@desplega.ai/agent-swarm 1.131.1 → 1.134.0

package/dist/{http-9xh6ta4r.js → http-nh14kkms.js}

@@ -45,6 +45,7 @@ import {
   getKapsoNumberMapping,
   getLinksForMemory,
   getOAuthPreset,
+  getParseErrorMessage,
   getPathSegments,
   getTaskDetailsHandler,
   getTaskDetailsInputSchema,
@@ -52,6 +53,7 @@ import {
   getTasksHandler,
   getTasksInputSchema,
   getTasksOutputSchema,
+  getUserCommsPrefs,
   guardTerminalTaskResultWrite,
   handleAgentSessionEvent,
   handleAgentSessionPrompted,
@@ -104,6 +106,7 @@ import {
   markScriptSdkRequestOrigin,
   mcpOverflowAuthError,
   mergeScheduleTiming,
+  normalizeObjectSchema,
   parseBody,
   parseQueryParams,
   parseSkillContent,
@@ -119,6 +122,8 @@ import {
   resolveScriptsOnlyMode,
   resolveTaskAuditUserId,
   route,
+  runtimeInstanceHeader,
+  safeParseAsync,
   safeRequestUrlForLog,
   scheduleIntegrationsReload,
   scopedResourceScopeIdSchema,
@@ -152,15 +157,15 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-jevgrb4w.js";
-import"./cli-1z7048dy.js";
+} from "./cli-h39xxnq6.js";
+import"./cli-mnm7w46e.js";
 import {
   Anthropic
-} from "./cli-gz9sbyk3.js";
+} from "./cli-jepmgn7r.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
-} from "./cli-2wadx7p2.js";
+} from "./cli-pt43pdp1.js";
 import {
   deriveCodexKeySuffix,
   getValidCodexOAuth,
@@ -173,34 +178,48 @@ import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-g74vpjp2.js";
+} from "./cli-brm3et47.js";
 import {
+  AGENT_MAX_TASKS_CONFIG_KEY,
   createResumeFollowUp,
-  createWorkerTaskFollowUp
-} from "./cli-3ty0t082.js";
+  createWorkerTaskFollowUp,
+  getRuntimeInstanceById,
+  listRuntimeInstancesForAgent,
+  reconcileAgentMaxTasksPolicy,
+  reconcileAgentStatusFromRuntimes,
+  resetAgentMaxTasksMirror,
+  runtimeStaleThresholdMinutes,
+  setRuntimeCredentialReady,
+  touchRuntimeInstance,
+  upsertRuntimeInstance,
+  upsertSwarmConfigWithPolicyMirror
+} from "./cli-43x36mty.js";
+import {
+  isMultiRuntimeEnabled
+} from "./cli-qh4sqfws.js";
 import {
   calculateNextRun,
   dispatchScheduleTarget,
   ensure,
   initialize,
   require_dist
-} from "./cli-ycrnynpw.js";
+} from "./cli-480nehnh.js";
 import {
   getModelsCatalog
-} from "./cli-t8d349cy.js";
+} from "./cli-f4wj0s3m.js";
 import {
   normalizeModelKey
-} from "./cli-114fvtmj.js";
+} from "./cli-c79a9zrc.js";
 import {
   getUserGrant
-} from "./cli-sy7jk3tx.js";
+} from "./cli-h0djenzm.js";
 import {
   can,
   clearAuditSink,
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-bqw0mt1n.js";
+} from "./cli-k46t4664.js";
 import {
   ensureAgentFsCredentialsForAgent,
   extractArgsJsonSchema,
@@ -210,12 +229,12 @@ import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-4rkfg1wx.js";
+} from "./cli-tkrr24mz.js";
 import {
   collectScriptReferences,
   getApp,
   listAppRecords
-} from "./cli-gecy3z2s.js";
+} from "./cli-snw62ze5.js";
 import {
   RawLlmConfigSchema,
   RawLlmOutputSchema,
@@ -235,7 +254,7 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-jbcva0xj.js";
+} from "./cli-mrammd8c.js";
 import"./cli-3dpj7atn.js";
 import {
   ConnectionAuthInputSchema,
@@ -307,14 +326,14 @@ import {
   upsertMcpOAuthToken,
   upsertScriptByName,
   upsertScriptConnection
-} from "./cli-6dp3ydxa.js";
-import"./cli-epan13p1.js";
+} from "./cli-e07exmsb.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import"./cli-epan13p1.js";
 import {
   searchScripts
-} from "./cli-g1re8r05.js";
+} from "./cli-rh6f3s9n.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -322,8 +341,8 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-se2p6rkb.js";
-import"./cli-0258203w.js";
+} from "./cli-38taxznr.js";
+import"./cli-492e7ap5.js";
 import {
   acquireOAuthRefreshLock,
   buildAuthorizationUrl,
@@ -347,14 +366,14 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-nrkkknat.js";
+} from "./cli-h37gbjbf.js";
 import"./cli-fad8m16k.js";
 import {
   FilesError,
   getFileStorageProvider,
   normalizeFilesError
 } from "./cli-bnx54kxv.js";
-import"./cli-6dpytdr2.js";
+import"./cli-6x363v1z.js";
 import {
   findUserById,
   fingerprintApiKey,
@@ -370,18 +389,18 @@ import {
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-aca5pz9f.js";
+} from "./cli-589599p9.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-2f07m0xr.js";
+} from "./cli-wf86d5t7.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-rgrfzg8z.js";
-import"./cli-k9qkf1hw.js";
-import"./cli-b0p7rfnd.js";
-import"./cli-t930g0xh.js";
+} from "./cli-grt6qv91.js";
+import"./cli-qf9kpsve.js";
+import"./cli-g2p9bd1z.js";
+import"./cli-5tnr64pm.js";
 import {
   ActiveSessionSchema,
   AgentAvatarSchema,
@@ -449,6 +468,7 @@ import {
   RepoGuidelinesSchema,
   RepoHooksSchema,
   ResumeReasonSchema,
+  RuntimeInstanceSchema,
   ScheduledTaskSchema,
   ScheduledTaskTargetTypeSchema,
   ScriptApiAuthModeSchema,
@@ -481,6 +501,7 @@ import {
   TaskTemplateKindSchema,
   TaskTemplateSchema,
   TriggerConfigSchema,
+  UserCommsPrefsSchema,
   UserFavoriteSchema,
   UserSchema,
   WorkflowDefinitionSchema,
@@ -505,6 +526,7 @@ import {
   clearKeyRateLimit,
   closeDb,
   completeTask,
+  computeContentHash,
   countActiveScriptRuns,
   countAllMetrics,
   countAllPages,
@@ -567,6 +589,7 @@ import {
   getAllTasks,
   getAllUsers,
   getApprovalRequestById,
+  getAttributionByPerson,
   getAvailableKeyIndices,
   getBudget,
   getBudgets,
@@ -602,6 +625,7 @@ import {
   getPendingTaskForAgent,
   getPricingRows,
   getPromptTemplateById,
+  getPromptTemplateDefaultDrift,
   getPromptTemplateHistory,
   getPromptTemplates,
   getRecentBudgetRefusalNotifications,
@@ -655,11 +679,12 @@ import {
   init_credential_broker,
   init_date_utils,
   init_db,
+  init_default_drift,
   init_request_auth_context,
   init_steering,
   init_swarm_config_guard,
   init_telemetry,
-  init_templates1 as init_templates,
+  init_templates,
   init_types,
   insertActiveSession,
   insertPricingRow,
@@ -724,6 +749,7 @@ import {
   updateActiveSessionProviderSessionId,
   updateAgentActivity,
   updateAgentCredStatus,
+  updateAgentCredentialMissing,
   updateAgentCredentialState,
   updateAgentMaxTasks,
   updateAgentName,
@@ -756,20 +782,23 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-50vbt00w.js";
+} from "./cli-m07313tr.js";
+import {
+  IDENTITY_FIELD_BUDGETS,
+  IdentityFieldBudgetError,
+  init_identity_field_budget
+} from "./cli-34w2584r.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
-  init_env_flag,
   init_registry,
   init_resolver,
   init_steering_enabled,
   init_template,
   interpolate,
-  isEnvFlagEnabled,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-xpxde7rm.js";
+} from "./cli-2wv4kj0e.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -777,62 +806,66 @@ import {
   getMcpBaseUrl,
   getPublicMcpBaseUrl,
   init_constants
-} from "./cli-x23me2mg.js";
-import"./cli-z2zcxes1.js";
+} from "./cli-a1rrkrb4.js";
+import"./cli-qt5bt3vk.js";
+import {
+  init_env_flag,
+  isEnvFlagEnabled
+} from "./cli-nanaxrz6.js";
 import {
   init_zod
-} from "./cli-zsspvvm2.js";
+} from "./cli-1ybr6vw2.js";
+import {
+  init_package,
+  package_default
+} from "./cli-jmvk6et8.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-4j2mrzag.js";
-import {
-  init_package,
-  package_default
-} from "./cli-ccf9vy7q.js";
+} from "./cli-mkq1rk7b.js";
 import {
   array,
   exports_external,
   number,
   object,
   string
-} from "./cli-5dsbcjjw.js";
-import"./cli-e15jhafb.js";
+} from "./cli-ghexzd2d.js";
+import"./cli-qntkxysp.js";
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-9aryf9tv.js";
+} from "./cli-95m51ztz.js";
 import {
   bedrockProviderModule
-} from "./cli-9dr5qzc0.js";
-import"./cli-cwy5hqbq.js";
+} from "./cli-tv9f1kyb.js";
+import"./cli-gpt9kf01.js";
 import {
   setBedrockProviderModule
 } from "./cli-darcwax3.js";
-import"./cli-jvv0g8bh.js";
-import"./cli-r6kqqbj0.js";
+import"./cli-tkf8n6cw.js";
+import"./cli-yjmk7tzc.js";
 import"./cli-6map995v.js";
-import"./cli-4wgngmwv.js";
-import"./cli-vapyk8sw.js";
-import"./cli-zyxs93y9.js";
-import"./cli-57khth04.js";
+import"./cli-00w4hbam.js";
+import"./cli-7jcc9y1r.js";
+import"./cli-xmyqv00z.js";
 import"./cli-y2apkfe2.js";
+import"./cli-vapyk8sw.js";
 import"./cli-akdvwc9v.js";
 import"./cli-8wrympd7.js";
-import"./cli-7sgrxg9a.js";
-import"./cli-3fj60etf.js";
-import"./cli-9sbhdpvb.js";
-import"./cli-z905tvmm.js";
-import"./cli-dxak0fqd.js";
-import"./cli-49n9f49x.js";
-import"./cli-jxg3s9ey.js";
-import"./cli-czkae1fp.js";
+import"./cli-q6d0vvey.js";
+import"./cli-497b685t.js";
+import"./cli-3cgfyfzm.js";
+import"./cli-g814jbst.js";
+import"./cli-787ph852.js";
+import"./cli-dx3dz0ms.js";
+import"./cli-65d93ves.js";
+import"./cli-c5ddbdfj.js";
 import {
   __require,
   __toESM
-} from "./cli-p9swy5t3.js";
+} from "./cli-pq2ee5ja.js";
 
 // src/utils/internal-ai/register-bedrock.ts
 setBedrockProviderModule(bedrockProviderModule);
@@ -979,6 +1012,162 @@ function seedLegacyCapabilitiesConfig() {
   return { seeded: true, added: [...added] };
 }
 
+// src/queue-stall-alarm.ts
+init_db();
+init_secret_scrubber();
+var QUEUE_STALL_THRESHOLD_MS = 30 * 60 * 1000;
+var QUEUE_STALL_CHECK_INTERVAL_MS = 5 * 60 * 1000;
+var QUEUE_STALL_STARTUP_DELAY_MS = 1e4;
+var alarmInterval = null;
+var startupTimeout = null;
+var checkInFlight = false;
+var alarmActive = false;
+function getQueueStallSnapshot(now = new Date) {
+  const oldest = getDb().prepare(`WITH queued AS (
+         SELECT
+           t.id,
+           t.dependsOn,
+           COALESCE(
+             (
+               SELECT MAX(entry.createdAt)
+               FROM agent_log entry
+               WHERE entry.taskId = t.id
+                 AND entry.newValue = t.status
+                 AND entry.eventType IN (
+                   'task_created',
+                   'task_status_change',
+                   'task_released',
+                   'task_accepted',
+                   'task_rejected'
+                 )
+             ),
+             t.createdAt
+           ) AS queueEnteredAt
+         FROM agent_tasks t
+         WHERE t.status IN ('pending', 'unassigned')
+       ),
+       claimable AS (
+         SELECT
+           queued.id,
+           MAX(
+             queued.queueEnteredAt,
+             COALESCE(
+               (
+                 SELECT MAX(COALESCE(prerequisite.finishedAt, prerequisite.createdAt))
+                 FROM json_each(COALESCE(queued.dependsOn, '[]')) dep
+                 JOIN agent_tasks prerequisite ON prerequisite.id = dep.value
+               ),
+               queued.queueEnteredAt
+             )
+           ) AS claimableAt
+         FROM queued
+         WHERE NOT EXISTS (
+             SELECT 1
+             FROM json_each(COALESCE(queued.dependsOn, '[]')) dep
+             LEFT JOIN agent_tasks prerequisite ON prerequisite.id = dep.value
+             WHERE prerequisite.id IS NULL OR prerequisite.status != 'completed'
+           )
+       ),
+       oldest AS (
+         SELECT id, claimableAt FROM claimable ORDER BY claimableAt ASC LIMIT 1
+       )
+       SELECT
+         (SELECT COUNT(*) FROM claimable) AS claimableCount,
+         (SELECT id FROM oldest) AS oldestTaskId,
+         (SELECT claimableAt FROM oldest) AS oldestClaimableAt`).get();
+  const pickupCutoff = new Date(now.getTime() - QUEUE_STALL_THRESHOLD_MS).toISOString();
+  const recentPickupCount = getDb().prepare(`SELECT COUNT(*) AS count
+         FROM agent_log
+         WHERE eventType IN ('task_status_change', 'task_claimed')
+           AND oldValue IN ('pending', 'unassigned')
+           AND newValue = 'in_progress'
+           AND createdAt >= ?`).get(pickupCutoff)?.count ?? 0;
+  const oldestClaimableAt = oldest?.oldestClaimableAt ?? null;
+  return {
+    claimableCount: oldest?.claimableCount ?? 0,
+    oldestTaskId: oldest?.oldestTaskId ?? null,
+    oldestClaimableAt,
+    oldestAgeMs: oldestClaimableAt ? Math.max(0, now.getTime() - new Date(oldestClaimableAt).getTime()) : 0,
+    recentPickupCount
+  };
+}
+function isQueueStalled(snapshot) {
+  return snapshot.claimableCount > 0 && snapshot.oldestAgeMs >= QUEUE_STALL_THRESHOLD_MS;
+}
+function formatAge(ageMs) {
+  return `${Math.floor(ageMs / 60000)}m`;
+}
+function formatCheckFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return `[Queue Stall Alarm] Check or notification failed: ${scrubSecrets(message)}`;
+}
+async function notifySlack(message) {
+  const channel = process.env.SLACK_ALERTS_CHANNEL?.trim();
+  if (!channel)
+    throw new Error("SLACK_ALERTS_CHANNEL is not configured");
+  const app = getSlackApp();
+  if (!app)
+    throw new Error("Slack is not connected");
+  await app.client.chat.postMessage({
+    channel,
+    text: message,
+    unfurl_links: false,
+    unfurl_media: false
+  });
+}
+async function checkQueueStall(now = new Date, notify = notifySlack) {
+  const snapshot = getQueueStallSnapshot(now);
+  const stalled = isQueueStalled(snapshot);
+  if (stalled && !alarmActive) {
+    await notify(`\uD83D\uDEA8 *Agent Swarm queue pickup stalled*
+` + `Claimable tasks: *${snapshot.claimableCount}*
+` + `Oldest wait: *${formatAge(snapshot.oldestAgeMs)}* (task \`${snapshot.oldestTaskId}\`)
+` + `Pickups in the last 30m: *${snapshot.recentPickupCount}*
+
+` + "This alarm runs in the API process and does not require an agent to claim a task.");
+    alarmActive = true;
+    console.error(`[Queue Stall Alarm] Fired: claimable=${snapshot.claimableCount}, oldest=${snapshot.oldestTaskId}, age=${formatAge(snapshot.oldestAgeMs)}, recent_pickups=${snapshot.recentPickupCount}`);
+  } else if (!stalled && alarmActive) {
+    await notify(`✅ *Agent Swarm queue pickup recovered*
+Claimable tasks: *${snapshot.claimableCount}*
+Pickups in the last 30m: *${snapshot.recentPickupCount}*`);
+    alarmActive = false;
+    console.log("[Queue Stall Alarm] Recovery notification sent");
+  }
+  return snapshot;
+}
+function scheduleCheck() {
+  if (checkInFlight)
+    return;
+  checkInFlight = true;
+  checkQueueStall().catch((error) => {
+    console.error(formatCheckFailure(error));
+  }).finally(() => {
+    checkInFlight = false;
+  });
+}
+function startQueueStallAlarm() {
+  if (alarmInterval || startupTimeout)
+    return;
+  console.log(`[Queue Stall Alarm] Starting (threshold ${formatAge(QUEUE_STALL_THRESHOLD_MS)}, interval ${formatAge(QUEUE_STALL_CHECK_INTERVAL_MS)})`);
+  startupTimeout = setTimeout(() => {
+    startupTimeout = null;
+    scheduleCheck();
+  }, QUEUE_STALL_STARTUP_DELAY_MS);
+  alarmInterval = setInterval(scheduleCheck, QUEUE_STALL_CHECK_INTERVAL_MS);
+}
+function stopQueueStallAlarm() {
+  if (startupTimeout) {
+    clearTimeout(startupTimeout);
+    startupTimeout = null;
+  }
+  if (alarmInterval) {
+    clearInterval(alarmInterval);
+    alarmInterval = null;
+  }
+  checkInFlight = false;
+}
+
 // src/script-workflows/supervisor.ts
 init_db();
 
@@ -986,6 +1175,7 @@ init_db();
 import { existsSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
 import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 // src/script-workflows/limits.ts
 var DEFAULT_MAX_STEPS = 1000;
@@ -1013,7 +1203,7 @@ var MAX_STDERR_BYTES = 1048576;
 function getScriptWorkflowHarnessPath() {
   const runtimeDir = process.env.SCRIPT_WORKFLOW_RUNTIME_DIR;
   if (!runtimeDir)
-    return new URL("./harness.ts", import.meta.url).pathname;
+    return fileURLToPath(new URL("./harness.ts", import.meta.url));
   const bundledHarness = `${resolve(runtimeDir)}/harness.bundle.js`;
   if (!existsSync(bundledHarness)) {
     throw new Error(`Script workflow harness bundle not found at ${bundledHarness}. ` + "Build/copy harness.bundle.js and set SCRIPT_WORKFLOW_RUNTIME_DIR to its directory.");
@@ -1237,7 +1427,8 @@ var createActiveSession = route({
     triggerType: exports_external.string().min(1),
     inboxMessageId: exports_external.string().optional(),
     taskDescription: exports_external.string().optional(),
-    runnerSessionId: exports_external.string().optional()
+    runnerSessionId: exports_external.string().optional(),
+    runtimeInstanceId: exports_external.string().optional()
   }),
   responses: {
     201: { description: "Session created", schema: exports_external.object({ session: ActiveSessionSchema }) },
@@ -1340,7 +1531,8 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
       triggerType: parsed.body.triggerType,
       inboxMessageId: parsed.body.inboxMessageId,
       taskDescription: parsed.body.taskDescription,
-      runnerSessionId: parsed.body.runnerSessionId
+      runnerSessionId: parsed.body.runnerSessionId,
+      runtimeInstanceId: parsed.body.runtimeInstanceId
     });
     createActiveSession.respond(res, 201, { session });
     return true;
@@ -1383,7 +1575,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
       return true;
     let cleaned = 0;
     if (parsed.body?.agentId) {
-      cleaned = cleanupAgentSessions(parsed.body.agentId);
+      cleaned = isMultiRuntimeEnabled() ? 0 : cleanupAgentSessions(parsed.body.agentId);
     } else {
       cleaned = cleanupStaleSessions(parsed.body?.maxAgeMinutes ?? 30);
     }
@@ -1411,6 +1603,12 @@ init_db();
 init_telemetry();
 init_types();
 init_constants();
+init_identity_field_budget();
+init_secret_scrubber();
+function singleHeaderValue(req, name) {
+  const raw = req.headers[name];
+  return Array.isArray(raw) ? raw[0] : raw;
+}
 var CapabilitySchema = exports_external.enum(ALL_CAPABILITIES);
 var AgentCapacitySchema = exports_external.object({
   current: exports_external.number().int(),
@@ -1450,7 +1648,8 @@ var registerAgent = route({
     capabilities: exports_external.array(exports_external.string()).optional(),
     maxTasks: exports_external.number().int().optional(),
     provider: ProviderNameSchema.optional(),
-    harness_provider: ProviderNameSchema.optional()
+    harness_provider: ProviderNameSchema.optional(),
+    runtimeInstanceId: exports_external.string().min(1).optional()
   }),
   responses: {
     200: {
@@ -1552,6 +1751,36 @@ var getAgentSetupScript = route({
     404: { description: "Agent not found" }
   }
 });
+var AgentRuntimeInstanceSchema = RuntimeInstanceSchema.omit({ metadata: true }).extend({
+  isLive: exports_external.boolean()
+});
+var listAgentRuntimeInstances = route({
+  method: "get",
+  path: "/api/agents/{id}/runtime-instances",
+  pattern: ["api", "agents", null, "runtime-instances"],
+  summary: "List runtime instances serving an agent",
+  description: "Read-only view of the worker processes currently registered for a logical agent. Rows exist only for multi-runtime registrations (MULTI_RUNTIME_ENABLED), so the list is empty in the default configuration. `isLive` combines `status` with `lastSeenAt` freshness against the server's staleness cutoff (`staleThresholdMinutes`); `reportedSlots` is each process's self-reported capacity, distinct from the agent's logical `maxTasks` policy.",
+  tags: ["Agents"],
+  params: exports_external.object({ id: exports_external.string() }),
+  responses: {
+    200: {
+      description: "Runtime instances for the agent (empty when none are registered)",
+      schema: exports_external.object({
+        runtimeInstances: exports_external.array(AgentRuntimeInstanceSchema),
+        staleThresholdMinutes: exports_external.number().int()
+      })
+    },
+    404: { description: "Agent not found" }
+  }
+});
+var ProfileSyncRejectionSchema = exports_external.object({
+  field: exports_external.enum(["soulMd", "identityMd", "claudeMd", "toolsMd"]),
+  diskSize: exports_external.number().int(),
+  dbSize: exports_external.number().int(),
+  budget: exports_external.number().int(),
+  delta: exports_external.number().int(),
+  reason: exports_external.string()
+});
 var updateAgentProfileRoute = route({
   method: "put",
   path: "/api/agents/{id}/profile",
@@ -1563,11 +1792,11 @@ var updateAgentProfileRoute = route({
     role: exports_external.string().max(100).optional(),
     description: exports_external.string().optional(),
     capabilities: exports_external.array(exports_external.string()).optional(),
-    claudeMd: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
-    soulMd: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
-    identityMd: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
+    claudeMd: exports_external.string().optional(),
+    soulMd: exports_external.string().optional(),
+    identityMd: exports_external.string().optional(),
     setupScript: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
-    toolsMd: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
+    toolsMd: exports_external.string().optional(),
     heartbeatMd: exports_external.string().max(MAX_PROFILE_FILE_LENGTH).optional(),
     avatar: AgentAvatarSchema.nullable().optional(),
     changeSource: exports_external.string().optional(),
@@ -1576,7 +1805,13 @@ var updateAgentProfileRoute = route({
   }),
   responses: {
     200: { description: "Profile updated", schema: AgentWithCapacitySchema },
-    400: { description: "Validation error" },
+    400: {
+      description: "Validation or identity-field budget error",
+      schema: exports_external.object({
+        error: exports_external.string(),
+        profileSyncRejection: ProfileSyncRejectionSchema.optional()
+      })
+    },
     404: { description: "Agent not found" }
   }
 });
@@ -1619,12 +1854,14 @@ var updateAgentCredentialStatusRoute = route({
   summary: "Worker self-report of credential readiness (Phase 3 boot loop)",
   tags: ["Agents"],
   params: exports_external.object({ id: exports_external.string() }),
+  headers: runtimeInstanceHeader("report credential readiness"),
   body: credentialStatusBody,
   responses: {
     200: {
       description: "State updated; returns the agent row.",
       schema: AgentWithCapacitySchema
     },
+    400: { description: "Missing X-Runtime-Instance-ID in multi-runtime mode" },
     404: { description: "Agent not found" }
   }
 });
@@ -1662,13 +1899,26 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
     if (!parsed)
       return true;
     const agentId = myAgentId || crypto.randomUUID();
+    const multiRuntime = isMultiRuntimeEnabled();
+    if (multiRuntime && parsed.body.runtimeInstanceId) {
+      const existingRuntime = getRuntimeInstanceById(parsed.body.runtimeInstanceId);
+      if (existingRuntime && existingRuntime.agentId !== agentId) {
+        jsonError(res, "runtimeInstanceId is already registered to another agent", 400);
+        return true;
+      }
+    } else if (multiRuntime) {
+      jsonError(res, "runtimeInstanceId is required when multi-runtime mode is enabled", 400);
+      return true;
+    }
     const result = getDb().transaction(() => {
       const existingAgent = getAgentById(agentId);
       if (existingAgent) {
         if (existingAgent.status === "offline") {
           updateAgentStatus(existingAgent.id, "idle");
         }
-        if (parsed.body.maxTasks !== undefined && parsed.body.maxTasks !== existingAgent.maxTasks) {
+        if (multiRuntime) {
+          reconcileAgentMaxTasksPolicy(existingAgent.id);
+        } else if (parsed.body.maxTasks !== undefined && parsed.body.maxTasks !== existingAgent.maxTasks) {
           updateAgentMaxTasks(existingAgent.id, parsed.body.maxTasks);
         }
         if (parsed.body.provider && parsed.body.provider !== existingAgent.provider) {
@@ -1678,6 +1928,14 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
           setAgentHarnessProvider(existingAgent.id, parsed.body.harness_provider);
         }
         resetEmptyPollCount(existingAgent.id);
+        if (multiRuntime && parsed.body.runtimeInstanceId) {
+          upsertRuntimeInstance({
+            id: parsed.body.runtimeInstanceId,
+            agentId: existingAgent.id,
+            reportedSlots: parsed.body.maxTasks ?? 1
+          });
+          reconcileAgentStatusFromRuntimes(existingAgent.id);
+        }
         return { agent: getAgentById(agentId), created: false };
       }
       const agent = createAgent({
@@ -1692,6 +1950,18 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
         provider: parsed.body.provider,
         harnessProvider: parsed.body.harness_provider ?? null
       });
+      if (multiRuntime) {
+        reconcileAgentMaxTasksPolicy(agent.id);
+        if (parsed.body.runtimeInstanceId) {
+          upsertRuntimeInstance({
+            id: parsed.body.runtimeInstanceId,
+            agentId: agent.id,
+            reportedSlots: parsed.body.maxTasks ?? 1
+          });
+          reconcileAgentStatusFromRuntimes(agent.id);
+        }
+        return { agent: getAgentById(agent.id), created: true };
+      }
       return { agent, created: true };
     })();
     telemetry.agent("registered", {
@@ -1780,6 +2050,20 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
     });
     return true;
   }
+  if (listAgentRuntimeInstances.match(req.method, pathSegments)) {
+    const parsed = await listAgentRuntimeInstances.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!getAgentById(parsed.params.id)) {
+      jsonError(res, "Agent not found", 404);
+      return true;
+    }
+    listAgentRuntimeInstances.respond(res, 200, {
+      runtimeInstances: listRuntimeInstancesForAgent(parsed.params.id).map(({ metadata: _metadata, ...instance }) => instance),
+      staleThresholdMinutes: runtimeStaleThresholdMinutes()
+    });
+    return true;
+  }
   if (updateAgentProfileRoute.match(req.method, pathSegments)) {
     const parsed = await updateAgentProfileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -1795,22 +2079,77 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
       changedByAgentId: body.changedByAgentId ?? null,
       changeReason: body.changeReason ?? null
     } : undefined;
-    const agent = updateAgentProfile(parsed.params.id, {
-      role: body.role,
-      description: body.description,
-      capabilities: body.capabilities,
-      claudeMd: body.claudeMd,
-      soulMd: body.soulMd,
-      identityMd: body.identityMd,
-      setupScript: body.setupScript,
-      toolsMd: body.toolsMd,
-      heartbeatMd: body.heartbeatMd,
-      ...body.avatar !== undefined ? { avatar: body.avatar } : {}
-    }, versionMeta);
+    let agent;
+    try {
+      agent = updateAgentProfile(parsed.params.id, {
+        role: body.role,
+        description: body.description,
+        capabilities: body.capabilities,
+        claudeMd: body.claudeMd,
+        soulMd: body.soulMd,
+        identityMd: body.identityMd,
+        setupScript: body.setupScript,
+        toolsMd: body.toolsMd,
+        heartbeatMd: body.heartbeatMd,
+        ...body.avatar !== undefined ? { avatar: body.avatar } : {}
+      }, versionMeta);
+    } catch (error) {
+      if (error instanceof IdentityFieldBudgetError) {
+        if (versionMeta?.changeSource === "self_edit" || versionMeta?.changeSource === "session_sync") {
+          try {
+            createEvent({
+              category: "system",
+              event: "system.profile_sync_rejected",
+              status: "error",
+              source: "api",
+              agentId: parsed.params.id,
+              data: {
+                ...error.rejection,
+                dbHash: error.dbHash,
+                diskHash: error.diskHash,
+                changeSource: versionMeta.changeSource
+              }
+            });
+          } catch (eventError) {
+            const message = eventError instanceof Error ? eventError.message : String(eventError);
+            console.error(scrubSecrets(`[profile-sync] Failed to persist budget rejection event: ${message}`));
+          }
+        }
+        updateAgentProfileRoute.respond(res, 400, {
+          error: error.message,
+          profileSyncRejection: error.rejection
+        });
+        return true;
+      }
+      throw error;
+    }
     if (!agent) {
       jsonError(res, "Agent not found", 404);
       return true;
     }
+    if (versionMeta?.changeSource === "self_edit" || versionMeta?.changeSource === "session_sync") {
+      try {
+        for (const field of Object.keys(IDENTITY_FIELD_BUDGETS)) {
+          if (body[field] === undefined)
+            continue;
+          createEvent({
+            category: "system",
+            event: "system.profile_sync_reconciled",
+            status: "ok",
+            source: "api",
+            agentId: parsed.params.id,
+            data: {
+              field,
+              dbHash: computeContentHash(agent[field] ?? ""),
+              changeSource: versionMeta.changeSource
+            }
+          });
+        }
+      } catch (eventError) {
+        const message = eventError instanceof Error ? eventError.message : String(eventError);
+        console.error(scrubSecrets(`[profile-sync] Failed to persist reconciliation event: ${message}`));
+      }
+    }
     updateAgentProfileRoute.respond(res, 200, agentWithCapacity(agent));
     return true;
   }
@@ -1934,7 +2273,24 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
       jsonError(res, "Agent not found", 404);
       return true;
     }
-    const agent = parsed.body.ready !== undefined ? updateAgentCredentialState(parsed.params.id, parsed.body.ready, parsed.body.missing ?? null) ?? existing : existing;
+    const runtimeInstanceId = singleHeaderValue(req, "x-runtime-instance-id");
+    const multiRuntime = isMultiRuntimeEnabled();
+    if (multiRuntime && parsed.body.ready !== undefined && !runtimeInstanceId) {
+      jsonError(res, "X-Runtime-Instance-ID is required when multi-runtime mode is enabled", 400);
+      return true;
+    }
+    let agent = existing;
+    if (parsed.body.ready !== undefined) {
+      if (multiRuntime && runtimeInstanceId) {
+        if (setRuntimeCredentialReady(runtimeInstanceId, parsed.params.id, parsed.body.ready)) {
+          updateAgentCredentialMissing(parsed.params.id, parsed.body.missing ?? null);
+          reconcileAgentStatusFromRuntimes(parsed.params.id);
+        }
+        agent = getAgentById(parsed.params.id) ?? existing;
+      } else {
+        agent = updateAgentCredentialState(parsed.params.id, parsed.body.ready, parsed.body.missing ?? null) ?? existing;
+      }
+    }
     if (!agent) {
       jsonError(res, "Agent not found", 404);
       return true;
@@ -3526,7 +3882,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     }
     try {
       const includeSecrets = queryParams.get("includeSecrets") === "true";
-      const config = upsertSwarmConfig({
+      const config = upsertSwarmConfigWithPolicyMirror({
         scope,
         scopeId: scopeId || null,
         key,
@@ -3564,6 +3920,9 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     if (existing.scope === "global") {
       scheduleIntegrationsReload();
     }
+    if (existing.scope === "agent" && existing.scopeId && existing.key === AGENT_MAX_TASKS_CONFIG_KEY) {
+      resetAgentMaxTasksMirror(existing.scopeId);
+    }
     deleteConfig.respond(res, 200, { success: true });
     return true;
   }
@@ -3801,6 +4160,7 @@ var getEventsRoute = route({
     agentId: exports_external.string().optional(),
     taskId: exports_external.string().optional(),
     sessionId: exports_external.string().optional(),
+    dataField: exports_external.string().optional(),
     since: exports_external.string().optional(),
     until: exports_external.string().optional(),
     limit: exports_external.coerce.number().int().min(1).max(1000).optional()
@@ -3893,6 +4253,7 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
       agentId: parsed.query.agentId || undefined,
       taskId: parsed.query.taskId || undefined,
       sessionId: parsed.query.sessionId || undefined,
+      dataField: parsed.query.dataField || undefined,
       since: parsed.query.since || undefined,
       until: parsed.query.until || undefined,
       limit: parsed.query.limit ?? 100
@@ -6455,6 +6816,15 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
       chunks.push(chunk);
     }
     const body = JSON.parse(Buffer.concat(chunks).toString());
+    if (!sessionId && body.method === "server/discover") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        jsonrpc: "2.0",
+        error: { code: -32601, message: "Method not found" },
+        id: body.id ?? null
+      }));
+      return true;
+    }
     let transport;
     if (sessionId && transports[sessionId]) {
       transport = transports[sessionId];
@@ -6577,6 +6947,9 @@ var SDK_TOOL_NAME_MAP = {
   slack_post: "slack-post",
   slack_reply: "slack-reply",
   slack_startThread: "slack-start-thread",
+  slack_createChannel: "slack-create-channel",
+  slack_inviteToChannel: "slack-invite-to-channel",
+  slack_archiveChannel: "slack-archive-channel",
   slack_uploadFile: "slack-upload-file",
   slack_downloadFile: "slack-download-file",
   slack_delete: "slack-delete",
@@ -6663,6 +7036,7 @@ var mcpBridgeRoute = route({
   pattern: ["api", "mcp-bridge"],
   summary: "Generic MCP tool proxy for the scripts SDK bridge",
   tags: ["Scripts"],
+  headers: runtimeInstanceHeader("acquire work through bridged tools"),
   body: exports_external.object({
     tool: exports_external.string().min(1).max(200),
     args: exports_external.record(exports_external.string(), exports_external.unknown()).default({})
@@ -6700,17 +7074,30 @@ async function handleMcpBridge(req, res, pathSegments, _queryParams, myAgentId)
     return true;
   }
   const sourceTaskId = Array.isArray(req.headers["x-source-task-id"]) ? req.headers["x-source-task-id"][0] : req.headers["x-source-task-id"];
+  const runtimeInstanceId = Array.isArray(req.headers["x-runtime-instance-id"]) ? req.headers["x-runtime-instance-id"][0] : req.headers["x-runtime-instance-id"];
   const extra = markScriptSdkRequestOrigin({
     sessionId: "mcp-bridge",
     requestInfo: {
       headers: {
         "x-agent-id": myAgentId ?? "",
-        ...sourceTaskId ? { "x-source-task-id": sourceTaskId } : {}
+        ...sourceTaskId ? { "x-source-task-id": sourceTaskId } : {},
+        ...runtimeInstanceId ? { "x-runtime-instance-id": runtimeInstanceId } : {}
       }
     }
   });
+  let handlerArgs = args;
+  if (tool.inputSchema) {
+    const inputObj = normalizeObjectSchema(tool.inputSchema);
+    const parseResult = await safeParseAsync(inputObj ?? tool.inputSchema, args);
+    if (!parseResult.success) {
+      const parseError = "error" in parseResult ? parseResult.error : "Unknown error";
+      jsonError(res, `Invalid arguments for tool '${toolName}': ${getParseErrorMessage(parseError)}`, 400);
+      return true;
+    }
+    handlerArgs = parseResult.data;
+  }
   try {
-    const result = tool.inputSchema ? await Promise.resolve(tool.handler(args, extra)) : await Promise.resolve(tool.handler(extra));
+    const result = tool.inputSchema ? await Promise.resolve(tool.handler(handlerArgs, extra)) : await Promise.resolve(tool.handler(extra));
     if (result && typeof result === "object" && "structuredContent" in result) {
       json(res, result.structuredContent);
     } else if (result && typeof result === "object" && "content" in result) {
@@ -8495,6 +8882,7 @@ function getUsefulnessStats(options = {}) {
 
 // src/http/memory.ts
 init_types();
+init_secret_scrubber();
 var MemoryRetrievalSourceSchema = exports_external.enum(["vec", "fts", "hybrid", "fallback", "graph"]);
 var IndexMemoryResponseSchema = exports_external.object({
   queued: exports_external.boolean(),
@@ -9037,7 +9425,7 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
       } catch (err) {
         console.error("[memory] Batch embedding failed:", err.message);
       }
-    })();
+    })().catch((err) => console.error("[memory] batch embed failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
     indexMemory.respond(res, 202, { queued: true, memoryIds: memories.map((m) => m.id) });
     return true;
   }
@@ -9308,7 +9696,7 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
         }
       }
       console.log(`[memory] Re-embedding complete: ${memories.length} memories`);
-    })();
+    })().catch((err) => console.error("[memory] re-embed batch failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
     return true;
   }
   if (rateMemory.match(req.method, pathSegments)) {
@@ -11945,11 +12333,14 @@ var PollRequestedBySchema = UserSchema.pick({
   email: true,
   role: true,
   notes: true
+}).extend({
+  comms: UserCommsPrefsSchema.optional()
 });
 var PollTaskOfferedTriggerSchema = exports_external.object({
   type: exports_external.literal("task_offered"),
   taskId: exports_external.string(),
-  task: AgentTaskSchema
+  task: AgentTaskSchema,
+  requestedBy: PollRequestedBySchema.optional()
 });
 var PollTaskAssignedTriggerSchema = exports_external.object({
   type: exports_external.literal("task_assigned"),
@@ -11993,6 +12384,7 @@ var pollTriggers = route({
   summary: "Poll for triggers (tasks, mentions)",
   tags: ["Poll"],
   auth: { apiKey: true, agentId: true },
+  headers: runtimeInstanceHeader("poll for work"),
   responses: {
     200: { description: "Trigger data or null", schema: pollResponseSchema },
     400: { description: "Missing X-Agent-ID" },
@@ -12004,6 +12396,22 @@ var lastChannelActivityCheckAt = 0;
 function getRequesterNotes(notes) {
   return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
 }
+function buildTriggerRequestedBy(task) {
+  const user = task.requestedByUserId ? getUserById(task.requestedByUserId) : undefined;
+  if (user) {
+    return {
+      name: user.name,
+      email: user.email,
+      role: user.role,
+      notes: getRequesterNotes(user.notes),
+      comms: getUserCommsPrefs(user)
+    };
+  }
+  if (task.slackUserId) {
+    return { name: renderIdentity(resolveIdentity("slack", task.slackUserId)) };
+  }
+  return;
+}
 function attachmentsForTrigger(taskId) {
   return getTaskAttachments(taskId).map((a) => ({
     id: a.id,
@@ -12034,6 +12442,7 @@ var commitCursorsRoute = route({
   }
 });
 async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
+  const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
   if (commitCursorsRoute.match(req.method, pathSegments)) {
     const parsed = await commitCursorsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -12061,16 +12470,21 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         if (!agent) {
           return { error: "Agent not found", status: 404 };
         }
-        const offeredTasks = getOfferedTasksForAgent(myAgentId);
+        if (isMultiRuntimeEnabled() && !(runtimeInstanceId && touchRuntimeInstance(runtimeInstanceId, agent.id))) {
+          return { trigger: null };
+        }
+        const offeredTasks = hasCapacity(myAgentId) ? getOfferedTasksForAgent(myAgentId) : [];
         const firstOfferedTask = offeredTasks[0];
         if (firstOfferedTask) {
           const claimedTask = claimOfferedTask(firstOfferedTask.id, myAgentId);
           if (claimedTask) {
+            const offeredRequestedBy = buildTriggerRequestedBy(claimedTask);
             return {
               trigger: {
                 type: "task_offered",
                 taskId: claimedTask.id,
-                task: claimedTask
+                task: claimedTask,
+                ...offeredRequestedBy && { requestedBy: offeredRequestedBy }
               }
             };
           }
@@ -12121,6 +12535,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
               };
             }
             startTask(pendingTask.id);
+            updateAgentStatusFromCapacity(myAgentId);
             ensure({
               id: "started",
               flow: "task",
@@ -12140,9 +12555,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
               source: pendingTask.source,
               agentId: myAgentId
             });
-            const requestedByUser = pendingTask.requestedByUserId ? getUserById(pendingTask.requestedByUserId) : undefined;
-            const requestedByNotes = getRequesterNotes(requestedByUser?.notes);
-            const requestedByUnknownName = !requestedByUser && pendingTask.slackUserId ? renderIdentity(resolveIdentity("slack", pendingTask.slackUserId)) : undefined;
+            const assignedRequestedBy = buildTriggerRequestedBy(pendingTask);
             return {
               trigger: {
                 type: "task_assigned",
@@ -12152,17 +12565,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                   status: "in_progress",
                   attachments: attachmentsForTrigger(pendingTask.id)
                 },
-                ...requestedByUser && {
-                  requestedBy: {
-                    name: requestedByUser.name,
-                    email: requestedByUser.email,
-                    role: requestedByUser.role,
-                    notes: requestedByNotes
-                  }
-                },
-                ...requestedByUnknownName && {
-                  requestedBy: { name: requestedByUnknownName }
-                }
+                ...assignedRequestedBy && { requestedBy: assignedRequestedBy }
               }
             };
           }
@@ -12230,16 +12633,19 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
             for (const candidateId of unassignedIds) {
               const claimed = claimTask(candidateId, myAgentId);
               if (claimed) {
+                updateAgentStatusFromCapacity(myAgentId);
                 telemetry.taskEvent("claimed", {
                   taskId: claimed.id,
                   source: claimed.source,
                   agentId: myAgentId
                 });
+                const claimedRequestedBy = buildTriggerRequestedBy(claimed);
                 return {
                   trigger: {
                     type: "task_assigned",
                     taskId: claimed.id,
-                    task: { ...claimed, attachments: attachmentsForTrigger(claimed.id) }
+                    task: { ...claimed, attachments: attachmentsForTrigger(claimed.id) },
+                    ...claimedRequestedBy && { requestedBy: claimedRequestedBy }
                   }
                 };
               }
@@ -12489,6 +12895,7 @@ async function handlePricing(req, res, pathSegments, queryParams, _myAgentId) {
 // src/http/prompt-templates.ts
 init_zod();
 init_db();
+init_default_drift();
 init_registry();
 init_resolver();
 init_types();
@@ -12505,6 +12912,14 @@ var EventTemplateDefinitionResponseSchema = exports_external.object({
   variables: exports_external.array(VariableDefinitionSchema),
   category: exports_external.enum(["event", "system", "common", "task_lifecycle", "session"])
 });
+var PromptTemplateResponseSchema = PromptTemplateSchema.extend({
+  defaultDrifted: exports_external.boolean()
+}).openapi("PromptTemplateResponse");
+function toPromptTemplateResponse(template) {
+  const definition = getTemplateDefinition(template.eventType);
+  const defaultDrifted = definition ? getPromptTemplateDefaultDrift(template, definition.defaultBody).defaultDrifted : false;
+  return { ...template, defaultDrifted };
+}
 var ResolveResultSchema = exports_external.object({
   text: exports_external.string(),
   templateId: exports_external.string().optional(),
@@ -12512,7 +12927,10 @@ var ResolveResultSchema = exports_external.object({
   skipped: exports_external.boolean(),
   unresolved: exports_external.array(exports_external.string())
 });
-var DbResolveResultSchema = exports_external.union([exports_external.object({ template: PromptTemplateSchema }), exports_external.object({ skip: exports_external.literal(true) })]).nullable();
+var DbResolveResultSchema = exports_external.union([
+  exports_external.object({ template: PromptTemplateResponseSchema }),
+  exports_external.object({ skip: exports_external.literal(true) })
+]).nullable();
 var resolvedRoute = route({
   method: "get",
   path: "/api/prompt-templates/resolved",
@@ -12600,7 +13018,7 @@ var checkoutRoute = route({
   responses: {
     200: {
       description: "Checked-out template",
-      schema: exports_external.object({ template: PromptTemplateSchema })
+      schema: exports_external.object({ template: PromptTemplateResponseSchema })
     },
     400: { description: "Validation error" },
     404: { description: "Template or version not found" }
@@ -12615,7 +13033,10 @@ var resetRoute = route({
   tags: ["PromptTemplates"],
   params: exports_external.object({ id: exports_external.string() }),
   responses: {
-    200: { description: "Reset template", schema: exports_external.object({ template: PromptTemplateSchema }) },
+    200: {
+      description: "Reset template",
+      schema: exports_external.object({ template: PromptTemplateResponseSchema })
+    },
     404: { description: "Template not found or no code default available" }
   },
   auth: { apiKey: true }
@@ -12631,7 +13052,7 @@ var getByIdRoute2 = route({
     200: {
       description: "Template with history",
       schema: exports_external.object({
-        template: PromptTemplateSchema,
+        template: PromptTemplateResponseSchema,
         history: exports_external.array(PromptTemplateHistorySchema)
       })
     },
@@ -12671,7 +13092,7 @@ var listRoute2 = route({
   responses: {
     200: {
       description: "List of prompt templates",
-      schema: exports_external.object({ templates: exports_external.array(PromptTemplateSchema) })
+      schema: exports_external.object({ templates: exports_external.array(PromptTemplateResponseSchema) })
     }
   },
   auth: { apiKey: true }
@@ -12694,7 +13115,7 @@ var upsertRoute = route({
   responses: {
     200: {
       description: "Upserted template",
-      schema: exports_external.object({ template: PromptTemplateSchema })
+      schema: exports_external.object({ template: PromptTemplateResponseSchema })
     },
     400: { description: "Validation error" }
   },
@@ -12715,7 +13136,7 @@ async function handlePromptTemplates(req, res, pathSegments, queryParams) {
     const definition = getTemplateDefinition(eventType);
     resolvedRoute.respond(res, 200, {
       resolution: result,
-      dbResult,
+      dbResult: dbResult && "template" in dbResult ? { template: toPromptTemplateResponse(dbResult.template) } : dbResult,
       definition: definition ? {
         eventType: definition.eventType,
         header: definition.header,
@@ -12772,7 +13193,7 @@ ${templateBody}` : templateBody;
       return true;
     try {
       const template = checkoutPromptTemplate(parsed.params.id, parsed.body.version);
-      checkoutRoute.respond(res, 200, { template });
+      checkoutRoute.respond(res, 200, { template: toPromptTemplateResponse(template) });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       if (message.includes("not found")) {
@@ -12799,7 +13220,7 @@ ${templateBody}` : templateBody;
     }
     try {
       const template = resetPromptTemplateToDefault(parsed.params.id, definition.defaultBody);
-      resetRoute.respond(res, 200, { template });
+      resetRoute.respond(res, 200, { template: toPromptTemplateResponse(template) });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       jsonError(res, message, 400);
@@ -12816,7 +13237,7 @@ ${templateBody}` : templateBody;
       return true;
     }
     const history = getPromptTemplateHistory(parsed.params.id);
-    getByIdRoute2.respond(res, 200, { template, history });
+    getByIdRoute2.respond(res, 200, { template: toPromptTemplateResponse(template), history });
     return true;
   }
   if (deleteByIdRoute.match(req.method, pathSegments)) {
@@ -12846,7 +13267,7 @@ ${templateBody}` : templateBody;
       scopeId: parsed.query.scopeId || undefined,
       isDefault: parsed.query.isDefault ? parsed.query.isDefault === "true" : undefined
     });
-    listRoute2.respond(res, 200, { templates });
+    listRoute2.respond(res, 200, { templates: templates.map(toPromptTemplateResponse) });
     return true;
   }
   if (upsertRoute.match(req.method, pathSegments)) {
@@ -12881,7 +13302,7 @@ ${templateBody}` : templateBody;
         changedBy,
         changeReason
       });
-      upsertRoute.respond(res, 200, { template });
+      upsertRoute.respond(res, 200, { template: toPromptTemplateResponse(template) });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       jsonError(res, message, 500);
@@ -13085,7 +13506,7 @@ var scheduleUpdateBodySchema = exports_external.object({
   taskTemplate: exports_external.string().optional(),
   taskType: exports_external.string().optional(),
   tags: exports_external.array(exports_external.string()).optional(),
-  priority: exports_external.number().int().optional(),
+  priority: exports_external.number().int().min(0).max(100).optional(),
   targetAgentId: exports_external.string().nullable().optional(),
   enabled: exports_external.boolean().optional(),
   timezone: exports_external.string().optional(),
@@ -13122,7 +13543,7 @@ var createSchedule = route({
     taskTemplate: exports_external.string().min(1).optional(),
     taskType: exports_external.string().optional(),
     tags: exports_external.array(exports_external.string()).optional(),
-    priority: exports_external.number().int().optional(),
+    priority: exports_external.number().int().min(0).max(100).optional(),
     targetAgentId: exports_external.string().optional(),
     enabled: exports_external.boolean().optional(),
     timezone: exports_external.string().optional(),
@@ -16296,6 +16717,7 @@ var runRoute = route({
   summary: "Run a reusable or inline script",
   description: "Inline source skips typecheck and is auto-saved as a scratch script only on success.",
   tags: ["Scripts"],
+  headers: runtimeInstanceHeader("acquire work through the script SDK"),
   body: runBodySchema,
   responses: {
     200: { description: "Script run completed", schema: scriptRunResponseSchema },
@@ -16657,6 +17079,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     const agent = requireAgent2(res, agentId);
     if (!agent)
       return true;
+    const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
     let namedScript = null;
@@ -16682,6 +17105,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       args: parsed.body.args,
       fsMode,
       agentId: agent.id,
+      runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
       failedBindings: credentials.failedBindings,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
@@ -17120,7 +17544,10 @@ var SessionCostSummaryTotalsSchema = exports_external.object({
   totalDurationMs: exports_external.number().int(),
   totalSessions: exports_external.number().int(),
   avgCostPerSession: exports_external.number(),
-  attributedCostUsd: exports_external.number()
+  attributedCostUsd: exports_external.number(),
+  attributableCostUsd: exports_external.number(),
+  excludedCostUsd: exports_external.number(),
+  excludedTaskCount: exports_external.number().int()
 });
 var SessionCostDailyRowSchema = exports_external.object({
   date: exports_external.string(),
@@ -17155,6 +17582,15 @@ var DashboardCostSummarySchema = exports_external.object({
   costToday: exports_external.number(),
   costMtd: exports_external.number()
 });
+var AttributionByPersonRowSchema = exports_external.object({
+  userId: exports_external.string(),
+  problemsInitiated: exports_external.number().int(),
+  problemsShipped: exports_external.number().int(),
+  agentsReached: exports_external.number().int(),
+  reposReached: exports_external.number().int(),
+  surfacesReached: exports_external.number().int(),
+  firstPassYield: exports_external.null()
+});
 var createSessionLogsRoute = route({
   method: "post",
   path: "/api/session-logs",
@@ -17247,6 +17683,23 @@ var getSessionCostSummaryRoute = route({
     400: { description: "Invalid groupBy" }
   }
 });
+var getAttributionByPersonRoute = route({
+  method: "get",
+  path: "/api/attribution/by-person",
+  pattern: ["api", "attribution", "by-person"],
+  summary: "Four-metric per-person attribution (problems initiated/shipped, reach)",
+  tags: ["Session Data"],
+  query: exports_external.object({
+    startDate: exports_external.string().optional(),
+    endDate: exports_external.string().optional()
+  }),
+  responses: {
+    200: {
+      description: "Per-person attribution rows",
+      schema: exports_external.object({ rows: exports_external.array(AttributionByPersonRowSchema) })
+    }
+  }
+});
 var getDashboardCosts = route({
   method: "get",
   path: "/api/session-costs/dashboard",
@@ -17408,6 +17861,17 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
     getDashboardCosts.respond(res, 200, dashboardCosts);
     return true;
   }
+  if (getAttributionByPersonRoute.match(req.method, pathSegments)) {
+    const parsed = await getAttributionByPersonRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const rows = getAttributionByPerson({
+      startDate: parsed.query.startDate || undefined,
+      endDate: parsed.query.endDate || undefined
+    });
+    getAttributionByPersonRoute.respond(res, 200, { rows });
+    return true;
+  }
   if (listSessionCosts.match(req.method, pathSegments)) {
     const parsed = await listSessionCosts.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -19183,7 +19647,7 @@ var createTask = route({
     agentId: exports_external.string().optional(),
     taskType: exports_external.string().optional(),
     tags: exports_external.array(exports_external.string()).optional(),
-    priority: exports_external.number().int().optional(),
+    priority: exports_external.number().int().min(0).max(100).optional(),
     dependsOn: exports_external.array(exports_external.string()).optional(),
     offeredTo: exports_external.string().optional(),
     dir: exports_external.string().optional(),
@@ -19643,7 +20107,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
         creatorAgentId: myAgentId || undefined,
         taskType: parsed.body.taskType || undefined,
         tags: parsed.body.tags || undefined,
-        priority: parsed.body.priority || 50,
+        priority: parsed.body.priority,
         dependsOn: parsed.body.dependsOn || undefined,
         offeredTo: parsed.body.offeredTo || undefined,
         dir: parsed.body.dir || undefined,
@@ -21202,6 +21666,7 @@ var updateUserRoute = route({
     preferredChannel: exports_external.string().optional(),
     timezone: exports_external.string().optional(),
     metadata: exports_external.record(exports_external.string(), exports_external.unknown()).nullable().optional(),
+    comms: UserCommsPrefsSchema.nullable().optional().describe("Merges into metadata.comms without touching sibling metadata keys; null removes only the comms key. When metadata is also provided, it is applied first and replaces the whole blob."),
     dailyBudgetUsd: exports_external.number().nullable().optional(),
     status: exports_external.enum(["invited", "active", "suspended"]).optional(),
     identities: exports_external.array(exports_external.object({ kind: exports_external.string().min(1), externalId: exports_external.string().min(1) })).optional()
@@ -21620,43 +22085,46 @@ async function handleUsers(req, res, pathSegments, queryParams) {
       return true;
     }
     try {
-      for (const ident of sourceBefore.identities) {
-        unlinkIdentity(sourceId, ident.kind, ident.externalId, actor);
-        linkIdentity(targetId, ident.kind, ident.externalId, actor);
-      }
-      const targetAliases = new Set(targetBefore.emailAliases ?? []);
-      const targetPrimary = (targetBefore.email ?? "").toLowerCase();
-      const newAliases = [];
-      const candidates = [
-        ...sourceBefore.email ? [sourceBefore.email] : [],
-        ...sourceBefore.emailAliases ?? []
-      ];
-      for (const candidate of candidates) {
-        const lower = candidate.toLowerCase();
-        if (!lower || lower === targetPrimary)
-          continue;
-        if (![...targetAliases].some((a) => a.toLowerCase() === lower) && !newAliases.some((a) => a.toLowerCase() === lower)) {
-          newAliases.push(candidate);
+      const mergedUser = getDb().transaction(() => {
+        for (const ident of sourceBefore.identities) {
+          unlinkIdentity(sourceId, ident.kind, ident.externalId, actor);
+          linkIdentity(targetId, ident.kind, ident.externalId, actor);
         }
-      }
-      if (newAliases.length > 0) {
-        const merged = [...targetBefore.emailAliases ?? [], ...newAliases];
-        updateUser(targetId, { emailAliases: merged });
-        for (const alias of newAliases) {
-          recordIdentityEvent(targetId, "email_added", actor, null, { email: alias });
+        const targetAliases = new Set(targetBefore.emailAliases ?? []);
+        const targetPrimary = (targetBefore.email ?? "").toLowerCase();
+        const newAliases = [];
+        const candidates = [
+          ...sourceBefore.email ? [sourceBefore.email] : [],
+          ...sourceBefore.emailAliases ?? []
+        ];
+        for (const candidate of candidates) {
+          const lower = candidate.toLowerCase();
+          if (!lower || lower === targetPrimary)
+            continue;
+          if (![...targetAliases].some((a) => a.toLowerCase() === lower) && !newAliases.some((a) => a.toLowerCase() === lower)) {
+            newAliases.push(candidate);
+          }
         }
-      }
-      deleteUser(sourceId);
-      const targetAfter = composeUser(targetId);
-      recordIdentityEvent(targetId, "manual_merge", actor, targetBefore, {
-        ...targetAfter,
-        source: {
-          id: sourceBefore.id,
-          name: sourceBefore.name,
-          email: sourceBefore.email
+        if (newAliases.length > 0) {
+          const merged = [...targetBefore.emailAliases ?? [], ...newAliases];
+          updateUser(targetId, { emailAliases: merged });
+          for (const alias of newAliases) {
+            recordIdentityEvent(targetId, "email_added", actor, null, { email: alias });
+          }
         }
-      });
-      mergeUsersRoute.respond(res, 200, { user: composeUser(targetId) });
+        deleteUser(sourceId, targetId);
+        const targetAfter = composeUser(targetId);
+        recordIdentityEvent(targetId, "manual_merge", actor, targetBefore, {
+          ...targetAfter,
+          source: {
+            id: sourceBefore.id,
+            name: sourceBefore.name,
+            email: sourceBefore.email
+          }
+        });
+        return composeUser(targetId);
+      })();
+      mergeUsersRoute.respond(res, 200, { user: mergedUser });
     } catch (err) {
       jsonError(res, err instanceof Error ? err.message : "Failed to merge users", 500);
     }
@@ -21687,9 +22155,19 @@ async function handleUsers(req, res, pathSegments, queryParams) {
       return true;
     }
     try {
-      const { identities, metadata, ...rest } = parsed.body;
+      const { identities, metadata, comms, ...rest } = parsed.body;
       const update = { ...rest };
-      if (metadata !== undefined) {
+      if (comms !== undefined) {
+        const base = {
+          ...metadata !== undefined ? metadata ?? {} : before.metadata ?? {}
+        };
+        if (comms === null) {
+          delete base.comms;
+        } else {
+          base.comms = comms;
+        }
+        update.metadata = Object.keys(base).length > 0 ? base : null;
+      } else if (metadata !== undefined) {
         update.metadata = metadata;
       }
       const updated = updateUser(parsed.params.id, update);
@@ -22301,7 +22779,10 @@ async function handleWebhooks(req, res, pathSegments) {
       const routing = routeKapsoInbound(payload);
       switch (routing.kind) {
         case "workflow":
-          await handleWebhookTrigger(routing.workflowId, rawBody, req.headers, getExecutorRegistry(), { alreadyAuthenticated: true });
+          await handleWebhookTrigger(routing.workflowId, rawBody, req.headers, getExecutorRegistry(), {
+            alreadyAuthenticated: true,
+            requestedByUserId: resolveKapsoRequestedByUserId(payload)
+          });
           break;
         case "no_mapping":
           console.warn(`[Kapso] No native mapping for phone_number_id "${routing.phoneNumberId}" — ignoring (register it with register-kapso-number)`);
@@ -22418,7 +22899,6 @@ async function handleWorkflowEvents(req, res, pathSegments, queryParams) {
 init_zod();
 init_db();
 init_types();
-init_request_auth_context();
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: exports_external.boolean() });
 var WorkflowSummarySchema = WorkflowSchema.omit({
   definition: true,
@@ -23085,12 +23565,11 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     const body = await parseBody(req);
-    const auth = getRequestAuth(req);
     let runId;
     try {
       runId = await startWorkflowExecution(workflow, body, getExecutorRegistry(), {
         triggerType: "api",
-        requestedByUserId: auth?.kind === "user" ? auth.userId : workflow.createdBy
+        requestedByUserId: resolveHttpAuditUserId(req, myAgentId) ?? undefined
       });
     } catch (err) {
       if (err instanceof TriggerSchemaError) {
@@ -23585,14 +24064,15 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-25wjsdv2.js");
+    const { stopScheduler } = await import("./index-67pzqfrb.js");
     stopScheduler();
   }
   stopHeartbeat();
+  stopQueueStallAlarm();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-vc7s2aa6.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-9k51nqhc.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -23631,11 +24111,11 @@ if (!globalState.__sigintRegistered) {
   globalState.__sigintRegistered = true;
   process.on("SIGINT", () => {
     shutdownSignal = "SIGINT";
-    shutdown();
+    shutdown().catch((err) => console.error("[shutdown] SIGINT shutdown failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
   });
   process.on("SIGTERM", () => {
     shutdownSignal = "SIGTERM";
-    shutdown();
+    shutdown().catch((err) => console.error("[shutdown] SIGTERM shutdown failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
   });
 }
 if (!globalState.__runId) {
@@ -23647,6 +24127,7 @@ try {
   startupConfigsInjected = loadGlobalConfigsIntoEnv(false);
 } catch (err) {
   console.error("[startup] Failed to load global swarm configs before listen:", err);
+  process.exitCode = 1;
   throw err;
 }
 try {
@@ -23655,15 +24136,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-8kceb43f.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-52xx6z63.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-2cn6effr.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-jw1yw2fn.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-vynday5g.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-dg964c8p.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -23671,7 +24152,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-eaxyqcmj.js");
+  const { runAllSeeders } = await import("./index-dvsk64sm.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -23700,6 +24181,7 @@ httpServer.listen(port, async () => {
   }, { generateIfMissing: true });
   telemetry.server("started", { port });
   await startSlackApp();
+  startQueueStallAlarm();
   initGitHub();
   initGitLab();
   initAgentMail();
@@ -23708,35 +24190,35 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-25wjsdv2.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-ywds4812.js");
+    const { startScheduler } = await import("./index-67pzqfrb.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-4cbyhq2g.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-vg4snay4.js");
+    const { startHeartbeat } = await import("./index-yrfphye1.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-vc7s2aa6.js");
+    const { startOAuthKeepalive } = await import("./keepalive-9k51nqhc.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-yecgjpk4.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-273a64r2.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-q7mp8hcr.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-b1rcqn85.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-xmw8wcx6.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-kw2541c4.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-dsqrv79n.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-ja29t92g.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {