@desplega.ai/agent-swarm 1.119.6 → 1.121.0

package/dist/{cli-g6qz2kts.js → cli-0df2g86x.js}

@@ -2,6 +2,14 @@ import {
   deriveProviderFromKeyType,
   init_credentials
 } from "./cli-z2zcxes1.js";
+import {
+  init_package,
+  package_default
+} from "./cli-46etyprn.js";
+import {
+  init_secret_scrubber,
+  scrubSecrets
+} from "./cli-4j2mrzag.js";
 import {
   init_zod
 } from "./cli-bw80ck94.js";
@@ -23,14 +31,6 @@ import {
   unknown,
   uuid
 } from "./cli-xz9aq0rf.js";
-import {
-  init_package,
-  package_default
-} from "./cli-pasyk3vc.js";
-import {
-  init_secret_scrubber,
-  scrubSecrets
-} from "./cli-4j2mrzag.js";
 import {
   __commonJS,
   __esm,
@@ -803,7 +803,7 @@ function resolveTaskModelSelection(opts) {
 function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUSES.includes(status);
 }
-var AssetKeySchema, AssetEntityTypeSchema, AssetProviderRefSchema, AssetKeyMappingSchema, AssetSummarySchema, ModelTierSchema, MODEL_TIERS, ReasoningEffortSchema, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, RoutingAffinitySchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, FavoriteItemTypeSchema, UserFavoriteSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskTargetTypeSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, WebhookVerificationSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, ScriptApiAuthModeSchema, ScriptApiRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
+var AssetKeySchema, AssetEntityTypeSchema, AssetProviderRefSchema, AssetKeyMappingSchema, AssetSummarySchema, ModelTierSchema, MODEL_TIERS, ReasoningEffortSchema, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, RoutingAffinitySchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, FavoriteItemTypeSchema, UserFavoriteSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentAvatarSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskTargetTypeSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, WebhookVerificationSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, ScriptApiAuthModeSchema, ScriptApiRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
 var init_types = __esm(() => {
   init_zod();
   init_key();
@@ -968,6 +968,7 @@ var init_types = __esm(() => {
     agentId: uuid().nullable(),
     creatorAgentId: uuid().optional(),
     task: string().min(1),
+    title: string().optional(),
     status: AgentTaskStatusSchema,
     source: AgentTaskSourceSchema.default("mcp"),
     taskType: string().max(50).optional(),
@@ -1166,6 +1167,13 @@ var init_types = __esm(() => {
     createdAt: string()
   });
   AgentStatusSchema = _enum(["idle", "busy", "offline", "waiting_for_credentials"]);
+  AgentAvatarSchema = discriminatedUnion("type", [
+    object({
+      type: literal("lucide"),
+      icon: string().regex(/^[a-z0-9-]+$/).max(64),
+      color: string().regex(/^#[0-9a-fA-F]{6}$/).optional()
+    })
+  ]);
   AgentSchema = object({
     id: uuid(),
     name: string().min(1),
@@ -1187,6 +1195,7 @@ var init_types = __esm(() => {
     harnessProvider: ProviderNameSchema.nullable().optional(),
     credentialMissing: array(string()).nullable().optional(),
     credStatus: lazy(() => AgentCredStatusSchema).nullable().optional(),
+    avatar: lazy(() => AgentAvatarSchema).nullable().optional(),
     createdAt: exports_iso.datetime().default(() => new Date().toISOString()),
     lastUpdatedAt: exports_iso.datetime().default(() => new Date().toISOString())
   });
@@ -2378,6 +2387,220 @@ var init_asset_key_audit = __esm(() => {
   ];
 });
 
+// src/scripts-runtime/credential-broker/types.ts
+function placeholderForConfigKey(configKey) {
+  return `${REDACTED_PLACEHOLDER_PREFIX}${configKey}]`;
+}
+function normalizeCredentialBindingsDocument(input, resolveLegacyOAuthProvider, defaultScope) {
+  const document = Array.isArray(input) ? input : input && typeof input === "object" && Array.isArray(input.bindings) ? input.bindings : [];
+  return document.flatMap((raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+      return [];
+    const candidate = { ...raw };
+    if (defaultScope !== undefined && candidate.scope == null) {
+      candidate.scope = defaultScope;
+    }
+    if (candidate.authKind === "oauth" && typeof candidate.oauthAuthorizationId !== "string" && typeof candidate.oauthProvider === "string") {
+      const authorizationId = resolveLegacyOAuthProvider?.(candidate.oauthProvider);
+      if (!authorizationId)
+        return [];
+      candidate.oauthAuthorizationId = authorizationId;
+    }
+    const parsed = CredentialBindingSchema.safeParse(candidate);
+    return parsed.success ? [parsed.data] : [];
+  });
+}
+var CREDENTIAL_BINDINGS_CONFIG_KEY = "SCRIPT_CREDENTIAL_BINDINGS", REDACTED_PLACEHOLDER_PREFIX = "[REDACTED:", CredentialBindingScopeSchema, CredentialBindingAuthKindSchema, CredentialBindingSchema, CredentialBindingsDocumentSchema;
+var init_types2 = __esm(() => {
+  init_zod();
+  CredentialBindingScopeSchema = _enum(["global", "agent", "repo"]);
+  CredentialBindingAuthKindSchema = _enum(["config", "oauth"]);
+  CredentialBindingSchema = object({
+    configKey: string().min(1).max(255),
+    allowedHosts: array(string().min(1)).min(1),
+    headerTemplate: string().min(1).optional(),
+    queryTemplate: string().min(1).optional(),
+    scope: CredentialBindingScopeSchema.default("global"),
+    scopeId: string().nullable().optional(),
+    active: boolean().default(true),
+    authKind: CredentialBindingAuthKindSchema.default("config"),
+    oauthAuthorizationId: string().min(1).max(255).optional()
+  }).refine((binding) => binding.headerTemplate || binding.queryTemplate, {
+    message: "At least one of headerTemplate or queryTemplate is required."
+  }).refine((binding) => binding.authKind !== "oauth" || !!binding.oauthAuthorizationId, {
+    message: "oauthAuthorizationId is required when authKind is oauth.",
+    path: ["oauthAuthorizationId"]
+  });
+  CredentialBindingsDocumentSchema = union([
+    array(CredentialBindingSchema),
+    object({ bindings: array(CredentialBindingSchema) })
+  ]);
+});
+
+// src/scripts-runtime/credential-broker/broker.ts
+function bindingHasPlaceholder(binding) {
+  const placeholder = placeholderForConfigKey(binding.configKey);
+  return binding.headerTemplate?.includes(placeholder) === true || binding.queryTemplate?.includes(placeholder) === true;
+}
+function reasonFromError(err) {
+  const reason = err.reason;
+  return typeof reason === "string" && reason.length > 0 ? reason : "refresh_failed";
+}
+function labelFromError(err) {
+  const label = err.authorizationLabel;
+  return typeof label === "string" && label.length > 0 ? label : undefined;
+}
+
+class CredentialBroker {
+  store;
+  resolveConfigCredential;
+  defaults;
+  resolveOAuthCredential;
+  constructor(store, resolveConfigCredential, defaults = [], resolveOAuthCredential) {
+    this.store = store;
+    this.resolveConfigCredential = resolveConfigCredential;
+    this.defaults = defaults;
+    this.resolveOAuthCredential = resolveOAuthCredential;
+  }
+  async resolveBindingsWithFailures(context) {
+    const merged = [...this.defaults, ...this.store.listActiveBindings(context)];
+    const resolved = [];
+    const failed = [];
+    const seen = new Set;
+    const failedSeen = new Set;
+    for (const binding of merged) {
+      if (binding.active === false)
+        continue;
+      if (!bindingHasPlaceholder(binding))
+        continue;
+      let value;
+      if (binding.authKind === "oauth") {
+        if (!binding.oauthAuthorizationId)
+          continue;
+        try {
+          value = await this.resolveOAuthCredential?.(binding.oauthAuthorizationId);
+        } catch (err) {
+          const placeholder = placeholderForConfigKey(binding.configKey);
+          const failKey = [placeholder, [...binding.allowedHosts].sort().join(",")].join("\x00");
+          if (!failedSeen.has(failKey)) {
+            failedSeen.add(failKey);
+            const label = labelFromError(err);
+            failed.push({
+              placeholder,
+              allowedHosts: binding.allowedHosts,
+              reason: reasonFromError(err),
+              ...label ? { authorizationLabel: label } : {}
+            });
+          }
+          continue;
+        }
+      } else {
+        value = this.resolveConfigCredential(binding.configKey);
+      }
+      if (!value)
+        continue;
+      const dedupeKey = [
+        binding.configKey,
+        [...binding.allowedHosts].sort().join(","),
+        binding.headerTemplate ?? "",
+        binding.queryTemplate ?? "",
+        binding.scope,
+        binding.scopeId ?? ""
+      ].join("\x00");
+      if (seen.has(dedupeKey))
+        continue;
+      seen.add(dedupeKey);
+      resolved.push({
+        ...binding,
+        placeholder: placeholderForConfigKey(binding.configKey),
+        value
+      });
+    }
+    return { resolved, failed };
+  }
+  async resolveBindings(context) {
+    return (await this.resolveBindingsWithFailures(context)).resolved;
+  }
+}
+var init_broker = __esm(() => {
+  init_types2();
+});
+
+// src/scripts-runtime/credential-broker/default-bindings.ts
+var DEFAULT_CREDENTIAL_BINDINGS;
+var init_default_bindings = __esm(() => {
+  DEFAULT_CREDENTIAL_BINDINGS = [
+    {
+      configKey: "GITHUB_TOKEN",
+      allowedHosts: ["api.github.com"],
+      headerTemplate: "Authorization: Bearer [REDACTED:GITHUB_TOKEN]",
+      scope: "global",
+      scopeId: null,
+      active: true,
+      authKind: "config"
+    }
+  ];
+});
+
+// src/scripts-runtime/credential-broker/fetch-patch.ts
+var init_fetch_patch = () => {};
+
+// src/scripts-runtime/credential-broker/index.ts
+var init_credential_broker = __esm(() => {
+  init_broker();
+  init_default_bindings();
+  init_fetch_patch();
+  init_types2();
+});
+
+// src/be/connection-bindings-blob-migration.ts
+function migrateLegacyCredentialBindingBlob(database) {
+  const rows = database.prepare("SELECT id, scope, scopeId, value FROM swarm_config WHERE key = ?").all(CREDENTIAL_BINDINGS_CONFIG_KEY);
+  if (rows.length === 0)
+    return 0;
+  const resolveLegacyOAuthProvider = (provider) => {
+    const row = database.prepare(`SELECT z.id
+         FROM oauth_authorizations z
+         JOIN oauth_apps a ON a.id = z.appId
+         WHERE a.provider = ? AND a.mcpServerId IS NULL AND z.label = 'default'
+         ORDER BY a.createdAt ASC, a.id ASC
+         LIMIT 1`).get(provider);
+    return row?.id;
+  };
+  const insert = database.prepare(`INSERT OR IGNORE INTO script_credential_bindings
+       (id, config_key, allowed_hosts_json, header_template, query_template, scope, scope_id,
+        active, auth_kind, oauth_authorization_id, source, managed_by_connection_id,
+        created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'migration', NULL,
+             datetime('now'), datetime('now'))`);
+  let imported = 0;
+  const tx = database.transaction(() => {
+    for (const config of rows) {
+      let bindings;
+      try {
+        bindings = normalizeCredentialBindingsDocument(JSON.parse(config.value), resolveLegacyOAuthProvider, config.scope);
+      } catch (err) {
+        console.warn(`[credential-bindings] Skipping unparseable SCRIPT_CREDENTIAL_BINDINGS entry (config id ${config.id}, scope ${config.scope}): ${scrubSecrets(err instanceof Error ? err.message : String(err))}`);
+        continue;
+      }
+      for (const binding of bindings) {
+        const scope = binding.scope ?? config.scope;
+        const scopeId = binding.scopeId ?? config.scopeId ?? null;
+        insert.run(crypto.randomUUID(), binding.configKey, JSON.stringify(binding.allowedHosts), binding.headerTemplate ?? null, binding.queryTemplate ?? null, scope, scope === "global" ? null : scopeId, binding.active === false ? 0 : 1, binding.authKind, binding.oauthAuthorizationId ?? null);
+        imported += 1;
+      }
+    }
+    database.prepare("DELETE FROM swarm_config WHERE key = ?").run(CREDENTIAL_BINDINGS_CONFIG_KEY);
+  });
+  tx();
+  console.log(`[credential-bindings] Migrated ${imported} legacy SCRIPT_CREDENTIAL_BINDINGS entr(ies) to relational rows and retired the blob key.`);
+  return imported;
+}
+var init_connection_bindings_blob_migration = __esm(() => {
+  init_credential_broker();
+  init_secret_scrubber();
+});
+
 // src/be/crypto/secrets-cipher.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 function assertKey(key) {
@@ -2692,6 +2915,45 @@ var init_runner = __esm(() => {
   ];
 });
 
+// src/be/oauth-encryption-backfill.ts
+function autoEncryptLegacyOAuthSecrets(database) {
+  const apps = database.prepare(`SELECT id, clientSecret
+       FROM oauth_apps
+       WHERE clientSecretEncrypted = 0 AND clientSecret IS NOT NULL`).all();
+  const authorizations = database.prepare(`SELECT id, accessToken, refreshToken
+       FROM oauth_authorizations
+       WHERE tokensEncrypted = 0`).all();
+  if (apps.length === 0 && authorizations.length === 0) {
+    console.log("[oauth-encryption] No plaintext OAuth secrets to migrate.");
+    return { appsEncrypted: 0, authorizationsEncrypted: 0 };
+  }
+  const key = getEncryptionKey();
+  const updateApp = database.prepare(`UPDATE oauth_apps
+     SET clientSecret = ?, clientSecretEncrypted = 1,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND clientSecretEncrypted = 0`);
+  const updateAuthorization = database.prepare(`UPDATE oauth_authorizations
+     SET accessToken = ?, refreshToken = ?, tokensEncrypted = 1,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND tokensEncrypted = 0`);
+  database.transaction(() => {
+    for (const app of apps) {
+      updateApp.run(encryptSecret(app.clientSecret, key), app.id);
+    }
+    for (const authorization of authorizations) {
+      updateAuthorization.run(encryptSecret(authorization.accessToken, key), authorization.refreshToken == null ? null : encryptSecret(authorization.refreshToken, key), authorization.id);
+    }
+  })();
+  console.log(`[oauth-encryption] Migrated ${apps.length} app secret(s) and ${authorizations.length} authorization token set(s).`);
+  return {
+    appsEncrypted: apps.length,
+    authorizationsEncrypted: authorizations.length
+  };
+}
+var init_oauth_encryption_backfill = __esm(() => {
+  init_crypto();
+});
+
 // src/prompts/session-templates.ts
 var init_session_templates = __esm(() => {
   init_registry();
@@ -2825,7 +3087,6 @@ As a worker agent of the swarm, you are responsible for executing tasks assigned
 
 - \`store-progress\`: Save your work progress on tasks (critical!)
 - \`task-action\`: Manage tasks - claim from pool, release, accept/reject offered tasks
-- \`read-messages\`: Read messages from the lead or other workers
 
 #### Completing Tasks
 
@@ -2855,6 +3116,18 @@ curl -H "Authorization: Bearer lin_oauth_abc123..." https://api.example.com
 \`\`\`
 
 The same applies to \`store-progress\` output — never include raw secret values in progress text, output, or failure reasons.
+`,
+    variables: [],
+    category: "system"
+  });
+  registerTemplate({
+    eventType: "system.agent.messaging",
+    header: "",
+    defaultBody: `
+#### Swarm Messaging
+
+- \`post-message\`: Post a message to a swarm channel (use \`mentions\` to notify specific agents, \`replyTo\` to thread)
+- \`read-messages\`: Read messages from the lead or other agents (filters: \`unreadOnly\`, \`mentionsOnly\`)
 `,
     variables: [],
     category: "system"
@@ -4164,6 +4437,7 @@ __export(exports_db, {
   updateWorkflow: () => updateWorkflow,
   updateUser: () => updateUser,
   updateTaskVcs: () => updateTaskVcs,
+  updateTaskTitle: () => updateTaskTitle,
   updateTaskProgress: () => updateTaskProgress,
   updateTaskClaudeSessionId: () => updateTaskClaudeSessionId,
   updateSwarmRepo: () => updateSwarmRepo,
@@ -4661,15 +4935,34 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
   seedContextVersions();
   configureDbResolver(resolvePromptTemplate);
   seedDefaultTemplates();
-  const hasExistingEncryptedSecrets = (database.prepare("SELECT EXISTS(SELECT 1 FROM swarm_config WHERE isSecret = 1 AND encrypted = 1) as present").get()?.present ?? 0) === 1;
+  const hasExistingEncryptedSecrets = (database.prepare(`SELECT EXISTS(
+           SELECT 1 FROM swarm_config WHERE isSecret = 1 AND encrypted = 1
+           UNION ALL
+           SELECT 1 FROM oauth_apps
+             WHERE clientSecretEncrypted = 1 AND clientSecret IS NOT NULL
+           UNION ALL
+           SELECT 1 FROM oauth_authorizations WHERE tokensEncrypted = 1
+         ) AS present`).get()?.present ?? 0) === 1;
   const userProvidedKey = !!(process.env.SECRETS_ENCRYPTION_KEY?.length || process.env.SECRETS_ENCRYPTION_KEY_FILE?.length);
   resolveEncryptionKey(dbPath, { allowGenerate: !hasExistingEncryptedSecrets });
+  try {
+    autoEncryptLegacyOAuthSecrets(database);
+  } catch (err) {
+    console.error(`[oauth-encryption] FATAL: failed to auto-encrypt legacy OAuth secrets: ${err.message}`);
+    throw err;
+  }
   try {
     autoEncryptLegacyPlaintextSecrets(database, dbPath, { createBackup: !userProvidedKey });
   } catch (err) {
     console.error(`[secrets] FATAL: failed to auto-encrypt legacy secrets: ${err.message}`);
     throw err;
   }
+  try {
+    migrateLegacyCredentialBindingBlob(database);
+  } catch (err) {
+    console.error(`[credential-bindings] FATAL: failed to migrate legacy credential binding blob: ${err.message}`);
+    throw err;
+  }
   return db;
 }
 function getDb(path2) {
@@ -4763,6 +5056,16 @@ function seedContextVersions() {
     }
   }
 }
+function parseAgentAvatar(raw) {
+  if (!raw)
+    return null;
+  try {
+    const parsed = AgentAvatarSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
 function rowToAgent(row, slim = false) {
   const base = {
     id: row.id,
@@ -4780,7 +5083,8 @@ function rowToAgent(row, slim = false) {
     createdAt: row.createdAt,
     lastUpdatedAt: row.lastUpdatedAt,
     credentialMissing: row.credentialMissing ? JSON.parse(row.credentialMissing) : null,
-    credStatus: row.cred_status ? JSON.parse(row.cred_status) : null
+    credStatus: row.cred_status ? JSON.parse(row.cred_status) : null,
+    avatar: parseAgentAvatar(row.avatar)
   };
   if (slim)
     return base;
@@ -5007,6 +5311,7 @@ function rowToAgentTask(row) {
     agentId: row.agentId,
     creatorAgentId: row.creatorAgentId ?? undefined,
     task: row.task,
+    title: row.title ?? undefined,
     status: row.status,
     source: row.source,
     taskType: row.taskType ?? undefined,
@@ -5081,6 +5386,7 @@ function rowToAgentTaskSummary(row) {
     agentId: t.agentId,
     creatorAgentId: t.creatorAgentId,
     task: previewText(t.task, TASK_PREVIEW_LENGTH),
+    title: t.title,
     status: t.status,
     source: t.source,
     taskType: t.taskType,
@@ -5263,6 +5569,11 @@ function updateTaskClaudeSessionId(taskId, claudeSessionId, provider, providerMe
   const row = getDb().prepare(`UPDATE agent_tasks SET ${setClauses.join(", ")} WHERE id = ? RETURNING *`).get(...params);
   return row ? rowToAgentTask(row) : null;
 }
+function updateTaskTitle(taskId, title) {
+  const normalized = title === null ? null : title.trim() || null;
+  const row = getDb().prepare("UPDATE agent_tasks SET title = ? WHERE id = ? RETURNING *").get(normalized, taskId);
+  return row ? rowToAgentTask(row) : null;
+}
 function updateTaskVcs(taskId, vcs) {
   const row = getDb().prepare(`UPDATE agent_tasks
        SET vcsProvider = ?, vcsRepo = ?, vcsNumber = ?, vcsUrl = ?, lastUpdatedAt = ?
@@ -6910,6 +7221,8 @@ function updateAgentProfile(id, updates, meta) {
         previousVersionId: latestVersion?.id ?? null
       });
     }
+    const avatarProvided = Object.hasOwn(updates, "avatar");
+    const avatarJson = updates.avatar ? JSON.stringify(updates.avatar) : null;
     const now = new Date().toISOString();
     const row = database.prepare(`UPDATE agents SET
           description = COALESCE(?, description),
@@ -6921,8 +7234,9 @@ function updateAgentProfile(id, updates, meta) {
           setupScript = COALESCE(?, setupScript),
           toolsMd = COALESCE(?, toolsMd),
           heartbeatMd = COALESCE(?, heartbeatMd),
+          avatar = CASE WHEN ? = 1 THEN ? ELSE avatar END,
           lastUpdatedAt = ?
-         WHERE id = ? RETURNING *`).get(updates.description ?? null, updates.role ?? null, updates.capabilities ? JSON.stringify(updates.capabilities) : null, updates.claudeMd ?? null, updates.soulMd ?? null, updates.identityMd ?? null, updates.setupScript ?? null, updates.toolsMd ?? null, updates.heartbeatMd ?? null, now, id);
+         WHERE id = ? RETURNING *`).get(updates.description ?? null, updates.role ?? null, updates.capabilities ? JSON.stringify(updates.capabilities) : null, updates.claudeMd ?? null, updates.soulMd ?? null, updates.identityMd ?? null, updates.setupScript ?? null, updates.toolsMd ?? null, updates.heartbeatMd ?? null, avatarProvided ? 1 : 0, avatarJson, now, id);
     return row ? rowToAgent(row) : null;
   })();
 }
@@ -10490,8 +10804,9 @@ function listRecentSessions(opts) {
     params.push(...sources);
   }
   if (q && q.length > 0) {
-    conditions.push("lower(r.task) LIKE ?");
-    params.push(`%${q.toLowerCase()}%`);
+    conditions.push("(lower(r.task) LIKE ? OR lower(COALESCE(r.title, '')) LIKE ?)");
+    const like = `%${q.toLowerCase()}%`;
+    params.push(like, like);
   }
   if (requestedByUserId) {
     conditions.push("r.requestedByUserId = ?");
@@ -10563,8 +10878,9 @@ function countSessions(opts) {
     params.push(...sources);
   }
   if (q && q.length > 0) {
-    conditions.push("lower(task) LIKE ?");
-    params.push(`%${q.toLowerCase()}%`);
+    conditions.push("(lower(task) LIKE ? OR lower(COALESCE(title, '')) LIKE ?)");
+    const like = `%${q.toLowerCase()}%`;
+    params.push(like, like);
   }
   if (requestedByUserId) {
     conditions.push("requestedByUserId = ?");
@@ -11143,9 +11459,11 @@ var init_db = __esm(() => {
   init_request_auth_context();
   init_secret_scrubber();
   init_asset_key_audit();
+  init_connection_bindings_blob_migration();
   init_crypto();
   init_date_utils();
   init_runner();
+  init_oauth_encryption_backfill();
   init_seed_prompt_templates();
   init_swarm_config_guard();
   init_task_lifecycle_events();
@@ -11243,4 +11561,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { normalizeAssetKey, parseAssetKey, canWriteAssetKey, init_key, interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, AssetKeySchema, AssetEntityTypeSchema, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { normalizeAssetKey, parseAssetKey, canWriteAssetKey, init_key, interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, AssetKeySchema, AssetEntityTypeSchema, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentAvatarSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskTitle, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };