@desplega.ai/agent-swarm 1.159.0 → 1.161.0

package/dist/{cli-79aq9cgb.js → cli-0383bp7f.js}

@@ -2,33 +2,16 @@ import {
   COMPOSIO_HTTP_METHODS,
   composioArgsFromParts,
   executeComposioRequest
-} from "./cli-0z2v4nhw.js";
+} from "./cli-cat6h73s.js";
 import {
   LlmRater,
   REFERENCES_SOURCE_MAX_LENGTH,
   getMemoryRaterNames,
   sanitizeReferencesSource
-} from "./cli-cpvsaqsw.js";
+} from "./cli-w0bwte75.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import {
-  AgentFsProvider,
-  getFileStorageProvider,
-  providerPath
-} from "./cli-jsp14b6c.js";
-import {
-  ensurePricingSeeded,
-  ensureRbacSeeded,
-  getUserGrant
-} from "./cli-z9x0sh1t.js";
-import {
-  can,
-  decideAdmission,
-  grantLeadEquivalence,
-  isRbacEnabled,
-  revokeLeadEquivalence
-} from "./cli-9yg65c1j.js";
 import {
   buildCatalogEntries,
   getCatalogGeneration,
@@ -38,10 +21,7 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-cygyqj3b.js";
-import {
-  loadModelsDevCache
-} from "./cli-0n2e4x49.js";
+} from "./cli-3zc55ctx.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -121,7 +101,7 @@ import {
   validateDefinition,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-fjtp3463.js";
+} from "./cli-1er0rhz8.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -130,9 +110,14 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import {
+  AgentFsProvider,
+  getFileStorageProvider,
+  providerPath
+} from "./cli-jsp14b6c.js";
 import {
   embedScript
-} from "./cli-vwbbaecp.js";
+} from "./cli-7119ja3w.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -147,23 +132,48 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-qv4jv8bx.js";
+} from "./cli-hgmnf38m.js";
+import {
+  ensurePricingSeeded,
+  ensureRbacSeeded,
+  getUserGrant
+} from "./cli-we0q7t0e.js";
+import {
+  can,
+  decideAdmission,
+  grantLeadEquivalence,
+  isRbacEnabled,
+  revokeLeadEquivalence
+} from "./cli-tsk3nz8a.js";
+import {
+  loadModelsDevCache
+} from "./cli-ecfxwnyb.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
 } from "./cli-fad8m16k.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
+  LONGTERM_ROOT,
+  MEMORY_KEY_MAX_LENGTH,
+  MEMORY_KEY_PATTERN,
+  MEMORY_KEY_PATTERN_MESSAGE,
   computeScore,
+  consolidatedKeyMessage,
   getEmbeddingProvider,
   getMemoryStore,
   init_constants as init_constants2,
+  init_key_paths,
   init_reranker,
   init_sqlite_store,
+  isConsolidatedKey,
   isGraphExpansionEnabled,
+  isLongtermKey,
+  longtermKeyError,
   rerank,
+  resolveStoreKey,
   rowToCandidate
-} from "./cli-kc3dp84d.js";
+} from "./cli-d56tgd45.js";
 import {
   require_dist
 } from "./cli-51tf7ac3.js";
@@ -189,7 +199,7 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-wgjx0q33.js";
+} from "./cli-phfg8vy8.js";
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
@@ -204,6 +214,7 @@ import {
   acceptTask,
   agentContextKey,
   agentmailContextKey,
+  azureDevOpsContextKey,
   beginRequestAuthScope,
   buildJiraContextKey,
   buildRoutingAffinityFromAgent,
@@ -458,7 +469,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-g9df2m37.js";
+} from "./cli-1cz0c18q.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -505,6 +516,7 @@ import {
   WorkflowNodePatchSchema,
   WorkflowRunStatusSchema,
   canWriteAssetKey,
+  checkExtensionInstallSource,
   init_bundle_path,
   init_dist,
   init_key,
@@ -516,18 +528,13 @@ import {
   parseAssetKey,
   parseModelTier,
   splitLegacyModelAlias
-} from "./cli-e4xnc0qp.js";
+} from "./cli-akfj32vj.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
   generateDefaultSoulMd,
   init_defaults
-} from "./cli-ardpzhjm.js";
-import {
-  getSlackConfiguration,
-  init_config,
-  isSlackConfigured
-} from "./cli-n7h1kqpf.js";
+} from "./cli-yrg7c73k.js";
 import {
   deepInterpolate,
   findInterpolationTokens,
@@ -538,7 +545,12 @@ import {
   interpolate,
   registerTemplate,
   resolveTemplate
-} from "./cli-rgjprct3.js";
+} from "./cli-ptr8h7kp.js";
+import {
+  getSlackConfiguration,
+  init_config,
+  isSlackConfigured
+} from "./cli-n7h1kqpf.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -556,12 +568,13 @@ import {
   claudeCatalogModelId,
   harnessCatalogSection,
   harnessModelIds,
+  harnessModelMismatch,
   init_src,
   isAlias,
   modelFamilyKey,
   parseAlias,
   resolveAlias
-} from "./cli-7zttzetj.js";
+} from "./cli-jyy6pm2f.js";
 import {
   exports_zod,
   init_zod
@@ -610,7 +623,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-48527fpw.js";
+} from "./cli-a8c82p2t.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -618,7 +631,7 @@ import {
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-r2ap2czm.js";
+} from "./cli-nexqx4ve.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -14349,7 +14362,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-y1b9srva.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-0hdqa4k1.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -17093,6 +17106,23 @@ async function verifyWebhookRequest(trigger, rawBody, headers) {
     }
     return;
   }
+  if (verification.format === "standard-webhooks") {
+    const key = decodeStandardWebhookSecret(secret);
+    if (!key) {
+      throw new WebhookError("Webhook trigger `standard-webhooks` secret must be base64 (optionally prefixed with `whsec_`)", 500);
+    }
+    const id = getHeader(headers, "webhook-id");
+    const timestamp = getHeader(headers, "webhook-timestamp");
+    const signature2 = getHeader(headers, "webhook-signature");
+    if (!id || !timestamp || !signature2) {
+      throw new WebhookError("Missing signature", 401);
+    }
+    const isValid2 = verifyStandardWebhookSignature(key, rawBody, { id, timestamp, signature: signature2 }, { toleranceSeconds: verification.toleranceSeconds });
+    if (!isValid2) {
+      throw new WebhookError("Invalid signature", 401);
+    }
+    return;
+  }
   const header = verification.header || DEFAULT_HMAC_HEADER;
   const signature = getHeader(headers, header);
   if (!signature) {
@@ -17226,6 +17256,36 @@ function verifyTimestampedHmacSignature(secret, body, headerValue, opts = {}, no
   const expected = Buffer.from(expectedHex, "hex");
   return signatures.some((signature) => timingSafeEqualHex(signature, expected));
 }
+var STANDARD_WEBHOOK_SECRET_PREFIX = "whsec_";
+function decodeStandardWebhookSecret(secret) {
+  const encoded = secret.startsWith(STANDARD_WEBHOOK_SECRET_PREFIX) ? secret.slice(STANDARD_WEBHOOK_SECRET_PREFIX.length) : secret;
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || encoded.length % 4 === 1) {
+    return null;
+  }
+  const key = Buffer.from(encoded, "base64");
+  return key.length > 0 ? key : null;
+}
+function verifyStandardWebhookSignature(key, body, headers, opts = {}, nowMs = Date.now()) {
+  const toleranceSeconds = opts.toleranceSeconds ?? 300;
+  if (!/^\d+$/.test(headers.timestamp)) {
+    return false;
+  }
+  const timestampSeconds = Number(headers.timestamp);
+  if (!Number.isSafeInteger(timestampSeconds)) {
+    return false;
+  }
+  if (Math.abs(nowMs / 1000 - timestampSeconds) > toleranceSeconds) {
+    return false;
+  }
+  const expected = Buffer.from(crypto2.createHmac("sha256", key).update(`${headers.id}.${headers.timestamp}.${body}`).digest("base64"));
+  return headers.signature.split(" ").some((entry) => {
+    const separatorIndex = entry.indexOf(",");
+    if (separatorIndex <= 0 || entry.slice(0, separatorIndex) !== "v1")
+      return false;
+    const provided = Buffer.from(entry.slice(separatorIndex + 1));
+    return provided.length === expected.length && crypto2.timingSafeEqual(provided, expected);
+  });
+}
 function verifyTokenEquality(secret, providedToken) {
   const secretDigest = crypto2.createHash("sha256").update(secret).digest();
   const providedDigest = crypto2.createHash("sha256").update(providedToken).digest();
@@ -17601,22 +17661,45 @@ function taskModelCandidates(input) {
   }
   return candidates;
 }
+function harnessMismatchReason(model, harness) {
+  return `[model-harness-mismatch] Model "${model}" does not run on the ${harness} harness of this worker. The task pinned a model from another harness family. Re-create the task with modelTier or with a ${harness} model.`;
+}
 async function resolveTaskModel(input) {
+  const harness = input.harnessProvider ?? null;
+  const judged = harness !== null && harnessCatalogSection(harness) !== null;
+  const sections = judged ? (await loadResolutionCatalog()).catalog : {};
   for (const candidate of taskModelCandidates(input)) {
+    let resolution = null;
     if (!isAlias(candidate.value)) {
-      return { resolvedModel: candidate.value, modelSource: candidate.source, modelAlias: null };
-    }
-    const resolved = await resolveLatestAlias(candidate.value, input.now, {
-      record: input.record
-    });
-    if (resolved) {
-      return {
-        resolvedModel: resolved,
+      resolution = {
+        resolvedModel: candidate.value,
         modelSource: candidate.source,
-        modelAlias: candidate.value.trim().toLowerCase()
+        modelAlias: null
       };
+    } else {
+      const resolved = await resolveLatestAlias(candidate.value, input.now, {
+        record: input.record
+      });
+      if (resolved) {
+        resolution = {
+          resolvedModel: resolved,
+          modelSource: candidate.source,
+          modelAlias: candidate.value.trim().toLowerCase()
+        };
+      }
     }
-    console.warn(`[model-tiers] ${candidate.source} alias ${candidate.value} resolved to nothing; trying next layer`);
+    if (!resolution) {
+      console.warn(`[model-tiers] ${candidate.source} alias ${candidate.value} resolved to nothing; trying next layer`);
+      continue;
+    }
+    if (judged && harnessModelMismatch(resolution.resolvedModel, harness, sections)) {
+      if (candidate.source === "model") {
+        return { harnessMismatch: harnessMismatchReason(candidate.value, harness) };
+      }
+      console.warn(`[model-tiers] ${candidate.source} value ${candidate.value} does not run on ${harness}; trying next layer`);
+      continue;
+    }
+    return resolution;
   }
   return null;
 }
@@ -17636,15 +17719,16 @@ async function previewModelTiers(opts = {}) {
         now: opts.now,
         record: false
       });
+      const previewed = resolution && "harnessMismatch" in resolution ? null : resolution;
       rows.push({
         provider,
         tier,
         key,
         defaultValue: DEFAULT_MODEL_TIER_MAP[provider][tier],
         configured,
-        source: resolution?.modelSource === "tier-config" ? "tier-config" : "tier-default",
-        resolvedModel: resolution?.resolvedModel ?? null,
-        alias: resolution?.modelAlias ?? null
+        source: previewed?.modelSource === "tier-config" ? "tier-config" : "tier-default",
+        resolvedModel: previewed?.resolvedModel ?? null,
+        alias: previewed?.modelAlias ?? null
       });
     }
   }
@@ -17678,6 +17762,8 @@ async function recordClaimModelResolution(task, agent) {
   });
   if (!resolved)
     return {};
+  if ("harnessMismatch" in resolved)
+    return { modelUnsupported: resolved.harnessMismatch };
   const checked = await applyCliSupport(resolved, harnessProvider, await getAgentHarnessCliVersion(agent.id));
   if ("unsupported" in checked) {
     return { modelUnsupported: checked.unsupported };
@@ -17716,12 +17802,31 @@ function isKnownCatalogModel(model, catalog) {
   const anthropic = catalog.anthropic?.models;
   return Object.hasOwn(buildClaudeShortnameMap(anthropic), id);
 }
+async function harnessModelErrorFor(model, harness) {
+  const { providers } = await loadModelsCatalog();
+  return harnessModelMismatch(model, harness, providers, {});
+}
+async function poolTaskRunsOnHarness(task, harness) {
+  const model = task?.model?.trim();
+  if (!model)
+    return true;
+  return await harnessModelErrorFor(model, harness) === null;
+}
 async function explicitModelError(check) {
   const model = check.model?.trim();
-  if (!model || check.allowCustomModel)
+  if (!model)
     return null;
   if (check.harnessProvider && FREE_FORM_HARNESSES.has(check.harnessProvider))
     return null;
+  const { providers } = await loadModelsCatalog();
+  const catalog = providers;
+  if (check.harnessProvider) {
+    const mismatch = harnessModelMismatch(model, check.harnessProvider, catalog, { agentId: check.agentId, agentName: check.agentName });
+    if (mismatch)
+      return mismatch;
+  }
+  if (check.allowCustomModel)
+    return null;
   if (isAlias(model)) {
     if (!parseAlias(model)) {
       return `Invalid model alias "${model}". Use latest:<provider>/<family>[@stable|@any], e.g. latest:anthropic/opus.`;
@@ -17729,8 +17834,6 @@ async function explicitModelError(check) {
     const resolved = await resolveLatestAlias(model, new Date, { record: false });
     return resolved ? null : `Model alias "${model}" matches no model in the catalog. Check the provider and family, or use a concrete model id.`;
   }
-  const { providers } = await loadModelsCatalog();
-  const catalog = providers;
   if (Object.keys(catalog).length === 0)
     return null;
   if (isKnownCatalogModel(model, catalog))
@@ -17738,10 +17841,40 @@ async function explicitModelError(check) {
   return `Unknown model "${model}": it is not in the model catalog. Use a catalog model id, a Claude CLI shortname (opus, sonnet, haiku, fable), a latest:<provider>/<family> alias, or modelTier. To run a custom model id anyway, set allowCustomModel: true (allow_custom_model on the agent runtime).`;
 }
 async function explicitModelErrorForAgent(check) {
-  if (!check.model?.trim() || check.allowCustomModel)
+  const model = check.model?.trim();
+  if (!model)
     return null;
   const agent = check.agentId ? await getAgentById(check.agentId) : null;
-  return explicitModelError({ ...check, harnessProvider: agent?.harnessProvider ?? null });
+  if (agent) {
+    return explicitModelError({
+      ...check,
+      agentId: agent.id,
+      agentName: agent.name,
+      harnessProvider: agent.harnessProvider ?? agent.provider ?? null
+    });
+  }
+  if (!check.agentId && !isAlias(model)) {
+    const poolError = await poolHarnessModelError(model);
+    if (poolError)
+      return poolError;
+  }
+  return explicitModelError({ ...check, harnessProvider: null });
+}
+async function poolHarnessModelError(model) {
+  const agents = await getAllAgents({ slim: true });
+  if (agents.length === 0)
+    return null;
+  const { providers } = await loadModelsCatalog();
+  const sections = providers;
+  const harnesses = new Set;
+  for (const agent of agents) {
+    const harness = agent.harnessProvider ?? agent.provider ?? null;
+    if (!harnessModelMismatch(model, harness, sections))
+      return null;
+    if (harness)
+      harnesses.add(harness);
+  }
+  return `Model "${model}" does not run on any registered agent harness (${[...harnesses].sort().join(", ")}). Use modelTier (smol, regular, smart, ultra) for portable intent, or omit model and let the claiming agent resolve it.`;
 }
 
 // src/extensions/apply-task-create.ts
@@ -17969,7 +18102,8 @@ async function prepareTaskWithSiblingAwareness(description, options, args = {})
   const preCreate = await applyPreTaskCreate({
     description,
     options,
-    origin: args.origin ?? "rest"
+    origin: args.origin ?? "rest",
+    allowCustomModel: args.allowCustomModel
   });
   if (preCreate.kind === "blocked") {
     throw new TaskCreationBlockedError(preCreate.reason, preCreate.extension);
@@ -24030,6 +24164,10 @@ init_steering();
 
 // src/github/task-reactions.ts
 init_task_lifecycle_events();
+init_secret_scrubber();
+
+// src/github/reactions.ts
+init_secret_scrubber();
 
 // src/github/app.ts
 var initialized = false;
@@ -24181,18 +24319,25 @@ async function getInstallationToken(installationId) {
 }
 
 // src/github/reactions.ts
-async function addReaction(repo, commentId, reaction, installationId) {
-  if (!isReactionsEnabled()) {
-    console.log("[GitHub] Reactions not enabled, skipping");
-    return false;
-  }
-  const token = await getInstallationToken(installationId);
-  if (!token) {
-    console.log("[GitHub] No installation token, skipping reaction");
+async function resolveReactionToken(installationId) {
+  if (installationId && isReactionsEnabled()) {
+    const appToken = await getInstallationToken(installationId);
+    if (appToken)
+      return appToken;
+    console.log("[GitHub] No installation token, trying GITHUB_TOKEN for reaction");
+  }
+  const pat = process.env.GITHUB_TOKEN?.trim();
+  if (pat)
+    return pat;
+  console.log("[GitHub] No App installation and no GITHUB_TOKEN, skipping reaction");
+  return null;
+}
+async function postRestReaction(repo, target, reaction, installationId, label) {
+  const token = await resolveReactionToken(installationId);
+  if (!token)
     return false;
-  }
   try {
-    const response = await fetch(`https://api.github.com/repos/${repo}/issues/comments/${commentId}/reactions`, {
+    const response = await fetch(`https://api.github.com/repos/${repo}/${target}/reactions`, {
       method: "POST",
       headers: {
         Accept: "application/vnd.github+json",
@@ -24204,92 +24349,29 @@ async function addReaction(repo, commentId, reaction, installationId) {
     });
     if (!response.ok) {
       const errorText2 = await response.text();
-      console.error(`[GitHub] Failed to add reaction: ${response.status} ${errorText2}`);
+      console.error(`[GitHub] Failed to add ${label} reaction: ${response.status} ${scrubSecrets(errorText2)}`);
       return false;
     }
-    console.log(`[GitHub] Added ${reaction} reaction to comment ${commentId}`);
+    console.log(`[GitHub] Added ${reaction} reaction to ${label}`);
     return true;
   } catch (error) {
-    console.error("[GitHub] Error adding reaction:", error);
+    console.error(`[GitHub] Error adding ${label} reaction:`, scrubSecrets(error instanceof Error ? error.message : String(error)));
     return false;
   }
 }
+async function addReaction(repo, commentId, reaction, installationId) {
+  return postRestReaction(repo, `issues/comments/${commentId}`, reaction, installationId, `comment ${commentId}`);
+}
 async function addIssueReaction(repo, issueNumber, reaction, installationId) {
-  if (!isReactionsEnabled()) {
-    console.log("[GitHub] Reactions not enabled, skipping");
-    return false;
-  }
-  const token = await getInstallationToken(installationId);
-  if (!token) {
-    console.log("[GitHub] No installation token, skipping reaction");
-    return false;
-  }
-  try {
-    const response = await fetch(`https://api.github.com/repos/${repo}/issues/${issueNumber}/reactions`, {
-      method: "POST",
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({ content: reaction })
-    });
-    if (!response.ok) {
-      const errorText2 = await response.text();
-      console.error(`[GitHub] Failed to add issue reaction: ${response.status} ${errorText2}`);
-      return false;
-    }
-    console.log(`[GitHub] Added ${reaction} reaction to issue/PR #${issueNumber}`);
-    return true;
-  } catch (error) {
-    console.error("[GitHub] Error adding issue reaction:", error);
-    return false;
-  }
+  return postRestReaction(repo, `issues/${issueNumber}`, reaction, installationId, `issue/PR #${issueNumber}`);
 }
 async function addPullReviewCommentReaction(repo, commentId, reaction, installationId) {
-  if (!isReactionsEnabled()) {
-    console.log("[GitHub] Reactions not enabled, skipping");
-    return false;
-  }
-  const token = await getInstallationToken(installationId);
-  if (!token) {
-    console.log("[GitHub] No installation token, skipping reaction");
-    return false;
-  }
-  try {
-    const response = await fetch(`https://api.github.com/repos/${repo}/pulls/comments/${commentId}/reactions`, {
-      method: "POST",
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({ content: reaction })
-    });
-    if (!response.ok) {
-      const errorText2 = await response.text();
-      console.error(`[GitHub] Failed to add PR review comment reaction: ${response.status} ${errorText2}`);
-      return false;
-    }
-    console.log(`[GitHub] Added ${reaction} reaction to PR review comment ${commentId}`);
-    return true;
-  } catch (error) {
-    console.error("[GitHub] Error adding PR review comment reaction:", error);
-    return false;
-  }
+  return postRestReaction(repo, `pulls/comments/${commentId}`, reaction, installationId, `PR review comment ${commentId}`);
 }
 async function addGraphQLReaction(nodeId, reaction, installationId) {
-  if (!isReactionsEnabled()) {
-    console.log("[GitHub] Reactions not enabled, skipping");
-    return false;
-  }
-  const token = await getInstallationToken(installationId);
-  if (!token) {
-    console.log("[GitHub] No installation token, skipping GraphQL reaction");
+  const token = await resolveReactionToken(installationId);
+  if (!token)
     return false;
-  }
   try {
     const response = await fetch("https://api.github.com/graphql", {
       method: "POST",
@@ -24310,28 +24392,26 @@ async function addGraphQLReaction(nodeId, reaction, installationId) {
     });
     if (!response.ok) {
       const errorText2 = await response.text();
-      console.error(`[GitHub] GraphQL reaction failed: ${response.status} ${errorText2}`);
+      console.error(`[GitHub] GraphQL reaction failed: ${response.status} ${scrubSecrets(errorText2)}`);
       return false;
     }
     const data = await response.json();
     if (data.errors?.length) {
-      console.error(`[GitHub] GraphQL reaction errors: ${JSON.stringify(data.errors)}`);
+      console.error(`[GitHub] GraphQL reaction errors: ${scrubSecrets(JSON.stringify(data.errors))}`);
       return false;
     }
     console.log(`[GitHub] Added ${reaction} GraphQL reaction to node ${nodeId}`);
     return true;
   } catch (error) {
-    console.error("[GitHub] Error adding GraphQL reaction:", error);
+    console.error("[GitHub] Error adding GraphQL reaction:", scrubSecrets(error instanceof Error ? error.message : String(error)));
     return false;
   }
 }
 
 // src/github/task-reactions.ts
-async function addEyesReactionOnTaskStart(task) {
+async function addEyesReactionToTaskSource(task) {
   if (task.source !== "github" || task.vcsProvider !== "github")
     return;
-  if (!task.vcsInstallationId)
-    return;
   const installationId = task.vcsInstallationId;
   const repo = task.vcsRepo;
   if (!repo)
@@ -24353,6 +24433,8 @@ async function addEyesReactionOnTaskStart(task) {
       case "pull_request_review": {
         if (task.vcsNodeId) {
           await addGraphQLReaction(task.vcsNodeId, "EYES", installationId);
+        } else if (task.vcsNumber) {
+          await addIssueReaction(repo, task.vcsNumber, "eyes", installationId);
         }
         break;
       }
@@ -24365,9 +24447,12 @@ async function addEyesReactionOnTaskStart(task) {
       }
     }
   } catch (error) {
-    console.error("[GitHub] Failed to add eyes reaction on task start:", error);
+    console.error("[GitHub] Failed to add eyes reaction:", scrubSecrets(error instanceof Error ? error.message : String(error)));
   }
 }
+async function addEyesReactionOnTaskStart(task) {
+  await addEyesReactionToTaskSource(task);
+}
 var registered = false;
 function registerGithubTaskReactions() {
   if (registered)
@@ -25230,6 +25315,510 @@ async function handleMessageReceived(payload) {
   console.log(`[AgentMail] Created unassigned task ${task.id} (no lead or mapping available)`);
   return { created: true, taskId: task.id };
 }
+// src/azure-devops/auth.ts
+init_env_flag();
+var initialized3 = false;
+var webhookSecret3 = null;
+var apiToken = null;
+var orgUrl = null;
+function isAzureDevOpsEnabled() {
+  return !!process.env.AZURE_DEVOPS_WEBHOOK_SECRET && !isEnvFlagEnabled("AZURE_DEVOPS_DISABLE", false);
+}
+function initAzureDevOps() {
+  if (initialized3)
+    return;
+  if (!isAzureDevOpsEnabled()) {
+    console.log("[AzureDevOps] Integration disabled (AZURE_DEVOPS_WEBHOOK_SECRET not set)");
+    return;
+  }
+  webhookSecret3 = process.env.AZURE_DEVOPS_WEBHOOK_SECRET;
+  apiToken = process.env.AZURE_DEVOPS_TOKEN ?? null;
+  orgUrl = normalizeOrgUrl(process.env.AZURE_DEVOPS_ORG_URL);
+  initialized3 = true;
+  console.log(`[AzureDevOps] Integration initialized (org: ${orgUrl ?? "from payload"})`);
+}
+function verifyAzureDevOpsWebhook(authorizationHeader) {
+  if (!webhookSecret3)
+    return false;
+  if (!authorizationHeader?.startsWith("Basic "))
+    return false;
+  const decoded = Buffer.from(authorizationHeader.slice("Basic ".length), "base64").toString();
+  const separator = decoded.indexOf(":");
+  if (separator === -1)
+    return false;
+  const password = decoded.slice(separator + 1);
+  if (password.length !== webhookSecret3.length)
+    return false;
+  return crypto.timingSafeEqual(Buffer.from(password), Buffer.from(webhookSecret3));
+}
+function getAzureDevOpsToken() {
+  return apiToken;
+}
+function getAzureDevOpsOrgUrl() {
+  return orgUrl;
+}
+function normalizeOrgUrl(url) {
+  const trimmed = url?.trim().replace(/\/+$/, "");
+  return trimmed ? trimmed : null;
+}
+var AZURE_DEVOPS_BOT_NAME = process.env.AZURE_DEVOPS_BOT_NAME ?? "agent-swarm-bot";
+function resetAzureDevOps() {
+  initialized3 = false;
+  webhookSecret3 = null;
+  apiToken = null;
+  orgUrl = null;
+}
+
+// src/azure-devops/api.ts
+var API_VERSION = "7.1";
+function headers() {
+  const token = getAzureDevOpsToken();
+  if (!token)
+    throw new Error("[AzureDevOps] No API token configured");
+  return {
+    Authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}`,
+    "Content-Type": "application/json",
+    Accept: "application/json"
+  };
+}
+function pullRequestBase(ref) {
+  return `${ref.orgUrl}/${encodeURIComponent(ref.projectId)}/_apis/git/repositories/` + `${encodeURIComponent(ref.repositoryId)}/pullRequests/${ref.pullRequestId}`;
+}
+var cachedBotId = null;
+async function resolveAzureDevOpsBotId(orgBaseUrl) {
+  const fromEnv = process.env.AZURE_DEVOPS_BOT_ID?.trim();
+  if (fromEnv)
+    return fromEnv;
+  const orgUrl2 = normalizeOrgUrl(orgBaseUrl) ?? getAzureDevOpsOrgUrl();
+  if (!orgUrl2 || !getAzureDevOpsToken())
+    return null;
+  if (cachedBotId?.orgUrl === orgUrl2)
+    return cachedBotId.id;
+  try {
+    const resp = await fetch(`${orgUrl2}/_apis/connectionData`, { headers: headers() });
+    if (!resp.ok) {
+      console.error(`[AzureDevOps] Failed to resolve bot identity: ${resp.status}`);
+      return null;
+    }
+    const data = await resp.json();
+    const id = data.authenticatedUser?.id;
+    if (!id)
+      return null;
+    cachedBotId = { orgUrl: orgUrl2, id };
+    return id;
+  } catch (err) {
+    console.error(`[AzureDevOps] Error resolving bot identity:`, err);
+    return null;
+  }
+}
+function resetAzureDevOpsBotIdCache() {
+  cachedBotId = null;
+}
+async function likeAzureDevOpsComment(ref, threadId, commentId) {
+  const url = `${pullRequestBase(ref)}/threads/${threadId}/comments/${commentId}/likes?api-version=${API_VERSION}`;
+  try {
+    const resp = await fetch(url, { method: "POST", headers: headers() });
+    if (!resp.ok) {
+      console.error(`[AzureDevOps] Failed to like comment: ${resp.status} ${await resp.text()}`);
+    }
+  } catch (err) {
+    console.error(`[AzureDevOps] Error liking comment:`, err);
+  }
+}
+// src/azure-devops/handlers.ts
+init_db();
+init_resolver();
+init_context_key();
+
+// src/vcs/azure-devops.ts
+function isAzureDevOpsUrl(url) {
+  return /(^|[/@.])dev\.azure\.com[/:]|\.visualstudio\.com[/:]/i.test(url);
+}
+function canonicalAzureDevOpsRepoUrl(url) {
+  const trimmed = url.trim();
+  const ssh = trimmed.match(/^(?:ssh:\/\/)?[^@]+@ssh\.dev\.azure\.com[:/]v3\/([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (ssh)
+    return `https://dev.azure.com/${ssh[1]}/${ssh[2]}/_git/${ssh[3]}`;
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return trimmed;
+  }
+  parsed.username = "";
+  parsed.password = "";
+  parsed.search = "";
+  parsed.hash = "";
+  const parts = parsed.pathname.replace(/\.git\/?$/, "").split("/").filter(Boolean);
+  if (parsed.hostname === "dev.azure.com" && parts.length === 3 && parts[1] === "_git") {
+    parts.splice(1, 0, parts[2]);
+  }
+  parsed.pathname = `/${parts.join("/")}`;
+  return parsed.toString().replace(/\/+$/, "");
+}
+function parseAzureDevOpsRepoUrl(url) {
+  const canonical = canonicalAzureDevOpsRepoUrl(url);
+  let parsed;
+  try {
+    parsed = new URL(canonical);
+  } catch {
+    return null;
+  }
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  const gitIndex = parts.indexOf("_git");
+  const repository = parts[gitIndex + 1];
+  if (gitIndex < 1 || !repository) {
+    if (gitIndex === 0 && repository) {
+      return { orgUrl: parsed.origin, project: repository, repository };
+    }
+    return null;
+  }
+  const collectionOnly = parts[gitIndex - 1]?.toLowerCase() === "defaultcollection";
+  const project = collectionOnly ? repository : parts[gitIndex - 1];
+  const orgPath = parts.slice(0, collectionOnly ? gitIndex : gitIndex - 1).join("/");
+  return {
+    orgUrl: orgPath ? `${parsed.origin}/${orgPath}` : parsed.origin,
+    project: decodeURIComponent(project),
+    repository: decodeURIComponent(repository)
+  };
+}
+
+// src/azure-devops/templates.ts
+init_registry();
+registerTemplate({
+  eventType: "common.delegation_instruction.azure_devops",
+  header: "",
+  defaultBody: "\n\n**Delegation instruction:** As the lead agent, analyze this and decide whether to handle it yourself or delegate to a worker agent. Use `send-task` to delegate with clear instructions.",
+  variables: [],
+  category: "common"
+});
+registerTemplate({
+  eventType: "common.command_suggestions.azure_devops_pr",
+  header: "",
+  defaultBody: 'Workers have the `az` CLI with the azure-devops extension, authenticated with the swarm PAT. Inspect the PR with `az repos pr show --id {{pr_id}}`. To reply on the PR, write `{"comments":[{"content":"<reply>"}],"status":1}` to a JSON file and run `az devops invoke --area git --resource pullRequestThreads --route-parameters project={{project}} repositoryId={{repository}} pullRequestId={{pr_id}} --http-method POST --in-file <file> --api-version 7.1`.',
+  variables: [
+    { name: "pr_id", description: "Pull request ID" },
+    { name: "project", description: "Azure DevOps project name" },
+    { name: "repository", description: "Azure Repos repository name" }
+  ],
+  category: "common"
+});
+var SHARED_VARIABLES = [
+  { name: "pr_id", description: "Pull request ID" },
+  { name: "pr_title", description: "Pull request title" },
+  {
+    name: "repo",
+    description: "Repository clone URL (https://dev.azure.com/<org>/<project>/_git/<repo>)"
+  },
+  { name: "project", description: "Azure DevOps project name" },
+  { name: "repository", description: "Azure Repos repository name" },
+  { name: "pr_url", description: "Pull request web URL" }
+];
+registerTemplate({
+  eventType: "azure-devops.pull_request.opened",
+  header: "[Azure DevOps PR #{{pr_id}}] {{pr_title}}",
+  defaultBody: `Repo: {{repo}}
+Author: {{username}}
+Branch: {{source_branch}} → {{target_branch}}
+URL: {{pr_url}}
+
+{{context_section}}{{@template[common.command_suggestions.azure_devops_pr]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...SHARED_VARIABLES,
+    {
+      name: "username",
+      description: "Author identity — resolved canonical name (e.g. 'Luis (azure-devops:luis@example.com)') or the UNKNOWN sentinel"
+    },
+    { name: "source_branch", description: "Source branch name" },
+    { name: "target_branch", description: "Target branch name" },
+    { name: "context_section", description: "Context section with description or empty string" }
+  ],
+  category: "event"
+});
+registerTemplate({
+  eventType: "azure-devops.comment.mentioned",
+  header: "[Azure DevOps Comment on PR #{{pr_id}}] {{username}} mentioned bot",
+  defaultBody: `Repo: {{repo}}
+PR: {{pr_title}}
+URL: {{pr_url}}
+
+Comment:
+{{context}}{{existing_task_note}}
+
+{{@template[common.command_suggestions.azure_devops_pr]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...SHARED_VARIABLES,
+    {
+      name: "username",
+      description: "Comment author identity — resolved canonical name (e.g. 'Luis (azure-devops:luis@example.com)') or the UNKNOWN sentinel"
+    },
+    { name: "context", description: "Extracted mention context from comment" },
+    {
+      name: "existing_task_note",
+      description: "Note about existing active task, or empty string"
+    }
+  ],
+  category: "event"
+});
+
+// src/azure-devops/handlers.ts
+var processedEvents2 = new Map;
+var DEDUP_TTL_MS = 60000;
+function isDuplicate2(key) {
+  const now = Date.now();
+  for (const [k, ts] of processedEvents2) {
+    if (now - ts > DEDUP_TTL_MS)
+      processedEvents2.delete(k);
+  }
+  if (processedEvents2.has(key))
+    return true;
+  processedEvents2.set(key, now);
+  return false;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function mentionPatterns(botId) {
+  const patterns = [new RegExp(`@${escapeRegExp(AZURE_DEVOPS_BOT_NAME)}\\b`, "gi")];
+  if (botId)
+    patterns.push(new RegExp(`@<${escapeRegExp(botId)}>`, "gi"));
+  return patterns;
+}
+function detectMention(text, botId) {
+  if (!text)
+    return false;
+  return mentionPatterns(botId).some((re) => {
+    re.lastIndex = 0;
+    return re.test(text);
+  });
+}
+function extractMentionContext(text, botId) {
+  return mentionPatterns(botId).reduce((acc, re) => acc.replace(re, ""), text).trim();
+}
+function isBot(identity, botId) {
+  return !!botId && identity.id.toLowerCase() === botId.toLowerCase();
+}
+function pullRequestWebUrl(pr) {
+  const web = pr._links?.web?.href;
+  if (web)
+    return web.split("#")[0];
+  return `${canonicalAzureDevOpsRepoUrl(pr.repository.remoteUrl)}/pullrequest/${pr.pullRequestId}`;
+}
+function branchName(refName) {
+  return refName.replace(/^refs\/heads\//, "");
+}
+function orgUrlFor(event) {
+  const containers = event.resourceContainers;
+  return normalizeOrgUrl(containers?.account?.baseUrl ?? containers?.collection?.baseUrl) ?? getAzureDevOpsOrgUrl();
+}
+function threadIdOf(links) {
+  const href = links?.threads?.href ?? links?.self?.href ?? "";
+  const match = href.match(/\/threads\/(\d+)/);
+  return match ? Number(match[1]) : null;
+}
+function isPullRequest(value) {
+  const pr = value;
+  return typeof pr?.pullRequestId === "number" && typeof pr.repository?.id === "string" && typeof pr.repository.remoteUrl === "string" && !!pr.repository.project && !!pr.createdBy;
+}
+function createdPullRequestOf(event) {
+  return isPullRequest(event?.resource) ? event.resource : null;
+}
+function commentedPayloadOf(event) {
+  const resource = event?.resource;
+  const comment = resource?.comment;
+  const pullRequest = resource?.pullRequest;
+  if (!isPullRequest(pullRequest) || typeof comment?.id !== "number" || !comment.author) {
+    return null;
+  }
+  return { comment, pullRequest };
+}
+function warnMalformed(event) {
+  console.warn(`[AzureDevOps] Ignoring ${event?.eventType} event with resourceVersion ${event?.resourceVersion ?? "unknown"}: required resource fields are missing`);
+}
+async function findLeadAgent2() {
+  const agents = await getAllAgents();
+  return agents.find((a) => a.role === "lead" && a.status === "idle") ?? agents.find((a) => a.role === "lead") ?? null;
+}
+var UNMAPPED_NAMESPACE = "integration:unmapped:azure-devops";
+var UNMAPPED_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+var AZURE_DEVOPS_WEBHOOK_ACTOR = { kind: "system", id: "webhook:azure-devops" };
+function externalIdOf(identity) {
+  return identity.uniqueName?.trim() || identity.id;
+}
+async function resolveAzureDevOpsSender(identity, sampleEventType, sampleContext) {
+  const externalId = externalIdOf(identity);
+  const existing = await findUserByExternalId("azure-devops", externalId);
+  if (existing)
+    return existing.id;
+  if (externalId.includes("@")) {
+    const { user: linked } = await findOrCreateUserByEmail(externalId, { name: identity.displayName }, AZURE_DEVOPS_WEBHOOK_ACTOR);
+    await linkIdentity(linked.id, "azure-devops", externalId, AZURE_DEVOPS_WEBHOOK_ACTOR);
+    return linked.id;
+  }
+  await upsertKv({
+    namespace: UNMAPPED_NAMESPACE,
+    key: `${externalId}:meta`,
+    value: {
+      lastSeenAt: new Date().toISOString(),
+      sampleEventType,
+      sampleContext: sampleContext.slice(0, 100)
+    },
+    valueType: "json",
+    expiresAt: Date.now() + UNMAPPED_TTL_MS
+  });
+  await incrKv(UNMAPPED_NAMESPACE, `${externalId}:count`, 1);
+  return;
+}
+async function renderAzureDevOpsIdentity(identity) {
+  return renderIdentity(await resolveIdentity("azure-devops", externalIdOf(identity)));
+}
+async function handlePullRequestCreated(event) {
+  const pr = createdPullRequestOf(event);
+  if (!pr) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const repo = canonicalAzureDevOpsRepoUrl(pr.repository.remoteUrl);
+  console.log(`[AzureDevOps] PR #${pr.pullRequestId} created by ${pr.createdBy.displayName} in ${repo}`);
+  const orgUrl2 = orgUrlFor(event);
+  const botId = await resolveAzureDevOpsBotId(orgUrl2);
+  if (isBot(pr.createdBy, botId)) {
+    console.log(`[AzureDevOps] PR opened by the bot itself, skipping`);
+    return { created: false };
+  }
+  if (!detectMention(pr.description, botId)) {
+    console.log(`[AzureDevOps] PR opened without bot mention, skipping`);
+    return { created: false };
+  }
+  const dedupKey = `azure-devops-pr-${pr.repository.id}-${pr.pullRequestId}-created`;
+  if (isDuplicate2(dedupKey)) {
+    console.log(`[AzureDevOps] Skipping duplicate PR event`);
+    return { created: false };
+  }
+  const requestedByUserId = await resolveAzureDevOpsSender(pr.createdBy, "pull_request", `PR !${pr.pullRequestId}: ${pr.title}`);
+  const context = pr.description ? extractMentionContext(pr.description, botId) : "";
+  const prUrl = pullRequestWebUrl(pr);
+  const result = resolveTemplate("azure-devops.pull_request.opened", {
+    pr_id: pr.pullRequestId,
+    pr_title: pr.title,
+    repo,
+    project: pr.repository.project.name,
+    repository: pr.repository.name,
+    username: await renderAzureDevOpsIdentity(pr.createdBy),
+    source_branch: branchName(pr.sourceRefName),
+    target_branch: branchName(pr.targetRefName),
+    pr_url: prUrl,
+    context_section: context ? `Context: ${context}
+
+` : ""
+  });
+  if (result.skipped) {
+    return { created: false };
+  }
+  const lead = await findLeadAgent2();
+  const task = await createTaskWithSiblingAwareness(result.text, {
+    agentId: lead?.id ?? null,
+    routingReason: lead ? "skill" : undefined,
+    routingSource: lead ? "engine_default" : undefined,
+    source: "azure-devops",
+    vcsProvider: "azure-devops",
+    taskType: "azure-devops-pr",
+    vcsRepo: repo,
+    vcsEventType: "pull_request",
+    vcsNumber: pr.pullRequestId,
+    vcsAuthor: externalIdOf(pr.createdBy),
+    requestedByUserId,
+    vcsUrl: prUrl,
+    contextKey: azureDevOpsContextKey({
+      repositoryId: pr.repository.id,
+      pullRequestId: pr.pullRequestId
+    })
+  }, { origin: "webhook" });
+  return { created: true, taskId: task.id };
+}
+async function handlePullRequestCommented(event) {
+  const payload = commentedPayloadOf(event);
+  if (!payload) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const { comment, pullRequest: pr } = payload;
+  const repo = canonicalAzureDevOpsRepoUrl(pr.repository.remoteUrl);
+  if (comment.commentType === "system") {
+    return { created: false };
+  }
+  if (comment.lastContentUpdatedDate && comment.lastContentUpdatedDate !== comment.publishedDate) {
+    console.log(`[AzureDevOps] Ignoring edited comment ${comment.id} on PR #${pr.pullRequestId}`);
+    return { created: false };
+  }
+  const orgUrl2 = orgUrlFor(event);
+  const botId = await resolveAzureDevOpsBotId(orgUrl2);
+  if (isBot(comment.author, botId)) {
+    return { created: false };
+  }
+  if (!detectMention(comment.content, botId)) {
+    return { created: false };
+  }
+  console.log(`[AzureDevOps] Comment by ${comment.author.displayName} on PR #${pr.pullRequestId} in ${repo}`);
+  const threadId = threadIdOf(comment._links);
+  const dedupKey = `azure-devops-comment-${pr.repository.id}-${pr.pullRequestId}-${threadId}-${comment.id}`;
+  if (isDuplicate2(dedupKey)) {
+    return { created: false };
+  }
+  const requestedByUserId = await resolveAzureDevOpsSender(comment.author, "pull_request_comment", comment.content);
+  const existingTask = await findTaskByVcs(repo, pr.pullRequestId);
+  const existingTaskNote = existingTask ? `
+
+_Note: There's an active task (${existingTask.id}) for this PR #${pr.pullRequestId}._` : "";
+  const prUrl = pullRequestWebUrl(pr);
+  const result = resolveTemplate("azure-devops.comment.mentioned", {
+    pr_id: pr.pullRequestId,
+    pr_title: pr.title,
+    username: await renderAzureDevOpsIdentity(comment.author),
+    repo,
+    project: pr.repository.project.name,
+    repository: pr.repository.name,
+    pr_url: prUrl,
+    context: extractMentionContext(comment.content, botId),
+    existing_task_note: existingTaskNote
+  });
+  if (result.skipped) {
+    return { created: false };
+  }
+  const lead = await findLeadAgent2();
+  const task = await createTaskWithSiblingAwareness(result.text, {
+    agentId: lead?.id ?? null,
+    routingReason: lead ? "skill" : undefined,
+    routingSource: lead ? "engine_default" : undefined,
+    source: "azure-devops",
+    vcsProvider: "azure-devops",
+    taskType: "azure-devops-comment",
+    vcsRepo: repo,
+    vcsEventType: "pull_request_comment",
+    vcsNumber: pr.pullRequestId,
+    vcsCommentId: comment.id,
+    vcsAuthor: externalIdOf(comment.author),
+    requestedByUserId,
+    vcsUrl: prUrl,
+    parentTaskId: existingTask?.id,
+    contextKey: azureDevOpsContextKey({
+      repositoryId: pr.repository.id,
+      pullRequestId: pr.pullRequestId
+    })
+  }, { origin: "webhook" });
+  if (orgUrl2 && threadId !== null) {
+    const ref = {
+      orgUrl: orgUrl2,
+      projectId: pr.repository.project.id,
+      repositoryId: pr.repository.id,
+      pullRequestId: pr.pullRequestId
+    };
+    try {
+      await likeAzureDevOpsComment(ref, threadId, comment.id);
+    } catch {}
+  }
+  return { created: true, taskId: task.id };
+}
 // src/http/core.ts
 init_db();
 
@@ -25601,7 +26190,6 @@ function stopAuditGc() {
 init_db();
 init_resolver();
 init_context_key();
-init_secret_scrubber();
 
 // src/github/mentions.ts
 var GITHUB_BOT_NAME = process.env.GITHUB_BOT_NAME || "agent-swarm-bot";
@@ -25620,12 +26208,12 @@ function computeMentionPattern(names) {
 }
 var BOT_NAMES = computeBotNames();
 var MENTION_PATTERN = computeMentionPattern(BOT_NAMES);
-function detectMention(text) {
+function detectMention2(text) {
   if (!text)
     return false;
   return MENTION_PATTERN.test(text);
 }
-function extractMentionContext(text) {
+function extractMentionContext2(text) {
   if (!text)
     return "";
   return text.replace(MENTION_PATTERN, "").trim();
@@ -26068,7 +26656,7 @@ Related task: {{related_task_id}}
 });
 
 // src/github/handlers.ts
-var processedEvents2 = new Map;
+var processedEvents3 = new Map;
 var EVENT_TTL2 = 60000;
 function buildGithubContextKey(fullName, kind, number3) {
   const [owner, repo] = fullName.split("/");
@@ -26112,34 +26700,34 @@ function getCommandSuggestions(taskType, targetType) {
       return "";
   }
 }
-function isDuplicate2(eventKey) {
+function isDuplicate3(eventKey) {
   const now = Date.now();
-  for (const [key, timestamp] of processedEvents2) {
+  for (const [key, timestamp] of processedEvents3) {
     if (now - timestamp > EVENT_TTL2) {
-      processedEvents2.delete(key);
+      processedEvents3.delete(key);
     }
   }
-  if (processedEvents2.has(eventKey)) {
+  if (processedEvents3.has(eventKey)) {
     return true;
   }
-  processedEvents2.set(eventKey, now);
+  processedEvents3.set(eventKey, now);
   return false;
 }
-async function findLeadAgent2() {
+async function findLeadAgent3() {
   const agents = await getAllAgents();
   const onlineLead = agents.find((a) => a.isLead && a.status !== "offline");
   if (onlineLead)
     return onlineLead;
   return agents.find((a) => a.isLead) ?? null;
 }
-var UNMAPPED_NAMESPACE = "integration:unmapped:github";
-var UNMAPPED_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+var UNMAPPED_NAMESPACE2 = "integration:unmapped:github";
+var UNMAPPED_TTL_MS2 = 30 * 24 * 60 * 60 * 1000;
 async function resolveGitHubSender(login, sampleEventType, sampleContext) {
   const existing = await findUserByExternalId("github", login);
   if (existing)
     return existing.id;
   await upsertKv({
-    namespace: UNMAPPED_NAMESPACE,
+    namespace: UNMAPPED_NAMESPACE2,
     key: `${login}:meta`,
     value: {
       lastSeenAt: new Date().toISOString(),
@@ -26147,9 +26735,9 @@ async function resolveGitHubSender(login, sampleEventType, sampleContext) {
       sampleContext: sampleContext.slice(0, 100)
     },
     valueType: "json",
-    expiresAt: Date.now() + UNMAPPED_TTL_MS
+    expiresAt: Date.now() + UNMAPPED_TTL_MS2
   });
-  await incrKv(UNMAPPED_NAMESPACE, `${login}:count`, 1);
+  await incrKv(UNMAPPED_NAMESPACE2, `${login}:count`, 1);
   return;
 }
 async function handlePullRequest(event) {
@@ -26168,10 +26756,10 @@ async function handlePullRequest(event) {
       return { created: false };
     }
     const eventKey2 = `pr-assigned:${repository.full_name}:${pr.number}`;
-    if (isDuplicate2(eventKey2)) {
+    if (isDuplicate3(eventKey2)) {
       return { created: false };
     }
-    const lead2 = await findLeadAgent2();
+    const lead2 = await findLeadAgent3();
     const result2 = resolveTemplate("github.pull_request.assigned", {
       pr_number: pr.number,
       pr_title: pr.title,
@@ -26207,9 +26795,7 @@ async function handlePullRequest(event) {
     } else {
       console.log(`[GitHub] Created unassigned task ${task2.id} for PR #${pr.number} (assigned, no lead available)`);
     }
-    if (installation?.id) {
-      addIssueReaction(repository.full_name, pr.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
+    addEyesReactionToTaskSource(task2).catch(() => {});
     return { created: true, taskId: task2.id };
   }
   if (action === "unassigned") {
@@ -26237,7 +26823,7 @@ async function handlePullRequest(event) {
       return { created: false };
     }
     const eventKey2 = `pr-review-requested:${repository.full_name}:${pr.number}`;
-    if (isDuplicate2(eventKey2)) {
+    if (isDuplicate3(eventKey2)) {
       return { created: false };
     }
     const existingTask = await findTaskByVcs(repository.full_name, pr.number);
@@ -26245,7 +26831,7 @@ async function handlePullRequest(event) {
       console.log(`[GitHub] Skipping review task for PR #${pr.number} — active task ${existingTask.id} already exists`);
       return { created: false };
     }
-    const lead2 = await findLeadAgent2();
+    const lead2 = await findLeadAgent3();
     const result2 = resolveTemplate("github.pull_request.review_requested", {
       pr_number: pr.number,
       pr_title: pr.title,
@@ -26281,9 +26867,7 @@ async function handlePullRequest(event) {
     } else {
       console.log(`[GitHub] Created unassigned task ${task2.id} for PR #${pr.number} (review requested, no lead available)`);
     }
-    if (installation?.id) {
-      addIssueReaction(repository.full_name, pr.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
+    addEyesReactionToTaskSource(task2).catch(() => {});
     return { created: true, taskId: task2.id };
   }
   if (action === "review_request_removed") {
@@ -26312,10 +26896,10 @@ async function handlePullRequest(event) {
       return { created: false };
     }
     const eventKey2 = `pr-labeled:${repository.full_name}:${pr.number}:${labelName}`;
-    if (isDuplicate2(eventKey2)) {
+    if (isDuplicate3(eventKey2)) {
       return { created: false };
     }
-    const lead2 = await findLeadAgent2();
+    const lead2 = await findLeadAgent3();
     const result2 = resolveTemplate("github.pull_request.labeled", {
       pr_number: pr.number,
       pr_title: pr.title,
@@ -26351,9 +26935,7 @@ async function handlePullRequest(event) {
     } else {
       console.log(`[GitHub] Created unassigned task ${task2.id} for PR #${pr.number} (labeled: ${labelName}, no lead available)`);
     }
-    if (installation?.id) {
-      addIssueReaction(repository.full_name, pr.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
+    addEyesReactionToTaskSource(task2).catch(() => {});
     return { created: true, taskId: task2.id };
   }
   if (action === "closed") {
@@ -26367,16 +26949,16 @@ async function handlePullRequest(event) {
   if (action !== "opened" && action !== "edited") {
     return { created: false };
   }
-  const hasMention = detectMention(pr.title) || detectMention(pr.body);
+  const hasMention = detectMention2(pr.title) || detectMention2(pr.body);
   if (!hasMention) {
     return { created: false };
   }
   const eventKey = `pr:${repository.full_name}:${pr.number}:${action}`;
-  if (isDuplicate2(eventKey)) {
+  if (isDuplicate3(eventKey)) {
     return { created: false };
   }
-  const lead = await findLeadAgent2();
-  const context = extractMentionContext(pr.body) || pr.title;
+  const lead = await findLeadAgent3();
+  const context = extractMentionContext2(pr.body) || pr.title;
   const result = resolveTemplate("github.pull_request.mentioned", {
     pr_number: pr.number,
     pr_title: pr.title,
@@ -26411,9 +26993,7 @@ async function handlePullRequest(event) {
   } else {
     console.log(`[GitHub] Created unassigned task ${task.id} for PR #${pr.number} (no lead available)`);
   }
-  if (installation?.id) {
-    addIssueReaction(repository.full_name, pr.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-  }
+  addEyesReactionToTaskSource(task).catch(() => {});
   return { created: true, taskId: task.id };
 }
 async function handleIssue(event) {
@@ -26424,10 +27004,10 @@ async function handleIssue(event) {
       return { created: false };
     }
     const eventKey2 = `issue-assigned:${repository.full_name}:${issue.number}`;
-    if (isDuplicate2(eventKey2)) {
+    if (isDuplicate3(eventKey2)) {
       return { created: false };
     }
-    const lead2 = await findLeadAgent2();
+    const lead2 = await findLeadAgent3();
     const result2 = resolveTemplate("github.issue.assigned", {
       issue_number: issue.number,
       issue_title: issue.title,
@@ -26461,9 +27041,7 @@ async function handleIssue(event) {
     } else {
       console.log(`[GitHub] Created unassigned task ${task2.id} for issue #${issue.number} (assigned, no lead available)`);
     }
-    if (installation?.id) {
-      addIssueReaction(repository.full_name, issue.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
+    addEyesReactionToTaskSource(task2).catch(() => {});
     return { created: true, taskId: task2.id };
   }
   if (action === "unassigned") {
@@ -26492,10 +27070,10 @@ async function handleIssue(event) {
       return { created: false };
     }
     const eventKey2 = `issue-labeled:${repository.full_name}:${issue.number}:${labelName}`;
-    if (isDuplicate2(eventKey2)) {
+    if (isDuplicate3(eventKey2)) {
       return { created: false };
     }
-    const lead2 = await findLeadAgent2();
+    const lead2 = await findLeadAgent3();
     const result2 = resolveTemplate("github.issue.labeled", {
       issue_number: issue.number,
       issue_title: issue.title,
@@ -26529,24 +27107,22 @@ async function handleIssue(event) {
     } else {
       console.log(`[GitHub] Created unassigned task ${task2.id} for issue #${issue.number} (labeled: ${labelName}, no lead available)`);
     }
-    if (installation?.id) {
-      addIssueReaction(repository.full_name, issue.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
+    addEyesReactionToTaskSource(task2).catch(() => {});
     return { created: true, taskId: task2.id };
   }
   if (action !== "opened" && action !== "edited") {
     return { created: false };
   }
-  const hasMention = detectMention(issue.title) || detectMention(issue.body);
+  const hasMention = detectMention2(issue.title) || detectMention2(issue.body);
   if (!hasMention) {
     return { created: false };
   }
   const eventKey = `issue:${repository.full_name}:${issue.number}:${action}`;
-  if (isDuplicate2(eventKey)) {
+  if (isDuplicate3(eventKey)) {
     return { created: false };
   }
-  const lead = await findLeadAgent2();
-  const context = extractMentionContext(issue.body) || issue.title;
+  const lead = await findLeadAgent3();
+  const context = extractMentionContext2(issue.body) || issue.title;
   const result = resolveTemplate("github.issue.mentioned", {
     issue_number: issue.number,
     issue_title: issue.title,
@@ -26579,9 +27155,7 @@ async function handleIssue(event) {
   } else {
     console.log(`[GitHub] Created unassigned task ${task.id} for issue #${issue.number} (no lead available)`);
   }
-  if (installation?.id) {
-    addIssueReaction(repository.full_name, issue.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-  }
+  addEyesReactionToTaskSource(task).catch(() => {});
   return { created: true, taskId: task.id };
 }
 async function handleComment(event, eventType) {
@@ -26590,21 +27164,21 @@ async function handleComment(event, eventType) {
   if (action !== "created") {
     return { created: false };
   }
-  if (!detectMention(comment.body)) {
+  if (!detectMention2(comment.body)) {
     return { created: false };
   }
   const eventKey = `comment:${repository.full_name}:${comment.id}`;
-  if (isDuplicate2(eventKey)) {
+  if (isDuplicate3(eventKey)) {
     return { created: false };
   }
-  const lead = await findLeadAgent2();
+  const lead = await findLeadAgent3();
   const target = pull_request || issue;
   const targetType = pull_request ? "PR" : "Issue";
   const targetNumber = target?.number ?? 0;
   const targetTitle = target?.title ?? "Unknown";
   const targetUrl = target?.html_url ?? comment.html_url;
   const existingTask = targetNumber ? await findTaskByVcs(repository.full_name, targetNumber) : null;
-  const context = extractMentionContext(comment.body);
+  const context = extractMentionContext2(comment.body);
   const suggestions = getCommandSuggestions("github-comment", targetType);
   const relatedTaskSection = existingTask ? `Related task: ${existingTask.id}
 \uD83D\uDD00 Consider routing to the same agent working on the related task.
@@ -26646,9 +27220,7 @@ async function handleComment(event, eventType) {
   } else {
     console.log(`[GitHub] Created unassigned task ${task.id} for comment on #${targetNumber} (no lead available)`);
   }
-  if (installation?.id) {
-    addReaction(repository.full_name, comment.id, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add comment reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-  }
+  addEyesReactionToTaskSource(task).catch(() => {});
   return { created: true, taskId: task.id };
 }
 function parseNextPageLink(linkHeader) {
@@ -26667,12 +27239,12 @@ function buildReviewCommentsHeaders(token) {
     "X-GitHub-Api-Version": "2022-11-28"
   };
 }
-async function fetchPaginatedReviewComments(initialUrl, headers) {
+async function fetchPaginatedReviewComments(initialUrl, headers2) {
   const allComments = [];
   let url = initialUrl;
   try {
     while (url) {
-      const response = await fetch(url, { headers });
+      const response = await fetch(url, { headers: headers2 });
       if (!response.ok) {
         console.error(`[GitHub] Failed to fetch review inline comments: ${response.status}`);
         return { comments: allComments, degraded: true };
@@ -26689,24 +27261,24 @@ async function fetchPaginatedReviewComments(initialUrl, headers) {
     return { comments: allComments, degraded: true };
   }
 }
-async function fetchReviewScopedComments(repo, prNumber, reviewId, headers) {
+async function fetchReviewScopedComments(repo, prNumber, reviewId, headers2) {
   const url = `https://api.github.com/repos/${repo}/pulls/${prNumber}/reviews/${reviewId}/comments?per_page=100`;
-  let result = await fetchPaginatedReviewComments(url, headers);
+  let result = await fetchPaginatedReviewComments(url, headers2);
   if (result.degraded || result.comments.length > 0) {
     return result;
   }
   for (const delayMs of REVIEW_COMMENTS_EMPTY_RETRY_DELAYS_MS) {
     await reviewCommentsRetryDelay(delayMs);
-    result = await fetchPaginatedReviewComments(url, headers);
+    result = await fetchPaginatedReviewComments(url, headers2);
     if (result.degraded || result.comments.length > 0) {
       return result;
     }
   }
   return result;
 }
-async function fetchPrLevelReviewComments(repo, prNumber, reviewId, headers) {
+async function fetchPrLevelReviewComments(repo, prNumber, reviewId, headers2) {
   const url = `https://api.github.com/repos/${repo}/pulls/${prNumber}/comments?per_page=100`;
-  const result = await fetchPaginatedReviewComments(url, headers);
+  const result = await fetchPaginatedReviewComments(url, headers2);
   return {
     comments: result.comments.filter((comment) => comment.pull_request_review_id === reviewId),
     degraded: result.degraded
@@ -26726,12 +27298,12 @@ async function fetchReviewComments(repo, prNumber, reviewId, installationId) {
   if (!token) {
     return { comments: [], degraded: true };
   }
-  const headers = buildReviewCommentsHeaders(token);
-  const scopedResult = await fetchReviewScopedComments(repo, prNumber, reviewId, headers);
+  const headers2 = buildReviewCommentsHeaders(token);
+  const scopedResult = await fetchReviewScopedComments(repo, prNumber, reviewId, headers2);
   if (!scopedResult.degraded && scopedResult.comments.length > 0) {
     return scopedResult;
   }
-  const fallbackResult = await fetchPrLevelReviewComments(repo, prNumber, reviewId, headers);
+  const fallbackResult = await fetchPrLevelReviewComments(repo, prNumber, reviewId, headers2);
   const mergedComments = dedupeReviewComments([
     ...scopedResult.comments,
     ...fallbackResult.comments
@@ -26782,7 +27354,7 @@ async function handlePullRequestReview(event) {
     return { created: false };
   }
   const eventKey = `pr-review:${repository.full_name}:${pr.number}:${review.id}`;
-  if (isDuplicate2(eventKey)) {
+  if (isDuplicate3(eventKey)) {
     return { created: false };
   }
   const { comments: inlineComments, degraded } = installation?.id ? await fetchReviewComments(repository.full_name, pr.number, review.id, installation.id) : { comments: [], degraded: true };
@@ -26794,7 +27366,7 @@ async function handlePullRequestReview(event) {
   if (!isBotCreator && !existingTask) {
     return { created: false };
   }
-  const lead = await findLeadAgent2();
+  const lead = await findLeadAgent3();
   const { emoji, label } = getReviewStateInfo(review.state);
   const reviewBodySection = review.body ? `
 
@@ -26846,9 +27418,7 @@ ${review.body}` : "";
   } else {
     console.log(`[GitHub] Created unassigned task ${task.id} for PR #${pr.number} review (${review.state}, no lead available)`);
   }
-  if (installation?.id) {
-    addIssueReaction(repository.full_name, pr.number, "eyes", installation.id).catch((err) => console.error("[GitHub] failed to add issue reaction:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-  }
+  addEyesReactionToTaskSource(task).catch(() => {});
   return { created: true, taskId: task.id };
 }
 async function handleCheckRun(event) {
@@ -26871,46 +27441,46 @@ async function handleWorkflowRun(event) {
 }
 // src/gitlab/auth.ts
 init_env_flag();
-var initialized3 = false;
-var webhookSecret3 = null;
-var apiToken = null;
+var initialized4 = false;
+var webhookSecret4 = null;
+var apiToken2 = null;
 var gitlabUrl = "https://gitlab.com";
 function isGitLabEnabled() {
   return !!process.env.GITLAB_WEBHOOK_SECRET && !isEnvFlagEnabled("GITLAB_DISABLE", false);
 }
 function initGitLab() {
-  if (initialized3)
+  if (initialized4)
     return;
   if (!isGitLabEnabled()) {
     console.log("[GitLab] Integration disabled (GITLAB_WEBHOOK_SECRET not set)");
     return;
   }
-  webhookSecret3 = process.env.GITLAB_WEBHOOK_SECRET;
-  apiToken = process.env.GITLAB_TOKEN ?? null;
+  webhookSecret4 = process.env.GITLAB_WEBHOOK_SECRET;
+  apiToken2 = process.env.GITLAB_TOKEN ?? null;
   gitlabUrl = process.env.GITLAB_URL ?? "https://gitlab.com";
-  initialized3 = true;
+  initialized4 = true;
   console.log(`[GitLab] Integration initialized (url: ${gitlabUrl})`);
 }
 function verifyGitLabWebhook(tokenHeader) {
-  if (!webhookSecret3)
+  if (!webhookSecret4)
     return false;
   if (!tokenHeader)
     return false;
-  if (tokenHeader.length !== webhookSecret3.length)
+  if (tokenHeader.length !== webhookSecret4.length)
     return false;
-  return crypto.timingSafeEqual(Buffer.from(tokenHeader), Buffer.from(webhookSecret3));
+  return crypto.timingSafeEqual(Buffer.from(tokenHeader), Buffer.from(webhookSecret4));
 }
 function getGitLabToken() {
-  return apiToken;
+  return apiToken2;
 }
 function getGitLabUrl() {
   return gitlabUrl;
 }
 var GITLAB_BOT_NAME = process.env.GITLAB_BOT_NAME ?? "agent-swarm-bot";
 function resetGitLab() {
-  initialized3 = false;
-  webhookSecret3 = null;
-  apiToken = null;
+  initialized4 = false;
+  webhookSecret4 = null;
+  apiToken2 = null;
   gitlabUrl = "https://gitlab.com";
 }
 // src/gitlab/handlers.ts
@@ -26919,7 +27489,7 @@ init_resolver();
 init_context_key();
 
 // src/gitlab/reactions.ts
-function headers() {
+function headers2() {
   const token = getGitLabToken();
   if (!token)
     throw new Error("[GitLab] No API token configured");
@@ -26940,7 +27510,7 @@ async function addGitLabReaction(project, entityType, iid, emojiName) {
   try {
     const resp = await fetch(url, {
       method: "POST",
-      headers: headers(),
+      headers: headers2(),
       body: JSON.stringify({ name: emojiName })
     });
     if (!resp.ok) {
@@ -26956,7 +27526,7 @@ async function addGitLabNoteReaction(project, entityType, iid, noteId, emojiName
   try {
     const resp = await fetch(url, {
       method: "POST",
-      headers: headers(),
+      headers: headers2(),
       body: JSON.stringify({ name: emojiName })
     });
     if (!resp.ok) {
@@ -27080,33 +27650,33 @@ The CI pipeline has failed. Please investigate and fix the issues.{{@template[co
 });
 
 // src/gitlab/handlers.ts
-var processedEvents3 = new Map;
-var DEDUP_TTL_MS = 60000;
-function isDuplicate3(key) {
+var processedEvents4 = new Map;
+var DEDUP_TTL_MS2 = 60000;
+function isDuplicate4(key) {
   const now = Date.now();
-  for (const [k, ts] of processedEvents3) {
-    if (now - ts > DEDUP_TTL_MS)
-      processedEvents3.delete(k);
+  for (const [k, ts] of processedEvents4) {
+    if (now - ts > DEDUP_TTL_MS2)
+      processedEvents4.delete(k);
   }
-  if (processedEvents3.has(key))
+  if (processedEvents4.has(key))
     return true;
-  processedEvents3.set(key, now);
+  processedEvents4.set(key, now);
   return false;
 }
-function detectMention2(text) {
+function detectMention3(text) {
   if (!text)
     return false;
   return new RegExp(`@${GITLAB_BOT_NAME}\\b`, "i").test(text);
 }
-function extractMentionContext2(text) {
+function extractMentionContext3(text) {
   return text.replace(new RegExp(`@${GITLAB_BOT_NAME}\\b`, "gi"), "").trim();
 }
-async function findLeadAgent3() {
+async function findLeadAgent4() {
   const agents = await getAllAgents();
   return agents.find((a) => a.role === "lead" && a.status === "idle") ?? agents.find((a) => a.role === "lead") ?? null;
 }
-var UNMAPPED_NAMESPACE2 = "integration:unmapped:gitlab";
-var UNMAPPED_TTL_MS2 = 30 * 24 * 60 * 60 * 1000;
+var UNMAPPED_NAMESPACE3 = "integration:unmapped:gitlab";
+var UNMAPPED_TTL_MS3 = 30 * 24 * 60 * 60 * 1000;
 var GITLAB_WEBHOOK_ACTOR = { kind: "system", id: "webhook:gitlab" };
 async function resolveGitLabSender(user, sampleEventType, sampleContext) {
   const existing = await findUserByExternalId("gitlab", user.username);
@@ -27119,7 +27689,7 @@ async function resolveGitLabSender(user, sampleEventType, sampleContext) {
     return linked.id;
   }
   await upsertKv({
-    namespace: UNMAPPED_NAMESPACE2,
+    namespace: UNMAPPED_NAMESPACE3,
     key: `${user.username}:meta`,
     value: {
       lastSeenAt: new Date().toISOString(),
@@ -27127,9 +27697,9 @@ async function resolveGitLabSender(user, sampleEventType, sampleContext) {
       sampleContext: sampleContext.slice(0, 100)
     },
     valueType: "json",
-    expiresAt: Date.now() + UNMAPPED_TTL_MS2
+    expiresAt: Date.now() + UNMAPPED_TTL_MS3
   });
-  await incrKv(UNMAPPED_NAMESPACE2, `${user.username}:count`, 1);
+  await incrKv(UNMAPPED_NAMESPACE3, `${user.username}:count`, 1);
   return;
 }
 async function renderGitLabIdentity(username) {
@@ -27142,19 +27712,19 @@ async function handleMergeRequest(event) {
   const requestedByUserId = await resolveGitLabSender(user, "merge_request", `MR !${mr.iid}: ${mr.title}`);
   console.log(`[GitLab] MR #${mr.iid} ${action} by ${user.username} in ${repo}`);
   const dedupKey = `gitlab-mr-${repo}-${mr.iid}-${action}-${user.username}`;
-  if (isDuplicate3(dedupKey)) {
+  if (isDuplicate4(dedupKey)) {
     console.log(`[GitLab] Skipping duplicate MR event`);
     return { created: false };
   }
-  const lead = await findLeadAgent3();
+  const lead = await findLeadAgent4();
   switch (action) {
     case "open": {
-      const hasMention = detectMention2(mr.description);
+      const hasMention = detectMention3(mr.description);
       if (!hasMention) {
         console.log(`[GitLab] MR opened without bot mention, skipping`);
         return { created: false };
       }
-      const context = mr.description ? extractMentionContext2(mr.description) : "";
+      const context = mr.description ? extractMentionContext3(mr.description) : "";
       const contextSection = context ? `Context: ${context}
 
 ` : "";
@@ -27226,13 +27796,13 @@ async function handleIssue2(event) {
   const requestedByUserId = await resolveGitLabSender(user, "issue", `Issue #${issue.iid}: ${issue.title}`);
   console.log(`[GitLab] Issue #${issue.iid} ${action} by ${user.username} in ${repo}`);
   const dedupKey = `gitlab-issue-${repo}-${issue.iid}-${action}-${user.username}`;
-  if (isDuplicate3(dedupKey)) {
+  if (isDuplicate4(dedupKey)) {
     return { created: false };
   }
-  const lead = await findLeadAgent3();
+  const lead = await findLeadAgent4();
   switch (action) {
     case "open": {
-      const hasMention = detectMention2(issue.description);
+      const hasMention = detectMention3(issue.description);
       if (!hasMention) {
         const isBotAssigned = event.assignees?.some((a) => a.username.toLowerCase() === GITLAB_BOT_NAME.toLowerCase());
         if (!isBotAssigned) {
@@ -27240,7 +27810,7 @@ async function handleIssue2(event) {
           return { created: false };
         }
       }
-      const context = issue.description ? extractMentionContext2(issue.description) : "";
+      const context = issue.description ? extractMentionContext3(issue.description) : "";
       const contextSection = context ? `Context: ${context}
 
 ` : "";
@@ -27296,16 +27866,16 @@ async function handleNote(event) {
   const { user, project, object_attributes: note } = event;
   const repo = project.path_with_namespace;
   const requestedByUserId = await resolveGitLabSender(user, "note", note.note);
-  if (!detectMention2(note.note)) {
+  if (!detectMention3(note.note)) {
     return { created: false };
   }
   console.log(`[GitLab] Note by ${user.username} in ${repo} (${note.noteable_type})`);
   const dedupKey = `gitlab-note-${note.id}`;
-  if (isDuplicate3(dedupKey)) {
+  if (isDuplicate4(dedupKey)) {
     return { created: false };
   }
-  const lead = await findLeadAgent3();
-  const context = extractMentionContext2(note.note);
+  const lead = await findLeadAgent4();
+  const context = extractMentionContext3(note.note);
   let targetNumber;
   let targetUrl;
   let eventType;
@@ -27379,14 +27949,14 @@ async function handlePipeline(event) {
   }
   const mrIid = event.merge_request.iid;
   const dedupKey = `gitlab-pipeline-${pipeline2.id}`;
-  if (isDuplicate3(dedupKey)) {
+  if (isDuplicate4(dedupKey)) {
     return { created: false };
   }
   const existingTask = await findTaskByVcs(repo, mrIid);
   if (!existingTask) {
     return { created: false };
   }
-  const lead = await findLeadAgent3();
+  const lead = await findLeadAgent4();
   const pipelineResult = resolveTemplate("gitlab.pipeline.failed", {
     pipeline_id: pipeline2.id,
     mr_iid: mrIid,
@@ -27748,14 +28318,14 @@ async function jiraFetch(path, init) {
   const send = async (token2) => {
     const cloudId = await getJiraCloudId();
     const url = `https://api.atlassian.com/ex/jira/${cloudId}${path}`;
-    const headers2 = new Headers(init?.headers);
-    headers2.set("Authorization", `Bearer ${token2}`);
-    if (!headers2.has("Accept"))
-      headers2.set("Accept", "application/json");
-    if (init?.body && !headers2.has("Content-Type")) {
-      headers2.set("Content-Type", "application/json");
-    }
-    return fetch(url, { ...init, headers: headers2 });
+    const headers3 = new Headers(init?.headers);
+    headers3.set("Authorization", `Bearer ${token2}`);
+    if (!headers3.has("Accept"))
+      headers3.set("Accept", "application/json");
+    if (init?.body && !headers3.has("Content-Type")) {
+      headers3.set("Content-Type", "application/json");
+    }
+    return fetch(url, { ...init, headers: headers3 });
   };
   let token = await getJiraAccessToken();
   let response = await send(token);
@@ -28079,7 +28649,7 @@ async function resolveBotAccountId() {
 function resetBotAccountIdCache() {
   setCachedBotAccountId(null);
 }
-async function findLeadAgent4() {
+async function findLeadAgent5() {
   const agents = await getAllAgents();
   const onlineLead = agents.find((a) => a.isLead && a.status !== "offline");
   if (onlineLead)
@@ -28283,7 +28853,7 @@ async function handleIssueDeleteEvent(event) {
   }
 }
 async function createInitialJiraTask(input) {
-  const lead = await findLeadAgent4();
+  const lead = await findLeadAgent5();
   const descriptionSection = input.descriptionText ? `
 Description:
 ${input.descriptionText}
@@ -28321,7 +28891,7 @@ ${input.descriptionText}
   console.log(`[Jira Sync] Created ${action} task ${task.id} for ${input.issueKey} -> ${lead?.name ?? "unassigned"}`);
 }
 async function createCommentMentionTask(input) {
-  const lead = await findLeadAgent4();
+  const lead = await findLeadAgent5();
   const descriptionSection = input.descriptionText ? `
 Description:
 ${input.descriptionText}
@@ -28381,7 +28951,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-y1b9srva.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-0hdqa4k1.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -28452,7 +29022,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-s3znhvbn.js");
+  const { getDbClient: getDbClient2 } = await import("./db-d2pvjpyt.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -28559,7 +29129,7 @@ function stopJiraWebhookKeepalive() {
 }
 
 // src/jira/app.ts
-var initialized4 = false;
+var initialized5 = false;
 function isJiraEnabled() {
   const disabled = process.env.JIRA_DISABLE;
   if (disabled === "true" || disabled === "1")
@@ -28573,12 +29143,12 @@ function resetJira() {
   resetBotAccountIdCache();
   teardownJiraOutboundSync();
   stopJiraWebhookKeepalive();
-  initialized4 = false;
+  initialized5 = false;
 }
 async function initJira() {
-  if (initialized4)
+  if (initialized5)
     return isJiraEnabled();
-  initialized4 = true;
+  initialized5 = true;
   if (!isJiraEnabled()) {
     console.log("[Jira] Integration disabled or JIRA_CLIENT_ID not set");
     return false;
@@ -28799,14 +29369,14 @@ var InvalidInputLinearError = class extends LinearError {
 var RatelimitedLinearError = class extends LinearError {
   constructor(error, errors) {
     super(error, errors, LinearErrorType.Ratelimited);
-    const headers2 = error?.response?.headers;
-    this.retryAfter = this.parseNumber(headers2?.get("retry-after"));
-    this.requestsLimit = this.parseNumber(headers2?.get("x-ratelimit-requests-limit"));
-    this.requestsRemaining = this.parseNumber(headers2?.get("x-ratelimit-requests-remaining"));
-    this.requestsResetAt = this.parseNumber(headers2?.get("x-ratelimit-requests-reset"));
-    this.complexityLimit = this.parseNumber(headers2?.get("x-ratelimit-complexity-limit"));
-    this.complexityRemaining = this.parseNumber(headers2?.get("x-ratelimit-complexity-remaining"));
-    this.complexityResetAt = this.parseNumber(headers2?.get("x-ratelimit-complexity-reset"));
+    const headers3 = error?.response?.headers;
+    this.retryAfter = this.parseNumber(headers3?.get("retry-after"));
+    this.requestsLimit = this.parseNumber(headers3?.get("x-ratelimit-requests-limit"));
+    this.requestsRemaining = this.parseNumber(headers3?.get("x-ratelimit-requests-remaining"));
+    this.requestsResetAt = this.parseNumber(headers3?.get("x-ratelimit-requests-reset"));
+    this.complexityLimit = this.parseNumber(headers3?.get("x-ratelimit-complexity-limit"));
+    this.complexityRemaining = this.parseNumber(headers3?.get("x-ratelimit-complexity-remaining"));
+    this.complexityResetAt = this.parseNumber(headers3?.get("x-ratelimit-complexity-reset"));
   }
   retryAfter;
   requestsLimit;
@@ -29829,7 +30399,7 @@ var LinearGraphQLClient = class {
     this.options = options || {};
   }
   async rawRequest(query, variables, requestHeaders) {
-    const { headers: headers2, ...others } = this.options;
+    const { headers: headers3, ...others } = this.options;
     const body = JSON.stringify({
       query,
       variables
@@ -29839,7 +30409,7 @@ var LinearGraphQLClient = class {
       method: "POST",
       headers: {
         ...typeof body === "string" ? { "Content-Type": "application/json" } : {},
-        ...resolveHeaders(headers2),
+        ...resolveHeaders(headers3),
         ...resolveHeaders(requestHeaders)
       },
       body,
@@ -29863,7 +30433,7 @@ var LinearGraphQLClient = class {
       }));
   }
   async request(document2, variables, requestHeaders) {
-    const { headers: headers2, ...others } = this.options;
+    const { headers: headers3, ...others } = this.options;
     const query = typeof document2 === "string" ? document2 : (0, import_printer.print)(document2);
     const body = JSON.stringify({
       query,
@@ -29873,7 +30443,7 @@ var LinearGraphQLClient = class {
       method: "POST",
       headers: {
         ...typeof body === "string" ? { "Content-Type": "application/json" } : {},
-        ...resolveHeaders(headers2),
+        ...resolveHeaders(headers3),
         ...resolveHeaders(requestHeaders)
       },
       body,
@@ -29892,14 +30462,14 @@ var LinearGraphQLClient = class {
         variables
       });
   }
-  setHeaders(headers2) {
-    this.options.headers = headers2;
+  setHeaders(headers3) {
+    this.options.headers = headers3;
     return this;
   }
   setHeader(key, value) {
-    const { headers: headers2 } = this.options;
-    if (headers2)
-      headers2[key] = value;
+    const { headers: headers3 } = this.options;
+    if (headers3)
+      headers3[key] = value;
     else
       this.options.headers = { [key]: value };
     return this;
@@ -29912,22 +30482,22 @@ function getResult(response) {
   else
     return response.text();
 }
-function resolveHeaders(headers2) {
+function resolveHeaders(headers3) {
   let oHeaders = {};
-  if (headers2)
-    if (typeof Headers !== "undefined" && headers2 instanceof Headers)
-      oHeaders = headersToObject(headers2);
-    else if (Array.isArray(headers2))
-      headers2.forEach(([name, value]) => {
+  if (headers3)
+    if (typeof Headers !== "undefined" && headers3 instanceof Headers)
+      oHeaders = headersToObject(headers3);
+    else if (Array.isArray(headers3))
+      headers3.forEach(([name, value]) => {
         oHeaders[name] = value;
       });
     else
-      oHeaders = headers2;
+      oHeaders = headers3;
   return oHeaders;
 }
-function headersToObject(headers2) {
+function headersToObject(headers3) {
   const o = {};
-  headers2.forEach((v, k) => {
+  headers3.forEach((v, k) => {
     o[k] = v;
   });
   return o;
@@ -93790,8 +94360,8 @@ var IssueVcsBranchSearchQuery = class extends Request2 {
   constructor(request) {
     super(request);
   }
-  async fetch(branchName) {
-    const data = (await this._request(IssueVcsBranchSearchDocument.toString(), { branchName })).issueVcsBranchSearch;
+  async fetch(branchName2) {
+    const data = (await this._request(IssueVcsBranchSearchDocument.toString(), { branchName: branchName2 })).issueVcsBranchSearch;
     return data ? new Issue(this._request, data) : undefined;
   }
 };
@@ -99124,8 +99694,8 @@ var LinearSdk = class extends Request2 {
   issueTitleSuggestionFromCustomerRequest(request) {
     return new IssueTitleSuggestionFromCustomerRequestQuery(this._request).fetch(request);
   }
-  issueVcsBranchSearch(branchName) {
-    return new IssueVcsBranchSearchQuery(this._request).fetch(branchName);
+  issueVcsBranchSearch(branchName2) {
+    return new IssueVcsBranchSearchQuery(this._request).fetch(branchName2);
   }
   issues(variables) {
     return new IssuesQuery(this._request).fetch(variables);
@@ -100142,13 +100712,13 @@ var LinearSdk = class extends Request2 {
     return new UpdateWorkflowStateMutation(this._request).fetch(id, input);
   }
 };
-function parseClientOptions({ apiKey, accessToken, apiUrl, headers: headers2, ...opts }) {
+function parseClientOptions({ apiKey, accessToken, apiUrl, headers: headers3, ...opts }) {
   if (!accessToken && !apiKey)
     throw new Error("No accessToken or apiKey provided to the LinearClient - create one here: https://linear.app/settings/account/security");
   return {
     headers: {
       Authorization: accessToken ? accessToken.startsWith("Bearer ") ? accessToken : `Bearer ${accessToken}` : apiKey ?? "",
-      ...headers2,
+      ...headers3,
       "User-Agent": serializeUserAgent({ [process.env.npm_package_name ?? "@linear/sdk"]: process.env.npm_package_version ?? "unknown" })
     },
     apiUrl: apiUrl ?? "https://api.linear.app/graphql",
@@ -100464,15 +101034,15 @@ async function _fetchIssueGatingInfo(issueId) {
   const labelNames = (json.data?.issue?.labels?.nodes ?? []).map((n) => n?.name ?? "").filter((n) => n.length > 0);
   return { stateType, labelNames };
 }
-async function findLeadAgent5() {
+async function findLeadAgent6() {
   const agents = await getAllAgents();
   const onlineLead = agents.find((a) => a.isLead && a.status !== "offline");
   if (onlineLead)
     return onlineLead;
   return agents.find((a) => a.isLead) ?? null;
 }
-var UNMAPPED_NAMESPACE3 = "integration:unmapped:linear";
-var UNMAPPED_TTL_MS3 = 30 * 24 * 60 * 60 * 1000;
+var UNMAPPED_NAMESPACE4 = "integration:unmapped:linear";
+var UNMAPPED_TTL_MS4 = 30 * 24 * 60 * 60 * 1000;
 var LINEAR_WEBHOOK_ACTOR = { kind: "system", id: "webhook:linear" };
 var APP_USER_ID_NAMESPACE = "integration:linear:bot-app-user-id";
 async function getStoredAppUserId(workspaceId) {
@@ -100503,7 +101073,7 @@ async function resolveLinearActor(linearUserId, email, name, workspaceId, sample
     return linked.id;
   }
   await upsertKv({
-    namespace: UNMAPPED_NAMESPACE3,
+    namespace: UNMAPPED_NAMESPACE4,
     key: `${linearUserId}:meta`,
     value: {
       lastSeenAt: new Date().toISOString(),
@@ -100511,9 +101081,9 @@ async function resolveLinearActor(linearUserId, email, name, workspaceId, sample
       sampleContext: sampleContext ? sampleContext.slice(0, 100) : null
     },
     valueType: "json",
-    expiresAt: Date.now() + UNMAPPED_TTL_MS3
+    expiresAt: Date.now() + UNMAPPED_TTL_MS4
   });
-  await incrKv(UNMAPPED_NAMESPACE3, `${linearUserId}:count`, 1);
+  await incrKv(UNMAPPED_NAMESPACE4, `${linearUserId}:count`, 1);
   return;
 }
 async function handleAgentSessionEvent(event) {
@@ -100584,7 +101154,7 @@ async function handleAgentSessionEvent(event) {
     }
     return;
   }
-  const lead = await findLeadAgent5();
+  const lead = await findLeadAgent6();
   const sessionSection = sessionUrl ? `
 Session: ${sessionUrl}` : "";
   const descriptionSection = issueDescription ? `
@@ -100785,7 +101355,7 @@ async function handleAgentSessionPrompted(event) {
       return;
     }
   }
-  const lead = await findLeadAgent5();
+  const lead = await findLeadAgent6();
   const activity = event.agentActivity;
   const promptUser = activity?.user;
   const promptedActorLinearId = promptUser ? String(promptUser.id ?? "") : "";
@@ -101067,7 +101637,7 @@ function shouldSkipForLoopPrevention2(sync) {
 }
 
 // src/linear/app.ts
-var initialized5 = false;
+var initialized6 = false;
 var unsubscribeRefresh = null;
 function isLinearEnabled() {
   const disabled = process.env.LINEAR_DISABLE;
@@ -101084,12 +101654,12 @@ function resetLinear() {
     unsubscribeRefresh();
     unsubscribeRefresh = null;
   }
-  initialized5 = false;
+  initialized6 = false;
 }
 async function initLinear() {
-  if (initialized5)
+  if (initialized6)
     return isLinearEnabled();
-  initialized5 = true;
+  initialized6 = true;
   if (!isLinearEnabled()) {
     console.log("[Linear] Integration disabled or LINEAR_CLIENT_ID not set");
     return false;
@@ -102184,7 +102754,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-bjmjh9h4.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-k4nj18qs.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await stopSlackApp();
@@ -102197,10 +102767,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-48d2qpkt.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-gt5gjkt4.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-w0bryhkr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-xy9t7avg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -102214,6 +102784,11 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
   initGitLab();
   if (isGitLabEnabled())
     integrations.push("gitlab");
+  resetAzureDevOps();
+  resetAzureDevOpsBotIdCache();
+  initAzureDevOps();
+  if (isAzureDevOpsEnabled())
+    integrations.push("azure-devops");
   resetLinear();
   if (await initLinear())
     integrations.push("linear");
@@ -103013,7 +103588,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-5xn0c7rf.js");
+  const dispatcher = await import("./dispatcher-8wbwyzjg.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -105065,6 +105640,7 @@ var registerContextDiffTool = (server) => {
       fromVersion: number().optional(),
       toVersion: number().optional(),
       diff: string().optional(),
+      predecessorPruned: boolean().optional(),
       changeSource: string().optional(),
       createdAt: string().optional()
     })
@@ -105112,6 +105688,20 @@ var registerContextDiffTool = (server) => {
     } else if (version.previousVersionId) {
       compareVersion = await getContextVersion(version.previousVersionId);
     }
+    if (!compareToVersionId && !compareVersion && version.version > 1) {
+      const message = `No predecessor for ${version.field} v${version.version}: v${version.version - 1} was removed by context version retention. Pass compareToVersionId with a surviving version from context-history.`;
+      return toolOk(message, {
+        details: message,
+        data: {
+          yourAgentId: requestInfo.agentId,
+          field: version.field,
+          toVersion: version.version,
+          predecessorPruned: true,
+          changeSource: version.changeSource,
+          createdAt: version.createdAt
+        }
+      });
+    }
     const oldContent = compareVersion?.content ?? "";
     const diff = await computeDiff(oldContent, version.content);
     const fromVersion = compareVersion?.version ?? 0;
@@ -109426,8 +110016,8 @@ async function applyRating(events, ctx = {}) {
   const UPDATE_MEMORY_SQL = "UPDATE agent_memory SET alpha = alpha + ?, beta = beta + ? WHERE id = ?";
   const CHECK_EXISTS_SQL = "SELECT id FROM agent_memory WHERE id = ?";
   const INSERT_RATING_SQL = `INSERT INTO memory_rating
-       (id, memoryId, taskId, source, signal, weight, reasoning, createdAt, contextKey)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+       (id, memoryId, taskId, source, signal, weight, reasoning, createdAt, contextKey, model)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
   const UPSERT_EDGE_SQL = `INSERT INTO agent_memory_edge (from_id, to_id, type, alpha, beta, createdAt)
      VALUES (?, ?, 'references-source', ?, ?, ?)
      ON CONFLICT(from_id, to_id, type) DO UPDATE SET
@@ -109456,7 +110046,8 @@ async function applyRating(events, ctx = {}) {
           event.weight,
           event.reasoning ?? null,
           new Date().toISOString(),
-          ctx.contextKey ?? null
+          ctx.contextKey ?? null,
+          event.source === "llm" ? event.model ?? null : null
         ]);
       } catch (err) {
         if (isUniqueConstraintError(err)) {
@@ -110660,20 +111251,20 @@ async function proxySwarmApi(args) {
   if (!args.requestInfo.agentId)
     return toolErr(args.transportError);
   const apiKey = getApiKey();
-  const headers2 = {
+  const headers3 = {
     Authorization: `Bearer ${apiKey}`,
     "X-Agent-ID": args.requestInfo.agentId,
     "Content-Type": "application/json"
   };
   if (args.requestInfo.sourceTaskId) {
-    headers2["X-Source-Task-Id"] = args.requestInfo.sourceTaskId;
+    headers3["X-Source-Task-Id"] = args.requestInfo.sourceTaskId;
   }
   if (args.requestInfo.runtimeInstanceId) {
-    headers2["X-Runtime-Instance-ID"] = args.requestInfo.runtimeInstanceId;
+    headers3["X-Runtime-Instance-ID"] = args.requestInfo.runtimeInstanceId;
   }
   const res = await fetch(`${apiBaseUrl()}${args.path}`, {
     method: args.method,
-    headers: headers2,
+    headers: headers3,
     body: args.body === undefined ? undefined : JSON.stringify(args.body)
   });
   const text = await res.text();
@@ -110908,7 +111499,15 @@ var registerExtensionEnableTool = (server) => {
 
 // src/tools/extension-install.ts
 init_zod();
-var EXTENSION_INSTALL_DESCRIPTION = "Install a predefined extension by name. Only extensions in the catalog (extension-catalog, GET /api/extensions/catalog) can be installed; inline bundles are rejected. Install creates the extension, its ext:<name> agent and every asset it declares (scripts, and disabled schedules). Any authenticated agent may install; the installing agent is recorded as createdByAgentId. Workers may install subsequent versions only for their own extensions; those versions remain inactive. A new extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
+init_types();
+var EXTENSION_INSTALL_DESCRIPTION = "Install an extension from the catalog by `template` name (extension-catalog, GET /api/extensions/catalog), or from an inline bundle: `manifest` plus a `files` map keyed by bundle path. `template` and `manifest`/`files` are mutually exclusive. Inline bundles are accepted only when the deployment sets EXTENSION_ALLOW_INLINE_INSTALL=true, and only from lead, operator and dashboard-user callers. Workers are denied (403) and stay catalog-only; with the flag off the call fails with inline_install_disabled. Before writing an inline bundle, fetch the hook contract: GET /api/extensions/type-defs returns swarm-extension.d.ts. Install creates the extension, its ext:<name> agent and every asset it declares (scripts, and disabled schedules, workflows and skills). Any authenticated agent may install from the catalog; the installing agent is recorded as createdByAgentId. Workers may install subsequent versions only for their own extensions; those versions remain inactive. A new extension remains disabled until a lead, operator, or dashboard user enables it with extension-enable.";
+var extensionInstallInputSchema = object({
+  template: string().min(1).optional().describe("Name of a predefined extension from extension-catalog. Mutually exclusive with manifest and files."),
+  manifest: ExtensionManifestSchema.optional().describe("Inline bundle manifest. Requires files. Needs EXTENSION_ALLOW_INLINE_INSTALL and a lead, operator, or dashboard-user caller."),
+  files: record(string(), string()).optional().describe("Inline bundle files keyed by relative path. Requires manifest."),
+  priority: number().int().optional().describe("Handler priority. Lower values run first."),
+  config: record(string(), unknown()).optional().describe("Extension configuration.")
+}).strict().superRefine(checkExtensionInstallSource);
 function extensionInstallResult(data, fallbackName) {
   const body = data;
   const extension = coerceExtensionSummary(body.extension);
@@ -110929,18 +111528,14 @@ var registerExtensionInstallTool = (server) => {
     title: "Extension Install",
     description: EXTENSION_INSTALL_DESCRIPTION,
     annotations: { openWorldHint: false },
-    inputSchema: object({
-      template: string().min(1).describe("Name of a predefined extension from extension-catalog."),
-      priority: number().int().optional().describe("Handler priority. Lower values run first."),
-      config: record(string(), unknown()).optional().describe("Extension configuration.")
-    }).strict(),
+    inputSchema: extensionInstallInputSchema,
     outputSchema: extensionToolOutputSchema
   }, async (args, requestInfo) => proxyExtensionsApi({
     method: "POST",
     path: "/api/extensions/install",
     body: args,
     requestInfo,
-    success: (data) => extensionInstallResult(data, args.template)
+    success: (data) => extensionInstallResult(data, args.template ?? args.manifest?.name ?? "extension")
   }));
 };
 
@@ -112591,6 +113186,52 @@ var registerMemoryDeleteTool = (server) => {
 init_zod();
 init_db();
 
+// src/be/memory/key-guard.ts
+init_key_paths();
+
+class MemoryKeyError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "MemoryKeyError";
+  }
+}
+var NO_AUTHORITY = {
+  principal: { kind: "agent", agentId: "", isLead: false },
+  source: "http"
+};
+function shapeError(key, origin) {
+  if (key.length <= MEMORY_KEY_MAX_LENGTH && MEMORY_KEY_PATTERN.test(key))
+    return null;
+  const subject = origin === "sourcePath" ? `sourcePath "${key}" starts with ${LONGTERM_ROOT}, so it is used as the key, but it is not a valid key.` : `Key "${key}" is not a valid key.`;
+  return `${subject} ${MEMORY_KEY_PATTERN_MESSAGE}`;
+}
+function assertKeyWritable(key, origin, writer) {
+  if (origin === "sourcePath" && !isLongtermKey(key))
+    return;
+  const shape = shapeError(key, origin);
+  if (shape)
+    throw new MemoryKeyError(shape, "invalid");
+  const pathError = longtermKeyError(key);
+  if (pathError)
+    throw new MemoryKeyError(pathError, "invalid");
+  if (!isConsolidatedKey(key))
+    return;
+  const { principal, source } = writer ?? NO_AUTHORITY;
+  const decision = can({
+    principal,
+    verb: "memory.write.consolidated",
+    resource: { kind: "none" },
+    source
+  });
+  if (!decision.allow)
+    throw new MemoryKeyError(consolidatedKeyMessage(key), "forbidden");
+}
+
+// src/tools/memory-edit.ts
+init_key_paths();
+
 // src/be/memory/link-resolver.ts
 init_db();
 var WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
@@ -112805,7 +113446,7 @@ var agentMemoryOutputSchema = looseObject({
 var registerMemoryEditTool = (server) => {
   createToolRegistrar(server)("memory-edit", {
     title: "Edit a memory",
-    description: "Edit a single memory in place while preserving its ID, usefulness posterior, and audit history. Two modes: 'replace' overwrites the entire content (requires `content`); 'exact' performs a surgical find-and-replace of `oldString` with `newString` within the existing content (fails if `oldString` is missing or ambiguous). Use 'replace' for full rewrites, 'exact' for targeted edits. Agents can edit their own memories; lead agents can edit any scope.",
+    description: "Edit a single memory in place while preserving its ID, usefulness posterior, and audit history. Two modes: 'replace' overwrites the entire content (requires `content`); 'exact' performs a surgical find-and-replace of `oldString` with `newString` within the existing content (fails if `oldString` is missing or ambiguous). Use 'replace' for full rewrites, 'exact' for targeted edits. Pass `newKey` alone to move the memory to another logical path (every chunk, same ID, posterior, access counts and author). A move into /longterm also clears the expiry. Agents can edit their own memories; lead agents can edit any scope.",
     annotations: { destructiveHint: true },
     inputSchema: object({
       memoryId: uuid().optional().describe("The memory ID to edit."),
@@ -112816,7 +113457,8 @@ var registerMemoryEditTool = (server) => {
       oldString: string().min(1).optional().describe("Substring to find in existing content. Required for 'exact' mode. Must appear exactly once."),
       newString: string().optional().describe("Replacement for oldString. Required for 'exact' mode. Can be empty to delete."),
       intent: string().min(1).describe("Why you are editing this memory."),
-      expectedVersion: number().int().min(1).optional()
+      expectedVersion: number().int().min(1).optional(),
+      newKey: string().max(MEMORY_KEY_MAX_LENGTH).regex(MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE).optional().describe("Move the memory to this logical path, for example '/longterm/facts/swarm-runtime/slug'. Alone it is a pure move: omit content/oldString/newString. Fails when the key is already used in this scope by the same owner. Moving into /longterm marks the memory as curated on every chunk: it stops expiring and is protected from cleanup, and moving it out later does not bring the expiry back. A key under /longterm must start with /longterm/company-story, /longterm/entities/people, /longterm/entities/customers, /longterm/facts, /longterm/decisions, /longterm/workstreams or /longterm/timeline. Paths under /longterm/company-story, /longterm/entities and /longterm/timeline are lead-only.")
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string().optional(),
@@ -112825,7 +113467,18 @@ var registerMemoryEditTool = (server) => {
       previousVersion: number().int().optional(),
       version: number().int().optional()
     })
-  }, async ({ memoryId, key, scope, mode, content, oldString, newString, intent, expectedVersion }, requestInfo, _meta) => {
+  }, async ({
+    memoryId,
+    key,
+    scope,
+    mode,
+    content,
+    oldString,
+    newString,
+    intent,
+    expectedVersion,
+    newKey
+  }, requestInfo, _meta) => {
     if (!requestInfo.agentId) {
       return toolErr("Agent ID required. Are you registered in the swarm?");
     }
@@ -112835,6 +113488,17 @@ var registerMemoryEditTool = (server) => {
       });
     }
     try {
+      if (newKey) {
+        const agent = await getAgentById(requestInfo.agentId);
+        assertKeyWritable(newKey, "key", {
+          principal: {
+            kind: "agent",
+            agentId: requestInfo.agentId,
+            isLead: agent?.isLead ?? false
+          },
+          source: "mcp"
+        });
+      }
       const store = getMemoryStore();
       if (memoryId) {
         const memory = await store.peek(memoryId);
@@ -112871,9 +113535,11 @@ var registerMemoryEditTool = (server) => {
         newString,
         intent,
         expectedVersion,
-        changedByAgentId: requestInfo.agentId
+        changedByAgentId: requestInfo.agentId,
+        newKey
       });
-      if (result.changed) {
+      const contentEdited = content !== undefined || oldString !== undefined || newString !== undefined;
+      if (result.changed && (newKey === undefined || contentEdited)) {
         const provider = getEmbeddingProvider();
         const embedding = await provider.embed(result.memory.content);
         if (embedding)
@@ -112894,6 +113560,9 @@ var registerMemoryEditTool = (server) => {
         }
       });
     } catch (err) {
+      if (err instanceof MemoryKeyError) {
+        return toolErr(err.message, { data: { yourAgentId: requestInfo.agentId } });
+      }
       return toolErr(`Memory edit failed: ${err.message}`, {
         data: { yourAgentId: requestInfo.agentId }
       });
@@ -113231,7 +113900,7 @@ function addNeighborScopeConditions(conditions, params, agentId, scope, isLead)
 async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
   if (!isGraphExpansionEnabled())
     return candidates;
-  const { cap = 5, damping = 0.7, scope = "all", source, isLead = false } = options;
+  const { cap = 5, damping = 0.7, scope = "all", source, keyPrefix, isLead = false } = options;
   if (candidates.length === 0 || cap <= 0)
     return candidates;
   const parentById = new Map(candidates.map((c) => [c.id, c]));
@@ -113247,6 +113916,10 @@ async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
     conditions.push("m.source = ?");
     params.push(source);
   }
+  if (keyPrefix) {
+    conditions.push("substr(m.key, 1, length(?)) = ?");
+    params.push(keyPrefix, keyPrefix);
+  }
   let rows;
   try {
     rows = await getDbClient().query(`SELECT m.*, ml.from_memory_id AS fromMemoryId, ml.strength AS linkStrength
@@ -113303,6 +113976,7 @@ async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
 }
 
 // src/tools/memory-search.ts
+init_key_paths();
 init_reranker();
 init_types();
 var NUDGE_ELIGIBLE_SOURCES2 = new Set(["manual", "file_index"]);
@@ -113345,10 +114019,11 @@ var registerMemorySearchTool = (server) => {
       intent: string().min(1).optional().describe("Optional reason for searching for this memory. E.g. 'looking for auth pattern to fix login bug'."),
       scope: _enum(["all", "agent", "swarm"]).default("all").describe("Search scope: 'all' (own + swarm), 'agent' (own only), 'swarm' (shared only)."),
       limit: number().int().min(1).max(50).default(10).describe("Max results to return."),
-      source: AgentMemorySourceSchema.optional().describe("Filter by memory source type.")
+      source: AgentMemorySourceSchema.optional().describe("Filter by memory source type."),
+      keyPrefix: string().min(1).max(MEMORY_KEY_MAX_LENGTH).optional().describe("Only return memories whose key starts with this text, for example '/longterm/facts/' or '/longterm/entities/people/'. Matched literally, case-sensitive. Include the trailing '/' to stay inside one folder.")
     }),
     outputSchema: memorySearchOutputSchema
-  }, async ({ query, intent, scope, limit, source }, requestInfo, _meta) => {
+  }, async ({ query, intent, scope, limit, source, keyPrefix }, requestInfo, _meta) => {
     if (!requestInfo.agentId) {
       return toolErr("Agent ID required. Are you registered in the swarm?");
     }
@@ -113363,11 +114038,13 @@ var registerMemorySearchTool = (server) => {
       limit: candidateLimit,
       source,
       isLead,
-      queryText: query
+      queryText: query,
+      keyPrefix
     });
     const expanded = await expandCandidatesWithGraph(candidates, requestInfo.agentId, {
       scope,
       source,
+      keyPrefix,
       isLead
     });
     if (expanded.length > 0) {
@@ -113414,7 +114091,8 @@ var registerMemorySearchTool = (server) => {
       scope,
       limit,
       isLead,
-      source
+      source,
+      keyPrefix
     });
     const consumedIds = dedupeMemoryDocumentIds(recent);
     try {
@@ -113442,6 +114120,7 @@ var registerMemorySearchTool = (server) => {
 
 // src/tools/memory-store.ts
 init_zod();
+init_db();
 
 // src/be/chunking.ts
 var MAX_CHUNK_SIZE = 2000;
@@ -113594,6 +114273,9 @@ function addOverlap(chunks, _originalText) {
 init_secret_scrubber();
 async function indexMemoryContent(params) {
   const { agentId, content, name, scope, source, sourceTaskId, sourcePath, tags } = params;
+  const rowKey2 = params.key ?? (sourcePath || null);
+  if (rowKey2)
+    assertKeyWritable(rowKey2, params.key != null ? "key" : "sourcePath", params.writer);
   const contentChunks = chunkContent(content);
   if (contentChunks.length === 0) {
     contentChunks.push({
@@ -113647,7 +114329,7 @@ async function indexMemoryContent(params) {
     tags: tags || [],
     contextKey: params.contextKey ?? null,
     intent: params.intent ?? "index memory content",
-    key: sourcePath || null
+    key: rowKey2
   })));
   if (agentId) {
     for (const memory of memories) {
@@ -113674,6 +114356,7 @@ async function indexMemoryContent(params) {
 }
 
 // src/tools/memory-store.ts
+init_key_paths();
 init_types();
 var registerMemoryStoreTool = (server) => {
   createToolRegistrar(server)("memory-store", {
@@ -113682,11 +114365,12 @@ var registerMemoryStoreTool = (server) => {
     annotations: { destructiveHint: false },
     inputSchema: object({
       content: string().min(1).describe("The memory body. Markdown is fine. State the fact, the context it applies to, and the evidence."),
-      name: string().min(1).max(200).optional().describe("Short title used in search results and the UI. Defaults to the first non-empty content line (up to 200 characters)."),
+      name: string().min(1).max(200).optional().describe("Short title used in search results and the UI. Defaults to the first non-empty content line (up to 200 characters). A name that starts with /longterm/ is also used as the key when no key is given."),
       scope: AgentMemoryScopeSchema.default("agent").describe("'agent' (default): only you can recall it. 'swarm': every agent can recall it."),
       tags: union([array(string()), string()]).optional().describe("Free-form tags as an array or a comma-separated string, for example a repo name or a topic."),
       taskId: uuid().optional().describe("The task this learning came from, when there is one."),
-      intent: string().min(1).optional().describe("Why this is worth remembering. Kept in the audit trail.")
+      intent: string().min(1).optional().describe("Why this is worth remembering. Kept in the audit trail."),
+      key: string().max(MEMORY_KEY_MAX_LENGTH).regex(MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE).optional().describe("Optional logical path for this memory, for example '/longterm/facts/swarm-runtime/sqlite-busy-retry'. Lowercase segments joined by '/', starting with '/'. Search it with memory-search keyPrefix and move it with memory-edit newKey. Fails when you already have a memory with this key in this scope. A key under /longterm marks the memory as curated: it never expires and is protected from cleanup. It must start with /longterm/company-story, /longterm/entities/people, /longterm/entities/customers, /longterm/facts, /longterm/decisions, /longterm/workstreams or /longterm/timeline. Paths under /longterm/company-story, /longterm/entities and /longterm/timeline are lead-only. Defaults to an auto key, which makes the memory inbox material.")
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string().optional(),
@@ -113694,13 +114378,18 @@ var registerMemoryStoreTool = (server) => {
       chunks: number().int().optional(),
       queued: boolean().optional()
     })
-  }, async ({ content, name: requestedName, scope, tags, taskId, intent }, requestInfo, _meta) => {
+  }, async ({ content, name: requestedName, scope, tags, taskId, intent, key }, requestInfo, _meta) => {
     const name = requestedName ?? content.split(/\r?\n/).find((line) => line.trim())?.trim().slice(0, 200) ?? "Untitled memory";
     const normalizedTags = typeof tags === "string" ? tags.split(",").map((tag) => tag.trim()).filter(Boolean) : tags;
     if (!requestInfo.agentId) {
       return toolErr("Agent ID required. Are you registered in the swarm?");
     }
+    const storeKey = resolveStoreKey(key, requestedName);
+    if (storeKey && !key && !MEMORY_KEY_PATTERN.test(storeKey)) {
+      return toolErr(`Name "${storeKey}" starts with /longterm/, so it is used as the key, but it is not a valid key. ${MEMORY_KEY_PATTERN_MESSAGE}`, { data: { yourAgentId: requestInfo.agentId } });
+    }
     try {
+      const agent = storeKey ? await getAgentById(requestInfo.agentId) : undefined;
       const result = await indexMemoryContent({
         agentId: requestInfo.agentId,
         content,
@@ -113709,7 +114398,16 @@ var registerMemoryStoreTool = (server) => {
         source: "manual",
         sourceTaskId: taskId ?? null,
         tags: normalizedTags,
-        intent
+        intent,
+        key: storeKey,
+        writer: {
+          principal: {
+            kind: "agent",
+            agentId: requestInfo.agentId,
+            isLead: agent?.isLead ?? false
+          },
+          source: "mcp"
+        }
       });
       return toolOk(`Memory "${name}" stored as ${result.chunks} chunk(s) in ${scope} scope. Embedding runs in the background.`, {
         data: {
@@ -113720,7 +114418,14 @@ var registerMemoryStoreTool = (server) => {
         }
       });
     } catch (err) {
-      return toolErr(`Memory store failed: ${err.message}`, {
+      if (err instanceof MemoryKeyError) {
+        return toolErr(err.message, { data: { yourAgentId: requestInfo.agentId } });
+      }
+      const message = err.message;
+      if (storeKey && /UNIQUE constraint failed/i.test(message)) {
+        return toolErr(`Memory store failed: key "${storeKey}" is already used in ${scope} scope. Edit that memory with memory-edit, or pick another key.`, { data: { yourAgentId: requestInfo.agentId } });
+      }
+      return toolErr(`Memory store failed: ${message}`, {
         data: { yourAgentId: requestInfo.agentId }
       });
     }
@@ -121843,7 +122548,7 @@ var createScheduleInputSchema = object({
   targetAgentId: string().optional().describe("Agent to assign tasks to (omit for task pool)"),
   timezone: string().default("UTC").optional().describe("Timezone for cron schedules"),
   enabled: boolean().default(true).optional().describe("Whether the schedule is enabled (default: true)"),
-  model: string().trim().min(1).optional().describe("Concrete model override for tasks created by this schedule. Interpreted by each assignee's harness/provider and does not switch providers. Prefer modelTier for portable intent."),
+  model: string().trim().min(1).optional().describe("Concrete model override for tasks created by this schedule. Interpreted by each assignee's harness/provider and does not switch providers. Prefer modelTier for portable intent. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier for tasks created by this schedule: 'smol', 'regular', 'smart', or 'ultra'. Resolved by each assignee's harness/provider at run time."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.")
 });
@@ -122427,7 +123132,7 @@ var patchScheduleInputSchema = object({
   targetAgentId: string().nullable().optional().describe("New target agent ID"),
   timezone: string().optional().describe("New timezone"),
   enabled: boolean().optional().describe("Enable or disable the schedule"),
-  model: string().trim().min(1).nullable().optional().describe("Concrete model override for tasks created by this schedule. Set to null to clear."),
+  model: string().trim().min(1).nullable().optional().describe("Concrete model override for tasks created by this schedule. Set to null to clear. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
   modelTier: ModelTierSchema.nullable().optional().describe("Portable model tier for tasks created by this schedule. Set to null to clear."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.")
 });
@@ -122586,12 +123291,13 @@ var registerPatchScheduleTool = (server) => {
         updateData.timezone = timezone;
       if (enabled2 !== undefined)
         updateData.enabled = enabled2;
+      const agentChanged = targetAgentId !== undefined && targetAgentId !== schedule.targetAgentId;
       if (model !== undefined || modelTier !== undefined) {
         const normalizedModel = splitLegacyModelAlias({ model, modelTier });
-        if (normalizedModel.model !== schedule.model) {
+        if (normalizedModel.model !== schedule.model || agentChanged) {
           const modelError = await explicitModelErrorForAgent({
             model: normalizedModel.model,
-            allowCustomModel,
+            allowCustomModel: allowCustomModel || normalizedModel.model === schedule.model,
             agentId: targetAgentId ?? schedule.targetAgentId
           });
           if (modelError)
@@ -122602,6 +123308,14 @@ var registerPatchScheduleTool = (server) => {
         if (modelTier !== undefined || normalizedModel.modelTier) {
           updateData.modelTier = normalizedModel.modelTier ?? null;
         }
+      } else if (agentChanged && schedule.model) {
+        const modelError = await explicitModelErrorForAgent({
+          model: schedule.model,
+          allowCustomModel: true,
+          agentId: targetAgentId ?? schedule.targetAgentId
+        });
+        if (modelError)
+          return toolErr(modelError);
       }
       if (schedule.scheduleType === "one_time") {
         if (enabled2 === false) {
@@ -122728,7 +123442,7 @@ var updateScheduleInputSchema = object({
   targetAgentId: string().nullable().optional().describe("New target agent ID"),
   timezone: string().optional().describe("New timezone"),
   enabled: boolean().optional().describe("Enable or disable the schedule"),
-  model: string().trim().min(1).nullable().optional().describe("Concrete model override for tasks created by this schedule. Set to null to clear."),
+  model: string().trim().min(1).nullable().optional().describe("Concrete model override for tasks created by this schedule. Set to null to clear. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
   modelTier: ModelTierSchema.nullable().optional().describe("Portable model tier for tasks created by this schedule. Set to null to clear."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.")
 });
@@ -122887,12 +123601,13 @@ var registerUpdateScheduleTool = (server) => {
         updateData.timezone = timezone;
       if (enabled2 !== undefined)
         updateData.enabled = enabled2;
+      const agentChanged = targetAgentId !== undefined && targetAgentId !== schedule.targetAgentId;
       if (model !== undefined || modelTier !== undefined) {
         const normalizedModel = splitLegacyModelAlias({ model, modelTier });
-        if (normalizedModel.model !== schedule.model) {
+        if (normalizedModel.model !== schedule.model || agentChanged) {
           const modelError = await explicitModelErrorForAgent({
             model: normalizedModel.model,
-            allowCustomModel,
+            allowCustomModel: allowCustomModel || normalizedModel.model === schedule.model,
             agentId: targetAgentId ?? schedule.targetAgentId
           });
           if (modelError)
@@ -122903,6 +123618,14 @@ var registerUpdateScheduleTool = (server) => {
         if (modelTier !== undefined || normalizedModel.modelTier) {
           updateData.modelTier = normalizedModel.modelTier ?? null;
         }
+      } else if (agentChanged && schedule.model) {
+        const modelError = await explicitModelErrorForAgent({
+          model: schedule.model,
+          allowCustomModel: true,
+          agentId: targetAgentId ?? schedule.targetAgentId
+        });
+        if (modelError)
+          return toolErr(modelError);
       }
       if (schedule.scheduleType === "one_time") {
         if (enabled2 === false) {
@@ -123773,7 +124496,7 @@ var sendTaskInputSchema = object({
   parentTaskId: uuid().optional().describe("Parent task ID for session continuity. Child task will resume the parent's Claude session. Auto-routes to the same worker unless agentId is explicitly provided."),
   dir: string().min(1).startsWith("/").optional().describe("Working directory (absolute path) for the agent to start in. If the directory doesn't exist, falls back to the default working directory."),
   vcsRepo: string().optional().describe("VCS repo identifier (e.g., 'desplega-ai/agent-swarm' for GitHub or 'group/project' for GitLab). Links the task to a registered repo for workspace context."),
-  model: string().trim().min(1).optional().describe("Concrete model override for this task, interpreted by the assignee's harness/provider. This does not switch providers. Prefer modelTier for portable intent."),
+  model: string().trim().min(1).optional().describe("Concrete model override for this task, interpreted by the assignee's harness/provider. This does not switch providers. Prefer modelTier for portable intent. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier for this task: 'smol', 'regular', 'smart', or 'ultra'. Resolved at claim/run time using the assignee's harness/provider. Legacy model shortnames map as haiku→smol, sonnet→regular, opus→smart, fable→ultra."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet (a fresh launch, a private deployment)."),
   effort: ReasoningEffortSchema.optional().describe("Reasoning effort for this task: 'off', 'low', 'medium', 'high', 'xhigh', or 'max'. If omitted, the assignee's REASONING_EFFORT_OVERRIDE/default applies."),
@@ -123887,13 +124610,6 @@ async function sendTaskHandler(ctx, {
   }
   const effectiveVcsRepo = vcsRepo;
   const normalizedModel = splitLegacyModelAlias({ model, modelTier });
-  const modelError = await explicitModelErrorForAgent({
-    model: normalizedModel.model,
-    allowCustomModel,
-    agentId
-  });
-  if (modelError)
-    return toolErr(modelError, { data: { yourAgentId: creatorAgentId } });
   const effectiveParentTaskId = parentTaskId ?? sourceTaskId;
   const effectiveParentTask = effectiveParentTaskId ? await getTaskById(effectiveParentTaskId) : null;
   if (effectiveParentTask?.routingAffinityInvalid) {
@@ -123931,6 +124647,13 @@ async function sendTaskHandler(ctx, {
       effectiveAgentId = effectiveParentTask.agentId;
     }
   }
+  const modelError = await explicitModelErrorForAgent({
+    model: normalizedModel.model,
+    allowCustomModel,
+    agentId: effectiveAgentId
+  });
+  if (modelError)
+    return toolErr(modelError, { data: { yourAgentId: creatorAgentId } });
   const effectiveRoutingReason = agentId !== undefined ? routingReason : effectiveAgentId ? "continuity" : undefined;
   const effectiveRoutingNote = effectiveRoutingReason ? routingNote : undefined;
   const effectiveRoutingSource = agentId !== undefined ? "declared" : effectiveAgentId ? "engine_default" : undefined;
@@ -123968,7 +124691,8 @@ async function sendTaskHandler(ctx, {
     description: task,
     options: requestedTaskOptions,
     origin: "mcp",
-    requestInfo: ctx.kind === "owner" ? ctx.requestInfo : undefined
+    requestInfo: ctx.kind === "owner" ? ctx.requestInfo : undefined,
+    allowCustomModel
   });
   if (preCreate.kind === "blocked") {
     return toolErr(preCreate.reason, {
@@ -126167,9 +126891,9 @@ var registerSlackReadTool = (server) => {
         const extractedText = extractSlackMessageText(m);
         if (!extractedText && (!m.files || m.files.length === 0))
           continue;
-        const isBot = m.user === botUserId || m.bot_id !== undefined || m.subtype === "bot_message";
+        const isBot2 = m.user === botUserId || m.bot_id !== undefined || m.subtype === "bot_message";
         let username;
-        if (isBot) {
+        if (isBot2) {
           username = m.username || "Agent";
         } else if (m.user) {
           username = await getUserDisplayName(m.user);
@@ -126207,7 +126931,7 @@ var registerSlackReadTool = (server) => {
         messages.push({
           user: m.user,
           username,
-          isBot,
+          isBot: isBot2,
           text: extractedText,
           ts: m.ts,
           files
@@ -126867,6 +127591,20 @@ init_types();
 init_secret_scrubber();
 var BLOCKED_WAITING_PATTERN = /\b(waiting (for|on)|blocked (on|until|by)|still waiting|awaiting)\b/i;
 var BLOCKED_WAITING_MIN_ELAPSED_MS = 3 * 60 * 1000;
+async function foreignTaskWriteError(caller, task, sourceTaskId) {
+  const decision = can({
+    principal: { kind: "agent", agentId: caller.id, isLead: caller.isLead === true },
+    verb: "task.progress.write",
+    resource: { kind: "task", taskId: task.id, agentId: task.agentId },
+    source: "mcp"
+  });
+  if (decision.allow)
+    return;
+  const sourceTask = sourceTaskId ? await getTaskById(sourceTaskId) : null;
+  const ownTask = sourceTask?.agentId === caller.id ? sourceTask : await getAgentCurrentTask(caller.id);
+  const retry = ownTask ? ` Your own task is "${ownTask.id}"; call store-progress with that taskId.` : " You have no in-progress task.";
+  return `Task "${task.id}" is assigned to another agent; only its assignee may store progress on it. Nothing was written.${retry}`;
+}
 var storeProgressOutputSchema = swarmToolOutputSchema({
   task: looseObject({
     id: string(),
@@ -126940,12 +127678,17 @@ var registerStoreProgressTool = (server) => {
     const agentFsScopes = new Map;
     const agentFsAttachments = attachments?.filter((a) => a.kind === "agent-fs") ?? [];
     if (agentFsAttachments.length > 0) {
-      if (!await getAgentById(requestInfo.agentId)) {
+      const caller = await getAgentById(requestInfo.agentId);
+      if (!caller) {
         return toolErr(`Agent with ID "${requestInfo.agentId}" not found in the swarm, register before storing task progress.`);
       }
-      if (!await getTaskById(taskId)) {
+      const target = await getTaskById(taskId);
+      if (!target) {
         return toolErr(`Task with ID "${taskId}" not found.`);
       }
+      const foreignError = await foreignTaskWriteError(caller, target, requestInfo.sourceTaskId);
+      if (foreignError)
+        return toolErr(foreignError);
       const configs = await getResolvedConfig(requestInfo.agentId ?? undefined);
       const configValue = (key) => configs.find((c) => c.key === key)?.value?.trim();
       const defaultOrgId = configValue("AGENT_FS_DEFAULT_ORG_ID");
@@ -127006,6 +127749,10 @@ var registerStoreProgressTool = (server) => {
           message: `Task with ID "${taskId}" not found.`
         };
       }
+      const foreignError = await foreignTaskWriteError(agent, existingTask, requestInfo.sourceTaskId);
+      if (foreignError) {
+        return { success: false, message: foreignError };
+      }
       let updatedTask = existingTask;
       const isTerminal2 = isTerminalTaskStatus(existingTask.status);
       const goingTerminal = status !== undefined && isTerminalTaskStatus(status);
@@ -127063,8 +127810,8 @@ var registerStoreProgressTool = (server) => {
         return terminalResultGuard;
       }
       if (progress && !isTerminal2) {
-        const isDuplicate4 = existingTask.progress === progress && existingTask.lastUpdatedAt && Date.now() - new Date(existingTask.lastUpdatedAt).getTime() < 5 * 60 * 1000;
-        if (!isDuplicate4) {
+        const isDuplicate5 = existingTask.progress === progress && existingTask.lastUpdatedAt && Date.now() - new Date(existingTask.lastUpdatedAt).getTime() < 5 * 60 * 1000;
+        if (!isDuplicate5) {
           const result2 = await updateTaskProgress(taskId, progress);
           if (result2)
             updatedTask = result2;
@@ -127780,7 +128527,7 @@ var taskActionInputSchema = object({
   taskId: uuid().optional().describe("Task ID (required for claim/release/accept/reject)."),
   reason: string().optional().describe("Reason for rejection (optional for 'reject')."),
   dir: string().min(1).startsWith("/").optional().describe("Working directory (absolute path) for the agent to start in. Only used with 'create' action."),
-  model: string().trim().min(1).optional().describe("Concrete model override for the created task, interpreted by the claiming worker's harness/provider. This does not switch providers. Only used with 'create' action."),
+  model: string().trim().min(1).optional().describe("Concrete model override for the created task, interpreted by the claiming worker's harness/provider. This does not switch providers. Only used with 'create' action. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier for the created task: 'smol', 'regular', 'smart', or 'ultra'. Resolved when a worker claims/runs the task. Only used with 'create' action."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only used with 'create' action."),
   effort: ReasoningEffortSchema.optional().describe("Reasoning effort for the created task: 'off', 'low', 'medium', 'high', 'xhigh', or 'max'. Only used with 'create' action."),
@@ -127928,7 +128675,8 @@ async function taskActionHandler(ctx, input) {
         routingAffinity: leadOnly || requiredCapabilities?.length ? { leadOnly, capabilities: requiredCapabilities ?? [] } : undefined
       },
       origin: "mcp",
-      requestInfo: ctx.requestInfo
+      requestInfo: ctx.requestInfo,
+      allowCustomModel: input.allowCustomModel
     });
     if (preCreate.kind === "blocked") {
       return taskActionResult({ success: false, message: preCreate.reason }, agentId);
@@ -128849,6 +129597,43 @@ var registerCancelWorkflowRunTool = (server) => {
 init_zod();
 init_db();
 init_types();
+
+// src/workflows/model-validation.ts
+init_types();
+function asConfig(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function isStatic(value) {
+  return typeof value === "string" && value.trim() !== "" && !value.includes("{{");
+}
+async function workflowModelErrors(def) {
+  const errors = [];
+  for (const node of def.nodes) {
+    const targets = [];
+    if (node.type === "agent-task")
+      targets.push({ config: node.config, path: "config" });
+    if (node.type === "foreach") {
+      const body = asConfig(asConfig(node.config.body)?.config);
+      if (body)
+        targets.push({ config: body, path: "config.body.config" });
+    }
+    for (const { config, path: path3 } of targets) {
+      if (!isStatic(config.model) || !isStatic(config.agentId))
+        continue;
+      const modelTier = typeof config.modelTier === "string" ? config.modelTier : undefined;
+      const error = await explicitModelErrorForAgent({
+        model: splitLegacyModelAlias({ model: config.model, modelTier }).model,
+        allowCustomModel: config.allowCustomModel === true,
+        agentId: config.agentId
+      });
+      if (error)
+        errors.push(`Node "${node.id}" ${path3}.model: ${error}`);
+    }
+  }
+  return errors;
+}
+
+// src/tools/workflows/create-workflow.ts
 var registerCreateWorkflowTool = (server) => {
   createToolRegistrar(server)("create-workflow", {
     title: "Create Workflow",
@@ -128860,14 +129645,14 @@ var registerCreateWorkflowTool = (server) => {
 ` + `- Agent-task config: { template, outputSchema?, agentId?, tags?, priority?, dir?, vcsRepo?, model? }.
 ` + "- FOREACH NODE: type 'foreach' fans out one agent-task per item. Config: " + "{ over: <array or exact {{input}} token>, itemKey: <property name>, body: { type: 'agent-task', config: {...} } }. " + "The body config is interpolated once per item with {{item.*}} and {{index}}. Child steps use synthetic IDs " + "'<foreachNodeId>#<itemKey>'; the parent waits for every child and exposes one aggregate result to successors. " + `concurrency is not supported in v1; use definition-level onNodeFailure: 'continue' to aggregate failed children.
 ` + "- TRIGGER SCHEMA: Optional 'triggerSchema' is a JSON-Schema object that validates incoming trigger payloads. " + "Supported keywords: type, required, properties, enum, const, items (recursive into arrays). " + `Other JSON-Schema keywords (oneOf/anyOf/$ref/pattern/format/additionalProperties) are silently ignored.
-` + "- WEBHOOK VERIFICATION: Webhook triggers use hmacSecret for all verification formats. " + "Omit verification for legacy HMAC-SHA256 over the raw body with fallback header scanning; " + "or set verification to { format: 'hmac-sha256', header }, { format: 'timestamped-hmac-sha256', header, toleranceSeconds? }, " + "or { format: 'token-equality', header }. Example: { type: 'webhook', hmacSecret: 'secret.SUPERAGENT_WEBHOOK_SECRET', " + `verification: { format: 'timestamped-hmac-sha256', header: 'X-Superagent-Signature', toleranceSeconds: 300 } }.
+` + "- WEBHOOK VERIFICATION: Webhook triggers use hmacSecret for all verification formats. " + "Omit verification for legacy HMAC-SHA256 over the raw body with fallback header scanning; " + "or set verification to { format: 'hmac-sha256', header }, { format: 'timestamped-hmac-sha256', header, toleranceSeconds? }, " + "{ format: 'token-equality', header }, or { format: 'standard-webhooks', toleranceSeconds? } " + "(standardwebhooks.com: webhook-id/webhook-timestamp/webhook-signature headers, hmacSecret is the whsec_ signing secret). Example: { type: 'webhook', hmacSecret: 'secret.SUPERAGENT_WEBHOOK_SECRET', " + `verification: { format: 'timestamped-hmac-sha256', header: 'X-Superagent-Signature', toleranceSeconds: 300 } }.
 ` + "- WAIT NODE: type 'wait' pauses a workflow for a duration or until a named workflowEventBus event arrives. " + "See runbooks/workflows.md#wait-nodes for config shapes, ordering caveats, and built-in event names.",
     inputSchema: exports_external.object({
       name: exports_external.string().describe("Unique name for the workflow"),
       key: AssetKeySchema.optional().describe("Logical namespace. Defaults to a shared/workflow:<id>/ resource key."),
       description: exports_external.string().optional().describe("Description of what this workflow does"),
       definition: WorkflowDefinitionSchema.describe("The workflow definition with nodes (each node has id, type, config, and optional next/retry/validation)"),
-      triggers: exports_external.array(TriggerConfigSchema).optional().describe("Optional trigger configurations (webhook, schedule, event). Webhook verification formats: legacy omitted verification, hmac-sha256, timestamped-hmac-sha256, token-equality."),
+      triggers: exports_external.array(TriggerConfigSchema).optional().describe("Optional trigger configurations (webhook, schedule, event). Webhook verification formats: legacy omitted verification, hmac-sha256, timestamped-hmac-sha256, token-equality, standard-webhooks."),
       cooldown: CooldownConfigSchema.optional().describe("Optional cooldown configuration to prevent re-triggering too frequently"),
       input: exports_external.record(exports_external.string(), InputValueSchema).optional().describe("Optional input values resolved at execution time (env vars like VAR_NAME, secrets secret.NAME, or literals)"),
       dir: exports_external.string().min(1).startsWith("/").optional().describe("Default working directory for all agent-task nodes (absolute path, e.g. /tmp/workspace)"),
@@ -128899,6 +129684,10 @@ var registerCreateWorkflowTool = (server) => {
       if (!validation.valid) {
         return toolErr(`Invalid definition: ${validation.errors.join("; ")}`);
       }
+      const modelErrors = await workflowModelErrors(definition);
+      if (modelErrors.length > 0) {
+        return toolErr(`Invalid definition: ${modelErrors.join("; ")}`);
+      }
       const createdBy = await resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const assetKey = key ? await authorizeAssetKeyWrite(key, createdBy) : undefined;
       const workflow = await createWorkflow({
@@ -129178,6 +129967,10 @@ async function patchWorkflowDefinition(options) {
     if (!validation.valid) {
       return { ok: false, reason: "invalid", errors: validation.errors };
     }
+    const modelErrors = await workflowModelErrors(patchResult.definition);
+    if (modelErrors.length > 0) {
+      return { ok: false, reason: "invalid", errors: modelErrors };
+    }
     let version = null;
     if (snapshotOptional) {
       try {
@@ -129438,14 +130231,14 @@ var registerUpdateWorkflowTool = (server) => {
   createToolRegistrar(server)("update-workflow", {
     title: "Update Workflow",
     annotations: { destructiveHint: false },
-    description: "Update an existing workflow's name, description, definition, triggers, cooldown, input, triggerSchema, or enabled state. " + "Creates a version snapshot before applying changes. " + "TRIGGER SCHEMA: pass 'triggerSchema' as a JSON-Schema object to set/replace, or 'null' to clear. " + "Supported JSON-Schema keywords: type, required, properties, enum, const, items (recursive into arrays). " + "Other JSON-Schema keywords (oneOf/anyOf/$ref/pattern/format/additionalProperties) are silently ignored. " + "WEBHOOK VERIFICATION: webhook triggers use hmacSecret for all verification formats. " + "Omit verification for legacy HMAC-SHA256 over the raw body with fallback header scanning; " + "or set verification to { format: 'hmac-sha256', header }, { format: 'timestamped-hmac-sha256', header, toleranceSeconds? }, " + "or { format: 'token-equality', header }.",
+    description: "Update an existing workflow's name, description, definition, triggers, cooldown, input, triggerSchema, or enabled state. " + "Creates a version snapshot before applying changes. " + "TRIGGER SCHEMA: pass 'triggerSchema' as a JSON-Schema object to set/replace, or 'null' to clear. " + "Supported JSON-Schema keywords: type, required, properties, enum, const, items (recursive into arrays). " + "Other JSON-Schema keywords (oneOf/anyOf/$ref/pattern/format/additionalProperties) are silently ignored. " + "WEBHOOK VERIFICATION: webhook triggers use hmacSecret for all verification formats. " + "Omit verification for legacy HMAC-SHA256 over the raw body with fallback header scanning; " + "or set verification to { format: 'hmac-sha256', header }, { format: 'timestamped-hmac-sha256', header, toleranceSeconds? }, " + "{ format: 'token-equality', header }, or { format: 'standard-webhooks', toleranceSeconds? } " + "(standardwebhooks.com: webhook-id/webhook-timestamp/webhook-signature headers, hmacSecret is the whsec_ signing secret).",
     inputSchema: exports_external.object({
       id: exports_external.string().uuid().describe("Workflow ID to update"),
       key: AssetKeySchema.optional().describe("Move to a logical namespace."),
       name: exports_external.string().optional().describe("New name for the workflow"),
       description: exports_external.string().optional().describe("New description"),
       definition: WorkflowDefinitionSchema.optional().describe("New workflow definition"),
-      triggers: exports_external.array(TriggerConfigSchema).optional().describe("New trigger configurations. Webhook verification formats: legacy omitted verification, hmac-sha256, timestamped-hmac-sha256, token-equality."),
+      triggers: exports_external.array(TriggerConfigSchema).optional().describe("New trigger configurations. Webhook verification formats: legacy omitted verification, hmac-sha256, timestamped-hmac-sha256, token-equality, standard-webhooks."),
       cooldown: CooldownConfigSchema.optional().nullable().describe("New cooldown configuration (null to remove)"),
       input: exports_external.record(exports_external.string(), InputValueSchema).optional().nullable().describe("New input values (null to remove)"),
       dir: exports_external.string().min(1).startsWith("/").optional().nullable().describe("Default working directory for all agent-task nodes (null to remove)"),
@@ -129484,6 +130277,10 @@ var registerUpdateWorkflowTool = (server) => {
         if (!validation.valid) {
           return toolErr(`Invalid definition: ${validation.errors.join("; ")}`);
         }
+        const modelErrors = await workflowModelErrors(definition);
+        if (modelErrors.length > 0) {
+          return toolErr(`Invalid definition: ${modelErrors.join("; ")}`);
+        }
       }
       const updatedBy = await resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
       const assetKey = key === undefined ? undefined : await authorizeAssetKeyWrite(key, updatedBy);
@@ -130205,7 +131002,7 @@ async function readScriptSdkJsonResponse(response, operation, limitBytes = SCRIP
 }
 
 // src/scripts-runtime/swarm-sdk.ts
-function headers2(config) {
+function headers3(config) {
   return {
     Authorization: `Bearer ${Redacted.value(config.apiKey)}`,
     "X-Agent-ID": Redacted.value(config.agentId),
@@ -130638,7 +131435,7 @@ async function callBridgeApi(name, args2, config, options = {}) {
     const mcpToolName = mcpToolNameForSdkMethod(name);
     const res2 = await fetch(`${baseUrl}/api/mcp-bridge`, {
       method: "POST",
-      headers: headers2(config),
+      headers: headers3(config),
       body: JSON.stringify({ tool: mcpToolName, args: args2 ?? {} })
     });
     const data2 = await readScriptSdkJsonResponse(res2, `ctx.swarm.${name}`);
@@ -130650,7 +131447,7 @@ async function callBridgeApi(name, args2, config, options = {}) {
   }
   const res = await fetch(`${baseUrl}${request.path}`, {
     method: request.method,
-    headers: headers2(config),
+    headers: headers3(config),
     body: request.body === undefined ? undefined : JSON.stringify(request.body)
   });
   const data = await readScriptSdkJsonResponse(res, `ctx.swarm.${name}`);
@@ -131777,6 +132574,7 @@ async function applyPreTaskCreate(args2) {
   const creatingExtensionId = extensionIdForAgent(args2.requestInfo?.agentId);
   const creatingExtension = creatingExtensionId ? listRegistered().find((loaded) => loaded.record.id === creatingExtensionId) : undefined;
   const origin = creatingExtension ? `extension:${creatingExtension.record.name}` : args2.origin;
+  let modelEditor;
   const result = await dispatchPre("pre.task.create", {
     description: args2.description,
     options: args2.options,
@@ -131803,6 +132601,9 @@ async function applyPreTaskCreate(args2) {
       }
       const { description: _description, ...optionChanges2 } = filtered;
       CreateTaskOptionsSchema.parse({ ...currentOptions, ...optionChanges2 });
+      if ("model" in optionChanges2 || "agentId" in optionChanges2) {
+        modelEditor = { id: extension.id, name: extension.name };
+      }
       return filtered;
     }
   });
@@ -131817,10 +132618,25 @@ async function applyPreTaskCreate(args2) {
     return { kind: "proceed", description: args2.description, options: args2.options };
   }
   const { description, ...optionChanges } = result.data;
+  const options = CreateTaskOptionsSchema.parse({ ...args2.options, ...optionChanges });
+  if (modelEditor) {
+    const modelError = await explicitModelErrorForAgent({
+      model: options.model,
+      allowCustomModel: args2.allowCustomModel || options.model === args2.options.model,
+      agentId: options.agentId
+    });
+    if (modelError) {
+      return {
+        kind: "blocked",
+        reason: `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
+        extension: modelEditor
+      };
+    }
+  }
   return {
     kind: "proceed",
     description: description ?? args2.description,
-    options: CreateTaskOptionsSchema.parse({ ...args2.options, ...optionChanges })
+    options
   };
 }
 
@@ -131920,13 +132736,13 @@ class AgentTaskExecutor extends BaseExecutor {
         followUpConfig: config.followUpConfig,
         contextKey: workflowContextKey({ workflowRunId: meta2.runId })
       },
-      origin: "workflow"
+      origin: "workflow",
+      allowCustomModel: config.allowCustomModel
     });
     if (preCreate.kind === "blocked") {
       throw new TaskCreationBlockedError(preCreate.reason, preCreate.extension);
     }
-    const { description: taskDescription, options: taskOptions } = await withSiblingAwareness(preCreate.description, preCreate.options);
-    const task = await db.createTaskExtended(taskDescription, taskOptions);
+    const task = await db.createTaskExtended(preCreate.description, preCreate.options);
     return {
       status: "success",
       async: true,
@@ -132187,7 +133003,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-y1b9srva.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-0hdqa4k1.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -132992,4 +133808,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, workflowSaveWarnings, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, explicitModelError, explicitModelErrorForAgent, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, workflowSaveWarnings, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };