@desplega.ai/agent-swarm 2.7.0 → 2.7.1

package/src/http/onboarding.ts

@@ -2,12 +2,15 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import OpenAI from "openai";
 import { getAutomationSetupStates } from "../be/automation-preflight";
 import { getAgentHarnessProviders, getReadyAgentCounts, getTaskById } from "../be/db";
-import { getEmbeddingProvider } from "../be/memory";
+import { getEmbeddingProvider, resetEmbeddingProvider } from "../be/memory";
 import { EMBEDDING_DIMENSIONS } from "../be/memory/constants";
 import {
+  EMBEDDING_PREFIX_KEYS,
+  type MemoryConfigChange,
   OnboardingActionSchema,
   type OnboardingErrorClass,
   type OnboardingMemoryPreset,
+  type OnboardingMemoryProvider,
   type OnboardingMemoryRequest,
   OnboardingMemoryRequestSchema,
   type OnboardingMemoryResponse,
@@ -21,16 +24,89 @@ import {
 } from "../be/onboarding";
 import { assertUrlSafe, publicEndpointSsrfOptions } from "../oauth/mcp-wrapper";
 import { ProviderNameSchema } from "../types";
+import { isCombEnabled } from "../utils/constants";
 import { splitCredentialPool } from "../utils/credentials";
+import { isPrivateAddress } from "../utils/egress-guard";
 import { getOpenRouterAttributionHeaders } from "../utils/openrouter-base-url";
 import { ensureConfigAdmin } from "./config";
-import { scheduleIntegrationsReload } from "./core";
+import {
+  getDeploymentEnvValue,
+  loadGlobalConfigsIntoEnv,
+  scheduleIntegrationsReload,
+} from "./core";
 import { route } from "./route-def";
 import { rollupCredStatusForProvider } from "./status";
 import { jsonError } from "./utils";
 
 export type { OnboardingState } from "../be/onboarding";
 
+/**
+ * The embeddings endpoint runs on this server or its private network: a
+ * loopback name, a private IP, or a single-label host such as the bundled
+ * `tei` service. Unset means the hosted OpenAI default.
+ */
+function isLocalEndpoint(baseUrl: string | undefined): boolean {
+  if (!baseUrl?.trim()) return false;
+  let host: string;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (isPrivateAddress(host)) return true;
+  // IPv6 literals hold colons: only a plain name can be a single label.
+  return !host.includes(".") && !host.includes(":");
+}
+
+/** The hosts of the hosted memory presets (the UI's preset list). */
+const PRESET_HOSTS: ReadonlyArray<[OnboardingMemoryProvider, (host: string) => boolean]> = [
+  ["openai", (host) => host === "api.openai.com"],
+  ["openrouter", (host) => host === "openrouter.ai"],
+  ["vercel", (host) => host === "ai-gateway.vercel.sh"],
+  [
+    "azure",
+    (host) =>
+      [".services.ai.azure.com", ".openai.azure.com", ".cognitiveservices.azure.com"].some(
+        (suffix) => host.endsWith(suffix),
+      ),
+  ],
+];
+
+/** Where an embeddings endpoint runs, from its host. Unset means the hosted OpenAI default. */
+function embeddingsProvider(baseUrl: string | undefined): OnboardingMemoryProvider {
+  if (isLocalEndpoint(baseUrl)) return "local";
+  if (!baseUrl?.trim()) return "openai";
+  let host: string;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return "custom";
+  }
+  return PRESET_HOSTS.find(([, matches]) => matches(host))?.[0] ?? "custom";
+}
+
+/**
+ * The deployment environment's own embeddings setup, before a stored config
+ * replaced it: its base URL, model, and key. The key can also be a stored
+ * OPENAI_API_KEY, as for the setup the server runs.
+ */
+function deploymentEmbeddings() {
+  return {
+    baseUrl: getDeploymentEnvValue("EMBEDDING_API_BASE_URL"),
+    model: getDeploymentEnvValue("EMBEDDING_MODEL") ?? "text-embedding-3-small",
+    apiKey: getDeploymentEnvValue("EMBEDDING_API_KEY") ?? process.env.OPENAI_API_KEY,
+  };
+}
+
+/** The local setup of the deployment environment, when it has a local endpoint and a key. */
+function localDefault(): { model: string } | null {
+  const deployment = deploymentEmbeddings();
+  if (!isLocalEndpoint(deployment.baseUrl) || !deployment.apiKey) return null;
+  return { model: deployment.model };
+}
+
 async function buildSignals(state: OnboardingState): Promise<OnboardingSignals> {
   const providers: OnboardingSignals["providers"] = [];
   for (const entry of await getAgentHarnessProviders()) {
@@ -51,12 +127,18 @@ async function buildSignals(state: OnboardingState): Promise<OnboardingSignals>
   const integrations = await getAutomationSetupStates();
   const agentCounts = await getReadyAgentCounts();
   const firstTask = state.firstTaskId ? await getTaskById(state.firstTaskId) : null;
+  const embeddingsOn = getEmbeddingProvider().isConfigured();
 
   return {
     providers,
     embeddings: {
-      configured: getEmbeddingProvider().isConfigured(),
+      configured: embeddingsOn,
       dimensions: EMBEDDING_DIMENSIONS,
+      // The model id and the host class only: never the key or the URL.
+      model: embeddingsOn ? (process.env.EMBEDDING_MODEL ?? "text-embedding-3-small") : null,
+      local: embeddingsOn && isLocalEndpoint(process.env.EMBEDDING_API_BASE_URL),
+      provider: embeddingsOn ? embeddingsProvider(process.env.EMBEDDING_API_BASE_URL) : null,
+      localDefault: localDefault(),
     },
     integrations: {
       slack: integrations.slack === "configured",
@@ -71,6 +153,7 @@ async function buildSignals(state: OnboardingState): Promise<OnboardingSignals>
       workersOnline: agentCounts.workers,
     },
     firstTask: firstTask ? { id: firstTask.id, status: firstTask.status } : null,
+    files: { enabled: isCombEnabled() },
   };
 }
 
@@ -195,10 +278,31 @@ function memoryErrorMessage(errorClass: OnboardingErrorClass, status?: number):
 async function updateMemoryState(
   preset: OnboardingMemoryPreset,
   result: { ok: true } | { ok: false; errorClass: OnboardingErrorClass },
-  saveConfig?: { baseUrl: string; model: string; apiKey?: string },
+  change?: MemoryConfigChange,
 ): Promise<void> {
-  const configSaved = await updateOnboardingMemory(preset, result, saveConfig);
-  if (configSaved) scheduleIntegrationsReload();
+  const configChanged = await updateOnboardingMemory(preset, result, change);
+  if (!configChanged) return;
+  if (change?.kind === "restore") {
+    // Apply the deployment setup before the response: the next GET shows it
+    // in use. Memory search stays on, so the reload starts no backfill.
+    await loadGlobalConfigsIntoEnv(true);
+    resetEmbeddingProvider();
+  }
+  scheduleIntegrationsReload();
+}
+
+/**
+ * The task prefixes of a saved setup. A prefix of the deployment environment
+ * belongs to its model (nomic needs `search_query: `): another model gets an
+ * empty stored prefix over it, and the same model gets the deployment prefix
+ * back (the stored row is deleted).
+ */
+function prefixChanges(model: string): Extract<MemoryConfigChange, { kind: "save" }>["prefixes"] {
+  const sameModel = model === getDeploymentEnvValue("EMBEDDING_MODEL");
+  return EMBEDDING_PREFIX_KEYS.filter((key) => getDeploymentEnvValue(key)).map((key) => ({
+    key,
+    value: sameModel ? null : "",
+  }));
 }
 
 async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<OnboardingMemoryResponse> {
@@ -207,21 +311,39 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     body.preset === "openai" || body.preset === "openrouter" || body.preset === "vercel"
       ? MEMORY_PRESETS[body.preset]
       : undefined;
+  // `existing` tests the setup the server runs. With `restoreDefault` it
+  // tests the deployment environment's setup, which applies once the stored
+  // config is gone.
+  const restore = body.preset === "existing" && body.restoreDefault === true;
+  const deployment = restore ? deploymentEmbeddings() : null;
   const baseUrl =
     body.preset === "existing"
-      ? process.env.EMBEDDING_API_BASE_URL
+      ? deployment
+        ? deployment.baseUrl
+        : process.env.EMBEDDING_API_BASE_URL
       : (body.baseUrl ??
         preset?.baseUrl ??
         process.env.EMBEDDING_API_BASE_URL ??
         "https://api.openai.com/v1");
   const model =
     body.preset === "existing"
-      ? (process.env.EMBEDDING_MODEL ?? "text-embedding-3-small")
+      ? (deployment?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small")
       : (body.model ?? preset?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small");
 
+  // Preset `existing` tests the server's own EMBEDDING_API_BASE_URL. When it is
+  // the deployment environment's value, the URL is operator config, not request
+  // input, so a private endpoint (a local TEI at http://tei:80/v1) is allowed. A
+  // value stored through `/api/config` and every URL that can come from the
+  // request still pass the SSRF check.
+  const configuredEndpoint =
+    body.preset === "existing" &&
+    !!baseUrl &&
+    baseUrl === getDeploymentEnvValue("EMBEDDING_API_BASE_URL");
   let endpoint: URL;
   try {
-    endpoint = assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
+    endpoint = configuredEndpoint
+      ? new URL(baseUrl ?? "")
+      : assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
   } catch {
     // Input rejections are not probe outcomes: the step state stays as is.
     return {
@@ -243,7 +365,9 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     !explicitKey && body.reuseKey && canReuseKey ? process.env[body.reuseKey] : undefined;
   const implicitKey =
     body.preset === "existing"
-      ? (process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY)
+      ? deployment
+        ? deployment.apiKey
+        : (process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY)
       : undefined;
   // Test and save the same pool member.
   const apiKey = splitCredentialPool(explicitKey ?? reusedKey ?? implicitKey ?? "")[0];
@@ -290,11 +414,15 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
       body.preset,
       { ok: true },
       body.preset === "existing"
-        ? undefined
+        ? restore
+          ? { kind: "restore" }
+          : undefined
         : {
+            kind: "save",
             baseUrl: baseUrl ?? "https://api.openai.com/v1",
             model,
             apiKey: keyToSave,
+            prefixes: prefixChanges(model),
           },
     );
     return { ok: true, dimensions, latencyMs };

package/src/http/session-access.ts

@@ -88,6 +88,30 @@ export async function hasSessionWrite(
   return hasSessionAccess(access, "write");
 }
 
+export const NOT_YOUR_TASK_DENIED =
+  "You can only change tasks you requested, or sessions shared with you to edit.";
+
+/**
+ * True when a user token without a grant-all role (RBAC on) changes a task it
+ * does not own: neither the task nor its session root names the user as
+ * requester, and the session is not shared with the user for writing. The
+ * session wall reads an ownerless root (Slack, schedules, operator key) as
+ * everyone's; for such a user it is not theirs to change. Operator, agent and
+ * admin callers are never denied here.
+ */
+export async function deniesNonOwnerTaskWrite(
+  req: IncomingMessage,
+  task: { id: string; requestedByUserId?: string | null },
+): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled()) return false;
+  if (task.requestedByUserId === auth.userId) return false;
+  if ((await getUserGrant(auth.userId)).grantsAll) return false;
+  const root = await getSessionRoot(task.id);
+  if (!root?.requestedByUserId) return true;
+  return !hasSessionAccess(await sessionAccessForRoot(auth.userId, root), "write");
+}
+
 /**
  * The parent gate shared by `POST /api/tasks` and `POST /api/apps/{id}/actions/{name}`.
  * The child inherits the parent's thread context, so an agent caller must own or

package/src/http/sessions.ts

@@ -77,7 +77,13 @@ import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { canMutateTaskNamespace } from "./assets";
 import { agentFirstPrincipal } from "./request-principal";
 import { route } from "./route-def";
-import { resolveSessionActor, type SessionActor, sessionAccessFor } from "./session-access";
+import {
+  deniesNonOwnerTaskWrite,
+  NOT_YOUR_TASK_DENIED,
+  resolveSessionActor,
+  type SessionActor,
+  sessionAccessFor,
+} from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Response Schemas ────────────────────────────────────────────────────────
@@ -660,7 +666,7 @@ const triageSessionListRoute = route({
     401: { description: "Unauthorized" },
   },
   auth: { apiKey: true },
-  rbac: { ungated: "per-user inbox UI state, same posture as PATCH /api/inbox-state" },
+  rbac: { permission: "favorite.write.own" },
 });
 
 const SESSION_MOVE_LIMIT = 200;
@@ -671,10 +677,7 @@ const SessionMoveResultSchema = z.object({
   moved: z.array(z.string()),
   skipped: z.array(z.object({ rootTaskId: z.string(), reason: z.string() })),
 });
-const sessionMoveRbac = {
-  ungated:
-    "per-session access, per-task task.fs.mutate, and asset-key write checks in the handler, as PATCH /api/assets/task/{id}/key",
-};
+const sessionMoveRbac = { permission: "task.fs.mutate" } as const;
 const sessionMoveResponses = {
   400: { description: "Invalid namespace or request" },
   403: { description: "Personal destination not authorized" },
@@ -759,6 +762,7 @@ async function checkSessionMove(
     const access = await sessionAccessFor(actor, root.id);
     if (access === "none") return { reason: SESSION_MOVE_UNAVAILABLE };
     if (!hasSessionAccess(access, "write")) return { reason: "Session write access required" };
+    if (await deniesNonOwnerTaskWrite(req, root)) return { reason: NOT_YOUR_TASK_DENIED };
   }
   if (root.parentTaskId) return { reason: "Task is not a session root" };
   const sourceError = sourceMoveError(options.destination ?? null, root);

package/src/http/tasks.ts

@@ -11,6 +11,7 @@ import {
   getAgentById,
   getAllTasks,
   getDbClient,
+  getInProgressTasksByContextKey,
   getLeadAgent,
   getLogsByTaskId,
   getPausedTasksForAgent,
@@ -39,6 +40,7 @@ import {
 } from "../be/db";
 import { modelProfileRefError, taskProfileError } from "../be/db/model-profiles";
 import { explicitModelErrorForAgent } from "../be/model-validation";
+import { getUserGrant } from "../be/rbac-roles";
 import { hasSessionAccess, type SessionAccess } from "../be/session-shares";
 import {
   getTaskSteeringFields,
@@ -49,7 +51,7 @@ import {
 } from "../be/steering";
 import { getTaskCitations, TaskCitationSchema } from "../be/task-citations";
 import { findUserById } from "../be/users";
-import { can, type RbacPrincipal, type RbacResource } from "../rbac";
+import { can, isRbacEnabled, type RbacPrincipal, type RbacResource } from "../rbac";
 import { chatThreadOfContextKey } from "../tasks/context-key";
 import { TaskCreationBlockedError } from "../tasks/errors";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
@@ -87,7 +89,9 @@ import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { bodyTask, route } from "./route-def";
 import {
   canReadSession,
+  deniesNonOwnerTaskWrite,
   denyParentAttach,
+  NOT_YOUR_TASK_DENIED,
   readableByFor,
   resolveSessionActor,
   SESSION_READ_DENIED,
@@ -279,6 +283,7 @@ const createTask = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   session: bodyTask("parentTaskId"),
+  rbac: { permission: "task.create.own" },
   summary: "Create a new task",
   tags: ["Tasks"],
   body: z
@@ -411,6 +416,7 @@ const cancelTaskRoute = route({
   path: "/api/tasks/{id}/cancel",
   pattern: ["api", "tasks", null, "cancel"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.cancel.own" },
   summary: "Cancel a pending or in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -687,6 +693,7 @@ const pauseTaskRoute = route({
   path: "/api/tasks/{id}/pause",
   pattern: ["api", "tasks", null, "pause"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Pause an in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -703,6 +710,7 @@ const resumeTaskRoute = route({
   path: "/api/tasks/{id}/resume",
   pattern: ["api", "tasks", null, "resume"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Resume a paused task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -777,9 +785,7 @@ const updateTaskTitleRoute = route({
     404: { description: "Task not found" },
   },
   auth: { apiKey: true },
-  rbac: {
-    ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only",
-  },
+  rbac: { permission: "task.action.own" },
 });
 
 async function canSteerTask(
@@ -879,6 +885,40 @@ async function resolveTaskWritePrincipal(
   return { kind: "agent", agentId, isLead: agent?.isLead === true };
 }
 
+/**
+ * May this caller bind a new task to a chat thread? The operator may. An agent needs the
+ * lead's chat post permission. A user needs admin, or a role with `integration.chat.post`.
+ */
+async function mayBindChatThread(principal: RbacPrincipal): Promise<boolean> {
+  if (principal.kind === "operator") return true;
+  if (principal.kind === "user") {
+    if (!isRbacEnabled()) return true;
+    const grant = await getUserGrant(principal.userId);
+    return grant.grantsAll || grant.verbs.has("integration.chat.post");
+  }
+  return can({
+    principal,
+    verb: "integration.chat.post",
+    resource: { kind: "none" },
+    source: "http",
+  }).allow;
+}
+
+/**
+ * Sibling awareness copies the open tasks under a contextKey into the new task, and may pick
+ * one as its parent. A non-admin user may name a context only when they may write each of
+ * its open tasks.
+ */
+async function deniesForeignContext(req: IncomingMessage, contextKey: string): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled()) return false;
+  if ((await getUserGrant(auth.userId)).grantsAll) return false;
+  for (const task of await getInProgressTasksByContextKey(contextKey)) {
+    if (await deniesNonOwnerTaskWrite(req, task)) return true;
+  }
+  return false;
+}
+
 /**
  * Requester for a new task. Prefer trusted server-side identity: an
  * authenticated request user, or the caller's own ownership-gated task context
@@ -1070,17 +1110,27 @@ export async function handleTasks(
       return true;
     }
     // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator
-    // may then read and post to. An agent may only name a thread other than the parent's
-    // with the lead's chat post permission.
+    // may then read and post to. Only a caller with chat post permission may name a thread
+    // other than the parent's.
     if (
-      principal.kind === "agent" &&
       parsed.body.contextKey &&
       parsed.body.contextKey !== parentTask?.contextKey &&
       chatThreadOfContextKey(parsed.body.contextKey) &&
-      !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" })
-        .allow
+      !(await mayBindChatThread(principal))
     ) {
-      jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
+      jsonError(
+        res,
+        "Permission denied: only a lead or an admin can bind a task to a chat thread.",
+        403,
+      );
+      return true;
+    }
+    if (
+      parsed.body.contextKey &&
+      parsed.body.contextKey !== parentTask?.contextKey &&
+      (await deniesForeignContext(req, parsed.body.contextKey))
+    ) {
+      jsonError(res, "You don't have access to the tasks in this context.", 403);
       return true;
     }
     let assetKey: string | undefined;
@@ -1240,7 +1290,12 @@ export async function handleTasks(
       return true;
     }
 
-    // Humans may cancel any task. Agents get the MCP cancel-task policy:
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
+    // Admins may cancel any task. Agents get the MCP cancel-task policy:
     // lead or task creator.
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
     if (
@@ -1882,6 +1937,11 @@ export async function handleTasks(
       return true;
     }
 
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;
@@ -1945,6 +2005,15 @@ export async function handleTasks(
   if (updateTaskTitleRoute.match(req.method, pathSegments)) {
     const parsed = await updateTaskTitleRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
+    const existing = await getTaskById(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Task not found", 404);
+      return true;
+    }
+    if (await deniesNonOwnerTaskWrite(req, existing)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
     const task = await updateTaskTitle(parsed.params.id, parsed.body.title);
     if (!task) {
       jsonError(res, "Task not found", 404);
@@ -1964,6 +2033,11 @@ export async function handleTasks(
       return true;
     }
 
+    if (await deniesNonOwnerTaskWrite(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED, 403);
+      return true;
+    }
+
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;

package/src/http/telemetry-ui.ts

@@ -32,7 +32,7 @@ const uiEvent = route({
     401: { description: "Unauthorized" },
     403: { description: "Guest page sessions cannot send events" },
   },
-  rbac: { ungated: "any authenticated dashboard user; event name allowlisted" },
+  rbac: { permission: "favorite.write.own" },
 });
 
 const enableTelemetry = route({

package/src/http/user-roles.ts

@@ -80,7 +80,10 @@ async function composeRoles(userId: string) {
 }
 
 /** Operator or user only; agents never change human roles, even with the shared key. */
-async function ensureRoleManager(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+export async function ensureRoleManager(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<boolean> {
   if (rejectGuest(req, res)) return false;
   const auth = getRequestAuth(req);
   if (auth?.kind !== "operator" && auth?.kind !== "user") {