@desplega.ai/agent-swarm 1.168.0 → 1.171.0

package/dist/{cli-74ez9b66.js → cli-0d2rqhvq.js}

@@ -1,7 +1,7 @@
 import {
   ALL_TOOLS,
   init_tool_config
-} from "./cli-3qhyh31j.js";
+} from "./cli-ywm1azg9.js";
 import {
   AgentAvatarSchema,
   CreateTaskOptionsSchema,
@@ -22,7 +22,7 @@ import {
   normalizeAssetKey,
   parseAssetKey,
   parseModelTier
-} from "./cli-xvdgasgy.js";
+} from "./cli-hsem16hb.js";
 import {
   IdentityFieldBudgetError,
   checkIdentityFieldBudget,
@@ -36,14 +36,14 @@ import {
   init_profile_sync,
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd
-} from "./cli-mxvnnv5q.js";
+} from "./cli-rrbctenq.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
 } from "./cli-7mm2r1kp.js";
 import {
   init_session_templates
-} from "./cli-g5erf0zt.js";
+} from "./cli-e2prcx5m.js";
 import {
   init_config,
   isSlackConfigured
@@ -76,10 +76,6 @@ import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-a35hzdve.js";
-import {
-  init_env_flag,
-  isEnvFlagEnabled
-} from "./cli-ej6gbxfb.js";
 import {
   harnessModelMismatch,
   init_runtime_model_catalog,
@@ -103,18 +99,22 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-ng1pmdx6.js";
+} from "./cli-erbp6b4g.js";
 import {
   init_bus,
   realtimeBus
 } from "./cli-zf8jjwex.js";
+import {
+  init_env_flag,
+  isEnvFlagEnabled
+} from "./cli-ej6gbxfb.js";
 import {
   init_secret_scrubber,
   registerSensitiveKeyName,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-wt7ccy4r.js";
+} from "./cli-d161g69q.js";
 import {
   __commonJS,
   __esm,
@@ -8597,6 +8597,15 @@ var init_catalog = __esm(() => {
           "system",
           "other"
         ]
+      },
+      popup: {
+        type: "string",
+        description: "Dashboard pop-up that a popup.* event is about.",
+        enum: [
+          "feedback",
+          "org_name",
+          "used_by"
+        ]
       }
     },
     common_properties: {
@@ -9721,6 +9730,10 @@ var init_catalog = __esm(() => {
           key: {
             type: "string",
             required: true
+          },
+          email_domain: {
+            type: "string",
+            description: "Domain of the email typed into the item, never the address."
           }
         }
       },
@@ -9800,6 +9813,148 @@ var init_catalog = __esm(() => {
           }
         }
       },
+      {
+        product: "agent-swarm",
+        event: "popup.shown",
+        description: "A dashboard pop-up was shown. Telemetry-gated: never sent while telemetry is off.",
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          popup: {
+            ref: "popup",
+            required: true
+          },
+          trigger: {
+            type: "string",
+            required: true,
+            enum: [
+              "task_failed",
+              "tasks_completed",
+              "workflow_completed",
+              "quarterly",
+              "missing_org_name"
+            ],
+            description: "Rule that made the pop-up eligible."
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "popup.dismissed",
+        description: "A dashboard pop-up was closed without submitting.",
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          popup: {
+            ref: "popup",
+            required: true
+          },
+          method: {
+            type: "string",
+            required: true,
+            enum: [
+              "later",
+              "close",
+              "escape"
+            ]
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "popup.submitted",
+        description: "A dashboard pop-up was submitted. Content stays out of telemetry: only flags for what was filled.",
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          popup: {
+            ref: "popup",
+            required: true
+          },
+          score: {
+            type: "integer",
+            minimum: 0,
+            description: "Feedback pop-up only: the 0-10 score. /v1/feedback enforces the upper bound."
+          },
+          has_message: {
+            type: "boolean",
+            required: true
+          },
+          has_contact: {
+            type: "boolean",
+            required: true,
+            description: "A name or email was left. The values go to /v1/feedback, never here."
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "org.profile_updated",
+        description: "An admin changed the org profile. Lists which fields changed, never their values.",
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          fields: {
+            type: "array",
+            required: true,
+            description: "Changed field names: name, website."
+          },
+          surface: {
+            type: "string",
+            required: true,
+            enum: [
+              "prompt",
+              "setup",
+              "settings"
+            ],
+            description: "Where the change was made. Not trigger_surface: that key fills the raw_events.trigger_surface column."
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "used_by.consent_changed",
+        description: 'An admin granted or revoked the "used by" logo consent. The request itself goes to /v1/used-by.',
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          granted: {
+            type: "boolean",
+            required: true
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "telemetry.enabled",
+        description: "Telemetry was turned on. Sent once, on the first boot or re-init after opting in.",
+        since: "2026-10-12",
+        source: "api-server",
+        properties: {
+          via: {
+            type: "string",
+            required: true,
+            enum: [
+              "banner",
+              "settings",
+              "env"
+            ]
+          }
+        }
+      },
+      {
+        product: "agent-swarm",
+        event: "fleet_benchmark.viewed",
+        description: "The fleet benchmark card was shown.",
+        since: "2026-10-12",
+        source: "ui",
+        properties: {
+          has_org_name: {
+            type: "boolean",
+            required: true
+          }
+        }
+      },
       {
         product: "agent-fs",
         event: "server.started",
@@ -9955,6 +10110,7 @@ function buildContext(input) {
   const userId = input.actor?.userId?.trim();
   const orgName = input.orgName?.trim();
   const orgDomain = validOrgDomain(input.orgDomain);
+  const orgWebsite = validOrgDomain(input.orgWebsite);
   return {
     org_id: input.orgId,
     org_name: orgName ? orgName : null,
@@ -9966,7 +10122,8 @@ function buildContext(input) {
     swarm_version: input.swarmVersion,
     install_method: input.installMethod ?? null,
     install_preset: input.installPreset ?? null,
-    acquisition_source: input.acquisitionSource ?? null
+    acquisition_source: input.acquisitionSource ?? null,
+    ...orgWebsite ? { org_website: orgWebsite } : {}
   };
 }
 function catalogSpecs(event) {
@@ -10007,6 +10164,87 @@ var init_telemetry_context = __esm(() => {
   ORG_DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
 });
 
+// src/utils/org-website.ts
+function normalizeOrgWebsite(raw) {
+  let value = raw?.trim().toLowerCase();
+  if (!value)
+    return null;
+  if (!/^[a-z][a-z0-9+.-]*:\/\//.test(value))
+    value = `https://${value}`;
+  let host;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+      return null;
+    if (url.username || url.password)
+      return null;
+    host = url.hostname;
+  } catch {
+    return null;
+  }
+  host = host.replace(/\.$/, "");
+  if (host.startsWith("www."))
+    host = host.slice(4);
+  if (!host || host.length > 253)
+    return null;
+  if (host.startsWith("[") || IPV4.test(host))
+    return null;
+  const labels = host.split(".");
+  if (labels.length < 2)
+    return null;
+  if (!labels.every((label) => label.length <= 63 && LABEL.test(label)))
+    return null;
+  if (/^\d+$/.test(labels.at(-1) ?? ""))
+    return null;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix)))
+    return null;
+  return host;
+}
+function orgLogoUrl(host, origin = TELEMETRY_PROXY_ORIGIN) {
+  return `${origin.replace(/\/+$/, "")}/v1/logo?domain=${encodeURIComponent(host)}`;
+}
+function isFilledOrgLogoUrl(url, origin = TELEMETRY_PROXY_ORIGIN) {
+  if (!url)
+    return false;
+  try {
+    const parsed = new URL(url);
+    return parsed.origin === new URL(origin).origin && parsed.pathname === "/v1/logo" && parsed.searchParams.has("domain");
+  } catch {
+    return false;
+  }
+}
+var LABEL, IPV4, BLOCKED_SUFFIXES, TELEMETRY_PROXY_ORIGIN = "https://proxy.desplega.sh", FREE_MAIL_DOMAINS;
+var init_org_website = __esm(() => {
+  LABEL = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+  IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+  BLOCKED_SUFFIXES = [".local", ".internal", ".localhost", ".lan", ".home", ".test"];
+  FREE_MAIL_DOMAINS = new Set([
+    "gmail.com",
+    "googlemail.com",
+    "outlook.com",
+    "hotmail.com",
+    "live.com",
+    "msn.com",
+    "yahoo.com",
+    "icloud.com",
+    "me.com",
+    "mac.com",
+    "aol.com",
+    "proton.me",
+    "protonmail.com",
+    "gmx.com",
+    "gmx.de",
+    "yandex.com",
+    "yandex.ru",
+    "mail.com",
+    "zoho.com",
+    "qq.com",
+    "163.com",
+    "hey.com",
+    "fastmail.com"
+  ]);
+});
+
 // src/utils/request-auth-context.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 function beginRequestAuthScope() {
@@ -10041,6 +10279,9 @@ var init_request_auth_context = __esm(() => {
 
 // src/telemetry.ts
 import { randomUUID } from "node:crypto";
+function setTelemetryIngestObserver(observer) {
+  ingestObserver = observer;
+}
 function isTelemetryEnabled() {
   return isEnvFlagEnabled("ANONYMIZED_TELEMETRY", true);
 }
@@ -10228,7 +10469,13 @@ function getTelemetryEnvironment() {
     ;
   return "production";
 }
-function emit(event, properties, metadata, actor) {
+function track(options) {
+  emit(options.event, options.properties, options.metadata, options.actor);
+}
+function trackRelayed(event, properties, options) {
+  emit(event, properties, undefined, options.actor, options.emitter);
+}
+function emit(event, properties, metadata, actor, emitter = source) {
   if (!isTelemetryEnabled() || !installationId)
     return;
   maybeRefreshOrgIdentity();
@@ -10236,6 +10483,8 @@ function emit(event, properties, metadata, actor) {
   if (!orgId)
     return;
   try {
+    const occurredAt = new Date().toISOString();
+    const sentFor = installationId;
     const isCloud = cachedIsCloud || isCloudDeployment();
     const orgIdentity = getOrgIdentity();
     const userId = actor?.userId?.trim() || undefined;
@@ -10243,14 +10492,15 @@ function emit(event, properties, metadata, actor) {
       schema_version: 2,
       product: PRODUCT,
       event,
-      occurred_at: new Date().toISOString(),
-      source,
+      occurred_at: occurredAt,
+      source: emitter,
       actor_mode: "anonymous",
       actor_anonymous_id: installationId,
       context: buildContext({
         orgId,
         orgName: orgIdentity.organization_name,
         orgDomain: cachedOrgDomain,
+        orgWebsite: normalizeOrgWebsite(process.env.SWARM_ORG_WEBSITE),
         installationId,
         actor: userId ? { userId, role: actor?.role ?? roleResolver?.(userId) ?? null } : undefined,
         isCloud,
@@ -10286,6 +10536,9 @@ function emit(event, properties, metadata, actor) {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload),
       signal: AbortSignal.timeout(TIMEOUT_MS)
+    }).then((response) => {
+      if (response.ok)
+        ingestObserver?.({ installationId: sentFor, occurredAt });
     }).catch(() => {});
   } catch {}
 }
@@ -10300,12 +10553,13 @@ function emitIntegrationConnected(type, providerSlug, firstOfType) {
   }, { userId: getCurrentRequestUserId() ?? null });
   return true;
 }
-var TELEMETRY_ENDPOINT = "https://proxy.desplega.sh/v1/events", PRODUCT = "agent-swarm", TIMEOUT_MS = 5000, installationId = null, installedAt = null, cachedOrgId, cachedOrgDomain, roleResolver = null, identityReloader = null, lastIdentityLoadAt = 0, source = "unknown", cachedIsCloud = false, cachedIsE2b = false, cachedHasEmbedding = false, cachedHasSlackChannel = false, cachedHasEmailChannel = false, cachedInstallMethod = "manual", cachedInstallPreset, CLOUD_HOST_EXACT, CLOUD_HOST_SUFFIXES, KNOWN_INSTALL_METHODS, KNOWN_INSTALL_PRESETS, KNOWN_INTEGRATION_TYPES, INTEGRATION_PROVIDERS, ORG_IDENTITY_RETRY_MS = 60000, ORG_IDENTITY_REFRESH_MS, telemetry;
+var TELEMETRY_ENDPOINT = "https://proxy.desplega.sh/v1/events", PRODUCT = "agent-swarm", TIMEOUT_MS = 5000, installationId = null, installedAt = null, ingestObserver = null, cachedOrgId, cachedOrgDomain, roleResolver = null, identityReloader = null, lastIdentityLoadAt = 0, source = "unknown", cachedIsCloud = false, cachedIsE2b = false, cachedHasEmbedding = false, cachedHasSlackChannel = false, cachedHasEmailChannel = false, cachedInstallMethod = "manual", cachedInstallPreset, CLOUD_HOST_EXACT, CLOUD_HOST_SUFFIXES, KNOWN_INSTALL_METHODS, KNOWN_INSTALL_PRESETS, KNOWN_INTEGRATION_TYPES, INTEGRATION_PROVIDERS, ORG_IDENTITY_RETRY_MS = 60000, ORG_IDENTITY_REFRESH_MS, telemetry;
 var init_telemetry = __esm(() => {
   init_package();
   init_config();
   init_telemetry_context();
   init_env_flag();
+  init_org_website();
   init_request_auth_context();
   CLOUD_HOST_EXACT = new Set([
     "agent-swarm-mcp.desplega.sh",
@@ -12118,7 +12372,7 @@ var init_runtime = __esm(() => {
 // src/telemetry-identity.ts
 async function loadUserRole(userId) {
   try {
-    const { getUserGrant } = await import("./rbac-roles-97w370qj.js");
+    const { getUserGrant } = await import("./rbac-roles-nc7k9d0t.js");
     const grant = await getUserGrant(userId);
     const role = grant.grantsAll ? "admin" : "member";
     if (roleCache.size >= ROLE_CACHE_LIMIT) {
@@ -12278,6 +12532,10 @@ var init_codex_auth_failure = __esm(() => {
   ];
 });
 
+// src/utils/config-secrets.ts
+var MASKED_SECRET_VALUE = "********";
+var init_config_secrets = () => {};
+
 // src/utils/github-pull-request.ts
 function parseGitHubPullRequestToken(token) {
   const candidate = token.replace(TRAILING_PROSE_PUNCTUATION_RE, "");
@@ -12396,6 +12654,14 @@ var init_heartbeat_expiry = __esm(() => {
   };
 });
 
+// src/utils/runtime-pools-flag.ts
+function isRuntimePoolsEnabled(env2 = process.env) {
+  return isEnvFlagEnabled("RUNTIME_POOLS_ENABLED", false, env2);
+}
+var init_runtime_pools_flag = __esm(() => {
+  init_env_flag();
+});
+
 // src/be/date-utils.ts
 function normalizeDate(date) {
   if (date == null)
@@ -12436,6 +12702,9 @@ function rowToAgent(row, slim = false) {
     name: row.name,
     isLead: row.isLead === 1,
     status: row.status,
+    runtimePoolId: row.runtime_pool_id ?? null,
+    runtimeProvisionAttempts: row.runtime_provision_attempts ?? 0,
+    runtimeProvisionRetryAt: row.runtime_provision_retry_at ?? null,
     description: row.description ?? undefined,
     role: row.role ?? undefined,
     capabilities: row.capabilities ? JSON.parse(row.capabilities) : [],
@@ -13106,6 +13375,7 @@ function rowToAgentTask(row) {
     routingReason: row.routing_reason ?? undefined,
     routingSource: row.routing_source ?? undefined,
     routingNote: row.routing_note ?? undefined,
+    poolWakeAt: row.pool_wake_at ?? undefined,
     taskType: row.taskType ?? undefined,
     tags: row.tags ? JSON.parse(row.tags) : [],
     priority: row.priority ?? 50,
@@ -13839,6 +14109,52 @@ var init_task_lifecycle_events = __esm(() => {
   taskStartedHandlers = [];
 });
 
+// src/realtime/channels.ts
+function channelTopic(namespace, name) {
+  return `channel:${JSON.stringify([namespace, name])}`;
+}
+function addWorkerSubscription(agentId, subscriber) {
+  const subscribers = workerSubscribers.get(agentId) ?? new Set;
+  subscribers.add(subscriber);
+  workerSubscribers.set(agentId, subscribers);
+}
+function removeWorkerSubscription(agentId, subscriber) {
+  const subscribers = workerSubscribers.get(agentId);
+  subscribers?.delete(subscriber);
+  if (subscribers?.size === 0)
+    workerSubscribers.delete(agentId);
+}
+function listSubscribedWorkerAgents() {
+  return [...workerSubscribers.keys()];
+}
+var workerSubscribers;
+var init_channels = __esm(() => {
+  workerSubscribers = new Map;
+});
+
+// src/be/worker-nudges.ts
+function publishWorkerNudge(agentId, nudge) {
+  if (!isRuntimePoolsEnabled())
+    return;
+  realtimeBus.publish(channelTopic(`worker:${agentId}`, "nudge"), {
+    v: 1,
+    ...nudge,
+    at: new Date().toISOString()
+  });
+}
+function publishWorkerConfigNudge(scope, scopeId) {
+  if (!isRuntimePoolsEnabled())
+    return;
+  const agents = scope === "agent" ? scopeId ? [scopeId] : [] : listSubscribedWorkerAgents();
+  for (const agentId of agents)
+    publishWorkerNudge(agentId, { kind: "config" });
+}
+var init_worker_nudges = __esm(() => {
+  init_bus();
+  init_channels();
+  init_runtime_pools_flag();
+});
+
 // src/be/db/tasks/write.ts
 function configureTaskWriteDependencies(value) {
   dependencies3 = value;
@@ -13917,10 +14233,10 @@ async function getPendingTaskForAgent(agentId) {
   }
   return null;
 }
-async function assignUnassignedTaskPending(taskId, agentId) {
+async function assignUnassignedTaskPending(taskId, agentId, options = {}) {
   {
-    const task = await getTaskById(taskId);
-    const agent = await getAgentById(agentId);
+    const task = options.routingSnapshot?.task ?? await getTaskById(taskId);
+    const agent = options.routingSnapshot?.agent ?? await getAgentById(agentId);
     if (task && (!agent || !isAgentEligibleForTask(agent, task))) {
       try {
         await dependencies3.createLogEntry({
@@ -13939,8 +14255,22 @@ async function assignUnassignedTaskPending(taskId, agentId) {
     }
   }
   const now = new Date().toISOString();
-  const row = await getDbClient().get(`UPDATE agent_tasks SET agentId = ?, status = 'pending', lastUpdatedAt = ?
-       WHERE id = ? AND status = 'unassigned' RETURNING *`, [agentId, now, taskId]);
+  const snapshot = options.routingSnapshot;
+  const guards = snapshot ? ` AND lastUpdatedAt = ?
+        AND EXISTS (SELECT 1 FROM agents WHERE id = ? AND lastUpdatedAt = ?
+          AND (SELECT COUNT(*) FROM agent_tasks WHERE agentId = agents.id
+            AND status IN ('pending', 'in_progress')) < COALESCE(maxTasks, 1))` : "";
+  const poolGuard = snapshot?.pool ? ` AND EXISTS (SELECT 1 FROM runtime_pools WHERE id = ? AND updated_at = ?
+        AND enabled = 1 AND (circuit_open_until IS NULL OR circuit_open_until <= ?))` : "";
+  const row = await getDbClient().get(`UPDATE agent_tasks SET agentId = ?, status = 'pending', lastUpdatedAt = ?, pool_wake_at = ?
+       WHERE id = ? AND status = 'unassigned'${guards}${poolGuard} RETURNING *`, [
+    agentId,
+    now,
+    options.poolWakeAt ?? null,
+    taskId,
+    ...snapshot ? [snapshot.task.lastUpdatedAt, agentId, snapshot.agent.lastUpdatedAt] : [],
+    ...snapshot?.pool ? [snapshot.pool.id, snapshot.pool.updatedAt, options.poolWakeAt ?? now] : []
+  ]);
   if (row) {
     try {
       await dependencies3.createLogEntry({
@@ -13952,6 +14282,7 @@ async function assignUnassignedTaskPending(taskId, agentId) {
         metadata: { pendingDispatch: true }
       });
     } catch {}
+    getDbClient().afterCommit(() => publishWorkerNudge(agentId, { kind: "work", taskId }));
   }
   return row ? rowToAgentTask(row) : null;
 }
@@ -14077,7 +14408,7 @@ async function completeTask(id, output, options) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.completed", {
           taskId: id,
           output: scrubbedOutput,
@@ -14132,7 +14463,7 @@ async function failTask(id, reason, opts = {}) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.failed", {
           taskId: id,
           failureReason: scrubbedReason,
@@ -14189,6 +14520,13 @@ async function cancelTask(id, reason) {
   const row = await getDbClient().get(`UPDATE agent_tasks SET status = 'cancelled', failureReason = ?, finishedAt = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
        WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled', 'superseded') RETURNING *`, [cancelReason, finishedAt, id]);
   if (row && oldTask) {
+    const recipients = new Set([row.agentId, row.offeredTo]);
+    getDbClient().afterCommit(() => {
+      for (const agentId of recipients) {
+        if (agentId)
+          publishWorkerNudge(agentId, { kind: "cancel", taskId: id });
+      }
+    });
     dependencies3.emitTaskLifecycleTelemetryAfterCommit("cancelled", {
       taskId: id,
       source: oldTask.source,
@@ -14207,7 +14545,7 @@ async function cancelTask(id, reason) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.cancelled", {
           taskId: id,
           agentId: row.agentId,
@@ -14264,7 +14602,7 @@ async function supersedeTask(id, args) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.superseded", {
           taskId: id,
           reason: args.reason,
@@ -14476,7 +14814,7 @@ async function updateTaskProgress(id, progress) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.progress", {
           taskId: id,
           progress: scrubbedProgress,
@@ -14494,6 +14832,7 @@ var init_write = __esm(() => {
   init_types();
   init_secret_scrubber();
   init_task_lifecycle_events();
+  init_worker_nudges();
   init_agents();
   init_runtime();
   init_human_free();
@@ -14502,6 +14841,90 @@ var init_write = __esm(() => {
   lastAffinityDispatchSkipLoggedAt = new Map;
 });
 
+// src/be/db/workflow-runs.ts
+async function getChildWorkflowRunId(parentStepId) {
+  const row = await getDbClient().get("SELECT id FROM workflow_runs WHERE parentStepId = ?", [parentStepId]);
+  return row?.id ?? null;
+}
+async function getWorkflowRunParent(parentStepId) {
+  const row = await getDbClient().get(`SELECT s.runId AS runId, r.workflowId AS workflowId, s.id AS stepId, s.nodeId AS nodeId
+       FROM workflow_run_steps s
+       JOIN workflow_runs r ON r.id = s.runId
+      WHERE s.id = ?`, [parentStepId]);
+  return row ?? null;
+}
+async function getWorkflowRunLineage(runId, maxDepth) {
+  const rows = await getDbClient().query(`WITH RECURSIVE lineage(id, workflowId, parentStepId, depth) AS (
+       SELECT id, workflowId, parentStepId, 0 FROM workflow_runs WHERE id = ?
+       UNION ALL
+       SELECT r.id, r.workflowId, r.parentStepId, l.depth + 1
+         FROM lineage l
+         JOIN workflow_run_steps s ON s.id = l.parentStepId
+         JOIN workflow_runs r ON r.id = s.runId
+        WHERE l.depth < ?
+     )
+     SELECT workflowId FROM lineage ORDER BY depth`, [runId, maxDepth]);
+  return rows.map((row) => row.workflowId);
+}
+async function getSettledChildRunParentSteps() {
+  const rows = await getDbClient().query(`SELECT s.id
+       FROM workflow_run_steps s
+       LEFT JOIN workflow_runs c ON c.parentStepId = s.id
+      WHERE s.status = 'waiting' AND s.nodeType = 'sub-workflow'
+        AND (c.id IS NULL OR c.status IN ('completed', 'failed', 'cancelled', 'skipped'))`);
+  return rows.map((row) => row.id);
+}
+async function wakeParentsOfDeletedRuns(workflowId) {
+  const rows = await getDbClient().query("SELECT id, parentStepId FROM workflow_runs WHERE workflowId = ? AND parentStepId IS NOT NULL", [workflowId]);
+  for (const row of rows)
+    emitAfterCommit(row.id, row.parentStepId);
+}
+function emitChildRunFinished(childRunId, parentStepId, status) {
+  if (TERMINAL_STATUSES.has(status))
+    emitAfterCommit(childRunId, parentStepId);
+}
+function emitAfterCommit(childRunId, parentStepId) {
+  getDbClient().afterCommit(() => {
+    import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      workflowEventBus.emit("workflow.child.finished", { childRunId, parentStepId });
+    }).catch((err) => console.error("[db] workflow.child.finished event not emitted:", scrubSecrets(err instanceof Error ? err.message : String(err))));
+  });
+}
+var TERMINAL_STATUSES;
+var init_workflow_runs = __esm(() => {
+  init_secret_scrubber();
+  init_runtime();
+  TERMINAL_STATUSES = new Set([
+    "completed",
+    "failed",
+    "cancelled",
+    "skipped"
+  ]);
+});
+
+// src/scripts-runtime/executors/quickjs-pool-config.ts
+function validateQuickJSPoolSize(value) {
+  const error2 = `Invalid SCRIPT_QUICKJS_POOL_SIZE (must be an integer between 1 and ${MAX_QUICKJS_POOL_SIZE})`;
+  if (typeof value !== "string" && typeof value !== "number")
+    return error2;
+  const text = String(value).trim();
+  const size = Number(text);
+  if (!/^\d+$/.test(text) || !Number.isSafeInteger(size) || size < 1 || size > MAX_QUICKJS_POOL_SIZE) {
+    return error2;
+  }
+  return null;
+}
+function resolveQuickJSPoolSize(value) {
+  if (value === undefined)
+    return DEFAULT_QUICKJS_POOL_SIZE;
+  const error2 = validateQuickJSPoolSize(value);
+  if (error2)
+    throw new Error(error2);
+  return Number(value);
+}
+var DEFAULT_QUICKJS_POOL_SIZE = 4, MAX_QUICKJS_POOL_SIZE = 32;
+var init_quickjs_pool_config = () => {};
+
 // src/slack/reaction-shortcode.ts
 function normalizeSlackReactionShortcode(raw) {
   if (typeof raw !== "string")
@@ -14627,7 +15050,8 @@ function isInternalConfigKey(key) {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
 }
 function internalConfigKeyError(key) {
-  return new Error(`Key '${key}' is managed by /api/onboarding`);
+  const owner = key.toLowerCase() === "runtime_owner_id" ? "the runtime supervisor" : "/api/onboarding";
+  return new Error(`Key '${key}' is managed by ${owner}`);
 }
 function isReservedConfigKey(key) {
   return RESERVED_KEYS.has(key.toUpperCase());
@@ -14719,18 +15143,24 @@ function validateFloatRange(key, value, min, max, expectation) {
   }
   return null;
 }
+function validateRuntimeTokenTtlHours(value) {
+  const hours = Number(value);
+  return typeof value === "string" && Number.isFinite(hours) && hours > 0 && hours <= 168 ? null : "Invalid RUNTIME_TOKEN_TTL_HOURS (must be greater than zero and at most 168)";
+}
 function validateConfigValue(key, value) {
   if (isTierConfigKey(key))
     return validateTierConfigValue(key.toUpperCase(), value);
   const validator = VALIDATED_KEYS[key.toUpperCase()];
   return validator ? validator(value) : null;
 }
-var RESERVED_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, VALIDATED_KEYS;
+var RESERVED_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, validateControllerTokenTtlDays, validateControllerGraceSec, VALIDATED_KEYS;
 var init_swarm_config_guard = __esm(() => {
+  init_quickjs_pool_config();
   init_reaction_shortcode();
   init_types();
   init_api_drain();
   init_enabled_tools();
+  init_org_website();
   init_task_tool_manifest();
   init_model_tier_keys();
   RESERVED_KEYS = new Set([
@@ -14739,14 +15169,37 @@ var init_swarm_config_guard = __esm(() => {
     "CORS_ALLOW_ANY_ORIGIN",
     "EXTENSION_ALLOW_LEAD_ACTIVATION"
   ]);
-  INTERNAL_CONFIG_KEYS = new Set(["onboarding_state"]);
+  INTERNAL_CONFIG_KEYS = new Set(["onboarding_state", "runtime_owner_id"]);
   BOOLEAN_LITERALS = ["true", "false", "1", "0"];
   DB_RETENTION_TUNING_BOUNDS = {
     DB_RETENTION_TICK_BUDGET_MS: { min: 1000, max: 300000 },
     DB_RETENTION_CATCHUP_INTERVAL_MS: { min: 5000, max: 3600000 },
     DB_RETENTION_MAX_STATEMENT_MS: { min: 25, max: 5000 }
   };
+  validateControllerTokenTtlDays = boundedIntegerValidators(["RUNTIME_CONTROLLER_TOKEN_TTL_DAYS"], 1, 3650).RUNTIME_CONTROLLER_TOKEN_TTL_DAYS;
+  validateControllerGraceSec = boundedIntegerValidators(["RUNTIME_CONTROLLER_GRACE_SEC"], 0, 86400).RUNTIME_CONTROLLER_GRACE_SEC;
   VALIDATED_KEYS = {
+    ...booleanValidators(["RUNTIME_POOLS_ENABLED"]),
+    ...enumValidator("RUNTIME_DEFAULT_DELIVERY", ["poll", "push"]),
+    RUNTIME_TOKEN_TTL_HOURS: validateRuntimeTokenTtlHours,
+    RUNTIME_CONTROLLER_TOKEN_TTL_DAYS: validateControllerTokenTtlDays,
+    RUNTIME_CONTROLLER_GRACE_SEC: validateControllerGraceSec,
+    ...integerValidators([
+      "RUNTIME_SUPERVISOR_INTERVAL_MS",
+      "RUNTIME_PROVISION_TIMEOUT_SEC",
+      "RUNTIME_PROVISION_CONCURRENCY",
+      "RUNTIME_PER_TASK_EXIT_GRACE_SEC",
+      "RUNTIME_PROVISION_MAX_ATTEMPTS",
+      "RUNTIME_CIRCUIT_THRESHOLD",
+      "RUNTIME_CIRCUIT_OPEN_MIN",
+      "RUNTIME_TOKEN_ROTATE_BEFORE_MIN",
+      "RUNTIME_LEASE_RENEW_BEFORE_SEC",
+      "RUNTIME_E2B_BUILD_TIMEOUT_SEC",
+      "RUNTIME_ROTATE_BEFORE_SEC",
+      "E2B_MAX_CONTINUOUS_SEC"
+    ], 1),
+    ...integerValidators(["RUNTIME_SOCKET_GRACE_SEC"], 0),
+    ...integerValidators(["RUNTIME_WAKE_GRACE_SEC", "RUNTIME_WAKE_REROUTE_SEC", "RUNTIME_ROUTING_INTERVAL_MS"], 0),
     TASK_TOOL_MANIFESTS: (value) => {
       try {
         if (typeof value !== "string")
@@ -14791,7 +15244,9 @@ var init_swarm_config_guard = __esm(() => {
     },
     ...enumValidator("CLAUDE_TRANSPORT", ["cli", "sdk"]),
     ...enumValidator("SCRIPT_EXECUTOR", ["native", "quickjs"]),
+    SCRIPT_QUICKJS_POOL_SIZE: validateQuickJSPoolSize,
     ...enumValidator("MODEL_WINDOW_EXHAUSTED_POLICY", ["fail", "fallback"]),
+    ...enumValidator("HEARTBEAT_CHECKLIST_GATE_MODE", ["shadow", "enforce"]),
     CODEX_CREDITS_EXHAUSTED_COOLDOWN_MS: (value) => {
       const str2 = String(value).trim();
       if (!/^\d+$/.test(str2) || Number(str2) <= 0) {
@@ -14820,7 +15275,12 @@ var init_swarm_config_guard = __esm(() => {
       }
       return null;
     },
+    SWARM_ORG_WEBSITE: (value) => {
+      const str2 = String(value).trim();
+      return str2 === "" || normalizeOrgWebsite(str2) === str2 ? null : "Invalid SWARM_ORG_WEBSITE (must be a public hostname such as example.com, without scheme, www, path or port)";
