@desplega.ai/agent-swarm 1.167.0 → 1.168.0

package/dist/{http-jsmtag08.js → http-ef2fnn9v.js}

@@ -27,7 +27,7 @@ import {
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-c2tpw9ck.js";
+} from "./cli-jb931ba2.js";
 import {
   DEFAULT_CONNECTOR_CODE_LABEL,
   checkHeartbeatChecklist,
@@ -35,7 +35,7 @@ import {
   exchangeConnectorCode,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-qzmzwegq.js";
+} from "./cli-pgehz8e1.js";
 import {
   Anthropic
 } from "./cli-5qkcdv8c.js";
@@ -335,7 +335,7 @@ import {
   workflowModelErrors,
   workflowSaveWarnings,
   writeUnhandledError
-} from "./cli-wydz3feg.js";
+} from "./cli-ee0402n1.js";
 import"./cli-xvc3q9br.js";
 import {
   AMP_ESTIMATE_MODELS,
@@ -350,16 +350,16 @@ import {
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-tx2zvn23.js";
+import"./cli-43jg9xdw.js";
 import {
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh,
   upsertModelCatalogOverlay
-} from "./cli-p8rt8spp.js";
+} from "./cli-9q24yyvs.js";
 import {
   normalizeModelKey
-} from "./cli-v1pwxreq.js";
+} from "./cli-ewhwpyrb.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -383,6 +383,7 @@ import {
   createApprovalFollowUpTask,
   definitionNodeIds,
   deleteMcpOAuthToken,
+  deleteScriptConnection,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   ensureMcpToken,
@@ -436,7 +437,7 @@ import {
   upsertMcpOAuthToken,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-577bxkf6.js";
+} from "./cli-g6gx2dn1.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
@@ -469,7 +470,7 @@ import {
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow,
   oauthAppRowToProviderConfig
-} from "./cli-kw0jcfje.js";
+} from "./cli-fhj4y16f.js";
 import {
   AgentFsProvider,
   FilesError,
@@ -502,7 +503,7 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-c8r99akr.js";
+} from "./cli-j05x7pnb.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
 import"./cli-yatxqynm.js";
@@ -532,7 +533,7 @@ import"./cli-pzxba7gw.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-ypgba1a8.js";
+} from "./cli-0jngabtb.js";
 import {
   LEGACY_RULES,
   can,
@@ -925,7 +926,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-mkdsy1nq.js";
+} from "./cli-74ez9b66.js";
 import"./cli-3qhyh31j.js";
 import {
   ActiveSessionSchema,
@@ -1129,7 +1130,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-ymmc1zxg.js";
+} from "./cli-ng1pmdx6.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -10008,6 +10009,605 @@ export default extension;
     },
     readme: '# require-verification-note\n\nGuards `store-progress` with `status: "completed"`. The call is refused until the `output` contains the configured marker (default `Verified:`). The agent sees the reason as a tool error and can retry with a corrected output.\n\nConfig:\n\n```json\n{ "marker": "Verified:" }\n```\n\nThe guard covers agent MCP calls only. REST and dashboard completions are not tool calls and pass through.\n'
   },
+  "slack-reply-gate": {
+    manifestFile: "manifest.json",
+    manifest: {
+      $schema: "../manifest.schema.json",
+      name: "slack-reply-gate",
+      description: "Asks Jev (TypeSafe or OpenRouter) whether Lead should answer a buffered Slack thread follow-up, and drops the wake-up when it should not",
+      version: "1.2.0",
+      runtime: "api",
+      assets: {
+        hooks: "hooks.ts"
+      }
+    },
+    files: {
+      "hooks.ts": `import { type ApiCtx, block, type SwarmExtension } from "swarm-extension";
+import { z } from "zod";
+
+/**
+ * slack-reply-gate
+ *
+ * Every human message in a Slack thread the swarm takes part in is buffered and
+ * flushed into a Lead task ("[Thread follow-up — N message(s) buffered]"), even
+ * "lol", ":joy:" or two people bantering. This hook asks TypeSafe Jev whether
+ * Lead should answer, and drops the wake-up when the answer is no.
+ *
+ * Hook: \`pre.task.create\`, origin "slack", description carrying the
+ * thread-buffer header. \`pre.slack.route\` cannot be used: the buffered thread
+ * path returns before that hook is dispatched, and its result can only
+ * re-target a message, never drop it.
+ *
+ * Rules:
+ *   - A message that @mentions Lead passes without a Jev call.
+ *   - Otherwise one Jev \`choice\` question classifies the message into a reason;
+ *     reply=false only for reaction_only | banter_between_others |
+ *     not_addressed_to_lead, and only when the summed probability of those
+ *     three labels is >= minConfidence (a banter/reaction split is still a skip).
+ *   - Fails OPEN on every error, timeout or missing key.
+ *
+ * Transport (config.provider): Jev is served by TypeSafe directly and by
+ * OpenRouter's Decisions endpoint. Both take the same {model, state, questions}
+ * body and return the same \`answers\` shape. \`auto\` uses TYPESAFE_API_KEY when
+ * set, else OPENROUTER_API_KEY.
+ *
+ * modes (config.mode):
+ *   off     -> never evaluate
+ *   shadow  -> evaluate + record, never block (default)
+ *   enforce -> record, block the task when reply=false, and mark the
+ *              triggering Slack message with :mute: (config.muteReaction)
+ *
+ * Muting: no swarm tool or ctx method adds a Slack reaction, so the hook calls
+ * the Slack Web API (reactions.remove / reactions.add) with the bot token. It
+ * first removes the bot's own acceptance reactions (:eyes:, :heavy_plus_sign:,
+ * :zap:, :speech_balloon:, or their SLACK_REACTION_* overrides), the same set
+ * the engine clears when it finalizes a task, then adds :mute:. With
+ * muteReaction "" it only removes them: a true no-op on the message. It runs after
+ * the block decision returns, so a slow or failing Slack call never delays or
+ * changes the drop; its errors go to the same KV namespace.
+ *
+ * Every decision lands in KV namespace \`ext:slack-reply-gate\`.
+ */
+
+export const config = z.object({
+  mode: z.enum(["off", "shadow", "enforce"]).default("shadow"),
+  timeoutMs: z.number().int().positive().default(3000),
+  provider: z.enum(["auto", "typesafe", "openrouter"]).default("auto"),
+  /** Jev model on the TypeSafe transport. */
+  model: z.string().default("jev-latest"),
+  /** Jev model on the OpenRouter transport. */
+  openrouterModel: z.string().default("typesafe/jev-1.13"),
+  minConfidence: z.number().min(0).max(1).default(0.55),
+  contextMessages: z.number().int().min(0).max(20).default(6),
+  leadAliases: z.array(z.string()).default(["lead"]),
+  botSlackUserIds: z.array(z.string()).default([]),
+  /** Explicit TypeSafe key; otherwise TYPESAFE_API_KEY from the API process env. */
+  apiKey: z.string().optional(),
+  /**
+   * Reaction for a dropped message in enforce mode. "" only removes the bot's
+   * acceptance reaction(s) and adds nothing.
+   */
+  muteReaction: z.string().default("mute"),
+  slackTimeoutMs: z.number().int().positive().default(5000),
+});
+
+type Cfg = z.infer<typeof config>;
+type Swarm = ApiCtx["swarm"];
+
+const NS = "ext:slack-reply-gate";
+const TYPESAFE_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
+const OPENROUTER_ENDPOINT = "https://openrouter.ai/api/alpha/decisions";
+const HEADER_LINE_RE = /(?:^|\\n)\\[Thread follow-up — \\d+ message\\(s\\) buffered\\]\\n/g;
+const CTX_OPEN = "<thread_context>";
+const CTX_CLOSE = "</thread_context>";
+// The dispatcher cancels a handler after 5 s; leave room for the KV writes.
+const MAX_TIMEOUT_MS = 4000;
+
+export const REASONS = {
+  direct_ask:
+    "Asks Lead (or the swarm, the bot, 'you' meaning the AI) a question or for something, explicitly or clearly implied.",
+  followup_to_lead:
+    "Answers, confirms, corrects or continues something Lead or another swarm agent ([Agent]) just said or asked, so Lead needs it to proceed.",
+  instruction_to_lead:
+    "Gives a task, instruction, request or decision for the AI to act on, even without naming it (for example 'can you create X', 'ship it', 'do it').",
+  reaction_only:
+    "Only a reaction: emoji, laughter (lol, haha, jaja), 'boom!', 'nice', 'thanks', '+1', with no request and nothing new for Lead.",
+  banter_between_others:
+    "Chat between the humans, or between other people and other bots, that is not aimed at Lead.",
+  not_addressed_to_lead:
+    "Addressed to a specific other person or another assistant, or an FYI that needs no answer from Lead.",
+  other: "None of the above, or unclear.",
+} as const;
+
+export type Reason = keyof typeof REASONS;
+const SKIP_REASONS: ReadonlySet<string> = new Set([
+  "reaction_only",
+  "banter_between_others",
+  "not_addressed_to_lead",
+]);
+
+const cfgOf = (raw: unknown): Cfg => {
+  const parsed = config.safeParse(raw ?? {});
+  return parsed.success ? parsed.data : config.parse({});
+};
+
+// kv keys accept [a-zA-Z0-9._:/%-]
+const safeKey = (raw: string | undefined | null): string =>
+  (raw && raw.length > 0 ? raw : "unknown").replace(/[^a-zA-Z0-9._:-]/g, "_").slice(0, 120);
+
+const escapeRe = (s: string): string => s.replace(/[.*+?^\${}()|[\\]\\\\]/g, "\\\\$&");
+
+/**
+ * Locate the engine's follow-up header (src/slack/thread-buffer.ts): at the start of the
+ * description, or right after the closing \`</thread_context>\`. Thread context quotes old
+ * messages verbatim, so a header (or a \`</thread_context>\`) quoted inside it is skipped.
+ */
+const findHeader = (description: string): { index: number; end: number } | null => {
+  for (const m of description.matchAll(HEADER_LINE_RE)) {
+    const index = m.index! + (m[0].startsWith("\\n") ? 1 : 0);
+    const before = description.slice(0, index);
+    const open = before.indexOf(CTX_OPEN);
+    if (open < 0 || before.trimEnd().endsWith(CTX_CLOSE)) {
+      return { index, end: m.index! + m[0].length };
+    }
+  }
+  return null;
+};
+
+/**
+ * Split a buffered follow-up description into thread context and new messages, or null
+ * when the description is not a buffered follow-up. Only \`messages\` is new text.
+ */
+export const parseFollowUp = (
+  description: string,
+): { context: string[]; messages: string[] } | null => {
+  const header = findHeader(description);
+  if (!header) return null;
+  const before = description.slice(0, header.index).trimEnd();
+  const open = before.indexOf(CTX_OPEN);
+  const context =
+    open >= 0
+      ? before
+          .slice(open + CTX_OPEN.length, before.length - CTX_CLOSE.length)
+          .split(/\\n(?=<@[A-Z0-9]+[|>]|\\[Agent\\]:)/)
+          .map((m) => m.trim())
+          .filter(Boolean)
+      : [];
+  const messages = description
+    .slice(header.end)
+    .split("\\n---\\n")
+    .map((m) => m.trim())
+    .filter(Boolean);
+  return { context, messages };
+};
+
+/** True when the new text addresses Lead with an @mention. */
+export const mentionsLead = (text: string, aliases: readonly string[]): boolean => {
+  // The buffer rewrites a mention of the swarm's own bot to \`<@U…> (that's you)\`.
+  if (/<@[A-Z0-9]+>\\s*\\(that's you\\)/.test(text)) return true;
+  const names = aliases
+    .map((a) => a.trim())
+    .filter(Boolean)
+    .map(escapeRe);
+  if (names.length === 0) return false;
+  const alt = names.join("|");
+  return (
+    new RegExp(\`(^|[^\\\\w@])@(\${alt})\\\\b\`, "i").test(text) ||
+    new RegExp(\`<@[A-Z0-9]+\\\\|(\${alt})>\`, "i").test(text)
+  );
+};
+
+const secretCache = new Map<string, { value: string; at: number }>();
+const KEY_TTL_MS = 5 * 60 * 1000;
+const usable = (v: string): boolean => Boolean(v) && !v.startsWith("[REDACTED");
+const envOf = (name: string): string => String(process.env[name] ?? "");
+
+/**
+ * Resolve a secret: explicit value, then the API process env. The API process loads
+ * global swarm_config rows into process.env at boot and on config reload.
+ * ctx.swarm.config_get cannot serve it: the SDK scrubs secrets to "[REDACTED:<name>]".
+ */
+const secret = (name: string, explicit?: string): string => {
+  const cached = secretCache.get(name);
+  if (cached && Date.now() - cached.at < KEY_TTL_MS) return cached.value;
+  const value = [String(explicit ?? ""), envOf(name)].find(usable) ?? "";
+  if (usable(value)) secretCache.set(name, { value, at: Date.now() });
+  return value;
+};
+
+/** Test hook: forget cached secrets. */
+export const resetKeyCache = (): void => {
+  secretCache.clear();
+};
+
+export type JevTransport = {
+  provider: "typesafe" | "openrouter";
+  endpoint: string;
+  key: string;
+  model: string;
+};
+
+/**
+ * Pick the Jev transport. \`auto\` prefers TypeSafe and falls back to OpenRouter.
+ * Throws when the chosen provider has no usable key; the handler fails open.
+ */
+export const resolveTransport = (cfg: Cfg): JevTransport => {
+  const typesafe = (): JevTransport | null => {
+    const key = secret("TYPESAFE_API_KEY", cfg.apiKey);
+    return usable(key)
+      ? { provider: "typesafe", endpoint: TYPESAFE_ENDPOINT, key, model: cfg.model }
+      : null;
+  };
+  const openrouter = (): JevTransport | null => {
+    const key = secret("OPENROUTER_API_KEY");
+    return usable(key)
+      ? { provider: "openrouter", endpoint: OPENROUTER_ENDPOINT, key, model: cfg.openrouterModel }
+      : null;
+  };
+  const transport =
+    cfg.provider === "typesafe"
+      ? typesafe()
+      : cfg.provider === "openrouter"
+        ? openrouter()
+        : (typesafe() ?? openrouter());
+  if (transport) return transport;
+  throw new Error(
+    cfg.provider === "typesafe"
+      ? "no TYPESAFE_API_KEY"
+      : cfg.provider === "openrouter"
+        ? "no OPENROUTER_API_KEY"
+        : "no TYPESAFE_API_KEY or OPENROUTER_API_KEY",
+  );
+};
+
+const SLACK_API = "https://slack.com/api";
+// The engine's acceptance reactions (src/slack/reaction-shortcode.ts), by config key.
+const ACCEPTANCE_REACTIONS: ReadonlyArray<[string, string]> = [
+  ["SLACK_REACTION_ACCEPTED", "eyes"],
+  ["SLACK_REACTION_BUFFERED", "heavy_plus_sign"],
+  ["SLACK_REACTION_NOW", "zap"],
+  ["SLACK_REACTION_STEERED", "speech_balloon"],
+];
+const SHORTCODE_RE = /^[a-z0-9_+'-]+(::skin-tone-[2-6])?$/;
+const shortcode = (raw: string): string | null => {
+  const s = raw.trim().replace(/^:/, "").replace(/:$/, "").toLowerCase();
+  return s && SHORTCODE_RE.test(s) ? s : null;
+};
+
+/** The acceptance reactions the engine may have put on the message, deduplicated. */
+export const acceptanceReactions = (): string[] => [
+  ...new Set(ACCEPTANCE_REACTIONS.map(([key, fallback]) => shortcode(envOf(key)) ?? fallback)),
+];
+
+const slackCall = async (
+  method: string,
+  token: string,
+  body: Record<string, string>,
+  timeoutMs: number,
+): Promise<{ ok: boolean; error?: string }> => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(\`\${SLACK_API}/\${method}\`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: \`Bearer \${token}\`,
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+    if (!res.ok) return { ok: false, error: \`http_\${res.status}\` };
+    const data = (await res.json()) as { ok?: boolean; error?: string };
+    return { ok: data?.ok === true, error: data?.error };
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+export type MuteResult = { removed: string[]; added: boolean; errors: string[] };
+
+/**
+ * Replace the bot's acceptance reaction(s) on one message with \`name\`, or only
+ * remove them when \`name\` is "". \`reactions.remove\` only removes the calling
+ * bot's own reaction, so a human's :eyes: stays. Never throws: every failure
+ * lands in \`errors\`.
+ */
+export const muteMessage = async (
+  token: string,
+  channel: string,
+  timestamp: string,
+  name: string,
+  timeoutMs: number,
+): Promise<MuteResult> => {
+  const result: MuteResult = { removed: [], added: false, errors: [] };
+  const call = (method: string, reaction: string) =>
+    slackCall(method, token, { channel, timestamp, name: reaction }, timeoutMs).catch(
+      (err): { ok: boolean; error?: string } => ({ ok: false, error: String(err).slice(0, 120) }),
+    );
+  const removals = acceptanceReactions().filter((r) => r !== name);
+  const removed = await Promise.all(removals.map((r) => call("reactions.remove", r)));
+  removed.forEach((res, i) => {
+    const reaction = removals[i]!;
+    if (res.ok) result.removed.push(reaction);
+    else if (res.error !== "no_reaction" && res.error !== "invalid_name")
+      result.errors.push(\`remove \${reaction}: \${res.error ?? "unknown"}\`);
+  });
+  if (!name) return result;
+  const added = await call("reactions.add", name);
+  if (added.ok || added.error === "already_reacted") result.added = true;
+  else result.errors.push(\`add \${name}: \${added.error ?? "unknown"}\`);
+  return result;
+};
+
+// In-flight mutes, so tests can await the work the handler does not wait for.
+const pendingMutes = new Set<Promise<void>>();
+/** Test hook: wait for every in-flight mute. */
+export const settleMutes = async (): Promise<void> => {
+  await Promise.allSettled([...pendingMutes]);
+};
+
+export type JevVerdict = {
+  reason: string;
+  confidence: number | null;
+  probabilities: Record<string, number> | null;
+  latencyMs: number;
+};
+
+/**
+ * One Jev call: classify the newest message into a reason. Throws on any failure.
+ * TypeSafe and OpenRouter share the request body and the \`answers\` response shape.
+ */
+export const askJev = async (
+  input: {
+    messages: string[];
+    context: string[];
+    sender: string;
+    leadNames: readonly string[];
+  },
+  transport: JevTransport,
+  cfg: Cfg,
+  outer?: AbortSignal,
+): Promise<JevVerdict> => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS));
+  const onOuterAbort = () => controller.abort();
+  outer?.addEventListener("abort", onOuterAbort);
+  const t0 = Date.now();
+  try {
+    const res = await fetch(transport.endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: \`Bearer \${transport.key}\`,
+      },
+      body: JSON.stringify({
+        state: {
+          role: "Decide whether Lead, the coordinating AI agent of a team's agent swarm, should answer a new Slack message in a thread it takes part in. Lead is woken by every message in the thread, including ones not meant for it. Answering noise wastes everyone's time; missing a real ask is worse.",
+          lead_names: input.leadNames,
+          recent_thread_messages: input.context,
+          new_message: input.messages.join("\\n---\\n"),
+          new_message_sender: input.sender,
+        },
+        model: transport.model,
+        questions: {
+          reason: {
+            type: "choice",
+            instructions:
+              "Which label best describes new_message from Lead's point of view? Use recent_thread_messages to tell who it is talking to. Lines starting with [Agent] are swarm bots.",
+            criteria: REASONS,
+          },
+        },
+      }),
+      signal: controller.signal,
+    });
+    if (!res.ok) throw new Error(\`\${transport.provider} \${res.status}\`);
+    const body = (await res.json()) as {
+      answers?: { reason?: { choice?: unknown; confidence?: unknown; probabilities?: unknown } };
+    } | null;
+    const answer = body?.answers?.reason;
+    const reason = typeof answer?.choice === "string" ? answer.choice : "";
+    if (!(reason in REASONS)) throw new Error(\`unexpected choice: \${String(reason).slice(0, 60)}\`);
+    const confidence = typeof answer?.confidence === "number" ? answer.confidence : null;
+    const probabilities =
+      answer?.probabilities && typeof answer.probabilities === "object"
+        ? (answer.probabilities as Record<string, number>)
+        : null;
+    return { reason, confidence, probabilities, latencyMs: Date.now() - t0 };
+  } finally {
+    clearTimeout(timer);
+    outer?.removeEventListener("abort", onOuterAbort);
+  }
+};
+
+/** Probability that the message needs no reply: the summed mass of the skip labels. */
+export const skipProbability = (verdict: JevVerdict): number | null => {
+  if (verdict.probabilities) {
+    let sum = 0;
+    for (const [label, p] of Object.entries(verdict.probabilities)) {
+      if (SKIP_REASONS.has(label) && typeof p === "number") sum += p;
+    }
+    return sum;
+  }
+  return verdict.confidence;
+};
+
+/** Map a Jev verdict to the typed decision. An unsure skip verdict replies. */
+export const decide = (
+  verdict: JevVerdict,
+  minConfidence: number,
+): { reply: boolean; reason: Reason; skipP: number | null; lowConfidence: boolean } => {
+  const reason = verdict.reason as Reason;
+  const skipP = skipProbability(verdict);
+  if (!SKIP_REASONS.has(reason)) return { reply: true, reason, skipP, lowConfidence: false };
+  const lowConfidence = skipP !== null && skipP < minConfidence;
+  return { reply: lowConfidence, reason, skipP, lowConfidence };
+};
+
+const record = async (
+  swarm: Swarm,
+  entry: Record<string, unknown>,
+  counters: string[],
+  prefix: "d" | "m" = "d",
+) => {
+  const at = new Date().toISOString();
+  const thread = safeKey(\`\${entry.channelId ?? ""}_\${entry.threadTs ?? ""}\`);
+  const value = { at, ...entry };
+  await Promise.allSettled([
+    swarm.kv_set({ namespace: NS, key: \`\${prefix}:\${Date.now()}:\${thread}\`, value }),
+    // \`last\` stays the latest decision; mute outcomes only get their own row.
+    ...(prefix === "d" ? [swarm.kv_set({ namespace: NS, key: "last", value })] : []),
+    ...counters.map((c) => swarm.kv_incr({ namespace: NS, key: safeKey(c) })),
+  ]);
+};
+
+/** Mute the triggering message and log the outcome. Never throws. */
+const muteTrigger = async (
+  swarm: Swarm,
+  cfg: Cfg,
+  base: Record<string, unknown>,
+): Promise<void> => {
+  try {
+    const channel = String(base.channelId ?? "");
+    const ts = String(base.triggerTs ?? "");
+    if (!channel || !ts) throw new Error("no slackChannelId or slackTriggerMessageTs");
+    const token = secret("SLACK_BOT_TOKEN");
+    if (!usable(token)) throw new Error("no SLACK_BOT_TOKEN");
+    const result = await muteMessage(token, channel, ts, cfg.muteReaction, cfg.slackTimeoutMs);
+    // "" adds nothing: success is clearing the acceptance reaction(s).
+    const done = cfg.muteReaction ? "muted" : "unreacted";
+    const ok = (result.added || !cfg.muteReaction) && result.errors.length === 0;
+    const action = ok ? done : "mute-error";
+    await record(swarm, { ...base, action, ...result }, [action], "m");
+  } catch (err) {
+    await record(
+      swarm,
+      { ...base, action: "mute-error", errors: [String(err).slice(0, 300)] },
+      ["mute-error"],
+      "m",
+    ).catch(() => {});
+  }
+};
+
+const extension: SwarmExtension = (api) => {
+  api.on("pre.task.create", async (event, ctx) => {
+    if (event.origin !== "slack") return;
+    // Only buffered follow-ups. A direct @mention task never carries the header outside
+    // its thread context.
+    const followUp = parseFollowUp(event.description);
+    if (!followUp) return;
+
+    const cfg = cfgOf(ctx.config);
+    if (cfg.mode === "off") return;
+
+    const opts = event.options;
+    const base = {
+      mode: cfg.mode,
+      channelId: opts.slackChannelId,
+      threadTs: opts.slackThreadTs,
+      triggerTs: opts.slackTriggerMessageTs,
+      senderSlackId: opts.slackUserId,
+    };
+
+    try {
+      // A draft follow-up carries downloaded files: always let Lead see them.
+      if (opts.status === "draft") {
+        await record(ctx.swarm, { ...base, action: "pass", reason: "has_files" }, [
+          "total",
+          "files",
+        ]);
+        return;
+      }
+
+      // The mention check reads only the new messages, never the thread context.
+      const { context, messages } = followUp;
+      const preview = messages.join(" | ").slice(0, 300);
+
+      if (messages.some((m) => mentionsLead(m, cfg.leadAliases))) {
+        await record(ctx.swarm, { ...base, action: "pass", reason: "mention", preview }, [
+          "total",
+          "mention",
+        ]);
+        return;
+      }
+
+      const transport = resolveTransport(cfg);
+
+      const sender =
+        opts.slackUserId && cfg.botSlackUserIds.includes(opts.slackUserId)
+          ? "bot"
+          : opts.requestedByUserId
+            ? "human (known teammate)"
+            : "unknown (not a known teammate; may be a bot or an external person)";
+
+      const verdict = await askJev(
+        {
+          messages,
+          context: context.slice(-cfg.contextMessages).map((m) => m.slice(0, 500)),
+          sender,
+          leadNames: cfg.leadAliases,
+        },
+        transport,
+        cfg,
+        ctx.signal,
+      );
+      const decision = decide(verdict, cfg.minConfidence);
+
+      const skip = !decision.reply;
+      const action = skip ? (cfg.mode === "enforce" ? "skipped" : "shadow-skip") : "pass";
+      await record(
+        ctx.swarm,
+        {
+          ...base,
+          action,
+          reply: decision.reply,
+          reason: decision.reason,
+          confidence: verdict.confidence,
+          skipP: decision.skipP,
+          lowConfidence: decision.lowConfidence,
+          latencyMs: verdict.latencyMs,
+          provider: transport.provider,
+          sender,
+          preview,
+        },
+        ["total", skip ? action : "reply", \`reason:\${decision.reason}\`],
+      );
+
+      if (skip && cfg.mode === "enforce") {
+        // Not awaited: the block must return inside the dispatcher's 5 s budget
+        // whatever Slack does, and a failed reaction never changes the drop.
+        // An empty (or invalid) muteReaction still clears the acceptance reaction(s).
+        const muteReaction = shortcode(cfg.muteReaction) ?? "";
+        const pending = muteTrigger(ctx.swarm, { ...cfg, muteReaction }, base);
+        pendingMutes.add(pending);
+        void pending.finally(() => pendingMutes.delete(pending));
+        return block(
+          \`slack-reply-gate: no reply needed (\${decision.reason}\${decision.skipP !== null ? \`, p(skip) \${decision.skipP.toFixed(2)}\` : ""})\`,
+        );
+      }
+      return;
+    } catch (err) {
+      // Fail open, always.
+      try {
+        await record(
+          ctx.swarm,
+          { ...base, action: "fail-open", error: String(err).slice(0, 300) },
+          ["total", "error"],
+        );
+      } catch {
+        /* ignore */
+      }
+      ctx.log.warn("slack-reply-gate: failing open", { error: String(err) });
+      return;
+    }
+  });
+};
+
+export default extension;
+`
+    },
+    readme: '# slack-reply-gate\n\nLead is woken by every human message in a Slack thread the swarm takes part in, including "lol", an emoji, or two people chatting with each other. This extension asks Jev, [TypeSafe](https://typesafe.ai)\'s decision model, whether Lead should answer a new thread message, and drops the wake-up when it should not.\n\nInstall config:\n\n```json\n{ "mode": "shadow" }\n```\n\nStart in `shadow`, read the decisions in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks Jev and records the verdict. Never blocks. |\n| `enforce` | Asks Jev, records the verdict, and blocks the Lead task when the answer is no. The message gets :mute: instead: no Lead task, no reply, no outcome card. |\n\n## What it gates\n\nHook: `pre.task.create`, for tasks with origin `slack` whose description carries the thread buffer\'s header `[Thread follow-up — N message(s) buffered]`. Those are the non-mention thread replies that `src/slack/thread-buffer.ts` batches into a Lead task. A direct @mention of the bot creates a task without that header and is never gated.\n\nThe header counts only at the start of the description or right after the closing `</thread_context>`. Thread context quotes old messages verbatim, and an older Lead reply can quote the header itself, so a header inside the context is ignored. Only the text after the real header is treated as new.\n\n## Decision\n\n1. A follow-up with downloaded files (status `draft`) passes without a Jev call.\n2. **@mention pass-through.** A new message that @mentions Lead passes without a Jev call. A mention is the bot mention the engine rewrites to `<@U…> (that\'s you)`, a resolved `<@U…|lead>`, or a literal `@lead` (any name in `leadAliases`). Only the new messages are scanned, never the thread context, so an old mention earlier in the thread does not pass later banter.\n3. Otherwise one Jev call (one `choice` question, see [Jev transport](#jev-transport)) with the new message(s), the sender kind, and the last `contextMessages` thread messages. Labels: `direct_ask`, `followup_to_lead`, `instruction_to_lead`, `reaction_only`, `banter_between_others`, `not_addressed_to_lead`, `other`.\n4. The answer is no only when the top label is `reaction_only`, `banter_between_others`, or `not_addressed_to_lead`, and the summed probability of those three labels is at least `minConfidence`. A split between two skip labels is still a skip. An unsure verdict replies.\n\nSeveral buffered messages are judged together. One mention in any of them passes the batch.\n\n## Jev transport\n\nJev is reachable two ways. Both take the same request and return the same answer, so the decision is identical whichever one runs.\n\n| `provider` | Endpoint | Key | Model |\n|---|---|---|---|\n| `typesafe` | `POST https://api.typesafe.ai/v1/systemone` | `TYPESAFE_API_KEY` (or `apiKey`) | `model`, default `jev-latest` |\n| `openrouter` | `POST https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `openrouterModel`, default `typesafe/jev-1.13` |\n| `auto` (default) | TypeSafe when its key is set, else OpenRouter | | |\n\nUnder `auto`, `TYPESAFE_API_KEY` wins when both keys are set. With neither key, every message fails open and the KV row names both secrets. Each decision row records the `provider` that answered.\n\n## Fail open\n\nEvery error lets the task through: a missing key, a TypeSafe HTTP error, a network error, a timeout, a malformed answer, or an unknown label. The handler never throws, so an outage cannot auto-disable the extension. Each failure is recorded as `fail-open` in KV and logged as a warning.\n\n## :mute: on drop (enforce)\n\nNo swarm tool or extension `ctx` method adds a Slack reaction, so the hook calls the Slack Web API with the bot token. It needs the `reactions:write` scope, which the Slack app already uses for its acceptance reactions.\n\n1. `reactions.remove` for each acceptance reaction the engine may have put on the triggering message: `eyes`, `heavy_plus_sign`, `zap`, `speech_balloon`, or their `SLACK_REACTION_ACCEPTED`, `SLACK_REACTION_BUFFERED`, `SLACK_REACTION_NOW`, and `SLACK_REACTION_STEERED` overrides. Slack only removes the bot\'s own reaction, so a human\'s :eyes: stays.\n2. `reactions.add` with `muteReaction` (default `mute`). `already_reacted` counts as success. Skipped when `muteReaction` is `""`.\n\nThe block returns first and the Slack calls run after it. A slow or failing Slack call never delays the drop or turns it back into a task. Set `muteReaction` to `""` for a true no-op: step 1 still clears the bot\'s acceptance reaction(s), and nothing is added.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `timeoutMs` | `3000` | Jev call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `provider` | `auto` | `auto`, `typesafe`, or `openrouter`. See [Jev transport](#jev-transport) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `minConfidence` | `0.55` | Minimum summed skip probability to skip |\n| `contextMessages` | `6` | Thread messages sent to Jev, 0 to 20 |\n| `leadAliases` | `["lead"]` | A literal `@alias` in a new message counts as a mention |\n| `botSlackUserIds` | `[]` | Slack user ids labelled `bot` as the sender for Jev |\n| `apiKey` | unset | Explicit TypeSafe key. Prefer the `TYPESAFE_API_KEY` secret below |\n| `muteReaction` | `mute` | Reaction for a dropped message; `""` only removes the acceptance reaction(s) |\n| `slackTimeoutMs` | `5000` | Timeout per Slack call |\n\n## Required secrets\n\nAll are read from the API process environment at call time. Set them as global `swarm_config` secrets: the API process loads global rows into `process.env` at boot and on config reload.\n\n- `TYPESAFE_API_KEY` or `OPENROUTER_API_KEY`: one is required for any evaluation. Under `auto`, TypeSafe wins when both are set. Without either, every message fails open.\n- `SLACK_BOT_TOKEN`: the Slack app\'s bot token. A swarm with Slack connected already has it. Without it, `enforce` still drops the message but cannot touch its reactions, and logs a `mute-error`.\n\nNo key is written to config, KV, logs, or a description.\n\n## KV namespace `ext:slack-reply-gate`\n\n- `d:<epochMs>:<channel>_<threadTs>`: one row per decision, with `action` (`pass`, `shadow-skip`, `skipped`, `fail-open`), `provider`, `reason`, `confidence`, `skipP`, `latencyMs`, `sender`, and a 300-character `preview`.\n- `m:<epochMs>:<channel>_<threadTs>`: one row per mute attempt, with `action` (`muted`, `unreacted` when `muteReaction` is `""`, `mute-error`), `removed`, `added`, and `errors`.\n- `last`: the latest decision. Mute rows never overwrite it.\n- Counters: `total`, `mention`, `files`, `reply`, `shadow-skip`, `skipped`, `error`, `muted`, `unreacted`, `mute-error`, and `reason:<label>`.\n\n## Known limits\n\n- When Lead already has an active task in the thread, the buffer steers that task instead of creating one, so `pre.task.create` does not fire and the gate does not run.\n- A blocked flush makes the thread buffer log a `TaskCreationBlockedError`. Nothing is lost: the next follow-up\'s `<thread_context>` carries the earlier messages.\n- A flush of several messages mutes only the triggering (last) message. The others keep their acceptance reaction.\n'
+  },
   "task-digest": {
     manifestFile: "manifest.yaml",
     manifest: {
@@ -22995,6 +23595,25 @@ var setConnectionEnabledRoute = route({
   },
   rbac: { permission: "script-connection.manage" }
 });
+var deleteConnectionRoute = route({
+  method: "delete",
+  path: "/api/script-connections/{id}",
+  pattern: ["api", "script-connections", null],
+  operationId: "script_connections_delete",
+  summary: "Delete a script connection",
+  description: "Hard-deletes the connection, its auto-managed credential binding, and any derived inline secret it owns.",
+  tags: ["Script Connections"],
+  params: idParamsSchema2,
+  responses: {
+    200: {
+      description: "Script connection deleted",
+      schema: exports_external.object({ deleted: exports_external.literal(true), id: exports_external.string() })
+    },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "Script connection not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
 var listCredentialBindingsRoute = route({
   method: "get",
   path: "/api/credential-bindings",
@@ -24083,6 +24702,20 @@ async function handleScriptConnections(req, res, pathSegments, queryParams, agen
     });
     return true;
   }
+  if (deleteConnectionRoute.match(req.method, pathSegments)) {
+    const parsed = await deleteConnectionRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConnectionAdmin(req, res, agentId))
+      return true;
+    const deleted = await deleteScriptConnection(parsed.params.id);
+    if (!deleted) {
+      jsonError(res, "Script connection not found.", 404);
+      return true;
+    }
+    deleteConnectionRoute.respond(res, 200, { deleted: true, id: deleted.id });
+    return true;
+  }
   if (listCredentialBindingsRoute.match(req.method, pathSegments)) {
     const includeManaged = queryParams.get("includeManaged") === "true";
     listCredentialBindingsRoute.respond(res, 200, {
@@ -33070,7 +33703,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-ekywyv2v.js");
+    const { stopScheduler } = await import("./index-9fc2h7ww.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -33079,7 +33712,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-4aezx4bj.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-qhcqz56v.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -33154,15 +33787,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-22tx8a53.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-9qt0j8j2.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-mjrqvnvw.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-35f91nx2.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-22tx8a53.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-9qt0j8j2.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -33170,7 +33803,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-cx1sb9bq.js");
+  const { runAllSeeders } = await import("./index-h26wjcfy.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -33230,37 +33863,37 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-ekywyv2v.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-t4g06w93.js");
+    const { startScheduler } = await import("./index-9fc2h7ww.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-48pb9erw.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-bt8wkv1w.js");
+    const { startHeartbeat } = await import("./index-w2yhye23.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-4aezx4bj.js");
+    const { startOAuthKeepalive } = await import("./keepalive-qhcqz56v.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-wm4ctjfj.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-ngskthwh.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-fmp5ww69.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-jvfadhsk.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-1ze5853n.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-20q3nzvg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-cbp8xd4e.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-jtfajzve.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {