@automagik/omni 2.260713.4 → 2.260714.2

package/db/drizzle/0039_instances_message_supersede_mode.sql

@@ -0,0 +1,19 @@
+-- Per-instance stale-reply policy for the agent dispatcher.
+--
+-- Adds `instances.message_supersede_mode` ('off' | 'discard', default 'off').
+-- When 'discard', an agent reply whose input snapshot is already stale — i.e.
+-- newer inbound arrived for the chat while the agent was still running — is
+-- dropped instead of delivered. The message debouncer's finally-block re-flush
+-- then dispatches the buffered messages immediately, so the follow-up run
+-- answers everything with full context and the user never receives an
+-- out-of-date reply (e.g. a question they already answered).
+--
+-- Default 'off' preserves current delivery behavior for every existing
+-- instance. See `isReplySuperseded` and the gates in
+-- packages/api/src/plugins/agent-dispatcher.ts.
+--
+-- Hand-written (not `drizzle-kit generate`) to avoid the gupshup column
+-- rename prompts that block non-interactive runs in this repo.
+
+ALTER TABLE "instances"
+  ADD COLUMN IF NOT EXISTS "message_supersede_mode" varchar(20) DEFAULT 'off' NOT NULL;

package/db/drizzle/meta/_journal.json

@@ -274,6 +274,13 @@
       "when": 1778040000000,
       "tag": "0038_instances_allow_first_party",
       "breakpoints": true
+    },
+    {
+      "idx": 39,
+      "version": "7",
+      "when": 1783900800000,
+      "tag": "0039_instances_message_supersede_mode",
+      "breakpoints": true
     }
   ]
 }

package/dist/index.js

@@ -31827,12 +31827,13 @@ var init_guild_config = __esm(() => {
 });
 
 // ../core/src/schemas/instance.ts
-var DebounceModeSchema, SplitDelayModeSchema, AgentTypeSchema, AgentProviderSchema, CreateAgentProviderSchema, InstanceSchema, CreateInstanceSchema, InstanceStatusSchema;
+var DebounceModeSchema, SplitDelayModeSchema, SupersedeModeSchema, AgentTypeSchema, AgentProviderSchema, CreateAgentProviderSchema, InstanceSchema, CreateInstanceSchema, InstanceStatusSchema;
 var init_instance = __esm(() => {
   init_zod();
   init_common();
   DebounceModeSchema = exports_external.enum(["disabled", "fixed", "randomized"]);
   SplitDelayModeSchema = exports_external.enum(["disabled", "fixed", "randomized"]);
+  SupersedeModeSchema = exports_external.enum(["off", "discard"]);
   AgentTypeSchema = exports_external.enum(["agent", "team", "workflow"]);
   AgentProviderSchema = exports_external.object({
     id: UuidSchema,
@@ -31904,6 +31905,7 @@ var init_instance = __esm(() => {
     messageDebounceMode: DebounceModeSchema,
     messageDebounceMinMs: exports_external.number().int().min(0),
     messageDebounceMaxMs: exports_external.number().int().min(0),
+    messageSupersedeMode: SupersedeModeSchema,
     messageSplitDelayMode: SplitDelayModeSchema,
     messageSplitDelayFixedMs: exports_external.number().int().min(0),
     messageSplitDelayMinMs: exports_external.number().int().min(0),
@@ -65853,6 +65855,7 @@ __export(exports_src, {
   UpdateAgentRouteSchema: () => UpdateAgentRouteSchema,
   TimestampSchema: () => TimestampSchema,
   SystemEventSchemas: () => SystemEventSchemas,
+  SupersedeModeSchema: () => SupersedeModeSchema,
   SubscriptionManager: () => SubscriptionManager,
   SplitDelayModeSchema: () => SplitDelayModeSchema,
   SettingValueTypeSchema: () => SettingValueTypeSchema,
@@ -71274,6 +71277,7 @@ __export(exports_schema, {
   syncJobsRelations: () => syncJobsRelations,
   syncJobs: () => syncJobs,
   syncJobTypes: () => syncJobTypes,
+  supersedeMode: () => supersedeMode,
   splitDelayMode: () => splitDelayMode,
   settingValueTypes: () => settingValueTypes,
   settingChangeHistoryRelations: () => settingChangeHistoryRelations,
@@ -71363,7 +71367,7 @@ __export(exports_schema, {
   accessRules: () => accessRules,
   accessModes: () => accessModes
 });
-var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts;
+var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts;
 var init_schema2 = __esm(() => {
   init_events();
   init_drizzle_orm();
@@ -71384,13 +71388,23 @@ var init_schema2 = __esm(() => {
   agentEntityTypes = ["assistant", "workflow", "team", "tool"];
   debounceMode = ["disabled", "fixed", "randomized", "presence"];
   splitDelayMode = ["disabled", "fixed", "randomized"];
+  supersedeMode = ["off", "discard"];
   replyFilterMode = ["all", "filtered"];
   agentSessionStrategies = ["per_user", "per_chat", "per_thread"];
   ruleTypes = ["allow", "deny", "pending_pairing"];
   accessModes = ["disabled", "blocklist", "allowlist"];
   settingValueTypes = ["string", "integer", "boolean", "json", "secret"];
   apiKeyStatuses = ["active", "revoked", "expired"];
-  apiKeyProfiles = ["cs", "personal", "scout", "coworker", "admin"];
+  apiKeyProfiles = [
+    "cs",
+    "personal",
+    "scout",
+    "coworker",
+    "admin",
+    "console-viewer",
+    "console-operator",
+    "console-admin"
+  ];
   eventTypes = CORE_EVENT_TYPES;
   contentTypes = [
     "text",
@@ -71673,6 +71687,7 @@ var init_schema2 = __esm(() => {
     messageDebounceMaxMs: integer("message_debounce_max_ms").notNull().default(0),
     messageDebounceRestartOnTyping: boolean("message_debounce_restart_on_typing").notNull().default(false),
     messageDebounceMaxWaitMs: integer("message_debounce_max_wait_ms"),
+    messageSupersedeMode: varchar("message_supersede_mode", { length: 20 }).notNull().default("off").$type(),
     agentGateEnabled: boolean("agent_gate_enabled").notNull().default(false),
     agentGateModel: varchar("agent_gate_model", { length: 120 }),
     agentGatePrompt: text("agent_gate_prompt"),
@@ -73413,8 +73428,80 @@ var init_api_keys = __esm(() => {
 });
 
 // ../api/src/constants/profiles.ts
-var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", PROFILES;
+var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", CONSOLE_READ_SCOPES, CONSOLE_OPERATE_SCOPES, CONSOLE_ADMINISTRATION_SCOPES, CONSOLE_VIEWER_SCOPES, CONSOLE_OPERATOR_SCOPES, CONSOLE_ADMIN_SCOPES, PROFILES;
 var init_profiles = __esm(() => {
+  CONSOLE_READ_SCOPES = [
+    "access:read",
+    "agent-state:read",
+    "agent-tasks:read",
+    "agents:read",
+    "auth:validate",
+    "automations:read",
+    "batch-jobs:read",
+    "chats:read",
+    "context:read",
+    "conversations:read",
+    "dead-letters:read",
+    "event-ops:read",
+    "events:read",
+    "follow-up:read",
+    "handoffs:read",
+    "instances:read",
+    "journeys:read",
+    "logs:read",
+    "media:read",
+    "messages:read",
+    "metrics:read",
+    "payloads:read",
+    "persons:read",
+    "providers:read",
+    "routes:read",
+    "settings:read",
+    "trust:read",
+    "voice:read",
+    "webhooks:read"
+  ];
+  CONSOLE_OPERATE_SCOPES = [
+    "agent-state:write",
+    "agent-tasks:write",
+    "automations:write",
+    "batch-jobs:write",
+    "chats:write",
+    "context:write",
+    "conversations:write",
+    "dead-letters:write",
+    "event-ops:write",
+    "events:write",
+    "follow-up:write",
+    "instances:write",
+    "media:write",
+    "messages:send",
+    "messages:write",
+    "persons:write",
+    "routes:write",
+    "tts:synthesize",
+    "turns:admin",
+    "turns:close",
+    "voice:write"
+  ];
+  CONSOLE_ADMINISTRATION_SCOPES = [
+    "access:write",
+    "agents:write",
+    "keys:read",
+    "keys:write",
+    "payloads:write",
+    "providers:write",
+    "settings:write",
+    "trust:write",
+    "webhooks:write"
+  ];
+  CONSOLE_VIEWER_SCOPES = [...CONSOLE_READ_SCOPES];
+  CONSOLE_OPERATOR_SCOPES = [...CONSOLE_READ_SCOPES, ...CONSOLE_OPERATE_SCOPES];
+  CONSOLE_ADMIN_SCOPES = [
+    ...CONSOLE_READ_SCOPES,
+    ...CONSOLE_OPERATE_SCOPES,
+    ...CONSOLE_ADMINISTRATION_SCOPES
+  ];
   PROFILES = {
     cs: {
       buckets: ["outgoing", "read", "context", "turn"],
@@ -73445,6 +73532,27 @@ var init_profiles = __esm(() => {
       buckets: ["outgoing", "read", "context", "turn", "multimodal_in", "multimodal_out"],
       requiresLocks: [],
       adminOnlyFlag: true
+    },
+    "console-viewer": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_VIEWER_SCOPES
+      }
+    },
+    "console-operator": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_OPERATOR_SCOPES
+      }
+    },
+    "console-admin": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_ADMIN_SCOPES
+      }
     }
   };
 });
@@ -125056,7 +125164,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260713.4",
+  version: "2.260714.2",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -23757,12 +23757,13 @@ var init_guild_config = __esm(() => {
 });
 
 // ../core/src/schemas/instance.ts
-var DebounceModeSchema, SplitDelayModeSchema, AgentTypeSchema, AgentProviderSchema, CreateAgentProviderSchema, InstanceSchema, CreateInstanceSchema, InstanceStatusSchema;
+var DebounceModeSchema, SplitDelayModeSchema, SupersedeModeSchema, AgentTypeSchema, AgentProviderSchema, CreateAgentProviderSchema, InstanceSchema, CreateInstanceSchema, InstanceStatusSchema;
 var init_instance = __esm(() => {
   init_zod();
   init_common();
   DebounceModeSchema = exports_external.enum(["disabled", "fixed", "randomized"]);
   SplitDelayModeSchema = exports_external.enum(["disabled", "fixed", "randomized"]);
+  SupersedeModeSchema = exports_external.enum(["off", "discard"]);
   AgentTypeSchema = exports_external.enum(["agent", "team", "workflow"]);
   AgentProviderSchema = exports_external.object({
     id: UuidSchema,
@@ -23834,6 +23835,7 @@ var init_instance = __esm(() => {
     messageDebounceMode: DebounceModeSchema,
     messageDebounceMinMs: exports_external.number().int().min(0),
     messageDebounceMaxMs: exports_external.number().int().min(0),
+    messageSupersedeMode: SupersedeModeSchema,
     messageSplitDelayMode: SplitDelayModeSchema,
     messageSplitDelayFixedMs: exports_external.number().int().min(0),
     messageSplitDelayMinMs: exports_external.number().int().min(0),
@@ -225881,7 +225883,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260713.4",
+    version: "2.260714.2",
     type: "module",
     exports: {
       ".": {
@@ -278015,6 +278017,7 @@ __export(exports_schema, {
   syncJobsRelations: () => syncJobsRelations,
   syncJobs: () => syncJobs,
   syncJobTypes: () => syncJobTypes,
+  supersedeMode: () => supersedeMode,
   splitDelayMode: () => splitDelayMode,
   settingValueTypes: () => settingValueTypes,
   settingChangeHistoryRelations: () => settingChangeHistoryRelations,
@@ -278104,7 +278107,7 @@ __export(exports_schema, {
   accessRules: () => accessRules,
   accessModes: () => accessModes
 });
-var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts;
+var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts;
 var init_schema2 = __esm(() => {
   init_events();
   init_drizzle_orm();
@@ -278125,13 +278128,23 @@ var init_schema2 = __esm(() => {
   agentEntityTypes = ["assistant", "workflow", "team", "tool"];
   debounceMode = ["disabled", "fixed", "randomized", "presence"];
   splitDelayMode = ["disabled", "fixed", "randomized"];
+  supersedeMode = ["off", "discard"];
