@desplega.ai/agent-swarm 1.157.0 → 1.159.0

package/dist/{http-c7jfx990.js → http-akc3wy3m.js}

@@ -1,14 +1,16 @@
 import {
   BROWSER_SDK_JS,
   SWARM_UI_JS
-} from "./cli-2daksqps.js";
+} from "./cli-t1ze64h3.js";
 import {
   ACP_TARGET_IDS
 } from "./cli-dgnj0zcc.js";
 import {
   SIMILARITY_THRESHOLD,
+  isUnknownModelError,
+  memoryRelevance,
   writeSkillsToFilesystem
-} from "./cli-tjmghmm5.js";
+} from "./cli-phsaj4xq.js";
 import {
   Anthropic
 } from "./cli-j490egb5.js";
@@ -16,7 +18,7 @@ import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-tpv97m71.js";
+} from "./cli-20035trh.js";
 import {
   isClaudeBridgeEffective,
   resolveClaudeTransport
@@ -26,11 +28,11 @@ import {
 } from "./cli-npssxgaz.js";
 import {
   reasoningCapability
-} from "./cli-avkd6mqv.js";
+} from "./cli-ca2w7zv7.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-vx9p3qdt.js";
+} from "./cli-mzkqpxee.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -57,6 +59,7 @@ import {
   TriggerSchemaError,
   WebhookError,
   activateVersion,
+  agentRanModel,
   agentWithCapacity,
   allowedCredentialRedirect,
   applyRating,
@@ -70,6 +73,7 @@ import {
   calculateNextRun,
   canClaim,
   canReadMemory,
+  cancelApprovalRequest,
   cancelTaskHandler,
   cancelTaskInputSchema,
   cancelTaskOutputSchema,
@@ -100,10 +104,13 @@ import {
   executeRawLlm,
   executeReadOnlyQuery,
   expandCandidatesWithGraph,
+  explicitModelError,
+  explicitModelErrorForAgent,
   extractAndVerifyCookie,
   findUserById,
   fingerprintApiKey,
   flushAuditBuffer,
+  getAgentHarnessCliVersion,
   getAutomationSetupStates,
   getEnabledCapabilities,
   getEventCountsFiltered,
@@ -182,6 +189,7 @@ import {
   listExtensionRuns,
   listExtensionVersions,
   listExtensions,
+  listHarnessModelSupport,
   listOAuthPresetIds,
   listOAuthPresets,
   listRuntimeInstancesForAgent,
@@ -198,13 +206,17 @@ import {
   mintToken,
   parseBody,
   parseCookieHeader,
+  parseModelTierOverridesHeader,
   parseQueryParams,
   parseSkillContent,
   patchWorkflowDefinition,
   preflightAutomation,
+  previewModelTiers,
   readScriptSdkJsonResponse,
   reconcileAgentMaxTasksPolicy,
   reconcileAgentStatusFromRuntimes,
+  recordClaimModelResolution,
+  recordHarnessModelSupport,
   recordIdentityEvent,
   recordMemoryAccesses,
   recordRetrievals,
@@ -241,11 +253,14 @@ import {
   runtimeInstanceHeader,
   runtimeStaleThresholdMinutes,
   safeRequestUrlForLog,
+  sanitizeModelTierOverrides,
   scheduleIntegrationsReload,
   scopedResourceScopeIdSchema,
   sendKapsoReaction,
   sendTaskHandler,
   sendTaskOutputSchema,
+  setAgentHarnessCliVersion,
+  setAgentModelTierOverrides,
   setCorsHeaders,
   setExtensionLoopbackBaseUrl,
   setRuntimeCredentialReady,
@@ -284,38 +299,25 @@ import {
   verifyHmacSignature,
   verifyWebhookSignature,
   warnIfCorsAllowsAnyOrigin,
-  wireHttpSpanLifecycle
-} from "./cli-01vfmq8c.js";
+  wireHttpSpanLifecycle,
+  workflowSaveWarnings
+} from "./cli-79aq9cgb.js";
 import"./cli-0z2v4nhw.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
-} from "./cli-tt9k8r35.js";
-import {
-  CLIENT_ID,
-  MAX_CODEX_OAUTH_SLOT,
-  _fetchHolder,
-  codexOAuthKeyForSlot,
-  deriveCodexKeySuffix,
-  exchangeAuthorizationCode as exchangeAuthorizationCode2,
-  getAccountId,
-  getValidCodexOAuth,
-  loadAllCodexOAuthSlots
-} from "./cli-vhjwh6cz.js";
+} from "./cli-cpvsaqsw.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-3dpj7atn.js";
-import"./cli-aw1jwp1r.js";
-import {
-  getModelsCatalog
-} from "./cli-6jjzxv3b.js";
 import {
-  normalizeModelKey
-} from "./cli-xf5b7y1f.js";
+  FilesError,
+  getFileStorageProvider,
+  normalizeFilesError
+} from "./cli-jsp14b6c.js";
 import {
   getUserGrant
-} from "./cli-f3va018d.js";
+} from "./cli-z9x0sh1t.js";
 import {
   LEGACY_RULES,
   can,
@@ -323,7 +325,17 @@ import {
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-ytxs7mn1.js";
+} from "./cli-9yg65c1j.js";
+import {
+  deleteModelCatalogOverlay,
+  loadModelsCatalog,
+  requestModelCatalogRefresh,
+  upsertModelCatalogOverlay
+} from "./cli-cygyqj3b.js";
+import"./cli-m4excttz.js";
+import {
+  normalizeModelKey
+} from "./cli-0n2e4x49.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -344,6 +356,7 @@ import {
   connectionAuthInputFromFlat,
   connectionAuthSummary,
   consumeMcpOAuthPending,
+  createApprovalFollowUpTask,
   createScriptApi,
   definitionNodeIds,
   deleteMcpOAuthToken,
@@ -415,7 +428,7 @@ import {
   upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-c41wjx0r.js";
+} from "./cli-fjtp3463.js";
 import"./cli-epan13p1.js";
 import {
   detachedProcessGroup,
@@ -427,9 +440,25 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import"./cli-rfezr056.js";
+import {
+  CLIENT_ID,
+  MAX_CODEX_OAUTH_SLOT,
+  _fetchHolder,
+  codexOAuthKeyForSlot,
+  deriveCodexKeySuffix,
+  exchangeAuthorizationCode as exchangeAuthorizationCode2,
+  getAccountId,
+  getValidCodexOAuth,
+  loadAllCodexOAuthSlots
+} from "./cli-vhjwh6cz.js";
+import"./cli-3dpj7atn.js";
+import"./cli-gzyh0j0g.js";
+import"./cli-rb9m6rpe.js";
+import"./cli-rykfmgwg.js";
 import {
   searchScripts
-} from "./cli-wsed24mk.js";
+} from "./cli-vwbbaecp.js";
 import {
   acquireOAuthRefreshLock,
   buildAuthorizationUrl,
@@ -453,34 +482,29 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-wb2zvbfg.js";
-import {
-  FilesError,
-  getFileStorageProvider,
-  normalizeFilesError
-} from "./cli-jsp14b6c.js";
+} from "./cli-qv4jv8bx.js";
+import"./cli-fad8m16k.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   EMBEDDING_DIMENSIONS,
+  OpenAI,
   getEmbeddingProvider,
   getMemoryStore,
   init_constants as init_constants2,
+  init_openai,
   init_reranker,
   rerank
-} from "./cli-v53rbqp3.js";
-import"./cli-nbp6m6gp.js";
+} from "./cli-kc3dp84d.js";
+import"./cli-10ym38qc.js";
 import"./cli-bsakbbkm.js";
-import"./cli-fad8m16k.js";
 import"./cli-51tf7ac3.js";
-import {
-  OpenAI,
-  init_openai
-} from "./cli-aehm1rbq.js";
 import {
   TaskCitationSchema,
   ensure,
   getSlackApp,
+  getSlackConnectionState,
   getTaskCitations,
+  getTaskCitationsForTasks,
   initOtel,
   initialize,
   isPollTracingEnabled,
@@ -493,7 +517,7 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-9p33cz9h.js";
+} from "./cli-wgjx0q33.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
 import"./cli-2658f6at.js";
@@ -571,6 +595,7 @@ import {
   deleteTaskAttachment,
   deleteUser,
   deleteWorkflow,
+  drainHumanFreeReclassifyQueue,
   emitBuiltInIntegrationConnectedOnce,
   emitIntegrationConnected,
   emitMcpServerConnectedTelemetry,
@@ -580,9 +605,11 @@ import {
   getActivePricingRow,
   getActiveSessions,
   getAgentById,
+  getAgentDailyTaskCounts,
   getAgentHarnessProviders,
   getAgentMcpServers,
   getAgentSkills,
+  getAgentStatusCounts,
   getAgentWithTasks,
   getAllAgents,
   getAllAgentsWithTasks,
@@ -668,9 +695,9 @@ import {
   getTaskById,
   getTaskStats,
   getTaskSteeringFields,
+  getTaskSteeringFieldsForTasks,
   getTasksCount,
   getUnassignedTaskIdsForAgent,
-  getUsageDataVersion,
   getUserById,
   getWorkflow,
   getWorkflowRun,
@@ -692,6 +719,7 @@ import {
   init_db,
   init_default_drift,
   init_heartbeat_expiry,
+  init_human_free,
   init_request_auth_context,
   init_steering,
   init_swarm_config_guard,
@@ -710,6 +738,7 @@ import {
   listAgentsWithCredStatusByProvider,
   listAllMetrics,
   listAllPages,
+  listApprovalRequestSummaries,
   listApprovalRequests,
   listAssetSummaries,
   listFavorites,
@@ -724,7 +753,6 @@ import {
   listSkillFileManifest,
   listSkills,
   listTaskTemplates,
-  listWorkflowRuns,
   listWorkflowRunsPage,
   listWorkflows,
   markKeyRateLimited,
@@ -757,7 +785,9 @@ import {
   setApiKeyName,
   setApiKeyPlan,
   setFavorite,
+  setHumanFreeQueueListener,
   setRequestAuth,
+  settleSupersededTaskDependents,
   startTask,
   supersedeTask,
   sweepExpiredKv,
@@ -801,7 +831,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-awwphhcs.js";
+} from "./cli-g9df2m37.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -851,6 +881,7 @@ import {
   KvKeySchema,
   KvNamespaceSchema,
   KvValueTypeSchema,
+  MODEL_TIERS,
   McpAuthMethodSchema,
   McpServerSchema,
   McpServerWithInstallInfoSchema,
@@ -918,6 +949,7 @@ import {
   WorkflowRunSchema,
   WorkflowRunStatusSchema,
   WorkflowRunStepSchema,
+  WorkflowRunSummarySchema,
   WorkflowSchema,
   WorkflowVersionSchema,
   init_bundle_path,
@@ -926,12 +958,16 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-h0wdadsx.js";
+} from "./cli-e4xnc0qp.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-3gmcwfyx.js";
+} from "./cli-ardpzhjm.js";
+import {
+  getSlackConfiguration,
+  init_config
+} from "./cli-n7h1kqpf.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -942,8 +978,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-ggm92wcn.js";
-import"./cli-19jenss3.js";
+} from "./cli-rgjprct3.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -952,26 +987,27 @@ import {
   getPublicMcpBaseUrl,
   init_constants
 } from "./cli-dv6cdjs2.js";
-import {
-  getSlackConfiguration,
-  init_config
-} from "./cli-n7h1kqpf.js";
-import {
-  MODEL_SCOPED_WINDOWS,
-  activeModelBlocks,
-  init_model_rate_limit_windows
-} from "./cli-de1396j2.js";
 import {
   SUBSCRIPTION_PLANS,
   SUBSCRIPTION_PLANS_CHECKED_AT,
   init_subscription_plans,
   isSubscriptionPlanId
 } from "./cli-cqt19wg6.js";
+import"./cli-19jenss3.js";
+import {
+  MODEL_SCOPED_WINDOWS,
+  activeModelBlocks,
+  init_model_rate_limit_windows
+} from "./cli-de1396j2.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
   parseEnvFlag
 } from "./cli-ej6gbxfb.js";
+import {
+  init_src,
+  isAlias
+} from "./cli-7zttzetj.js";
 import {
   exports_zod,
   init_zod
@@ -988,7 +1024,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-sgyqyyxe.js";
+} from "./cli-48527fpw.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -997,20 +1033,20 @@ import {
 } from "./cli-r2ap2czm.js";
 import {
   bedrockProviderModule
-} from "./cli-h38x0qhg.js";
+} from "./cli-kdnehe0t.js";
 import"./cli-yn0a417a.js";
 import"./cli-cgj4hc12.js";
 import"./cli-txgcknmy.js";
 import"./cli-6map995v.js";
-import"./cli-k0g1sjzm.js";
+import"./cli-31nkw3g3.js";
 import"./cli-y2apkfe2.js";
-import"./cli-vapyk8sw.js";
+import"./cli-7kyk9jr3.js";
 import {
   setBedrockProviderModule
-} from "./cli-5b6b62tz.js";
+} from "./cli-13hw4z91.js";
 import"./cli-btbzvq95.js";
 import"./cli-1m2e086m.js";
-import"./cli-mcnhgnn1.js";
+import"./cli-ykk5jaax.js";
 import"./cli-bzr0ftht.js";
 import"./cli-bd957dgb.js";
 import {
@@ -1501,6 +1537,62 @@ async function stopDbRetention() {
   await retentionTickPromise;
 }
 
+// src/be/human-free-drain.ts
+init_human_free();
+var YIELD_MS2 = 25;
+var IDLE_INTERVAL_MS = 60000;
+var running = false;
+var idleTimer = null;
+var passTimer = null;
+function scheduleIdle() {
+  if (!running)
+    return;
+  if (idleTimer)
+    clearTimeout(idleTimer);
+  idleTimer = setTimeout(() => schedulePass(0), IDLE_INTERVAL_MS);
+  idleTimer.unref?.();
+}
+function schedulePass(delayMs) {
+  if (!running || passTimer)
+    return;
+  passTimer = setTimeout(() => {
+    passTimer = null;
+    runPass();
+  }, delayMs);
+  passTimer.unref?.();
+}
+async function runPass() {
+  if (!running)
+    return;
+  try {
+    const { batches, remaining } = await drainHumanFreeReclassifyQueue({ maxBatches: 1 });
+    if (batches > 0 && remaining > 0) {
+      schedulePass(YIELD_MS2);
+      return;
+    }
+  } catch (err) {
+    console.error("[human-free-drain] batch failed, retrying later:", err instanceof Error ? err.message : String(err));
+  }
+  scheduleIdle();
+}
+function startHumanFreeDrain() {
+  if (running)
+    return;
+  running = true;
+  setHumanFreeQueueListener(() => schedulePass(0));
+  schedulePass(0);
+}
+function stopHumanFreeDrain() {
+  running = false;
+  setHumanFreeQueueListener(undefined);
+  if (idleTimer)
+    clearTimeout(idleTimer);
+  if (passTimer)
+    clearTimeout(passTimer);
+  idleTimer = null;
+  passTimer = null;
+}
+
 // src/be/scripts/retention.ts
 init_db();
 var SCRATCH_RETENTION_DAYS = 14;
@@ -3318,6 +3410,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
 }
 
 // src/http/agents.ts
+init_src();
 init_zod();
 init_db();
 init_telemetry();
@@ -3370,7 +3463,9 @@ var registerAgent = route({
     maxTasks: exports_external.number().int().optional(),
     provider: ProviderNameSchema.optional(),
     harness_provider: ProviderNameSchema.optional(),
-    runtimeInstanceId: exports_external.string().min(1).optional()
+    runtimeInstanceId: exports_external.string().min(1).optional(),
+    modelTierOverrides: exports_external.record(exports_external.string(), exports_external.record(exports_external.string(), exports_external.string())).optional(),
+    harnessCliVersion: exports_external.string().max(64).optional()
   }),
   responses: {
     200: {
@@ -3450,7 +3545,7 @@ var updateAgentRuntimeRoute = route({
   path: "/api/agents/{id}/runtime",
   pattern: ["api", "agents", null, "runtime"],
   summary: "Update an agent's runtime harness and default model",
-  description: "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it.",
+  description: "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it. A `model` the model catalog does not list is a 400 unless `allow_custom_model` is true. A `latest:` alias is not accepted here (aliases resolve for a task's model and for `MODEL_TIER_*` values); `reasoning_effort` must be one the harness and model support.",
   tags: ["Agents"],
   params: exports_external.object({ id: exports_external.string() }),
   query: exports_external.object({ repoId: exports_external.string().optional() }),
@@ -3584,6 +3679,25 @@ var listAgentRuntimeInstances = route({
     404: { description: "Agent not found" }
   }
 });
+var getAgentTaskActivity = route({
+  method: "get",
+  path: "/api/agents/{id}/task-activity",
+  pattern: ["api", "agents", null, "task-activity"],
+  summary: "Daily task counts for an agent",
+  description: "Number of tasks created for the agent per UTC day over the last `days` days (default 365, max 730), oldest first. Days with no tasks are omitted. Backs the activity heatmap on the agent page.",
+  tags: ["Agents"],
+  params: exports_external.object({ id: exports_external.string() }),
+  query: exports_external.object({ days: exports_external.coerce.number().int().min(1).max(730).optional() }),
+  responses: {
+    200: {
+      description: "Daily task counts",
+      schema: exports_external.object({
+        days: exports_external.array(exports_external.object({ date: exports_external.string(), count: exports_external.number().int() }))
+      })
+    },
+    404: { description: "Agent not found" }
+  }
+});
 var ContentHashSchema = exports_external.string().regex(/^[0-9a-f]{64}$/, "sha256 hex");
 var ProfileSyncRejectionSchema = exports_external.object({
   field: exports_external.enum(["soulMd", "identityMd", "claudeMd", "toolsMd"]),
@@ -3782,6 +3896,12 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
       }
       return { agent, created: true };
     });
+    if (parsed.body.harnessCliVersion !== undefined) {
+      await setAgentHarnessCliVersion(agentId, parsed.body.harnessCliVersion.trim() || null);
+    }
+    if (parsed.body.modelTierOverrides) {
+      await setAgentModelTierOverrides(agentId, sanitizeModelTierOverrides(parsed.body.modelTierOverrides));
+    }
     telemetry.agent("registered", {
       role: parsed.body.role,
       capabilities: parsed.body.capabilities ?? [],
@@ -3890,6 +4010,19 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
     });
     return true;
   }
+  if (getAgentTaskActivity.match(req.method, pathSegments)) {
+    const parsed = await getAgentTaskActivity.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await getAgentById(parsed.params.id)) {
+      jsonError(res, "Agent not found", 404);
+      return true;
+    }
+    getAgentTaskActivity.respond(res, 200, {
+      days: await getAgentDailyTaskCounts(parsed.params.id, parsed.query.days ?? 365)
+    });
+    return true;
+  }
   if (updateAgentProfileRoute.match(req.method, pathSegments)) {
     const parsed = await updateAgentProfileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -4074,6 +4207,21 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
         return true;
       }
     }
+    if (typeof model === "string" && isAlias(model)) {
+      jsonError(res, `A latest: alias cannot be an agent's default model ("${model}"). Set the alias on a task, or as a MODEL_TIER_<PROVIDER>_<TIER> value.`, 400);
+      return true;
+    }
+    if (typeof model === "string") {
+      const modelError = await explicitModelError({
+        model,
+        allowCustomModel: allow_custom_model,
+        harnessProvider: harness_provider
+      });
+      if (modelError) {
+        jsonError(res, modelError, 400);
+        return true;
+      }
+    }
     let agent;
     try {
       agent = await getDbClient().transaction(async () => {
@@ -4333,22 +4481,50 @@ init_subscription_plans();
 
 // src/http/usage-cache.ts
 var USAGE_CACHE_TTL_MS = 30000;
+var USAGE_CACHE_MAX_STALE_MS = 120000;
 var MAX_ENTRIES = 100;
 var entries = new Map;
-async function cachedUsageReport(key, load) {
-  const now = Date.now();
+var loading = new Map;
+var generation = 0;
+function load(key, loader) {
+  const running2 = loading.get(key);
+  if (running2)
+    return running2;
+  const startedIn = generation;
+  const promise = Promise.resolve().then(loader).then((value) => {
+    if (startedIn === generation) {
+      entries.delete(key);
+      if (entries.size >= MAX_ENTRIES)
+        entries.delete(entries.keys().next().value);
+      entries.set(key, { fetchedAt: Date.now(), value });
+    }
+    return value;
+  }).finally(() => {
+    if (loading.get(key) === promise)
+      loading.delete(key);
+  });
+  loading.set(key, promise);
+  return promise;
+}
+async function cachedUsageReport(key, loader) {
   const hit = entries.get(key);
-  if (hit && hit.expiresAt > now)
-    return hit.value;
-  const value = await load();
-  entries.delete(key);
-  if (entries.size >= MAX_ENTRIES)
-    entries.delete(entries.keys().next().value);
-  entries.set(key, { expiresAt: now + USAGE_CACHE_TTL_MS, value });
-  return value;
+  if (hit) {
+    const age = Date.now() - hit.fetchedAt;
+    if (age < USAGE_CACHE_TTL_MS)
+      return hit.value;
+    if (age < USAGE_CACHE_MAX_STALE_MS) {
+      load(key, loader).catch((error) => {
+        console.error(`[usage-cache] background refresh failed for ${key.split(":")[0]}:`, error);
+      });
+      return hit.value;
+    }
+  }
+  return load(key, loader);
 }
 function clearUsageCache() {
+  generation++;
   entries.clear();
+  loading.clear();
 }
 
 // src/http/api-keys.ts
@@ -4850,7 +5026,6 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
 // src/http/approval-requests.ts
 init_zod();
 init_db();
-init_resolver();
 init_request_auth_context();
 init_event_bus();
 var QuestionSchema = exports_external.object({
@@ -4900,6 +5075,13 @@ var ApprovalRequestSchema = exports_external.object({
   createdAt: exports_external.string(),
   updatedAt: exports_external.string()
 });
+var ApprovalRequestSummarySchema = ApprovalRequestSchema.omit({
+  questions: true,
+  approvers: true,
+  responses: true,
+  resolutionReason: true,
+  notificationChannels: true
+}).extend({ questionCount: exports_external.number().int() });
 function toApprovalRequestResponse(request) {
   return {
     ...request,
@@ -4976,7 +5158,7 @@ var createRoute = route({
     workflowRunId: exports_external.string().uuid().optional(),
     workflowRunStepId: exports_external.string().uuid().optional(),
     sourceTaskId: exports_external.string().uuid().optional(),
-    timeoutSeconds: exports_external.number().int().min(1).optional(),
+    timeoutSeconds: exports_external.number().int().min(1).optional().describe("Seconds until the request expires. After that the request becomes 'timeout' and you get a hitl-follow-up task. A request with no timeout is cancelled after APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS days (default 7)."),
     notifications: exports_external.array(exports_external.object({
       channel: exports_external.enum(["slack", "email"]),
       target: exports_external.string()
@@ -5029,21 +5211,54 @@ var respondRoute = route({
   },
   auth: { apiKey: true }
 });
+var cancelRoute = route({
+  method: "post",
+  path: "/api/approval-requests/{id}/cancel",
+  pattern: ["api", "approval-requests", null, "cancel"],
+  summary: "Cancel a pending approval request",
+  tags: ["ApprovalRequests"],
+  params: exports_external.object({ id: exports_external.string().uuid() }),
+  body: exports_external.object({ reason: exports_external.string().max(500).optional() }),
+  responses: {
+    200: {
+      description: "Request cancelled, or already cancelled. A request that gates a running or waiting workflow run cancels that run too.",
+      schema: exports_external.object({
+        approvalRequest: ApprovalRequestSchema,
+        alreadyCancelled: exports_external.boolean(),
+        runCancelled: exports_external.boolean()
+      })
+    },
+    403: { description: "Caller may not cancel this request" },
+    404: { description: "Not found" },
+    409: {
+      description: "Already resolved with approved, rejected, or timeout, or its expiresAt passed"
+    }
+  },
+  auth: { apiKey: true },
+  rbac: { permission: "approval.cancel.any" }
+});
 var listRoute = route({
   method: "get",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
   summary: "List approval requests with optional filters",
+  description: "Returns full approval requests by default. Pass `fields=slim` for the list-view shape: `questions`, `approvers`, `responses`, `resolutionReason` and `notificationChannels` are dropped and `questionCount` is added. Fetch one request in full via `GET /api/approval-requests/{id}`.",
   tags: ["ApprovalRequests"],
   query: exports_external.object({
     status: exports_external.string().optional(),
     workflowRunId: exports_external.string().optional(),
-    limit: exports_external.coerce.number().optional()
+    limit: exports_external.coerce.number().optional(),
+    fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
     200: {
       description: "List of approval requests",
-      schema: exports_external.object({ approvalRequests: exports_external.array(ApprovalRequestSchema) })
+      schema: exports_external.object({
+        approvalRequests: exports_external.union([
+          exports_external.array(ApprovalRequestSchema),
+          exports_external.array(ApprovalRequestSummarySchema)
+        ])
+      })
     }
   },
   auth: { apiKey: true }
@@ -5063,6 +5278,19 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
       jsonError(res, `Approval request already resolved with status: ${existing.status}${reason}`, 409);
       return true;
     }
+    if (existing.expiresAt && new Date(existing.expiresAt) < new Date) {
+      await getDbClient().transaction(async () => {
+        const timedOut = await resolveApprovalRequest(existing.id, {
+          status: "timeout",
+          resolutionReason: `Timed out: the answer arrived after the deadline ${existing.expiresAt}`
+        });
+        if (timedOut && !existing.workflowRunId) {
+          await createApprovalFollowUpTask(timedOut, "hitl.timeout");
+        }
+      });
+      jsonError(res, `Approval request expired at ${existing.expiresAt}`, 409);
+      return true;
+    }
     const unavailableReason = await getWorkflowApprovalUnavailableReason(existing);
     if (unavailableReason) {
       jsonError(res, unavailableReason, 409);
@@ -5104,33 +5332,32 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
         workflowRunStepId: updated.workflowRunStepId
       });
     }
-    if (!updated.workflowRunId && updated.sourceTaskId) {
-      const sourceTask = await getTaskById(updated.sourceTaskId);
-      if (sourceTask) {
-        const formattedResponses = formatResponses(updated.questions, updated.responses);
-        const { text: taskText } = resolveTemplate("hitl.follow_up", {
-          request_id: updated.id,
-          title: updated.title,
-          status: updated.status,
-          responses: formattedResponses
-        });
-        await createTaskExtended(taskText, {
-          agentId: sourceTask.agentId,
-          routingReason: sourceTask.agentId ? "continuity" : undefined,
-          routingSource: sourceTask.agentId ? "engine_default" : undefined,
-          parentTaskId: updated.sourceTaskId,
-          source: "system",
-          taskType: "hitl-follow-up",
-          tags: ["hitl", "follow-up"],
-          slackChannelId: sourceTask.slackChannelId ?? undefined,
-          slackThreadTs: sourceTask.slackThreadTs ?? undefined,
-          slackUserId: sourceTask.slackUserId ?? undefined
-        });
-      }
-    }
+    await createApprovalFollowUpTask(updated, "hitl.follow_up");
     respondRoute.respond(res, 200, { approvalRequest: toApprovalRequestResponse(updated) });
     return true;
   }
+  if (cancelRoute.match(req.method, pathSegments)) {
+    const parsed = await cancelRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { principal, resolvedBy } = await approvalCancelPrincipal(req);
+    const result = await cancelApprovalRequest({
+      id: parsed.params.id,
+      reason: parsed.body.reason,
+      principal,
+      resolvedBy
+    });
+    if (!result.ok) {
+      jsonError(res, result.message, result.status);
+      return true;
+    }
+    cancelRoute.respond(res, 200, {
+      approvalRequest: toApprovalRequestResponse(result.request),
+      alreadyCancelled: result.alreadyCancelled,
+      runCancelled: result.runCancelled
+    });
+    return true;
+  }
   if (getByIdRoute.match(req.method, pathSegments)) {
     const parsed = await getByIdRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -5171,11 +5398,18 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
     const parsed = await listRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const requests = await listApprovalRequests({
+    const filters = {
       status: parsed.query.status || undefined,
       workflowRunId: parsed.query.workflowRunId || undefined,
       limit: parsed.query.limit || undefined
-    });
+    };
+    if (parsed.query.fields === "slim") {
+      listRoute.respond(res, 200, {
+        approvalRequests: await listApprovalRequestSummaries(filters)
+      });
+      return true;
+    }
+    const requests = await listApprovalRequests(filters);
     listRoute.respond(res, 200, {
       approvalRequests: requests.map(toApprovalRequestResponse)
     });
@@ -5183,25 +5417,21 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
   }
   return false;
 }
-function formatResponses(questions, responses) {
-  return questions.map((q) => {
-    const answer = responses[q.id];
-    let answerText;
-    if (answer == null) {
-      answerText = "(no answer)";
-    } else if (q.type === "approval") {
-      const a = answer;
-      answerText = a.approved ? "Approved" : "Rejected";
-      if (a.comment)
-        answerText += ` — ${a.comment}`;
-    } else if (typeof answer === "object") {
-      answerText = JSON.stringify(answer);
-    } else {
-      answerText = String(answer);
-    }
-    return `- ${q.label}: ${answerText}`;
-  }).join(`
-`);
+async function approvalCancelPrincipal(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "user") {
+    return { principal: { kind: "user", userId: auth.userId }, resolvedBy: auth.userId };
+  }
+  const rawAgentId = req.headers["x-agent-id"];
+  const agentId = auth?.kind === "agent" ? auth.agentId : Array.isArray(rawAgentId) ? rawAgentId[0] : rawAgentId;
+  if (agentId) {
+    const agent = await getAgentById(agentId);
+    return {
+      principal: { kind: "agent", agentId, isLead: agent?.isLead ?? false },
+      resolvedBy: agentId
+    };
+  }
+  return { principal: { kind: "operator" }, resolvedBy: "operator" };
 }
 
 // src/http/assets.ts
@@ -6363,6 +6593,7 @@ var getResolvedConfigRoute = route({
   query: exports_external.object({
     agentId: exports_external.string().optional(),
     repoId: exports_external.string().optional(),
+    key: exports_external.string().min(1).optional().describe("Return only the entry with this exact key. Omit to return every resolved entry."),
     includeSecrets: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
@@ -6439,6 +6670,7 @@ var listConfig = route({
   query: exports_external.object({
     scope: exports_external.string().optional(),
     scopeId: exports_external.string().optional(),
+    key: exports_external.string().min(1).optional().describe("Return only entries with this exact key. Omit to return every entry."),
     includeSecrets: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
@@ -6495,7 +6727,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
     const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
-    const configs = stripApiOnlyKeys(await getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined));
+    const key = parsed.query.key;
+    const configs = stripApiOnlyKeys(await getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined)).filter((c) => !key || c.key === key);
     const result = effectiveIncludeSecrets ? configs : maskSecrets(configs);
     if (effectiveIncludeSecrets) {
       for (const c of result) {
@@ -6568,7 +6801,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(await getSwarmConfigs({
       scope: parsed.query.scope || undefined,
-      scopeId: parsed.query.scopeId || undefined
+      scopeId: parsed.query.scopeId || undefined,
+      key: parsed.query.key
     }));
     const listResult = effectiveIncludeSecrets ? configs : maskSecrets(configs);
     if (effectiveIncludeSecrets) {
@@ -7258,13 +7492,20 @@ var getEventsRoute = route({
     dataField: exports_external.string().optional(),
     since: exports_external.string().optional(),
     until: exports_external.string().optional(),
-    limit: exports_external.coerce.number().int().min(1).max(1000).optional()
+    limit: exports_external.coerce.number().int().min(1).max(1000).optional(),
+    events: exports_external.string().optional().describe("Comma-separated event names; matches any of them (ANDed with `event`)"),
+    dataFields: exports_external.string().optional().describe("Comma-separated `data.field` values, used with latestPerDataField"),
+    latestPerDataField: exports_external.enum(["true", "false"]).optional().describe("When true, return only the newest event per (event, data.field) pair for every name in `event`/`events` and every value in `dataFields`")
   }),
   responses: {
     200: {
       description: "List of events",
-      schema: exports_external.object({ events: exports_external.array(SwarmEventSchema) })
-    }
+      schema: exports_external.object({
+        events: exports_external.array(SwarmEventSchema),
+        latestPerDataField: exports_external.literal(true).optional().describe("Present only when the request asked for latestPerDataField=true")
+      })
+    },
+    400: { description: "Validation error" }
   },
   auth: { apiKey: true }
 });
@@ -7293,6 +7534,7 @@ var getEventCountsRoute = route({
   },
   auth: { apiKey: true }
 });
+var MAX_LATEST_PAIRS = 50;
 async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
   if (createEventsBatchRoute.match(req.method, pathSegments)) {
     const parsed = await createEventsBatchRoute.parse(req, res, pathSegments, queryParams);
@@ -7340,6 +7582,20 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
     const parsed = await getEventsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const eventNames = parsed.query.events ? parsed.query.events.split(",").map((name) => EventNameSchema.safeParse(name.trim())) : [];
+    const invalid = eventNames.find((result) => !result.success);
+    if (invalid) {
+      jsonError(res, "Invalid event name in `events`", 400);
+      return true;
+    }
+    const eventFilter = eventNames.flatMap((result) => result.success ? [result.data] : []);
+    const latestPerDataField = parsed.query.latestPerDataField === "true";
+    const dataFields = (parsed.query.dataFields ?? "").split(",").map((field) => field.trim()).filter(Boolean);
+    const latestEvents = eventFilter.length > 0 ? eventFilter : parsed.query.event ? [parsed.query.event] : [];
+    if (latestPerDataField && (latestEvents.length === 0 || dataFields.length === 0 || latestEvents.length * dataFields.length > MAX_LATEST_PAIRS)) {
+      jsonError(res, `latestPerDataField needs \`event\` or \`events\` and \`dataFields\`, at most ${MAX_LATEST_PAIRS} pairs`, 400);
+      return true;
+    }
     const events = await getEventsFiltered({
       category: parsed.query.category || undefined,
       event: parsed.query.event || undefined,
@@ -7351,9 +7607,11 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
       dataField: parsed.query.dataField || undefined,
       since: parsed.query.since || undefined,
       until: parsed.query.until || undefined,
-      limit: parsed.query.limit ?? 100
+      limit: parsed.query.limit ?? 100,
+      events: eventFilter,
+      latestPerDataField: latestPerDataField ? { events: latestEvents, dataFields } : undefined
     });
-    getEventsRoute.respond(res, 200, { events });
+    getEventsRoute.respond(res, 200, latestPerDataField ? { events, latestPerDataField: true } : { events });
     return true;
   }
   return false;
@@ -7433,6 +7691,7 @@ declare module "swarm-extension" {
     outputSchema?: Record<string, unknown> | undefined;
     inheritParentOutputSchema?: boolean | undefined;
     inheritParentRoutingAffinity?: boolean | undefined;
+    inheritParentFollowUpConfig?: boolean | undefined;
     followUpConfig?:
       | {
           disabled?: boolean | undefined;
@@ -7548,6 +7807,9 @@ declare module "swarm-extension" {
     model?: string | undefined;
     modelTier?: "smol" | "regular" | "smart" | "ultra" | undefined;
     effort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+    resolvedModel?: string | undefined;
+    modelSource?: string | undefined;
+    modelAlias?: string | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | null | undefined;
     workflowRunStepId?: string | null | undefined;
@@ -8049,6 +8311,78 @@ void _configIsValid;
 
 // src/extensions/catalog.generated.json
 var catalog_generated_default = {
+  "github-sender-allowlist": {
+    manifestFile: "manifest.json",
+    manifest: {
+      $schema: "../manifest.schema.json",
+      name: "github-sender-allowlist",
+      description: "Blocks GitHub webhook tasks from senders outside configured allowlists",
+      version: "1.0.0",
+      runtime: "api",
+      assets: {
+        hooks: "hooks.ts"
+      }
+    },
+    files: {
+      "hooks.ts": `import { block, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+export const config = z.object({
+  internal: z.array(z.string()).default([]),
+  external: z.array(z.string()).default([]),
+  reviewBots: z.array(z.string()).default([]),
+  exemptTaskTypes: z.array(z.string()).default([]),
+});
+
+const manifest = {
+  name: "github-sender-allowlist",
+  description: "Blocks GitHub webhook tasks from senders outside configured allowlists",
+  version: "1.0.0",
+  runtime: "api",
+  assets: { hooks: "hooks.ts" },
+  config,
+} as const;
+
+function includesLogin(logins: string[], login: string): boolean {
+  return logins.some((allowed) => allowed.toLowerCase() === login.toLowerCase());
+}
+
+const extension: SwarmExtension<typeof manifest> = (api) => {
+  api.on("pre.task.create", (event, ctx) => {
+    const { options } = event;
+    if (options.source !== "github") return;
+
+    const taskType = options.taskType ?? "unknown";
+    const login = options.vcsAuthor ?? "";
+    if (includesLogin(ctx.config.internal, login)) return;
+
+    const isReviewBot = includesLogin(ctx.config.reviewBots, login);
+    if (isReviewBot && taskType === "github-review") return;
+    if (!isReviewBot && ctx.config.exemptTaskTypes.includes(taskType)) return;
+
+    const isPullRequest = options.vcsUrl?.includes("/pull/") ?? false;
+    const isExternalPullRequestTask =
+      (taskType === "github-comment" || taskType === "github-pr" || taskType === "github-review") &&
+      isPullRequest;
+    const isExternalSender = includesLogin(ctx.config.external, login);
+    if (!isReviewBot && isExternalSender && isExternalPullRequestTask) return;
+
+    const rule = isReviewBot
+      ? "review bots are allowed only for github-review tasks"
+      : isExternalSender
+        ? "external senders are allowed only for PR comments, reviews, and github-pr tasks on pull requests"
+        : "sender is not on the internal, external, or reviewBots allowlist";
+    const reason = \`GitHub sender "\${login || "unknown"}" is blocked: \${rule}.\`;
+    ctx.log.warn(reason, { login: login || null, taskType, vcsUrl: options.vcsUrl ?? null });
+    return block(reason);
+  });
+};
+
+export default extension;
+`
+    },
+    readme: '# github-sender-allowlist\n\nBlocks GitHub webhook tasks from senders outside the configured allowlists. Login matching is case-insensitive. Tasks from other sources pass through. No task type is exempt by default.\n\nConfig:\n\n```json\n{\n  "internal": ["tarasyarema", "harlequinetcie"],\n  "external": ["fuvidani", "capchase-bot"],\n  "reviewBots": [],\n  "exemptTaskTypes": []\n}\n```\n\nInternal senders can create any GitHub task, including reviews. Logins in `reviewBots` can create `github-review` tasks only. External senders can create `github-comment` or `github-pr` tasks on pull requests, and `github-review` tasks when `vcsUrl` contains `/pull/`. Choose any review-bot logins from the sender census in the [security audit](https://live.agent-fs.dev/file/~/648a5f3c-35c8-4f11-8673-b89de52cd6bd/2faf73ba-4eee-4472-8b3b-359c4ed6bfbb/thoughts/a09d19a4-bd35-4593-9b6f-c2ccafccead8/reviews/2026-09-28-github-sender-authorization-audit.md) when installing the extension; the template intentionally defaults to an empty list.\n\n`exemptTaskTypes` is an optional operator override for explicitly exempting task types. It defaults to an empty list. The GitHub handler does not pass the action for `github-pr` tasks, so external `github-pr` access also permits assignment and label events on pull requests.\n'
+  },
   "notify-on-complete": {
     manifestFile: "manifest.json",
     manifest: {
@@ -14072,18 +14406,20 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
         source,
         isLead: false
       });
-      const ranked = rerank(expanded, { limit: Math.min(limit, 20) });
+      const resultLimit = Math.min(limit, 20);
+      const consumptionHeader = req.headers["x-memory-consumption"];
+      const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
+      const ranked = consumptionMode === "prompt" ? rerank(expanded, { limit: expanded.length }).map((r) => ({ r, eligible: memoryRelevance(r) > SIMILARITY_THRESHOLD })).sort((a, b) => Number(b.eligible) - Number(a.eligible)).slice(0, resultLimit).map(({ r }) => r) : rerank(expanded, { limit: resultLimit });
       const sourceTaskIdHeader = req.headers["x-source-task-id"];
       const sourceTaskId = Array.isArray(sourceTaskIdHeader) ? sourceTaskIdHeader[0] : sourceTaskIdHeader;
       const contextKeyHeader = req.headers["x-context-key"];
       const contextKey = Array.isArray(contextKeyHeader) ? contextKeyHeader[0] : contextKeyHeader;
-      const consumptionHeader = req.headers["x-memory-consumption"];
-      const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
       if (sourceTaskId && intent) {
         try {
           await recordRetrievals(sourceTaskId, myAgentId, ranked.map((r) => ({
             memoryId: r.id,
             similarity: r.similarity,
+            relevance: r.rawSimilarity,
             retrievalSource: r.retrievalSource
           })), undefined, { intent, contextKey, eventType: "search" });
         } catch (err) {
@@ -14092,7 +14428,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
       }
       let consumedIds = [];
       if (intent) {
-        const consumed = consumptionMode === "prompt" ? ranked.filter((r) => r.similarity > SIMILARITY_THRESHOLD) : ranked;
+        const consumed = consumptionMode === "prompt" ? ranked.filter((r) => memoryRelevance(r) > SIMILARITY_THRESHOLD) : ranked;
         consumedIds = dedupeMemoryDocumentIds(consumed);
         try {
           await recordMemoryAccesses(consumedIds);
@@ -14976,11 +15312,21 @@ async function handleMetrics(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/models-catalog.ts
 init_zod();
+init_db();
+init_types();
+init_request_auth_context();
 var CatalogModelSchema = exports_external.object({
   id: exports_external.string(),
   name: exports_external.string().optional(),
-  cost: exports_external.object({ input: exports_external.number().optional(), output: exports_external.number().optional() }).optional(),
+  cost: exports_external.object({
+    input: exports_external.number().optional(),
+    output: exports_external.number().optional(),
+    cache_read: exports_external.number().optional(),
+    cache_write: exports_external.number().optional()
+  }).optional(),
   limit: exports_external.object({ context: exports_external.number().optional() }).optional(),
+  release_date: exports_external.string().optional(),
+  status: exports_external.string().optional(),
   reasoning: exports_external.boolean().optional(),
   reasoning_options: exports_external.array(exports_external.object({ type: exports_external.string(), values: exports_external.array(exports_external.string()).optional() })).optional()
 });
@@ -14989,6 +15335,55 @@ var CatalogProviderSchema = exports_external.object({
   name: exports_external.string().optional(),
   models: exports_external.record(exports_external.string(), CatalogModelSchema)
 });
+var ReasoningOptionSchema = exports_external.object({
+  type: exports_external.string(),
+  values: exports_external.array(exports_external.string()).optional()
+});
+var OverlayPricingSchema = exports_external.object({
+  input: exports_external.number().nonnegative().optional(),
+  output: exports_external.number().nonnegative().optional(),
+  cache_read: exports_external.number().nonnegative().optional(),
+  cache_write: exports_external.number().nonnegative().optional()
+});
+var ModelCatalogRefreshResultSchema = exports_external.object({
+  status: exports_external.enum(["updated", "not-modified", "skipped-fresh", "skipped-cooldown", "error"]),
+  models: exports_external.number(),
+  added: exports_external.array(exports_external.string()),
+  checkedAt: exports_external.number().nullable(),
+  retryAfterMs: exports_external.number().optional(),
+  error: exports_external.string().optional()
+});
+var ModelCatalogOverlayBodySchema = exports_external.object({
+  provider: exports_external.string().min(1),
+  modelId: exports_external.string().min(1),
+  name: exports_external.string().optional(),
+  family: exports_external.string().optional(),
+  releaseDate: exports_external.string().optional(),
+  contextWindow: exports_external.number().int().positive().optional(),
+  maxOutput: exports_external.number().int().positive().optional(),
+  reasoning: exports_external.boolean().optional(),
+  reasoningOptions: exports_external.array(ReasoningOptionSchema).optional(),
+  pricing: OverlayPricingSchema.optional(),
+  status: exports_external.string().optional(),
+  reason: exports_external.string().min(1),
+  verifiedBy: exports_external.string().optional(),
+  expiresWhenUpstreamMatches: exports_external.boolean().optional()
+});
+var OverlayEntrySchema = ModelCatalogOverlayBodySchema.extend({
+  name: exports_external.string().nullish(),
+  family: exports_external.string().nullish(),
+  releaseDate: exports_external.string().nullish(),
+  contextWindow: exports_external.number().nullish(),
+  maxOutput: exports_external.number().nullish(),
+  reasoning: exports_external.boolean().nullish(),
+  reasoningOptions: exports_external.array(ReasoningOptionSchema).nullish(),
+  pricing: OverlayPricingSchema.nullish(),
+  status: exports_external.string().nullish(),
+  verifiedBy: exports_external.string().nullish(),
+  expiresWhenUpstreamMatches: exports_external.boolean(),
+  createdAt: exports_external.number(),
+  updatedAt: exports_external.number()
+});
 var getCatalog = route({
   method: "get",
   path: "/api/models-catalog",
@@ -15007,12 +15402,218 @@ var getCatalog = route({
     }
   }
 });
+var ModelTierPreviewSchema = exports_external.object({
+  provider: ProviderNameSchema,
+  tier: exports_external.enum(MODEL_TIERS),
+  key: exports_external.string(),
+  defaultValue: exports_external.string(),
+  configured: exports_external.string().nullable(),
+  source: exports_external.enum(["tier-config", "tier-default"]),
+  resolvedModel: exports_external.string().nullable(),
+  alias: exports_external.string().nullable()
+});
+var getTiers = route({
+  method: "get",
+  path: "/api/models-catalog/tiers",
+  pattern: ["api", "models-catalog", "tiers"],
+  summary: "Preview what each model tier resolves to per harness provider",
+  description: "One row per provider and tier: the built-in default, the `MODEL_TIER_<PROVIDER>_<TIER>` value stored in swarm config (if any), which layer wins, and the concrete model it resolves to against the current catalog (`latest:` aliases resolved with the same soak and auto-upgrade rules as claim time, without recording a resolution). Ignores per-worker `MODEL_TIER_*` overrides and per-task models.",
+  tags: ["Pricing"],
+  responses: {
+    200: {
+      description: "Tier previews",
+      schema: exports_external.object({ tiers: exports_external.array(ModelTierPreviewSchema) })
+    }
+  }
+});
+var refreshCatalog = route({
+  method: "post",
+  path: "/api/models-catalog/refresh",
+  pattern: ["api", "models-catalog", "refresh"],
+  summary: "Refresh the model catalog from models.dev",
+  description: "Unforced calls skip the network when the last models.dev check is younger than 4h (`skipped-fresh`). `force: true` always fetches, still conditional on the stored ETag (`not-modified` on 304), but a forced call within a minute of the previous one returns `skipped-cooldown` with `retryAfterMs`. Concurrent refreshes share one fetch. Lead agent or operator only. `added` lists provider/modelId keys new since the previous fetch.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: exports_external.object({ force: exports_external.boolean().optional() }),
+  responses: {
+    200: { description: "Refresh outcome", schema: ModelCatalogRefreshResultSchema },
+    403: { description: "Forbidden" }
+  }
+});
+var upsertOverlay = route({
+  method: "put",
+  path: "/api/models-catalog/overlay",
+  pattern: ["api", "models-catalog", "overlay"],
+  summary: "Upsert one model-catalog overlay row",
+  description: "Overlay facts win per non-null field over the models.dev row; overlay-only models are served too. Overlay prices fill pricing-table gaps (never override an active price). With `expiresWhenUpstreamMatches` (default true) the row is deleted once upstream matches every non-null fact.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: ModelCatalogOverlayBodySchema,
+  responses: {
+    200: { description: "Overlay row upserted", schema: OverlayEntrySchema },
+    403: { description: "Forbidden" }
+  }
+});
+var deleteOverlay = route({
+  method: "delete",
+  path: "/api/models-catalog/overlay",
+  pattern: ["api", "models-catalog", "overlay"],
+  summary: "Delete one model-catalog overlay row",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: exports_external.object({ provider: exports_external.string().min(1), modelId: exports_external.string().min(1) }),
+  responses: {
+    200: { description: "Overlay row deleted", schema: exports_external.object({ deleted: exports_external.boolean() }) },
+    403: { description: "Forbidden" }
+  }
+});
+var HarnessSupportRowSchema = exports_external.object({
+  harness: exports_external.string(),
+  cliVersion: exports_external.string(),
+  modelId: exports_external.string(),
+  status: exports_external.enum(["ok", "unsupported", "unknown"]),
+  checkedAt: exports_external.number(),
+  error: exports_external.string().nullable()
+});
+var listHarnessSupport = route({
+  method: "get",
+  path: "/api/models-catalog/harness-support",
+  pattern: ["api", "models-catalog", "harness-support"],
+  summary: "List harness CLI model support rows",
+  description: "Whether a catalog model runs on a given `claude` / `codex` CLI version, as recorded by workers after a model's first run. No row means unknown (allowed at claim).",
+  tags: ["Pricing"],
+  query: exports_external.object({ harness: exports_external.string().optional(), cliVersion: exports_external.string().optional() }),
+  responses: {
+    200: {
+      description: "Support rows, newest first",
+      schema: exports_external.object({ rows: exports_external.array(HarnessSupportRowSchema) })
+    }
+  }
+});
+var recordHarnessSupport = route({
+  method: "put",
+  path: "/api/models-catalog/harness-support",
+  pattern: ["api", "models-catalog", "harness-support"],
+  summary: "Record whether a harness CLI version accepts a model",
+  description: "Written by workers: `ok` after a model's first successful run, `unsupported` when the CLI rejects the model id. Claim-time resolution falls back (alias/tier) or fails fast (explicit model) on `unsupported`.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.harness-support.write" },
+  body: exports_external.object({
+    harness: exports_external.string().min(1).max(32),
+    cliVersion: exports_external.string().min(1).max(64),
+    modelId: exports_external.string().min(1).max(200),
+    status: exports_external.enum(["ok", "unsupported", "unknown"]),
+    error: exports_external.string().max(4000).optional()
+  }),
+  responses: {
+    200: { description: "Support row upserted", schema: HarnessSupportRowSchema },
+    403: { description: "Forbidden" }
+  }
+});
+async function ensureCatalogWriter(req, res, verb = "models.catalog.write") {
+  const auth = getRequestAuth(req);
+  const header2 = req.headers["x-agent-id"];
+  const agentId = auth?.kind === "agent" ? auth.agentId : Array.isArray(header2) ? header2[0] : header2;
+  let principal;
+  if (auth?.kind === "user") {
+    principal = { kind: "user", userId: auth.userId };
+  } else if (agentId) {
+    const agent = await getAgentById(agentId);
+    principal = { kind: "agent", agentId, isLead: agent?.isLead ?? false };
+  } else if (auth?.kind === "operator") {
+    principal = { kind: "operator" };
+  } else {
+    principal = { kind: "agent", agentId: "", isLead: false };
+  }
+  const decision = can({
+    principal,
+    verb,
+    resource: { kind: "none" },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, verb === "models.catalog.write" ? "Writing the model catalog requires the lead agent or an operator" : "Recording harness model support requires a registered agent or an operator", 403);
+    return null;
+  }
+  return {
+    userId: auth?.kind === "user" ? auth.userId : null,
+    agentId: principal.kind === "agent" && principal.agentId ? principal.agentId : null
+  };
+}
+async function callerOwnsSupportRow(agentId, body) {
+  const agent = await getAgentById(agentId);
+  if (!agent || agent.harnessProvider !== body.harness)
+    return false;
+  return await getAgentHarnessCliVersion(agentId) === body.cliVersion;
+}
 async function handleModelsCatalog(req, res, pathSegments, queryParams) {
   if (getCatalog.match(req.method, pathSegments)) {
     const parsed = await getCatalog.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    json(res, getModelsCatalog());
+    getCatalog.respond(res, 200, await loadModelsCatalog());
+    return true;
+  }
+  if (getTiers.match(req.method, pathSegments)) {
+    const parsed = await getTiers.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    getTiers.respond(res, 200, { tiers: await previewModelTiers() });
+    return true;
+  }
+  if (refreshCatalog.match(req.method, pathSegments)) {
+    const parsed = await refreshCatalog.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureCatalogWriter(req, res))
+      return true;
+    refreshCatalog.respond(res, 200, await requestModelCatalogRefresh({ force: parsed.body.force }));
+    return true;
+  }
+  if (upsertOverlay.match(req.method, pathSegments)) {
+    const parsed = await upsertOverlay.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const writer = await ensureCatalogWriter(req, res);
+    if (!writer)
+      return true;
+    const entry = await upsertModelCatalogOverlay(parsed.body, { userId: writer.userId });
+    upsertOverlay.respond(res, 200, entry);
+    return true;
+  }
+  if (deleteOverlay.match(req.method, pathSegments)) {
+    const parsed = await deleteOverlay.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureCatalogWriter(req, res))
+      return true;
+    const deleted = await deleteModelCatalogOverlay(parsed.body.provider, parsed.body.modelId);
+    deleteOverlay.respond(res, 200, { deleted });
+    return true;
+  }
+  if (listHarnessSupport.match(req.method, pathSegments)) {
+    const parsed = await listHarnessSupport.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    listHarnessSupport.respond(res, 200, { rows: await listHarnessModelSupport(parsed.query) });
+    return true;
+  }
+  if (recordHarnessSupport.match(req.method, pathSegments)) {
+    const parsed = await recordHarnessSupport.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const writer = await ensureCatalogWriter(req, res, "models.harness-support.write");
+    if (!writer)
+      return true;
+    if (writer.agentId && !await callerOwnsSupportRow(writer.agentId, parsed.body)) {
+      jsonError(res, "Harness support can only be recorded for the calling agent's own harness and registered CLI version", 403);
+      return true;
+    }
+    if (writer.agentId && parsed.body.status === "unsupported" && !(isUnknownModelError(parsed.body.error, parsed.body.modelId) && await agentRanModel(writer.agentId, parsed.body.modelId))) {
+      jsonError(res, "An unsupported report needs a model the calling agent ran and the CLI's model-rejection error", 403);
+      return true;
+    }
+    recordHarnessSupport.respond(res, 200, await recordHarnessModelSupport(parsed.body));
     return true;
   }
   return false;
@@ -15803,11 +16404,19 @@ function slackMilestone(state) {
       action_url: automationIntegrationFixUrl("slack")
     };
   }
+  if (config.mode === "socket" && getSlackConnectionState() === "connected") {
+    return {
+      id: "slack",
+      label: "Slack configured",
+      state: "verified",
+      action_url: automationIntegrationFixUrl("slack")
+    };
+  }
   return {
     id: "slack",
     label: "Slack configured",
     state: "configured",
-    hint: config.mode === "http" ? "HTTP credentials are configured, but HTTP ingress is unavailable until the receiver is installed." : "Socket Mode credentials are configured; a live connection has not been verified.",
+    hint: config.mode === "http" ? "HTTP credentials are configured, but HTTP ingress is unavailable until the receiver is installed." : "Socket Mode credentials are configured, but the bot is not connected to Slack.",
     action_url: automationIntegrationFixUrl("slack")
   };
 }
@@ -17663,7 +18272,9 @@ var pollTriggers = route({
   summary: "Poll for triggers (tasks, mentions)",
   tags: ["Poll"],
   auth: { apiKey: true, agentId: true },
-  headers: runtimeInstanceHeader("poll for work"),
+  headers: runtimeInstanceHeader("poll for work").extend({
+    "X-Model-Tier-Overrides": exports_external.string().optional().describe("URL-encoded JSON {provider: {tier: model}} of the worker's MODEL_TIER_* env overrides. " + "Stored on the agent row and applied at claim time (modelSource=worker-env).")
+  }),
   responses: {
     200: { description: "Trigger data or null", schema: pollResponseSchema },
     400: { description: "Missing X-Agent-ID" },
@@ -17700,6 +18311,14 @@ async function attachmentsForTrigger(taskId) {
     sizeBytes: a.sizeBytes
   }));
 }
+async function claimModelFields(task, agent) {
+  try {
+    return await recordClaimModelResolution(task, agent);
+  } catch (error) {
+    console.warn(`[/api/poll] model resolution failed for task ${task.id}:`, error);
+    return {};
+  }
+}
 var commitCursorsRoute = route({
   method: "post",
   path: "/api/channel-activity/commit-cursors",
@@ -17723,6 +18342,7 @@ var commitCursorsRoute = route({
 });
 async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
   const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
+  const modelTierOverrides = parseModelTierOverridesHeader(((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-model-tier-overrides"]));
   if (commitCursorsRoute.match(req.method, pathSegments)) {
     const parsed = await commitCursorsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -17750,6 +18370,9 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         if (!agent) {
           return { error: "Agent not found", status: 404 };
         }
+        if (modelTierOverrides) {
+          await setAgentModelTierOverrides(agent.id, modelTierOverrides);
+        }
         if (isExtensionAgent(agent)) {
           return { trigger: null };
         }
@@ -17847,6 +18470,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                 taskId: pendingTask.id,
                 task: {
                   ...pendingTask,
+                  ...await claimModelFields(pendingTask, agent),
                   status: "in_progress",
                   attachments: await attachmentsForTrigger(pendingTask.id)
                 },
@@ -17931,7 +18555,11 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                   trigger: {
                     type: "task_assigned",
                     taskId: claimed.id,
-                    task: { ...claimed, attachments: await attachmentsForTrigger(claimed.id) },
+                    task: {
+                      ...claimed,
+                      ...await claimModelFields(claimed, agent),
+                      attachments: await attachmentsForTrigger(claimed.id)
+                    },
                     ...claimedRequestedBy && { requestedBy: claimedRequestedBy }
                   }
                 };
@@ -19093,6 +19721,7 @@ var scheduleUpdateBodySchema = exports_external.object({
   timezone: exports_external.string().optional(),
   model: exports_external.string().nullable().optional(),
   modelTier: ModelTierSchema.nullable().optional(),
+  allowCustomModel: exports_external.boolean().optional(),
   nextRunAt: exports_external.string().nullable().optional(),
   targetType: ScheduledTaskTargetTypeSchema.optional(),
   workflowId: exports_external.string().uuid().nullable().optional(),
@@ -19133,6 +19762,7 @@ var createSchedule = route({
     timezone: exports_external.string().optional(),
     model: exports_external.string().optional(),
     modelTier: ModelTierSchema.optional(),
+    allowCustomModel: exports_external.boolean().optional(),
     scheduleType: exports_external.enum(["recurring", "one_time"]).optional(),
     targetType: ScheduledTaskTargetTypeSchema.optional(),
     workflowId: exports_external.string().uuid().optional(),
@@ -19370,6 +20000,15 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
         return true;
       }
     }
+    const modelError = await explicitModelErrorForAgent({
+      model: splitLegacyModelAlias({ model: body.model, modelTier: body.modelTier }).model,
+      allowCustomModel: body.allowCustomModel,
+      agentId: body.targetAgentId
+    });
+    if (modelError) {
+      jsonError(res, modelError, 400);
+      return true;
+    }
     try {
       const trustedUserId = await resolveHttpAuditUserId(req, myAgentId);
       let key;
@@ -19498,22 +20137,35 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
         throw error;
       }
     }
+    const allowCustomModel = parsed.body.allowCustomModel;
+    delete body.allowCustomModel;
+    const existing = await getScheduledTaskById(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
     if (parsed.body.model !== undefined || parsed.body.modelTier !== undefined) {
       const normalizedModel = splitLegacyModelAlias({
         model: parsed.body.model,
         modelTier: parsed.body.modelTier
       });
+      if (normalizedModel.model !== existing.model) {
+        const modelError = await explicitModelErrorForAgent({
+          model: normalizedModel.model,
+          allowCustomModel,
+          agentId: parsed.body.targetAgentId ?? existing.targetAgentId
+        });
+        if (modelError) {
+          jsonError(res, modelError, 400);
+          return true;
+        }
+      }
       if (parsed.body.model !== undefined)
         body.model = normalizedModel.model ?? null;
       if (parsed.body.modelTier !== undefined || normalizedModel.modelTier) {
         body.modelTier = normalizedModel.modelTier ?? null;
       }
     }
-    const existing = await getScheduledTaskById(parsed.params.id);
-    if (!existing) {
-      jsonError(res, "Schedule not found", 404);
-      return true;
-    }
     if (existing.scheduleType === "one_time" && !existing.enabled && existing.lastRunAt) {
       jsonError(res, "One-time schedule has already executed. Create a new one instead.", 400);
       return true;
@@ -23348,7 +24000,7 @@ var createSessionCostRoute = route({
     model: exports_external.string().optional(),
     models: exports_external.array(SessionCostModelBreakdownSchema.omit({ costUsd: true })).optional(),
     isError: exports_external.boolean().optional(),
-    provider: exports_external.enum(["claude", "claude-managed", "codex", "pi", "opencode", "devin", "gemini", "acp"]).optional(),
+    provider: PricingProviderSchema.optional(),
     createdAt: exports_external.number().int().nonnegative().optional()
   }),
   responses: {
@@ -23547,8 +24199,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
       userId: parsed.query.userId || undefined,
       groupBy: parsed.query.groupBy || "both"
     };
-    const version = await getUsageDataVersion();
-    const summary = await cachedUsageReport(`summary:${version}:${JSON.stringify(opts)}`, () => getSessionCostSummary(opts));
+    const summary = await cachedUsageReport(`summary:${JSON.stringify(opts)}`, () => getSessionCostSummary(opts));
     getSessionCostSummaryRoute.respond(res, 200, summary);
     return true;
   }
@@ -23565,8 +24216,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
       startDate: parsed.query.startDate || undefined,
       endDate: parsed.query.endDate || undefined
     };
-    const version = await getUsageDataVersion();
-    const rows = await cachedUsageReport(`attribution:${version}:${JSON.stringify(opts)}`, () => getAttributionByPerson(opts));
+    const rows = await cachedUsageReport(`attribution:${JSON.stringify(opts)}`, () => getAttributionByPerson(opts));
     getAttributionByPersonRoute.respond(res, 200, { rows });
     return true;
   }
@@ -23700,6 +24350,7 @@ var listSessions = route({
     source: exports_external.string().optional(),
     q: exports_external.string().optional(),
     requestedByUserId: exports_external.string().min(1).optional(),
+    contextKeyPrefix: exports_external.string().min(1).optional(),
     fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
@@ -23773,13 +24424,15 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       offset: parsed.query.offset,
       source: sources,
       q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId
+      requestedByUserId: parsed.query.requestedByUserId,
+      contextKeyPrefix: parsed.query.contextKeyPrefix
     };
     const sessions = parsed.query.fields === "full" ? await listRecentSessions(baseOpts) : await listRecentSessions({ ...baseOpts, slim: true });
     const total = await countSessions({
       source: sources,
       q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId
+      requestedByUserId: parsed.query.requestedByUserId,
+      contextKeyPrefix: parsed.query.contextKeyPrefix
     });
     listSessions.respond(res, 200, {
       sessions,
@@ -23799,18 +24452,17 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       return true;
     }
     const chain = await getRootTaskChain(parsed.params.rootTaskId);
-    getSession.respond(res, 200, {
-      root: {
-        ...root,
-        ...await getTaskSteeringFields(root),
-        citations: await getTaskCitations(root.id)
-      },
-      chain: await Promise.all(chain.map(async (task) => ({
-        ...task,
-        ...await getTaskSteeringFields(task),
-        citations: await getTaskCitations(task.id)
-      })))
+    const tasks = [root, ...chain];
+    const [steering, citations] = await Promise.all([
+      getTaskSteeringFieldsForTasks(tasks),
+      getTaskCitationsForTasks(tasks.map((task) => task.id))
+    ]);
+    const decorate = (task) => ({
+      ...task,
+      ...steering.get(task.id),
+      citations: citations.get(task.id)
     });
+    getSession.respond(res, 200, { root: decorate(root), chain: chain.map(decorate) });
     return true;
   }
   return false;
@@ -24597,6 +25249,7 @@ init_zod();
 init_db();
 init_steering();
 init_types();
+init_env_flag();
 var AgentCountsSchema = exports_external.object({
   total: exports_external.number(),
   idle: exports_external.number(),
@@ -24618,7 +25271,8 @@ var DashboardStatsSchema = exports_external.object({
   agents: AgentCountsSchema,
   tasks: TaskCountsSchema,
   steeringEnabled: exports_external.boolean(),
-  multiRuntimeEnabled: exports_external.boolean()
+  multiRuntimeEnabled: exports_external.boolean(),
+  devMode: exports_external.boolean()
 });
 var RetentionTableStatsSchema = exports_external.object({
   at: exports_external.string(),
@@ -24732,6 +25386,7 @@ var listScheduledTasks = route({
   path: "/api/scheduled-tasks",
   pattern: ["api", "scheduled-tasks"],
   summary: "List scheduled tasks",
+  description: "Returns full schedules by default. Pass `fields=slim` for the list-view shape, which swaps the full `taskTemplate` for a bounded `taskTemplatePreview`. Fetch one schedule in full via `GET /api/schedules/{id}`.",
   tags: ["Stats"],
   query: exports_external.object({
     enabled: exports_external.enum(["true", "false"]).optional(),
@@ -24740,12 +25395,18 @@ var listScheduledTasks = route({
     hideCompleted: exports_external.enum(["true", "false"]).optional(),
     targetType: exports_external.enum(["agent-task", "workflow", "script"]).optional(),
     workflowId: exports_external.string().uuid().optional(),
-    scriptName: exports_external.string().optional()
+    scriptName: exports_external.string().optional(),
+    fields: exports_external.enum(["full", "slim"]).optional()
   }),
   responses: {
     200: {
       description: "Scheduled tasks list",
-      schema: exports_external.object({ scheduledTasks: exports_external.array(ScheduledTaskSchema) })
+      schema: exports_external.object({
+        scheduledTasks: exports_external.union([
+          exports_external.array(ScheduledTaskSchema),
+          exports_external.array(scheduleSummaryWithFavoriteSchema)
+        ])
+      })
     }
   }
 });
@@ -24776,15 +25437,10 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (getStats.match(req.method, pathSegments)) {
-    const agents = await getAllAgents();
+    const agents = await getAgentStatusCounts();
     const taskStats = await getTaskStats();
     const stats = {
-      agents: {
-        total: agents.length,
-        idle: agents.filter((a) => a.status === "idle").length,
-        busy: agents.filter((a) => a.status === "busy").length,
-        offline: agents.filter((a) => a.status === "offline").length
-      },
+      agents,
       tasks: {
         total: taskStats.total,
         unassigned: taskStats.unassigned,
@@ -24797,6 +25453,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
         failed: taskStats.failed
       },
       steeringEnabled: isSteeringEnabled2(),
+      devMode: isEnvFlagEnabled("SWARM_DEV_MODE", false),
       multiRuntimeEnabled: isMultiRuntimeEnabled()
     };
     getStats.respond(res, 200, stats);
@@ -24825,7 +25482,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await listScheduledTasks.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const scheduledTasks = await getScheduledTasks({
+    const filters = {
       enabled: parsed.query.enabled !== undefined ? parsed.query.enabled === "true" : undefined,
       name: parsed.query.name || undefined,
       scheduleType: parsed.query.scheduleType || undefined,
@@ -24833,13 +25490,11 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
       targetType: parsed.query.targetType,
       workflowId: parsed.query.workflowId,
       scriptName: parsed.query.scriptName
-    });
+    };
     const favoriteScope = (await resolveHttpFavoriteOwner(req, myAgentId))?.scope;
+    const favoriteOpts = { favoriteScope, itemType: "schedule" };
     listScheduledTasks.respond(res, 200, {
-      scheduledTasks: await withFavoriteFlags(scheduledTasks, {
-        favoriteScope,
-        itemType: "schedule"
-      })
+      scheduledTasks: parsed.query.fields === "slim" ? await withFavoriteFlags(await getScheduledTasks(filters, { slim: true }), favoriteOpts) : await withFavoriteFlags(await getScheduledTasks(filters), favoriteOpts)
     });
     return true;
   }
@@ -24917,6 +25572,9 @@ var AgentTaskSummarySchema2 = AgentTaskSchema.pick({
   scheduleId: true,
   model: true,
   modelTier: true,
+  resolvedModel: true,
+  modelSource: true,
+  modelAlias: true,
   effort: true,
   provider: true,
   requestedByUserId: true,
@@ -24927,6 +25585,19 @@ var AgentTaskSummarySchema2 = AgentTaskSchema.pick({
   peakContextPercent: true,
   totalCostUsd: true
 });
+var AgentTaskTimelineItemSchema = AgentTaskSchema.pick({
+  id: true,
+  agentId: true,
+  parentTaskId: true,
+  task: true,
+  title: true,
+  status: true,
+  createdAt: true,
+  lastUpdatedAt: true,
+  finishedAt: true,
+  peakContextTokens: true,
+  totalCostUsd: true
+});
 var TaskActionResultSchema = exports_external.object({
   success: exports_external.literal(true),
   task: AgentTaskSchema
@@ -24971,7 +25642,7 @@ var listTasks = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   summary: "List tasks with filters",
-  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`. Fetch a single task in full via `GET /api/tasks/{id}`.",
+  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
   tags: ["Tasks"],
   query: exports_external.object({
     status: exports_external.string().optional(),
@@ -24988,14 +25659,19 @@ var listTasks = route({
     orderBy: exports_external.enum(["lastUpdatedAt", "createdAt"]).optional(),
     limit: exports_external.coerce.number().int().optional(),
     offset: exports_external.coerce.number().int().optional(),
-    fields: exports_external.enum(["full", "slim"]).optional()
+    fields: exports_external.enum(["full", "slim", "timeline"]).optional(),
+    includeTotal: exports_external.enum(["true", "false"]).optional()
   }),
   responses: {
     200: {
       description: "Paginated task list",
       schema: exports_external.object({
-        tasks: exports_external.union([exports_external.array(AgentTaskSchema), exports_external.array(AgentTaskSummarySchema2)]),
-        total: exports_external.number().int()
+        tasks: exports_external.union([
+          exports_external.array(AgentTaskSchema),
+          exports_external.array(AgentTaskSummarySchema2),
+          exports_external.array(AgentTaskTimelineItemSchema)
+        ]),
+        total: exports_external.number().int().optional()
       })
     },
     400: { description: "Validation error (e.g. unknown status token)" }
@@ -25026,6 +25702,7 @@ var createTask = route({
     requestedByUserId: exports_external.string().optional(),
     model: exports_external.string().optional(),
     modelTier: ModelTierSchema.optional(),
+    allowCustomModel: exports_external.boolean().optional(),
     effort: ReasoningEffortSchema.optional(),
     draft: exports_external.boolean().optional()
   }).superRefine((body, ctx) => {
@@ -25039,7 +25716,9 @@ var createTask = route({
   }),
   responses: {
     201: { description: "Task created", schema: AgentTaskSchema },
-    400: { description: "Validation error, or agentId/offeredTo targets an extension identity" },
+    400: {
+      description: "Validation error, an unknown `model` (set `allowCustomModel` to store a custom id), or agentId/offeredTo targets an extension identity"
+    },
     422: {
       description: "Task creation blocked by an extension",
       schema: exports_external.object({
@@ -25489,9 +26168,13 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       limit: parsed.query.limit,
       offset: parsed.query.offset
     };
-    const tasks = parsed.query.fields === "full" ? await getAllTasks(filters) : await getAllTasks(filters, { slim: true });
-    const total = await getTasksCount(filters);
-    listTasks.respond(res, 200, { tasks, total });
+    const tasks = parsed.query.fields === "full" ? await getAllTasks(filters) : parsed.query.fields === "timeline" ? await getAllTasks(filters, { fields: "timeline" }) : await getAllTasks(filters, { slim: true });
+    if (parsed.query.includeTotal === "true") {
+      const total = await getTasksCount(filters);
+      listTasks.respond(res, 200, { tasks, total });
+    } else {
+      listTasks.respond(res, 200, { tasks });
+    }
     return true;
   }
   if (createTask.match(req.method, pathSegments)) {
@@ -25512,6 +26195,15 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       if (lead)
         defaultAgentId = lead.id;
     }
+    const modelError = await explicitModelErrorForAgent({
+      model: splitLegacyModelAlias({ model: parsed.body.model, modelTier: parsed.body.modelTier }).model,
+      allowCustomModel: parsed.body.allowCustomModel,
+      agentId: defaultAgentId
+    });
+    if (modelError) {
+      jsonError(res, modelError, 400);
+      return true;
+    }
     const parentTask = parsed.body.parentTaskId ? await getTaskById(parsed.body.parentTaskId) : null;
     let assetKey;
     try {
@@ -26189,6 +26881,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       reason: parsed.body.reason
     });
     if (followUp.kind !== "created") {
+      await settleSupersededTaskDependents(parsed.params.id, null);
       console.warn(`[Supersede] Task ${parsed.params.id.slice(0, 8)} superseded but resume creation skipped (${followUp.kind === "skipped" ? followUp.reason : followUp.kind})`);
       supersedeTaskRoute.respond(res, 200, {
         success: true,
@@ -27890,8 +28583,21 @@ async function routeKapsoInbound(payload) {
 init_event_bus();
 var WebhookDispatchResultSchema = exports_external.object({
   created: exports_external.boolean(),
-  taskId: exports_external.string().optional()
+  taskId: exports_external.string().optional(),
+  skipped: exports_external.boolean().optional(),
+  reason: exports_external.string().optional(),
+  extension: exports_external.object({ id: exports_external.string(), name: exports_external.string() }).optional()
 });
+async function runBlockableHandler(source, handler) {
+  try {
+    return await handler();
+  } catch (err) {
+    if (!(err instanceof TaskCreationBlockedError))
+      throw err;
+    console.log(`[${source}] Task creation blocked by extension ${err.extension.name}: ${err.reason}`);
+    return { created: false, skipped: true, reason: err.reason, extension: err.extension };
+  }
+}
 var githubWebhook = route({
   method: "post",
   path: "/api/github/webhook",
@@ -28039,34 +28745,29 @@ async function handleWebhooks(req, res, pathSegments) {
     console.log(`[GitHub] Received ${eventType} event`);
     let result = { created: false };
     try {
-      switch (eventType) {
-        case "pull_request":
-          result = await handlePullRequest(body);
-          break;
-        case "issues":
-          result = await handleIssue(body);
-          break;
-        case "issue_comment":
-          result = await handleComment(body, "issue_comment");
-          break;
-        case "pull_request_review_comment":
-          result = await handleComment(body, "pull_request_review_comment");
-          break;
-        case "pull_request_review":
-          result = await handlePullRequestReview(body);
-          break;
-        case "check_run":
-          result = await handleCheckRun(body);
-          break;
-        case "check_suite":
-          result = await handleCheckSuite(body);
-          break;
-        case "workflow_run":
-          result = await handleWorkflowRun(body);
-          break;
-        default:
-          console.log(`[GitHub] Ignoring unsupported event type: ${eventType}`);
-      }
+      result = await runBlockableHandler("GitHub", async () => {
+        switch (eventType) {
+          case "pull_request":
+            return await handlePullRequest(body);
+          case "issues":
+            return await handleIssue(body);
+          case "issue_comment":
+            return await handleComment(body, "issue_comment");
+          case "pull_request_review_comment":
+            return await handleComment(body, "pull_request_review_comment");
+          case "pull_request_review":
+            return await handlePullRequestReview(body);
+          case "check_run":
+            return await handleCheckRun(body);
+          case "check_suite":
+            return await handleCheckSuite(body);
+          case "workflow_run":
+            return await handleWorkflowRun(body);
+          default:
+            console.log(`[GitHub] Ignoring unsupported event type: ${eventType}`);
+            return { created: false };
+        }
+      });
       switch (eventType) {
         case "pull_request": {
           const pr = body;
@@ -28155,22 +28856,21 @@ async function handleWebhooks(req, res, pathSegments) {
     console.log(`[GitLab] Received ${objectKind} event`);
     let result = { created: false };
     try {
-      switch (objectKind) {
-        case "merge_request":
-          result = await handleMergeRequest(body);
-          break;
-        case "issue":
-          result = await handleIssue2(body);
-          break;
-        case "note":
-          result = await handleNote(body);
-          break;
-        case "pipeline":
-          result = await handlePipeline(body);
-          break;
-        default:
-          console.log(`[GitLab] Ignoring unsupported event type: ${objectKind}`);
-      }
+      result = await runBlockableHandler("GitLab", async () => {
+        switch (objectKind) {
+          case "merge_request":
+            return await handleMergeRequest(body);
+          case "issue":
+            return await handleIssue2(body);
+          case "note":
+            return await handleNote(body);
+          case "pipeline":
+            return await handlePipeline(body);
+          default:
+            console.log(`[GitLab] Ignoring unsupported event type: ${objectKind}`);
+            return { created: false };
+        }
+      });
       switch (objectKind) {
         case "merge_request": {
           const mr = body;
@@ -28450,6 +29150,9 @@ init_zod();
 init_db();
 init_types();
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: exports_external.boolean() });
+var WorkflowSaveResponseSchema = WorkflowSchema.extend({
+  warnings: exports_external.array(exports_external.string()).optional()
+});
 var WorkflowSummarySchema = WorkflowSchema.omit({
   definition: true,
   triggers: true,
@@ -28463,8 +29166,9 @@ var ExecutorTypeInfoSchema = exports_external.object({
   configSchema: exports_external.record(exports_external.string(), exports_external.unknown()),
   outputSchema: exports_external.record(exports_external.string(), exports_external.unknown())
 });
+var DEFAULT_WORKFLOW_RUNS_LIMIT = 50;
 var WorkflowRunPageSchema = exports_external.object({
-  runs: exports_external.array(WorkflowRunSchema),
+  runs: exports_external.array(WorkflowRunSummarySchema),
   page: exports_external.object({
     limit: exports_external.number().int(),
     offset: exports_external.number().int(),
@@ -28474,6 +29178,10 @@ var WorkflowRunPageSchema = exports_external.object({
   })
 });
 var SuccessResponseSchema = exports_external.object({ success: exports_external.literal(true) });
+async function withSaveWarnings(workflow) {
+  const warnings = await workflowSaveWarnings(workflow.definition, getExecutorRegistry());
+  return warnings.length > 0 ? { ...workflow, warnings } : workflow;
+}
 var listWorkflowsRoute = route({
   method: "get",
   path: "/api/workflows",
@@ -28518,7 +29226,7 @@ var createWorkflowRoute = route({
     vcsRepo: exports_external.string().min(1).optional()
   }),
   responses: {
-    201: { description: "Workflow created", schema: WorkflowSchema },
+    201: { description: "Workflow created", schema: WorkflowSaveResponseSchema },
     400: { description: "Invalid definition" }
   }
 });
@@ -28564,7 +29272,10 @@ var updateWorkflowRoute = route({
     enabled: exports_external.boolean().optional()
   }),
   responses: {
-    200: { description: "Workflow updated (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow updated (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid definition" },
     404: { description: "Workflow not found" }
   }
@@ -28578,7 +29289,10 @@ var patchWorkflowRoute = route({
   params: exports_external.object({ id: exports_external.string() }),
   body: WorkflowPatchSchema.extend({ key: AssetKeySchema.optional() }),
   responses: {
-    200: { description: "Workflow patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow not found" }
   }
@@ -28592,7 +29306,10 @@ var patchWorkflowNodeRoute = route({
   params: exports_external.object({ id: exports_external.string(), nodeId: exports_external.string() }),
   body: WorkflowNodePatchSchema,
   responses: {
-    200: { description: "Node patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Node patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow or node not found" }
   }
@@ -28646,7 +29363,8 @@ var listWorkflowRunsRoute = route({
   method: "get",
   path: "/api/workflows/{id}/runs",
   pattern: ["api", "workflows", null, "runs"],
-  summary: "List runs for a workflow",
+  summary: "List runs for a workflow, newest first",
+  description: `Returns one page of runs without \`context\` (fetch it with GET /api/workflow-runs/{id}). \`limit\` defaults to ${DEFAULT_WORKFLOW_RUNS_LIMIT} and is capped at 100; follow \`page.nextOffset\` while \`page.hasMore\` is true.`,
   tags: ["Workflows"],
   params: exports_external.object({ id: exports_external.string() }),
   query: exports_external.object({
@@ -28656,8 +29374,8 @@ var listWorkflowRunsRoute = route({
   }),
   responses: {
     200: {
-      description: "Workflow run list",
-      schema: exports_external.union([exports_external.array(WorkflowRunSchema), WorkflowRunPageSchema])
+      description: "One page of workflow runs",
+      schema: WorkflowRunPageSchema
     }
   }
 });
@@ -28899,7 +29617,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       createdByAgentId: myAgentId ?? undefined,
       createdBy: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
     }, "api");
-    createWorkflowRoute.respond(res, 201, workflow);
+    createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
     return true;
   }
   if (getWorkflowRoute.match(req.method, pathSegments)) {
@@ -28944,7 +29662,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, result.reason === "patch" ? result.errors.join("; ") : `Invalid definition: ${result.errors.join("; ")}`, 400);
       return true;
     }
-    patchWorkflowNodeRoute.respond(res, 200, result.workflow);
+    patchWorkflowNodeRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
   if (patchWorkflowRoute.match(req.method, pathSegments)) {
@@ -28995,7 +29713,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, result.reason === "patch" ? result.errors.join("; ") : `Invalid definition: ${result.errors.join("; ")}`, 400);
       return true;
     }
-    patchWorkflowRoute.respond(res, 200, result.workflow);
+    patchWorkflowRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
   if (updateWorkflowRoute.match(req.method, pathSegments)) {
@@ -29054,7 +29772,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       res.end();
       return true;
     }
-    updateWorkflowRoute.respond(res, 200, workflow);
+    updateWorkflowRoute.respond(res, 200, await withSaveWarnings(workflow));
     return true;
   }
   if (deleteWorkflowRoute.match(req.method, pathSegments)) {
@@ -29132,18 +29850,12 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await listWorkflowRunsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const paginationRequested = parsed.query?.limit !== undefined || parsed.query?.offset !== undefined;
-    if (paginationRequested) {
-      const page = await listWorkflowRunsPage(parsed.params.id, {
-        status: parsed.query?.status,
-        limit: parsed.query?.limit ?? 20,
-        offset: parsed.query?.offset ?? 0
-      });
-      listWorkflowRunsRoute.respond(res, 200, page);
-      return true;
-    }
-    const runs = await listWorkflowRuns(parsed.params.id, { status: parsed.query?.status });
-    listWorkflowRunsRoute.respond(res, 200, runs);
+    const page = await listWorkflowRunsPage(parsed.params.id, {
+      status: parsed.query?.status,
+      limit: parsed.query?.limit ?? DEFAULT_WORKFLOW_RUNS_LIMIT,
+      offset: parsed.query?.offset ?? 0
+    });
+    listWorkflowRunsRoute.respond(res, 200, page);
     return true;
   }
   if (getWorkflowRunRoute.match(req.method, pathSegments)) {
@@ -29613,7 +30325,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-yy07ef2s.js");
+    const { stopScheduler } = await import("./index-cd151qkq.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -29621,12 +30333,13 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-f7ekefyc.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-8p9rpvz5.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
   stopMemoryGc();
   await stopDbRetention();
+  stopHumanFreeDrain();
   stopScratchScriptGc();
   await stopExtensionRuntime();
   stopAuditGc();
@@ -29689,23 +30402,23 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-vqxa06qf.js");
-  seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-6sw65tck.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-h7c32hvm.js");
+  ensurePricingSeeded();
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-0v77385v.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-3gxmnb20.js");
-  ensureRbacSeedsSynced();
+  const { ensureRbacSeeded } = await import("./boot-seeds-h7c32hvm.js");
+  ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
   if (isRbacEnabled())
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-jtvpgb8f.js");
+  const { runAllSeeders } = await import("./index-5sz16ksh.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -29759,36 +30472,37 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-yy07ef2s.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-4k9hct21.js");
+    const { startScheduler } = await import("./index-cd151qkq.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-ttpbhnjg.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-r6bty6tb.js");
+    const { startHeartbeat } = await import("./index-k661dzzr.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-f7ekefyc.js");
+    const { startOAuthKeepalive } = await import("./keepalive-8p9rpvz5.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-vra1dhkd.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-cwcq1ctx.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
-  import("./boot-reembed-zfxb937k.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  startHumanFreeDrain();
+  import("./boot-reembed-48d2qpkt.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-r6shx5qx.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-w0bryhkr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-k5y0se6r.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-t65wbrn7.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {