@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/dist/{http-r4kq5g8d.js → http-y06z517d.js}

@@ -108,6 +108,7 @@ import {
   isJSONRPCResultResponse,
   isJiraEnabled,
   isLinearEnabled,
+  isOriginAllowedForCredentials,
   isSenderAllowed,
   issuePageSessionCookie,
   json,
@@ -178,9 +179,10 @@ import {
   verifyAgentMailWebhook,
   verifyGitLabWebhook,
   verifyWebhookSignature,
+  warnIfCorsAllowsAnyOrigin,
   wireHttpSpanLifecycle,
   writeSkillsToFilesystem
-} from "./cli-z9fprcrf.js";
+} from "./cli-atcve9y8.js";
 import"./cli-8fc8de14.js";
 import {
   Anthropic
@@ -199,16 +201,16 @@ import {
 import {
   calculateNextRun,
   dispatchScheduleTarget
-} from "./cli-59ej1c07.js";
+} from "./cli-smby5m17.js";
 import {
   getModelsCatalog
-} from "./cli-m4j6trn4.js";
+} from "./cli-m8yrsg97.js";
 import {
   normalizeModelKey
-} from "./cli-gh8y8f36.js";
+} from "./cli-rw51bq3j.js";
 import {
   getUserGrant
-} from "./cli-q34a0e10.js";
+} from "./cli-8v0g1yc8.js";
 import {
   can,
   clearAuditSink,
@@ -225,12 +227,12 @@ import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-ygbjp3z8.js";
+} from "./cli-54wwve05.js";
 import {
   collectScriptReferences,
   getApp,
   listAppRecords
-} from "./cli-gzky0gkr.js";
+} from "./cli-de14znh8.js";
 import {
   require_dist
 } from "./cli-qgm2pfpq.js";
@@ -238,7 +240,7 @@ import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-bxdhw615.js";
+} from "./cli-12fz972k.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   createResumeFollowUp,
@@ -253,7 +255,7 @@ import {
   touchRuntimeInstance,
   upsertRuntimeInstance,
   upsertSwarmConfigWithPolicyMirror
-} from "./cli-1fj0chdk.js";
+} from "./cli-f7dsy61y.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-07jd68a1.js";
@@ -276,7 +278,7 @@ import {
   startWorkflowExecution,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-123q2get.js";
+} from "./cli-yz3djrm0.js";
 import"./cli-1ebpar1q.js";
 import {
   deriveCodexKeySuffix,
@@ -361,11 +363,11 @@ import {
   upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-rs6ec3b9.js";
+} from "./cli-3tgwnf43.js";
 import"./cli-epan13p1.js";
 import {
   searchScripts
-} from "./cli-a0g1gbt5.js";
+} from "./cli-hbv0kq6w.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -373,7 +375,7 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-s2f20r5w.js";
+} from "./cli-1th1728g.js";
 import {
   detachedProcessGroup,
   forceTerminateProcessGroup,
@@ -384,7 +386,7 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-fs1kkqgr.js";
+import"./cli-m9sxbkhm.js";
 import {
   acquireOAuthRefreshLock,
   buildAuthorizationUrl,
@@ -408,19 +410,20 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-wvp6bvy4.js";
+} from "./cli-zhjmqxzh.js";
 import"./cli-fad8m16k.js";
 import"./cli-aehm1rbq.js";
 import"./cli-bsakbbkm.js";
+import"./cli-51tf7ac3.js";
 import {
-  getFileStorageProvider
-} from "./cli-n1q8q14d.js";
+  MAX_TASK_ATTACHMENT_BYTES,
+  recordTaskAttachmentUpload
+} from "./cli-mmemxxdc.js";
 import {
   FilesError,
+  getFileStorageProvider,
   normalizeFilesError
-} from "./cli-fhsz3twr.js";
-import"./cli-51tf7ac3.js";
-import"./cli-jnf5zghe.js";
+} from "./cli-jsp14b6c.js";
 import {
   findUserById,
   fingerprintApiKey,
@@ -428,18 +431,20 @@ import {
   linkIdentity,
   listUserEvents,
   listUserTokens,
+  mintSessionToken,
   mintToken,
   recordIdentityEvent,
   recordUnmappedIdentity,
   renderIdentity,
   resolveIdentity,
   resolveUserByToken,
+  revokeSessionToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-z96t0thj.js";
+} from "./cli-p1d5b073.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-axs8e6d4.js";
+} from "./cli-53s590z8.js";
 import {
   ensure,
   getSlackApp,
@@ -455,8 +460,9 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-jmb7g47h.js";
+} from "./cli-b5bq9crk.js";
 import"./cli-q51yprfq.js";
+import"./cli-9d8ntetj.js";
 import"./cli-yatxqynm.js";
 import {
   ActiveSessionSchema,
@@ -496,6 +502,7 @@ import {
   EventSourceSchema,
   EventStatusSchema,
   FavoriteItemTypeSchema,
+  HeartbeatExpiryError,
   InboxItemStateSchema,
   InboxItemStatusSchema,
   InboxItemTypeSchema,
@@ -526,7 +533,7 @@ import {
   PromptTemplateSchema,
   ProviderNameSchema,
   ReasoningEffortSchema,
-  RepoGuidelinesSchema,
+  RepoGuidelinesInputSchema,
   RepoHooksSchema,
   ResumeReasonSchema,
   RuntimeInstanceSchema,
@@ -565,6 +572,7 @@ import {
   UserCommsPrefsSchema,
   UserFavoriteSchema,
   UserSchema,
+  VersionableFieldSchema,
   WorkflowDefinitionSchema,
   WorkflowEdgeSchema,
   WorkflowNodePatchSchema,
@@ -748,6 +756,7 @@ import {
   init_date_utils,
   init_db,
   init_default_drift,
+  init_heartbeat_expiry,
   init_request_auth_context,
   init_steering,
   init_swarm_config_guard,
@@ -756,7 +765,6 @@ import {
   init_types,
   insertActiveSession,
   insertPricingRow,
-  insertTaskAttachment,
   installMcpServer,
   installSkill,
   isReservedConfigKey,
@@ -853,12 +861,12 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-f567d5c1.js";
+} from "./cli-ftht3zzj.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-kpev657q.js";
+} from "./cli-y6b6fb76.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -869,7 +877,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-kpv03zhj.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -898,7 +906,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-dc9k2ba9.js";
+} from "./cli-w9kb3bk1.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -2252,6 +2260,7 @@ var SDK_TOOL_NAME_MAP = {
   task_list: "get-tasks",
   task_get: "get-task-details",
   task_storeProgress: "store-progress",
+  task_defer: "defer-task",
   task_poll: "poll-task",
   task_send: "send-task",
   task_cancel: "cancel-task",
@@ -3447,6 +3456,7 @@ init_db();
 init_telemetry();
 init_types();
 init_constants();
+init_heartbeat_expiry();
 init_identity_field_budget();
 init_secret_scrubber();
 function singleHeaderValue(req, name) {
@@ -3707,6 +3717,7 @@ var listAgentRuntimeInstances = route({
     404: { description: "Agent not found" }
   }
 });
+var ContentHashSchema = exports_external.string().regex(/^[0-9a-f]{64}$/, "sha256 hex");
 var ProfileSyncRejectionSchema = exports_external.object({
   field: exports_external.enum(["soulMd", "identityMd", "claudeMd", "toolsMd"]),
   diskSize: exports_external.number().int(),
@@ -3735,7 +3746,8 @@ var updateAgentProfileRoute = route({
     avatar: AgentAvatarSchema.nullable().optional(),
     changeSource: exports_external.string().optional(),
     changedByAgentId: exports_external.string().optional(),
-    changeReason: exports_external.string().optional()
+    changeReason: exports_external.string().optional(),
+    expectedHashes: exports_external.partialRecord(VersionableFieldSchema, ContentHashSchema).optional()
   }),
   responses: {
     200: { description: "Profile updated", schema: AgentWithCapacitySchema },
@@ -4022,6 +4034,7 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
       changedByAgentId: body.changedByAgentId ?? null,
       changeReason: body.changeReason ?? null
     } : undefined;
+    const conflicts = [];
     let agent;
     try {
       agent = await updateAgentProfile(parsed.params.id, {
@@ -4035,8 +4048,15 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
         toolsMd: body.toolsMd,
         heartbeatMd: body.heartbeatMd,
         ...body.avatar !== undefined ? { avatar: body.avatar } : {}
-      }, versionMeta);
+      }, versionMeta, {
+        expectedHashes: body.expectedHashes,
+        onConflict: (conflict) => conflicts.push(conflict)
+      });
     } catch (error) {
+      if (error instanceof HeartbeatExpiryError) {
+        jsonError(res, error.message, 400);
+        return true;
+      }
       if (error instanceof IdentityFieldBudgetError) {
         if (versionMeta?.changeSource === "self_edit" || versionMeta?.changeSource === "session_sync") {
           try {
@@ -4070,10 +4090,25 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
       jsonError(res, "Agent not found", 404);
       return true;
     }
+    for (const conflict of conflicts) {
+      try {
+        await createEvent({
+          category: "system",
+          event: "system.profile_sync_conflict",
+          status: "skipped",
+          source: "api",
+          agentId: parsed.params.id,
+          data: { ...conflict, changeSource: versionMeta?.changeSource ?? null }
+        });
+      } catch (eventError) {
+        const message = eventError instanceof Error ? eventError.message : String(eventError);
+        console.error(scrubSecrets(`[profile-sync] Failed to persist conflict event: ${message}`));
+      }
+    }
     if (versionMeta?.changeSource === "self_edit" || versionMeta?.changeSource === "session_sync") {
       try {
         for (const field of Object.keys(IDENTITY_FIELD_BUDGETS)) {
-          if (body[field] === undefined)
+          if (body[field] === undefined || conflicts.some((c) => c.field === field))
             continue;
           await createEvent({
             category: "system",
@@ -6463,7 +6498,6 @@ async function handleFavorites(req, res, pathSegments, queryParams, myAgentId) {
 // src/http/fs.ts
 init_zod();
 init_db();
-import { createHash as createHash2 } from "node:crypto";
 init_types();
 
 // src/utils/content-disposition.ts
@@ -6477,7 +6511,6 @@ function attachmentContentDisposition(filename) {
 // src/http/fs.ts
 init_request_auth_context();
 init_secret_scrubber();
-var MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
 var SLOW_UPLOAD_LOG_MS = 3000;
 var taskParams = exports_external.object({ taskId: exports_external.uuid() });
 var attachmentParams = exports_external.object({ taskId: exports_external.uuid(), attachmentId: exports_external.uuid() });
@@ -6732,7 +6765,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
     return sendDelete(res, attachment);
   }
   if (uploadTaskFileRoute.match(req.method, pathSegments)) {
-    if (enforceContentLengthCap(req, res, MAX_UPLOAD_BYTES) === BODY_TOO_LARGE)
+    if (enforceContentLengthCap(req, res, MAX_TASK_ATTACHMENT_BYTES) === BODY_TOO_LARGE)
       return true;
     const parsed = await uploadTaskFileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -6766,9 +6799,9 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
   return false;
 }
 async function sendUpload(req, res, taskId, query, agentId) {
-  const body = await readRawBody(req, MAX_UPLOAD_BYTES);
+  const body = await readRawBody(req, MAX_TASK_ATTACHMENT_BYTES);
   if (body === BODY_TOO_LARGE) {
-    jsonError(res, `Payload too large (max ${MAX_UPLOAD_BYTES} bytes)`, 413);
+    jsonError(res, `Payload too large (max ${MAX_TASK_ATTACHMENT_BYTES} bytes)`, 413);
     return true;
   }
   const provider = getFileStorageProvider();
@@ -6792,38 +6825,21 @@ async function sendUpload(req, res, taskId, query, agentId) {
     }
     return sendProviderError(res, error);
   }
-  try {
-    const auth = getCurrentRequestAuth();
-    const attachment = await insertTaskAttachment({
-      taskId,
-      agentId,
-      name: query.name,
-      kind: provider.id === "agent-fs" ? "agent-fs" : "shared-fs",
-      path: uploaded.key,
-      providerId: provider.id,
-      providerKey: uploaded.key,
-      capabilities: {
-        ...provider.capabilities,
-        version: uploaded.version,
-        etag: uploaded.etag
-      },
-      mimeType: uploaded.contentType ?? contentType,
-      sizeBytes: uploaded.sizeBytes ?? body.byteLength,
-      sha256: uploaded.sha256 ?? createHash2("sha256").update(body).digest("hex"),
-      intent: query.intent,
-      description: query.description,
-      isPrimary: query.isPrimary === "true",
-      createdBy: auth?.kind === "user" ? auth.userId : undefined
-    });
-    uploadTaskFileRoute.respond(res, 201, attachment);
-  } catch (error) {
-    try {
-      await provider.delete(scope);
-    } catch (cleanupError) {
-      console.warn(scrubSecrets(`[fs] upload metadata insert failed and blob cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`));
-    }
-    throw error;
-  }
+  const auth = getCurrentRequestAuth();
+  const attachment = await recordTaskAttachmentUpload({
+    provider,
+    scope,
+    uploaded,
+    sizeBytes: body.byteLength,
+    sha256: uploaded.sha256 ?? new Bun.CryptoHasher("sha256").update(body).digest("hex"),
+    contentType,
+    agentId,
+    intent: query.intent,
+    description: query.description,
+    isPrimary: query.isPrimary === "true",
+    createdBy: auth?.kind === "user" ? auth.userId : undefined
+  });
+  uploadTaskFileRoute.respond(res, 201, attachment);
   return true;
 }
 async function sendDownload(res, attachment) {
@@ -8961,6 +8977,7 @@ class StreamableHTTPServerTransport {
 
 // src/http/mcp.ts
 init_db();
+init_request_auth_context();
 var DEFAULT_MCP_TRANSPORT_IDLE_TIMEOUT_MS = 2 * 60 * 60 * 1000;
 function markMcpTransportActivity(sessionActivity, sessionId, now = Date.now()) {
   if (sessionId) {
@@ -8997,6 +9014,25 @@ function unauthorized(res, message = "Unauthorized") {
   res.end(JSON.stringify({ error: message }));
   return true;
 }
+function forbidden2(res, message) {
+  res.writeHead(403, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: message }));
+  return true;
+}
+function validateAgentTokenIdentity(req, res) {
+  const auth = getRequestAuth(req);
+  if (!auth || auth.kind !== "agent")
+    return;
+  const agentId = headerValue(req.headers["x-agent-id"]);
+  const taskId = headerValue(req.headers["x-source-task-id"]);
+  if (!agentId || agentId !== auth.agentId) {
+    return forbidden2(res, "X-Agent-ID does not match session token");
+  }
+  if (!taskId || taskId !== auth.taskId) {
+    return forbidden2(res, "X-Source-Task-Id does not match session token");
+  }
+  return;
+}
 function headerValue(value) {
   return Array.isArray(value) ? value[0] : value;
 }
@@ -9028,6 +9064,9 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
   if (req.url !== "/mcp") {
     return false;
   }
+  const tokenIdentityMismatch = validateAgentTokenIdentity(req, res);
+  if (tokenIdentityMismatch)
+    return true;
   const agentMismatch = validateBoundAgent(req, res, sessionId, sessionAgents);
   if (agentMismatch)
     return true;
@@ -13222,9 +13261,11 @@ var getPageVersionRoute = route({
 function applyLaunchCors(req, res) {
   const origin = req.headers.origin ?? "";
   if (origin) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
     res.setHeader("Vary", "Origin");
-    res.setHeader("Access-Control-Allow-Credentials", "true");
+    if (isOriginAllowedForCredentials(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+    }
   }
   res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type");
@@ -13568,13 +13609,13 @@ var publicPageRoute = route({
   method: "get",
   path: "/p/{id}",
   pattern: ["p", null],
-  summary: "Render a page (HTML inline; JSON redirects to SPA)",
+  summary: "Render a page (HTML/SVG inline; JSON redirects to SPA)",
   tags: ["Pages"],
   params: exports_external.object({ id: exports_external.string() }),
   responses: {
     200: {
-      description: "Rendered HTML page",
-      unstructured: "Serves the page's raw agent-authored HTML body (SDK-injected) or, for ?print=1 on a JSON-content page, a standalone printable HTML document — not a JSON shape"
+      description: "Rendered HTML page or raw SVG image",
+      unstructured: "Serves raw image/svg+xml bytes, the page's agent-authored HTML body (SDK-injected) or, for ?print=1 on a JSON-content page, a standalone printable HTML document — not a JSON shape"
     },
     302: { description: "Redirect to SPA for JSON content" },
     401: { description: "Page requires an authenticated session" },
@@ -13921,6 +13962,20 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
     await bumpViewCount(page.id);
     return true;
   }
+  if (page.contentType === "image/svg+xml") {
+    const headers3 = {
+      "Content-Type": "image/svg+xml",
+      "Cache-Control": page.authMode === "public" ? "public, max-age=1800" : "private, no-store",
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
+    };
+    if (inlineSetCookie)
+      headers3["Set-Cookie"] = inlineSetCookie;
+    res.writeHead(200, headers3);
+    res.end(page.body);
+    await bumpViewCount(page.id);
+    return true;
+  }
   const wantsPrint = queryParams.get("print") === "1";
   if (page.contentType === "application/json") {
     if (wantsPrint) {
@@ -14103,11 +14158,13 @@ var PollTriggerAttachmentSchema = TaskAttachmentSchema.pick({
   sizeBytes: true
 });
 var PollRequestedBySchema = UserSchema.pick({
+  id: true,
   name: true,
   email: true,
   role: true,
   notes: true
 }).extend({
+  id: exports_external.string().optional(),
   comms: UserCommsPrefsSchema.optional()
 });
 var PollTaskOfferedTriggerSchema = exports_external.object({
@@ -14174,6 +14231,7 @@ async function buildTriggerRequestedBy(task) {
   const user = task.requestedByUserId ? await getUserById(task.requestedByUserId) : undefined;
   if (user) {
     return {
+      id: user.id,
       name: user.name,
       email: user.email,
       role: user.role,
@@ -14499,13 +14557,13 @@ init_zod();
 init_db();
 init_types();
 init_secret_scrubber();
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function apiKeyFingerprint2(req) {
   const authHeader = req.headers.authorization;
   const providedKey = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
   if (!providedKey)
     return "";
-  const digest = createHash3("sha256").update(providedKey).digest("hex").slice(0, 8);
+  const digest = createHash2("sha256").update(providedKey).digest("hex").slice(0, 8);
   return scrubSecrets(digest);
 }
 var PricingTriplePathParams = exports_external.object({
@@ -15160,7 +15218,7 @@ var createRepo = route({
     defaultBranch: exports_external.string().optional(),
     autoClone: exports_external.boolean().optional(),
     hooks: RepoHooksSchema.optional(),
-    guidelines: RepoGuidelinesSchema.nullable().optional()
+    guidelines: RepoGuidelinesInputSchema.nullable().optional()
   }),
   responses: {
     201: { description: "Repo created", schema: SwarmRepoSchema },
@@ -15182,7 +15240,7 @@ var updateRepo = route({
     defaultBranch: exports_external.string().optional(),
     autoClone: exports_external.boolean().optional(),
     hooks: RepoHooksSchema.nullable().optional(),
-    guidelines: RepoGuidelinesSchema.nullable().optional()
+    guidelines: RepoGuidelinesInputSchema.nullable().optional()
   }),
   responses: {
     200: { description: "Repo updated", schema: SwarmRepoSchema },
@@ -20051,6 +20109,7 @@ init_zod();
 init_db();
 init_steering();
 init_types();
+init_request_auth_context();
 var AgentTaskSummarySchema = AgentTaskSchema.pick({
   id: true,
   key: true,
@@ -20090,6 +20149,50 @@ var TaskWithSteeringSchema = AgentTaskSchema.extend({
   isLeadTask: exports_external.boolean(),
   supportedSteerModes: exports_external.array(SteerModeSchema)
 });
+var MAX_SESSION_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+var mintSessionTokenRoute = route({
+  method: "post",
+  path: "/api/sessions/tokens",
+  pattern: ["api", "sessions", "tokens"],
+  summary: "Mint an ephemeral session token for an ACP provider session",
+  description: "Returns a short-lived aseph_ bearer for use by the ACP adapter in place of the full " + "operator key. The token expires at the requested TTL and is actively revoked when the " + "session ends. Only the operator key may mint session tokens.",
+  tags: ["Sessions"],
+  body: exports_external.object({
+    agentId: exports_external.string().min(1),
+    taskId: exports_external.string().min(1),
+    ttlMs: exports_external.number().int().positive().max(MAX_SESSION_TOKEN_TTL_MS)
+  }),
+  responses: {
+    200: {
+      description: "Minted token plaintext (returned once) and its stable token ID",
+      schema: exports_external.object({
+        tokenId: exports_external.string(),
+        plaintext: exports_external.string()
+      })
+    },
+    400: { description: "Validation error" },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true },
+  rbac: { ungated: "operator-only: minting is gated on the full operator key in auth middleware" }
+});
+var revokeSessionTokenRoute = route({
+  method: "delete",
+  path: "/api/sessions/tokens/{tokenId}",
+  pattern: ["api", "sessions", "tokens", null],
+  summary: "Revoke an ephemeral session token",
+  description: "Revokes an aseph_ bearer token by ID. No-op if already revoked.",
+  tags: ["Sessions"],
+  params: exports_external.object({ tokenId: exports_external.string() }),
+  responses: {
+    204: { description: "Token revoked (or was already revoked)" },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true },
+  rbac: {
+    ungated: "operator-only: revocation is gated on the full operator key in auth middleware"
+  }
+});
 var listSessions = route({
   method: "get",
   path: "/api/sessions",
@@ -20140,6 +20243,32 @@ var getSession = route({
   auth: { apiKey: true }
 });
 async function handleSessions(req, res, pathSegments, queryParams) {
+  if (mintSessionTokenRoute.match(req.method, pathSegments)) {
+    if (getRequestAuth(req)?.kind !== "operator") {
+      jsonError(res, "Unauthorized", 401);
+      return true;
+    }
+    const parsed = await mintSessionTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { agentId, taskId, ttlMs } = parsed.body;
+    const token = await mintSessionToken(agentId, taskId, ttlMs);
+    mintSessionTokenRoute.respond(res, 200, { tokenId: token.tokenId, plaintext: token.plaintext });
+    return true;
+  }
+  if (revokeSessionTokenRoute.match(req.method, pathSegments)) {
+    if (getRequestAuth(req)?.kind !== "operator") {
+      jsonError(res, "Unauthorized", 401);
+      return true;
+    }
+    const parsed = await revokeSessionTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    await revokeSessionToken(parsed.params.tokenId);
+    res.writeHead(204);
+    res.end();
+    return true;
+  }
   if (listSessions.match(req.method, pathSegments)) {
     const parsed = await listSessions.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -22144,7 +22273,9 @@ var listPausedTasks = route({
   responses: {
     200: {
       description: "Paused task list",
-      schema: exports_external.object({ tasks: exports_external.array(AgentTaskSchema) })
+      schema: exports_external.object({
+        tasks: exports_external.array(AgentTaskSchema.extend({ attachments: exports_external.array(TaskAttachmentSchema) }))
+      })
     }
   }
 });
@@ -22850,7 +22981,11 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     const pausedTasks = await getPausedTasksForAgent(myAgentId);
-    listPausedTasks.respond(res, 200, { tasks: pausedTasks });
+    const tasks = await Promise.all(pausedTasks.map(async (task) => ({
+      ...task,
+      attachments: await getTaskAttachments(task.id)
+    })));
+    listPausedTasks.respond(res, 200, { tasks });
     return true;
   }
   if (pauseTaskRoute.match(req.method, pathSegments)) {
@@ -26369,7 +26504,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-nqvf26za.js");
+    const { stopScheduler } = await import("./index-x5j894zf.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -26377,7 +26512,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-xs8fa55y.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-w733ax66.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -26437,21 +26572,22 @@ try {
   process.exitCode = 1;
   throw err;
 }
+warnIfCorsAllowsAnyOrigin();
 try {
   await seedLegacyCapabilitiesConfig();
 } catch (err) {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-t223sw91.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-g62hy1pk.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-e5jhzz4j.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-9nzsrgcq.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-p1mf40z3.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-r3hqjp09.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -26459,7 +26595,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-53zyht4z.js");
+  const { runAllSeeders } = await import("./index-tce1rss4.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -26500,36 +26636,36 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-nqvf26za.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-gay66b9w.js");
+    const { startScheduler } = await import("./index-x5j894zf.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-k8znfx0z.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-q3qja6ta.js");
+    const { startHeartbeat } = await import("./index-hssww7kj.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-xs8fa55y.js");
+    const { startOAuthKeepalive } = await import("./keepalive-w733ax66.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-03snsye5.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-wdetky26.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
-  import("./boot-reembed-072x00vn.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-az5rassp.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-65zz2smt.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-j3mm3rfz.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-yz0ams04.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-b6h54817.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {