@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/dist/{cli-z3wkng35.js → cli-6r3cgpk2.js}

@@ -7,9 +7,10 @@ import {
   DEFAULT_MODEL,
   LlmRater,
   REFERENCES_SOURCE_MAX_LENGTH,
+  getMemoryRaterNames,
   resolveCredential,
   sanitizeReferencesSource
-} from "./cli-4wppfkcm.js";
+} from "./cli-3bkz2p7j.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
@@ -18,18 +19,21 @@ import {
 } from "./cli-3dpj7atn.js";
 import {
   startPricingRefreshLoop
-} from "./cli-b9dd0h3k.js";
+} from "./cli-stwsmd6k.js";
+import {
+  seedPricingFromModelsDev
+} from "./cli-e0pg4zeh.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-r84ctdxn.js";
+} from "./cli-e31ehqwy.js";
 import {
   can,
   decideAdmission,
   grantLeadEquivalence,
   isRbacEnabled,
   revokeLeadEquivalence
-} from "./cli-zfzznn7c.js";
+} from "./cli-ytxs7mn1.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -93,7 +97,7 @@ import {
   upsertScriptConnection,
   validateDefinition,
   writeBareImportShim
-} from "./cli-fmy65jdn.js";
+} from "./cli-pf1v8xhb.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -102,10 +106,6 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import {
-  ZodFirstPartyTypeKind,
-  objectType
-} from "./cli-fad8m16k.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -120,10 +120,28 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-56h18ng2.js";
+} from "./cli-n62atwh9.js";
 import {
-  seedPricingFromModelsDev
-} from "./cli-2nnd56zt.js";
+  ZodFirstPartyTypeKind,
+  objectType
+} from "./cli-fad8m16k.js";
+import {
+  AgentFsProvider,
+  getFileStorageProvider,
+  providerPath
+} from "./cli-jsp14b6c.js";
+import {
+  CANDIDATE_SET_MULTIPLIER,
+  computeScore,
+  getEmbeddingProvider,
+  getMemoryStore,
+  init_constants as init_constants2,
+  init_reranker,
+  init_sqlite_store,
+  isGraphExpansionEnabled,
+  rerank,
+  rowToCandidate
+} from "./cli-hws0vn86.js";
 import {
   require_dist
 } from "./cli-51tf7ac3.js";
@@ -137,82 +155,24 @@ import {
   startSlackApp,
   stopSlackApp,
   withSpan
-} from "./cli-qn042eh7.js";
-import {
-  CANDIDATE_SET_MULTIPLIER,
-  computeScore,
-  getEmbeddingProvider,
-  getMemoryStore,
-  init_constants as init_constants2,
-  init_reranker,
-  init_sqlite_store,
-  isGraphExpansionEnabled,
-  rerank,
-  rowToCandidate
-} from "./cli-jew3jda5.js";
+} from "./cli-c1v10xb2.js";
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
 } from "./cli-2658f6at.js";
 import {
-  AgentFsProvider,
-  getFileStorageProvider,
-  providerPath
-} from "./cli-jsp14b6c.js";
-import {
-  $OpenAPIRegistry,
-  $OpenApiGeneratorV31,
-  AgentAvatarSchema,
-  AgentMemoryScopeSchema,
-  AgentMemorySourceSchema,
-  AgentStatusSchema,
-  AgentTaskStatusSchema,
-  AssetKeySchema,
-  AttachmentInputSchema,
-  BudgetRefusalCauseSchema,
-  ChannelTypeSchema,
-  CooldownConfigSchema,
-  CreateTaskOptionsSchema,
   CredentialBindingSchema,
-  ExtensionManifestSchema,
-  FollowUpConfigSchema,
-  InputValueSchema,
-  KvKeySchema,
-  KvNamespaceSchema,
+  EXTENSION_AGENT_ROLE,
   KvTypeCollisionError,
-  KvValueTypeSchema,
   MAX_EMPTY_POLLS,
-  MetricDefinitionSchema,
-  ModelTierSchema,
-  OnUnsupportedSchema,
-  PageAuthModeSchema,
-  PageContentTypeSchema,
-  PromptTemplateScopeSchema,
-  PromptTemplateStateSchema,
-  ProviderNameSchema,
-  ReasoningEffortSchema,
-  RepoGuidelinesInputSchema,
-  RepoHooksSchema,
-  RoutingReasonSchema,
-  ScheduledTaskTargetTypeSchema,
-  ScriptRunStatusSchema,
-  ServiceStatusSchema,
-  SteerModeSchema,
-  SteerOutcomeSchema,
   SteeringRequestError,
-  SwarmConfigScopeSchema,
-  TriggerConfigSchema,
-  WorkflowDefinitionSchema,
-  WorkflowNodePatchSchema,
-  WorkflowRunStatusSchema,
   acceptTask,
   agentContextKey,
   agentmailContextKey,
   beginRequestAuthScope,
   buildJiraContextKey,
   buildRoutingAffinityFromAgent,
-  canWriteAssetKey,
   cancelPendingApprovalRequestsForRun,
   cancelTask,
   checkDependencies,
@@ -257,6 +217,7 @@ import {
   deleteWorkflow,
   emitMcpServerConnectedTelemetry,
   exports_db,
+  extensionAgentAssignmentError,
   failTask,
   findCompletedTaskInThread,
   findExistingLinearTrackerContextWork,
@@ -365,14 +326,11 @@ import {
   incrKv,
   incrementEmptyPollCount,
   initDb,
-  init_bundle_path,
   init_context_key,
   init_credential_broker,
   init_date_utils,
   init_db,
   init_db_client,
-  init_dist,
-  init_key,
   init_request_auth_context,
   init_slack_routing,
   init_steering,
@@ -380,17 +338,14 @@ import {
   init_task_lifecycle_events,
   init_telemetry,
   init_templates,
-  init_types,
-  init_zod_openapi,
   insertTaskAttachment,
   installMcpServer,
   installSkill,
   isAgentEligibleForTask,
+  isExtensionAgent,
   isInTransaction,
   isReservedConfigKey,
-  isSafeBundlePath,
   isSteeringEnabled,
-  isTerminalTaskStatus,
   linearContextKey,
   listCancelledApprovalRequestsForRun,
   listKv,
@@ -404,12 +359,10 @@ import {
   maskSecrets,
   moveTaskFromBacklog,
   moveTaskToBacklog,
-  normalizeAssetKey,
   normalizeDateRequired,
   onTaskStarted,
   overwriteTerminalTaskResultText,
   pageContextKey,
-  parseAssetKey,
   placeholderForConfigKey,
   postMessage,
   promoteDraftTask,
@@ -433,7 +386,6 @@ import {
   setBudgetRefusalFollowUpTaskId,
   setRequestAuth,
   shouldBlockPolling,
-  splitLegacyModelAlias,
   startTask,
   sweepExpiredKvPrefix,
   telemetry,
@@ -463,13 +415,67 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-zvgj5zg8.js";
+} from "./cli-ge67p080.js";
+import {
+  $OpenAPIRegistry,
+  $OpenApiGeneratorV31,
+  AgentAvatarSchema,
+  AgentMemoryScopeSchema,
+  AgentMemorySourceSchema,
+  AgentStatusSchema,
+  AgentTaskStatusSchema,
+  AssetKeySchema,
+  AttachmentInputSchema,
+  BudgetRefusalCauseSchema,
+  ChannelTypeSchema,
+  CooldownConfigSchema,
+  CreateTaskOptionsSchema,
+  ExtensionManifestSchema,
+  FollowUpConfigSchema,
+  InputValueSchema,
+  KvKeySchema,
+  KvNamespaceSchema,
+  KvValueTypeSchema,
+  MetricDefinitionSchema,
+  ModelTierSchema,
+  OnUnsupportedSchema,
+  PageAuthModeSchema,
+  PageContentTypeSchema,
+  PromptTemplateScopeSchema,
+  PromptTemplateStateSchema,
+  ProviderNameSchema,
+  ReasoningEffortSchema,
+  RepoGuidelinesInputSchema,
+  RepoHooksSchema,
+  RoutingReasonSchema,
+  ScheduledTaskTargetTypeSchema,
+  ScriptRunStatusSchema,
+  ServiceStatusSchema,
+  SteerModeSchema,
+  SteerOutcomeSchema,
+  SwarmConfigScopeSchema,
+  TriggerConfigSchema,
+  WorkflowDefinitionSchema,
+  WorkflowNodePatchSchema,
+  WorkflowRunStatusSchema,
+  canWriteAssetKey,
+  init_bundle_path,
+  init_dist,
+  init_key,
+  init_types,
+  init_zod_openapi,
+  isSafeBundlePath,
+  isTerminalTaskStatus,
+  normalizeAssetKey,
+  parseAssetKey,
+  splitLegacyModelAlias
+} from "./cli-4k7jazkq.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
   generateDefaultSoulMd,
   init_defaults
-} from "./cli-ht5rs63n.js";
+} from "./cli-0e31nm4n.js";
 import {
   deepInterpolate,
   findInterpolationTokens,
@@ -480,7 +486,7 @@ import {
   interpolate,
   registerTemplate,
   resolveTemplate
-} from "./cli-z61ykvam.js";
+} from "./cli-wg04s9kr.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -488,6 +494,11 @@ import {
   getPublicMcpBaseUrl,
   init_constants
 } from "./cli-dv6cdjs2.js";
+import {
+  getSlackConfiguration,
+  init_config,
+  isSlackConfigured
+} from "./cli-n7h1kqpf.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
@@ -541,7 +552,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-zvkq5csn.js";
+} from "./cli-myaxtgh8.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -14276,6 +14287,9 @@ init_db_client();
 
 // src/be/extensions/db.ts
 init_db();
+
+class ExtensionOwnershipError extends Error {
+}
 function rowToExtension(row) {
   return {
     ...row,
@@ -14302,6 +14316,12 @@ async function installExtension(args) {
       args.manifest.name
     ]);
     const existing = existingRow ? rowToExtension(existingRow) : null;
+    if (existing && args.ownerOnly && existing.createdByAgentId !== args.ownerOnly) {
+      throw new ExtensionOwnershipError("Forbidden: extension belongs to another owner");
+    }
+    if (existing?.enabled && args.ownerOnly && (args.config !== undefined && JSON.stringify(args.config) !== existing.configJson || args.priority !== undefined && args.priority !== existing.priority)) {
+      throw new ExtensionOwnershipError("Forbidden: only a lead or operator may change live extension configuration");
+    }
     const now = new Date().toISOString();
     if (!existing) {
       const id = crypto.randomUUID();
@@ -14499,11 +14519,17 @@ async function updateExtensionMeta(id, args) {
     sets.push("description = ?");
     values.push(args.description);
   }
-  if (sets.length === 0)
+  if (sets.length === 0 && !args.ownerOnly)
     return getExtensionById(id);
   sets.push("updated_by = ?", "updatedAt = ?");
   values.push(args.updatedBy ?? null, new Date().toISOString(), id);
-  const row = await getDbClient().get(`UPDATE extensions SET ${sets.join(", ")} WHERE id = ? RETURNING *`, values);
+  const ownerCondition = args.ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : "";
+  if (args.ownerOnly)
+    values.push(args.ownerOnly);
+  const row = await getDbClient().get(`UPDATE extensions SET ${sets.join(", ")} WHERE id = ?${ownerCondition} RETURNING *`, values);
+  if (!row && args.ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return row ? rowToExtension(row) : null;
 }
 async function setExtensionState(id, args) {
@@ -14544,8 +14570,11 @@ async function recordExtensionFailure(id, lastError, maxConsecutiveFailures) {
      RETURNING *`, [lastError, maxConsecutiveFailures, maxConsecutiveFailures, new Date().toISOString(), id]);
   return row ? rowToExtension(row) : null;
 }
-async function deleteExtension(id) {
-  const result = await getDbClient().run("DELETE FROM extensions WHERE id = ?", [id]);
+async function deleteExtension(id, ownerOnly) {
+  const result = await getDbClient().run(`DELETE FROM extensions WHERE id = ?${ownerOnly ? " AND createdByAgentId = ? AND enabled = 0" : ""}`, ownerOnly ? [id, ownerOnly] : [id]);
+  if (result.changes === 0 && ownerOnly) {
+    throw new ExtensionOwnershipError("Forbidden: extension must be your own disabled draft");
+  }
   return result.changes > 0;
 }
 async function insertExtensionRun(args) {
@@ -20757,6 +20786,8 @@ function resourceIdOf(resource) {
       return resource.agentId;
     case "kv-namespace":
       return resource.namespace;
+    case "extension":
+      return resource.extensionId ?? null;
     case "app":
       return resource.appId;
     case "owned":
@@ -23685,7 +23716,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-zk1apkf6.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -23756,7 +23787,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-r3jxf3wy.js");
+  const { getDbClient: getDbClient2 } = await import("./db-y9zwsr79.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -97476,9 +97507,10 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-gpfn1741.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-m9ks8a7t.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
+  await stopSlackApp();
   const { resetFileStorageProvider } = await import("./registry-v5wytg0s.js");
   resetFileStorageProvider();
   resetEmbeddingProvider();
@@ -97488,10 +97520,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-je26h5y7.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-22hd3jjn.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-1qmybsd4.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-qe168424.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -97511,9 +97543,8 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
   resetJira();
   if (await initJira())
     integrations.push("jira");
-  await stopSlackApp();
-  await startSlackApp();
-  integrations.push("slack");
+  if (await startSlackApp())
+    integrations.push("slack");
   return {
     configsLoaded: updated.length,
     keysUpdated: updated,
@@ -97813,6 +97844,7 @@ async function handleCore(req, res, myAgentId, apiKey) {
 
 // src/server.ts
 init_resolver();
+init_config();
 
 // src/tools/accept-steer.ts
 init_zod();
@@ -97978,7 +98010,7 @@ var storeProgressBlockedWaitingNudge = (r) => {
   const ms = r.data?.blockedWaitingElapsedMs;
   if (typeof ms !== "number")
     return;
-  return `That reads as blocked-waiting, ${formatIdleDuration(ms)} since your last update — call defer-task so a wake-up task resumes you instead of polling manually.`;
+  return `That reads as blocked-waiting, ${formatIdleDuration(ms)} since your last update — keep working if you can, and if the wait is genuinely long, defer-task is one way to resume later instead of polling.`;
 };
 var workflowLongScriptTimeoutNudge = (r) => {
   if (!r.ok)
@@ -98304,7 +98336,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-06vph6q4.js");
+  const dispatcher = await import("./dispatcher-9m9zss36.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -104632,11 +104664,7 @@ var FACTORIES = {
 };
 var SERVER_RATERS = new Set(["implicit-citation"]);
 function getRegisteredRaters() {
-  const raw = process.env.MEMORY_RATERS;
-  if (!raw || raw.trim() === "") {
-    return [new NoopRater];
-  }
-  const names = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  const names = getMemoryRaterNames();
   const raters = [];
   for (const name of names) {
     const factory = FACTORIES[name];
@@ -105491,7 +105519,6 @@ async function guardTerminalTaskResultWrite(task, write) {
 
 // src/tools/defer-task.ts
 init_types();
-init_constants();
 
 class DeferAbortedError extends Error {
 }
@@ -105534,7 +105561,7 @@ function formatDeferralDateTime(target, now, tz) {
     zone = "UTC";
   }
   const t = partsInTz(target, zone);
-  const time = `${t.hour}:${t.minute}:${t.second}`;
+  const time = `${t.hour}:${t.minute}`;
   const n = partsInTz(now, zone);
   if (t.year === n.year && t.month === n.month && t.day === n.day)
     return { date: "today", time };
@@ -105552,22 +105579,26 @@ async function resolveRequesterTimezone(requestedByUserId) {
   }
   return { tz: "UTC", isFallback: true };
 }
-function renderShortDesc(note, max = 100) {
-  const firstLine = (note.split(`
-`)[0] ?? "").trim().replace(/^pending:\s*/i, "");
-  if (firstLine.length <= max)
-    return firstLine;
-  return `${firstLine.slice(0, max - 1).trimEnd()}…`;
+function joinNames(names) {
+  if (names.length < 2)
+    return names[0] ?? "";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
 }
-function renderHumanFacingDeferral(note, nextRunAt, scheduleId, tz, isFallbackTz) {
-  const now = new Date;
-  const target = new Date(nextRunAt);
-  const { date: date2, time } = formatDeferralDateTime(target, now, tz);
+function renderWaitingOn(agentNames, watchedCount) {
+  const named = joinNames([...new Set(agentNames.filter((name) => name.trim()))]);
+  if (named)
+    return named;
+  return `${watchedCount} task${watchedCount === 1 ? "" : "s"}`;
+}
+function renderWhen(nextRunAt, tz, isFallbackTz) {
+  const { date: date2, time } = formatDeferralDateTime(new Date(nextRunAt), new Date, tz);
   const timeLabel = isFallbackTz ? `${time} UTC` : time;
-  const shortId = scheduleId.slice(0, 8);
-  const link = `[${shortId}](${getAppUrl()}/schedules/${scheduleId})`;
-  const shortDesc = renderShortDesc(note);
-  return `Deferred until ${date2} ${timeLabel} (${link}) -> ${shortDesc}`;
+  const day = date2 === "today" || date2 === "tomorrow" ? date2 : `on ${date2}`;
+  return `${day} at ${timeLabel}`;
+}
+function renderHumanFacingDeferral(nextRunAt, tz, isFallbackTz, waitingOn) {
+  const when = renderWhen(nextRunAt, tz, isFallbackTz);
+  return waitingOn ? `Waiting on ${waitingOn} — or ${when} at the latest` : `Checking back ${when}`;
 }
 var registerDeferTaskTool = (server) => {
   createToolRegistrar(server)("defer-task", {
@@ -105650,6 +105681,7 @@ var registerDeferTaskTool = (server) => {
     const { tz: requesterTz, isFallback: isFallbackTz } = await resolveRequesterTimezone(task.requestedByUserId);
     try {
       const committed = await getDbClient().transaction(async () => {
+        const watchedAgentNames = [];
         for (const watchedId of watchedTaskIds) {
           if (watchedId === taskId)
             throw new DeferAbortedError("Cannot wake on the task being deferred.");
@@ -105658,6 +105690,9 @@ var registerDeferTaskTool = (server) => {
             throw new DeferAbortedError(`Watched task ${watchedId} not found.`);
           if (isTerminalTaskStatus(watched.status))
             throw new DeferAbortedError(`Watched task ${watchedId} is already ${watched.status}; read its result instead of deferring.`);
+          const watchedAgent = watched.agentId ? await getAgentById(watched.agentId) : null;
+          if (watchedAgent?.name)
+            watchedAgentNames.push(watchedAgent.name);
         }
         const schedule = await createScheduledTask({
           name: `deferred-${taskId.slice(0, 8)}-${Date.now()}-${crypto.randomUUID()}`,
@@ -105671,6 +105706,8 @@ var registerDeferTaskTool = (server) => {
           taskType: "deferred",
           tags: ["deferred"],
           priority: task.priority,
+          requestedDelayMs: delayMs,
+          requestedRunAt: runAt,
           modelTier: task.modelTier,
           parentTaskId: taskId,
           createdBy
@@ -105689,9 +105726,10 @@ var registerDeferTaskTool = (server) => {
         const deferralDetails = `${summary}
 
 Deferred until ${nextRunAt} (schedule ${schedule.id}). Pending: ${note}${checksBlock}`;
-        const terminalOutput = task.outputSchema ? output : renderHumanFacingDeferral(note, nextRunAt, schedule.id, requesterTz, isFallbackTz);
+        const terminalOutput = task.outputSchema ? output : renderHumanFacingDeferral(nextRunAt, requesterTz, isFallbackTz, wakeOn ? renderWaitingOn(watchedAgentNames, watchedTaskIds.length) : undefined);
         const completed = await completeTask(taskId, terminalOutput, {
-          addTags: ["deferred"]
+          addTags: ["deferred"],
+          deferredAt: new Date().toISOString()
         });
         if (!completed) {
           throw new DeferAbortedError(`Task ${taskId} reached a terminal state before this deferral committed.`);
@@ -106058,6 +106096,7 @@ var extensionListItemSchema = looseObject({
   name: string().optional(),
   version: number().optional(),
   activeVersion: number().optional(),
+  createdByAgentId: string().nullable().optional(),
   enabled: boolean().optional(),
   status: string().optional(),
   priority: number().optional(),
@@ -106068,6 +106107,7 @@ var extensionToolOutputSchema = swarmToolOutputSchema({
   name: string().optional(),
   version: number().optional(),
   activeVersion: number().optional(),
+  createdByAgentId: string().nullable().optional(),
   enabled: boolean().optional(),
   status: string().optional(),
   priority: number().optional(),
@@ -106083,6 +106123,7 @@ function coerceExtensionSummary(entry) {
   const extension = isRecord2(entry) ? entry : {};
   return {
     id: typeof extension.id === "string" ? extension.id : undefined,
+    createdByAgentId: typeof extension.createdByAgentId === "string" ? extension.createdByAgentId : null,
     name: typeof extension.name === "string" ? extension.name : undefined,
     version: typeof extension.version === "number" ? extension.version : undefined,
     activeVersion: typeof extension.activeVersion === "number" ? extension.activeVersion : undefined,
@@ -106207,7 +106248,7 @@ var registerExtensionEnableTool = (server) => {
 // src/tools/extension-install.ts
 init_zod();
 init_types();
-var EXTENSION_INSTALL_DESCRIPTION = "Validate and store a TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
+var EXTENSION_INSTALL_DESCRIPTION = "Any authenticated agent may create and install its own TypeScript extension bundle (manifest plus a files map with one hooks.ts). Fetch the hook contract first: GET /api/extensions/type-defs returns swarm-extension.d.ts with every event and modify shape. The installing agent is recorded as createdByAgentId. Workers may install subsequent versions only for their own extensions; those versions remain inactive. A new extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
 function extensionInstallResult(data, fallbackName) {
   const body = data;
   const extension = coerceExtensionSummary(body.extension);
@@ -106254,9 +106295,9 @@ function extensionListItems(data) {
   return data.extensions.map(coerceExtensionSummary);
 }
 function renderExtensionsTable(extensions) {
-  const header = "| Name | Version | Active | Enabled | Status | Priority | Failures |";
-  const divider = "| --- | ---: | ---: | --- | --- | ---: | ---: |";
-  const rows = extensions.map((extension) => `| ${extension.name ?? "?"} | ${extension.version ?? "?"} | ${extension.activeVersion ?? "?"} | ${extension.enabled ?? false} | ${extension.status ?? "unknown"} | ${extension.priority ?? "?"} | ${extension.consecutiveFailures ?? 0} |`);
+  const header = "| Name | Owner agent | Version | Active | Enabled | Status | Priority | Failures |";
+  const divider = "| --- | --- | ---: | ---: | --- | --- | ---: | ---: |";
+  const rows = extensions.map((extension) => `| ${extension.name ?? "?"} | ${extension.createdByAgentId ?? "operator/user"} | ${extension.version ?? "?"} | ${extension.activeVersion ?? "?"} | ${extension.enabled ?? false} | ${extension.status ?? "unknown"} | ${extension.priority ?? "?"} | ${extension.consecutiveFailures ?? 0} |`);
   return [header, divider, ...rows].join(`
 `);
 }
@@ -106661,7 +106702,7 @@ var registerJoinSwarmTool = (server) => {
     const agentId = requestInfo.agentId ?? requestedId ?? "";
     try {
       const agent = await getDbClient().transaction(async () => {
-        const agents = await getAllAgents();
+        const agents = await getAllAgents({ includeExtensions: true });
         const existingIdAgent = agents.find((agent3) => agent3.id === agentId);
         if (existingIdAgent) {
           throw new Error(`Agent with ID "${agentId}" already exists.`);
@@ -117032,7 +117073,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-zk1apkf6.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -117055,6 +117096,7 @@ Fix setup: ${getAppUrl()}${preflight.fixUrl}`),
 }
 
 // src/be/automation-preflight.ts
+init_config();
 init_db();
 var NEEDS_SETUP_PREFIX = "needs_setup:";
 function hasValue(value) {
@@ -117232,7 +117274,7 @@ async function getAutomationSetupStates() {
   const agentFsOrg = process.env.AGENT_FS_DEFAULT_ORG_ID ?? process.env.AGENT_FS_SHARED_ORG_ID;
   const gscConfigured = present(process.env.GSC_SERVICE_ACCOUNT_BASE64) || present(process.env.GSC_SERVICE_ACCOUNT_JSON);
   return {
-    slack: enabled(process.env.SLACK_DISABLE) && present(process.env.SLACK_BOT_TOKEN) && present(process.env.SLACK_APP_TOKEN) ? "verified" : "unverified",
+    slack: getSlackConfiguration().mode === "socket" && isSlackConfigured() ? "configured" : "unverified",
     github: present(process.env.GITHUB_WEBHOOK_SECRET) && present(process.env.GITHUB_APP_ID) && present(process.env.GITHUB_APP_PRIVATE_KEY) ? "verified" : "unverified",
     linear: linearTokens ? "verified" : "unverified",
     jira: jiraTokens && jiraCloudId ? "verified" : "unverified",
@@ -117774,7 +117816,23 @@ async function startWorkflowExecution(workflow, triggerData, registry, options =
   await walkGraph(workflow.definition, runId, ctx, entryNodes, registry, workflow.id, secretKeys, options);
   return runId;
 }
+var activeWalks = new Map;
+function isWorkflowRunActive(runId) {
+  return activeWalks.has(runId);
+}
 async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
+  try {
+    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
+  } finally {
+    const remaining = activeWalks.get(runId) - 1;
+    if (remaining === 0)
+      activeWalks.delete(runId);
+    else
+      activeWalks.set(runId, remaining);
+  }
+}
+async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
   if (!options.requestedByUserId) {
     options = {
       ...options,
@@ -119062,7 +119120,7 @@ async function recoverIncompleteRuns(registry) {
   recovered += await recoverApprovalWaitingRuns(registry);
   recovered += await recoverWaitStates(registry);
   if (recovered > 0) {
-    console.log(`[workflows] Recovered ${recovered} incomplete run(s) on startup`);
+    console.log(`[workflows] Recovered ${recovered} incomplete run(s)`);
   }
   return recovered;
 }
@@ -119071,6 +119129,8 @@ async function recoverRunningRuns(registry) {
   let recovered = 0;
   for (const runId of runningRunIds) {
     try {
+      if (isWorkflowRunActive(runId))
+        continue;
       const run = await getWorkflowRun(runId);
       if (!run || run.status !== "running")
         continue;
@@ -119080,6 +119140,8 @@ async function recoverRunningRuns(registry) {
       const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
       const ctx = run.context ?? {};
       const readyNodes = findReadyNodes(workflow.definition, completedNodeIds);
+      if (isWorkflowRunActive(runId))
+        continue;
       if (readyNodes.length === 0) {
         await updateWorkflowRun(runId, {
           status: "completed",
@@ -120177,7 +120239,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+          const { getSlackApp: getSlackApp2 } = await import("./app-zk1apkf6.js");
           const slackApp = getSlackApp2();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -120297,7 +120359,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-p8teva95.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-zk1apkf6.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -121604,6 +121666,9 @@ var registerCreateScheduleTool = (server) => {
       if (!agent) {
         return toolErr(`Target agent not found: ${targetAgentId}`);
       }
+      if (isExtensionAgent(agent)) {
+        return toolErr(extensionAgentAssignmentError(agent));
+      }
     }
     const resolvedTargetType = targetType ?? "agent-task";
     if (resolvedTargetType === "agent-task" && !taskTemplate) {
@@ -122142,6 +122207,9 @@ var registerPatchScheduleTool = (server) => {
       if (!agent) {
         return toolErr(`Target agent not found: ${targetAgentId}`);
       }
+      if (isExtensionAgent(agent)) {
+        return toolErr(extensionAgentAssignmentError(agent));
+      }
     }
     if (newName && newName !== schedule.name) {
       const existing = await getScheduledTaskByName(newName);
@@ -122429,6 +122497,9 @@ var registerUpdateScheduleTool = (server) => {
       if (!agent) {
         return toolErr(`Target agent not found: ${targetAgentId}`);
       }
+      if (isExtensionAgent(agent)) {
+        return toolErr(extensionAgentAssignmentError(agent));
+      }
     }
     if (newName && newName !== schedule.name) {
       const existing = await getScheduledTaskByName(newName);
@@ -123634,6 +123705,9 @@ async function sendTaskHandler(ctx, {
         message: `Agent with ID "${targetAgentId}" not found.`
       };
     }
+    if (isExtensionAgent(agent)) {
+      return { success: false, message: extensionAgentAssignmentError(agent) };
+    }
     if (taskOptions.routingAffinity?.leadOnly && !agent.isLead) {
       return {
         success: false,
@@ -129105,7 +129179,8 @@ function hasCapability(cap) {
   return getCapabilities().has(cap);
 }
 function getEnabledCapabilities() {
-  return Array.from(getCapabilities());
+  const capabilities = Array.from(getCapabilities());
+  return getSlackConfiguration().mode === "socket" ? capabilities : capabilities.filter((capability) => capability !== "slack");
 }
 function isScriptsOnlyMcp() {
   return resolveScriptsOnlyMode({ env: process.env.SCRIPTS_ONLY_MCP });
@@ -130228,7 +130303,7 @@ function extensionAgentName(name) {
 async function ensureExtensionAgent(name) {
   const agentName = extensionAgentName(name);
   return await getDbClient().transaction(async () => {
-    let agent = (await getAllAgents()).find((candidate) => candidate.name === agentName);
+    let agent = (await getAllAgents({ includeExtensions: true })).find((candidate) => candidate.name === agentName);
     if (!agent) {
       agent = await createAgent({
         name: agentName,
@@ -130244,14 +130319,14 @@ async function ensureExtensionAgent(name) {
       await updateAgentMaxTasks(agent.id, 0);
     await updateAgentProfile(agent.id, {
       description: `System agent for extension ${name}`,
-      role: "extension",
+      role: EXTENSION_AGENT_ROLE,
       capabilities: []
-    });
+    }, undefined, { allowExtensionRole: true });
     return agent.id;
   });
 }
 async function deactivateExtensionAgent(name) {
-  const agent = (await getAllAgents()).find((candidate) => candidate.name === extensionAgentName(name));
+  const agent = (await getAllAgents({ includeExtensions: true })).find((candidate) => candidate.name === extensionAgentName(name));
   if (agent && agent.status !== "offline")
     await updateAgentStatus(agent.id, "offline");
 }
@@ -130540,25 +130615,18 @@ function maxUpdatedAt(extensions) {
   return extensions.reduce((latest, extension) => extension.updatedAt > latest ? extension.updatedAt : latest, "");
 }
 async function loadableExtension(record3) {
-  if (record3.activeVersion !== record3.version) {
-    const version = await getExtensionVersion(record3.id, record3.activeVersion);
-    if (!version) {
-      throw new ExtensionLifecycleError(`Extension version ${record3.activeVersion} was not found`, 404);
-    }
-    return {
-      record: {
-        ...record3,
-        manifestJson: version.manifestJson,
-        contentHash: version.contentHash
-      },
-      manifest: ExtensionManifestSchema.parse(JSON.parse(version.manifestJson)),
-      files: JSON.parse(version.filesJson)
-    };
+  const version = await getExtensionVersion(record3.id, record3.activeVersion);
+  if (!version) {
+    throw new ExtensionLifecycleError(`Extension version ${record3.activeVersion} was not found`, 404);
   }
   return {
-    record: record3,
-    manifest: ExtensionManifestSchema.parse(JSON.parse(record3.manifestJson)),
-    files: await getExtensionFiles(record3.id)
+    record: {
+      ...record3,
+      manifestJson: version.manifestJson,
+      contentHash: version.contentHash
+    },
+    manifest: ExtensionManifestSchema.parse(JSON.parse(version.manifestJson)),
+    files: JSON.parse(version.filesJson)
   };
 }
 async function removeRegistered(id2) {
@@ -131183,4 +131251,4 @@ async function dispatchPost(event, payload, opts) {
   }
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, installExtension, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, deleteExtension, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, TaskCreationBlockedError, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, validateJsonSchema, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, ExtensionOwnershipError, installExtension, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, deleteExtension, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, TaskCreationBlockedError, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, validateJsonSchema, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };