@desplega.ai/agent-swarm 2.7.2 → 2.7.3

package/src/utils/constants.ts

@@ -2,7 +2,7 @@
  * Shared constants used across worker- and server-side code.
  */
 
-import { isEnvFlagEnabled } from "./env-flag";
+import { isEnvFlagEnabled, parseEnvFlag } from "./env-flag";
 
 /** Maximum profile-file length in JavaScript characters (not UTF-8 bytes). */
 export const MAX_PROFILE_FILE_LENGTH = 256 * 1024;
@@ -187,13 +187,135 @@ export function buildAgentFsLiveUrl(opts: AgentFsFileRef): string | null {
   return route ? `${getAgentFsLiveUrl()}/file/~/${route}` : null;
 }
 
+/** RFC 1918 private and 169.254/16 link-local IPv4 space, by its first two octets. */
+function isPrivateIpv4(a: number, b: number): boolean {
+  return (
+    a === 10 ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 168) ||
+    (a === 169 && b === 254)
+  );
+}
+
 /**
- * Comb (the agent-fs review space in the dashboard) is on: `COMB_ENABLED` plus
- * an agent-fs API URL. `getCombConfig()` (`src/comb/config.ts`) reports it.
+ * The eight 16-bit groups of an IPv6 literal (no brackets), or null when it is
+ * malformed. `new URL` already normalizes a host to compressed hex, so a
+ * dotted IPv4 tail never reaches here; one is rejected rather than parsed.
  */
-export function isCombEnabled(): boolean {
+function parseIpv6(addr: string): number[] | null {
+  if (addr.includes(".")) return null;
+  const halves = addr.split("::");
+  if (halves.length > 2) return null;
+  const toGroups = (part: string): number[] | null => {
+    if (!part) return [];
+    const groups = part
+      .split(":")
+      .map((g) => (/^[0-9a-f]{1,4}$/.test(g) ? Number.parseInt(g, 16) : Number.NaN));
+    return groups.some(Number.isNaN) ? null : groups;
+  };
+  const head = toGroups(halves[0] ?? "");
+  const tail = toGroups(halves[1] ?? "");
+  if (!head || !tail) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const missing = 8 - head.length - tail.length;
+  return missing < 1 ? null : [...head, ...new Array<number>(missing).fill(0), ...tail];
+}
+
+/**
+ * Whether a browser can plausibly open this URL. False for the addresses only
+ * the swarm's own network resolves: a single-label host (a docker or compose
+ * service such as `agent-fs`), `*.internal` (Railway, Fly, GCP),
+ * `*.svc` / `*.cluster.local` (Kubernetes), and private, link-local or
+ * unique-local IPs, including IPv4-mapped IPv6 (`::ffff:10.0.0.5`), `::` and
+ * multicast `ff00::/8`. Loopback counts as reachable: a localhost URL means the
+ * API and agent-fs share a host, which only works for a browser on that same
+ * machine (the local dev setup), and a remote operator can set `COMB_ENABLED`.
+ * An unparseable value is not reachable.
+ */
+export function isBrowserReachableUrl(value: string): boolean {
+  let host: string;
+  try {
+    host = new URL(value).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.startsWith("[")) {
+    const parsed = parseIpv6(host.slice(1, -1));
+    if (!parsed) return false;
+    const g = (i: number) => parsed[i] ?? 0;
+    // Loopback is reachable (the local dev setup).
+    if (parsed.slice(0, 7).every((x) => x === 0) && g(7) === 1) return true;
+    // `::` and multicast `ff00::/8` are not addresses a browser can open.
+    if (parsed.every((x) => x === 0) || (g(0) & 0xff00) === 0xff00) return false;
+    // Unique-local `fc00::/7` and link-local `fe80::/10`.
+    if ((g(0) & 0xfe00) === 0xfc00 || (g(0) & 0xffc0) === 0xfe80) return false;
+    // IPv4-mapped `::ffff:a.b.c.d`: judge the embedded IPv4 address.
+    if (parsed.slice(0, 5).every((x) => x === 0) && g(5) === 0xffff) {
+      const a = g(6) >> 8;
+      return a === 127 || !isPrivateIpv4(a, g(6) & 0xff);
+    }
+    return true;
+  }
+  const octets = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (octets) {
+    const [a, b] = [Number(octets[1]), Number(octets[2])];
+    return a === 127 || !isPrivateIpv4(a, b);
+  }
+  if (!host.includes(".")) return false;
+  return !(host.endsWith(".internal") || host.endsWith(".svc") || host.endsWith(".cluster.local"));
+}
+
+export interface CombState {
+  enabled: boolean;
+  /** An explicit `COMB_ENABLED` decided it; otherwise the unset default did. */
+  explicit: boolean;
+  /** What is missing, for `/status` `agent_fs.comb.reason`. Null when Comb is on. */
+  reason: string | null;
+}
+
+/**
+ * Comb (the agent-fs review space in the dashboard). An explicit
+ * `COMB_ENABLED` wins both ways, but still needs `AGENT_FS_API_URL`. Unset, it
+ * is on only when a browser can reach agent-fs: `AGENT_FS_PUBLIC_URL` is set,
+ * `AGENT_FS_PROXY` is on and the public API URL is {@link isBrowserReachableUrl}
+ * (the browser goes through the API), or, with no proxy, `AGENT_FS_API_URL` is
+ * itself reachable. Otherwise the browser would land on a private host.
+ * Reads `process.env` per call, so a config reload applies without a restart.
+ */
+export function getCombState(): CombState {
   const apiUrl = process.env.AGENT_FS_API_URL?.trim().replace(/\/+$/, "");
-  return isEnvFlagEnabled("COMB_ENABLED", false) && Boolean(apiUrl);
+  const raw = process.env.COMB_ENABLED;
+  // The two parses agree only when the value is a recognized flag literal.
+  const explicit = parseEnvFlag(raw, true) === parseEnvFlag(raw, false);
+  if (explicit && !isEnvFlagEnabled("COMB_ENABLED", false)) {
+    return { enabled: false, explicit, reason: "COMB_ENABLED is false." };
+  }
+  if (!apiUrl) return { enabled: false, explicit, reason: "AGENT_FS_API_URL is not set." };
+  if (explicit) return { enabled: true, explicit, reason: null };
+  if (process.env.AGENT_FS_PUBLIC_URL?.trim()) return { enabled: true, explicit, reason: null };
+  // With the proxy on, the browser goes to `<public API URL>/agentfs`, so that
+  // is the address to check, not `AGENT_FS_API_URL`.
+  const proxy = isAgentFsProxyEnabled();
+  const browserUrl = proxy ? getPublicMcpBaseUrl() : apiUrl;
+  return isBrowserReachableUrl(browserUrl)
+    ? { enabled: true, explicit, reason: null }
+    : {
+        enabled: false,
+        explicit,
+        reason: proxy
+          ? `AGENT_FS_PROXY is on, but the API address ${browserUrl} is not reachable from a browser. Set PUBLIC_MCP_BASE_URL to the public API URL, or set COMB_ENABLED=true to force Files on.`
+          : `AGENT_FS_API_URL (${apiUrl}) is not reachable from a browser. Set AGENT_FS_PUBLIC_URL or AGENT_FS_PROXY=true, or set COMB_ENABLED=true to force Files on.`,
+      };
+}
+
+/**
+ * Comb is on: see {@link getCombState}. `getCombConfig()` (`src/comb/config.ts`)
+ * reports it.
+ */
+export function isCombEnabled(): boolean {
+  return getCombState().enabled;
 }
 
 /**

package/templates/official/lead/HEARTBEAT.md

@@ -8,8 +8,10 @@
 - Check for failed tasks — especially "worker session not found" failures which indicate interrupted work that may need re-creation
 - Review reboot-retry tasks — verify they are progressing, cancel if work is no longer needed
 
-## Tracked Items
+## Tracked Item Rules
 
 - Live items only: active blockers and watch items. Cap 10, 20 max during a surge; prune before you add.
-- Each item states its lift trigger and a calendar date as a bare `MM-DD` (e.g. `lift when X; check 08-22`) or `DELETE MM-DD`. A full `YYYY-MM-DD` stamp does not arm the gate.
+- Each item states its lift trigger and an expiry as `DELETE MM-DD` (or `DELETE on MM-DD`). A bare date or a full `YYYY-MM-DD` stamp does not arm the gate.
 - An item closes: move its durable facts to memory, then delete the line. Never strike it through.
+
+## Tracked Items

package/templates/official/lead/config.json

@@ -2,12 +2,12 @@
   "name": "lead",
   "displayName": "Lead",
   "description": "Orchestrator agent that coordinates workers, decomposes tasks, and builds institutional knowledge across sessions",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "category": "official",
   "icon": "crown",
   "author": "Agent Swarm <contact@agent-swarm.dev>",
   "createdAt": "2026-03-09",
-  "lastUpdatedAt": "2026-10-17",
+  "lastUpdatedAt": "2026-10-28",
   "agentDefaults": {
     "role": "lead",
     "capabilities": ["coordination", "planning", "communication"],

package/templates/skills/swarm-docs/content.md

@@ -60,6 +60,7 @@ Fetch the page as markdown: `curl -fsSL https://docs.agent-swarm.dev/llms.mdx/do
 ## Guides
 
 - [Deployment Guide](https://docs.agent-swarm.dev/docs/guides/deployment). When: Someone wants to run Agent Swarm on their own server with Docker Compose.
+- [One-click deploy](https://docs.agent-swarm.dev/docs/guides/one-click-deploy). When: Someone has no server yet and wants Agent Swarm running in the cloud with HTTPS.
 - [Kubernetes and Helm](https://docs.agent-swarm.dev/docs/guides/kubernetes). When: Someone wants to install Agent Swarm on Kubernetes.
 - [Rootless Podman](https://docs.agent-swarm.dev/docs/guides/podman-rootless). When: Someone wants to run Agent Swarm under rootless Podman.
 - [Published Artifacts](https://docs.agent-swarm.dev/docs/guides/published-artifacts). Reference.
@@ -88,6 +89,7 @@ Fetch the page as markdown: `curl -fsSL https://docs.agent-swarm.dev/llms.mdx/do
 - [Scripts as external APIs](https://docs.agent-swarm.dev/docs/guides/scripts-external-apis). When: Someone wants a swarm script exposed as a public HTTP endpoint or webhook receiver.
 - [Scripts credential broker](https://docs.agent-swarm.dev/docs/guides/scripts-credential-broker). Reference.
 - [One-off Script Workflow Runs](https://docs.agent-swarm.dev/docs/guides/script-workflow-runs). Reference.
+- [Dreaming](https://docs.agent-swarm.dev/docs/guides/dreaming). When: Someone asks what the nightly dreaming run changed, how to configure or turn it off, or how to undo one of its changes.
 - [Claude Bridge](https://docs.agent-swarm.dev/docs/guides/claude-bridge-experimental). Reference.
 - [Worker Credential Recovery](https://docs.agent-swarm.dev/docs/guides/worker-credential-recovery). Reference.
 - [Model Gateways](https://docs.agent-swarm.dev/docs/guides/provider-auth/model-gateways). Reference.

package/dist/handlers-7x8sywgr.js

@@ -1,42 +0,0 @@
-import {
-  isUserAllowed2,
-  registerMessageHandler2
-} from "./cli-2m2p3snc.js";
-import"./cli-7xsq63pe.js";
-import"./cli-942pp3bc.js";
-import"./cli-qy0z3mfj.js";
-import"./cli-vpq0n13a.js";
-import"./cli-qz93y3x5.js";
-import"./cli-qp6adcmw.js";
-import"./cli-3h26v7yj.js";
-import"./cli-mzgppb7q.js";
-import"./cli-e19bgatr.js";
-import"./cli-p8yrsmfn.js";
-import"./cli-10cp92df.js";
-import"./cli-3ggwdtb0.js";
-import"./cli-t3npd8hm.js";
-import"./cli-g9ypd5en.js";
-import"./cli-s7cm1927.js";
-import"./cli-1xpr5992.js";
-import"./cli-b2rhbaty.js";
-import"./cli-n0ysjjtv.js";
-import"./cli-jbgrwv4y.js";
-import"./cli-e8xyjvfc.js";
-import"./cli-13p25grh.js";
-import"./cli-0adyhvq2.js";
-import"./cli-9jfty8px.js";
-import"./cli-6vq3ymqm.js";
-import"./cli-2qbmjfta.js";
-import"./cli-9jn9cj0q.js";
-import"./cli-rycdaj0a.js";
-import"./cli-2nf3b08t.js";
-import"./cli-445c1vp7.js";
-import"./cli-kvzgak7c.js";
-import"./cli-jmcf8cnz.js";
-import"./cli-eny54typ.js";
-import"./cli-2cj8fqv1.js";
-import"./cli-txr0z97c.js";
-export {
-  isUserAllowed2 as isUserAllowed,
-  registerMessageHandler2 as registerMessageHandler
-};

package/dist/index-mc30r1hs.js

@@ -1,44 +0,0 @@
-import"./cli-ns59dc6r.js";
-import {
-  startHeartbeat2,
-  stopHeartbeat2
-} from "./cli-qa4hgda3.js";
-import"./cli-0awbtmv2.js";
-import"./cli-5d8wd50e.js";
-import"./cli-qy0z3mfj.js";
-import"./cli-vpq0n13a.js";
-import"./cli-qz93y3x5.js";
-import"./cli-qp6adcmw.js";
-import"./cli-3h26v7yj.js";
-import"./cli-mzgppb7q.js";
-import"./cli-e19bgatr.js";
-import"./cli-p8yrsmfn.js";
-import"./cli-10cp92df.js";
-import"./cli-3ggwdtb0.js";
-import"./cli-t3npd8hm.js";
-import"./cli-g9ypd5en.js";
-import"./cli-s7cm1927.js";
-import"./cli-1xpr5992.js";
-import"./cli-b2rhbaty.js";
-import"./cli-n0ysjjtv.js";
-import"./cli-jbgrwv4y.js";
-import"./cli-e8xyjvfc.js";
-import"./cli-13p25grh.js";
-import"./cli-0adyhvq2.js";
-import"./cli-9jfty8px.js";
-import"./cli-6vq3ymqm.js";
-import"./cli-2qbmjfta.js";
-import"./cli-9jn9cj0q.js";
-import"./cli-rycdaj0a.js";
-import"./cli-2nf3b08t.js";
-import"./cli-445c1vp7.js";
-import"./cli-kvzgak7c.js";
-import"./cli-b2mz5mjc.js";
-import"./cli-jmcf8cnz.js";
-import"./cli-eny54typ.js";
-import"./cli-2cj8fqv1.js";
-import"./cli-txr0z97c.js";
-export {
-  startHeartbeat2 as startHeartbeat,
-  stopHeartbeat2 as stopHeartbeat
-};