@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/http/scripts.ts

@@ -40,12 +40,14 @@ import {
   typecheckScript,
 } from "../be/scripts/typecheck";
 import { can } from "../rbac";
+import { isExecutorAllowedByDeployment } from "../scripts-runtime/executors/registry";
 import { extractScriptSignature, type ScriptSignature } from "../scripts-runtime/extract-signature";
 import { checkQuickJSCompat, quickJSCompatWarnings } from "../scripts-runtime/quickjs-compat";
 import {
   ScriptApiAuthModeSchema,
   ScriptApiRecordSchema,
   type ScriptDetail,
+  ScriptExecutorNameSchema,
   ScriptFsModeSchema,
   type ScriptListItem,
   type ScriptRecord,
@@ -67,6 +69,7 @@ const upsertBodySchema = z.object({
   intent: z.string().default(""),
   scope: ScriptScopeSchema.default("agent"),
   fsMode: ScriptFsModeSchema.default("none"),
+  executor: ScriptExecutorNameSchema.nullable().optional(),
 });
 
 const runBodySchema = z
@@ -77,6 +80,7 @@ const runBodySchema = z
     intent: z.string().default(""),
     scope: ScriptScopeSchema.optional(),
     fsMode: ScriptFsModeSchema.default("none"),
+    executor: ScriptExecutorNameSchema.nullable().optional(),
     idempotencyKey: z.string().max(200).optional(),
   })
   .refine((body) => Boolean(body.name) !== Boolean(body.source), {
@@ -671,6 +675,15 @@ export async function handleScripts(
       }
     }
 
+    if (parsed.body.executor && !isExecutorAllowedByDeployment(parsed.body.executor)) {
+      jsonError(
+        res,
+        'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"',
+        400,
+      );
+      return true;
+    }
+
     const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
     if (secretRefusal) {
       json(res, secretRefusal, 400);
@@ -708,6 +721,7 @@ export async function handleScripts(
       signatureJson: signatureJsonFor(parsed.body.source),
       argsJsonSchema,
       fsMode: parsed.body.fsMode,
+      executor: parsed.body.executor,
       agentId: agent.id,
       isScratch: false,
       typeChecked: true,
@@ -758,6 +772,7 @@ export async function handleScripts(
 
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
+    let executor = parsed.body.executor ?? null;
     let namedScript: ScriptRecord | null = null;
     if (parsed.body.name) {
       const script = await resolveScript(parsed.body.name, agent.id, parsed.body.scope);
@@ -768,6 +783,7 @@ export async function handleScripts(
       namedScript = script;
       source = script.source;
       fsMode = script.fsMode;
+      executor = parsed.body.executor !== undefined ? parsed.body.executor : script.executor;
     }
 
     if (fsMode === "workspace-rw") {
@@ -775,6 +791,15 @@ export async function handleScripts(
       return true;
     }
 
+    if (executor && !isExecutorAllowedByDeployment(executor)) {
+      jsonError(
+        res,
+        'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"',
+        400,
+      );
+      return true;
+    }
+
     const startedAt = new Date().toISOString();
     // Touch before executing so an already-stale scratch script isn't reaped
     // by the retention sweep while this run is still in flight.
@@ -786,6 +811,7 @@ export async function handleScripts(
       source: source as string,
       args: parsed.body.args,
       fsMode,
+      executor,
       agentId: agent.id,
       runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
@@ -954,6 +980,7 @@ export async function handleScripts(
       isScratch: script.isScratch,
       typeChecked: script.typeChecked,
       fsMode: script.fsMode,
+      executor: script.executor,
       createdByAgentId: script.createdByAgentId,
       createdAt: script.createdAt,
       updatedAt: script.updatedAt,

package/src/http/session-access.ts

@@ -88,6 +88,30 @@ export async function hasSessionWrite(
   return hasSessionAccess(access, "write");
 }
 
+export const NOT_YOUR_TASK_DENIED =
+  "You can only change tasks you requested, or sessions shared with you to edit.";
+
+/**
+ * True when a user token without a grant-all role (RBAC on) changes a task it
+ * does not own: neither the task nor its session root names the user as
+ * requester, and the session is not shared with the user for writing. The
+ * session wall reads an ownerless root (Slack, schedules, operator key) as
+ * everyone's; for such a user it is not theirs to change. Operator, agent and
+ * admin callers are never denied here.
+ */
+export async function deniesNonOwnerTaskWrite(
+  req: IncomingMessage,
+  task: { id: string; requestedByUserId?: string | null },
+): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled()) return false;
+  if (task.requestedByUserId === auth.userId) return false;
+  if ((await getUserGrant(auth.userId)).grantsAll) return false;
+  const root = await getSessionRoot(task.id);
+  if (!root?.requestedByUserId) return true;
+  return !hasSessionAccess(await sessionAccessForRoot(auth.userId, root), "write");
+}
+
 /**
  * The parent gate shared by `POST /api/tasks` and `POST /api/apps/{id}/actions/{name}`.
  * The child inherits the parent's thread context, so an agent caller must own or

package/src/http/sessions.ts

@@ -77,7 +77,13 @@ import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { canMutateTaskNamespace } from "./assets";
 import { agentFirstPrincipal } from "./request-principal";
 import { route } from "./route-def";
-import { resolveSessionActor, type SessionActor, sessionAccessFor } from "./session-access";
+import {
+  deniesNonOwnerTaskWrite,
+  NOT_YOUR_TASK_DENIED,
+  resolveSessionActor,
+  type SessionActor,
+  sessionAccessFor,
+} from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Response Schemas ────────────────────────────────────────────────────────
@@ -660,7 +666,7 @@ const triageSessionListRoute = route({
     401: { description: "Unauthorized" },
   },
   auth: { apiKey: true },
-  rbac: { ungated: "per-user inbox UI state, same posture as PATCH /api/inbox-state" },
+  rbac: { permission: "favorite.write.own" },
 });
 
 const SESSION_MOVE_LIMIT = 200;
@@ -671,10 +677,7 @@ const SessionMoveResultSchema = z.object({
   moved: z.array(z.string()),
   skipped: z.array(z.object({ rootTaskId: z.string(), reason: z.string() })),
 });
-const sessionMoveRbac = {
-  ungated:
-    "per-session access, per-task task.fs.mutate, and asset-key write checks in the handler, as PATCH /api/assets/task/{id}/key",
-};
+const sessionMoveRbac = { permission: "task.fs.mutate" } as const;
 const sessionMoveResponses = {
   400: { description: "Invalid namespace or request" },
   403: { description: "Personal destination not authorized" },
@@ -759,6 +762,7 @@ async function checkSessionMove(
     const access = await sessionAccessFor(actor, root.id);
     if (access === "none") return { reason: SESSION_MOVE_UNAVAILABLE };
     if (!hasSessionAccess(access, "write")) return { reason: "Session write access required" };
+    if (await deniesNonOwnerTaskWrite(req, root)) return { reason: NOT_YOUR_TASK_DENIED };
   }
   if (root.parentTaskId) return { reason: "Task is not a session root" };
   const sourceError = sourceMoveError(options.destination ?? null, root);

package/src/http/tasks.ts

@@ -11,6 +11,7 @@ import {
   getAgentById,
   getAllTasks,
   getDbClient,
+  getInProgressTasksByContextKey,
   getLeadAgent,
   getLogsByTaskId,
   getPausedTasksForAgent,
@@ -39,6 +40,7 @@ import {
 } from "../be/db";
 import { modelProfileRefError, taskProfileError } from "../be/db/model-profiles";
 import { explicitModelErrorForAgent } from "../be/model-validation";
+import { getUserGrant } from "../be/rbac-roles";
 import { hasSessionAccess, type SessionAccess } from "../be/session-shares";
 import {
   getTaskSteeringFields,
@@ -49,7 +51,7 @@ import {
 } from "../be/steering";
 import { getTaskCitations, TaskCitationSchema } from "../be/task-citations";
 import { findUserById } from "../be/users";
-import { can, type RbacPrincipal, type RbacResource } from "../rbac";
+import { can, isRbacEnabled, type RbacPrincipal, type RbacResource } from "../rbac";
 import { chatThreadOfContextKey } from "../tasks/context-key";
 import { TaskCreationBlockedError } from "../tasks/errors";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
@@ -87,7 +89,9 @@ import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { bodyTask, route } from "./route-def";
 import {
   canReadSession,
+  deniesNonOwnerTaskWrite,
   denyParentAttach,
+  NOT_YOUR_TASK_DENIED,
   readableByFor,
   resolveSessionActor,
   SESSION_READ_DENIED,
@@ -279,6 +283,7 @@ const createTask = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   session: bodyTask("parentTaskId"),
+  rbac: { permission: "task.create.own" },
   summary: "Create a new task",
   tags: ["Tasks"],
   body: z
@@ -411,6 +416,7 @@ const cancelTaskRoute = route({
   path: "/api/tasks/{id}/cancel",
   pattern: ["api", "tasks", null, "cancel"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.cancel.own" },
   summary: "Cancel a pending or in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -687,6 +693,7 @@ const pauseTaskRoute = route({
   path: "/api/tasks/{id}/pause",
   pattern: ["api", "tasks", null, "pause"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Pause an in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -703,6 +710,7 @@ const resumeTaskRoute = route({
   path: "/api/tasks/{id}/resume",
   pattern: ["api", "tasks", null, "resume"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Resume a paused task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -777,9 +785,7 @@ const updateTaskTitleRoute = route({
     404: { description: "Task not found" },
   },
   auth: { apiKey: true },
-  rbac: {
-    ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only",
-  },
+  rbac: { permission: "task.action.own" },
 });
 
 async function canSteerTask(
@@ -879,6 +885,40 @@ async function resolveTaskWritePrincipal(
   return { kind: "agent", agentId, isLead: agent?.isLead === true };
 }
 
+/**
+ * May this caller bind a new task to a chat thread? The operator may. An agent needs the
+ * lead's chat post permission. A user needs admin, or a role with `integration.chat.post`.
+ */
+async function mayBindChatThread(principal: RbacPrincipal): Promise<boolean> {
+  if (principal.kind === "operator") return true;
+  if (principal.kind === "user") {
+    if (!isRbacEnabled()) return true;
+    const grant = await getUserGrant(principal.userId);
+    return grant.grantsAll || grant.verbs.has("integration.chat.post");
+  }
+  return can({
+    principal,
+    verb: "integration.chat.post",
+    resource: { kind: "none" },
+    source: "http",
+  }).allow;
+}
+
+/**
+ * Sibling awareness copies the open tasks under a contextKey into the new task, and may pick
+ * one as its parent. A non-admin user may name a context only when they may write each of
+ * its open tasks.
+ */
+async function deniesForeignContext(req: IncomingMessage, contextKey: string): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled()) return false;
+  if ((await getUserGrant(auth.userId)).grantsAll) return false;
+  for (const task of await getInProgressTasksByContextKey(contextKey)) {
+    if (await deniesNonOwnerTaskWrite(req, task)) return true;
+  }
+  return false;
+}
+
 /**
  * Requester for a new task. Prefer trusted server-side identity: an
  * authenticated request user, or the caller's own ownership-gated task context
@@ -1070,17 +1110,27 @@ export async function handleTasks(
       return true;
     }
     // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator
-    // may then read and post to. An agent may only name a thread other than the parent's
-    // with the lead's chat post permission.
+    // may then read and post to. Only a caller with chat post permission may name a thread
+    // other than the parent's.
     if (
-      principal.kind === "agent" &&
       parsed.body.contextKey &&
       parsed.body.contextKey !== parentTask?.contextKey &&
       chatThreadOfContextKey(parsed.body.contextKey) &&
-      !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" })
-        .allow
+      !(await mayBindChatThread(principal))
     ) {
-      jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
+      jsonError(
+        res,
+        "Permission denied: only a lead or an admin can bind a task to a chat thread.",
+        403,
+      );
+      return true;
+    }
+    if (
+      parsed.body.contextKey &&
+      parsed.body.contextKey !== parentTask?.contextKey &&
+      (await deniesForeignContext(req, parsed.body.contextKey))
+    ) {
+      jsonError(res, "You don't have access to the tasks in this context.", 403);
       return true;
     }
     let assetKey: string | undefined;
@@ -1240,7 +1290,12 @@ export async function handleTasks(
       return true;
     }
 
-    // Humans may cancel any task. Agents get the MCP cancel-task policy:
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
+    // Admins may cancel any task. Agents get the MCP cancel-task policy:
     // lead or task creator.
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
     if (
@@ -1882,6 +1937,11 @@ export async function handleTasks(
       return true;
     }
 
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;
@@ -1945,6 +2005,15 @@ export async function handleTasks(
   if (updateTaskTitleRoute.match(req.method, pathSegments)) {
     const parsed = await updateTaskTitleRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
+    const existing = await getTaskById(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Task not found", 404);
+      return true;
+    }
+    if (await deniesNonOwnerTaskWrite(req, existing)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
     const task = await updateTaskTitle(parsed.params.id, parsed.body.title);
     if (!task) {
       jsonError(res, "Task not found", 404);
@@ -1964,6 +2033,11 @@ export async function handleTasks(
       return true;
     }
 
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;

package/src/http/telemetry-ui.ts

@@ -32,7 +32,7 @@ const uiEvent = route({
     401: { description: "Unauthorized" },
     403: { description: "Guest page sessions cannot send events" },
   },
-  rbac: { ungated: "any authenticated dashboard user; event name allowlisted" },
+  rbac: { permission: "favorite.write.own" },
 });
 
 const enableTelemetry = route({

package/src/http/user-roles.ts

@@ -80,7 +80,10 @@ async function composeRoles(userId: string) {
 }
 
 /** Operator or user only; agents never change human roles, even with the shared key. */
-async function ensureRoleManager(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+export async function ensureRoleManager(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
   if (rejectGuest(req, res)) return false;
   const auth = getRequestAuth(req);
   if (auth?.kind !== "operator" && auth?.kind !== "user") {