@desplega.ai/agent-swarm 2.5.3 → 2.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "2.5.3",
+  "version": "2.6.0",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -54,7 +54,7 @@
   "config": {
     "name": "agent-swarm"
   },
-  "packageManager": "bun@1.4.3",
+  "packageManager": "bun@1.4.4",
   "workspaces": [
     "apps/ui",
     "apps/templates-ui",
@@ -199,10 +199,10 @@
     "bun": ">=1.3.12"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "2.0.1",
+    "@agentclientprotocol/sdk": "2.0.2",
     "@ai-sdk/openai": "^3.0.41",
-    "@anthropic-ai/claude-agent-sdk": "0.3.309",
-    "@anthropic-ai/sdk": "^1.2.0",
+    "@anthropic-ai/claude-agent-sdk": "0.3.310",
+    "@anthropic-ai/sdk": "^1.3.0",
     "@asteasolutions/zod-to-openapi": "^8.0.0",
     "@aws-sdk/client-bedrock": "3.1048.0",
     "@chat-adapter/discord": "4.41.1",

package/plugin/commands/create-pr.md

@@ -31,8 +31,8 @@ You should be working in a repository cloned to `/workspace/personal/<repo-name>
    - **Show the change, do not narrate it.** Aim for about 250 prose words; code blocks, mermaid, tables and `<details>` do not count. No file-by-file changelog: that belongs in your task output.
    - **Review map**: build it from `git diff --stat <base>...HEAD`. One row per area, biggest risk first, with `(+N/-M)`, a depth (🔍 deep, 👀 skim, ⏭ skip for tests and generated files) and what could break.
    - **Change outline**: 1 or 2 views of the shape of the change. Pseudocode with `+`/`-` lines for logic, mermaid for flow, a tree with paths on the nodes for structure.
-   - **Swarm provenance** (when you run in the swarm): fill it from your task context. Link the task (`$APP_URL/tasks/<taskId>`) and its tree (`$APP_URL/sessions/<rootTaskId>`), the Slack permalink of the ask if the task came from Slack, any workflow run, and the plan or research as an `agent-fs share-create` link plus its durable `live.agent-fs.dev` path. These auth-gated links go in this section only.
-   - **Media**: images and mp4s as GitHub user attachments (`github-attach` skill), docs as `agent-fs share-create` links. Never a presigned agent-fs URL for docs or videos.
+   - **Swarm provenance** (when you run in the swarm): fill it from your task context. Link the task (`$APP_URL/tasks/<taskId>`) and its tree (`$APP_URL/sessions/<rootTaskId>`), the Slack permalink of the ask if the task came from Slack, any workflow run, and the plan or research as its agent-fs live app link (`${AGENT_FS_LIVE_URL}/file/~/<org>/<drive>/<path>`). These auth-gated links go in this section only.
+   - **Media**: images and mp4s as GitHub user attachments (`github-attach` skill), docs as the agent-fs live app link under Swarm provenance (an `agent-fs share-create` link only when the requester asks for one or a reader has no agent-fs login). Never a presigned agent-fs URL for docs or videos.
 6. **Create the PR/MR** using `gh pr create` or `glab mr create`. `gh pr create --body` does not apply the repo template, so write the filled description to a file and pass it with `--body-file <file>`.
 7. **Check CI status** — After creating the PR, wait ~30 seconds, then check CI with `gh pr checks <pr-number>` (GitHub) or `glab mr view --json pipelines` (GitLab). If any check is failing, investigate the failure, fix it, push the fix, and re-check. Repeat until CI is green.
 8. **Report** the PR/MR URL and CI status.

package/plugin/pi-skills/create-pr/SKILL.md

@@ -31,8 +31,8 @@ You should be working in a repository cloned to `/workspace/personal/<repo-name>
    - **Show the change, do not narrate it.** Aim for about 250 prose words; code blocks, mermaid, tables and `<details>` do not count. No file-by-file changelog: that belongs in your task output.
    - **Review map**: build it from `git diff --stat <base>...HEAD`. One row per area, biggest risk first, with `(+N/-M)`, a depth (🔍 deep, 👀 skim, ⏭ skip for tests and generated files) and what could break.
    - **Change outline**: 1 or 2 views of the shape of the change. Pseudocode with `+`/`-` lines for logic, mermaid for flow, a tree with paths on the nodes for structure.
-   - **Swarm provenance** (when you run in the swarm): fill it from your task context. Link the task (`$APP_URL/tasks/<taskId>`) and its tree (`$APP_URL/sessions/<rootTaskId>`), the Slack permalink of the ask if the task came from Slack, any workflow run, and the plan or research as an `agent-fs share-create` link plus its durable `live.agent-fs.dev` path. These auth-gated links go in this section only.
-   - **Media**: images and mp4s as GitHub user attachments (`github-attach` skill), docs as `agent-fs share-create` links. Never a presigned agent-fs URL for docs or videos.
+   - **Swarm provenance** (when you run in the swarm): fill it from your task context. Link the task (`$APP_URL/tasks/<taskId>`) and its tree (`$APP_URL/sessions/<rootTaskId>`), the Slack permalink of the ask if the task came from Slack, any workflow run, and the plan or research as its agent-fs live app link (`${AGENT_FS_LIVE_URL}/file/~/<org>/<drive>/<path>`). These auth-gated links go in this section only.
+   - **Media**: images and mp4s as GitHub user attachments (`github-attach` skill), docs as the agent-fs live app link under Swarm provenance (an `agent-fs share-create` link only when the requester asks for one or a reader has no agent-fs login). Never a presigned agent-fs URL for docs or videos.
 6. **Create the PR/MR** using `gh pr create` or `glab mr create`. `gh pr create --body` does not apply the repo template, so write the filled description to a file and pass it with `--body-file <file>`.
 7. **Check CI status** — After creating the PR, wait ~30 seconds, then check CI with `gh pr checks <pr-number>` (GitHub) or `glab mr view --json pipelines` (GitLab). If any check is failing, investigate the failure, fix it, push the fix, and re-check. Repeat until CI is green.
 8. **Report** the PR/MR URL and CI status.

package/src/assets/source-key.ts

@@ -0,0 +1,95 @@
+import { chatThreadOfContextKey } from "../tasks/context-key";
+import { normalizeAssetKey, sessionGroupKey } from "./key";
+
+export const SESSION_SOURCES = ["slack", "telegram", "discord"] as const;
+export type SessionSource = (typeof SESSION_SOURCES)[number];
+
+/**
+ * The source asset key of a root session, or null when the task has no Slack
+ * thread and no supported Chat SDK thread. Shapes:
+ * - Slack fields or chat-sdk `slack:<channel>:<ts>`: `shared/slack/<channel>/thread:<ts>/`
+ * - chat-sdk `slack:<channel>:` (a top-level DM, empty ts): `shared/slack/<channel>/task:<id>/`
+ * - `telegram:<chatId>[:<topicId>]`: `shared/telegram/<chatId>/thread:<topicId>/`, else `.../task:<id>/`
+ * - `discord:<guild|@me>:<channelId>[:<threadId>]`: `shared/discord/<channelId>/thread:<threadId>/`, else `.../task:<id>/`
+ */
+export function sessionSourceKey({
+  id,
+  slackChannelId,
+  slackThreadTs,
+  contextKey,
+}: {
+  id: string;
+  slackChannelId?: string | null;
+  slackThreadTs?: string | null;
+  contextKey?: string | null;
+}): string | null {
+  let parts: [SessionSource, string | undefined, string | undefined];
+  if (slackChannelId && slackThreadTs) {
+    parts = ["slack", slackChannelId, slackThreadTs];
+  } else {
+    const chat = chatThreadOfContextKey(contextKey);
+    if (!chat) return null;
+    // threadId keeps its adapter prefix, so index 0 is the adapter.
+    const ids = chat.threadId.split(":");
+    if (chat.adapter === "slack" && ids.length === 3 && !ids[2]) ids.pop();
+    if (ids.some((part) => !part)) return null;
+    if (chat.adapter === "slack" && (ids.length === 2 || ids.length === 3)) {
+      parts = ["slack", ids[1], ids[2]];
+    } else if (chat.adapter === "telegram" && (ids.length === 2 || ids.length === 3)) {
+      parts = ["telegram", ids[1], ids[2]];
+    } else if (chat.adapter === "discord" && (ids.length === 3 || ids.length === 4)) {
+      parts = ["discord", ids[2], ids[3]];
+    } else {
+      return null;
+    }
+  }
+  const [source, channel, thread] = parts;
+  // A "/" inside an id would add key segments and break the group shape.
+  if (!channel || channel.includes("/") || thread?.includes("/")) return null;
+  try {
+    return normalizeAssetKey(
+      `shared/${source}/${channel}/${thread ? `thread:${thread}` : `task:${id}`}/`,
+    );
+  } catch {
+    return null;
+  }
+}
+
+export function sourceOfKey(key: string): SessionSource | null {
+  return SESSION_SOURCES.find((source) => key.startsWith(`shared/${source}/`)) ?? null;
+}
+
+export const NESTED_THREAD_MIN_ROOTS = 2;
+
+export function isSourceThreadKey(key: string): boolean {
+  return sourceOfKey(key) !== null && /\/thread:[^/]+\/$/.test(key);
+}
+
+/** A source thread with at least two owned roots gets its own nested group. */
+export function sessionThreadGroupKey(key: string, threadRoots: number): string {
+  const normalized = normalizeAssetKey(key);
+  return isSourceThreadKey(normalized) && threadRoots >= NESTED_THREAD_MIN_ROOTS
+    ? normalized
+    : sessionGroupKey(normalized);
+}
+
+export const SOURCE_GROUPS_READ_ONLY = "Source groups are read-only.";
+
+/** The source a filter matches: the source of the key prefix, else the raw task source. */
+export function effectiveSource(key: string, source: string): string {
+  return sourceOfKey(key) ?? source;
+}
+
+/**
+ * Why a session root may not move to `destination` (a normalized key), or null.
+ * Source groups are read-only: only a move back to the root's own source key
+ * (Undo after a move out) may land under a source prefix. Null is No group.
+ */
+export function sourceMoveError(
+  destination: string | null,
+  root: Parameters<typeof sessionSourceKey>[0],
+): string | null {
+  return destination !== null && sourceOfKey(destination) && destination !== sessionSourceKey(root)
+    ? SOURCE_GROUPS_READ_ONLY
+    : null;
+}

package/src/be/db/api-keys.ts

@@ -68,3 +68,83 @@ export async function recordKeySeatMismatch(
     return { planChanged };
   });
 }
+
+/** Store definitive live-test results and retire rejections for removed pool members. */
+export async function recordKeyValidation(
+  keyType: string,
+  keys: Array<{
+    keyIndex: number;
+    keySuffix: string;
+    ok: boolean;
+    httpStatus?: number;
+    error?: string;
+  }>,
+  scope = "global",
+  scopeId: string | null = null,
+  options: { retireAbsent?: boolean } = {},
+): Promise<void> {
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  await getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    for (const key of keys) {
+      // Only 401 means the key is bad. A 403 on a list endpoint can be a valid
+      // key without that scope (an OpenAI restricted key, a gateway virtual key).
+      if (!key.ok && key.httpStatus !== 401) continue;
+      await tx.run(
+        `INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, lastValidationError, lastValidationFailedAt, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET lastValidationError = excluded.lastValidationError,
+           lastValidationFailedAt = excluded.lastValidationFailedAt,
+           keyIndex = excluded.keyIndex, updatedAt = excluded.updatedAt`,
+        [
+          keyType,
+          key.keySuffix,
+          key.keyIndex,
+          scope,
+          effectiveScopeId,
+          key.ok ? null : `HTTP ${key.httpStatus}`,
+          key.ok ? null : now,
+          provider,
+          now,
+        ],
+      );
+    }
+    if (options.retireAbsent === false) return;
+    const placeholders = keys.map(() => "?").join(", ");
+    await tx.run(
+      `UPDATE api_key_status SET lastValidationError = NULL, lastValidationFailedAt = NULL, updatedAt = ?
+       WHERE keyType = ? AND scope = ? AND scopeId = ?
+         ${keys.length ? `AND keySuffix NOT IN (${placeholders})` : ""}
+         AND lastValidationFailedAt IS NOT NULL`,
+      [now, keyType, scope, effectiveScopeId, ...keys.map((key) => key.keySuffix)],
+    );
+  });
+}
+
+/**
+ * Forget the status of a key that left its pool, and store the new index of
+ * each remaining key. A new key that later takes the same index or Codex slot
+ * then starts with no rejection, rate limit or auth bench.
+ */
+export async function retirePoolKeyStatus(
+  keyType: string,
+  removedSuffix: string,
+  remaining: Array<{ keySuffix: string; keyIndex: number }>,
+): Promise<void> {
+  await getDbClient().transaction(async (tx) => {
+    if (!remaining.some((key) => key.keySuffix === removedSuffix)) {
+      await tx.run(
+        "DELETE FROM api_key_status WHERE keyType = ? AND keySuffix = ? AND scope = 'global' AND scopeId = ''",
+        [keyType, removedSuffix],
+      );
+    }
+    for (const key of remaining) {
+      await tx.run(
+        "UPDATE api_key_status SET keyIndex = ? WHERE keyType = ? AND keySuffix = ? AND scope = 'global' AND scopeId = ''",
+        [key.keyIndex, keyType, key.keySuffix],
+      );
+    }
+  });
+}

package/src/be/db/approvals.ts

@@ -162,3 +162,51 @@ export async function getPendingApprovalsForTasks(taskIds: string[]): Promise<
     taskIds,
   );
 }
+
+/** The claim key of one Slack thread's cancellation post: `<channel>:<messageTs>`. */
+export function approvalCancellationNotificationKey(target: string, messageTs: string): string {
+  return `${target}:${messageTs}`;
+}
+
+/**
+ * Ids of the cancelled requests of the given runs with a Slack cancellation
+ * post not yet delivered (never claimed, or a claim a failed post released).
+ * A delivered post never comes back, so a repeat cancel of a settled tree
+ * retries only what failed. One query per 500 runs.
+ */
+export async function listUndeliveredCancelledApprovalRequestIds(
+  runIds: string[],
+): Promise<string[]> {
+  const ids: string[] = [];
+  for (let i = 0; i < runIds.length; i += 500) {
+    const chunk = runIds.slice(i, i + 500);
+    const rows = await getDbClient().query<{
+      id: string;
+      notificationChannels: string;
+      claims: string | null;
+    }>(
+      `SELECT id, notificationChannels, cancellationNotificationClaims AS claims
+         FROM approval_requests
+        WHERE workflowRunId IN (${chunk.map(() => "?").join(", ")})
+          AND status = 'cancelled' AND notificationChannels IS NOT NULL`,
+      chunk,
+    );
+    for (const row of rows) {
+      const claims = row.claims ? (JSON.parse(row.claims) as Record<string, unknown>) : {};
+      const channels = JSON.parse(row.notificationChannels) as Array<{
+        channel?: string;
+        target?: string;
+        messageTs?: string;
+      }>;
+      const undelivered = channels.some(
+        (n) =>
+          n.channel === "slack" &&
+          n.target &&
+          n.messageTs &&
+          claims[approvalCancellationNotificationKey(n.target, n.messageTs)] !== "delivered",
+      );
+      if (undelivered) ids.push(row.id);
+    }
+  }
+  return ids;
+}

package/src/be/db/session-labels.ts

@@ -0,0 +1,28 @@
+import { getDbClient, upsertKv } from "../db";
+
+const NAMESPACE = "session-labels";
+
+export async function getSessionLabels(keys: string[]): Promise<Record<string, string>> {
+  if (keys.length === 0) return {};
+  const rows = await getDbClient().query<{ key: string; value: string }>(
+    `SELECT key, value FROM kv_entries
+     WHERE namespace = ? AND key IN (${keys.map(() => "?").join(", ")})
+       AND (expires_at IS NULL OR expires_at > ?)`,
+    [NAMESPACE, ...keys, Date.now()],
+  );
+  return Object.fromEntries(rows.map((row) => [row.key, row.value]));
+}
+
+export async function rememberSessionLabel(
+  key: string,
+  label: string,
+  ttlMs?: number,
+): Promise<void> {
+  await upsertKv({
+    namespace: NAMESPACE,
+    key,
+    value: label,
+    valueType: "string",
+    expiresAt: ttlMs === undefined ? null : Date.now() + ttlMs,
+  });
+}

package/src/be/db/session-moves.ts

@@ -85,15 +85,14 @@ export async function moveTaskChainKeyInTx(
       [task.id, task.id],
     );
     // The namespace is metadata, and lastUpdatedAt tracks task activity, as in updateTaskTitle.
-    await client.run('UPDATE agent_tasks SET "key" = ?, updated_by = ? WHERE id = ?', [
-      key,
-      changedBy ?? null,
-      task.id,
-    ]);
+    await client.run(
+      'UPDATE agent_tasks SET "key" = ?, updated_by = COALESCE(?, updated_by) WHERE id = ?',
+      [key, changedBy ?? null, task.id],
+    );
     for (const mapping of mappedFiles) {
       if (mapping.key === key) continue;
       await client.run(
-        'UPDATE asset_key_mappings SET "key" = ?, updated_at = ?, updated_by = ? WHERE id = ?',
+        'UPDATE asset_key_mappings SET "key" = ?, updated_at = ?, updated_by = COALESCE(?, updated_by) WHERE id = ?',
         [key, now, changedBy ?? null, mapping.id],
       );
       await insertAssetKeyHistory({

package/src/be/db/session-tree.ts

@@ -4,6 +4,14 @@ import {
   SESSION_LEAF_KINDS,
   sessionGroupKey,
 } from "../../assets/key";
+import {
+  effectiveSource,
+  isSourceThreadKey,
+  NESTED_THREAD_MIN_ROOTS,
+  SESSION_SOURCES,
+  sessionThreadGroupKey,
+  sourceOfKey,
+} from "../../assets/source-key";
 import { isTerminalTaskStatus, TERMINAL_TASK_STATUSES } from "../../types";
 import { getDbClient, literalPrefixPattern } from "../db";
 import {
@@ -14,13 +22,17 @@ import {
 
 export type SessionReadState = "unread" | "read" | "later" | "done";
 export interface SessionFilters {
-  /** Restrict roots to these task sources. */
+  /** Restrict roots to these raw task sources (`agent_tasks.source`). */
   source?: string[];
-  /** Leave out roots of these task sources (the older sessions v2 source filter). */
+  /**
+   * Leave out roots of these effective sources (the older sessions v2 source
+   * filter). The effective source of a root under a source key prefix such as
+   * `shared/slack/` is that source, else its raw task source.
+   */
   hideSource?: string[];
   /**
-   * Keep only roots of these task sources (the sessions v2 source filter).
-   * Unlike `source`, an empty list matches no root.
+   * Keep only roots of these effective sources (the sessions v2 source filter,
+   * see `hideSource`). Unlike `source`, an empty list matches no root.
    */
   showSource?: string[];
   /** Match root task text or title with a case-insensitive substring. */
@@ -74,15 +86,47 @@ function sessionReadStateSql(now = new Date().toISOString()): SqlFragment {
   };
 }
 
+function sourceKeyRanges() {
+  return SESSION_SOURCES.map((source) => ({ source, ...keyPrefixRange(`shared/${source}/`) }));
+}
+
+/** Count every owned root at the exact source thread key, independent of viewer filters. */
+export function threadRootsSql(): SqlFragment {
+  const key = 'r."key"';
+  // Trim the final slash, then all non-slash characters to locate the last segment.
+  // For example, shared/slack/c1/thread:1.2/ gives thread:1.2/.
+  const leaf = `substr(${key}, length(rtrim(rtrim(${key}, '/'), replace(${key}, '/', ''))) + 1)`;
+  const ranges = sourceKeyRanges();
+  return {
+    sql: `(CASE WHEN (${ranges.map(() => `(${key} >= ? AND ${key} < ?)`).join(" OR ")}) AND ${leaf} GLOB 'thread:?*/'
+      THEN (SELECT COUNT(*) FROM agent_tasks session_thread_root WHERE session_thread_root."key" = ${key}
+        AND session_thread_root.parentTaskId IS NULL AND session_thread_root.requestedByUserId IS NOT NULL)
+      ELSE 0 END)`,
+    params: ranges.flatMap(({ lo, hi }) => [lo, hi]),
+  };
+}
+
+/** A task's group with the list row's rule (`groupKey` on `GET /api/sessions`). */
+export async function getSessionGroupKey(task: { id: string; key: string }): Promise<string> {
+  const threadRoots = threadRootsSql();
+  const row = await getDbClient().get<{ threadRoots: number }>(
+    `SELECT ${threadRoots.sql} AS threadRoots FROM agent_tasks r WHERE r.id = ?`,
+    [...threadRoots.params, task.id],
+  );
+  return sessionThreadGroupKey(task.key, row?.threadRoots ?? 0);
+}
+
 function groupCondition(group: string): SqlFragment {
   const { lo, hi } = keyPrefixRange(group);
   // The remaining key must be one resource leaf, with no nested path.
   // SQLite substr/length count code points, so count them here too (not UTF-16 units).
   const start = [...lo].length + 1;
+  const threadRoots = threadRootsSql();
   return {
     sql: `(r."key" >= ? AND r."key" < ? AND (r."key" = ? OR (
       instr(substr(r."key", ?, length(r."key") - ?), '/') = 0 AND
-      (${SESSION_LEAF_KINDS.map(() => 'substr(r."key", ?) GLOB ?').join(" OR ")})
+      (${SESSION_LEAF_KINDS.map(() => 'substr(r."key", ?) GLOB ?').join(" OR ")}) AND
+      ${threadRoots.sql} < ?
     )))`,
     params: [
       lo,
@@ -91,10 +135,21 @@ function groupCondition(group: string): SqlFragment {
       start,
       start,
       ...SESSION_LEAF_KINDS.flatMap((kind) => [start, `${kind}:?*/`]),
+      ...threadRoots.params,
+      NESTED_THREAD_MIN_ROOTS,
     ],
   };
 }
 
+/** `effectiveSource` of the root `r` in SQL, with key ranges so the key index still serves it. */
+function effectiveSourceSql(): SqlFragment {
+  const ranges = sourceKeyRanges();
+  return {
+    sql: `(CASE ${ranges.map(() => `WHEN r."key" >= ? AND r."key" < ? THEN ?`).join(" ")} ELSE r.source END)`,
+    params: ranges.flatMap(({ source, lo, hi }) => [lo, hi, source]),
+  };
+}
+
 export function sessionRootFilter(opts: SessionFilters = {}): SqlFragment {
   const conditions = ["r.parentTaskId IS NULL"];
   const params: SqlFragment["params"] = [];
@@ -107,13 +162,22 @@ export function sessionRootFilter(opts: SessionFilters = {}): SqlFragment {
   if (sources.length)
     add({ sql: `r.source IN (${sources.map(() => "?").join(",")})`, params: sources });
   const hidden = opts.hideSource?.filter(Boolean) ?? [];
-  if (hidden.length)
-    add({ sql: `r.source NOT IN (${hidden.map(() => "?").join(",")})`, params: hidden });
+  if (hidden.length) {
+    const source = effectiveSourceSql();
+    add({
+      sql: `${source.sql} NOT IN (${hidden.map(() => "?").join(",")})`,
+      params: [...source.params, ...hidden],
+    });
+  }
   if (opts.showSource) {
     const shown = opts.showSource.filter(Boolean);
+    const source = effectiveSourceSql();
     add(
       shown.length
-        ? { sql: `r.source IN (${shown.map(() => "?").join(",")})`, params: shown }
+        ? {
+            sql: `${source.sql} IN (${shown.map(() => "?").join(",")})`,
+            params: [...source.params, ...shown],
+          }
         : { sql: "0", params: [] },
     );
   }
@@ -388,8 +452,45 @@ export interface SessionTree {
   later: SessionSectionCounts;
   done: SessionSectionCounts;
   noGroup: SessionSectionCounts;
-  /** Each root source in this view with its session count, hidden sources included, most first. */
+  /** Each effective root source in this view with its session count, hidden sources included, most first. */
   sources: { source: string; total: number }[];
+  /** Every source group key in this view, hidden sources included, so a pane of a hidden source still gets its label. */
+  sourceGroups: string[];
+  /** Slack channel ids backed by visible roots with matching Slack fields, including hidden sources. */
+  slackChannels: string[];
+  /**
+   * The oldest visible root of each nested source thread, including hidden
+   * sources: its title, else a preview of its prompt without the thread context.
+   */
+  threadLabels: Record<string, string>;
+}
+
+/**
+ * The first `<thread_context>` block of a prompt, as the Slack and Chat SDK
+ * templates write it (each tag alone on its line). It holds the earlier thread
+ * messages, so a label cut from the start of the prompt never reaches the ask.
+ */
+const THREAD_OPEN = "<thread_context>";
+const THREAD_CLOSE = "</thread_context>";
+const THREAD_OPEN_AT = `instr(r.task, '${THREAD_OPEN}' || char(10))`;
+const THREAD_CLOSE_AT = `instr(r.task, char(10) || '${THREAD_CLOSE}')`;
+/**
+ * The task list preview length. The UI reads this length plus "…" as a list
+ * preview and repairs a Slack token or a block that the cut splits
+ * (`isListPreview` in `apps/ui/src/lib/prompt-display.ts`).
+ */
+const THREAD_LABEL_LENGTH = 300;
+/** Extra characters for the blank lines that `threadPromptPreview` trims, so the preview stays full. */
+const THREAD_LABEL_TRIM_MARGIN = 100;
+/** The prompt of `r` without its first thread context block, cut for `threadPromptPreview`. */
+const THREAD_PROMPT_SQL = `substr(CASE
+    WHEN ${THREAD_OPEN_AT} > 0 AND ${THREAD_CLOSE_AT} > ${THREAD_OPEN_AT}
+    THEN substr(r.task, 1, ${THREAD_OPEN_AT} - 1) || substr(r.task, ${THREAD_CLOSE_AT} + ${THREAD_CLOSE.length + 1})
+    ELSE r.task END, 1, ${THREAD_LABEL_LENGTH + THREAD_LABEL_TRIM_MARGIN})`;
+
+function threadPromptPreview(prompt: string): string {
+  const text = prompt.trim();
+  return text.length > THREAD_LABEL_LENGTH ? `${text.slice(0, THREAD_LABEL_LENGTH)}…` : text;
 }
 
 export async function getSessionTree(
@@ -405,17 +506,22 @@ export async function getSessionTree(
     tree: true,
     mine: opts.mine,
   });
+  const threadRoots = threadRootsSql();
   const rows = await getDbClient().query<{
+    id: string;
     key: string;
     source: string;
+    slackChannelId: string | null;
     lastActivityAt: string;
     latestStatus: string;
     readState: SessionReadState | null;
     needsYou: number;
+    threadRoots: number;
   }>(
-    `SELECT r."key", r.source, a.lastActivityAt, a.latestStatus, a.readState, a.needsYou
+    `SELECT r.id, r."key", r.source, r.slackChannelId, a.lastActivityAt, a.latestStatus, a.readState, a.needsYou,
+      ${threadRoots.sql} AS threadRoots
     FROM (${query.sql}) a CROSS JOIN agent_tasks r ON r.id = a.root_id`,
-    query.params,
+    [...threadRoots.params, ...query.params],
   );
   const counts = (): SessionSectionCounts => ({ total: 0, unread: 0, running: 0, needsYou: 0 });
   const result: SessionTree = {
@@ -425,10 +531,16 @@ export async function getSessionTree(
     done: counts(),
     noGroup: counts(),
     sources: [],
+    sourceGroups: [],
+    slackChannels: [],
+    threadLabels: {},
   };
   const hidden = new Set(opts.hideSource);
   const shown = opts.showSource ? new Set(opts.showSource) : null;
   const sources = new Map<string, number>();
+  const sourceGroups = new Set<string>();
+  const slackChannels = new Set<string>();
+  const threadRootIds: string[] = [];
   const groups = new Map<string, SessionTreeGroup>();
   const add = (section: SessionSectionCounts, row: (typeof rows)[number]) => {
     section.total++;
@@ -437,9 +549,20 @@ export async function getSessionTree(
     if (row.needsYou) section.needsYou++;
   };
   for (const row of rows) {
-    sources.set(row.source, (sources.get(row.source) ?? 0) + 1);
-    if (hidden.has(row.source) || (shown && !shown.has(row.source))) continue;
-    const key = sessionGroupKey(row.key);
+    const source = effectiveSource(row.key, row.source);
+    sources.set(source, (sources.get(source) ?? 0) + 1);
+    const key = sessionThreadGroupKey(row.key, row.threadRoots);
+    const sourceGroupKey = sessionGroupKey(row.key);
+    const channelId = /^shared\/slack\/([^/]+)\/$/.exec(sourceGroupKey)?.[1];
+    if (channelId && row.slackChannelId?.toLowerCase() === channelId) {
+      slackChannels.add(channelId);
+    }
+    if (row.threadRoots >= NESTED_THREAD_MIN_ROOTS && isSourceThreadKey(row.key)) {
+      threadRootIds.push(row.id);
+      sourceGroups.add(sourceGroupKey);
+    }
+    if (sourceOfKey(key)) sourceGroups.add(key);
+    if (hidden.has(source) || (shown && !shown.has(source))) continue;
     const noGroup =
       key === "shared/" || (actor.kind === "user" && key === `personal/${actor.userId}/`);
     let group: SessionTreeGroup | undefined;
@@ -462,6 +585,22 @@ export async function getSessionTree(
   result.sources = [...sources]
     .map(([source, total]) => ({ source, total }))
     .sort((a, b) => b.total - a.total || a.source.localeCompare(b.source));
+  result.sourceGroups = [...sourceGroups].sort();
+  result.slackChannels = [...slackChannels].sort();
+  if (threadRootIds.length) {
+    // A missing or empty title falls back to a preview of the prompt without its thread context.
+    const labels = await getDbClient().query<{ key: string; title: string | null; prompt: string }>(
+      `SELECT "key", title, prompt FROM (
+        SELECT r."key", NULLIF(trim(r.title), '') AS title, ${THREAD_PROMPT_SQL} AS prompt,
+          ROW_NUMBER() OVER (PARTITION BY r."key" ORDER BY r.createdAt, r.rowid) AS ordinal
+        FROM agent_tasks r WHERE r.id IN (${threadRootIds.map(() => "?").join(",")})
+      ) WHERE ordinal = 1`,
+      threadRootIds,
+    );
+    result.threadLabels = Object.fromEntries(
+      labels.map((row) => [row.key, row.title ?? threadPromptPreview(row.prompt)]),
+    );
+  }
   return result;
 }
 

package/src/be/db/tasks/read.ts

@@ -803,6 +803,7 @@ export interface TaskFilters {
   taskType?: string;
   tags?: string[];
   scheduleId?: string;
+  workflowRunId?: string;
   /** Exact canonical asset namespace. */
   key?: string;
   /** Canonical namespace subtree prefix. */
@@ -937,6 +938,11 @@ export async function getAllTasks(
     params.push(filters.scheduleId);
   }
 
+  if (filters?.workflowRunId) {
+    conditions.push("workflowRunId = ?");
+    params.push(filters.workflowRunId);
+  }
+
   if (filters?.key) {
     conditions.push('"key" = ?');
     params.push(normalizeAssetKey(filters.key));
@@ -1103,6 +1109,11 @@ export async function getTasksCount(
     params.push(filters.scheduleId);
   }
 
+  if (filters?.workflowRunId) {
+    conditions.push("workflowRunId = ?");
+    params.push(filters.workflowRunId);
+  }
+
   if (filters?.key) {
     conditions.push('"key" = ?');
     params.push(normalizeAssetKey(filters.key));