@desplega.ai/agent-swarm 1.101.1 → 1.103.0

package/dist/{cli-qsy1aedt.js → cli-2307phk1.js}

@@ -13,13 +13,13 @@ import {
   ensureTokenOrThrow,
   getOAuthApp,
   getOAuthTokens
-} from "./cli-yg15ef2d.js";
+} from "./cli-v9283nma.js";
 import {
   startPricingRefreshLoop
-} from "./cli-ft42ja8t.js";
+} from "./cli-ksq38x4n.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-z5gm760z.js";
+} from "./cli-m8f6qzck.js";
 import {
   createTrackerAgentMapping,
   createTrackerSync,
@@ -27,13 +27,13 @@ import {
   deleteTrackerSync,
   getAllTrackerSyncs,
   repointTrackerSyncBySwarmId
-} from "./cli-42f5hj29.js";
+} from "./cli-4fnp2tc3.js";
 import {
   cancelWorkflowRun,
   getExecutorRegistry,
   retryFailedRun,
   snapshotWorkflow
-} from "./cli-gwp428sg.js";
+} from "./cli-8hyv6c2v.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -47,7 +47,7 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   init_constants
-} from "./cli-qr8ky518.js";
+} from "./cli-8w95v19d.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -57,7 +57,7 @@ import {
   ensure,
   require_dist,
   runScheduleNow
-} from "./cli-p3mgqhjg.js";
+} from "./cli-ns0r7mkr.js";
 import {
   TriggerSchemaError,
   applyDefinitionPatch,
@@ -65,13 +65,13 @@ import {
   startWorkflowExecution,
   validateDefinition,
   validateJsonSchema
-} from "./cli-0v0nmmx1.js";
+} from "./cli-rttgde5f.js";
 import {
   extractSlackMessageText
 } from "./cli-2deg0cen.js";
 import {
   getSlackApp
-} from "./cli-3a5wne6a.js";
+} from "./cli-kk51f3tf.js";
 import {
   findUserByEmail,
   findUserByExternalId,
@@ -80,7 +80,7 @@ import {
   linkIdentity,
   recordIdentityEvent,
   unlinkIdentity
-} from "./cli-54wmx6d9.js";
+} from "./cli-yfwwjeft.js";
 import {
   markdownToSlack
 } from "./cli-z92pkwzn.js";
@@ -91,7 +91,7 @@ import {
 } from "./cli-dh55d5fg.js";
 import {
   agentContextKey
-} from "./cli-n2xem10h.js";
+} from "./cli-jt9d9fjw.js";
 import {
   AgentLogSchema,
   AgentMemorySchema,
@@ -123,6 +123,7 @@ import {
   PromptTemplateScopeSchema,
   PromptTemplateStateSchema,
   RepoGuidelinesSchema,
+  RepoHooksSchema,
   ScriptRunStatusSchema,
   ServiceSchema,
   ServiceStatusSchema,
@@ -213,6 +214,7 @@ import {
   getPromptTemplateById,
   getPromptTemplateHistory,
   getPromptTemplates,
+  getRequestAuth,
   getResolvedConfig,
   getScheduledTaskById,
   getScheduledTaskByName,
@@ -242,10 +244,11 @@ import {
   initDb,
   init_db,
   init_defaults,
-  init_model_tiers,
   init_registry,
+  init_request_auth_context,
   init_resolver,
   init_swarm_config_guard,
+  init_task_lifecycle_events,
   init_template,
   init_types,
   insertTaskAttachment,
@@ -264,6 +267,7 @@ import {
   maskSecrets,
   moveTaskFromBacklog,
   moveTaskToBacklog,
+  onTaskStarted,
   postMessage,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
@@ -300,7 +304,7 @@ import {
   upsertService,
   upsertSwarmConfig,
   validateConfigValue
-} from "./cli-53w8f9q9.js";
+} from "./cli-fedn86nz.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";
@@ -344,7 +348,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-7fzbt4p5.js";
+} from "./cli-85pf4z38.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -11206,6 +11210,356 @@ var EMPTY_COMPLETION_RESULT = {
 init_package();
 init_db();
 
+// src/github/task-reactions.ts
+init_task_lifecycle_events();
+
+// src/github/app.ts
+var initialized = false;
+var webhookSecret = null;
+var appId = null;
+var privateKey = null;
+var tokenCache = new Map;
+function isGitHubEnabled() {
+  const githubDisable = process.env.GITHUB_DISABLE;
+  if (githubDisable === "true" || githubDisable === "1") {
+    return false;
+  }
+  return !!process.env.GITHUB_WEBHOOK_SECRET;
+}
+function resetGitHub() {
+  initialized = false;
+  webhookSecret = null;
+  appId = null;
+  privateKey = null;
+  tokenCache.clear();
+}
+function initGitHub() {
+  if (initialized) {
+    console.log("[GitHub] Already initialized, skipping");
+    return isGitHubEnabled();
+  }
+  initialized = true;
+  const githubDisable = process.env.GITHUB_DISABLE;
+  if (githubDisable === "true" || githubDisable === "1") {
+    console.log("[GitHub] Disabled via GITHUB_DISABLE");
+    return false;
+  }
+  webhookSecret = process.env.GITHUB_WEBHOOK_SECRET ?? null;
+  if (!webhookSecret) {
+    console.log("[GitHub] Missing GITHUB_WEBHOOK_SECRET, GitHub integration disabled");
+    return false;
+  }
+  appId = process.env.GITHUB_APP_ID ?? null;
+  const rawPrivateKey = process.env.GITHUB_APP_PRIVATE_KEY ?? null;
+  if (appId && rawPrivateKey) {
+    if (rawPrivateKey.startsWith("-----BEGIN")) {
+      privateKey = rawPrivateKey.replace(/\\n/g, `
+`);
+    } else {
+      privateKey = Buffer.from(rawPrivateKey, "base64").toString("utf-8");
+    }
+    console.log("[GitHub] App credentials loaded for bot reactions");
+  } else {
+    console.log("[GitHub] No App credentials, bot reactions disabled");
+  }
+  console.log("[GitHub] Webhook handler initialized");
+  return true;
+}
+function isReactionsEnabled() {
+  return !!(appId && privateKey);
+}
+async function verifyWebhookSignature(payload, signature) {
+  if (!webhookSecret || !signature) {
+    console.log(`[GitHub] Signature verification failed: webhookSecret=${!!webhookSecret}, signature=${!!signature}`);
+    return false;
+  }
+  if (!signature.startsWith("sha256=")) {
+    return false;
+  }
+  const expectedSig = signature.slice(7);
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(webhookSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signatureBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+  const computedSig = Array.from(new Uint8Array(signatureBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (computedSig.length !== expectedSig.length) {
+    console.log(`[GitHub] Signature length mismatch: computed=${computedSig.length}, expected=${expectedSig.length}`);
+    return false;
+  }
+  let result = 0;
+  for (let i = 0;i < computedSig.length; i++) {
+    result |= computedSig.charCodeAt(i) ^ expectedSig.charCodeAt(i);
+  }
+  const isValid = result === 0;
+  if (!isValid) {
+    console.log(`[GitHub] Signature mismatch:`);
+    console.log(`  Expected: ${expectedSig}`);
+    console.log(`  Computed: ${computedSig}`);
+  }
+  return isValid;
+}
+async function generateAppJWT() {
+  if (!appId || !privateKey) {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    iat: now - 60,
+    exp: now + 600,
+    iss: appId
+  };
+  const base64url = (data) => {
+    const base64 = Buffer.isBuffer(data) ? data.toString("base64") : Buffer.from(data).toString("base64");
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  };
+  const header = { alg: "RS256", typ: "JWT" };
+  const headerB64 = base64url(JSON.stringify(header));
+  const payloadB64 = base64url(JSON.stringify(payload));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  try {
+    const crypto2 = await import("node:crypto");
+    const sign = crypto2.createSign("RSA-SHA256");
+    sign.update(signingInput);
+    const signature = sign.sign(privateKey);
+    const signatureB64 = base64url(signature);
+    return `${signingInput}.${signatureB64}`;
+  } catch (error) {
+    console.error("[GitHub] Failed to generate JWT:", error);
+    return null;
+  }
+}
+async function getInstallationToken(installationId) {
+  const cached = tokenCache.get(installationId);
+  if (cached && cached.expiresAt > Date.now() + 60000) {
+    return cached.token;
+  }
+  const jwt = await generateAppJWT();
+  if (!jwt) {
+    console.log("[GitHub] No JWT available, cannot get installation token");
+    return null;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${jwt}`,
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to get installation token: ${response.status} ${errorText}`);
+      return null;
+    }
+    const data = await response.json();
+    const expiresAt = new Date(data.expires_at).getTime();
+    tokenCache.set(installationId, { token: data.token, expiresAt });
+    console.log(`[GitHub] Got installation token for ${installationId}, expires at ${data.expires_at}`);
+    return data.token;
+  } catch (error) {
+    console.error("[GitHub] Error getting installation token:", error);
+    return null;
+  }
+}
+
+// src/github/reactions.ts
+async function addReaction(repo, commentId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/issues/comments/${commentId}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to comment ${commentId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding reaction:", error);
+    return false;
+  }
+}
+async function addIssueReaction(repo, issueNumber, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/issues/${issueNumber}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add issue reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to issue/PR #${issueNumber}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding issue reaction:", error);
+    return false;
+  }
+}
+async function addPullReviewCommentReaction(repo, commentId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/pulls/comments/${commentId}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add PR review comment reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to PR review comment ${commentId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding PR review comment reaction:", error);
+    return false;
+  }
+}
+async function addGraphQLReaction(nodeId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping GraphQL reaction");
+    return false;
+  }
+  try {
+    const response = await fetch("https://api.github.com/graphql", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        query: `mutation AddReaction($input: AddReactionInput!) {
+          addReaction(input: $input) {
+            reaction { content }
+          }
+        }`,
+        variables: {
+          input: { subjectId: nodeId, content: reaction }
+        }
+      })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] GraphQL reaction failed: ${response.status} ${errorText}`);
+      return false;
+    }
+    const data = await response.json();
+    if (data.errors?.length) {
+      console.error(`[GitHub] GraphQL reaction errors: ${JSON.stringify(data.errors)}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} GraphQL reaction to node ${nodeId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding GraphQL reaction:", error);
+    return false;
+  }
+}
+
+// src/github/task-reactions.ts
+async function addEyesReactionOnTaskStart(task) {
+  if (task.source !== "github" || task.vcsProvider !== "github")
+    return;
+  if (!task.vcsInstallationId)
+    return;
+  const installationId = task.vcsInstallationId;
+  const repo = task.vcsRepo;
+  if (!repo)
+    return;
+  try {
+    switch (task.vcsEventType) {
+      case "issue_comment": {
+        if (task.vcsCommentId) {
+          await addReaction(repo, task.vcsCommentId, "eyes", installationId);
+        }
+        break;
+      }
+      case "pull_request_review_comment": {
+        if (task.vcsCommentId) {
+          await addPullReviewCommentReaction(repo, task.vcsCommentId, "eyes", installationId);
+        }
+        break;
+      }
+      case "pull_request_review": {
+        if (task.vcsNodeId) {
+          await addGraphQLReaction(task.vcsNodeId, "EYES", installationId);
+        }
+        break;
+      }
+      case "pull_request":
+      case "issues": {
+        if (task.vcsNumber) {
+          await addIssueReaction(repo, task.vcsNumber, "eyes", installationId);
+        }
+        break;
+      }
+    }
+  } catch (error) {
+    console.error("[GitHub] Failed to add eyes reaction on task start:", error);
+  }
+}
+var registered = false;
+function registerGithubTaskReactions() {
+  if (registered)
+    return;
+  registered = true;
+  onTaskStarted((task) => {
+    addEyesReactionOnTaskStart(task).catch(() => {});
+  });
+}
+
 // src/tools/cancel-task.ts
 init_zod();
 init_db();
@@ -11253,7 +11607,7 @@ var NOOP_SPAN = {
   setStatus: () => NOOP_SPAN,
   end: () => {}
 };
-var initialized = false;
+var initialized2 = false;
 var realWithSpan;
 var realStartSpan;
 var realWithRemoteContext;
@@ -11265,11 +11619,11 @@ function isPollTracingEnabled() {
   return v === "1" || v === "true" || v === "yes" || v === "on";
 }
 async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
-  if (!enabled || initialized)
+  if (!enabled || initialized2)
     return;
-  initialized = true;
+  initialized2 = true;
   try {
-    const impl = await import("./otel-impl-7c00xnhe.js");
+    const impl = await import("./otel-impl-jt7gpyp9.js");
     await impl.boot(serviceRole);
     realWithSpan = impl.withSpan;
     realStartSpan = impl.startSpan;
@@ -16563,6 +16917,7 @@ var registerUpdateRepoTool = (server) => {
       clonePath: string().optional().describe("New clone path."),
       defaultBranch: string().optional().describe("New default branch."),
       autoClone: boolean().optional().describe("Whether to auto-clone."),
+      hooks: RepoHooksSchema.nullable().optional().describe("Repository hook install config. Set { enabled: true } to opt into best-effort worker hook installation, or null to disable."),
       guidelines: RepoGuidelinesSchema.nullable().optional().describe("Repository guidelines: prChecks (commands before PR), mergeChecks (conditions before merge), allowMerge (default false), review (guidance for reviewers). Pass null to clear.")
     }),
     outputSchema: object({
@@ -16725,9 +17080,33 @@ var registerResolveUserTool = (server) => {
 
 // src/tools/schedules/create-schedule.ts
 init_zod();
-init_db();
 var import_cron_parser = __toESM(require_dist(), 1);
-init_model_tiers();
+
+// src/be/audit-user.ts
+init_request_auth_context();
+init_db();
+function resolveTaskAuditUserId(sourceTaskId, callerAgentId) {
+  if (!sourceTaskId || !callerAgentId)
+    return null;
+  const task = getTaskById(sourceTaskId);
+  if (!task)
+    return null;
+  if (task.agentId !== callerAgentId)
+    return null;
+  return task.requestedByUserId ?? null;
+}
+function resolveHttpAuditUserId(req, callerAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "user")
+    return auth.userId;
+  const header = req.headers["x-source-task-id"];
+  const sourceTaskId = Array.isArray(header) ? header[0] : header;
+  return resolveTaskAuditUserId(sourceTaskId, callerAgentId);
+}
+
+// src/tools/schedules/create-schedule.ts
+init_db();
+init_types();
 var createScheduleInputSchema = object({
   name: string().min(1).max(100).describe("Unique name for the schedule (e.g., 'daily-cleanup')"),
   taskTemplate: string().min(1).describe("The task description that will be created each time"),
@@ -16937,6 +17316,7 @@ var registerCreateScheduleTool = (server) => {
         };
         nextRunAt = calculateNextRun(tempSchedule, new Date);
       }
+      const createdBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const schedule = createScheduledTask({
         name,
         taskTemplate,
@@ -16953,7 +17333,8 @@ var registerCreateScheduleTool = (server) => {
         createdByAgentId: requestInfo.agentId,
         model: normalizedModel.model,
         modelTier: normalizedModel.modelTier,
-        scheduleType: scheduleType ?? "recurring"
+        scheduleType: scheduleType ?? "recurring",
+        createdBy
       });
       const scheduleDesc = isOneTime ? `one-time at ${schedule.nextRunAt}` : cronExpression || `every ${intervalMs}ms`;
       return {
@@ -17281,8 +17662,8 @@ var registerRunScheduleNowTool = (server) => {
 };
 // src/tools/schedules/update-schedule.ts
 init_zod();
-init_db();
 var import_cron_parser2 = __toESM(require_dist(), 1);
+init_db();
 
 // src/be/schedules/validate.ts
 function mergeScheduleTiming(existing, patch) {
@@ -17299,7 +17680,7 @@ function validateRecurringTiming(merged) {
 }
 
 // src/tools/schedules/update-schedule.ts
-init_model_tiers();
+init_types();
 var updateScheduleInputSchema = object({
   scheduleId: string().uuid().optional().describe("Schedule ID to update"),
   name: string().optional().describe("Schedule name to update (alternative to ID)"),
@@ -17520,7 +17901,8 @@ var registerUpdateScheduleTool = (server) => {
           updateData.nextRunAt = undefined;
         }
       }
-      const updated = updateScheduledTask(schedule.id, updateData);
+      const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      const updated = updateScheduledTask(schedule.id, { ...updateData, updatedBy });
       if (!updated) {
         return {
           content: [{ type: "text", text: "Failed to update schedule." }],
@@ -17590,13 +17972,17 @@ async function proxyScriptsApi(args) {
   if (!args.requestInfo.agentId)
     return toolError(SCRIPT_TRANSPORT_ERROR);
   const apiKey = getApiKey();
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    "X-Agent-ID": args.requestInfo.agentId,
+    "Content-Type": "application/json"
+  };
+  if (args.requestInfo.sourceTaskId) {
+    headers["X-Source-Task-Id"] = args.requestInfo.sourceTaskId;
+  }
   const res = await fetch(`${apiBaseUrl()}${args.path}`, {
     method: args.method,
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "X-Agent-ID": args.requestInfo.agentId,
-      "Content-Type": "application/json"
-    },
+    headers,
     body: args.body === undefined ? undefined : JSON.stringify(args.body)
   });
   const text = await res.text();
@@ -17875,7 +18261,6 @@ function findDuplicateTask(opts) {
 
 // src/tools/send-task.ts
 init_types();
-init_model_tiers();
 var sendTaskInputSchema = object({
   agentId: uuid().optional().describe("The agent to assign/offer task to. Omit to create unassigned task for pool."),
   task: string().min(1).describe("The task description to send."),
@@ -21640,7 +22025,6 @@ function emitBudgetRefusalSideEffects(ctx, inserted) {
 // src/tools/task-action.ts
 init_db();
 init_types();
-init_model_tiers();
 var TaskActionSchema = _enum([
   "create",
   "claim",
@@ -22859,6 +23243,7 @@ var registerCreateWorkflowTool = (server) => {
           }
         };
       }
+      const createdBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const workflow = createWorkflow({
         name,
         description,
@@ -22869,7 +23254,8 @@ var registerCreateWorkflowTool = (server) => {
         dir,
         vcsRepo,
         triggerSchema,
-        createdByAgentId: requestInfo.agentId
+        createdByAgentId: requestInfo.agentId,
+        createdBy
       });
       return {
         content: [
@@ -23170,12 +23556,16 @@ var registerPatchWorkflowTool = (server) => {
         };
       }
       const version = snapshotWorkflow(id, requestInfo.agentId);
+      const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const updateArgs = {
         definition: patchResult.definition
       };
       if (triggerSchema !== undefined) {
         updateArgs.triggerSchema = triggerSchema;
       }
+      if (updatedBy !== undefined) {
+        updateArgs.updatedBy = updatedBy;
+      }
       const workflow = updateWorkflow(id, updateArgs);
       if (!workflow) {
         return {
@@ -23256,7 +23646,14 @@ var registerPatchWorkflowNodeTool = (server) => {
         };
       }
       const version = snapshotWorkflow(id, requestInfo.agentId);
-      const workflow = updateWorkflow(id, { definition: patchResult.definition });
+      const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      const updateArgs = {
+        definition: patchResult.definition
+      };
+      if (updatedBy !== undefined) {
+        updateArgs.updatedBy = updatedBy;
+      }
+      const workflow = updateWorkflow(id, updateArgs);
       if (!workflow) {
         return {
           content: [{ type: "text", text: `Workflow not found: ${id}` }],
@@ -23485,6 +23882,7 @@ var registerUpdateWorkflowTool = (server) => {
         }
       }
       const version = snapshotWorkflow(id, requestInfo.agentId);
+      const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const workflow = updateWorkflow(id, {
         name,
         description,
@@ -23495,7 +23893,8 @@ var registerUpdateWorkflowTool = (server) => {
         dir: dir === null ? null : dir,
         vcsRepo: vcsRepo === null ? null : vcsRepo,
         enabled: enabled2,
-        triggerSchema: triggerSchema === null ? null : triggerSchema
+        triggerSchema: triggerSchema === null ? null : triggerSchema,
+        updatedBy
       });
       if (!workflow) {
         return {
@@ -23538,6 +23937,7 @@ function createServer() {
   initDb(process.env.DATABASE_PATH);
   seedPricingFromModelsDev();
   startPricingRefreshLoop();
+  registerGithubTaskReactions();
   const server = new McpServer({
     name: package_default.name,
     version: package_default.version,
@@ -23820,4 +24220,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, routeRegistry, isPublicRoute, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, snapshotPage, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, recordRetrievals, rerank, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, resetGitHub, initGitHub, verifyWebhookSignature, getInstallationToken, addReaction, addIssueReaction, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, routeRegistry, isPublicRoute, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, snapshotPage, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, recordRetrievals, rerank, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveHttpAuditUserId, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };