@desplega.ai/agent-swarm 1.145.0 → 1.146.0

package/dist/{cli-65vqzz3v.js → cli-ah5hjk49.js}

@@ -1,10 +1,10 @@
 import {
   renderSteeringDelivery
-} from "./cli-dt553ktb.js";
+} from "./cli-bafd6xnf.js";
 import {
   checkCodexCredentials,
   codexUserHome
-} from "./cli-gxnzc6wh.js";
+} from "./cli-q3qr220d.js";
 import {
   checkClaudeManagedCredentials
 } from "./cli-cn6mmc7f.js";
@@ -18,10 +18,10 @@ import {
   renderMemoriesPrompt,
   resolveScriptsOnlyMode,
   writeSkillsToFilesystem
-} from "./cli-z9fprcrf.js";
+} from "./cli-dhg6j8h3.js";
 import {
   checkClaudeCredentials
-} from "./cli-v0asr5yv.js";
+} from "./cli-rymrjneb.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -34,7 +34,7 @@ import {
 } from "./cli-s25avqg9.js";
 import {
   validateJsonSchema
-} from "./cli-123q2get.js";
+} from "./cli-3k2g3kg2.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
@@ -57,7 +57,7 @@ import {
   syncProfileFilesToServer,
   writeIdentityBaselines,
   writeProfileFileFromDb
-} from "./cli-fs1kkqgr.js";
+} from "./cli-00kyrp1a.js";
 import {
   ensure,
   initOtel,
@@ -68,7 +68,7 @@ import {
   taskAttachmentDisplayUrl,
   withSpan,
   withSpanContext
-} from "./cli-jmb7g47h.js";
+} from "./cli-46yck6nj.js";
 import {
   ProviderNameSchema,
   initTelemetry,
@@ -76,7 +76,7 @@ import {
   init_types,
   resolveTaskModelSelection,
   telemetry
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -86,7 +86,7 @@ import {
   init_base_prompt,
   init_defaults,
   init_templates
-} from "./cli-kpev657q.js";
+} from "./cli-skd674mt.js";
 import {
   configureHttpResolver,
   init_resolver,
@@ -95,7 +95,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplateAsync
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   getMcpBaseUrl,
   init_constants
@@ -144,7 +144,7 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-paj270y2.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-ep6qekbm.js");
       return new ClaudeAdapter;
     }
     case "pi": {
@@ -152,7 +152,7 @@ async function createProviderAdapter(provider) {
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-k98vaw2r.js");
+      const { CodexAdapter } = await import("./codex-adapter-d6qajxj3.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
@@ -168,7 +168,7 @@ async function createProviderAdapter(provider) {
       return new OpencodeAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-580t41c0.js");
+      const { ACPAdapter } = await import("./acp-adapter-jnq4612m.js");
       return new ACPAdapter;
     }
     default:

package/dist/{cli-dt553ktb.js → cli-bafd6xnf.js}

@@ -2,7 +2,7 @@ import {
   init_resolver,
   init_session_templates,
   resolveTemplateAsync
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 
 // src/prompts/steering-delivery.ts
 init_session_templates();

package/dist/{cli-ygbjp3z8.js → cli-c8q7292f.js}

@@ -1,12 +1,12 @@
 import {
   SYSTEM_COLUMN_KINDS,
   listAppRecords
-} from "./cli-gzky0gkr.js";
+} from "./cli-a960nkfb.js";
 import {
   getScriptApiTypes,
   getScriptMcpTypes,
   require_typescript
-} from "./cli-rs6ec3b9.js";
+} from "./cli-68h2mfrn.js";
 import {
   deleteSwarmConfigByKey,
   getAgentById,
@@ -15,7 +15,7 @@ import {
   getSwarmConfigs,
   init_db,
   upsertSwarmConfig
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-f567d5c1.js → cli-d4xqde2b.js}

@@ -10,7 +10,7 @@ import {
   init_templates,
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd
-} from "./cli-kpev657q.js";
+} from "./cli-skd674mt.js";
 import {
   configureDbResolver,
   getAllTemplateDefinitions,
@@ -20,7 +20,7 @@ import {
   init_steering_enabled,
   isSteeringEnabled,
   registerTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   init_constants
@@ -48,7 +48,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-dc9k2ba9.js";
+} from "./cli-yxwe913z.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -5452,7 +5452,7 @@ var RESERVED_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_T
 var init_swarm_config_guard = __esm(() => {
   init_reaction_shortcode();
   init_types();
-  RESERVED_KEYS = new Set(["API_KEY", "SECRETS_ENCRYPTION_KEY"]);
+  RESERVED_KEYS = new Set(["API_KEY", "SECRETS_ENCRYPTION_KEY", "CORS_ALLOW_ANY_ORIGIN"]);
   BOOLEAN_LITERALS = ["true", "false", "1", "0"];
   DB_RETENTION_TUNING_BOUNDS = {
     DB_RETENTION_TICK_BUDGET_MS: { min: 1000, max: 300000 },
@@ -11049,7 +11049,7 @@ async function getSwarmConfigs(filters) {
 async function getInjectableGlobalConfigs() {
   const rows = await getDbClient().query(`SELECT * FROM swarm_config
        WHERE scope = 'global'
-         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY')
+         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN')
        ORDER BY key ASC`);
   return rows.map(rowToSwarmConfig);
 }

package/dist/{cli-m1xa8be7.js → cli-d9pnxgth.js}

@@ -1,13 +1,13 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-jnf5zghe.js";
+} from "./cli-ss6vybmt.js";
 import {
   rewriteSlackMentions
-} from "./cli-xytwff7f.js";
+} from "./cli-s8sbe32s.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-axs8e6d4.js";
+} from "./cli-m4xsy03s.js";
 import {
   buildBufferFlushBlocks,
   ensureSlackThreadTree,
@@ -16,7 +16,7 @@ import {
   getSlackApp,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-jmb7g47h.js";
+} from "./cli-46yck6nj.js";
 import {
   createLogEntry,
   getAgentById,
@@ -29,13 +29,13 @@ import {
   init_steering,
   requestSteering,
   slackContextKey
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_registry,
   init_steering_enabled,
   isSteeringEnabled,
   registerTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 
 // src/slack/event-dedup.ts
 var DEFAULT_TTL_MS = 300000;

package/dist/{cli-z9fprcrf.js → cli-dhg6j8h3.js}

@@ -11,17 +11,17 @@ import {
 import {
   calculateNextRun,
   runScheduleNow
-} from "./cli-59ej1c07.js";
+} from "./cli-zww3vcnm.js";
 import {
   startPricingRefreshLoop
-} from "./cli-m4j6trn4.js";
+} from "./cli-a9bn9svs.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-gh8y8f36.js";
+} from "./cli-yqeb27t1.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-q34a0e10.js";
+} from "./cli-506z6jqa.js";
 import {
   can,
   decideAdmission,
@@ -48,7 +48,7 @@ import {
   runSavedScriptAsAgent,
   updateApp,
   upgradeAppDefinition
-} from "./cli-gzky0gkr.js";
+} from "./cli-a960nkfb.js";
 import {
   require_dist as require_dist2
 } from "./cli-qgm2pfpq.js";
@@ -72,7 +72,7 @@ import {
   updateTrackerSync,
   updateTrackerSyncSwarmId,
   upsertSwarmConfigWithPolicyMirror
-} from "./cli-1fj0chdk.js";
+} from "./cli-qar1f940.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-07jd68a1.js";
@@ -86,7 +86,7 @@ import {
   snapshotWorkflow,
   startWorkflowExecution,
   validateJsonSchema
-} from "./cli-123q2get.js";
+} from "./cli-3k2g3kg2.js";
 import {
   ConnectionAuthInputSchema,
   SCRIPT_LONG_TIMEOUT_HINT_MS,
@@ -109,7 +109,7 @@ import {
   upsertCredentialBinding,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-rs6ec3b9.js";
+} from "./cli-68h2mfrn.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   computeScore,
@@ -121,7 +121,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-s2f20r5w.js";
+} from "./cli-pzfc7j7g.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -139,7 +139,7 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-wvp6bvy4.js";
+} from "./cli-4secrq32.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -154,7 +154,7 @@ import {
   createAdditiveBuffer,
   extractSlackMessageText,
   parseSlackTs
-} from "./cli-jnf5zghe.js";
+} from "./cli-ss6vybmt.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -170,10 +170,10 @@ import {
   resolveIdentityByEmail,
   resolveUserByToken,
   unlinkIdentity
-} from "./cli-z96t0thj.js";
+} from "./cli-q0qq1sxw.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-axs8e6d4.js";
+} from "./cli-m4xsy03s.js";
 import {
   ensure,
   getAgentDisplayName,
@@ -184,7 +184,7 @@ import {
   startSlackApp,
   stopSlackApp,
   withSpan
-} from "./cli-jmb7g47h.js";
+} from "./cli-46yck6nj.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -431,13 +431,13 @@ import {
   upsertPromptTemplate,
   upsertService,
   validateConfigValue
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
   generateDefaultSoulMd,
   init_defaults
-} from "./cli-kpev657q.js";
+} from "./cli-skd674mt.js";
 import {
   getTemplateDefinition,
   init_registry,
@@ -446,7 +446,7 @@ import {
   interpolate,
   registerTemplate,
   resolveTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -507,7 +507,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-dc9k2ba9.js";
+} from "./cli-yxwe913z.js";
 import {
   init_secret_scrubber,
   refreshSecretScrubberCache,
@@ -22295,7 +22295,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-zb3rndm8.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-j8bfw3f6.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -22366,7 +22366,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-30p4h2t1.js");
+  const { getDbClient: getDbClient2 } = await import("./db-m1hy4zh5.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -95438,14 +95438,68 @@ init_secret_scrubber();
 
 // src/http/utils.ts
 init_db();
+init_env_flag();
 init_secret_scrubber();
+var DEFAULT_ALLOWED_ORIGINS = [
+  "https://*.agent-swarm.dev",
+  "https://*.agent-swarm.cloud",
+  "http://localhost:5274",
+  "http://127.0.0.1:5274",
+  "http://[::1]:5274",
+  "https://ui.swarm.localhost:1355"
+];
+var warnedAboutAllowAnyOrigin = false;
+function warnIfCorsAllowsAnyOrigin() {
+  if (isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false) && !warnedAboutAllowAnyOrigin) {
+    warnedAboutAllowAnyOrigin = true;
+    console.warn("[CORS] CORS_ALLOW_ANY_ORIGIN=true: any request origin can receive non-credentialed responses; cookie-authenticated responses still require CORS_ALLOWED_ORIGINS. Set CORS_ALLOWED_ORIGINS and disable CORS_ALLOW_ANY_ORIGIN to restrict access.");
+  }
+}
+function getAllowedOrigins() {
+  const raw = process.env.CORS_ALLOWED_ORIGINS;
+  if (!raw || !raw.trim())
+    return DEFAULT_ALLOWED_ORIGINS;
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function isOriginAllowedForCredentials(origin) {
+  const allowed = getAllowedOrigins().some((entry) => {
+    if (!entry.includes("*"))
+      return entry === origin;
+    const pattern = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/\*\.([a-zA-Z0-9.-]+)(:\d+)?$/.exec(entry);
+    const candidate = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([a-zA-Z0-9.-]+)(:\d+)?$/.exec(origin);
+    if (!pattern || !candidate)
+      return false;
+    if (pattern[1] !== candidate[1] || pattern[3] !== candidate[3])
+      return false;
+    const suffix = pattern[2].toLowerCase();
+    const hostname = candidate[2].toLowerCase();
+    const validLabel = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    if (![...suffix.split("."), ...hostname.split(".")].every((label) => validLabel.test(label))) {
+      return false;
+    }
+    return hostname.endsWith(`.${suffix}`);
+  });
+  if (!allowed) {
+    console.warn(`[CORS] Denied credentialed origin ${scrubSecrets(JSON.stringify(origin.slice(0, 512)))}; add the trusted SPA origin to CORS_ALLOWED_ORIGINS (custom values replace hosted/dev defaults).`);
+  }
+  return allowed;
+}
 function setCorsHeaders(req, res) {
   const rawOrigin = req.headers.origin;
   const origin = Array.isArray(rawOrigin) ? rawOrigin[0] : rawOrigin;
+  const allowCredentials = origin ? isOriginAllowedForCredentials(origin) : false;
+  const allowAnyOrigin = isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false);
+  if (allowAnyOrigin)
+    warnIfCorsAllowsAnyOrigin();
+  if (origin && !allowCredentials && !allowAnyOrigin) {
+    res.setHeader("Vary", "Origin");
+    return;
+  }
   if (origin) {
     res.setHeader("Access-Control-Allow-Origin", origin);
     res.setHeader("Vary", "Origin");
-    res.setHeader("Access-Control-Allow-Credentials", "true");
+    if (allowCredentials)
+      res.setHeader("Access-Control-Allow-Credentials", "true");
     const reqHeaders = req.headers["access-control-request-headers"];
     const askedHeaders = Array.isArray(reqHeaders) ? reqHeaders.join(", ") : reqHeaders;
     res.setHeader("Access-Control-Allow-Headers", askedHeaders ?? "Authorization, Content-Type, X-Agent-ID, X-Requested-With");
@@ -121593,4 +121647,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };
+export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };

package/dist/{cli-bxdhw615.js → cli-jyy3e193.js}

@@ -11,14 +11,14 @@ import {
   getResumeGeneration,
   repointTrackerSyncBySwarmId,
   resolveLeadOnlyRecoveryAssignment
-} from "./cli-1fj0chdk.js";
+} from "./cli-qar1f940.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-07jd68a1.js";
 import {
   getExecutorRegistry,
   recoverIncompleteRuns
-} from "./cli-123q2get.js";
+} from "./cli-3k2g3kg2.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -61,13 +61,13 @@ import {
   releaseStaleReviewingTasks,
   supersedeTask,
   updateAgentStatus
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_registry,
   init_resolver,
   registerTemplate,
   resolveTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-axs8e6d4.js → cli-m4xsy03s.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 
 // src/tasks/sibling-awareness.ts
 init_db();

package/dist/{cli-a0g1gbt5.js → cli-pmwbdw36.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-s2f20r5w.js";
+} from "./cli-pzfc7j7g.js";
 import {
   getDbClient,
   init_db
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-s2f20r5w.js → cli-pzfc7j7g.js}

@@ -1,7 +1,7 @@
 import {
   contentSha256,
   init_profile_sync
-} from "./cli-fs1kkqgr.js";
+} from "./cli-00kyrp1a.js";
 import {
   OpenAI,
   init_openai
@@ -11,7 +11,7 @@ import {
   getDbClient,
   init_db,
   isSqliteVecAvailable
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   __esm,
   __export,

package/dist/{cli-z96t0thj.js → cli-q0qq1sxw.js}

@@ -4,7 +4,7 @@ import {
   incrKv,
   init_db,
   upsertKv
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 
 // src/be/users.ts
 init_db();

package/dist/{cli-gxnzc6wh.js → cli-q3qr220d.js}

@@ -49,7 +49,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-dc9k2ba9.js";
+} from "./cli-yxwe913z.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-1fj0chdk.js → cli-qar1f940.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-07jd68a1.js";
 import {
   taskAttachmentDisplayUrl
-} from "./cli-jmb7g47h.js";
+} from "./cli-46yck6nj.js";
 import {
   buildRoutingAffinityFromAgent,
   createLogEntry,
@@ -25,11 +25,11 @@ import {
   updateAgentMaxTasks,
   updateAgentStatus,
   upsertSwarmConfig
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_resolver,
   resolveTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   init_env_flag,
   isEnvFlagEnabled

package/dist/{cli-v0asr5yv.js → cli-rymrjneb.js}

@@ -1,6 +1,6 @@
 import {
   runStopHookSessionSummarySubprocess
-} from "./cli-anktweqr.js";
+} from "./cli-zn65x0w8.js";
 import {
   SessionErrorTracker,
   buildOtelTraceparentEnv,
@@ -817,7 +817,7 @@ class ClaudeAdapter {
     if (transport === "sdk" && isClaudeBridgeEffective(sourceEnv)) {
       throw new Error("CLAUDE_TRANSPORT=sdk cannot run with an effective Claude Bridge configuration. Select CLI transport or disable the bridge.");
     }
-    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-swt80j9z.js") : undefined;
+    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-0wp3qrcy.js") : undefined;
     claudeSdk?.validateClaudeSdkAdditionalArgs([
       ...claudeBinaryArgv.slice(1),
       ...config.additionalArgs ?? []

package/dist/{cli-xytwff7f.js → cli-s8sbe32s.js}

@@ -4,12 +4,12 @@ import {
   linkIdentity,
   recordUnmappedIdentity,
   resolveIdentity
-} from "./cli-z96t0thj.js";
+} from "./cli-q0qq1sxw.js";
 import {
   getKv,
   init_db,
   upsertKv
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 
 // src/slack/enrich.ts
 init_db();

package/dist/{cli-kpev657q.js → cli-skd674mt.js}

@@ -6,7 +6,7 @@ import {
   isSteeringEnabled,
   registerTemplate,
   resolveTemplateAsync
-} from "./cli-7fnkj1hj.js";
+} from "./cli-2zvtzevh.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/dist/{cli-jnf5zghe.js → cli-ss6vybmt.js}

@@ -3,7 +3,7 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 import {
   init_env_flag,
   isEnvFlagEnabled

package/dist/{cli-gh8y8f36.js → cli-yqeb27t1.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-f567d5c1.js";
+} from "./cli-d4xqde2b.js";
 
 // src/be/seed-pricing.ts
 init_db();

package/dist/{cli-dc9k2ba9.js → cli-yxwe913z.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "1.145.0",
+    version: "1.146.0",
     description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
     keywords: [
       "agent-swarm.dev",