@desplega.ai/agent-swarm 1.158.0 → 1.160.0

package/dist/{cli-47m6dkd3.js → cli-qydf22qq.js}

@@ -1,7 +1,12 @@
+import {
+  ALL_TOOLS,
+  init_tool_config
+} from "./cli-3qhyh31j.js";
 import {
   AgentAvatarSchema,
   CreateTaskOptionsSchema,
   FollowUpConfigSchema,
+  MODEL_TIERS,
   PROVIDER_STEER_CAPABILITIES,
   ProviderNameSchema,
   ReasoningEffortSchema,
@@ -17,7 +22,7 @@ import {
   normalizeAssetKey,
   parseAssetKey,
   parseModelTier
-} from "./cli-4198qc9v.js";
+} from "./cli-ktmyrtpn.js";
 import {
   IdentityFieldBudgetError,
   checkIdentityFieldBudget,
@@ -30,7 +35,11 @@ import {
   init_templates,
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd
-} from "./cli-3gmcwfyx.js";
+} from "./cli-r1mxd1xh.js";
+import {
+  init_config,
+  isSlackConfigured
+} from "./cli-n7h1kqpf.js";
 import {
   configureDbResolver,
   getAllTemplateDefinitions,
@@ -40,28 +49,33 @@ import {
   init_steering_enabled,
   isSteeringEnabled,
   registerTemplate
-} from "./cli-ggm92wcn.js";
+} from "./cli-ptr8h7kp.js";
+import {
+  SUBSCRIPTION_KEY_TYPES,
+  estimateClaudePlan,
+  init_subscription_plans,
+  planAllowsModelFamily
+} from "./cli-1a2j50m0.js";
 import {
   deriveProviderFromKeyType,
   init_credentials
-} from "./cli-19jenss3.js";
-import {
-  init_config,
-  isSlackConfigured
-} from "./cli-n7h1kqpf.js";
+} from "./cli-0wgxmwf6.js";
 import {
   activeModelBlock,
   init_model_rate_limit_windows
-} from "./cli-de1396j2.js";
-import {
-  SUBSCRIPTION_KEY_TYPES,
-  estimateClaudePlan,
-  init_subscription_plans
-} from "./cli-cqt19wg6.js";
+} from "./cli-ywybs5as.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
 } from "./cli-ej6gbxfb.js";
+import {
+  harnessModelMismatch,
+  init_runtime_model_catalog,
+  init_src,
+  isAlias,
+  parseAlias,
+  runtimeHarnessSections
+} from "./cli-kmcpfwn2.js";
 import {
   init_zod
 } from "./cli-sd0mxa3c.js";
@@ -77,7 +91,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-c07r9a2m.js";
+} from "./cli-0q3avq3s.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -355,7 +369,7 @@ var init_slack_routing = __esm(() => {
 
 // src/telemetry.ts
 import { randomUUID } from "node:crypto";
-function isEnabled() {
+function isTelemetryEnabled() {
   return isEnvFlagEnabled("ANONYMIZED_TELEMETRY", true);
 }
 function isCloudHostname(hostname) {
@@ -426,7 +440,7 @@ function _hasEmailChannel(env = process.env) {
   return !!env.AGENTMAIL_WEBHOOK_SECRET && !isEnvFlagEnabled("AGENTMAIL_DISABLE", false, env);
 }
 async function initTelemetry(sourceId, getConfig, setConfig, options = {}) {
-  if (!isEnabled())
+  if (!isTelemetryEnabled())
     return;
   source = sourceId;
   const generateIfMissing = options.generateIfMissing === true;
@@ -489,7 +503,7 @@ function getTelemetryEnvironment() {
   return "production";
 }
 function track(options) {
-  if (!isEnabled() || !installationId)
+  if (!isTelemetryEnabled() || !installationId)
     return;
   try {
     const payload = {
@@ -530,7 +544,7 @@ function track(options) {
   } catch {}
 }
 function emitIntegrationConnected(type, providerSlug, firstOfType) {
-  if (!isEnabled() || !installationId)
+  if (!isTelemetryEnabled() || !installationId)
     return false;
   const provider = _resolveIntegrationProvider(providerSlug);
   telemetry.integration("connected", {
@@ -652,6 +666,27 @@ var init_telemetry = __esm(() => {
   };
 });
 
+// src/utils/codex-auth-failure.ts
+function isCodexAuthFailureReason(failureReason) {
+  if (!failureReason || !failureReason.includes("[auth-error]"))
+    return false;
+  const lower = failureReason.toLowerCase();
+  return !TRANSIENT_AUTH_ERROR_MARKERS.some((m) => lower.includes(m));
+}
+var CODEX_AUTH_FAILURE_BENCH_THRESHOLD = 2, CODEX_AUTH_FAILURE_BENCH_MS, CODEX_AUTH_WATCH_NAMESPACE = "codex-auth-watch", codexAuthBenchMarkerKey = (keySuffix) => `bench:${keySuffix}`, TRANSIENT_AUTH_ERROR_MARKERS;
+var init_codex_auth_failure = __esm(() => {
+  CODEX_AUTH_FAILURE_BENCH_MS = 365 * 24 * 60 * 60 * 1000;
+  TRANSIENT_AUTH_ERROR_MARKERS = [
+    "waiting for the refresh lock",
+    "refresh rejected (429",
+    "refresh rejected (5",
+    "refresh rejected (unknown status",
+    "out of credits",
+    "no credentials found in config store",
+    "not a confirmed auth rejection"
+  ];
+});
+
 // src/utils/github-pull-request.ts
 function parseGitHubPullRequestToken(token) {
   const candidate = token.replace(TRAILING_PROSE_PUNCTUATION_RE, "");
@@ -2501,6 +2536,17 @@ async function getAllAgents(opts) {
   const rows = await getDbClient().query(opts?.includeExtensions ? "SELECT * FROM agents ORDER BY name" : `SELECT * FROM agents WHERE ${NOT_EXTENSION_AGENT_SQL} ORDER BY name`);
   return rows.map((row) => rowToAgent(row, opts?.slim ?? false));
 }
+async function getAgentStatusCounts() {
+  const rows = await getDbClient().query(`SELECT status, COUNT(*) AS count FROM agents WHERE ${NOT_EXTENSION_AGENT_SQL} GROUP BY status`);
+  const counts = { total: 0, idle: 0, busy: 0, offline: 0 };
+  for (const { status, count } of rows) {
+    counts.total += count;
+    if (status === "idle" || status === "busy" || status === "offline") {
+      counts[status] = count;
+    }
+  }
+  return counts;
+}
 async function getLeadAgent() {
   const leads = (await getAllAgents()).filter((a) => a.isLead);
   return leads.find((a) => a.status !== "offline") ?? leads[0] ?? null;
@@ -2789,6 +2835,199 @@ var init_context_versions = __esm(() => {
   init_runtime();
 });
 
+// src/be/db/tasks/human-free.ts
+function humanFreeCase(parentFlag) {
+  return `CASE
+        WHEN ${HUMAN_FREE_BASE_SQL} THEN 1
+        WHEN ${parentFlag} = 1 AND ${UNATTRIBUTED_SQL} THEN 1
+        ELSE 0
+      END`;
+}
+function carriesHumanFreeTag(tagsJson) {
+  const haystack = (tagsJson ?? "[]").toLowerCase();
+  return HUMAN_FREE_TAGS.some((tag) => haystack.includes(`"${tag}"`));
+}
+function tagWriteChangesHumanFree(previousTagsJson, nextTagsJson) {
+  return carriesHumanFreeTag(previousTagsJson) !== carriesHumanFreeTag(nextTagsJson);
+}
+async function classifyTaskHumanFree(input) {
+  const row = await getDbClient().get(`WITH task(taskType, tags, source, requestedByUserId, requestedByUserIdInherited, parentTaskId, workflowRunId) AS (
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      )
+      SELECT ${humanFreeCase("parent.isHumanFree")} AS humanFree
+      FROM task
+      LEFT JOIN agent_tasks parent ON parent.id = task.parentTaskId`, [
+    input.taskType ?? null,
+    input.tags ?? null,
+    input.source ?? null,
+    input.requestedByUserId ?? null,
+    input.requestedByUserIdInherited ? 1 : 0,
+    input.parentTaskId ?? null,
+    input.workflowRunId ?? null
+  ]);
+  return row?.humanFree === 1;
+}
+function setHumanFreeQueueListener(listener) {
+  queueListener = listener;
+}
+async function enqueueHumanFreeWork(taskIds, scope, hops) {
+  if (taskIds.length === 0)
+    return;
+  if (hops > HUMAN_FREE_MAX_CONTINUATION_HOPS) {
+    console.error(`[human-free] dropping ${taskIds.length} ${scope} continuation(s) past ${HUMAN_FREE_MAX_CONTINUATION_HOPS} hops; the task graph likely has a parent cycle`);
+    return;
+  }
+  await getDbClient().run(`INSERT INTO human_free_reclassify_queue (taskId, scope, afterRowid, hops)
+       SELECT value, ?, 0, ? FROM json_each(?) WHERE true
+       ON CONFLICT (taskId, scope) DO UPDATE SET
+         afterRowid = 0,
+         hops = MAX(hops, excluded.hops)`, [scope, hops, JSON.stringify(taskIds)]);
+  getDbClient().afterCommit(() => queueListener?.());
+}
+async function reclassifyBatch(seedTaskIds, batchSize, hops) {
+  const client = getDbClient();
+  const affected = (await client.query(`WITH RECURSIVE affected(id) AS (
+          SELECT value FROM json_each(?)
+
+          UNION
+
+          SELECT task.id
+          FROM affected
+          JOIN agent_tasks task ON task.parentTaskId = affected.id
+          LIMIT ?
+        )
+        SELECT id FROM affected`, [JSON.stringify(seedTaskIds), batchSize])).map((row) => row.id);
+  const result = await client.run(`WITH RECURSIVE affected(id) AS (
+        SELECT value FROM json_each(?)
+      ),
+      free(id) AS (
+        SELECT task.id
+        FROM agent_tasks task
+        LEFT JOIN agent_tasks parent ON parent.id = task.parentTaskId
+        WHERE task.id IN (SELECT id FROM affected)
+          AND (
+            ${HUMAN_FREE_BASE_SQL}
+            OR (
+              parent.isHumanFree = 1
+              AND parent.id NOT IN (SELECT id FROM affected)
+              AND ${UNATTRIBUTED_SQL}
+            )
+          )
+
+        UNION
+
+        SELECT task.id
+        FROM free
+        JOIN agent_tasks task ON task.parentTaskId = free.id
+        WHERE +task.id IN (SELECT id FROM affected)
+          AND ${UNATTRIBUTED_SQL}
+      )
+      UPDATE agent_tasks
+      SET isHumanFree = CASE WHEN id IN (SELECT id FROM free) THEN 1 ELSE 0 END
+      WHERE id IN (SELECT id FROM affected)
+        AND isHumanFree != CASE WHEN id IN (SELECT id FROM free) THEN 1 ELSE 0 END`, [JSON.stringify(affected)]);
+  if (affected.length >= batchSize) {
+    const unfinished = await client.query(`WITH batch(id) AS (
+          SELECT value FROM json_each(?)
+        )
+        SELECT batch.id
+        FROM batch
+        WHERE EXISTS (
+          SELECT 1
+          FROM agent_tasks child
+          WHERE child.parentTaskId = batch.id
+            AND child.id NOT IN (SELECT id FROM batch)
+        )`, [JSON.stringify(affected)]);
+    await enqueueHumanFreeWork(unfinished.map((row) => row.id), "children", hops);
+  }
+  return result.changes;
+}
+async function reclassifyTaskHumanFree(seedTaskIds, options = {}) {
+  const batchSize = options.batchSize ?? HUMAN_FREE_RECLASSIFY_BATCH;
+  const seeds = [...new Set(seedTaskIds)];
+  if (seeds.length === 0)
+    return 0;
+  await enqueueHumanFreeWork(seeds.slice(batchSize), "self", 1);
+  return await reclassifyBatch(seeds.slice(0, batchSize), batchSize, 1);
+}
+async function drainOneBatch(batchSize) {
+  return await getDbClient().transaction(async (tx) => {
+    const head = await tx.get("SELECT * FROM human_free_reclassify_queue ORDER BY seq LIMIT 1");
+    if (!head)
+      return null;
+    if (head.scope === "self") {
+      const rows = await tx.query("SELECT * FROM human_free_reclassify_queue WHERE scope = 'self' ORDER BY seq LIMIT ?", [batchSize]);
+      const seeds = rows.map((row) => row.taskId);
+      const hops = Math.max(...rows.map((row) => row.hops)) + 1;
+      await tx.run("DELETE FROM human_free_reclassify_queue WHERE seq IN (SELECT value FROM json_each(?))", [JSON.stringify(rows.map((row) => row.seq))]);
+      return await reclassifyBatch(seeds, batchSize, hops);
+    }
+    const page = await tx.query(`SELECT id, rowid AS position
+       FROM agent_tasks
+       WHERE parentTaskId = ? AND rowid > ?
+       ORDER BY rowid
+       LIMIT ?`, [head.taskId, head.afterRowid, batchSize]);
+    if (page.length < batchSize) {
+      await tx.run("DELETE FROM human_free_reclassify_queue WHERE seq = ?", [head.seq]);
+    } else {
+      await tx.run("UPDATE human_free_reclassify_queue SET afterRowid = ? WHERE seq = ?", [
+        page[page.length - 1]?.position ?? head.afterRowid,
+        head.seq
+      ]);
+    }
+    if (page.length === 0)
+      return 0;
+    return await reclassifyBatch(page.map((row) => row.id), batchSize, head.hops + 1);
+  });
+}
+async function pendingHumanFreeReclassifications() {
+  const row = await getDbClient().get("SELECT COUNT(*) AS count FROM human_free_reclassify_queue");
+  return row?.count ?? 0;
+}
+async function drainHumanFreeReclassifyQueue(options = {}) {
+  const batchSize = options.batchSize ?? HUMAN_FREE_RECLASSIFY_BATCH;
+  const maxBatches = options.maxBatches ?? Number.POSITIVE_INFINITY;
+  let batches = 0;
+  let changed = 0;
+  while (batches < maxBatches) {
+    const batchChanged = await drainOneBatch(batchSize);
+    if (batchChanged === null)
+      break;
+    batches += 1;
+    changed += batchChanged;
+  }
+  return { batches, changed, remaining: await pendingHumanFreeReclassifications() };
+}
+var HUMAN_FREE_TAGS, HUMAN_FREE_TAG_SQL, HUMAN_FREE_BASE_SQL, UNATTRIBUTED_SQL = "(task.requestedByUserId IS NULL OR task.requestedByUserIdInherited = 1)", HUMAN_FREE_RECLASSIFY_BATCH = 500, HUMAN_FREE_MAX_CONTINUATION_HOPS = 1e4, queueListener;
+var init_human_free = __esm(() => {
+  init_runtime();
+  HUMAN_FREE_TAGS = ["heartbeat"];
+  HUMAN_FREE_TAG_SQL = HUMAN_FREE_TAGS.map((tag) => `COALESCE(task.tags, '[]') LIKE '%"${tag}"%'`).join(`
+        OR `);
+  HUMAN_FREE_BASE_SQL = `(
+        COALESCE(task.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
+        OR ${HUMAN_FREE_TAG_SQL}
+        OR (COALESCE(task.source, '') = 'schedule' AND task.requestedByUserId IS NULL)
+        OR (
+          task.parentTaskId IS NULL
+          AND COALESCE(task.source, '') = 'workflow'
+          AND task.requestedByUserId IS NULL
+          AND EXISTS (
+            SELECT 1
+            FROM workflow_runs run
+            WHERE run.id = task.workflowRunId
+              AND run.triggerType = 'schedule'
+              AND run.created_by IS NULL
+          )
+        )
+        OR (
+          COALESCE(task.source, '') = 'system'
+          AND parent.id IS NOT NULL
+          AND parent.requestedByUserId IS NULL
+        )
+      )`;
+});
+
 // src/utils/provider-metadata.ts
 function parseProviderMeta(rawProvider, rawMeta) {
   if (!rawMeta || !rawProvider)
@@ -2882,6 +3121,9 @@ function rowToAgentTask(row) {
     claudeSessionId: row.claudeSessionId ?? undefined,
     model: row.model ?? undefined,
     modelTier: parseModelTier(row.modelTier) ?? undefined,
+    resolvedModel: row.resolvedModel ?? undefined,
+    modelSource: row.modelSource ?? undefined,
+    modelAlias: row.modelAlias ?? undefined,
     effort: ReasoningEffortSchema.safeParse(row.effort).success ? row.effort : undefined,
     scheduleId: row.scheduleId ?? undefined,
     workflowRunId: row.workflowRunId ?? undefined,
@@ -2935,6 +3177,9 @@ function rowToAgentTaskSummary(row) {
     scheduleId: row.scheduleId ?? undefined,
     model: row.model ?? undefined,
     modelTier: parseModelTier(row.modelTier) ?? undefined,
+    resolvedModel: row.resolvedModel ?? undefined,
+    modelSource: row.modelSource ?? undefined,
+    modelAlias: row.modelAlias ?? undefined,
     effort: ReasoningEffortSchema.safeParse(row.effort).success ? row.effort : undefined,
     provider: row.provider ?? undefined,
     requestedByUserId: row.requestedByUserId ?? undefined,
@@ -2989,6 +3234,24 @@ async function getSupersededTasksWithoutResume(finishedBefore, finishedAfter) {
        ORDER BY t.finishedAt ASC`, [finishedBefore, finishedAfter]);
   return rows.map(rowToAgentTask);
 }
+async function getSupersededTasksWithUnsettledDependents(finishedBefore, finishedAfter) {
+  const placeholders = NEVER_STARTED_TASK_STATUSES.map(() => "?").join(", ");
+  return getDbClient().query(`SELECT taskId, resumeTaskId FROM (
+       SELECT t.id AS taskId, t.finishedAt AS finishedAt,
+              (SELECT c.id FROM agent_tasks c
+                 WHERE c.parentTaskId = t.id AND c.taskType = 'resume'
+                 ORDER BY c.createdAt DESC LIMIT 1) AS resumeTaskId
+         FROM agent_tasks t
+         WHERE t.status = 'superseded'
+           AND t.finishedAt < ?
+           AND t.finishedAt > ?
+           AND EXISTS (
+             SELECT 1 FROM agent_tasks d, json_each(d.dependsOn) AS j
+              WHERE j.value = t.id AND d.status IN (${placeholders})
+           ))
+     WHERE resumeTaskId IS NOT NULL
+     ORDER BY finishedAt ASC`, [finishedBefore, finishedAfter, ...NEVER_STARTED_TASK_STATUSES]);
+}
 async function hasNonTerminalRerouteDecisionChild(parentId) {
   const row = await getDbClient().get(`SELECT 1 FROM agent_tasks
        WHERE parentTaskId = ?
@@ -3482,7 +3745,7 @@ async function findRecentCancelledTaskInThread(channelId, threadTs, windowMinute
        LIMIT 1`, [channelId, threadTs, since]);
   return row ? rowToAgentTask(row) : null;
 }
-var dependencies2, TASK_PREVIEW_LENGTH = 300, TASK_PREVIEW_BYTES, TASK_PREVIEW_SQL, taskPreviewDecoder, LIST_COLUMNS, findTaskByGitHub, LINEAR_TRACKER_CONTEXT_KEY_PREFIX = "task:trackers:linear:";
+var dependencies2, TASK_PREVIEW_LENGTH = 300, TASK_PREVIEW_BYTES, TASK_PREVIEW_SQL, taskPreviewDecoder, LIST_COLUMNS, NEVER_STARTED_TASK_STATUSES, findTaskByGitHub, LINEAR_TRACKER_CONTEXT_KEY_PREFIX = "task:trackers:linear:";
 var init_read = __esm(() => {
   init_key();
   init_types();
@@ -3498,7 +3761,8 @@ var init_read = __esm(() => {
     ${TASK_PREVIEW_SQL}, agent_tasks.title, agent_tasks.status, agent_tasks.source,
     agent_tasks.taskType, agent_tasks.tags, agent_tasks.priority, agent_tasks.dependsOn,
     agent_tasks.offeredTo, agent_tasks.acceptedAt, agent_tasks.parentTaskId,
-    agent_tasks.scheduleId, agent_tasks.model, agent_tasks.modelTier, agent_tasks.effort,
+    agent_tasks.scheduleId, agent_tasks.model, agent_tasks.modelTier,
+    agent_tasks.resolvedModel, agent_tasks.modelSource, agent_tasks.modelAlias, agent_tasks.effort,
     agent_tasks.provider, agent_tasks.requestedByUserId, agent_tasks.progress,
     agent_tasks.createdAt, agent_tasks.lastUpdatedAt, agent_tasks.finishedAt,
     agent_tasks.peakContextPercent`,
@@ -3506,6 +3770,14 @@ var init_read = __esm(() => {
     agent_tasks.title, agent_tasks.status, agent_tasks.createdAt, agent_tasks.lastUpdatedAt,
     agent_tasks.finishedAt, agent_tasks.peakContextTokens`
   };
+  NEVER_STARTED_TASK_STATUSES = [
+    "draft",
+    "backlog",
+    "unassigned",
+    "offered",
+    "reviewing",
+    "pending"
+  ];
   findTaskByGitHub = findTaskByVcs;
 });
 
@@ -3535,8 +3807,9 @@ function configureTaskWriteDependencies(value) {
 async function createTask(agentId, task, options) {
   const id = crypto.randomUUID();
   const source2 = options?.source ?? "mcp";
-  const row = await getDbClient().get(`INSERT INTO agent_tasks (id, "key", agentId, task, status, source, slackChannelId, slackThreadTs, slackUserId, swarmVersion, createdAt, lastUpdatedAt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *`, [
+  const isHumanFree = await classifyTaskHumanFree({ source: source2 });
+  const row = await getDbClient().get(`INSERT INTO agent_tasks (id, "key", agentId, task, status, source, slackChannelId, slackThreadTs, slackUserId, swarmVersion, isHumanFree, createdAt, lastUpdatedAt)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *`, [
     id,
     defaultAssetKey("task", id),
     agentId,
@@ -3546,7 +3819,8 @@ async function createTask(agentId, task, options) {
     options?.slackChannelId ?? null,
     options?.slackThreadTs ?? null,
     options?.slackUserId ?? null,
-    package_default.version
+    package_default.version,
+    isHumanFree ? 1 : 0
   ]);
   if (!row)
     throw new Error("Failed to create task");
@@ -3719,7 +3993,12 @@ async function completeTask(id, output, options) {
     if (completed && options?.addTags?.length) {
       const existingTags = completed.tags ? JSON.parse(completed.tags) : [];
       const nextTags = Array.from(new Set([...existingTags, ...options.addTags]));
-      completed = await getDbClient().get("UPDATE agent_tasks SET tags = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *", [JSON.stringify(nextTags), id]);
+      const previousTagsJson = completed.tags;
+      const nextTagsJson = JSON.stringify(nextTags);
+      completed = await getDbClient().get("UPDATE agent_tasks SET tags = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *", [nextTagsJson, id]);
+      if (tagWriteChangesHumanFree(previousTagsJson, nextTagsJson)) {
+        await reclassifyTaskHumanFree([id]);
+      }
     }
     if (completed && options?.deferredAt) {
       completed = await getDbClient().get("UPDATE agent_tasks SET deferredAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ? RETURNING *", [options.deferredAt, id]);
@@ -3950,15 +4229,52 @@ async function supersedeTask(id, args) {
         });
       }).catch((err) => console.error("[db] task.superseded event not emitted:", scrubSecrets(err instanceof Error ? err.message : String(err))));
     });
-    try {
-      await dependencies3.cascadeFailDependents(id, "superseded");
-    } catch (err) {
-      console.error("[supersedeTask] cascade-fail dependents error:", err);
-    }
+    if (args.resumeTaskId)
+      await settleSupersededTaskDependents(id, args.resumeTaskId);
   }
   return row ? rowToAgentTask(row) : null;
 }
+async function settleSupersededTaskDependents(supersededId, resumeTaskId) {
+  try {
+    if (resumeTaskId) {
+      const placeholders = NEVER_STARTED_TASK_STATUSES.map(() => "?").join(", ");
+      const repointed = await getDbClient().query(`UPDATE agent_tasks
+            SET dependsOn = (
+                  SELECT json_group_array(value ORDER BY k) FROM (
+                    SELECT CASE WHEN j.value = ? THEN ? ELSE j.value END AS value,
+                           MIN(j.key) AS k
+                      FROM json_each(agent_tasks.dependsOn) AS j
+                     GROUP BY 1)),
+                lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+          WHERE status IN (${placeholders})
+            AND EXISTS (SELECT 1 FROM json_each(agent_tasks.dependsOn) WHERE value = ?)
+          RETURNING id, agentId`, [supersededId, resumeTaskId, ...NEVER_STARTED_TASK_STATUSES, supersededId]);
+      for (const dep of repointed) {
+        try {
+          await dependencies3.createLogEntry({
+            eventType: "task_dependency_repointed",
+            taskId: dep.id,
+            agentId: dep.agentId ?? undefined,
+            oldValue: supersededId,
+            newValue: resumeTaskId,
+            metadata: { reason: "supersede_resume" }
+          });
+        } catch {}
+      }
+      const resume = await getTaskById(resumeTaskId);
+      if (repointed.length > 0 && (resume?.status === "failed" || resume?.status === "cancelled")) {
+        await dependencies3.cascadeFailDependents(resumeTaskId, resume.status);
+      }
+    }
+    await dependencies3.cascadeFailDependents(supersededId, "superseded");
+  } catch (err) {
+    console.error("[supersedeTask] settling dependents error:", err);
+  }
+}
 async function backfillSupersedeTaskResumeTaskId(taskId, resumeTaskId) {
+  if ((await getTaskById(taskId))?.status === "superseded") {
+    await settleSupersededTaskDependents(taskId, resumeTaskId);
+  }
   const row = await getDbClient().get(`SELECT id, metadata
        FROM agent_log
        WHERE taskId = ? AND eventType = 'task_superseded'
@@ -4091,8 +4407,12 @@ async function getRecentlyCancelledTasksForAgent(agentId) {
   return rows.map(rowToAgentTask);
 }
 async function deleteTask(id) {
-  const result = await getDbClient().run("DELETE FROM agent_tasks WHERE id = ?", [id]);
-  return result.changes > 0;
+  return await getDbClient().transaction(async (tx) => {
+    const childIds = (await tx.query("SELECT id FROM agent_tasks WHERE parentTaskId = ?", [id])).map((row) => row.id);
+    const result = await tx.run("DELETE FROM agent_tasks WHERE id = ?", [id]);
+    await reclassifyTaskHumanFree(childIds);
+    return result.changes > 0;
+  });
 }
 async function updateTaskProgress(id, progress) {
   const scrubbedProgress = scrubSecrets(progress);
@@ -4130,6 +4450,7 @@ var init_write = __esm(() => {
   init_task_lifecycle_events();
   init_agents();
   init_runtime();
+  init_human_free();
   init_read();
   AFFINITY_DISPATCH_SKIP_LOG_COOLDOWN_MS = 5 * 60 * 1000;
   lastAffinityDispatchSkipLoggedAt = new Map;
@@ -4336,165 +4657,6 @@ var init_reaction_shortcode = __esm(() => {
   SLACK_REACTION_SHORTCODE_PATTERN = /^[a-z0-9_+'-]+(::skin-tone-[2-6])?$/;
 });
 
-// src/tools/tool-config.ts
-var CORE_TOOLS, DEFERRED_TOOLS, ALL_TOOLS;
-var init_tool_config = __esm(() => {
-  CORE_TOOLS = new Set([
-    "join-swarm",
-    "my-agent-info",
-    "poll-task",
-    "get-task-details",
-    "store-progress",
-    "task-action",
-    "send-task",
-    "get-tasks",
-    "defer-task",
-    "memory-search",
-    "memory-get",
-    "memory-store",
-    "memory-delete",
-    "memory_rate",
-    "get-swarm",
-    "script-run",
-    "db-query",
-    "kv-get",
-    "script-query-types",
-    "get-repos",
-    "accept-steer",
-    "memory-edit",
-    "script-search",
-    "steer-task",
-    "kv-list",
-    "get-config"
-  ]);
-  DEFERRED_TOOLS = new Set([
-    "list-schedules",
-    "create-schedule",
-    "update-schedule",
-    "patch-schedule",
-    "delete-schedule",
-    "run-schedule-now",
-    "create-workflow",
-    "list-workflows",
-    "get-workflow",
-    "update-workflow",
-    "patch-workflow",
-    "patch-workflow-node",
-    "delete-workflow",
-    "trigger-workflow",
-    "list-workflow-runs",
-    "get-workflow-run",
-    "retry-workflow-run",
-    "cancel-workflow-run",
-    "register-service",
-    "unregister-service",
-    "list-services",
-    "update-service-status",
-    "set-config",
-    "list-config",
-    "delete-config",
-    "credential-bindings",
-    "script-connections",
-    "update-repo",
-    "update-profile",
-    "context-history",
-    "context-diff",
-    "read-messages",
-    "post-message",
-    "slack-reply",
-    "slack-read",
-    "slack-upload-file",
-    "slack-download-file",
-    "slack-list-channels",
-    "slack-post",
-    "slack-start-thread",
-    "slack-create-channel",
-    "slack-invite-to-channel",
-    "slack-archive-channel",
-    "slack-delete",
-    "slack-update",
-    "create-channel",
-    "delete-channel",
-    "list-channels",
-    "register-agentmail-inbox",
-    "register-kapso-number",
-    "unregister-kapso-number",
-    "send-whatsapp-message",
-    "reply-whatsapp-message",
-    "tracker-status",
-    "get-oauth-access-token",
-    "tracker-link-task",
-    "tracker-unlink",
-    "tracker-sync-status",
-    "tracker-map-agent",
-    "list-prompt-templates",
-    "get-prompt-template",
-    "set-prompt-template",
-    "delete-prompt-template",
-    "preview-prompt-template",
-    "create_metric",
-    "request-human-input",
-    "cancel-approval-request",
-    "skill-create",
-    "skill-update",
-    "skill-delete",
-    "skill-get",
-    "skill-get-file",
-    "skill-list",
-    "skill-search",
-    "skill-install",
-    "skill-uninstall",
-    "skill-install-remote",
-    "skill-sync-remote",
-    "skill-publish",
-    "mcp-server-create",
-    "mcp-server-delete",
-    "mcp-server-get",
-    "mcp-server-install",
-    "mcp-server-list",
-    "mcp-server-uninstall",
-    "mcp-server-update",
-    "resolve-user",
-    "manage-user",
-    "app-get",
-    "app-list",
-    "app-patch",
-    "app-query",
-    "app-sync",
-    "app-upsert",
-    "app-history",
-    "app-diff",
-    "app-rollback",
-    "create_page",
-    "delete-page",
-    "kv-set",
-    "kv-delete",
-    "kv-incr",
-    "room-get",
-    "room-change",
-    "room-reset",
-    "room-decode",
-    "script-upsert",
-    "script-delete",
-    "script-apis",
-    "launch-script-run",
-    "get-script-run",
-    "list-script-runs",
-    "extension-delete",
-    "extension-enable",
-    "extension-disable",
-    "extension-activate-version",
-    "extension-catalog",
-    "extension-install",
-    "extension-list",
-    "swarm_x",
-    "cancel-task",
-    "inject-learning",
-    "get-metrics"
-  ]);
-  ALL_TOOLS = new Set([...CORE_TOOLS, ...DEFERRED_TOOLS]);
-});
-
 // src/utils/task-tool-manifest.ts
 function parseTaskToolManifest(value) {
   return taskToolManifestSchema.parse(JSON.parse(value));
@@ -4515,6 +4677,42 @@ var init_task_tool_manifest = __esm(() => {
   });
 });
 
+// src/be/model-tier-keys.ts
+function tierConfigKey(provider, tier) {
+  return `MODEL_TIER_${provider.toUpperCase().replace(/-/g, "_")}_${tier.toUpperCase()}`;
+}
+function isTierConfigKey(key) {
+  return TIER_CONFIG_KEY_RE.test(key.toUpperCase());
+}
+function tierConfigKeyProvider(key) {
+  const match = TIER_CONFIG_KEY_RE.exec(key.toUpperCase());
+  if (!match)
+    return null;
+  return ProviderNameSchema.options.find((p) => p.toUpperCase().replace(/-/g, "_") === match[1]) ?? null;
+}
+function validateTierConfigValue(key, value) {
+  const message = `Invalid ${key} (expected a model id, a CLI alias such as "opus", or latest:<anthropic|openai|openrouter>/<target>[@stable|@any])`;
+  if (typeof value !== "string")
+    return message;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || /\s/.test(trimmed) || trimmed.length > 200)
+    return message;
+  if (isAlias(trimmed) && !parseAlias(trimmed))
+    return message;
+  const provider = tierConfigKeyProvider(key);
+  if (provider && harnessModelMismatch(trimmed, provider, runtimeHarnessSections())) {
+    return `Invalid ${key}: model "${trimmed}" does not run on the ${provider} harness.`;
+  }
+  return null;
+}
+var TIER_CONFIG_KEY_RE;
+var init_model_tier_keys = __esm(() => {
+  init_src();
+  init_types();
+  init_runtime_model_catalog();
+  TIER_CONFIG_KEY_RE = new RegExp(`^MODEL_TIER_(${ProviderNameSchema.options.map((p) => p.toUpperCase().replace(/-/g, "_")).join("|")})_(${MODEL_TIERS.map((t) => t.toUpperCase()).join("|")})$`);
+});
+
 // src/be/swarm-config-guard.ts
 function isInternalConfigKey(key) {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
@@ -4596,6 +4794,8 @@ function validateFloatRange(key, value, min, max, expectation) {
   return null;
 }
 function validateConfigValue(key, value) {
+  if (isTierConfigKey(key))
+    return validateTierConfigValue(key.toUpperCase(), value);
   const validator = VALIDATED_KEYS[key.toUpperCase()];
   return validator ? validator(value) : null;
 }
@@ -4604,6 +4804,7 @@ var init_swarm_config_guard = __esm(() => {
   init_reaction_shortcode();
   init_types();
   init_task_tool_manifest();
+  init_model_tier_keys();
   RESERVED_KEYS = new Set([
     "API_KEY",
     "SECRETS_ENCRYPTION_KEY",
@@ -4697,6 +4898,7 @@ var init_swarm_config_guard = __esm(() => {
       return null;
     },
     ...booleanValidators([
+      "SWARM_DEV_MODE",
       "MULTI_RUNTIME_ENABLED",
       "STEERING_ENABLED",
       "MEMORY_HYBRID_SEARCH",
@@ -4706,6 +4908,8 @@ var init_swarm_config_guard = __esm(() => {
       "POOL_AFFINITY_ENFORCEMENT",
       "SCRIPTS_ONLY_MCP",
       "TASK_TOOL_PRELOAD_ENABLED",
+      "PI_TOOL_DEFERRAL",
+      "PI_CODEMODE",
       "SLACK_DISABLE",
       "SLACK_RENDER_V2",
       "SLACK_RENDER_V2_DELEGATION",
@@ -4726,7 +4930,8 @@ var init_swarm_config_guard = __esm(() => {
       "ANONYMIZED_TELEMETRY",
       "SWARM_HIDE_CLOUD_PROMO",
       "DB_QUERY_BOUNDED_ENABLED",
-      "DB_RETENTION_DRY_RUN"
+      "DB_RETENTION_DRY_RUN",
+      "MODEL_AUTO_UPGRADE"
     ]),
     ...enumValidator("SLACK_MODE", ["socket", "http"]),
     ...enumValidator("SLACK_THREAD_STEERING", ["off", "lead", "all"]),
@@ -4767,6 +4972,7 @@ var init_swarm_config_guard = __esm(() => {
     ...boundedIntegerValidatorsFor(DB_RETENTION_TUNING_BOUNDS),
     ...boundedIntegerValidators(["SESSION_LOG_RETENTION_DAYS", "AGENT_LOG_RETENTION_DAYS", "EVENTS_RETENTION_DAYS"], 1, MAX_DB_RETENTION_DAYS),
     ...integerValidators(["HEARTBEAT_MAX_AUTO_ASSIGN"], 0),
+    ...integerValidators(["MODEL_LATEST_SOAK_DAYS"], 0),
     ...integerValidators(["APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS"], 0),
     ...boundedIntegerValidators(["CONTEXT_PREAMBLE_MAX_TOKENS"], 100, 20000),
     MEMORY_MIN_SIMILARITY: (value) => validateFloatRange("MEMORY_MIN_SIMILARITY", value, 0, 1, "between 0 and 1 inclusive"),
@@ -4774,6 +4980,43 @@ var init_swarm_config_guard = __esm(() => {
   };
 });
 
+// src/be/db/api-keys.ts
+async function recordKeySeatMismatch(keyType, keySuffix, keyIndex, model, scope = "global", scopeId = null) {
+  const now = new Date().toISOString();
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  return getDbClient().transaction(async (tx) => {
+    await tx.run(`INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET
+           keyIndex = excluded.keyIndex,
+           provider = excluded.provider,
+           updatedAt = excluded.updatedAt`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, provider, now]);
+    await tx.run(`UPDATE api_key_status SET lastSeatMismatchAt = ?, lastSeatMismatchModel = ?
+         WHERE keyType = ? AND keySuffix = ?`, [now, model, keyType, keySuffix]);
+    let planChanged = false;
+    if (keyType === "CLAUDE_CODE_OAUTH_TOKEN" && !planAllowsModelFamily("claude_team_standard", model)) {
+      const result = await tx.run(`UPDATE api_key_status SET plan = 'claude_team_standard', planSource = 'detected'
+           WHERE keyType = ? AND keySuffix = ? AND COALESCE(planSource, '') != 'manual'`, [keyType, keySuffix]);
+      planChanged = result.changes > 0;
+    }
+    if (!planChanged) {
+      const stored = await tx.get(`SELECT plan FROM api_key_status
+           WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [keyType, keySuffix, scope, effectiveScopeId]);
+      if (planAllowsModelFamily(stored?.plan, model)) {
+        console.warn(`[api-keys] seat mismatch: key ...${keySuffix} (${keyType}) has plan ${stored?.plan ?? "none"} but cannot run ${model}`);
+      }
+    }
+    return { planChanged };
+  });
+}
+var init_api_keys = __esm(() => {
+  init_credentials();
+  init_subscription_plans();
+  init_runtime();
+});
+
 // src/be/db.ts
 var exports_db = {};
 __export(exports_db, {
@@ -4910,6 +5153,7 @@ __export(exports_db, {
   getAgentMailInboxMappingsByAgent: () => getAgentMailInboxMappingsByAgent,
   getAgentMcpServers: () => getAgentMcpServers,
   getAgentSkills: () => getAgentSkills,
+  getAgentStatusCounts: () => getAgentStatusCounts,
   getAgentWithTasks: () => getAgentWithTasks,
   getAgentWorkingOnThread: () => getAgentWorkingOnThread,
   getAllAgentMailInboxMappings: () => getAllAgentMailInboxMappings,
@@ -5064,6 +5308,7 @@ __export(exports_db, {
   getStuckApprovalRuns: () => getStuckApprovalRuns,
   getStuckWaitRuns: () => getStuckWaitRuns,
   getStuckWorkflowRuns: () => getStuckWorkflowRuns,
+  getSupersededTasksWithUnsettledDependents: () => getSupersededTasksWithUnsettledDependents,
   getSupersededTasksWithoutResume: () => getSupersededTasksWithoutResume,
   getSwarmConfigById: () => getSwarmConfigById,
   getSwarmConfigLookupById: () => getSwarmConfigLookupById,
@@ -5087,7 +5332,6 @@ __export(exports_db, {
   getUnassignedTasksCount: () => getUnassignedTasksCount,
   getUnreadInboxMessages: () => getUnreadInboxMessages,
   getUnreadMessages: () => getUnreadMessages,
-  getUsageDataVersion: () => getUsageDataVersion,
   getUserById: () => getUserById,
   getWaitStateById: () => getWaitStateById,
   getWaitStateByStepId: () => getWaitStateByStepId,
@@ -5120,6 +5364,7 @@ __export(exports_db, {
   isPendingSlackMessage: () => isPendingSlackMessage,
   isPoolAffinityEnforcementEnabled: () => isPoolAffinityEnforcementEnabled,
   isSettledSlackMessage: () => isSettledSlackMessage,
+  isSlackThreadAwaitingHuman: () => isSlackThreadAwaitingHuman,
   isSqliteVecAvailable: () => isSqliteVecAvailable,
   kvPrefixUpperBound: () => kvPrefixUpperBound,
   listAgentsWithCredStatusByProvider: () => listAgentsWithCredStatusByProvider,
@@ -5141,6 +5386,7 @@ __export(exports_db, {
   listScriptRuns: () => listScriptRuns,
   listSkillFileManifest: () => listSkillFileManifest,
   listSkills: () => listSkills,
+  listSlackThreadsAwaitingHuman: () => listSlackThreadsAwaitingHuman,
   listTaskTemplates: () => listTaskTemplates,
   listUserFavorites: () => listUserFavorites,
   listWorkflowRuns: () => listWorkflowRuns,
@@ -5174,7 +5420,9 @@ __export(exports_db, {
   reassociateSessionLogs: () => reassociateSessionLogs,
   recordBudgetRefusalNotification: () => recordBudgetRefusalNotification,
   recordInlineScriptRun: () => recordInlineScriptRun,
+  recordKeyAuthFailure: () => recordKeyAuthFailure,
   recordKeyRateLimitWindows: () => recordKeyRateLimitWindows,
+  recordKeySeatMismatch: () => recordKeySeatMismatch,
   recordKeyUsage: () => recordKeyUsage,
   recordSlackMessage: () => recordSlackMessage,
   recordTaskPullRequestAttachments: () => recordTaskPullRequestAttachments,
@@ -5207,6 +5455,7 @@ __export(exports_db, {
   setFavorite: () => setFavorite,
   setSlackMessageTracking: () => setSlackMessageTracking,
   setUserFavorite: () => setUserFavorite,
+  settleSupersededTaskDependents: () => settleSupersededTaskDependents,
   shouldBlockPolling: () => shouldBlockPolling,
   startTask: () => startTask,
   supersedeTask: () => supersedeTask,
@@ -5583,6 +5832,26 @@ async function getSlackTasksInThread(channelId, threadTs) {
        ORDER BY createdAt ASC, rowid ASC`, [channelId, threadTs]);
   return rows.map(rowToAgentTask);
 }
+async function listSlackThreadsAwaitingHuman() {
+  return getDbClient().query(`SELECT DISTINCT task.slackChannelId AS channelId, task.slackThreadTs AS threadTs
+       FROM approval_requests request
+       JOIN agent_tasks task ON task.id = request.sourceTaskId
+       WHERE request.status = 'pending'
+       AND (request.expiresAt IS NULL OR request.expiresAt > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       AND task.slackChannelId IS NOT NULL
+       AND task.slackThreadTs IS NOT NULL`);
+}
+async function isSlackThreadAwaitingHuman(channelId, threadTs) {
+  const row = await getDbClient().get(`SELECT 1 AS waiting
+       FROM approval_requests request
+       JOIN agent_tasks task ON task.id = request.sourceTaskId
+       WHERE request.status = 'pending'
+       AND (request.expiresAt IS NULL OR request.expiresAt > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       AND task.slackChannelId = ?
+       AND task.slackThreadTs = ?
+       LIMIT 1`, [channelId, threadTs]);
+  return !!row;
+}
 async function markTaskSlackReplySent(taskId) {
   await getDbClient().run(`UPDATE agent_tasks SET slackReplySent = 1 WHERE id = ?`, [taskId]);
 }
@@ -6612,6 +6881,15 @@ async function createTaskExtended(task, options) {
     } catch (error) {
       logRoutingDecisionFailure(id, "capture", error);
     }
+    const isHumanFree = await classifyTaskHumanFree({
+      taskType: options?.taskType,
+      tags: JSON.stringify(options?.tags ?? []),
+      source: options?.source ?? "mcp",
+      requestedByUserId: options?.requestedByUserId,
+      requestedByUserIdInherited,
+      parentTaskId: options?.parentTaskId,
+      workflowRunId: options?.workflowRunId
+    });
     const inserted = await getDbClient().get(`INSERT INTO agent_tasks (
         id, "key", agentId, creatorAgentId, task, status, source, routing_reason, routing_source, routing_note,
         taskType, tags, priority, dependsOn, offeredTo, offeredAt,
@@ -6620,8 +6898,8 @@ async function createTaskExtended(task, options) {
         vcsInstallationId, vcsNodeId,
         agentmailInboxId, agentmailMessageId, agentmailThreadId,
         mentionMessageId, mentionChannelId, dir, parentTaskId, model, modelTier, effort, scheduleId,
-        workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, requestedByUserIdInherited, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`, [
+        workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, requestedByUserIdInherited, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by, isHumanFree
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`, [
       id,
       assetKey,
       options?.agentId ?? null,
@@ -6674,7 +6952,8 @@ async function createTaskExtended(task, options) {
       now,
       now,
       auditUserId,
-      auditUserId
+      auditUserId,
+      isHumanFree ? 1 : 0
     ]);
     if (!inserted)
       throw new Error("Failed to create task");
@@ -7019,7 +7298,7 @@ async function getUnassignedTaskIds(limit = 10) {
   const rows = await getDbClient().query("SELECT id FROM agent_tasks WHERE status = 'unassigned' ORDER BY priority DESC, createdAt ASC, rowid ASC LIMIT ?", [limit]);
   return rows.map((r) => r.id);
 }
-async function getUnassignedTaskIdsForAgent(agentId, limit = 10) {
+async function getUnassignedTaskIdsForAgent(agentId, limit = 10, accept) {
   const agent = await getAgentById(agentId);
   if (!agent)
     return [];
@@ -7032,7 +7311,7 @@ async function getUnassignedTaskIdsForAgent(agentId, limit = 10) {
       break;
     for (const row of rows) {
       const task = rowToAgentTask(row);
-      if (isAgentEligibleForTask(agent, task)) {
+      if (isAgentEligibleForTask(agent, task) && (!accept || await accept(task))) {
         eligible.push(task.id);
         if (eligible.length >= limit)
           break;
@@ -7855,8 +8134,8 @@ async function getSessionCostsFiltered(opts) {
   return rows.map(rowToSessionCost);
 }
 async function getSessionCostSummary(opts) {
-  const from = "FROM session_costs sc LEFT JOIN agent_tasks t ON t.id = sc.taskId";
-  const fromHf = `${from} LEFT JOIN human_free_tasks hf ON hf.id = t.id`;
+  const from = "FROM session_costs sc LEFT JOIN agent_tasks t INDEXED BY idx_agent_tasks_usage_cover ON t.id = sc.taskId";
+  const agentFrom = opts.userId === undefined ? "FROM session_costs sc" : from;
   const conditions = [];
   const params = [];
   if (opts.startDate) {
@@ -7878,12 +8157,8 @@ async function getSessionCostSummary(opts) {
     params.push(opts.userId);
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const classify = opts.userId !== undefined;
-  const withHf = classify ? `WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}` : "";
-  const scopedFrom = classify ? fromHf : from;
   const subscriptionSql = `t.credentialKeyType IN (${SUBSCRIPTION_KEY_TYPES.map((k) => `'${k}'`).join(", ")})`;
-  const totalsRow = await getDbClient().get(`WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
-      SELECT
+  const totalsRow = await getDbClient().get(`SELECT
         COALESCE(SUM(sc.totalCostUsd), 0) as totalCostUsd,
         COALESCE(SUM(sc.inputTokens), 0) as totalInputTokens,
         COALESCE(SUM(sc.outputTokens), 0) as totalOutputTokens,
@@ -7900,7 +8175,7 @@ async function getSessionCostSummary(opts) {
         COUNT(DISTINCT CASE WHEN ${HUMAN_FREE_SQL} THEN t.id END) as excludedTaskCount,
         COALESCE(SUM(CASE WHEN ${subscriptionSql}
           THEN sc.totalCostUsd ELSE 0 END), 0) as subscriptionCostUsd
-      ${fromHf} ${where}`, params);
+      ${from} ${where}`, params);
   const totals = totalsRow ? {
     ...totalsRow,
     avgCostPerSession: totalsRow.totalSessions > 0 ? totalsRow.totalCostUsd / totalsRow.totalSessions : 0
@@ -7922,8 +8197,7 @@ async function getSessionCostSummary(opts) {
   const groupBy = opts.groupBy ?? "both";
   let daily = [];
   if (groupBy === "day" || groupBy === "both") {
-    daily = await getDbClient().query(`${withHf}
-        SELECT
+    daily = await getDbClient().query(`SELECT
           DATE(sc.createdAt) as date,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
@@ -7931,42 +8205,39 @@ async function getSessionCostSummary(opts) {
           COUNT(*) as sessions,
           COALESCE(SUM(CASE WHEN ${subscriptionSql} THEN sc.totalCostUsd ELSE 0 END), 0)
             as subscriptionCostUsd
-        ${scopedFrom} ${where}
+        ${from} ${where}
         GROUP BY DATE(sc.createdAt)
         ORDER BY date ASC`, params);
   }
   let byAgent = [];
   if (groupBy === "agent" || groupBy === "both") {
-    byAgent = await getDbClient().query(`${withHf}
-        SELECT
+    byAgent = await getDbClient().query(`SELECT
           sc.agentId as agentId,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
           COALESCE(SUM(sc.outputTokens), 0) as outputTokens,
           COUNT(*) as sessions,
           COALESCE(SUM(sc.durationMs), 0) as durationMs
-        ${scopedFrom} ${where}
+        ${agentFrom} ${where}
         GROUP BY sc.agentId
         ORDER BY costUsd DESC`, params);
   }
   let byUser = [];
   if (groupBy === "user" || groupBy === "both") {
-    byUser = await getDbClient().query(`WITH RECURSIVE ${HUMAN_FREE_TASKS_CTE}
-        SELECT
+    byUser = await getDbClient().query(`SELECT
           CASE WHEN ${HUMAN_FREE_SQL} THEN NULL ELSE t.requestedByUserId END as userId,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
           COALESCE(SUM(sc.inputTokens), 0) as inputTokens,
           COALESCE(SUM(sc.outputTokens), 0) as outputTokens,
           COUNT(DISTINCT sc.taskId) as tasks,
           COALESCE(SUM(sc.durationMs), 0) as durationMs
-        ${fromHf} ${where}
+        ${from} ${where}
         GROUP BY CASE WHEN ${HUMAN_FREE_SQL} THEN NULL ELSE t.requestedByUserId END
         ORDER BY costUsd DESC`, params);
   }
   let byCredential = [];
   if (groupBy === "both") {
-    const rows = await getDbClient().query(`${withHf}
-        SELECT
+    const rows = await getDbClient().query(`SELECT
           t.credentialKeyType as keyType,
           t.credentialKeySuffix as keySuffix,
           COALESCE(SUM(sc.totalCostUsd), 0) as costUsd,
@@ -7975,7 +8246,7 @@ async function getSessionCostSummary(opts) {
           COUNT(*) as sessions,
           MIN(sc.createdAt) as firstSessionAt,
           MAX(sc.createdAt) as lastSessionAt
-        ${scopedFrom} ${where}
+        ${from} ${where}
         GROUP BY t.credentialKeyType, t.credentialKeySuffix
         ORDER BY costUsd DESC`, params);
     const labels = await getCredentialLabels();
@@ -8011,11 +8282,6 @@ async function getCredentialLabels() {
   }
   return labels;
 }
-async function getUsageDataVersion() {
-  const row = await getDbClient().get(`SELECT COALESCE((SELECT MAX(rowid) FROM session_costs), 0) || ':' ||
-            COALESCE((SELECT MAX(rowid) FROM agent_tasks), 0) as version`);
-  return row?.version ?? "0:0";
-}
 async function getAttributionByPerson(opts) {
   const conditions = ["t.requestedByUserId IS NOT NULL"];
   const params = [];
@@ -8035,18 +8301,20 @@ async function getAttributionByPerson(opts) {
     }
   }
   const where = `WHERE ${conditions.join(" AND ")}`;
-  const rootRows = await getDbClient().query(`WITH RECURSIVE selected_roots(id, requestedByUserId, status, output) AS (
-        SELECT t.id, t.requestedByUserId, t.status, t.output
+  const rootRows = await getDbClient().query(`WITH RECURSIVE selected_roots(id, requestedByUserId, status) AS (
+        SELECT t.id, t.requestedByUserId, t.status
         FROM agent_tasks t
-        ${where} AND t.parentTaskId IS NULL AND NOT ${ROOT_HUMAN_FREE_SQL}
+        ${where} AND t.parentTaskId IS NULL AND t.isHumanFree = 0
       ),
-      task_tree(rootId, taskId, output) AS (
-        SELECT id, id, output
+      -- Ids only: carrying each descendant's \`output\` through the recursion copied
+      -- every task's text into the queue. The output fallback below reads it by id.
+      task_tree(rootId, taskId) AS (
+        SELECT id, id
         FROM selected_roots
 
         UNION ALL
 
-        SELECT tree.rootId, child.id, child.output
+        SELECT tree.rootId, child.id
         FROM agent_tasks child
         JOIN task_tree tree ON child.parentTaskId = tree.taskId
       ),
@@ -8079,8 +8347,11 @@ async function getAttributionByPerson(opts) {
 
         SELECT tree.rootId
         FROM task_tree tree
-        WHERE tree.output LIKE '%github.com/%/pull/%'
-           OR tree.output LIKE '%/-/merge_requests/%'
+        -- CROSS JOIN pins the order (tree outer, task by id). Left to itself the
+        -- planner scans every task's output and probes the tree instead.
+        CROSS JOIN agent_tasks described ON described.id = tree.taskId
+        WHERE described.output LIKE '%github.com/%/pull/%'
+           OR described.output LIKE '%/-/merge_requests/%'
       )
       SELECT
         t.requestedByUserId as userId,
@@ -8089,65 +8360,13 @@ async function getAttributionByPerson(opts) {
       FROM selected_roots t
       LEFT JOIN shipped_roots s ON s.rootId = t.id
       GROUP BY t.requestedByUserId`, params);
-  const reachRows = await getDbClient().query(`WITH RECURSIVE report_tasks AS (
-        -- Only the columns read below: a task row carries its full prompt and output.
-        SELECT t.id, t.agentId, t.vcsRepo, t.source, t.parentTaskId, t.requestedByUserId,
-          t.requestedByUserIdInherited, t.taskType, t.tags, t.workflowRunId
-        FROM agent_tasks t
-        ${where}
-      ),
-      task_ancestry(
-        taskId, id, parentTaskId, requestedByUserId, requestedByUserIdInherited,
-        taskType, tags, source, workflowRunId
-      ) AS (
-        SELECT
-          id, id, parentTaskId, requestedByUserId, requestedByUserIdInherited,
-          taskType, tags, source, workflowRunId
-        FROM report_tasks
-
-        UNION ALL
-
-        SELECT
-          child.taskId, parent.id, parent.parentTaskId, parent.requestedByUserId,
-          parent.requestedByUserIdInherited, parent.taskType, parent.tags,
-          parent.source, parent.workflowRunId
-        FROM agent_tasks parent
-        JOIN task_ancestry child ON parent.id = child.parentTaskId
-        WHERE child.requestedByUserId IS NULL
-          OR child.requestedByUserIdInherited = 1
-      ),
-      human_free_report_tasks(id) AS (
-        SELECT DISTINCT ancestor.taskId
-        FROM task_ancestry ancestor
-        LEFT JOIN agent_tasks parent ON parent.id = ancestor.parentTaskId
-        WHERE COALESCE(ancestor.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
-          OR COALESCE(ancestor.tags, '[]') LIKE '%"heartbeat"%'
-          OR (COALESCE(ancestor.source, '') = 'schedule' AND ancestor.requestedByUserId IS NULL)
-          OR (
-            ancestor.parentTaskId IS NULL
-            AND COALESCE(ancestor.source, '') = 'workflow'
-            AND ancestor.requestedByUserId IS NULL
-            AND EXISTS (
-              SELECT 1
-              FROM workflow_runs run
-              WHERE run.id = ancestor.workflowRunId
-                AND run.triggerType = 'schedule'
-                AND run.created_by IS NULL
-            )
-          )
-          OR (
-            COALESCE(ancestor.source, '') = 'system'
-            AND parent.id IS NOT NULL
-            AND parent.requestedByUserId IS NULL
-          )
-      )
-      SELECT
+  const reachRows = await getDbClient().query(`SELECT
         t.requestedByUserId as userId,
         COUNT(DISTINCT t.agentId) as agentsReached,
         COUNT(DISTINCT t.vcsRepo) as reposReached,
         COUNT(DISTINCT t.source) as surfacesReached
-      FROM report_tasks t
-      WHERE NOT EXISTS (SELECT 1 FROM human_free_report_tasks WHERE id = t.id)
+      FROM agent_tasks t
+      ${where} AND t.isHumanFree = 0
       GROUP BY t.requestedByUserId`, params);
   const byUser = new Map;
   for (const r of rootRows) {
@@ -9310,10 +9529,15 @@ async function updateWorkflow(id, data) {
   return row ? rowToWorkflow(row) : null;
 }
 async function deleteWorkflow(id, source2) {
+  return await getDbClient().transaction(() => deleteWorkflowRows(id, source2));
+}
+async function deleteWorkflowRows(id, source2) {
   const client = getDbClient();
+  const linkedTaskIds = (await client.query(`SELECT id FROM agent_tasks WHERE workflowRunId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id])).map((row) => row.id);
   await client.run(`UPDATE agent_tasks SET workflowRunId = NULL, workflowRunStepId = NULL WHERE workflowRunId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id]);
   await client.run(`DELETE FROM workflow_run_steps WHERE runId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id]);
   await client.run("DELETE FROM workflow_runs WHERE workflowId = ?", [id]);
+  await reclassifyTaskHumanFree(linkedTaskIds);
   const result = await client.run("DELETE FROM workflows WHERE id = ?", [id]);
   const deleted = result.changes > 0;
   if (deleted) {
@@ -11368,8 +11592,8 @@ async function getAvailableKeyIndices(keyType, totalKeys, scope = "global", scop
   await client.run(`UPDATE api_key_status
      SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
      WHERE keyType = ? AND scope = ? AND scopeId = ?
-       AND status = 'rate_limited' AND rateLimitedUntil IS NOT NULL AND rateLimitedUntil <= ?`, [now, keyType, scope, effectiveScopeId, now]);
-  const rows = await client.query(`SELECT keyIndex, status, rateLimitWindows FROM api_key_status
+       AND status = 'rate_limited' AND rateLimitedUntil <= ? AND consecutiveAuthFailures < ?`, [now, keyType, scope, effectiveScopeId, now, CODEX_AUTH_FAILURE_BENCH_THRESHOLD]);
+  const rows = await client.query(`SELECT keyIndex, status, rateLimitWindows, plan, authFailureSeq FROM api_key_status
        WHERE keyType = ? AND scope = ? AND scopeId = ?`, [keyType, scope, effectiveScopeId]);
   const blockedIndices = new Set(rows.filter((r) => r.status === "rate_limited").map((r) => r.keyIndex));
   const modelBlockedIndices = [];
@@ -11388,16 +11612,26 @@ async function getAvailableKeyIndices(keyType, totalKeys, scope = "global", scop
     }
   }
   const modelBlockedSet = new Set(modelBlockedIndices);
+  const seatBlockedIndices = [];
+  if (modelFamily) {
+    for (const row of rows) {
+      if (!planAllowsModelFamily(row.plan, modelFamily))
+        seatBlockedIndices.push(row.keyIndex);
+    }
+  }
+  const seatBlockedSet = new Set(seatBlockedIndices);
   const availableIndices = [];
   for (let i = 0;i < totalKeys; i++) {
-    if (blockedIndices.has(i) || modelBlockedSet.has(i))
+    if (blockedIndices.has(i) || modelBlockedSet.has(i) || seatBlockedSet.has(i))
       continue;
     availableIndices.push(i);
   }
   return {
     availableIndices,
     modelBlockedIndices,
-    earliestModelResetAt: earliestModelResetsAtSec !== undefined ? new Date(earliestModelResetsAtSec * 1000).toISOString() : null
+    seatBlockedIndices,
+    earliestModelResetAt: earliestModelResetsAtSec !== undefined ? new Date(earliestModelResetsAtSec * 1000).toISOString() : null,
+    authFailureFence: Math.max(0, ...rows.map((r) => r.authFailureSeq))
   };
 }
 async function recordKeyUsage(keyType, keySuffix, keyIndex, taskId, scope = "global", scopeId = null, plan = null) {
@@ -11444,12 +11678,50 @@ async function markKeyRateLimited(keyType, keySuffix, keyIndex, rateLimitedUntil
        ON CONFLICT(keyType, keySuffix, scope, scopeId)
        DO UPDATE SET
          status = 'rate_limited',
-         rateLimitedUntil = excluded.rateLimitedUntil,
+         rateLimitedUntil = CASE WHEN status = 'rate_limited' AND consecutiveAuthFailures >= ${CODEX_AUTH_FAILURE_BENCH_THRESHOLD} THEN MAX(COALESCE(rateLimitedUntil, ''), excluded.rateLimitedUntil) ELSE excluded.rateLimitedUntil END,
          lastRateLimitAt = excluded.lastRateLimitAt,
          rateLimitCount = rateLimitCount + 1,
          keyIndex = excluded.keyIndex,
          updatedAt = excluded.updatedAt`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, rateLimitedUntil, now, provider, now]);
 }
+async function recordKeyAuthFailure(keyType, keySuffix, keyIndex, scope = "global", scopeId = null) {
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  return await getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    const source2 = "report-auth-failure";
+    const row = await tx.get(`INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, status, consecutiveAuthFailures, lastAuthFailureAt, authFailureSeq, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, 'available', 1, ?, (SELECT COALESCE(MAX(authFailureSeq), 0) + 1 FROM api_key_status), ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET
+           consecutiveAuthFailures = consecutiveAuthFailures + 1,
+           lastAuthFailureAt = excluded.lastAuthFailureAt, authFailureSeq = excluded.authFailureSeq,
+           keyIndex = excluded.keyIndex, updatedAt = excluded.updatedAt
+         RETURNING consecutiveAuthFailures, rateLimitedUntil`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, now, provider, now]);
+    if (!row)
+      throw new Error("Failed to record auth failure");
+    const { consecutiveAuthFailures } = row;
+    if (consecutiveAuthFailures < CODEX_AUTH_FAILURE_BENCH_THRESHOLD) {
+      return { consecutiveAuthFailures, benched: false, rateLimitedUntil: row.rateLimitedUntil };
+    }
+    let benchedUntil = new Date(Date.parse(now) + CODEX_AUTH_FAILURE_BENCH_MS).toISOString();
+    if (row.rateLimitedUntil && Date.parse(row.rateLimitedUntil) > Date.parse(benchedUntil)) {
+      benchedUntil = row.rateLimitedUntil;
+    }
+    await tx.run(`UPDATE api_key_status
+         SET status = 'rate_limited', rateLimitedUntil = ?, lastRateLimitAt = ?,
+             rateLimitCount = rateLimitCount + 1, updatedAt = ?
+         WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [benchedUntil, now, now, keyType, keySuffix, scope, effectiveScopeId]);
+    await upsertKv({
+      namespace: CODEX_AUTH_WATCH_NAMESPACE,
+      key: codexAuthBenchMarkerKey(keySuffix),
+      valueType: "json",
+      value: { keyIndex, keyType, benchedAt: now, benchedUntil, lastFailAt: now, source: source2 },
+      expiresAt: Date.parse(benchedUntil) + 86400000
+    });
+    return { consecutiveAuthFailures, benched: true, rateLimitedUntil: benchedUntil };
+  });
+}
 function mergeRateLimitWindowTelemetry(stored, reported) {
   const merged = { ...stored };
   for (const [type, entry] of Object.entries(reported)) {
@@ -11516,14 +11788,32 @@ async function setApiKeyName(keyType, keySuffix, name, scope = "global", scopeId
        WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [name, new Date().toISOString(), keyType, keySuffix, scope, scopeId ?? ""]);
   return result.changes > 0;
 }
-async function clearKeyRateLimit(keyType, keySuffix, scope = "global", scopeId = null) {
+async function clearKeyRateLimit(keyType, keySuffix, scope = "global", scopeId = null, opts = {}) {
   const now = new Date().toISOString();
   const effectiveScopeId = scopeId ?? "";
-  const result = await getDbClient().run(`UPDATE api_key_status
-       SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
-       WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?
-         AND status = 'rate_limited'`, [now, keyType, keySuffix, scope, effectiveScopeId]);
-  return result.changes > 0;
+  const { keyIndex = -1, authFence = null } = opts;
+  const clearAuthBench = opts.clearAuthBench === true && authFence !== null;
+  const key = [keyType, keySuffix, scope, effectiveScopeId];
+  return await getDbClient().transaction(async (tx) => {
+    const result = await tx.run(`UPDATE api_key_status
+         SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
+         WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?
+           AND status = 'rate_limited' AND ((? AND authFailureSeq <= ?) OR consecutiveAuthFailures < ?)`, [now, ...key, clearAuthBench ? 1 : 0, authFence, CODEX_AUTH_FAILURE_BENCH_THRESHOLD]);
+    const cleared = result.changes > 0;
+    if (!clearAuthBench)
+      return cleared;
+    const lifted = await tx.query(`UPDATE api_key_status SET consecutiveAuthFailures = 0, updatedAt = ?1,
+           status = CASE WHEN keySuffix = ?2 THEN status ELSE 'available' END, rateLimitedUntil = CASE WHEN keySuffix = ?2 THEN rateLimitedUntil END
+         WHERE keyType = ?3 AND scope = ?4 AND scopeId = ?5 AND (consecutiveAuthFailures > 0 OR status = 'rate_limited')
+           AND ((keySuffix = ?2 AND authFailureSeq <= ?7) OR (keySuffix != ?2 AND keyIndex = ?6)) RETURNING keySuffix`, [now, keySuffix, keyType, scope, effectiveScopeId, keyIndex, authFence]);
+    const retired = lifted.filter((row) => row.keySuffix !== keySuffix);
+    if (keyType === "CODEX_OAUTH") {
+      for (const suffix of [...cleared ? [keySuffix] : [], ...retired.map((r) => r.keySuffix)]) {
+        await deleteKv(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(suffix));
+      }
+    }
+    return cleared || retired.length > 0;
+  });
 }
 async function getKeyStatuses(keyType, scope, scopeId) {
   const conditions = [];
@@ -11700,6 +11990,10 @@ async function deleteUser(id, replacementUserId) {
              AND foreign_keys."table" = 'users'
          )`);
     const replacement = replacementUserId ?? null;
+    const reclassifySeedIds = replacementUserId ? [] : (await tx.query(`SELECT id FROM agent_tasks WHERE requestedByUserId = ?
+             UNION
+             SELECT id FROM agent_tasks
+             WHERE workflowRunId IN (SELECT id FROM workflow_runs WHERE created_by = ?)`, [id, id])).map((row) => row.id);
     for (const reference of references) {
       const table = quoteSqlIdentifier(reference.tableName);
       const column = quoteSqlIdentifier(reference.columnName);
@@ -11716,6 +12010,7 @@ async function deleteUser(id, replacementUserId) {
          WHERE json_valid(context)
            AND json_extract(context, '$.swarm.requestedByUserId') = ?`, [id]);
     }
+    await reclassifyTaskHumanFree(reclassifySeedIds);
     const result = await tx.run("DELETE FROM users WHERE id = ?", [id]);
     return result.changes > 0;
   });
@@ -12702,54 +12997,7 @@ var VERSIONABLE_FIELDS2, BUDGETED_IDENTITY_FIELDS, PENDING_SLACK_MESSAGE_TS_PREF
   LEFT JOIN agents a ON m.created_by_kind = 'agent' AND a.id = m.created_by_agent_id`, ROUTING_HOLDER_SQL = `CASE
   WHEN status IN ('draft', 'offered', 'reviewing') AND offeredTo IS NOT NULL THEN offeredTo
   ELSE COALESCE(agentId, offeredTo)
-END`, ELIGIBILITY_SCAN_BATCH_SIZE, ELIGIBILITY_SCAN_CAP, UNATTRIBUTED_USER_ID = "unattributed", HUMAN_FREE_TASKS_CTE = `human_free_tasks(id) AS (
-        SELECT task.id
-        FROM agent_tasks task
-        LEFT JOIN agent_tasks parent ON parent.id = task.parentTaskId
-        WHERE COALESCE(task.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
-          OR COALESCE(task.tags, '[]') LIKE '%"heartbeat"%'
-          OR (COALESCE(task.source, '') = 'schedule' AND task.requestedByUserId IS NULL)
-          OR (
-            task.parentTaskId IS NULL
-            AND COALESCE(task.source, '') = 'workflow'
-            AND task.requestedByUserId IS NULL
-            AND EXISTS (
-              SELECT 1
-              FROM workflow_runs run
-              WHERE run.id = task.workflowRunId
-                AND run.triggerType = 'schedule'
-                AND run.created_by IS NULL
-            )
-          )
-          OR (
-            COALESCE(task.source, '') = 'system'
-            AND parent.id IS NOT NULL
-            AND parent.requestedByUserId IS NULL
-          )
-
-        UNION
-
-        SELECT child.id
-        FROM agent_tasks child
-        JOIN human_free_tasks parent ON child.parentTaskId = parent.id
-        WHERE child.requestedByUserId IS NULL
-          OR child.requestedByUserIdInherited = 1
-      )`, HUMAN_FREE_SQL = "hf.id IS NOT NULL", ROOT_HUMAN_FREE_SQL = `(
-        COALESCE(t.taskType, '') IN ('heartbeat', 'heartbeat-checklist', 'boot-triage')
-        OR COALESCE(t.tags, '[]') LIKE '%"heartbeat"%'
-        OR (COALESCE(t.source, '') = 'schedule' AND t.requestedByUserId IS NULL)
-        OR (
-          COALESCE(t.source, '') = 'workflow'
-          AND t.requestedByUserId IS NULL
-          AND EXISTS (
-            SELECT 1
-            FROM workflow_runs run
-            WHERE run.id = t.workflowRunId
-              AND run.triggerType = 'schedule'
-              AND run.created_by IS NULL
-          )
-        )
-      )`, SCHEDULE_TEMPLATE_PREVIEW_LENGTH = 280, RESERVED_CONFIG_PLACEHOLDER = "[reserved key stored in swarm_config; delete this row]", WORKFLOW_RUN_SUMMARY_COLUMNS = "id, workflowId, status, triggerType, triggerData, error, created_by, startedAt, lastUpdatedAt, finishedAt", SKILL_FILE_LIMITS, BINARY_SKILL_FILE_PLACEHOLDER = "[binary file - not synced]", SKILL_SLIM_COLUMNS = "id, name, description, type, scope, ownerAgentId, sourceUrl, sourceRepo, sourcePath, sourceBranch, sourceHash, isComplex, allowedTools, model, effort, context, agent, disableModelInvocation, userInvocable, version, isEnabled, systemDefault, createdAt, lastUpdatedAt, lastFetchedAt, '' as content", WEEK_SECONDS, KvTypeCollisionError;
+END`, ELIGIBILITY_SCAN_BATCH_SIZE, ELIGIBILITY_SCAN_CAP, UNATTRIBUTED_USER_ID = "unattributed", HUMAN_FREE_SQL = "(COALESCE(t.isHumanFree, 0) = 1)", SCHEDULE_TEMPLATE_PREVIEW_LENGTH = 280, RESERVED_CONFIG_PLACEHOLDER = "[reserved key stored in swarm_config; delete this row]", WORKFLOW_RUN_SUMMARY_COLUMNS = "id, workflowId, status, triggerType, triggerData, error, created_by, startedAt, lastUpdatedAt, finishedAt", SKILL_FILE_LIMITS, BINARY_SKILL_FILE_PLACEHOLDER = "[binary file - not synced]", SKILL_SLIM_COLUMNS = "id, name, description, type, scope, ownerAgentId, sourceUrl, sourceRepo, sourcePath, sourceBranch, sourceHash, isComplex, allowedTools, model, effort, context, agent, disableModelInvocation, userInvocable, version, isEnabled, systemDefault, createdAt, lastUpdatedAt, lastFetchedAt, '' as content", WEEK_SECONDS, KvTypeCollisionError;
 var init_db = __esm(() => {
   init_package();
   init_key();
@@ -12758,6 +13006,7 @@ var init_db = __esm(() => {
   init_slack_routing();
   init_telemetry();
   init_types();
+  init_codex_auth_failure();
   init_credentials();
   init_github_pull_request();
   init_heartbeat_expiry();
@@ -12773,12 +13022,14 @@ var init_db = __esm(() => {
   init_approvals();
   init_context_versions();
   init_runtime();
+  init_human_free();
   init_read();
   init_write();
   init_steering();
   init_swarm_config_guard();
   init_task_lifecycle_events();
   init_agents();
+  init_api_keys();
   init_approvals();
   init_context_versions();
   init_runtime();
@@ -12835,4 +13086,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, telemetry, emitIntegrationConnected, init_telemetry, HeartbeatExpiryError, init_heartbeat_expiry, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, isInTransaction, init_db_client, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, listApprovalRequestSummaries, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, onTaskStarted, init_task_lifecycle_events, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateConfigValue, init_swarm_config_guard, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getUsageDataVersion, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, telemetry, emitIntegrationConnected, init_telemetry, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, HeartbeatExpiryError, init_heartbeat_expiry, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, isInTransaction, init_db_client, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, listApprovalRequestSummaries, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, onTaskStarted, init_task_lifecycle_events, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateConfigValue, init_swarm_config_guard, recordKeySeatMismatch, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };