@desplega.ai/agent-swarm 1.157.0 → 1.158.0

package/dist/{cli-01vfmq8c.js → cli-ftfvggzx.js}

@@ -18,22 +18,20 @@ import {
   getOpenRouterBaseUrl
 } from "./cli-3dpj7atn.js";
 import {
-  startPricingRefreshLoop
-} from "./cli-6jjzxv3b.js";
-import {
-  seedPricingFromModelsDev
-} from "./cli-xf5b7y1f.js";
-import {
-  ensureRbacSeedsSynced,
+  ensurePricingSeeded,
+  ensureRbacSeeded,
   getUserGrant
-} from "./cli-f3va018d.js";
+} from "./cli-aky8tctm.js";
 import {
   can,
   decideAdmission,
   grantLeadEquivalence,
   isRbacEnabled,
   revokeLeadEquivalence
-} from "./cli-ytxs7mn1.js";
+} from "./cli-g8djp6qe.js";
+import {
+  startPricingRefreshLoop
+} from "./cli-ws6rqycm.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -87,6 +85,7 @@ import {
   refreshScriptConnection,
   require_dist as require_dist2,
   resolveSyncRunAs,
+  resolveValidationPort,
   restoreScratchScriptLastUsedIfUnchanged,
   runSavedScriptAsAgent,
   runScript,
@@ -103,7 +102,7 @@ import {
   validateDefinition,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-c41wjx0r.js";
+} from "./cli-fgqxwrpv.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -114,7 +113,7 @@ import {
 } from "./cli-f14fvzag.js";
 import {
   embedScript
-} from "./cli-wsed24mk.js";
+} from "./cli-987hg0aa.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -129,7 +128,7 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-wb2zvbfg.js";
+} from "./cli-53sz8gkz.js";
 import {
   AgentFsProvider,
   getFileStorageProvider,
@@ -146,7 +145,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-v53rbqp3.js";
+} from "./cli-65hjmev5.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -176,7 +175,7 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-9p33cz9h.js";
+} from "./cli-j57qkrpq.js";
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
@@ -194,6 +193,7 @@ import {
   beginRequestAuthScope,
   buildJiraContextKey,
   buildRoutingAffinityFromAgent,
+  cancelApprovalRequestById,
   cancelPendingApprovalRequestsForRun,
   cancelTask,
   checkDependencies,
@@ -263,6 +263,7 @@ import {
   getAllUsers,
   getAppVersion,
   getAppVersions,
+  getApprovalRequestById,
   getBudget,
   getChannelById,
   getChannelByName,
@@ -270,6 +271,7 @@ import {
   getCompletedStepNodeIds,
   getContextVersion,
   getContextVersionHistory,
+  getCurrentStepForNode,
   getDailySpendForAgent,
   getDailySpendForUser,
   getDailySpendGlobal,
@@ -372,6 +374,7 @@ import {
   isInternalConfigKey,
   isReservedConfigKey,
   isSteeringEnabled,
+  kvPrefixUpperBound,
   linearContextKey,
   listCancelledApprovalRequestsForRun,
   listKv,
@@ -442,7 +445,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-awwphhcs.js";
+} from "./cli-47m6dkd3.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -482,6 +485,7 @@ import {
   SteerModeSchema,
   SteerOutcomeSchema,
   SwarmConfigScopeSchema,
+  TERMINAL_TASK_STATUSES,
   TriggerConfigSchema,
   WorkflowDefinitionSchema,
   WorkflowNodePatchSchema,
@@ -497,7 +501,7 @@ import {
   normalizeAssetKey,
   parseAssetKey,
   splitLegacyModelAlias
-} from "./cli-h0wdadsx.js";
+} from "./cli-4198qc9v.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -580,7 +584,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-sgyqyyxe.js";
+} from "./cli-c07r9a2m.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -14319,7 +14323,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-enysy1zd.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-g26wdcz6.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -14643,10 +14647,15 @@ async function checkpointStepFailure(runId, stepId, error, retryCount, retryPoli
   });
   const markRunFailed = options?.markRunFailed ?? true;
   if (markRunFailed) {
-    await updateWorkflowRun(runId, {
-      status: "failed",
-      error: `Step failed: ${error}`,
-      finishedAt: now
+    await getDbClient().transaction(async () => {
+      const run = await getWorkflowRun(runId);
+      if (run?.status !== "running" && run?.status !== "waiting")
+        return;
+      await updateWorkflowRun(runId, {
+        status: "failed",
+        error: `Step failed: ${error}`,
+        finishedAt: now
+      });
     });
   }
   return { shouldRetry: false };
@@ -15170,19 +15179,30 @@ async function startWorkflowExecution(workflow, triggerData, registry, options =
   return runId;
 }
 var activeWalks = new Map;
+var executingSteps = new Set;
 function isWorkflowRunActive(runId) {
   return activeWalks.has(runId);
 }
-async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+function holdWorkflowRun(runId) {
   activeWalks.set(runId, (activeWalks.get(runId) ?? 0) + 1);
-  try {
-    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
-  } finally {
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
     const remaining = activeWalks.get(runId) - 1;
     if (remaining === 0)
       activeWalks.delete(runId);
     else
       activeWalks.set(runId, remaining);
+  };
+}
+async function walkGraph(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
+  const release = holdWorkflowRun(runId);
+  try {
+    await walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys, options);
+  } finally {
+    release();
   }
 }
 async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId, secretKeys = new Set, options = {}) {
@@ -15215,12 +15235,13 @@ async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId,
       activeEdges.add(`${step.nodeId}→${succ.id}`);
     }
   }
+  const awaited = awaitedNodeIds(allSteps, activeEdges);
   let pendingNodes = startNodes.filter((n) => {
     const preds = getAllPredecessors(def, n.id);
     if (preds.length === 0) {
       return !completedNodeIds.has(n.id);
     }
-    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`));
+    const activePreds = preds.filter((predId) => activeEdges.has(`${predId}→${n.id}`) || awaited.has(predId));
     const predsToCheck = activePreds.length > 0 ? activePreds : preds;
     return predsToCheck.every((p) => completedNodeIds.has(p));
   });
@@ -15264,11 +15285,24 @@ async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId,
     if (hasWaiting)
       return;
     const readyNext = [];
+    const batchSteps = nextBatch.size > 0 ? await getWorkflowRunStepsByRunId(runId) : [];
+    const batchAwaited = awaitedNodeIds(batchSteps, activeEdges);
+    const batchLatest = latestStepByNode(batchSteps);
     for (const [nodeId, node] of nextBatch) {
       if (executedInThisWalk.has(nodeId))
         continue;
       const allPreds = getAllPredecessors(def, nodeId);
-      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`));
+      for (const predId of allPreds) {
+        if (completedNodeIds.has(predId))
+          continue;
+        const latest = batchLatest.get(predId);
+        if (latest?.status !== "completed")
+          continue;
+        completedNodeIds.add(predId);
+        if (latest.output !== undefined)
+          ctx[predId] = latest.output;
+      }
+      const activePreds = allPreds.filter((predId) => activeEdges.has(`${predId}→${nodeId}`) || batchAwaited.has(predId));
       const allActivePredsCompleted = activePreds.every((p) => completedNodeIds.has(p));
       if (allActivePredsCompleted) {
         readyNext.push(node);
@@ -15281,6 +15315,8 @@ async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId,
     if (!run || run.status !== "running")
       return;
     const finalSteps = await getWorkflowRunStepsByRunId(runId);
+    if (hasRunningStep(finalSteps))
+      return;
     const hasWaitingSteps = finalSteps.some((s) => s.status === "waiting");
     const hasPendingRetries = finalSteps.some((s) => s.status === "failed" && s.nextRetryAt != null);
     const failedSteps = finalSteps.filter((s) => s.status === "failed" && s.nextRetryAt == null);
@@ -15315,6 +15351,33 @@ async function walkGraphOwned(def, runId, ctx, startNodes, registry, workflowId,
     }
   });
 }
+function latestStepByNode(steps) {
+  const latest = new Map;
+  for (const step of steps)
+    latest.set(step.nodeId, step);
+  return latest;
+}
+function awaitedNodeIds(steps, activeEdges) {
+  const latest = latestStepByNode(steps);
+  const awaited = new Set;
+  for (const [nodeId, step] of latest) {
+    if (step.status === "running" || step.status === "waiting")
+      awaited.add(nodeId);
+  }
+  for (const edge of activeEdges) {
+    const target = edge.slice(edge.indexOf("→") + 1);
+    if (!latest.has(target))
+      awaited.add(target);
+  }
+  return awaited;
+}
+function hasRunningStep(steps) {
+  for (const step of latestStepByNode(steps).values()) {
+    if (step.status === "running")
+      return true;
+  }
+  return false;
+}
 async function rehydrateCompletedStepOutputs(def, runId, ctx, registry) {
   const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
   const latestSteps = new Map;
@@ -15352,23 +15415,30 @@ function getAllPredecessors(def, nodeId) {
   return preds;
 }
 async function executeStep(def, runId, ctx, node, registry, workflowId, secretKeys = new Set, options = {}) {
-  const dedup = await getDbClient().transaction(async () => {
+  let claimedStepId;
+  const claimStep = async () => {
     const run = await getWorkflowRun(runId);
     if (!run || run.status !== "running" && run.status !== "waiting") {
       return { halted: true };
     }
+    if (node.type !== "foreach") {
+      const current = await getCurrentStepForNode(runId, node.id, getAllPredecessors(def, node.id));
+      if (current && (current.status !== "running" || executingSteps.has(current.id))) {
+        return { current };
+      }
+    }
     const iteration = await getStepCountForNode(runId, node.id);
     const idempotencyKey = `${runId}:${node.id}:${iteration}`;
-    const existingStep2 = await getStepByIdempotencyKey(idempotencyKey);
-    if (existingStep2 && (existingStep2.status === "completed" || existingStep2.status === "waiting")) {
-      return { existingStep: existingStep2, stepId: existingStep2.id, deduped: true };
+    const existingStep = await getStepByIdempotencyKey(idempotencyKey);
+    if (existingStep && (existingStep.status === "completed" || existingStep.status === "waiting")) {
+      return { existingStep, stepId: existingStep.id, deduped: true };
     }
     const latestForeachStep = node.type === "foreach" ? await getLatestStepForNode(runId, node.id) : undefined;
     const reusableForeachStep = latestForeachStep && !FOREACH_TERMINAL_STEP_STATUSES.has(latestForeachStep.status) ? latestForeachStep : undefined;
-    const stepId2 = reusableForeachStep?.id ?? crypto.randomUUID();
+    const stepId = reusableForeachStep?.id ?? crypto.randomUUID();
     if (!reusableForeachStep) {
       await createWorkflowRunStep({
-        id: stepId2,
+        id: stepId,
         runId,
         nodeId: node.id,
         nodeType: node.type,
@@ -15376,20 +15446,38 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
         idempotencyKey
       });
     }
-    return { existingStep: existingStep2, stepId: stepId2, deduped: false };
+    claimedStepId = stepId;
+    executingSteps.add(stepId);
+    return { existingStep, stepId, deduped: false };
+  };
+  const dedup = await getDbClient().transaction(claimStep).catch((err) => {
+    if (claimedStepId)
+      executingSteps.delete(claimedStepId);
+    throw err;
   });
   if ("halted" in dedup)
     return { outcome: "completed", successors: [] };
+  if ("current" in dedup && dedup.current) {
+    if (dedup.current.status !== "completed")
+      return { outcome: "waiting", successors: [] };
+    ctx[node.id] = dedup.current.output;
+    return { outcome: "completed", successors: [] };
+  }
   if (dedup.deduped && dedup.existingStep) {
     if (dedup.existingStep.status === "completed") {
       ctx[node.id] = dedup.existingStep.output;
-      const successors2 = getSuccessors(def, node.id);
-      return { outcome: "completed", successors: successors2 };
+      const successors = getSuccessors(def, node.id);
+      return { outcome: "completed", successors };
     }
     return { outcome: "waiting", successors: [] };
   }
-  const existingStep = dedup.existingStep;
-  const stepId = dedup.stepId;
+  try {
+    return await runClaimedStep(def, runId, ctx, node, registry, dedup.existingStep, dedup.stepId, workflowId, options);
+  } finally {
+    executingSteps.delete(dedup.stepId);
+  }
+}
+async function runClaimedStep(def, runId, ctx, node, registry, existingStep, stepId, workflowId, options = {}) {
   const executor = registry.get(node.type);
   const interpolationCtx = buildNodeInterpolationCtx(node, ctx);
   if (node.inputSchema) {
@@ -15493,9 +15581,7 @@ async function executeStep(def, runId, ctx, node, registry, workflowId, secretKe
       return { outcome: "completed", successors: [] };
     }
   }
-  if (validationResult?.passed !== undefined && !result.nextPort && node.next && typeof node.next === "object" && !Array.isArray(node.next)) {
-    result.nextPort = validationResult.passed ? "pass" : "fail";
-  }
+  result.nextPort = resolveValidationPort(node.next, result.nextPort, validationResult?.passed);
   await checkpointStep(runId, stepId, node.id, result, ctx);
   const successors = result.nextPort ? getSuccessors(def, node.id, result.nextPort) : getSuccessors(def, node.id);
   return { outcome: "completed", successors };
@@ -15656,6 +15742,8 @@ init_secret_scrubber();
 
 // src/workflows/approval-notifications.ts
 init_db();
+init_resolver();
+init_types();
 init_secret_scrubber();
 async function postApprovalCancellationUpdates(approvals, reason, client = getSlackApp()?.client) {
   if (!client)
@@ -15689,6 +15777,60 @@ async function postApprovalCancellationUpdates(approvals, reason, client = getSl
     }
   }
 }
+async function createApprovalFollowUpTask(request, templateEventType) {
+  if (request.workflowRunId || !request.sourceTaskId)
+    return false;
+  const sourceTask = await getTaskById(request.sourceTaskId);
+  if (!sourceTask)
+    return false;
+  if (templateEventType === "hitl.timeout" && TERMINAL_TASK_STATUSES.includes(sourceTask.status)) {
+    return false;
+  }
+  const { text: taskText } = templateEventType === "hitl.follow_up" ? resolveTemplate("hitl.follow_up", {
+    request_id: request.id,
+    title: request.title,
+    status: request.status,
+    responses: formatResponses(request.questions, request.responses ?? {})
+  }) : resolveTemplate("hitl.timeout", {
+    request_id: request.id,
+    title: request.title,
+    expires_at: request.expiresAt ?? "",
+    reason: request.resolutionReason ?? ""
+  });
+  await createTaskExtended(taskText, {
+    agentId: sourceTask.agentId,
+    routingReason: sourceTask.agentId ? "continuity" : undefined,
+    routingSource: sourceTask.agentId ? "engine_default" : undefined,
+    parentTaskId: request.sourceTaskId,
+    source: "system",
+    taskType: "hitl-follow-up",
+    tags: ["hitl", "follow-up"],
+    slackChannelId: sourceTask.slackChannelId ?? undefined,
+    slackThreadTs: sourceTask.slackThreadTs ?? undefined,
+    slackUserId: sourceTask.slackUserId ?? undefined
+  });
+  return true;
+}
+function formatResponses(questions, responses) {
+  return questions.map((q) => {
+    const answer = responses[q.id];
+    let answerText;
+    if (answer == null) {
+      answerText = "(no answer)";
+    } else if (q.type === "approval") {
+      const a = answer;
+      answerText = a.approved ? "Approved" : "Rejected";
+      if (a.comment)
+        answerText += ` — ${a.comment}`;
+    } else if (typeof answer === "object") {
+      answerText = JSON.stringify(answer);
+    } else {
+      answerText = String(answer);
+    }
+    return `- ${q.label}: ${answerText}`;
+  }).join(`
+`);
+}
 
 // src/workflows/resume.ts
 init_event_bus();
@@ -16166,6 +16308,12 @@ async function resumeFromTaskCompletion(event, registry) {
 async function finalizeOrWait(runId) {
   await getDbClient().transaction(async () => {
     const steps = await getWorkflowRunStepsByRunId(runId);
+    if (hasRunningStep(steps)) {
+      const run = await getWorkflowRun(runId);
+      if (run?.status === "waiting")
+        await updateWorkflowRun(runId, { status: "running" });
+      return;
+    }
     const hasWaiting = steps.some((s) => s.status === "waiting");
     if (hasWaiting) {
       await updateWorkflowRun(runId, { status: "waiting" });
@@ -16253,27 +16401,19 @@ async function retryFailedRun(runId, registry) {
   });
   if (!claimed)
     throw new Error("Run is not in failed state");
-  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges);
+  const liveNodeIds = new Set(steps.filter((s) => s.status === "running" || s.status === "waiting").map((s) => s.nodeId));
+  const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges).filter((n) => n.id === failedNode.id || !liveNodeIds.has(n.id));
   const nodesToRun = !shouldRetryFailedNode || readyNodes.some((n) => n.id === failedNode.id) ? readyNodes : [failedNode, ...readyNodes];
   const secretKeys = getSecretInputKeys(workflow.input);
   await walkGraph(workflow.definition, runId, ctx, nodesToRun, registry, workflow.id, secretKeys);
 }
-async function cancelWorkflowRun(runId, reason) {
-  const run = await getWorkflowRun(runId);
-  if (!run)
-    throw new Error("Workflow run not found");
+async function cancelWorkflowRunRows(runId, cancelReason) {
   const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
-  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
-    throw new Error(`Cannot cancel run in '${run.status}' state`);
-  }
   const now = new Date().toISOString();
-  const cancelReason = reason ?? "Cancelled by user";
-  let applied = false;
-  await getDbClient().transaction(async () => {
+  return await getDbClient().transaction(async () => {
     const current = await getWorkflowRun(runId);
     if (!current || terminalStatuses.includes(current.status))
-      return;
-    applied = true;
+      return false;
     const steps = await getWorkflowRunStepsByRunId(runId);
     for (const step of steps) {
       if (terminalStatuses.includes(step.status))
@@ -16294,7 +16434,19 @@ async function cancelWorkflowRun(runId, reason) {
       error: cancelReason,
       finishedAt: now
     });
+    return true;
   });
+}
+async function cancelWorkflowRun(runId, reason) {
+  const run = await getWorkflowRun(runId);
+  if (!run)
+    throw new Error("Workflow run not found");
+  const terminalStatuses = ["completed", "failed", "cancelled", "skipped"];
+  if (terminalStatuses.includes(run.status) && run.status !== "cancelled") {
+    throw new Error(`Cannot cancel run in '${run.status}' state`);
+  }
+  const cancelReason = reason ?? "Cancelled by user";
+  const applied = await cancelWorkflowRunRows(runId, cancelReason);
   const cancelledApprovals = await listCancelledApprovalRequestsForRun(runId);
   const latestRun = await getWorkflowRun(runId);
   if (!applied && latestRun?.status !== "cancelled") {
@@ -16313,6 +16465,10 @@ async function resumeFromApprovalResolution(event, registry) {
   if (!workflow)
     return;
   const ctx = run.context ?? {};
+  if (event.status === "cancelled") {
+    console.warn(`[workflows] approval ${event.requestId} is cancelled; step ${event.workflowRunStepId} stays waiting for the run cancel path`);
+    return;
+  }
   const nextPort = event.status === "timeout" ? "timeout" : event.status === "rejected" ? "rejected" : "approved";
   const stepOutput = {
     requestId: event.requestId,
@@ -16507,15 +16663,13 @@ async function recoverRunningRuns(registry) {
       const completedNodeIds = new Set(await getCompletedStepNodeIds(runId));
       const ctx = run.context ?? {};
       const { activeEdges } = await loadCompletedStepRouting(workflow.definition, runId, completedNodeIds);
-      const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges);
+      const retryPending = retryPendingNodeIds(await getWorkflowRunStepsByRunId(runId));
+      const readyNodes = findReadyNodes(workflow.definition, completedNodeIds, activeEdges).filter((node) => !retryPending.has(node.id));
       if (isWorkflowRunActive(runId))
         continue;
       if (readyNodes.length === 0) {
-        await updateWorkflowRun(runId, {
-          status: "completed",
-          context: ctx,
-          finishedAt: new Date().toISOString()
-        });
+        if (!await completeIfSettled(runId, ctx))
+          continue;
       } else {
         const secretKeys = getSecretInputKeys(workflow.input);
         await walkGraph(workflow.definition, runId, ctx, readyNodes, registry, workflow.id, secretKeys);
@@ -16527,6 +16681,38 @@ async function recoverRunningRuns(registry) {
   }
   return recovered;
 }
+function retryPendingNodeIds(steps) {
+  const nodeIds = new Set;
+  for (const step of steps) {
+    if (step.status === "failed" && step.nextRetryAt != null)
+      nodeIds.add(step.nodeId);
+  }
+  return nodeIds;
+}
+async function completeIfSettled(runId, ctx) {
+  return getDbClient().transaction(async () => {
+    const run = await getWorkflowRun(runId);
+    if (run?.status !== "running")
+      return false;
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    if (retryPendingNodeIds(steps).size > 0)
+      return false;
+    const latest = new Map;
+    for (const step of steps)
+      latest.set(step.nodeId, step);
+    for (const step of latest.values()) {
+      if (step.status === "running" || step.status === "waiting" || step.status === "pending") {
+        return false;
+      }
+    }
+    await updateWorkflowRun(runId, {
+      status: "completed",
+      context: ctx,
+      finishedAt: new Date().toISOString()
+    });
+    return true;
+  });
+}
 async function recoverWaitingRuns(registry) {
   const stuckRuns = await getStuckWorkflowRuns();
   let recovered = 0;
@@ -16589,24 +16775,28 @@ async function recoverApprovalWaitingRuns(registry) {
       const workflow = await getWorkflow(stuck.workflowId);
       if (!run || !workflow)
         continue;
-      let approvalStatus = stuck.approvalStatus;
-      let responses = stuck.approvalResponses ? JSON.parse(stuck.approvalResponses) : null;
-      if (approvalStatus === "pending" && stuck.expiresAt) {
-        await resolveApprovalRequest(stuck.approvalId, {
-          status: "timeout"
-        });
-        approvalStatus = "timeout";
-        responses = null;
-      }
-      const nextPort = approvalStatus === "timeout" ? "timeout" : approvalStatus === "rejected" ? "rejected" : "approved";
       const ctx = run.context ?? {};
-      const stepOutput = {
-        requestId: stuck.approvalId,
-        status: approvalStatus,
-        responses
-      };
-      const routing = await checkpointPortStepAndResolveSuccessors(workflow.definition, stuck.runId, stuck.stepId, stuck.nodeId, stepOutput, nextPort, ctx);
-      if (!routing.claimed)
+      const routing = await getDbClient().transaction(async () => {
+        if (stuck.approvalStatus === "pending" && stuck.expiresAt) {
+          await resolveApprovalRequest(stuck.approvalId, {
+            status: "timeout",
+            resolutionReason: `Timed out: no answer before ${stuck.expiresAt}`
+          });
+        }
+        const approval = await getApprovalRequestById(stuck.approvalId);
+        const approvalStatus = approval?.status;
+        if (approvalStatus !== "approved" && approvalStatus !== "rejected" && approvalStatus !== "timeout") {
+          return null;
+        }
+        const nextPort = approvalStatus === "timeout" ? "timeout" : approvalStatus === "rejected" ? "rejected" : "approved";
+        const stepOutput = {
+          requestId: stuck.approvalId,
+          status: approvalStatus,
+          responses: approval?.responses ?? null
+        };
+        return await checkpointPortStepAndResolveSuccessors(workflow.definition, stuck.runId, stuck.stepId, stuck.nodeId, stepOutput, nextPort, ctx);
+      });
+      if (!routing?.claimed)
         continue;
       if (routing.successors.length > 0) {
         const secretKeys = getSecretInputKeys(workflow.input);
@@ -16665,6 +16855,7 @@ function startRetryPoller(registry, intervalMs = 5000) {
     try {
       const retryableSteps = await getRetryableSteps();
       for (const step of retryableSteps) {
+        let release;
         try {
           const run = await getWorkflowRun(step.runId);
           if (!run)
@@ -16676,17 +16867,9 @@ function startRetryPoller(registry, intervalMs = 5000) {
           if (!node)
             continue;
           console.log(`[workflows] Retrying step ${step.nodeId} (attempt ${step.retryCount}) for run ${step.runId}`);
-          if (run.status === "failed") {
-            await updateWorkflowRun(run.id, {
-              status: "running",
-              error: undefined
-            });
-          }
-          await updateWorkflowRunStep(step.id, {
-            status: "running",
-            error: undefined,
-            nextRetryAt: undefined
-          });
+          release = holdWorkflowRun(run.id);
+          if (!await claimRetry(run.id, step.id))
+            continue;
           const ctx = run.context ?? {};
           if (!("run" in ctx))
             ctx.run = { id: run.id };
@@ -16722,6 +16905,7 @@ function startRetryPoller(registry, intervalMs = 5000) {
               if (!waiting)
                 continue;
             } else {
+              let validationPassed;
               if (node.validation) {
                 const validationResult = await runStepValidation(registry, node, result.output, ctx, meta);
                 if (validationResult.outcome === "halt") {
@@ -16738,18 +16922,16 @@ function startRetryPoller(registry, intervalMs = 5000) {
                   await checkpointStepFailure(run.id, step.id, "Validation failed, retrying", step.retryCount, retryPolicy);
                   continue;
                 }
+                validationPassed = validationResult.passed;
               }
+              result.nextPort = resolveValidationPort(node.next, result.nextPort, validationPassed);
               await checkpointStep(run.id, step.id, step.nodeId, result, ctx);
               const port = result.nextPort || "default";
               const successors = getSuccessors(workflow.definition, step.nodeId, port);
               if (successors.length > 0) {
                 await walkGraph(workflow.definition, run.id, ctx, successors, registry, workflow.id);
               } else {
-                await updateWorkflowRun(run.id, {
-                  status: "completed",
-                  context: ctx,
-                  finishedAt: new Date().toISOString()
-                });
+                await completeRunIfSettled(run.id, ctx);
               }
             }
           } catch (err) {
@@ -16759,6 +16941,8 @@ function startRetryPoller(registry, intervalMs = 5000) {
           }
         } catch (err) {
           console.error(`[workflows] Retry failed for step ${step.id}:`, err);
+        } finally {
+          release?.();
         }
       }
     } catch (err) {
@@ -16768,6 +16952,40 @@ function startRetryPoller(registry, intervalMs = 5000) {
   }
   pollerTimeout = setTimeout(poll, intervalMs);
 }
+async function claimRetry(runId, stepId) {
+  return getDbClient().transaction(async () => {
+    const run = await getWorkflowRun(runId);
+    if (!run || !RETRYABLE_RUN_STATUSES.has(run.status))
+      return false;
+    const claimed = await getDbClient().get(`UPDATE workflow_run_steps
+          SET status = 'running', nextRetryAt = NULL
+        WHERE id = ? AND runId = ? AND status = 'failed' AND nextRetryAt IS NOT NULL
+        RETURNING id`, [stepId, runId]);
+    if (!claimed)
+      return false;
+    if (run.status === "failed") {
+      await updateWorkflowRun(runId, { status: "running", error: undefined });
+    }
+    return true;
+  });
+}
+async function completeRunIfSettled(runId, ctx) {
+  await getDbClient().transaction(async () => {
+    const run = await getWorkflowRun(runId);
+    if (!run || run.status !== "running" && run.status !== "waiting")
+      return;
+    const steps = await getWorkflowRunStepsByRunId(runId);
+    const live = steps.some((s) => s.status === "running" || s.status === "waiting" || s.status === "failed" && s.nextRetryAt != null);
+    if (live)
+      return;
+    await updateWorkflowRun(runId, {
+      status: "completed",
+      context: ctx,
+      finishedAt: new Date().toISOString()
+    });
+  });
+}
+var RETRYABLE_RUN_STATUSES = new Set(["running", "waiting", "failed"]);
 function stopRetryPoller() {
   if (pollerTimeout !== null) {
     clearTimeout(pollerTimeout);
@@ -17394,7 +17612,8 @@ async function prepareStandaloneScheduleTask(schedule, extraTags = []) {
     source: "schedule",
     requestedByUserId: schedule.createdBy,
     contextKey: scheduleContextKey({ scheduleId: schedule.id }),
-    parentTaskId: schedule.parentTaskId
+    parentTaskId: schedule.parentTaskId,
+    inheritParentFollowUpConfig: schedule.taskType === "deferred" && !!schedule.parentTaskId
   }, { origin: "schedule" });
 }
 async function createStandaloneScheduleTask(schedule, extraTags = [], prepared) {
@@ -27773,7 +27992,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-enysy1zd.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-g26wdcz6.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -27844,7 +28063,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-w8ghhsgf.js");
+  const { getDbClient: getDbClient2 } = await import("./db-03v9kzr2.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -100323,6 +100542,19 @@ async function handleTaskProgress(data) {
     console.error(`[Linear Outbound] Failed to post progress action for task ${taskId}:`, err);
   });
 }
+var LINEAR_BODY_MAX = 30000;
+function formatLinearOutcomeBody(text, taskId) {
+  if (text.length <= LINEAR_BODY_MAX)
+    return text;
+  const dashboardUrl = (process.env.SWARM_DASHBOARD_URL || process.env.APP_URL)?.replace(/\/+$/, "");
+  const where = dashboardUrl ? `${dashboardUrl}/tasks/${taskId}` : `swarm task \`${taskId}\``;
+  const note = (shown2) => `
+
+---
+_Truncated: showing ${shown2} of ${text.length} characters. Full text: ${where}_`;
+  const shown = LINEAR_BODY_MAX - note(LINEAR_BODY_MAX).length;
+  return `${text.slice(0, shown).trimEnd()}${note(shown)}`;
+}
 async function handleTaskCompleted2(data) {
   const { taskId, output } = data;
   if (!taskId)
@@ -100333,11 +100565,7 @@ async function handleTaskCompleted2(data) {
   if (shouldSkipForLoopPrevention2(sync))
     return;
   const sessionId = taskSessionMap.get(taskId);
-  const body = output ? `Task completed.
-
-+++ Output
-${output.slice(0, 2000)}
-+++` : "Task completed.";
+  const body = output?.trim() ? formatLinearOutcomeBody(output, taskId) : "Task completed.";
   if (sessionId) {
     endAgentSession(sessionId, body, "response").catch((err) => {
       console.error(`[Linear Outbound] Failed to end AgentSession for task ${taskId}:`, err);
@@ -100353,12 +100581,7 @@ ${output.slice(0, 2000)}
         console.log("[Linear Outbound] No Linear client available, skipping sync for", taskId);
         return;
       }
-      const comment = output ? `Task completed by swarm agent.
-
-+++ Output
-${output.slice(0, 2000)}
-+++` : "Task completed by swarm agent.";
-      await client.createComment({ issueId: sync.externalId, body: comment });
+      await client.createComment({ issueId: sync.externalId, body });
       console.log(`[Linear Outbound] Posted completion comment for task ${taskId}`);
     } catch (error) {
       console.error(`[Linear Outbound] Failed to sync task completion for ${taskId}:`, error instanceof Error ? error.message : error);
@@ -100379,11 +100602,9 @@ async function handleTaskFailed2(data) {
   if (shouldSkipForLoopPrevention2(sync))
     return;
   const sessionId = taskSessionMap.get(taskId);
-  const body = failureReason ? `Task failed.
+  const body = failureReason?.trim() ? formatLinearOutcomeBody(`Task failed.
 
-+++ Error Details
-${failureReason.slice(0, 2000)}
-+++` : "Task failed.";
+${failureReason}`, taskId) : "Task failed.";
   if (sessionId) {
     endAgentSession(sessionId, body, "error").catch((err) => {
       console.error(`[Linear Outbound] Failed to end AgentSession for task ${taskId}:`, err);
@@ -100399,12 +100620,7 @@ ${failureReason.slice(0, 2000)}
         console.log("[Linear Outbound] No Linear client available, skipping sync for", taskId);
         return;
       }
-      const comment = failureReason ? `Task failed.
-
-+++ Error Details
-${failureReason.slice(0, 2000)}
-+++` : "Task failed.";
-      await client.createComment({ issueId: sync.externalId, body: comment });
+      await client.createComment({ issueId: sync.externalId, body });
       console.log(`[Linear Outbound] Posted failure comment for task ${taskId}`);
     } catch (error) {
       console.error(`[Linear Outbound] Failed to sync task failure for ${taskId}:`, error instanceof Error ? error.message : error);
@@ -101579,7 +101795,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-dc2ek6bw.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-c6zsv1bd.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await stopSlackApp();
@@ -101592,10 +101808,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-zfxb937k.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-se8zmdcp.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-r6shx5qx.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-g5ckg9yb.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -102408,7 +102624,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-cp1rknjz.js");
+  const dispatcher = await import("./dispatcher-nrmg8yht.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -102631,6 +102847,7 @@ init_secret_scrubber();
 
 // src/apps/row-store.ts
 init_db();
+init_db_client();
 class AppRowValidationError extends Error {
   issues;
   constructor(issues) {
@@ -102648,6 +102865,9 @@ class AppRowAppNotFoundError extends Error {
 }
 var mutationChains = new Map;
 var lastCreatedAtMs = 0;
+function yieldToEventLoop() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
 function appsNamespace(appId2) {
   return `apps:${appId2}`;
 }
@@ -102840,11 +103060,12 @@ async function getAppRow(appId2, model, rowId) {
   }
   return entry.value;
 }
-async function listAppRows(appId2, model) {
+async function listAppRows(appId2, model, equals = []) {
   const entries = await listKv(appsNamespace(appId2), {
     prefix: `${model}/row/`,
     limit: 1e5,
-    offset: 0
+    offset: 0,
+    jsonFieldEquals: equals.filter((filter) => !/["\\]/.test(filter.column)).map((filter) => ({ field: filter.column, value: filter.value }))
   });
   return entries.map((entry) => entry.value).filter((value) => typeof value === "object" && value !== null && !Array.isArray(value));
 }
@@ -102853,18 +103074,32 @@ async function listAllAppRowsForMigrationUnlocked(appId2, model) {
   const rows = [];
   const namespace2 = appsNamespace(appId2);
   const prefix = `${model}/row/`;
-  let offset = 0;
+  const upper = kvPrefixUpperBound(prefix);
+  let afterKey = "";
   while (true) {
-    const entries = await listKv(namespace2, { prefix, limit: MIGRATION_KV_BATCH_SIZE, offset });
-    for (const entry of entries) {
-      const value = entry.value;
+    const page = await getDbClient().query(`SELECT key, value, value_type FROM kv_entries
+          WHERE namespace = ? AND key >= ? AND key < ? AND key > ?
+            AND (expires_at IS NULL OR expires_at > ?)
+          ORDER BY key
+          LIMIT ?`, [namespace2, prefix, upper, afterKey, Date.now(), MIGRATION_KV_BATCH_SIZE]);
+    for (const entry of page) {
+      if (entry.value_type !== "json")
+        continue;
+      let value;
+      try {
+        value = JSON.parse(entry.value);
+      } catch {
+        continue;
+      }
       if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         rows.push(value);
       }
     }
-    if (entries.length < MIGRATION_KV_BATCH_SIZE)
+    if (page.length < MIGRATION_KV_BATCH_SIZE)
       return rows;
-    offset += entries.length;
+    afterKey = page[page.length - 1].key;
+    if (!isInTransaction())
+      await yieldToEventLoop();
   }
 }
 function patchAppRow(appId2, model, _definition, rowId, values, options = {}) {
@@ -102962,14 +103197,16 @@ function deleteAppRow(appId2, model, _definition, rowId) {
     return true;
   });
 }
+var PURGE_BATCH_SIZE = 1000;
 async function purgeNamespace(appId2) {
   const namespace2 = appsNamespace(appId2);
   while (true) {
-    const entries = await listKv(namespace2, { prefix: "", limit: 1e5, offset: 0 });
-    if (entries.length === 0)
+    const result = await getDbClient().run(`DELETE FROM kv_entries
+          WHERE namespace = ?
+            AND key IN (SELECT key FROM kv_entries WHERE namespace = ? ORDER BY key LIMIT ?)`, [namespace2, namespace2, PURGE_BATCH_SIZE]);
+    if (result.changes === 0)
       return;
-    for (const entry of entries)
-      await deleteKv(namespace2, entry.key);
+    await yieldToEventLoop();
   }
 }
 function purgeAppRows(appId2, models, afterPurge) {
@@ -103318,6 +103555,30 @@ function pairFingerprint(model, sourceName, source) {
   }));
   return JSON.stringify({ source, bindings });
 }
+var RECONCILE_CHUNK_SIZE = 200;
+async function writeInChunks(items, counts, write) {
+  for (let start = 0;start < items.length; start += RECONCILE_CHUNK_SIZE) {
+    const chunk = items.slice(start, start + RECONCILE_CHUNK_SIZE);
+    const tally = await getDbClient().transaction(async () => {
+      const chunkTally = {
+        created: 0,
+        updated: 0,
+        refreshed: 0,
+        unchanged: 0,
+        markedStale: 0
+      };
+      for (const item of chunk)
+        await write(item, chunkTally);
+      return chunkTally;
+    });
+    counts.created += tally.created;
+    counts.updated += tally.updated;
+    counts.refreshed += tally.refreshed;
+    counts.unchanged += tally.unchanged;
+    counts.markedStale += tally.markedStale;
+    await yieldToEventLoop();
+  }
+}
 function reconcile(args) {
   const { appId: appId2, model, sourceName, joinKey, pull, warnings, counts } = args;
   return withMutationLock(appId2, model, async () => {
@@ -103344,7 +103605,7 @@ function reconcile(args) {
     const now = new Date().toISOString();
     const actor = `sync:${sourceName}`;
     const seen = new Set;
-    for (const record3 of pull.records) {
+    await writeInChunks(pull.records, counts, async (record3, tally) => {
       if (seen.has(record3.key)) {
         warn(warnings, `source returned duplicate key "${record3.key}"; the last record wins`);
       }
@@ -103359,8 +103620,8 @@ function reconcile(args) {
           actor
         });
         mine.set(record3.key, created);
-        counts.created += 1;
-        continue;
+        tally.created += 1;
+        return;
       }
       const differs = Object.entries(values).some(([name, value]) => !sameValue(existing[name], value));
       const updated = await patchAppRowUnlocked(appId2, model, modelDef, existing.id, values, {
@@ -103371,14 +103632,14 @@ function reconcile(args) {
       });
       if (!updated) {
         warn(warnings, `row "${existing.id}" vanished before it could be updated`);
-        continue;
+        return;
       }
       mine.set(record3.key, updated);
       if (differs)
-        counts.updated += 1;
+        tally.updated += 1;
       else
-        counts.refreshed += 1;
-    }
+        tally.refreshed += 1;
+    });
     const unseen = [...mine.entries()].filter(([key]) => !seen.has(key)).map(([, row]) => row).concat(unkeyed);
     if (!pull.complete) {
       counts.staleSweepSkipped = true;
@@ -103386,10 +103647,10 @@ function reconcile(args) {
       warn(warnings, "pull reported an incomplete window; stale sweep skipped");
       return;
     }
-    for (const row of unseen) {
+    await writeInChunks(unseen, counts, async (row, tally) => {
       if (row.stale === true) {
-        counts.unchanged += 1;
-        continue;
+        tally.unchanged += 1;
+        return;
       }
       await patchAppRowUnlocked(appId2, model, modelDef, row.id, {}, {
         allowSourceManaged: true,
@@ -103400,8 +103661,8 @@ function reconcile(args) {
           stale: true
         }
       });
-      counts.markedStale += 1;
-    }
+      tally.markedStale += 1;
+    });
   });
 }
 var inFlight = new Map;
@@ -105561,7 +105822,7 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       json(res, { error: "invalid row query", issues }, 400);
       return true;
     }
-    const rows = (await listAppRows(parsed.params.id, parsed.params.model)).filter((row) => filters.every((filter) => rowValue(row, filter.column) === filter.value));
+    const rows = (await listAppRows(parsed.params.id, parsed.params.model, filters.flatMap((filter) => typeof filter.value === "string" || typeof filter.value === "number" || typeof filter.value === "boolean" ? [{ column: filter.column, value: filter.value }] : []))).filter((row) => filters.every((filter) => rowValue(row, filter.column) === filter.value));
     const sortRaw = parsed.query.sort;
     if (sortRaw) {
       const [column, dir, extra] = sortRaw.split(":");
@@ -106717,6 +106978,148 @@ var registerAppUpsertTool = (server) => {
   });
 };
 
+// src/tools/cancel-approval-request.ts
+init_zod();
+init_db();
+
+// src/workflows/approval-cancel.ts
+init_db();
+var LIVE_RUN_STATUSES = new Set(["running", "waiting"]);
+async function cancelApprovalRequest(input) {
+  const finalReason = input.reason ?? "Cancelled through the API";
+  let authorized = false;
+  for (let attempt = 0;attempt < 3; attempt++) {
+    const existing = await getApprovalRequestById(input.id);
+    if (!existing)
+      return { ok: false, status: 404, message: "Approval request not found" };
+    if (existing.status === "cancelled") {
+      return { ok: true, request: existing, alreadyCancelled: true, runCancelled: false };
+    }
+    if (existing.status !== "pending") {
+      return {
+        ok: false,
+        status: 409,
+        message: `Approval request already resolved with status: ${existing.status}`
+      };
+    }
+    if (!authorized) {
+      const ownerAgentId = existing.sourceTaskId ? (await getTaskById(existing.sourceTaskId))?.agentId ?? null : null;
+      const decision = can({
+        principal: input.principal,
+        verb: "approval.cancel.any",
+        resource: { kind: "owned", ownerAgentId },
+        source: input.source ?? "http"
+      });
+      if (!decision.allow)
+        return { ok: false, status: 403, message: decision.reason };
+      authorized = true;
+    }
+    const result = await cancelApprovalRequestAndRun(input.id, {
+      reason: finalReason,
+      resolvedBy: input.resolvedBy
+    });
+    if (!result)
+      continue;
+    if ("timedOut" in result) {
+      return {
+        ok: false,
+        status: 409,
+        message: `Approval request expired at ${result.timedOut.expiresAt}`
+      };
+    }
+    return {
+      ok: true,
+      request: result.request,
+      alreadyCancelled: false,
+      runCancelled: result.runCancelled
+    };
+  }
+  return { ok: false, status: 409, message: "Approval request changed during cancellation" };
+}
+async function cancelApprovalRequestAndRun(id, data) {
+  const client = getDbClient();
+  return await client.transaction(async () => {
+    const current = await getApprovalRequestById(id);
+    if (current?.status === "pending" && current.expiresAt && new Date(current.expiresAt) < new Date) {
+      const timedOut = await resolveApprovalRequest(id, {
+        status: "timeout",
+        resolutionReason: `Timed out: the cancellation arrived after the deadline ${current.expiresAt}`
+      });
+      if (!timedOut)
+        return null;
+      await createApprovalFollowUpTask(timedOut, "hitl.timeout");
+      return { timedOut };
+    }
+    const request = await cancelApprovalRequestById(id, {
+      reason: data.reason,
+      resolvedBy: data.resolvedBy
+    });
+    if (!request)
+      return null;
+    let runCancelled = false;
+    const runId = request.workflowRunId;
+    if (runId) {
+      const run = await getWorkflowRun(runId);
+      if (run && LIVE_RUN_STATUSES.has(run.status)) {
+        runCancelled = await cancelWorkflowRunRows(runId, data.reason);
+      }
+    }
+    const slackReason = data.slackReason ?? data.reason;
+    client.afterCommit(async () => {
+      await postApprovalCancellationUpdates([request], slackReason);
+      if (runCancelled && runId) {
+        const others = (await listCancelledApprovalRequestsForRun(runId)).filter((row) => row.id !== request.id);
+        await postApprovalCancellationUpdates(others, data.reason);
+      }
+    });
+    return { request, runCancelled };
+  });
+}
+
+// src/tools/cancel-approval-request.ts
+var cancelApprovalRequestInputSchema = object({
+  requestId: uuid().describe("The ID of the approval request to cancel."),
+  reason: string().max(500).optional().describe("Reason for cancellation.")
+});
+var cancelApprovalRequestOutputSchema = swarmToolOutputSchema({
+  yourAgentId: string().optional(),
+  approvalRequest: looseObject({}).optional(),
+  alreadyCancelled: boolean().optional(),
+  runCancelled: boolean().optional()
+});
+var registerCancelApprovalRequestTool = (server) => {
+  createToolRegistrar(server)("cancel-approval-request", {
+    title: "Cancel approval request",
+    description: "Cancel a pending approval request by id. Allowed for a lead agent, or for the agent that owns the request's source task. If the request gates a running or waiting workflow run, that run is cancelled too. A request whose explicit timeout passed is already 'timeout' and cannot be cancelled.",
+    annotations: { destructiveHint: true },
+    inputSchema: cancelApprovalRequestInputSchema,
+    outputSchema: cancelApprovalRequestOutputSchema
+  }, async ({ requestId, reason }, info) => {
+    if (!info.agentId) {
+      return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+    }
+    const agent = await getAgentById(info.agentId);
+    const result = await cancelApprovalRequest({
+      id: requestId,
+      reason,
+      principal: { kind: "agent", agentId: info.agentId, isLead: agent?.isLead ?? false },
+      resolvedBy: info.agentId,
+      source: "mcp"
+    });
+    if (!result.ok) {
+      return toolErr(result.message, { data: { yourAgentId: info.agentId } });
+    }
+    const data = {
+      yourAgentId: info.agentId,
+      approvalRequest: result.request,
+      alreadyCancelled: result.alreadyCancelled,
+      runCancelled: result.runCancelled
+    };
+    const message = result.alreadyCancelled ? `Approval request "${requestId}" was already cancelled.` : `Approval request "${requestId}" cancelled${result.runCancelled ? ", and its workflow run with it" : ""}.`;
+    return toolOk(message, { data, details: JSON.stringify(data, null, 2) });
+  });
+};
+
 // src/tools/cancel-task.ts
 init_zod();
 init_db();
@@ -108460,8 +108863,8 @@ async function recordRetrievals(taskId, agentId, results, sessionId, extras) {
   if (!taskId || results.length === 0)
     return;
   const insertSql = `INSERT INTO memory_retrieval
-       (id, taskId, agentId, sessionId, memoryId, similarity, retrievedAt, contextKey, intent, eventType, retrievalId, rank, retrievalSource)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+       (id, taskId, agentId, sessionId, memoryId, similarity, retrievedAt, contextKey, intent, eventType, retrievalId, rank, retrievalSource, relevance)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
   const now = new Date().toISOString();
   const retrievalId = crypto.randomUUID();
   const contextKey = extras?.contextKey ?? null;
@@ -108482,7 +108885,8 @@ async function recordRetrievals(taskId, agentId, results, sessionId, extras) {
         eventType,
         retrievalId,
         rank,
-        r.retrievalSource ?? null
+        r.retrievalSource ?? null,
+        r.relevance ?? null
       ]);
     }
   });
@@ -109049,6 +109453,7 @@ async function createResumeFollowUp(args) {
     tags,
     priority,
     parentTaskId: parent.id,
+    inheritParentFollowUpConfig: true,
     routingAffinity
   });
   if (authorizationDecision) {
@@ -112479,6 +112884,7 @@ async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
     neighbors.set(row.id, {
       ...rowToCandidate(row, similarity),
       retrievalSource: "graph",
+      graphParentId: parent.id,
       recencyDecayApplied: false
     });
   }
@@ -112492,7 +112898,9 @@ async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
   for (const neighbor of ranked) {
     const existingIndex = indexById.get(neighbor.id);
     if (existingIndex !== undefined) {
-      if (computeScore(neighbor, now) > computeScore(result[existingIndex], now)) {
+      const parent = parentById.get(neighbor.graphParentId);
+      const graphScore = Math.min(computeScore(neighbor, now), computeScore(parent, now));
+      if (graphScore > computeScore(result[existingIndex], now)) {
         result[existingIndex] = neighbor;
       }
       continue;
@@ -112580,6 +112988,7 @@ var registerMemorySearchTool = (server) => {
           await recordRetrievals(requestInfo.sourceTaskId, requestInfo.agentId, ranked.map((r) => ({
             memoryId: r.id,
             similarity: r.similarity,
+            relevance: r.rawSimilarity,
             retrievalSource: r.retrievalSource
           })), requestInfo.sessionId, { intent, contextKey: requestInfo.contextKey, eventType: "search" });
         } catch (err) {
@@ -112769,9 +113178,9 @@ function hardSplit(text) {
   while (start < text.length) {
     const end = Math.min(start + MAX_CHUNK_SIZE, text.length);
     chunks.push(text.slice(start, end).trim());
-    start = end - CHUNK_OVERLAP;
-    if (start >= text.length - MIN_CHUNK_SIZE)
+    if (end === text.length)
       break;
+    start = end - CHUNK_OVERLAP;
   }
   return chunks.filter((c) => c.length > 0);
 }
@@ -114413,11 +114822,11 @@ var registerRequestHumanInputTool = (server) => {
   createToolRegistrar(server)("request-human-input", {
     title: "Request human input",
     annotations: { destructiveHint: false },
-    description: "Create an approval request that pauses until a human responds. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, and boolean. Returns the request ID and URL for the human to respond.",
+    description: "Create an approval request and return at once with the request id and URL. The answer arrives later as a hitl-follow-up task. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, and boolean. Returns the request ID and URL for the human to respond.",
     inputSchema: object({
       title: string().min(1).describe("Title of the approval request"),
       questions: array(QuestionSchema).min(1).describe("Questions to ask the human"),
-      timeoutSeconds: number().int().min(1).optional().describe("Timeout in seconds (auto-rejects on timeout)")
+      timeoutSeconds: number().int().min(1).optional().describe("Seconds until the request expires. After that the request becomes 'timeout' and you get a hitl-follow-up task. A request with no timeout is cancelled after APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS days (default 7).")
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string().optional(),
@@ -121253,6 +121662,10 @@ async function getEventsFiltered(filters) {
     conditions.push("event = ?");
     params2.push(filters.event);
   }
+  if (filters.events && filters.events.length > 0) {
+    conditions.push(`event IN (${filters.events.map(() => "?").join(", ")})`);
+    params2.push(...filters.events);
+  }
   if (filters.status) {
     conditions.push("status = ?");
     params2.push(filters.status);
@@ -121285,8 +121698,24 @@ async function getEventsFiltered(filters) {
     conditions.push("createdAt <= ?");
     params2.push(filters.until);
   }
-  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
   const limit = filters.limit ?? 100;
+  if (filters.latestPerDataField) {
+    const lookups = [];
+    const lookupParams = [];
+    for (const event of filters.latestPerDataField.events) {
+      for (const field of filters.latestPerDataField.dataFields) {
+        const where2 = [...conditions, "event = ?", "json_extract(data, '$.field') = ?"];
+        lookups.push(`SELECT * FROM (SELECT * FROM events WHERE ${where2.join(" AND ")} ORDER BY createdAt DESC LIMIT 1)`);
+        lookupParams.push(...params2, event, field);
+      }
+    }
+    if (lookups.length === 0)
+      return [];
+    const sql2 = `${lookups.join(" UNION ALL ")} ORDER BY createdAt DESC LIMIT ?`;
+    const rows2 = await getDbClient().query(sql2, [...lookupParams, limit]);
+    return rows2.map(rowToSwarmEvent);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
   params2.push(limit);
   const sql = `SELECT * FROM events ${where} ORDER BY createdAt DESC LIMIT ?`;
   const rows = await getDbClient().query(sql, params2);
@@ -122999,6 +123428,7 @@ async function sendTaskHandler(ctx, {
     slackUserId,
     overrideSlackContext,
     followUpConfig,
+    inheritParentFollowUpConfig: taskType === "resume",
     outputSchema,
     routingReason: effectiveRoutingReason,
     routingSource: effectiveRoutingSource,
@@ -128103,7 +128533,8 @@ async function listWorkflowRunsHandler({
     const { runs, page } = await listWorkflowRunsPage(workflowId, {
       status,
       limit,
-      offset
+      offset,
+      includeContext
     });
     const resultRuns = includeContext ? runs : runs.map(slimRun);
     return toolOk(`Found ${runs.length} run(s) at offset ${page.offset} (${page.total} total).`, {
@@ -128585,10 +129016,10 @@ async function createServer(opts = {}) {
   await loadGlobalConfigsIntoEnv(true);
   const hasCapability2 = (cap) => opts.fullSurface === true || getCapabilities().has(cap);
   initDb(process.env.DATABASE_PATH);
-  seedPricingFromModelsDev();
+  ensurePricingSeeded();
   startPricingRefreshLoop();
   try {
-    ensureRbacSeedsSynced();
+    ensureRbacSeeded();
   } catch (err) {
     console.error("[startup] Failed to sync RBAC seed rows:", err);
     if (isRbacEnabled())
@@ -128727,6 +129158,7 @@ async function createServer(opts = {}) {
     registerRetryWorkflowRunTool(server);
     registerCancelWorkflowRunTool(server);
     registerRequestHumanInputTool(server);
+    registerCancelApprovalRequestTool(server);
   }
   if (hasCapability2("skills")) {
     registerSkillCreateTool(server);
@@ -128953,7 +129385,8 @@ var SDK_TOOL_NAME_MAP = {
   page_create: "create_page",
   page_delete: "delete-page",
   metric_create: "create_metric",
-  request_humanInput: "request-human-input"
+  request_humanInput: "request-human-input",
+  approval_cancel: "cancel-approval-request"
 };
 var SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP);
 var MCP_TOOL_NAMES = new Set(Object.values(SDK_TOOL_NAME_MAP));
@@ -129297,6 +129730,16 @@ function bridgeRequestFor(name, args2) {
         throw new Error("task_cancel requires string `taskId`");
       return { method: "POST", path: `/api/tasks/${encodeURIComponent(taskId)}/cancel` };
     }
+    case "approval_cancel": {
+      const requestId = typeof body.requestId === "string" ? body.requestId : undefined;
+      if (!requestId)
+        throw new Error("approval_cancel requires string `requestId`");
+      return {
+        method: "POST",
+        path: `/api/approval-requests/${encodeURIComponent(requestId)}/cancel`,
+        body: { reason: body.reason }
+      };
+    }
     case "kv_get":
     case "kv_getOrNull":
       return { method: "GET", path: kvPath(body) };
@@ -131365,7 +131808,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp: getSlackApp2 } = await import("./app-enysy1zd.js");
+          const { getSlackApp: getSlackApp2 } = await import("./app-g26wdcz6.js");
           const slackApp = getSlackApp2();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -131379,7 +131822,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
               elements: [
                 {
                   type: "mrkdwn",
-                  text: `⏱ Timeout: ${formatTimeout(config.timeout.seconds)} — auto-rejects if not responded`
+                  text: `⏱ Timeout: ${formatTimeout(config.timeout.seconds)} — times out if not responded`
                 }
               ]
             }
@@ -131494,7 +131937,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-enysy1zd.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-g26wdcz6.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -132318,4 +132761,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, createApprovalFollowUpTask, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };