@desplega.ai/agent-swarm 2.5.1 → 2.5.2

package/src/http/x.ts

@@ -15,12 +15,12 @@ import {
   restoreScratchScriptLastUsedIfUnchanged,
   touchScratchScriptLastUsed,
 } from "../be/scripts/db";
+import { runScriptWithRunCredential } from "../be/scripts/run-credential";
 import {
   MAX_SCRIPT_WALL_CLOCK_MS,
   MIN_SCRIPT_WALL_CLOCK_MS,
 } from "../scripts-runtime/executors/types";
 import type { RunScriptOutput } from "../scripts-runtime/loader";
-import { runScript } from "../scripts-runtime/loader";
 import { scrubObject, scrubSecrets } from "../utils/secret-scrubber";
 import { validateJsonSchema } from "../workflows/json-schema-validator";
 import { route } from "./route-def";
@@ -242,7 +242,7 @@ export async function handleX(
   const credentials = await buildScriptCredentialBindingsWithFailures({
     agentId: endpoint.agentId,
   });
-  const output = await runScript({
+  const output = await runScriptWithRunCredential({
     source: script.source,
     args: args ?? null,
     fsMode: "none",

package/src/integrations/chat-sdk/commands.ts

@@ -63,7 +63,19 @@ function helpText(): string {
   return ["Commands:", ...CHAT_COMMANDS.map((c) => `/${c.command}: ${c.description}`)].join("\n");
 }
 
-function shortId(task: AgentTask): string {
+/**
+ * Telegram sends `/start` when a user opens a bot DM. It stays out of
+ * `CHAT_COMMANDS`, so the `/` menu does not list it.
+ */
+function welcomeText(): string {
+  return [
+    "Hi! Send a message here (in a group, mention me) and the swarm picks it up. Each answer arrives as a reply to your message.",
+    "",
+    helpText(),
+  ].join("\n");
+}
+
+export function shortId(task: Pick<AgentTask, "id">): string {
   return task.id.slice(0, 8);
 }
 
@@ -115,6 +127,7 @@ export async function runChatCommand(
 ): Promise<string> {
   const name = command.replace(/^\//, "").toLowerCase();
   if (name === "help") return helpText();
+  if (name === "start") return welcomeText();
   if (!CHAT_COMMANDS.some((c) => c.command === name)) {
     return `Unknown command /${name}.\n${helpText()}`;
   }

package/src/integrations/chat-sdk/inbound.ts

@@ -32,6 +32,12 @@ import { getChatThreadResetAt } from "./commands";
 import { type ChatAddressedReason, formatChatHeaderFacts, readChatMessageFacts } from "./facts";
 import { errorMessage } from "./logger";
 import { emitChatMessageSent, postChatMessage } from "./outbound";
+import {
+  chatAdapterReacts,
+  clearChatMessageReactions,
+  setChatMessageReaction,
+  wantsChatTextAck,
+} from "./reactions";
 import {
   type ChatAgentMatch,
   type ChatRouteTarget,
@@ -154,9 +160,14 @@ export async function handleChatInbound(
       console.log(
         `[chat-sdk] ${adapter} message steered task ${steering.task.id} (${steering.result.outcome})`,
       );
+      await setChatMessageReaction(adapter, thread.id, message.id, "steered");
+      if (!(await wantsChatTextAck(adapter, thread.channelId))) return;
       try {
         const ack = formatChatSteeringAck(steering.result);
-        const sent = await thread.post({ markdown: ack });
+        // Telegram threads the ack under the steering message; other adapters post it.
+        const sent = thread.adapter.reply
+          ? await thread.reply(message, { markdown: ack })
+          : await thread.post({ markdown: ack });
         emitChatMessageSent({
           adapter,
           channelId: thread.channelId,
@@ -177,6 +188,9 @@ export async function handleChatInbound(
   }
 
   if (text || attachments.length > 0) {
+    // Subscribed-thread messages may be dropped by the router at flush time;
+    // they get typing and a reaction once a task exists (see flushChatThread).
+    const acknowledge = kind !== "subscribed";
     bufferChatMessage(thread.id, {
       messageId: message.id,
       channelId: thread.channelId,
@@ -186,12 +200,14 @@ export async function handleChatInbound(
       botMentioned: mentioned || facts.replyToBot,
       isDirectMessage,
       addressed,
+      reacted: acknowledge && chatAdapterReacts(adapter),
       facts,
       attachments,
     });
-    // Subscribed-thread messages may be dropped by the router at flush time;
-    // they get typing once a task exists (see flushChatThread).
-    if (kind !== "subscribed") startTypingKeepalive(adapter, thread.id);
+    if (acknowledge) {
+      startTypingKeepalive(adapter, thread.id);
+      await setChatMessageReaction(adapter, thread.id, message.id, immediate ? "now" : "accepted");
+    }
   }
   if (immediate) await instantFlushChat(thread.id);
 }
@@ -377,6 +393,9 @@ export async function flushChatThread(
   // One task carries every sender's text, so a batch from several people
   // gets no requester: one sender's identity must not vouch for another's words.
   const otherSenders = new Set(items.map((item) => item.userId)).size - 1;
+  // The task answers the newest message; it alone carries the reaction lifecycle.
+  const answered = items.at(-1) ?? first;
+  const reacted = items.filter((item) => item.reacted).map((item) => item.messageId);
 
   // After `/reset` the thread's earlier tasks are not context: the new task gets
   // no parent and no thread history older than the reset.
@@ -418,6 +437,7 @@ export async function flushChatThread(
       scrubSecrets(routeResult.reason),
     );
     stopTypingKeepalive(threadId);
+    await clearChatMessageReactions(adapter, threadId, reacted);
     return;
   }
 
@@ -433,12 +453,14 @@ export async function flushChatThread(
   if (!target) {
     console.log(`[chat-sdk] ${threadId}: message not addressed to the swarm, ignored`);
     stopTypingKeepalive(threadId);
+    await clearChatMessageReactions(adapter, threadId, reacted);
     return;
   }
 
   if (target.kind === "workflow") {
-    // A workflow run has no relay that would stop the indicator.
+    // A workflow run has no relay that would stop the indicator or end the reaction.
     stopTypingKeepalive(threadId);
+    await clearChatMessageReactions(adapter, threadId, reacted);
     try {
       // The adapter verified the platform signature, and the workflow id comes
       // from an operator mapping or an extension, never from the message.
@@ -533,6 +555,11 @@ export async function flushChatThread(
       // A human message in the thread: never answer it in the previous task's
       // structured-output contract.
       inheritParentOutputSchema: false,
+      // The relay answers as a reply to the newest buffered message. Always set
+      // explicitly: `createTask` copies the parent's anchor into a child that
+      // has none, and that would point at an older ask.
+      mentionMessageId: answered.messageId,
+      mentionChannelId: first.channelId,
     };
     try {
       const { task, unattached } = await createChatTaskWithFiles(description, options, inbound);
@@ -555,8 +582,16 @@ export async function flushChatThread(
     await subscribe(thread);
     // Subscribed-thread messages start typing only here, once a task exists.
     startTypingKeepalive(adapter, threadId);
+    await clearChatMessageReactions(
+      adapter,
+      threadId,
+      reacted.filter((id) => id !== answered.messageId),
+    );
+    if (!answered.reacted)
+      await setChatMessageReaction(adapter, threadId, answered.messageId, "accepted");
   } else {
     stopTypingKeepalive(threadId);
+    await clearChatMessageReactions(adapter, threadId, reacted);
   }
 }
 

package/src/integrations/chat-sdk/outbound.ts

@@ -76,12 +76,14 @@ export class ChatFileTooLargeError extends Error {
   }
 }
 
+type SentChunk = { id: string; threadId?: string };
+
 interface PostTarget {
   post(message: {
     markdown: string;
     files?: FileUpload[];
     attachments?: Attachment[];
-  }): Promise<{ id: string; threadId?: string }>;
+  }): Promise<SentChunk>;
 }
 
 /** A fence opener or closer: up to 3 spaces, then 3+ backticks or tildes. */
@@ -120,16 +122,22 @@ export function escapeTelegramHashLines(markdown: string): string {
     .join("\n");
 }
 
+/** `replyFirst` sends the first chunk as a native reply; later chunks are plain posts. */
 async function postChunks(
   adapter: string,
   target: PostTarget,
-  text: string,
+  parts: readonly string[],
+  replyFirst?: (message: { markdown: string }) => Promise<SentChunk>,
 ): Promise<{ messageIds: string[]; threadId?: string }> {
   const messageIds: string[] = [];
   let threadId: string | undefined;
-  for (const chunk of splitChatMessage(text, chatMessageLimit(adapter))) {
-    const markdown = adapter === "telegram" ? escapeTelegramHashLines(chunk) : chunk;
-    const sent = await target.post({ markdown });
+  const limit = chatMessageLimit(adapter);
+  for (const chunk of parts.flatMap((part) => splitChatMessage(part, limit))) {
+    const message = { markdown: adapter === "telegram" ? escapeTelegramHashLines(chunk) : chunk };
+    const sent =
+      replyFirst && messageIds.length === 0
+        ? await replyFirst(message)
+        : await target.post(message);
     messageIds.push(sent.id);
     threadId ??= sent.threadId;
   }
@@ -323,28 +331,45 @@ export function formatUnsentFilesNote(unsent: UnsentChatFile[]): string {
  * Delivery is at-least-once: a chunk failure re-posts earlier chunks on retry,
  * and a crash between the send and `markChatRelayDelivered` re-sends the
  * message.
+ *
+ * An array `text` is posted as one message per element, each still split at
+ * the limit; the caller uses it when its own markup must not be cut in two.
+ *
+ * `replyToMessageId` anchors the first chunk to that message on a thread
+ * target. Telegram sends it with `allow_sending_without_reply`, so a deleted
+ * target still gets the message, unthreaded.
  */
 export async function postChatMessage(args: {
   adapter: string;
   threadId?: string;
   channelId?: string;
-  text: string;
+  text: string | readonly string[];
   taskId?: string;
   files?: OutboundChatFile[];
+  replyToMessageId?: string;
 }): Promise<ChatPostResult> {
   // Ids come from tools and stored context keys. Check the Teams origin
   // before the adapter sends its token.
   assertTrustedChatTarget(args.threadId ?? args.channelId ?? "");
   const chat = getChatInstance(args.adapter);
   if (!chat) throw new ChatAdapterUnavailableError(args.adapter);
-  const text = scrubSecrets(args.text);
+  const parts = (typeof args.text === "string" ? [args.text] : args.text).map(scrubSecrets);
+  const text = parts.join("\n\n");
 
   let result: ChatPostResult;
   let target: PostTarget;
   if (args.threadId) {
     const thread = chat.thread(args.threadId);
     target = thread;
-    const sent = await postChunks(args.adapter, thread, text);
+    // Only adapters with a native reply (Telegram in this SDK version) anchor;
+    // the others post unanchored, as before.
+    const replyTo = args.replyToMessageId;
+    const sent = await postChunks(
+      args.adapter,
+      thread,
+      parts,
+      replyTo && thread.adapter.reply ? (message) => thread.reply(replyTo, message) : undefined,
+    );
     result = {
       adapter: args.adapter,
       threadId: thread.id,
@@ -355,7 +380,7 @@ export async function postChatMessage(args: {
   } else if (args.channelId) {
     const channel = chat.channel(args.channelId);
     target = channel;
-    const sent = await postChunks(args.adapter, channel, text);
+    const sent = await postChunks(args.adapter, channel, parts);
     result = {
       adapter: args.adapter,
       threadId: sent.threadId ?? channel.id,
@@ -373,7 +398,7 @@ export async function postChatMessage(args: {
     result.unsentFiles = sent.unsent;
     if (sent.unsent.length > 0) {
       const note = formatUnsentFilesNote(sent.unsent);
-      const noted = await postChunks(args.adapter, target, scrubSecrets(note));
+      const noted = await postChunks(args.adapter, target, [scrubSecrets(note)]);
       result.messageIds.push(...noted.messageIds);
     }
   }

package/src/integrations/chat-sdk/reactions.ts

@@ -0,0 +1,107 @@
+import { getKv } from "@/be/db";
+import type { ReactionEvent } from "@/integrations/reaction-events";
+import { scrubSecrets } from "@/utils/secret-scrubber";
+import { errorMessage } from "./logger";
+import { chatChannelKey } from "./router";
+import { getChatInstance } from "./runtime";
+import { assertTrustedChatTarget } from "./teams-origin";
+
+/**
+ * Telegram reactions per lifecycle event. A bot may set only the emoji in the
+ * Bot API `ReactionTypeEmoji` list (https://core.telegram.org/bots/api#reactiontypeemoji),
+ * which has no ✅ or ❌. `✍` is U+270D with no variation selector, as listed.
+ * A bot sets one reaction per message, so each call replaces the previous one.
+ */
+export const TELEGRAM_REACTIONS: Record<ReactionEvent, string> = {
+  accepted: "👀",
+  buffered: "👀",
+  now: "⚡",
+  steered: "✍",
+  completed: "👍",
+  failed: "👎",
+};
+
+/** Adapters that show the task lifecycle as a reaction on the user's message. */
+const CHAT_REACTIONS: Readonly<Record<string, Record<ReactionEvent, string>>> = {
+  telegram: TELEGRAM_REACTIONS,
+};
+
+/** True when `adapter` shows the lifecycle as reactions instead of text acknowledgements. */
+export function chatAdapterReacts(adapter: string): boolean {
+  return adapter in CHAT_REACTIONS;
+}
+
+/**
+ * Set the reaction for `event` on one message. Best effort: an adapter without
+ * a reaction map is a no-op, and a platform error (Telegram answers
+ * `400 REACTION_INVALID` for an emoji a group admin disallowed) is logged and
+ * never thrown, so it cannot block delivery or fail the task.
+ */
+export async function setChatMessageReaction(
+  adapter: string,
+  threadId: string,
+  messageId: string,
+  event: ReactionEvent,
+): Promise<void> {
+  const emoji = CHAT_REACTIONS[adapter]?.[event];
+  if (!emoji) return;
+  try {
+    const target = getChatInstance(adapter)?.getAdapter(adapter);
+    if (!target) return;
+    assertTrustedChatTarget(threadId);
+    await target.addReaction(threadId, messageId, emoji);
+  } catch (error) {
+    console.warn(
+      scrubSecrets(
+        `[chat-sdk] Could not set the ${event} reaction on ${messageId} in ${threadId}: ${errorMessage(error)}`,
+      ),
+    );
+  }
+}
+
+/** Remove the bot's reaction from each message. Best effort, like {@link setChatMessageReaction}. */
+export async function clearChatMessageReactions(
+  adapter: string,
+  threadId: string,
+  messageIds: readonly string[],
+): Promise<void> {
+  if (!chatAdapterReacts(adapter) || messageIds.length === 0) return;
+  const target = getChatInstance(adapter)?.getAdapter(adapter);
+  if (!target) return;
+  for (const messageId of messageIds) {
+    try {
+      // Telegram clears the bot's whole reaction whatever emoji is named.
+      await target.removeReaction(threadId, messageId, TELEGRAM_REACTIONS.accepted);
+    } catch (error) {
+      console.warn(
+        scrubSecrets(
+          `[chat-sdk] Could not clear the reaction on ${messageId} in ${threadId}: ${errorMessage(error)}`,
+        ),
+      );
+    }
+  }
+}
+
+/** KV namespace of per-channel Chat SDK settings, keyed like the channel mappings. */
+export const CHAT_CHANNEL_SETTINGS_NAMESPACE = "integrations:chat:channel-settings";
+
+export interface ChatChannelSettings {
+  /** Also post the text steering acknowledgement on an adapter that reacts. */
+  textAcks?: boolean;
+}
+
+/**
+ * Whether a steering message gets a text acknowledgement. Adapters without
+ * reactions always get one; a reacting adapter only when its channel opts in.
+ */
+export async function wantsChatTextAck(adapter: string, channelId: string): Promise<boolean> {
+  if (!chatAdapterReacts(adapter)) return true;
+  try {
+    const row = await getKv(CHAT_CHANNEL_SETTINGS_NAMESPACE, chatChannelKey(adapter, channelId));
+    const settings = row?.value as ChatChannelSettings | null | undefined;
+    return typeof settings === "object" && settings !== null && settings.textAcks === true;
+  } catch (error) {
+    console.warn(`[chat-sdk] Could not read the channel settings: ${errorMessage(error)}`);
+    return false;
+  }
+}

package/src/integrations/chat-sdk/relay.ts

@@ -1,4 +1,5 @@
 import {
+  getAgentById,
   getPendingChatRelayTasks,
   giveUpStaleChatRelays,
   markChatRelayAttempted,
@@ -6,13 +7,17 @@ import {
   markChatRelayGivenUp,
   recordChatRelayError,
 } from "@/be/db";
+import { terminalReactionEvent } from "@/integrations/reaction-events";
 import { chatThreadOfContextKey } from "@/tasks/context-key";
 import type { AgentTask } from "@/types";
 import { scrubSecrets } from "@/utils/secret-scrubber";
 import { workflowEventBus } from "@/workflows/event-bus";
+import { shortId } from "./commands";
+import { chatMessageLimit, splitChatMessage } from "./limits";
 import { errorMessage } from "./logger";
 import { postChatMessage } from "./outbound";
 import { taskOutputChatFiles } from "./outbound-files";
+import { setChatMessageReaction } from "./reactions";
 import { getChatInstance, getChatSdkHealth } from "./runtime";
 import { sweepExpired } from "./state";
 import { stopTypingKeepalive } from "./typing";
@@ -33,14 +38,64 @@ const SWEEP_EVERY_N_TICKS = 20;
 /** Coalesce bursts of terminal-task events into one early tick. */
 const EARLY_TICK_DEBOUNCE_MS = 250;
 
-/** The text posted for a terminal task. Failed and cancelled tasks get a status line first. */
-export function formatChatRelayText(task: AgentTask): string {
+/**
+ * The first line of every relayed answer: the short task id `/status` shows
+ * and the agent's name, e.g. `#a3f2b1c9 · Coder`. Two answers in one chat stay
+ * apart even when the platform cannot show what they reply to.
+ */
+export function formatChatTaskTag(task: Pick<AgentTask, "id">, agentName?: string): string {
+  return agentName ? `#${shortId(task)} · ${agentName}` : `#${shortId(task)}`;
+}
+
+/** The task tag, an optional status line, and the answer itself. */
+function relayHeadAndBody(task: AgentTask, agentName?: string): { head: string; body: string } {
+  const tag = formatChatTaskTag(task, agentName);
   const body = (task.output || task.failureReason || "").trim();
-  if (task.status === "failed") return body ? `**Task failed.**\n\n${body}` : "**Task failed.**";
-  if (task.status === "cancelled") {
-    return body ? `**Task cancelled.**\n\n${body}` : "**Task cancelled.**";
+  if (task.status === "failed") return { head: `${tag}\n**Task failed.**`, body };
+  if (task.status === "cancelled") return { head: `${tag}\n**Task cancelled.**`, body };
+  return { head: tag, body: body || "Task completed." };
+}
+
+/** The text posted for a terminal task. Failed and cancelled tasks get a status line after the tag. */
+export function formatChatRelayText(task: AgentTask, agentName?: string): string {
+  const { head, body } = relayHeadAndBody(task, agentName);
+  return body ? `${head}\n\n${body}` : head;
+}
+
+/** On Telegram, an answer body longer than this is posted collapsed. */
+export const TELEGRAM_FOLD_CHARS = 1000;
+/** A first paragraph up to this long stays visible above the collapsed rest. */
+const FOLD_LEAD_MAX_CHARS = 280;
+/** Room for the `<details>` markup and separators around one folded piece. */
+const FOLD_MARKUP_CHARS = 80;
+
+/**
+ * The messages posted for a terminal task. On Telegram a long body goes into
+ * collapsed `<details>` blocks: Bot API 10.1 rich messages render them folded
+ * and parse the markdown inside. Each message gets its own block, so the
+ * length split never cuts the markup in two.
+ */
+export function formatChatRelayMessages(
+  task: AgentTask,
+  adapter: string,
+  agentName?: string,
+): string[] {
+  const { head, body } = relayHeadAndBody(task, agentName);
+  if (adapter !== "telegram" || body.length <= TELEGRAM_FOLD_CHARS) {
+    return [formatChatRelayText(task, agentName)];
   }
-  return body || "Task completed.";
+  const breakAt = body.indexOf("\n\n");
+  const lead = breakAt > 0 && breakAt <= FOLD_LEAD_MAX_CHARS ? body.slice(0, breakAt) : "";
+  const rest = lead ? body.slice(breakAt).trim() : body;
+  const top = lead ? `${head}\n\n${lead}` : head;
+  const room = chatMessageLimit(adapter) - top.length - FOLD_MARKUP_CHARS;
+  const pieces = splitChatMessage(rest, room);
+  return pieces.map((piece, index) => {
+    const label = lead ? "Rest of the answer" : "Full answer";
+    const summary = pieces.length > 1 ? `${label} (${index + 1}/${pieces.length})` : label;
+    const block = `<details><summary>${summary}</summary>\n\n${piece}\n\n</details>`;
+    return index === 0 ? `${top}\n\n${block}` : block;
+  });
 }
 
 /**
@@ -96,16 +151,29 @@ export async function processPendingChatRelays(
 
     if (!(await markChatRelayAttempted(task.id, now))) continue;
     try {
+      const agent = task.agentId ? await getAgentById(task.agentId) : null;
       await postChatMessage({
         adapter: target.adapter,
         threadId: target.threadId,
-        text: formatChatRelayText(task),
+        text: formatChatRelayMessages(task, target.adapter, agent?.name),
         taskId: task.id,
         files: await taskOutputChatFiles(task.id),
+        // The inbound message this task answers. A lead follow-up, resume or
+        // defer wake-up inherits it from its parent, so it answers the same ask.
+        replyToMessageId: task.mentionMessageId,
       });
       stopTypingKeepalive(target.threadId);
       await markChatRelayDelivered(task.id, now);
       console.log(`[chat-sdk] Relayed ${task.status} task ${task.id} to ${target.adapter}`);
+      // The ask's reaction ends with the answer. Never throws: delivery already landed.
+      if (task.mentionMessageId) {
+        await setChatMessageReaction(
+          target.adapter,
+          target.threadId,
+          task.mentionMessageId,
+          terminalReactionEvent(task.status),
+        );
+      }
     } catch (error) {
       const message = errorMessage(error);
       await recordChatRelayError(task.id, message, now);

package/src/integrations/chat-sdk/thread-buffer.ts

@@ -17,6 +17,8 @@ export interface ChatBufferedMessage {
   isDirectMessage: boolean;
   /** Why the message was taken; `none` when it is unaddressed. */
   addressed: ChatAddressedReason;
+  /** The message got the `accepted` reaction when it was buffered. */
+  reacted?: boolean;
   facts: ChatMessageFacts;
   attachments: Attachment[];
 }

package/src/integrations/reaction-events.ts

@@ -0,0 +1,20 @@
+import type { AgentTaskStatus } from "@/types";
+
+/**
+ * The task lifecycle a chat channel shows as a reaction on the user's message.
+ * Each channel maps these events to its own emoji: Slack in
+ * `src/slack/reaction-shortcode.ts`, Chat SDK adapters in
+ * `src/integrations/chat-sdk/reactions.ts`.
+ *
+ * - `accepted`: the swarm took the message.
+ * - `buffered`: the message joined a batch that is still waiting.
+ * - `now`: the message skipped the buffer (`!now`).
+ * - `steered`: the message went to a running task, or was queued for it.
+ * - `completed` / `failed`: the task that answers the message ended.
+ */
+export type ReactionEvent = "accepted" | "buffered" | "now" | "steered" | "completed" | "failed";
+
+/** The terminal event for an ended task: anything but `completed` shows as `failed`. */
+export function terminalReactionEvent(status: AgentTaskStatus): "completed" | "failed" {
+  return status === "completed" ? "completed" : "failed";
+}

package/src/providers/amp-adapter.ts

@@ -44,7 +44,7 @@ import type {
  * default; the image installs exactly this version and the per-task settings
  * set `amp.updates.mode: "disabled"`. Bump it deliberately, with a live run.
  */
-export const AMP_PACKAGE = "@ampcode/cli@0.0.1792670445-ge8d5b3";
+export const AMP_PACKAGE = "@ampcode/cli@0.0.1792728062-g40cf3f";
 
 /** MCP server name. Amp exposes its tools as `agent_swarm` / `store_progress` (dashes become underscores). */
 const AMP_MCP_SERVER_NAME = "agent-swarm";

package/src/rbac/legacy-policy.ts

@@ -351,6 +351,7 @@ export const LEGACY_POLICY = {
   "script.api.update": leadOnly,
   "script.api.rotate": leadOnly,
   "script.api.delete": leadOnly,
+  "schedule.deferral.update.any": leadOrResourceOwner,
   // Pool writes pick the image that receives a runtime token, so only humans
   // may make them. The lead may only place agents into operator-made pools.
   "runtime_pool.write": operatorOrUser,
@@ -358,6 +359,8 @@ export const LEGACY_POLICY = {
   "runtime_controller.write": operatorOrUser,
   // A worker token stands in for the swarm API key on a worker, so only humans mint it.
   "agent.token.manage": operatorOrUser,
+  // Agents never change human roles.
+  "user.role.manage": operatorOrUser,
   "extension.write": extensionWrite,
   "extension.activate": extensionActivation,
   "extension.install.inline": leadOrOperatorOrUser,

package/src/rbac/permissions.ts

@@ -37,6 +37,10 @@ export const PERMISSIONS = {
     description: "Mint, rotate, or revoke an agent-bound worker token.",
     namespace: "agent",
   },
+  "user.role.manage": {
+    description: "Assign or remove a person's RBAC roles.",
+    namespace: "user",
+  },
   "task.cancel.any": {
     description: "Cancel any task (beyond tasks the caller created).",
     namespace: "task",
@@ -354,6 +358,10 @@ export const PERMISSIONS = {
     description: "Delete an external script API endpoint.",
     namespace: "script",
   },
+  "schedule.deferral.update.any": {
+    description: "Change a defer-task schedule the caller did not create.",
+    namespace: "schedule",
+  },
   "runtime_pool.write": {
     description: "Create, update, or delete runtime pools (image, provider kind, placement).",
     namespace: "runtime_pool",

package/src/scheduler/schedule-task.ts

@@ -1,12 +1,53 @@
-import { createTaskExtended, getDbClient } from "@/be/db";
+import { createTaskExtended, getAgentById, getDbClient, getTaskById } from "@/be/db";
 import { carryUnhandledSteering } from "@/be/steering";
-import { scheduleContextKey } from "@/tasks/context-key";
+import { chatThreadOfContextKey, scheduleContextKey } from "@/tasks/context-key";
 import {
   type PreparedTaskCreate,
   prepareTaskWithSiblingAwareness,
 } from "@/tasks/sibling-awareness";
 import type { AgentTask, ScheduledTask } from "@/types";
 
+/**
+ * Whether the task's own answer is posted to its chat thread. Mirrors the
+ * relay triggers (migration 235): a delegated worker task, or its resume,
+ * reports through the Lead follow-up instead.
+ */
+async function answersInChat(task: AgentTask): Promise<boolean> {
+  if (task.source === "chat") return true;
+  if (task.source === "system" && task.taskType === "follow-up") return true;
+  // Only a wake-up that passed `scheduleTaskContextKey` has a chat key.
+  if (task.source === "schedule" && task.taskType === "deferred") return true;
+  if (task.source === "system" && task.taskType === "resume" && task.agentId) {
+    return (await getAgentById(task.agentId))?.isLead === true;
+  }
+  return false;
+}
+
+/**
+ * A defer-task wake-up of a chat task stays in its chat thread, so the chat
+ * relay posts the real answer there (and `/status` and `/cancel` see it).
+ * Only the deferring agent continuing its own task gets the thread: a schedule
+ * re-targeted or re-owned after the deferral, or the deferral of a task that
+ * never answered in chat, fires like any other schedule. Every other firing
+ * gets the schedule's own key.
+ */
+async function scheduleTaskContextKey(schedule: ScheduledTask): Promise<string> {
+  if (schedule.taskType === "deferred" && schedule.parentTaskId) {
+    const parent = await getTaskById(schedule.parentTaskId);
+    if (
+      parent?.contextKey &&
+      chatThreadOfContextKey(parent.contextKey) &&
+      parent.agentId &&
+      schedule.targetAgentId === parent.agentId &&
+      schedule.createdByAgentId === parent.agentId &&
+      (await answersInChat(parent))
+    ) {
+      return parent.contextKey;
+    }
+  }
+  return scheduleContextKey({ scheduleId: schedule.id });
+}
+
 /**
  * Run the `pre.task.create` extension hooks for a schedule firing. Call this OUTSIDE
  * the transaction that creates the task: the dispatcher skips hooks while a
@@ -35,7 +76,7 @@ export async function prepareStandaloneScheduleTask(
       scheduleId: schedule.id,
       source: "schedule",
       requestedByUserId: schedule.createdBy,
-      contextKey: scheduleContextKey({ scheduleId: schedule.id }),
+      contextKey: await scheduleTaskContextKey(schedule),
       // Set only by `defer-task`. An explicit parent wins over the sibling-awareness
       // auto-wiring (see withSiblingAwareness in src/tasks/sibling-awareness.ts), so
       // the wake-up run continues the deferred task rather than a random sibling.