@desplega.ai/agent-swarm 2.7.0 → 2.7.1

package/src/tests/store-progress-learning.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, type Mock, spyOn, test } from "bun:test";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { ZodType } from "zod";
 import {
@@ -10,6 +10,8 @@ import {
   initDb,
   startTask,
 } from "../be/db";
+import { getEmbeddingProvider, getMemoryStore } from "../be/memory";
+import { EMBEDDING_DIMENSIONS } from "../be/memory/constants";
 import { registerStoreProgressTool } from "../tools/store-progress";
 
 interface ToolResult {
@@ -73,7 +75,7 @@ function learningRows(taskId: string): MemoryRow[] {
 
 function learningData(result: ToolResult) {
   return result.structuredContent?.learning as
-    | { status: string; key?: string; error?: string }
+    | { status: string; key?: string; memoryId?: string; similarity?: number; error?: string }
     | undefined;
 }
 
@@ -286,3 +288,94 @@ describe("store-progress learning", () => {
     expect(learningRows(t.id)).toHaveLength(0);
   });
 });
+
+describe("store-progress learning near-duplicate guard", () => {
+  const vectors = new Map<string, Float32Array>();
+  let embedSpy: Mock<(text: string) => Promise<Float32Array | null>>;
+
+  /** Unit vector on `axis`, tilted toward `axis + 1` so its cosine to the bare axis is `cos`. */
+  function vector(axis: number, cos = 1): Float32Array {
+    const v = new Float32Array(EMBEDDING_DIMENSIONS);
+    v[axis] = cos;
+    v[axis + 1] = Math.sqrt(1 - cos ** 2);
+    return v;
+  }
+
+  /** Store a learning and give it its embedding now, not in the background. */
+  async function seed(text: string, embedding: Float32Array, workstream = "seeded") {
+    vectors.set(text, embedding);
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: { text, workstream } });
+    const memoryId = learningData(result)!.memoryId!;
+    await getMemoryStore().updateEmbedding(memoryId, embedding, "test-embedding");
+    return { task: t, memoryId, key: learningData(result)!.key! };
+  }
+
+  beforeAll(() => {
+    embedSpy = spyOn(getEmbeddingProvider(), "embed").mockImplementation(
+      async (text: string) => vectors.get(text) ?? null,
+    );
+  });
+  afterAll(() => embedSpy.mockRestore());
+
+  test("a near duplicate in another workstream is not stored and rates the existing row", async () => {
+    const existing = await seed("Upsert scripts from file bytes\nPOST the raw file.", vector(10));
+    const text = "Byte-exact script upsert from a local file\nPOST it to the API.";
+    vectors.set(text, vector(10, 0.9));
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: { text, workstream: "other" } });
+
+    expect(learningData(result)).toMatchObject({
+      status: "duplicate",
+      memoryId: existing.memoryId,
+      key: existing.key,
+    });
+    expect(learningData(result)?.similarity).toBeCloseTo(0.9, 2);
+    expect(message(result)).toContain(`Learning not stored: it matches ${existing.key}`);
+    expect(String(result.structuredContent?.nudge)).toContain(`memory-edit that memory instead`);
+    expect(String(result.structuredContent?.nudge)).toContain(existing.memoryId);
+    expect(learningRows(t.id)).toHaveLength(0);
+    const ratings = getDb()
+      .query<{ source: string; signal: number; taskId: string }, [string]>(
+        "SELECT source, signal, taskId FROM memory_rating WHERE memoryId = ?",
+      )
+      .all(existing.memoryId);
+    expect(ratings).toEqual([{ source: "learning-duplicate", signal: 1, taskId: t.id }]);
+  });
+
+  test("a related learning below the threshold is stored", async () => {
+    await seed("Retry flaky pushes once\nThe pre-push hook is slow.", vector(20));
+    const text = "Pre-push hooks take five minutes\nLet them finish.";
+    vectors.set(text, vector(20, 0.7));
+    const t = await task();
+    const result = await call({ taskId: t.id, learning: text });
+
+    expect(learningData(result)?.status).toBe("stored");
+    expect(learningRows(t.id)).toHaveLength(1);
+  });
+
+  test("a failed search falls through to the normal insert", async () => {
+    await seed("Kebab keys only\nSlugs are lowercase.", vector(30));
+    const text = "Keys are kebab case\nSlugs stay lowercase.";
+    vectors.set(text, vector(30, 0.95));
+    const searchSpy = spyOn(getMemoryStore(), "search").mockRejectedValue(new Error("vec down"));
+    try {
+      const t = await task();
+      const result = await call({ taskId: t.id, progress: "kept", learning: text });
+      expect(learningData(result)?.status).toBe("stored");
+      expect(learningRows(t.id)).toHaveLength(1);
+      expect((await getTaskById(t.id))?.progress).toBe("kept");
+    } finally {
+      searchSpy.mockRestore();
+    }
+  });
+
+  test("an exact replay on the same task is replayed, not a duplicate", async () => {
+    const text = "Replay before similarity\nThe same task retrying is not a duplicate.";
+    const seeded = await seed(text, vector(40));
+    const replay = await call({ taskId: seeded.task.id, learning: { text, workstream: "seeded" } });
+
+    expect(learningData(replay)).toMatchObject({ status: "replayed", memoryId: seeded.memoryId });
+    expect(learningRows(seeded.task.id)).toHaveLength(1);
+  });
+});

package/src/tests/whoami-route.test.ts

@@ -17,6 +17,7 @@ import {
   type ServerResponse,
 } from "node:http";
 import { closeDb, createUser, initDb, updateUser } from "../be/db";
+import { ensureRbacSeedsSynced, setUserRoles } from "../be/rbac-roles";
 import { type IdentityActor, mintToken, revokeToken } from "../be/users";
 import { handleCore } from "../http/core";
 import { handleUsers } from "../http/users";
@@ -30,6 +31,7 @@ const ACTOR: IdentityActor = { kind: "operator", id: "op:test" };
 interface WhoamiBody {
   kind: "operator" | "user";
   user: { id: string; name: string; status: string } | null;
+  grants?: { grantsAll: boolean; verbs: string[]; roles: string[] };
 }
 
 function createTestServer(): Server {
@@ -61,6 +63,7 @@ describe("GET /api/whoami", () => {
   beforeAll(async () => {
     cleanupDb();
     initDb(TEST_DB_PATH);
+    ensureRbacSeedsSynced({ quiet: true });
     server = createTestServer();
     port = await listenOnFreePort(server);
   });
@@ -82,6 +85,7 @@ describe("GET /api/whoami", () => {
     const body = (await res.json()) as WhoamiBody;
     expect(body.kind).toBe("operator");
     expect(body.user).toBeNull();
+    expect(body.grants?.grantsAll).toBe(true);
   });
 
   test("active user token resolves to its bound user", async () => {
@@ -96,6 +100,43 @@ describe("GET /api/whoami", () => {
     expect(body.user?.name).toBe("Whoami User");
   });
 
+  test("requester token reports its role and verbs, without grantsAll", async () => {
+    const user = await createUser({ name: "Requester User", email: "req@example.com" });
+    await setUserRoles(user.id, ["requester"], null);
+    const { plaintext } = await mintToken(user.id, "rest", ACTOR);
+
+    const body = (await (await whoami(plaintext)).json()) as WhoamiBody;
+    expect(body.grants?.grantsAll).toBe(false);
+    expect(body.grants?.roles).toEqual(["requester"]);
+    expect(body.grants?.verbs).toContain("task.create.own");
+    expect(body.grants?.verbs).not.toContain("config.write.any");
+  });
+
+  test("a new user holds admin by default: grantsAll", async () => {
+    const user = await createUser({ name: "Default Admin" });
+    const { plaintext } = await mintToken(user.id, "rest", ACTOR);
+
+    const body = (await (await whoami(plaintext)).json()) as WhoamiBody;
+    expect(body.grants?.grantsAll).toBe(true);
+    expect(body.grants?.roles).toEqual(["admin"]);
+  });
+
+  test("RBAC_ENABLED=false reports grantsAll for a viewer", async () => {
+    const user = await createUser({ name: "Viewer User" });
+    await setUserRoles(user.id, ["viewer"], null);
+    const { plaintext } = await mintToken(user.id, "rest", ACTOR);
+    const previous = process.env.RBAC_ENABLED;
+    process.env.RBAC_ENABLED = "false";
+    try {
+      const body = (await (await whoami(plaintext)).json()) as WhoamiBody;
+      expect(body.grants?.grantsAll).toBe(true);
+      expect(body.grants?.roles).toEqual(["viewer"]);
+    } finally {
+      if (previous === undefined) delete process.env.RBAC_ENABLED;
+      else process.env.RBAC_ENABLED = previous;
+    }
+  });
+
   test("revoked token is rejected at auth (401)", async () => {
     const user = await createUser({ name: "Revoked User" });
     const { plaintext, tokenId } = await mintToken(user.id, "rest", ACTOR);

package/src/tools/inject-learning.ts

@@ -73,7 +73,7 @@ export const registerInjectLearningTool = (server: McpServer) => {
       // Generate and store embedding (async, best-effort)
       try {
         const provider = getEmbeddingProvider();
-        const embedding = await provider.embed(memory.content);
+        const embedding = await provider.embed(memory.content, { kind: "document" });
         if (embedding) {
           await store.updateEmbedding(memory.id, embedding, provider.name);
         }

package/src/tools/memory-edit.ts

@@ -183,7 +183,7 @@ export const registerMemoryEditTool = (server: McpServer) => {
           content !== undefined || oldString !== undefined || newString !== undefined;
         if (result.changed && (newKey === undefined || contentEdited)) {
           const provider = getEmbeddingProvider();
-          const embedding = await provider.embed(result.memory.content);
+          const embedding = await provider.embed(result.memory.content, { kind: "document" });
           if (embedding) await store.updateEmbedding(result.memory.id, embedding, provider.name);
           try {
             // Edit path: prune links derived from removed content (sequel links survive).

package/src/tools/memory-search.ts

@@ -120,7 +120,7 @@ export const registerMemorySearchTool = (server: McpServer) => {
       // Try vector search first
       const provider = getEmbeddingProvider();
       const store = getMemoryStore();
-      const queryEmbedding = await provider.embed(query);
+      const queryEmbedding = await provider.embed(query, { kind: "query" });
 
       const candidateLimit = limit * CANDIDATE_SET_MULTIPLIER;
       const candidates = await searchMemoryCandidates(

package/src/tools/store-progress.ts

@@ -125,17 +125,21 @@ export const storeProgressOutputSchema = swarmToolOutputSchema({
       key: z.string().optional(),
       memoryId: z.string().optional(),
       workstream: z.string().optional(),
+      similarity: z.number().optional(),
       error: z.string().optional(),
     })
     .optional()
     .describe(
-      "Present when the call carried a learning: stored, replayed (same text already stored for this task), or failed with error.",
+      "Present when the call carried a learning: stored, replayed (same text already stored for this task), duplicate (an existing swarm memory at key/memoryId says the same; similarity is the raw cosine), or failed with error.",
     ),
 });
 
 function learningSentence(result: TaskLearningResult): string {
   if (result.status === "stored") return `Learning stored at ${result.key}.`;
   if (result.status === "replayed") return `Learning already stored at ${result.key}; skipped.`;
+  if (result.status === "duplicate") {
+    return `Learning not stored: it matches ${result.key} (similarity ${result.similarity}).`;
+  }
   return `Learning not stored: ${result.error}.`;
 }
 

package/src/tools/utils.ts

@@ -297,6 +297,17 @@ const storeProgressBlockedWaitingNudge = (r: SwarmToolResult): string | undefine
   return `That reads as blocked-waiting, ${formatIdleDuration(ms)} since your last update — keep working if you can, and if the wait is genuinely long, defer-task is one way to resume later instead of polling.`;
 };
 
+const storeProgressNudge = (r: SwarmToolResult): string | undefined => {
+  const learning = (r.data as { learning?: { status?: unknown; memoryId?: unknown } } | undefined)
+    ?.learning;
+  // nudgeMiddleware permits exactly one steer: the duplicate-learning steer
+  // names a concrete next call, so it wins over the blocked-waiting reminder.
+  if (r.ok && learning?.status === "duplicate" && typeof learning.memoryId === "string") {
+    return `That learning repeats memory ${learning.memoryId}; if your text adds something, memory-edit that memory instead of storing a new one.`;
+  }
+  return storeProgressBlockedWaitingNudge(r);
+};
+
 const workflowLongScriptTimeoutNudge = (r: SwarmToolResult): string | undefined => {
   if (!r.ok) return undefined;
   const hint = (r.data as { longScriptTimeoutHint?: unknown } | undefined)?.longScriptTimeoutHint;
@@ -311,7 +322,7 @@ const workflowLongScriptTimeoutNudge = (r: SwarmToolResult): string | undefined
 export const NUDGES: Record<string, (result: SwarmToolResult) => string | undefined> = {
   "defer-task": (r) =>
     r.ok ? "Stop working on this task now; the wake-up task will carry your note." : undefined,
-  "store-progress": storeProgressBlockedWaitingNudge,
+  "store-progress": storeProgressNudge,
   "script-run": scriptRunNudge,
   "script-upsert": scriptAuthoringNudge,
   "launch-script-run": scriptAuthoringNudge,

package/src/utils/constants.ts

@@ -89,6 +89,36 @@ export function getAgentFsLiveUrl(): string {
   return (raw || DEFAULT_AGENT_FS_LIVE_URL).replace(/\/+$/, "");
 }
 
+/** Where people-facing agent-fs file links point: Comb in the dashboard, or the live app. */
+export type AgentFsLinkTarget = "dashboard" | "live";
+
+/**
+ * The operator's `AGENT_FS_LINK_TARGET` choice (trimmed, lowercased). Null when
+ * unset, blank, or invalid: every surface then keeps its automatic behavior.
+ */
+export function readAgentFsLinkTarget(): AgentFsLinkTarget | null {
+  const raw = process.env.AGENT_FS_LINK_TARGET?.trim().toLowerCase();
+  return raw === "dashboard" || raw === "live" ? raw : null;
+}
+
+/**
+ * The base URL (no trailing slash) that a people-facing file link starts with,
+ * per {@link readAgentFsLinkTarget}. `dashboard` uses `APP_URL` when one is
+ * configured (and, for attachments, Comb is on), else the live app. Null when
+ * no target is set: the caller keeps its current code path.
+ *
+ * The prompt surface skips the Comb check: workers do not get `COMB_ENABLED`,
+ * and an explicit `dashboard` is the operator's choice.
+ */
+export function resolveAgentFsLinkBase(surface: "prompt" | "attachment"): string | null {
+  const target = readAgentFsLinkTarget();
+  if (target === null) return null;
+  if (target === "dashboard" && getConfiguredAppUrls().length > 0) {
+    if (surface === "prompt" || isCombEnabled()) return getAppUrl();
+  }
+  return getAgentFsLiveUrl();
+}
+
 /**
  * Optional fallback agent-fs `org_id` for attachments that store only `path`.
  * Strictly opt-in — when neither env var is set, the renderer keeps the
@@ -166,6 +196,15 @@ export function isCombEnabled(): boolean {
   return isEnvFlagEnabled("COMB_ENABLED", false) && Boolean(apiUrl);
 }
 
+/**
+ * `AGENT_FS_PROXY`: the API serves agent-fs at `/agentfs/*` (plus the public
+ * `/share/*` and `/site/*` pages), and Comb uses `<public API URL>/agentfs`.
+ * Read per request, so a config upsert applies without a restart. Off by default.
+ */
+export function isAgentFsProxyEnabled(): boolean {
+  return isEnvFlagEnabled("AGENT_FS_PROXY", false);
+}
+
 /**
  * The dashboard (Comb) URL for an agent-fs file, same id and encoding rules as
  * {@link buildAgentFsLiveUrl}. Null unless Comb is on AND an explicit

package/src/utils/task-attachment-links.ts

@@ -1,5 +1,11 @@
 import type { TaskAttachment } from "../types";
-import { buildAgentFsLiveUrl, buildCombFileUrl, getAppUrl } from "./constants";
+import {
+  agentFsFileRoute,
+  buildAgentFsLiveUrl,
+  buildCombFileUrl,
+  getAppUrl,
+  resolveAgentFsLinkBase,
+} from "./constants";
 
 function shellQuote(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -26,8 +32,9 @@ export function taskAttachmentFetchCommand(
 /**
  * The link a human (Slack, prompts, citations) sees for an attachment. An
  * agent-fs file links to the dashboard (Comb) when Comb is on and `APP_URL` is
- * set, else to the agent-fs live UI, else to the raw `agent-fs:<path>`.
- * `comb: false` skips the dashboard link.
+ * set, else to the agent-fs live UI, else to the raw `agent-fs:<path>`. An
+ * explicit `AGENT_FS_LINK_TARGET` picks the base instead (see
+ * `resolveAgentFsLinkBase`). `comb: false` always links to the live UI.
  */
 export function taskAttachmentDisplayUrl(
   attachment: TaskAttachment,
@@ -40,6 +47,11 @@ export function taskAttachmentDisplayUrl(
 
   if (attachment.providerId === "agent-fs" || attachment.kind === "agent-fs") {
     const file = { path: attachment.path, orgId: attachment.orgId, driveId: attachment.driveId };
+    const linkBase = opts.comb === false ? null : resolveAgentFsLinkBase("attachment");
+    if (linkBase !== null) {
+      const route = agentFsFileRoute(file);
+      return route ? `${linkBase}/file/~/${route}` : `agent-fs:${attachment.path ?? ""}`;
+    }
     const combUrl = opts.comb === false ? null : buildCombFileUrl(file);
     return combUrl ?? buildAgentFsLiveUrl(file) ?? `agent-fs:${attachment.path ?? ""}`;
   }

package/templates/skills/swarm-docs/content.md

@@ -118,7 +118,7 @@ Fetch the page as markdown: `curl -fsSL https://docs.agent-swarm.dev/llms.mdx/do
 - [Overview](https://docs.agent-swarm.dev/docs/ui)
 - [Sessions](https://docs.agent-swarm.dev/docs/ui/sessions)
 - [Configuration](https://docs.agent-swarm.dev/docs/ui/configuration)
-- [Comb (beta)](https://docs.agent-swarm.dev/docs/ui/comb)
+- [Comb](https://docs.agent-swarm.dev/docs/ui/comb)
 - [Integrations](https://docs.agent-swarm.dev/docs/integrations)
 - [Slack Integration](https://docs.agent-swarm.dev/docs/integrations/slack)
 - [GitHub App Integration](https://docs.agent-swarm.dev/docs/integrations/github)

package/dist/handlers-tzmevqb5.js

@@ -1,41 +0,0 @@
-import {
-  isUserAllowed2,
-  registerMessageHandler2
-} from "./cli-f4dbh7a5.js";
-import"./cli-sgqm2582.js";
-import"./cli-2pvzmas1.js";
-import"./cli-6a9qfa8b.js";
-import"./cli-737pyqxr.js";
-import"./cli-8mbc9za9.js";
-import"./cli-qz93y3x5.js";
-import"./cli-3h26v7yj.js";
-import"./cli-60sty27p.js";
-import"./cli-j9bpmykh.js";
-import"./cli-3ggwdtb0.js";
-import"./cli-aypd09nf.js";
-import"./cli-rd5m70gj.js";
-import"./cli-d20qvpr2.js";
-import"./cli-g9ypd5en.js";
-import"./cli-twctnkng.js";
-import"./cli-j0ppywdr.js";
-import"./cli-1m9x8dr5.js";
-import"./cli-0z1xjzwa.js";
-import"./cli-e8xyjvfc.js";
-import"./cli-wqr7cea4.js";
-import"./cli-13p25grh.js";
-import"./cli-0adyhvq2.js";
-import"./cli-m30k9777.js";
-import"./cli-s09j9vp5.js";
-import"./cli-6srv653c.js";
-import"./cli-a89zdqz9.js";
-import"./cli-rycdaj0a.js";
-import"./cli-445c1vp7.js";
-import"./cli-kvzgak7c.js";
-import"./cli-2nf3b08t.js";
-import"./cli-8wmj18cz.js";
-import"./cli-48gxjmcz.js";
-import"./cli-kt907da6.js";
-export {
-  isUserAllowed2 as isUserAllowed,
-  registerMessageHandler2 as registerMessageHandler
-};

package/dist/{openai-codex-responses-79s8xnbh.js → openai-codex-responses-jhr3sjtm.js}

@@ -9,6 +9,9 @@ import {
 } from "./cli-2nf3b08t.js";
 import"./cli-445c1vp7.js";
 import"./cli-kvzgak7c.js";
+import {
+  combineAbortSignals
+} from "./cli-aphet7e8.js";
 import {
   getResponsesToolSupport,
   convertResponsesMessages,
@@ -18,9 +21,6 @@ import {
 import {
   clampOpenAIPromptCacheKey
 } from "./cli-dxqypk0n.js";
-import {
-  combineAbortSignals
-} from "./cli-aphet7e8.js";
 import {
   registerSessionResourceCleanup,
   uuidv7

package/dist/{openai-completions-tdbyts0x.js → openai-completions-gs6yn37k.js}

@@ -24,12 +24,12 @@ import {
 import {
   clampOpenAIPromptCacheKey
 } from "./cli-dxqypk0n.js";
-import {
-  retryProviderRequest
-} from "./cli-w6pm0v4s.js";
 import {
   shortHash
 } from "./cli-j3xf15kq.js";
+import {
+  retryProviderRequest
+} from "./cli-w6pm0v4s.js";
 import {
   normalizeProviderError,
   formatProviderError