@desplega.ai/agent-swarm 1.162.0 → 1.163.0

package/dist/{cli-wxkkd0e0.js → cli-rtekzxtd.js}

@@ -1,14 +1,14 @@
 import {
   seedPricingFromModelsDev
-} from "./cli-vy3ed88x.js";
+} from "./cli-p7y8jxd7.js";
 import {
   ensureRbacSeedsSynced,
   init_rbac_roles
-} from "./cli-2zy95vhm.js";
+} from "./cli-67fh0xdx.js";
 import {
   getDb,
   init_db
-} from "./cli-jf7wmv1r.js";
+} from "./cli-8hsexrtr.js";
 
 // src/be/boot-seeds.ts
 init_db();

package/dist/{cli-kdkwd3yr.js → cli-s81xzy0b.js}

@@ -60,6 +60,10 @@ var init_permissions = __esm(() => {
       description: "Create a task the caller owns.",
       namespace: "task"
     },
+    "task.requester.assign": {
+      description: "Attribute a new task to a user other than the requester of the caller's own current task.",
+      namespace: "task"
+    },
     "task.read.own": {
       description: "Read details of a task the principal requested.",
       namespace: "task"
@@ -100,14 +104,22 @@ var init_permissions = __esm(() => {
       description: "Write or move a memory key under a lead-maintained /longterm root (company-story, entities, timeline).",
       namespace: "memory"
     },
+    "memory.read.any": {
+      description: "List every agent's memories, beyond the caller's own and swarm-scoped entries (lead, operator, or user).",
+      namespace: "memory"
+    },
     "memory.delete.any": {
-      description: "Delete a memory entry (own entries, or swarm-scoped entries as lead).",
+      description: "Delete a memory entry: own agent-scoped entries; swarm-scoped entries as lead, operator, or user; any entry as operator or user.",
       namespace: "memory"
     },
     "channel.delete": {
       description: "Delete a Slack channel.",
       namespace: "channel"
     },
+    "repo.merge-policy.write": {
+      description: "Change a repo's allowMerge guideline, which tells agents whether they may merge a PR themselves.",
+      namespace: "repo"
+    },
     "integration.kapso.manage": {
       description: "Register or unregister a Kapso inbound number.",
       namespace: "integration"
@@ -236,6 +248,10 @@ var init_permissions = __esm(() => {
       description: "Update an MCP server the caller does not own.",
       namespace: "mcp-server"
     },
+    "mcp-server.stdio.write": {
+      description: "Create an agent-scope stdio MCP server, or change or enable what a stdio server runs. A stdio server runs a command on the worker.",
+      namespace: "mcp-server"
+    },
     "mcp-server.read.secrets": {
       description: "Read resolved MCP server secret env/header values.",
       namespace: "mcp-server"
@@ -358,7 +374,7 @@ var init_admission = __esm(() => {
 function actsAsLead(principal) {
   return principal.kind === "agent" && (principal.isLead || hasLeadEquivalence(principal.agentId));
 }
-var leadOnly, operatorOrUser, leadOrOperatorOrUser, leadOrOperator, agentOrOperator, extensionWrite, extensionActivation, leadOrTaskCreator, leadOrResourceOwner, humanOrLeadOrResourceOwner, leadOrOwnNamespace, anyAuthenticated, requesterOwnsTask, memoryOwnerOrLeadSwarm, taskFsMutate, taskProgressWrite, LEGACY_RULES, LEGACY_POLICY;
+var leadOnly, operatorOrUser, leadOrOperatorOrUser, leadOrOperator, agentOrOperator, extensionWrite, extensionActivation, leadOrTaskCreator, leadOrResourceOwner, humanOrLeadOrResourceOwner, leadOrOwnNamespace, anyAuthenticated, requesterOwnsTask, memoryDelete, taskFsMutate, taskProgressWrite, LEGACY_RULES, LEGACY_POLICY;
 var init_legacy_policy = __esm(() => {
   init_env_flag();
   init_elevated_agents();
@@ -459,15 +475,18 @@ var init_legacy_policy = __esm(() => {
       return resource?.kind === "task" && resource.requestedByUserId === principal.userId;
     }
   };
-  memoryOwnerOrLeadSwarm = {
-    name: "memory-owner-or-lead-swarm",
-    denyReason: "requires memory owner, or lead agent for swarm-scoped memories",
+  memoryDelete = {
+    name: "memory-delete",
+    denyReason: "requires operator or user, the lead for swarm-scoped memories, or the owner for agent-scoped memories",
     evaluate: (principal, resource) => {
-      if (principal.kind !== "agent" || resource?.kind !== "owned")
-        return false;
-      if (resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId)
+      if (principal.kind === "operator" || principal.kind === "user")
         return true;
-      return actsAsLead(principal) && resource.scope === "swarm";
+      if (resource?.kind !== "owned")
+        return false;
+      const isOwner = principal.agentId !== "" && resource.ownerAgentId != null && resource.ownerAgentId === principal.agentId;
+      if (actsAsLead(principal))
+        return isOwner || resource.scope === "swarm";
+      return isOwner && resource.scope === "agent";
     }
   };
   taskFsMutate = {
@@ -517,6 +536,7 @@ var init_legacy_policy = __esm(() => {
     "approval.cancel.any": humanOrLeadOrResourceOwner,
     "task.steer.any": leadOrTaskCreator,
     "task.create.own": anyAuthenticated,
+    "task.requester.assign": leadOrOperatorOrUser,
     "task.read.own": requesterOwnsTask,
     "task.cancel.own": requesterOwnsTask,
     "task.steer.own": requesterOwnsTask,
@@ -527,8 +547,10 @@ var init_legacy_policy = __esm(() => {
     "memory.learning.inject": leadOnly,
     "memory.edit.any": leadOrResourceOwner,
     "memory.write.consolidated": leadOnly,
-    "memory.delete.any": memoryOwnerOrLeadSwarm,
+    "memory.read.any": leadOrOperatorOrUser,
+    "memory.delete.any": memoryDelete,
     "channel.delete": leadOnly,
+    "repo.merge-policy.write": leadOrOperatorOrUser,
     "integration.kapso.manage": leadOnly,
     "integration.slack.post": leadOnly,
     "integration.slack.read": leadOnly,
@@ -561,6 +583,7 @@ var init_legacy_policy = __esm(() => {
     "mcp-server.uninstall.any": leadOnly,
     "mcp-server.delete.any": leadOrResourceOwner,
     "mcp-server.update.any": leadOrResourceOwner,
+    "mcp-server.stdio.write": leadOrOperatorOrUser,
     "mcp-server.read.secrets": leadOnly,
     "mcp-oauth.authorize.any": anyAuthenticated,
     "kv.write.any": leadOrOwnNamespace,

package/dist/{cli-kp42yek0.js → cli-vbz0wywh.js}

@@ -15,7 +15,7 @@ import {
 import {
   ensurePricingSeeded,
   ensureRbacSeeded
-} from "./cli-wxkkd0e0.js";
+} from "./cli-rtekzxtd.js";
 import {
   buildCatalogEntries,
   getCatalogGeneration,
@@ -25,10 +25,10 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-zvhd3f64.js";
+} from "./cli-esa2g8rn.js";
 import {
   loadModelsDevCache
-} from "./cli-vy3ed88x.js";
+} from "./cli-p7y8jxd7.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -108,7 +108,7 @@ import {
   validateDefinition,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-5xhpb3kv.js";
+} from "./cli-z5swnjvr.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -124,7 +124,7 @@ import {
 } from "./cli-mzfth0bp.js";
 import {
   embedScript
-} from "./cli-sptrj5f5.js";
+} from "./cli-585swr20.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   LONGTERM_ROOT,
@@ -146,7 +146,7 @@ import {
   rerank,
   resolveStoreKey,
   rowToCandidate
-} from "./cli-5k6k8ta3.js";
+} from "./cli-ykph25en.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -161,7 +161,7 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-kh04eqwe.js";
+} from "./cli-e2e7m2eb.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -191,7 +191,7 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-swfmp1fx.js";
+} from "./cli-zv5gxh3p.js";
 import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
@@ -200,7 +200,7 @@ import {
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-2zy95vhm.js";
+} from "./cli-67fh0xdx.js";
 import {
   can,
   decideAdmission,
@@ -209,7 +209,7 @@ import {
   init_rbac,
   isRbacEnabled,
   revokeLeadEquivalence
-} from "./cli-kdkwd3yr.js";
+} from "./cli-s81xzy0b.js";
 import {
   API_DRAIN_MAX_MS_LIMIT,
   CredentialBindingSchema,
@@ -361,6 +361,7 @@ import {
   getSwarmConfigLookupById,
   getSwarmConfigs,
   getSwarmMetrics,
+  getSwarmRepoById,
   getSwarmRepos,
   getTaskAttachments,
   getTaskById,
@@ -480,7 +481,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-jf7wmv1r.js";
+} from "./cli-8hsexrtr.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -640,7 +641,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-sqvfa090.js";
+} from "./cli-j9tvyt49.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -14379,7 +14380,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-pt68fbwp.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-vcj9h5py.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -29025,7 +29026,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-pt68fbwp.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-vcj9h5py.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -29096,7 +29097,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-7f5pecwg.js");
+  const { getDbClient: getDbClient2 } = await import("./db-k9rc1c3j.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -102830,7 +102831,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-s75wc4wd.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-hn2bv5eh.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await stopSlackApp();
@@ -102843,10 +102844,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-nxpcvpj9.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-35hsdjh7.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-4ht4gqth.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-8wbky6be.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -103668,7 +103669,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-fh9at8nz.js");
+  const dispatcher = await import("./dispatcher-8q94tcgt.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -112841,7 +112842,7 @@ var registerMcpServerCreateTool = (server) => {
   createToolRegistrar(server)("mcp-server-create", {
     title: "Create MCP Server",
     annotations: { destructiveHint: false },
-    description: "Create a new MCP server definition. Agent-scope servers are auto-installed for the creating agent. Swarm/global scope requires lead.",
+    description: "Create a new MCP server definition. Agent-scope servers are auto-installed for the creating agent. Swarm/global scope and stdio servers require lead.",
     inputSchema: object({
       name: string().describe("Server name"),
       description: string().optional().describe("Server description"),
@@ -112893,6 +112894,24 @@ var registerMcpServerCreateTool = (server) => {
           });
         }
       }
+      if (scope === "agent" && args.transport === "stdio") {
+        const agent = await getAgentById(requestInfo.agentId);
+        const decision = can({
+          principal: {
+            kind: "agent",
+            agentId: requestInfo.agentId,
+            isLead: agent?.isLead ?? false
+          },
+          verb: "mcp-server.stdio.write",
+          resource: { kind: "none" },
+          source: "mcp"
+        });
+        if (!decision.allow) {
+          return toolErr("Only lead agents can create or change stdio MCP servers.", {
+            data: { yourAgentId: requestInfo.agentId }
+          });
+        }
+      }
       const created = await createMcpServer({
         name: args.name,
         description: args.description,
@@ -113156,12 +113175,38 @@ var registerMcpServerUninstallTool = (server) => {
 // src/tools/mcp-servers/mcp-server-update.ts
 init_zod();
 init_db();
+
+// src/be/mcp-server-checked-update.ts
+init_db();
+async function updateMcpServerChecked(id, updates, check) {
+  return await getDbClient().transaction(async () => {
+    const existing = await getMcpServerById(id);
+    if (!existing)
+      return { kind: "not-found" };
+    const refusal = await check(existing);
+    if (refusal !== null)
+      return { kind: "refused", refusal };
+    const server = await updateMcpServer(id, updates);
+    return server ? { kind: "updated", server } : { kind: "not-found" };
+  });
+}
+
+// src/be/mcp-server-stdio-gate.ts
+var differs = (next, current) => next !== undefined && next !== current;
+function updateTouchesStdioExecution(existing, updates) {
+  const resulting = updates.transport ?? existing.transport;
+  if (resulting === "http" || resulting === "sse")
+    return false;
+  return differs(updates.transport, existing.transport) || differs(updates.command, existing.command) || differs(updates.args, existing.args) || differs(updates.envConfigKeys, existing.envConfigKeys) || updates.isEnabled !== undefined && Boolean(updates.isEnabled) && !existing.isEnabled;
+}
+
+// src/tools/mcp-servers/mcp-server-update.ts
 init_rbac();
 var registerMcpServerUpdateTool = (server) => {
   createToolRegistrar(server)("mcp-server-update", {
     title: "Update MCP Server",
     annotations: { destructiveHint: false },
-    description: "Update an MCP server's configuration. Only the owner or lead can update.",
+    description: "Update an MCP server's configuration. Only the owner or lead can update. Changing or enabling what a stdio server runs requires lead.",
     inputSchema: object({
       id: string().describe("ID of the MCP server to update"),
       name: string().optional().describe("New name"),
@@ -113185,26 +113230,6 @@ var registerMcpServerUpdateTool = (server) => {
       return toolErr("Agent ID not found.");
     }
     try {
-      const existing = await getMcpServerById(args.id);
-      if (!existing) {
-        return toolErr("MCP server not found.", { data: { yourAgentId: requestInfo.agentId } });
-      }
-      const agent = await getAgentById(requestInfo.agentId);
-      const decision = can({
-        principal: {
-          kind: "agent",
-          agentId: requestInfo.agentId,
-          isLead: agent?.isLead ?? false
-        },
-        verb: "mcp-server.update.any",
-        resource: { kind: "owned", ownerAgentId: existing.ownerAgentId },
-        source: "mcp"
-      });
-      if (!decision.allow) {
-        return toolErr("Only the owning agent or lead can update this MCP server.", {
-          data: { yourAgentId: requestInfo.agentId }
-        });
-      }
       const updates = {};
       if (args.name !== undefined)
         updates.name = args.name;
@@ -113228,10 +113253,42 @@ var registerMcpServerUpdateTool = (server) => {
         updates.extraAuthorizeParams = args.extraAuthorizeParams;
       if (args.isEnabled !== undefined)
         updates.isEnabled = args.isEnabled;
-      const updated = await updateMcpServer(args.id, updates);
-      if (!updated) {
-        return toolErr("Update failed.", { data: { yourAgentId: requestInfo.agentId } });
+      const agentId = requestInfo.agentId;
+      const result = await updateMcpServerChecked(args.id, updates, async (existing) => {
+        const agent = await getAgentById(agentId);
+        const principal = {
+          kind: "agent",
+          agentId,
+          isLead: agent?.isLead ?? false
+        };
+        const decision = can({
+          principal,
+          verb: "mcp-server.update.any",
+          resource: { kind: "owned", ownerAgentId: existing.ownerAgentId },
+          source: "mcp"
+        });
+        if (!decision.allow)
+          return "Only the owning agent or lead can update this MCP server.";
+        if (updateTouchesStdioExecution(existing, updates)) {
+          const stdioDecision = can({
+            principal,
+            verb: "mcp-server.stdio.write",
+            resource: { kind: "none" },
+            source: "mcp"
+          });
+          if (!stdioDecision.allow) {
+            return "Only lead agents can create or change stdio MCP servers.";
+          }
+        }
+        return null;
+      });
+      if (result.kind === "not-found") {
+        return toolErr("MCP server not found.", { data: { yourAgentId: requestInfo.agentId } });
+      }
+      if (result.kind === "refused") {
+        return toolErr(result.refusal, { data: { yourAgentId: requestInfo.agentId } });
       }
+      const updated = result.server;
       return toolOk(`Updated MCP server "${updated.name}" to version ${updated.version}.`, {
         data: { yourAgentId: requestInfo.agentId, server: updated }
       });
@@ -113248,7 +113305,7 @@ init_rbac();
 var registerMemoryDeleteTool = (server) => {
   createToolRegistrar(server)("memory-delete", {
     title: "Delete a memory",
-    description: "Delete a specific memory by its ID. Agents can delete their own memories; lead agents can also delete swarm-scoped memories.",
+    description: "Delete a specific memory by its ID. Agents can delete their own agent-scoped memories; only the lead can delete swarm-scoped memories.",
     annotations: { destructiveHint: true },
     inputSchema: object({
       memoryId: uuid().describe("The ID of the memory to delete.")
@@ -113279,7 +113336,7 @@ var registerMemoryDeleteTool = (server) => {
       source: "mcp"
     });
     if (!decision.allow) {
-      return toolErr("Permission denied. You can only delete your own memories, or swarm memories if you are the lead.", { data: { yourAgentId: requestInfo.agentId } });
+      return toolErr("Permission denied. You can only delete your own agent-scoped memories; only the lead can delete swarm memories.", { data: { yourAgentId: requestInfo.agentId } });
     }
     const deleted = await store.delete(memoryId);
     const message = deleted ? `Memory "${memoryId}" deleted.` : `Failed to delete memory "${memoryId}".`;
@@ -116185,6 +116242,35 @@ var registerGetReposTool = (server) => {
 // src/tools/repos/update-repo.ts
 init_zod();
 init_db();
+
+// src/be/repo-checked-update.ts
+init_db();
+
+// src/be/repo-merge-policy.ts
+function changesAllowMerge(current, incoming) {
+  if (incoming === undefined)
+    return false;
+  return incoming?.allowMerge === true !== (current?.allowMerge === true);
+}
+
+// src/be/repo-checked-update.ts
+async function updateSwarmRepoChecked(id, updates, authorize) {
+  return await getDbClient().transaction(async () => {
+    if (updates.guidelines !== undefined) {
+      const existing = await getSwarmRepoById(id);
+      if (existing && changesAllowMerge(existing.guidelines, updates.guidelines)) {
+        const refusal = await authorize(existing);
+        if (refusal !== null)
+          return { kind: "refused", refusal };
+      }
+    }
+    const repo = await updateSwarmRepo(id, updates);
+    return repo ? { kind: "updated", repo } : { kind: "not-found" };
+  });
+}
+
+// src/tools/repos/update-repo.ts
+init_rbac();
 init_types();
 var swarmRepoOutputShape2 = looseObject({
   id: string().optional(),
@@ -116206,7 +116292,7 @@ var swarmRepoOutputShape2 = looseObject({
 var registerUpdateRepoTool = (server) => {
   createToolRegistrar(server)("update-repo", {
     title: "Update Repo",
-    description: "Update a repo's configuration including guidelines (PR checks, merge policy, review guidance). The lead uses this to set guidelines after asking the user. Pass null for guidelines to clear them.",
+    description: "Update a repo's configuration including guidelines (PR checks, merge policy, review guidance). The lead uses this to set guidelines after asking the user. Pass null for guidelines to clear them. Only the lead can change allowMerge: resend its current value to edit other guidelines.",
     annotations: { readOnlyHint: false },
     inputSchema: object({
       id: string().uuid().describe("The repo ID to update."),
@@ -116221,11 +116307,27 @@ var registerUpdateRepoTool = (server) => {
     outputSchema: swarmToolOutputSchema({
       repo: swarmRepoOutputShape2.nullable().optional()
     })
-  }, async ({ id, ...updates }) => {
-    const updated = await updateSwarmRepo(id, updates);
-    if (!updated) {
+  }, async ({ id, ...updates }, requestInfo) => {
+    const result = await updateSwarmRepoChecked(id, updates, async (existing) => {
+      const agent = requestInfo.agentId ? await getAgentById(requestInfo.agentId) : null;
+      const decision = can({
+        principal: requestInfo.agentId ? { kind: "agent", agentId: requestInfo.agentId, isLead: agent?.isLead ?? false } : { kind: "operator" },
+        verb: "repo.merge-policy.write",
+        resource: { kind: "none" },
+        source: "mcp"
+      });
+      if (decision.allow)
+        return null;
+      const current = existing.guidelines?.allowMerge === true;
+      return `Only lead agents can change allowMerge (it is currently ${current}). Resend ${current} to keep it while you edit the other guidelines.`;
+    });
+    if (result.kind === "refused") {
+      return toolErr(result.refusal, { data: { repo: null } });
+    }
+    if (result.kind === "not-found") {
       return toolErr(`Repo not found: ${id}`, { data: { repo: null } });
     }
+    const updated = result.repo;
     return toolOk(`Updated repo "${updated.name}".`, {
       details: `Updated repo "${updated.name}" — guidelines: ${updated.guidelines ? "configured" : "not set"}`,
       data: { repo: updated }
@@ -124720,6 +124822,7 @@ var registerScriptUpsertTool = (server) => {
 // src/tools/send-task.ts
 init_zod();
 init_db();
+init_rbac();
 init_slack_routing();
 
 // src/tools/task-dedup.ts
@@ -124805,7 +124908,7 @@ var sendTaskInputSchema = object({
   slackThreadTs: string().optional().describe("Slack thread timestamp. Required with slackChannelId for thread-level updates."),
   slackUserId: string().optional().describe("Slack user ID of the original requester."),
   overrideSlackContext: boolean().default(false).describe("Explicitly route this task's Slack updates to a different channel/thread than its parent/contextKey. Requires slackChannelId AND slackThreadTs. Use only for deliberate cross-channel dispatch (e.g. escalation to another human's DM); logged for audit. Without this flag, a slackChannelId/slackThreadTs that disagrees with the parent task or inherited contextKey is rejected — omit the three Slack fields to inherit them from the parent as a unit instead."),
-  requestedByUserId: string().regex(/^[a-f0-9]{32}$/, "Expected a registry user ID (32 lowercase hexadecimal characters).").optional().describe("Registered requester ID (32 lowercase hexadecimal characters). When omitted, inherited from the caller's current task so the attribution flows through multi-hop delegation automatically."),
+  requestedByUserId: string().regex(/^[a-f0-9]{32}$/, "Expected a registry user ID (32 lowercase hexadecimal characters).").optional().describe("Registered requester ID (32 lowercase hexadecimal characters). When omitted, inherited from the caller's current task so the attribution flows through multi-hop delegation automatically. Only lead agents can name a user other than the requester of their current task."),
   followUpConfig: FollowUpConfigSchema.optional().describe("Control the lead follow-up created when this task finishes. When to use `followUpConfig`: set `disabled: true` when you'll wait for this task to complete inline and no follow-up is needed; set `onCompleted` / `onFailed` with specific instructions when you need to follow up effectively on a particular outcome of a long-running flow; for normal one-shot tasks, leave it unset because defaults are fine. It is most valuable for long-running / complex flows."),
   outputSchema: record(string(), unknown()).optional().describe("Optional JSON Schema the assignee's final output must satisfy. store-progress rejects a completion that does not match. Supported keywords: type, required, properties, enum, const, items.")
 }).superRefine((data, ctx) => {
@@ -124898,6 +125001,21 @@ async function sendTaskHandler(ctx, {
   const creatorAgentId = ctx.kind === "owner" ? ctx.agentId : undefined;
   const sourceTaskId = ctx.kind === "owner" ? ctx.sourceTaskId : undefined;
   const requestedByUserId = ctx.kind === "user" ? ctx.userId : inputRequestedByUserId ?? undefined;
+  if (ctx.kind === "owner" && creatorAgentId && requestedByUserId) {
+    const ownRequester = await resolveTaskAuditUserId(sourceTaskId, creatorAgentId);
+    if (requestedByUserId !== ownRequester) {
+      const caller = await getAgentById(creatorAgentId);
+      const decision = can({
+        principal: { kind: "agent", agentId: creatorAgentId, isLead: caller?.isLead ?? false },
+        verb: "task.requester.assign",
+        resource: { kind: "none" },
+        source: "mcp"
+      });
+      if (!decision.allow) {
+        return toolErr("Only lead agents can set requestedByUserId to anyone but the requester of your current task. Omit it to inherit that requester.", { data: { yourAgentId: creatorAgentId } });
+      }
+    }
+  }
   if (ctx.kind === "owner" && requestedByUserId && !await getUserById(requestedByUserId)) {
     return toolErr("requestedByUserId must identify an existing registered user.", {
       data: { yourAgentId: creatorAgentId }
@@ -133338,7 +133456,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-pt68fbwp.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-vcj9h5py.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -134143,4 +134261,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, workflowSaveWarnings, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, findUserById, findUserByExternalId, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, mintSessionToken, revokeSessionToken, fingerprintApiKey, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, automationIntegrationFixUrl, preflightAutomation, getAutomationSetupStates, listEnabledAutomationPreflightInputs, validateJsonSchema, workflowSaveWarnings, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, toolErr, createToolRegistrar, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };

package/dist/{cli-q24re23n.js → cli-vy32s71t.js}

@@ -17,13 +17,13 @@ import {
   recoverIncompleteRuns,
   repointTrackerSyncBySwarmId,
   resolveLeadOnlyRecoveryAssignment
-} from "./cli-kp42yek0.js";
+} from "./cli-vbz0wywh.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
 import {
   createApprovalFollowUpTask
-} from "./cli-5xhpb3kv.js";
+} from "./cli-z5swnjvr.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -74,7 +74,7 @@ import {
   settleSupersededTaskDependents,
   supersedeTask,
   updateAgentStatus
-} from "./cli-jf7wmv1r.js";
+} from "./cli-8hsexrtr.js";
 import {
   init_registry,
   init_resolver,