@desplega.ai/agent-swarm 1.159.0 → 1.161.0

package/dist/{cli-g9df2m37.js → cli-1cz0c18q.js}

@@ -1,3 +1,7 @@
+import {
+  ALL_TOOLS,
+  init_tool_config
+} from "./cli-3qhyh31j.js";
 import {
   AgentAvatarSchema,
   CreateTaskOptionsSchema,
@@ -18,7 +22,7 @@ import {
   normalizeAssetKey,
   parseAssetKey,
   parseModelTier
-} from "./cli-e4xnc0qp.js";
+} from "./cli-akfj32vj.js";
 import {
   IdentityFieldBudgetError,
   checkIdentityFieldBudget,
@@ -31,11 +35,7 @@ import {
   init_templates,
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd
-} from "./cli-ardpzhjm.js";
-import {
-  init_config,
-  isSlackConfigured
-} from "./cli-n7h1kqpf.js";
+} from "./cli-yrg7c73k.js";
 import {
   configureDbResolver,
   getAllTemplateDefinitions,
@@ -45,29 +45,37 @@ import {
   init_steering_enabled,
   isSteeringEnabled,
   registerTemplate
-} from "./cli-rgjprct3.js";
-import {
-  SUBSCRIPTION_KEY_TYPES,
-  estimateClaudePlan,
-  init_subscription_plans
-} from "./cli-cqt19wg6.js";
+} from "./cli-ptr8h7kp.js";
 import {
   deriveProviderFromKeyType,
   init_credentials
-} from "./cli-19jenss3.js";
+} from "./cli-xk79303e.js";
+import {
+  init_config,
+  isSlackConfigured
+} from "./cli-n7h1kqpf.js";
 import {
   activeModelBlock,
   init_model_rate_limit_windows
-} from "./cli-de1396j2.js";
+} from "./cli-ywybs5as.js";
+import {
+  SUBSCRIPTION_KEY_TYPES,
+  estimateClaudePlan,
+  init_subscription_plans,
+  planAllowsModelFamily
+} from "./cli-1a2j50m0.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
 } from "./cli-ej6gbxfb.js";
 import {
+  harnessModelMismatch,
+  init_runtime_model_catalog,
   init_src,
   isAlias,
-  parseAlias
-} from "./cli-7zttzetj.js";
+  parseAlias,
+  runtimeHarnessSections
+} from "./cli-jyy6pm2f.js";
 import {
   init_zod
 } from "./cli-sd0mxa3c.js";
@@ -83,12 +91,12 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-48527fpw.js";
+} from "./cli-a8c82p2t.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubSecrets
-} from "./cli-r2ap2czm.js";
+} from "./cli-nexqx4ve.js";
 import {
   init_bus,
   realtimeBus
@@ -149,6 +157,14 @@ function gitlabContextKey(input) {
   }
   return ["task", "trackers", "gitlab", projectId, kind, iid].join(SEPARATOR);
 }
+function azureDevOpsContextKey(input) {
+  const repositoryId = assertSafePart(input.repositoryId, "repositoryId");
+  const pullRequestId = assertSafePart(input.pullRequestId, "pullRequestId");
+  if (!/^\d+$/.test(pullRequestId)) {
+    throw new Error(`context-key: azure-devops "pullRequestId" must be a positive integer (got ${JSON.stringify(pullRequestId)})`);
+  }
+  return ["task", "trackers", "azure-devops", repositoryId, "pr", pullRequestId].join(SEPARATOR);
+}
 function linearContextKey(input) {
   const issueIdentifier = assertSafePart(input.issueIdentifier, "issueIdentifier");
   return ["task", "trackers", "linear", issueIdentifier].join(SEPARATOR);
@@ -253,6 +269,21 @@ function parseContextKey(key) {
           parts: { projectId, kind, iid }
         };
       }
+      if (subFamily === "azure-devops") {
+        if (parts.length !== 6 || parts[4] !== "pr") {
+          throw new Error(`context-key: malformed azure-devops key: ${JSON.stringify(key)}`);
+        }
+        const idStr = parts[5];
+        const pullRequestId = Number.parseInt(idStr, 10);
+        if (!Number.isFinite(pullRequestId)) {
+          throw new Error(`context-key: malformed azure-devops pullRequestId "${idStr}": ${JSON.stringify(key)}`);
+        }
+        return {
+          family: "trackers",
+          subFamily: "azure-devops",
+          parts: { repositoryId: parts[3], kind: "pr", pullRequestId }
+        };
+      }
       if (subFamily === "linear") {
         if (parts.length !== 4) {
           throw new Error(`context-key: malformed linear key: ${JSON.stringify(key)}`);
@@ -361,7 +392,7 @@ var init_slack_routing = __esm(() => {
 
 // src/telemetry.ts
 import { randomUUID } from "node:crypto";
-function isEnabled() {
+function isTelemetryEnabled() {
   return isEnvFlagEnabled("ANONYMIZED_TELEMETRY", true);
 }
 function isCloudHostname(hostname) {
@@ -432,7 +463,7 @@ function _hasEmailChannel(env = process.env) {
   return !!env.AGENTMAIL_WEBHOOK_SECRET && !isEnvFlagEnabled("AGENTMAIL_DISABLE", false, env);
 }
 async function initTelemetry(sourceId, getConfig, setConfig, options = {}) {
-  if (!isEnabled())
+  if (!isTelemetryEnabled())
     return;
   source = sourceId;
   const generateIfMissing = options.generateIfMissing === true;
@@ -495,7 +526,7 @@ function getTelemetryEnvironment() {
   return "production";
 }
 function track(options) {
-  if (!isEnabled() || !installationId)
+  if (!isTelemetryEnabled() || !installationId)
     return;
   try {
     const payload = {
@@ -536,7 +567,7 @@ function track(options) {
   } catch {}
 }
 function emitIntegrationConnected(type, providerSlug, firstOfType) {
-  if (!isEnabled() || !installationId)
+  if (!isTelemetryEnabled() || !installationId)
     return false;
   const provider = _resolveIntegrationProvider(providerSlug);
   telemetry.integration("connected", {
@@ -658,6 +689,27 @@ var init_telemetry = __esm(() => {
   };
 });
 
+// src/utils/codex-auth-failure.ts
+function isCodexAuthFailureReason(failureReason) {
+  if (!failureReason || !failureReason.includes("[auth-error]"))
+    return false;
+  const lower = failureReason.toLowerCase();
+  return !TRANSIENT_AUTH_ERROR_MARKERS.some((m) => lower.includes(m));
+}
+var CODEX_AUTH_FAILURE_BENCH_THRESHOLD = 2, CODEX_AUTH_FAILURE_BENCH_MS, CODEX_AUTH_WATCH_NAMESPACE = "codex-auth-watch", codexAuthBenchMarkerKey = (keySuffix) => `bench:${keySuffix}`, TRANSIENT_AUTH_ERROR_MARKERS;
+var init_codex_auth_failure = __esm(() => {
+  CODEX_AUTH_FAILURE_BENCH_MS = 365 * 24 * 60 * 60 * 1000;
+  TRANSIENT_AUTH_ERROR_MARKERS = [
+    "waiting for the refresh lock",
+    "refresh rejected (429",
+    "refresh rejected (5",
+    "refresh rejected (unknown status",
+    "out of credits",
+    "no credentials found in config store",
+    "not a confirmed auth rejection"
+  ];
+});
+
 // src/utils/github-pull-request.ts
 function parseGitHubPullRequestToken(token) {
   const candidate = token.replace(TRAILING_PROSE_PUNCTUATION_RE, "");
@@ -1423,8 +1475,9 @@ class BunSqliteClient {
   async runTimed(sql, params = []) {
     let executionMs = 0;
     const result = await this.execute(sql, (db) => {
-      const run = db.query(sql).run(...params);
-      return { changes: run.changes };
+      db.query(sql).run(...params);
+      const own = db.query("SELECT changes() AS n").get();
+      return { changes: own?.n ?? 0 };
     }, (ms) => {
       executionMs += ms;
     });
@@ -3940,6 +3993,12 @@ async function updateTaskClaudeSessionId(taskId, claudeSessionId, provider, prov
   const row = await getDbClient().get(`UPDATE agent_tasks SET ${setClauses.join(", ")} WHERE id = ? RETURNING *`, params);
   return row ? rowToAgentTask(row) : null;
 }
+async function recordTaskProviderIfUnset(taskId, provider) {
+  await getDbClient().run("UPDATE agent_tasks SET provider = ? WHERE id = ? AND provider IS NULL", [
+    provider,
+    taskId
+  ]);
+}
 async function updateTaskTitle(taskId, title2) {
   const normalized = title2 === null ? null : title2.trim() || null;
   const row = await getDbClient().get("UPDATE agent_tasks SET title = ? WHERE id = ? RETURNING *", [normalized, taskId]);
@@ -4628,167 +4687,6 @@ var init_reaction_shortcode = __esm(() => {
   SLACK_REACTION_SHORTCODE_PATTERN = /^[a-z0-9_+'-]+(::skin-tone-[2-6])?$/;
 });
 
-// src/tools/tool-config.ts
-var CORE_TOOLS, DEFERRED_TOOLS, ALL_TOOLS;
-var init_tool_config = __esm(() => {
-  CORE_TOOLS = new Set([
-    "join-swarm",
-    "my-agent-info",
-    "poll-task",
-    "get-task-details",
-    "store-progress",
-    "task-action",
-    "send-task",
-    "get-tasks",
-    "defer-task",
-    "memory-search",
-    "memory-get",
-    "memory-store",
-    "memory-delete",
-    "memory_rate",
-    "get-swarm",
-    "script-run",
-    "db-query",
-    "kv-get",
-    "script-query-types",
-    "get-repos",
-    "accept-steer",
-    "memory-edit",
-    "script-search",
-    "steer-task",
-    "kv-list",
-    "get-config"
-  ]);
-  DEFERRED_TOOLS = new Set([
-    "list-schedules",
-    "create-schedule",
-    "update-schedule",
-    "patch-schedule",
-    "delete-schedule",
-    "run-schedule-now",
-    "create-workflow",
-    "list-workflows",
-    "get-workflow",
-    "update-workflow",
-    "patch-workflow",
-    "patch-workflow-node",
-    "delete-workflow",
-    "trigger-workflow",
-    "list-workflow-runs",
-    "get-workflow-run",
-    "retry-workflow-run",
-    "cancel-workflow-run",
-    "register-service",
-    "unregister-service",
-    "list-services",
-    "update-service-status",
-    "set-config",
-    "list-config",
-    "delete-config",
-    "credential-bindings",
-    "script-connections",
-    "model-catalog-refresh",
-    "model-catalog-overlay-upsert",
-    "update-repo",
-    "update-profile",
-    "context-history",
-    "context-diff",
-    "read-messages",
-    "post-message",
-    "slack-reply",
-    "slack-read",
-    "slack-upload-file",
-    "slack-download-file",
-    "slack-list-channels",
-    "slack-post",
-    "slack-start-thread",
-    "slack-create-channel",
-    "slack-invite-to-channel",
-    "slack-archive-channel",
-    "slack-delete",
-    "slack-update",
-    "create-channel",
-    "delete-channel",
-    "list-channels",
-    "register-agentmail-inbox",
-    "register-kapso-number",
-    "unregister-kapso-number",
-    "send-whatsapp-message",
-    "reply-whatsapp-message",
-    "tracker-status",
-    "get-oauth-access-token",
-    "tracker-link-task",
-    "tracker-unlink",
-    "tracker-sync-status",
-    "tracker-map-agent",
-    "list-prompt-templates",
-    "get-prompt-template",
-    "set-prompt-template",
-    "delete-prompt-template",
-    "preview-prompt-template",
-    "create_metric",
-    "request-human-input",
-    "cancel-approval-request",
-    "skill-create",
-    "skill-update",
-    "skill-delete",
-    "skill-get",
-    "skill-get-file",
-    "skill-list",
-    "skill-search",
-    "skill-install",
-    "skill-uninstall",
-    "skill-install-remote",
-    "skill-sync-remote",
-    "skill-publish",
-    "mcp-server-create",
-    "mcp-server-delete",
-    "mcp-server-get",
-    "mcp-server-install",
-    "mcp-server-list",
-    "mcp-server-uninstall",
-    "mcp-server-update",
-    "resolve-user",
-    "manage-user",
-    "app-get",
-    "app-list",
-    "app-patch",
-    "app-query",
-    "app-sync",
-    "app-upsert",
-    "app-history",
-    "app-diff",
-    "app-rollback",
-    "create_page",
-    "delete-page",
-    "kv-set",
-    "kv-delete",
-    "kv-incr",
-    "room-get",
-    "room-change",
-    "room-reset",
-    "room-decode",
-    "script-upsert",
-    "script-delete",
-    "script-apis",
-    "launch-script-run",
-    "get-script-run",
-    "list-script-runs",
-    "extension-delete",
-    "extension-enable",
-    "extension-disable",
-    "extension-activate-version",
-    "extension-catalog",
-    "extension-install",
-    "extension-list",
-    "swarm_x",
-    "cancel-task",
-    "inject-learning",
-    "get-metrics"
-  ]);
-  ALL_TOOLS = new Set([...CORE_TOOLS, ...DEFERRED_TOOLS]);
-});
-
 // src/utils/task-tool-manifest.ts
 function parseTaskToolManifest(value) {
   return taskToolManifestSchema.parse(JSON.parse(value));
@@ -4816,6 +4714,12 @@ function tierConfigKey(provider, tier) {
 function isTierConfigKey(key) {
   return TIER_CONFIG_KEY_RE.test(key.toUpperCase());
 }
+function tierConfigKeyProvider(key) {
+  const match = TIER_CONFIG_KEY_RE.exec(key.toUpperCase());
+  if (!match)
+    return null;
+  return ProviderNameSchema.options.find((p) => p.toUpperCase().replace(/-/g, "_") === match[1]) ?? null;
+}
 function validateTierConfigValue(key, value) {
   const message = `Invalid ${key} (expected a model id, a CLI alias such as "opus", or latest:<anthropic|openai|openrouter>/<target>[@stable|@any])`;
   if (typeof value !== "string")
@@ -4825,12 +4729,17 @@ function validateTierConfigValue(key, value) {
     return message;
   if (isAlias(trimmed) && !parseAlias(trimmed))
     return message;
+  const provider = tierConfigKeyProvider(key);
+  if (provider && harnessModelMismatch(trimmed, provider, runtimeHarnessSections())) {
+    return `Invalid ${key}: model "${trimmed}" does not run on the ${provider} harness.`;
+  }
   return null;
 }
 var TIER_CONFIG_KEY_RE;
 var init_model_tier_keys = __esm(() => {
   init_src();
   init_types();
+  init_runtime_model_catalog();
   TIER_CONFIG_KEY_RE = new RegExp(`^MODEL_TIER_(${ProviderNameSchema.options.map((p) => p.toUpperCase().replace(/-/g, "_")).join("|")})_(${MODEL_TIERS.map((t) => t.toUpperCase()).join("|")})$`);
 });
 
@@ -5029,11 +4938,15 @@ var init_swarm_config_guard = __esm(() => {
       "POOL_AFFINITY_ENFORCEMENT",
       "SCRIPTS_ONLY_MCP",
       "TASK_TOOL_PRELOAD_ENABLED",
+      "PI_TOOL_DEFERRAL",
+      "PI_CODEMODE",
+      "PI_CODEMODE_MODELS",
       "SLACK_DISABLE",
       "SLACK_RENDER_V2",
       "SLACK_RENDER_V2_DELEGATION",
       "GITHUB_DISABLE",
       "GITLAB_DISABLE",
+      "AZURE_DEVOPS_DISABLE",
       "LINEAR_DISABLE",
       "JIRA_DISABLE",
       "AGENTMAIL_DISABLE",
@@ -5042,6 +4955,7 @@ var init_swarm_config_guard = __esm(() => {
       "RBAC_ENABLED",
       "SEED_AUTOMATIONS_ENABLED",
       "RBAC_AUDIT_DISABLED",
+      "EXTENSION_ALLOW_INLINE_INSTALL",
       "BUDGET_ADMISSION_DISABLED",
       "MCP_OAUTH_ALLOW_PRIVATE_HOSTS",
       "OTEL_TRACE_POLL",
@@ -5089,7 +5003,12 @@ var init_swarm_config_guard = __esm(() => {
       "SLACK_TREE_STALL_MIN"
     ], 1),
     ...boundedIntegerValidatorsFor(DB_RETENTION_TUNING_BOUNDS),
-    ...boundedIntegerValidators(["SESSION_LOG_RETENTION_DAYS", "AGENT_LOG_RETENTION_DAYS", "EVENTS_RETENTION_DAYS"], 1, MAX_DB_RETENTION_DAYS),
+    ...boundedIntegerValidators([
+      "SESSION_LOG_RETENTION_DAYS",
+      "AGENT_LOG_RETENTION_DAYS",
+      "EVENTS_RETENTION_DAYS",
+      "CONTEXT_VERSIONS_KEEP_LATEST"
+    ], 1, MAX_DB_RETENTION_DAYS),
     ...integerValidators(["HEARTBEAT_MAX_AUTO_ASSIGN"], 0),
     ...integerValidators(["MODEL_LATEST_SOAK_DAYS"], 0),
     ...integerValidators(["APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS"], 0),
@@ -5099,6 +5018,43 @@ var init_swarm_config_guard = __esm(() => {
   };
 });
 
+// src/be/db/api-keys.ts
+async function recordKeySeatMismatch(keyType, keySuffix, keyIndex, model, scope = "global", scopeId = null) {
+  const now = new Date().toISOString();
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  return getDbClient().transaction(async (tx) => {
+    await tx.run(`INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET
+           keyIndex = excluded.keyIndex,
+           provider = excluded.provider,
+           updatedAt = excluded.updatedAt`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, provider, now]);
+    await tx.run(`UPDATE api_key_status SET lastSeatMismatchAt = ?, lastSeatMismatchModel = ?
+         WHERE keyType = ? AND keySuffix = ?`, [now, model, keyType, keySuffix]);
+    let planChanged = false;
+    if (keyType === "CLAUDE_CODE_OAUTH_TOKEN" && !planAllowsModelFamily("claude_team_standard", model)) {
+      const result = await tx.run(`UPDATE api_key_status SET plan = 'claude_team_standard', planSource = 'detected'
+           WHERE keyType = ? AND keySuffix = ? AND COALESCE(planSource, '') != 'manual'`, [keyType, keySuffix]);
+      planChanged = result.changes > 0;
+    }
+    if (!planChanged) {
+      const stored = await tx.get(`SELECT plan FROM api_key_status
+           WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [keyType, keySuffix, scope, effectiveScopeId]);
+      if (planAllowsModelFamily(stored?.plan, model)) {
+        console.warn(`[api-keys] seat mismatch: key ...${keySuffix} (${keyType}) has plan ${stored?.plan ?? "none"} but cannot run ${model}`);
+      }
+    }
+    return { planChanged };
+  });
+}
+var init_api_keys = __esm(() => {
+  init_credentials();
+  init_subscription_plans();
+  init_runtime();
+});
+
 // src/be/db.ts
 var exports_db = {};
 __export(exports_db, {
@@ -5446,6 +5402,7 @@ __export(exports_db, {
   isPendingSlackMessage: () => isPendingSlackMessage,
   isPoolAffinityEnforcementEnabled: () => isPoolAffinityEnforcementEnabled,
   isSettledSlackMessage: () => isSettledSlackMessage,
+  isSlackThreadAwaitingHuman: () => isSlackThreadAwaitingHuman,
   isSqliteVecAvailable: () => isSqliteVecAvailable,
   kvPrefixUpperBound: () => kvPrefixUpperBound,
   listAgentsWithCredStatusByProvider: () => listAgentsWithCredStatusByProvider,
@@ -5467,6 +5424,7 @@ __export(exports_db, {
   listScriptRuns: () => listScriptRuns,
   listSkillFileManifest: () => listSkillFileManifest,
   listSkills: () => listSkills,
+  listSlackThreadsAwaitingHuman: () => listSlackThreadsAwaitingHuman,
   listTaskTemplates: () => listTaskTemplates,
   listUserFavorites: () => listUserFavorites,
   listWorkflowRuns: () => listWorkflowRuns,
@@ -5500,9 +5458,12 @@ __export(exports_db, {
   reassociateSessionLogs: () => reassociateSessionLogs,
   recordBudgetRefusalNotification: () => recordBudgetRefusalNotification,
   recordInlineScriptRun: () => recordInlineScriptRun,
+  recordKeyAuthFailure: () => recordKeyAuthFailure,
   recordKeyRateLimitWindows: () => recordKeyRateLimitWindows,
+  recordKeySeatMismatch: () => recordKeySeatMismatch,
   recordKeyUsage: () => recordKeyUsage,
   recordSlackMessage: () => recordSlackMessage,
+  recordTaskProviderIfUnset: () => recordTaskProviderIfUnset,
   recordTaskPullRequestAttachments: () => recordTaskPullRequestAttachments,
   refreshDraftTaskLease: () => refreshDraftTaskLease,
   rejectTask: () => rejectTask,
@@ -5910,6 +5871,26 @@ async function getSlackTasksInThread(channelId, threadTs) {
        ORDER BY createdAt ASC, rowid ASC`, [channelId, threadTs]);
   return rows.map(rowToAgentTask);
 }
+async function listSlackThreadsAwaitingHuman() {
+  return getDbClient().query(`SELECT DISTINCT task.slackChannelId AS channelId, task.slackThreadTs AS threadTs
+       FROM approval_requests request
+       JOIN agent_tasks task ON task.id = request.sourceTaskId
+       WHERE request.status = 'pending'
+       AND (request.expiresAt IS NULL OR request.expiresAt > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       AND task.slackChannelId IS NOT NULL
+       AND task.slackThreadTs IS NOT NULL`);
+}
+async function isSlackThreadAwaitingHuman(channelId, threadTs) {
+  const row = await getDbClient().get(`SELECT 1 AS waiting
+       FROM approval_requests request
+       JOIN agent_tasks task ON task.id = request.sourceTaskId
+       WHERE request.status = 'pending'
+       AND (request.expiresAt IS NULL OR request.expiresAt > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       AND task.slackChannelId = ?
+       AND task.slackThreadTs = ?
+       LIMIT 1`, [channelId, threadTs]);
+  return !!row;
+}
 async function markTaskSlackReplySent(taskId) {
   await getDbClient().run(`UPDATE agent_tasks SET slackReplySent = 1 WHERE id = ?`, [taskId]);
 }
@@ -7356,7 +7337,7 @@ async function getUnassignedTaskIds(limit = 10) {
   const rows = await getDbClient().query("SELECT id FROM agent_tasks WHERE status = 'unassigned' ORDER BY priority DESC, createdAt ASC, rowid ASC LIMIT ?", [limit]);
   return rows.map((r) => r.id);
 }
-async function getUnassignedTaskIdsForAgent(agentId, limit = 10) {
+async function getUnassignedTaskIdsForAgent(agentId, limit = 10, accept) {
   const agent = await getAgentById(agentId);
   if (!agent)
     return [];
@@ -7369,7 +7350,7 @@ async function getUnassignedTaskIdsForAgent(agentId, limit = 10) {
       break;
     for (const row of rows) {
       const task = rowToAgentTask(row);
-      if (isAgentEligibleForTask(agent, task)) {
+      if (isAgentEligibleForTask(agent, task) && (!accept || await accept(task))) {
         eligible.push(task.id);
         if (eligible.length >= limit)
           break;
@@ -11650,8 +11631,8 @@ async function getAvailableKeyIndices(keyType, totalKeys, scope = "global", scop
   await client.run(`UPDATE api_key_status
      SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
      WHERE keyType = ? AND scope = ? AND scopeId = ?
-       AND status = 'rate_limited' AND rateLimitedUntil IS NOT NULL AND rateLimitedUntil <= ?`, [now, keyType, scope, effectiveScopeId, now]);
-  const rows = await client.query(`SELECT keyIndex, status, rateLimitWindows FROM api_key_status
+       AND status = 'rate_limited' AND rateLimitedUntil <= ? AND consecutiveAuthFailures < ?`, [now, keyType, scope, effectiveScopeId, now, CODEX_AUTH_FAILURE_BENCH_THRESHOLD]);
+  const rows = await client.query(`SELECT keyIndex, status, rateLimitWindows, plan, authFailureSeq FROM api_key_status
        WHERE keyType = ? AND scope = ? AND scopeId = ?`, [keyType, scope, effectiveScopeId]);
   const blockedIndices = new Set(rows.filter((r) => r.status === "rate_limited").map((r) => r.keyIndex));
   const modelBlockedIndices = [];
@@ -11670,16 +11651,26 @@ async function getAvailableKeyIndices(keyType, totalKeys, scope = "global", scop
     }
   }
   const modelBlockedSet = new Set(modelBlockedIndices);
+  const seatBlockedIndices = [];
+  if (modelFamily) {
+    for (const row of rows) {
+      if (!planAllowsModelFamily(row.plan, modelFamily))
+        seatBlockedIndices.push(row.keyIndex);
+    }
+  }
+  const seatBlockedSet = new Set(seatBlockedIndices);
   const availableIndices = [];
   for (let i = 0;i < totalKeys; i++) {
-    if (blockedIndices.has(i) || modelBlockedSet.has(i))
+    if (blockedIndices.has(i) || modelBlockedSet.has(i) || seatBlockedSet.has(i))
       continue;
     availableIndices.push(i);
   }
   return {
     availableIndices,
     modelBlockedIndices,
-    earliestModelResetAt: earliestModelResetsAtSec !== undefined ? new Date(earliestModelResetsAtSec * 1000).toISOString() : null
+    seatBlockedIndices,
+    earliestModelResetAt: earliestModelResetsAtSec !== undefined ? new Date(earliestModelResetsAtSec * 1000).toISOString() : null,
+    authFailureFence: Math.max(0, ...rows.map((r) => r.authFailureSeq))
   };
 }
 async function recordKeyUsage(keyType, keySuffix, keyIndex, taskId, scope = "global", scopeId = null, plan = null) {
@@ -11726,12 +11717,50 @@ async function markKeyRateLimited(keyType, keySuffix, keyIndex, rateLimitedUntil
        ON CONFLICT(keyType, keySuffix, scope, scopeId)
        DO UPDATE SET
          status = 'rate_limited',
-         rateLimitedUntil = excluded.rateLimitedUntil,
+         rateLimitedUntil = CASE WHEN status = 'rate_limited' AND consecutiveAuthFailures >= ${CODEX_AUTH_FAILURE_BENCH_THRESHOLD} THEN MAX(COALESCE(rateLimitedUntil, ''), excluded.rateLimitedUntil) ELSE excluded.rateLimitedUntil END,
          lastRateLimitAt = excluded.lastRateLimitAt,
          rateLimitCount = rateLimitCount + 1,
          keyIndex = excluded.keyIndex,
          updatedAt = excluded.updatedAt`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, rateLimitedUntil, now, provider, now]);
 }
+async function recordKeyAuthFailure(keyType, keySuffix, keyIndex, scope = "global", scopeId = null) {
+  const effectiveScopeId = scopeId ?? "";
+  const provider = deriveProviderFromKeyType(keyType);
+  return await getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    const source2 = "report-auth-failure";
+    const row = await tx.get(`INSERT INTO api_key_status (keyType, keySuffix, keyIndex, scope, scopeId, status, consecutiveAuthFailures, lastAuthFailureAt, authFailureSeq, provider, updatedAt)
+         VALUES (?, ?, ?, ?, ?, 'available', 1, ?, (SELECT COALESCE(MAX(authFailureSeq), 0) + 1 FROM api_key_status), ?, ?)
+         ON CONFLICT(keyType, keySuffix, scope, scopeId)
+         DO UPDATE SET
+           consecutiveAuthFailures = consecutiveAuthFailures + 1,
+           lastAuthFailureAt = excluded.lastAuthFailureAt, authFailureSeq = excluded.authFailureSeq,
+           keyIndex = excluded.keyIndex, updatedAt = excluded.updatedAt
+         RETURNING consecutiveAuthFailures, rateLimitedUntil`, [keyType, keySuffix, keyIndex, scope, effectiveScopeId, now, provider, now]);
+    if (!row)
+      throw new Error("Failed to record auth failure");
+    const { consecutiveAuthFailures } = row;
+    if (consecutiveAuthFailures < CODEX_AUTH_FAILURE_BENCH_THRESHOLD) {
+      return { consecutiveAuthFailures, benched: false, rateLimitedUntil: row.rateLimitedUntil };
+    }
+    let benchedUntil = new Date(Date.parse(now) + CODEX_AUTH_FAILURE_BENCH_MS).toISOString();
+    if (row.rateLimitedUntil && Date.parse(row.rateLimitedUntil) > Date.parse(benchedUntil)) {
+      benchedUntil = row.rateLimitedUntil;
+    }
+    await tx.run(`UPDATE api_key_status
+         SET status = 'rate_limited', rateLimitedUntil = ?, lastRateLimitAt = ?,
+             rateLimitCount = rateLimitCount + 1, updatedAt = ?
+         WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [benchedUntil, now, now, keyType, keySuffix, scope, effectiveScopeId]);
+    await upsertKv({
+      namespace: CODEX_AUTH_WATCH_NAMESPACE,
+      key: codexAuthBenchMarkerKey(keySuffix),
+      valueType: "json",
+      value: { keyIndex, keyType, benchedAt: now, benchedUntil, lastFailAt: now, source: source2 },
+      expiresAt: Date.parse(benchedUntil) + 86400000
+    });
+    return { consecutiveAuthFailures, benched: true, rateLimitedUntil: benchedUntil };
+  });
+}
 function mergeRateLimitWindowTelemetry(stored, reported) {
   const merged = { ...stored };
   for (const [type, entry] of Object.entries(reported)) {
@@ -11798,14 +11827,32 @@ async function setApiKeyName(keyType, keySuffix, name, scope = "global", scopeId
        WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?`, [name, new Date().toISOString(), keyType, keySuffix, scope, scopeId ?? ""]);
   return result.changes > 0;
 }
-async function clearKeyRateLimit(keyType, keySuffix, scope = "global", scopeId = null) {
+async function clearKeyRateLimit(keyType, keySuffix, scope = "global", scopeId = null, opts = {}) {
   const now = new Date().toISOString();
   const effectiveScopeId = scopeId ?? "";
-  const result = await getDbClient().run(`UPDATE api_key_status
-       SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
-       WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?
-         AND status = 'rate_limited'`, [now, keyType, keySuffix, scope, effectiveScopeId]);
-  return result.changes > 0;
+  const { keyIndex = -1, authFence = null } = opts;
+  const clearAuthBench = opts.clearAuthBench === true && authFence !== null;
+  const key = [keyType, keySuffix, scope, effectiveScopeId];
+  return await getDbClient().transaction(async (tx) => {
+    const result = await tx.run(`UPDATE api_key_status
+         SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
+         WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?
+           AND status = 'rate_limited' AND ((? AND authFailureSeq <= ?) OR consecutiveAuthFailures < ?)`, [now, ...key, clearAuthBench ? 1 : 0, authFence, CODEX_AUTH_FAILURE_BENCH_THRESHOLD]);
+    const cleared = result.changes > 0;
+    if (!clearAuthBench)
+      return cleared;
+    const lifted = await tx.query(`UPDATE api_key_status SET consecutiveAuthFailures = 0, updatedAt = ?1,
+           status = CASE WHEN keySuffix = ?2 THEN status ELSE 'available' END, rateLimitedUntil = CASE WHEN keySuffix = ?2 THEN rateLimitedUntil END
+         WHERE keyType = ?3 AND scope = ?4 AND scopeId = ?5 AND (consecutiveAuthFailures > 0 OR status = 'rate_limited')
+           AND ((keySuffix = ?2 AND authFailureSeq <= ?7) OR (keySuffix != ?2 AND keyIndex = ?6)) RETURNING keySuffix`, [now, keySuffix, keyType, scope, effectiveScopeId, keyIndex, authFence]);
+    const retired = lifted.filter((row) => row.keySuffix !== keySuffix);
+    if (keyType === "CODEX_OAUTH") {
+      for (const suffix of [...cleared ? [keySuffix] : [], ...retired.map((r) => r.keySuffix)]) {
+        await deleteKv(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(suffix));
+      }
+    }
+    return cleared || retired.length > 0;
+  });
 }
 async function getKeyStatuses(keyType, scope, scopeId) {
   const conditions = [];
@@ -12998,6 +13045,7 @@ var init_db = __esm(() => {
   init_slack_routing();
   init_telemetry();
   init_types();
+  init_codex_auth_failure();
   init_credentials();
   init_github_pull_request();
   init_heartbeat_expiry();
@@ -13020,6 +13068,7 @@ var init_db = __esm(() => {
   init_swarm_config_guard();
   init_task_lifecycle_events();
   init_agents();
+  init_api_keys();
   init_approvals();
   init_context_versions();
   init_runtime();
@@ -13076,4 +13125,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, telemetry, emitIntegrationConnected, init_telemetry, HeartbeatExpiryError, init_heartbeat_expiry, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, isInTransaction, init_db_client, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, listApprovalRequestSummaries, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, onTaskStarted, init_task_lifecycle_events, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateConfigValue, init_swarm_config_guard, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, telemetry, emitIntegrationConnected, init_telemetry, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, HeartbeatExpiryError, init_heartbeat_expiry, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, isInTransaction, init_db_client, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, listApprovalRequestSummaries, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, onTaskStarted, init_task_lifecycle_events, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, recordTaskProviderIfUnset, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateConfigValue, init_swarm_config_guard, recordKeySeatMismatch, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };