@desplega.ai/agent-swarm 1.124.0 → 1.125.0

package/dist/{cli-x268say8.js → cli-wbcsjpyv.js}

@@ -13,22 +13,22 @@ import {
   ensure,
   require_dist,
   runScheduleNow
-} from "./cli-2yr6edr7.js";
+} from "./cli-4xft7caa.js";
 import {
   startPricingRefreshLoop
-} from "./cli-qf7acvyr.js";
+} from "./cli-94796kxr.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-gzjsamwc.js";
+} from "./cli-q92pr3rt.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-zxb72ctk.js";
+} from "./cli-3x5aphbt.js";
 import {
   can,
   decideAdmission,
   isRbacEnabled
-} from "./cli-y43n987v.js";
+} from "./cli-gbx122ge.js";
 import {
   createTrackerAgentMapping,
   createTrackerSync,
@@ -43,7 +43,7 @@ import {
   repointTrackerSyncBySwarmId,
   updateTrackerSync,
   updateTrackerSyncSwarmId
-} from "./cli-gkvf8d83.js";
+} from "./cli-n02497b2.js";
 import {
   TriggerSchemaError,
   applyDefinitionPatch,
@@ -57,7 +57,7 @@ import {
   startWorkflowExecution,
   validateDefinition,
   validateJsonSchema
-} from "./cli-kk58tg33.js";
+} from "./cli-5a4nmfrn.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -67,7 +67,7 @@ import {
   ensureToken,
   ensureTokenOrThrow,
   onAuthorizationRefreshed
-} from "./cli-h89g0qrd.js";
+} from "./cli-v292k2fv.js";
 import {
   ConnectionAuthInputSchema,
   assertUrlSafe,
@@ -82,7 +82,7 @@ import {
   setScriptConnectionEnabled,
   upsertCredentialBinding,
   upsertScriptConnection
-} from "./cli-wn3m6q54.js";
+} from "./cli-dbmh9yqn.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   computeScore,
@@ -94,7 +94,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-p0ec4vv6.js";
+} from "./cli-ff8b5cbe.js";
 import {
   createOAuthApp,
   getAuthorizationById,
@@ -104,7 +104,7 @@ import {
   getOAuthTokens,
   listAuthorizationsForApp,
   upsertOAuthApp
-} from "./cli-mcez7z4p.js";
+} from "./cli-vvbwy286.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -113,7 +113,7 @@ import {
   createAdditiveBuffer,
   extractSlackMessageText,
   parseSlackTs
-} from "./cli-92bqgbgy.js";
+} from "./cli-zhp3t49e.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -129,15 +129,15 @@ import {
   resolveIdentityByEmail,
   resolveUserByToken,
   unlinkIdentity
-} from "./cli-0925phzv.js";
+} from "./cli-0w3mk6r2.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-qwsagsmg.js";
+} from "./cli-k5c6jfzn.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-dq2ssyf0.js";
+} from "./cli-refygp3c.js";
 import {
   markdownToSlack
 } from "./cli-5ncdb7ff.js";
@@ -296,7 +296,6 @@ import {
   getSwarmRepos,
   getTaskAttachments,
   getTaskById,
-  getTemplateDefinition,
   getUnassignedTasksCount,
   getUnreadMessages,
   getUserById,
@@ -313,25 +312,19 @@ import {
   init_credential_broker,
   init_db,
   init_defaults,
-  init_env_flag,
   init_key,
-  init_registry,
   init_request_auth_context,
-  init_resolver,
   init_slack_routing,
   init_steering,
   init_swarm_config_guard,
   init_task_lifecycle_events,
-  init_template,
   init_types,
   insertTaskAttachment,
   installMcpServer,
   installSkill,
-  interpolate,
   isAgentEligibleForTask,
-  isEnvFlagEnabled,
   isReservedConfigKey,
-  isSteeringEnabled1 as isSteeringEnabled,
+  isSteeringEnabled,
   isTerminalTaskStatus,
   linearContextKey,
   listKv,
@@ -348,25 +341,23 @@ import {
   normalizeAssetKey,
   onTaskStarted,
   parseAssetKey,
-  parseEnvFlag,
   placeholderForConfigKey,
   postMessage,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
-  registerTemplate,
   rejectTask,
   releaseMentionProcessing,
   releaseTask,
   requestSteering,
   reservedKeyError,
   resetEmptyPollCount,
-  resolveTemplate,
   searchSkills,
   setBudgetRefusalFollowUpTaskId,
   setRequestAuth,
   shouldBlockPolling,
   splitLegacyModelAlias,
   startTask,
+  sweepExpiredKvPrefix,
   uninstallMcpServer,
   uninstallSkill,
   updateAgentName,
@@ -390,11 +381,23 @@ import {
   upsertService,
   upsertSwarmConfig,
   validateConfigValue
-} from "./cli-3z4q09tn.js";
+} from "./cli-yr11vvst.js";
+import {
+  getTemplateDefinition,
+  init_env_flag,
+  init_registry,
+  init_resolver,
+  init_template,
+  interpolate,
+  isEnvFlagEnabled,
+  parseEnvFlag,
+  registerTemplate,
+  resolveTemplate
+} from "./cli-k1py8264.js";
 import {
   init_package,
   package_default
-} from "./cli-p0zgv8pj.js";
+} from "./cli-8vzddbs7.js";
 import {
   init_secret_scrubber,
   refreshSecretScrubberCache,
@@ -22851,7 +22854,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-q2rc9tdr.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-xbt4n4mt.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -22920,7 +22923,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDb: getDb2 } = await import("./db-vn9e4rqj.js");
+  const { getDb: getDb2 } = await import("./db-r5705rk8.js");
   const db = getDb2();
   const txn = db.transaction(() => {
     const row = db.query("SELECT metadata FROM oauth_apps WHERE provider = 'jira'").get();
@@ -97786,6 +97789,22 @@ init_db();
 
 // src/tools/utils.ts
 init_zod();
+init_db();
+
+// src/kv-overflow.ts
+var MCP_OVERFLOW_NAMESPACE = "mcp:overflow";
+function mcpOverflowNamespace(agentId) {
+  return `${MCP_OVERFLOW_NAMESPACE}:${agentId}`;
+}
+function mcpOverflowAuthError(namespace, agentId) {
+  if (namespace !== MCP_OVERFLOW_NAMESPACE && !namespace.startsWith(`${MCP_OVERFLOW_NAMESPACE}:`)) {
+    return null;
+  }
+  if (agentId && namespace === mcpOverflowNamespace(agentId)) {
+    return null;
+  }
+  return "access to another agent's MCP overflow namespace is forbidden";
+}
 
 // src/otel.ts
 function otelConfigured() {
@@ -97816,7 +97835,7 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     return;
   initialized6 = true;
   try {
-    const impl = await import("./otel-impl-7yjkfg68.js");
+    const impl = await import("./otel-impl-vja8f9mm.js");
     await impl.boot(serviceRole);
     realWithSpan = impl.withSpan;
     realStartSpan = impl.startSpan;
@@ -97868,6 +97887,11 @@ function recordSessionCost(m) {
 
 // src/tools/utils.ts
 init_secret_scrubber();
+var scriptSdkRequestOrigins = new WeakSet;
+function markScriptSdkRequestOrigin(meta2) {
+  scriptSdkRequestOrigins.add(meta2);
+  return meta2;
+}
 var getRequestInfo = (req) => {
   const agentIdHeader = req.requestInfo?.headers?.["x-agent-id"];
   const sourceTaskIdHeader = req.requestInfo?.headers?.["x-source-task-id"];
@@ -97894,7 +97918,8 @@ var getRequestInfo = (req) => {
     sessionId: req.sessionId || undefined,
     agentId,
     sourceTaskId,
-    contextKey
+    contextKey,
+    callOrigin: scriptSdkRequestOrigins.has(req) ? "script-sdk" : "mcp"
   };
 };
 var PREVIEW_LIMIT = 500;
@@ -97929,11 +97954,19 @@ function toolResultAttributes(result) {
 }
 var toolOk = (message, extras = {}) => ({ ok: true, message, ...extras });
 var toolErr = (message, extras = {}) => ({ ok: false, message, ...extras });
+var swarmToolTruncationSchema = looseObject({
+  truncated: literal(true),
+  fullValueAt: string(),
+  originalBytes: number(),
+  limitBytes: number(),
+  retrieval: string()
+});
 var swarmToolEnvelopeShape = {
   success: boolean(),
   message: string(),
   details: string().optional(),
-  nudge: string().optional()
+  nudge: string().optional(),
+  truncation: swarmToolTruncationSchema.optional()
 };
 var swarmToolOutputSchema = (dataShape) => looseObject({ ...swarmToolEnvelopeShape, ...dataShape ?? {} });
 var SCRIPT_AUTHORING_NUDGE = "Scripts must `export default async function (args, ctx)` — args FIRST, ctx second; run script-query-types (no name) for the full ctx/SDK type surface, and see the `swarm-scripts` skill for authoring patterns.";
@@ -97955,15 +97988,20 @@ var NUDGES = {
       return;
     const results = r.data?.results;
     return Array.isArray(results) && results.some((entry) => Boolean(entry?.rateHint)) ? "Rate memories that help or mislead you with memory_rate." : undefined;
+  },
+  "kv-get": (r) => {
+    if (!r.ok)
+      return;
+    const entry = r.data?.entry;
+    if (!entry)
+      return;
+    const rendered = typeof entry.value === "string" ? entry.value : JSON.stringify(entry.value) ?? "";
+    return rendered.length > MCP_RESULT_WIRE_LIMIT_BYTES ? "Large value — your harness may truncate this result; to filter or aggregate it, process it in a script via ctx.swarm.kv_get instead." : undefined;
   }
 };
-var DETAILS_CAP = 8000;
-function truncateForText(text) {
-  if (text.length <= DETAILS_CAP)
-    return text;
-  return `${text.slice(0, DETAILS_CAP)}
-… [truncated ${text.length - DETAILS_CAP} chars]`;
-}
+var MCP_RESULT_WIRE_LIMIT_BYTES = 1e4;
+var MCP_OVERFLOW_TTL_MS = 24 * 60 * 60 * 1000;
+var MCP_PROSE_PREVIEW_CHARS = 1200;
 var scrubMiddleware = (result) => result.allowSecretEgress ? result : scrubObject(result);
 var nudgeMiddleware = (result, ctx) => {
   if (result.nudge)
@@ -97971,21 +98009,10 @@ var nudgeMiddleware = (result, ctx) => {
   const nudge = NUDGES[ctx.toolName]?.(result);
   return nudge ? { ...result, nudge } : result;
 };
-var FINALIZE_PIPELINE = [scrubMiddleware, nudgeMiddleware];
-function finalizeSwarmToolResult(toolName, result) {
-  let r = result;
-  if (!r.message?.trim()) {
-    console.warn(`[mcp] tool ${toolName} returned an empty message — every tool must summarize`);
-    r = {
-      ...r,
-      message: r.ok ? "Tool call succeeded (no message provided)." : "Tool call failed (no message provided)."
-    };
-  }
-  for (const middleware of FINALIZE_PIPELINE)
-    r = middleware(r, { toolName });
-  const explicitDetails = r.details?.trim() ? truncateForText(r.details.trim()) : undefined;
-  const dataFallback = !explicitDetails && r.data && Object.keys(r.data).length > 0 ? truncateForText(JSON.stringify(r.data, null, 2)) : undefined;
-  const text = [r.message, explicitDetails ?? dataFallback, r.nudge].filter((part) => Boolean(part?.trim())).join(`
+function composeWireResult(r) {
+  const normalizedDetails = r.details?.trim() || undefined;
+  const dataFallback = !normalizedDetails && r.data && Object.keys(r.data).length > 0 ? JSON.stringify(r.data, null, 2) : undefined;
+  const text = [r.message, r.nudge, normalizedDetails ?? dataFallback].filter((part) => Boolean(part?.trim())).join(`
 
 `);
   const structuredContent = {
@@ -97993,16 +98020,252 @@ function finalizeSwarmToolResult(toolName, result) {
     success: r.ok,
     message: r.message
   };
-  if (explicitDetails)
-    structuredContent.details = explicitDetails;
+  if (normalizedDetails)
+    structuredContent.details = normalizedDetails;
   if (r.nudge)
     structuredContent.nudge = r.nudge;
+  if (r.truncation)
+    structuredContent.truncation = r.truncation;
   return {
     content: [{ type: "text", text }],
     structuredContent,
     isError: !r.ok
   };
 }
+function overflowKey(toolName, value) {
+  const safeToolName = toolName.replace(/[^a-zA-Z0-9._-]/g, "-").slice(0, 80);
+  const hash = new Bun.CryptoHasher("sha256").update(value).digest("hex");
+  return `v1/${safeToolName}/${hash}`;
+}
+function overflowRetrieval(namespace, key) {
+  return `kv-get(${JSON.stringify({ namespace, key })}) returns the full value ` + `(your harness may truncate it); to filter or aggregate it instead, ` + `process it in a script via ctx.swarm.kv_get.`;
+}
+function canonicalOverflowPayload(toolName, result) {
+  const safe = result.allowSecretEgress ? scrubObject(result) : result;
+  return JSON.stringify({
+    version: 1,
+    toolName,
+    outcome: {
+      ok: safe.ok,
+      message: safe.message,
+      ...safe.details ? { details: safe.details } : {},
+      ...safe.data ? { data: safe.data } : {},
+      ...safe.nudge ? { nudge: safe.nudge } : {}
+    }
+  });
+}
+var CTX_CONTROL_EXEMPT_TOOLS = new Set(["kv-get"]);
+function cloneResultData(value) {
+  if (Array.isArray(value))
+    return value.map(cloneResultData);
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+    key,
+    cloneResultData(child)
+  ]));
+}
+function collectArrayTargets(value, path, targets, parent, key) {
+  if (Array.isArray(value)) {
+    if (parent !== undefined && key !== undefined && value.length > 0) {
+      targets.push({ path, parent, key, originalItems: value.slice() });
+    }
+    return;
+  }
+  if (!value || typeof value !== "object")
+    return;
+  for (const [childKey, child] of Object.entries(value)) {
+    collectArrayTargets(child, `${path}.${childKey}`, targets, value, childKey);
+  }
+}
+function setArrayLength(target, length) {
+  target.parent[target.key] = target.originalItems.slice(0, length);
+}
+function currentArrayLength(target) {
+  const value = target.parent[target.key];
+  return Array.isArray(value) ? value.length : 0;
+}
+function pruneBranchesWithoutArrays(value) {
+  if (Array.isArray(value))
+    return true;
+  if (!value || typeof value !== "object")
+    return false;
+  let containsArray = false;
+  for (const [key, child] of Object.entries(value)) {
+    if (pruneBranchesWithoutArrays(child)) {
+      containsArray = true;
+    } else {
+      delete value[key];
+    }
+  }
+  return containsArray;
+}
+function arrayTruncationMessage(message, targets) {
+  const truncatedTargets = targets.filter((target) => currentArrayLength(target) < target.originalItems.length);
+  if (truncatedTargets.length === 1) {
+    const [target] = truncatedTargets;
+    if (target) {
+      const kept = currentArrayLength(target);
+      const original = target.originalItems.length;
+      const originalCount = new RegExp(`\\b${original}\\b`);
+      if (originalCount.test(message)) {
+        const rewritten = message.replace(originalCount, String(kept)).replace(/\.\s*$/, "");
+        return `${rewritten} (truncated from ${original}; ${target.path} shortened in this bounded response).`;
+      }
+    }
+  }
+  const summaries = truncatedTargets.map((target) => `${currentArrayLength(target)} of ${target.originalItems.length} ${target.path} item(s)`);
+  if (summaries.length === 0)
+    return message;
+  return `${message} Returned ${summaries.join(", ")} in this bounded response.`;
+}
+function arrayPreservingOverflowResult(result, data, targets, truncation, pointer) {
+  const normalizedDetails = result.details?.trim() || undefined;
+  const details = normalizedDetails ? `${normalizedDetails.slice(0, MCP_PROSE_PREVIEW_CHARS)}
+… [truncated ${Math.max(normalizedDetails.length - MCP_PROSE_PREVIEW_CHARS, 0)} chars]
+${pointer}` : `JSON payload truncated in place:
+${JSON.stringify(data, null, 2)}
+${pointer}`;
+  return {
+    ok: result.ok,
+    message: arrayTruncationMessage(result.message, targets),
+    details,
+    data,
+    nudge: result.nudge,
+    truncation
+  };
+}
+function truncateArraysInPlace(result, truncation, pointer) {
+  if (!result.data)
+    return;
+  const data = cloneResultData(result.data);
+  const targets = [];
+  collectArrayTargets(data, "data", targets);
+  if (targets.length === 0)
+    return;
+  targets.sort((a, b) => Buffer.byteLength(JSON.stringify(b.originalItems), "utf8") - Buffer.byteLength(JSON.stringify(a.originalItems), "utf8"));
+  const render = () => arrayPreservingOverflowResult(result, data, targets, truncation, pointer);
+  const fits = () => Buffer.byteLength(JSON.stringify(composeWireResult(render())), "utf8") <= MCP_RESULT_WIRE_LIMIT_BYTES;
+  for (const target of targets) {
+    setArrayLength(target, 0);
+    if (!fits())
+      continue;
+    let low = 0;
+    let high = target.originalItems.length;
+    while (low < high) {
+      const mid = Math.ceil((low + high) / 2);
+      setArrayLength(target, mid);
+      if (fits())
+        low = mid;
+      else
+        high = mid - 1;
+    }
+    setArrayLength(target, low);
+    return render();
+  }
+  if (fits())
+    return render();
+  pruneBranchesWithoutArrays(data);
+  if (!fits())
+    return;
+  for (const target of targets) {
+    let low = 0;
+    let high = target.originalItems.length;
+    while (low < high) {
+      const mid = Math.ceil((low + high) / 2);
+      setArrayLength(target, mid);
+      if (fits())
+        low = mid;
+      else
+        high = mid - 1;
+    }
+    setArrayLength(target, low);
+  }
+  return render();
+}
+var ctxControlMiddleware = (result, ctx) => {
+  if (ctx.callOrigin === "script-sdk")
+    return result;
+  if (CTX_CONTROL_EXEMPT_TOOLS.has(ctx.toolName))
+    return result;
+  const fullWire = composeWireResult(result);
+  const fullWireJson = JSON.stringify(fullWire);
+  const fullWireBytes = Buffer.byteLength(fullWireJson, "utf8");
+  if (fullWireBytes <= MCP_RESULT_WIRE_LIMIT_BYTES) {
+    return result;
+  }
+  let fullValueAt;
+  let retrieval;
+  if (ctx.agentId) {
+    const storedValue = canonicalOverflowPayload(ctx.toolName, result);
+    const key = overflowKey(ctx.toolName, storedValue);
+    const namespace = mcpOverflowNamespace(ctx.agentId);
+    fullValueAt = `kv://${namespace}/${key}`;
+    retrieval = overflowRetrieval(namespace, key);
+    const expiresAt = Date.now() + MCP_OVERFLOW_TTL_MS;
+    sweepExpiredKvPrefix(MCP_OVERFLOW_NAMESPACE);
+    upsertKv({
+      namespace,
+      key,
+      value: storedValue,
+      valueType: "string",
+      expiresAt
+    });
+  } else {
+    fullValueAt = "unavailable: authenticated agent identity required";
+    retrieval = "Retry the tool with an authenticated X-Agent-ID to retain the full value.";
+  }
+  const truncation = {
+    truncated: true,
+    fullValueAt,
+    originalBytes: fullWireBytes,
+    limitBytes: MCP_RESULT_WIRE_LIMIT_BYTES,
+    retrieval
+  };
+  const pointer = `Full value: ${fullValueAt}
+Retrieval: ${retrieval}
+` + `Truncation: ${JSON.stringify(truncation)}`;
+  const arrayPreservingResult = truncateArraysInPlace(result, truncation, pointer);
+  if (arrayPreservingResult)
+    return arrayPreservingResult;
+  const normalizedDetails = result.details?.trim() || undefined;
+  const details = normalizedDetails ? `${normalizedDetails.slice(0, MCP_PROSE_PREVIEW_CHARS)}
+… [truncated ${Math.max(normalizedDetails.length - MCP_PROSE_PREVIEW_CHARS, 0)} chars]
+${pointer}` : `JSON payload omitted because the composed result exceeded ${MCP_RESULT_WIRE_LIMIT_BYTES} bytes.
+${pointer}`;
+  return {
+    ok: result.ok,
+    message: result.message,
+    details,
+    nudge: result.nudge,
+    truncation
+  };
+};
+var FINALIZE_PIPELINE = [
+  scrubMiddleware,
+  nudgeMiddleware,
+  ctxControlMiddleware
+];
+function finalizeSwarmToolResult(toolName, result, requestInfo = {
+  agentId: undefined
+}) {
+  let r = result;
+  if (!r.message?.trim()) {
+    console.warn(`[mcp] tool ${toolName} returned an empty message — every tool must summarize`);
+    r = {
+      ...r,
+      message: r.ok ? "Tool call succeeded (no message provided)." : "Tool call failed (no message provided)."
+    };
+  }
+  for (const middleware of FINALIZE_PIPELINE) {
+    r = middleware(r, {
+      toolName,
+      agentId: requestInfo.agentId,
+      callOrigin: requestInfo.callOrigin ?? "mcp"
+    });
+  }
+  return composeWireResult(r);
+}
 var createToolRegistrar = (server) => {
   return (name, config, cb) => {
     if (config.inputSchema === undefined) {
@@ -98010,7 +98273,7 @@ var createToolRegistrar = (server) => {
         const requestInfo = getRequestInfo(meta2);
         return withSpan("mcp.tool", async (span) => {
           const outcome = await cb(requestInfo, meta2);
-          const result = finalizeSwarmToolResult(name, outcome);
+          const result = finalizeSwarmToolResult(name, outcome, requestInfo);
           span.setAttributes(toolResultAttributes(result));
           return result;
         }, toolRequestAttributes(name, requestInfo));
@@ -98020,7 +98283,7 @@ var createToolRegistrar = (server) => {
       const requestInfo = getRequestInfo(meta2);
       return withSpan(`mcp.tool ${name}`, async (span) => {
         const outcome = await cb(args, requestInfo, meta2);
-        const result = finalizeSwarmToolResult(name, outcome);
+        const result = finalizeSwarmToolResult(name, outcome, requestInfo);
         span.setAttributes(toolResultAttributes(result));
         return result;
       }, toolRequestAttributes(name, requestInfo, args));
@@ -100251,6 +100514,9 @@ init_types();
 // src/tools/kv/kv-write-auth.ts
 init_db();
 function kvWriteAuthError(namespace, info) {
+  const overflowAuthErr = mcpOverflowAuthError(namespace, info.agentId);
+  if (overflowAuthErr)
+    return overflowAuthErr;
   if (namespace.startsWith("task:page:")) {
     return "task:page:* writes require a page-proxy request, not an MCP call";
   }
@@ -100334,6 +100600,13 @@ var registerKvDeleteTool = (server) => {
 init_zod();
 init_db();
 init_types();
+
+// src/tools/kv/kv-read-auth.ts
+function kvReadAuthError(namespace, info) {
+  return mcpOverflowAuthError(namespace, info.agentId);
+}
+
+// src/tools/kv/kv-get.ts
 var kvEntryOutputSchema = looseObject({
   namespace: string().optional(),
   key: string().optional(),
@@ -100367,6 +100640,12 @@ var registerKvGetTool = (server) => {
     if ("error" in resolved) {
       return toolErr(resolved.error, { data: { yourAgentId: requestInfo.agentId } });
     }
+    const authErr = kvReadAuthError(resolved.namespace, { agentId: requestInfo.agentId });
+    if (authErr) {
+      return toolErr(authErr, {
+        data: { yourAgentId: requestInfo.agentId, namespace: resolved.namespace }
+      });
+    }
     const entry = getKv(resolved.namespace, key);
     return toolOk(entry ? `Found "${key}" in "${resolved.namespace}".` : `No entry for "${key}" in "${resolved.namespace}".`, {
       details: entry ? renderKvEntry(entry) : undefined,
@@ -100480,6 +100759,12 @@ var registerKvListTool = (server) => {
     if ("error" in resolved) {
       return toolErr(resolved.error, { data: { yourAgentId: requestInfo.agentId } });
     }
+    const authErr = kvReadAuthError(resolved.namespace, { agentId: requestInfo.agentId });
+    if (authErr) {
+      return toolErr(authErr, {
+        data: { yourAgentId: requestInfo.agentId, namespace: resolved.namespace }
+      });
+    }
     const effectiveLimit = Math.min(limit ?? 100, MAX_KV_LIST_LIMIT);
     const effectivePrefix = prefix && prefix.length > 0 ? prefix : undefined;
     const entries = listKv(resolved.namespace, {
@@ -104826,17 +105111,17 @@ var scriptToolOutputSchema = swarmToolOutputSchema({
   status: number().optional(),
   data: unknown().optional()
 });
-var DETAILS_CAP2 = 16000;
+var DETAILS_CAP = 16000;
 function stripAnsi(text) {
   return text.replace(/\x1b\[[0-9;]*m/g, "");
 }
 function capDetails(text) {
   if (!text)
     return;
-  if (text.length <= DETAILS_CAP2)
+  if (text.length <= DETAILS_CAP)
     return text;
-  return `${text.slice(0, DETAILS_CAP2)}
-… [truncated ${text.length - DETAILS_CAP2} chars]`;
+  return `${text.slice(0, DETAILS_CAP)}
+… [truncated ${text.length - DETAILS_CAP} chars]`;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -107898,7 +108183,7 @@ async function steerTaskHandler(ctx, { taskId, message, mode = "queue", onUnsupp
 var registerSteerTaskTool = (server) => {
   createToolRegistrar(server)("steer-task", {
     title: "Steer Task",
-    description: 'Send a message to a task that is already running. `mode:"steer"` is honored on pi and claude-managed; claude, devin and opencode support queue only; codex always promotes the message to a follow-up task. Pass `onUnsupported:"fail"` to get an error instead of a downgrade.',
+    description: 'Send a message to a task that is already running. `mode:"steer"` is honored on pi and claude-managed; claude, devin, opencode and codex support queue only (codex delivery lands at the next tool-call boundary via its lifecycle hooks). Pass `onUnsupported:"fail"` to get an error instead of a downgrade.',
     annotations: { destructiveHint: true },
     inputSchema: steerTaskInputSchema,
     outputSchema: steerTaskOutputSchema
@@ -108180,7 +108465,11 @@ var shouldPersistTaskCompletionMemory = shouldPersistAutomaticTaskMemory;
 // src/tools/store-progress.ts
 init_types();
 var storeProgressOutputSchema = swarmToolOutputSchema({
-  task: looseAgentTaskOutputSchema.optional(),
+  task: looseObject({
+    id: string(),
+    status: AgentTaskStatusSchema,
+    finishedAt: string().optional()
+  }).optional(),
   yourAgentId: string().optional(),
   wasNoOp: boolean().optional().describe("True when the call was a no-op because the task was already in a terminal state (completed/failed/cancelled). First-call-wins.")
 });
@@ -108459,8 +108748,17 @@ ${taskContent}`,
         console.warn(`[store-progress] Failed to create follow-up task: ${err}`);
       }
     }
-    const { success, message, ...rest } = result;
-    const data = { yourAgentId: requestInfo.agentId, ...rest };
+    const { success, message } = result;
+    const task = result.task ? {
+      id: result.task.id,
+      status: result.task.status,
+      ...result.task.finishedAt ? { finishedAt: result.task.finishedAt } : {}
+    } : undefined;
+    const data = {
+      yourAgentId: requestInfo.agentId,
+      ...task ? { task } : {},
+      ..."wasNoOp" in result && result.wasNoOp ? { wasNoOp: true } : {}
+    };
     return success ? toolOk(message, { data }) : toolErr(message, { data });
   });
 };
@@ -111057,4 +111355,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, toolErr, createToolRegistrar, userCtx, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, resolveTaskAuditUserId, resolveHttpAuditUserId, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, storeLinks, refreshLinks, canReadMemory, getLinksForMemory, recordRetrievals, expandCandidatesWithGraph, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, resolveScriptsOnlyMode, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, resolveTaskAuditUserId, resolveHttpAuditUserId, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, storeLinks, refreshLinks, canReadMemory, getLinksForMemory, recordRetrievals, expandCandidatesWithGraph, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, resolveScriptsOnlyMode, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };