@desplega.ai/agent-swarm 1.167.0 → 1.169.0

package/src/be/migrations/204_slack_inbound_receipts.sql

@@ -0,0 +1,51 @@
+-- Durable receipts for inbound Slack deliveries (events, interactions, commands).
+--
+-- A receipt is admitted with one atomic INSERT against the unique dedup key, so a
+-- retried delivery can never create a second drain job. The payload is stored
+-- encrypted (AES-256-GCM, the secrets cipher) only while it may still be needed:
+-- processed and ignored receipts erase it on completion. Pending, processing and
+-- uncertain receipts are never expired by retention; completed dedup keys are kept
+-- for 48 hours so Slack's retry schedule cannot replay them.
+--
+-- A receipt left `processing` by a crash becomes `uncertain` at the next boot and is
+-- never replayed automatically: a handler may already have created tasks.
+CREATE TABLE slack_inbound_receipts (
+  id                  TEXT PRIMARY KEY,
+  dedup_key           TEXT NOT NULL UNIQUE,
+  transport           TEXT NOT NULL CHECK (transport IN ('socket', 'http')),
+  kind                TEXT NOT NULL CHECK (kind IN ('event', 'interaction', 'command')),
+  payload_type        TEXT NOT NULL,
+  api_app_id          TEXT,
+  event_id            TEXT,
+  payload_ciphertext  TEXT,
+  payload_bytes       INTEGER NOT NULL DEFAULT 0 CHECK (payload_bytes >= 0),
+  retry_num           INTEGER,
+  retry_reason        TEXT,
+  state               TEXT NOT NULL DEFAULT 'pending'
+    CHECK (state IN ('pending', 'processing', 'processed', 'ignored', 'failed', 'uncertain')),
+  attempts            INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  duplicate_count     INTEGER NOT NULL DEFAULT 0 CHECK (duplicate_count >= 0),
+  outcome_code        TEXT,
+  error_code          TEXT,
+  received_at         TEXT NOT NULL,
+  available_at        TEXT NOT NULL,
+  claimed_at          TEXT,
+  completed_at        TEXT,
+  last_duplicate_at   TEXT,
+  payload_erased_at   TEXT,
+  created_at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  created_by          TEXT REFERENCES users(id),
+  updated_by          TEXT REFERENCES users(id)
+);
+
+CREATE INDEX idx_slack_inbound_receipts_claim
+  ON slack_inbound_receipts(available_at, received_at)
+  WHERE state = 'pending';
+
+CREATE INDEX idx_slack_inbound_receipts_state
+  ON slack_inbound_receipts(state, received_at);
+
+CREATE INDEX idx_slack_inbound_receipts_completed
+  ON slack_inbound_receipts(completed_at)
+  WHERE state IN ('processed', 'ignored', 'failed');

package/src/be/script-connections.ts

@@ -1137,8 +1137,8 @@ async function deriveConnectionBinding(
     // connection references this key, so every path that supersedes or removes
     // the connection's inline-secret auth MUST delete this swarm_config row via
     // deleteManagedConnectionSecret() (the managed binding CASCADEs, this does
-    // not). upsertScriptConnection handles supersession; a future
-    // connection-delete path must handle deletion.
+    // not). upsertScriptConnection handles supersession; deleteScriptConnection
+    // handles deletion.
     configKey = `connection.${ctx.slug}.secret`;
     secretWrite = { scope: ctx.scope, scopeId: ctx.scopeId, key: configKey, value: auth.secret };
   } else if (auth.configKey) {
@@ -1308,10 +1308,8 @@ async function deleteManagedBindingForConnection(connectionId: string): Promise<
  *   1. upsertScriptConnection, when an upsert SUPERSEDES a previously-derived
  *      inline secret (slug change, or the new auth no longer uses that derived
  *      key). Handled below.
- *   2. FUTURE connection-delete path: there is no deleteScriptConnection today
- *      (only mcp_server_id CASCADE), but any such path MUST call this for the
- *      connection's derived `connection.<slug>.secret` key (when auth_type used a
- *      derived inline secret) so the secret is not orphaned.
+ *   2. deleteScriptConnection, for the connection's derived
+ *      `connection.<slug>.secret` key (when auth used a derived inline secret).
  */
 async function deleteManagedConnectionSecret(input: {
   scope: ScriptConnectionScope;
@@ -1470,7 +1468,7 @@ function parseOpenapiSpecBody(body: string): unknown {
   try {
     return JSON.parse(body);
   } catch (jsonErr) {
-    const yaml = (Bun as unknown as { YAML?: { parse(input: string): unknown } }).YAML;
+    const yaml = (Bun as { YAML?: { parse(input: string): unknown } }).YAML;
     if (!yaml) {
       throw new Error(
         `OpenAPI spec response was not valid JSON. JSON specs only unless Bun.YAML.parse is available: ${
@@ -2079,6 +2077,42 @@ export async function setScriptConnectionEnabled(
   return row ? connectionFromRow(row) : null;
 }
 
+/**
+ * Hard-delete a script connection. Returns the deleted record, or null when no
+ * connection has that id.
+ *
+ * The auto-managed credential binding CASCADEs (and is deleted explicitly too);
+ * a derived inline secret (`connection.<slug>.secret`) is deleted here because
+ * nothing CASCADEs it. Concurrent upserts read the row's `version` and update
+ * with a `version` predicate, so they fail with ScriptConnectionConflictError
+ * once the row is gone instead of resurrecting it.
+ */
+export async function deleteScriptConnection(id: string): Promise<ScriptConnectionRecord | null> {
+  const deleted = await getDbClient().transaction(
+    async (tx): Promise<ScriptConnectionRecord | null> => {
+      await tx.run("PRAGMA defer_foreign_keys = ON");
+      const row = await tx.get<ConnectionRow>("SELECT * FROM script_connections WHERE id = ?", [
+        id,
+      ]);
+      if (!row) return null;
+      const connection = connectionFromRow(row);
+      await deleteManagedBindingForConnection(id);
+      await tx.run("DELETE FROM script_connections WHERE id = ?", [id]);
+      const secretKey = derivedInlineSecretKey(connection);
+      if (secretKey) {
+        await deleteManagedConnectionSecret({
+          scope: connection.scope,
+          scopeId: connection.scopeId,
+          key: secretKey,
+        });
+      }
+      return connection;
+    },
+  );
+  if (deleted && derivedInlineSecretKey(deleted)) refreshSecretScrubberCache();
+  return deleted;
+}
+
 export function getScriptApiConnectionDescriptors(
   context: { agentId?: string; repoId?: string } = {},
 ): ScriptApiConnectionDescriptor[] {

package/src/be/scripts/run-saved.ts

@@ -1,4 +1,4 @@
-import { runScript } from "../../scripts-runtime/loader";
+import { type RunScriptOutput, runScript } from "../../scripts-runtime/loader";
 import type { ScriptRecord } from "../../types";
 import {
   getScriptApiConnectionDescriptors,
@@ -11,12 +11,21 @@ export function getSavedScriptOwnerAgentId(script: ScriptRecord): string | null
   return script.scopeId ?? script.createdByAgentId;
 }
 
-/** Run a saved script with the selected agent's credential and connection bindings. */
-export async function runSavedScriptAsAgent(args: {
-  script: ScriptRecord;
-  input: unknown;
-  agentId: string;
-}) {
+/**
+ * Run a saved script with the selected agent's credential and connection bindings.
+ * `signal` covers the whole call: an abort during credential setup means the
+ * script never starts, and an abort during execution kills it.
+ */
+export async function runSavedScriptAsAgent(
+  args: {
+    script: ScriptRecord;
+    input: unknown;
+    agentId: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+  },
+  deps: { buildCredentials?: typeof buildScriptCredentialBindingsWithFailures } = {},
+) {
   // Touch before executing (not just after) so a scratch script that's already
   // stale when a run starts can't be reaped by the retention sweep while the
   // run — which may take up to the runtime's wall-clock ceiling — is in flight.
@@ -24,19 +33,30 @@ export async function runSavedScriptAsAgent(args: {
     ? await touchScratchScriptLastUsed(args.script.id)
     : null;
 
-  const credentials = await buildScriptCredentialBindingsWithFailures({
-    agentId: args.agentId,
-  });
-  const output = await runScript({
-    source: args.script.source,
-    args: args.input,
-    fsMode: args.script.fsMode,
-    agentId: args.agentId,
-    egressSecrets: credentials.egressSecrets,
-    failedBindings: credentials.failedBindings,
-    apiConnections: getScriptApiConnectionDescriptors({ agentId: args.agentId }),
-    mcpConnections: getScriptMcpConnectionDescriptors({ agentId: args.agentId }),
-  });
+  const buildCredentials = deps.buildCredentials ?? buildScriptCredentialBindingsWithFailures;
+  const credentials = await buildCredentials({ agentId: args.agentId });
+  const output: RunScriptOutput = args.signal?.aborted
+    ? {
+        result: undefined,
+        stdout: "",
+        stderr: "aborted before execution started",
+        truncated: { stdout: false, stderr: false },
+        durationMs: 0,
+        exitCode: 1,
+        error: "killed",
+      }
+    : await runScript({
+        source: args.script.source,
+        args: args.input,
+        fsMode: args.script.fsMode,
+        agentId: args.agentId,
+        egressSecrets: credentials.egressSecrets,
+        failedBindings: credentials.failedBindings,
+        apiConnections: getScriptApiConnectionDescriptors({ agentId: args.agentId }),
+        mcpConnections: getScriptMcpConnectionDescriptors({ agentId: args.agentId }),
+        ...(args.timeoutMs ? { timeoutMs: args.timeoutMs } : {}),
+        ...(args.signal ? { signal: args.signal } : {}),
+      });
   if (output.exitCode === 0 && !output.error && !output.runtimeError) {
     await touchScratchScriptLastUsed(args.script.id);
   } else if (runStartTouch) {

package/src/be/swarm-config-guard.ts

@@ -1,3 +1,4 @@
+import { validateQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-pool-config";
 import { normalizeSlackReactionShortcode } from "../slack/reaction-shortcode";
 import { ProviderNameSchema } from "../types";
 import { API_DRAIN_MAX_MS_LIMIT } from "../utils/api-drain";
@@ -263,9 +264,12 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
     return `Invalid HARNESS_PROVIDER value (must be one of: ${ProviderNameSchema.options.join(", ")})`;
   },
   ...enumValidator("CLAUDE_TRANSPORT", ["cli", "sdk"]),
+  ...enumValidator("SCRIPT_EXECUTOR", ["native", "quickjs"]),
+  SCRIPT_QUICKJS_POOL_SIZE: validateQuickJSPoolSize,
   // fail: worker fails a task fast when every key has exhausted the task
   // model's weekly window (Fable/Opus/Sonnet). fallback: legacy random pick.
   ...enumValidator("MODEL_WINDOW_EXHAUSTED_POLICY", ["fail", "fallback"]),
+  ...enumValidator("HEARTBEAT_CHECKLIST_GATE_MODE", ["shadow", "enforce"]),
   // Codex credits-exhausted cooldown (ms). Permissive on range here (positive
   // integer) — the worker clamps to [5m, 7d] via resolveCodexCreditsExhaustedCooldownMs.
   CODEX_CREDITS_EXHAUSTED_COOLDOWN_MS: (value) => {

package/src/extensions/catalog.generated.json

@@ -84,6 +84,23 @@
     },
     "readme": "# require-verification-note\n\nGuards `store-progress` with `status: \"completed\"`. The call is refused until the `output` contains the configured marker (default `Verified:`). The agent sees the reason as a tool error and can retry with a corrected output.\n\nConfig:\n\n```json\n{ \"marker\": \"Verified:\" }\n```\n\nThe guard covers agent MCP calls only. REST and dashboard completions are not tool calls and pass through.\n"
   },
+  "slack-reply-gate": {
+    "manifestFile": "manifest.json",
+    "manifest": {
+      "$schema": "../manifest.schema.json",
+      "name": "slack-reply-gate",
+      "description": "Asks Jev (TypeSafe or OpenRouter) whether Lead should answer a buffered Slack thread follow-up, and drops the wake-up when it should not",
+      "version": "1.2.0",
+      "runtime": "api",
+      "assets": {
+        "hooks": "hooks.ts"
+      }
+    },
+    "files": {
+      "hooks.ts": "import { type ApiCtx, block, type SwarmExtension } from \"swarm-extension\";\nimport { z } from \"zod\";\n\n/**\n * slack-reply-gate\n *\n * Every human message in a Slack thread the swarm takes part in is buffered and\n * flushed into a Lead task (\"[Thread follow-up — N message(s) buffered]\"), even\n * \"lol\", \":joy:\" or two people bantering. This hook asks TypeSafe Jev whether\n * Lead should answer, and drops the wake-up when the answer is no.\n *\n * Hook: `pre.task.create`, origin \"slack\", description carrying the\n * thread-buffer header. `pre.slack.route` cannot be used: the buffered thread\n * path returns before that hook is dispatched, and its result can only\n * re-target a message, never drop it.\n *\n * Rules:\n *   - A message that @mentions Lead passes without a Jev call.\n *   - Otherwise one Jev `choice` question classifies the message into a reason;\n *     reply=false only for reaction_only | banter_between_others |\n *     not_addressed_to_lead, and only when the summed probability of those\n *     three labels is >= minConfidence (a banter/reaction split is still a skip).\n *   - Fails OPEN on every error, timeout or missing key.\n *\n * Transport (config.provider): Jev is served by TypeSafe directly and by\n * OpenRouter's Decisions endpoint. Both take the same {model, state, questions}\n * body and return the same `answers` shape. `auto` uses TYPESAFE_API_KEY when\n * set, else OPENROUTER_API_KEY.\n *\n * modes (config.mode):\n *   off     -> never evaluate\n *   shadow  -> evaluate + record, never block (default)\n *   enforce -> record, block the task when reply=false, and mark the\n *              triggering Slack message with :mute: (config.muteReaction)\n *\n * Muting: no swarm tool or ctx method adds a Slack reaction, so the hook calls\n * the Slack Web API (reactions.remove / reactions.add) with the bot token. It\n * first removes the bot's own acceptance reactions (:eyes:, :heavy_plus_sign:,\n * :zap:, :speech_balloon:, or their SLACK_REACTION_* overrides), the same set\n * the engine clears when it finalizes a task, then adds :mute:. With\n * muteReaction \"\" it only removes them: a true no-op on the message. It runs after\n * the block decision returns, so a slow or failing Slack call never delays or\n * changes the drop; its errors go to the same KV namespace.\n *\n * Every decision lands in KV namespace `ext:slack-reply-gate`.\n */\n\nexport const config = z.object({\n  mode: z.enum([\"off\", \"shadow\", \"enforce\"]).default(\"shadow\"),\n  timeoutMs: z.number().int().positive().default(3000),\n  provider: z.enum([\"auto\", \"typesafe\", \"openrouter\"]).default(\"auto\"),\n  /** Jev model on the TypeSafe transport. */\n  model: z.string().default(\"jev-latest\"),\n  /** Jev model on the OpenRouter transport. */\n  openrouterModel: z.string().default(\"typesafe/jev-1.13\"),\n  minConfidence: z.number().min(0).max(1).default(0.55),\n  contextMessages: z.number().int().min(0).max(20).default(6),\n  leadAliases: z.array(z.string()).default([\"lead\"]),\n  botSlackUserIds: z.array(z.string()).default([]),\n  /** Explicit TypeSafe key; otherwise TYPESAFE_API_KEY from the API process env. */\n  apiKey: z.string().optional(),\n  /**\n   * Reaction for a dropped message in enforce mode. \"\" only removes the bot's\n   * acceptance reaction(s) and adds nothing.\n   */\n  muteReaction: z.string().default(\"mute\"),\n  slackTimeoutMs: z.number().int().positive().default(5000),\n});\n\ntype Cfg = z.infer<typeof config>;\ntype Swarm = ApiCtx[\"swarm\"];\n\nconst NS = \"ext:slack-reply-gate\";\nconst TYPESAFE_ENDPOINT = \"https://api.typesafe.ai/v1/systemone\";\nconst OPENROUTER_ENDPOINT = \"https://openrouter.ai/api/alpha/decisions\";\nconst HEADER_LINE_RE = /(?:^|\\n)\\[Thread follow-up — \\d+ message\\(s\\) buffered\\]\\n/g;\nconst CTX_OPEN = \"<thread_context>\";\nconst CTX_CLOSE = \"</thread_context>\";\n// The dispatcher cancels a handler after 5 s; leave room for the KV writes.\nconst MAX_TIMEOUT_MS = 4000;\n\nexport const REASONS = {\n  direct_ask:\n    \"Asks Lead (or the swarm, the bot, 'you' meaning the AI) a question or for something, explicitly or clearly implied.\",\n  followup_to_lead:\n    \"Answers, confirms, corrects or continues something Lead or another swarm agent ([Agent]) just said or asked, so Lead needs it to proceed.\",\n  instruction_to_lead:\n    \"Gives a task, instruction, request or decision for the AI to act on, even without naming it (for example 'can you create X', 'ship it', 'do it').\",\n  reaction_only:\n    \"Only a reaction: emoji, laughter (lol, haha, jaja), 'boom!', 'nice', 'thanks', '+1', with no request and nothing new for Lead.\",\n  banter_between_others:\n    \"Chat between the humans, or between other people and other bots, that is not aimed at Lead.\",\n  not_addressed_to_lead:\n    \"Addressed to a specific other person or another assistant, or an FYI that needs no answer from Lead.\",\n  other: \"None of the above, or unclear.\",\n} as const;\n\nexport type Reason = keyof typeof REASONS;\nconst SKIP_REASONS: ReadonlySet<string> = new Set([\n  \"reaction_only\",\n  \"banter_between_others\",\n  \"not_addressed_to_lead\",\n]);\n\nconst cfgOf = (raw: unknown): Cfg => {\n  const parsed = config.safeParse(raw ?? {});\n  return parsed.success ? parsed.data : config.parse({});\n};\n\n// kv keys accept [a-zA-Z0-9._:/%-]\nconst safeKey = (raw: string | undefined | null): string =>\n  (raw && raw.length > 0 ? raw : \"unknown\").replace(/[^a-zA-Z0-9._:-]/g, \"_\").slice(0, 120);\n\nconst escapeRe = (s: string): string => s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\n/**\n * Locate the engine's follow-up header (src/slack/thread-buffer.ts): at the start of the\n * description, or right after the closing `</thread_context>`. Thread context quotes old\n * messages verbatim, so a header (or a `</thread_context>`) quoted inside it is skipped.\n */\nconst findHeader = (description: string): { index: number; end: number } | null => {\n  for (const m of description.matchAll(HEADER_LINE_RE)) {\n    const index = m.index! + (m[0].startsWith(\"\\n\") ? 1 : 0);\n    const before = description.slice(0, index);\n    const open = before.indexOf(CTX_OPEN);\n    if (open < 0 || before.trimEnd().endsWith(CTX_CLOSE)) {\n      return { index, end: m.index! + m[0].length };\n    }\n  }\n  return null;\n};\n\n/**\n * Split a buffered follow-up description into thread context and new messages, or null\n * when the description is not a buffered follow-up. Only `messages` is new text.\n */\nexport const parseFollowUp = (\n  description: string,\n): { context: string[]; messages: string[] } | null => {\n  const header = findHeader(description);\n  if (!header) return null;\n  const before = description.slice(0, header.index).trimEnd();\n  const open = before.indexOf(CTX_OPEN);\n  const context =\n    open >= 0\n      ? before\n          .slice(open + CTX_OPEN.length, before.length - CTX_CLOSE.length)\n          .split(/\\n(?=<@[A-Z0-9]+[|>]|\\[Agent\\]:)/)\n          .map((m) => m.trim())\n          .filter(Boolean)\n      : [];\n  const messages = description\n    .slice(header.end)\n    .split(\"\\n---\\n\")\n    .map((m) => m.trim())\n    .filter(Boolean);\n  return { context, messages };\n};\n\n/** True when the new text addresses Lead with an @mention. */\nexport const mentionsLead = (text: string, aliases: readonly string[]): boolean => {\n  // The buffer rewrites a mention of the swarm's own bot to `<@U…> (that's you)`.\n  if (/<@[A-Z0-9]+>\\s*\\(that's you\\)/.test(text)) return true;\n  const names = aliases\n    .map((a) => a.trim())\n    .filter(Boolean)\n    .map(escapeRe);\n  if (names.length === 0) return false;\n  const alt = names.join(\"|\");\n  return (\n    new RegExp(`(^|[^\\\\w@])@(${alt})\\\\b`, \"i\").test(text) ||\n    new RegExp(`<@[A-Z0-9]+\\\\|(${alt})>`, \"i\").test(text)\n  );\n};\n\nconst secretCache = new Map<string, { value: string; at: number }>();\nconst KEY_TTL_MS = 5 * 60 * 1000;\nconst usable = (v: string): boolean => Boolean(v) && !v.startsWith(\"[REDACTED\");\nconst envOf = (name: string): string => String(process.env[name] ?? \"\");\n\n/**\n * Resolve a secret: explicit value, then the API process env. The API process loads\n * global swarm_config rows into process.env at boot and on config reload.\n * ctx.swarm.config_get cannot serve it: the SDK scrubs secrets to \"[REDACTED:<name>]\".\n */\nconst secret = (name: string, explicit?: string): string => {\n  const cached = secretCache.get(name);\n  if (cached && Date.now() - cached.at < KEY_TTL_MS) return cached.value;\n  const value = [String(explicit ?? \"\"), envOf(name)].find(usable) ?? \"\";\n  if (usable(value)) secretCache.set(name, { value, at: Date.now() });\n  return value;\n};\n\n/** Test hook: forget cached secrets. */\nexport const resetKeyCache = (): void => {\n  secretCache.clear();\n};\n\nexport type JevTransport = {\n  provider: \"typesafe\" | \"openrouter\";\n  endpoint: string;\n  key: string;\n  model: string;\n};\n\n/**\n * Pick the Jev transport. `auto` prefers TypeSafe and falls back to OpenRouter.\n * Throws when the chosen provider has no usable key; the handler fails open.\n */\nexport const resolveTransport = (cfg: Cfg): JevTransport => {\n  const typesafe = (): JevTransport | null => {\n    const key = secret(\"TYPESAFE_API_KEY\", cfg.apiKey);\n    return usable(key)\n      ? { provider: \"typesafe\", endpoint: TYPESAFE_ENDPOINT, key, model: cfg.model }\n      : null;\n  };\n  const openrouter = (): JevTransport | null => {\n    const key = secret(\"OPENROUTER_API_KEY\");\n    return usable(key)\n      ? { provider: \"openrouter\", endpoint: OPENROUTER_ENDPOINT, key, model: cfg.openrouterModel }\n      : null;\n  };\n  const transport =\n    cfg.provider === \"typesafe\"\n      ? typesafe()\n      : cfg.provider === \"openrouter\"\n        ? openrouter()\n        : (typesafe() ?? openrouter());\n  if (transport) return transport;\n  throw new Error(\n    cfg.provider === \"typesafe\"\n      ? \"no TYPESAFE_API_KEY\"\n      : cfg.provider === \"openrouter\"\n        ? \"no OPENROUTER_API_KEY\"\n        : \"no TYPESAFE_API_KEY or OPENROUTER_API_KEY\",\n  );\n};\n\nconst SLACK_API = \"https://slack.com/api\";\n// The engine's acceptance reactions (src/slack/reaction-shortcode.ts), by config key.\nconst ACCEPTANCE_REACTIONS: ReadonlyArray<[string, string]> = [\n  [\"SLACK_REACTION_ACCEPTED\", \"eyes\"],\n  [\"SLACK_REACTION_BUFFERED\", \"heavy_plus_sign\"],\n  [\"SLACK_REACTION_NOW\", \"zap\"],\n  [\"SLACK_REACTION_STEERED\", \"speech_balloon\"],\n];\nconst SHORTCODE_RE = /^[a-z0-9_+'-]+(::skin-tone-[2-6])?$/;\nconst shortcode = (raw: string): string | null => {\n  const s = raw.trim().replace(/^:/, \"\").replace(/:$/, \"\").toLowerCase();\n  return s && SHORTCODE_RE.test(s) ? s : null;\n};\n\n/** The acceptance reactions the engine may have put on the message, deduplicated. */\nexport const acceptanceReactions = (): string[] => [\n  ...new Set(ACCEPTANCE_REACTIONS.map(([key, fallback]) => shortcode(envOf(key)) ?? fallback)),\n];\n\nconst slackCall = async (\n  method: string,\n  token: string,\n  body: Record<string, string>,\n  timeoutMs: number,\n): Promise<{ ok: boolean; error?: string }> => {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  try {\n    const res = await fetch(`${SLACK_API}/${method}`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json; charset=utf-8\",\n        Authorization: `Bearer ${token}`,\n      },\n      body: JSON.stringify(body),\n      signal: controller.signal,\n    });\n    if (!res.ok) return { ok: false, error: `http_${res.status}` };\n    const data = (await res.json()) as { ok?: boolean; error?: string };\n    return { ok: data?.ok === true, error: data?.error };\n  } finally {\n    clearTimeout(timer);\n  }\n};\n\nexport type MuteResult = { removed: string[]; added: boolean; errors: string[] };\n\n/**\n * Replace the bot's acceptance reaction(s) on one message with `name`, or only\n * remove them when `name` is \"\". `reactions.remove` only removes the calling\n * bot's own reaction, so a human's :eyes: stays. Never throws: every failure\n * lands in `errors`.\n */\nexport const muteMessage = async (\n  token: string,\n  channel: string,\n  timestamp: string,\n  name: string,\n  timeoutMs: number,\n): Promise<MuteResult> => {\n  const result: MuteResult = { removed: [], added: false, errors: [] };\n  const call = (method: string, reaction: string) =>\n    slackCall(method, token, { channel, timestamp, name: reaction }, timeoutMs).catch(\n      (err): { ok: boolean; error?: string } => ({ ok: false, error: String(err).slice(0, 120) }),\n    );\n  const removals = acceptanceReactions().filter((r) => r !== name);\n  const removed = await Promise.all(removals.map((r) => call(\"reactions.remove\", r)));\n  removed.forEach((res, i) => {\n    const reaction = removals[i]!;\n    if (res.ok) result.removed.push(reaction);\n    else if (res.error !== \"no_reaction\" && res.error !== \"invalid_name\")\n      result.errors.push(`remove ${reaction}: ${res.error ?? \"unknown\"}`);\n  });\n  if (!name) return result;\n  const added = await call(\"reactions.add\", name);\n  if (added.ok || added.error === \"already_reacted\") result.added = true;\n  else result.errors.push(`add ${name}: ${added.error ?? \"unknown\"}`);\n  return result;\n};\n\n// In-flight mutes, so tests can await the work the handler does not wait for.\nconst pendingMutes = new Set<Promise<void>>();\n/** Test hook: wait for every in-flight mute. */\nexport const settleMutes = async (): Promise<void> => {\n  await Promise.allSettled([...pendingMutes]);\n};\n\nexport type JevVerdict = {\n  reason: string;\n  confidence: number | null;\n  probabilities: Record<string, number> | null;\n  latencyMs: number;\n};\n\n/**\n * One Jev call: classify the newest message into a reason. Throws on any failure.\n * TypeSafe and OpenRouter share the request body and the `answers` response shape.\n */\nexport const askJev = async (\n  input: {\n    messages: string[];\n    context: string[];\n    sender: string;\n    leadNames: readonly string[];\n  },\n  transport: JevTransport,\n  cfg: Cfg,\n  outer?: AbortSignal,\n): Promise<JevVerdict> => {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS));\n  const onOuterAbort = () => controller.abort();\n  outer?.addEventListener(\"abort\", onOuterAbort);\n  const t0 = Date.now();\n  try {\n    const res = await fetch(transport.endpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Authorization: `Bearer ${transport.key}`,\n      },\n      body: JSON.stringify({\n        state: {\n          role: \"Decide whether Lead, the coordinating AI agent of a team's agent swarm, should answer a new Slack message in a thread it takes part in. Lead is woken by every message in the thread, including ones not meant for it. Answering noise wastes everyone's time; missing a real ask is worse.\",\n          lead_names: input.leadNames,\n          recent_thread_messages: input.context,\n          new_message: input.messages.join(\"\\n---\\n\"),\n          new_message_sender: input.sender,\n        },\n        model: transport.model,\n        questions: {\n          reason: {\n            type: \"choice\",\n            instructions:\n              \"Which label best describes new_message from Lead's point of view? Use recent_thread_messages to tell who it is talking to. Lines starting with [Agent] are swarm bots.\",\n            criteria: REASONS,\n          },\n        },\n      }),\n      signal: controller.signal,\n    });\n    if (!res.ok) throw new Error(`${transport.provider} ${res.status}`);\n    const body = (await res.json()) as {\n      answers?: { reason?: { choice?: unknown; confidence?: unknown; probabilities?: unknown } };\n    } | null;\n    const answer = body?.answers?.reason;\n    const reason = typeof answer?.choice === \"string\" ? answer.choice : \"\";\n    if (!(reason in REASONS)) throw new Error(`unexpected choice: ${String(reason).slice(0, 60)}`);\n    const confidence = typeof answer?.confidence === \"number\" ? answer.confidence : null;\n    const probabilities =\n      answer?.probabilities && typeof answer.probabilities === \"object\"\n        ? (answer.probabilities as Record<string, number>)\n        : null;\n    return { reason, confidence, probabilities, latencyMs: Date.now() - t0 };\n  } finally {\n    clearTimeout(timer);\n    outer?.removeEventListener(\"abort\", onOuterAbort);\n  }\n};\n\n/** Probability that the message needs no reply: the summed mass of the skip labels. */\nexport const skipProbability = (verdict: JevVerdict): number | null => {\n  if (verdict.probabilities) {\n    let sum = 0;\n    for (const [label, p] of Object.entries(verdict.probabilities)) {\n      if (SKIP_REASONS.has(label) && typeof p === \"number\") sum += p;\n    }\n    return sum;\n  }\n  return verdict.confidence;\n};\n\n/** Map a Jev verdict to the typed decision. An unsure skip verdict replies. */\nexport const decide = (\n  verdict: JevVerdict,\n  minConfidence: number,\n): { reply: boolean; reason: Reason; skipP: number | null; lowConfidence: boolean } => {\n  const reason = verdict.reason as Reason;\n  const skipP = skipProbability(verdict);\n  if (!SKIP_REASONS.has(reason)) return { reply: true, reason, skipP, lowConfidence: false };\n  const lowConfidence = skipP !== null && skipP < minConfidence;\n  return { reply: lowConfidence, reason, skipP, lowConfidence };\n};\n\nconst record = async (\n  swarm: Swarm,\n  entry: Record<string, unknown>,\n  counters: string[],\n  prefix: \"d\" | \"m\" = \"d\",\n) => {\n  const at = new Date().toISOString();\n  const thread = safeKey(`${entry.channelId ?? \"\"}_${entry.threadTs ?? \"\"}`);\n  const value = { at, ...entry };\n  await Promise.allSettled([\n    swarm.kv_set({ namespace: NS, key: `${prefix}:${Date.now()}:${thread}`, value }),\n    // `last` stays the latest decision; mute outcomes only get their own row.\n    ...(prefix === \"d\" ? [swarm.kv_set({ namespace: NS, key: \"last\", value })] : []),\n    ...counters.map((c) => swarm.kv_incr({ namespace: NS, key: safeKey(c) })),\n  ]);\n};\n\n/** Mute the triggering message and log the outcome. Never throws. */\nconst muteTrigger = async (\n  swarm: Swarm,\n  cfg: Cfg,\n  base: Record<string, unknown>,\n): Promise<void> => {\n  try {\n    const channel = String(base.channelId ?? \"\");\n    const ts = String(base.triggerTs ?? \"\");\n    if (!channel || !ts) throw new Error(\"no slackChannelId or slackTriggerMessageTs\");\n    const token = secret(\"SLACK_BOT_TOKEN\");\n    if (!usable(token)) throw new Error(\"no SLACK_BOT_TOKEN\");\n    const result = await muteMessage(token, channel, ts, cfg.muteReaction, cfg.slackTimeoutMs);\n    // \"\" adds nothing: success is clearing the acceptance reaction(s).\n    const done = cfg.muteReaction ? \"muted\" : \"unreacted\";\n    const ok = (result.added || !cfg.muteReaction) && result.errors.length === 0;\n    const action = ok ? done : \"mute-error\";\n    await record(swarm, { ...base, action, ...result }, [action], \"m\");\n  } catch (err) {\n    await record(\n      swarm,\n      { ...base, action: \"mute-error\", errors: [String(err).slice(0, 300)] },\n      [\"mute-error\"],\n      \"m\",\n    ).catch(() => {});\n  }\n};\n\nconst extension: SwarmExtension = (api) => {\n  api.on(\"pre.task.create\", async (event, ctx) => {\n    if (event.origin !== \"slack\") return;\n    // Only buffered follow-ups. A direct @mention task never carries the header outside\n    // its thread context.\n    const followUp = parseFollowUp(event.description);\n    if (!followUp) return;\n\n    const cfg = cfgOf(ctx.config);\n    if (cfg.mode === \"off\") return;\n\n    const opts = event.options;\n    const base = {\n      mode: cfg.mode,\n      channelId: opts.slackChannelId,\n      threadTs: opts.slackThreadTs,\n      triggerTs: opts.slackTriggerMessageTs,\n      senderSlackId: opts.slackUserId,\n    };\n\n    try {\n      // A draft follow-up carries downloaded files: always let Lead see them.\n      if (opts.status === \"draft\") {\n        await record(ctx.swarm, { ...base, action: \"pass\", reason: \"has_files\" }, [\n          \"total\",\n          \"files\",\n        ]);\n        return;\n      }\n\n      // The mention check reads only the new messages, never the thread context.\n      const { context, messages } = followUp;\n      const preview = messages.join(\" | \").slice(0, 300);\n\n      if (messages.some((m) => mentionsLead(m, cfg.leadAliases))) {\n        await record(ctx.swarm, { ...base, action: \"pass\", reason: \"mention\", preview }, [\n          \"total\",\n          \"mention\",\n        ]);\n        return;\n      }\n\n      const transport = resolveTransport(cfg);\n\n      const sender =\n        opts.slackUserId && cfg.botSlackUserIds.includes(opts.slackUserId)\n          ? \"bot\"\n          : opts.requestedByUserId\n            ? \"human (known teammate)\"\n            : \"unknown (not a known teammate; may be a bot or an external person)\";\n\n      const verdict = await askJev(\n        {\n          messages,\n          context: context.slice(-cfg.contextMessages).map((m) => m.slice(0, 500)),\n          sender,\n          leadNames: cfg.leadAliases,\n        },\n        transport,\n        cfg,\n        ctx.signal,\n      );\n      const decision = decide(verdict, cfg.minConfidence);\n\n      const skip = !decision.reply;\n      const action = skip ? (cfg.mode === \"enforce\" ? \"skipped\" : \"shadow-skip\") : \"pass\";\n      await record(\n        ctx.swarm,\n        {\n          ...base,\n          action,\n          reply: decision.reply,\n          reason: decision.reason,\n          confidence: verdict.confidence,\n          skipP: decision.skipP,\n          lowConfidence: decision.lowConfidence,\n          latencyMs: verdict.latencyMs,\n          provider: transport.provider,\n          sender,\n          preview,\n        },\n        [\"total\", skip ? action : \"reply\", `reason:${decision.reason}`],\n      );\n\n      if (skip && cfg.mode === \"enforce\") {\n        // Not awaited: the block must return inside the dispatcher's 5 s budget\n        // whatever Slack does, and a failed reaction never changes the drop.\n        // An empty (or invalid) muteReaction still clears the acceptance reaction(s).\n        const muteReaction = shortcode(cfg.muteReaction) ?? \"\";\n        const pending = muteTrigger(ctx.swarm, { ...cfg, muteReaction }, base);\n        pendingMutes.add(pending);\n        void pending.finally(() => pendingMutes.delete(pending));\n        return block(\n          `slack-reply-gate: no reply needed (${decision.reason}${decision.skipP !== null ? `, p(skip) ${decision.skipP.toFixed(2)}` : \"\"})`,\n        );\n      }\n      return;\n    } catch (err) {\n      // Fail open, always.\n      try {\n        await record(\n          ctx.swarm,\n          { ...base, action: \"fail-open\", error: String(err).slice(0, 300) },\n          [\"total\", \"error\"],\n        );\n      } catch {\n        /* ignore */\n      }\n      ctx.log.warn(\"slack-reply-gate: failing open\", { error: String(err) });\n      return;\n    }\n  });\n};\n\nexport default extension;\n"
+    },
+    "readme": "# slack-reply-gate\n\nLead is woken by every human message in a Slack thread the swarm takes part in, including \"lol\", an emoji, or two people chatting with each other. This extension asks Jev, [TypeSafe](https://typesafe.ai)'s decision model, whether Lead should answer a new thread message, and drops the wake-up when it should not.\n\nInstall config:\n\n```json\n{ \"mode\": \"shadow\" }\n```\n\nStart in `shadow`, read the decisions in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks Jev and records the verdict. Never blocks. |\n| `enforce` | Asks Jev, records the verdict, and blocks the Lead task when the answer is no. The message gets :mute: instead: no Lead task, no reply, no outcome card. |\n\n## What it gates\n\nHook: `pre.task.create`, for tasks with origin `slack` whose description carries the thread buffer's header `[Thread follow-up — N message(s) buffered]`. Those are the non-mention thread replies that `src/slack/thread-buffer.ts` batches into a Lead task. A direct @mention of the bot creates a task without that header and is never gated.\n\nThe header counts only at the start of the description or right after the closing `</thread_context>`. Thread context quotes old messages verbatim, and an older Lead reply can quote the header itself, so a header inside the context is ignored. Only the text after the real header is treated as new.\n\n## Decision\n\n1. A follow-up with downloaded files (status `draft`) passes without a Jev call.\n2. **@mention pass-through.** A new message that @mentions Lead passes without a Jev call. A mention is the bot mention the engine rewrites to `<@U…> (that's you)`, a resolved `<@U…|lead>`, or a literal `@lead` (any name in `leadAliases`). Only the new messages are scanned, never the thread context, so an old mention earlier in the thread does not pass later banter.\n3. Otherwise one Jev call (one `choice` question, see [Jev transport](#jev-transport)) with the new message(s), the sender kind, and the last `contextMessages` thread messages. Labels: `direct_ask`, `followup_to_lead`, `instruction_to_lead`, `reaction_only`, `banter_between_others`, `not_addressed_to_lead`, `other`.\n4. The answer is no only when the top label is `reaction_only`, `banter_between_others`, or `not_addressed_to_lead`, and the summed probability of those three labels is at least `minConfidence`. A split between two skip labels is still a skip. An unsure verdict replies.\n\nSeveral buffered messages are judged together. One mention in any of them passes the batch.\n\n## Jev transport\n\nJev is reachable two ways. Both take the same request and return the same answer, so the decision is identical whichever one runs.\n\n| `provider` | Endpoint | Key | Model |\n|---|---|---|---|\n| `typesafe` | `POST https://api.typesafe.ai/v1/systemone` | `TYPESAFE_API_KEY` (or `apiKey`) | `model`, default `jev-latest` |\n| `openrouter` | `POST https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `openrouterModel`, default `typesafe/jev-1.13` |\n| `auto` (default) | TypeSafe when its key is set, else OpenRouter | | |\n\nUnder `auto`, `TYPESAFE_API_KEY` wins when both keys are set. With neither key, every message fails open and the KV row names both secrets. Each decision row records the `provider` that answered.\n\n## Fail open\n\nEvery error lets the task through: a missing key, a TypeSafe HTTP error, a network error, a timeout, a malformed answer, or an unknown label. The handler never throws, so an outage cannot auto-disable the extension. Each failure is recorded as `fail-open` in KV and logged as a warning.\n\n## :mute: on drop (enforce)\n\nNo swarm tool or extension `ctx` method adds a Slack reaction, so the hook calls the Slack Web API with the bot token. It needs the `reactions:write` scope, which the Slack app already uses for its acceptance reactions.\n\n1. `reactions.remove` for each acceptance reaction the engine may have put on the triggering message: `eyes`, `heavy_plus_sign`, `zap`, `speech_balloon`, or their `SLACK_REACTION_ACCEPTED`, `SLACK_REACTION_BUFFERED`, `SLACK_REACTION_NOW`, and `SLACK_REACTION_STEERED` overrides. Slack only removes the bot's own reaction, so a human's :eyes: stays.\n2. `reactions.add` with `muteReaction` (default `mute`). `already_reacted` counts as success. Skipped when `muteReaction` is `\"\"`.\n\nThe block returns first and the Slack calls run after it. A slow or failing Slack call never delays the drop or turns it back into a task. Set `muteReaction` to `\"\"` for a true no-op: step 1 still clears the bot's acceptance reaction(s), and nothing is added.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `timeoutMs` | `3000` | Jev call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `provider` | `auto` | `auto`, `typesafe`, or `openrouter`. See [Jev transport](#jev-transport) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `minConfidence` | `0.55` | Minimum summed skip probability to skip |\n| `contextMessages` | `6` | Thread messages sent to Jev, 0 to 20 |\n| `leadAliases` | `[\"lead\"]` | A literal `@alias` in a new message counts as a mention |\n| `botSlackUserIds` | `[]` | Slack user ids labelled `bot` as the sender for Jev |\n| `apiKey` | unset | Explicit TypeSafe key. Prefer the `TYPESAFE_API_KEY` secret below |\n| `muteReaction` | `mute` | Reaction for a dropped message; `\"\"` only removes the acceptance reaction(s) |\n| `slackTimeoutMs` | `5000` | Timeout per Slack call |\n\n## Required secrets\n\nAll are read from the API process environment at call time. Set them as global `swarm_config` secrets: the API process loads global rows into `process.env` at boot and on config reload.\n\n- `TYPESAFE_API_KEY` or `OPENROUTER_API_KEY`: one is required for any evaluation. Under `auto`, TypeSafe wins when both are set. Without either, every message fails open.\n- `SLACK_BOT_TOKEN`: the Slack app's bot token. A swarm with Slack connected already has it. Without it, `enforce` still drops the message but cannot touch its reactions, and logs a `mute-error`.\n\nNo key is written to config, KV, logs, or a description.\n\n## KV namespace `ext:slack-reply-gate`\n\n- `d:<epochMs>:<channel>_<threadTs>`: one row per decision, with `action` (`pass`, `shadow-skip`, `skipped`, `fail-open`), `provider`, `reason`, `confidence`, `skipP`, `latencyMs`, `sender`, and a 300-character `preview`.\n- `m:<epochMs>:<channel>_<threadTs>`: one row per mute attempt, with `action` (`muted`, `unreacted` when `muteReaction` is `\"\"`, `mute-error`), `removed`, `added`, and `errors`.\n- `last`: the latest decision. Mute rows never overwrite it.\n- Counters: `total`, `mention`, `files`, `reply`, `shadow-skip`, `skipped`, `error`, `muted`, `unreacted`, `mute-error`, and `reason:<label>`.\n\n## Known limits\n\n- When Lead already has an active task in the thread, the buffer steers that task instead of creating one, so `pre.task.create` does not fire and the gate does not run.\n- A blocked flush makes the thread buffer log a `TaskCreationBlockedError`. Nothing is lost: the next follow-up's `<thread_context>` carries the earlier messages.\n- A flush of several messages mutes only the triggering (last) message. The others keep their acceptance reaction.\n"
+  },
   "task-digest": {
     "manifestFile": "manifest.yaml",
     "manifest": {

package/src/extensions/catalog.ts

@@ -15,7 +15,7 @@ export type ExtensionCatalogEntry = {
   readme: string | null;
 };
 
-const BUNDLED = generated as unknown as Record<string, ExtensionCatalogEntry>;
+const BUNDLED = generated as Record<string, ExtensionCatalogEntry>;
 let override: Record<string, ExtensionCatalogEntry> | null = null;
 
 export function getExtensionCatalog(): Record<string, ExtensionCatalogEntry> {

package/src/extensions/dispatcher.ts

@@ -374,8 +374,8 @@ export async function dispatchPre<E extends PreEventName>(
     return { action: "continue" };
   }
 
-  let currentPayload = payload as unknown as Record<string, unknown>;
-  let mergedData: Record<string, unknown> = {};
+  let currentPayload: Record<string, unknown> = { ...payload };
+  const mergedData: Record<string, unknown> = {};
   let modified = false;
   for (const { loaded, handler } of handlersFor(event, opts)) {
     if (!isRegistered(loaded.record.id)) continue;
@@ -445,7 +445,7 @@ export async function dispatchPre<E extends PreEventName>(
           if (!validation.success) throw validation.error;
           data = definedObject(validation.data);
         }
-        mergedData = { ...mergedData, ...data };
+        Object.assign(mergedData, data);
         currentPayload = mergePayload(event, currentPayload, data);
         modified = true;
         await markSuccess(loaded);

package/src/heartbeat/heartbeat.ts

@@ -56,6 +56,8 @@ import {
   countActiveRuntimeInstancesForAgent,
   expireStaleRuntimeInstances,
 } from "../be/multi-runtime";
+import { getScript } from "../be/scripts/db";
+import { runSavedScriptAsAgent } from "../be/scripts/run-saved";
 import { promotePendingSteeringForTask } from "../be/steering";
 import type { HeartbeatAction, HeartbeatClassification } from "../extensions/contract";
 import { dispatchPre, extensionIdForAgent } from "../extensions/dispatcher";
@@ -257,6 +259,31 @@ function isBootTriageAlways(): boolean {
   return isEnvFlagEnabled("HEARTBEAT_BOOT_TRIAGE_ALWAYS", false);
 }
 
+/**
+ * Wall-clock ceiling for the whole checklist gate call: script lookup,
+ * credential setup, and execution.
+ */
+const HEARTBEAT_CHECKLIST_GATE_TIMEOUT_MS = 60_000;
+let checklistGateTimeoutMs = HEARTBEAT_CHECKLIST_GATE_TIMEOUT_MS;
+
+/**
+ * Name of a global-scope script that decides whether a checklist tick needs
+ * the Lead. Unset or empty turns the gate off.
+ */
+function heartbeatChecklistGateScript(): string | null {
+  return process.env.HEARTBEAT_CHECKLIST_GATE_SCRIPT?.trim() || null;
+}
+
+/**
+ * `shadow` (default) runs the gate and only tags the checklist task with its
+ * verdict. `enforce` skips the task when the gate reports a quiet tick.
+ */
+function heartbeatChecklistGateMode(): "shadow" | "enforce" {
+  return process.env.HEARTBEAT_CHECKLIST_GATE_MODE?.trim().toLowerCase() === "enforce"
+    ? "enforce"
+    : "shadow";
+}
+
 // ============================================================================
 // Types
 // ============================================================================
@@ -322,6 +349,23 @@ export function setBeforeHeartbeatSupersedeForTests(
   beforeHeartbeatSupersedeForTests = hook;
 }
 
+type ChecklistGateRunner = (
+  scriptName: string,
+  leadAgentId: string,
+  signal: AbortSignal,
+) => Promise<unknown>;
+let checklistGateRunnerForTests: ChecklistGateRunner | null = null;
+
+/** Replace the gate script runner. The runner returns the script's result or throws. */
+export function setChecklistGateRunnerForTests(runner: ChecklistGateRunner | null): void {
+  checklistGateRunnerForTests = runner;
+}
+
+/** Override the gate deadline. `null` restores the 60s default. */
+export function setChecklistGateTimeoutMsForTests(ms: number | null): void {
+  checklistGateTimeoutMs = ms ?? HEARTBEAT_CHECKLIST_GATE_TIMEOUT_MS;
+}
+
 // ============================================================================
 // Tier 1: Preflight Gate
 // ============================================================================
@@ -1664,6 +1708,91 @@ export async function getBootTriageFindings(): Promise<BootTriageFindings> {
   };
 }
 
+type ChecklistGateVerdict =
+  | { verdict: "quiet"; reason: string }
+  | { verdict: "wake"; reason: string; summary: string | null }
+  | { verdict: "error"; reason: string };
+
+/**
+ * Look up the global gate script and run it as the Lead. `deps` lets tests
+ * stall credential setup on the real path.
+ */
+export async function defaultChecklistGateRunner(
+  scriptName: string,
+  leadAgentId: string,
+  signal: AbortSignal,
+  deps: Parameters<typeof runSavedScriptAsAgent>[1] = {},
+): Promise<unknown> {
+  const script = await getScript({ name: scriptName, scope: "global" });
+  if (!script) throw new Error(`global script "${scriptName}" not found`);
+  const output = await runSavedScriptAsAgent(
+    {
+      script,
+      input: { leadAgentId },
+      agentId: leadAgentId,
+      timeoutMs: checklistGateTimeoutMs,
+      signal,
+    },
+    deps,
+  );
+  if (output.exitCode !== 0 || output.error || output.runtimeError) {
+    throw new Error(
+      output.runtimeError?.message ?? output.error ?? `script exited with code ${output.exitCode}`,
+    );
+  }
+  return output.result;
+}
+
+/**
+ * Ask the gate script whether this tick needs the Lead. The script returns
+ * `{ quiet: boolean, reason?: string, summary?: string }`. Anything else, and
+ * any failure, is an `error` verdict, which never skips a checklist.
+ *
+ * One deadline covers the whole call, credential setup included. When it
+ * fires, the runner's signal aborts (the script never starts, or is killed)
+ * and the verdict is `error` without waiting for the runner to settle.
+ */
+async function runChecklistGate(
+  scriptName: string,
+  leadAgentId: string,
+): Promise<ChecklistGateVerdict> {
+  const controller = new AbortController();
+  const timeoutMs = checklistGateTimeoutMs;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const runner = checklistGateRunnerForTests ?? defaultChecklistGateRunner;
+    const run = runner(scriptName, leadAgentId, controller.signal);
+    // A runner that settles after the deadline must not surface as an unhandled rejection.
+    run.catch(() => {});
+    const deadline = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(new Error(`gate timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+    });
+    const result = (await Promise.race([run, deadline])) as {
+      quiet?: unknown;
+      reason?: unknown;
+      summary?: unknown;
+    } | null;
+    if (!result || typeof result !== "object" || typeof result.quiet !== "boolean") {
+      return { verdict: "error", reason: "result has no boolean `quiet` field" };
+    }
+    const reason = typeof result.reason === "string" ? result.reason.slice(0, 300) : "";
+    if (result.quiet) return { verdict: "quiet", reason };
+    const summary =
+      typeof result.summary === "string" && result.summary.trim()
+        ? result.summary.slice(0, 4000)
+        : null;
+    return { verdict: "wake", reason, summary };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { verdict: "error", reason: scrubSecrets(message).slice(0, 300) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * Check HEARTBEAT.md content and create a checklist task for the lead if needed.
  */
@@ -1687,7 +1816,28 @@ export async function checkHeartbeatChecklist(): Promise<void> {
   );
   if (existing) return;
 
-  const systemStatus = await gatherSystemStatus();
+  const gateScript = heartbeatChecklistGateScript();
+  const gateMode = heartbeatChecklistGateMode();
+  const gate = gateScript ? await runChecklistGate(gateScript, lead.id) : null;
+  if (gate) {
+    console.log(
+      `[Heartbeat] Checklist gate "${gateScript}" (${gateMode}): ${gate.verdict}${gate.reason ? ` (${gate.reason})` : ""}`,
+    );
+  }
+  if (gate?.verdict === "quiet" && gateMode === "enforce") {
+    console.log(`[Heartbeat] Checklist skipped for lead ${lead.name}: quiet tick`);
+    return;
+  }
+
+  let systemStatus = await gatherSystemStatus();
+  // Shadow mode leaves the prompt untouched so the Lead's own quiet/non-quiet
+  // outcome stays an independent check on the gate's verdict.
+  if (gateMode === "enforce" && gate?.verdict === "wake" && gate.summary) {
+    const findings = resolveTemplate("heartbeat.checklist.gate_findings", {
+      gate_summary: gate.summary,
+    });
+    if (!findings.skipped && findings.text) systemStatus += `\n\n${findings.text}`;
+  }
 
   const result = resolveTemplate("heartbeat.checklist", {
     system_status: systemStatus,
@@ -1704,7 +1854,7 @@ export async function checkHeartbeatChecklist(): Promise<void> {
     // the swarm's own work, not as a human's MCP usage.
     source: "system",
     taskType: "heartbeat-checklist",
-    tags: ["checklist", "auto-generated"],
+    tags: ["checklist", "auto-generated", ...(gate ? [`heartbeat-gate:${gate.verdict}`] : [])],
     priority: 60,
   });
 

package/src/heartbeat/templates.ts

@@ -53,6 +53,22 @@ Goal: Review system status and your standing orders, take action if needed.
   category: "event",
 });
 
+// Appended to the checklist's system status when the checklist gate runs in
+// enforce mode and reports a wake verdict with a summary.
+registerTemplate({
+  eventType: "heartbeat.checklist.gate_findings",
+  header: "",
+  defaultBody: `## Gate Findings [auto-generated]
+{{gate_summary}}`,
+  variables: [
+    {
+      name: "gate_summary",
+      description: "The checklist gate script's `summary` of what changed since the last tick",
+    },
+  ],
+  category: "event",
+});
+
 // ============================================================================
 // Boot triage (one-off after container restart)
 // ============================================================================

package/src/http/all-routes.ts

@@ -55,6 +55,7 @@ import "./script-connection-proxy";
 import "./session-data";
 import "./sessions";
 import "./skills";
+import "./slack-inbound";
 import "./scripts";
 import "./mcp-bridge";
 import "./mcp-oauth";

package/src/http/index.ts

@@ -121,6 +121,7 @@ import { handleScripts } from "./scripts";
 import { handleSessionData } from "./session-data";
 import { handleSessions } from "./sessions";
 import { handleSkills } from "./skills";
+import { handleSlackInbound } from "./slack-inbound";
 import { handleStats } from "./stats";
 import { handleStatus } from "./status";
 import { handleTaskTemplates } from "./task-templates";
@@ -362,6 +363,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleRealtimeTicket(req, res, pathSegments, queryParams),
         () => handleRealtimeAsset(req, res),
         () => handleIntegrations(req, res, pathSegments, queryParams),
+        () => handleSlackInbound(req, res, pathSegments),
         () => handlePromptTemplates(req, res, pathSegments, queryParams),
         () => handleDbQuery(req, res, pathSegments, queryParams),
         () => handleMetrics(req, res, pathSegments, queryParams, myAgentId),

package/src/http/integrations.ts

@@ -105,7 +105,9 @@ const slackManifestRoute = route({
 export function createIntegrationsHandler(deps: TestConnectionDeps = {}) {
   const buildClient =
     deps.buildClient ??
-    ((apiKey: string) => new Anthropic({ apiKey }) as unknown as ClaudeManagedTestClient);
+    ((apiKey: string) =>
+      // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- the SDK client is a superset of this narrow test seam.
+      new Anthropic({ apiKey }) as unknown as ClaudeManagedTestClient);
 
   return async function handleIntegrations(
     req: IncomingMessage,

package/src/http/mcp-bridge.ts

@@ -66,6 +66,7 @@ export async function invokeToolInProcess(args: {
   }
 
   const server = await getBridgeServer();
+  // oxlint-disable-next-line anti-slop/no-chained-type-assertions -- the MCP SDK keeps its tool registry private.
   const tools = (server as unknown as { _registeredTools: ToolRegistry })._registeredTools;
   const tool = tools[args.toolName];
   if (!tool) {

package/src/http/pages-public.ts

@@ -24,6 +24,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { BROWSER_SDK_JS, SWARM_UI_JS } from "../artifact-sdk/browser-sdk";
+import { feedbackOverlayScripts, isPageFeedbackRequested } from "../artifact-sdk/feedback-overlay";
 import { getPage, incrementPageViewCount } from "../be/db";
 import { type Page, PageSchema } from "../types";
 import { getAppUrl, getConfiguredAppUrls } from "../utils/constants";
@@ -642,8 +643,12 @@ export async function handlePagesPublic(
   }
 
   // text/html — inject SDK + serve. Append the self-print snippet when the
-  // export button requested it.
-  const html = injectBrowserSdk(page.body) + (wantsPrint ? PRINT_AUTOTRIGGER_SCRIPT : "");
+  // export button requested it, and the feedback overlay when
+  // `?__swarm-feedback` is on (the overlay hides itself in print).
+  const html =
+    injectBrowserSdk(page.body) +
+    (wantsPrint ? PRINT_AUTOTRIGGER_SCRIPT : "") +
+    (isPageFeedbackRequested(queryParams) ? feedbackOverlayScripts(page.id) : "");
   const headers: Record<string, string> = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",