   replyFilterMode = ["all", "filtered"];
   agentSessionStrategies = ["per_user", "per_chat", "per_thread"];
   ruleTypes = ["allow", "deny", "pending_pairing"];
   accessModes = ["disabled", "blocklist", "allowlist"];
   settingValueTypes = ["string", "integer", "boolean", "json", "secret"];
   apiKeyStatuses = ["active", "revoked", "expired"];
-  apiKeyProfiles = ["cs", "personal", "scout", "coworker", "admin"];
+  apiKeyProfiles = [
+    "cs",
+    "personal",
+    "scout",
+    "coworker",
+    "admin",
+    "console-viewer",
+    "console-operator",
+    "console-admin"
+  ];
   eventTypes = CORE_EVENT_TYPES;
   contentTypes = [
     "text",
@@ -278414,6 +278427,7 @@ var init_schema2 = __esm(() => {
     messageDebounceMaxMs: integer("message_debounce_max_ms").notNull().default(0),
     messageDebounceRestartOnTyping: boolean("message_debounce_restart_on_typing").notNull().default(false),
     messageDebounceMaxWaitMs: integer("message_debounce_max_wait_ms"),
+    messageSupersedeMode: varchar("message_supersede_mode", { length: 20 }).notNull().default("off").$type(),
     agentGateEnabled: boolean("agent_gate_enabled").notNull().default(false),
     agentGateModel: varchar("agent_gate_model", { length: 120 }),
     agentGatePrompt: text("agent_gate_prompt"),
@@ -285026,8 +285040,80 @@ var init_genie_signature = __esm(() => {
 });
 
 // ../api/src/constants/profiles.ts
-var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", PROFILES;
+var COWORKER_DEFAULT_DENYLIST_PRESET_KEY = "khal-os-core", CONSOLE_READ_SCOPES, CONSOLE_OPERATE_SCOPES, CONSOLE_ADMINISTRATION_SCOPES, CONSOLE_VIEWER_SCOPES, CONSOLE_OPERATOR_SCOPES, CONSOLE_ADMIN_SCOPES, PROFILES;
 var init_profiles = __esm(() => {
+  CONSOLE_READ_SCOPES = [
+    "access:read",
+    "agent-state:read",
+    "agent-tasks:read",
+    "agents:read",
+    "auth:validate",
+    "automations:read",
+    "batch-jobs:read",
+    "chats:read",
+    "context:read",
+    "conversations:read",
+    "dead-letters:read",
+    "event-ops:read",
+    "events:read",
+    "follow-up:read",
+    "handoffs:read",
+    "instances:read",
+    "journeys:read",
+    "logs:read",
+    "media:read",
+    "messages:read",
+    "metrics:read",
+    "payloads:read",
+    "persons:read",
+    "providers:read",
+    "routes:read",
+    "settings:read",
+    "trust:read",
+    "voice:read",
+    "webhooks:read"
+  ];
+  CONSOLE_OPERATE_SCOPES = [
+    "agent-state:write",
+    "agent-tasks:write",
+    "automations:write",
+    "batch-jobs:write",
+    "chats:write",
+    "context:write",
+    "conversations:write",
+    "dead-letters:write",
+    "event-ops:write",
+    "events:write",
+    "follow-up:write",
+    "instances:write",
+    "media:write",
+    "messages:send",
+    "messages:write",
+    "persons:write",
+    "routes:write",
+    "tts:synthesize",
+    "turns:admin",
+    "turns:close",
+    "voice:write"
+  ];
+  CONSOLE_ADMINISTRATION_SCOPES = [
+    "access:write",
+    "agents:write",
+    "keys:read",
+    "keys:write",
+    "payloads:write",
+    "providers:write",
+    "settings:write",
+    "trust:write",
+    "webhooks:write"
+  ];
+  CONSOLE_VIEWER_SCOPES = [...CONSOLE_READ_SCOPES];
+  CONSOLE_OPERATOR_SCOPES = [...CONSOLE_READ_SCOPES, ...CONSOLE_OPERATE_SCOPES];
+  CONSOLE_ADMIN_SCOPES = [
+    ...CONSOLE_READ_SCOPES,
+    ...CONSOLE_OPERATE_SCOPES,
+    ...CONSOLE_ADMINISTRATION_SCOPES
+  ];
   PROFILES = {
     cs: {
       buckets: ["outgoing", "read", "context", "turn"],
@@ -285058,6 +285144,27 @@ var init_profiles = __esm(() => {
       buckets: ["outgoing", "read", "context", "turn", "multimodal_in", "multimodal_out"],
       requiresLocks: [],
       adminOnlyFlag: true
+    },
+    "console-viewer": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_VIEWER_SCOPES
+      }
+    },
+    "console-operator": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_OPERATOR_SCOPES
+      }
+    },
+    "console-admin": {
+      buckets: [],
+      requiresLocks: [],
+      defaultOverrides: {
+        extraScopes: CONSOLE_ADMIN_SCOPES
+      }
     }
   };
 });
@@ -285415,6 +285522,17 @@ var init_scopes = __esm(() => {
     "POST /events/search": "events:read",
     "GET /events/:id": "events:read",
     "GET /events/by-sender/:senderId": "events:read",
+    "GET /follow-up/agents/:id": "follow-up:read",
+    "PUT /follow-up/agents/:id": "follow-up:write",
+    "DELETE /follow-up/agents/:id": "follow-up:write",
+    "GET /follow-up/instances/:id": "follow-up:read",
+    "PUT /follow-up/instances/:id": "follow-up:write",
+    "DELETE /follow-up/instances/:id": "follow-up:write",
+    "GET /follow-up/chats/:id": "follow-up:read",
+    "PUT /follow-up/chats/:id": "follow-up:write",
+    "DELETE /follow-up/chats/:id": "follow-up:write",
+    "GET /handoffs": "handoffs:read",
+    "GET /handoffs/:id": "handoffs:read",
     "GET /instances": "instances:read",
     "GET /instances/supported-channels": "instances:read",
     "GET /instances/:id": "instances:read",
@@ -285548,6 +285666,15 @@ var init_scopes = __esm(() => {
     "POST /turns/:id/close": "turns:admin",
     "POST /turns/close-all": "turns:admin",
     "POST /turns/close": "turns:close",
+    "POST /trust/handshake": "trust:write",
+    "GET /trust/hosts": "trust:read",
+    "GET /trust/hosts/:id": "trust:read",
+    "PATCH /trust/hosts/:id": "trust:write",
+    "DELETE /trust/hosts/:id": "trust:write",
+    "POST /voice/join": "voice:write",
+    "POST /voice/leave": "voice:write",
+    "GET /voice/sessions": "voice:read",
+    "GET /voice/sessions/:id": "voice:read",
     "GET /webhook-sources": "webhooks:read",
     "GET /webhook-sources/:id": "webhooks:read",
     "POST /webhook-sources": "webhooks:write",
@@ -338233,6 +338360,9 @@ class MessageDebouncer {
       return;
     this.restartTimer(chatKey, config4);
   }
+  hasPending(instanceId, chatId) {
+    return (this.buffers.get(this.getChatKey(instanceId, chatId))?.length ?? 0) > 0;
+  }
   onUserTyping(instanceId, chatId, config4) {
     const chatKey = this.getChatKey(instanceId, chatId);
     if (this.inFlight.has(chatKey))
@@ -339188,6 +339318,13 @@ class ReactionDedup {
     return false;
   }
 }
+function hasPendingInbound(instanceId, chatId) {
+  return activeMessageDebouncer?.hasPending(instanceId, chatId) ?? false;
+}
+function isReplySuperseded(instance4, chatId) {
+  const mode = instance4.messageSupersedeMode ?? "off";
+  return mode === "discard" && hasPendingInbound(instance4.id, chatId);
+}
 function getDebounceConfig(instance4) {
   const mode = instance4.messageDebounceMode ?? "disabled";
   const isPresence = mode === "presence";
@@ -339363,6 +339500,11 @@ async function triggerErrorHandoff(services, db2, channel5, instance4, chatId, m
   log101.info("agent_dispatch_error_handoff", { instanceId: instance4.id, chatId, channel: channel5 });
   return true;
 }
+async function maybeTriggerErrorHandoff(services, db2, channel5, instance4, chatId, customerErrorBlocked, handoffTriggered) {
+  if (!customerErrorBlocked || handoffTriggered)
+    return false;
+  return triggerErrorHandoff(services, db2, channel5, instance4, chatId, resolveErrorHandoffMessage());
+}
 async function handleDispatchFailure(services, db2, channel5, instance4, chatId, error3) {
   const handedOff = await triggerErrorHandoff(services, db2, channel5, instance4, chatId, resolveErrorHandoffMessage());
   if (handedOff)
@@ -340509,11 +340651,9 @@ async function dispatchViaProvider(services, instance4, messages4, triggerType,
     }
     const chatAfterRun = await services.chats.findByExternalIdSmart(instance4.id, chatId);
     const handoffTriggered = chatAfterRun?.settings?.agentPaused === true;
-    let errorHandoffDone = false;
-    if (result?.metadata.customerErrorBlocked === true && !handoffTriggered) {
-      errorHandoffDone = await triggerErrorHandoff(services, db2, channel5, instance4, chatId, resolveErrorHandoffMessage());
-    }
-    if (result && result.parts.length > 0 && !handoffTriggered && !errorHandoffDone) {
+    const supersededByNewerInbound = !handoffTriggered && isReplySuperseded(instance4, chatId);
+    const errorHandoffDone = await maybeTriggerErrorHandoff(services, db2, channel5, instance4, chatId, result?.metadata.customerErrorBlocked === true, handoffTriggered);
+    if (result && result.parts.length > 0 && !handoffTriggered && !errorHandoffDone && !supersededByNewerInbound) {
       const selfChat = isSelfChat(chatId, instance4.ownerIdentifier);
       const rawParts = selfChat ? result.parts.map((p2) => `${BOT_PREFIX}${p2}`) : result.parts;
       const parts = await Promise.all(rawParts.map((part) => executeBeforeMessageWriteHooks(instance4.id, chatId, part)));
@@ -340534,6 +340674,13 @@ async function dispatchViaProvider(services, instance4, messages4, triggerType,
         instanceId: instance4.id,
         chatId
       });
+    } else if (supersededByNewerInbound) {
+      log101.info("Agent response discarded \u2014 superseded by newer inbound", {
+        instanceId: instance4.id,
+        chatId,
+        parts: result?.parts.length ?? 0,
+        traceId
+      });
     }
     log101.info("Agent response via IAgentProvider", {
       instanceId: instance4.id,
@@ -340606,6 +340753,15 @@ async function dispatchViaLegacy(services, instance4, messages4, triggerType, ch
     files: mediaFiles.length > 0 ? mediaFiles : undefined
   }));
   const correlationId = messages4[0]?.metadata.correlationId;
+  if (isReplySuperseded(instance4, chatId)) {
+    log101.info("Agent response discarded \u2014 superseded by newer inbound", {
+      instanceId: instance4.id,
+      chatId,
+      parts: result.parts.length,
+      traceId
+    });
+    return;
+  }
   const selfChat = isSelfChat(chatId, instance4.ownerIdentifier);
   const rawParts = selfChat ? result.parts.map((p2) => `${BOT_PREFIX}${p2}`) : result.parts;
   const parts = await Promise.all(rawParts.map((part) => executeBeforeMessageWriteHooks(instance4.id, chatId, part)));
@@ -341932,6 +342088,7 @@ async function setupAgentDispatcher(eventBus, services, db2) {
     }
     await processAgentResponse(services, instance4, messages4, triggerType, db2, eventBus);
   });
+  activeMessageDebouncer = debouncer;
   try {
     await eventBus.subscribe("message.received", async (event) => {
       const payload = event.payload;
@@ -342145,7 +342302,7 @@ async function setupAgentDispatcher(eventBus, services, db2) {
     log101.info("Agent dispatcher shutdown complete");
   };
 }
-var import_api32, log101, agentDispatchLimiter, _natsGenieProviderCtor, QUOTED_MESSAGE_MAX_CHARS = 4000, DM_HISTORY_LIMIT = 20, LIFECYCLE_PREVIEW_MAX_CHARS = 160, LIFECYCLE_SENSITIVE_KEY_PARTS, PRESENCE_DEFAULT_MIN_MS = 5000, PRESENCE_DEFAULT_MAX_WAIT_MS = 30000, DEFAULT_DISPATCH_ERROR_MESSAGE = "\u26A0\uFE0F Sorry, I ran into an issue processing your message. Please try again.", DEFAULT_ERROR_HANDOFF_MESSAGE = "T\xF4 com um probleminha t\xE9cnico aqui agora. Logo algu\xE9m do time vai entrar em contato com