@desplega.ai/agent-swarm 2.7.4 → 2.7.6

package/src/slack/assistant.ts

@@ -20,6 +20,7 @@ import {
   fetchSlackFiles,
   notifySlackFileFailures,
 } from "./inbound-files";
+import { shouldSkipLeftSlackThread } from "./left-threads";
 import {
   collectSlackMessageFiles,
   type SlackMessageLike,
@@ -194,11 +195,26 @@ export function createAssistant(
           }
         }
 
+        const botMentioned = !!cachedBotUserId && rawText.includes(`<@${cachedBotUserId}>`);
+        // A thread the swarm left (slack-leave-thread) stays silent until someone
+        // @mentions the bot.
+        if (
+          await shouldSkipLeftSlackThread(
+            channelId,
+            msg.thread_ts as string | undefined,
+            botMentioned,
+          )
+        ) {
+          console.log(
+            `[Slack] assistant: skipping message in left thread ${channelId}/${threadTs}`,
+          );
+          return ignoreSlackInbound("thread_left");
+        }
+
         // If the message @-mentions someone OTHER than our bot and does NOT mention
         // our bot, it is addressed to a different agent/user — do not spawn a task
         // (unless SLACK_THREAD_WAKE_ON_ANY_MESSAGE=true).
         if (cachedBotUserId) {
-          const botMentioned = rawText.includes(`<@${cachedBotUserId}>`);
           if (!botMentioned && isAddressedToOtherUser(rawText, cachedBotUserId)) {
             console.log(
               `[Slack] assistant: skipping message in ${channelId}/${threadTs} — mentions another user, not us`,

package/src/slack/commands.ts

@@ -2,6 +2,7 @@ import type { App } from "@slack/bolt";
 import { getAllAgents, getAllTasks } from "../be/db";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import { EXTERNAL_CHANNEL_BLOCKED_REPLY, shouldBlockChannel } from "./external-channel";
+import { isSlackLeaveThreadDisabled } from "./left-threads";
 
 export function registerCommandHandler(app: App): void {
   app.command("/agent-swarm-status", async ({ ack, respond, command, client }) => {
@@ -88,9 +89,12 @@ export function registerCommandHandler(app: App): void {
 • Follow-up tasks auto-depend on the active task in the thread for natural sequencing`);
     }
 
+    const leaveLine = isSlackLeaveThreadDisabled()
+      ? ""
+      : "\n• `!leave` in a thread - Make the swarm ignore that thread until someone @mentions it";
     sections.push(`*Commands:*
 • \`/agent-swarm-status\` - Show all agents and their current status
-• \`/agent-swarm-help\` - Show this help message`);
+• \`/agent-swarm-help\` - Show this help message${leaveLine}`);
 
     const blocks = [
       {

package/src/slack/handlers.ts

@@ -10,6 +10,7 @@ import {
   getTasksByAgentId,
   isExtensionAgent,
 } from "../be/db";
+import { SteeringBlockedError } from "../be/steering";
 import { dispatchPre } from "../extensions/dispatcher";
 import { resolveTemplate } from "../prompts/resolver";
 import { slackContextKey } from "../tasks/context-key";
@@ -51,6 +52,13 @@ import {
   leaveExternalChannel,
   shouldBlockChannel,
 } from "./external-channel";
+import {
+  isSlackLeaveThreadCommand,
+  isSlackLeaveThreadDisabled,
+  leaveSlackThread,
+  SLACK_LEFT_THREAD_CONFIRMATION,
+  shouldSkipLeftSlackThread,
+} from "./left-threads";
 import {
   collectSlackMessageFiles,
   extractSlackMessageText,
@@ -486,6 +494,46 @@ export function registerMessageHandler(app: App): void {
       return ignoreSlackInbound("unauthorized_user");
     }
 
+    // Check if bot was mentioned (in original text only)
+    const botMentioned = !!cachedBotUserId && !!msg.text?.includes(`<@${cachedBotUserId}>`);
+
+    // `!leave` in a thread the swarm is in: a human makes the swarm leave it,
+    // in code, with no workflow event, buffering, task, or model call.
+    // Any task bound to the thread counts, assigned or not, as does a thread
+    // the swarm started. Checked before the left-thread gate so `@bot !leave`
+    // leaves rather than rejoining. The confirmation is ephemeral, to the
+    // sender only.
+    if (
+      msg.thread_ts &&
+      !isSlackLeaveThreadDisabled() &&
+      isSlackLeaveThreadCommand(msg.text, cachedBotUserId) &&
+      ((await getMostRecentTaskInThread(msg.channel, msg.thread_ts)) !== null ||
+        (await wasThreadStartedBySwarm(client, msg.channel, msg.thread_ts)))
+    ) {
+      noteSlackInboundSideEffect("thread_leave");
+      await leaveSlackThread(msg.channel, msg.thread_ts, { slackUserId: msg.user });
+      console.log(`[Slack] Left thread ${msg.channel}/${msg.thread_ts}: !leave from ${msg.user}`);
+      try {
+        await client.chat.postEphemeral({
+          channel: msg.channel,
+          user: msg.user,
+          thread_ts: msg.thread_ts,
+          text: SLACK_LEFT_THREAD_CONFIRMATION,
+        });
+      } catch (error) {
+        console.error("[Slack] Failed to confirm !leave:", error);
+      }
+      return;
+    }
+
+    // A thread the swarm left (slack-leave-thread or `!leave`) stays silent until someone
+    // @mentions the bot. Checked before the workflow event, buffering, routing,
+    // or any AI call.
+    if (await shouldSkipLeftSlackThread(msg.channel, msg.thread_ts, botMentioned)) {
+      console.log(`[Slack] Skipping message in left thread ${msg.channel}/${msg.thread_ts}`);
+      return ignoreSlackInbound("thread_left");
+    }
+
     // Resolve canonical user identity via the three-step cascade:
     //   fast-path alias lookup → enrich+auto-link by email → unmapped tracker.
     // Returns undefined when no email is recoverable; task creation proceeds
@@ -519,9 +567,6 @@ export function registerMessageHandler(app: App): void {
     }
     const botUserId = cachedBotUserId;
 
-    // Check if bot was mentioned (in original text only)
-    const botMentioned = !!msg.text?.includes(`<@${botUserId}>`);
-
     // Detect assistant thread context. Bolt's Assistant middleware claims DM thread
     // messages with no subtype or `file_share` (`isAssistantMessage` in @slack/bolt), so
     // those — file uploads included — are handled in assistant.ts. An assistant-thread
@@ -862,6 +907,7 @@ export function registerMessageHandler(app: App): void {
                   message: taskDescription,
                   messageTimestamps: [msg.ts],
                   requestedByUserId,
+                  slackUserId: msg.user,
                 })
               : null;
           if (steering) {
@@ -937,12 +983,14 @@ export function registerMessageHandler(app: App): void {
       } catch (error) {
         // A policy block is an answered outcome; anything else is a failure the
         // user sees as "could not assign" and the dispatcher must not call success.
-        if (!(error instanceof TaskCreationBlockedError)) {
+        const blocked =
+          error instanceof TaskCreationBlockedError || error instanceof SteeringBlockedError;
+        if (!blocked) {
           reportSlackInboundFailure("task_creation_error");
         }
         results.failed.push({
           agentName: agent.name,
-          reason: error instanceof TaskCreationBlockedError ? error.reason : "error",
+          reason: blocked ? error.reason : "error",
         });
       }
     }

package/src/slack/left-threads.ts

@@ -0,0 +1,88 @@
+import { deleteKv, getKv, upsertKv } from "../be/db";
+import { isEnvFlagEnabled } from "../utils/env-flag";
+
+/**
+ * Slack threads the swarm left, via the `slack-leave-thread` tool or a
+ * human's `!leave` in the thread.
+ *
+ * A left thread drops every inbound message that does not @mention the bot,
+ * in code, before buffering, routing, or any AI call. A mention clears the
+ * state and the message is handled as usual. Stored in kv_entries so a
+ * restart keeps it.
+ */
+export const SLACK_LEFT_THREAD_KV_NAMESPACE = "slack-left-thread";
+
+/** Operator flag that turns leaving threads off: the tool and `!leave`. */
+export const SLACK_LEAVE_THREAD_DISABLE = "SLACK_LEAVE_THREAD_DISABLE";
+
+/**
+ * Read at call time, not cached: a global swarm_config row is hydrated into
+ * process.env on every config reload, so a flip applies without a restart.
+ */
+export function isSlackLeaveThreadDisabled(): boolean {
+  return isEnvFlagEnabled(SLACK_LEAVE_THREAD_DISABLE, false);
+}
+
+/** Ephemeral reply to the human who sent `!leave`. */
+export const SLACK_LEFT_THREAD_CONFIRMATION =
+  "Left this thread. @mention the swarm to bring it back.";
+
+/**
+ * True when a thread message is the `!leave` command: exactly `!leave`,
+ * optionally after @mentions of the bot. A message that mentions anyone else
+ * is not addressed to the swarm and does not match.
+ */
+export function isSlackLeaveThreadCommand(
+  text: string | undefined,
+  botUserId: string | null,
+): boolean {
+  const withoutBotMentions = botUserId
+    ? (text ?? "").replaceAll(`<@${botUserId}>`, "")
+    : (text ?? "");
+  return withoutBotMentions.trim() === "!leave";
+}
+
+function threadKey(channelId: string, threadTs: string): string {
+  return `${channelId}:${threadTs}`;
+}
+
+/** Who left the thread: an agent via the tool, or a Slack user via `!leave`. */
+export type SlackThreadLeftBy = { agentId: string } | { slackUserId: string };
+
+export async function leaveSlackThread(
+  channelId: string,
+  threadTs: string,
+  leftBy: SlackThreadLeftBy,
+): Promise<void> {
+  await upsertKv({
+    namespace: SLACK_LEFT_THREAD_KV_NAMESPACE,
+    key: threadKey(channelId, threadTs),
+    value: { ...leftBy, leftAt: new Date().toISOString() },
+    valueType: "json",
+  });
+}
+
+export async function isSlackThreadLeft(channelId: string, threadTs: string): Promise<boolean> {
+  return (await getKv(SLACK_LEFT_THREAD_KV_NAMESPACE, threadKey(channelId, threadTs))) !== null;
+}
+
+/**
+ * Inbound gate for left threads. Returns true when the message must be dropped:
+ * the thread is left and the message does not @mention the bot. A mention
+ * clears the left state and returns false.
+ */
+export async function shouldSkipLeftSlackThread(
+  channelId: string,
+  threadTs: string | undefined,
+  botMentioned: boolean,
+): Promise<boolean> {
+  if (!threadTs) return false;
+  const key = threadKey(channelId, threadTs);
+  if (botMentioned) {
+    if (await deleteKv(SLACK_LEFT_THREAD_KV_NAMESPACE, key)) {
+      console.log(`[Slack] Rejoined left thread ${key}: bot mentioned`);
+    }
+    return false;
+  }
+  return isSlackThreadLeft(channelId, threadTs);
+}

package/src/slack/steering.ts

@@ -9,6 +9,7 @@ export interface SlackThreadSteeringRequest {
   message: string;
   messageTimestamps?: string[];
   requestedByUserId?: string;
+  slackUserId?: string;
 }
 
 export interface SlackThreadSteeringResult {
@@ -52,6 +53,8 @@ export async function requestSlackThreadSteering(
     source: "slack",
     createdByKind: "user",
     createdByUserId: args.requestedByUserId,
+    messageTimestamps: args.messageTimestamps,
+    slack: { channelId: args.channelId, threadTs: args.threadTs, userId: args.slackUserId },
   });
   for (const messageTs of args.messageTimestamps ?? []) {
     await createLogEntry({

package/src/slack/thread-buffer.ts

@@ -4,6 +4,7 @@ import {
   getLeadAgent,
   getMostRecentTaskInThread,
 } from "../be/db";
+import { SteeringBlockedError } from "../be/steering";
 import { findUserByExternalId } from "../be/users";
 import { createAdditiveBuffer } from "../tasks/additive-buffer";
 import { slackContextKey } from "../tasks/context-key";
@@ -21,6 +22,7 @@ import {
   fetchSlackFiles,
   notifySlackFileFailures,
 } from "./inbound-files";
+import { isSlackThreadLeft } from "./left-threads";
 import { extractSlackMessageText } from "./message-text";
 import { ensureSlackThreadTree, isSlackRenderV2Enabled } from "./render-v2";
 import { getAgentDisplayName, getAgentSlackIcon } from "./responses";
@@ -164,6 +166,12 @@ async function slackFlush(
     return;
   }
   const { channelId, threadTs } = split;
+  // The thread was left (slack-leave-thread) while these replies waited. Only
+  // non-mentions are buffered, so none of them rejoins it.
+  if (await isSlackThreadLeft(channelId, threadTs)) {
+    console.log(`[Slack] Buffer flush: dropping ${items.length} message(s) in left thread ${key}`);
+    return;
+  }
   // Buffer is guaranteed to have at least one item — the first carries the
   // original requester's userId (same semantics as the pre-refactor version).
   const originalRequesterId = items[0]!.userId;
@@ -226,22 +234,38 @@ async function slackFlush(
 
   // Steering carries text only. As on the mention path, files need a follow-up
   // task so its attachments exist before a worker can claim it.
-  const steering =
-    files.length === 0
-      ? await requestSlackThreadSteering({
-          channelId,
-          threadTs,
-          message:
-            nextSenderIndex === -1
-              ? combinedText
-              : await rewriteSlackMentions(
-                  steeringItems.map((item) => item.text).join("\n---\n"),
-                  botUserId,
-                ),
-          messageTimestamps: steeringItems.map((item) => item.ts),
-          requestedByUserId,
-        })
-      : null;
+  let steering: Awaited<ReturnType<typeof requestSlackThreadSteering>>;
+  try {
+    steering =
+      files.length === 0
+        ? await requestSlackThreadSteering({
+            channelId,
+            threadTs,
+            message:
+              nextSenderIndex === -1
+                ? combinedText
+                : await rewriteSlackMentions(
+                    steeringItems.map((item) => item.text).join("\n---\n"),
+                    botUserId,
+                  ),
+            messageTimestamps: steeringItems.map((item) => item.ts),
+            requestedByUserId,
+            slackUserId: originalRequesterId,
+          })
+        : null;
+  } catch (error) {
+    if (!(error instanceof SteeringBlockedError)) throw error;
+    console.info("[Slack] pre.task.steer blocked:", error.extension.name, error.reason);
+    if (app) {
+      for (const item of steeringItems) {
+        await ackSlackMessage(app.client, channelId, item.ts, "no_entry");
+      }
+    }
+    if (nextSenderIndex !== -1) {
+      await slackFlush(items.slice(nextSenderIndex), key, immediate);
+    }
+    return;
+  }
   if (steering) {
     console.log(
       `[Slack] Buffer flushed → steering ${steering.result.outcome} for task ${steering.task.id}`,

package/src/tasks/follow-up-redelegation-guard.ts

@@ -0,0 +1,155 @@
+/**
+ * Follow-up re-delegation guard, shared by every agent dispatch path that can
+ * run inside a follow-up session: MCP `send-task` and durable-run
+ * `ctx.step.agentTask` steps (`src/http/script-runs.ts`).
+ *
+ * When the dispatching session's source task is a `follow-up` in a Slack
+ * thread, two rules stop the cycle
+ * worker completes → follow-up → Lead re-delegates → repeat,
+ * while a distinct next step (step 2 of a chain, a fix round, a retry) passes:
+ *
+ * 1. same-work: the new task matches a completed task in the thread under the
+ *    dedup similarity rules. Bypassed when a task in the thread was cancelled
+ *    or failed after that completion: the work was interrupted or went wrong,
+ *    so re-dispatch is the correct response, not a deduped no-op.
+ * 2. loop-cap: the caller already made FOLLOW_UP_DISPATCH_CAP dispatches into
+ *    the thread within FOLLOW_UP_DISPATCH_WINDOW_MINUTES. A durable script run
+ *    counts once however many steps it dispatched. Independent of similarity,
+ *    so a loop that rewords each re-delegation still stops.
+ *
+ * Callers bypass both with `allowRedelegation` and log the override. Each
+ * caller evaluates the rules inside the write transaction that inserts the
+ * task, so two concurrent dispatches into one thread (send-task or a run's
+ * first step, in any mix) cannot both read the count below the cap.
+ */
+import {
+  countAgentDispatchesInThread,
+  findCompletedTasksInThread,
+  findRecentCancelledTaskInThread,
+  findRecentFailedTaskInThread,
+  getTaskById,
+} from "../be/db";
+import { type DedupMatch, matchSimilarTask } from "../tools/task-dedup";
+
+/** How far back the same-work rule looks for a completed task in the thread. */
+export const FOLLOW_UP_SAME_WORK_WINDOW_MINUTES = 2880; // 48 hours
+/**
+ * Loop cap: dispatches one agent may make into one Slack thread per window
+ * before a follow-up session needs allowRedelegation. A long legitimate chain
+ * (plan, implement, review, fix, re-review, fix, CI fix, retry) is about 8
+ * dispatches; a runaway loop makes one per worker run (minutes), so it hits
+ * 10 within a few hours and burns at most 10 worker sessions.
+ */
+export const FOLLOW_UP_DISPATCH_CAP = 10;
+export const FOLLOW_UP_DISPATCH_WINDOW_MINUTES = 360; // 6 hours
+
+/** Rows per page when the same-work rule scans a thread's completions. */
+export const FOLLOW_UP_SAME_WORK_PAGE_SIZE = 200;
+
+export type FollowUpThread = { channelId: string; threadTs: string; userId?: string };
+
+export type FollowUpRedelegationBlock = {
+  rule: "same-work" | "loop-cap";
+  message: string;
+};
+
+/**
+ * The Slack thread the guard applies to, or null when the source task is not
+ * a `follow-up` in a Slack thread. A `resume` source is intentionally exempt:
+ * a resume IS the legitimate re-dispatch.
+ */
+export async function followUpThreadForSourceTask(
+  sourceTaskId: string | null | undefined,
+): Promise<FollowUpThread | null> {
+  if (!sourceTaskId) return null;
+  const sourceTask = await getTaskById(sourceTaskId);
+  if (
+    sourceTask?.taskType !== "follow-up" ||
+    !sourceTask.slackChannelId ||
+    !sourceTask.slackThreadTs
+  ) {
+    return null;
+  }
+  return {
+    channelId: sourceTask.slackChannelId,
+    threadTs: sourceTask.slackThreadTs,
+    userId: sourceTask.slackUserId,
+  };
+}
+
+/**
+ * The most recent completed task in the thread's same-work window whose
+ * description matches this dispatch. Pages through every completion in the
+ * window (an older match can sit behind any number of newer unrelated ones),
+ * one bounded query per page, and stops at the first match.
+ */
+async function findMatchingCompletedWork(args: {
+  channelId: string;
+  threadTs: string;
+  taskDescription: string;
+  targetAgentId?: string;
+}): Promise<DedupMatch | null> {
+  let before: { lastUpdatedAt: string; id: string } | undefined;
+  for (;;) {
+    const page = await findCompletedTasksInThread(
+      args.channelId,
+      args.threadTs,
+      FOLLOW_UP_SAME_WORK_WINDOW_MINUTES,
+      FOLLOW_UP_SAME_WORK_PAGE_SIZE,
+      before,
+    );
+    for (const existing of page) {
+      const match = matchSimilarTask(existing, args);
+      if (match) return match;
+    }
+    const last = page.at(-1);
+    if (!last || page.length < FOLLOW_UP_SAME_WORK_PAGE_SIZE) return null;
+    before = { lastUpdatedAt: last.lastUpdatedAt, id: last.id };
+  }
+}
+
+/**
+ * The follow-up re-delegation rules. Returns the rule that blocks this
+ * dispatch, or null when it may proceed.
+ */
+export async function evaluateFollowUpRedelegation(args: {
+  channelId: string;
+  threadTs: string;
+  creatorAgentId: string;
+  taskDescription: string;
+  targetAgentId?: string;
+}): Promise<FollowUpRedelegationBlock | null> {
+  const { channelId, threadTs } = args;
+  const match = await findMatchingCompletedWork(args);
+  if (match) {
+    const existing = match.task;
+    const [cancelled, failed] = await Promise.all([
+      findRecentCancelledTaskInThread(channelId, threadTs, FOLLOW_UP_SAME_WORK_WINDOW_MINUTES),
+      findRecentFailedTaskInThread(channelId, threadTs, FOLLOW_UP_SAME_WORK_WINDOW_MINUTES),
+    ]);
+    const completedAt = new Date(existing.lastUpdatedAt).getTime();
+    const interruptedLater = [cancelled, failed].some(
+      (t) => t && new Date(t.lastUpdatedAt).getTime() > completedAt,
+    );
+    if (!interruptedLater) {
+      return {
+        rule: "same-work",
+        message: `Blocked by the follow-up re-delegation guard (same-work rule): this task matches completed task ${existing.id.slice(0, 8)} in this Slack thread (${match.reason}), so the work was already done. If it must run again, pass allowRedelegation: true.`,
+      };
+    }
+  }
+
+  const dispatched = await countAgentDispatchesInThread(
+    channelId,
+    threadTs,
+    args.creatorAgentId,
+    FOLLOW_UP_DISPATCH_WINDOW_MINUTES,
+  );
+  if (dispatched >= FOLLOW_UP_DISPATCH_CAP) {
+    return {
+      rule: "loop-cap",
+      message: `Blocked by the follow-up re-delegation guard (loop-cap rule): you already dispatched ${dispatched} times into this Slack thread in the last ${FOLLOW_UP_DISPATCH_WINDOW_MINUTES / 60} hours (cap ${FOLLOW_UP_DISPATCH_CAP}; a durable script run counts once). If this is a deliberate next step and not a re-delegation loop, pass allowRedelegation: true.`,
+    };
+  }
+  return null;
+}

package/src/tests/acp-adapter.test.ts

@@ -1179,6 +1179,85 @@ ${serveFakeAcpAgent("FakeCopilot")}
     expect(toAcpMcpServers(null)).toEqual([]);
   });
 
+  test("a target without the opt-in hooks keeps its session/new payload, MCP URL and no steering", async () => {
+    const cwd = makeTempDir();
+    const agentPath = join(cwd, "fake-acp-hooks-off.ts");
+    const captureFile = join(cwd, "session-new.json");
+    await Bun.write(
+      agentPath,
+      `
+import { Readable, Writable } from "node:stream";
+import { PROTOCOL_VERSION, agent, methods, ndJsonStream } from "${ACP_SDK_PATH}";
+class FakeAgent {
+  constructor(connection) { this.connection = connection; }
+  async initialize() {
+    // Advertises every capability the opt-in hooks key off; a target without
+    // the hooks must ignore them.
+    return {
+      protocolVersion: PROTOCOL_VERSION,
+      agentCapabilities: {
+        loadSession: true,
+        mcpCapabilities: { http: true, sse: false },
+        sessionCapabilities: { resume: {}, systemPrompt: {} },
+        _meta: { fx: { steering: true } },
+      },
+      agentInfo: { name: "fake", version: "9.9.9" },
+    };
+  }
+  async newSession(params) {
+    await Bun.write(${JSON.stringify(captureFile)}, JSON.stringify(params));
+    return { sessionId: "hooks-off-1" };
+  }
+  async prompt() { return { stopReason: "end_turn" }; }
+  async cancel() {}
+}
+${serveFakeAcpAgent("FakeAgent")}
+`,
+    );
+    const { close: closeTokenStub, apiUrl } = await startTokenStubServer(
+      "hooks-off-token",
+      "aseph_hooksofftoken1234567890",
+    );
+    // A reachable, plain-HTTP, non-loopback URL: only requiresSecureMcpUrl rewrites it.
+    const publicStyleUrl = apiUrl.replace("127.0.0.1", "0.0.0.0");
+    try {
+      const adapter = new ACPAdapter();
+      const session = await adapter.createSession(
+        baseConfig({
+          cwd,
+          apiUrl: publicStyleUrl,
+          resumeSessionId: "ignored-without-a-resume-hook",
+          env: {
+            PATH: process.env.PATH ?? "",
+            HOME: process.env.HOME ?? "",
+            ACP_TARGET_COMMAND: "bun",
+            ACP_TARGET_ARGS: JSON.stringify([agentPath]),
+          },
+        }),
+      );
+      const events: ProviderEvent[] = [];
+      session.onEvent((event) => events.push(event));
+      await session.waitForCompletion();
+
+      expect(session.sessionId).toBe("hooks-off-1");
+      expect(session.deliverSteering).toBeUndefined();
+      expect(await adapter.canResume("hooks-off-1")).toBe(false);
+      const params = JSON.parse(await Bun.file(captureFile).text());
+      expect(Object.keys(params).sort()).toEqual(["cwd", "mcpServers"]);
+      expect(params.mcpServers.map((server: { url: string }) => server.url)).toEqual([
+        `${publicStyleUrl}/mcp`,
+      ]);
+      // Every ACP target records the agent's own version on session_init.
+      expect(events.find((event) => event.type === "session_init")).toMatchObject({
+        sessionId: "hooks-off-1",
+        provider: "acp",
+        harnessVariantMeta: { version: "9.9.9" },
+      });
+    } finally {
+      await closeTokenStub();
+    }
+  });
+
   test("completes before the revoke response and logs a failed revocation", async () => {
     const cwd = makeTempDir();
     const agentPath = join(cwd, "fake-acp-ephem-agent.ts");

package/src/tests/base-prompt.test.ts

@@ -1290,6 +1290,18 @@ describe("getBasePrompt: harness tool discovery", () => {
     expect(result).toContain('import { store_progress } from "agent-swarm"');
   });
 
+  test("fx gets capability_search guidance with mcp_swarm_ tool names", async () => {
+    const result = await getBasePrompt({
+      ...minimalArgs,
+      provider: "fx",
+      traits: { ...localTraits, hasToolSearch: false },
+    });
+    expect(result).not.toContain(deferred);
+    expect(result).not.toContain("already in your tool list");
+    expect(result).toContain("`capability_search`");
+    expect(result).toContain("`store-progress` is `mcp_swarm_store-progress`");
+  });
+
   test("codex gets exec guidance with the normalized tool name", async () => {
     const result = await getBasePrompt({
       ...minimalArgs,

package/src/tests/chat-sdk-inbound.test.ts

@@ -12,13 +12,16 @@ import {
   createUser,
   getDbClient,
   getKv,
+  getLogsByTaskId,
   getTaskAttachments,
   getTaskById,
   initDb,
   startTask,
   upsertKv,
 } from "../be/db";
+import { installExtension } from "../be/extensions/db";
 import { linkIdentity } from "../be/users";
+import { enableExtension, stopExtensionRuntime } from "../extensions/lifecycle";
 import { resetFileStorageProviderForTests } from "../fs/registry";
 import { drainBackground } from "../integrations/chat-sdk/background";
 import { CHAT_CHANNEL_SETTINGS_NAMESPACE } from "../integrations/chat-sdk/reactions";
@@ -42,6 +45,8 @@ import {
   telegramUpdate,
 } from "./chat-sdk-harness";
 
+import { loadBundleFixture } from "./fixtures/extensions/load";
+
 const TEST_DB_PATH = "./test-chat-sdk-inbound.sqlite";
 const ENV_KEYS = [
   "AGENT_FS_LOCAL_DIR",
@@ -271,6 +276,31 @@ describe("Chat SDK inbound pipeline", () => {
     expect(sendCount()).toBe(sendsBefore);
   });
 
+  test("an extension-blocked steer never falls back to a follow-up task", async () => {
+    await postTelegramUpdate(telegramUpdate(group(-2025), "@swarm_test_bot plan the report"));
+    await flushChatBuffers();
+    const [task] = await chatTasks(-2025);
+    expect(task).toBeDefined();
+    await startTask(task!.id);
+    const bundle = await loadBundleFixture("steering-policy");
+    const { extension } = await installExtension({ ...bundle, config: { action: "block" } });
+    await enableExtension(extension.id);
+    try {
+      const blocked = telegramUpdate(group(-2025), "Do not deliver this correction");
+      await postTelegramUpdate(blocked);
+      await flushChatBuffers();
+      expect(await chatTasks(-2025)).toHaveLength(1);
+      expect(await steeringRows(task!.id)).toEqual([]);
+      expect(reactionsOn(-2025, blocked)).toEqual(["👎"]);
+      expect(
+        (await getLogsByTaskId(task!.id)).filter((log) => log.eventType === "task_steering"),
+      ).toEqual([]);
+    } finally {
+      await stopExtensionRuntime();
+      await getDbClient().run("DELETE FROM extensions WHERE id = ?", [extension.id]);
+    }
+  });
+
   test("a channel that opts into text acks also gets the steering reply", async () => {
     await upsertKv({
       namespace: CHAT_CHANNEL_SETTINGS_NAMESPACE,