@desplega.ai/agent-swarm 2.4.3 → 2.4.4

package/src/http/core.ts

@@ -547,6 +547,8 @@ export async function handleCore(
         return true;
       }
       req.headers["x-runtime-instance-id"] = auth.runtimeId;
+    }
+    if (auth.tokenKind !== "task") {
       const sourceHeader = req.headers["x-source-task-id"];
       const taskId = Array.isArray(sourceHeader) ? sourceHeader[0] : sourceHeader;
       if (taskId !== undefined && (await getTaskById(taskId))?.agentId !== auth.agentId) {

package/src/http/session-access.ts

@@ -1,4 +1,4 @@
-import type { IncomingMessage } from "node:http";
+import type { IncomingMessage, ServerResponse } from "node:http";
 import { getSteeringMessageById } from "../be/db";
 import { getActiveSessionById } from "../be/db/active-sessions";
 import { getUserGrant } from "../be/rbac-roles";
@@ -10,10 +10,12 @@ import {
   sessionAccessForRoot,
 } from "../be/session-shares";
 import { findUserById } from "../be/users";
-import { isRbacEnabled } from "../rbac";
+import { can, isRbacEnabled, type RbacPrincipal } from "../rbac";
+import type { AgentTask } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { dashboardUserIdHeader } from "./favorite-owner";
 import { type RouteDef, routePathParams } from "./route-def";
+import { jsonError } from "./utils";
 
 /**
  * Who a request acts for when it touches a session.
@@ -76,6 +78,53 @@ export function readableByFor(actor: SessionActor): { userId: string | null } |
 export const SESSION_WRITE_DENIED =
   "You can't write in this session. Ask the owner to share it with edit access.";
 
+/** True unless the request acts for a user who lacks write access to the task's session. */
+export async function hasSessionWrite(
+  req: IncomingMessage,
+  myAgentId: string | undefined,
+  taskId: string,
+): Promise<boolean> {
+  const access = await sessionAccessFor(await resolveSessionActor(req, myAgentId), taskId);
+  return hasSessionAccess(access, "write");
+}
+
+/**
+ * The parent gate shared by `POST /api/tasks` and `POST /api/apps/{id}/actions/{name}`.
+ * The child inherits the parent's thread context, so an agent caller must own or
+ * have created the parent (`task.parent.attach`; operator and user callers keep
+ * their access), and a follow-up in someone else's session needs a write share.
+ * Writes the 403 and returns true when denied.
+ */
+export async function denyParentAttach(
+  req: IncomingMessage,
+  res: ServerResponse,
+  myAgentId: string | undefined,
+  parentTask: Pick<AgentTask, "id" | "requestedByUserId" | "creatorAgentId" | "agentId">,
+  principal: RbacPrincipal,
+): Promise<boolean> {
+  const attach = can({
+    principal,
+    verb: "task.parent.attach",
+    resource: {
+      kind: "task",
+      taskId: parentTask.id,
+      requestedByUserId: parentTask.requestedByUserId,
+      creatorAgentId: parentTask.creatorAgentId,
+      agentId: parentTask.agentId,
+    },
+    source: "http",
+  });
+  if (!attach.allow) {
+    jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
+    return true;
+  }
+  if (!(await hasSessionWrite(req, myAgentId, parentTask.id))) {
+    jsonError(res, SESSION_WRITE_DENIED, 403);
+    return true;
+  }
+  return false;
+}
+
 /**
  * The denial for an actor lacking `needed` access to the session holding
  * `taskId`, or null. An unknown task passes, so the handler still answers 404.

package/src/http/sessions.ts

@@ -2,11 +2,14 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import {
   countSessions,
+  createAgent,
+  getAgentById,
   getDbClient,
   getRootTaskChain,
   getTaskById,
   listRecentSessions,
 } from "../be/db";
+import { getUserGrant } from "../be/rbac-roles";
 import {
   getSessionRoot,
   listActiveSessionShares,
@@ -18,13 +21,17 @@ import {
 import { getTaskSteeringFieldsForTasks } from "../be/steering";
 import { getTaskCitationsForTasks, TaskCitationSchema } from "../be/task-citations";
 import {
+  AgentTokenExistsError,
   findUserById,
   InvalidRuntimeTokenError,
+  mintAgentToken,
   mintRuntimeToken,
   mintSessionToken,
+  revokeAgentTokens,
   revokeSessionToken,
+  rotateAgentToken,
 } from "../be/users";
-import { can } from "../rbac";
+import { can, isRbacEnabled } from "../rbac";
 import { sessionAccessTopic } from "../realtime/auth";
 import { realtimeBus } from "../realtime/bus";
 import {
@@ -39,6 +46,7 @@ import {
 } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
+import { agentFirstPrincipal } from "./request-principal";
 import { route } from "./route-def";
 import { resolveSessionActor, type SessionActor } from "./session-access";
 import { jsonError } from "./utils";
@@ -118,7 +126,7 @@ const mintSessionTokenRoute = route({
   },
   summary: "Mint an ephemeral task or runtime token",
   description:
-    "Operators can mint task or runtime tokens. Runtime tokens can mint task tokens for their own assigned tasks. Child tokens expire with their parent runtime.",
+    "Operators can mint task or runtime tokens. Runtime and agent tokens can mint task tokens for their own assigned tasks. A child token never outlives its parent and is revoked with it.",
   tags: ["Sessions"],
   body: z
     .object({
@@ -147,7 +155,8 @@ const mintSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token minting for its own assigned task, enforced in the handler",
+    ungated:
+      "operator, or a runtime or agent token minting for its own assigned task, enforced in the handler",
   },
 });
 
@@ -157,7 +166,7 @@ const revokeSessionTokenRoute = route({
   pattern: ["api", "sessions", "tokens", null],
   summary: "Revoke an ephemeral session token",
   description:
-    "Operators can revoke any ephemeral token. With runtime pools enabled, runtime tokens can revoke their own child task tokens. Repeated revocation has no effect.",
+    "Operators can revoke any ephemeral token. Agent tokens, and runtime tokens when runtime pools are enabled, can revoke their own child task tokens. Repeated revocation has no effect.",
   tags: ["Sessions"],
   params: z.object({ tokenId: z.string() }),
   responses: {
@@ -167,10 +176,234 @@ const revokeSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token revoking its own child, enforced in the handler",
+    ungated:
+      "operator, or a runtime or agent token revoking its own child, enforced in the handler",
   },
 });
 
+/** Default rotation grace: the old worker token keeps working this long. */
+const AGENT_TOKEN_ROTATE_GRACE_SEC = 300;
+
+const AgentTokenSchema = z.object({
+  agentId: z.string(),
+  tokenId: z.string(),
+  plaintext: z.string(),
+  expiresAt: z.string().nullable().describe("null when the token does not expire"),
+});
+
+const agentTokenTtl = z
+  .number()
+  .int()
+  .positive()
+  .optional()
+  .describe("Token lifetime in ms. Omit for the default (no expiry).");
+
+const mintAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_mintWorkerToken",
+  summary: "Mint an agent-bound worker token",
+  description:
+    "Returns the token once. A worker runs on it in place of the swarm API key and acts only as this agent. Creates the agent when it does not exist and `name` is given. Fails with 409 when the agent already holds an active token.",
+  tags: ["Sessions"],
+  params: z.object({ id: z.string().min(1) }),
+  body: z
+    .object({ name: z.string().min(1).optional(), ttlMs: agentTokenTtl })
+    .strict()
+    .optional(),
+  responses: {
+    200: {
+      description: "Minted worker token",
+      schema: AgentTokenSchema.extend({ agentCreated: z.boolean() }),
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent not found and no name given" },
+    409: { description: "Agent already holds an active token" },
+  },
+  rbac: { permission: "agent.token.manage" },
+});
+
+const rotateAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token/rotate",
+  pattern: ["api", "agents", null, "token", "rotate"],
+  operationId: "agents_rotateWorkerToken",
+  summary: "Rotate an agent-bound worker token",
+  description:
+    "Returns a new token once. The previous token keeps working for `graceSec` (default 300), then expires. Use revoke for a token that must stop now.",
+  tags: ["Sessions"],
+  params: z.object({ id: z.string().min(1) }),
+  body: z
+    .object({ graceSec: z.number().int().min(0).max(86_400).optional(), ttlMs: agentTokenTtl })
+    .strict()
+    .optional(),
+  responses: {
+    200: {
+      description: "New worker token",
+      schema: AgentTokenSchema.extend({ previousExpiresAt: z.string() }),
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent holds no active token" },
+  },
+  rbac: { permission: "agent.token.manage" },
+});
+
+const revokeAgentTokenRoute = route({
+  method: "delete",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_revokeWorkerToken",
+  summary: "Revoke an agent-bound worker token",
+  description:
+    "Revokes every active worker token of the agent and the task tokens they minted. Open realtime connections on them close.",
+  tags: ["Sessions"],
+  params: z.object({ id: z.string().min(1) }),
+  responses: {
+    200: {
+      description: "Number of worker tokens revoked (0 when none was active)",
+      schema: z.object({ revoked: z.number().int() }),
+    },
+    403: { description: "Operator or user credentials required" },
+  },
+  rbac: { permission: "agent.token.manage" },
+});
+
+const AGENT_TOKEN_ROUTES = [mintAgentTokenRoute, rotateAgentTokenRoute, revokeAgentTokenRoute];
+
+/**
+ * Gate the worker-token routes. Only an operator key or a user may manage
+ * them, never a session token. The principal is agent-first: an operator key
+ * sent with X-Agent-ID acts as that agent and is refused, as on the
+ * controller-token route.
+ */
+async function ensureAgentTokenManager(
+  req: IncomingMessage,
+  res: ServerResponse,
+  agentId: string,
+): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "operator" && auth?.kind !== "user") {
+    jsonError(res, "Worker tokens require operator or user credentials", 403);
+    return false;
+  }
+  const header = req.headers["x-agent-id"];
+  const decision = can({
+    principal: await agentFirstPrincipal(req, Array.isArray(header) ? header[0] : header),
+    verb: "agent.token.manage",
+    resource: { kind: "agent", agentId },
+    source: "http",
+  });
+  if (!decision.allow) {
+    jsonError(res, decision.reason, 403);
+    return false;
+  }
+  // A worker token carries the target agent's privileges and reads that
+  // agent's resolved config, global secrets included. A user without a
+  // grant-all role must already hold both, and may not manage the token of an
+  // agent that may itself act on any agent (a lead).
+  if (auth.kind === "user" && isRbacEnabled()) {
+    const grant = await getUserGrant(auth.userId);
+    if (!grant.grantsAll) {
+      const target = await getAgentById(agentId);
+      const targetActsOnAny = can({
+        principal: { kind: "agent", agentId, isLead: target?.isLead ?? false },
+        verb: "agent.act.any",
+        resource: { kind: "agent", agentId },
+        source: "http",
+      }).allow;
+      if (targetActsOnAny) {
+        jsonError(res, "A lead agent's worker token requires a grant-all role", 403);
+        return false;
+      }
+      const missing = (["agent.act.any", "config.read.secrets"] as const).filter(
+        (verb) => !grant.verbs.has(verb),
+      );
+      if (missing.length > 0) {
+        jsonError(res, `Worker tokens also require: ${missing.join(", ")}`, 403);
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+async function handleAgentTokens(
+  req: IncomingMessage,
+  res: ServerResponse,
+  pathSegments: string[],
+  queryParams: URLSearchParams,
+): Promise<boolean> {
+  const matched = AGENT_TOKEN_ROUTES.find((def) => def.match(req.method, pathSegments));
+  if (!matched) return false;
+  if (!(await ensureAgentTokenManager(req, res, pathSegments[2]!))) return true;
+  res.setHeader("Cache-Control", "no-store");
+
+  if (matched === mintAgentTokenRoute) {
+    const parsed = await mintAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    const agentId = parsed.params.id;
+    const result = await getDbClient()
+      .transaction(async () => {
+        let agentCreated = false;
+        if (!(await getAgentById(agentId))) {
+          if (!parsed.body?.name) return { status: 404 as const };
+          // Same defaults as a worker's first registration; it is offline until it connects.
+          await createAgent({
+            id: agentId,
+            name: parsed.body.name,
+            isLead: false,
+            status: "offline",
+            capabilities: [],
+            maxTasks: 1,
+          });
+          agentCreated = true;
+        }
+        return {
+          status: 200 as const,
+          agentCreated,
+          token: await mintAgentToken(agentId, parsed.body?.ttlMs),
+        };
+      })
+      .catch((error) => {
+        if (error instanceof AgentTokenExistsError) return { status: 409 as const };
+        throw error;
+      });
+    if (result.status === 404) {
+      jsonError(res, "Agent not found; pass name to create it", 404);
+      return true;
+    }
+    if (result.status === 409) {
+      jsonError(res, "Agent already holds an active worker token; rotate or revoke it", 409);
+      return true;
+    }
+    mintAgentTokenRoute.respond(res, 200, {
+      agentId,
+      ...result.token,
+      agentCreated: result.agentCreated,
+    });
+    return true;
+  }
+
+  if (matched === rotateAgentTokenRoute) {
+    const parsed = await rotateAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    const graceSec = parsed.body?.graceSec ?? AGENT_TOKEN_ROTATE_GRACE_SEC;
+    const token = await rotateAgentToken(parsed.params.id, graceSec * 1000, parsed.body?.ttlMs);
+    if (!token) {
+      jsonError(res, "Agent holds no active worker token", 404);
+      return true;
+    }
+    rotateAgentTokenRoute.respond(res, 200, { agentId: parsed.params.id, ...token });
+    return true;
+  }
+
+  const parsed = await revokeAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed) return true;
+  revokeAgentTokenRoute.respond(res, 200, { revoked: await revokeAgentTokens(parsed.params.id) });
+  return true;
+}
+
 const listSessions = route({
   method: "get",
   path: "/api/sessions",
@@ -309,9 +542,11 @@ export async function handleSessions(
   queryParams: URLSearchParams,
   myAgentId?: string,
 ): Promise<boolean> {
+  if (await handleAgentTokens(req, res, pathSegments, queryParams)) return true;
+
   if (mintSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
-    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.runtimeId)) {
+    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.tokenKind !== "task")) {
       jsonError(res, "Unauthorized", 401);
       return true;
     }
@@ -334,7 +569,7 @@ export async function handleSessions(
           return {
             token: await mintSessionToken(agentId, taskId!, ttlMs!, {
               tokenId: auth.tokenId,
-              runtimeId: auth.runtimeId!,
+              runtimeId: auth.runtimeId,
             }),
           };
         }
@@ -365,7 +600,10 @@ export async function handleSessions(
     const auth = getRequestAuth(req);
     if (
       auth?.kind !== "operator" &&
-      !(isRuntimePoolsEnabled() && auth?.kind === "agent" && auth.runtimeId)
+      !(
+        auth?.kind === "agent" &&
+        (auth.tokenKind === "agent" || (auth.tokenKind === "runtime" && isRuntimePoolsEnabled()))
+      )
     ) {
       jsonError(res, "Unauthorized", 401);
       return true;
@@ -375,8 +613,9 @@ export async function handleSessions(
     const revoked = await getDbClient().transaction(async (client) => {
       if (auth.kind === "agent") {
         const child = await client.get(
-          "SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND parentRuntimeId = ? AND taskId IS NOT NULL",
-          [parsed.params.tokenId, auth.agentId, auth.runtimeId!],
+          `SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND taskId IS NOT NULL
+           AND ${auth.runtimeId ? "parentRuntimeId" : "parentTokenId"} = ?`,
+          [parsed.params.tokenId, auth.agentId, auth.runtimeId ?? auth.tokenId],
         );
         if (!child) return false;
       }

package/src/http/tasks.ts

@@ -87,6 +87,7 @@ import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { bodyTask, route } from "./route-def";
 import {
   canReadSession,
+  denyParentAttach,
   readableByFor,
   resolveSessionActor,
   SESSION_READ_DENIED,
@@ -779,16 +780,6 @@ const updateTaskTitleRoute = route({
   },
 });
 
-/** True unless the request acts for a user who lacks write access to the task's session. */
-async function hasSessionWrite(
-  req: IncomingMessage,
-  myAgentId: string | undefined,
-  taskId: string,
-): Promise<boolean> {
-  const access = await sessionAccessFor(await resolveSessionActor(req, myAgentId), taskId);
-  return hasSessionAccess(access, "write");
-}
-
 async function canSteerTask(
   req: IncomingMessage,
   myAgentId: string | undefined,
@@ -1069,29 +1060,10 @@ export async function handleTasks(
       ? await getTaskById(parsed.body.parentTaskId)
       : null;
     // The child inherits the parent's thread context, so an agent caller must own or
-    // have created the parent. Operator and user callers keep their access.
+    // have created the parent, and a follow-up in someone else's session needs a
+    // write share. The same gate guards app actions that chain under a task.
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
-    if (
-      parentTask &&
-      !can({
-        principal,
-        verb: "task.parent.attach",
-        resource: {
-          kind: "task",
-          taskId: parentTask.id,
-          requestedByUserId: parentTask.requestedByUserId,
-          creatorAgentId: parentTask.creatorAgentId,
-          agentId: parentTask.agentId,
-        },
-        source: "http",
-      }).allow
-    ) {
-      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
-      return true;
-    }
-    // A follow-up in someone else's session needs a write share.
-    if (parentTask && !(await hasSessionWrite(req, myAgentId, parentTask.id))) {
-      jsonError(res, SESSION_WRITE_DENIED, 403);
+    if (parentTask && (await denyParentAttach(req, res, myAgentId, parentTask, principal))) {
       return true;
     }
     // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator

package/src/providers/acp-adapter.ts

@@ -1,15 +1,21 @@
+// `/unstable` keeps the full ACP v1 surface the 1.x default import carried:
+// turn `usage` on the prompt response is unstable, and the stable entrypoint
+// does not type it. Both entrypoints speak ACP v1 on the wire.
 import {
-  type Client,
-  ClientSideConnection,
+  client as acpClient,
+  type ClientContext,
   type McpServer,
+  methods,
   ndJsonStream,
   PROTOCOL_VERSION,
   type RequestPermissionRequest,
   type RequestPermissionResponse,
   type SessionConfigOption,
   type SessionNotification,
+  type SetSessionConfigOptionRequest,
+  type SetSessionConfigOptionResponse,
   type Usage,
-} from "@agentclientprotocol/sdk";
+} from "@agentclientprotocol/sdk/unstable";
 import pkg from "../../package.json";
 import type { AcpSessionConfigOption } from "../types";
 import { mintAcpSessionToken, revokeAcpSessionToken } from "../utils/acp-session-token";
@@ -154,7 +160,7 @@ function boundedAcpLogScalar(value: unknown): unknown {
   return typeof value === "string" ? value.slice(0, 500) : value;
 }
 
-class SwarmAcpClient implements Client {
+class SwarmAcpClient {
   /** Latest cumulative USD cost the target reported for the session. */
   reportedCostUsd: number | null = null;
 
@@ -199,7 +205,7 @@ class ACPSession implements ProviderSession {
   private ephemeralTokenId: string | null = null;
 
   constructor(
-    private readonly connection: ClientSideConnection,
+    private readonly agent: ClientContext,
     private readonly client: SwarmAcpClient,
     private readonly process: Bun.Subprocess<"pipe", "pipe", "pipe">,
     private readonly config: ProviderSessionConfig,
@@ -234,7 +240,7 @@ class ACPSession implements ProviderSession {
     if (this.aborted) return;
     this.aborted = true;
     try {
-      await this.connection.cancel({ sessionId: this.sessionId });
+      await this.agent.notify(methods.agent.session.cancel, { sessionId: this.sessionId });
       await Promise.race([this.completionPromise, Bun.sleep(ACP_CANCEL_SETTLE_MS)]);
     } catch (err) {
       this.emit({
@@ -282,7 +288,7 @@ class ACPSession implements ProviderSession {
   private async runPrompt(): Promise<void> {
     let result: ProviderResult;
     try {
-      const response = await this.connection.prompt({
+      const response = await this.agent.request(methods.agent.session.prompt, {
         sessionId: this.sessionId,
         prompt: [{ type: "text", text: this.config.prompt }],
       });
@@ -441,11 +447,16 @@ export class ACPAdapter implements ProviderAdapter {
       else preSessionEvents.push(event);
     }, target);
     const stream = ndJsonStream(fileSinkWritableStream(proc.stdin), proc.stdout);
-    const connection = new ClientSideConnection(() => client, stream);
+    const agent = acpClient()
+      .onRequest(methods.client.session.requestPermission, ({ params }) =>
+        client.requestPermission(params),
+      )
+      .onNotification(methods.client.session.update, ({ params }) => client.sessionUpdate(params))
+      .connect(stream).agent;
 
     let ephemeralToken: { tokenId: string; plaintext: string } | null = null;
     try {
-      await connection.initialize({
+      await agent.request(methods.agent.initialize, {
         protocolVersion: PROTOCOL_VERSION,
         clientInfo: { name: "agent-swarm", version: pkg.version },
         clientCapabilities: { session: { configOptions: { boolean: {} } } },
@@ -473,7 +484,7 @@ export class ACPAdapter implements ProviderAdapter {
       // shape for an ACP agent with no network route to the swarm API. Gated on
       // `mcpCapabilities.acp` and UNSTABLE; not adopted here.
       const sessionMeta = target.sessionMeta?.(config);
-      const newSession = await connection.newSession({
+      const newSession = await agent.request(methods.agent.session.new, {
         ...(sessionMeta ? { _meta: sessionMeta } : {}),
         cwd: config.cwd,
         mcpServers: [
@@ -491,13 +502,16 @@ export class ACPAdapter implements ProviderAdapter {
         ],
       });
       const configOptions = await applyConfiguredOptions(
-        connection,
+        {
+          setSessionConfigOption: (params) =>
+            agent.request(methods.agent.session.setConfigOption, params),
+        },
         newSession.sessionId,
         newSession.configOptions ?? [],
         target.configuredOptions(config),
       );
       session = new ACPSession(
-        connection,
+        agent,
         client,
         proc,
         config,
@@ -537,8 +551,14 @@ export class ACPAdapter implements ProviderAdapter {
   }
 }
 
+export interface AcpConfigOptionSetter {
+  setSessionConfigOption(
+    params: SetSessionConfigOptionRequest,
+  ): Promise<SetSessionConfigOptionResponse>;
+}
+
 export async function applyConfiguredOptions(
-  connection: Pick<ClientSideConnection, "setSessionConfigOption">,
+  connection: AcpConfigOptionSetter,
   sessionId: string,
   advertised: SessionConfigOption[],
   configured: Record<string, string | boolean>,

package/src/providers/acp-swarm-events.ts

@@ -3,7 +3,7 @@ import type {
   SessionNotification,
   SessionUpdate,
   ToolCallUpdate,
-} from "@agentclientprotocol/sdk";
+} from "@agentclientprotocol/sdk/unstable";
 import type { ProviderEvent } from "./types";
 
 function contentToText(content: ContentBlock): string {

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792470027-g8c393d";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792506219-g025e7e";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/providers/codex-oauth/storage.ts

@@ -364,7 +364,7 @@ export async function persistCodexOAuth(
  * once it was issued more than that long ago (see {@link isStaleByAge}) — on
  * top of the near-expiry skew above, not instead of it. This is how the
  * locked keep-warm sweep (`POST /api/oauth/keep-warm/codex`) reuses this same
- * function to refresh slots proactively (~weekly, `maxAgeMs` ≈ 7 days) rather
+ * function to refresh slots proactively (`maxAgeMs` default 5 days) rather
  * than waiting for a task to draw a slot within `REFRESH_SKEW_MS` of expiry.
  * Default behavior (opts omitted) is unchanged.
  *

package/src/rbac/legacy-policy.ts

@@ -318,7 +318,7 @@ export const LEGACY_POLICY = {
   "config.write.any": leadOnly,
   "config.delete.any": leadOnly,
   "config.read.secrets": leadOnly,
-  // HTTP runtime tokens can read their own resolved config in src/http/config.ts.
+  // HTTP runtime and agent tokens can read their own resolved config in src/http/config.ts.
   // Lead tokens retain config.read.secrets. This exception does not grant config administration.
   "models.catalog.write": leadOrOperator,
   "models.harness-support.write": agentOrOperator,
@@ -356,6 +356,8 @@ export const LEGACY_POLICY = {
   "runtime_pool.write": operatorOrUser,
   "runtime_pool.bind": leadOrOperatorOrUser,
   "runtime_controller.write": operatorOrUser,
+  // A worker token stands in for the swarm API key on a worker, so only humans mint it.
+  "agent.token.manage": operatorOrUser,
   "extension.write": extensionWrite,
   "extension.activate": extensionActivation,
   "extension.install.inline": leadOrOperatorOrUser,

package/src/rbac/permissions.ts

@@ -33,6 +33,10 @@ export const PERMISSIONS = {
     description: "View or diff another agent's context history.",
     namespace: "agent",
   },
+  "agent.token.manage": {
+    description: "Mint, rotate, or revoke an agent-bound worker token.",
+    namespace: "agent",
+  },
   "task.cancel.any": {
     description: "Cancel any task (beyond tasks the caller created).",
     namespace: "task",