@desplega.ai/agent-swarm 1.151.0 → 1.152.1

package/dist/{http-ecsar8ez.js → http-pppxg5vr.js}

@@ -31,12 +31,12 @@ import {
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript,
   typecheckWithAmbient
-} from "./cli-5jd2z7av.js";
+} from "./cli-ks8a1cgq.js";
 import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-9004vfdf.js";
+} from "./cli-y8tayczk.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -285,7 +285,7 @@ import {
   verifyWebhookSignature,
   warnIfCorsAllowsAnyOrigin,
   wireHttpSpanLifecycle
-} from "./cli-5tpgq60f.js";
+} from "./cli-72tgtzr1.js";
 import"./cli-0z2v4nhw.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -302,17 +302,17 @@ import {
 import"./cli-3dpj7atn.js";
 import {
   getModelsCatalog
-} from "./cli-g69fdc9g.js";
+} from "./cli-kf8qp2vf.js";
 import {
   getUserGrant
-} from "./cli-7tgcstn2.js";
+} from "./cli-jytf5mw9.js";
 import {
   can,
   clearAuditSink,
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-gbfwcd3k.js";
+} from "./cli-zfzznn7c.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -395,7 +395,7 @@ import {
   upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-sjaae6ff.js";
+} from "./cli-dsyg66vt.js";
 import"./cli-epan13p1.js";
 import {
   detachedProcessGroup,
@@ -431,14 +431,14 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-j9xczhaq.js";
+} from "./cli-vbk025fm.js";
 import {
   normalizeModelKey
-} from "./cli-0qb1z6s2.js";
+} from "./cli-7bwaerjt.js";
 import"./cli-bsakbbkm.js";
 import {
   searchScripts
-} from "./cli-q88st9aj.js";
+} from "./cli-gxf2ebyz.js";
 import"./cli-51tf7ac3.js";
 import {
   ensure,
@@ -455,7 +455,7 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-r2q6pevn.js";
+} from "./cli-wfve107r.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
 import {
@@ -465,7 +465,7 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-ppm4975n.js";
+} from "./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
@@ -605,6 +605,7 @@ import {
   backfillSupersedeTaskResumeTaskId,
   cancelTask,
   checkoutPromptTemplate,
+  claimKv,
   claimMentions,
   claimOfferedTask,
   claimTask,
@@ -842,6 +843,7 @@ import {
   splitLegacyModelAlias,
   startTask,
   supersedeTask,
+  sweepExpiredKv,
   telemetry,
   uninstallMcpServer,
   uninstallSkill,
@@ -882,7 +884,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-s14agm5s.js";
+} from "./cli-bdt7w021.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
@@ -928,7 +930,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-zkxymas5.js";
+} from "./cli-gfez0qmk.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -7029,7 +7031,7 @@ var enableRoute = route({
   pattern: ["api", "extensions", null, "enable"],
   operationId: "extensions_enable",
   summary: "Enable an extension",
-  description: "Loads and enables an extension. This route is operator-only.",
+  description: "Loads and enables an extension. Available to leads, operators, and dashboard users.",
   tags: ["Extensions"],
   params: idParamsSchema,
   responses: {
@@ -7046,7 +7048,7 @@ var disableRoute = route({
   pattern: ["api", "extensions", null, "disable"],
   operationId: "extensions_disable",
   summary: "Disable an extension",
-  description: "Unloads and disables an extension. This route is operator-only.",
+  description: "Unloads and disables an extension. Available to leads, operators, and dashboard users.",
   tags: ["Extensions"],
   params: idParamsSchema,
   responses: {
@@ -7062,7 +7064,7 @@ var activateVersionRoute = route({
   pattern: ["api", "extensions", null, "activate-version"],
   operationId: "extensions_activate_version",
   summary: "Activate an extension version",
-  description: "Activates a stored version. This route is operator-only.",
+  description: "Activates a stored version. Available to leads, operators, and dashboard users.",
   tags: ["Extensions"],
   params: idParamsSchema,
   body: exports_external.object({ version: exports_external.number().int().min(1) }).strict(),
@@ -7290,7 +7292,8 @@ async function handleExtensions(req, res, pathSegments, queryParams, agentId) {
     const writerAgentId = principal.kind === "agent" ? principal.agentId : undefined;
     try {
       const extension = await enableExtension(parsed.params.id, {
-        by: await resolveHttpAuditUserId(req, writerAgentId)
+        by: await resolveHttpAuditUserId(req, writerAgentId),
+        agentId: writerAgentId
       });
       enableRoute.respond(res, 200, { extension: redactExtension(extension) });
     } catch (error) {
@@ -7308,7 +7311,8 @@ async function handleExtensions(req, res, pathSegments, queryParams, agentId) {
     const writerAgentId = principal.kind === "agent" ? principal.agentId : undefined;
     try {
       const extension = await disableExtension(parsed.params.id, {
-        by: await resolveHttpAuditUserId(req, writerAgentId)
+        by: await resolveHttpAuditUserId(req, writerAgentId),
+        agentId: writerAgentId
       });
       disableRoute.respond(res, 200, { extension: redactExtension(extension) });
     } catch (error) {
@@ -7326,7 +7330,8 @@ async function handleExtensions(req, res, pathSegments, queryParams, agentId) {
     const writerAgentId = principal.kind === "agent" ? principal.agentId : undefined;
     try {
       const extension = await activateVersion(parsed.params.id, parsed.body.version, {
-        by: await resolveHttpAuditUserId(req, writerAgentId)
+        by: await resolveHttpAuditUserId(req, writerAgentId),
+        agentId: writerAgentId
       });
       activateVersionRoute.respond(res, 200, { extension: redactExtension(extension) });
     } catch (error) {
@@ -25581,6 +25586,57 @@ async function handleUsers(req, res, pathSegments, queryParams) {
 // src/http/webhooks.ts
 init_zod();
 
+// src/agentmail/inbound-archive.ts
+init_db();
+init_secret_scrubber();
+import { createHash as createHash3 } from "node:crypto";
+var INBOUND_ARCHIVE_NAMESPACE = "agentmail-inbound";
+var INBOUND_ARCHIVE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+var text = (value, limit) => typeof value === "string" ? scrubSecrets(value).slice(0, limit) : "";
+var inboundArchiveKey = (inboxId, messageId) => createHash3("sha256").update(JSON.stringify([inboxId, messageId])).digest("hex");
+async function archiveInboundMessage(payload) {
+  if (![
+    "message.received",
+    "message.received.unauthenticated",
+    "message.received.blocked",
+    "message.received.spam"
+  ].includes(payload.event_type))
+    return;
+  const message = payload.message;
+  if (!message?.inbox_id || !message.message_id || !message.thread_id) {
+    throw new Error("Inbound webhook missing inbox, message or thread ID");
+  }
+  const now = Date.now();
+  await sweepExpiredKv(INBOUND_ARCHIVE_NAMESPACE, now);
+  const minimized = {
+    event_type: payload.event_type,
+    message: {
+      inbox_id: message.inbox_id,
+      message_id: message.message_id,
+      thread_id: message.thread_id,
+      from_: text(Array.isArray(message.from_) ? message.from_.join(", ") : message.from_, 1500),
+      reply_to: Array.isArray(message.reply_to) ? message.reply_to.slice(0, 20).map((value) => text(value, 1500)) : undefined,
+      subject: text(message.subject, 300),
+      text: text(message.text, 16000),
+      html: text(message.html, 16000),
+      timestamp: text(message.timestamp || message.created_at, 100),
+      labels: Array.isArray(message.labels) ? message.labels.filter((label) => label === "unauthenticated") : [],
+      attachments: Array.isArray(message.attachments) ? message.attachments.map((attachment) => ({
+        filename: text(attachment.filename, 1500),
+        content_type: text(attachment.content_type, 200),
+        size: typeof attachment.size === "number" ? attachment.size : null
+      })) : undefined
+    }
+  };
+  await claimKv({
+    namespace: INBOUND_ARCHIVE_NAMESPACE,
+    key: inboundArchiveKey(message.inbox_id, message.message_id),
+    value: { version: 1, capturedAt: new Date(now).toISOString(), payload: minimized },
+    expiresAt: now + INBOUND_ARCHIVE_TTL_MS,
+    valueType: "json"
+  });
+}
+
 // src/integrations/kapso/inbound.ts
 init_resolver();
 init_event_bus();
@@ -25730,7 +25786,7 @@ var agentmailWebhook = route({
   responses: {
     200: { description: "Event received", schema: exports_external.object({ received: exports_external.literal(true) }) },
     401: { description: "Invalid signature" },
-    503: { description: "AgentMail integration not configured" }
+    503: { description: "AgentMail integration not configured or inbound archive unavailable" }
   }
 });
 var kapsoWebhook = route({
@@ -26053,8 +26109,16 @@ async function handleWebhooks(req, res, pathSegments) {
       res.end(JSON.stringify({ error: "Invalid signature" }));
       return true;
     }
-    agentmailWebhook.respond(res, 200, { received: true });
     const payload = verified;
+    try {
+      await archiveInboundMessage(payload);
+    } catch (err) {
+      console.error("[AgentMail] Inbound archive failed; requesting webhook retry", err);
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Inbound archive unavailable" }));
+      return true;
+    }
+    agentmailWebhook.respond(res, 200, { received: true });
     if (payload.message && !isInboxAllowed(payload.message.inbox_id, process.env.AGENTMAIL_INBOX_DOMAIN_FILTER)) {
       const domain = payload.message.inbox_id.split("@")[1] ?? "unknown";
       console.log(`[AgentMail] Ignoring event for inbox domain "${domain}" (not in AGENTMAIL_INBOX_DOMAIN_FILTER)`);
@@ -27402,7 +27466,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-hw26vj40.js");
+    const { stopScheduler } = await import("./index-68bd9b5f.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -27410,7 +27474,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-asqtcm4y.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-xvmwnh1d.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -27478,15 +27542,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-jqjs6cws.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-thxpn9vn.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-mx51az05.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-4e201wtd.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-wcmrg6sv.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-mkc5n5qa.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -27494,7 +27558,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-16js521z.js");
+  const { runAllSeeders } = await import("./index-k1hq1qt6.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -27548,36 +27612,36 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-hw26vj40.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-nnrbpcjp.js");
+    const { startScheduler } = await import("./index-68bd9b5f.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-z0zwjtkn.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-zj518gf9.js");
+    const { startHeartbeat } = await import("./index-mjpxsr6k.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-asqtcm4y.js");
+    const { startOAuthKeepalive } = await import("./keepalive-xvmwnh1d.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-3s04c6qw.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-6207x9sj.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
-  import("./boot-reembed-nafcmmmc.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-smy30z32.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-3cmrrmpa.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-42vgkrrj.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-cd6a2sq0.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-b6s72fsw.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {

package/dist/{index-hw26vj40.js → index-68bd9b5f.js}

@@ -4,34 +4,34 @@ import {
   runScheduleNow,
   startScheduler,
   stopScheduler
-} from "./cli-5tpgq60f.js";
+} from "./cli-72tgtzr1.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-g69fdc9g.js";
-import"./cli-7tgcstn2.js";
-import"./cli-gbfwcd3k.js";
-import"./cli-sjaae6ff.js";
+import"./cli-kf8qp2vf.js";
+import"./cli-jytf5mw9.js";
+import"./cli-zfzznn7c.js";
+import"./cli-dsyg66vt.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-j9xczhaq.js";
-import"./cli-0qb1z6s2.js";
+import"./cli-vbk025fm.js";
+import"./cli-7bwaerjt.js";
 import"./cli-bsakbbkm.js";
-import"./cli-q88st9aj.js";
+import"./cli-gxf2ebyz.js";
 import"./cli-51tf7ac3.js";
-import"./cli-r2q6pevn.js";
+import"./cli-wfve107r.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-ppm4975n.js";
+import"./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-s14agm5s.js";
+import"./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -39,7 +39,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/dist/{index-16js521z.js → index-k1hq1qt6.js}

@@ -6,20 +6,20 @@ import {
   extractArgsJsonSchema,
   extractScriptSignature,
   typecheckScript
-} from "./cli-5jd2z7av.js";
+} from "./cli-ks8a1cgq.js";
 import {
   getScript,
   require_dist,
   upsertScriptByName,
   validateDefinition,
   validateScriptImports
-} from "./cli-sjaae6ff.js";
+} from "./cli-dsyg66vt.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
-import"./cli-j9xczhaq.js";
-import"./cli-q88st9aj.js";
-import"./cli-ppm4975n.js";
+import"./cli-vbk025fm.js";
+import"./cli-gxf2ebyz.js";
+import"./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
@@ -39,7 +39,7 @@ import {
   updateSkill,
   updateWorkflow,
   upsertSkillFiles
-} from "./cli-s14agm5s.js";
+} from "./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -47,7 +47,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import {
@@ -5655,7 +5655,7 @@ var config_default = `{
 `;
 
 // templates/skills/agent-browser/content.md
-var content_default = '# agent-browser\n\n`agent-browser` (vercel-labs) is the swarm\'s browser-automation CLI. It drives a headless Chromium over CDP and returns accessibility-tree snapshots with compact `@eN` refs. Use it for any browser task: verify a UI change, take a screenshot, walk a page, fill a form, extract page text, reproduce a frontend bug, or attach UI evidence to a PR, issue, Linear comment, or Slack thread.\n\nDo not use `qa-use`. It is not installed in the worker image any more.\n\n## Step 0: check that the CLI is present\n\nThe full worker image (`agent-swarm-worker:latest`) ships `agent-browser` and a headless Chromium. The slim image (`:slim`) has neither. The first command of any browser work is:\n\n```bash\ncommand -v agent-browser\n```\n\nIf it prints nothing, you are on the slim image. Say so in your progress report ("agent-browser is not available on this worker image") and fall back to manual QA: write the exact steps a human should run and mark the browser test cases as **Blocked**, not failed. Do not install a browser or the CLI yourself.\n\n## Step 1: load the version-matched guide\n\nThe CLI bundles its own usage guide. Load it once per task before the first browser command. Do not guess flags from memory.\n\n```bash\nagent-browser skills get core          # overview + common patterns\nagent-browser skills get core --full   # adds the full command reference\nagent-browser skills list              # specialized guides (dogfood, electron, slack, ...)\n```\n\n## Step 2: the core loop\n\n```bash\nagent-browser open <url>\nagent-browser snapshot -i              # accessibility tree, interactive elements only, @eN refs\nagent-browser click @e12               # act on refs from the snapshot\nagent-browser fill @e7 "text"\nagent-browser screenshot /tmp/<name>.png\nagent-browser close\n```\n\n- Re-run `snapshot` after every navigation or state change. Refs are only valid for the snapshot that produced them.\n- Run one browser session at a time. Call `store-progress` between page batches so the heartbeat watchdog sees you.\n- The browser is headless. Local servers inside the worker container are reachable at `http://localhost:<port>`.\n- The image launches Chromium with `--no-sandbox,--disable-dev-shm-usage` through `AGENT_BROWSER_ARGS`. If you pass your own `--args`, include `--no-sandbox` again or Chrome will not start.\n\n## Step 3: share the screenshot through agent-fs\n\nScreenshots on the worker disk disappear with the task. Upload them to agent-fs under the qa path convention and share the signed URL. `--file` is binary-safe. `--content` is text-only and mangles PNGs.\n\n```bash\nagent-fs write thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png \\\n  --file /tmp/<name>.png -m "<what it shows>"\nagent-fs stat thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json        # confirm size > 0\nagent-fs signed-url thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json  # 24h default, --expires-in up to 7d\n```\n\n- Embed the URL as `![caption](<url>)` in the PR body, review comment, Linear comment, or Slack message.\n- In `store-progress`, list the upload in the `attachments` field with `kind: "agent-fs"` and the path, and paste the signed URL in the progress text.\n- If `agent-fs auth whoami` fails, report the local path, say the upload was skipped, and continue.\n\nThe `artifacts` skill holds the full agent-fs recipe and the naming conventions.\n';
+var content_default = '# agent-browser\n\n`agent-browser` (vercel-labs) is the swarm\'s browser-automation CLI. It drives a headless Chromium over CDP and returns accessibility-tree snapshots with compact `@eN` refs. Use it for any browser task: verify a UI change, take a screenshot, walk a page, fill a form, extract page text, reproduce a frontend bug, or attach UI evidence to a PR, issue, Linear comment, or Slack thread.\n\nDo not use `qa-use`. It is not installed in the worker image any more.\n\n## Step 0: check that the CLI is present\n\nThe full worker image (`agent-swarm-worker:latest`) ships `agent-browser` and a headless Chromium. The slim image (`:slim`) has neither. The first command of any browser work is:\n\n```bash\ncommand -v agent-browser\n```\n\nIf it prints nothing, you are on the slim image. Say so in your progress report ("agent-browser is not available on this worker image") and fall back to manual QA: write the exact steps a human should run and mark the browser test cases as **Blocked**, not failed. Do not install a browser or the CLI yourself.\n\n## Step 1: load the version-matched guide\n\nThe CLI bundles its own usage guide. Load it once per task before the first browser command. Do not guess flags from memory.\n\n```bash\nagent-browser skills get core          # overview + common patterns\nagent-browser skills get core --full   # adds the full command reference\nagent-browser skills list              # specialized guides (dogfood, electron, slack, ...)\n```\n\n## Step 2: the core loop\n\n```bash\nagent-browser open <url>\nagent-browser snapshot -i              # accessibility tree, interactive elements only, @eN refs\nagent-browser click @e12               # act on refs from the snapshot\nagent-browser fill @e7 "text"\nagent-browser screenshot /tmp/<name>.png\nagent-browser close\n```\n\n- Re-run `snapshot` after every navigation or state change. Refs are only valid for the snapshot that produced them.\n- Run one browser session at a time. Call `store-progress` between page batches so the heartbeat watchdog sees you.\n- The browser is headless. Local servers inside the worker container are reachable at `http://localhost:<port>`.\n- The image launches Chromium with `--no-sandbox,--disable-dev-shm-usage` through `AGENT_BROWSER_ARGS`. If you pass your own `--args`, include `--no-sandbox` again or Chrome will not start.\n\n## Recording\n\nDefault: record with `--cursor`, drive every supported pointer action (`click`, `mouse move`, `drag`) with `--human`, and ship the **1.5x video**. Keep the 1x original only if a reviewer asks for it. Human pointer movement follows an eased curve; use `--seed <n>` on `mouse move` to make the take reproducible instead of using a bare move.\n\nOpen the page first, then record the interaction:\n\n```bash\nagent-browser record start ./in.mp4 --cursor\nagent-browser snapshot -i\nagent-browser mouse move 600 400 --human --seed 42 --duration 1400\nagent-browser click @e3 --human          # use a ref from the current snapshot\n# Perform the remaining QA steps; use --human for drag actions too.\nagent-browser record stop\nffmpeg -y -i in.mp4 -filter:v "setpts=PTS/1.5,fps=30" -an \\\n  -c:v libx264 -preset veryfast -crf 23 -pix_fmt yuv420p out-1.5x.mp4\n```\n\nSpeed-up is a post-process step: `record start` has no speed or human flag. Keep `fps=30` to preserve a steady 30 fps output rather than uneven frame drops at an inferred rate. `-an` disables audio because agent-browser recordings carry no audio track. The worker ships only `ffmpeg`, not `ffprobe`; inspect duration with `ffmpeg -i out-1.5x.mp4 2>&1 | grep Duration`.\n\nAdd `--contact-sheet` to the start command for a timestamped PNG summary of visual changes. Recording needs `ffmpeg` on PATH; check `agent-browser doctor` before starting. Stop the recording before closing the browser so the video is saved. Upload the 1.5x file through the same agent-fs QA path and signed-URL steps as screenshots below, and link it in the PR body.\n\n## Step 3: share the screenshot through agent-fs\n\nScreenshots on the worker disk disappear with the task. Upload them to agent-fs under the qa path convention and share the signed URL. `--file` is binary-safe. `--content` is text-only and mangles PNGs.\n\n```bash\nagent-fs write thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png \\\n  --file /tmp/<name>.png -m "<what it shows>"\nagent-fs stat thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json        # confirm size > 0\nagent-fs signed-url thoughts/<agent-id>/qa/<topic>-screenshots/<name>.png --json  # 24h default, --expires-in up to 7d\n```\n\n- Embed the URL as `![caption](<url>)` in the PR body, review comment, Linear comment, or Slack message.\n- In `store-progress`, list the upload in the `attachments` field with `kind: "agent-fs"` and the path, and paste the signed URL in the progress text.\n- If `agent-fs auth whoami` fails, report the local path, say the upload was skipped, and continue.\n\nThe `artifacts` skill holds the full agent-fs recipe and the naming conventions.\n';
 
 // templates/skills/apps/config.json
 var config_default2 = `{

package/dist/{index-zj518gf9.js → index-mjpxsr6k.js}

@@ -4,35 +4,35 @@ import {
   runRebootSweep,
   startHeartbeat,
   stopHeartbeat
-} from "./cli-9004vfdf.js";
-import"./cli-5tpgq60f.js";
+} from "./cli-y8tayczk.js";
+import"./cli-72tgtzr1.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-g69fdc9g.js";
-import"./cli-7tgcstn2.js";
-import"./cli-gbfwcd3k.js";
-import"./cli-sjaae6ff.js";
+import"./cli-kf8qp2vf.js";
+import"./cli-jytf5mw9.js";
+import"./cli-zfzznn7c.js";
+import"./cli-dsyg66vt.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-j9xczhaq.js";
-import"./cli-0qb1z6s2.js";
+import"./cli-vbk025fm.js";
+import"./cli-7bwaerjt.js";
 import"./cli-bsakbbkm.js";
-import"./cli-q88st9aj.js";
+import"./cli-gxf2ebyz.js";
 import"./cli-51tf7ac3.js";
-import"./cli-r2q6pevn.js";
+import"./cli-wfve107r.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-ppm4975n.js";
+import"./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-s14agm5s.js";
+import"./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -40,7 +40,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import"./cli-f7kvq46p.js";

package/dist/{index-ymn7em0p.js → index-y0te09pn.js}

@@ -2,11 +2,11 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   resetEmbeddingProvider
-} from "./cli-ppm4975n.js";
+} from "./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
-import"./cli-s14agm5s.js";
+import"./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -14,7 +14,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import"./cli-r2ap2czm.js";
 import"./cli-zf8jjwex.js";
 import"./cli-bc05qbss.js";

package/dist/{index-nnrbpcjp.js → index-z0zwjtkn.js}

@@ -20,37 +20,37 @@ import {
   stopWaitPoller,
   subscribeWaitToBus,
   validateTemplateVariables
-} from "./cli-5tpgq60f.js";
+} from "./cli-72tgtzr1.js";
 import"./cli-0z2v4nhw.js";
 import"./cli-4wppfkcm.js";
 import"./cli-e7d20cty.js";
 import"./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
-import"./cli-g69fdc9g.js";
-import"./cli-7tgcstn2.js";
-import"./cli-gbfwcd3k.js";
+import"./cli-kf8qp2vf.js";
+import"./cli-jytf5mw9.js";
+import"./cli-zfzznn7c.js";
 import {
   findEntryNodes,
   getSuccessors
-} from "./cli-sjaae6ff.js";
+} from "./cli-dsyg66vt.js";
 import"./cli-epan13p1.js";
 import"./cli-y89t4nca.js";
 import"./cli-f14fvzag.js";
 import"./cli-fad8m16k.js";
-import"./cli-j9xczhaq.js";
-import"./cli-0qb1z6s2.js";
+import"./cli-vbk025fm.js";
+import"./cli-7bwaerjt.js";
 import"./cli-bsakbbkm.js";
-import"./cli-q88st9aj.js";
+import"./cli-gxf2ebyz.js";
 import"./cli-51tf7ac3.js";
-import"./cli-r2q6pevn.js";
+import"./cli-wfve107r.js";
 import"./cli-q51yprfq.js";
 import"./cli-yatxqynm.js";
-import"./cli-ppm4975n.js";
+import"./cli-jtvs5m8q.js";
 import"./cli-fm4ytsdk.js";
 import"./cli-aehm1rbq.js";
 import"./cli-2658f6at.js";
 import"./cli-jsp14b6c.js";
-import"./cli-s14agm5s.js";
+import"./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import {
   interpolate
@@ -60,7 +60,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import"./cli-r2ap2czm.js";
 import"./cli-pzxba7gw.js";
 import {

package/dist/{keepalive-asqtcm4y.js → keepalive-xvmwnh1d.js}

@@ -1,8 +1,8 @@
 import {
   ensureAuthorizationTokenOrThrow,
   listKeepAliveAuthorizations
-} from "./cli-j9xczhaq.js";
-import"./cli-s14agm5s.js";
+} from "./cli-vbk025fm.js";
+import"./cli-bdt7w021.js";
 import"./cli-ht5rs63n.js";
 import"./cli-z61ykvam.js";
 import"./cli-dv6cdjs2.js";
@@ -10,7 +10,7 @@ import"./cli-c2mk1kgf.js";
 import"./cli-ej6gbxfb.js";
 import"./cli-sd0mxa3c.js";
 import"./cli-w5e1d1vv.js";
-import"./cli-zkxymas5.js";
+import"./cli-gfez0qmk.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -66,7 +66,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-1706zhr1.js");
+    const { getSlackApp } = await import("./app-j54aq0dj.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[OAuth Keepalive] Slack not available, cannot send notification");