@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/providers/dsh-adapter.ts

@@ -37,7 +37,7 @@ import type {
 } from "./types";
 
 // npm's `latest` is older and lacks the JSON/stdin contract used here.
-export const DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.3";
+export const DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.4";
 
 export function checkDshCredentials(env: Record<string, string | undefined>): CredStatus {
   return env.DEEPSEEK_API_KEY?.trim() || env.OPENROUTER_API_KEY?.trim()

package/src/providers/pi-mono-adapter.ts

@@ -382,14 +382,15 @@ type ToolStructuredContent = NonNullable<AgentToolResult["structuredContent"]>;
 export const SWARM_TOOL_NAMESPACE = { name: "agent-swarm" } as const;
 
 /**
- * `PI_TOOL_DEFERRAL`: hide non-core swarm tools behind pi's `tool_search`.
- * Off by default until a pilot measures the prompt-cache cost of mid-session
- * tool-set changes. Read from `process.env` by both the adapter traits (which
- * pick the prompt's tool-discovery line) and `createSession`, so the prompt
- * and the session always agree.
+ * `PI_TOOL_DEFERRAL`: hide non-core swarm tools, and installed MCP server
+ * tools, behind pi's `tool_search`. On by default: the deferred schemas cost
+ * more on every request than the one partial cache miss a load causes.
+ * `false` declares every tool up front. Read from `process.env` by both the
+ * adapter traits (which pick the prompt's tool-discovery line) and
+ * `createSession`, so the prompt and the session always agree.
  */
 export function isPiToolDeferralEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
-  return parseEnvFlag(env.PI_TOOL_DEFERRAL, false);
+  return parseEnvFlag(env.PI_TOOL_DEFERRAL, true);
 }
 
 /**
@@ -919,6 +920,28 @@ function requestContextTokens(message: unknown): number | undefined {
   return usage.input + cacheRead + cacheWrite;
 }
 
+/**
+ * The session-log line for one LLM call's usage (token counts only, never
+ * content). The dashboard reads it as that call's cache-hit chip.
+ */
+function callUsageLine(message: unknown): string | undefined {
+  const usage = (message as { usage?: Record<string, unknown> } | null)?.usage;
+  if (typeof usage?.input !== "number") return undefined;
+  const count = (value: unknown) =>
+    typeof value === "number" && Number.isFinite(value) ? value : 0;
+  return JSON.stringify({
+    type: "call_usage",
+    harness: "pi",
+    usage: {
+      input: count(usage.input),
+      cacheRead: count(usage.cacheRead),
+      cacheWrite: count(usage.cacheWrite),
+      output: count(usage.output),
+      reasoning: count(usage.reasoning),
+    },
+  });
+}
+
 function describeAssistantTurn(message: unknown): AssistantTurnShape {
   const msg = (message ?? {}) as {
     content?: unknown;
@@ -1018,6 +1041,8 @@ export class PiMonoSession implements ProviderSession {
   private emptyTurnReprompted = false;
   /** `abort()` was called: never prompt a session someone is trying to stop. */
   private abortRequested = false;
+  /** Pending `waitForIdle()` resolvers released when `agent_end` fires or `abort()` is called. */
+  private idleResolvers = new Set<() => void>();
   /** Removes this session's own models.json once the session ends. */
   private disposeModels: () => Promise<void>;
   /** Fed each assistant request's prompt size; steers the one-time context-bound note. */
@@ -1116,6 +1141,10 @@ export class PiMonoSession implements ProviderSession {
         if (endMsg.role === "assistant") {
           const turn = describeAssistantTurn(event.message);
           this.lastAssistantTurn = turn;
+          // Ahead of the turn's text and tool lines: the chip rides on the
+          // call's first row.
+          const usageLine = callUsageLine(event.message);
+          if (usageLine) this.emit({ type: "raw_log", content: usageLine });
           if (endMsg.stopReason === "error") {
             // Candidate terminal failure. May still be cleared by a successful
             // retry (auto_retry_end success / a later good message_end).
@@ -1222,6 +1251,14 @@ export class PiMonoSession implements ProviderSession {
       case "tool_execution_end":
         if (this.pendingTerminalStoreProgress.delete(event.toolCallId) && !event.isError) {
           this.terminalStoreProgressDone = true;
+          const snapshotCost = this.safeBuildCostData(false);
+          if (snapshotCost) {
+            this.emit({
+              type: "result",
+              cost: snapshotCost,
+              isError: false,
+            });
+          }
         }
         this.emit({
           type: "raw_log",
@@ -1327,6 +1364,24 @@ export class PiMonoSession implements ProviderSession {
       };
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
+      if (this.abortRequested && this.terminalStoreProgressDone) {
+        const cost = this.safeBuildCostData(false);
+        if (cost) {
+          this.emit({
+            type: "result",
+            cost,
+            isError: false,
+          });
+        }
+        return {
+          exitCode: 0,
+          sessionId: this._sessionId,
+          cost,
+          output: this.lastAssistantText || undefined,
+          isError: false,
+          appliedReasoningEffort: this.appliedReasoningEffort,
+        };
+      }
       // Defense-in-depth: AWS SDK failures surface as structured events (handled
       // above in runSession), not thrown exceptions, so this catch is for genuine
       // unexpected throws (MCP / transport / etc). Still classify in case an AWS
@@ -1341,9 +1396,11 @@ export class PiMonoSession implements ProviderSession {
       }
       this.emit({ type: "raw_stderr", content: `[pi-mono] Error: ${errorMessage}\n` });
 
+      const cost = this.safeBuildCostData(true);
       return {
         exitCode: 1,
         sessionId: this._sessionId,
+        cost,
         isError: true,
         errorCategory: awsCatchError?.category,
         failureReason: scrubSecrets(awsCatchError?.message ?? errorMessage),
@@ -1426,16 +1483,38 @@ export class PiMonoSession implements ProviderSession {
         return;
       }
 
-      // Subscribe and wait for agent_end
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        unsub();
+        this.idleResolvers.delete(finish);
+        resolve();
+      };
+
+      // Subscribe and wait for agent_end (or abort)
       const unsub = this.agentSession.subscribe((event) => {
         if (event.type === "agent_end") {
-          unsub();
-          resolve();
+          finish();
         }
       });
+      this.idleResolvers.add(finish);
+      if (this.abortRequested) {
+        finish();
+      }
     });
   }
 
+  private safeBuildCostData(isError: boolean): CostData | undefined {
+    try {
+      const stats = this.agentSession.getSessionStats();
+      if (!stats) return undefined;
+      return { ...this.buildCostData(stats), isError };
+    } catch {
+      return undefined;
+    }
+  }
+
   private buildCostData(stats: SessionStats): CostData {
     return {
       sessionId: "", // Runner overrides with runner session ID
@@ -1475,6 +1554,9 @@ export class PiMonoSession implements ProviderSession {
 
   async abort(): Promise<void> {
     this.abortRequested = true;
+    for (const resolve of [...this.idleResolvers]) {
+      resolve();
+    }
     await this.agentSession.abort();
   }
 
@@ -1684,12 +1766,15 @@ function escapeValues(values: unknown): Record<string, string> {
 /**
  * Map installed servers (`fetchInstalledMcpServers(..., "claude")` entries)
  * to pi MCP configs. pi speaks stdio and streamable HTTP; `sse` entries map to
- * HTTP, which is how the previous pi client already reached them. Tools stay
- * `direct`, as before: the prompt lists these servers as in the tool list.
+ * HTTP, which is how the previous pi client already reached them. With
+ * `deferred`, their tools load through `tool_search` like non-core swarm
+ * tools; otherwise they are declared up front.
  */
 export function toPiMcpServers(
   installed: Record<string, Record<string, unknown>> | null,
+  options: { deferred?: boolean } = {},
 ): Record<string, McpServerConfig> {
+  const exposure = options.deferred ? "deferred" : "direct";
   const servers: Record<string, McpServerConfig> = {};
   for (const [name, entry] of Object.entries(installed ?? {})) {
     if (typeof entry.command === "string") {
@@ -1698,14 +1783,14 @@ export function toPiMcpServers(
         command: entry.command,
         args: Array.isArray(entry.args) ? entry.args.map(String) : [],
         env: escapeValues(entry.env),
-        exposure: "direct",
+        exposure,
       };
     } else if (typeof entry.url === "string") {
       servers[name] = {
         type: "http",
         url: entry.url,
         headers: escapeValues(entry.headers),
-        exposure: "direct",
+        exposure,
       };
     }
   }
@@ -1860,7 +1945,7 @@ export class PiMonoAdapter implements ProviderAdapter {
       config.apiUrl && config.apiKey && config.agentId
         ? await fetchInstalledMcpServers(config.apiUrl, config.apiKey, config.agentId, "claude")
         : null;
-    const piMcpServers = toPiMcpServers(installedMcpServers);
+    const piMcpServers = toPiMcpServers(installedMcpServers, { deferred: deferTools });
     if (Object.keys(piMcpServers).length > 0) {
       console.log(
         `\x1b[2m[${config.role}]\x1b[0m Registering ${Object.keys(piMcpServers).length} installed MCP server(s) with pi`,

package/src/rbac/legacy-policy.ts

@@ -340,6 +340,7 @@ export const LEGACY_POLICY = {
   "mcp-oauth.authorize.any": anyAuthenticated,
   "kv.write.any": leadOrOwnNamespace,
   "comb.presence": operatorOrUser,
+  "fs.join.own": anyAuthenticated,
   "page.delete.any": leadOrResourceOwner,
   "app.manage": anyAuthenticated,
   "app.use": anyAuthenticated,

package/src/rbac/permissions.ts

@@ -314,6 +314,10 @@ export const PERMISSIONS = {
     description: "Use dashboard presence rooms for Comb drives.",
     namespace: "comb",
   },
+  "fs.join.own": {
+    description: "Join the swarm's shared agent-fs drive with your own account email.",
+    namespace: "fs",
+  },
   "page.delete.any": {
     description: "Delete a page the caller does not own.",
     namespace: "page",

package/src/scheduler/scheduler.ts

@@ -75,7 +75,7 @@ function resolveExecutorRegistry(): ExecutorRegistry | null {
  * scripts-runtime — no agent/LLM in the loop. Reuses the same `runScriptWithRunCredential()`
  * path as the `swarm-script` workflow executor.
  */
-async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
+export async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
   if (!schedule.scriptName) {
     throw new Error(`Schedule "${schedule.name}" has no scriptName (targetType=script)`);
   }
@@ -106,6 +106,7 @@ async function executeScheduleScript(schedule: ScheduledTask): Promise<void> {
       source: script.source,
       args,
       fsMode: "none",
+      executor: script.executor,
       agentId,
       egressSecrets: credentials.egressSecrets,
       userConfig: credentials.userConfig,

package/src/scripts-runtime/eval-harness.ts

@@ -1,6 +1,7 @@
 import { buildCtx } from "./ctx";
 import { patchFetchWithEgressSubstitution } from "./egress-secrets";
 import type { SwarmConfigPayload } from "./executors/types";
+import { isHostValidationEquivalent } from "./host-validated-args";
 import { ctxSignatureHintFor } from "./script-error-hints";
 import { SwarmConfig } from "./swarm-config";
 
@@ -131,8 +132,14 @@ try {
     );
   }
 
+  const hostValidatedArgs = process.env.SWARM_SCRIPT_HOST_VALIDATED_ARGS === "1";
   let validatedArgs = parsedArgs;
-  if (mod.argsSchema && typeof mod.argsSchema === "object" && "parse" in mod.argsSchema) {
+  if (
+    mod.argsSchema &&
+    typeof mod.argsSchema === "object" &&
+    "parse" in mod.argsSchema &&
+    !(hostValidatedArgs && isHostValidationEquivalent(mod.argsSchema, parsedArgs))
+  ) {
     try {
       // biome-ignore lint/suspicious/noExplicitAny: argsSchema is a Zod schema at runtime
       validatedArgs = (mod.argsSchema as any).parse(parsedArgs);

package/src/scripts-runtime/executors/native.ts

@@ -173,23 +173,21 @@ export class NativeScriptExecutor implements ScriptExecutor {
     let removeAbortListener: (() => void) | undefined;
     let proc: Bun.Subprocess<"pipe", "pipe", "pipe"> | undefined;
 
-    try {
-      if (killed) {
-        return {
-          result: undefined,
-          stdout: "",
-          stderr: "",
-          truncated: { stdout: false, stderr: false },
-          durationMs: Date.now() - start,
-          exitCode: 1,
-          error: "killed",
-        };
-      }
+    const killedOutput = (): ExecutorOutput => ({
+      result: undefined,
+      stdout: "",
+      stderr: "",
+      truncated: { stdout: false, stderr: false },
+      durationMs: Date.now() - start,
+      exitCode: 1,
+      error: "killed",
+    });
 
-      await Bun.write(argsFile, JSON.stringify(input.args ?? null));
-      await Bun.write(sourceFile, input.source);
-      await writeBareImportShims(tmpdir);
+    try {
+      if (killed) return killedOutput();
 
+      // Listen before the first await: an abort during the file writes below
+      // must stop the spawn, not land between the writes and the listener.
       const onExternalAbort = () => {
         killed = true;
         if (proc) void terminateProcessGroup(proc.pid);
@@ -197,12 +195,19 @@ export class NativeScriptExecutor implements ScriptExecutor {
       input.signal?.addEventListener("abort", onExternalAbort, { once: true });
       removeAbortListener = () => input.signal?.removeEventListener("abort", onExternalAbort);
 
+      await Bun.write(argsFile, JSON.stringify(input.args ?? null));
+      await Bun.write(sourceFile, input.source);
+      await writeBareImportShims(tmpdir);
+
+      // No await between this check and the spawn below.
+      if (killed) return killedOutput();
+
       const timeout = setTimeout(() => {
         timedOut = true;
         if (proc) void terminateProcessGroup(proc.pid);
       }, input.resources.wallClockMs);
 
-      const harnessEnv = {
+      const harnessEnv: Record<string, string> = {
         PATH: process.env.PATH ?? "/usr/bin:/bin",
         HOME: process.env.HOME ?? "/tmp",
         LANG: process.env.LANG ?? "C.UTF-8",
@@ -214,6 +219,7 @@ export class NativeScriptExecutor implements ScriptExecutor {
         SWARM_SCRIPT_RESULT_FILE: resultFile,
         SWARM_SCRIPT_ERROR_FILE: errorFile,
         SWARM_SCRIPT_STARTED_FILE: startedFile,
+        ...(input.hostValidatedArgs ? { SWARM_SCRIPT_HOST_VALIDATED_ARGS: "1" } : {}),
       };
 
       proc = registerProcessGroup(

package/src/scripts-runtime/executors/quickjs-prelude.ts

@@ -308,14 +308,116 @@ define("__swarm_ctx", ctx);
  * zod `argsSchema` check, the same contract as `eval-harness.ts`.
  */
 export const SANDBOX_EPILOGUE = String.raw`(async () => {
+  const isStructuralSchemaNode = (schema) => {
+    if (!schema || typeof schema !== "object") return false;
+    const def = schema._zod && schema._zod.def;
+    if (!def || typeof def !== "object") return false;
+    if (def.coerce) return false;
+    if (Array.isArray(def.checks) && def.checks.length > 0) return false;
+    switch (def.type) {
+      case "string":
+      case "number":
+        return !def.format;
+      case "boolean":
+      case "literal":
+      case "enum":
+        return true;
+      case "optional":
+      case "nullable":
+        return isStructuralSchemaNode(def.innerType);
+      case "array":
+        return isStructuralSchemaNode(def.element);
+      case "object": {
+        const rawShape = typeof def.shape === "function" ? def.shape() : def.shape;
+        if (!rawShape || typeof rawShape !== "object") return false;
+        return Object.values(rawShape).every(isStructuralSchemaNode);
+      }
+      default:
+        return false;
+    }
+  };
+  const isHostValidationEquivalent = (schema, value) => {
+    if (!schema || typeof schema !== "object") return false;
+    const def = schema._zod && schema._zod.def;
+    if (!def || typeof def !== "object") return false;
+    if (def.coerce) return false;
+    if (Array.isArray(def.checks) && def.checks.length > 0) return false;
+    switch (def.type) {
+      case "string":
+        return typeof value === "string" && !def.format;
+      case "number":
+        return typeof value === "number" && Number.isFinite(value) && !def.format;
+      case "boolean":
+        return typeof value === "boolean";
+      case "literal": {
+        const rawValues = def.values;
+        const values = Array.isArray(rawValues)
+          ? rawValues
+          : rawValues instanceof Set
+            ? Array.from(rawValues)
+            : [];
+        return (
+          values.length > 0 &&
+          values.some((v) => v === value && typeof v !== "bigint" && typeof v !== "symbol")
+        );
+      }
+      case "enum": {
+        if (schema._zod && schema._zod.values instanceof Set) {
+          return schema._zod.values.has(value);
+        }
+        const entriesObj = def.entries && typeof def.entries === "object" ? def.entries : null;
+        if (!entriesObj) return false;
+        const entries = Object.values(entriesObj).filter(
+          (v) => !(typeof v === "string" && typeof entriesObj[v] === "number"),
+        );
+        return entries.length > 0 && entries.includes(value);
+      }
+      case "optional":
+        return value === undefined
+          ? isStructuralSchemaNode(def.innerType)
+          : isHostValidationEquivalent(def.innerType, value);
+      case "nullable":
+        return value === null
+          ? isStructuralSchemaNode(def.innerType)
+          : isHostValidationEquivalent(def.innerType, value);
+      case "array":
+        return (
+          Array.isArray(value) &&
+          isStructuralSchemaNode(def.element) &&
+          value.every((item) => isHostValidationEquivalent(def.element, item))
+        );
+      case "object": {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+        const shape = typeof def.shape === "function" ? def.shape() : def.shape;
+        if (!shape || typeof shape !== "object") return false;
+        for (const key of Object.keys(value)) {
+          if (!Object.hasOwn(shape, key)) return false;
+        }
+        for (const [key, propSchema] of Object.entries(shape)) {
+          if (!Object.hasOwn(value, key) && key in value) return false;
+          const propValue = value[key];
+          if (!isHostValidationEquivalent(propSchema, propValue)) return false;
+        }
+        return true;
+      }
+      default:
+        return false;
+    }
+  };
   const mod = globalThis.__swarm_module;
   if (!mod || typeof mod.default !== "function") {
     throw new Error(
       "Swarm script must export a default function. Script must export default async function (args, ctx): args FIRST, ctx second.",
     );
   }
+  const hostValidatedArgs = globalThis.__swarm_host_validated_args === true;
   let args = globalThis.__swarm_args;
-  if (mod.argsSchema && typeof mod.argsSchema === "object" && "parse" in mod.argsSchema) {
+  if (
+    mod.argsSchema &&
+    typeof mod.argsSchema === "object" &&
+    "parse" in mod.argsSchema &&
+    !(hostValidatedArgs && isHostValidationEquivalent(mod.argsSchema, args))
+  ) {
     try {
       args = mod.argsSchema.parse(args);
     } catch (error) {

package/src/scripts-runtime/executors/quickjs-runner.ts

@@ -29,6 +29,7 @@ import type {
 export type QuickJSJob = {
   source: string;
   args: unknown;
+  hostValidatedArgs?: boolean;
   configPayload: SwarmConfigPayload;
   resources: ScriptResourcePolicy;
   network: ExecutorInput["network"];
@@ -656,7 +657,7 @@ async function evaluateJob(
 
   let timer: ReturnType<typeof setTimeout> | undefined;
   try {
-    const init = `globalThis.__swarm_shape = ${JSON.stringify(shape)};\nglobalThis.__swarm_args = ${JSON.stringify(args)};`;
+    const init = `globalThis.__swarm_shape = ${JSON.stringify(shape)};\nglobalThis.__swarm_args = ${JSON.stringify(args)};\nglobalThis.__swarm_host_validated_args = ${Boolean(job.hostValidatedArgs)};`;
     const ok =
       evaluate(init, "swarm-init.js") &&
       evaluate(SANDBOX_WEB_SHIMS, "swarm-web-shims.js") &&

package/src/scripts-runtime/executors/quickjs.ts

@@ -146,6 +146,12 @@ export class QuickJSScriptExecutor implements ScriptExecutor {
         `quickjs worker failed to start: ${error instanceof Error ? error.message : String(error)}`,
       );
     }
+    // An abort while the worker booted fired before the listener below
+    // exists. From here to postMessage nothing awaits.
+    if (input.signal?.aborted) {
+      pool.release(slot);
+      return emptyOutput("killed");
+    }
 
     const id = ++requestSeq;
     const start = performance.now();
@@ -196,6 +202,7 @@ export class QuickJSScriptExecutor implements ScriptExecutor {
         job: {
           source: input.source,
           args: input.args,
+          ...(input.hostValidatedArgs ? { hostValidatedArgs: true } : {}),
           configPayload: input.configPayload,
           resources: input.resources,
           network: input.network,

package/src/scripts-runtime/executors/registry.ts

@@ -7,6 +7,27 @@ const EXECUTORS: Record<string, () => ScriptExecutor> = {
   quickjs: () => new QuickJSScriptExecutor(),
 };
 
+export function getDeploymentScriptExecutorName(env: NodeJS.ProcessEnv = process.env): string {
+  return (env.SCRIPT_EXECUTOR ?? "native").trim();
+}
+
+/**
+ * Operator sandbox ceiling: when the deployment sets `SCRIPT_EXECUTOR=quickjs`,
+ * individual scripts or agent calls may not escalate to the less-restricted
+ * `native` executor. When the deployment runs `native` (the default), scripts
+ * may opt down into `quickjs`.
+ */
+export function isExecutorAllowedByDeployment(
+  requested: string | null | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (!requested) return true;
+  if (getDeploymentScriptExecutorName(env) === "quickjs" && requested.trim() === "native") {
+    return false;
+  }
+  return true;
+}
+
 export function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native"): ScriptExecutor {
   const factory = EXECUTORS[name.trim()];
   if (!factory) {
@@ -16,3 +37,14 @@ export function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native"
   }
   return factory();
 }
+
+export function resolveScriptExecutor(
+  requested?: string | null,
+  env: NodeJS.ProcessEnv = process.env,
+): ScriptExecutor {
+  if (!isExecutorAllowedByDeployment(requested, env)) {
+    throw new Error('Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"');
+  }
+  const effective = requested ?? env.SCRIPT_EXECUTOR ?? "native";
+  return getScriptExecutor(effective);
+}

package/src/scripts-runtime/executors/types.ts

@@ -3,6 +3,7 @@ import type { ScriptApiConnectionDescriptor, ScriptMcpConnectionDescriptor } fro
 import type { FailedCredentialBinding, ResolvedCredentialBinding } from "../credential-broker";
 
 export type ScriptFsMode = "none" | "workspace-rw";
+export type ScriptExecutorName = "native" | "quickjs";
 
 export type EgressSecretEntry = ResolvedCredentialBinding;
 
@@ -49,6 +50,12 @@ export type ScriptResourcePolicy = {
 export type ExecutorInput = {
   source: string;
   args: unknown;
+  /**
+   * Trusted host-only flag indicating `args` already passed host JSON Schema
+   * validation for this run. Executors may skip `argsSchema.parse(args)` only
+   * when this flag is true AND the runtime `argsSchema` is purely structural.
+   */
+  hostValidatedArgs?: boolean;
   configPayload: SwarmConfigPayload;
   resources: ScriptResourcePolicy;
   fsMode: ScriptFsMode;