@desplega.ai/agent-swarm 1.152.2 → 1.153.0

package/dist/cli-n7h1kqpf.js

@@ -0,0 +1,29 @@
+import {
+  __esm
+} from "./cli-bc05qbss.js";
+
+// src/slack/config.ts
+function getSlackConfiguration(env = process.env) {
+  const rawMode = env.SLACK_MODE === undefined ? "socket" : env.SLACK_MODE.trim();
+  const mode = SLACK_MODES.includes(rawMode) ? rawMode : null;
+  const missingCredentials = ["SLACK_BOT_TOKEN"];
+  if (mode === "socket")
+    missingCredentials.push("SLACK_APP_TOKEN");
+  if (mode === "http")
+    missingCredentials.push("SLACK_SIGNING_SECRET");
+  return {
+    disabled: env.SLACK_DISABLE === "true" || env.SLACK_DISABLE === "1",
+    mode,
+    missingCredentials: missingCredentials.filter((key) => !env[key]?.trim())
+  };
+}
+function isSlackConfigured(env = process.env) {
+  const config = getSlackConfiguration(env);
+  return !config.disabled && config.mode !== null && config.missingCredentials.length === 0;
+}
+var SLACK_MODES;
+var init_config = __esm(() => {
+  SLACK_MODES = ["socket", "http"];
+});
+
+export { getSlackConfiguration, isSlackConfigured, init_config };

package/dist/{cli-ckz5t2hb.js → cli-nq0kgyxe.js}

@@ -5,12 +5,12 @@ import {
   instantFlush,
   requestSlackThreadSteering,
   wasEventSeen
-} from "./cli-jvy9qgjs.js";
+} from "./cli-a9scg8sv.js";
 import {
   enrichSlackUserEmail,
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-3bpzj8me.js";
+} from "./cli-eazstkad.js";
 import {
   TaskCreationBlockedError,
   broadcastMatches,
@@ -23,14 +23,14 @@ import {
   hasOtherUserMention,
   notifySlackFileFailures,
   routeMessage
-} from "./cli-z3wkng35.js";
+} from "./cli-qrqhc31j.js";
 import {
   ackSlackMessage,
   buildTreeBlocks,
   ensureSlackThreadTree,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-qn042eh7.js";
+} from "./cli-n0q9b7j4.js";
 import {
   getAgentById,
   getAgentWorkingOnThread,
@@ -42,7 +42,7 @@ import {
   init_db,
   reactionName,
   slackContextKey
-} from "./cli-zvgj5zg8.js";
+} from "./cli-djvxhnc4.js";
 import {
   init_resolver,
   resolveTemplate

package/dist/{cli-z3wkng35.js → cli-qrqhc31j.js}

@@ -9,7 +9,7 @@ import {
   REFERENCES_SOURCE_MAX_LENGTH,
   resolveCredential,
   sanitizeReferencesSource
-} from "./cli-4wppfkcm.js";
+} from "./cli-7g9s78jf.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
@@ -18,18 +18,21 @@ import {
 } from "./cli-3dpj7atn.js";
 import {
   startPricingRefreshLoop
-} from "./cli-b9dd0h3k.js";
+} from "./cli-vw03hg5t.js";
+import {
+  seedPricingFromModelsDev
+} from "./cli-tdh4hjr2.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-r84ctdxn.js";
+} from "./cli-83wkg402.js";
 import {
   can,
   decideAdmission,
   grantLeadEquivalence,
   isRbacEnabled,
   revokeLeadEquivalence
-} from "./cli-zfzznn7c.js";
+} from "./cli-ytxs7mn1.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -93,7 +96,7 @@ import {
   upsertScriptConnection,
   validateDefinition,
   writeBareImportShim
-} from "./cli-fmy65jdn.js";
+} from "./cli-6ks9xf1n.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -102,10 +105,6 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import {
-  ZodFirstPartyTypeKind,
-  objectType
-} from "./cli-fad8m16k.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -120,10 +119,28 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-56h18ng2.js";
+} from "./cli-r8tdds6s.js";
 import {
-  seedPricingFromModelsDev
-} from "./cli-2nnd56zt.js";
+  ZodFirstPartyTypeKind,
+  objectType
+} from "./cli-fad8m16k.js";
+import {
+  AgentFsProvider,
+  getFileStorageProvider,
+  providerPath
+} from "./cli-jsp14b6c.js";
+import {
+  CANDIDATE_SET_MULTIPLIER,
+  computeScore,
+  getEmbeddingProvider,
+  getMemoryStore,
+  init_constants as init_constants2,
+  init_reranker,
+  init_sqlite_store,
+  isGraphExpansionEnabled,
+  rerank,
+  rowToCandidate
+} from "./cli-7pnz2v6s.js";
 import {
   require_dist
 } from "./cli-51tf7ac3.js";
@@ -137,82 +154,23 @@ import {
   startSlackApp,
   stopSlackApp,
   withSpan
-} from "./cli-qn042eh7.js";
-import {
-  CANDIDATE_SET_MULTIPLIER,
-  computeScore,
-  getEmbeddingProvider,
-  getMemoryStore,
-  init_constants as init_constants2,
-  init_reranker,
-  init_sqlite_store,
-  isGraphExpansionEnabled,
-  rerank,
-  rowToCandidate
-} from "./cli-jew3jda5.js";
+} from "./cli-n0q9b7j4.js";
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
 } from "./cli-2658f6at.js";
 import {
-  AgentFsProvider,
-  getFileStorageProvider,
-  providerPath
-} from "./cli-jsp14b6c.js";
-import {
-  $OpenAPIRegistry,
-  $OpenApiGeneratorV31,
-  AgentAvatarSchema,
-  AgentMemoryScopeSchema,
-  AgentMemorySourceSchema,
-  AgentStatusSchema,
-  AgentTaskStatusSchema,
-  AssetKeySchema,
-  AttachmentInputSchema,
-  BudgetRefusalCauseSchema,
-  ChannelTypeSchema,
-  CooldownConfigSchema,
-  CreateTaskOptionsSchema,
   CredentialBindingSchema,
-  ExtensionManifestSchema,
-  FollowUpConfigSchema,
-  InputValueSchema,
-  KvKeySchema,
-  KvNamespaceSchema,
   KvTypeCollisionError,
-  KvValueTypeSchema,
   MAX_EMPTY_POLLS,
-  MetricDefinitionSchema,
-  ModelTierSchema,
-  OnUnsupportedSchema,
-  PageAuthModeSchema,
-  PageContentTypeSchema,
-  PromptTemplateScopeSchema,
-  PromptTemplateStateSchema,
-  ProviderNameSchema,
-  ReasoningEffortSchema,
-  RepoGuidelinesInputSchema,
-  RepoHooksSchema,
-  RoutingReasonSchema,
-  ScheduledTaskTargetTypeSchema,
-  ScriptRunStatusSchema,
-  ServiceStatusSchema,
-  SteerModeSchema,
-  SteerOutcomeSchema,
   SteeringRequestError,
-  SwarmConfigScopeSchema,
-  TriggerConfigSchema,
-  WorkflowDefinitionSchema,
-  WorkflowNodePatchSchema,
-  WorkflowRunStatusSchema,
   acceptTask,
   agentContextKey,
   agentmailContextKey,
   beginRequestAuthScope,
   buildJiraContextKey,
   buildRoutingAffinityFromAgent,
-  canWriteAssetKey,
   cancelPendingApprovalRequestsForRun,
   cancelTask,
   checkDependencies,
@@ -365,14 +323,11 @@ import {
   incrKv,
   incrementEmptyPollCount,
   initDb,
-  init_bundle_path,
   init_context_key,
   init_credential_broker,
   init_date_utils,
   init_db,
   init_db_client,
-  init_dist,
-  init_key,
   init_request_auth_context,
   init_slack_routing,
   init_steering,
@@ -380,17 +335,13 @@ import {
   init_task_lifecycle_events,
   init_telemetry,
   init_templates,
-  init_types,
-  init_zod_openapi,
   insertTaskAttachment,
   installMcpServer,
   installSkill,
   isAgentEligibleForTask,
   isInTransaction,
   isReservedConfigKey,
-  isSafeBundlePath,
   isSteeringEnabled,
-  isTerminalTaskStatus,
   linearContextKey,
   listCancelledApprovalRequestsForRun,
   listKv,
@@ -404,12 +355,10 @@ import {
   maskSecrets,
   moveTaskFromBacklog,
   moveTaskToBacklog,
-  normalizeAssetKey,
   normalizeDateRequired,
   onTaskStarted,
   overwriteTerminalTaskResultText,
   pageContextKey,
-  parseAssetKey,
   placeholderForConfigKey,
   postMessage,
   promoteDraftTask,
@@ -433,7 +382,6 @@ import {
   setBudgetRefusalFollowUpTaskId,
   setRequestAuth,
   shouldBlockPolling,
-  splitLegacyModelAlias,
   startTask,
   sweepExpiredKvPrefix,
   telemetry,
@@ -463,13 +411,67 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-zvgj5zg8.js";
+} from "./cli-djvxhnc4.js";
+import {
+  $OpenAPIRegistry,
+  $OpenApiGeneratorV31,
+  AgentAvatarSchema,
+  AgentMemoryScopeSchema,
+  AgentMemorySourceSchema,
+  AgentStatusSchema,
+  AgentTaskStatusSchema,
+  AssetKeySchema,
+  AttachmentInputSchema,
+  BudgetRefusalCauseSchema,
+  ChannelTypeSchema,
+  CooldownConfigSchema,
+  CreateTaskOptionsSchema,
+  ExtensionManifestSchema,
+  FollowUpConfigSchema,
+  InputValueSchema,
+  KvKeySchema,
+  KvNamespaceSchema,
+  KvValueTypeSchema,
+  MetricDefinitionSchema,
+  ModelTierSchema,
+  OnUnsupportedSchema,
+  PageAuthModeSchema,
+  PageContentTypeSchema,
+  PromptTemplateScopeSchema,
+  PromptTemplateStateSchema,
+  ProviderNameSchema,
+  ReasoningEffortSchema,
+  RepoGuidelinesInputSchema,
+  RepoHooksSchema,
+  RoutingReasonSchema,
+  ScheduledTaskTargetTypeSchema,
+  ScriptRunStatusSchema,
+  ServiceStatusSchema,
+  SteerModeSchema,
+  SteerOutcomeSchema,
+  SwarmConfigScopeSchema,
+  TriggerConfigSchema,
+  WorkflowDefinitionSchema,
+  WorkflowNodePatchSchema,
+  WorkflowRunStatusSchema,
+  canWriteAssetKey,
+  init_bundle_path,
+  init_dist,
+  init_key,
+  init_types,
+  init_zod_openapi,
+  isSafeBundlePath,
+  isTerminalTaskStatus,
+  normalizeAssetKey,
+  parseAssetKey,
+  splitLegacyModelAlias
+} from "./cli-zcsyfw2z.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
   generateDefaultSoulMd,
   init_defaults
-} from "./cli-ht5rs63n.js";
+} from "./cli-b2g6mzjc.js";
 import {
   deepInterpolate,
   findInterpolationTokens,
@@ -488,6 +490,11 @@ import {
   getPublicMcpBaseUrl,
   init_constants
 } from "./cli-dv6cdjs2.js";
+import {
+  getSlackConfiguration,
+  init_config,
+  isSlackConfigured
+} from "./cli-n7h1kqpf.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
@@ -541,7 +548,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-zvkq5csn.js";
+} from "./cli-ybpp1srm.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -14276,6 +14283,9 @@ init_db_client();
 
 // src/be/extensions/db.ts
 init_db();
+
+class ExtensionOwnershipError extends Error {
+}
 function rowToExtension(row) {
   return {
     ...row,
@@ -14302,6 +14312,12 @@ async function installExtension(args) {
       args.manifest.name
     ]);
     const existing = existingRow ? rowToExtension(existingRow) : null;
+    if (existing && args.ownerOnly && existing.createdByAgentId !== args.ownerOnly) {
+      throw new ExtensionOwnershipError("Forbidden: extension belongs to another owner");
+    }
+    if (existing?.enabled && args.ownerOnly && (args.config !== undefined && JSON.stringify(args.config) !== existing.configJson || args.priority !== undefined && args.priority !== existing.priority)) {
+      throw new ExtensionOwnershipError("Forbidden: only a lead or operator may change live extension configuration");
+    }
     const now = new Date().toISOString();
     if (!existing) {
       const id = crypto.randomUUID();
@@ -14499,11 +14515,17 @@ async function updateExtensionMeta(id, args) {
     sets.push("description = ?");
     values.push(args.description);
   }
-  if (sets.length === 0)
+  if (sets.length === 0 && !args.ownerOnly)
     return getExtensionById(id);
   sets.push("updated_by = ?", "updatedAt = ?");
   values.push(args.updatedBy ?? null, new Date().toISOString(), id);
-  const row = await getDbClient().get(`UPDATE extensions SET ${sets.join(", ")} WHERE id = ? RETURNING *`, values);
+  const ownerCondition = args.ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : "";
+  if (args.ownerOnly)
+    values.push(args.ownerOnly);
+  const row = await getDbClient().get(`UPDATE extensions SET ${sets.join(", ")} WHERE id = ?${ownerCondition} RETURNING *`, values);
+  if (!row && args.ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return row ? rowToExtension(row) : null;
 }
 async function setExtensionState(id, args) {
@@ -14544,8 +14566,11 @@ async function recordExtensionFailure(id, lastError, maxConsecutiveFailures) {
      RETURNING *`, [lastError, maxConsecutiveFailures, maxConsecutiveFailures, new Date().toISOString(), id]);
   return row ? rowToExtension(row) : null;
 }
-async function deleteExtension(id) {
-  const result = await getDbClient().run("DELETE FROM extensions WHERE id = ?", [id]);
+async function deleteExtension(id, ownerOnly) {
+  const result = await getDbClient().run(`DELETE FROM extensions WHERE id = ?${ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : ""}`, ownerOnly ? [id, ownerOnly] : [id]);
+  if (result.changes === 0 && ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return result.changes > 0;
 }
 async function insertExtensionRun(args) {
@@ -20757,6 +20782,8 @@ function resourceIdOf(resource) {
       return resource.agentId;
     case "kv-namespace":
       return resource.namespace;
+    case "extension":
+      return resource.extensionId ?? null;
     case "app":
       return resource.appId;
     case "owned":
@@ -23685,7 +23712,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-03na2vwb.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -23756,7 +23783,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-r3jxf3wy.js");
+  const { getDbClient: getDbClient2 } = await import("./db-4jjvwz1s.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -97476,9 +97503,10 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-gpfn1741.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-b56xkbc7.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
+  await stopSlackApp();
   const { resetFileStorageProvider } = await import("./registry-v5wytg0s.js");
   resetFileStorageProvider();
   resetEmbeddingProvider();
@@ -97488,10 +97516,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-je26h5y7.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-c98xrad3.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-1qmybsd4.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-zt3qm9xn.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -97511,9 +97539,8 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
   resetJira();
   if (await initJira())
     integrations.push("jira");
-  await stopSlackApp();
-  await startSlackApp();
-  integrations.push("slack");
+  if (await startSlackApp())
+    integrations.push("slack");
   return {
     configsLoaded: updated.length,
     keysUpdated: updated,
@@ -97813,6 +97840,7 @@ async function handleCore(req, res, myAgentId, apiKey) {
 
 // src/server.ts
 init_resolver();
+init_config();
 
 // src/tools/accept-steer.ts
 init_zod();
@@ -98304,7 +98332,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-06vph6q4.js");
+  const dispatcher = await import("./dispatcher-ca590nkz.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -106058,6 +106086,7 @@ var extensionListItemSchema = looseObject({
   name: string().optional(),
   version: number().optional(),
   activeVersion: number().optional(),
+  createdByAgentId: string().nullable().optional(),
   enabled: boolean().optional(),
   status: string().optional(),
   priority: number().optional(),
@@ -106068,6 +106097,7 @@ var extensionToolOutputSchema = swarmToolOutputSchema({
   name: string().optional(),
   version: number().optional(),
   activeVersion: number().optional(),
+  createdByAgentId: string().nullable().optional(),
   enabled: boolean().optional(),
   status: string().optional(),
   priority: number().optional(),
@@ -106083,6 +106113,7 @@ function coerceExtensionSummary(entry) {
   const extension = isRecord2(entry) ? entry : {};
   return {
     id: typeof extension.id === "string" ? extension.id : undefined,
+    createdByAgentId: typeof extension.createdByAgentId === "string" ? extension.createdByAgentId : null,
     name: typeof extension.name === "string" ? extension.name : undefined,
     version: typeof extension.version === "number" ? extension.version : undefined,
     activeVersion: typeof extension.activeVersion === "number" ? extension.activeVersion : undefined,
@@ -106207,7 +106238,7 @@ var registerExtensionEnableTool = (server) => {
 // src/tools/extension-install.ts
 init_zod();
 init_types();
-var EXTENSION_INSTALL_DESCRIPTION = "Validate and store a TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
+var EXTENSION_INSTALL_DESCRIPTION = "Any authenticated agent may create and install its own TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The installing agent is recorded as createdByAgentId. Workers may install subsequent versions only for their own extensions; those versions remain inactive. A new extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
 function extensionInstallResult(data, fallbackName) {
   const body = data;
   const extension = coerceExtensionSummary(body.extension);
@@ -106254,9 +106285,9 @@ function extensionListItems(data) {
   return data.extensions.map(coerceExtensionSummary);
 }
 function renderExtensionsTable(extensions) {
-  const header = "| Name | Version | Active | Enabled | Status | Priority | Failures |";
-  const divider = "| --- | ---: | ---: | --- | --- | ---: | ---: |";
-  const rows = extensions.map((extension) => `| ${extension.name ?? "?"} | ${extension.version ?? "?"} | ${extension.activeVersion ?? "?"} | ${extension.enabled ?? false} | ${extension.status ?? "unknown"} | ${extension.priority ?? "?"} | ${extension.consecutiveFailures ?? 0} |`);
+  const header = "| Name | Owner agent | Version | Active | Enabled | Status | Priority | Failures |";
+  const divider = "| --- | --- | ---: | ---: | --- | --- | ---: | ---: |";
+  const rows = extensions.map((extension) => `| ${extension.name ?? "?"} | ${extension.createdByAgentId ?? "operator/user"} | ${extension.version ?? "?"} | ${extension.activeVersion ?? "?"} | ${extension.enabled ?? false} | ${extension.status ?? "unknown"} | ${extension.priority ?? "?"} | ${extension.consecutiveFailures ?? 0} |`);
   return [header, divider, ...rows].join(`
 `);
 }
@@ -117032,7 +117063,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-03na2vwb.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -117055,6 +117086,7 @@ Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
 }
 
 // src/be/automation-preflight.ts
+init_config();
 init_db();
 var NEEDS_SETUP_PREFIX = "needs_setup:";
 function hasValue(value) {
@@ -117232,7 +117264,7 @@ async function getAutomationSetupStates() {
   const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
   const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
   return {
-    slack: enabled(process.env.SLACK_DISABLE) && present(process.env.SLACK_BOT_TOKEN) && present(process.env.SLACK_APP_TOKEN) ? "verified" : "unverified",
+    slack: getSlackConfiguration().mode === "socket" && isSlackConfigured() ? "configured" : "unverified",
     github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
     linear: linearTokens ? "verified" : "unverified",
     jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
@@ -120177,7 +120209,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+          const { getSlackApp: getSlackApp2 } = await import("./app-03na2vwb.js");
           const slackApp = getSlackApp2();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -120297,7 +120329,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-03na2vwb.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -129105,7 +129137,8 @@ function hasCapability(cap) {
   return getCapabilities().has(cap);
 }
 function getEnabledCapabilities() {
-  return Array.from(getCapabilities());
+  const capabilities = Array.from(getCapabilities());
+  return getSlackConfiguration().mode === "socket" ? capabilities : capabilities.filter((capability) => capability !== "slack");
 }
 function isScriptsOnlyMcp() {
   return resolveScriptsOnlyMode({ env: process.env.SCRIPTS_ONLY_MCP });
@@ -130540,25 +130573,18 @@ function maxUpdatedAt(extensions) {
   return extensions.reduce((latest, extension) => extension.updatedAt > latest ? extension.updatedAt : latest, "");
 }
 async function loadableExtension(record3) {
-  if (record3.activeVersion !== record3.version) {
-    const version = await getExtensionVersion(record3.id, record3.activeVersion);
-    if (!version) {
-      throw new ExtensionLifecycleError(`Extension version ${record3.activeVersion} was not found`, 404);
-    }
-    return {
-      record: {
-        ...record3,
-        manifestJson: version.manifestJson,
-        contentHash: version.contentHash
-      },
-      manifest: ExtensionManifestSchema.parse(JSON.parse(version.manifestJson)),
-      files: JSON.parse(version.filesJson)
-    };
+  const version = await getExtensionVersion(record3.id, record3.activeVersion);
+  if (!version) {
+    throw new ExtensionLifecycleError(`Extension version ${record3.activeVersion} was not found`, 404);
   }
   return {
-    record: record3,
-    manifest: ExtensionManifestSchema.parse(JSON.parse(record3.manifestJson)),
-    files: await getExtensionFiles(record3.id)
+    record: {
+      ...record3,
+      manifestJson: version.manifestJson,
+      contentHash: version.contentHash
+    },
+    manifest: ExtensionManifestSchema.parse(JSON.parse(version.manifestJson)),
+    files: JSON.parse(version.filesJson)
   };
 }
 async function removeRegistered(id2) {
@@ -131183,4 +131209,4 @@ async function dispatchPost(event, payload, opts) {
   }
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, installExtension, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, deleteExtension, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, TaskCreationBlockedError, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, validateJsonSchema, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, ExtensionOwnershipError, installExtension, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, deleteExtension, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, TaskCreationBlockedError, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, validateJsonSchema, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };