@desplega.ai/agent-swarm 2.4.4 → 2.5.0

package/dist/{cli-cynvc9fj.js → cli-9ce2xw98.js}

@@ -9,16 +9,16 @@ import {
   init_active_sessions,
   getSteeringMessageById2,
   init_db3
-} from "./cli-p20r8w42.js";
+} from "./cli-fcc5qe3f.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-4dg55wsk.js";
+} from "./cli-0z3vjrpm.js";
 import {
   findUserById,
   findUserByExternalId,
   init_users
-} from "./cli-9fhkkpj5.js";
+} from "./cli-xt768r5m.js";
 import {
   isRbacEnabled,
   can,
@@ -43,7 +43,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 
 // src/http/route-def.ts
 init_zod();
@@ -503,7 +503,7 @@ function route(def) {
       try {
         const rawBody = def.body ? await parseBody(req, def.maxBodyBytes) : undefined;
         if (def.session && "bodyTaskIds" in def.session) {
-          const { bodySessionDenial } = await import("./session-access-cv3mq6mc.js");
+          const { bodySessionDenial } = await import("./session-access-dnbyp3cn.js");
           const denial = await bodySessionDenial(req, def.session.bodyTaskIds(rawBody));
           if (denial) {
             jsonError(res, denial, 403);
@@ -771,7 +771,7 @@ function readableByFor2(actor) {
   return actor.kind === "user" ? { userId: actor.userId } : undefined;
 }
 var SESSION_WRITE_DENIED2 = "You can't write in this session. Ask the owner to share it with edit access.";
-async function hasSessionWrite(req, myAgentId, taskId) {
+async function hasSessionWrite2(req, myAgentId, taskId) {
   const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
   return hasSessionAccess(access, "write");
 }
@@ -792,7 +792,7 @@ async function denyParentAttach2(req, res, myAgentId, parentTask, principal) {
     jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
     return true;
   }
-  if (!await hasSessionWrite(req, myAgentId, parentTask.id)) {
+  if (!await hasSessionWrite2(req, myAgentId, parentTask.id)) {
     jsonError(res, SESSION_WRITE_DENIED2, 403);
     return true;
   }
@@ -873,4 +873,4 @@ async function userAgentIdentityDenial2(req, def, pathSegments) {
   return USER_AGENT_HEADER_DENIED;
 }
 
-export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, denyParentAttach2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };
+export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, RequestBodyTooLargeError, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, hasSessionWrite2, denyParentAttach2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };

package/dist/{cli-gqvh8d8a.js → cli-bgdtv62r.js}

@@ -10,7 +10,7 @@ import {
   getMostRecentTaskInThread2,
   reactionName,
   init_db3
-} from "./cli-p20r8w42.js";
+} from "./cli-fcc5qe3f.js";
 import {
   TaskCreationBlockedError,
   buildEffectiveText,
@@ -23,7 +23,7 @@ import {
   extractTaskFromMessage,
   extractSlackMessageText,
   dispatchPre2
-} from "./cli-v3yr2gbg.js";
+} from "./cli-5kzk3472.js";
 import {
   noteSlackInboundSideEffect,
   ignoreSlackInbound,
@@ -34,23 +34,23 @@ import {
   isSlackRenderV2Enabled2,
   ensureSlackThreadTree2,
   registerTreeMessage
-} from "./cli-qkhc5aqy.js";
+} from "./cli-fy1jyyym.js";
 import {
   isBlockExternalEnabled2,
   invalidateChannelExternality2,
   getChannelBlockReason2,
   shouldBlockChannel2,
   leaveExternalChannel2
-} from "./cli-1d70crsy.js";
+} from "./cli-ftmq4nvk.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-wt645v7q.js";
+} from "./cli-dabehxhp.js";
 import {
   enrichSlackUserEmail,
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-2v045xyf.js";
+} from "./cli-7bwtc6yx.js";
 import {
   wasEventSeen,
   requestSlackThreadSteering,
@@ -58,7 +58,7 @@ import {
   bufferThreadMessage,
   getBufferMessageCount,
   instantFlush
-} from "./cli-b8k7epj1.js";
+} from "./cli-segs7hx9.js";
 import {
   resolveTemplate,
   init_resolver
@@ -79,7 +79,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 import {
   __using,
   __callDispose
@@ -102,30 +102,44 @@ var SlackRouteModifySchema = object2({
 }).strict();
 var allowedEmailDomains = (process.env.SLACK_ALLOWED_EMAIL_DOMAINS || "").split(",").map((d) => d.trim().toLowerCase()).filter(Boolean);
 var allowedUserIds = (process.env.SLACK_ALLOWED_USER_IDS || "").split(",").map((id) => id.trim()).filter(Boolean);
-var filteringEnabled = allowedEmailDomains.length > 0 || allowedUserIds.length > 0;
-async function isUserAllowed2(client, userId) {
-  if (!filteringEnabled) {
+var envUserFilterConfig = { allowedEmailDomains, allowedUserIds };
+function checkUserAccess(userId, email, config) {
+  const { allowedEmailDomains: domains, allowedUserIds: userIds } = config;
+  if (domains.length === 0 && userIds.length === 0) {
     return true;
   }
-  if (allowedUserIds.includes(userId)) {
+  if (userIds.includes(userId)) {
     return true;
   }
-  if (allowedEmailDomains.length === 0) {
+  if (domains.length === 0) {
     return false;
   }
-  const email = await enrichSlackUserEmail(client, userId);
   if (!email) {
-    console.log(`[Slack] User ${userId} has no email, denying access`);
     return false;
   }
   const domain = email.split("@")[1]?.toLowerCase();
   if (!domain) {
-    console.log(`[Slack] User ${userId} has invalid email format, denying access`);
     return false;
   }
-  const allowed = allowedEmailDomains.includes(domain);
+  return domains.includes(domain);
+}
+async function isUserAllowed2(client, userId) {
+  const config = envUserFilterConfig;
+  const allowedWithoutEmail = checkUserAccess(userId, null, config);
+  if (allowedWithoutEmail || config.allowedEmailDomains.length === 0) {
+    return allowedWithoutEmail;
+  }
+  const email = await enrichSlackUserEmail(client, userId);
+  const allowed = checkUserAccess(userId, email, config);
   if (!allowed) {
-    console.log(`[Slack] User ${userId} email domain "${domain}" not in allowed list`);
+    const domain = email?.split("@")[1]?.toLowerCase();
+    if (!email) {
+      console.log(`[Slack] User ${userId} has no email, denying access`);
+    } else if (!domain) {
+      console.log(`[Slack] User ${userId} has invalid email format, denying access`);
+    } else {
+      console.log(`[Slack] User ${userId} email domain "${domain}" not in allowed list`);
+    }
   }
   return allowed;
 }
@@ -400,8 +414,8 @@ function registerMessageHandler2(app) {
             }
             return ignoreSlackInbound("rate_limited");
           }
-          const inbound = __using(__stack, await fetchSlackFiles(client, msg.files), 1);
-          const taskText = buildEffectiveText(msg.text, inbound.files, inbound.failed);
+          const inbound = __using(__stack, await fetchSlackFiles(client, msg.files, { transcribe: true }), 1);
+          const taskText = buildEffectiveText(msg.text, inbound.files, inbound.failed, inbound.notes);
           const taskDescription = isImplicitMention ? taskText : extractTaskFromMessage(taskText, botUserId);
           if (!taskDescription) {
             if (!isImplicitMention && !isSlackRenderV2Enabled2()) {
@@ -465,8 +479,8 @@ ${taskDescription}`;
         }
         return ignoreSlackInbound("rate_limited");
       }
-      const inbound = __using(__stack2, await fetchSlackFiles(client, msg.files), 1);
-      const taskDescription = extractTaskFromMessage(buildEffectiveText(msg.text, inbound.files, inbound.failed), botUserId);
+      const inbound = __using(__stack2, await fetchSlackFiles(client, msg.files, { transcribe: true }), 1);
+      const taskDescription = extractTaskFromMessage(buildEffectiveText(msg.text, inbound.files, inbound.failed, inbound.notes), botUserId);
       if (!taskDescription) {
         if (!isSlackRenderV2Enabled2()) {
           await say({

package/dist/{cli-wxbn3yfx.js → cli-cz5nmdxt.js}

@@ -8,11 +8,11 @@ import {
   resolveConfigValueOrThrow,
   resolveHeadersOrThrow,
   FileAuthStorageBackend
-} from "./cli-d2mb5s8a.js";
+} from "./cli-x77gen2p.js";
 import {
   oauthSuccessHtml,
   oauthErrorHtml
-} from "./cli-8nyhf7za.js";
+} from "./cli-qqzmjxkf.js";
 import {
   __toESM
 } from "./cli-242037k3.js";

package/dist/{cli-wt645v7q.js → cli-dabehxhp.js}

@@ -6,7 +6,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-vfha21c9.js → cli-e5bxnjps.js}

@@ -10,7 +10,7 @@ import {
 } from "./cli-0726awxw.js";
 import {
   summarizeSession
-} from "./cli-pnp2j5zg.js";
+} from "./cli-mmhj8vd7.js";
 import {
   resolveTemplateFromCode,
   resolveTemplateAsync,
@@ -28,7 +28,7 @@ import {
 import {
   scrubSecrets,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 
 // src/prompts/goal-reminder.ts
 init_session_templates();