@desplega.ai/agent-swarm 1.150.0 → 1.152.0

package/dist/cli-pf9q3696.js

@@ -0,0 +1,172 @@
+// src/prompts/memories.ts
+var SIMILARITY_THRESHOLD = 0.4;
+var RATE_TOOL_HINT = `
+
+When a memory above genuinely helps you solve this task — or actively
+misleads you — call \`memory_rate\` with the memory id and useful=true/false.
+This trains the swarm to surface better memories next time. Use sparingly:
+2-5 ratings per task is plenty.`;
+function renderMemoriesPrompt(memories) {
+  const useful = memories.filter((m) => m.similarity > SIMILARITY_THRESHOLD);
+  if (useful.length === 0)
+    return null;
+  const memoryContext = useful.map((m) => `- **${m.name}** (id: ${m.id}): ${m.content.substring(0, 300)}`).join(`
+`);
+  let prompt = `
+
+### Relevant Past Knowledge
+
+These memories from your previous sessions may be useful. Use \`memory-get\` with the memory ID to retrieve full details.
+
+${memoryContext}
+`;
+  if (isExplicitSelfRaterEnabled()) {
+    prompt += RATE_TOOL_HINT;
+  }
+  return prompt;
+}
+function isExplicitSelfRaterEnabled() {
+  const ratersEnabled = (process.env.MEMORY_RATERS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return ratersEnabled.includes("explicit-self");
+}
+
+// src/utils/skill-fs-writer.ts
+import { existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+var SWARM_MARKER_FILE = ".swarm-managed";
+function reconcileManagedSkillFiles(skillDir, currentRelativeFiles) {
+  if (!existsSync(join(skillDir, SWARM_MARKER_FILE)))
+    return 0;
+  let removed = 0;
+  const walk = (dir, relativeDir = "") => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+    let hasEntries = false;
+    for (const entry of entries) {
+      const relativePath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        const childHasEntries = walk(fullPath, relativePath);
+        if (!childHasEntries) {
+          try {
+            rmSync(fullPath, { recursive: true, force: true });
+          } catch {
+            hasEntries = true;
+          }
+        } else {
+          hasEntries = true;
+        }
+        continue;
+      }
+      if (relativePath === "SKILL.md" || relativePath === SWARM_MARKER_FILE || currentRelativeFiles.has(relativePath)) {
+        hasEntries = true;
+        continue;
+      }
+      try {
+        rmSync(fullPath, { force: true });
+        removed++;
+      } catch {
+        hasEntries = true;
+      }
+    }
+    return hasEntries;
+  };
+  walk(skillDir);
+  return removed;
+}
+function writeSkillsToFilesystem(entries, harnessType = "all", home) {
+  const errors = [];
+  let synced = 0;
+  let removed = 0;
+  const skillDirs = [];
+  if (harnessType === "claude" || harnessType === "all") {
+    skillDirs.push(join(home, ".claude", "skills"));
+  }
+  if (harnessType === "pi" || harnessType === "all") {
+    skillDirs.push(join(home, ".pi", "agent", "skills"));
+  }
+  if (harnessType === "codex" || harnessType === "all") {
+    skillDirs.push(join(home, ".codex", "skills"));
+  }
+  if (harnessType === "opencode" || harnessType === "all") {
+    skillDirs.push(join(home, ".opencode", "skills"));
+  }
+  if (harnessType === "agents" || harnessType === "all") {
+    skillDirs.push(join(home, ".agents", "skills"));
+  }
+  for (const dir of skillDirs) {
+    mkdirSync(dir, { recursive: true });
+  }
+  const writtenNames = new Set;
+  for (const skill of entries) {
+    if (!skill.isActive || !skill.isEnabled)
+      continue;
+    if (skill.isComplex && skill.files.length === 0)
+      continue;
+    if (!skill.content)
+      continue;
+    const safeName = skill.name.replace(/[^a-zA-Z0-9_-]/g, "_");
+    if (!safeName)
+      continue;
+    writtenNames.add(safeName);
+    const currentBundledFilePaths = new Set(skill.files.filter((file) => !file.isBinary).map((file) => file.path));
+    for (const baseDir of skillDirs) {
+      const skillDir = join(baseDir, safeName);
+      const skillFile = join(skillDir, "SKILL.md");
+      const markerFile = join(skillDir, SWARM_MARKER_FILE);
+      try {
+        mkdirSync(skillDir, { recursive: true });
+        removed += reconcileManagedSkillFiles(skillDir, currentBundledFilePaths);
+        writeFileSync(skillFile, skill.content, "utf-8");
+        writeFileSync(markerFile, "", "utf-8");
+        synced++;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        errors.push(`${skill.name} -> ${skillDir}: ${msg}`);
+        console.error(`[skill-fs-writer] Failed to write SKILL.md for ${skill.name} to ${skillDir}: ${msg}`);
+      }
+      for (const file of skill.files) {
+        if (file.isBinary) {
+          console.log(`[skill-fs-writer] Skipping binary skill file ${skill.name}/${file.path}`);
+          continue;
+        }
+        const targetPath = join(skillDir, file.path);
+        try {
+          mkdirSync(dirname(targetPath), { recursive: true });
+          writeFileSync(targetPath, file.content, "utf-8");
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : "Unknown error";
+          errors.push(`${skill.name}/${file.path} -> ${targetPath}: ${msg}`);
+          console.error(`[skill-fs-writer] Failed to write bundled file ${skill.name}/${file.path} to ${targetPath}: ${msg}`);
+        }
+      }
+    }
+  }
+  for (const baseDir of skillDirs) {
+    if (!existsSync(baseDir))
+      continue;
+    try {
+      const existing = readdirSync(baseDir, { withFileTypes: true });
+      for (const entry of existing) {
+        if (!entry.isDirectory())
+          continue;
+        if (writtenNames.has(entry.name))
+          continue;
+        const skillDir = join(baseDir, entry.name);
+        if (!existsSync(join(skillDir, SWARM_MARKER_FILE)))
+          continue;
+        try {
+          rmSync(skillDir, { recursive: true, force: true });
+          removed++;
+        } catch {}
+      }
+    } catch {}
+  }
+  return { synced, removed, errors };
+}
+
+export { SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };

package/dist/{cli-7fesa1ky.js → cli-pgj4a5fb.js}

@@ -2,7 +2,7 @@ import {
   init_resolver,
   init_session_templates,
   resolveTemplateAsync
-} from "./cli-n75jt793.js";
+} from "./cli-z61ykvam.js";
 
 // src/prompts/steering-delivery.ts
 init_session_templates();

package/dist/{cli-07jd68a1.js → cli-re8z5p8p.js}

@@ -6,7 +6,7 @@ import {
 // src/utils/multi-runtime.ts
 init_env_flag();
 function isMultiRuntimeEnabled(env = process.env) {
-  return parseEnvFlag(env.MULTI_RUNTIME_ENABLED, false);
+  return parseEnvFlag(env.MULTI_RUNTIME_ENABLED, true);
 }
 function swarmRuntimeInstanceId(env = process.env) {
   return env.SWARM_RUNTIME_INSTANCE_ID || undefined;

package/dist/{cli-ryz8q8p1.js → cli-t1mykkng.js}

@@ -1,27 +1,22 @@
-import {
-  checkOpencodeCredentials
-} from "./cli-5my3bjsd.js";
 import {
   renderSteeringDelivery
-} from "./cli-7fesa1ky.js";
-import {
-  checkCodexCredentials,
-  codexUserHome
-} from "./cli-taym3dmg.js";
+} from "./cli-pgj4a5fb.js";
 import {
   checkClaudeManagedCredentials
-} from "./cli-wk0gjrn3.js";
+} from "./cli-kj76p1ez.js";
 import {
   checkDevinCredentials
 } from "./cli-9b13ggd1.js";
 import {
-  renderMemoriesPrompt,
-  resolveScriptsOnlyMode,
-  writeSkillsToFilesystem
-} from "./cli-3mh119qv.js";
+  checkOpencodeCredentials
+} from "./cli-d3p82erb.js";
 import {
   checkClaudeCredentials
-} from "./cli-zthatyrx.js";
+} from "./cli-8fy9dmpv.js";
+import {
+  checkCodexCredentials,
+  codexUserHome
+} from "./cli-87hdfyde.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -33,8 +28,13 @@ import {
   getContextWindowSize
 } from "./cli-s25avqg9.js";
 import {
+  renderMemoriesPrompt,
+  writeSkillsToFilesystem
+} from "./cli-pf9q3696.js";
+import {
+  resolveScriptsOnlyMode,
   validateJsonSchema
-} from "./cli-rnsr8asm.js";
+} from "./cli-72vksk1n.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
@@ -49,6 +49,16 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import {
+  ensure,
+  initOtel,
+  initialize,
+  injectTraceContext,
+  isPollTracingEnabled,
+  startSpan,
+  withSpan,
+  withSpanContext
+} from "./cli-cwvey7n1.js";
 import {
   buildContextPreamble,
   buildResumeContextPreamble,
@@ -61,17 +71,7 @@ import {
   syncProfileFilesToServer,
   writeIdentityBaselines,
   writeProfileFileFromDb
-} from "./cli-a45d5v9b.js";
-import {
-  ensure,
-  initOtel,
-  initialize,
-  injectTraceContext,
-  isPollTracingEnabled,
-  startSpan,
-  withSpan,
-  withSpanContext
-} from "./cli-kt7wevqh.js";
+} from "./cli-fm4ytsdk.js";
 import {
   init_task_attachment_links,
   taskAttachmentFetchCommand
@@ -83,11 +83,7 @@ import {
   init_types,
   resolveTaskModelSelection,
   telemetry
-} from "./cli-qp69dd5d.js";
-import {
-  init_credentials,
-  resolveCredentialPools
-} from "./cli-c2mk1kgf.js";
+} from "./cli-gacq5hg8.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -97,7 +93,7 @@ import {
   init_base_prompt,
   init_defaults,
   init_templates
-} from "./cli-hmyynq9b.js";
+} from "./cli-ht5rs63n.js";
 import {
   configureHttpResolver,
   init_resolver,
@@ -106,11 +102,15 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplateAsync
-} from "./cli-n75jt793.js";
+} from "./cli-z61ykvam.js";
 import {
   getMcpBaseUrl,
   init_constants
 } from "./cli-dv6cdjs2.js";
+import {
+  init_credentials,
+  resolveCredentialPools
+} from "./cli-c2mk1kgf.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -151,19 +151,19 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-cjegjbje.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-h58xqzzd.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-4s2bbkgq.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-jcqt71cg.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-rn3aq7jm.js");
+      const { CodexAdapter } = await import("./codex-adapter-v3cz462q.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
-      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-p3ts5m9m.js");
+      const { ClaudeManagedAdapter } = await import("./claude-managed-adapter-dsmkcrjy.js");
       return new ClaudeManagedAdapter;
     }
     case "devin": {
@@ -171,11 +171,11 @@ async function createProviderAdapter(provider) {
       return new DevinAdapter;
     }
     case "opencode": {
-      const { OpencodeAdapter } = await import("./opencode-adapter-dce4wskd.js");
+      const { OpencodeAdapter } = await import("./opencode-adapter-28axqa09.js");
       return new OpencodeAdapter;
     }
     case "acp": {
-      const { ACPAdapter } = await import("./acp-adapter-d5mzggyk.js");
+      const { ACPAdapter } = await import("./acp-adapter-d05sg0q4.js");
       return new ACPAdapter;
     }
     default:
@@ -588,7 +588,7 @@ var CREDENTIAL_PROVIDER_CHECKERS = {
   devin: (env) => checkDevinCredentials(env),
   opencode: (env, opts) => checkOpencodeCredentials(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-4s2bbkgq.js");
+    const { checkPiMonoCredentials } = await import("./pi-mono-adapter-jcqt71cg.js");
     return checkPiMonoCredentials(env, opts);
   },
   acp: () => ({ ready: true, missing: [], satisfiedBy: "sdk-delegated" })

package/dist/{cli-ck1vqzdj.js → cli-t6axtdcg.js}

@@ -1,13 +1,18 @@
 import {
   PermissionVerbSchema
-} from "./cli-cmp8g3sw.js";
+} from "./cli-zfzznn7c.js";
 import {
   getDb,
   getDbClient,
   init_db
-} from "./cli-qp69dd5d.js";
+} from "./cli-gacq5hg8.js";
+import {
+  init_env_flag,
+  isEnvFlagEnabled
+} from "./cli-ej6gbxfb.js";
 
 // src/be/rbac-roles.ts
+init_env_flag();
 init_db();
 var DEFAULT_ROLE_ID = "rbac-role-admin";
 var BUILTIN_ROLES = [
@@ -217,8 +222,8 @@ function ensureRbacSeedsSynced(opts) {
 function describeRbacFlag() {
   const raw = process.env.RBAC_ENABLED;
   if (raw === undefined)
-    return "unset (off)";
-  return `${raw} (${raw === "true" ? "on" : "off"})`;
+    return "unset (on)";
+  return `${raw} (${isEnvFlagEnabled("RBAC_ENABLED", true) ? "on" : "off"})`;
 }
 function printRolesTable(rows) {
   const tableRows = rows.map((row) => [

package/dist/{cli-1mx65de9.js → cli-wbyk465z.js}

@@ -13,7 +13,7 @@ import {
   parseClaudeMdPendingRecord,
   planClaudeMdSync,
   withFileLock
-} from "./cli-a45d5v9b.js";
+} from "./cli-fm4ytsdk.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-kyysm7m3.js → cli-wp7cejrg.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-gm0fhz13.js";
+} from "./cli-jh9txj4n.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-n75jt793.js → cli-z61ykvam.js}

@@ -8,7 +8,7 @@ import {
 
 // src/utils/steering-enabled.ts
 function isSteeringEnabled(env = process.env) {
-  return parseEnvFlag(env.STEERING_ENABLED, false);
+  return parseEnvFlag(env.STEERING_ENABLED, true);
 }
 var init_steering_enabled = __esm(() => {
   init_env_flag();
@@ -272,7 +272,8 @@ Complete with \`store-progress\`: status \`completed\`, and \`output\` naming th
 Free-text \`output\`: under 120 words by default, with the exceptions in How you write. Link documents instead of inlining them; omit process narration.
 For a task with \`outputSchema\`, return matching JSON in \`output\`.
 When you are blocked after real effort, store the blocker with \`store-progress\` and keep working on what you can.
-The task has four endings. When you are done: \`completed\`. When the answer needs time (a build, a deploy, a reply): \`defer-task\` with a summary of what you did, when to wake up, and what to check. It completes the task now; the wake-up task continues it. When a person must decide: \`request-human-input\`. When nothing else is possible: \`failed\` with the blocker.
+The task has four endings. When you are done: \`completed\`. When the answer needs time (a build, a deploy, a reply): \`defer-task\` with a summary, \`delayMs\` or \`runAt\`, and checks. It completes the task now; the wake-up task continues it. When a person must decide: \`request-human-input\`. When nothing else is possible: \`failed\` with the blocker.
+For task waits, add \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\`; the displayed time is a ceiling, not a fixed wake-up.
 `,
     variables: [],
     category: "system"
@@ -292,9 +293,9 @@ Delegate by the shape of the work: a workflow for multi-step or fan-out work, a
 Research or exploration: tell the worker to use the \`researching\` skill. A large feature: a task for the \`planning\` skill first, then a task for the \`implementing\` skill with \`parentTaskId\`. A small fix: direct implementation.
 A follow-up that continues earlier work carries \`parentTaskId\`. The worker receives the prior context.
 
-Worker completion/failure triggers a follow-up by default. For longer work, \`defer-task\` with a wake-up or complete this task. Review the worker's answer and complete the follow-up. Escalate only failures needing a person.
+Worker completion/failure triggers a follow-up by default; review the result and complete it. Escalate only failures needing a person. For longer task waits, complete this task or \`defer-task\` with \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\` alongside \`delayMs\` or \`runAt\`. The displayed time is a ceiling, not a fixed wake-up.
 
-Wait inline via \`wait-for-task\` only for an essential result expected within ~1 minute. Set \`send-task.followUpConfig.disabled=true\`; cap all waits at ~1 minute total. If still running, \`defer-task\` with a wake-up.
+For an essential result expected within ~1 minute, set \`send-task.followUpConfig.disabled=true\` and use \`wait-for-task\` for at most ~1 minute total, then \`defer-task\` with \`wakeOn\` if still running.
 
 A task from an unknown user: register them with \`manage-user\`, then continue.
 Your heartbeat runbook is the \`heartbeatMd\` profile field. Edit it with \`update-profile\`. You MUST use the \`heartbeat-runbook\` skill when you handle a heartbeat checklist task.
@@ -537,7 +538,7 @@ The script authoring contract in the \`swarm-scripts\` skill (entry signature, \
 
 **Built-in coordination scripts, USE THESE FIRST (\`script-run\` with \`name\` + \`args\`):**
 - \`delegate\` {agentName, task, routingReason, routingNote, parentTaskId?} → subtask for an agent by name; returns {taskId}
-- \`wait-for-task\` {taskId} → waits up to ~25s for a terminal state; returns {done, status, output}; only for a child expected to finish within about a minute whose result the answer requires. Bound all calls to about a minute total; if still done=false, use \`defer-task\` with a wake-up to collect the result.
+- \`wait-for-task\` {taskId} → waits up to ~25s for a terminal state; returns {done, status, output}; only for a child expected to finish within about a minute whose result the answer requires. Bound all calls to about a minute total; if still done=false, use \`defer-task\` with \`wakeOn:{event:"settled",taskIds:["<id>"],mode:"all"}\` alongside \`delayMs\` or \`runAt\`. The displayed time is a ceiling; matching task outcomes wake you sooner.
 - \`get-child-outputs\` {parentTaskId} → all children with status+output
 - \`complete-task\` {taskId, output} → THE way to finish your assigned task
 - \`report-progress\` {taskId, note} → progress update

package/dist/{cli-ceb5y160.js → cli-zdcdh02m.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-qp69dd5d.js";
+} from "./cli-gacq5hg8.js";
 
 // src/be/seed-pricing.ts
 init_db();

package/dist/{cli-cmp8g3sw.js → cli-zfzznn7c.js}

@@ -9,6 +9,18 @@ import {
   _enum
 } from "./cli-w5e1d1vv.js";
 
+// src/rbac/elevated-agents.ts
+var leadEquivalentAgentIds = new Set;
+function grantLeadEquivalence(agentId) {
+  leadEquivalentAgentIds.add(agentId);
+}
+function revokeLeadEquivalence(agentId) {
+  leadEquivalentAgentIds.delete(agentId);
+}
+function hasLeadEquivalence(agentId) {
+  return !!agentId && leadEquivalentAgentIds.has(agentId);
+}
+
 // src/rbac/permissions.ts
 init_zod();
 var PERMISSIONS = {
@@ -251,6 +263,14 @@ var PERMISSIONS = {
   "script.api.delete": {
     description: "Delete an external script API endpoint.",
     namespace: "script"
+  },
+  "extension.write": {
+    description: "Install, update, or uninstall a swarm extension.",
+    namespace: "extension"
+  },
+  "extension.activate": {
+    description: "Enable, disable, or activate a version of a swarm extension.",
+    namespace: "extension"
   }
 };
 var PERMISSION_VERBS = Object.keys(PERMISSIONS);
@@ -259,7 +279,7 @@ var PermissionVerbSchema = _enum(PERMISSION_VERBS);
 // src/rbac/admission.ts
 init_env_flag();
 function isRbacEnabled() {
-  return isEnvFlagEnabled("RBAC_ENABLED", false);
+  return isEnvFlagEnabled("RBAC_ENABLED", true);
 }
 function decideAdmission(input) {
   if (input.grant.grantsAll) {
@@ -295,10 +315,24 @@ function decideToolAdmission(input) {
   return { allow: false, reason: "admission: tool has no permission verb (operator-only)" };
 }
 // src/rbac/legacy-policy.ts
+init_env_flag();
+function actsAsLead(principal) {
+  return principal.kind === "agent" && (principal.isLead || hasLeadEquivalence(principal.agentId));
+}
 var leadOnly = {
   name: "lead-only",
   denyReason: "requires lead agent",
-  evaluate: (principal) => principal.kind === "agent" && principal.isLead
+  evaluate: (principal) => actsAsLead(principal)
+};
+var leadOrOperatorOrUser = {
+  name: "lead-or-operator-or-user",
+  denyReason: "requires lead agent, operator, or user authentication",
+  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal)
+};
+var extensionActivation = {
+  name: "extension-activation",
+  denyReason: "requires operator/user authentication, or a lead with EXTENSION_ALLOW_LEAD_ACTIVATION enabled",
+  evaluate: (principal) => principal.kind === "operator" || principal.kind === "user" || actsAsLead(principal) && isEnvFlagEnabled("EXTENSION_ALLOW_LEAD_ACTIVATION", true)
 };
 var leadOrTaskCreator = {
   name: "lead-or-task-creator",
@@ -306,7 +340,7 @@ var leadOrTaskCreator = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return resource?.kind === "task" && resource.creatorAgentId != null && resource.creatorAgentId === principal.agentId;
   }
@@ -317,7 +351,7 @@ var leadOrResourceOwner = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return resource?.kind === "owned" && resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId;
   }
@@ -328,7 +362,7 @@ var leadOrOwnNamespace = {
   evaluate: (principal, resource) => {
     if (principal.kind !== "agent")
       return false;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     return principal.agentId !== "" && resource?.kind === "kv-namespace" && resource.namespace === `task:agent:${principal.agentId}`;
   }
@@ -355,7 +389,7 @@ var memoryOwnerOrLeadSwarm = {
       return false;
     if (resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId)
       return true;
-    return principal.isLead && resource.scope === "swarm";
+    return actsAsLead(principal) && resource.scope === "swarm";
   }
 };
 var taskFsMutate = {
@@ -364,7 +398,7 @@ var taskFsMutate = {
   evaluate: (principal, resource) => {
     if (principal.kind === "operator" || principal.kind === "user")
       return true;
-    if (principal.isLead)
+    if (actsAsLead(principal))
       return true;
     if (resource?.kind !== "task")
       return false;
@@ -431,7 +465,9 @@ var LEGACY_POLICY = {
   "script.api.create": leadOnly,
   "script.api.update": leadOnly,
   "script.api.rotate": leadOnly,
-  "script.api.delete": leadOnly
+  "script.api.delete": leadOnly,
+  "extension.write": leadOrOperatorOrUser,
+  "extension.activate": extensionActivation
 };
 
 // src/rbac/can.ts
@@ -452,4 +488,4 @@ function can(check) {
   }
   return decision;
 }
-export { isRbacEnabled, decideAdmission, decideToolAdmission, setAuditSink, clearAuditSink, can, PermissionVerbSchema };
+export { isRbacEnabled, decideAdmission, decideToolAdmission, grantLeadEquivalence, revokeLeadEquivalence, setAuditSink, clearAuditSink, can, PermissionVerbSchema };