@desplega.ai/agent-swarm 1.158.0 → 1.160.0

package/dist/{http-2eqa8t24.js → http-3bbb19be.js}

@@ -7,31 +7,32 @@ import {
 } from "./cli-dgnj0zcc.js";
 import {
   SIMILARITY_THRESHOLD,
+  isUnknownModelError,
   memoryRelevance,
   writeSkillsToFilesystem
-} from "./cli-q67y4wzm.js";
+} from "./cli-phsaj4xq.js";
 import {
   Anthropic
 } from "./cli-j490egb5.js";
+import {
+  checkHeartbeatChecklist,
+  runHeartbeatSweep,
+  stopHeartbeat
+} from "./cli-a8dvhzrt.js";
 import {
   isClaudeBridgeEffective,
   resolveClaudeTransport
 } from "./cli-eree7rnv.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
-} from "./cli-npssxgaz.js";
+} from "./cli-2pdaysab.js";
 import {
   reasoningCapability
-} from "./cli-h967nb6r.js";
+} from "./cli-4derpgyk.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-xhaeg2nc.js";
-import {
-  checkHeartbeatChecklist,
-  runHeartbeatSweep,
-  stopHeartbeat
-} from "./cli-rqz8qbw7.js";
+} from "./cli-7e398j1h.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -58,6 +59,7 @@ import {
   TriggerSchemaError,
   WebhookError,
   activateVersion,
+  agentRanModel,
   agentWithCapacity,
   allowedCredentialRedirect,
   applyRating,
@@ -80,7 +82,6 @@ import {
   checkOutputSchemaShape,
   clearJiraMetadata,
   closeRooms,
-  createApprovalFollowUpTask,
   createEvent,
   createEventsBatch,
   createResumeFollowUp,
@@ -103,10 +104,13 @@ import {
   executeRawLlm,
   executeReadOnlyQuery,
   expandCandidatesWithGraph,
+  explicitModelError,
+  explicitModelErrorForAgent,
   extractAndVerifyCookie,
   findUserById,
   fingerprintApiKey,
   flushAuditBuffer,
+  getAgentHarnessCliVersion,
   getAutomationSetupStates,
   getEnabledCapabilities,
   getEventCountsFiltered,
@@ -154,6 +158,7 @@ import {
   handlePullRequestReview,
   handleWebhookTrigger,
   handleWorkflowRun,
+  harnessModelErrorFor,
   hasCapability,
   httpServerSemconvAttributes,
   hydrateOAuthAppFromPreset,
@@ -185,6 +190,7 @@ import {
   listExtensionRuns,
   listExtensionVersions,
   listExtensions,
+  listHarnessModelSupport,
   listOAuthPresetIds,
   listOAuthPresets,
   listRuntimeInstancesForAgent,
@@ -201,13 +207,18 @@ import {
   mintToken,
   parseBody,
   parseCookieHeader,
+  parseModelTierOverridesHeader,
   parseQueryParams,
   parseSkillContent,
   patchWorkflowDefinition,
+  poolTaskRunsOnHarness,
   preflightAutomation,
+  previewModelTiers,
   readScriptSdkJsonResponse,
   reconcileAgentMaxTasksPolicy,
   reconcileAgentStatusFromRuntimes,
+  recordClaimModelResolution,
+  recordHarnessModelSupport,
   recordIdentityEvent,
   recordMemoryAccesses,
   recordRetrievals,
@@ -244,11 +255,14 @@ import {
   runtimeInstanceHeader,
   runtimeStaleThresholdMinutes,
   safeRequestUrlForLog,
+  sanitizeModelTierOverrides,
   scheduleIntegrationsReload,
   scopedResourceScopeIdSchema,
   sendKapsoReaction,
   sendTaskHandler,
   sendTaskOutputSchema,
+  setAgentHarnessCliVersion,
+  setAgentModelTierOverrides,
   setCorsHeaders,
   setExtensionLoopbackBaseUrl,
   setRuntimeCredentialReady,
@@ -266,6 +280,7 @@ import {
   stopAuditGc,
   stopAuditWriter,
   stopExtensionRuntime,
+  stripSiblingBlock,
   sweepRooms,
   taskActionHandler,
   taskActionInputSchema,
@@ -287,32 +302,26 @@ import {
   verifyHmacSignature,
   verifyWebhookSignature,
   warnIfCorsAllowsAnyOrigin,
-  wireHttpSpanLifecycle
-} from "./cli-ftfvggzx.js";
+  wireHttpSpanLifecycle,
+  workflowModelErrors,
+  workflowSaveWarnings
+} from "./cli-9hsgwz4w.js";
 import"./cli-0z2v4nhw.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
-} from "./cli-tt9k8r35.js";
-import {
-  CLIENT_ID,
-  MAX_CODEX_OAUTH_SLOT,
-  _fetchHolder,
-  codexOAuthKeyForSlot,
-  deriveCodexKeySuffix,
-  exchangeAuthorizationCode as exchangeAuthorizationCode2,
-  getAccountId,
-  getValidCodexOAuth,
-  loadAllCodexOAuthSlots
-} from "./cli-vhjwh6cz.js";
+} from "./cli-cpvsaqsw.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-3dpj7atn.js";
-import"./cli-aw1jwp1r.js";
+import {
+  FilesError,
+  getFileStorageProvider,
+  normalizeFilesError
+} from "./cli-jsp14b6c.js";
 import {
   getUserGrant
-} from "./cli-aky8tctm.js";
+} from "./cli-tzx2ke1v.js";
 import {
   LEGACY_RULES,
   can,
@@ -320,13 +329,16 @@ import {
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-g8djp6qe.js";
+} from "./cli-tmqt7dpj.js";
 import {
-  getModelsCatalog
-} from "./cli-ws6rqycm.js";
+  deleteModelCatalogOverlay,
+  loadModelsCatalog,
+  requestModelCatalogRefresh,
+  upsertModelCatalogOverlay
+} from "./cli-tfky2838.js";
 import {
   normalizeModelKey
-} from "./cli-wscdvcqz.js";
+} from "./cli-vctdqs5h.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -347,6 +359,7 @@ import {
   connectionAuthInputFromFlat,
   connectionAuthSummary,
   consumeMcpOAuthPending,
+  createApprovalFollowUpTask,
   createScriptApi,
   definitionNodeIds,
   deleteMcpOAuthToken,
@@ -418,7 +431,7 @@ import {
   upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-fgqxwrpv.js";
+} from "./cli-tpq83z89.js";
 import"./cli-epan13p1.js";
 import {
   detachedProcessGroup,
@@ -430,9 +443,25 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import"./cli-12tszpk9.js";
+import {
+  CLIENT_ID,
+  MAX_CODEX_OAUTH_SLOT,
+  _fetchHolder,
+  codexOAuthKeyForSlot,
+  deriveCodexKeySuffix,
+  exchangeAuthorizationCode as exchangeAuthorizationCode2,
+  getAccountId,
+  getValidCodexOAuth,
+  loadAllCodexOAuthSlots
+} from "./cli-ygwm91nt.js";
+import"./cli-3dpj7atn.js";
+import"./cli-10nhj6xq.js";
+import"./cli-rb9m6rpe.js";
+import"./cli-rykfmgwg.js";
 import {
   searchScripts
-} from "./cli-987hg0aa.js";
+} from "./cli-0jwe9034.js";
 import {
   acquireOAuthRefreshLock,
   buildAuthorizationUrl,
@@ -456,29 +485,23 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-53sz8gkz.js";
-import {
-  FilesError,
-  getFileStorageProvider,
-  normalizeFilesError
-} from "./cli-jsp14b6c.js";
+} from "./cli-6cs6wzxt.js";
+import"./cli-fad8m16k.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   EMBEDDING_DIMENSIONS,
+  OpenAI,
   getEmbeddingProvider,
   getMemoryStore,
   init_constants as init_constants2,
+  init_openai,
   init_reranker,
   rerank
-} from "./cli-65hjmev5.js";
-import"./cli-xberxa1r.js";
+} from "./cli-jz4w45qt.js";
+import"./cli-25fcq4b4.js";
 import"./cli-bsakbbkm.js";
-import"./cli-fad8m16k.js";
+import"./cli-trc24wk2.js";
 import"./cli-51tf7ac3.js";
-import {
-  OpenAI,
-  init_openai
-} from "./cli-aehm1rbq.js";
 import {
   TaskCitationSchema,
   ensure,
@@ -498,12 +521,13 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-j57qkrpq.js";
+} from "./cli-azhgzetg.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
 import"./cli-2658f6at.js";
 import"./cli-yatxqynm.js";
 import {
+  CODEX_AUTH_WATCH_NAMESPACE,
   CredentialBindingSchema,
   DB_RETENTION_TUNING_BOUNDS,
   EXTENSION_AGENT_ROLE,
@@ -529,6 +553,7 @@ import {
   cleanupStaleSessions,
   clearKeyRateLimit,
   closeDb,
+  codexAuthBenchMarkerKey,
   completeTask,
   computeContentHash,
   countActiveScriptRuns,
@@ -576,6 +601,7 @@ import {
   deleteTaskAttachment,
   deleteUser,
   deleteWorkflow,
+  drainHumanFreeReclassifyQueue,
   emitBuiltInIntegrationConnectedOnce,
   emitIntegrationConnected,
   emitMcpServerConnectedTelemetry,
@@ -589,6 +615,7 @@ import {
   getAgentHarnessProviders,
   getAgentMcpServers,
   getAgentSkills,
+  getAgentStatusCounts,
   getAgentWithTasks,
   getAllAgents,
   getAllAgentsWithTasks,
@@ -677,7 +704,6 @@ import {
   getTaskSteeringFieldsForTasks,
   getTasksCount,
   getUnassignedTaskIdsForAgent,
-  getUsageDataVersion,
   getUserById,
   getWorkflow,
   getWorkflowRun,
@@ -692,6 +718,7 @@ import {
   incrementPageViewCount,
   initTelemetry,
   init_asset_key_audit,
+  init_codex_auth_failure,
   init_context_key,
   init_credential_broker,
   init_crypto,
@@ -699,6 +726,7 @@ import {
   init_db,
   init_default_drift,
   init_heartbeat_expiry,
+  init_human_free,
   init_request_auth_context,
   init_steering,
   init_swarm_config_guard,
@@ -714,6 +742,7 @@ import {
   isInternalConfigKey,
   isReservedConfigKey,
   isSteeringEnabled as isSteeringEnabled2,
+  isTelemetryEnabled,
   listAgentsWithCredStatusByProvider,
   listAllMetrics,
   listAllPages,
@@ -748,7 +777,9 @@ import {
   promoteDraftTask,
   recordBudgetRefusalNotification,
   recordInlineScriptRun,
+  recordKeyAuthFailure,
   recordKeyRateLimitWindows,
+  recordKeySeatMismatch,
   recordKeyUsage,
   requestSteering,
   reservedKeyError,
@@ -764,7 +795,9 @@ import {
   setApiKeyName,
   setApiKeyPlan,
   setFavorite,
+  setHumanFreeQueueListener,
   setRequestAuth,
+  settleSupersededTaskDependents,
   startTask,
   supersedeTask,
   sweepExpiredKv,
@@ -808,7 +841,8 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-47m6dkd3.js";
+} from "./cli-qydf22qq.js";
+import"./cli-3qhyh31j.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -858,6 +892,7 @@ import {
   KvKeySchema,
   KvNamespaceSchema,
   KvValueTypeSchema,
+  MODEL_TIERS,
   McpAuthMethodSchema,
   McpServerSchema,
   McpServerWithInstallInfoSchema,
@@ -934,12 +969,16 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-4198qc9v.js";
+} from "./cli-ktmyrtpn.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-3gmcwfyx.js";
+} from "./cli-r1mxd1xh.js";
+import {
+  getSlackConfiguration,
+  init_config
+} from "./cli-n7h1kqpf.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -950,8 +989,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-ggm92wcn.js";
-import"./cli-19jenss3.js";
+} from "./cli-ptr8h7kp.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -960,26 +998,27 @@ import {
   getPublicMcpBaseUrl,
   init_constants
 } from "./cli-dv6cdjs2.js";
-import {
-  getSlackConfiguration,
-  init_config
-} from "./cli-n7h1kqpf.js";
-import {
-  MODEL_SCOPED_WINDOWS,
-  activeModelBlocks,
-  init_model_rate_limit_windows
-} from "./cli-de1396j2.js";
 import {
   SUBSCRIPTION_PLANS,
   SUBSCRIPTION_PLANS_CHECKED_AT,
   init_subscription_plans,
   isSubscriptionPlanId
-} from "./cli-cqt19wg6.js";
+} from "./cli-1a2j50m0.js";
+import"./cli-0wgxmwf6.js";
+import {
+  MODEL_SCOPED_WINDOWS,
+  activeModelBlocks,
+  init_model_rate_limit_windows
+} from "./cli-ywybs5as.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
   parseEnvFlag
 } from "./cli-ej6gbxfb.js";
+import {
+  init_src,
+  isAlias
+} from "./cli-kmcpfwn2.js";
 import {
   exports_zod,
   init_zod
@@ -996,7 +1035,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-c07r9a2m.js";
+} from "./cli-0q3avq3s.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -1005,20 +1044,20 @@ import {
 } from "./cli-r2ap2czm.js";
 import {
   bedrockProviderModule
-} from "./cli-h38x0qhg.js";
+} from "./cli-et8m9xsv.js";
 import"./cli-yn0a417a.js";
 import"./cli-cgj4hc12.js";
 import"./cli-txgcknmy.js";
 import"./cli-6map995v.js";
-import"./cli-k0g1sjzm.js";
+import"./cli-ybgv4kw2.js";
 import"./cli-y2apkfe2.js";
-import"./cli-vapyk8sw.js";
+import"./cli-7kyk9jr3.js";
 import {
   setBedrockProviderModule
-} from "./cli-5b6b62tz.js";
+} from "./cli-13hw4z91.js";
 import"./cli-btbzvq95.js";
 import"./cli-1m2e086m.js";
-import"./cli-mcnhgnn1.js";
+import"./cli-ykk5jaax.js";
 import"./cli-bzr0ftht.js";
 import"./cli-bd957dgb.js";
 import {
@@ -1509,6 +1548,62 @@ async function stopDbRetention() {
   await retentionTickPromise;
 }
 
+// src/be/human-free-drain.ts
+init_human_free();
+var YIELD_MS2 = 25;
+var IDLE_INTERVAL_MS = 60000;
+var running = false;
+var idleTimer = null;
+var passTimer = null;
+function scheduleIdle() {
+  if (!running)
+    return;
+  if (idleTimer)
+    clearTimeout(idleTimer);
+  idleTimer = setTimeout(() => schedulePass(0), IDLE_INTERVAL_MS);
+  idleTimer.unref?.();
+}
+function schedulePass(delayMs) {
+  if (!running || passTimer)
+    return;
+  passTimer = setTimeout(() => {
+    passTimer = null;
+    runPass();
+  }, delayMs);
+  passTimer.unref?.();
+}
+async function runPass() {
+  if (!running)
+    return;
+  try {
+    const { batches, remaining } = await drainHumanFreeReclassifyQueue({ maxBatches: 1 });
+    if (batches > 0 && remaining > 0) {
+      schedulePass(YIELD_MS2);
+      return;
+    }
+  } catch (err) {
+    console.error("[human-free-drain] batch failed, retrying later:", err instanceof Error ? err.message : String(err));
+  }
+  scheduleIdle();
+}
+function startHumanFreeDrain() {
+  if (running)
+    return;
+  running = true;
+  setHumanFreeQueueListener(() => schedulePass(0));
+  schedulePass(0);
+}
+function stopHumanFreeDrain() {
+  running = false;
+  setHumanFreeQueueListener(undefined);
+  if (idleTimer)
+    clearTimeout(idleTimer);
+  if (passTimer)
+    clearTimeout(passTimer);
+  idleTimer = null;
+  passTimer = null;
+}
+
 // src/be/scripts/retention.ts
 init_db();
 var SCRATCH_RETENTION_DAYS = 14;
@@ -3326,6 +3421,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
 }
 
 // src/http/agents.ts
+init_src();
 init_zod();
 init_db();
 init_telemetry();
@@ -3378,7 +3474,9 @@ var registerAgent = route({
     maxTasks: exports_external.number().int().optional(),
     provider: ProviderNameSchema.optional(),
     harness_provider: ProviderNameSchema.optional(),
-    runtimeInstanceId: exports_external.string().min(1).optional()
+    runtimeInstanceId: exports_external.string().min(1).optional(),
+    modelTierOverrides: exports_external.record(exports_external.string(), exports_external.record(exports_external.string(), exports_external.string())).optional(),
+    harnessCliVersion: exports_external.string().max(64).optional()
   }),
   responses: {
     200: {
@@ -3458,7 +3556,7 @@ var updateAgentRuntimeRoute = route({
   path: "/api/agents/{id}/runtime",
   pattern: ["api", "agents", null, "runtime"],
   summary: "Update an agent's runtime harness and default model",
-  description: "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it.",
+  description: "Updates `agents.harness_provider` and agent-scoped runtime config. The settings apply to future provider sessions. For `model`, `reasoning_effort`, and `claude.transport`: omit the field to leave it unchanged, send `null` to clear the corresponding override, or send a value to set it. A `model` the model catalog does not list is a 400 unless `allow_custom_model` is true. A `latest:` alias is not accepted here (aliases resolve for a task's model and for `MODEL_TIER_*` values); `reasoning_effort` must be one the harness and model support.",
   tags: ["Agents"],
   params: exports_external.object({ id: exports_external.string() }),
   query: exports_external.object({ repoId: exports_external.string().optional() }),
@@ -3771,6 +3869,13 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
         }
         if (parsed.body.harness_provider && parsed.body.harness_provider !== existingAgent.harnessProvider) {
           await setAgentHarnessProvider(existingAgent.id, parsed.body.harness_provider);
+          const harness = parsed.body.harness_provider;
+          const override = (await getSwarmConfigs({ scope: "agent", scopeId: agentId, key: "MODEL_OVERRIDE" }))[0]?.value;
+          if (override && await harnessModelErrorFor(override, harness)) {
+            getDbClient().afterCommit(() => {
+              console.warn(`[agents] MODEL_OVERRIDE ${override} of agent ${agentId} does not run on its new ${harness} harness (was ${existingAgent.harnessProvider ?? "unset"}); update or clear it`);
+            });
+          }
         }
         await resetEmptyPollCount(existingAgent.id);
         if (multiRuntime && parsed.body.runtimeInstanceId) {
@@ -3809,6 +3914,12 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
       }
       return { agent, created: true };
     });
+    if (parsed.body.harnessCliVersion !== undefined) {
+      await setAgentHarnessCliVersion(agentId, parsed.body.harnessCliVersion.trim() || null);
+    }
+    if (parsed.body.modelTierOverrides) {
+      await setAgentModelTierOverrides(agentId, sanitizeModelTierOverrides(parsed.body.modelTierOverrides));
+    }
     telemetry.agent("registered", {
       role: parsed.body.role,
       capabilities: parsed.body.capabilities ?? [],
@@ -4114,6 +4225,21 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
         return true;
       }
     }
+    if (typeof model === "string" && isAlias(model)) {
+      jsonError(res, `A latest: alias cannot be an agent's default model ("${model}"). Set the alias on a task, or as a MODEL_TIER_<PROVIDER>_<TIER> value.`, 400);
+      return true;
+    }
+    if (typeof model === "string") {
+      const modelError = await explicitModelError({
+        model,
+        allowCustomModel: allow_custom_model,
+        harnessProvider: harness_provider
+      });
+      if (modelError) {
+        jsonError(res, modelError, 400);
+        return true;
+      }
+    }
     let agent;
     try {
       agent = await getDbClient().transaction(async () => {
@@ -4373,22 +4499,50 @@ init_subscription_plans();
 
 // src/http/usage-cache.ts
 var USAGE_CACHE_TTL_MS = 30000;
+var USAGE_CACHE_MAX_STALE_MS = 120000;
 var MAX_ENTRIES = 100;
 var entries = new Map;
-async function cachedUsageReport(key, load) {
-  const now = Date.now();
+var loading = new Map;
+var generation = 0;
+function load(key, loader) {
+  const running2 = loading.get(key);
+  if (running2)
+    return running2;
+  const startedIn = generation;
+  const promise = Promise.resolve().then(loader).then((value) => {
+    if (startedIn === generation) {
+      entries.delete(key);
+      if (entries.size >= MAX_ENTRIES)
+        entries.delete(entries.keys().next().value);
+      entries.set(key, { fetchedAt: Date.now(), value });
+    }
+    return value;
+  }).finally(() => {
+    if (loading.get(key) === promise)
+      loading.delete(key);
+  });
+  loading.set(key, promise);
+  return promise;
+}
+async function cachedUsageReport(key, loader) {
   const hit = entries.get(key);
-  if (hit && hit.expiresAt > now)
-    return hit.value;
-  const value = await load();
-  entries.delete(key);
-  if (entries.size >= MAX_ENTRIES)
-    entries.delete(entries.keys().next().value);
-  entries.set(key, { expiresAt: now + USAGE_CACHE_TTL_MS, value });
-  return value;
+  if (hit) {
+    const age = Date.now() - hit.fetchedAt;
+    if (age < USAGE_CACHE_TTL_MS)
+      return hit.value;
+    if (age < USAGE_CACHE_MAX_STALE_MS) {
+      load(key, loader).catch((error) => {
+        console.error(`[usage-cache] background refresh failed for ${key.split(":")[0]}:`, error);
+      });
+      return hit.value;
+    }
+  }
+  return load(key, loader);
 }
 function clearUsageCache() {
+  generation++;
   entries.clear();
+  loading.clear();
 }
 
 // src/http/api-keys.ts
@@ -4439,6 +4593,38 @@ var reportRateLimit = route({
   },
   auth: { apiKey: true }
 });
+var reportAuthFailure = route({
+  method: "post",
+  path: "/api/keys/report-auth-failure",
+  pattern: ["api", "keys", "report-auth-failure"],
+  summary: "Record an auth failure for a pooled key; bench it after 2 in a row",
+  tags: ["API Keys"],
+  body: exports_external.object({
+    keyType: exports_external.string(),
+    keySuffix: exports_external.string().min(1).max(10),
+    keyIndex: exports_external.number().int().min(0),
+    taskId: exports_external.string().uuid().optional(),
+    scope: exports_external.string().optional(),
+    scopeId: exports_external.string().optional()
+  }),
+  responses: {
+    200: {
+      description: "Failure recorded",
+      schema: exports_external.object({
+        success: exports_external.literal(true),
+        consecutiveAuthFailures: exports_external.number().int(),
+        benched: exports_external.boolean(),
+        rateLimitedUntil: exports_external.string().nullable()
+      })
+    },
+    400: { description: "Validation error" },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true },
+  rbac: {
+    ungated: "worker credential telemetry, same posture as POST /api/keys/report-rate-limit"
+  }
+});
 var rateLimitWindowSchema = exports_external.object({
   status: exports_external.string(),
   utilization: exports_external.number().optional(),
@@ -4480,6 +4666,30 @@ var reportRateLimitWindows = route({
   },
   auth: { apiKey: true }
 });
+var reportSeatMismatch = route({
+  method: "post",
+  path: "/api/keys/report-seat-mismatch",
+  pattern: ["api", "keys", "report-seat-mismatch"],
+  summary: "Record that an API key's subscription seat cannot run a model family",
+  tags: ["API Keys"],
+  body: exports_external.object({
+    keyType: exports_external.string(),
+    keySuffix: exports_external.string().min(1).max(10),
+    keyIndex: exports_external.number().int().min(0),
+    model: exports_external.enum(["fable", "opus", "sonnet", "haiku"]),
+    scope: exports_external.string().optional(),
+    scopeId: exports_external.string().optional()
+  }),
+  responses: {
+    200: { description: "Seat mismatch recorded", schema: successMessageSchema },
+    400: { description: "Validation error" },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true },
+  rbac: {
+    ungated: "worker credential telemetry, same posture as POST /api/keys/report-rate-limit"
+  }
+});
 var getAvailable = route({
   method: "get",
   path: "/api/keys/available",
@@ -4501,7 +4711,9 @@ var getAvailable = route({
         availableIndices: exports_external.array(exports_external.number().int()),
         totalKeys: exports_external.number().int(),
         modelBlockedIndices: exports_external.array(exports_external.number().int()).optional(),
-        earliestModelResetAt: exports_external.string().nullable().optional()
+        earliestModelResetAt: exports_external.string().nullable().optional(),
+        seatBlockedIndices: exports_external.array(exports_external.number().int()).optional(),
+        authFailureFence: exports_external.number().int()
       })
     },
     400: { description: "Validation error" },
@@ -4527,6 +4739,10 @@ var ApiKeyStatusSchema = exports_external.object({
   rateLimitWindows: exports_external.record(exports_external.string(), rateLimitWindowSchema),
   plan: exports_external.string().nullable(),
   planSource: exports_external.enum(["manual", "detected", "estimated"]).nullable(),
+  lastSeatMismatchAt: exports_external.string().nullable(),
+  lastSeatMismatchModel: exports_external.string().nullable(),
+  consecutiveAuthFailures: exports_external.number().int(),
+  lastAuthFailureAt: exports_external.string().nullable(),
   modelLimits: exports_external.array(exports_external.object({
     model: exports_external.string(),
     window: exports_external.string(),
@@ -4648,7 +4864,10 @@ var clearRateLimitRoute = route({
     keyType: exports_external.string(),
     keySuffix: exports_external.string().min(1).max(10),
     scope: exports_external.string().optional(),
-    scopeId: exports_external.string().optional()
+    scopeId: exports_external.string().optional(),
+    clearAuthBench: exports_external.boolean().optional(),
+    keyIndex: exports_external.number().int().min(0).optional(),
+    authFence: exports_external.number().int().min(0).optional()
   }),
   responses: {
     200: {
@@ -4746,6 +4965,21 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     }
     return true;
   }
+  if (reportAuthFailure.match(req.method, pathSegments)) {
+    const parsed = await reportAuthFailure.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { keyType, keySuffix, keyIndex, scope, scopeId } = parsed.body;
+    try {
+      const result = await recordKeyAuthFailure(keyType, keySuffix, keyIndex, scope, scopeId ?? null);
+      if (result.benched)
+        clearUsageCache();
+      reportAuthFailure.respond(res, 200, { success: true, ...result });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : "Failed to record auth failure", 500);
+    }
+    return true;
+  }
   if (reportRateLimitWindows.match(req.method, pathSegments)) {
     const parsed = await reportRateLimitWindows.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -4764,6 +4998,24 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     }
     return true;
   }
+  if (reportSeatMismatch.match(req.method, pathSegments)) {
+    const parsed = await reportSeatMismatch.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { keyType, keySuffix, keyIndex, model, scope, scopeId } = parsed.body;
+    try {
+      const { planChanged } = await recordKeySeatMismatch(keyType, keySuffix, keyIndex, model, scope, scopeId ?? null);
+      if (planChanged)
+        clearUsageCache();
+      reportSeatMismatch.respond(res, 200, {
+        success: true,
+        message: `Seat mismatch recorded for ...${keySuffix} (${model})`
+      });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : "Failed to record seat mismatch", 500);
+    }
+    return true;
+  }
   if (getAvailable.match(req.method, pathSegments)) {
     const parsed = await getAvailable.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -4775,9 +5027,11 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
         success: true,
         availableIndices: result.availableIndices,
         totalKeys,
+        authFailureFence: result.authFailureFence,
         ...model !== undefined ? {
           modelBlockedIndices: result.modelBlockedIndices,
-          earliestModelResetAt: result.earliestModelResetAt
+          earliestModelResetAt: result.earliestModelResetAt,
+          seatBlockedIndices: result.seatBlockedIndices
         } : {}
       });
     } catch (err) {
@@ -4871,9 +5125,13 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     const parsed = await clearRateLimitRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const { keyType, keySuffix, scope, scopeId } = parsed.body;
+    const { keyType, keySuffix, scope, scopeId, clearAuthBench, keyIndex, authFence } = parsed.body;
     try {
-      const cleared = await clearKeyRateLimit(keyType, keySuffix, scope, scopeId ?? null);
+      const cleared = await clearKeyRateLimit(keyType, keySuffix, scope, scopeId ?? null, {
+        clearAuthBench: clearAuthBench === true,
+        keyIndex,
+        authFence
+      });
       clearRateLimitRoute.respond(res, 200, {
         success: true,
         cleared,
@@ -7054,8 +7312,8 @@ async function handleCodexOAuthDevice(req, res, pathSegments, queryParams) {
 // src/http/codex-oauth-keep-warm.ts
 init_zod();
 init_db();
+init_codex_auth_failure();
 var KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
-var AUTH_WATCH_NAMESPACE = "codex-auth-watch";
 var slotOutcomeSchema = exports_external.discriminatedUnion("outcome", [
   exports_external.object({ slot: exports_external.number(), keySuffix: exports_external.string(), outcome: exports_external.literal("warm") }),
   exports_external.object({ slot: exports_external.number(), keySuffix: exports_external.string(), outcome: exports_external.literal("refreshed") }),
@@ -7073,7 +7331,7 @@ var keepWarmRoute = route({
   path: "/api/oauth/keep-warm/codex",
   pattern: ["api", "oauth", "keep-warm", "codex"],
   summary: "Locked keep-warm refresh sweep across all Codex OAuth pool slots",
-  description: "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots already benched by codex-auth-expiry-watch.",
+  description: "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
   tags: ["OAuth"],
   responses: {
     200: {
@@ -7094,7 +7352,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
   const results = [];
   for (const { slot, creds } of slots) {
     const keySuffix = deriveCodexKeySuffix(creds.access, creds.accountId);
-    if (await getKv(AUTH_WATCH_NAMESPACE, `bench:${keySuffix}`)) {
+    if (await getKv(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(keySuffix))) {
       results.push({ slot, keySuffix, outcome: "skipped-benched" });
       continue;
     }
@@ -7671,6 +7929,9 @@ declare module "swarm-extension" {
     model?: string | undefined;
     modelTier?: "smol" | "regular" | "smart" | "ultra" | undefined;
     effort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+    resolvedModel?: string | undefined;
+    modelSource?: string | undefined;
+    modelAlias?: string | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | null | undefined;
     workflowRunStepId?: string | null | undefined;
@@ -13753,6 +14014,79 @@ async function getUsefulnessStats(options = {}) {
   };
 }
 
+// src/memory/recall-query.ts
+var COMPLETED_INSTRUCTIONS = `
+
+IMPORTANT: Do NOT re-delegate or re-answer the original request. The worker has already handled it. Your job is ONLY to:
+1. Review the output above
+2. Do not relay the worker's raw output to Slack; the engine owns the thread tree and outcome card
+3. Complete this follow-up task
+
+Use`;
+var FAILED_INSTRUCTIONS = `
+
+Decide whether to reassign, retry, or handle the failure. Use`;
+var DETAILS_PREFIX = ' `get-task-details` with taskId "';
+var DETAILS_SUFFIX = '" for full details.';
+function buildRecallQuery(description) {
+  let query = stripSiblingBlock(truncateUtf8(description, 65536));
+  const header2 = query.match(/^Worker task (completed|failed) — (?:review|action) needed\.\n\nAgent: [^\n]*\nOriginal task created by agent [^\n]*\nTask: "/);
+  if (header2) {
+    const taskStart = header2[0].length;
+    const outputMarker = header2[1] === "completed" ? `"
+
+Output:
+` : `"
+
+Failure reason: `;
+    const taskEnd = query.indexOf(outputMarker, taskStart);
+    const outputStart = taskEnd + outputMarker.length;
+    const instructions = header2[1] === "completed" ? COMPLETED_INSTRUCTIONS : FAILED_INSTRUCTIONS;
+    const outputEnd = query.indexOf(instructions + DETAILS_PREFIX, outputStart);
+    const idStart = outputEnd + instructions.length + DETAILS_PREFIX.length;
+    const idEnd = query.indexOf('"', idStart);
+    if (taskEnd !== -1 && outputEnd !== -1 && idEnd !== -1 && !query.slice(idStart, idEnd).includes(`
+`) && query.startsWith(DETAILS_SUFFIX, idEnd)) {
+      const creatorInstructions = query.indexOf(`
+Additional instructions from the task creator:
+`, outputStart);
+      const contentEnd = creatorInstructions !== -1 && creatorInstructions < outputEnd ? creatorInstructions : outputEnd;
+      const threadContext = [];
+      let cursor = idEnd + DETAILS_SUFFIX.length;
+      while (cursor < query.length) {
+        const start = query.indexOf("<thread_context>", cursor);
+        if (start === -1)
+          break;
+        const end = query.indexOf("</thread_context>", start);
+        if (end === -1)
+          break;
+        cursor = end + "</thread_context>".length;
+        threadContext.push(query.slice(start, cursor));
+      }
+      query = [
+        query.slice(taskStart, taskEnd),
+        query.slice(outputStart, contentEnd),
+        ...threadContext
+      ].join(`
+
+`);
+    }
+  }
+  query = query.trim();
+  return truncateUtf8(query, 8191);
+}
+function truncateUtf8(query, maxBytes) {
+  let bytes = 0;
+  let end = 0;
+  for (const character of query) {
+    bytes += Buffer.byteLength(character, "utf8");
+    if (bytes > maxBytes)
+      break;
+    end += character.length;
+  }
+  return query.slice(0, end);
+}
+
 // src/http/memory.ts
 init_types();
 init_request_auth_context();
@@ -14249,7 +14583,14 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
     const parsed = await searchMemory.parse(req, res, pathSegments, new URLSearchParams);
     if (!parsed)
       return true;
-    const { query, intent, limit, scope, source } = parsed.body;
+    const { query: originalQuery, intent, limit, scope, source } = parsed.body;
+    const consumptionHeader = req.headers["x-memory-consumption"];
+    const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
+    const query = consumptionMode === "prompt" ? buildRecallQuery(originalQuery) : originalQuery;
+    if (consumptionMode === "prompt" && !query) {
+      searchMemory.respond(res, 200, { results: [] });
+      return true;
+    }
     try {
       const provider = getEmbeddingProvider();
       const store = getMemoryStore();
@@ -14268,8 +14609,6 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
         isLead: false
       });
       const resultLimit = Math.min(limit, 20);
-      const consumptionHeader = req.headers["x-memory-consumption"];
-      const consumptionMode = Array.isArray(consumptionHeader) ? consumptionHeader[0] : consumptionHeader;
       const ranked = consumptionMode === "prompt" ? rerank(expanded, { limit: expanded.length }).map((r) => ({ r, eligible: memoryRelevance(r) > SIMILARITY_THRESHOLD })).sort((a, b) => Number(b.eligible) - Number(a.eligible)).slice(0, resultLimit).map(({ r }) => r) : rerank(expanded, { limit: resultLimit });
       const sourceTaskIdHeader = req.headers["x-source-task-id"];
       const sourceTaskId = Array.isArray(sourceTaskIdHeader) ? sourceTaskIdHeader[0] : sourceTaskIdHeader;
@@ -15173,11 +15512,21 @@ async function handleMetrics(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/models-catalog.ts
 init_zod();
+init_db();
+init_types();
+init_request_auth_context();
 var CatalogModelSchema = exports_external.object({
   id: exports_external.string(),
   name: exports_external.string().optional(),
-  cost: exports_external.object({ input: exports_external.number().optional(), output: exports_external.number().optional() }).optional(),
+  cost: exports_external.object({
+    input: exports_external.number().optional(),
+    output: exports_external.number().optional(),
+    cache_read: exports_external.number().optional(),
+    cache_write: exports_external.number().optional()
+  }).optional(),
   limit: exports_external.object({ context: exports_external.number().optional() }).optional(),
+  release_date: exports_external.string().optional(),
+  status: exports_external.string().optional(),
   reasoning: exports_external.boolean().optional(),
   reasoning_options: exports_external.array(exports_external.object({ type: exports_external.string(), values: exports_external.array(exports_external.string()).optional() })).optional()
 });
@@ -15186,6 +15535,55 @@ var CatalogProviderSchema = exports_external.object({
   name: exports_external.string().optional(),
   models: exports_external.record(exports_external.string(), CatalogModelSchema)
 });
+var ReasoningOptionSchema = exports_external.object({
+  type: exports_external.string(),
+  values: exports_external.array(exports_external.string()).optional()
+});
+var OverlayPricingSchema = exports_external.object({
+  input: exports_external.number().nonnegative().optional(),
+  output: exports_external.number().nonnegative().optional(),
+  cache_read: exports_external.number().nonnegative().optional(),
+  cache_write: exports_external.number().nonnegative().optional()
+});
+var ModelCatalogRefreshResultSchema = exports_external.object({
+  status: exports_external.enum(["updated", "not-modified", "skipped-fresh", "skipped-cooldown", "error"]),
+  models: exports_external.number(),
+  added: exports_external.array(exports_external.string()),
+  checkedAt: exports_external.number().nullable(),
+  retryAfterMs: exports_external.number().optional(),
+  error: exports_external.string().optional()
+});
+var ModelCatalogOverlayBodySchema = exports_external.object({
+  provider: exports_external.string().min(1),
+  modelId: exports_external.string().min(1),
+  name: exports_external.string().optional(),
+  family: exports_external.string().optional(),
+  releaseDate: exports_external.string().optional(),
+  contextWindow: exports_external.number().int().positive().optional(),
+  maxOutput: exports_external.number().int().positive().optional(),
+  reasoning: exports_external.boolean().optional(),
+  reasoningOptions: exports_external.array(ReasoningOptionSchema).optional(),
+  pricing: OverlayPricingSchema.optional(),
+  status: exports_external.string().optional(),
+  reason: exports_external.string().min(1),
+  verifiedBy: exports_external.string().optional(),
+  expiresWhenUpstreamMatches: exports_external.boolean().optional()
+});
+var OverlayEntrySchema = ModelCatalogOverlayBodySchema.extend({
+  name: exports_external.string().nullish(),
+  family: exports_external.string().nullish(),
+  releaseDate: exports_external.string().nullish(),
+  contextWindow: exports_external.number().nullish(),
+  maxOutput: exports_external.number().nullish(),
+  reasoning: exports_external.boolean().nullish(),
+  reasoningOptions: exports_external.array(ReasoningOptionSchema).nullish(),
+  pricing: OverlayPricingSchema.nullish(),
+  status: exports_external.string().nullish(),
+  verifiedBy: exports_external.string().nullish(),
+  expiresWhenUpstreamMatches: exports_external.boolean(),
+  createdAt: exports_external.number(),
+  updatedAt: exports_external.number()
+});
 var getCatalog = route({
   method: "get",
   path: "/api/models-catalog",
@@ -15204,12 +15602,218 @@ var getCatalog = route({
     }
   }
 });
+var ModelTierPreviewSchema = exports_external.object({
+  provider: ProviderNameSchema,
+  tier: exports_external.enum(MODEL_TIERS),
+  key: exports_external.string(),
+  defaultValue: exports_external.string(),
+  configured: exports_external.string().nullable(),
+  source: exports_external.enum(["tier-config", "tier-default"]),
+  resolvedModel: exports_external.string().nullable(),
+  alias: exports_external.string().nullable()
+});
+var getTiers = route({
+  method: "get",
+  path: "/api/models-catalog/tiers",
+  pattern: ["api", "models-catalog", "tiers"],
+  summary: "Preview what each model tier resolves to per harness provider",
+  description: "One row per provider and tier: the built-in default, the `MODEL_TIER_<PROVIDER>_<TIER>` value stored in swarm config (if any), which layer wins, and the concrete model it resolves to against the current catalog (`latest:` aliases resolved with the same soak and auto-upgrade rules as claim time, without recording a resolution). Ignores per-worker `MODEL_TIER_*` overrides and per-task models.",
+  tags: ["Pricing"],
+  responses: {
+    200: {
+      description: "Tier previews",
+      schema: exports_external.object({ tiers: exports_external.array(ModelTierPreviewSchema) })
+    }
+  }
+});
+var refreshCatalog = route({
+  method: "post",
+  path: "/api/models-catalog/refresh",
+  pattern: ["api", "models-catalog", "refresh"],
+  summary: "Refresh the model catalog from models.dev",
+  description: "Unforced calls skip the network when the last models.dev check is younger than 4h (`skipped-fresh`). `force: true` always fetches, still conditional on the stored ETag (`not-modified` on 304), but a forced call within a minute of the previous one returns `skipped-cooldown` with `retryAfterMs`. Concurrent refreshes share one fetch. Lead agent or operator only. `added` lists provider/modelId keys new since the previous fetch.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: exports_external.object({ force: exports_external.boolean().optional() }),
+  responses: {
+    200: { description: "Refresh outcome", schema: ModelCatalogRefreshResultSchema },
+    403: { description: "Forbidden" }
+  }
+});
+var upsertOverlay = route({
+  method: "put",
+  path: "/api/models-catalog/overlay",
+  pattern: ["api", "models-catalog", "overlay"],
+  summary: "Upsert one model-catalog overlay row",
+  description: "Overlay facts win per non-null field over the models.dev row; overlay-only models are served too. Overlay prices fill pricing-table gaps (never override an active price). With `expiresWhenUpstreamMatches` (default true) the row is deleted once upstream matches every non-null fact.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: ModelCatalogOverlayBodySchema,
+  responses: {
+    200: { description: "Overlay row upserted", schema: OverlayEntrySchema },
+    403: { description: "Forbidden" }
+  }
+});
+var deleteOverlay = route({
+  method: "delete",
+  path: "/api/models-catalog/overlay",
+  pattern: ["api", "models-catalog", "overlay"],
+  summary: "Delete one model-catalog overlay row",
+  tags: ["Pricing"],
+  rbac: { permission: "models.catalog.write" },
+  body: exports_external.object({ provider: exports_external.string().min(1), modelId: exports_external.string().min(1) }),
+  responses: {
+    200: { description: "Overlay row deleted", schema: exports_external.object({ deleted: exports_external.boolean() }) },
+    403: { description: "Forbidden" }
+  }
+});
+var HarnessSupportRowSchema = exports_external.object({
+  harness: exports_external.string(),
+  cliVersion: exports_external.string(),
+  modelId: exports_external.string(),
+  status: exports_external.enum(["ok", "unsupported", "unknown"]),
+  checkedAt: exports_external.number(),
+  error: exports_external.string().nullable()
+});
+var listHarnessSupport = route({
+  method: "get",
+  path: "/api/models-catalog/harness-support",
+  pattern: ["api", "models-catalog", "harness-support"],
+  summary: "List harness CLI model support rows",
+  description: "Whether a catalog model runs on a given `claude` / `codex` CLI version, as recorded by workers after a model's first run. No row means unknown (allowed at claim).",
+  tags: ["Pricing"],
+  query: exports_external.object({ harness: exports_external.string().optional(), cliVersion: exports_external.string().optional() }),
+  responses: {
+    200: {
+      description: "Support rows, newest first",
+      schema: exports_external.object({ rows: exports_external.array(HarnessSupportRowSchema) })
+    }
+  }
+});
+var recordHarnessSupport = route({
+  method: "put",
+  path: "/api/models-catalog/harness-support",
+  pattern: ["api", "models-catalog", "harness-support"],
+  summary: "Record whether a harness CLI version accepts a model",
+  description: "Written by workers: `ok` after a model's first successful run, `unsupported` when the CLI rejects the model id. Claim-time resolution falls back (alias/tier) or fails fast (explicit model) on `unsupported`.",
+  tags: ["Pricing"],
+  rbac: { permission: "models.harness-support.write" },
+  body: exports_external.object({
+    harness: exports_external.string().min(1).max(32),
+    cliVersion: exports_external.string().min(1).max(64),
+    modelId: exports_external.string().min(1).max(200),
+    status: exports_external.enum(["ok", "unsupported", "unknown"]),
+    error: exports_external.string().max(4000).optional()
+  }),
+  responses: {
+    200: { description: "Support row upserted", schema: HarnessSupportRowSchema },
+    403: { description: "Forbidden" }
+  }
+});
+async function ensureCatalogWriter(req, res, verb = "models.catalog.write") {
+  const auth = getRequestAuth(req);
+  const header2 = req.headers["x-agent-id"];
+  const agentId = auth?.kind === "agent" ? auth.agentId : Array.isArray(header2) ? header2[0] : header2;
+  let principal;
+  if (auth?.kind === "user") {
+    principal = { kind: "user", userId: auth.userId };
+  } else if (agentId) {
+    const agent = await getAgentById(agentId);
+    principal = { kind: "agent", agentId, isLead: agent?.isLead ?? false };
+  } else if (auth?.kind === "operator") {
+    principal = { kind: "operator" };
+  } else {
+    principal = { kind: "agent", agentId: "", isLead: false };
+  }
+  const decision = can({
+    principal,
+    verb,
+    resource: { kind: "none" },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, verb === "models.catalog.write" ? "Writing the model catalog requires the lead agent or an operator" : "Recording harness model support requires a registered agent or an operator", 403);
+    return null;
+  }
+  return {
+    userId: auth?.kind === "user" ? auth.userId : null,
+    agentId: principal.kind === "agent" && principal.agentId ? principal.agentId : null
+  };
+}
+async function callerOwnsSupportRow(agentId, body) {
+  const agent = await getAgentById(agentId);
+  if (!agent || agent.harnessProvider !== body.harness)
+    return false;
+  return await getAgentHarnessCliVersion(agentId) === body.cliVersion;
+}
 async function handleModelsCatalog(req, res, pathSegments, queryParams) {
   if (getCatalog.match(req.method, pathSegments)) {
     const parsed = await getCatalog.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    json(res, getModelsCatalog());
+    getCatalog.respond(res, 200, await loadModelsCatalog());
+    return true;
+  }
+  if (getTiers.match(req.method, pathSegments)) {
+    const parsed = await getTiers.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    getTiers.respond(res, 200, { tiers: await previewModelTiers() });
+    return true;
+  }
+  if (refreshCatalog.match(req.method, pathSegments)) {
+    const parsed = await refreshCatalog.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureCatalogWriter(req, res))
+      return true;
+    refreshCatalog.respond(res, 200, await requestModelCatalogRefresh({ force: parsed.body.force }));
+    return true;
+  }
+  if (upsertOverlay.match(req.method, pathSegments)) {
+    const parsed = await upsertOverlay.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const writer = await ensureCatalogWriter(req, res);
+    if (!writer)
+      return true;
+    const entry = await upsertModelCatalogOverlay(parsed.body, { userId: writer.userId });
+    upsertOverlay.respond(res, 200, entry);
+    return true;
+  }
+  if (deleteOverlay.match(req.method, pathSegments)) {
+    const parsed = await deleteOverlay.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureCatalogWriter(req, res))
+      return true;
+    const deleted = await deleteModelCatalogOverlay(parsed.body.provider, parsed.body.modelId);
+    deleteOverlay.respond(res, 200, { deleted });
+    return true;
+  }
+  if (listHarnessSupport.match(req.method, pathSegments)) {
+    const parsed = await listHarnessSupport.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    listHarnessSupport.respond(res, 200, { rows: await listHarnessModelSupport(parsed.query) });
+    return true;
+  }
+  if (recordHarnessSupport.match(req.method, pathSegments)) {
+    const parsed = await recordHarnessSupport.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const writer = await ensureCatalogWriter(req, res, "models.harness-support.write");
+    if (!writer)
+      return true;
+    if (writer.agentId && !await callerOwnsSupportRow(writer.agentId, parsed.body)) {
+      jsonError(res, "Harness support can only be recorded for the calling agent's own harness and registered CLI version", 403);
+      return true;
+    }
+    if (writer.agentId && parsed.body.status === "unsupported" && !(isUnknownModelError(parsed.body.error, parsed.body.modelId) && await agentRanModel(writer.agentId, parsed.body.modelId))) {
+      jsonError(res, "An unsupported report needs a model the calling agent ran and the CLI's model-rejection error", 403);
+      return true;
+    }
+    recordHarnessSupport.respond(res, 200, await recordHarnessModelSupport(parsed.body));
     return true;
   }
   return false;
@@ -15761,6 +16365,7 @@ init_types();
 init_zod();
 init_db();
 init_config();
+init_telemetry();
 init_types();
 var SetupMilestoneStateSchema = exports_external.enum(["unverified", "configured", "verified"]);
 var SetupMilestoneIdSchema = exports_external.enum([
@@ -15804,6 +16409,9 @@ var StatusActivitySchema = exports_external.object({
   leads_online: exports_external.number().int().nonnegative(),
   recent_tasks_count: exports_external.number().int().nonnegative()
 });
+var StatusTelemetrySchema = exports_external.object({
+  enabled: exports_external.boolean()
+});
 var StatusAgentFsSchema = exports_external.object({
   configured: exports_external.boolean(),
   base_url: exports_external.string().nullable(),
@@ -15836,7 +16444,8 @@ var StatusResponseSchema = exports_external.object({
   activity: StatusActivitySchema,
   agent_fs: StatusAgentFsSchema,
   automations: exports_external.array(AutomationStatusSchema),
-  health: StatusHealthSchema
+  health: StatusHealthSchema,
+  telemetry: StatusTelemetrySchema.optional()
 });
 var TestConnectionRequestSchema = exports_external.object({
   provider: ProviderNameSchema
@@ -16191,7 +16800,8 @@ async function buildStatusPayload() {
       ...getAgentFsStatusProvider()
     },
     automations,
-    health: computeHealth(setup)
+    health: computeHealth(setup),
+    telemetry: { enabled: isTelemetryEnabled() }
   };
 }
 function getAgentFsStatusProvider() {
@@ -16213,7 +16823,7 @@ var getStatus = route({
   path: "/status",
   pattern: ["status"],
   summary: "Identity + setup readiness + live activity for the swarm dashboard",
-  description: "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set.",
+  description: "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set; telemetry reports the effective ANONYMIZED_TELEMETRY opt-out state.",
   tags: ["Status"],
   responses: {
     200: { description: "Status payload", schema: StatusResponseSchema },
@@ -17868,7 +18478,9 @@ var pollTriggers = route({
   summary: "Poll for triggers (tasks, mentions)",
   tags: ["Poll"],
   auth: { apiKey: true, agentId: true },
-  headers: runtimeInstanceHeader("poll for work"),
+  headers: runtimeInstanceHeader("poll for work").extend({
+    "X-Model-Tier-Overrides": exports_external.string().optional().describe("URL-encoded JSON {provider: {tier: model}} of the worker's MODEL_TIER_* env overrides. " + "Stored on the agent row and applied at claim time (modelSource=worker-env).")
+  }),
   responses: {
     200: { description: "Trigger data or null", schema: pollResponseSchema },
     400: { description: "Missing X-Agent-ID" },
@@ -17905,6 +18517,14 @@ async function attachmentsForTrigger(taskId) {
     sizeBytes: a.sizeBytes
   }));
 }
+async function claimModelFields(task, agent) {
+  try {
+    return await recordClaimModelResolution(task, agent);
+  } catch (error) {
+    console.warn(`[/api/poll] model resolution failed for task ${task.id}:`, error);
+    return {};
+  }
+}
 var commitCursorsRoute = route({
   method: "post",
   path: "/api/channel-activity/commit-cursors",
@@ -17928,6 +18548,7 @@ var commitCursorsRoute = route({
 });
 async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
   const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
+  const modelTierOverrides = parseModelTierOverridesHeader(((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-model-tier-overrides"]));
   if (commitCursorsRoute.match(req.method, pathSegments)) {
     const parsed = await commitCursorsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -17955,6 +18576,9 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         if (!agent) {
           return { error: "Agent not found", status: 404 };
         }
+        if (modelTierOverrides) {
+          await setAgentModelTierOverrides(agent.id, modelTierOverrides);
+        }
         if (isExtensionAgent(agent)) {
           return { trigger: null };
         }
@@ -18052,6 +18676,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                 taskId: pendingTask.id,
                 task: {
                   ...pendingTask,
+                  ...await claimModelFields(pendingTask, agent),
                   status: "in_progress",
                   attachments: await attachmentsForTrigger(pendingTask.id)
                 },
@@ -18073,7 +18698,8 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         }
         if (agent.isLead) {} else {
           if (await hasCapacity(myAgentId)) {
-            const unassignedIds = await getUnassignedTaskIdsForAgent(myAgentId, 5);
+            const harness = agent.harnessProvider ?? agent.provider ?? null;
+            const unassignedIds = await getUnassignedTaskIdsForAgent(myAgentId, 5, (task) => poolTaskRunsOnHarness(task, harness));
             if (unassignedIds.length > 0) {
               const candidateId = unassignedIds[0];
               const candidateTask = await getTaskById(candidateId);
@@ -18136,7 +18762,11 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                   trigger: {
                     type: "task_assigned",
                     taskId: claimed.id,
-                    task: { ...claimed, attachments: await attachmentsForTrigger(claimed.id) },
+                    task: {
+                      ...claimed,
+                      ...await claimModelFields(claimed, agent),
+                      attachments: await attachmentsForTrigger(claimed.id)
+                    },
                     ...claimedRequestedBy && { requestedBy: claimedRequestedBy }
                   }
                 };
@@ -19298,6 +19928,7 @@ var scheduleUpdateBodySchema = exports_external.object({
   timezone: exports_external.string().optional(),
   model: exports_external.string().nullable().optional(),
   modelTier: ModelTierSchema.nullable().optional(),
+  allowCustomModel: exports_external.boolean().optional(),
   nextRunAt: exports_external.string().nullable().optional(),
   targetType: ScheduledTaskTargetTypeSchema.optional(),
   workflowId: exports_external.string().uuid().nullable().optional(),
@@ -19338,6 +19969,7 @@ var createSchedule = route({
     timezone: exports_external.string().optional(),
     model: exports_external.string().optional(),
     modelTier: ModelTierSchema.optional(),
+    allowCustomModel: exports_external.boolean().optional(),
     scheduleType: exports_external.enum(["recurring", "one_time"]).optional(),
     targetType: ScheduledTaskTargetTypeSchema.optional(),
     workflowId: exports_external.string().uuid().optional(),
@@ -19575,6 +20207,15 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
         return true;
       }
     }
+    const modelError = await explicitModelErrorForAgent({
+      model: splitLegacyModelAlias({ model: body.model, modelTier: body.modelTier }).model,
+      allowCustomModel: body.allowCustomModel,
+      agentId: body.targetAgentId
+    });
+    if (modelError) {
+      jsonError(res, modelError, 400);
+      return true;
+    }
     try {
       const trustedUserId = await resolveHttpAuditUserId(req, myAgentId);
       let key;
@@ -19703,21 +20344,45 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
         throw error;
       }
     }
+    const allowCustomModel = parsed.body.allowCustomModel;
+    delete body.allowCustomModel;
+    const existing = await getScheduledTaskById(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
+    const agentChanged = parsed.body.targetAgentId !== undefined && parsed.body.targetAgentId !== existing.targetAgentId;
     if (parsed.body.model !== undefined || parsed.body.modelTier !== undefined) {
       const normalizedModel = splitLegacyModelAlias({
         model: parsed.body.model,
         modelTier: parsed.body.modelTier
       });
+      if (normalizedModel.model !== existing.model || agentChanged) {
+        const modelError = await explicitModelErrorForAgent({
+          model: normalizedModel.model,
+          allowCustomModel: allowCustomModel || normalizedModel.model === existing.model,
+          agentId: parsed.body.targetAgentId ?? existing.targetAgentId
+        });
+        if (modelError) {
+          jsonError(res, modelError, 400);
+          return true;
+        }
+      }
       if (parsed.body.model !== undefined)
         body.model = normalizedModel.model ?? null;
       if (parsed.body.modelTier !== undefined || normalizedModel.modelTier) {
         body.modelTier = normalizedModel.modelTier ?? null;
       }
-    }
-    const existing = await getScheduledTaskById(parsed.params.id);
-    if (!existing) {
-      jsonError(res, "Schedule not found", 404);
-      return true;
+    } else if (agentChanged && existing.model) {
+      const modelError = await explicitModelErrorForAgent({
+        model: existing.model,
+        allowCustomModel: true,
+        agentId: parsed.body.targetAgentId ?? existing.targetAgentId
+      });
+      if (modelError) {
+        jsonError(res, modelError, 400);
+        return true;
+      }
     }
     if (existing.scheduleType === "one_time" && !existing.enabled && existing.lastRunAt) {
       jsonError(res, "One-time schedule has already executed. Create a new one instead.", 400);
@@ -21950,6 +22615,7 @@ var agentTaskBodySchema = exports_external.object({
   dir: exports_external.string().min(1).optional(),
   vcsRepo: exports_external.string().min(1).optional(),
   model: exports_external.string().min(1).optional(),
+  allowCustomModel: exports_external.boolean().optional(),
   parentTaskId: exports_external.string().uuid().optional(),
   requestedByUserId: exports_external.string().optional(),
   outputSchema: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
@@ -22402,6 +23068,15 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
     const contextKey = `script-run:${run.id}:${parsed.body.stepKey}`;
     let task = await getLatestScriptRunStepTaskByContextKey(contextKey);
     if (!task) {
+      const modelError = await explicitModelErrorForAgent({
+        model: parsed.body.model,
+        allowCustomModel: parsed.body.allowCustomModel,
+        agentId: parsed.body.agentId
+      });
+      if (modelError) {
+        jsonError(res, modelError, 400);
+        return true;
+      }
       try {
         task = await createTaskExtended(parsed.body.template ?? parsed.body.task ?? parsed.body.stepKey, {
           agentId: parsed.body.agentId,
@@ -23752,8 +24427,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
       userId: parsed.query.userId || undefined,
       groupBy: parsed.query.groupBy || "both"
     };
-    const version = await getUsageDataVersion();
-    const summary = await cachedUsageReport(`summary:${version}:${JSON.stringify(opts)}`, () => getSessionCostSummary(opts));
+    const summary = await cachedUsageReport(`summary:${JSON.stringify(opts)}`, () => getSessionCostSummary(opts));
     getSessionCostSummaryRoute.respond(res, 200, summary);
     return true;
   }
@@ -23770,8 +24444,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
       startDate: parsed.query.startDate || undefined,
       endDate: parsed.query.endDate || undefined
     };
-    const version = await getUsageDataVersion();
-    const rows = await cachedUsageReport(`attribution:${version}:${JSON.stringify(opts)}`, () => getAttributionByPerson(opts));
+    const rows = await cachedUsageReport(`attribution:${JSON.stringify(opts)}`, () => getAttributionByPerson(opts));
     getAttributionByPersonRoute.respond(res, 200, { rows });
     return true;
   }
@@ -24804,6 +25477,7 @@ init_zod();
 init_db();
 init_steering();
 init_types();
+init_env_flag();
 var AgentCountsSchema = exports_external.object({
   total: exports_external.number(),
   idle: exports_external.number(),
@@ -24825,7 +25499,8 @@ var DashboardStatsSchema = exports_external.object({
   agents: AgentCountsSchema,
   tasks: TaskCountsSchema,
   steeringEnabled: exports_external.boolean(),
-  multiRuntimeEnabled: exports_external.boolean()
+  multiRuntimeEnabled: exports_external.boolean(),
+  devMode: exports_external.boolean()
 });
 var RetentionTableStatsSchema = exports_external.object({
   at: exports_external.string(),
@@ -24990,15 +25665,10 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (getStats.match(req.method, pathSegments)) {
-    const agents = await getAllAgents();
+    const agents = await getAgentStatusCounts();
     const taskStats = await getTaskStats();
     const stats = {
-      agents: {
-        total: agents.length,
-        idle: agents.filter((a) => a.status === "idle").length,
-        busy: agents.filter((a) => a.status === "busy").length,
-        offline: agents.filter((a) => a.status === "offline").length
-      },
+      agents,
       tasks: {
         total: taskStats.total,
         unassigned: taskStats.unassigned,
@@ -25011,6 +25681,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
         failed: taskStats.failed
       },
       steeringEnabled: isSteeringEnabled2(),
+      devMode: isEnvFlagEnabled("SWARM_DEV_MODE", false),
       multiRuntimeEnabled: isMultiRuntimeEnabled()
     };
     getStats.respond(res, 200, stats);
@@ -25129,6 +25800,9 @@ var AgentTaskSummarySchema2 = AgentTaskSchema.pick({
   scheduleId: true,
   model: true,
   modelTier: true,
+  resolvedModel: true,
+  modelSource: true,
+  modelAlias: true,
   effort: true,
   provider: true,
   requestedByUserId: true,
@@ -25254,8 +25928,9 @@ var createTask = route({
     outputSchema: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
     contextKey: exports_external.string().optional(),
     requestedByUserId: exports_external.string().optional(),
-    model: exports_external.string().optional(),
+    model: exports_external.string().optional().describe("Concrete model override for this task, interpreted by the assignee's harness/provider. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
     modelTier: ModelTierSchema.optional(),
+    allowCustomModel: exports_external.boolean().optional(),
     effort: ReasoningEffortSchema.optional(),
     draft: exports_external.boolean().optional()
   }).superRefine((body, ctx) => {
@@ -25269,7 +25944,9 @@ var createTask = route({
   }),
   responses: {
     201: { description: "Task created", schema: AgentTaskSchema },
-    400: { description: "Validation error, or agentId/offeredTo targets an extension identity" },
+    400: {
+      description: "Validation error, an unknown `model` (set `allowCustomModel` to store a custom id), or agentId/offeredTo targets an extension identity"
+    },
     422: {
       description: "Task creation blocked by an extension",
       schema: exports_external.object({
@@ -25336,6 +26013,7 @@ var cancelTaskRoute = route({
   responses: {
     200: { description: "Task cancelled", schema: TaskActionResultSchema },
     400: { description: "Cannot cancel terminal task" },
+    403: { description: "Agent caller is neither a lead nor the task creator" },
     404: { description: "Task not found" }
   }
 });
@@ -25485,6 +26163,7 @@ var updateTaskProgressRoute = route({
   body: exports_external.object({ progress: exports_external.string().min(1) }),
   responses: {
     200: { description: "Progress updated", schema: exports_external.object({ success: exports_external.literal(true) }) },
+    403: { description: "Task is assigned to another agent" },
     404: { description: "Task not found" }
   }
 });
@@ -25668,6 +26347,16 @@ async function canActOnOwnTask(req, myAgentId, task) {
   }
   return can({ principal, verb: "task.action.own", resource, source: "http" }).allow;
 }
+async function resolveTaskWritePrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  const agentId = auth?.kind === "agent" ? auth.agentId : myAgentId;
+  if (!agentId)
+    return { kind: "operator" };
+  const agent = await getAgentById(agentId);
+  return { kind: "agent", agentId, isLead: agent?.isLead === true };
+}
 async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
   if (listTasks.match(req.method, pathSegments)) {
     const parsed = await listTasks.parse(req, res, pathSegments, queryParams);
@@ -25746,6 +26435,15 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       if (lead)
         defaultAgentId = lead.id;
     }
+    const modelError = await explicitModelErrorForAgent({
+      model: splitLegacyModelAlias({ model: parsed.body.model, modelTier: parsed.body.modelTier }).model,
+      allowCustomModel: parsed.body.allowCustomModel,
+      agentId: defaultAgentId
+    });
+    if (modelError) {
+      jsonError(res, modelError, 400);
+      return true;
+    }
     const parentTask = parsed.body.parentTaskId ? await getTaskById(parsed.body.parentTaskId) : null;
     let assetKey;
     try {
@@ -25784,7 +26482,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
           modelTier: parsed.body.modelTier
         }),
         effort: parsed.body.effort
-      }, { origin: "rest" });
+      }, { origin: "rest", allowCustomModel: parsed.body.allowCustomModel });
       ensure({
         id: "created",
         flow: "task",
@@ -25858,6 +26556,16 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    const principal = await resolveTaskWritePrincipal(req, myAgentId);
+    if (principal.kind === "agent" && !can({
+      principal,
+      verb: "task.cancel.any",
+      resource: { kind: "task", taskId: task.id, creatorAgentId: task.creatorAgentId },
+      source: "http"
+    }).allow) {
+      jsonError(res, "Only the lead or task creator can cancel tasks.", 403);
+      return true;
+    }
     if (isTerminalTaskStatus(task.status)) {
       jsonError(res, `Cannot cancel task with status '${task.status}'`, 400);
       return true;
@@ -26134,12 +26842,30 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await updateTaskProgressRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const task = await getTaskById(parsed.params.id);
-    if (!task) {
+    const principal = await resolveTaskWritePrincipal(req, myAgentId);
+    const status = await getDbClient().transaction(async () => {
+      const task = await getTaskById(parsed.params.id);
+      if (!task)
+        return 404;
+      const decision = can({
+        principal,
+        verb: "task.progress.write",
+        resource: { kind: "task", taskId: task.id, agentId: task.agentId },
+        source: "http"
+      });
+      if (!decision.allow)
+        return 403;
+      await updateTaskProgress(parsed.params.id, parsed.body.progress);
+      return 200;
+    });
+    if (status === 404) {
       jsonError(res, "Task not found", 404);
       return true;
     }
-    await updateTaskProgress(parsed.params.id, parsed.body.progress);
+    if (status === 403) {
+      jsonError(res, "Task is assigned to another agent", 403);
+      return true;
+    }
     updateTaskProgressRoute.respond(res, 200, { success: true });
     return true;
   }
@@ -26423,6 +27149,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       reason: parsed.body.reason
     });
     if (followUp.kind !== "created") {
+      await settleSupersededTaskDependents(parsed.params.id, null);
       console.warn(`[Supersede] Task ${parsed.params.id.slice(0, 8)} superseded but resume creation skipped (${followUp.kind === "skipped" ? followUp.reason : followUp.kind})`);
       supersedeTaskRoute.respond(res, 200, {
         success: true,
@@ -28691,6 +29418,9 @@ init_zod();
 init_db();
 init_types();
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: exports_external.boolean() });
+var WorkflowSaveResponseSchema = WorkflowSchema.extend({
+  warnings: exports_external.array(exports_external.string()).optional()
+});
 var WorkflowSummarySchema = WorkflowSchema.omit({
   definition: true,
   triggers: true,
@@ -28716,6 +29446,10 @@ var WorkflowRunPageSchema = exports_external.object({
   })
 });
 var SuccessResponseSchema = exports_external.object({ success: exports_external.literal(true) });
+async function withSaveWarnings(workflow) {
+  const warnings = await workflowSaveWarnings(workflow.definition, getExecutorRegistry());
+  return warnings.length > 0 ? { ...workflow, warnings } : workflow;
+}
 var listWorkflowsRoute = route({
   method: "get",
   path: "/api/workflows",
@@ -28760,7 +29494,7 @@ var createWorkflowRoute = route({
     vcsRepo: exports_external.string().min(1).optional()
   }),
   responses: {
-    201: { description: "Workflow created", schema: WorkflowSchema },
+    201: { description: "Workflow created", schema: WorkflowSaveResponseSchema },
     400: { description: "Invalid definition" }
   }
 });
@@ -28806,7 +29540,10 @@ var updateWorkflowRoute = route({
     enabled: exports_external.boolean().optional()
   }),
   responses: {
-    200: { description: "Workflow updated (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow updated (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid definition" },
     404: { description: "Workflow not found" }
   }
@@ -28820,7 +29557,10 @@ var patchWorkflowRoute = route({
   params: exports_external.object({ id: exports_external.string() }),
   body: WorkflowPatchSchema.extend({ key: AssetKeySchema.optional() }),
   responses: {
-    200: { description: "Workflow patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow not found" }
   }
@@ -28834,7 +29574,10 @@ var patchWorkflowNodeRoute = route({
   params: exports_external.object({ id: exports_external.string(), nodeId: exports_external.string() }),
   body: WorkflowNodePatchSchema,
   responses: {
-    200: { description: "Node patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Node patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow or node not found" }
   }
@@ -29114,6 +29857,11 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, `Invalid definition: ${validation.errors.join("; ")}`, 400);
       return true;
     }
+    const modelErrors = await workflowModelErrors(parsed.body.definition);
+    if (modelErrors.length > 0) {
+      jsonError(res, `Invalid definition: ${modelErrors.join("; ")}`, 400);
+      return true;
+    }
     const trustedUserId = await resolveHttpAuditUserId(req, myAgentId);
     let key;
     try {
@@ -29142,7 +29890,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       createdByAgentId: myAgentId ?? undefined,
       createdBy: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
     }, "api");
-    createWorkflowRoute.respond(res, 201, workflow);
+    createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
     return true;
   }
   if (getWorkflowRoute.match(req.method, pathSegments)) {
@@ -29187,7 +29935,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, result.reason === "patch" ? result.errors.join("; ") : `Invalid definition: ${result.errors.join("; ")}`, 400);
       return true;
     }
-    patchWorkflowNodeRoute.respond(res, 200, result.workflow);
+    patchWorkflowNodeRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
   if (patchWorkflowRoute.match(req.method, pathSegments)) {
@@ -29238,7 +29986,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, result.reason === "patch" ? result.errors.join("; ") : `Invalid definition: ${result.errors.join("; ")}`, 400);
       return true;
     }
-    patchWorkflowRoute.respond(res, 200, result.workflow);
+    patchWorkflowRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
   if (updateWorkflowRoute.match(req.method, pathSegments)) {
@@ -29261,6 +30009,11 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
         jsonError(res, `Invalid definition: ${validation.errors.join("; ")}`, 400);
         return true;
       }
+      const modelErrors = await workflowModelErrors(body.definition);
+      if (modelErrors.length > 0) {
+        jsonError(res, `Invalid definition: ${modelErrors.join("; ")}`, 400);
+        return true;
+      }
     }
     const updatedBy2 = await resolveHttpAuditUserId(req, myAgentId) ?? undefined;
     let key;
@@ -29297,7 +30050,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       res.end();
       return true;
     }
-    updateWorkflowRoute.respond(res, 200, workflow);
+    updateWorkflowRoute.respond(res, 200, await withSaveWarnings(workflow));
     return true;
   }
   if (deleteWorkflowRoute.match(req.method, pathSegments)) {
@@ -29850,7 +30603,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-chgdkq36.js");
+    const { stopScheduler } = await import("./index-kkv84jq9.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -29858,12 +30611,13 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-vtkf5n99.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-yra8dy57.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
   stopMemoryGc();
   await stopDbRetention();
+  stopHumanFreeDrain();
   stopScratchScriptGc();
   await stopExtensionRuntime();
   stopAuditGc();
@@ -29926,15 +30680,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-s3q01xj3.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-gsetbs5y.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-v1cbr9te.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-wx0tp7cb.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-s3q01xj3.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-gsetbs5y.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -29942,7 +30696,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-a3vn96n8.js");
+  const { runAllSeeders } = await import("./index-zg7vp46x.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -29996,36 +30750,37 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-chgdkq36.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-1yks3qcr.js");
+    const { startScheduler } = await import("./index-kkv84jq9.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-fg0dsp6c.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-x71bvq0p.js");
+    const { startHeartbeat } = await import("./index-668me3f0.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-vtkf5n99.js");
+    const { startOAuthKeepalive } = await import("./keepalive-yra8dy57.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-qp3dzmdp.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-7rdt1m9n.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
-  import("./boot-reembed-se8zmdcp.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  startHumanFreeDrain();
+  import("./boot-reembed-cqz9swn5.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-g5ckg9yb.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-m3656j2n.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-wfxqan61.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-xbxf5d7w.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {