AgentSwarms 1.3.0

AgentSwarms 1.3.0

The data half grows up. 1.2 described an agentic AI platform with a BI surface;
1.3 ships the other half that agents need pointing at: a lakehouse of your
own (DuckDB over Parquet in your bucket, with a transactional catalog), ETL
pipelines that feed it, no-code machine learning that trains on it, and
decision provenance that ties every answer to the snapshot it read. Around
those land web-crawl and Confluence knowledge sources, Jira and Zendesk
datasets, Azure lakes, local embedding models, a production server that uses
every core, a Kubernetes path proven on a real cluster, backups that prove they
restore, and a README half its previous size.

62 commits, 330 files, 27 migrations.

---

Highlights

A lakehouse built in. DuckDB as the engine, a Postgres catalog for
transactions, zstd Parquet in your own object storage. Compute is per-request
and stateless, so replicas behind a load balancer share storage instead of
sharding it. Snapshot time travel, partition pruning, a result cache keyed on
the catalog snapshot, materialized views, spill to disk, hourly compaction, and
mounted data lakes queried in place. Governance is one chokepoint: every
statement is classified and access-checked before the engine sees it, and row
filters and column masks are rewritten into the query's parse tree so a CTE or
alias cannot route around them. It registers as a warehouse with nothing to
enter, so BI, the AI Analyst and agents reach it at once.

ETL pipelines, canvas or code. Object storage, databases, change-data-capture,
HTTP APIs, webhooks and the lakehouse in; object storage, databases, Snowflake,
BigQuery, Databricks and the lakehouse out. Cron with real timezone math, a
retry ladder, overlap guards, incremental watermarks, schema-drift policy,
quality gates, per-node preview, version history, alert policy. Runs execute on
the sandboxed runtime and credentials reach process memory only; every
successful load re-crawls its destination so the new tables appear for BI, the
analyst and agents.

Machine learning without leaving the platform. Pick a table and a goal —
predict a column, forecast a series, find groups, find anomalies, recommend
items — and a sandboxed trainer prepares the data, tries several algorithms
under a time budget, and keeps the best with its metrics, leaderboard,
importance and a passport (snapshot, decision id, artifact digest). Every model
is a registry entry with versions and stages: compare them, read the model card,
retrain on a schedule that promotes only when better, watch drift on every
batch, request GPUs. Predictions write back to the lakehouse, reach agents
through ml_predict, draw on BI dashboards through one shared forecaster, and
answer a scoped public API with per-model keys. And the trainer says when a
score could mislead — a leaked feature, a do-nothing baseline, a period nobody
chose — on the version, in the compare view, in the model card and in the
agent's notes.

Every answer has one id. A chat turn, a swarm run or a dashboard refresh
carries a decision id across the model calls, data reads, cost and approvals it
made, plus the lakehouse snapshot it saw. Export it as a signed Answer Passport,
replay it against the original snapshot and against today, and keep it past a
shorter trace window. Replay tells tampering from non-determinism, and a deleted
account can no longer break the audit chain.

A server that uses the machine, and a Kubernetes path that was run. npm start serves through server.mjs with one worker per CPU instead of Vite's
single-threaded preview: on an 8-core host SSR went from 19 to 55 requests per
second. The fully self-hosted Kubernetes path — Supabase as pods, the app, the
Office renderer, the JS sandbox, the lakehouse catalog, the cron job — came up
on a real cluster and then on one that is not the author's laptop, with GPU
placement and egress for the ML platform.

---

Also in this release

• Knowledge from a website, discovered by sitemap or links and re-checked on
  a schedule; Confluence Cloud and Data Center; Azure Blob and ADLS Gen2
  lakes; Jira and Zendesk as datasets, for 29 connectors in all.
• Embeddings from the provider that is connected, including local Ollama
  and vLLM models at their own vector widths, so an air-gapped install can
  search its own documents without an OpenAI key.
• Session restore, contributed by @theniteshdev: a tab that closed or
  crashed mid-work is offered back on the next visit.
• Backups that prove they restore. npm run backup captures the four
  stateful things a self-hosted install cannot regenerate; `npm run restore -- --drill` restores them into a scratch target first.
• Spend the machine you bought. The six compute knobs are settings under
  Admin, and the sizing guide says what to set them to for ETL, the lakehouse
  and ML training.
• Headless runs read as their owner, agents' warehouse queries are audited
  like the UI's, a dashboard's alerts are evaluated as its owner, and a browser
  cannot switch a destructive confirmation back on.
• Deleting a knowledge base asks first.
• Data Prep reads and writes lakehouse tables, which is the way to wrangle a
  training set.
• The dashboard, the tagline and the README admit the data half; seven
  engineering chapters explain how the thing is built; one worked scenario runs
  the whole platform at three systems that disagree about revenue.

---

Upgrading

git pull
npm install
npx supabase db push                                 # 27 migrations
docker compose --profile all up -d --build           # rebuilds the notebook runtime image too

The setup scripts and the Kubernetes installer apply the migrations for you.
The notebook runtime image gained the machine-learning stack, so rebuild it;
--profile all does. The compose file adds a lakehouse-catalog Postgres
service with its own volume, one of the four things npm run backup captures.
Ten environment variables are new and all optional with working defaults;
PROVENANCE_SIGNING_SECRET is the one worth setting, since it signs Answer
Passports. The generated egress allow-list files are no longer tracked.

Known limits

• No SCIM; users arrive through SSO or invitation, groups are managed in IAM.
• One vector store: pgvector in the application database.
• The lakehouse catalog's high availability is yours to provide; compose
  runs one Postgres container.
• The lakehouse is single-node compute: columnar scans, partition pruning and
  spill to disk keep large tables workable, and the honest ceilings are in
  docs/LAKEHOUSE.md.
• The ML platform has no warm real-time endpoint, feature store or distributed
  training; predictions are batch or small payloads through the API and the
  agent tool. The comparison with Databricks and SageMaker is in docs/ML.md.
• Credentialed connectors are verified to validation, not in CI against live
  tenants.

Thanks

@theniteshdev for session restore (#56).

AgentSwarms 1.2.2

AgentSwarms 1.2.2

Two arcs, one visible and one not. The visible one is AgentSwarms Native —
dark navigation chrome around a light working pane, now the default theme. The
other is a cluster of self-hosted Docker failures that all announced themselves
as "Unauthorized" while the real fault was a connection the container could not
make. A failure that lies about its own cause costs far more to find than one
that simply reports itself, which is the same reason this release adds a schema
health check.

35 commits, 54 files, no migrations.

---

Highlights

A new default theme. AgentSwarms Native puts dark navigation chrome around a
light working pane — the pattern the Oracle and AWS consoles use. Navigation
reads as a persistent frame while content sits on light surfaces, which is where
dense tables, charts and long documents are easiest to read. Dark and light are
untouched and still selectable. A follow-up fix removed the white seam where the
sidebar met the top bar: a full-height right border drawn on a transparent
element, so the translucent border colour composited against the page instead of
against the chrome it was meant to divide.

Self-hosting under Docker actually works. Every server-side Supabase call
failed on a containerized install and reported "Unauthorized" while doing it —
resolving the caller is the first thing those handlers do, so a
connect ECONNREFUSED 127.0.0.1:8000 surfaced as a rejected token. Document
generation (PowerPoint, Word, Excel) failed the same way and for the same
reason. Separately, setup-selfhosted.sh could not complete against a stock
stack: the migration step built its connection string without sslmode, so the
Supabase CLI negotiated TLS against a Postgres serving plaintext. All three are
fixed, along with a first-boot race and a js-sandbox health check that was
polling a port Docker never binds.

An unapplied migration now says so. A contributor pulls code expecting a
column a recent migration added, never re-applies migrations, and PostgREST
rejects the query — which until now surfaced as a broken page or an unhandled
rejection with no hint that "run your migrations" is the fix. Detection runs in
two layers, a proactive check on mount and a reactive fetch interceptor that
catches the failure as it happens, deduped by table and column. The modal names
the specific tables and columns, gives the migration filename and description
where known, and hands over three copyable commands — supabase db push,
migration up, and a danger-styled db reset. Dismissing is session-scoped,
because the problem has not gone away just because the modal did. It is mounted
for every route, authenticated or not: an unapplied migration can break the
public landing page as easily as a dashboard.

Pick a model from a list, not a text box. Choosing a model meant typing an
exact id into a free-text field, with a suggestion row capped at 24 so a large
catalogue would not become a wall of badges — which left an OpenRouter user with
24 chips and a text box in front of roughly 400 models. Swarm nodes were worse:
they offered a bundled, hand-maintained list of about a dozen ids per provider,
when the app already fetches the full catalogue for the agent editor. The
searchable picker now covers swarm nodes, the agent editor and prompt compare.

Read a web page without a third-party key. web_browse was hidden from the
model unless a Firecrawl key existed, and adding a URL to a knowledge base
returned FIRECRAWL_NOT_CONNECTED — while web_search, its sibling, degraded
to a free provider rather than disappearing. Both surfaces now have the same
floor.

---

Also in this release

• A resizable sidebar. A drag handle on the right edge clamped to 200–400px,
  Cmd/Ctrl+\ alongside the existing Cmd/Ctrl+B, and both the collapsed state
  and the chosen width persisted to localStorage rather than to a cookie nothing
  read back. Dragging below 100px auto-hides it, VS Code style, and a Show/Hide
  toggle in the profile menu works without hunting for the header trigger.
  Collapsing now hides the panel completely instead of leaving a 48px icon rail.
• The Create Agent form survives an accidental dismissal. Clicking outside
  the dialog unmounts the form entirely and threw away everything typed into it.
  Every field it manages — guardrails, tool toggles, MCP allow-lists,
  knowledge-base links, memory config, not just name and prompt — now
  round-trips through a sessionStorage draft.
• An instance-wide OpenRouter key counts as a connected provider in BI. On an
  instance whose only provider was OPENROUTER_API_KEY in .env, the analyst's
  "New analyst" dialog said "Connect a model provider in Integrations" while
  agent chat and swarms called OpenRouter through that same key without
  complaint.
• One command starts every service. Six of the seven services sit behind
  Compose profiles, so a plain docker compose up deliberately starts the app
  alone — and there is no --all flag for it. Every profiled service now also
  carries all, so docker compose --profile all up -d --build brings up the
  whole stack, while the narrower --profile docgen/notebooks/sandbox keep
  working unchanged.

---

Security fixes

• .env backups are ignored properly. The existing rules covered .env,
  .env.local and .env.*.local — none of which match .env.cloud.bak,
  .env.production.backup or .env.old.copy, which are the names people
  actually leave behind when switching backends. Those files hold the same
  service-role and provider keys as .env itself and sat one git add -A away
  from being committed.

---

Notable fixes

• Popovers no longer clipped by the dialogs containing them — the Prompt Library
  popover in the Agent Builder lost the first characters of every title, and its
  "Use this prompt" button could not be reached at all.
• "Browse registry" failed with "expected object, received undefined" on every
  open.
• The model dropdown wiped a registry pick one render later: the toast said
  "Selected Jamba Large 1.7" and the control fell back to "Select a model".

---

Upgrading

git pull
npm install            # new dependency: turndown
docker compose --profile all up -d --build

No migrations and no new environment variables in this release. --profile all
starts all seven services; a plain docker compose up still starts the app
alone, which is unchanged.

One thing to know before you upgrade: AgentSwarms Native is now the default
theme, so an installation where nobody picked a theme explicitly will look
different afterwards. Dark and light are unchanged and still selectable from the
theme toggle.

Known limits

• The schema health check is not exhaustive. RLS-locked tables can
  false-negative, and the curated list of checks is deliberately partial — it is
  there to turn a confusing failure into an actionable one, not to prove a schema
  correct. See docs/SCHEMA_HEALTH_CHECK.md.
• The standing limits from 1.2.0 are unchanged: a billion-row import into a
  local dataset is not supported (the warehouse is the engine — see
  docs/SCALE_AND_LIMITS.md), the embedded analyst takes 30–95 seconds per
  question, and signed viewers remain dashboard-only by design.

AgentSwarms 1.2.1

AgentSwarms 1.2.1

The app stopped presenting a read it had failed to make as a fact it knew.
Thirty-one modules were audited by recomputing every headline figure
independently from the database and comparing it against what the page claimed,
which is the only way this class of defect surfaces — a page that renders 0
looks exactly like a page that worked, and logs nothing either way. The
documentation was put through the same treatment against the running product,
and now carries search and two checkers that fail on drift.

82 commits, 234 files, 3 migrations.

---

Highlights

A discarded read error is not an empty account. Secrets, the skill library,
notebooks, the prompt library, MCP servers and the model registry each answered
a failed load by rendering the empty state — you have none — rather than we
could not tell. Every one of them now distinguishes the two and offers a retry.
The same shape appeared in worse clothes elsewhere: the MCP page published 0
tools, the monitoring page reported healthy over a probe set it had failed to
load, two lab pages awarded verdicts to work that never happened, and the audit
log manufactured evidence of absence — which is the worst possible page to do it
on.

The sharpest version of it argued for an action. A failed count on the model
registry did not merely misreport; it talked an admin into running a sync that
was not needed. A misreported number is a wrong answer, but a misreported number
attached to a call to action is a wrong instruction.

Capped views say they are capped. The analytics page reported a thousand
traces as though they were the population, the trace log presented its page as
the whole, and the analyst's 50-row cap could be reached with no disclosure.
Aggregates still run in the database and the cap only trims what is displayed —
the difference is that the page now says so.

The pages that held are written up too. /monitoring's refresh path, the trace
log's failed-read handling, Web Embedding, and the AI Analyst under direct
attack all survived the pass, documented at the same length as the ones that
failed. A log that records only faults says nothing about where the ground is
solid.

Slack, in both directions. The AI Analyst now answers in the channel where
the question was asked, with request signature verification, and a settings tab
means a workspace can be configured without inserting a row by hand. The
outbound notification webhook is unchanged; this is the other direction, and a
different trust problem.

Import a dbt project. Reads target/manifest.json — the file dbt writes on
every run, compile or docs build — and says plainly what could not come across.
A team that already runs dbt has months of model descriptions, column docs and
MetricFlow measures; asking them to retype it into a form is why define your
metrics in our UI loses to a YAML file in git.

A pull request that breaks a metric now fails. Git export already wrote every
semantic model as JSON, and nothing read those files back — so a broken governed
metric surfaced later as a refusal at query time, in front of whoever asked the
question rather than whoever made the change.

Skills load on demand once they outgrow the prompt. Every attached skill used
to be pasted into the system prompt in full on every turn. Below
SKILLS_INLINE_MAX_CHARS (default 8000) that is still exactly what happens;
above it the prompt carries an index of names and summaries and the agent pulls
the body it needs through a use_skill tool. Swarms are unaffected — the
headless executor sends no skill ids.

---

Also in this release

• Generate a whole dashboard from a governed semantic model, not only from
  source tables.
• Export a dashboard as a branded PowerPoint deck whose numbers are the
  dashboard's, with a per-visual checklist, a model picker and a free-text
  instruction field for tone and audience.
• @agentswarms/react — a React SDK alternative to iframe embeds, for host
  apps that want their own message rendering, their own theme, or programmatic
  control over the stream, citations and Visual-BI widgets.
• One command from nothing to a running stack. The self-hosted Supabase path
  was fully documented and fully manual — JWT secret, two signed keys, the
  storage-boot caveat, the extension preflight, five values wired into .env by
  hand. It is now scripted.
• Synced data is filed under the source it came from, and can be operated
  from there.
• Chats can be renamed in place, and a per-chat Tools menu turns on web
  search for one conversation without changing the agent.
• Documentation: 27 pages audited against the running product, search across
  378 headings, subsections in the on-this-page rail, 28 previously undocumented
  tuning variables, scenario guides for swarm shapes and RAG configurations, and
  two checkers (check:docs, check:md-docs) that fail on drift.

---

Security fixes

• Three injection paths closed in the agent and swarm code exporters. The
  exporters turn a saved graph into a Python or TypeScript file the user is told
  to run, and a swarm can arrive from anyone as a dropped .swarm.json that is
  one click from the export menu — which makes every interpolated value
  untrusted. Numeric fields are coerced rather than pasted, labels are sanitised
  before they reach docstrings, and tool configs are redacted instead of being
  serialised with credentials intact.
• An API key scoped to everything now says so. Scope rendered as · N tools
  or as nothing at all, so the most powerful key on the page was the one with
  nothing written on it.

---

Notable fixes

• Every response from a conformant MCP server was unreadable, reported as a
  server that "did not start in time". It had started.
• A swarm's deployed badge tracked whether a deploy was once clicked, not
  whether traffic can actually arrive.
• Importing an agent into a swarm dropped the settings that restrict it.
• A retrieval that found nothing was passed over in silence instead of being
  told to the model.
• Local datasets were stamped "crawled a minute ago" weeks after they were
  loaded.
• A semantic model decertified on most definition changes, not all of them.
• The dashboard card headed "last 24h" did not describe the last 24 hours.
• The BI toolbar could not reach its last action — twelve buttons, 1175px, in a
  nested non-wrapping flex item on a row that did wrap, which is why it survived
  inspection.
• Provider-reported cost now replaces the vendored price table wherever the
  provider supplies it. Reported as "kimi k3 shows 0 cost", which it did on all
  116 runs: the model postdated the catalog, so the resolver was correctly
  answering that it had no price.
• One 403 claimed "no providers connected" for a whole session, in a shared
  module, so the fix lands on two pages.

---

Upgrading

git pull
npx supabase db push   # 3 migrations
docker compose up --build

Nothing in this release requires a configuration change. Two optional
environment variables were added, both unset by default:

• SKILLS_INLINE_MAX_CHARS — the size at which attached skills switch from
  inline to on-demand loading. Defaults to 8000, which keeps all six bundled
  sample skills inline; existing agents behave exactly as before unless you
  lower it.
• GITHUB_TOKEN — only needed for the semantic-layer pull request check.

Slack needs no environment variables: the workspace is configured in the app,
under Integrations.

Known limits

Stated plainly, because the alternative is you discovering them:

• Scale. Warehouse tables of any size are fine through the semantic layer,
  and prep flows that fold are fine. Importing a billion rows into a local
  dataset is not. There is no distributed in-memory engine; the warehouse is the
  engine. See docs/SCALE_AND_LIMITS.md.
• Embedded analyst latency. 30–95 seconds per question. It streams, so the
  wait is legible, but it is still a wait.
• Signed viewers are dashboard-only. They filter stored results; an analyst
  writes fresh SQL each turn, so enforcement would cover the governed steps and
  not the rest. Partial enforcement is a badge that vouches for less than it
  appears to.
• The adversarial pass has a hole in it. It covered the thirty-one mapped
  modules, but streaming, tool calls and guardrails in Agent Chat were exercised
  only in part — a budget cap blocked live model turns at the time. They are
  recorded as uncovered rather than left looking as though they passed.

AgentSwarms 1.2.0

AgentSwarms 1.2.0

The semantic layer stopped being a place to write definitions and became a
compiler that refuses to produce a wrong one. On top of it sits a dedicated AI
Analyst that shows every step it took — the SQL, the result, its own check on
that result — and a verification badge that expires when the query underneath it
changes. Dashboards and the analyst itself can now be embedded per customer,
each viewer seeing only their own rows.

77 commits, 265 files, 15 migrations.

---

Highlights

A compiler that refuses to be wrong. Declare a measure's grain, a table's
primary key and a join's cardinality, and a query that would fan out is
refused at compile time — naming the join and suggesting the fix. Ask a
typical BI tool for revenue by campaign across orders ⋈ order_lines and it
returns a number; the number is wrong, because the join multiplied the rows.
Chasm traps are resolved by computing each fact at its own grain, and INNER
fanning joins keep their filtering scope through an EXISTS rewrite rather than
double-counting.

An AI Analyst that shows its work. Every question runs a transparent loop —
plan, write SQL, execute, self-check, synthesise — and every stage is stored and
shown. Where the planner can express a step against a semantic model, the
compiler writes the SQL, so a governed metric is authoritative rather than
advisory; steps say which were governed and which were raw SQL. It asks instead
of guessing. Driver contribution, trend slopes and median/MAD outliers are
computed, not narrated — and too little history means no forecast at all rather
than a confident line through noise.

Verification that expires. A human verdict is pinned to a fingerprint of the
SQL it reviewed. Edit a step and the green tick voids itself: a badge must not
outlive what it vouched for.

Row and column security that follows the viewer. A grant carries a row
filter and a field mask, enforced before compilation so the filter becomes a
governed IN-clause inside the SQL — identical on DuckDB and every warehouse.
Values may be {{user.attribute}} tokens resolved per caller, and an
unresolvable token refuses the query rather than compiling an empty filter,
because silent zero rows read as "there is no data".

Embedded analytics, per customer. Your backend mints a short-lived HMAC
token naming a viewer's attributes; we verify it and turn those attributes into
row filters. Every failure is a 403 stating the reason, never a fallback to the
owner's unfiltered view. Widgets that cannot be scoped — because they
aggregated the scope column away — are withheld with the reason and the fix,
rather than rendered blank, which would read as "no data".

Embed the analyst itself, streamed. The full reasoning loop runs server-side
as the analyst's owner, bounded by the analyst's configured data scope. Its
generated SQL never reaches the browser. A turn takes 30–95s, so it streams: the
named stage and the stated approach land at about six seconds.

Aggregate awareness. Declare a rollup and the compiler routes to it only when
it can prove the answer is identical — then tells the reader which table
answered.

Object storage as a first-class source. Parquet described from its footer
rather than skipped, ORC support, an honest account of Avro, and a Parquet/CSV
bucket queryable straight from the Workbench. Per-dataset storage modes and a
mirror budget with least-recently-used eviction, where eviction costs speed and
never correctness.

---

Also in this release

• Metrics catalog — every governed metric, searchable by synonym, with what
  its certification actually covers and how fresh its data is. Usage never says
  "unused"; it says what was searched.
• Scan — trends, outliers and concentration across a dashboard's snapshots,
  computed with no model call. A scan that finds nothing reports how many widgets
  it examined, how many it could not, and the thresholds it applied.
• Certification, versions and dependents for semantic models, with
  certification blocked until validation passes clean.
• Fiscal and custom 4-4-5 calendars, parameters, hierarchies, currency, and
  period-over-period comparison across a multi-fact plan.
• Scheduled analyses that re-run pinned SQL rather than re-asking the
  question, with a digest that says plainly when nothing changed.
• Credential key rotation with envelope/key-id support, a full SECURITY.md,
  and a design for external KMS.

Security fixes

• The local SQL engine could read the server's filesystem.
• Blocked PII was still written to the trace in full.
• Refused warehouse queries were not audited, only successful ones.

Notable fixes

• Dashboard charts silently drew 50 of 364 rows.
• Spend totals read only the first 1000 trace rows.
• Headless runs were not billed at all.
• The BI narrator added up averages.
• The embedded Ask-AI answered from row-less stubs, because that path never
  hydrated the widget snapshots.
• Dialogs had no height bound or overflow, so a tall form grew off both edges of
  a laptop screen with no way to reach the submit button; and a popover inside a
  dialog could not be scrolled with a mouse, because the dialog's scroll lock
  cancelled wheel events outside its own subtree.

---

Upgrading

git pull
npx supabase db push   # 15 migrations
docker compose up --build

Nothing in this release requires a configuration change. Two optional
environment variables were added for dataset capacity, both unset by default:
PARQUET_MAX_ROWS (defaults to 5,000,000) and MIRROR_BUDGET_BYTES (defaults
to unlimited, so mirror eviction does not fire until you set a budget). See
.env.example.

Known limits

Stated plainly, because the alternative is you discovering them:

• Scale. Warehouse tables of any size are fine through the semantic layer,
  and prep flows that fold are fine. Importing a billion rows into a local
  dataset is not. There is no distributed in-memory engine; the warehouse is the
  engine. See docs/SCALE_AND_LIMITS.md.
• Embedded analyst latency. 30–95 seconds per question. It streams, so the
  wait is legible, but it is still a wait — set expectations on the page you
  embed it in.
• Signed viewers are dashboard-only. They filter stored results; an analyst
  writes fresh SQL each turn, so enforcement would cover the governed steps and
  not the rest. Partial enforcement is a badge that vouches for less than it
  appears to, so it is refused at the database rather than half-implemented.

AgentSwarms 1.1.0

AgentSwarms 1.1.0

Deployed swarms now serve a version you chose rather than whatever happens to be
on the canvas. Custom code runs in headless runs instead of the browser only.
There is a way to measure whether a change made a swarm better. And knowledge
bases gained the three retrieval features that were the real gap against Dify.

21 commits, 100 files, 9 migrations.

---

Highlights

Draft vs published for deployed swarms. Editing a swarm used to change what
its API keys served the moment you pressed Save — mid-experiment, at 3am, to
production callers. Version history made that recoverable, not preventable. The
canvas now edits a draft; API keys, schedules, sub-swarm calls and embeds
execute a pinned snapshot until you press Publish. The Deploy dialog shows
Draft ahead whenever the canvas has moved on, and the toolbar carries the
same badge so you don't have to open a dialog to find out.

Batch evaluations. Run a dataset of cases through a swarm and score every
output. The judge's own pass/fail is deliberately ignored and the verdict
recomputed from weighted per-metric scores — a model that grades and then
decides will contradict itself. A missing metric is a rejection, not a zero.

Custom components, and custom code in deployed runs. Author a snippet once
with a declared parameter schema and it appears in every swarm's palette;
bindings are snapshots, so editing the library cannot silently change a swarm
that already works. With the new sandbox profile, Function and component nodes
also run in deployed and scheduled runs — in a separate container with a fresh
V8 realm per call, an internal-only network, and no route back to the app.

RAG depth: parent-child chunking, Q&A indexing, hybrid retrieval. Small
chunks match precisely and large chunks let the model answer; parent-child stops
you having to choose. Q&A mode embeds a generated question, so a user's
question is compared against a question rather than against prose. And keyword
search now runs over the same chunks as vector search, fused by a weight you
control — previously it only ever looked at documents with no embeddings, so an
exact term inside an indexed document could never rescue a weak semantic match.

Observability → Monitoring. One row per service with status, response time
and the address that answered, plus live CPU, memory and disk. An optional
service you chose not to start reads "Not running" in grey with the command that
would start it — not a red "Down", because a status page that cries wolf is one
people stop opening. Memory reports the container's cgroup limit when there is
one, not the host's RAM.

--all actually installs everything. docker compose up brought up one
container; the setup scripts had no way to say "give me the whole product".
scripts/setup.sh --all (or setup.ps1 -All) now starts every profile.

---

Security

A cross-tenant hole let any authenticated user run another tenant's swarm.

The RLS policies on swarm_api_keys and swarm_schedules checked only that a
row belonged to you — never that the swarm it named did. Any signed-in user
could insert an API key row pointing at someone else's swarm_id, with a key
hash of their choosing, then call POST /api/swarm/run and receive that swarm's
output. The server function that mints keys did check ownership, but the anon key
is public by design and a direct PostgREST insert bypassed it entirely.

Verified against a live instance before fixing. Both halves of each policy now
require swarm ownership, and migration 20260813000000 removes any row already
created through the hole. If you self-host, upgrade.

---

Upgrading

git pull && npx supabase db push
docker compose up -d --build

AgentSwarms 1.0.0

AgentSwarms 1.0.0 is the first numbered release — a source-available, self-hosted platform for Unified Agentic AI and BI that runs on your own infrastructure: one stateless container, one Supabase project, your model keys.

What's in the box

• Agents & swarms — a visual agent builder (models, tools, knowledge, memory, guardrails, skills) and a multi-agent canvas with routers, conditions, loops, approvals and human-in-the-loop gates. Export any swarm as runnable LangGraph or Strands code.
• Knowledge & RAG — knowledge bases with pgvector retrieval, Graph RAG, and synced sources: Google Drive, Notion, SharePoint, Dropbox, plus files/URLs/GitHub — with scheduled ingestion, content-hash dedup, and source-ACL-aware retrieval.
• AI-native BI — dashboards with 19+ visual types, an AI analyst that writes and runs the SQL, scheduled refreshes and data alerts, semantic models with governed metrics, and a SQL workbench running DuckDB in the browser and on the server.
• Data connectors — 22 databases/warehouses (PostgreSQL, MySQL, Snowflake, BigQuery, Databricks, Redshift, ClickHouse and more) queried read-only in place, and 5 SaaS sources (Sheets, Stripe, Shopify, HubSpot, Salesforce) synced into datasets.
• Governance — IAM with groups, resource grants, row filters and column masks; per-principal model allow-lists with a default-deny option; monthly budget caps per user and group; a hash-chained, verifiable audit log; full execution traces with real cost attribution.
• Enterprise posture — AES-256-GCM credential encryption, SSRF-guarded egress, read-only SQL enforcement, SAML SSO, no telemetry or call-home (verified by tests), air-gap friendly (self-hosted fonts, models, wasm).

Highlights hardened on the way to 1.0

• The warehouse read-only guard now blocks data-modifying CTEs (WITH d AS (DELETE …) SELECT …) — both guards share one implementation, pinned by tests.
• CSV exports are formula-injection safe (CWE-1236); RLS is enabled and tested across all 96 tables; the embed widget honors agent table allow-lists.
• One SQL engine everywhere: DuckDB-Wasm in the browser (self-hosted binaries, /engine-check to verify a deployment).
• Trust pages (/architecture, /security, /license) are fact-checked against the code by CI.
• A full design pass: command palette (Ctrl/⌘-K), View-Transition navigation, consistent design system across every page.

Install

git clone https://github.com/AgentSwarms-fyi/agentswarms && cd agentswarms
# create a (free-tier) Supabase project, fill in .env — see docs/DEPLOYMENT.md
npx supabase db push
docker compose up

License

Source-available under the Elastic License 2.0: use it, modify it, run it for yourself and your clients freely; don't offer it as a hosted service. Plain-English FAQ: /license in the app or LICENSE.md.

Full details in CHANGELOG.md.