@desplega.ai/agent-swarm 2.7.5 → 2.7.6

package/src/tools/task-dedup.ts

@@ -34,11 +34,53 @@ const HIGH_SIMILARITY_THRESHOLD = 0.8;
 /** Lower threshold used when the tasks also target the same agent */
 const SAME_AGENT_SIMILARITY_THRESHOLD = 0.6;
 
+/**
+ * Rows one duplicate check scans. The JS similarity match needs more than the
+ * query's default 50 (an older duplicate can sit behind newer unrelated tasks),
+ * but the scan must stay bounded: send-task runs it twice per call, once inside
+ * the write transaction.
+ */
+export const DEDUP_SCAN_LIMIT = 500;
+
 export interface DedupMatch {
   task: AgentTask;
   reason: string;
 }
 
+/**
+ * The description-similarity rules shared by the duplicate check and the
+ * follow-up re-delegation guard: a very similar description matches any
+ * target, a moderately similar one matches only the same target agent.
+ */
+export function matchSimilarTask(
+  existing: AgentTask,
+  opts: { taskDescription: string; targetAgentId?: string },
+): DedupMatch | null {
+  const similarity = jaccardSimilarity(existing.task, opts.taskDescription);
+
+  // Very similar task description: likely duplicate regardless of target
+  if (similarity > HIGH_SIMILARITY_THRESHOLD) {
+    return {
+      task: existing,
+      reason: `similar task description (${(similarity * 100).toFixed(0)}% match)`,
+    };
+  }
+
+  // Same target agent + moderately similar task: lower threshold
+  if (
+    opts.targetAgentId &&
+    existing.agentId === opts.targetAgentId &&
+    similarity > SAME_AGENT_SIMILARITY_THRESHOLD
+  ) {
+    return {
+      task: existing,
+      reason: `similar task to same agent (${(similarity * 100).toFixed(0)}% match)`,
+    };
+  }
+
+  return null;
+}
+
 /**
  * Check for duplicate tasks created recently.
  * Returns the first matching duplicate, or null if none found.
@@ -54,6 +96,7 @@ export async function findDuplicateTask(opts: {
   const recentTasks = await findRecentSimilarTasks({
     creatorAgentId: opts.creatorAgentId,
     windowMinutes: opts.windowMinutes ?? 10,
+    limit: DEDUP_SCAN_LIMIT,
   });
 
   for (const existing of recentTasks) {
@@ -70,27 +113,8 @@ export async function findDuplicateTask(opts: {
       };
     }
 
-    const similarity = jaccardSimilarity(existing.task, opts.taskDescription);
-
-    // 2. Very similar task description — likely duplicate regardless of target
-    if (similarity > HIGH_SIMILARITY_THRESHOLD) {
-      return {
-        task: existing,
-        reason: `similar task description (${(similarity * 100).toFixed(0)}% match)`,
-      };
-    }
-
-    // 3. Same target agent + moderately similar task — lower threshold
-    if (
-      opts.targetAgentId &&
-      existing.agentId === opts.targetAgentId &&
-      similarity > SAME_AGENT_SIMILARITY_THRESHOLD
-    ) {
-      return {
-        task: existing,
-        reason: `similar task to same agent (${(similarity * 100).toFixed(0)}% match)`,
-      };
-    }
+    const match = matchSimilarTask(existing, opts);
+    if (match) return match;
   }
 
   return null;

package/src/types.ts

@@ -2212,6 +2212,39 @@ export const RuntimeControllerSchema = RuntimeControllerCreateSchema.omit({ secr
   .openapi("RuntimeController");
 export type RuntimeController = z.infer<typeof RuntimeControllerSchema>;
 
+export const RuntimePoolCacheSchema = z
+  .object({
+    mountPath: z
+      .string()
+      .min(2)
+      .refine((path) => {
+        const parts = path.split("/").filter(Boolean);
+        const normalized = `/${parts.join("/")}`;
+        const protectedPaths = [
+          "/workspace/personal",
+          "/workspace/shared",
+          ...["/home/worker", "/root"].flatMap((home) =>
+            [".ssh", ".codex", ".claude", ".claude.json", ".pi", ".config", ".local"].map(
+              (directory) => `${home}/${directory}`,
+            ),
+          ),
+        ];
+        return (
+          path.startsWith("/") &&
+          parts.length > 0 &&
+          !path.includes("\0") &&
+          !parts.some((part) => part === "." || part === "..") &&
+          !protectedPaths.some(
+            (protectedPath) =>
+              protectedPath === normalized ||
+              protectedPath.startsWith(`${normalized}/`) ||
+              normalized.startsWith(`${protectedPath}/`),
+          )
+        );
+      }, "Cache mountPath must be absolute, without . or .., and must not cover worker homes, workspaces or credential directories"),
+  })
+  .strict();
+
 export const RuntimePoolCreateSchema = z
   .object({
     name: z.string().min(1).max(200),
@@ -2226,6 +2259,7 @@ export const RuntimePoolCreateSchema = z
     delivery: DeliveryModeSchema.nullable().default(null),
     env: z.record(z.string(), z.string()).default({}),
     resources: RuntimeResourcesSchema.nullable().default(null),
+    cache: RuntimePoolCacheSchema.nullable().default(null),
     ttlSec: z.number().int().positive().nullable().default(null),
     enabled: z.boolean().default(true),
   })
@@ -2239,6 +2273,7 @@ export const RuntimePoolUpdateSchema = RuntimePoolCreateSchema.partial().extend(
   delivery: DeliveryModeSchema.nullable().optional(),
   env: z.record(z.string(), z.string()).optional(),
   resources: RuntimeResourcesSchema.nullable().optional(),
+  cache: RuntimePoolCacheSchema.nullable().optional(),
   ttlSec: z.number().int().positive().nullable().optional(),
   enabled: z.boolean().optional(),
 });
@@ -3114,6 +3149,8 @@ export const ScriptRunSchema = z
     lastHeartbeatAt: z.string().optional(),
     idempotencyKey: z.string().optional(),
     requestedByUserId: z.string().optional(),
+    /** Task whose session launched the run; the follow-up re-delegation guard reads it. */
+    sourceTaskId: z.string().optional(),
   })
   .openapi("ScriptRun");
 export type ScriptRun = z.infer<typeof ScriptRunSchema>;
@@ -3122,6 +3159,7 @@ export const ScriptRunListItemSchema = ScriptRunSchema.omit({
   source: true,
   args: true,
   output: true,
+  sourceTaskId: true,
 });
 export type ScriptRunListItem = z.infer<typeof ScriptRunListItemSchema>;
 

package/templates/skills/composio-google-docs/content.md

@@ -80,6 +80,16 @@ Google Drive export, then preserve or reconstruct the structure explicitly.
 There is no `GET_DOCUMENT_MARKDOWN` tool; markdown exists on create/update, not
 on read.
 
+## Comments
+
+Doc comments are a Drive feature, not a Docs one: there is no `GOOGLEDOCS_*`
+comment slug. List them with `GOOGLEDRIVE_LIST_COMMENTS` (replies:
+`GOOGLEDRIVE_LIST_REPLIES`) from the `googledrive` toolkit, so resolve the
+user's `googledrive` connected account instead of their `googledocs` one.
+Listing only works when the Drive read scopes are authorized on that account.
+`GOOGLEDRIVE_CREATE_COMMENT` and the update/delete tools are write actions,
+only on explicit request.
+
 ## Gotchas
 
 - Search returns Drive metadata, not document content — do a second

package/templates/skills/script-workflows/content.md

@@ -43,7 +43,25 @@ export default async function main(args, ctx) {
 }
 ```
 
-`ctx.step.agentTask` blocks until the dispatched task reaches a terminal status (default `waitForCompletion: true`, default `timeoutMs` 2h) and journals its real output — a sequential `plan → implement → review` chain will not fan out. Pass `waitForCompletion: false` for the legacy fire-and-poll-yourself shape, or `failOnTaskFailure: false` to receive `{taskId, status: "failed", error}` instead of a throw when the task fails/is cancelled.
+`ctx.step.agentTask` blocks until the dispatched task reaches a terminal status (default `waitForCompletion: true`, default `timeoutMs` 2h) and journals its real output — a sequential `plan → implement → review` chain will not fan out. Pass `failOnTaskFailure: false` to receive `{taskId, status: "failed", error}` instead of a throw when the task fails/is cancelled.
+
+A run launched from a `follow-up` task in a Slack thread passes the same re-delegation guard as `send-task`, decided once for the whole run at its first new step: a step that repeats completed thread work, or a run past the thread's dispatch cap (a run counts once), throws with the rule's message, and every later new step of that run throws too. Pass `allowRedelegation: true` on a step only for a deliberate re-run. Do not wrap a single dispatch in a durable run; use `send-task`.
+
+`waitForCompletion: false` does not return right after dispatch. The first call still waits up to ~30s while the server polls the task, then returns one of three shapes:
+
+- The task finished in that window: its output string or `null`, as on success.
+- The task failed or was cancelled in that window: a throw, or `{taskId, status: "failed", error}` with `failOnTaskFailure: false`.
+- The task is still running: `{taskId, status}`.
+
+On success, `ctx.step.agentTask` resolves to the worker's output string (JSON text under `outputSchema`, so parse it yourself; `null` when the task stored none), not a task record. On a string, `step.taskId` and `step.status` are undefined, so a guard such as `step.status !== "completed"` or `step?.taskId ?? "unknown"` silently misfires. On `null`, `step.taskId` throws a TypeError. Only `failOnTaskFailure: false` with a failed or cancelled task returns `{taskId, status: "failed", error}`, and only `waitForCompletion: false` on a task still running returns `{taskId, status}`. To get a step's task id, query by its context key (the label is the step label you passed):
+
+```sql
+SELECT id, status, output FROM agent_tasks
+WHERE contextKey = 'script-run:<runId>:<label>' AND taskType = 'script-run-step'
+ORDER BY createdAt DESC, rowid DESC LIMIT 1
+```
+
+Inside the run, `<runId>` is `ctx.run.id`.
 
 ## Label Rules
 

package/templates/skills/swarm-docs/content.md

@@ -91,6 +91,7 @@ Fetch the page as markdown: `curl -fsSL https://docs.agent-swarm.dev/llms.mdx/do
 - [One-off Script Workflow Runs](https://docs.agent-swarm.dev/docs/guides/script-workflow-runs). Reference.
 - [Dreaming](https://docs.agent-swarm.dev/docs/guides/dreaming). When: Someone asks what the nightly dreaming run changed, how to configure or turn it off, or how to undo one of its changes.
 - [Claude Bridge](https://docs.agent-swarm.dev/docs/guides/claude-bridge-experimental). Reference.
+- [Reading claude.ai Artifacts headless](https://docs.agent-swarm.dev/docs/guides/claude-artifacts-read). When: Someone wants an agent to read a claude.ai Artifact link, such as a design and its canvas.json, from a headless session.
 - [Worker Credential Recovery](https://docs.agent-swarm.dev/docs/guides/worker-credential-recovery). Reference.
 - [Model Gateways](https://docs.agent-swarm.dev/docs/guides/provider-auth/model-gateways). Reference.
 - [Codex OAuth](https://docs.agent-swarm.dev/docs/guides/provider-auth/codex-oauth). Reference.

package/templates/skills/swarm-scripts/SKILL.md

@@ -23,6 +23,8 @@ Named script only when the logic will run two or more times, by you, another age
 
 Reference point: a workflow triage that took about 26 tool calls returns as one result of about 4k tokens in about 13 seconds.
 
+Pick the run mode before you author. A short inline `script-run` is for small lookups only. A job that scans a whole population or may run past the inline cap of about 30 s starts as a durable `launch-script-run` from the start. A single `ctx.step.swarmScript` step has the same cap, so collect in bounded steps: each step takes a cursor, collects one slice in well under 30 s, and returns its rows plus the next cursor. Label each step with its slice (`collect-${page}`) so the journal checkpoints it, then compute from the collected slices in a final step. Restarting a long inline run throws away the work it already did.
+
 ## Loading the tools
 
 The script tools are deferred. Load them with your harness tool search before the first call: `script-search`, `script-run`, `script-upsert`, `script-query-types`, `script-delete`, and for durable runs `launch-script-run`, `get-script-run`, `list-script-runs`.

package/templates/skills/swarm-scripts/content.md

@@ -18,6 +18,8 @@ Named script only when the logic will run two or more times, by you, another age
 
 Reference point: a workflow triage that took about 26 tool calls returns as one result of about 4k tokens in about 13 seconds.
 
+Pick the run mode before you author. A short inline `script-run` is for small lookups only. A job that scans a whole population or may run past the inline cap of about 30 s starts as a durable `launch-script-run` from the start. A single `ctx.step.swarmScript` step has the same cap, so collect in bounded steps: each step takes a cursor, collects one slice in well under 30 s, and returns its rows plus the next cursor. Label each step with its slice (`collect-${page}`) so the journal checkpoints it, then compute from the collected slices in a final step. Restarting a long inline run throws away the work it already did.
+
 ## Loading the tools
 
 The script tools are deferred. Load them with your harness tool search before the first call: `script-search`, `script-run`, `script-upsert`, `script-query-types`, `script-delete`, and for durable runs `launch-script-run`, `get-script-run`, `list-script-runs`.

package/dist/cli-dznrgaep.js

@@ -1,30 +0,0 @@
-import {
-  require_permessage_deflate,
-  require_receiver,
-  require_sender,
-  require_extension,
-  require_websocket,
-  require_stream,
-  require_subprotocol,
-  require_websocket_server
-} from "./cli-hf6zt5m6.js";
-import {
-  __toESM,
-  __esm
-} from "./cli-242037k3.js";
-
-// node_modules/ws/wrapper.mjs
-var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server, wrapper_default;
-var init_wrapper2 = __esm(() => {
-  import_stream = __toESM(require_stream(), 1);
-  import_extension = __toESM(require_extension(), 1);
-  import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
-  import_receiver = __toESM(require_receiver(), 1);
-  import_sender = __toESM(require_sender(), 1);
-  import_subprotocol = __toESM(require_subprotocol(), 1);
-  import_websocket = __toESM(require_websocket(), 1);
-  import_websocket_server = __toESM(require_websocket_server(), 1);
-  wrapper_default = import_websocket.default;
-});
-
-export { import_websocket, import_websocket_server, wrapper_default, init_wrapper2 };