@desplega.ai/agent-swarm 1.130.0 → 1.131.1

package/dist/{cli-n9yxcnvk.js → cli-5n6e5yfn.js}

@@ -1,3 +1,6 @@
+import {
+  retryProviderRequest
+} from "./cli-s8s499xy.js";
 import {
   import_websocket
 } from "./cli-4w4fmq9x.js";
@@ -9,7 +12,7 @@ import {
 import {
   resolveJsonSchemaStrictSampling,
   transformMessages
-} from "./cli-vgexpfsr.js";
+} from "./cli-57khth04.js";
 import {
   sanitizeSurrogates
 } from "./cli-y2apkfe2.js";
@@ -25054,7 +25057,8 @@ function resolveThoughtSignature(isSameProviderAndModel, signature) {
   return isSameProviderAndModel && isValidThoughtSignature(signature) ? signature : undefined;
 }
 function requiresToolCallId(modelId) {
-  return modelId.startsWith("claude-") || modelId.startsWith("gpt-oss-");
+  const geminiMajorVersion = getGeminiMajorVersion(modelId);
+  return modelId.startsWith("claude-") || modelId.startsWith("gpt-oss-") || geminiMajorVersion !== undefined && geminiMajorVersion >= 3;
 }
 function getGeminiMajorVersion(modelId) {
   const match = modelId.toLowerCase().match(/^gemini(?:-live)?-(\d+)/);
@@ -25109,24 +25113,26 @@ function convertMessages(model, context) {
       const isSameProviderAndModel = msg.provider === model.provider && msg.model === model.id;
       for (const block of msg.content) {
         if (block.type === "text") {
-          if (!block.text || block.text.trim() === "")
-            continue;
           const thoughtSignature = resolveThoughtSignature(isSameProviderAndModel, block.textSignature);
+          if ((!block.text || block.text.trim() === "") && !thoughtSignature)
+            continue;
           parts.push({
             text: sanitizeSurrogates(block.text),
             ...thoughtSignature && { thoughtSignature }
           });
         } else if (block.type === "thinking") {
-          if (!block.thinking || block.thinking.trim() === "")
-            continue;
           if (isSameProviderAndModel) {
             const thoughtSignature = resolveThoughtSignature(isSameProviderAndModel, block.thinkingSignature);
+            if ((!block.thinking || block.thinking.trim() === "") && !thoughtSignature)
+              continue;
             parts.push({
               thought: true,
               text: sanitizeSurrogates(block.thinking),
               ...thoughtSignature && { thoughtSignature }
             });
           } else {
+            if (!block.thinking || block.thinking.trim() === "")
+              continue;
             parts.push({
               text: sanitizeSurrogates(block.thinking)
             });
@@ -25282,5 +25288,21 @@ function mapStopReason(reason) {
     }
   }
 }
+function retryGoogleRequest(request, options) {
+  return retryProviderRequest(async () => {
+    try {
+      return await request();
+    } catch (error) {
+      if (error instanceof Error && "status" in error && !("headers" in error)) {
+        error.headers = undefined;
+      }
+      throw error;
+    }
+  }, {
+    maxRetries: options?.maxRetries,
+    maxRetryDelayMs: options?.maxRetryDelayMs,
+    signal: options?.signal
+  });
+}
 
-export { ThinkingLevel, ResourceScope, GoogleGenAI, isThinkingPart, retainThoughtSignature, convertMessages, convertTools, supportsGoogleStrictToolSampling, resolveGoogleFunctionCallingMode, mapStopReason };
+export { ThinkingLevel, ResourceScope, GoogleGenAI, isThinkingPart, retainThoughtSignature, convertMessages, convertTools, supportsGoogleStrictToolSampling, resolveGoogleFunctionCallingMode, mapStopReason, retryGoogleRequest };

package/dist/{cli-q8zwffx0.js → cli-6dp3ydxa.js}

@@ -6,7 +6,7 @@ import {
 } from "./cli-f14fvzag.js";
 import {
   embedScript
-} from "./cli-1px8pn1s.js";
+} from "./cli-g1re8r05.js";
 import {
   calculatePKCECodeChallenge,
   ensureAuthorizationTokenOrThrow,
@@ -18,12 +18,13 @@ import {
   oauthAppRowToProviderConfig,
   updateAuthorizationTokens,
   upsertAuthorization
-} from "./cli-1mj7yz1r.js";
+} from "./cli-nrkkknat.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
   computeContentHash,
   decryptSecret,
+  defaultAssetKey,
   encryptSecret,
   getDb,
   getEncryptionKey,
@@ -33,14 +34,15 @@ import {
   init_crypto,
   init_date_utils,
   init_db,
+  init_key,
   normalizeDateRequired,
   placeholderForConfigKey,
   upsertSwarmConfig
-} from "./cli-s18zzkfp.js";
+} from "./cli-50vbt00w.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   init_zod
 } from "./cli-zsspvvm2.js";
@@ -168933,6 +168935,75 @@ async function discoverAuthorizationServerMetadata(issuer) {
   }
   throw lastError ?? new Error(`Authorization server metadata not found at ${issuer}`);
 }
+var KNOWN_TOKEN_ENDPOINT_AUTH_METHODS = [
+  "client_secret_basic",
+  "client_secret_post",
+  "none"
+];
+var DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD = "client_secret_basic";
+function normalizeTokenEndpointAuthMethod(value) {
+  return KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.includes(value ?? "") ? value : DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+}
+
+class UnsupportedTokenEndpointAuthMethodError extends Error {
+  constructor(value, source) {
+    super(`Authorization server ${source} token_endpoint_auth_method "${value}", which agent-swarm cannot perform. ` + `Supported methods: ${KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}. ` + `Register a client manually via POST /api/mcp-oauth/:id/manual-client with a supported method.`);
+    this.name = "UnsupportedTokenEndpointAuthMethodError";
+  }
+}
+function resolveAdvertisedTokenEndpointAuthMethod(value, source) {
+  if (value == null || value === "")
+    return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  if (!KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.includes(value)) {
+    throw new UnsupportedTokenEndpointAuthMethodError(value, source);
+  }
+  return value;
+}
+function authMethodForStoredClient(value) {
+  if (value == null || value === "")
+    return "client_secret_post";
+  return normalizeTokenEndpointAuthMethod(value);
+}
+function selectDcrTokenEndpointAuthMethod(supportedMethods) {
+  if (!supportedMethods || supportedMethods.length === 0) {
+    return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  }
+  for (const method of KNOWN_TOKEN_ENDPOINT_AUTH_METHODS) {
+    if (supportedMethods.includes(method))
+      return method;
+  }
+  throw new UnsupportedTokenEndpointAuthMethodError(supportedMethods.join(", "), "advertises only");
+}
+function formUrlEncodeComponent(value) {
+  return new URLSearchParams({ v: value }).toString().slice(2);
+}
+function redactSentCredentials(text, sent) {
+  let out = scrubSecrets(text);
+  for (const value of sent) {
+    if (!value)
+      continue;
+    for (const shape of new Set([value, formUrlEncodeComponent(value)])) {
+      out = out.split(shape).join("[REDACTED]");
+    }
+  }
+  return out;
+}
+function applyClientAuthentication(method, clientId, clientSecret, body, headers) {
+  if (method === "client_secret_basic" && clientSecret) {
+    const encodedSecret = formUrlEncodeComponent(clientSecret);
+    const credentials = `${formUrlEncodeComponent(clientId)}:${encodedSecret}`;
+    const encoded = Buffer.from(credentials).toString("base64");
+    registerVolatileSecret(encoded, "mcp_oauth_basic_credential");
+    headers.Authorization = `Basic ${encoded}`;
+    return [clientSecret, encodedSecret, encoded, credentials];
+  }
+  body.set("client_id", clientId);
+  if (method === "client_secret_post" && clientSecret) {
+    body.set("client_secret", clientSecret);
+    return [clientSecret, formUrlEncodeComponent(clientSecret)];
+  }
+  return [];
+}
 async function registerClient(registrationEndpoint, req) {
   const res = await safeFetch(registrationEndpoint, {
     method: "POST",
@@ -168985,27 +169056,33 @@ async function buildAuthorizeUrl(input) {
   return { url: url.toString(), state, codeVerifier, codeChallenge };
 }
 async function exchangeCodeForTokens(input) {
+  if (input.clientSecret)
+    registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "authorization_code",
     code: input.code,
     redirect_uri: input.redirectUri,
-    client_id: input.clientId,
     code_verifier: input.codeVerifier,
     resource: input.resource
   });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token exchange failed (${res.status}): ${text}`);
+    throw new Error(`Token exchange failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.code,
+      input.codeVerifier
+    ])}`);
   }
   return await res.json();
 }
@@ -169013,50 +169090,57 @@ async function refreshMcpToken(input) {
   if (input.clientSecret)
     registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
   registerVolatileSecret(input.refreshToken, "mcp_oauth_refresh_token");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: input.refreshToken,
-    client_id: input.clientId,
     resource: input.resource
   });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
   if (input.scopes && input.scopes.length > 0)
     body.set("scope", input.scopes.join(" "));
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token refresh failed (${res.status}): ${scrubSecrets(text)}`);
+    throw new Error(`Token refresh failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.refreshToken
+    ])}`);
   }
   return await res.json();
 }
 async function revokeMcpToken(input) {
-  const body = new URLSearchParams({
-    token: input.token,
-    client_id: input.clientId
-  });
+  if (input.clientSecret)
+    registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  registerVolatileSecret(input.token, "mcp_oauth_revoked_token");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
+  const body = new URLSearchParams({ token: input.token });
   if (input.tokenTypeHint)
     body.set("token_type_hint", input.tokenTypeHint);
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.revocationUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok && res.status !== 200 && res.status !== 204) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token revocation failed (${res.status}): ${text}`);
+    throw new Error(`Token revocation failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.token
+    ])}`);
   }
 }
 function computeExpiresAt(expiresInSeconds) {
@@ -169136,6 +169220,7 @@ function decryptTokenRow(row) {
     revocationUrl: row.revocationUrl,
     dcrClientId: row.clientId || null,
     dcrClientSecret: row.clientSecret == null ? null : clientKey ? decryptSecret(row.clientSecret, clientKey) : row.clientSecret,
+    tokenEndpointAuthMethod: typeof metadata.tokenEndpointAuthMethod === "string" ? metadata.tokenEndpointAuthMethod : null,
     clientSource,
     status: statusFromUnified(row.status),
     lastErrorMessage: row.lastErrorMessage,
@@ -169157,6 +169242,7 @@ function upsertMcpApp(input) {
     authorizationServerIssuer: input.authorizationServerIssuer,
     registrationEndpoint: input.registrationEndpoint ?? null,
     clientSource: input.clientSource,
+    ...input.tokenEndpointAuthMethod !== undefined ? { tokenEndpointAuthMethod: input.tokenEndpointAuthMethod } : {},
     registeredScopes: input.registeredScopes !== undefined ? input.registeredScopes : existingMetadata.registeredScopes ?? null,
     invalidated: false
   });
@@ -169216,6 +169302,7 @@ function readMcpOAuthApp(appId) {
     authorizationServerIssuer: typeof metadata.authorizationServerIssuer === "string" ? metadata.authorizationServerIssuer : "",
     registrationEndpoint: typeof metadata.registrationEndpoint === "string" ? metadata.registrationEndpoint : null,
     registeredScopes: Array.isArray(metadata.registeredScopes) ? metadata.registeredScopes : null,
+    tokenEndpointAuthMethod: typeof metadata.tokenEndpointAuthMethod === "string" ? metadata.tokenEndpointAuthMethod : null,
     clientSource
   };
 }
@@ -169277,6 +169364,7 @@ function upsertMcpOAuthToken(input) {
       registeredScopes: input.registeredScopes,
       dcrClientId: input.dcrClientId,
       dcrClientSecret: input.dcrClientSecret,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
       clientSource: input.clientSource
     });
     upsertAuthorization({
@@ -169359,6 +169447,7 @@ function insertMcpOAuthPending(input) {
       registeredScopes: input.registeredScopes,
       dcrClientId: input.dcrClientId,
       dcrClientSecret: input.dcrClientSecret,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
       clientSource,
       redirectUri: input.redirectUri
     });
@@ -169373,6 +169462,7 @@ function insertMcpOAuthPending(input) {
       registeredScopes: input.registeredScopes ?? null,
       dcrClientId: input.dcrClientId ?? null,
       dcrClientSecret: input.dcrClientSecret == null ? null : encryptSecret(input.dcrClientSecret, getEncryptionKey()),
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? null,
       clientSource
     });
     getDb().query(`INSERT INTO oauth_pending (
@@ -169420,6 +169510,7 @@ function consumeMcpOAuthPending(state) {
       registeredScopes: Array.isArray(context.registeredScopes) ? context.registeredScopes : null,
       dcrClientId: typeof context.dcrClientId === "string" ? context.dcrClientId : null,
       dcrClientSecret: encryptedClientSecret ? decryptSecret(encryptedClientSecret, getEncryptionKey()) : null,
+      tokenEndpointAuthMethod: typeof context.tokenEndpointAuthMethod === "string" ? context.tokenEndpointAuthMethod : null,
       redirectUri: row.redirectUri,
       finalRedirect: row.finalRedirect,
       createdAt: normalizeDateRequired(row.createdAt)
@@ -169465,6 +169556,7 @@ async function ensureMcpToken(mcpServerId, opts = {}) {
         tokenUrl: token.tokenUrl,
         clientId: token.dcrClientId ?? "",
         clientSecret: token.dcrClientSecret ?? undefined,
+        tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod),
         refreshToken: token.refreshToken,
         resource: token.resourceUrl,
         scopes: token.scope ? token.scope.split(" ").filter(Boolean) : undefined
@@ -170915,6 +171007,7 @@ ${members.join(`
 }
 
 // src/be/scripts/db.ts
+init_key();
 init_secret_scrubber();
 
 // src/utils/short-id.ts
@@ -170988,12 +171081,12 @@ function insertScript(args) {
   const typeChecked = args.typeChecked ? 1 : 0;
   const txn = getDb().transaction(() => {
     const row = getDb().prepare(`INSERT INTO scripts (
-          id, name, scope, scopeId, source, description, intent, signatureJson,
+          id, "key", name, scope, scopeId, source, description, intent, signatureJson,
           argsJsonSchema, contentHash, isScratch, typeChecked, fsMode, createdByAgentId, createdAt, updatedAt,
           created_by, updated_by
         )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        RETURNING *`).get(id, args.name, args.scope, scopeId, args.source, args.description, args.intent, args.signatureJson, args.argsJsonSchema ?? null, contentHash, isScratch, typeChecked, fsMode, args.agentId ?? null, now, now, args.createdBy ?? null, args.createdBy ?? null);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        RETURNING *`).get(id, defaultAssetKey("script", id), args.name, args.scope, scopeId, args.source, args.description, args.intent, args.signatureJson, args.argsJsonSchema ?? null, contentHash, isScratch, typeChecked, fsMode, args.agentId ?? null, now, now, args.createdBy ?? null, args.createdBy ?? null);
     if (!row)
       throw new Error("Failed to insert script");
     insertScriptVersion({
@@ -171033,7 +171126,8 @@ async function upsertScriptByName(args) {
     const argsJsonSchema2 = args.argsJsonSchema !== undefined ? args.argsJsonSchema : existing.argsJsonSchema;
     const trackedMetadataChanged = args.description !== existing.description || args.intent !== existing.intent || args.signatureJson !== existing.signatureJson || argsJsonSchema2 !== existing.argsJsonSchema;
     const promotedFromScratch = existing.isScratch && !isScratch2;
-    if (fsMode2 !== existing.fsMode || isScratch2 !== existing.isScratch || typeChecked2 !== existing.typeChecked || trackedMetadataChanged) {
+    const refreshScratchLastUsed = existing.scope === "agent" && existing.name.startsWith("scratch-") && existing.isScratch && isScratch2;
+    if (fsMode2 !== existing.fsMode || isScratch2 !== existing.isScratch || typeChecked2 !== existing.typeChecked || trackedMetadataChanged || refreshScratchLastUsed) {
       const row = getDb().prepare(`UPDATE scripts
           SET description = ?, intent = ?, signatureJson = ?, argsJsonSchema = ?,
             isScratch = ?, typeChecked = ?, fsMode = ?, updatedAt = ?, updated_by = ?
@@ -171142,6 +171236,15 @@ function deleteScript(args) {
   const result = getDb().run("DELETE FROM scripts WHERE id = ?", [existing.id]);
   return result.changes > 0;
 }
+function touchScratchScriptLastUsed(id, at = new Date().toISOString()) {
+  const result = getDb().prepare(`UPDATE scripts SET updatedAt = ?
+       WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*'`).run(at, id);
+  return result.changes > 0 ? at : null;
+}
+function restoreScratchScriptLastUsedIfUnchanged(id, priorUpdatedAt, expectedUpdatedAt) {
+  return getDb().prepare(`UPDATE scripts SET updatedAt = ?
+         WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*' AND updatedAt = ?`).run(priorUpdatedAt, id, expectedUpdatedAt).changes > 0;
+}
 var SCRIPT_API_ID_LEN = 12;
 function rowToScriptApi(row) {
   return {
@@ -171266,23 +171369,39 @@ var DEFAULT_SANDBOX_LIMITS = {
   maxFdCount: 64
 };
 var BUN_SANDBOX_VIRTUAL_MEMORY_MB = 4096;
+var JAVASCRIPT_RUNTIME_SANDBOX_MAX_PROCS = 512;
+var JAVASCRIPT_RUNTIMES = new Set(["bun", "bunx", "node", "nodejs", "npx"]);
+var SHELL_RUNTIMES = new Set(["bash", "dash", "sh"]);
+function commandBasename(command) {
+  return command.slice(command.lastIndexOf("/") + 1);
+}
+function usesInterpreterSandboxProfile(innerCommand) {
+  const runtime = commandBasename(innerCommand[0] ?? "");
+  return JAVASCRIPT_RUNTIMES.has(runtime) || SHELL_RUNTIMES.has(runtime);
+}
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 function buildSandboxedCommand(innerCommand, env, limits = DEFAULT_SANDBOX_LIMITS) {
   if (process.platform === "win32")
     return [...innerCommand];
-  const virtualMemoryMb = innerCommand[0] === "bun" ? Math.max(limits.virtualMemoryMb, BUN_SANDBOX_VIRTUAL_MEMORY_MB) : limits.virtualMemoryMb;
+  const usesInterpreterProfile = usesInterpreterSandboxProfile(innerCommand);
+  const virtualMemoryMb = usesInterpreterProfile ? Math.max(limits.virtualMemoryMb, BUN_SANDBOX_VIRTUAL_MEMORY_MB) : limits.virtualMemoryMb;
+  const maxProcs = usesInterpreterProfile ? Math.max(limits.maxProcs, JAVASCRIPT_RUNTIME_SANDBOX_MAX_PROCS) : limits.maxProcs;
   const ulimits = [
     `ulimit -v ${Math.floor(virtualMemoryMb * 1024)} 2>/dev/null || true`,
     `ulimit -t ${limits.cpuTimeSec} 2>/dev/null || true`,
-    `ulimit -u ${limits.maxProcs} 2>/dev/null || true`,
+    `ulimit -u ${maxProcs} 2>/dev/null || true`,
     `ulimit -f ${limits.maxFileKb} 2>/dev/null || true`,
     `ulimit -n ${limits.maxFdCount} 2>/dev/null || true`
   ].join("; ");
   const envAssignments = Object.entries(env).map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ");
   const quotedInner = innerCommand.map(shellQuote).join(" ");
-  return ["sh", "-c", `${ulimits}; exec env -i ${envAssignments} ${quotedInner}`];
+  return [
+    usesInterpreterProfile ? "bash" : "sh",
+    "-c",
+    `${ulimits}; exec env -i ${envAssignments} ${quotedInner}`
+  ];
 }
 function sandboxSpawnEnv(env) {
   return process.platform === "win32" ? { ...env } : { PATH: env.PATH ?? "" };
@@ -171729,4 +171848,4 @@ async function buildScriptCredentialBindings(input) {
   return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
 }
 
-export { MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, getScriptConnectionById, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, require_typescript, validateScriptImports, runScript, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings };
+export { MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, getScriptConnectionById, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, require_typescript, validateScriptImports, runScript, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings };

package/dist/{cli-r62me33w.js → cli-6dpytdr2.js}

@@ -3,11 +3,11 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-s18zzkfp.js";
+} from "./cli-50vbt00w.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 
 // src/slack/router.ts
 init_db();

package/dist/{cli-ch7t5v7n.js → cli-6map995v.js}

@@ -38,22 +38,27 @@ function extractBody(error) {
 function pickBodyText(error) {
   if (typeof error.body === "string")
     return error.body;
-  if (isNonEmptyObject(error.error))
+  if (isPlainNonEmptyObject(error.error))
     return safeJsonStringify(error.error);
   const responseBody = error.$response?.body;
   if (typeof responseBody === "string")
     return responseBody;
   if (isReadableStreamLike(responseBody))
     return;
-  if (isNonEmptyObject(responseBody))
+  if (isPlainNonEmptyObject(responseBody))
     return safeJsonStringify(responseBody);
   return;
 }
 function isReadableStreamLike(value) {
   return typeof value === "object" && value !== null && "pipe" in value && typeof value.pipe === "function";
 }
-function isNonEmptyObject(value) {
-  return typeof value === "object" && value !== null && Object.keys(value).length > 0;
+function isPlainNonEmptyObject(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    return false;
+  return Object.keys(value).length > 0;
 }
 function formatProviderError(norm, prefix) {
   if (norm.messageCarriesBody || norm.status === undefined || norm.body === undefined) {

package/dist/{cli-326083vb.js → cli-6pcz9h15.js}

@@ -1,12 +1,12 @@
 import {
   renderSteeringDelivery
-} from "./cli-xg2eezyv.js";
+} from "./cli-f1am9szv.js";
 import {
   checkCodexCredentials
-} from "./cli-h3e66g5b.js";
+} from "./cli-793jvbsh.js";
 import {
   checkClaudeManagedCredentials
-} from "./cli-qmdnhpej.js";
+} from "./cli-wz9115x0.js";
 import {
   checkDevinCredentials
 } from "./cli-9b13ggd1.js";
@@ -15,7 +15,7 @@ import {
 } from "./cli-n6h8qt8n.js";
 import {
   checkClaudeCredentials
-} from "./cli-e5p3es48.js";
+} from "./cli-kd1ck4rx.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -35,7 +35,7 @@ import {
   withSpan,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-haanc4qd.js";
+} from "./cli-jevgrb4w.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
@@ -44,10 +44,10 @@ import {
 import {
   ensure,
   initialize
-} from "./cli-dakxgk70.js";
+} from "./cli-ycrnynpw.js";
 import {
   validateJsonSchema
-} from "./cli-xdrmxvd4.js";
+} from "./cli-jbcva0xj.js";
 import {
   getOpenRouterBaseUrl
 } from "./cli-3dpj7atn.js";
@@ -78,7 +78,7 @@ import {
   init_types,
   resolveTaskModelSelection,
   telemetry
-} from "./cli-s18zzkfp.js";
+} from "./cli-50vbt00w.js";
 import {
   configureHttpResolver,
   init_resolver,
@@ -88,7 +88,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplateAsync
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   getMcpBaseUrl,
   init_constants
@@ -495,19 +495,19 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-qr0k17km.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-q6x7yspx.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-bpfrn6d7.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-4g5kby31.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-6pc50x9q.js");
+      const { CodexAdapter } = await import("./codex-adapter-htjkn22b.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-gv19tdew.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-wsg37bt8.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
@@ -1201,7 +1201,7 @@ async function checkProviderCredentials(provider, env, opts) {
     case "opencode":
       return checkOpencodeCredentials(env, opts);
     case "pi": {
-      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-bpfrn6d7.js");
+      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-4g5kby31.js");
       return checkPiMonoCredentials(env, opts);
     }
     default:

package/dist/{cli-h3e66g5b.js → cli-793jvbsh.js}

@@ -13,7 +13,7 @@ import {
 } from "./cli-psrqtw2m.js";
 import {
   summarizeSession
-} from "./cli-s21zzx4b.js";
+} from "./cli-w2wxd56v.js";
 import {
   CTX_MODE_NUDGE_EVERY
 } from "./cli-zm7njwzd.js";

package/dist/{cli-yj7z99vp.js → cli-7dm2zqy2.js}

@@ -4,12 +4,12 @@ import {
   linkIdentity,
   recordUnmappedIdentity,
   resolveIdentity
-} from "./cli-m8fs5ttq.js";
+} from "./cli-aca5pz9f.js";
 import {
   getKv,
   init_db,
   upsertKv
-} from "./cli-s18zzkfp.js";
+} from "./cli-50vbt00w.js";
 
 // src/slack/enrich.ts
 init_db();