@desplega.ai/agent-swarm 1.157.0 → 1.158.0

package/src/commands/onboard/steps/prereq-check.tsx

@@ -1,13 +1,19 @@
 import { Select, Spinner } from "@inkjs/ui";
 import { Box, Text } from "ink";
 import { useEffect, useRef, useState } from "react";
+import {
+  CONTAINER_ENGINE_LABELS,
+  ENGINE_INSTALL_HINTS,
+  type EngineCheck,
+  type EngineResolution,
+  resolveContainerEngine,
+} from "../container-engine.ts";
 import type { StepProps } from "../types.ts";
 
 type CheckStatus = "checking" | "passed" | "failed";
 
 interface CheckResult {
-  docker: { ok: boolean; version?: string; error?: string };
-  compose: { ok: boolean; version?: string; error?: string };
+  engine: EngineResolution;
   ports: { ok: boolean; conflicts?: string[] };
 }
 
@@ -22,35 +28,10 @@ export function PrereqCheckStep({ state, addLog, goToNext, goToStep, goToError }
 
     const run = async () => {
       const res: CheckResult = {
-        docker: { ok: false },
-        compose: { ok: false },
+        engine: await resolveContainerEngine(state.containerEngine),
         ports: { ok: true },
       };
 
-      // Check Docker
-      try {
-        const out = await Bun.$`docker --version`.quiet();
-        if (out.exitCode === 0) {
-          res.docker = { ok: true, version: out.text().trim() };
-        } else {
-          res.docker = { ok: false, error: "Docker exited with non-zero status" };
-        }
-      } catch {
-        res.docker = { ok: false, error: "Docker not found" };
-      }
-
-      // Check Docker Compose
-      try {
-        const out = await Bun.$`docker compose version`.quiet();
-        if (out.exitCode === 0) {
-          res.compose = { ok: true, version: out.text().trim() };
-        } else {
-          res.compose = { ok: false, error: "Docker Compose not found" };
-        }
-      } catch {
-        res.compose = { ok: false, error: "Docker Compose v2 not found" };
-      }
-
       // Check ports
       const portsToCheck = [3013];
       const agentCount = state.services.reduce((sum, s) => sum + s.count, 0);
@@ -75,7 +56,8 @@ export function PrereqCheckStep({ state, addLog, goToNext, goToStep, goToError }
 
       setResult(res);
 
-      if (res.docker.ok && res.compose.ok && res.ports.ok) {
+      if (res.engine.ok && res.ports.ok) {
+        addLog(`Container engine: ${CONTAINER_ENGINE_LABELS[res.engine.engine]}`);
         addLog("All prerequisites met");
         setStatus("passed");
       } else {
@@ -84,15 +66,16 @@ export function PrereqCheckStep({ state, addLog, goToNext, goToStep, goToError }
     };
 
     run().catch((err) => goToError(err.message));
-  }, [state.services, addLog, goToError]);
+  }, [state.services, state.containerEngine, addLog, goToError]);
 
   // Auto-advance on pass
   useEffect(() => {
-    if (status === "passed") {
-      const timer = setTimeout(() => goToNext(), 500);
+    if (status === "passed" && result?.engine.ok) {
+      const engine = result.engine.engine;
+      const timer = setTimeout(() => goToNext({ containerEngine: engine }), 500);
       return () => clearTimeout(timer);
     }
-  }, [status, goToNext]);
+  }, [status, result, goToNext]);
 
   if (status === "checking") {
     return (
@@ -102,46 +85,41 @@ export function PrereqCheckStep({ state, addLog, goToNext, goToStep, goToError }
     );
   }
 
-  if (status === "passed" && result) {
+  if (status === "passed" && result?.engine.ok) {
     return (
       <Box flexDirection="column" padding={1}>
         <Text color="green">
-          {"✓"} {result.docker.version}
+          {"✓"} {result.engine.probe.binary.version}
         </Text>
         <Text color="green">
-          {"✓"} {result.compose.version}
+          {"✓"} {result.engine.probe.compose.version}
         </Text>
         <Text color="green">{"✓"} All ports available</Text>
       </Box>
     );
   }
 
+  const probe = result?.engine.probe ?? null;
+  const engineLabel = probe ? CONTAINER_ENGINE_LABELS[probe.engine] : "Container engine";
+
   // Failed
   return (
     <Box flexDirection="column" padding={1}>
-      {result?.docker.ok ? (
-        <Text color="green">
-          {"✓"} {result.docker.version}
-        </Text>
-      ) : (
+      {result && !result.engine.ok && !result.engine.engine ? (
         <Box flexDirection="column">
           <Text color="red">
-            {"✗"} Docker: {result?.docker.error}
-          </Text>
-          <Text dimColor>
-            {" "}
-            Install: brew install --cask docker (macOS) or https://docs.docker.com/get-docker/
+            {"✗"} {result.engine.error}
           </Text>
+          <Text dimColor> {ENGINE_INSTALL_HINTS.docker}</Text>
+          <Text dimColor> or {ENGINE_INSTALL_HINTS.podman}</Text>
         </Box>
-      )}
-      {result?.compose.ok ? (
-        <Text color="green">
-          {"✓"} {result.compose.version}
-        </Text>
       ) : (
-        <Text color="red">
-          {"✗"} Docker Compose v2: {result?.compose.error}
-        </Text>
+        <>
+          <CheckLine label={engineLabel} check={probe?.binary} />
+          {probe?.binary.ok ? (
+            <CheckLine label={`${engineLabel} Compose`} check={probe.compose} />
+          ) : null}
+        </>
       )}
       {result?.ports.ok ? (
         <Text color="green">{"✓"} All ports available</Text>
@@ -176,3 +154,21 @@ export function PrereqCheckStep({ state, addLog, goToNext, goToStep, goToError }
     </Box>
   );
 }
+
+function CheckLine({ label, check }: { label: string; check: EngineCheck | undefined }) {
+  if (check?.ok) {
+    return (
+      <Text color="green">
+        {"✓"} {check.version}
+      </Text>
+    );
+  }
+  return (
+    <Box flexDirection="column">
+      <Text color="red">
+        {"✗"} {label}: {check?.error}
+      </Text>
+      {check?.hint ? <Text dimColor> {check.hint}</Text> : null}
+    </Box>
+  );
+}

package/src/commands/onboard/steps/start.tsx

@@ -1,6 +1,13 @@
 import { Select, Spinner } from "@inkjs/ui";
 import { Box, Text } from "ink";
 import { useEffect, useRef, useState } from "react";
+import {
+  CONTAINER_ENGINE_LABELS,
+  composeArgv,
+  composeCommandText,
+  defaultCommandRunner,
+  engineForCommands,
+} from "../container-engine.ts";
 import type { StepProps } from "../types.ts";
 
 type StartStatus = "starting" | "success" | "failed";
@@ -9,24 +16,27 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
   const [status, setStatus] = useState<StartStatus>("starting");
   const [errorMsg, setErrorMsg] = useState("");
   const executed = useRef(false);
+  const engine = engineForCommands(state.containerEngine);
+  const engineLabel = CONTAINER_ENGINE_LABELS[engine];
 
   useEffect(() => {
     if (executed.current) return;
     executed.current = true;
 
     const run = async () => {
-      addLog("Running docker compose up -d...");
+      addLog(`Running ${composeCommandText(engine, "--env-file .env up -d")}...`);
       try {
-        const result = await Bun.$`docker compose --env-file .env up -d`
-          .cwd(state.outputDir)
-          .quiet();
+        const result = await defaultCommandRunner(
+          composeArgv(engine, ["--env-file", ".env", "up", "-d"]),
+          { cwd: state.outputDir },
+        );
 
         if (result.exitCode === 0) {
-          addLog("Docker stack started successfully");
+          addLog(`${engineLabel} stack started successfully`);
           setStatus("success");
         } else {
-          const stderr = result.stderr.toString().trim();
-          setErrorMsg(stderr || "docker compose up failed");
+          const stderr = result.stderr.trim();
+          setErrorMsg(stderr || `${composeCommandText(engine, "up")} failed`);
           setStatus("failed");
         }
       } catch (err) {
@@ -36,7 +46,7 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
     };
 
     run().catch((err) => addLog(`Start failed: ${err}`));
-  }, [state.outputDir, addLog]);
+  }, [state.outputDir, engine, engineLabel, addLog]);
 
   useEffect(() => {
     if (status === "success") {
@@ -48,7 +58,7 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
   if (status === "starting") {
     return (
       <Box padding={1}>
-        <Spinner label="Starting Docker stack..." />
+        <Spinner label={`Starting ${engineLabel} stack...`} />
       </Box>
     );
   }
@@ -56,20 +66,24 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
   if (status === "success") {
     return (
       <Box padding={1}>
-        <Text color="green">{"✓"} Docker stack started</Text>
+        <Text color="green">
+          {"✓"} {engineLabel} stack started
+        </Text>
       </Box>
     );
   }
 
   return (
     <Box flexDirection="column" padding={1}>
-      <Text color="red">{"✗"} Failed to start Docker stack</Text>
+      <Text color="red">
+        {"✗"} Failed to start {engineLabel} stack
+      </Text>
       <Text dimColor>{errorMsg}</Text>
       <Box marginTop={1}>
         <Select
           options={[
             { label: "Retry", value: "retry" },
-            { label: "View logs (docker compose logs)", value: "logs" },
+            { label: `View logs (${composeCommandText(engine, "logs")})`, value: "logs" },
             { label: "Skip", value: "skip" },
           ]}
           onChange={async (value) => {
@@ -79,10 +93,11 @@ export function StartStep({ state, addLog, goToNext }: StepProps) {
               setErrorMsg("");
             } else if (value === "logs") {
               try {
-                const logs = await Bun.$`docker compose logs --tail 30`
-                  .cwd(state.outputDir)
-                  .quiet();
-                addLog(logs.text());
+                const logs = await defaultCommandRunner(
+                  composeArgv(engine, ["logs", "--tail", "30"]),
+                  { cwd: state.outputDir },
+                );
+                addLog(logs.stdout || logs.stderr);
               } catch {
                 addLog("Failed to fetch logs");
               }

package/src/commands/onboard/types.ts

@@ -1,4 +1,5 @@
 import type { SlackMode } from "../../slack/config";
+import type { ContainerEnginePreference } from "./container-engine.ts";
 
 export type OnboardStep =
   | "welcome"
@@ -90,6 +91,8 @@ export interface OnboardState {
   apiPort: number;
   maxConcurrentTasks: number | null;
   pullPolicy: PullPolicy;
+  /** `auto` until the prereq check resolves it to the engine that passed. */
+  containerEngine: ContainerEnginePreference;
   outputDir: string;
   nonInteractive: boolean;
   error: string | null;
@@ -110,6 +113,7 @@ export interface OnboardProps {
   preset?: string;
   maxConcurrentTasks?: string;
   pullPolicy?: string;
+  containerEngine?: string;
 }
 
 export type PullPolicy = "always" | "missing" | "never";
@@ -137,7 +141,7 @@ export const STEP_LABELS: { step: OnboardStep; label: string }[] = [
   { step: "integration_menu", label: "Integrations" },
   { step: "review", label: "Review" },
   { step: "generate", label: "Generate" },
-  { step: "prereq_check", label: "Docker" },
+  { step: "prereq_check", label: "Engine" },
   { step: "start", label: "Start" },
   { step: "health_check", label: "Health" },
   { step: "post_connect", label: "Connect" },
@@ -205,6 +209,7 @@ export const INITIAL_STATE: OnboardState = {
   apiPort: 0,
   maxConcurrentTasks: null,
   pullPolicy: "always",
+  containerEngine: "auto",
   outputDir: process.cwd(),
   nonInteractive: false,
   error: null,
@@ -293,7 +298,7 @@ export function nextStep(current: OnboardStep, state: OnboardState): OnboardStep
       return "generate";
 
     case "prereq_check":
-      // If Docker is missing and user chose "files only", skip to done
+      // If the container engine is missing and user chose "files only", skip to done
       // Default: proceed to start
       return "start";
 

package/src/commands/onboard.tsx

@@ -5,6 +5,13 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import pkg from "../../package.json";
 import { getSlackConfiguration, isSlackConfigured } from "../slack/config.ts";
 import { getApiKey } from "../utils/api-key.ts";
+import {
+  CONTAINER_ENGINE_LABELS,
+  composeCommandText,
+  engineForCommands,
+  isContainerEnginePreference,
+  resolveContainerEnginePreference,
+} from "./onboard/container-engine.ts";
 import { buildOnboardDashboardUrl } from "./onboard/dashboard-url.ts";
 import {
   parseMaxConcurrentTasks,
@@ -53,6 +60,7 @@ export function Onboard({
   preset,
   maxConcurrentTasks,
   pullPolicy,
+  containerEngine,
 }: OnboardProps) {
   const { exit } = useApp();
   const [state, setState] = useState<OnboardState>(() => {
@@ -75,6 +83,13 @@ export function Onboard({
       }
       initial.pullPolicy = pullPolicy;
     }
+    const engine = resolveContainerEnginePreference(containerEngine, process.env);
+    if (!engine.ok) {
+      initial.step = "error";
+      initial.error = engine.error;
+      return initial;
+    }
+    initial.containerEngine = engine.value;
     return initial;
   });
 
@@ -311,8 +326,14 @@ export function Onboard({
           </Box>
           <Box marginTop={1} flexDirection="column">
             <Text bold>Useful commands:</Text>
-            <Text dimColor> docker compose logs -f</Text>
-            <Text dimColor> docker compose down</Text>
+            <Text dimColor>
+              {" "}
+              {composeCommandText(engineForCommands(state.containerEngine), "logs -f")}
+            </Text>
+            <Text dimColor>
+              {" "}
+              {composeCommandText(engineForCommands(state.containerEngine), "down")}
+            </Text>
             <Text dimColor> agent-swarm setup</Text>
           </Box>
         </Box>
@@ -341,8 +362,22 @@ function renderStep(step: OnboardStep, props: StepProps) {
           <Text bold>How would you like to deploy your swarm?</Text>
           <Box marginTop={1}>
             <Select
-              options={[{ label: "Local (Docker Compose)", value: "local" }]}
-              onChange={() => props.goToNext({ deployType: "local" })}
+              defaultValue={props.state.containerEngine}
+              options={[
+                {
+                  label: "Local, auto-detect engine (Docker if installed, else Podman)",
+                  value: "auto",
+                },
+                { label: `Local (${CONTAINER_ENGINE_LABELS.docker} Compose)`, value: "docker" },
+                {
+                  label: `Local (${CONTAINER_ENGINE_LABELS.podman} Compose, rootless)`,
+                  value: "podman",
+                },
+              ]}
+              onChange={(value) => {
+                if (!isContainerEnginePreference(value)) return;
+                props.goToNext({ deployType: "local", containerEngine: value });
+              }}
             />
           </Box>
           <Text dimColor>Remote (SSH) — Coming soon</Text>

package/src/commands/profile-sync.ts

@@ -189,6 +189,82 @@ export async function renderProfileSyncRejectionBanner(event: SwarmEvent): Promi
   return result.skipped ? null : result.text;
 }
 
+type LatestProfileSyncEvents = {
+  rejection: SwarmEvent | null;
+  reconciliation: SwarmEvent | null;
+};
+
+const PROFILE_SYNC_REJECTED = "system.profile_sync_rejected";
+const PROFILE_SYNC_RECONCILED = "system.profile_sync_reconciled";
+
+function profileSyncHeaders(config: Pick<ProfileSyncOptions, "agentId" | "apiKey">) {
+  return { Authorization: `Bearer ${config.apiKey}`, "X-Agent-ID": config.agentId };
+}
+
+/**
+ * One request for every field's latest rejection and reconciliation. Returns
+ * null when the API does not confirm `latestPerDataField` (an API that predates
+ * it ignores the parameters), so the caller falls back to per-field lookups.
+ */
+async function fetchLatestProfileSyncEventsBatched(
+  config: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey">,
+  fetchImpl: typeof fetch,
+): Promise<LatestProfileSyncEvents[] | null> {
+  const query = new URLSearchParams({
+    events: `${PROFILE_SYNC_REJECTED},${PROFILE_SYNC_RECONCILED}`,
+    dataFields: Object.keys(IDENTITY_FIELD_BUDGETS).join(","),
+    agentId: config.agentId,
+    latestPerDataField: "true",
+  });
+  const response = await fetchImpl(`${config.apiUrl}/api/events?${query}`, {
+    headers: profileSyncHeaders(config),
+  });
+  if (!response.ok) return null;
+  const payload = (await response.json()) as {
+    events?: SwarmEvent[];
+    latestPerDataField?: boolean;
+  };
+  if (payload.latestPerDataField !== true || !Array.isArray(payload.events)) return null;
+  const events = payload.events;
+  const latest = (event: string, field: string) =>
+    events.find((candidate) => candidate.event === event && candidate.data?.field === field) ??
+    null;
+  return (Object.keys(IDENTITY_FIELD_BUDGETS) as BudgetedIdentityField[]).map((field) => ({
+    rejection: latest(PROFILE_SYNC_REJECTED, field),
+    reconciliation: latest(PROFILE_SYNC_RECONCILED, field),
+  }));
+}
+
+/** Legacy path: one `limit=1` lookup per (field, event), for APIs without batching. */
+async function fetchLatestProfileSyncEventsPerField(
+  config: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey">,
+  fetchImpl: typeof fetch,
+): Promise<LatestProfileSyncEvents[]> {
+  return await Promise.all(
+    (Object.keys(IDENTITY_FIELD_BUDGETS) as BudgetedIdentityField[]).map(async (field) => {
+      const fetchLatestEvent = async (event: SwarmEvent["event"]): Promise<SwarmEvent | null> => {
+        const query = new URLSearchParams({
+          event,
+          agentId: config.agentId,
+          dataField: field,
+          limit: "1",
+        });
+        const response = await fetchImpl(`${config.apiUrl}/api/events?${query}`, {
+          headers: profileSyncHeaders(config),
+        });
+        if (!response.ok) return null;
+        const payload = (await response.json()) as { events?: SwarmEvent[] };
+        return payload.events?.[0] ?? null;
+      };
+      const [rejection, reconciliation] = await Promise.all([
+        fetchLatestEvent(PROFILE_SYNC_REJECTED),
+        fetchLatestEvent(PROFILE_SYNC_RECONCILED),
+      ]);
+      return { rejection, reconciliation };
+    }),
+  );
+}
+
 /** Fetch every field's latest unresolved rejection before a provider session. */
 export async function fetchProfileSyncRejectionBanner(
   config: Pick<ProfileSyncOptions, "agentId" | "apiUrl" | "apiKey" | "claudeMdPath">,
@@ -196,32 +272,9 @@ export async function fetchProfileSyncRejectionBanner(
   readFile: FileReader = readFileIfExists,
 ): Promise<string> {
   try {
-    const responses = await Promise.all(
-      (Object.keys(IDENTITY_FIELD_BUDGETS) as BudgetedIdentityField[]).map(async (field) => {
-        const fetchLatestEvent = async (event: SwarmEvent["event"]): Promise<SwarmEvent | null> => {
-          const query = new URLSearchParams({
-            event,
-            agentId: config.agentId,
-            dataField: field,
-            limit: "1",
-          });
-          const response = await fetchImpl(`${config.apiUrl}/api/events?${query}`, {
-            headers: {
-              Authorization: `Bearer ${config.apiKey}`,
-              "X-Agent-ID": config.agentId,
-            },
-          });
-          if (!response.ok) return null;
-          const payload = (await response.json()) as { events?: SwarmEvent[] };
-          return payload.events?.[0] ?? null;
-        };
-        const [rejection, reconciliation] = await Promise.all([
-          fetchLatestEvent("system.profile_sync_rejected"),
-          fetchLatestEvent("system.profile_sync_reconciled"),
-        ]);
-        return { rejection, reconciliation };
-      }),
-    );
+    const responses =
+      (await fetchLatestProfileSyncEventsBatched(config, fetchImpl)) ??
+      (await fetchLatestProfileSyncEventsPerField(config, fetchImpl));
     const latestEvents = responses.flatMap(({ rejection, reconciliation }) =>
       rejection ? [{ rejection, reconciliation }] : [],
     );

package/src/commands/runner.ts

@@ -1156,6 +1156,7 @@ const SWARM_TOOL_LABELS: Record<string, string | null> = {
   "post-message": "💬 Sending message",
   "read-messages": "💬 Reading messages",
   "request-human-input": "🙋 Requesting human input",
+  "cancel-approval-request": "🚫 Cancelling approval request",
   "cancel-task": "🚫 Cancelling task",
   "db-query": "🗃️ Querying database",
   "inject-learning": "🧠 Storing learning",
@@ -3253,7 +3254,13 @@ async function fetchRelevantMemories(
     if (!response.ok) return null;
 
     const data = (await response.json()) as {
-      results: Array<{ id: string; name: string; content: string; similarity: number }>;
+      results: Array<{
+        id: string;
+        name: string;
+        content: string;
+        similarity: number;
+        rawSimilarity?: number;
+      }>;
     };
 
     return renderMemoriesPrompt(data.results || []);

package/src/extensions/catalog.generated.json

@@ -1,4 +1,21 @@
 {
+  "github-sender-allowlist": {
+    "manifestFile": "manifest.json",
+    "manifest": {
+      "$schema": "../manifest.schema.json",
+      "name": "github-sender-allowlist",
+      "description": "Blocks GitHub webhook tasks from senders outside configured allowlists",
+      "version": "1.0.0",
+      "runtime": "api",
+      "assets": {
+        "hooks": "hooks.ts"
+      }
+    },
+    "files": {
+      "hooks.ts": "import { block, type SwarmExtension } from \"swarm-extension\";\nimport { z } from \"zod\";\n\nexport const config = z.object({\n  internal: z.array(z.string()).default([]),\n  external: z.array(z.string()).default([]),\n  reviewBots: z.array(z.string()).default([]),\n  exemptTaskTypes: z.array(z.string()).default([]),\n});\n\nconst manifest = {\n  name: \"github-sender-allowlist\",\n  description: \"Blocks GitHub webhook tasks from senders outside configured allowlists\",\n  version: \"1.0.0\",\n  runtime: \"api\",\n  assets: { hooks: \"hooks.ts\" },\n  config,\n} as const;\n\nfunction includesLogin(logins: string[], login: string): boolean {\n  return logins.some((allowed) => allowed.toLowerCase() === login.toLowerCase());\n}\n\nconst extension: SwarmExtension<typeof manifest> = (api) => {\n  api.on(\"pre.task.create\", (event, ctx) => {\n    const { options } = event;\n    if (options.source !== \"github\") return;\n\n    const taskType = options.taskType ?? \"unknown\";\n    const login = options.vcsAuthor ?? \"\";\n    if (includesLogin(ctx.config.internal, login)) return;\n\n    const isReviewBot = includesLogin(ctx.config.reviewBots, login);\n    if (isReviewBot && taskType === \"github-review\") return;\n    if (!isReviewBot && ctx.config.exemptTaskTypes.includes(taskType)) return;\n\n    const isPullRequest = options.vcsUrl?.includes(\"/pull/\") ?? false;\n    const isExternalPullRequestTask =\n      (taskType === \"github-comment\" || taskType === \"github-pr\" || taskType === \"github-review\") &&\n      isPullRequest;\n    const isExternalSender = includesLogin(ctx.config.external, login);\n    if (!isReviewBot && isExternalSender && isExternalPullRequestTask) return;\n\n    const rule = isReviewBot\n      ? \"review bots are allowed only for github-review tasks\"\n      : isExternalSender\n        ? \"external senders are allowed only for PR comments, reviews, and github-pr tasks on pull requests\"\n        : \"sender is not on the internal, external, or reviewBots allowlist\";\n    const reason = `GitHub sender \"${login || \"unknown\"}\" is blocked: ${rule}.`;\n    ctx.log.warn(reason, { login: login || null, taskType, vcsUrl: options.vcsUrl ?? null });\n    return block(reason);\n  });\n};\n\nexport default extension;\n"
+    },
+    "readme": "# github-sender-allowlist\n\nBlocks GitHub webhook tasks from senders outside the configured allowlists. Login matching is case-insensitive. Tasks from other sources pass through. No task type is exempt by default.\n\nConfig:\n\n```json\n{\n  \"internal\": [\"tarasyarema\", \"harlequinetcie\"],\n  \"external\": [\"fuvidani\", \"capchase-bot\"],\n  \"reviewBots\": [],\n  \"exemptTaskTypes\": []\n}\n```\n\nInternal senders can create any GitHub task, including reviews. Logins in `reviewBots` can create `github-review` tasks only. External senders can create `github-comment` or `github-pr` tasks on pull requests, and `github-review` tasks when `vcsUrl` contains `/pull/`. Choose any review-bot logins from the sender census in the [security audit](https://live.agent-fs.dev/file/~/648a5f3c-35c8-4f11-8673-b89de52cd6bd/2faf73ba-4eee-4472-8b3b-359c4ed6bfbb/thoughts/a09d19a4-bd35-4593-9b6f-c2ccafccead8/reviews/2026-09-28-github-sender-authorization-audit.md) when installing the extension; the template intentionally defaults to an empty list.\n\n`exemptTaskTypes` is an optional operator override for explicitly exempting task types. It defaults to an empty list. The GitHub handler does not pass the action for `github-pr` tasks, so external `github-pr` access also permits assignment and label events on pull requests.\n"
+  },
   "notify-on-complete": {
     "manifestFile": "manifest.json",
     "manifest": {