@desplega.ai/agent-swarm 1.114.0 → 1.115.0

package/dist/{http-6g0hfzax.js → http-809fvtz2.js}

@@ -25,6 +25,7 @@ import {
   describeRequestRoute,
   emitBudgetRefusalSideEffects,
   enforceContentLengthCap,
+  enqueueAdmissionRow,
   enqueueAuditRow,
   executeReadOnlyQuery,
   expandCandidatesWithGraph,
@@ -122,7 +123,7 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-e2xbxmhd.js";
+} from "./cli-hrhye2rm.js";
 import"./cli-1z7048dy.js";
 import {
   BROWSER_SDK_JS,
@@ -142,20 +143,21 @@ import {
 } from "./cli-gz9sbyk3.js";
 import {
   reasoningCapability
-} from "./cli-tkmm5nf9.js";
-import"./cli-w3nq88yc.js";
+} from "./cli-e61fs2hp.js";
+import"./cli-3samkyap.js";
 import {
   normalizeModelKey
-} from "./cli-k6h2zkw3.js";
+} from "./cli-tece6zgm.js";
 import {
   getUserGrant
-} from "./cli-7rgh0w0k.js";
+} from "./cli-52fg7s7x.js";
 import {
   can,
   clearAuditSink,
+  decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-0kgcv878.js";
+} from "./cli-86fdnerz.js";
 import {
   ensureAgentFsCredentialsForAgent,
   extractArgsJsonSchema,
@@ -163,16 +165,16 @@ import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-zmmp2r79.js";
+} from "./cli-12vb0xg6.js";
 import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-q4e2x252.js";
+} from "./cli-beea4a3y.js";
 import {
   createResumeFollowUp,
   createWorkerTaskFollowUp
-} from "./cli-2t4e4ayk.js";
+} from "./cli-dcca6j8m.js";
 import"./cli-fad8m16k.js";
 import {
   calculateNextRun,
@@ -180,7 +182,7 @@ import {
   ensure,
   initialize,
   require_dist
-} from "./cli-q1z5d5ss.js";
+} from "./cli-shvaxw27.js";
 import {
   RawLlmConfigSchema,
   TriggerSchemaError,
@@ -202,7 +204,7 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-a6tzw6vq.js";
+} from "./cli-q1rx7g0d.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -254,11 +256,11 @@ import {
   upsertMcpOAuthToken,
   upsertScriptByName,
   upsertScriptConnection
-} from "./cli-pnfyyp6h.js";
+} from "./cli-r9f6ngrf.js";
 import"./cli-jkhwmmgg.js";
 import {
   searchScripts
-} from "./cli-f9n2jg31.js";
+} from "./cli-cmw9rzy5.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -266,7 +268,7 @@ import {
   init_constants,
   init_reranker,
   rerank
-} from "./cli-byjcad11.js";
+} from "./cli-7xje5amz.js";
 import"./cli-q25ejbyn.js";
 import {
   acquireOAuthRefreshLock,
@@ -279,19 +281,20 @@ import {
   getOAuthTokens,
   releaseOAuthRefreshLock,
   upsertOAuthApp
-} from "./cli-49j095n9.js";
+} from "./cli-t0vqevnm.js";
 import"./cli-0pygq9r1.js";
-import"./cli-5ktc9fd4.js";
+import"./cli-tffvrh6j.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-hq39e630.js";
+} from "./cli-pet3aev6.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
+  findUserById,
   fingerprintApiKey,
   getUserIdentities,
   linkIdentity,
@@ -305,15 +308,15 @@ import {
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-113wmegp.js";
-import"./cli-6xd0bvf8.js";
+} from "./cli-6aq8xhvm.js";
+import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import {
   agentContextKey,
   createTaskWithSiblingAwareness,
   gitlabContextKey,
   pageContextKey
-} from "./cli-312v3c41.js";
+} from "./cli-k3y4z3h5.js";
 import {
   getAppUrl,
   getConfiguredAppUrls,
@@ -512,7 +515,7 @@ import {
   getTaskStats,
   getTasksCount,
   getTemplateDefinition,
-  getUnassignedTaskIds,
+  getUnassignedTaskIdsForAgent,
   getUserById,
   getWorkflow,
   getWorkflowRun,
@@ -621,7 +624,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-jzwtn8rm.js";
+} from "./cli-15y7qhzp.js";
 import"./cli-z2zcxes1.js";
 import {
   init_zod
@@ -636,7 +639,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-f5pzfvwb.js";
+} from "./cli-b23axgz4.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -3550,7 +3553,7 @@ var putFavorite = route({
   pattern: ["api", "favorites"],
   summary: "Set favorite state for an item",
   tags: ["Favorites"],
-  rbac: { ungated: "self-scoped to the authenticated user; no cross-principal access" },
+  rbac: { permission: "favorite.write.own" },
   body: exports_external.object({
     itemType: FavoriteItemTypeSchema,
     itemId: exports_external.string().min(1),
@@ -7214,6 +7217,7 @@ function stopMcpOAuthPendingGc() {
 // src/http/mcp-servers.ts
 init_zod();
 init_db();
+init_request_auth_context();
 var listMcpServersRoute = route({
   method: "get",
   path: "/api/mcp-servers",
@@ -7268,7 +7272,8 @@ var createMcpServerRoute = route({
   responses: {
     201: { description: "MCP server created" },
     400: { description: "Validation error" }
-  }
+  },
+  rbac: { permission: "mcp-server.create.swarm" }
 });
 var updateMcpServerRoute = route({
   method: "put",
@@ -7282,7 +7287,8 @@ var updateMcpServerRoute = route({
   responses: {
     200: { description: "MCP server updated" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.update.any" }
 });
 var deleteMcpServerRoute = route({
   method: "delete",
@@ -7295,7 +7301,8 @@ var deleteMcpServerRoute = route({
   responses: {
     200: { description: "MCP server deleted" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.delete.any" }
 });
 var installMcpServerRoute = route({
   method: "post",
@@ -7311,7 +7318,8 @@ var installMcpServerRoute = route({
   responses: {
     200: { description: "MCP server installed" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.install.any" }
 });
 var uninstallMcpServerRoute = route({
   method: "delete",
@@ -7323,7 +7331,8 @@ var uninstallMcpServerRoute = route({
   params: exports_external.object({ id: exports_external.string(), agentId: exports_external.string() }),
   responses: {
     200: { description: "MCP server uninstalled" }
-  }
+  },
+  rbac: { permission: "mcp-server.uninstall.any" }
 });
 var getAgentMcpServersRoute = route({
   method: "get",
@@ -7340,6 +7349,27 @@ var getAgentMcpServersRoute = route({
     200: { description: "Agent MCP servers list" }
   }
 });
+function canResolveMcpSecretsForHttpUser(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user")
+    return true;
+  if (!isRbacEnabled())
+    return true;
+  const verb = "mcp-server.read.secrets";
+  const grant = getUserGrant(auth.userId);
+  const decision = grant.grantsAll || grant.verbs.has(verb) ? { allow: true, verb } : {
+    allow: false,
+    reason: `admission: missing permission '${verb}'`,
+    verb
+  };
+  enqueueAdmissionRow({
+    userId: auth.userId,
+    decision,
+    method: req.method,
+    route: getAgentMcpServersRoute.def.path
+  });
+  return decision.allow;
+}
 async function handleMcpServers(req, res, pathSegments, queryParams) {
   if (getAgentMcpServersRoute.match(req.method, pathSegments)) {
     const parsed = await getAgentMcpServersRoute.parse(req, res, pathSegments, queryParams);
@@ -7348,6 +7378,10 @@ async function handleMcpServers(req, res, pathSegments, queryParams) {
     const servers = getAgentMcpServers(parsed.params.id);
     const resolveSecrets = parsed.query.resolveSecrets === "true";
     if (resolveSecrets) {
+      if (!canResolveMcpSecretsForHttpUser(req)) {
+        jsonError(res, "Forbidden: admission: missing permission 'mcp-server.read.secrets'", 403);
+        return true;
+      }
       const configs = getResolvedConfig(parsed.params.id);
       const configMap = new Map(configs.map((c) => [c.key, c.value]));
       const serversWithSecrets = await Promise.all(servers.map(async (server) => {
@@ -7564,6 +7598,33 @@ var userSendTaskInputSchema = object({
   model: string().trim().min(1).optional().describe("Concrete model override interpreted by the assignee's harness/provider."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier: 'smol', 'regular', 'smart', or 'ultra'. Resolved by the assignee's harness/provider.")
 });
+function permission(verb) {
+  return { permission: verb };
+}
+async function maybeDenyUserToolAdmission(user, toolName, config) {
+  if (!isRbacEnabled())
+    return;
+  const grant = getUserGrant(user.id);
+  if (grant.grantsAll)
+    return;
+  const decision = decideToolAdmission({
+    rbac: config.rbac,
+    readOnly: config.annotations?.readOnlyHint ?? false,
+    grant
+  });
+  enqueueAdmissionRow({
+    userId: user.id,
+    decision,
+    source: "mcp",
+    toolName
+  });
+  if (decision.allow)
+    return;
+  return {
+    isError: true,
+    content: [{ type: "text", text: `Forbidden: ${decision.reason}` }]
+  };
+}
 function createUserServer(user) {
   const server = new McpServer({
     name: `${package_default.name}-user`,
@@ -7575,44 +7636,77 @@ function createUserServer(user) {
     }
   });
   const registerTool = createToolRegistrar(server);
-  registerTool("send-task", {
+  const sendTaskConfig = {
     title: "Send a task",
     annotations: { destructiveHint: false },
+    rbac: permission("task.create.own"),
     description: "Creates an unassigned task requested by the authenticated user.",
     inputSchema: userSendTaskInputSchema,
     outputSchema: sendTaskOutputSchema
-  }, async (args, info, _meta) => sendTaskHandler(userCtx(user, info.sessionId), {
-    offerMode: false,
-    allowDuplicate: false,
-    ...args
-  }));
-  registerTool("get-tasks", {
+  };
+  registerTool("send-task", sendTaskConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "send-task", sendTaskConfig);
+    if (denied)
+      return denied;
+    return sendTaskHandler(userCtx(user, info.sessionId), {
+      offerMode: false,
+      allowDuplicate: false,
+      ...args
+    });
+  });
+  const getTasksConfig = {
     title: "Get tasks",
     description: "Returns tasks requested by the authenticated user.",
     annotations: { readOnlyHint: true },
     inputSchema: getTasksInputSchema,
     outputSchema: getTasksOutputSchema
-  }, async (args, info, _meta) => getTasksHandler(userCtx(user, info.sessionId), args));
-  registerTool("get-task-details", {
+  };
+  registerTool("get-tasks", getTasksConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "get-tasks", getTasksConfig);
+    if (denied)
+      return denied;
+    return getTasksHandler(userCtx(user, info.sessionId), args);
+  });
+  const getTaskDetailsConfig = {
     title: "Get task details",
     description: "Returns detailed information about one of your tasks.",
     annotations: { readOnlyHint: true },
     inputSchema: getTaskDetailsInputSchema,
     outputSchema: getTaskDetailsOutputSchema
-  }, async (args, info, _meta) => getTaskDetailsHandler(userCtx(user, info.sessionId), args));
-  registerTool("cancel-task", {
+  };
+  registerTool("get-task-details", getTaskDetailsConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "get-task-details", getTaskDetailsConfig);
+    if (denied)
+      return denied;
+    return getTaskDetailsHandler(userCtx(user, info.sessionId), args);
+  });
+  const cancelTaskConfig = {
     title: "Cancel Task",
     description: "Cancel one of your pending or in-progress tasks.",
     annotations: { destructiveHint: true },
+    rbac: permission("task.cancel.own"),
     inputSchema: cancelTaskInputSchema,
     outputSchema: cancelTaskOutputSchema
-  }, async (args, info, _meta) => cancelTaskHandler(userCtx(user, info.sessionId), args));
-  registerTool("task-action", {
+  };
+  registerTool("cancel-task", cancelTaskConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "cancel-task", cancelTaskConfig);
+    if (denied)
+      return denied;
+    return cancelTaskHandler(userCtx(user, info.sessionId), args);
+  });
+  const taskActionConfig = {
     title: "Task Pool Action",
     description: "Move one of your tasks to or from backlog.",
+    rbac: permission("task.action.own"),
     inputSchema: taskActionInputSchema,
     outputSchema: taskActionOutputSchema
-  }, async (args, info, _meta) => taskActionHandler(userCtx(user, info.sessionId), args));
+  };
+  registerTool("task-action", taskActionConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "task-action", taskActionConfig);
+    if (denied)
+      return denied;
+    return taskActionHandler(userCtx(user, info.sessionId), args);
+  });
   return server;
 }
 
@@ -10804,7 +10898,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         }
         if (agent.isLead) {} else {
           if (hasCapacity(myAgentId)) {
-            const unassignedIds = getUnassignedTaskIds(5);
+            const unassignedIds = getUnassignedTaskIdsForAgent(myAgentId, 5);
             if (unassignedIds.length > 0) {
               const candidateId = unassignedIds[0];
               const candidateTask = getTaskById(candidateId);
@@ -14041,7 +14135,8 @@ var searchRoute = route({
   responses: {
     200: { description: "Matching scripts" },
     400: { description: "Validation error" }
-  }
+  },
+  rbac: { permission: "script.search" }
 });
 var deleteRoute = route({
   method: "delete",
@@ -14154,7 +14249,8 @@ var createScriptApiRoute = route({
     201: { description: "Endpoint created" },
     400: { description: "Validation error or script has no owning agent" },
     404: { description: "Script not found" }
-  }
+  },
+  rbac: { permission: "script.api.create" }
 });
 var listScriptApisRoute = route({
   method: "get",
@@ -14180,7 +14276,8 @@ var revealScriptApiSecretRoute = route({
   responses: {
     200: { description: "Decrypted token (null when authMode is 'none')" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.read.secrets" }
 });
 var patchScriptApiRoute = route({
   method: "patch",
@@ -14194,7 +14291,8 @@ var patchScriptApiRoute = route({
   responses: {
     200: { description: "Updated endpoint" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.update" }
 });
 var rotateScriptApiRoute = route({
   method: "post",
@@ -14208,7 +14306,8 @@ var rotateScriptApiRoute = route({
     200: { description: "Endpoint with new plaintext token" },
     400: { description: "Endpoint uses 'none' auth — nothing to rotate" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.rotate" }
 });
 var deleteScriptApiRoute = route({
   method: "delete",
@@ -14221,7 +14320,8 @@ var deleteScriptApiRoute = route({
   responses: {
     200: { description: "Deleted" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.delete" }
 });
 function requireAgent2(res, agentId) {
   if (!agentId) {
@@ -15108,6 +15208,7 @@ var bulkUpsertSkillFilesRoute = route({
   summary: "Bulk upsert bundled files for a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.object({
     files: exports_external.array(skillFileWithPathSchema).max(100)
@@ -15140,6 +15241,7 @@ var upsertSkillFileRoute = route({
   summary: "Upsert a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string(), path: exports_external.string() }),
   body: skillFileBodySchema,
   responses: {
@@ -15156,6 +15258,7 @@ var deleteSkillFileRoute = route({
   summary: "Delete a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string(), path: exports_external.string() }),
   responses: {
     200: { description: "Skill file deleted" },
@@ -15169,6 +15272,7 @@ var createSkillRoute = route({
   summary: "Create a new skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.create.swarm" },
   body: exports_external.object({
     content: exports_external.string().min(1),
     type: exports_external.string().optional(),
@@ -15188,6 +15292,7 @@ var updateSkillRoute = route({
   summary: "Update a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.record(exports_external.string(), exports_external.unknown()),
   responses: {
@@ -15203,6 +15308,7 @@ var deleteSkillRoute = route({
   summary: "Delete a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.delete.any" },
   params: exports_external.object({ id: exports_external.string() }),
   responses: {
     200: { description: "Skill deleted" },
@@ -15217,6 +15323,7 @@ var installSkillRoute = route({
   summary: "Install skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.object({
     agentId: exports_external.string()
@@ -15233,6 +15340,7 @@ var uninstallSkillRoute = route({
   summary: "Uninstall skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.uninstall.any" },
   params: exports_external.object({ id: exports_external.string(), agentId: exports_external.string() }),
   responses: {
     200: { description: "Skill uninstalled" }
@@ -15245,6 +15353,7 @@ var installRemoteRoute = route({
   summary: "Install a remote skill from GitHub",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.global" },
   body: exports_external.object({
     sourceRepo: exports_external.string(),
     sourcePath: exports_external.string().optional(),
@@ -15263,6 +15372,7 @@ var syncRemoteRoute = route({
   summary: "Trigger remote skill sync",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   body: exports_external.object({
     skillId: exports_external.string().optional(),
     force: exports_external.boolean().optional()
@@ -15278,6 +15388,7 @@ var syncFilesystemRoute = route({
   summary: "Sync installed skills to agent filesystem",
   tags: ["Skills"],
   auth: { apiKey: true, agentId: true },
+  rbac: { ungated: "self-scoped: syncs the caller's own agent FS" },
   responses: {
     200: { description: "Filesystem sync results" }
   }
@@ -16636,7 +16747,13 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await createTask.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const requestedByUserId = resolveHttpAuditUserId(req, myAgentId) ?? undefined;
+    let requestedByUserId = resolveHttpAuditUserId(req, myAgentId) ?? undefined;
+    const trustBodyRequestedByUserId = process.env.TRUST_BODY_REQUESTED_BY_USER_ID === "true";
+    if (trustBodyRequestedByUserId && !requestedByUserId && parsed.body.requestedByUserId) {
+      const candidate = findUserById(parsed.body.requestedByUserId);
+      if (candidate)
+        requestedByUserId = candidate.id;
+    }
     let defaultAgentId = parsed.body.agentId || undefined;
     if (!defaultAgentId) {
       const lead = getLeadAgent();
@@ -20199,14 +20316,14 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-f03rnnrs.js");
+    const { stopScheduler } = await import("./index-9ht8gr56.js");
     stopScheduler();
   }
   stopHeartbeat();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-pm6g2wpw.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-3cps6e3e.js");
     await stopOAuthKeepalive();
   }
   stopMcpOAuthPendingGc();
@@ -20263,15 +20380,15 @@ try {
   throw err;
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-m9h69d2t.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-h2kdq4cq.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-2kk2ap9b.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-0hvazmkf.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-xdc5208b.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-kfesjy9y.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -20279,7 +20396,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-df8fmphk.js");
+  const { runAllSeeders } = await import("./index-rm85cfdx.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -20315,35 +20432,35 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-f03rnnrs.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-jbm7qcqk.js");
+    const { startScheduler } = await import("./index-9ht8gr56.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-9fqaktjr.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (process.env.HEARTBEAT_DISABLE !== "true") {
-    const { startHeartbeat } = await import("./index-ty42rxw9.js");
+    const { startHeartbeat } = await import("./index-47em3d2n.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-pm6g2wpw.js");
+    const { startOAuthKeepalive } = await import("./keepalive-3cps6e3e.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-mjsbmsk2.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-sycqtbph.js");
     startOAuthRefreshSweep();
   }
   startMcpOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-b9sbk87z.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-qata34xa.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-awr2179r.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-4jpxhb25.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-c1zsaw9m.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-tv48nn3z.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {

package/dist/{index-ty42rxw9.js → index-47em3d2n.js}

@@ -4,25 +4,25 @@ import {
   runRebootSweep,
   startHeartbeat,
   stopHeartbeat
-} from "./cli-q4e2x252.js";
-import"./cli-2t4e4ayk.js";
-import"./cli-a6tzw6vq.js";
+} from "./cli-beea4a3y.js";
+import"./cli-dcca6j8m.js";
+import"./cli-q1rx7g0d.js";
 import"./cli-f14fvzag.js";
-import"./cli-pnfyyp6h.js";
+import"./cli-r9f6ngrf.js";
 import"./cli-jkhwmmgg.js";
-import"./cli-f9n2jg31.js";
-import"./cli-byjcad11.js";
+import"./cli-cmw9rzy5.js";
+import"./cli-7xje5amz.js";
 import"./cli-q25ejbyn.js";
-import"./cli-49j095n9.js";
+import"./cli-t0vqevnm.js";
 import"./cli-0pygq9r1.js";
 import"./cli-wspgs9bt.js";
-import"./cli-312v3c41.js";
+import"./cli-k3y4z3h5.js";
 import"./cli-dh55d5fg.js";
-import"./cli-jzwtn8rm.js";
+import"./cli-15y7qhzp.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-f5pzfvwb.js";
+import"./cli-b23axgz4.js";
 import"./cli-4j2mrzag.js";
 import"./cli-9aryf9tv.js";
 import"./cli-p9swy5t3.js";