory-raters";
 import { getOpenRouterAttributionHeaders } from "../utils/openrouter-base-url";
@@ -743,7 +744,7 @@ export function createSwarmHooksExtension(config: SwarmHooksConfig): ExtensionFa
 
       // Session summarization — get session file from context's session manager
       const sessionFile = ctx.sessionManager.getSessionFile?.();
-      if (!process.env.SKIP_SESSION_SUMMARY) {
+      if (!isSessionSummarySkipped()) {
         await summarizeSessionForPi(config, sessionFile);
       } else {
         console.debug("session_summary skipped (pi): SKIP_SESSION_SUMMARY is set");

package/src/rbac/legacy-policy.ts

@@ -318,7 +318,7 @@ export const LEGACY_POLICY = {
   "config.write.any": leadOnly,
   "config.delete.any": leadOnly,
   "config.read.secrets": leadOnly,
-  // HTTP runtime tokens can read their own resolved config in src/http/config.ts.
+  // HTTP runtime and agent tokens can read their own resolved config in src/http/config.ts.
   // Lead tokens retain config.read.secrets. This exception does not grant config administration.
   "models.catalog.write": leadOrOperator,
   "models.harness-support.write": agentOrOperator,
@@ -356,6 +356,8 @@ export const LEGACY_POLICY = {
   "runtime_pool.write": operatorOrUser,
   "runtime_pool.bind": leadOrOperatorOrUser,
   "runtime_controller.write": operatorOrUser,
+  // A worker token stands in for the swarm API key on a worker, so only humans mint it.
+  "agent.token.manage": operatorOrUser,
   "extension.write": extensionWrite,
   "extension.activate": extensionActivation,
   "extension.install.inline": leadOrOperatorOrUser,

package/src/rbac/permissions.ts

@@ -33,6 +33,10 @@ export const PERMISSIONS = {
     description: "View or diff another agent's context history.",
     namespace: "agent",
   },
+  "agent.token.manage": {
+    description: "Mint, rotate, or revoke an agent-bound worker token.",
+    namespace: "agent",
+  },
   "task.cancel.any": {
     description: "Cancel any task (beyond tasks the caller created).",
     namespace: "task",

package/src/tests/acp-adapter.test.ts

@@ -3,7 +3,7 @@ import { chmodSync, existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { Usage } from "@agentclientprotocol/sdk";
+import type { Usage } from "@agentclientprotocol/sdk/unstable";
 import { normalizeSessionLogs } from "../../apps/ui/src/logs-parser";
 import {
   closeDb,
@@ -29,6 +29,7 @@ import {
   resolveAcpTarget,
 } from "../providers/acp-targets";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { ACP_SDK_PATH, serveFakeAcpAgent } from "./acp-fake-agent";
 import { listenOnFreePort } from "./test-net";
 
 const tmpDirs: string[] = [];
@@ -148,16 +149,11 @@ describe("ACPAdapter", () => {
   }) => {
     const cwd = makeTempDir();
     const agentPath = join(cwd, "fake-acp-agent.ts");
-    const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
     await Bun.write(
       agentPath,
       `
 import { Readable, Writable } from "node:stream";
-import {
-  AgentSideConnection,
-  PROTOCOL_VERSION,
-  ndJsonStream,
-} from "${sdkPath}";
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
 
 class FakeAgent {
   constructor(connection) {
@@ -313,10 +309,7 @@ class FakeAgent {
   async cancel() {}
 }
 
-const input = Writable.toWeb(process.stdout);
-const output = Readable.toWeb(process.stdin);
-const stream = ndJsonStream(input, output);
-new AgentSideConnection((connection) => new FakeAgent(connection), stream);
+${serveFakeAcpAgent("FakeAgent")}
 `,
     );
 
@@ -952,7 +945,6 @@ new AgentSideConnection((connection) => new FakeAgent(connection), stream);
     const binDir = makeTempDir();
     const captureFile = join(binDir, "capture.json");
     const agentPath = join(binDir, "fake-copilot-acp.ts");
-    const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
     const repoAgentsMd = "# Repo rules\nKeep this file as is.\n";
     await Bun.write(join(cwd, "AGENTS.md"), repoAgentsMd);
     await Bun.write(
@@ -961,7 +953,7 @@ new AgentSideConnection((connection) => new FakeAgent(connection), stream);
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { Readable, Writable } from "node:stream";
-import { AgentSideConnection, PROTOCOL_VERSION, ndJsonStream } from "${sdkPath}";
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
 class FakeCopilot {
   constructor(connection) { this.connection = connection; }
   async initialize() {
@@ -986,8 +978,7 @@ class FakeCopilot {
   }
   async cancel() {}
 }
-const stream = ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-new AgentSideConnection((connection) => new FakeCopilot(connection), stream);
+${serveFakeAcpAgent("FakeCopilot")}
 `,
     );
     const copilotStub = join(binDir, "copilot");
@@ -1191,7 +1182,6 @@ new AgentSideConnection((connection) => new FakeCopilot(connection), stream);
   test("completes before the revoke response and logs a failed revocation", async () => {
     const cwd = makeTempDir();
     const agentPath = join(cwd, "fake-acp-ephem-agent.ts");
-    const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
 
     const captureFile = join(cwd, "captured-auth.txt");
 
@@ -1199,7 +1189,7 @@ new AgentSideConnection((connection) => new FakeCopilot(connection), stream);
       agentPath,
       `
 import { Readable, Writable } from "node:stream";
-import { AgentSideConnection, PROTOCOL_VERSION, ndJsonStream } from "${sdkPath}";
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
 class FakeAgent {
   constructor(connection) { this.connection = connection; }
   async initialize() {
@@ -1223,8 +1213,7 @@ class FakeAgent {
   }
   async cancel() {}
 }
-const stream = ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-new AgentSideConnection((connection) => new FakeAgent(connection), stream);
+${serveFakeAcpAgent("FakeAgent")}
 `,
     );
 
@@ -1361,12 +1350,11 @@ new AgentSideConnection((connection) => new FakeAgent(connection), stream);
   ])("$name", async ({ costs, totalCostUsd, costSource }) => {
     const cwd = makeTempDir();
     const agentPath = join(cwd, "fake-acp-cost-agent.ts");
-    const sdkPath = join(process.cwd(), "node_modules/@agentclientprotocol/sdk/dist/acp.js");
     await Bun.write(
       agentPath,
       `
 import { Readable, Writable } from "node:stream";
-import { AgentSideConnection, PROTOCOL_VERSION, ndJsonStream } from "${sdkPath}";
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
 class FakeAgent {
   constructor(connection) { this.connection = connection; }
   async initialize() {
@@ -1384,8 +1372,7 @@ class FakeAgent {
   }
   async cancel() {}
 }
-const stream = ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-new AgentSideConnection((connection) => new FakeAgent(connection), stream);
+${serveFakeAcpAgent("FakeAgent")}
 `,
     );
     const { close: closeTokenStub, apiUrl } = await startTokenStubServer(

package/src/tests/acp-fake-agent.ts

@@ -0,0 +1,36 @@
+import { join } from "node:path";
+
+// Fake ACP targets run from temp dirs, so they import the SDK by path. The
+// unstable v1 entry point lets them return turn `usage` like OpenCode does.
+export const ACP_SDK_PATH = join(
+  process.cwd(),
+  "node_modules/@agentclientprotocol/sdk/dist/v1/unstable/acp.js",
+);
+
+/**
+ * Script tail that serves a fake agent class over stdio with the SDK's agent
+ * app API. The class implements the ACP agent methods and gets
+ * `{ sessionUpdate }` to notify the client. The script must import `agent`,
+ * `methods`, and `ndJsonStream` from ACP_SDK_PATH, and `Readable`/`Writable`
+ * from node:stream.
+ */
+export function serveFakeAcpAgent(className: string): string {
+  return `
+const fake = new ${className}({
+  sessionUpdate: (params) => connection.client.notify(methods.client.session.update, params),
+});
+const app = agent()
+  .onRequest(methods.agent.initialize, ({ params }) => fake.initialize(params))
+  .onRequest(methods.agent.session.new, ({ params }) => fake.newSession(params))
+  .onRequest(methods.agent.session.prompt, ({ params }) => fake.prompt(params))
+  .onNotification(methods.agent.session.cancel, ({ params }) => fake.cancel(params));
+if (fake.setSessionConfigOption) {
+  app.onRequest(methods.agent.session.setConfigOption, ({ params }) =>
+    fake.setSessionConfigOption(params),
+  );
+}
+const connection = app.connect(
+  ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin)),
+);
+`;
+}

package/src/tests/acp-swarm-events.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import type { SessionNotification } from "@agentclientprotocol/sdk";
+import type { SessionNotification } from "@agentclientprotocol/sdk/unstable";
 import { acpReportedCostUsd, translateAcpSessionNotification } from "../providers/acp-swarm-events";
 
 function notification(update: SessionNotification["update"]): SessionNotification {