@desplega.ai/agent-swarm 1.156.0 → 1.158.0

package/dist/{http-phnf93hp.js → http-2eqa8t24.js}

@@ -1,22 +1,18 @@
 import {
   BROWSER_SDK_JS,
   SWARM_UI_JS
-} from "./cli-2daksqps.js";
+} from "./cli-t1ze64h3.js";
 import {
   ACP_TARGET_IDS
 } from "./cli-dgnj0zcc.js";
 import {
   SIMILARITY_THRESHOLD,
+  memoryRelevance,
   writeSkillsToFilesystem
-} from "./cli-tjmghmm5.js";
+} from "./cli-q67y4wzm.js";
 import {
   Anthropic
 } from "./cli-j490egb5.js";
-import {
-  checkHeartbeatChecklist,
-  runHeartbeatSweep,
-  stopHeartbeat
-} from "./cli-s8hpxeg4.js";
 import {
   isClaudeBridgeEffective,
   resolveClaudeTransport
@@ -26,11 +22,16 @@ import {
 } from "./cli-npssxgaz.js";
 import {
   reasoningCapability
-} from "./cli-avkd6mqv.js";
+} from "./cli-h967nb6r.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-szcyv1mm.js";
+} from "./cli-xhaeg2nc.js";
+import {
+  checkHeartbeatChecklist,
+  runHeartbeatSweep,
+  stopHeartbeat
+} from "./cli-rqz8qbw7.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -70,6 +71,7 @@ import {
   calculateNextRun,
   canClaim,
   canReadMemory,
+  cancelApprovalRequest,
   cancelTaskHandler,
   cancelTaskInputSchema,
   cancelTaskOutputSchema,
@@ -78,6 +80,7 @@ import {
   checkOutputSchemaShape,
   clearJiraMetadata,
   closeRooms,
+  createApprovalFollowUpTask,
   createEvent,
   createEventsBatch,
   createResumeFollowUp,
@@ -285,7 +288,7 @@ import {
   verifyWebhookSignature,
   warnIfCorsAllowsAnyOrigin,
   wireHttpSpanLifecycle
-} from "./cli-9pyah9c4.js";
+} from "./cli-ftfvggzx.js";
 import"./cli-0z2v4nhw.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -307,15 +310,9 @@ import {
 } from "./cli-re8z5p8p.js";
 import"./cli-3dpj7atn.js";
 import"./cli-aw1jwp1r.js";
-import {
-  getModelsCatalog
-} from "./cli-hc2fkhdv.js";
-import {
-  normalizeModelKey
-} from "./cli-t1cd3mhp.js";
 import {
   getUserGrant
-} from "./cli-jk26c1sz.js";
+} from "./cli-aky8tctm.js";
 import {
   LEGACY_RULES,
   can,
@@ -323,7 +320,13 @@ import {
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-ytxs7mn1.js";
+} from "./cli-g8djp6qe.js";
+import {
+  getModelsCatalog
+} from "./cli-ws6rqycm.js";
+import {
+  normalizeModelKey
+} from "./cli-wscdvcqz.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -415,7 +418,7 @@ import {
   upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-nyqza443.js";
+} from "./cli-fgqxwrpv.js";
 import"./cli-epan13p1.js";
 import {
   detachedProcessGroup,
@@ -429,7 +432,7 @@ import {
 } from "./cli-f14fvzag.js";
 import {
   searchScripts
-} from "./cli-28wkjpdp.js";
+} from "./cli-987hg0aa.js";
 import {
   acquireOAuthRefreshLock,
   buildAuthorizationUrl,
@@ -453,7 +456,7 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-90x9ewbz.js";
+} from "./cli-53sz8gkz.js";
 import {
   FilesError,
   getFileStorageProvider,
@@ -467,8 +470,8 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-08n8jxcw.js";
-import"./cli-nbp6m6gp.js";
+} from "./cli-65hjmev5.js";
+import"./cli-xberxa1r.js";
 import"./cli-bsakbbkm.js";
 import"./cli-fad8m16k.js";
 import"./cli-51tf7ac3.js";
@@ -480,7 +483,9 @@ import {
   TaskCitationSchema,
   ensure,
   getSlackApp,
+  getSlackConnectionState,
   getTaskCitations,
+  getTaskCitationsForTasks,
   initOtel,
   initialize,
   isPollTracingEnabled,
@@ -493,7 +498,7 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-7vj52450.js";
+} from "./cli-j57qkrpq.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
 import"./cli-2658f6at.js";
@@ -580,6 +585,7 @@ import {
   getActivePricingRow,
   getActiveSessions,
   getAgentById,
+  getAgentDailyTaskCounts,
   getAgentHarnessProviders,
   getAgentMcpServers,
   getAgentSkills,
@@ -668,6 +674,7 @@ import {
   getTaskById,
   getTaskStats,
   getTaskSteeringFields,
+  getTaskSteeringFieldsForTasks,
   getTasksCount,
   getUnassignedTaskIdsForAgent,
   getUsageDataVersion,
@@ -710,6 +717,7 @@ import {
   listAgentsWithCredStatusByProvider,
   listAllMetrics,
   listAllPages,
+  listApprovalRequestSummaries,
   listApprovalRequests,
   listAssetSummaries,
   listFavorites,
@@ -724,7 +732,6 @@ import {
   listSkillFileManifest,
   listSkills,
   listTaskTemplates,
-  listWorkflowRuns,
   listWorkflowRunsPage,
   listWorkflows,
   markKeyRateLimited,
@@ -801,7 +808,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-24w39x6n.js";
+} from "./cli-47m6dkd3.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -918,6 +925,7 @@ import {
   WorkflowRunSchema,
   WorkflowRunStatusSchema,
   WorkflowRunStepSchema,
+  WorkflowRunSummarySchema,
   WorkflowSchema,
   WorkflowVersionSchema,
   init_bundle_path,
@@ -926,7 +934,7 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-h0wdadsx.js";
+} from "./cli-4198qc9v.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
@@ -988,7 +996,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-865swy5p.js";
+} from "./cli-c07r9a2m.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -3584,6 +3592,25 @@ var listAgentRuntimeInstances = route({
     404: { description: "Agent not found" }
   }
 });
+var getAgentTaskActivity = route({
+  method: "get",
+  path: "/api/agents/{id}/task-activity",
+  pattern: ["api", "agents", null, "task-activity"],
+  summary: "Daily task counts for an agent",
+  description: "Number of tasks created for the agent per UTC day over the last `days` days (default 365, max 730), oldest first. Days with no tasks are omitted. Backs the activity heatmap on the agent page.",
+  tags: ["Agents"],
+  params: exports_external.object({ id: exports_external.string() }),
+  query: exports_external.object({ days: exports_external.coerce.number().int().min(1).max(730).optional() }),
+  responses: {
+    200: {
+      description: "Daily task counts",
+      schema: exports_external.object({
+        days: exports_external.array(exports_external.object({ date: exports_external.string(), count: exports_external.number().int() }))
+      })
+    },
+    404: { description: "Agent not found" }
+  }
+});
 var ContentHashSchema = exports_external.string().regex(/^[0-9a-f]{64}$/, "sha256 hex");
 var ProfileSyncRejectionSchema = exports_external.object({
   field: exports_external.enum(["soulMd", "identityMd", "claudeMd", "toolsMd"]),
@@ -3890,6 +3917,19 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
     });
     return true;
   }
+  if (getAgentTaskActivity.match(req.method, pathSegments)) {
+    const parsed = await getAgentTaskActivity.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await getAgentById(parsed.params.id)) {
+      jsonError(res, "Agent not found", 404);
+      return true;
+    }
+    getAgentTaskActivity.respond(res, 200, {
+      days: await getAgentDailyTaskCounts(parsed.params.id, parsed.query.days ?? 365)
+    });
+    return true;
+  }
   if (updateAgentProfileRoute.match(req.method, pathSegments)) {
     const parsed = await updateAgentProfileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -4850,7 +4890,6 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
 // src/http/approval-requests.ts
 init_zod();
 init_db();
-init_resolver();
 init_request_auth_context();
 init_event_bus();
 var QuestionSchema = exports_external.object({
@@ -4900,6 +4939,13 @@ var ApprovalRequestSchema = exports_external.object({
   createdAt: exports_external.string(),
   updatedAt: exports_external.string()
 });
+var ApprovalRequestSummarySchema = ApprovalRequestSchema.omit({
+  questions: true,
+  approvers: true,
+  responses: true,
+  resolutionReason: true,
+  notificationChannels: true
+}).extend({ questionCount: exports_external.number().int() });
 function toApprovalRequestResponse(request) {
   return {
     ...request,
@@ -4976,7 +5022,7 @@ var createRoute = route({
     workflowRunId: exports_external.string().uuid().optional(),
     workflowRunStepId: exports_external.string().uuid().optional(),
     sourceTaskId: exports_external.string().uuid().optional(),
-    timeoutSeconds: exports_external.number().int().min(1).optional(),
+    timeoutSeconds: exports_external.number().int().min(1).optional().describe("Seconds until the request expires. After that the request becomes 'timeout' and you get a hitl-follow-up task. A request with no timeout is cancelled after APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS days (default 7)."),
     notifications: exports_external.array(exports_external.object({
       channel: exports_external.enum(["slack", "email"]),
       target: exports_external.string()
@@ -5029,21 +5075,54 @@ var respondRoute = route({
   },
   auth: { apiKey: true }
 });
+var cancelRoute = route({
+  method: "post",
+  path: "/api/approval-requests/{id}/cancel",
+  pattern: ["api", "approval-requests", null, "cancel"],
+  summary: "Cancel a pending approval request",
+  tags: ["ApprovalRequests"],
+  params: exports_external.object({ id: exports_external.string().uuid() }),
+  body: exports_external.object({ reason: exports_external.string().max(500).optional() }),
+  responses: {
+    200: {
+      description: "Request cancelled, or already cancelled. A request that gates a running or waiting workflow run cancels that run too.",
+      schema: exports_external.object({
+        approvalRequest: ApprovalRequestSchema,
+        alreadyCancelled: exports_external.boolean(),
+        runCancelled: exports_external.boolean()
+      })
+    },
+    403: { description: "Caller may not cancel this request" },
+    404: { description: "Not found" },
+    409: {
+      description: "Already resolved with approved, rejected, or timeout, or its expiresAt passed"
+    }
+  },
+  auth: { apiKey: true },
+  rbac: { permission: "approval.cancel.any" }
+});
 var listRoute = route({
   method: "get",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
   summary: "List approval requests with optional filters",
+  description: "Returns full approval requests by default. Pass `fields=slim` for the list-view shape: `questions`, `approvers`, `responses`, `resolutionReason` and `notificationChannels` are dropped and `questionCount` is added. Fetch one request in full via `GET /api/approval-requests/{id}`.",
   tags: ["ApprovalRequests"],
   query: exports_external.object({
     status: exports_external.string().optional(),
     workflowRunId: exports_external.string().optional(),
-    limit: exports_external.coerce.number().optional()
+    limit: exports_external.coerce.number().optional(),
+    fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
     200: {
       description: "List of approval requests",
-      schema: exports_external.object({ approvalRequests: exports_external.array(ApprovalRequestSchema) })
+      schema: exports_external.object({
+        approvalRequests: exports_external.union([
+          exports_external.array(ApprovalRequestSchema),
+          exports_external.array(ApprovalRequestSummarySchema)
+        ])
+      })
     }
   },
   auth: { apiKey: true }
@@ -5063,6 +5142,19 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
       jsonError(res, `Approval request already resolved with status: ${existing.status}${reason}`, 409);
       return true;
     }
+    if (existing.expiresAt && new Date(existing.expiresAt) < new Date) {
+      await getDbClient().transaction(async () => {
+        const timedOut = await resolveApprovalRequest(existing.id, {
+          status: "timeout",
+          resolutionReason: `Timed out: the answer arrived after the deadline ${existing.expiresAt}`
+        });
+        if (timedOut && !existing.workflowRunId) {
+          await createApprovalFollowUpTask(timedOut, "hitl.timeout");
+        }
+      });
+      jsonError(res, `Approval request expired at ${existing.expiresAt}`, 409);
+      return true;
+    }
     const unavailableReason = await getWorkflowApprovalUnavailableReason(existing);
     if (unavailableReason) {
       jsonError(res, unavailableReason, 409);
@@ -5104,33 +5196,32 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
         workflowRunStepId: updated.workflowRunStepId
       });
     }
-    if (!updated.workflowRunId && updated.sourceTaskId) {
-      const sourceTask = await getTaskById(updated.sourceTaskId);
-      if (sourceTask) {
-        const formattedResponses = formatResponses(updated.questions, updated.responses);
-        const { text: taskText } = resolveTemplate("hitl.follow_up", {
-          request_id: updated.id,
-          title: updated.title,
-          status: updated.status,
-          responses: formattedResponses
-        });
-        await createTaskExtended(taskText, {
-          agentId: sourceTask.agentId,
-          routingReason: sourceTask.agentId ? "continuity" : undefined,
-          routingSource: sourceTask.agentId ? "engine_default" : undefined,
-          parentTaskId: updated.sourceTaskId,
-          source: "system",
-          taskType: "hitl-follow-up",
-          tags: ["hitl", "follow-up"],
-          slackChannelId: sourceTask.slackChannelId ?? undefined,
-          slackThreadTs: sourceTask.slackThreadTs ?? undefined,
-          slackUserId: sourceTask.slackUserId ?? undefined
-        });
-      }
-    }
+    await createApprovalFollowUpTask(updated, "hitl.follow_up");
     respondRoute.respond(res, 200, { approvalRequest: toApprovalRequestResponse(updated) });
     return true;
   }
+  if (cancelRoute.match(req.method, pathSegments)) {
+    const parsed = await cancelRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { principal, resolvedBy } = await approvalCancelPrincipal(req);
+    const result = await cancelApprovalRequest({
+      id: parsed.params.id,
+      reason: parsed.body.reason,
+      principal,
+      resolvedBy
+    });
+    if (!result.ok) {
+      jsonError(res, result.message, result.status);
+      return true;
+    }
+    cancelRoute.respond(res, 200, {
+      approvalRequest: toApprovalRequestResponse(result.request),
+      alreadyCancelled: result.alreadyCancelled,
+      runCancelled: result.runCancelled
+    });
+    return true;
+  }
   if (getByIdRoute.match(req.method, pathSegments)) {
     const parsed = await getByIdRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -5171,11 +5262,18 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
     const parsed = await listRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const requests = await listApprovalRequests({
+    const filters = {
       status: parsed.query.status || undefined,
       workflowRunId: parsed.query.workflowRunId || undefined,
       limit: parsed.query.limit || undefined
-    });
+    };
+    if (parsed.query.fields === "slim") {
+      listRoute.respond(res, 200, {
+        approvalRequests: await listApprovalRequestSummaries(filters)
+      });
+      return true;
+    }
+    const requests = await listApprovalRequests(filters);
     listRoute.respond(res, 200, {
       approvalRequests: requests.map(toApprovalRequestResponse)
     });
@@ -5183,25 +5281,21 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
   }
   return false;
 }
-function formatResponses(questions, responses) {
-  return questions.map((q) => {
-    const answer = responses[q.id];
-    let answerText;
-    if (answer == null) {
-      answerText = "(no answer)";
-    } else if (q.type === "approval") {
-      const a = answer;
-      answerText = a.approved ? "Approved" : "Rejected";
-      if (a.comment)
-        answerText += ` — ${a.comment}`;
-    } else if (typeof answer === "object") {
-      answerText = JSON.stringify(answer);
-    } else {
-      answerText = String(answer);
-    }
-    return `- ${q.label}: ${answerText}`;
-  }).join(`
-`);
+async function approvalCancelPrincipal(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "user") {
+    return { principal: { kind: "user", userId: auth.userId }, resolvedBy: auth.userId };
+  }
+  const rawAgentId = req.headers["x-agent-id"];
+  const agentId = auth?.kind === "agent" ? auth.agentId : Array.isArray(rawAgentId) ? rawAgentId[0] : rawAgentId;
+  if (agentId) {
+    const agent = await getAgentById(agentId);
+    return {
+      principal: { kind: "agent", agentId, isLead: agent?.isLead ?? false },
+      resolvedBy: agentId
+    };
+  }
+  return { principal: { kind: "operator" }, resolvedBy: "operator" };
 }
 
 // src/http/assets.ts
@@ -6363,6 +6457,7 @@ var getResolvedConfigRoute = route({
   query: exports_external.object({
     agentId: exports_external.string().optional(),
     repoId: exports_external.string().optional(),
+    key: exports_external.string().min(1).optional().describe("Return only the entry with this exact key. Omit to return every resolved entry."),
     includeSecrets: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
@@ -6439,6 +6534,7 @@ var listConfig = route({
   query: exports_external.object({
     scope: exports_external.string().optional(),
     scopeId: exports_external.string().optional(),
+    key: exports_external.string().min(1).optional().describe("Return only entries with this exact key. Omit to return every entry."),
     includeSecrets: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
@@ -6495,7 +6591,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
     const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
-    const configs = stripApiOnlyKeys(await getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined));
+    const key = parsed.query.key;
+    const configs = stripApiOnlyKeys(await getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined)).filter((c) => !key || c.key === key);
     const result = effectiveIncludeSecrets ? configs : maskSecrets(configs);
     if (effectiveIncludeSecrets) {
       for (const c of result) {
@@ -6568,7 +6665,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(await getSwarmConfigs({
       scope: parsed.query.scope || undefined,
-      scopeId: parsed.query.scopeId || undefined
+      scopeId: parsed.query.scopeId || undefined,
+      key: parsed.query.key
     }));
     const listResult = effectiveIncludeSecrets ? configs : maskSecrets(configs);
     if (effectiveIncludeSecrets) {
@@ -7258,13 +7356,20 @@ var getEventsRoute = route({
     dataField: exports_external.string().optional(),
     since: exports_external.string().optional(),
     until: exports_external.string().optional(),
-    limit: exports_external.coerce.number().int().min(1).max(1000).optional()
+    limit: exports_external.coerce.number().int().min(1).max(1000).optional(),
+    events: exports_external.string().optional().describe("Comma-separated event names; matches any of them (ANDed with `event`)"),
+    dataFields: exports_external.string().optional().describe("Comma-separated `data.field` values, used with latestPerDataField"),
+    latestPerDataField: exports_external.enum(["true", "false"]).optional().describe("When true, return only the newest event per (event, data.field) pair for every name in `event`/`events` and every value in `dataFields`")
   }),
   responses: {
     200: {
       description: "List of events",
-      schema: exports_external.object({ events: exports_external.array(SwarmEventSchema) })
-    }
+      schema: exports_external.object({
+        events: exports_external.array(SwarmEventSchema),
+        latestPerDataField: exports_external.literal(true).optional().describe("Present only when the request asked for latestPerDataField=true")
+      })
+    },
+    400: { description: "Validation error" }
   },
   auth: { apiKey: true }
 });
@@ -7293,6 +7398,7 @@ var getEventCountsRoute = route({
   },
   auth: { apiKey: true }
 });
+var MAX_LATEST_PAIRS = 50;
 async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
   if (createEventsBatchRoute.match(req.method, pathSegments)) {
     const parsed = await createEventsBatchRoute.parse(req, res, pathSegments, queryParams);
@@ -7340,6 +7446,20 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
     const parsed = await getEventsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const eventNames = parsed.query.events ? parsed.query.events.split(",").map((name) => EventNameSchema.safeParse(name.trim())) : [];
+    const invalid = eventNames.find((result) => !result.success);
+    if (invalid) {
+      jsonError(res, "Invalid event name in `events`", 400);
+      return true;
+    }
+    const eventFilter = eventNames.flatMap((result) => result.success ? [result.data] : []);
+    const latestPerDataField = parsed.query.latestPerDataField === "true";
+    const dataFields = (parsed.query.dataFields ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+    const latestEvents = eventFilter.length > 0 ? eventFilter : parsed.query.event ? [parsed.query.event] : [];
+    if (latestPerDataField && (latestEvents.length === 0 || dataFields.length === 0 || latestEvents.length * dataFields.length > MAX_LATEST_PAIRS)) {
+      jsonError(res, `latestPerDataField needs \`event\` or \`events\` and \`dataFields\`, at most ${MAX_LATEST_PAIRS} pairs`, 400);
+      return true;
+    }
     const events = await getEventsFiltered({
       category: parsed.query.category || undefined,
       event: parsed.query.event || undefined,
@@ -7351,9 +7471,11 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
       dataField: parsed.query.dataField || undefined,
       since: parsed.query.since || undefined,
       until: parsed.query.until || undefined,
-      limit: parsed.query.limit ?? 100
+      limit: parsed.query.limit ?? 100,
+      events: eventFilter,
+      latestPerDataField: latestPerDataField ? { events: latestEvents, dataFields } : undefined
     });
-    getEventsRoute.respond(res, 200, { events });
+    getEventsRoute.respond(res, 200, latestPerDataField ? { events, latestPerDataField: true } : { events });
     return true;
   }
   return false;
@@ -7433,6 +7555,7 @@ declare module "swarm-extension" {
     outputSchema?: Record<string, unknown> | undefined;
     inheritParentOutputSchema?: boolean | undefined;
     inheritParentRoutingAffinity?: boolean | undefined;
+    inheritParentFollowUpConfig?: boolean | undefined;
     followUpConfig?:
       | {
           disabled?: boolean | undefined;
@@ -8049,6 +8172,78 @@ void _configIsValid;
 
 // src/extensions/catalog.generated.json
 var catalog_generated_default = {
+  "github-sender-allowlist": {
+    manifestFile: "manifest.json",
+    manifest: {
+      $schema: "../manifest.schema.json",
+      name: "github-sender-allowlist",
+      description: "Blocks GitHub webhook tasks from senders outside configured allowlists",
+      version: "1.0.0",
+      runtime: "api",
+      assets: {
+        hooks: "hooks.ts"
+      }
+    },
+    files: {
+      "hooks.ts": `import { block, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({
+  internal: z.array(z.string()).default([]),
+  external: z.array(z.string()).default([]),
+  reviewBots: z.array(z.string()).default([]),
+  exemptTaskTypes: z.array(z.string()).default([]),
+});
+
+const manifest = {
+  name: "github-sender-allowlist",
+  description: "Blocks GitHub webhook tasks from senders outside configured allowlists",
+  version: "1.0.0",
+  runtime: "api",
+  assets: { hooks: "hooks.ts" },
+  config,
+} as const;
+
+function includesLogin(logins: string[], login: string): boolean {
+  return logins.some((allowed) => allowed.toLowerCase() === login.toLowerCase());
+}
+
+const extension: SwarmExtension<typeof manifest> = (api) => {
+  api.on("pre.task.create", (event, ctx) => {
+    const { options } = event;
+    if (options.source !== "github") return;
+
+    const taskType = options.taskType ?? "unknown";
+    const login = options.vcsAuthor ?? "";
+    if (includesLogin(ctx.config.internal, login)) return;
+
+    const isReviewBot = includesLogin(ctx.config.reviewBots, login);
+    if (isReviewBot && taskType === "github-review") return;
+    if (!isReviewBot && ctx.config.exemptTaskTypes.includes(taskType)) return;
+
+    const isPullRequest = options.vcsUrl?.includes("/pull/") ?? false;
+    const isExternalPullRequestTask =
+      (taskType === "github-comment" || taskType === "github-pr" || taskType === "github-review") &&
+      isPullRequest;
+    const isExternalSender = includesLogin(ctx.config.external, login);
+    if (!isReviewBot && isExternalSender && isExternalPullRequestTask) return;
+
+    const rule = isReviewBot
+      ? "review bots are allowed only for github-review tasks"
+      : isExternalSender
+        ? "external senders are allowed only for PR comments, reviews, and github-pr tasks on pull requests"
+        : "sender is not on the internal, external, or reviewBots allowlist";
+    const reason = \`GitHub sender "\${login || "unknown"}" is blocked: \${rule}.\`;
+    ctx.log.warn(reason, { login: login || null, taskType, vcsUrl: options.vcsUrl ?? null });
+    return block(reason);
+  });
+};
+
+export default extension;
+`
+    },
+    readme: '# github-sender-allowlist\n\nBlocks GitHub webhook tasks from senders outside the configured allowlists. Login matching is case-insensitive. Tasks from other sources pass through. No task type is exempt by default.\n\nConfig:\n\n```json\n{\n  "internal": ["tarasyarema", "harlequinetcie"],\n  "external": ["fuvidani", "capchase-bot"],\n  "reviewBots": [],\n  "exemptTaskTypes": []\n}\n```\n\nInternal senders can create any GitHub task, including reviews. Logins in `reviewBots` can create `github-review` tasks only. External senders can create `github-comment` or `github-pr` tasks on pull requests, and `github-review` tasks when `vcsUrl` contains `/pull/`. Choose any review-bot logins from the sender census in the [security audit](https://live.agent-fs.dev/file/~/648a5f3c-35c8-4f11-8673-b89de52cd6bd/2faf73ba-4eee-4472-8b3b-359c4ed6bfbb/thoughts/a09d19a4-bd35-4593-9b6f-c2ccafccead8/reviews/2026-09-28-github-sender-authorization-audit.md) when installing the extension; the template intentionally defaults to an empty list.\n\n`exemptTaskTypes` is an optional operator override for explicitly exempting task types. It defaults to an empty list. The GitHub handler does not pass the action for `github-pr` tasks, so external `github-pr` access also permits assignment and label events on pull requests.\n'
+  },
   "notify-on-complete": {
     manifestFile: "manifest.json",
     manifest: {
@@ -14072,18 +14267,20 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
         source,
         isLead: false
       });
-      const ranked = rerank(expanded, { limit: Math.min(limit, 20) });
+      const resultLimit = Math.min(limit, 20);
+      const consumptionHeader = req.headers["x-memory-consumption"];
+      const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
+      const ranked = consumptionMode === "prompt" ? rerank(expanded, { limit: expanded.length }).map((r) => ({ r, eligible: memoryRelevance(r) > SIMILARITY_THRESHOLD })).sort((a, b) => Number(b.eligible) - Number(a.eligible)).slice(0, resultLimit).map(({ r }) => r) : rerank(expanded, { limit: resultLimit });
       const sourceTaskIdHeader = req.headers["x-source-task-id"];
       const sourceTaskId = Array.isArray(sourceTaskIdHeader) ? sourceTaskIdHeader[0] : sourceTaskIdHeader;
       const contextKeyHeader = req.headers["x-context-key"];
       const contextKey = Array.isArray(contextKeyHeader) ? contextKeyHeader[0] : contextKeyHeader;
-      const consumptionHeader = req.headers["x-memory-consumption"];
-      const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
       if (sourceTaskId && intent) {
         try {
           await recordRetrievals(sourceTaskId, myAgentId, ranked.map((r) => ({
             memoryId: r.id,
             similarity: r.similarity,
+            relevance: r.rawSimilarity,
             retrievalSource: r.retrievalSource
           })), undefined, { intent, contextKey, eventType: "search" });
         } catch (err) {
@@ -14092,7 +14289,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
       }
       let consumedIds = [];
       if (intent) {
-        const consumed = consumptionMode === "prompt" ? ranked.filter((r) => r.similarity > SIMILARITY_THRESHOLD) : ranked;
+        const consumed = consumptionMode === "prompt" ? ranked.filter((r) => memoryRelevance(r) > SIMILARITY_THRESHOLD) : ranked;
         consumedIds = dedupeMemoryDocumentIds(consumed);
         try {
           await recordMemoryAccesses(consumedIds);
@@ -15803,11 +16000,19 @@ function slackMilestone(state) {
       action_url: automationIntegrationFixUrl("slack")
     };
   }
+  if (config.mode === "socket" && getSlackConnectionState() === "connected") {
+    return {
+      id: "slack",
+      label: "Slack configured",
+      state: "verified",
+      action_url: automationIntegrationFixUrl("slack")
+    };
+  }
   return {
     id: "slack",
     label: "Slack configured",
     state: "configured",
-    hint: config.mode === "http" ? "HTTP credentials are configured, but HTTP ingress is unavailable until the receiver is installed." : "Socket Mode credentials are configured; a live connection has not been verified.",
+    hint: config.mode === "http" ? "HTTP credentials are configured, but HTTP ingress is unavailable until the receiver is installed." : "Socket Mode credentials are configured, but the bot is not connected to Slack.",
     action_url: automationIntegrationFixUrl("slack")
   };
 }
@@ -23348,7 +23553,7 @@ var createSessionCostRoute = route({
     model: exports_external.string().optional(),
     models: exports_external.array(SessionCostModelBreakdownSchema.omit({ costUsd: true })).optional(),
     isError: exports_external.boolean().optional(),
-    provider: exports_external.enum(["claude", "claude-managed", "codex", "pi", "opencode", "devin", "gemini", "acp"]).optional(),
+    provider: PricingProviderSchema.optional(),
     createdAt: exports_external.number().int().nonnegative().optional()
   }),
   responses: {
@@ -23700,6 +23905,7 @@ var listSessions = route({
     source: exports_external.string().optional(),
     q: exports_external.string().optional(),
     requestedByUserId: exports_external.string().min(1).optional(),
+    contextKeyPrefix: exports_external.string().min(1).optional(),
     fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
@@ -23773,13 +23979,15 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       offset: parsed.query.offset,
       source: sources,
       q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId
+      requestedByUserId: parsed.query.requestedByUserId,
+      contextKeyPrefix: parsed.query.contextKeyPrefix
     };
     const sessions = parsed.query.fields === "full" ? await listRecentSessions(baseOpts) : await listRecentSessions({ ...baseOpts, slim: true });
     const total = await countSessions({
       source: sources,
       q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId
+      requestedByUserId: parsed.query.requestedByUserId,
+      contextKeyPrefix: parsed.query.contextKeyPrefix
     });
     listSessions.respond(res, 200, {
       sessions,
@@ -23799,18 +24007,17 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       return true;
     }
     const chain = await getRootTaskChain(parsed.params.rootTaskId);
-    getSession.respond(res, 200, {
-      root: {
-        ...root,
-        ...await getTaskSteeringFields(root),
-        citations: await getTaskCitations(root.id)
-      },
-      chain: await Promise.all(chain.map(async (task) => ({
-        ...task,
-        ...await getTaskSteeringFields(task),
-        citations: await getTaskCitations(task.id)
-      })))
+    const tasks = [root, ...chain];
+    const [steering, citations] = await Promise.all([
+      getTaskSteeringFieldsForTasks(tasks),
+      getTaskCitationsForTasks(tasks.map((task) => task.id))
+    ]);
+    const decorate = (task) => ({
+      ...task,
+      ...steering.get(task.id),
+      citations: citations.get(task.id)
     });
+    getSession.respond(res, 200, { root: decorate(root), chain: chain.map(decorate) });
     return true;
   }
   return false;
@@ -24732,6 +24939,7 @@ var listScheduledTasks = route({
   path: "/api/scheduled-tasks",
   pattern: ["api", "scheduled-tasks"],
   summary: "List scheduled tasks",
+  description: "Returns full schedules by default. Pass `fields=slim` for the list-view shape, which swaps the full `taskTemplate` for a bounded `taskTemplatePreview`. Fetch one schedule in full via `GET /api/schedules/{id}`.",
   tags: ["Stats"],
   query: exports_external.object({
     enabled: exports_external.enum(["true", "false"]).optional(),
@@ -24740,12 +24948,18 @@ var listScheduledTasks = route({
     hideCompleted: exports_external.enum(["true", "false"]).optional(),
     targetType: exports_external.enum(["agent-task", "workflow", "script"]).optional(),
     workflowId: exports_external.string().uuid().optional(),
-    scriptName: exports_external.string().optional()
+    scriptName: exports_external.string().optional(),
+    fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
     200: {
       description: "Scheduled tasks list",
-      schema: exports_external.object({ scheduledTasks: exports_external.array(ScheduledTaskSchema) })
+      schema: exports_external.object({
+        scheduledTasks: exports_external.union([
+          exports_external.array(ScheduledTaskSchema),
+          exports_external.array(scheduleSummaryWithFavoriteSchema)
+        ])
+      })
     }
   }
 });
@@ -24825,7 +25039,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await listScheduledTasks.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const scheduledTasks = await getScheduledTasks({
+    const filters = {
       enabled: parsed.query.enabled !== undefined ? parsed.query.enabled === "true" : undefined,
       name: parsed.query.name || undefined,
       scheduleType: parsed.query.scheduleType || undefined,
@@ -24833,13 +25047,11 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
       targetType: parsed.query.targetType,
       workflowId: parsed.query.workflowId,
       scriptName: parsed.query.scriptName
-    });
+    };
     const favoriteScope = (await resolveHttpFavoriteOwner(req, myAgentId))?.scope;
+    const favoriteOpts = { favoriteScope, itemType: "schedule" };
     listScheduledTasks.respond(res, 200, {
-      scheduledTasks: await withFavoriteFlags(scheduledTasks, {
-        favoriteScope,
-        itemType: "schedule"
-      })
+      scheduledTasks: parsed.query.fields === "slim" ? await withFavoriteFlags(await getScheduledTasks(filters, { slim: true }), favoriteOpts) : await withFavoriteFlags(await getScheduledTasks(filters), favoriteOpts)
     });
     return true;
   }
@@ -24927,6 +25139,19 @@ var AgentTaskSummarySchema2 = AgentTaskSchema.pick({
   peakContextPercent: true,
   totalCostUsd: true
 });
+var AgentTaskTimelineItemSchema = AgentTaskSchema.pick({
+  id: true,
+  agentId: true,
+  parentTaskId: true,
+  task: true,
+  title: true,
+  status: true,
+  createdAt: true,
+  lastUpdatedAt: true,
+  finishedAt: true,
+  peakContextTokens: true,
+  totalCostUsd: true
+});
 var TaskActionResultSchema = exports_external.object({
   success: exports_external.literal(true),
   task: AgentTaskSchema
@@ -24971,7 +25196,7 @@ var listTasks = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   summary: "List tasks with filters",
-  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`. Fetch a single task in full via `GET /api/tasks/{id}`.",
+  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
   tags: ["Tasks"],
   query: exports_external.object({
     status: exports_external.string().optional(),
@@ -24988,14 +25213,19 @@ var listTasks = route({
     orderBy: exports_external.enum(["lastUpdatedAt", "createdAt"]).optional(),
     limit: exports_external.coerce.number().int().optional(),
     offset: exports_external.coerce.number().int().optional(),
-    fields: exports_external.enum(["full", "slim"]).optional()
+    fields: exports_external.enum(["full", "slim", "timeline"]).optional(),
+    includeTotal: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
     200: {
       description: "Paginated task list",
       schema: exports_external.object({
-        tasks: exports_external.union([exports_external.array(AgentTaskSchema), exports_external.array(AgentTaskSummarySchema2)]),
-        total: exports_external.number().int()
+        tasks: exports_external.union([
+          exports_external.array(AgentTaskSchema),
+          exports_external.array(AgentTaskSummarySchema2),
+          exports_external.array(AgentTaskTimelineItemSchema)
+        ]),
+        total: exports_external.number().int().optional()
       })
     },
     400: { description: "Validation error (e.g. unknown status token)" }
@@ -25489,9 +25719,13 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       limit: parsed.query.limit,
       offset: parsed.query.offset
     };
-    const tasks = parsed.query.fields === "full" ? await getAllTasks(filters) : await getAllTasks(filters, { slim: true });
-    const total = await getTasksCount(filters);
-    listTasks.respond(res, 200, { tasks, total });
+    const tasks = parsed.query.fields === "full" ? await getAllTasks(filters) : parsed.query.fields === "timeline" ? await getAllTasks(filters, { fields: "timeline" }) : await getAllTasks(filters, { slim: true });
+    if (parsed.query.includeTotal === "true") {
+      const total = await getTasksCount(filters);
+      listTasks.respond(res, 200, { tasks, total });
+    } else {
+      listTasks.respond(res, 200, { tasks });
+    }
     return true;
   }
   if (createTask.match(req.method, pathSegments)) {
@@ -27890,8 +28124,21 @@ async function routeKapsoInbound(payload) {
 init_event_bus();
 var WebhookDispatchResultSchema = exports_external.object({
   created: exports_external.boolean(),
-  taskId: exports_external.string().optional()
+  taskId: exports_external.string().optional(),
+  skipped: exports_external.boolean().optional(),
+  reason: exports_external.string().optional(),
+  extension: exports_external.object({ id: exports_external.string(), name: exports_external.string() }).optional()
 });
+async function runBlockableHandler(source, handler) {
+  try {
+    return await handler();
+  } catch (err) {
+    if (!(err instanceof TaskCreationBlockedError))
+      throw err;
+    console.log(`[${source}] Task creation blocked by extension ${err.extension.name}: ${err.reason}`);
+    return { created: false, skipped: true, reason: err.reason, extension: err.extension };
+  }
+}
 var githubWebhook = route({
   method: "post",
   path: "/api/github/webhook",
@@ -28039,34 +28286,29 @@ async function handleWebhooks(req, res, pathSegments) {
     console.log(`[GitHub] Received ${eventType} event`);
     let result = { created: false };
     try {
-      switch (eventType) {
-        case "pull_request":
-          result = await handlePullRequest(body);
-          break;
-        case "issues":
-          result = await handleIssue(body);
-          break;
-        case "issue_comment":
-          result = await handleComment(body, "issue_comment");
-          break;
-        case "pull_request_review_comment":
-          result = await handleComment(body, "pull_request_review_comment");
-          break;
-        case "pull_request_review":
-          result = await handlePullRequestReview(body);
-          break;
-        case "check_run":
-          result = await handleCheckRun(body);
-          break;
-        case "check_suite":
-          result = await handleCheckSuite(body);
-          break;
-        case "workflow_run":
-          result = await handleWorkflowRun(body);
-          break;
-        default:
-          console.log(`[GitHub] Ignoring unsupported event type: ${eventType}`);
-      }
+      result = await runBlockableHandler("GitHub", async () => {
+        switch (eventType) {
+          case "pull_request":
+            return await handlePullRequest(body);
+          case "issues":
+            return await handleIssue(body);
+          case "issue_comment":
+            return await handleComment(body, "issue_comment");
+          case "pull_request_review_comment":
+            return await handleComment(body, "pull_request_review_comment");
+          case "pull_request_review":
+            return await handlePullRequestReview(body);
+          case "check_run":
+            return await handleCheckRun(body);
+          case "check_suite":
+            return await handleCheckSuite(body);
+          case "workflow_run":
+            return await handleWorkflowRun(body);
+          default:
+            console.log(`[GitHub] Ignoring unsupported event type: ${eventType}`);
+            return { created: false };
+        }
+      });
       switch (eventType) {
         case "pull_request": {
           const pr = body;
@@ -28155,22 +28397,21 @@ async function handleWebhooks(req, res, pathSegments) {
     console.log(`[GitLab] Received ${objectKind} event`);
     let result = { created: false };
     try {
-      switch (objectKind) {
-        case "merge_request":
-          result = await handleMergeRequest(body);
-          break;
-        case "issue":
-          result = await handleIssue2(body);
-          break;
-        case "note":
-          result = await handleNote(body);
-          break;
-        case "pipeline":
-          result = await handlePipeline(body);
-          break;
-        default:
-          console.log(`[GitLab] Ignoring unsupported event type: ${objectKind}`);
-      }
+      result = await runBlockableHandler("GitLab", async () => {
+        switch (objectKind) {
+          case "merge_request":
+            return await handleMergeRequest(body);
+          case "issue":
+            return await handleIssue2(body);
+          case "note":
+            return await handleNote(body);
+          case "pipeline":
+            return await handlePipeline(body);
+          default:
+            console.log(`[GitLab] Ignoring unsupported event type: ${objectKind}`);
+            return { created: false };
+        }
+      });
       switch (objectKind) {
         case "merge_request": {
           const mr = body;
@@ -28463,8 +28704,9 @@ var ExecutorTypeInfoSchema = exports_external.object({
   configSchema: exports_external.record(exports_external.string(), exports_external.unknown()),
   outputSchema: exports_external.record(exports_external.string(), exports_external.unknown())
 });
+var DEFAULT_WORKFLOW_RUNS_LIMIT = 50;
 var WorkflowRunPageSchema = exports_external.object({
-  runs: exports_external.array(WorkflowRunSchema),
+  runs: exports_external.array(WorkflowRunSummarySchema),
   page: exports_external.object({
     limit: exports_external.number().int(),
     offset: exports_external.number().int(),
@@ -28646,7 +28888,8 @@ var listWorkflowRunsRoute = route({
   method: "get",
   path: "/api/workflows/{id}/runs",
   pattern: ["api", "workflows", null, "runs"],
-  summary: "List runs for a workflow",
+  summary: "List runs for a workflow, newest first",
+  description: `Returns one page of runs without \`context\` (fetch it with GET /api/workflow-runs/{id}). \`limit\` defaults to ${DEFAULT_WORKFLOW_RUNS_LIMIT} and is capped at 100; follow \`page.nextOffset\` while \`page.hasMore\` is true.`,
   tags: ["Workflows"],
   params: exports_external.object({ id: exports_external.string() }),
   query: exports_external.object({
@@ -28656,8 +28899,8 @@ var listWorkflowRunsRoute = route({
   }),
   responses: {
     200: {
-      description: "Workflow run list",
-      schema: exports_external.union([exports_external.array(WorkflowRunSchema), WorkflowRunPageSchema])
+      description: "One page of workflow runs",
+      schema: WorkflowRunPageSchema
     }
   }
 });
@@ -29132,18 +29375,12 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await listWorkflowRunsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const paginationRequested = parsed.query?.limit !== undefined || parsed.query?.offset !== undefined;
-    if (paginationRequested) {
-      const page = await listWorkflowRunsPage(parsed.params.id, {
-        status: parsed.query?.status,
-        limit: parsed.query?.limit ?? 20,
-        offset: parsed.query?.offset ?? 0
-      });
-      listWorkflowRunsRoute.respond(res, 200, page);
-      return true;
-    }
-    const runs = await listWorkflowRuns(parsed.params.id, { status: parsed.query?.status });
-    listWorkflowRunsRoute.respond(res, 200, runs);
+    const page = await listWorkflowRunsPage(parsed.params.id, {
+      status: parsed.query?.status,
+      limit: parsed.query?.limit ?? DEFAULT_WORKFLOW_RUNS_LIMIT,
+      offset: parsed.query?.offset ?? 0
+    });
+    listWorkflowRunsRoute.respond(res, 200, page);
     return true;
   }
   if (getWorkflowRunRoute.match(req.method, pathSegments)) {
@@ -29613,7 +29850,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-50jxgw0d.js");
+    const { stopScheduler } = await import("./index-chgdkq36.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -29621,7 +29858,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-nnz07ebd.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-vtkf5n99.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -29689,23 +29926,23 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-ncgxz1r2.js");
-  seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-3whntb69.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-s3q01xj3.js");
+  ensurePricingSeeded();
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-v1cbr9te.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-3zw68x72.js");
-  ensureRbacSeedsSynced();
+  const { ensureRbacSeeded } = await import("./boot-seeds-s3q01xj3.js");
+  ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
   if (isRbacEnabled())
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-1fktvwxc.js");
+  const { runAllSeeders } = await import("./index-a3vn96n8.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -29759,36 +29996,36 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-50jxgw0d.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-7x131mmf.js");
+    const { startScheduler } = await import("./index-chgdkq36.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-1yks3qcr.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-7jwk7nsm.js");
+    const { startHeartbeat } = await import("./index-x71bvq0p.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-nnz07ebd.js");
+    const { startOAuthKeepalive } = await import("./keepalive-vtkf5n99.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-c63sqfs1.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-qp3dzmdp.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
-  import("./boot-reembed-r00j03f3.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-se8zmdcp.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-0be1krkm.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-g5ckg9yb.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-9j4hd0vw.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-wfxqan61.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {