@desplega.ai/agent-swarm 1.166.0 → 1.168.0

package/dist/{http-3h21z9md.js → http-ef2fnn9v.js}

@@ -23,11 +23,11 @@ import {
 } from "./cli-2pdaysab.js";
 import {
   reasoningCapability
-} from "./cli-ttbsse3f.js";
+} from "./cli-tmhsxhb8.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-gt8azyet.js";
+} from "./cli-jb931ba2.js";
 import {
   DEFAULT_CONNECTOR_CODE_LABEL,
   checkHeartbeatChecklist,
@@ -35,10 +35,10 @@ import {
   exchangeConnectorCode,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-66zh26sp.js";
+} from "./cli-pgehz8e1.js";
 import {
   Anthropic
-} from "./cli-zy7vwsne.js";
+} from "./cli-5qkcdv8c.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -335,7 +335,7 @@ import {
   workflowModelErrors,
   workflowSaveWarnings,
   writeUnhandledError
-} from "./cli-df56tqdw.js";
+} from "./cli-ee0402n1.js";
 import"./cli-xvc3q9br.js";
 import {
   AMP_ESTIMATE_MODELS,
@@ -350,16 +350,16 @@ import {
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-0nhdwxd5.js";
+import"./cli-43jg9xdw.js";
 import {
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh,
   upsertModelCatalogOverlay
-} from "./cli-rggdq8wq.js";
+} from "./cli-9q24yyvs.js";
 import {
   normalizeModelKey
-} from "./cli-ysnyhws9.js";
+} from "./cli-ewhwpyrb.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -383,6 +383,7 @@ import {
   createApprovalFollowUpTask,
   definitionNodeIds,
   deleteMcpOAuthToken,
+  deleteScriptConnection,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   ensureMcpToken,
@@ -436,19 +437,12 @@ import {
   upsertMcpOAuthToken,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-jvj6a0cv.js";
+} from "./cli-g6gx2dn1.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import {
-  detachedProcessGroup,
-  forceTerminateProcessGroup,
-  registerProcessGroup,
-  signalProcessGroup,
-  terminateProcessGroup
-} from "./cli-zt3w1cn1.js";
-import"./cli-f2n17zhp.js";
+import"./cli-7mhy3ths.js";
 import {
   CLIENT_ID,
   MAX_CODEX_OAUTH_SLOT,
@@ -459,11 +453,24 @@ import {
   getAccountId,
   getValidCodexOAuth,
   loadAllCodexOAuthSlots
-} from "./cli-feh3dkah.js";
-import"./cli-3dpj7atn.js";
-import"./cli-2x0e561b.js";
-import"./cli-pkke6geq.js";
+} from "./cli-v1w7pbd8.js";
+import {
+  detachedProcessGroup,
+  forceTerminateProcessGroup,
+  registerProcessGroup,
+  signalProcessGroup,
+  terminateProcessGroup
+} from "./cli-zt3w1cn1.js";
+import"./cli-km4x66j0.js";
 import"./cli-rb9m6rpe.js";
+import"./cli-2x0e561b.js";
+import {
+  buildAuthorizationUrl,
+  exchangeAuthorizationCode,
+  forceRefreshAuthorizationOrThrow,
+  forceRefreshTokenOrThrow,
+  oauthAppRowToProviderConfig
+} from "./cli-fhj4y16f.js";
 import {
   AgentFsProvider,
   FilesError,
@@ -471,13 +478,6 @@ import {
   getFileStorageProvider,
   normalizeFilesError
 } from "./cli-mzfth0bp.js";
-import {
-  buildAuthorizationUrl,
-  exchangeAuthorizationCode,
-  forceRefreshAuthorizationOrThrow,
-  forceRefreshTokenOrThrow,
-  oauthAppRowToProviderConfig
-} from "./cli-j2jbr8af.js";
 import"./cli-fad8m16k.js";
 import"./cli-bsakbbkm.js";
 import"./cli-zxg80zs9.js";
@@ -496,33 +496,34 @@ import {
   recordDbRetentionStatement,
   recordDbRetentionSweep,
   recordSessionCost,
+  require_content_type,
   startSlackApp,
   startSpan,
   stopSlackApp,
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-ecknp7p1.js";
+} from "./cli-j05x7pnb.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
 import"./cli-yatxqynm.js";
 import {
   bedrockProviderModule
-} from "./cli-ng97fjq7.js";
+} from "./cli-cmxkbzzs.js";
 import"./cli-yn0a417a.js";
 import"./cli-cgj4hc12.js";
 import"./cli-txgcknmy.js";
 import"./cli-6map995v.js";
-import"./cli-8kt0bmgx.js";
+import"./cli-xf713zz0.js";
 import"./cli-y2apkfe2.js";
 import"./cli-7kyk9jr3.js";
 import {
   setBedrockProviderModule
-} from "./cli-b0f70z24.js";
-import"./cli-nexwh8zg.js";
+} from "./cli-mn8qkd8v.js";
+import"./cli-g7k7zbcz.js";
 import"./cli-btbzvq95.js";
 import"./cli-1m2e086m.js";
-import"./cli-bzr0ftht.js";
+import"./cli-wnb9b2g3.js";
 import"./cli-bd957dgb.js";
 import {
   import_websocket,
@@ -532,7 +533,7 @@ import"./cli-pzxba7gw.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-8kgvmkak.js";
+} from "./cli-0jngabtb.js";
 import {
   LEGACY_RULES,
   can,
@@ -925,7 +926,8 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-yshaazs1.js";
+} from "./cli-74ez9b66.js";
+import"./cli-3qhyh31j.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -1053,12 +1055,11 @@ import {
   isTerminalTaskStatus,
   splitLegacyModelAlias
 } from "./cli-xvdgasgy.js";
-import"./cli-3qhyh31j.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-jhm6hzjn.js";
+} from "./cli-mxvnnv5q.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
@@ -1068,21 +1069,6 @@ import {
   getSlackConfiguration,
   init_config
 } from "./cli-dmtrxqhg.js";
-import"./cli-tadfgd0t.js";
-import {
-  MODEL_SCOPED_WINDOWS,
-  activeModelBlocks,
-  init_model_rate_limit_windows
-} from "./cli-ywybs5as.js";
-import {
-  MAX_PROFILE_FILE_LENGTH,
-  agentFsFileRoute,
-  getAppUrl,
-  getConfiguredAppUrls,
-  getMcpBaseUrl,
-  getPublicMcpBaseUrl,
-  init_constants
-} from "./cli-gd4favx9.js";
 import"./cli-agamgm0p.js";
 import {
   getAllTemplateDefinitions,
@@ -1099,7 +1085,26 @@ import {
   init_subscription_plans,
   isSubscriptionPlanId
 } from "./cli-1a2j50m0.js";
+import"./cli-tadfgd0t.js";
+import {
+  MODEL_SCOPED_WINDOWS,
+  activeModelBlocks,
+  init_model_rate_limit_windows
+} from "./cli-ywybs5as.js";
 import"./cli-f9w1semm.js";
+import {
+  getOpenRouterAttributionHeaders,
+  init_openrouter_base_url
+} from "./cli-a35hzdve.js";
+import {
+  MAX_PROFILE_FILE_LENGTH,
+  agentFsFileRoute,
+  getAppUrl,
+  getConfiguredAppUrls,
+  getMcpBaseUrl,
+  getPublicMcpBaseUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
@@ -1108,7 +1113,7 @@ import {
 import {
   init_src,
   isAlias
-} from "./cli-zsh093hk.js";
+} from "./cli-014vns2y.js";
 import {
   exports_zod,
   init_zod
@@ -1125,7 +1130,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-4r1sjfc4.js";
+} from "./cli-ng1pmdx6.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -10004,6 +10009,605 @@ export default extension;
     },
     readme: '# require-verification-note\n\nGuards `store-progress` with `status: "completed"`. The call is refused until the `output` contains the configured marker (default `Verified:`). The agent sees the reason as a tool error and can retry with a corrected output.\n\nConfig:\n\n```json\n{ "marker": "Verified:" }\n```\n\nThe guard covers agent MCP calls only. REST and dashboard completions are not tool calls and pass through.\n'
   },
+  "slack-reply-gate": {
+    manifestFile: "manifest.json",
+    manifest: {
+      $schema: "../manifest.schema.json",
+      name: "slack-reply-gate",
+      description: "Asks Jev (TypeSafe or OpenRouter) whether Lead should answer a buffered Slack thread follow-up, and drops the wake-up when it should not",
+      version: "1.2.0",
+      runtime: "api",
+      assets: {
+        hooks: "hooks.ts"
+      }
+    },
+    files: {
+      "hooks.ts": `import { type ApiCtx, block, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+/**
+ * slack-reply-gate
+ *
+ * Every human message in a Slack thread the swarm takes part in is buffered and
+ * flushed into a Lead task ("[Thread follow-up — N message(s) buffered]"), even
+ * "lol", ":joy:" or two people bantering. This hook asks TypeSafe Jev whether
+ * Lead should answer, and drops the wake-up when the answer is no.
+ *
+ * Hook: \`pre.task.create\`, origin "slack", description carrying the
+ * thread-buffer header. \`pre.slack.route\` cannot be used: the buffered thread
+ * path returns before that hook is dispatched, and its result can only
+ * re-target a message, never drop it.
+ *
+ * Rules:
+ *   - A message that @mentions Lead passes without a Jev call.
+ *   - Otherwise one Jev \`choice\` question classifies the message into a reason;
+ *     reply=false only for reaction_only | banter_between_others |
+ *     not_addressed_to_lead, and only when the summed probability of those
+ *     three labels is >= minConfidence (a banter/reaction split is still a skip).
+ *   - Fails OPEN on every error, timeout or missing key.
+ *
+ * Transport (config.provider): Jev is served by TypeSafe directly and by
+ * OpenRouter's Decisions endpoint. Both take the same {model, state, questions}
+ * body and return the same \`answers\` shape. \`auto\` uses TYPESAFE_API_KEY when
+ * set, else OPENROUTER_API_KEY.
+ *
+ * modes (config.mode):
+ *   off     -> never evaluate
+ *   shadow  -> evaluate + record, never block (default)
+ *   enforce -> record, block the task when reply=false, and mark the
+ *              triggering Slack message with :mute: (config.muteReaction)
+ *
+ * Muting: no swarm tool or ctx method adds a Slack reaction, so the hook calls
+ * the Slack Web API (reactions.remove / reactions.add) with the bot token. It
+ * first removes the bot's own acceptance reactions (:eyes:, :heavy_plus_sign:,
+ * :zap:, :speech_balloon:, or their SLACK_REACTION_* overrides), the same set
+ * the engine clears when it finalizes a task, then adds :mute:. With
+ * muteReaction "" it only removes them: a true no-op on the message. It runs after
+ * the block decision returns, so a slow or failing Slack call never delays or
+ * changes the drop; its errors go to the same KV namespace.
+ *
+ * Every decision lands in KV namespace \`ext:slack-reply-gate\`.
+ */
+
+export const config = z.object({
+  mode: z.enum(["off", "shadow", "enforce"]).default("shadow"),
+  timeoutMs: z.number().int().positive().default(3000),
+  provider: z.enum(["auto", "typesafe", "openrouter"]).default("auto"),
+  /** Jev model on the TypeSafe transport. */
+  model: z.string().default("jev-latest"),
+  /** Jev model on the OpenRouter transport. */
+  openrouterModel: z.string().default("typesafe/jev-1.13"),
+  minConfidence: z.number().min(0).max(1).default(0.55),
+  contextMessages: z.number().int().min(0).max(20).default(6),
+  leadAliases: z.array(z.string()).default(["lead"]),
+  botSlackUserIds: z.array(z.string()).default([]),
+  /** Explicit TypeSafe key; otherwise TYPESAFE_API_KEY from the API process env. */
+  apiKey: z.string().optional(),
+  /**
+   * Reaction for a dropped message in enforce mode. "" only removes the bot's
+   * acceptance reaction(s) and adds nothing.
+   */
+  muteReaction: z.string().default("mute"),
+  slackTimeoutMs: z.number().int().positive().default(5000),
+});
+
+type Cfg = z.infer<typeof config>;
+type Swarm = ApiCtx["swarm"];
+
+const NS = "ext:slack-reply-gate";
+const TYPESAFE_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
+const OPENROUTER_ENDPOINT = "https://openrouter.ai/api/alpha/decisions";
+const HEADER_LINE_RE = /(?:^|\\n)\\[Thread follow-up — \\d+ message\\(s\\) buffered\\]\\n/g;
+const CTX_OPEN = "<thread_context>";
+const CTX_CLOSE = "</thread_context>";
+// The dispatcher cancels a handler after 5 s; leave room for the KV writes.
+const MAX_TIMEOUT_MS = 4000;
+
+export const REASONS = {
+  direct_ask:
+    "Asks Lead (or the swarm, the bot, 'you' meaning the AI) a question or for something, explicitly or clearly implied.",
+  followup_to_lead:
+    "Answers, confirms, corrects or continues something Lead or another swarm agent ([Agent]) just said or asked, so Lead needs it to proceed.",
+  instruction_to_lead:
+    "Gives a task, instruction, request or decision for the AI to act on, even without naming it (for example 'can you create X', 'ship it', 'do it').",
+  reaction_only:
+    "Only a reaction: emoji, laughter (lol, haha, jaja), 'boom!', 'nice', 'thanks', '+1', with no request and nothing new for Lead.",
+  banter_between_others:
+    "Chat between the humans, or between other people and other bots, that is not aimed at Lead.",
+  not_addressed_to_lead:
+    "Addressed to a specific other person or another assistant, or an FYI that needs no answer from Lead.",
+  other: "None of the above, or unclear.",
+} as const;
+
+export type Reason = keyof typeof REASONS;
+const SKIP_REASONS: ReadonlySet<string> = new Set([
+  "reaction_only",
+  "banter_between_others",
+  "not_addressed_to_lead",
+]);
+
+const cfgOf = (raw: unknown): Cfg => {
+  const parsed = config.safeParse(raw ?? {});
+  return parsed.success ? parsed.data : config.parse({});
+};
+
+// kv keys accept [a-zA-Z0-9._:/%-]
+const safeKey = (raw: string | undefined | null): string =>
+  (raw && raw.length > 0 ? raw : "unknown").replace(/[^a-zA-Z0-9._:-]/g, "_").slice(0, 120);
+
+const escapeRe = (s: string): string => s.replace(/[.*+?^\${}()|[\\]\\\\]/g, "\\\\$&");
+
+/**
+ * Locate the engine's follow-up header (src/slack/thread-buffer.ts): at the start of the
+ * description, or right after the closing \`</thread_context>\`. Thread context quotes old
+ * messages verbatim, so a header (or a \`</thread_context>\`) quoted inside it is skipped.
+ */
+const findHeader = (description: string): { index: number; end: number } | null => {
+  for (const m of description.matchAll(HEADER_LINE_RE)) {
+    const index = m.index! + (m[0].startsWith("\\n") ? 1 : 0);
+    const before = description.slice(0, index);
+    const open = before.indexOf(CTX_OPEN);
+    if (open < 0 || before.trimEnd().endsWith(CTX_CLOSE)) {
+      return { index, end: m.index! + m[0].length };
+    }
+  }
+  return null;
+};
+
+/**
+ * Split a buffered follow-up description into thread context and new messages, or null
+ * when the description is not a buffered follow-up. Only \`messages\` is new text.
+ */
+export const parseFollowUp = (
+  description: string,
+): { context: string[]; messages: string[] } | null => {
+  const header = findHeader(description);
+  if (!header) return null;
+  const before = description.slice(0, header.index).trimEnd();
+  const open = before.indexOf(CTX_OPEN);
+  const context =
+    open >= 0
+      ? before
+          .slice(open + CTX_OPEN.length, before.length - CTX_CLOSE.length)
+          .split(/\\n(?=<@[A-Z0-9]+[|>]|\\[Agent\\]:)/)
+          .map((m) => m.trim())
+          .filter(Boolean)
+      : [];
+  const messages = description
+    .slice(header.end)
+    .split("\\n---\\n")
+    .map((m) => m.trim())
+    .filter(Boolean);
+  return { context, messages };
+};
+
+/** True when the new text addresses Lead with an @mention. */
+export const mentionsLead = (text: string, aliases: readonly string[]): boolean => {
+  // The buffer rewrites a mention of the swarm's own bot to \`<@U…> (that's you)\`.
+  if (/<@[A-Z0-9]+>\\s*\\(that's you\\)/.test(text)) return true;
+  const names = aliases
+    .map((a) => a.trim())
+    .filter(Boolean)
+    .map(escapeRe);
+  if (names.length === 0) return false;
+  const alt = names.join("|");
+  return (
+    new RegExp(\`(^|[^\\\\w@])@(\${alt})\\\\b\`, "i").test(text) ||
+    new RegExp(\`<@[A-Z0-9]+\\\\|(\${alt})>\`, "i").test(text)
+  );
+};
+
+const secretCache = new Map<string, { value: string; at: number }>();
+const KEY_TTL_MS = 5 * 60 * 1000;
+const usable = (v: string): boolean => Boolean(v) && !v.startsWith("[REDACTED");
+const envOf = (name: string): string => String(process.env[name] ?? "");
+
+/**
+ * Resolve a secret: explicit value, then the API process env. The API process loads
+ * global swarm_config rows into process.env at boot and on config reload.
+ * ctx.swarm.config_get cannot serve it: the SDK scrubs secrets to "[REDACTED:<name>]".
+ */
+const secret = (name: string, explicit?: string): string => {
+  const cached = secretCache.get(name);
+  if (cached && Date.now() - cached.at < KEY_TTL_MS) return cached.value;
+  const value = [String(explicit ?? ""), envOf(name)].find(usable) ?? "";
+  if (usable(value)) secretCache.set(name, { value, at: Date.now() });
+  return value;
+};
+
+/** Test hook: forget cached secrets. */
+export const resetKeyCache = (): void => {
+  secretCache.clear();
+};
+
+export type JevTransport = {
+  provider: "typesafe" | "openrouter";
+  endpoint: string;
+  key: string;
+  model: string;
+};
+
+/**
+ * Pick the Jev transport. \`auto\` prefers TypeSafe and falls back to OpenRouter.
+ * Throws when the chosen provider has no usable key; the handler fails open.
+ */
+export const resolveTransport = (cfg: Cfg): JevTransport => {
+  const typesafe = (): JevTransport | null => {
+    const key = secret("TYPESAFE_API_KEY", cfg.apiKey);
+    return usable(key)
+      ? { provider: "typesafe", endpoint: TYPESAFE_ENDPOINT, key, model: cfg.model }
+      : null;
+  };
+  const openrouter = (): JevTransport | null => {
+    const key = secret("OPENROUTER_API_KEY");
+    return usable(key)
+      ? { provider: "openrouter", endpoint: OPENROUTER_ENDPOINT, key, model: cfg.openrouterModel }
+      : null;
+  };
+  const transport =
+    cfg.provider === "typesafe"
+      ? typesafe()
+      : cfg.provider === "openrouter"
+        ? openrouter()
+        : (typesafe() ?? openrouter());
+  if (transport) return transport;
+  throw new Error(
+    cfg.provider === "typesafe"
+      ? "no TYPESAFE_API_KEY"
+      : cfg.provider === "openrouter"
+        ? "no OPENROUTER_API_KEY"
+        : "no TYPESAFE_API_KEY or OPENROUTER_API_KEY",
+  );
+};
+
+const SLACK_API = "https://slack.com/api";
+// The engine's acceptance reactions (src/slack/reaction-shortcode.ts), by config key.
+const ACCEPTANCE_REACTIONS: ReadonlyArray<[string, string]> = [
+  ["SLACK_REACTION_ACCEPTED", "eyes"],
+  ["SLACK_REACTION_BUFFERED", "heavy_plus_sign"],
+  ["SLACK_REACTION_NOW", "zap"],
+  ["SLACK_REACTION_STEERED", "speech_balloon"],
+];
+const SHORTCODE_RE = /^[a-z0-9_+'-]+(::skin-tone-[2-6])?$/;
+const shortcode = (raw: string): string | null => {
+  const s = raw.trim().replace(/^:/, "").replace(/:$/, "").toLowerCase();
+  return s && SHORTCODE_RE.test(s) ? s : null;
+};
+
+/** The acceptance reactions the engine may have put on the message, deduplicated. */
+export const acceptanceReactions = (): string[] => [
+  ...new Set(ACCEPTANCE_REACTIONS.map(([key, fallback]) => shortcode(envOf(key)) ?? fallback)),
+];
+
+const slackCall = async (
+  method: string,
+  token: string,
+  body: Record<string, string>,
+  timeoutMs: number,
+): Promise<{ ok: boolean; error?: string }> => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(\`\${SLACK_API}/\${method}\`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: \`Bearer \${token}\`,
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (!res.ok) return { ok: false, error: \`http_\${res.status}\` };
+    const data = (await res.json()) as { ok?: boolean; error?: string };
+    return { ok: data?.ok === true, error: data?.error };
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+export type MuteResult = { removed: string[]; added: boolean; errors: string[] };
+
+/**
+ * Replace the bot's acceptance reaction(s) on one message with \`name\`, or only
+ * remove them when \`name\` is "". \`reactions.remove\` only removes the calling
+ * bot's own reaction, so a human's :eyes: stays. Never throws: every failure
+ * lands in \`errors\`.
+ */
+export const muteMessage = async (
+  token: string,
+  channel: string,
+  timestamp: string,
+  name: string,
+  timeoutMs: number,
+): Promise<MuteResult> => {
+  const result: MuteResult = { removed: [], added: false, errors: [] };
+  const call = (method: string, reaction: string) =>
+    slackCall(method, token, { channel, timestamp, name: reaction }, timeoutMs).catch(
+      (err): { ok: boolean; error?: string } => ({ ok: false, error: String(err).slice(0, 120) }),
+    );
+  const removals = acceptanceReactions().filter((r) => r !== name);
+  const removed = await Promise.all(removals.map((r) => call("reactions.remove", r)));
+  removed.forEach((res, i) => {
+    const reaction = removals[i]!;
+    if (res.ok) result.removed.push(reaction);
+    else if (res.error !== "no_reaction" && res.error !== "invalid_name")
+      result.errors.push(\`remove \${reaction}: \${res.error ?? "unknown"}\`);
+  });
+  if (!name) return result;
+  const added = await call("reactions.add", name);
+  if (added.ok || added.error === "already_reacted") result.added = true;
+  else result.errors.push(\`add \${name}: \${added.error ?? "unknown"}\`);
+  return result;
+};
+
+// In-flight mutes, so tests can await the work the handler does not wait for.
+const pendingMutes = new Set<Promise<void>>();
+/** Test hook: wait for every in-flight mute. */
+export const settleMutes = async (): Promise<void> => {
+  await Promise.allSettled([...pendingMutes]);
+};
+
+export type JevVerdict = {
+  reason: string;
+  confidence: number | null;
+  probabilities: Record<string, number> | null;
+  latencyMs: number;
+};
+
+/**
+ * One Jev call: classify the newest message into a reason. Throws on any failure.
+ * TypeSafe and OpenRouter share the request body and the \`answers\` response shape.
+ */
+export const askJev = async (
+  input: {
+    messages: string[];
+    context: string[];
+    sender: string;
+    leadNames: readonly string[];
+  },
+  transport: JevTransport,
+  cfg: Cfg,
+  outer?: AbortSignal,
+): Promise<JevVerdict> => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS));
+  const onOuterAbort = () => controller.abort();
+  outer?.addEventListener("abort", onOuterAbort);
+  const t0 = Date.now();
+  try {
+    const res = await fetch(transport.endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: \`Bearer \${transport.key}\`,
+      },
+      body: JSON.stringify({
+        state: {
+          role: "Decide whether Lead, the coordinating AI agent of a team's agent swarm, should answer a new Slack message in a thread it takes part in. Lead is woken by every message in the thread, including ones not meant for it. Answering noise wastes everyone's time; missing a real ask is worse.",
+          lead_names: input.leadNames,
+          recent_thread_messages: input.context,
+          new_message: input.messages.join("\\n---\\n"),
+          new_message_sender: input.sender,
+        },
+        model: transport.model,
+        questions: {
+          reason: {
+            type: "choice",
+            instructions:
+              "Which label best describes new_message from Lead's point of view? Use recent_thread_messages to tell who it is talking to. Lines starting with [Agent] are swarm bots.",
+            criteria: REASONS,
+          },
+        },
+      }),
+      signal: controller.signal,
+    });
+    if (!res.ok) throw new Error(\`\${transport.provider} \${res.status}\`);
+    const body = (await res.json()) as {
+      answers?: { reason?: { choice?: unknown; confidence?: unknown; probabilities?: unknown } };
+    } | null;
+    const answer = body?.answers?.reason;
+    const reason = typeof answer?.choice === "string" ? answer.choice : "";
+    if (!(reason in REASONS)) throw new Error(\`unexpected choice: \${String(reason).slice(0, 60)}\`);
+    const confidence = typeof answer?.confidence === "number" ? answer.confidence : null;
+    const probabilities =
+      answer?.probabilities && typeof answer.probabilities === "object"
+        ? (answer.probabilities as Record<string, number>)
+        : null;
+    return { reason, confidence, probabilities, latencyMs: Date.now() - t0 };
+  } finally {
+    clearTimeout(timer);
+    outer?.removeEventListener("abort", onOuterAbort);
+  }
+};
+
+/** Probability that the message needs no reply: the summed mass of the skip labels. */
+export const skipProbability = (verdict: JevVerdict): number | null => {
+  if (verdict.probabilities) {
+    let sum = 0;
+    for (const [label, p] of Object.entries(verdict.probabilities)) {
+      if (SKIP_REASONS.has(label) && typeof p === "number") sum += p;
+    }
+    return sum;
+  }
+  return verdict.confidence;
+};
+
+/** Map a Jev verdict to the typed decision. An unsure skip verdict replies. */
+export const decide = (
+  verdict: JevVerdict,
+  minConfidence: number,
+): { reply: boolean; reason: Reason; skipP: number | null; lowConfidence: boolean } => {
+  const reason = verdict.reason as Reason;
+  const skipP = skipProbability(verdict);
+  if (!SKIP_REASONS.has(reason)) return { reply: true, reason, skipP, lowConfidence: false };
+  const lowConfidence = skipP !== null && skipP < minConfidence;
+  return { reply: lowConfidence, reason, skipP, lowConfidence };
+};
+
+const record = async (
+  swarm: Swarm,
+  entry: Record<string, unknown>,
+  counters: string[],
+  prefix: "d" | "m" = "d",
+) => {
+  const at = new Date().toISOString();
+  const thread = safeKey(\`\${entry.channelId ?? ""}_\${entry.threadTs ?? ""}\`);
+  const value = { at, ...entry };
+  await Promise.allSettled([
+    swarm.kv_set({ namespace: NS, key: \`\${prefix}:\${Date.now()}:\${thread}\`, value }),
+    // \`last\` stays the latest decision; mute outcomes only get their own row.
+    ...(prefix === "d" ? [swarm.kv_set({ namespace: NS, key: "last", value })] : []),
+    ...counters.map((c) => swarm.kv_incr({ namespace: NS, key: safeKey(c) })),
+  ]);
+};
+
+/** Mute the triggering message and log the outcome. Never throws. */
+const muteTrigger = async (
+  swarm: Swarm,
+  cfg: Cfg,
+  base: Record<string, unknown>,
+): Promise<void> => {
+  try {
+    const channel = String(base.channelId ?? "");
+    const ts = String(base.triggerTs ?? "");
+    if (!channel || !ts) throw new Error("no slackChannelId or slackTriggerMessageTs");
+    const token = secret("SLACK_BOT_TOKEN");
+    if (!usable(token)) throw new Error("no SLACK_BOT_TOKEN");
+    const result = await muteMessage(token, channel, ts, cfg.muteReaction, cfg.slackTimeoutMs);
+    // "" adds nothing: success is clearing the acceptance reaction(s).
+    const done = cfg.muteReaction ? "muted" : "unreacted";
+    const ok = (result.added || !cfg.muteReaction) && result.errors.length === 0;
+    const action = ok ? done : "mute-error";
+    await record(swarm, { ...base, action, ...result }, [action], "m");
+  } catch (err) {
+    await record(
+      swarm,
+      { ...base, action: "mute-error", errors: [String(err).slice(0, 300)] },
+      ["mute-error"],
+      "m",
+    ).catch(() => {});
+  }
+};
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", async (event, ctx) => {
+    if (event.origin !== "slack") return;
+    // Only buffered follow-ups. A direct @mention task never carries the header outside
+    // its thread context.
+    const followUp = parseFollowUp(event.description);
+    if (!followUp) return;
+
+    const cfg = cfgOf(ctx.config);
+    if (cfg.mode === "off") return;
+
+    const opts = event.options;
+    const base = {
+      mode: cfg.mode,
+      channelId: opts.slackChannelId,
+      threadTs: opts.slackThreadTs,
+      triggerTs: opts.slackTriggerMessageTs,
+      senderSlackId: opts.slackUserId,
+    };
+
+    try {
+      // A draft follow-up carries downloaded files: always let Lead see them.
+      if (opts.status === "draft") {
+        await record(ctx.swarm, { ...base, action: "pass", reason: "has_files" }, [
+          "total",
+          "files",
+        ]);
+        return;
+      }
+
+      // The mention check reads only the new messages, never the thread context.
+      const { context, messages } = followUp;
+      const preview = messages.join(" | ").slice(0, 300);
+
+      if (messages.some((m) => mentionsLead(m, cfg.leadAliases))) {
+        await record(ctx.swarm, { ...base, action: "pass", reason: "mention", preview }, [
+          "total",
+          "mention",
+        ]);
+        return;
+      }
+
+      const transport = resolveTransport(cfg);
+
+      const sender =
+        opts.slackUserId && cfg.botSlackUserIds.includes(opts.slackUserId)
+          ? "bot"
+          : opts.requestedByUserId
+            ? "human (known teammate)"
+            : "unknown (not a known teammate; may be a bot or an external person)";
+
+      const verdict = await askJev(
+        {
+          messages,
+          context: context.slice(-cfg.contextMessages).map((m) => m.slice(0, 500)),
+          sender,
+          leadNames: cfg.leadAliases,
+        },
+        transport,
+        cfg,
+        ctx.signal,
+      );
+      const decision = decide(verdict, cfg.minConfidence);
+
+      const skip = !decision.reply;
+      const action = skip ? (cfg.mode === "enforce" ? "skipped" : "shadow-skip") : "pass";
+      await record(
+        ctx.swarm,
+        {
+          ...base,
+          action,
+          reply: decision.reply,
+          reason: decision.reason,
+          confidence: verdict.confidence,
+          skipP: decision.skipP,
+          lowConfidence: decision.lowConfidence,
+          latencyMs: verdict.latencyMs,
+          provider: transport.provider,
+          sender,
+          preview,
+        },
+        ["total", skip ? action : "reply", \`reason:\${decision.reason}\`],
+      );
+
+      if (skip && cfg.mode === "enforce") {
+        // Not awaited: the block must return inside the dispatcher's 5 s budget
+        // whatever Slack does, and a failed reaction never changes the drop.
+        // An empty (or invalid) muteReaction still clears the acceptance reaction(s).
+        const muteReaction = shortcode(cfg.muteReaction) ?? "";
+        const pending = muteTrigger(ctx.swarm, { ...cfg, muteReaction }, base);
+        pendingMutes.add(pending);
+        void pending.finally(() => pendingMutes.delete(pending));
+        return block(
+          \`slack-reply-gate: no reply needed (\${decision.reason}\${decision.skipP !== null ? \`, p(skip) \${decision.skipP.toFixed(2)}\` : ""})\`,
+        );
+      }
+      return;
+    } catch (err) {
+      // Fail open, always.
+      try {
+        await record(
+          ctx.swarm,
+          { ...base, action: "fail-open", error: String(err).slice(0, 300) },
+          ["total", "error"],
+        );
+      } catch {
+        /* ignore */
+      }
+      ctx.log.warn("slack-reply-gate: failing open", { error: String(err) });
+      return;
+    }
+  });
+};
+
+export default extension;
+`
+    },
+    readme: '# slack-reply-gate\n\nLead is woken by every human message in a Slack thread the swarm takes part in, including "lol", an emoji, or two people chatting with each other. This extension asks Jev, [TypeSafe](https://typesafe.ai)\'s decision model, whether Lead should answer a new thread message, and drops the wake-up when it should not.\n\nInstall config:\n\n```json\n{ "mode": "shadow" }\n```\n\nStart in `shadow`, read the decisions in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks Jev and records the verdict. Never blocks. |\n| `enforce` | Asks Jev, records the verdict, and blocks the Lead task when the answer is no. The message gets :mute: instead: no Lead task, no reply, no outcome card. |\n\n## What it gates\n\nHook: `pre.task.create`, for tasks with origin `slack` whose description carries the thread buffer\'s header `[Thread follow-up — N message(s) buffered]`. Those are the non-mention thread replies that `src/slack/thread-buffer.ts` batches into a Lead task. A direct @mention of the bot creates a task without that header and is never gated.\n\nThe header counts only at the start of the description or right after the closing `</thread_context>`. Thread context quotes old messages verbatim, and an older Lead reply can quote the header itself, so a header inside the context is ignored. Only the text after the real header is treated as new.\n\n## Decision\n\n1. A follow-up with downloaded files (status `draft`) passes without a Jev call.\n2. **@mention pass-through.** A new message that @mentions Lead passes without a Jev call. A mention is the bot mention the engine rewrites to `<@U…> (that\'s you)`, a resolved `<@U…|lead>`, or a literal `@lead` (any name in `leadAliases`). Only the new messages are scanned, never the thread context, so an old mention earlier in the thread does not pass later banter.\n3. Otherwise one Jev call (one `choice` question, see [Jev transport](#jev-transport)) with the new message(s), the sender kind, and the last `contextMessages` thread messages. Labels: `direct_ask`, `followup_to_lead`, `instruction_to_lead`, `reaction_only`, `banter_between_others`, `not_addressed_to_lead`, `other`.\n4. The answer is no only when the top label is `reaction_only`, `banter_between_others`, or `not_addressed_to_lead`, and the summed probability of those three labels is at least `minConfidence`. A split between two skip labels is still a skip. An unsure verdict replies.\n\nSeveral buffered messages are judged together. One mention in any of them passes the batch.\n\n## Jev transport\n\nJev is reachable two ways. Both take the same request and return the same answer, so the decision is identical whichever one runs.\n\n| `provider` | Endpoint | Key | Model |\n|---|---|---|---|\n| `typesafe` | `POST https://api.typesafe.ai/v1/systemone` | `TYPESAFE_API_KEY` (or `apiKey`) | `model`, default `jev-latest` |\n| `openrouter` | `POST https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `openrouterModel`, default `typesafe/jev-1.13` |\n| `auto` (default) | TypeSafe when its key is set, else OpenRouter | | |\n\nUnder `auto`, `TYPESAFE_API_KEY` wins when both keys are set. With neither key, every message fails open and the KV row names both secrets. Each decision row records the `provider` that answered.\n\n## Fail open\n\nEvery error lets the task through: a missing key, a TypeSafe HTTP error, a network error, a timeout, a malformed answer, or an unknown label. The handler never throws, so an outage cannot auto-disable the extension. Each failure is recorded as `fail-open` in KV and logged as a warning.\n\n## :mute: on drop (enforce)\n\nNo swarm tool or extension `ctx` method adds a Slack reaction, so the hook calls the Slack Web API with the bot token. It needs the `reactions:write` scope, which the Slack app already uses for its acceptance reactions.\n\n1. `reactions.remove` for each acceptance reaction the engine may have put on the triggering message: `eyes`, `heavy_plus_sign`, `zap`, `speech_balloon`, or their `SLACK_REACTION_ACCEPTED`, `SLACK_REACTION_BUFFERED`, `SLACK_REACTION_NOW`, and `SLACK_REACTION_STEERED` overrides. Slack only removes the bot\'s own reaction, so a human\'s :eyes: stays.\n2. `reactions.add` with `muteReaction` (default `mute`). `already_reacted` counts as success. Skipped when `muteReaction` is `""`.\n\nThe block returns first and the Slack calls run after it. A slow or failing Slack call never delays the drop or turns it back into a task. Set `muteReaction` to `""` for a true no-op: step 1 still clears the bot\'s acceptance reaction(s), and nothing is added.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `timeoutMs` | `3000` | Jev call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `provider` | `auto` | `auto`, `typesafe`, or `openrouter`. See [Jev transport](#jev-transport) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `minConfidence` | `0.55` | Minimum summed skip probability to skip |\n| `contextMessages` | `6` | Thread messages sent to Jev, 0 to 20 |\n| `leadAliases` | `["lead"]` | A literal `@alias` in a new message counts as a mention |\n| `botSlackUserIds` | `[]` | Slack user ids labelled `bot` as the sender for Jev |\n| `apiKey` | unset | Explicit TypeSafe key. Prefer the `TYPESAFE_API_KEY` secret below |\n| `muteReaction` | `mute` | Reaction for a dropped message; `""` only removes the acceptance reaction(s) |\n| `slackTimeoutMs` | `5000` | Timeout per Slack call |\n\n## Required secrets\n\nAll are read from the API process environment at call time. Set them as global `swarm_config` secrets: the API process loads global rows into `process.env` at boot and on config reload.\n\n- `TYPESAFE_API_KEY` or `OPENROUTER_API_KEY`: one is required for any evaluation. Under `auto`, TypeSafe wins when both are set. Without either, every message fails open.\n- `SLACK_BOT_TOKEN`: the Slack app\'s bot token. A swarm with Slack connected already has it. Without it, `enforce` still drops the message but cannot touch its reactions, and logs a `mute-error`.\n\nNo key is written to config, KV, logs, or a description.\n\n## KV namespace `ext:slack-reply-gate`\n\n- `d:<epochMs>:<channel>_<threadTs>`: one row per decision, with `action` (`pass`, `shadow-skip`, `skipped`, `fail-open`), `provider`, `reason`, `confidence`, `skipP`, `latencyMs`, `sender`, and a 300-character `preview`.\n- `m:<epochMs>:<channel>_<threadTs>`: one row per mute attempt, with `action` (`muted`, `unreacted` when `muteReaction` is `""`, `mute-error`), `removed`, `added`, and `errors`.\n- `last`: the latest decision. Mute rows never overwrite it.\n- Counters: `total`, `mention`, `files`, `reply`, `shadow-skip`, `skipped`, `error`, `muted`, `unreacted`, `mute-error`, and `reason:<label>`.\n\n## Known limits\n\n- When Lead already has an active task in the thread, the buffer steers that task instead of creating one, so `pre.task.create` does not fire and the gate does not run.\n- A blocked flush makes the thread buffer log a `TaskCreationBlockedError`. Nothing is lost: the next follow-up\'s `<thread_context>` carries the earlier messages.\n- A flush of several messages mutes only the triggering (last) message. The others keep their acceptance reaction.\n'
+  },
   "task-digest": {
     manifestFile: "manifest.yaml",
     manifest: {
@@ -12959,6 +13563,85 @@ var getRequestListener = (fetchCallback, options = {}) => {
   };
 };
 
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header2) {
+  if (!header2) {
+    return;
+  }
+  try {
+    return import_content_type.default.parse(header2).type;
+  } catch {
+    const essence = (header2.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header2.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header2) {
+  if (header2 === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header2) === "application/json";
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/requestBody.js
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+var MAX_BATCH_SIZE2 = 100;
+function requestBodyTooLargeMessage(maxBytes) {
+  return `Payload Too Large: Request body must not exceed ${maxBytes} bytes`;
+}
+function resolveMaxRequestBodySize(value) {
+  if (value === undefined) {
+    return DEFAULT_MAX_REQUEST_BODY_SIZE;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`maxRequestBodySize must be a positive number of bytes, got ${String(value)}`);
+  }
+  return value;
+}
+async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE) {
+  if (Number(request.headers.get("content-length")) > maxBytes) {
+    return { tooLarge: true };
+  }
+  if (request.body === null) {
+    return { tooLarge: false, text: "" };
+  }
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder;
+  let received = 0;
+  let text = "";
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      received += value.byteLength;
+      if (received > maxBytes) {
+        return { tooLarge: true };
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return { tooLarge: false, text: text + decoder.decode() };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000;
+var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
@@ -12966,10 +13649,12 @@ class WebStandardStreamableHTTPServerTransport {
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -12979,6 +13664,23 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+    this._maxRequestBodySize = resolveMaxRequestBodySize(options.maxRequestBodySize);
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -13026,6 +13728,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -13065,6 +13770,7 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
@@ -13092,18 +13798,25 @@ data:
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers2 = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers2["mcp-session-id"] = this.sessionId;
@@ -13112,12 +13825,16 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers: headers2 });
   }
   async replayEvents(lastEventId) {
@@ -13141,20 +13858,33 @@ data:
       const headers2 = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers2["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -13162,19 +13892,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers: headers2 });
     } catch (error) {
       this.onerror?.(error);
@@ -13224,7 +13969,7 @@ data:
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
         this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
@@ -13237,12 +13982,22 @@ data:
         rawMessage = options.parsedBody;
       } else {
         try {
-          rawMessage = await req.json();
+          const body = await readRequestBody(req, this._maxRequestBodySize);
+          if (body.tooLarge) {
+            const message = requestBodyTooLargeMessage(this._maxRequestBodySize);
+            this.onerror?.(new Error(message));
+            return this.createJsonErrorResponse(413, -32000, message);
+          }
+          rawMessage = JSON.parse(body.text);
         } catch {
           this.onerror?.(new Error("Parse error: Invalid JSON"));
           return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
         }
       }
+      if (Array.isArray(rawMessage) && rawMessage.length > MAX_BATCH_SIZE2) {
+        this.onerror?.(new Error(`Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE2} messages`));
+        return this.createJsonErrorResponse(400, -32600, `Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE2} messages`);
+      }
       let messages;
       try {
         if (Array.isArray(rawMessage)) {
@@ -13254,6 +14009,9 @@ data:
         this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
@@ -13280,6 +14038,9 @@ data:
           return protocolError2;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -13310,18 +14071,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers2 = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers2["mcp-session-id"] = this.sessionId;
@@ -13332,6 +14100,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -13341,19 +14112,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+        }
+      } catch (error) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+        throw error;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers: headers2 });
     } catch (error) {
@@ -13370,9 +14155,12 @@ data:
     if (protocolError2) {
       return protocolError2;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
@@ -13402,11 +14190,16 @@ data:
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -13441,7 +14234,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -13450,13 +14243,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -13464,6 +14263,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -13486,6 +14304,7 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
@@ -13720,6 +14539,7 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
       }
       const server = await createServer({
         preloadedTools,
+        enabledTools: configs.find((config) => config.key === "SWARM_ENABLED_TOOLS")?.value ?? process.env.SWARM_ENABLED_TOOLS,
         scriptsOnly: resolveScriptsOnlyMode({
           env: process.env.SCRIPTS_ONLY_MCP,
           configValue
@@ -17984,6 +18804,7 @@ init_db2();
 init_memory();
 init_constants2();
 init_types();
+init_openrouter_base_url();
 
 // src/http/status.ts
 init_zod();
@@ -18707,6 +19528,7 @@ async function handleMemoryProbe(body) {
     const client = new OpenAI({
       baseURL: endpoint.toString(),
       apiKey,
+      defaultHeaders: getOpenRouterAttributionHeaders(endpoint.toString()),
       timeout: 15000,
       maxRetries: 0,
       fetchOptions: { redirect: "manual" }
@@ -22773,6 +23595,25 @@ var setConnectionEnabledRoute = route({
   },
   rbac: { permission: "script-connection.manage" }
 });
+var deleteConnectionRoute = route({
+  method: "delete",
+  path: "/api/script-connections/{id}",
+  pattern: ["api", "script-connections", null],
+  operationId: "script_connections_delete",
+  summary: "Delete a script connection",
+  description: "Hard-deletes the connection, its auto-managed credential binding, and any derived inline secret it owns.",
+  tags: ["Script Connections"],
+  params: idParamsSchema2,
+  responses: {
+    200: {
+      description: "Script connection deleted",
+      schema: exports_external.object({ deleted: exports_external.literal(true), id: exports_external.string() })
+    },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "Script connection not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
 var listCredentialBindingsRoute = route({
   method: "get",
   path: "/api/credential-bindings",
@@ -23861,6 +24702,20 @@ async function handleScriptConnections(req, res, pathSegments, queryParams, agen
     });
     return true;
   }
+  if (deleteConnectionRoute.match(req.method, pathSegments)) {
+    const parsed = await deleteConnectionRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConnectionAdmin(req, res, agentId))
+      return true;
+    const deleted = await deleteScriptConnection(parsed.params.id);
+    if (!deleted) {
+      jsonError(res, "Script connection not found.", 404);
+      return true;
+    }
+    deleteConnectionRoute.respond(res, 200, { deleted: true, id: deleted.id });
+    return true;
+  }
   if (listCredentialBindingsRoute.match(req.method, pathSegments)) {
     const includeManaged = queryParams.get("includeManaged") === "true";
     listCredentialBindingsRoute.respond(res, 200, {
@@ -32848,7 +33703,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-bn6cy8ps.js");
+    const { stopScheduler } = await import("./index-9fc2h7ww.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -32857,7 +33712,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-3xspa9jw.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-qhcqz56v.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -32932,15 +33787,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-vvzs1zhk.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-9qt0j8j2.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-atnkngqs.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-35f91nx2.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-vvzs1zhk.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-9qt0j8j2.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -32948,7 +33803,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-f8xnqrye.js");
+  const { runAllSeeders } = await import("./index-h26wjcfy.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -33008,37 +33863,37 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-bn6cy8ps.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-n99fycq7.js");
+    const { startScheduler } = await import("./index-9fc2h7ww.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-48pb9erw.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-dkfxpkmm.js");
+    const { startHeartbeat } = await import("./index-w2yhye23.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-3xspa9jw.js");
+    const { startOAuthKeepalive } = await import("./keepalive-qhcqz56v.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-sh9q25xp.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-ngskthwh.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-s7k7c6v2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-jvfadhsk.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-998jtpdg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-20q3nzvg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-nepsk4t1.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-jtfajzve.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {