@desplega.ai/agent-swarm 1.102.0 → 1.103.0

package/dist/{cli-tsz1q7gk.js → cli-2307phk1.js}

@@ -13,13 +13,13 @@ import {
   ensureTokenOrThrow,
   getOAuthApp,
   getOAuthTokens
-} from "./cli-zmf7refz.js";
+} from "./cli-v9283nma.js";
 import {
   startPricingRefreshLoop
-} from "./cli-xde8vhhp.js";
+} from "./cli-ksq38x4n.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-stqqf5kh.js";
+} from "./cli-m8f6qzck.js";
 import {
   createTrackerAgentMapping,
   createTrackerSync,
@@ -27,13 +27,13 @@ import {
   deleteTrackerSync,
   getAllTrackerSyncs,
   repointTrackerSyncBySwarmId
-} from "./cli-k1ghyj8b.js";
+} from "./cli-4fnp2tc3.js";
 import {
   cancelWorkflowRun,
   getExecutorRegistry,
   retryFailedRun,
   snapshotWorkflow
-} from "./cli-zk4gn40w.js";
+} from "./cli-8hyv6c2v.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -47,7 +47,7 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   init_constants
-} from "./cli-k81y1cjb.js";
+} from "./cli-8w95v19d.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -57,7 +57,7 @@ import {
   ensure,
   require_dist,
   runScheduleNow
-} from "./cli-ap4md0gc.js";
+} from "./cli-ns0r7mkr.js";
 import {
   TriggerSchemaError,
   applyDefinitionPatch,
@@ -65,13 +65,13 @@ import {
   startWorkflowExecution,
   validateDefinition,
   validateJsonSchema
-} from "./cli-t2jk33ta.js";
+} from "./cli-rttgde5f.js";
 import {
   extractSlackMessageText
 } from "./cli-2deg0cen.js";
 import {
   getSlackApp
-} from "./cli-sygq3fhn.js";
+} from "./cli-kk51f3tf.js";
 import {
   findUserByEmail,
   findUserByExternalId,
@@ -80,7 +80,7 @@ import {
   linkIdentity,
   recordIdentityEvent,
   unlinkIdentity
-} from "./cli-5bqa41fd.js";
+} from "./cli-yfwwjeft.js";
 import {
   markdownToSlack
 } from "./cli-z92pkwzn.js";
@@ -91,7 +91,7 @@ import {
 } from "./cli-dh55d5fg.js";
 import {
   agentContextKey
-} from "./cli-r68m8arr.js";
+} from "./cli-jt9d9fjw.js";
 import {
   AgentLogSchema,
   AgentMemorySchema,
@@ -123,6 +123,7 @@ import {
   PromptTemplateScopeSchema,
   PromptTemplateStateSchema,
   RepoGuidelinesSchema,
+  RepoHooksSchema,
   ScriptRunStatusSchema,
   ServiceSchema,
   ServiceStatusSchema,
@@ -243,11 +244,11 @@ import {
   initDb,
   init_db,
   init_defaults,
-  init_model_tiers,
   init_registry,
   init_request_auth_context,
   init_resolver,
   init_swarm_config_guard,
+  init_task_lifecycle_events,
   init_template,
   init_types,
   insertTaskAttachment,
@@ -266,6 +267,7 @@ import {
   maskSecrets,
   moveTaskFromBacklog,
   moveTaskToBacklog,
+  onTaskStarted,
   postMessage,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
@@ -302,7 +304,7 @@ import {
   upsertService,
   upsertSwarmConfig,
   validateConfigValue
-} from "./cli-d0t4854c.js";
+} from "./cli-fedn86nz.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";
@@ -346,7 +348,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-hc4rd6sv.js";
+} from "./cli-85pf4z38.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -11208,6 +11210,356 @@ var EMPTY_COMPLETION_RESULT = {
 init_package();
 init_db();
 
+// src/github/task-reactions.ts
+init_task_lifecycle_events();
+
+// src/github/app.ts
+var initialized = false;
+var webhookSecret = null;
+var appId = null;
+var privateKey = null;
+var tokenCache = new Map;
+function isGitHubEnabled() {
+  const githubDisable = process.env.GITHUB_DISABLE;
+  if (githubDisable === "true" || githubDisable === "1") {
+    return false;
+  }
+  return !!process.env.GITHUB_WEBHOOK_SECRET;
+}
+function resetGitHub() {
+  initialized = false;
+  webhookSecret = null;
+  appId = null;
+  privateKey = null;
+  tokenCache.clear();
+}
+function initGitHub() {
+  if (initialized) {
+    console.log("[GitHub] Already initialized, skipping");
+    return isGitHubEnabled();
+  }
+  initialized = true;
+  const githubDisable = process.env.GITHUB_DISABLE;
+  if (githubDisable === "true" || githubDisable === "1") {
+    console.log("[GitHub] Disabled via GITHUB_DISABLE");
+    return false;
+  }
+  webhookSecret = process.env.GITHUB_WEBHOOK_SECRET ?? null;
+  if (!webhookSecret) {
+    console.log("[GitHub] Missing GITHUB_WEBHOOK_SECRET, GitHub integration disabled");
+    return false;
+  }
+  appId = process.env.GITHUB_APP_ID ?? null;
+  const rawPrivateKey = process.env.GITHUB_APP_PRIVATE_KEY ?? null;
+  if (appId && rawPrivateKey) {
+    if (rawPrivateKey.startsWith("-----BEGIN")) {
+      privateKey = rawPrivateKey.replace(/\\n/g, `
+`);
+    } else {
+      privateKey = Buffer.from(rawPrivateKey, "base64").toString("utf-8");
+    }
+    console.log("[GitHub] App credentials loaded for bot reactions");
+  } else {
+    console.log("[GitHub] No App credentials, bot reactions disabled");
+  }
+  console.log("[GitHub] Webhook handler initialized");
+  return true;
+}
+function isReactionsEnabled() {
+  return !!(appId && privateKey);
+}
+async function verifyWebhookSignature(payload, signature) {
+  if (!webhookSecret || !signature) {
+    console.log(`[GitHub] Signature verification failed: webhookSecret=${!!webhookSecret}, signature=${!!signature}`);
+    return false;
+  }
+  if (!signature.startsWith("sha256=")) {
+    return false;
+  }
+  const expectedSig = signature.slice(7);
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(webhookSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signatureBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+  const computedSig = Array.from(new Uint8Array(signatureBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (computedSig.length !== expectedSig.length) {
+    console.log(`[GitHub] Signature length mismatch: computed=${computedSig.length}, expected=${expectedSig.length}`);
+    return false;
+  }
+  let result = 0;
+  for (let i = 0;i < computedSig.length; i++) {
+    result |= computedSig.charCodeAt(i) ^ expectedSig.charCodeAt(i);
+  }
+  const isValid = result === 0;
+  if (!isValid) {
+    console.log(`[GitHub] Signature mismatch:`);
+    console.log(`  Expected: ${expectedSig}`);
+    console.log(`  Computed: ${computedSig}`);
+  }
+  return isValid;
+}
+async function generateAppJWT() {
+  if (!appId || !privateKey) {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    iat: now - 60,
+    exp: now + 600,
+    iss: appId
+  };
+  const base64url = (data) => {
+    const base64 = Buffer.isBuffer(data) ? data.toString("base64") : Buffer.from(data).toString("base64");
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  };
+  const header = { alg: "RS256", typ: "JWT" };
+  const headerB64 = base64url(JSON.stringify(header));
+  const payloadB64 = base64url(JSON.stringify(payload));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  try {
+    const crypto2 = await import("node:crypto");
+    const sign = crypto2.createSign("RSA-SHA256");
+    sign.update(signingInput);
+    const signature = sign.sign(privateKey);
+    const signatureB64 = base64url(signature);
+    return `${signingInput}.${signatureB64}`;
+  } catch (error) {
+    console.error("[GitHub] Failed to generate JWT:", error);
+    return null;
+  }
+}
+async function getInstallationToken(installationId) {
+  const cached = tokenCache.get(installationId);
+  if (cached && cached.expiresAt > Date.now() + 60000) {
+    return cached.token;
+  }
+  const jwt = await generateAppJWT();
+  if (!jwt) {
+    console.log("[GitHub] No JWT available, cannot get installation token");
+    return null;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${jwt}`,
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to get installation token: ${response.status} ${errorText}`);
+      return null;
+    }
+    const data = await response.json();
+    const expiresAt = new Date(data.expires_at).getTime();
+    tokenCache.set(installationId, { token: data.token, expiresAt });
+    console.log(`[GitHub] Got installation token for ${installationId}, expires at ${data.expires_at}`);
+    return data.token;
+  } catch (error) {
+    console.error("[GitHub] Error getting installation token:", error);
+    return null;
+  }
+}
+
+// src/github/reactions.ts
+async function addReaction(repo, commentId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/issues/comments/${commentId}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to comment ${commentId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding reaction:", error);
+    return false;
+  }
+}
+async function addIssueReaction(repo, issueNumber, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/issues/${issueNumber}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add issue reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to issue/PR #${issueNumber}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding issue reaction:", error);
+    return false;
+  }
+}
+async function addPullReviewCommentReaction(repo, commentId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping reaction");
+    return false;
+  }
+  try {
+    const response = await fetch(`https://api.github.com/repos/${repo}/pulls/comments/${commentId}/reactions`, {
+      method: "POST",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ content: reaction })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] Failed to add PR review comment reaction: ${response.status} ${errorText}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} reaction to PR review comment ${commentId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding PR review comment reaction:", error);
+    return false;
+  }
+}
+async function addGraphQLReaction(nodeId, reaction, installationId) {
+  if (!isReactionsEnabled()) {
+    console.log("[GitHub] Reactions not enabled, skipping");
+    return false;
+  }
+  const token = await getInstallationToken(installationId);
+  if (!token) {
+    console.log("[GitHub] No installation token, skipping GraphQL reaction");
+    return false;
+  }
+  try {
+    const response = await fetch("https://api.github.com/graphql", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        query: `mutation AddReaction($input: AddReactionInput!) {
+          addReaction(input: $input) {
+            reaction { content }
+          }
+        }`,
+        variables: {
+          input: { subjectId: nodeId, content: reaction }
+        }
+      })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[GitHub] GraphQL reaction failed: ${response.status} ${errorText}`);
+      return false;
+    }
+    const data = await response.json();
+    if (data.errors?.length) {
+      console.error(`[GitHub] GraphQL reaction errors: ${JSON.stringify(data.errors)}`);
+      return false;
+    }
+    console.log(`[GitHub] Added ${reaction} GraphQL reaction to node ${nodeId}`);
+    return true;
+  } catch (error) {
+    console.error("[GitHub] Error adding GraphQL reaction:", error);
+    return false;
+  }
+}
+
+// src/github/task-reactions.ts
+async function addEyesReactionOnTaskStart(task) {
+  if (task.source !== "github" || task.vcsProvider !== "github")
+    return;
+  if (!task.vcsInstallationId)
+    return;
+  const installationId = task.vcsInstallationId;
+  const repo = task.vcsRepo;
+  if (!repo)
+    return;
+  try {
+    switch (task.vcsEventType) {
+      case "issue_comment": {
+        if (task.vcsCommentId) {
+          await addReaction(repo, task.vcsCommentId, "eyes", installationId);
+        }
+        break;
+      }
+      case "pull_request_review_comment": {
+        if (task.vcsCommentId) {
+          await addPullReviewCommentReaction(repo, task.vcsCommentId, "eyes", installationId);
+        }
+        break;
+      }
+      case "pull_request_review": {
+        if (task.vcsNodeId) {
+          await addGraphQLReaction(task.vcsNodeId, "EYES", installationId);
+        }
+        break;
+      }
+      case "pull_request":
+      case "issues": {
+        if (task.vcsNumber) {
+          await addIssueReaction(repo, task.vcsNumber, "eyes", installationId);
+        }
+        break;
+      }
+    }
+  } catch (error) {
+    console.error("[GitHub] Failed to add eyes reaction on task start:", error);
+  }
+}
+var registered = false;
+function registerGithubTaskReactions() {
+  if (registered)
+    return;
+  registered = true;
+  onTaskStarted((task) => {
+    addEyesReactionOnTaskStart(task).catch(() => {});
+  });
+}
+
 // src/tools/cancel-task.ts
 init_zod();
 init_db();
@@ -11255,7 +11607,7 @@ var NOOP_SPAN = {
   setStatus: () => NOOP_SPAN,
   end: () => {}
 };
-var initialized = false;
+var initialized2 = false;
 var realWithSpan;
 var realStartSpan;
 var realWithRemoteContext;
@@ -11267,11 +11619,11 @@ function isPollTracingEnabled() {
   return v === "1" || v === "true" || v === "yes" || v === "on";
 }
 async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
-  if (!enabled || initialized)
+  if (!enabled || initialized2)
     return;
-  initialized = true;
+  initialized2 = true;
   try {
-    const impl = await import("./otel-impl-8k375amf.js");
+    const impl = await import("./otel-impl-jt7gpyp9.js");
     await impl.boot(serviceRole);
     realWithSpan = impl.withSpan;
     realStartSpan = impl.startSpan;
@@ -16565,6 +16917,7 @@ var registerUpdateRepoTool = (server) => {
       clonePath: string().optional().describe("New clone path."),
       defaultBranch: string().optional().describe("New default branch."),
       autoClone: boolean().optional().describe("Whether to auto-clone."),
+      hooks: RepoHooksSchema.nullable().optional().describe("Repository hook install config. Set { enabled: true } to opt into best-effort worker hook installation, or null to disable."),
       guidelines: RepoGuidelinesSchema.nullable().optional().describe("Repository guidelines: prChecks (commands before PR), mergeChecks (conditions before merge), allowMerge (default false), review (guidance for reviewers). Pass null to clear.")
     }),
     outputSchema: object({
@@ -16753,7 +17106,7 @@ function resolveHttpAuditUserId(req, callerAgentId) {
 
 // src/tools/schedules/create-schedule.ts
 init_db();
-init_model_tiers();
+init_types();
 var createScheduleInputSchema = object({
   name: string().min(1).max(100).describe("Unique name for the schedule (e.g., 'daily-cleanup')"),
   taskTemplate: string().min(1).describe("The task description that will be created each time"),
@@ -17327,7 +17680,7 @@ function validateRecurringTiming(merged) {
 }
 
 // src/tools/schedules/update-schedule.ts
-init_model_tiers();
+init_types();
 var updateScheduleInputSchema = object({
   scheduleId: string().uuid().optional().describe("Schedule ID to update"),
   name: string().optional().describe("Schedule name to update (alternative to ID)"),
@@ -17908,7 +18261,6 @@ function findDuplicateTask(opts) {
 
 // src/tools/send-task.ts
 init_types();
-init_model_tiers();
 var sendTaskInputSchema = object({
   agentId: uuid().optional().describe("The agent to assign/offer task to. Omit to create unassigned task for pool."),
   task: string().min(1).describe("The task description to send."),
@@ -21673,7 +22025,6 @@ function emitBudgetRefusalSideEffects(ctx, inserted) {
 // src/tools/task-action.ts
 init_db();
 init_types();
-init_model_tiers();
 var TaskActionSchema = _enum([
   "create",
   "claim",
@@ -23586,6 +23937,7 @@ function createServer() {
   initDb(process.env.DATABASE_PATH);
   seedPricingFromModelsDev();
   startPricingRefreshLoop();
+  registerGithubTaskReactions();
   const server = new McpServer({
     name: package_default.name,
     version: package_default.version,
@@ -23868,4 +24220,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, routeRegistry, isPublicRoute, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, snapshotPage, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, recordRetrievals, rerank, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveHttpAuditUserId, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, resetGitHub, initGitHub, verifyWebhookSignature, getInstallationToken, addReaction, addIssueReaction, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, routeRegistry, isPublicRoute, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, snapshotPage, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, recordRetrievals, rerank, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveHttpAuditUserId, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };

package/dist/{cli-g5px3d7x.js → cli-2957pqpj.js}

@@ -3,6 +3,7 @@ var HISTORY_DIR = "/tmp/agent-swarm-tool-history";
 var MAX_HISTORY = 30;
 var REPEAT_WARNING_THRESHOLD = 8;
 var REPEAT_CRITICAL_THRESHOLD = 15;
+var LOW_CARDINALITY_FILE_CHANGE_CRITICAL_THRESHOLD = 24;
 var PINGPONG_WARNING_THRESHOLD = 6;
 var PINGPONG_CRITICAL_THRESHOLD = 12;
 function hashArgs(args) {
@@ -15,6 +16,27 @@ function hashArgs(args) {
   }
   return hash.toString(36);
 }
+function isCodexFileChangeArgs(toolName, toolInput) {
+  if (toolName !== "Edit" && toolName !== "Write" && toolName !== "Delete") {
+    return false;
+  }
+  const topLevelKeys = Object.keys(toolInput);
+  if (topLevelKeys.length !== 1 || topLevelKeys[0] !== "changes") {
+    return false;
+  }
+  const changes = toolInput.changes;
+  if (!Array.isArray(changes) || changes.length === 0) {
+    return false;
+  }
+  return changes.every((change) => {
+    if (!change || typeof change !== "object" || Array.isArray(change)) {
+      return false;
+    }
+    const entry = change;
+    const keys = Object.keys(entry).sort();
+    return keys.length === 2 && keys[0] === "kind" && keys[1] === "path" && typeof entry.path === "string" && (entry.kind === "add" || entry.kind === "update" || entry.kind === "delete");
+  });
+}
 async function loadHistory(sessionKey) {
   try {
     const file = Bun.file(`${HISTORY_DIR}/${sessionKey}.json`);
@@ -39,13 +61,14 @@ async function checkToolLoop(sessionKey, toolName, toolInput) {
     return { blocked: false };
   }
   const key = `${toolName}:${argsHash}`;
+  const repeatCriticalThreshold = isCodexFileChangeArgs(toolName, toolInput) ? LOW_CARDINALITY_FILE_CHANGE_CRITICAL_THRESHOLD : REPEAT_CRITICAL_THRESHOLD;
   let repeatCount = 0;
   for (const record of history) {
     if (`${record.toolName}:${record.argsHash}` === key) {
       repeatCount++;
     }
   }
-  if (repeatCount >= REPEAT_CRITICAL_THRESHOLD) {
+  if (repeatCount >= repeatCriticalThreshold) {
     return {
       blocked: true,
       severity: "critical",

package/dist/{cli-9qascwj7.js → cli-2qynerth.js}

@@ -3,7 +3,7 @@ import {
   incrKv,
   init_db,
   upsertKv
-} from "./cli-d0t4854c.js";
+} from "./cli-fedn86nz.js";
 
 // src/be/unmapped-identities.ts
 init_db();

package/dist/{cli-k1ghyj8b.js → cli-4fnp2tc3.js}

@@ -14,7 +14,7 @@ import {
   init_templates1 as init_templates,
   normalizeDateRequired,
   resolveTemplate
-} from "./cli-d0t4854c.js";
+} from "./cli-fedn86nz.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();

package/dist/{cli-hc4rd6sv.js → cli-85pf4z38.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.102.0",
+    version: "1.103.0",
     description: "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
     license: "MIT",
     author: "desplega.sh <contact@desplega.sh>",