@desplega.ai/agent-swarm 1.104.0 → 1.106.0

package/dist/{cli-e7bwjntj.js → cli-6hqvenfv.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 
 // src/tasks/context-key.ts
 var SEPARATOR = ":";

package/dist/{cli-0jw6j755.js → cli-6xn2xv4r.js}

@@ -25,7 +25,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-yjt8a36k.js";
+} from "./cli-39jaysbv.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -469,7 +469,7 @@ function resolveTaskModelSelection(opts) {
 function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUSES.includes(status);
 }
-var ModelTierSchema, MODEL_TIERS, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
+var ModelTierSchema, MODEL_TIERS, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, ScriptApiAuthModeSchema, ScriptApiRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
 var init_types = __esm(() => {
   init_zod();
   ModelTierSchema = _enum(["smol", "regular", "smart", "ultra"]);
@@ -489,7 +489,7 @@ var init_types = __esm(() => {
     },
     "claude-managed": {
       smol: "claude-haiku-4-5",
-      regular: "claude-sonnet-4-6",
+      regular: "claude-sonnet-5",
       smart: "claude-opus-4-8",
       ultra: "claude-fable-5"
     },
@@ -1555,6 +1555,18 @@ var init_types = __esm(() => {
     changedAt: string(),
     changeReason: string().nullable()
   });
+  ScriptApiAuthModeSchema = _enum(["none", "bearer"]);
+  ScriptApiRecordSchema = object({
+    id: string(),
+    scriptId: string(),
+    agentId: string(),
+    authMode: ScriptApiAuthModeSchema,
+    enabled: boolean(),
+    label: string().nullable(),
+    callCount: number(),
+    lastUsedAt: string().nullable(),
+    createdAt: string()
+  });
   SkillTypeSchema = _enum(["remote", "personal"]);
   SkillScopeSchema = _enum(["global", "swarm", "agent"]);
   SkillSchema = object({
@@ -2497,6 +2509,10 @@ See the \`swarm-scripts\` skill for the full catalog, signatures, and usage patt
 **For any other repetitive multi-tool pattern:** Call \`script-search\` with a natural-language description. If a script exists, use it.
 
 Script tools are deferred — load via \`ToolSearch("select:script-search,script-run")\` before first use.
+
+### Exposing scripts as APIs
+
+A named script can be exposed as a public HTTP endpoint — \`POST /api/x/script/<id>\` — callable from outside the swarm. Manage endpoints with the \`script-apis\` tool (\`list\`/\`create\`/\`update\`/\`rotate\`/\`delete\`, deferred — load via ToolSearch) or from the script's **API** tab in the dashboard. \`list\` masks bearer tokens by default; pass \`includeSecrets: true\` to reveal them.
 `,
     variables: [],
     category: "system"
@@ -2509,7 +2525,7 @@ Script tools are deferred — load via \`ToolSearch("select:script-search,script
 
 You have a full Ubuntu environment with some packages pre-installed: node, bun, python3, curl, wget, git, gh, glab, jq, etc.
 
-If you need to install additional packages, use "sudo apt-get install {package_name}".
+The runtime agent process runs as the non-root \`worker\` user without passwordless sudo. Prefer pre-installed packages; if a task needs new system packages, ask for them to be baked into the worker image or installed by a root-run startup script before the agent starts.
 
 ### VCS CLI Tools (GitHub & GitLab)
 
@@ -9477,9 +9493,9 @@ function createScriptRun(data) {
 function recordInlineScriptRun(data) {
   const row = getDb().prepare(`INSERT INTO script_runs
         (id, agentId, scriptName, source, args, kind, status, output, error,
-         startedAt, finishedAt, requestedByUserId, created_by, updated_by)
-       VALUES (?, ?, ?, ?, ?, 'inline', ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`).get(data.id, data.agentId, data.scriptName ?? null, data.source, JSON.stringify(data.args ?? null), data.status, data.output === undefined ? null : JSON.stringify(data.output), data.error ?? null, data.startedAt, data.finishedAt, data.requestedByUserId ?? null, data.createdBy ?? null, data.createdBy ?? null);
+         startedAt, finishedAt, requestedByUserId, created_by, updated_by, apiEndpointId)
+       VALUES (?, ?, ?, ?, ?, 'inline', ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       RETURNING *`).get(data.id, data.agentId, data.scriptName ?? null, data.source, JSON.stringify(data.args ?? null), data.status, data.output === undefined ? null : JSON.stringify(data.output), data.error ?? null, data.startedAt, data.finishedAt, data.requestedByUserId ?? null, data.createdBy ?? null, data.createdBy ?? null, data.apiEndpointId ?? null);
   if (!row)
     throw new Error("Failed to record inline script run");
   return rowToScriptRun(row);
@@ -9746,4 +9762,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, initTelemetry, telemetry, init_telemetry, ModelTierSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, init_request_auth_context, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, initTelemetry, telemetry, init_telemetry, ModelTierSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, init_request_auth_context, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };

package/dist/{cli-2g9jf9ek.js → cli-842gfjn1.js}

@@ -3,7 +3,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 
 // src/be/db-queries/oauth.ts
 init_date_utils();

package/dist/{cli-v1syqkcb.js → cli-84gyjn6h.js}

@@ -1,12 +1,16 @@
 import {
   embedScript
-} from "./cli-5pf0b84v.js";
+} from "./cli-4fwzc50f.js";
 import {
   computeContentHash,
+  decryptSecret,
+  encryptSecret,
   getDb,
+  getEncryptionKey,
   getSwarmConfigs,
+  init_crypto,
   init_db
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";
@@ -18,6 +22,10 @@ import {
   string,
   union
 } from "./cli-anrj584m.js";
+import {
+  init_secret_scrubber,
+  registerVolatileSecret
+} from "./cli-3pp1362w.js";
 import {
   __commonJS,
   __require,
@@ -169282,6 +169290,37 @@ ${members.join(`
 }
 
 // src/be/scripts/db.ts
+init_secret_scrubber();
+
+// src/utils/short-id.ts
+import { randomBytes } from "node:crypto";
+var LETTERS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var BASE62 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+function generateShortId(len = 12) {
+  let out = "";
+  while (out.length < len) {
+    for (const byte of randomBytes((len - out.length) * 2)) {
+      if (byte < 208) {
+        out += LETTERS[byte % 52];
+        if (out.length === len)
+          break;
+      }
+    }
+  }
+  return out;
+}
+function base62(bytes) {
+  let out = "";
+  for (const byte of bytes)
+    out += BASE62[byte % 62];
+  return out;
+}
+function generateBearerToken() {
+  return `xsk_${base62(randomBytes(24))}`;
+}
+
+// src/be/scripts/db.ts
+init_crypto();
 init_db();
 function normalizeScopeId(scope, scopeId) {
   if (scope === "global")
@@ -169478,6 +169517,110 @@ function deleteScript(args) {
   const result = getDb().run("DELETE FROM scripts WHERE id = ?", [existing.id]);
   return result.changes > 0;
 }
+var SCRIPT_API_ID_LEN = 12;
+function rowToScriptApi(row) {
+  return {
+    id: row.id,
+    scriptId: row.scriptId,
+    agentId: row.agentId,
+    authMode: row.authMode,
+    enabled: row.enabled === 1,
+    label: row.label ?? null,
+    callCount: row.callCount,
+    lastUsedAt: row.lastUsedAt ?? null,
+    createdAt: row.createdAt
+  };
+}
+function isUniqueConstraintError(err) {
+  return err instanceof Error && /UNIQUE constraint failed/i.test(err.message);
+}
+function createScriptApi(args) {
+  const now = new Date().toISOString();
+  const token = args.authMode === "bearer" ? generateBearerToken() : null;
+  const encrypted = token ? encryptSecret(token, getEncryptionKey()) : null;
+  const createdBy = args.createdBy ?? null;
+  for (let attempt = 0;attempt < 5; attempt++) {
+    const id = generateShortId(SCRIPT_API_ID_LEN);
+    try {
+      const row = getDb().prepare(`INSERT INTO script_apis
+             (id, scriptId, agentId, authMode, bearerTokenEncrypted, enabled, label,
+              callCount, lastUsedAt, createdAt, created_by, updated_by)
+           VALUES (?, ?, ?, ?, ?, 1, ?, 0, NULL, ?, ?, ?)
+           RETURNING *`).get(id, args.scriptId, args.agentId, args.authMode, encrypted, args.label ?? null, now, createdBy, createdBy);
+      if (!row)
+        throw new Error("Failed to create script API endpoint");
+      if (token)
+        registerVolatileSecret(token, `script-api:${id}`);
+      return { ...rowToScriptApi(row), token };
+    } catch (err) {
+      if (isUniqueConstraintError(err) && attempt < 4)
+        continue;
+      throw err;
+    }
+  }
+  throw new Error("Failed to allocate a unique script API endpoint id");
+}
+function listScriptApisForScript(scriptId) {
+  return getDb().prepare("SELECT * FROM script_apis WHERE scriptId = ? ORDER BY createdAt DESC").all(scriptId).map(rowToScriptApi);
+}
+function getScriptApiById(id) {
+  const row = getDb().prepare("SELECT * FROM script_apis WHERE id = ?").get(id);
+  if (!row)
+    return null;
+  return { ...rowToScriptApi(row), bearerTokenEncrypted: row.bearerTokenEncrypted ?? null };
+}
+function getScriptApiSecret(id) {
+  const row = getDb().prepare("SELECT bearerTokenEncrypted FROM script_apis WHERE id = ?").get(id);
+  if (!row?.bearerTokenEncrypted)
+    return null;
+  const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
+  registerVolatileSecret(token, `script-api:${id}`);
+  return token;
+}
+function updateScriptApi(id, args) {
+  const sets = [];
+  const vals = [];
+  if (args.enabled !== undefined) {
+    sets.push("enabled = ?");
+    vals.push(args.enabled ? 1 : 0);
+  }
+  if (args.label !== undefined) {
+    sets.push("label = ?");
+    vals.push(args.label);
+  }
+  if (args.updatedBy !== undefined) {
+    sets.push("updated_by = ?");
+    vals.push(args.updatedBy);
+  }
+  if (sets.length === 0) {
+    const row2 = getDb().prepare("SELECT * FROM script_apis WHERE id = ?").get(id);
+    return row2 ? rowToScriptApi(row2) : null;
+  }
+  vals.push(id);
+  const row = getDb().prepare(`UPDATE script_apis SET ${sets.join(", ")} WHERE id = ? RETURNING *`).get(...vals);
+  return row ? rowToScriptApi(row) : null;
+}
+function rotateScriptApiSecret(id, updatedBy) {
+  const existing = getScriptApiById(id);
+  if (!existing || existing.authMode !== "bearer")
+    return null;
+  const token = generateBearerToken();
+  const encrypted = encryptSecret(token, getEncryptionKey());
+  const row = getDb().prepare("UPDATE script_apis SET bearerTokenEncrypted = ?, updated_by = ? WHERE id = ? RETURNING *").get(encrypted, updatedBy ?? null, id);
+  if (!row)
+    return null;
+  registerVolatileSecret(token, `script-api:${id}`);
+  return { ...rowToScriptApi(row), token };
+}
+function deleteScriptApi(id) {
+  return getDb().run("DELETE FROM script_apis WHERE id = ?", [id]).changes > 0;
+}
+function recordScriptApiUsage(id) {
+  getDb().run("UPDATE script_apis SET callCount = callCount + 1, lastUsedAt = ? WHERE id = ?", [
+    new Date().toISOString(),
+    id
+  ]);
+}
 
 // src/scripts-runtime/import-allowlist.ts
 var import_typescript = __toESM(require_typescript(), 1);
@@ -169544,4 +169687,4 @@ function validateScriptImports(source) {
   return { ok: false, diagnostic: reason, imports: rejected };
 }
 
-export { CREDENTIAL_BINDINGS_CONFIG_KEY, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, SwarmConfigCredentialBindingStore, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, importLegacyCredentialBindings, listScriptConnections, upsertScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptApiTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, require_typescript, validateScriptImports };
+export { CREDENTIAL_BINDINGS_CONFIG_KEY, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, SwarmConfigCredentialBindingStore, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, importLegacyCredentialBindings, listScriptConnections, upsertScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptApiTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, require_typescript, validateScriptImports };

package/dist/{cli-7b9ctyfq.js → cli-8da61htc.js}

@@ -8,7 +8,7 @@ import {
 } from "./cli-4w4fmq9x.js";
 import {
   transformMessages
-} from "./cli-2q1ct4en.js";
+} from "./cli-bsyka9ta.js";
 import {
   sanitizeSurrogates
 } from "./cli-y2apkfe2.js";

package/dist/{cli-nzc0h54v.js → cli-8fhhmzbh.js}

@@ -3,7 +3,7 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 
 // src/slack/router.ts
 init_db();

package/dist/{cli-khe4x17a.js → cli-anrn8brw.js}

@@ -1,13 +1,13 @@
 import {
   summarizeSession
-} from "./cli-p03mawph.js";
+} from "./cli-50nss8e8.js";
 import {
   extractChatgptUserId,
   getValidCodexOAuth
 } from "./cli-4wmnp8q3.js";
 import {
   createSwarmEventHandler
-} from "./cli-92fqyjcv.js";
+} from "./cli-07er7wrs.js";
 import {
   resolveCodexPrompt
 } from "./cli-r94z9p1z.js";
@@ -30,7 +30,7 @@ import {
   CONTEXT_FORMULA,
   clampContextPercent,
   computeContextUsedUnified
-} from "./cli-0k9dc6ks.js";
+} from "./cli-tghre7g6.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";

package/dist/{cli-2q1ct4en.js → cli-bsyka9ta.js}

@@ -1,8 +1,109 @@
+// node_modules/@earendil-works/pi-ai/dist/utils/estimate.js
+var CHARS_PER_TOKEN = 4;
+var ESTIMATED_IMAGE_CHARS = 4800;
+function calculateContextTokens(usage) {
+  return usage.totalTokens || usage.input + usage.output + usage.cacheRead + usage.cacheWrite;
+}
+function safeJsonStringify(value) {
+  try {
+    return JSON.stringify(value) ?? "undefined";
+  } catch {
+    return "[unserializable]";
+  }
+}
+function estimateTextAndImageContentChars(content) {
+  if (typeof content === "string")
+    return content.length;
+  let chars = 0;
+  for (const block of content)
+    chars += block.type === "text" ? block.text.length : ESTIMATED_IMAGE_CHARS;
+  return chars;
+}
+function estimateTextTokens(text) {
+  return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+function estimateTextAndImageContentTokens(content) {
+  return Math.ceil(estimateTextAndImageContentChars(content) / CHARS_PER_TOKEN);
+}
+function estimateMessageTokens(message) {
+  let chars = 0;
+  if (message.role === "user")
+    return estimateTextAndImageContentTokens(message.content);
+  if (message.role === "toolResult")
+    return estimateTextAndImageContentTokens(message.content);
+  for (const block of message.content) {
+    if (block.type === "text") {
+      chars += block.text.length;
+    } else if (block.type === "thinking") {
+      chars += block.thinking.length;
+    } else {
+      chars += block.name.length + safeJsonStringify(block.arguments).length;
+    }
+  }
+  return Math.ceil(chars / CHARS_PER_TOKEN);
+}
+function getLastAssistantUsageInfo(messages) {
+  for (let i = messages.length - 1;i >= 0; i--) {
+    const message = messages[i];
+    if (message.role !== "assistant")
+      continue;
+    const assistant = message;
+    if (assistant.stopReason === "aborted" || assistant.stopReason === "error")
+      continue;
+    if (calculateContextTokens(assistant.usage) > 0)
+      return { usage: assistant.usage, index: i };
+  }
+  return;
+}
+function estimateMessages(messages) {
+  const usageInfo = getLastAssistantUsageInfo(messages);
+  if (usageInfo) {
+    const usageTokens = calculateContextTokens(usageInfo.usage);
+    let trailingTokens = 0;
+    for (let i = usageInfo.index + 1;i < messages.length; i++) {
+      trailingTokens += estimateMessageTokens(messages[i]);
+    }
+    return { tokens: usageTokens + trailingTokens, usageTokens, trailingTokens, lastUsageIndex: usageInfo.index };
+  }
+  let tokens = 0;
+  for (const message of messages)
+    tokens += estimateMessageTokens(message);
+  return { tokens, usageTokens: 0, trailingTokens: tokens, lastUsageIndex: null };
+}
+function isMessageArray(value) {
+  return Array.isArray(value);
+}
+function estimateContextTokens(context) {
+  if (isMessageArray(context))
+    return estimateMessages(context);
+  const estimate = estimateMessages(context.messages);
+  if (estimate.lastUsageIndex !== null)
+    return estimate;
+  let prefixTokens = context.systemPrompt ? estimateTextTokens(context.systemPrompt) : 0;
+  if (context.tools && context.tools.length > 0) {
+    prefixTokens += estimateTextTokens(safeJsonStringify(context.tools));
+  }
+  return {
+    tokens: estimate.tokens + prefixTokens,
+    usageTokens: estimate.usageTokens,
+    trailingTokens: estimate.trailingTokens + prefixTokens,
+    lastUsageIndex: estimate.lastUsageIndex
+  };
+}
+
 // node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
-function buildBaseOptions(_model, options, apiKey) {
+var CONTEXT_SAFETY_TOKENS = 4096;
+var MIN_MAX_TOKENS = 1;
+function clampMaxTokensToContext(model, context, maxTokens) {
+  if (model.contextWindow <= 0)
+    return Math.max(MIN_MAX_TOKENS, maxTokens);
+  const available = model.contextWindow - estimateContextTokens(context).tokens - CONTEXT_SAFETY_TOKENS;
+  return Math.min(maxTokens, Math.max(MIN_MAX_TOKENS, available));
+}
+function buildBaseOptions(model, context, options, apiKey) {
   return {
     temperature: options?.temperature,
-    maxTokens: options?.maxTokens,
+    maxTokens: clampMaxTokensToContext(model, context, options?.maxTokens ?? model.maxTokens),
     signal: options?.signal,
     apiKey: apiKey || options?.apiKey,
     transport: options?.transport,
@@ -194,4 +295,4 @@ function transformMessages(messages, model, normalizeToolCallId) {
   return result;
 }
 
-export { buildBaseOptions, clampReasoning, adjustMaxTokensForThinking, transformMessages };
+export { clampMaxTokensToContext, buildBaseOptions, clampReasoning, adjustMaxTokensForThinking, transformMessages };

package/dist/{cli-p04j6hjv.js → cli-dqhz8451.js}

@@ -16,7 +16,7 @@ import {
   clampContextPercent,
   computeContextUsedUnified,
   getContextWindowSize
-} from "./cli-0k9dc6ks.js";
+} from "./cli-tghre7g6.js";
 import {
   init_credentials,
   validateClaudeCredentials

package/dist/{cli-s42f54ja.js → cli-f7ypwjgh.js}

@@ -14,7 +14,7 @@ import {
   init_templates1 as init_templates,
   normalizeDateRequired,
   resolveTemplate
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();

package/dist/{cli-p4cj4vhc.js → cli-hmqkes02.js}

@@ -6,7 +6,7 @@ import {
   getDb,
   init_db,
   isSqliteVecAvailable
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 import {
   __esm,
   __export,

package/dist/{cli-23zk7xqy.js → cli-j1172z85.js}

@@ -2,19 +2,19 @@ import {
   authJsonToCredentialSelection,
   checkCodexCredentials,
   credentialsToAuthJson
-} from "./cli-khe4x17a.js";
+} from "./cli-anrn8brw.js";
 import {
   loadAllCodexOAuthSlots
 } from "./cli-4wmnp8q3.js";
 import {
   checkClaudeManagedCredentials
-} from "./cli-yp2krx5r.js";
+} from "./cli-jk4tj5m6.js";
 import {
   checkDevinCredentials
 } from "./cli-tyfxrrdd.js";
 import {
   checkOpencodeCredentials
-} from "./cli-ncg70f07.js";
+} from "./cli-q44nxhwq.js";
 import {
   initOtel,
   injectTraceContext,
@@ -23,10 +23,10 @@ import {
   withSpan,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-qvzgncd8.js";
+} from "./cli-v90vvqt8.js";
 import {
   checkClaudeCredentials
-} from "./cli-p04j6hjv.js";
+} from "./cli-dqhz8451.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -36,7 +36,7 @@ import {
 } from "./cli-psrqtw2m.js";
 import {
   getContextWindowSize
-} from "./cli-0k9dc6ks.js";
+} from "./cli-tghre7g6.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -50,10 +50,10 @@ import {
 import {
   ensure,
   initialize
-} from "./cli-y9p3e94h.js";
+} from "./cli-08fnz4jm.js";
 import {
   validateJsonSchema
-} from "./cli-zghef0em.js";
+} from "./cli-v9853xza.js";
 import {
   getMcpBaseUrl
 } from "./cli-dh55d5fg.js";
@@ -76,7 +76,7 @@ import {
   resolveTaskModelSelection,
   resolveTemplateAsync,
   telemetry
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 import {
   init_credentials,
   resolveCredentialPools
@@ -436,19 +436,19 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-e3dhkq85.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-w96mzan4.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-zf7dt1wg.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-y037wnp4.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-w0xharsg.js");
+      const { CodexAdapter } = await import("./codex-adapter-h9rj59tj.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-z29hjgzz.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-vj9kzegz.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
@@ -456,7 +456,7 @@ async function createProviderAdapter(provider) {
       return new DevinAdapter;
     }
     case "opencode": {
-      const { OpencodeAdapter } = await import("./opencode-adapter-s8vsmzpy.js");
+      const { OpencodeAdapter } = await import("./opencode-adapter-p2w6efwc.js");
       return new OpencodeAdapter;
     }
     default:
@@ -483,14 +483,22 @@ init_credentials();
 // src/utils/harness-provider.ts
 init_types();
 var SUPPORTED_PROVIDERS = ProviderNameSchema.options;
+function hasEnvValue(key, resolvedEnv, fallbackEnv) {
+  return !!(resolvedEnv[key]?.trim() || fallbackEnv[key]?.trim());
+}
+function credentialAwareDefault(resolvedEnv, fallbackEnv) {
+  const hasOpenRouterKey = hasEnvValue("OPENROUTER_API_KEY", resolvedEnv, fallbackEnv);
+  const hasClaudeCredential = hasEnvValue("ANTHROPIC_API_KEY", resolvedEnv, fallbackEnv) || hasEnvValue("CLAUDE_CODE_OAUTH_TOKEN", resolvedEnv, fallbackEnv);
+  return hasOpenRouterKey && !hasClaudeCredential ? "pi" : "claude";
+}
 function resolveHarnessProvider(resolvedEnv, fallbackEnv = process.env) {
   const candidate = resolvedEnv.HARNESS_PROVIDER?.trim() || fallbackEnv.HARNESS_PROVIDER?.trim();
   if (!candidate)
-    return "claude";
+    return credentialAwareDefault(resolvedEnv, fallbackEnv);
   const parsed = ProviderNameSchema.safeParse(candidate);
   if (!parsed.success) {
-    console.warn(`[harness-provider] Invalid HARNESS_PROVIDER="${candidate}" (must be one of: ${SUPPORTED_PROVIDERS.join(", ")}); falling back to "claude"`);
-    return "claude";
+    console.warn(`[harness-provider] Invalid HARNESS_PROVIDER="${candidate}" (must be one of: ${SUPPORTED_PROVIDERS.join(", ")}); falling back to credential-aware default`);
+    return credentialAwareDefault(resolvedEnv, fallbackEnv);
   }
   return parsed.data;
 }
@@ -1108,7 +1116,7 @@ async function checkProviderCredentials(provider, env, opts) {
     case "opencode":
       return checkOpencodeCredentials(env, opts);
     case "pi": {
-      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-zf7dt1wg.js");
+      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-y037wnp4.js");
       return checkPiMonoCredentials(env, opts);
     }
     default: