@desplega.ai/agent-swarm 2.5.1 → 2.5.2

package/src/tests/sessions-tree.test.ts

@@ -491,3 +491,245 @@ test("limit clamps to 200 and count without chain filters does not recurse", asy
   expect(body.sessions).toHaveLength(200);
   expect(body.total).toBe(205);
 });
+
+describe("Mine view hides machine-started roots", () => {
+  test("a workflow root attributed to the viewer is hidden by default and shown under All", async () => {
+    // Positive control: pr-review-demo fan-out carries the trigger user as requester.
+    const demo = await task("shared/", { source: "workflow", tags: ["pr-review-demo"] });
+    const scheduled = await task("shared/", { source: "schedule" });
+    const heartbeat = await task("shared/", { source: "system" });
+    // Negative controls: the viewer's own human sessions stay.
+    const slack = await task("shared/", { source: "slack" });
+    const ui = await task("shared/", { source: "ui" });
+    const whatsapp = await task("shared/", { source: "system", taskType: "kapso-inbound" });
+    // A workflow root someone else shared with the viewer stays too.
+    const sharedRun = await task("shared/", { source: "workflow", requestedByUserId: other.id });
+    await share(sharedRun);
+    // Ownerless roots stay out of both views, as before.
+    await task("shared/", { source: "workflow", requestedByUserId: undefined });
+
+    const headers = { "x-swarm-user-id": owner.id };
+    const list = async (query: string) => {
+      const res = await fetch(`${baseUrl}/api/sessions?scope=tree&limit=50&${query}`, { headers });
+      const body = (await res.json()) as { total: number; sessions: { root: { id: string } }[] };
+      expect(body.sessions).toHaveLength(body.total);
+      return body.sessions.map((s) => s.root.id).sort();
+    };
+    const tree = async (query: string) => {
+      const res = await fetch(`${baseUrl}/api/session-tree?${query}`, { headers });
+      return ((await res.json()) as Awaited<ReturnType<typeof getSessionTree>>).noGroup.total;
+    };
+
+    const mine = [slack.id, ui.id, whatsapp.id, sharedRun.id].sort();
+    const all = [...mine, demo.id, scheduled.id, heartbeat.id].sort();
+    expect(await list("")).toEqual(mine);
+    expect(await list("show=mine")).toEqual(mine);
+    expect(await list("show=all")).toEqual(all);
+    expect(await tree("")).toBe(mine.length);
+    expect(await tree("show=all")).toBe(all.length);
+
+    // No picked user: the bypass actor still sees every root, ownerless included.
+    const bypass = await fetch(`${baseUrl}/api/sessions?scope=tree&limit=50`);
+    expect(((await bypass.json()) as { total: number }).total).toBe(all.length + 1);
+    // Access is unchanged: the hidden session still opens by direct link.
+    const detail = await fetch(`${baseUrl}/api/sessions/${demo.id}`, { headers });
+    expect(detail.status).toBe(200);
+  });
+});
+
+describe("source filter and list triage", () => {
+  const asOwner = () => ({ "x-swarm-user-id": owner.id, "content-type": "application/json" });
+  const treeOf = async (query = "") => {
+    const res = await fetch(`${baseUrl}/api/session-tree?${query}`, { headers: asOwner() });
+    expect(res.status).toBe(200);
+    return (await res.json()) as Awaited<ReturnType<typeof getSessionTree>>;
+  };
+  const listOf = async (query: string) => {
+    const res = await fetch(`${baseUrl}/api/sessions?scope=tree&limit=50&${query}`, {
+      headers: asOwner(),
+    });
+    const body = (await res.json()) as {
+      total: number;
+      sessions: { root: { id: string }; readState?: string }[];
+    };
+    return body;
+  };
+  const triage = (body: Record<string, unknown>, withUser = true) =>
+    fetch(`${baseUrl}/api/session-triage`, {
+      method: "POST",
+      headers: withUser ? asOwner() : { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    });
+
+  test("hideSource leaves a source out of sections and lists, and sources still count it", async () => {
+    const slackA = await task("shared/", { source: "slack" });
+    const slackB = await task("shared/a/", { source: "slack" });
+    const ui = await task("shared/", { source: "ui" });
+    const chat = await task("shared/", { source: "chat" });
+
+    const full = await treeOf();
+    expect(full.inbox.total).toBe(4);
+    expect(full.sources).toEqual([
+      { source: "slack", total: 2 },
+      { source: "chat", total: 1 },
+      { source: "ui", total: 1 },
+    ]);
+
+    const hidden = await treeOf("hideSource=slack,chat");
+    expect(hidden.inbox.total).toBe(1);
+    expect(hidden.noGroup.total).toBe(1);
+    expect(hidden.groups).toEqual([]);
+    // The menu still offers the hidden sources back.
+    expect(hidden.sources).toEqual(full.sources);
+
+    const inbox = await listOf("triage=inbox&hideSource=slack,chat");
+    expect(inbox.total).toBe(1);
+    expect(inbox.sessions.map((s) => s.root.id)).toEqual([ui.id]);
+    const all = await listOf("triage=inbox");
+    expect(all.sessions.map((s) => s.root.id).sort()).toEqual(
+      [slackA.id, slackB.id, ui.id, chat.id].sort(),
+    );
+  });
+
+  test("triage by list writes every matching session, honoring the list and the filters", async () => {
+    const a = await task("shared/", { source: "ui" });
+    const b = await task("shared/", { source: "ui" }, OLD);
+    const slack = await task("shared/", { source: "slack" });
+    const grouped = await task("shared/a/", { source: "ui" });
+    const workflow = await task("shared/", { source: "workflow" });
+    const later = await task("shared/", { source: "ui" });
+    await state(later.id, "snoozed", NOW, { snoozeUntil: "2999-01-01T00:00:00.000Z" });
+
+    // No group, Slack hidden, Mine view: a and b only.
+    let res = await triage({ action: "done", noGroup: true, hideSource: ["slack"] });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ updated: 2 });
+    let done = await listOf("triage=done");
+    expect(done.sessions.map((s) => s.root.id).sort()).toEqual([a.id, b.id].sort());
+    // The rest keep their state; the workflow root (All only) was not touched.
+    const inbox = await listOf("triage=inbox&show=all");
+    expect(inbox.sessions.map((s) => s.root.id).sort()).toEqual(
+      [slack.id, grouped.id, workflow.id].sort(),
+    );
+    expect((await listOf("triage=later")).sessions.map((s) => s.root.id)).toEqual([later.id]);
+
+    // Back to the Inbox from the Done list, then read and unread across the Inbox.
+    res = await triage({ action: "inbox", triage: "done" });
+    expect(await res.json()).toEqual({ updated: 2 });
+    expect((await listOf("triage=done")).total).toBe(0);
+    res = await triage({ action: "unread", triage: "inbox" });
+    expect(await res.json()).toEqual({ updated: 4 });
+    expect((await treeOf()).inbox.unread).toBe(4);
+    res = await triage({ action: "read", triage: "inbox" });
+    expect(await res.json()).toEqual({ updated: 4 });
+    const tree = await treeOf();
+    expect(tree.inbox.unread).toBe(0);
+    expect(tree.inbox.total).toBe(4);
+
+    // One group only.
+    res = await triage({ action: "done", groupKey: "shared/a/" });
+    expect(await res.json()).toEqual({ updated: 1 });
+    done = await listOf("triage=done");
+    expect(done.sessions.map((s) => s.root.id)).toEqual([grouped.id]);
+    // Show All reaches the workflow root.
+    res = await triage({ action: "done", triage: "inbox", show: "all" });
+    expect(await res.json()).toEqual({ updated: 4 });
+    expect((await listOf("triage=inbox&show=all")).total).toBe(0);
+  });
+
+  test("triage by list acts on the Later list", async () => {
+    const snoozedA = await task("shared/", { source: "ui" });
+    const snoozedB = await task("shared/", { source: "ui" });
+    const open = await task("shared/", { source: "ui" });
+    for (const id of [snoozedA.id, snoozedB.id]) {
+      await state(id, "snoozed", NOW, { snoozeUntil: "2999-01-01T00:00:00.000Z" });
+    }
+
+    let res = await triage({ action: "done", triage: "later" });
+    expect(await res.json()).toEqual({ updated: 2 });
+    expect((await listOf("triage=later")).total).toBe(0);
+    const done = await listOf("triage=done");
+    expect(done.sessions.map((s) => s.root.id).sort()).toEqual([snoozedA.id, snoozedB.id].sort());
+    const cleared = await getDbClient().query<{ snoozeUntil: string | null }>(
+      "SELECT snoozeUntil FROM inbox_item_state WHERE itemId IN (?, ?)",
+      [snoozedA.id, snoozedB.id],
+    );
+    expect(cleared.map((row) => row.snoozeUntil)).toEqual([null, null]);
+
+    await state(snoozedA.id, "snoozed", NOW, { snoozeUntil: "2999-01-01T00:00:00.000Z" });
+    res = await triage({ action: "inbox", triage: "later" });
+    expect(await res.json()).toEqual({ updated: 1 });
+    const inbox = await listOf("triage=inbox");
+    expect(inbox.sessions.map((s) => s.root.id).sort()).toEqual([snoozedA.id, open.id].sort());
+  });
+
+  test("triage by list writes the same row fields as the one-session PATCH", async () => {
+    type Row = {
+      status: string;
+      snoozeUntil: string | null;
+      dismissedAt: string | null;
+      doneAt: string | null;
+      readAt: string | null;
+      lastReadAt: string | null;
+    };
+    const rowOf = async (id: string) =>
+      (await getDbClient().get<Row>("SELECT * FROM inbox_item_state WHERE itemId = ?", [
+        id,
+      ])) as Row;
+    const unreadCursor = "1970-01-01T00:00:00.000Z";
+    for (const action of ["done", "inbox", "read", "unread"] as const) {
+      // Two sessions with the same earlier state: read once, then snoozed past
+      // the wake time (back in the Inbox). One gets the dashboard's PATCH
+      // write, the other the list write.
+      const one = await task(`shared/${action}-one/`, { source: "ui" });
+      const list = await task(`shared/${action}-list/`, { source: "ui" });
+      for (const id of [one.id, list.id]) {
+        await state(id, "snoozed", NOW, { snoozeUntil: OLD, lastReadAt: OLD });
+        await getDbClient().run("UPDATE inbox_item_state SET readAt = ? WHERE itemId = ?", [
+          OLD,
+          id,
+        ]);
+      }
+      const listed = (await fetch(
+        `${baseUrl}/api/sessions?scope=tree&groupKey=shared/${action}-one/`,
+        {
+          headers: asOwner(),
+        },
+      ).then((res) => res.json())) as { sessions: { lastActivityAt: string }[] };
+      const lastActivityAt = listed.sessions[0]?.lastActivityAt;
+      expect(lastActivityAt).toBeTruthy();
+      // The write of `writeFor` in apps/ui/src/api/hooks/use-session-triage.ts.
+      const write =
+        action === "done"
+          ? { status: "done" as const }
+          : action === "read"
+            ? { status: "open" as const, readAt: NOW, lastReadAt: lastActivityAt }
+            : action === "unread"
+              ? { status: "open" as const, lastReadAt: unreadCursor }
+              : { status: "open" as const };
+      await upsertInboxState({ userId: owner.id, itemType: "to_read", itemId: one.id, ...write });
+      const res = await triage({ action, groupKey: `shared/${action}-list/` });
+      expect(await res.json()).toEqual({ updated: 1 });
+
+      const [a, b] = [await rowOf(one.id), await rowOf(list.id)];
+      expect({ ...b, doneAt: b.doneAt !== null }).toMatchObject({
+        status: a.status,
+        snoozeUntil: a.snoozeUntil,
+        dismissedAt: a.dismissedAt,
+        doneAt: a.doneAt !== null,
+        readAt: a.readAt,
+        lastReadAt: a.lastReadAt,
+      });
+      // readAt is sticky: the first view stays.
+      expect(b.readAt).toBe(OLD);
+    }
+  });
+
+  test("triage by list needs a picked user and exactly one list", async () => {
+    await task("shared/", { source: "ui" });
+    expect((await triage({ action: "done", triage: "inbox" }, false)).status).toBe(400);
+    expect((await triage({ action: "done" })).status).toBe(400);
+    expect((await triage({ action: "done", triage: "inbox", noGroup: true })).status).toBe(400);
+    expect((await listOf("triage=inbox")).total).toBe(1);
+  });
+});

package/src/tests/user-roles-http.test.ts

@@ -0,0 +1,204 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { closeDb, createAgent, createUser, getDbClient, initDb } from "../be/db";
+import { ensureRbacSeedsSynced, listUserRoles, setUserRoles } from "../be/rbac-roles";
+import { type IdentityActor, listUserEvents, mintToken } from "../be/users";
+import { handleApprovalRequests } from "../http/approval-requests";
+import { handleCore } from "../http/core";
+import { handleTasks } from "../http/tasks";
+import { handleUserRoles } from "../http/user-roles";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { listenOnFreePort } from "./test-net";
+
+const key = `user-roles-test-${crypto.randomUUID()}`;
+const ACTOR: IdentityActor = { kind: "operator", id: "user-roles-test" };
+let server: Server;
+let baseUrl: string;
+let leadId: string;
+
+async function request(
+  path: string,
+  bearer: string,
+  options: { method?: string; body?: unknown; headers?: Record<string, string> } = {},
+) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: options.method ?? (options.body === undefined ? "GET" : "POST"),
+    headers: {
+      Authorization: `Bearer ${bearer}`,
+      "Content-Type": "application/json",
+      ...options.headers,
+    },
+    body: options.body === undefined ? undefined : JSON.stringify(options.body),
+  });
+  const text = await res.text();
+  let body: any = text;
+  try {
+    body = JSON.parse(text);
+  } catch {}
+  return { status: res.status, text, body };
+}
+
+const putRoles = (userId: string, bearer: string, roles: string[], headers = {}) =>
+  request(`/api/users/${userId}/roles`, bearer, { method: "PUT", body: { roles }, headers });
+
+async function newUser(name: string, roles?: string[]) {
+  const user = await createUser({ name });
+  if (roles) await setUserRoles(user.id, roles, null);
+  const token = (await mintToken(user.id, name, ACTOR)).plaintext;
+  return { id: user.id, token };
+}
+
+async function dispatch(req: IncomingMessage, res: ServerResponse) {
+  const id = req.headers["x-agent-id"] as string | undefined;
+  if (await handleCore(req, res, id, key)) return;
+  const segments = getPathSegments(req.url ?? "");
+  const query = parseQueryParams(req.url ?? "");
+  if (await handleUserRoles(req, res, segments, query)) return;
+  if (await handleApprovalRequests(req, res, segments, query)) return;
+  if (await handleTasks(req, res, segments, query, id)) return;
+  res.writeHead(404).end();
+}
+
+beforeAll(async () => {
+  initDb(":memory:");
+  ensureRbacSeedsSynced({ quiet: true });
+  leadId = (await createAgent({ name: "roles-lead", isLead: true, status: "idle" })).id;
+  server = createServer((req, res) => {
+    void dispatch(req, res).catch(() => res.writeHead(500).end());
+  });
+  baseUrl = `http://127.0.0.1:${await listenOnFreePort(server)}`;
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  closeDb();
+});
+
+describe("PUT /api/users/{id}/roles", () => {
+  test("a role change changes what the user may do", async () => {
+    await newUser("keeper-admin");
+    const alice = await newUser("alice");
+    const task = { task: "do a thing" };
+    expect((await request("/api/tasks", alice.token, { body: task })).status).not.toBe(403);
+
+    const set = await putRoles(alice.id, key, ["viewer"]);
+    expect(set.status).toBe(200);
+    expect(set.body.roles.map((r: { name: string }) => r.name)).toEqual(["viewer"]);
+    expect((await request("/api/tasks", alice.token, { body: task })).status).toBe(403);
+    expect((await request("/api/tasks", alice.token)).status).not.toBe(403);
+
+    expect((await putRoles(alice.id, key, ["admin"])).status).toBe(200);
+    expect((await request("/api/tasks", alice.token, { body: task })).status).not.toBe(403);
+  });
+
+  test("a demoted user can no longer answer approvals", async () => {
+    const bob = await newUser("bob", ["requester"]);
+    const res = await request(`/api/approval-requests/${crypto.randomUUID()}/respond`, bob.token, {
+      body: { responses: {} },
+    });
+    expect(res.status).toBe(403);
+    expect(res.text).toContain("approval.respond");
+  });
+
+  test("only an operator or a grant-all user may change roles", async () => {
+    const target = await newUser("target");
+    const requester = await newUser("requester-user", ["requester"]);
+    const viewer = await newUser("viewer-user", ["viewer"]);
+    const admin = await newUser("admin-user");
+    expect((await putRoles(target.id, requester.token, ["viewer"])).status).toBe(403);
+    expect((await putRoles(target.id, viewer.token, ["viewer"])).status).toBe(403);
+    // The shared key acting as an agent is not the operator.
+    expect((await putRoles(target.id, key, ["viewer"], { "X-Agent-ID": leadId })).status).toBe(403);
+    expect((await putRoles(target.id, admin.token, ["requester"])).status).toBe(200);
+  });
+
+  test("a custom role holding user.role.manage cannot grant admin", async () => {
+    const target = await newUser("grant-target");
+    const manager = await newUser("manager", ["viewer"]);
+    const client = getDbClient();
+    await client.run(
+      "INSERT INTO roles (id, name, description, isBuiltin, grantsAll) VALUES ('role-rm', 'role-manager', 'x', 0, 0)",
+    );
+    await client.run(
+      "INSERT INTO role_permissions (roleId, verb) VALUES ('role-rm', 'user.role.manage')",
+    );
+    await client.run(
+      "INSERT INTO principal_roles (principalType, principalId, roleId) VALUES ('user', ?, 'role-rm')",
+      [manager.id],
+    );
+    expect((await putRoles(target.id, manager.token, ["admin"])).status).toBe(403);
+  });
+
+  test("last-admin guard", async () => {
+    const client = getDbClient();
+    await client.run("UPDATE users SET status = 'suspended'");
+    const sole = await newUser("sole-admin");
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(409);
+    expect((await listUserRoles(sole.id)).map((r) => r.name)).toEqual(["admin"]);
+
+    const second = await newUser("second-admin");
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(200);
+    // second is now the sole active admin; a suspended admin may still be demoted.
+    await client.run("UPDATE users SET status = 'suspended' WHERE id = ?", [second.id]);
+    const third = await newUser("third");
+    await client.run("UPDATE users SET status = 'suspended' WHERE id = ?", [third.id]);
+    expect((await putRoles(third.id, key, ["requester"])).status).toBe(200);
+    await client.run("UPDATE users SET status = 'active'");
+  });
+
+  test("validation", async () => {
+    const user = await newUser("validated");
+    for (const roles of [[], ["nope"], ["admin", "viewer"]]) {
+      expect((await putRoles(user.id, key, roles)).status).toBe(400);
+    }
+    expect((await putRoles("missing-user", key, ["viewer"])).status).toBe(404);
+    expect((await listUserRoles(user.id)).map((r) => r.name)).toEqual(["admin"]);
+  });
+
+  test("agent rows in principal_roles are neither listed nor counted as admins", async () => {
+    const client = getDbClient();
+    await client.run("UPDATE users SET status = 'suspended'");
+    const sole = await newUser("sole-with-agent-twin");
+    await client.run(
+      `INSERT INTO principal_roles (principalType, principalId, roleId)
+       VALUES ('agent', 'agent-twin', 'rbac-role-admin')`,
+    );
+    const twin = await client.get<{ id: string }>("SELECT id FROM users WHERE id = ?", [sole.id]);
+    await client.run("UPDATE principal_roles SET principalId = ? WHERE principalType = 'agent'", [
+      twin!.id,
+    ]);
+    expect((await putRoles(sole.id, key, ["viewer"])).status).toBe(409);
+    const roles = await request(`/api/users/${sole.id}/roles`, key);
+    expect(roles.body.roles.map((r: { name: string }) => r.name)).toEqual(["admin"]);
+    await client.run("DELETE FROM principal_roles WHERE principalType = 'agent'");
+    await client.run("UPDATE users SET status = 'active'");
+  });
+
+  test("audit event and role catalog", async () => {
+    const user = await newUser("audited");
+    await putRoles(user.id, key, ["requester"]);
+    const events = await listUserEvents(user.id);
+    const change = events.find((e) => e.eventType === "profile_changed");
+    expect(JSON.stringify(change)).toContain("requester");
+    expect(JSON.stringify(change)).toContain("admin");
+
+    const catalog = await request("/api/rbac/roles", key);
+    const primary = catalog.body.roles.filter((r: { primary: boolean }) => r.primary);
+    expect(primary.map((r: { name: string }) => r.name).sort()).toEqual([
+      "admin",
+      "requester",
+      "viewer",
+    ]);
+  });
+
+  test("persists with RBAC disabled", async () => {
+    process.env.RBAC_ENABLED = "false";
+    try {
+      const user = await newUser("rbac-off");
+      expect((await putRoles(user.id, key, ["viewer"])).status).toBe(200);
+      expect((await listUserRoles(user.id)).map((r) => r.name)).toEqual(["viewer"]);
+    } finally {
+      delete process.env.RBAC_ENABLED;
+    }
+  });
+});

package/src/tests/workflow-hitl-dynamic-questions.test.ts

@@ -11,6 +11,7 @@ import {
   initDb,
 } from "../be/db";
 import type { WorkflowDefinition } from "../types";
+import { buildSlackQuestionsSummary } from "../workflows/approval-notifications";
 import { validateDefinition } from "../workflows/definition";
 import { interpolateNodeConfig, startWorkflowExecution } from "../workflows/engine";
 import { InProcessEventBus } from "../workflows/event-bus";
@@ -20,7 +21,6 @@ import {
   type ExecutorResult,
 } from "../workflows/executors/base";
 import {
-  buildSlackQuestionsSummary,
   HumanInTheLoopExecutor,
   MAX_HITL_QUESTIONS,
   resolveHitlQuestions,

package/src/tools/chat-reply.ts

@@ -70,6 +70,8 @@ export const registerChatReplyTool = (server: McpServer) => {
           text,
           taskId: task.id,
           files: resolved.files,
+          // Same anchor as the final answer: the message that started this task.
+          replyToMessageId: task.mentionMessageId,
         });
         return toolOk(
           `Posted to ${thread.adapter} thread ${sent.threadId}.${unsentFilesSummary(sent.unsentFiles)}`,

package/src/tools/schedules/patch-schedule.ts

@@ -15,6 +15,7 @@ import {
 import { explicitModelErrorForAgent } from "@/be/model-validation";
 import { mergeScheduleTiming, validateRecurringTiming } from "@/be/schedules/validate";
 import { getScript } from "@/be/scripts/db";
+import { can } from "@/rbac";
 import { calculateNextRun } from "@/scheduler";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
 import {
@@ -174,6 +175,23 @@ export const registerPatchScheduleTool = (server: McpServer) => {
         return toolErr("Agent not found.");
       }
 
+      // A deferral continues its owner's task, in that task's chat thread when
+      // it has one (src/scheduler/schedule-task.ts). Only the owner or a lead
+      // may change it.
+      if (
+        schedule.taskType === "deferred" &&
+        !can({
+          principal: { kind: "agent", agentId: caller.id, isLead: caller.isLead },
+          verb: "schedule.deferral.update.any",
+          resource: { kind: "owned", ownerAgentId: schedule.createdByAgentId },
+          source: "mcp",
+        }).allow
+      ) {
+        return toolErr(
+          `Schedule "${schedule.name}" defers another agent's task. Only that agent or a lead can change it.`,
+        );
+      }
+
       // Reject updates on completed one-time schedules
       if (schedule.scheduleType === "one_time" && !schedule.enabled && schedule.lastRunAt) {
         return toolErr(

package/src/tools/schedules/update-schedule.ts

@@ -15,6 +15,7 @@ import {
 import { explicitModelErrorForAgent } from "@/be/model-validation";
 import { mergeScheduleTiming, validateRecurringTiming } from "@/be/schedules/validate";
 import { getScript } from "@/be/scripts/db";
+import { can } from "@/rbac";
 import { calculateNextRun } from "@/scheduler";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
 import {
@@ -173,6 +174,23 @@ export const registerUpdateScheduleTool = (server: McpServer) => {
         return toolErr("Agent not found.");
       }
 
+      // A deferral continues its owner's task, in that task's chat thread when
+      // it has one (src/scheduler/schedule-task.ts). Only the owner or a lead
+      // may change it.
+      if (
+        schedule.taskType === "deferred" &&
+        !can({
+          principal: { kind: "agent", agentId: caller.id, isLead: caller.isLead },
+          verb: "schedule.deferral.update.any",
+          resource: { kind: "owned", ownerAgentId: schedule.createdByAgentId },
+          source: "mcp",
+        }).allow
+      ) {
+        return toolErr(
+          `Schedule "${schedule.name}" defers another agent's task. Only that agent or a lead can change it.`,
+        );
+      }
+
       // Reject updates on completed one-time schedules
       if (schedule.scheduleType === "one_time" && !schedule.enabled && schedule.lastRunAt) {
         return toolErr(

package/src/types.ts

@@ -1076,6 +1076,22 @@ export const UserSchema = z
 
 export type User = z.infer<typeof UserSchema>;
 
+export const RbacRoleSchema = z
+  .object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string().nullable(),
+    isBuiltin: z.boolean(),
+    grantsAll: z.boolean(),
+    primary: z.boolean(),
+    verbs: z.array(z.string()),
+  })
+  .openapi("RbacRole");
+
+export const UserRbacRolesSchema = z
+  .object({ userId: z.string(), roles: z.array(RbacRoleSchema) })
+  .openapi("UserRbacRoles");
+
 /**
  * Structured communication preferences read from `users.metadata.comms`.
  * All fields are free-form strings; values render verbatim into the requester