AgentSwarms 1.2.1

AgentSwarms 1.2.1

The app stopped presenting a read it had failed to make as a fact it knew.
Thirty-one modules were audited by recomputing every headline figure
independently from the database and comparing it against what the page claimed,
which is the only way this class of defect surfaces — a page that renders 0
looks exactly like a page that worked, and logs nothing either way. The
documentation was put through the same treatment against the running product,
and now carries search and two checkers that fail on drift.

82 commits, 234 files, 3 migrations.

---

Highlights

A discarded read error is not an empty account. Secrets, the skill library,
notebooks, the prompt library, MCP servers and the model registry each answered
a failed load by rendering the empty state — you have none — rather than we
could not tell. Every one of them now distinguishes the two and offers a retry.
The same shape appeared in worse clothes elsewhere: the MCP page published 0
tools, the monitoring page reported healthy over a probe set it had failed to
load, two lab pages awarded verdicts to work that never happened, and the audit
log manufactured evidence of absence — which is the worst possible page to do it
on.

The sharpest version of it argued for an action. A failed count on the model
registry did not merely misreport; it talked an admin into running a sync that
was not needed. A misreported number is a wrong answer, but a misreported number
attached to a call to action is a wrong instruction.

Capped views say they are capped. The analytics page reported a thousand
traces as though they were the population, the trace log presented its page as
the whole, and the analyst's 50-row cap could be reached with no disclosure.
Aggregates still run in the database and the cap only trims what is displayed —
the difference is that the page now says so.

The pages that held are written up too. /monitoring's refresh path, the trace
log's failed-read handling, Web Embedding, and the AI Analyst under direct
attack all survived the pass, documented at the same length as the ones that
failed. A log that records only faults says nothing about where the ground is
solid.

Slack, in both directions. The AI Analyst now answers in the channel where
the question was asked, with request signature verification, and a settings tab
means a workspace can be configured without inserting a row by hand. The
outbound notification webhook is unchanged; this is the other direction, and a
different trust problem.

Import a dbt project. Reads target/manifest.json — the file dbt writes on
every run, compile or docs build — and says plainly what could not come across.
A team that already runs dbt has months of model descriptions, column docs and
MetricFlow measures; asking them to retype it into a form is why define your
metrics in our UI loses to a YAML file in git.

A pull request that breaks a metric now fails. Git export already wrote every
semantic model as JSON, and nothing read those files back — so a broken governed
metric surfaced later as a refusal at query time, in front of whoever asked the
question rather than whoever made the change.

Skills load on demand once they outgrow the prompt. Every attached skill used
to be pasted into the system prompt in full on every turn. Below
SKILLS_INLINE_MAX_CHARS (default 8000) that is still exactly what happens;
above it the prompt carries an index of names and summaries and the agent pulls
the body it needs through a use_skill tool. Swarms are unaffected — the
headless executor sends no skill ids.

---

Also in this release

• Generate a whole dashboard from a governed semantic model, not only from
  source tables.
• Export a dashboard as a branded PowerPoint deck whose numbers are the
  dashboard's, with a per-visual checklist, a model picker and a free-text
  instruction field for tone and audience.
• @agentswarms/react — a React SDK alternative to iframe embeds, for host
  apps that want their own message rendering, their own theme, or programmatic
  control over the stream, citations and Visual-BI widgets.
• One command from nothing to a running stack. The self-hosted Supabase path
  was fully documented and fully manual — JWT secret, two signed keys, the
  storage-boot caveat, the extension preflight, five values wired into .env by
  hand. It is now scripted.
• Synced data is filed under the source it came from, and can be operated
  from there.
• Chats can be renamed in place, and a per-chat Tools menu turns on web
  search for one conversation without changing the agent.
• Documentation: 27 pages audited against the running product, search across
  378 headings, subsections in the on-this-page rail, 28 previously undocumented
  tuning variables, scenario guides for swarm shapes and RAG configurations, and
  two checkers (check:docs, check:md-docs) that fail on drift.

---

Security fixes

• Three injection paths closed in the agent and swarm code exporters. The
  exporters turn a saved graph into a Python or TypeScript file the user is told
  to run, and a swarm can arrive from anyone as a dropped .swarm.json that is
  one click from the export menu — which makes every interpolated value
  untrusted. Numeric fields are coerced rather than pasted, labels are sanitised
  before they reach docstrings, and tool configs are redacted instead of being
  serialised with credentials intact.
• An API key scoped to everything now says so. Scope rendered as · N tools
  or as nothing at all, so the most powerful key on the page was the one with
  nothing written on it.

---

Notable fixes

• Every response from a conformant MCP server was unreadable, reported as a
  server that "did not start in time". It had started.
• A swarm's deployed badge tracked whether a deploy was once clicked, not
  whether traffic can actually arrive.
• Importing an agent into a swarm dropped the settings that restrict it.
• A retrieval that found nothing was passed over in silence instead of being
  told to the model.
• Local datasets were stamped "crawled a minute ago" weeks after they were
  loaded.
• A semantic model decertified on most definition changes, not all of them.
• The dashboard card headed "last 24h" did not describe the last 24 hours.
• The BI toolbar could not reach its last action — twelve buttons, 1175px, in a
  nested non-wrapping flex item on a row that did wrap, which is why it survived
  inspection.
• Provider-reported cost now replaces the vendored price table wherever the
  provider supplies it. Reported as "kimi k3 shows 0 cost", which it did on all
  116 runs: the model postdated the catalog, so the resolver was correctly
  answering that it had no price.
• One 403 claimed "no providers connected" for a whole session, in a shared
  module, so the fix lands on two pages.

---

Upgrading

git pull
npx supabase db push   # 3 migrations
docker compose up --build

Nothing in this release requires a configuration change. Two optional
environment variables were added, both unset by default:

• SKILLS_INLINE_MAX_CHARS — the size at which attached skills switch from
  inline to on-demand loading. Defaults to 8000, which keeps all six bundled
  sample skills inline; existing agents behave exactly as before unless you
  lower it.
• GITHUB_TOKEN — only needed for the semantic-layer pull request check.

Slack needs no environment variables: the workspace is configured in the app,
under Integrations.

Known limits

Stated plainly, because the alternative is you discovering them:

• Scale. Warehouse tables of any size are fine through the semantic layer,
  and prep flows that fold are fine. Importing a billion rows into a local
  dataset is not. There is no distributed in-memory engine; the warehouse is the
  engine. See docs/SCALE_AND_LIMITS.md.
• Embedded analyst latency. 30–95 seconds per question. It streams, so the
  wait is legible, but it is still a wait.
• Signed viewers are dashboard-only. They filter stored results; an analyst
  writes fresh SQL each turn, so enforcement would cover the governed steps and
  not the rest. Partial enforcement is a badge that vouches for less than it
  appears to.
• The adversarial pass has a hole in it. It covered the thirty-one mapped
  modules, but streaming, tool calls and guardrails in Agent Chat were exercised
  only in part — a budget cap blocked live model turns at the time. They are
  recorded as uncovered rather than left looking as though they passed.