voc\xEA.", TRANSIENT_DISPATCH_ERROR_PATTERNS, TRANSIENT_DISPATCH_RETRY_DELAYS_MS, CHANNEL_MESSAGE_LIMITS, DEFAULT_MESSAGE_LIMIT = 4000, MEDIA_BASE_PATH3, MEDIA_ICONS, MEDIA_WAIT_NULL, mediaCompletions, mediaResultCache, MEDIA_WAIT_TIMEOUT_MS = 30000, DEFAULT_SEND_MEDIA_PATH_TYPES, BOT_PREFIX = "\uD83E\uDD16 ", activeStreams, sessionActivityStore, PROC_REACT_START, PROC_REACT_DONE = "\u2705", providerCache, openclawClientPool, nullFilterWarnedInstances, ACTIVE_OWNER_IDENTIFIER_CACHE_TTL_MS = 1e4, cachedActiveOwnerIdentifiers = null, cachedActiveOwnerIdentifiersAt = 0, DEFAULT_GATE_MODEL = "gemini-3-flash-preview", GATE_TIMEOUT_MS = 3000, setupAgentResponder;
+var import_api32, log101, agentDispatchLimiter, _natsGenieProviderCtor, QUOTED_MESSAGE_MAX_CHARS = 4000, DM_HISTORY_LIMIT = 20, LIFECYCLE_PREVIEW_MAX_CHARS = 160, LIFECYCLE_SENSITIVE_KEY_PARTS, PRESENCE_DEFAULT_MIN_MS = 5000, PRESENCE_DEFAULT_MAX_WAIT_MS = 30000, activeMessageDebouncer = null, DEFAULT_DISPATCH_ERROR_MESSAGE = "\u26A0\uFE0F Sorry, I ran into an issue processing your message. Please try again.", DEFAULT_ERROR_HANDOFF_MESSAGE = "T\xF4 com um probleminha t\xE9cnico aqui agora. Logo algu\xE9m do time vai entrar em contato com voc\xEA.", TRANSIENT_DISPATCH_ERROR_PATTERNS, TRANSIENT_DISPATCH_RETRY_DELAYS_MS, CHANNEL_MESSAGE_LIMITS, DEFAULT_MESSAGE_LIMIT = 4000, MEDIA_BASE_PATH3, MEDIA_ICONS, MEDIA_WAIT_NULL, mediaCompletions, mediaResultCache, MEDIA_WAIT_TIMEOUT_MS = 30000, DEFAULT_SEND_MEDIA_PATH_TYPES, BOT_PREFIX = "\uD83E\uDD16 ", activeStreams, sessionActivityStore, PROC_REACT_START, PROC_REACT_DONE = "\u2705", providerCache, openclawClientPool, nullFilterWarnedInstances, ACTIVE_OWNER_IDENTIFIER_CACHE_TTL_MS = 1e4, cachedActiveOwnerIdentifiers = null, cachedActiveOwnerIdentifiersAt = 0, DEFAULT_GATE_MODEL = "gemini-3-flash-preview", GATE_TIMEOUT_MS = 3000, setupAgentResponder;
 var init_agent_dispatcher = __esm(() => {
   init_src2();
   init_src();
@@ -354545,6 +354702,7 @@ var init_instances3 = __esm(() => {
     messageDebounceRestartOnTyping: exports_external.boolean().default(false).describe("Restart debounce timer when user is typing"),
     messageDebounceGroupMs: exports_external.number().int().min(0).nullable().default(null).describe("Debounce delay for group chats in milliseconds (null = use messageDebounceMinMs)"),
     messageDebounceMaxWaitMs: exports_external.number().int().min(0).nullable().default(null).describe("Presence-mode hard cap in milliseconds \u2014 flush at firstBuffered + this even under continuous typing (null = no cap)"),
+    messageSupersedeMode: exports_external.enum(["off", "discard"]).default("off").describe("Stale-reply policy: 'discard' drops an agent reply when newer inbound arrived while the agent was running (the debounced re-flush answers with full context); 'off' keeps legacy behavior"),
     messageSplitDelayMode: exports_external.enum(["disabled", "fixed", "randomized"]).default("randomized").describe("Between-chunk delay when agent responses are split into multiple messages"),
     messageSplitDelayFixedMs: exports_external.number().int().min(0).default(0).describe('Fixed delay between split chunks in milliseconds (used when messageSplitDelayMode="fixed")'),
     messageSplitDelayMinMs: exports_external.number().int().min(0).default(300).describe('Minimum delay between split chunks in milliseconds (used when messageSplitDelayMode="randomized")'),
@@ -356594,6 +356752,18 @@ function normalizeOverrides(overrides) {
     denylistPresetKey: overrides.denylistPresetKey === null ? undefined : overrides.denylistPresetKey
   };
 }
+function enforceMintCeiling(c, requestedScopes) {
+  const callerScopes = c.get("apiKey")?.scopes ?? [];
+  const exceeding = requestedScopes.filter((scope) => !ApiKeyService.scopeAllows(callerScopes, scope));
+  if (exceeding.length === 0)
+    return null;
+  return c.json({
+    error: {
+      code: "FORBIDDEN",
+      message: `Cannot mint a key whose scopes exceed the caller's own. Disallowed: ${exceeding.join(", ")}`
+    }
+  }, 403);
+}
 async function handleProfileCreate(c, data, services) {
   try {
     const resolved = resolveProfile({
@@ -356605,6 +356775,9 @@ async function handleProfileCreate(c, data, services) {
       overrides: normalizeOverrides(data.overrides),
       denylistPresetKey: data.denylistPresetKey
     });
+    const ceilingDenied = enforceMintCeiling(c, resolved.scopes);
+    if (ceilingDenied)
+      return ceilingDenied;
     const result = await services.apiKeys.create({
       name: data.name,
       description: data.description,
@@ -356637,6 +356810,9 @@ async function handleLegacyCreate(c, data, services) {
   if (!data.scopes || data.scopes.length === 0) {
     return c.json({ error: { code: "VALIDATION_ERROR", message: "scopes is required when no profile is supplied" } }, 400);
   }
+  const ceilingDenied = enforceMintCeiling(c, data.scopes);
+  if (ceilingDenied)
+    return ceilingDenied;
   const result = await services.apiKeys.create({
     name: data.name,
     description: data.description,
@@ -356655,8 +356831,17 @@ var init_keys = __esm(() => {
   init_zod();
   init_resolve_profile();
   init_date_query();
+  init_api_keys();
   keysRoutes = new Hono2;
-  NON_ADMIN_PROFILES = ["cs", "personal", "scout", "coworker"];
+  NON_ADMIN_PROFILES = [
+    "cs",
+    "personal",
+    "scout",
+    "coworker",
+    "console-viewer",
+    "console-operator",
+    "console-admin"
+  ];
   profileOverridesSchema = exports_external.object({
     add: exports_external.array(exports_external.string()).optional(),
     remove: exports_external.array(exports_external.string()).optional(),
@@ -356670,7 +356855,7 @@ var init_keys = __esm(() => {
     instanceIds: exports_external.array(exports_external.string().uuid()).optional().describe("Restrict key to specific instance IDs"),
     rateLimit: exports_external.number().int().positive().optional().describe("Rate limit in requests per minute"),
     expiresAt: exports_external.string().datetime().optional().describe("Expiration timestamp (ISO 8601)"),
-    profile: exports_external.enum(NON_ADMIN_PROFILES).optional().describe("Profile template: cs, personal, scout, coworker. admin is CLI-only and rejected here."),
+    profile: exports_external.enum(NON_ADMIN_PROFILES).optional().describe("Profile template: cs, personal, scout, coworker, console-viewer, console-operator, console-admin. " + "admin is CLI-only and rejected here."),
     overrides: profileOverridesSchema.optional().describe("Tenant overrides merged on top of the profile template"),
     chatAllowlist: exports_external.array(exports_external.string()).optional().describe("Chats this key may target (profile-aware semantics)"),
     instanceAllowlist: exports_external.array(exports_external.string().uuid()).optional().describe("Instances this key may target"),
@@ -356703,7 +356888,7 @@ var init_keys = __esm(() => {
     cursor: exports_external.string().optional().describe("Pagination cursor")
   });
   keysRoutes.post("/", async (c, next) => {
-    const raw2 = await c.req.raw.clone().json().catch(() => null);
+    const raw2 = await c.req.json().catch(() => null);
     if (raw2 && typeof raw2 === "object" && raw2.profile === "admin") {
       return c.json({
         error: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260713.4",
+  "version": "2.260714.2",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {