@desplega.ai/agent-swarm 2.5.1 → 2.5.2

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "2.5.1",
+    "version": "2.5.2",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -4581,6 +4581,65 @@
           "createdAt"
         ]
       },
+      "RbacRole": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "description": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "isBuiltin": {
+            "type": "boolean"
+          },
+          "grantsAll": {
+            "type": "boolean"
+          },
+          "primary": {
+            "type": "boolean"
+          },
+          "verbs": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "description",
+          "isBuiltin",
+          "grantsAll",
+          "primary",
+          "verbs"
+        ]
+      },
+      "UserRbacRoles": {
+        "type": "object",
+        "properties": {
+          "userId": {
+            "type": "string"
+          },
+          "roles": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/RbacRole"
+            }
+          }
+        },
+        "required": [
+          "userId",
+          "roles"
+        ]
+      },
       "User": {
         "type": "object",
         "properties": {
@@ -12446,7 +12505,8 @@
                         "channel",
                         "target"
                       ]
-                    }
+                    },
+                    "description": "Where to announce the request. A Slack target (channel or user ID) gets a card with the title, the questions and a link to the dashboard page that answers it. Slack targets need a lead agent caller (403 otherwise). Email is not supported yet and is skipped."
                   }
                 },
                 "required": [
@@ -12796,6 +12856,16 @@
                 }
               }
             }
+          },
+          "403": {
+            "description": "Slack notifications require a lead agent",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         }
       },
@@ -40022,6 +40092,16 @@
               }
             }
           },
+          "403": {
+            "description": "Deferral owned by another agent",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "404": {
             "description": "Schedule not found",
             "content": {
@@ -40416,6 +40496,16 @@
               }
             }
           },
+          "403": {
+            "description": "Deferral owned by another agent",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "404": {
             "description": "Schedule not found",
             "content": {
@@ -48513,6 +48603,30 @@
             "description": "mine: owned sessions. shared: sessions shared with me. tree: Sessions that GET /api/session-tree counts: mine plus shared with me, no ownerless roots. A bypass actor sees every root with tree scope.",
             "name": "scope",
             "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "mine",
+                "all"
+              ],
+              "description": "Sessions v2 view, for a user viewer with tree scope. mine (default): roots the user started from a human channel (not workflow, schedule, or system) plus sessions shared with the user. all: every tree session. Lists only: access is unchanged."
+            },
+            "required": false,
+            "description": "Sessions v2 view, for a user viewer with tree scope. mine (default): roots the user started from a human channel (not workflow, schedule, or system) plus sessions shared with the user. all: every tree session. Lists only: access is unchanged.",
+            "name": "show",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Comma-separated root sources to leave out (the sessions v2 source filter), e.g. `slack,chat`."
+            },
+            "required": false,
+            "description": "Comma-separated root sources to leave out (the sessions v2 source filter), e.g. `slack,chat`.",
+            "name": "hideSource",
+            "in": "query"
           }
         ],
         "responses": {
@@ -48876,6 +48990,32 @@
             "bearerAuth": []
           }
         ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "enum": [
+                "mine",
+                "all"
+              ],
+              "description": "Sessions v2 view, for a user viewer with tree scope. mine (default): roots the user started from a human channel (not workflow, schedule, or system) plus sessions shared with the user. all: every tree session. Lists only: access is unchanged."
+            },
+            "required": false,
+            "description": "Sessions v2 view, for a user viewer with tree scope. mine (default): roots the user started from a human channel (not workflow, schedule, or system) plus sessions shared with the user. all: every tree session. Lists only: access is unchanged.",
+            "name": "show",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "Comma-separated root sources to leave out (the sessions v2 source filter), e.g. `slack,chat`."
+            },
+            "required": false,
+            "description": "Comma-separated root sources to leave out (the sessions v2 source filter), e.g. `slack,chat`.",
+            "name": "hideSource",
+            "in": "query"
+          }
+        ],
         "responses": {
           "200": {
             "description": "Visible groups and section counts",
@@ -49009,6 +49149,25 @@
                         "running",
                         "needsYou"
                       ]
+                    },
+                    "sources": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "source": {
+                            "type": "string"
+                          },
+                          "total": {
+                            "type": "integer"
+                          }
+                        },
+                        "required": [
+                          "source",
+                          "total"
+                        ]
+                      },
+                      "description": "Each root source in this view with its session count, hidden sources included."
                     }
                   },
                   "required": [
@@ -49016,7 +49175,8 @@
                     "inbox",
                     "later",
                     "done",
-                    "noGroup"
+                    "noGroup",
+                    "sources"
                   ]
                 }
               }
@@ -49035,6 +49195,113 @@
         }
       }
     },
+    "/api/session-triage": {
+      "post": {
+        "summary": "Triage every session of one sidebar list",
+        "description": "The bulk bar's 'Select all N': Done, back to the Inbox, read, or unread for every session that one sessions v2 list shows the caller (the `GET /api/sessions?scope=tree` filters). Needs a picked user.",
+        "tags": [
+          "Sessions"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "action": {
+                    "type": "string",
+                    "enum": [
+                      "done",
+                      "inbox",
+                      "read",
+                      "unread"
+                    ]
+                  },
+                  "triage": {
+                    "type": "string",
+                    "enum": [
+                      "inbox",
+                      "later",
+                      "done"
+                    ]
+                  },
+                  "noGroup": {
+                    "type": "boolean"
+                  },
+                  "groupKey": {
+                    "type": "string"
+                  },
+                  "show": {
+                    "type": "string",
+                    "enum": [
+                      "mine",
+                      "all"
+                    ],
+                    "description": "Sessions v2 view, for a user viewer with tree scope. mine (default): roots the user started from a human channel (not workflow, schedule, or system) plus sessions shared with the user. all: every tree session. Lists only: access is unchanged."
+                  },
+                  "hideSource": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "maxItems": 32
+                  }
+                },
+                "required": [
+                  "action"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The number of sessions written",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "updated": {
+                      "type": "integer"
+                    }
+                  },
+                  "required": [
+                    "updated"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Validation error, or no picked user",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/session-moves": {
       "post": {
         "summary": "Move sessions into a group or reset their keys",
@@ -56909,6 +57176,189 @@
         }
       }
     },
+    "/api/rbac/roles": {
+      "get": {
+        "operationId": "rbac_listRoles",
+        "summary": "List RBAC roles with their verbs",
+        "tags": [
+          "Users"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Role catalog",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "roles": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/RbacRole"
+                      }
+                    }
+                  },
+                  "required": [
+                    "roles"
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/users/{id}/roles": {
+      "get": {
+        "operationId": "users_getRbacRoles",
+        "summary": "Get a user's RBAC roles",
+        "tags": [
+          "Users"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The user's roles",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserRbacRoles"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "User not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      },
+      "put": {
+        "operationId": "users_setRbacRoles",
+        "summary": "Set a user's RBAC roles",
+        "description": "Replaces the user's roles. The set holds exactly one of admin, requester, viewer plus any extra roles. Demoting a user below admin removes the ability to answer approval requests, even when the user is listed as an approver. Fails with 409 when it would leave no active admin.",
+        "tags": [
+          "Users"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "roles": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "minItems": 1
+                  }
+                },
+                "required": [
+                  "roles"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The user's roles after the change",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserRbacRoles"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid role set",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Not allowed to change roles",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "User not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Would leave no active admin",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/whoami": {
       "get": {
         "summary": "Resolve the authenticated principal behind the presented bearer",
@@ -59068,6 +59518,16 @@
                 }
               }
             }
+          },
+          "409": {
+            "description": "Source is the last active admin (last_admin)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -113,6 +113,7 @@
     "tsc:check": "bun check",
     "tsc:check:tsc": "bun tsc --noEmit",
     "check:db-boundary": "bash scripts/check-db-boundary.sh",
+    "check:codex-default-model": "bash scripts/check-codex-default-model.sh",
     "check:test-spawn-sync": "bash scripts/check-test-spawn-sync.sh",
     "check:dep-graph": "depcruise src packages/model-routing --config .dependency-cruiser.cjs",
     "check:api-key-boundary": "bash scripts/check-api-key-boundary.sh",
@@ -200,7 +201,7 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "2.0.1",
     "@ai-sdk/openai": "^3.0.41",
-    "@anthropic-ai/claude-agent-sdk": "0.3.308",
+    "@anthropic-ai/claude-agent-sdk": "0.3.309",
     "@anthropic-ai/sdk": "^1.1.0",
     "@asteasolutions/zod-to-openapi": "^8.0.0",
     "@aws-sdk/client-bedrock": "3.1048.0",
@@ -218,7 +219,7 @@
     "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
     "@linear/sdk": "^77.0.0",
     "@modelcontextprotocol/sdk": "1.32.1",
-    "@openai/codex": "0.163.0",
+    "@openai/codex": "0.164.0",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.218.0",