+    },
     ...booleanValidators([
+      "SWARM_USED_BY_CONSENT",
       "SWARM_DEV_MODE",
       "MULTI_RUNTIME_ENABLED",
       "STEERING_ENABLED",
@@ -14934,7 +15394,7 @@ async function listStoredConfigSecrets() {
   }
   return { secrets, failed };
 }
-var init_config_secrets = __esm(() => {
+var init_config_secrets2 = __esm(() => {
   init_crypto();
   init_swarm_config_guard();
   init_runtime();
@@ -16086,7 +16546,13 @@ function registerStoredSecret(value, name) {
     registerVolatileSecret(form, name);
 }
 async function loadSecretRegistry() {
-  const result = { config: 0, oauth: 0, scriptApi: 0, failed: 0 };
+  const result = {
+    config: 0,
+    oauth: 0,
+    scriptApi: 0,
+    runtimeController: 0,
+    failed: 0
+  };
   try {
     const { secrets, failed } = await listStoredConfigSecrets();
     for (const { key, value } of secrets)
@@ -16115,11 +16581,19 @@ async function loadSecretRegistry() {
   } catch {
     result.failed += 1;
   }
+  try {
+    const { loadRuntimeControllerSecrets } = await import("./db-2rmd23wq.js");
+    const loaded = await loadRuntimeControllerSecrets();
+    result.runtimeController = loaded.count;
+    result.failed += loaded.failed;
+  } catch {
+    result.failed += 1;
+  }
   return result;
 }
 var init_secret_registry = __esm(() => {
   init_secret_scrubber();
-  init_config_secrets();
+  init_config_secrets2();
   init_oauth();
   init_db();
 });
@@ -17848,6 +18322,11 @@ async function createSteeringMessage(args) {
   ]);
   if (!row)
     throw new Error("Failed to create steering message");
+  getDbClient().afterCommit(async () => {
+    const task = await getTaskById(args.taskId);
+    if (task?.agentId)
+      publishWorkerNudge(task.agentId, { kind: "steer", taskId: args.taskId });
+  });
   try {
     await createLogEntry({
       eventType: "task_steering",
@@ -18386,7 +18865,7 @@ async function createTaskExtended(task, options) {
     priority: row.priority
   }, (task2) => task2 !== null, row.requestedByUserId);
   getDbClient().afterCommit(() => {
-    import("./event-bus-vnfthafg.js").then(({ workflowEventBus }) => {
+    import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
       workflowEventBus.emit("task.created", {
         taskId: row.id,
         task: row.task,
@@ -18441,15 +18920,21 @@ async function claimTask(taskId, agentId) {
   }
   return result;
 }
-async function releaseTask(taskId) {
-  const task = await getTaskById(taskId);
+async function releaseTask(taskId, wakeSnapshot) {
+  const task = wakeSnapshot ?? await getTaskById(taskId);
   if (!task)
     return null;
   if (task.status !== "pending" && task.status !== "in_progress")
     return null;
   const now = new Date().toISOString();
-  const row = await getDbClient().get(`UPDATE agent_tasks SET agentId = NULL, status = 'unassigned', lastUpdatedAt = ?
-       WHERE id = ? AND status IN ('pending', 'in_progress') RETURNING *`, [now, taskId]);
+  const row = await getDbClient().get(`UPDATE agent_tasks SET agentId = NULL, status = 'unassigned', lastUpdatedAt = ?, pool_wake_at = NULL
+       WHERE id = ? AND status IN ('pending', 'in_progress')
+       ${wakeSnapshot ? "AND status = 'pending' AND agentId = ? AND pool_wake_at = ? AND COALESCE(routing_reason, '') != 'human_pinned'" : ""}
+       RETURNING *`, [
+    now,
+    taskId,
+    ...wakeSnapshot ? [wakeSnapshot.agentId ?? null, wakeSnapshot.poolWakeAt ?? null] : []
+  ]);
   if (row) {
     try {
       await createLogEntry({
@@ -18460,6 +18945,10 @@ async function releaseTask(taskId) {
         newValue: "unassigned"
       });
     } catch {}
+    if (isRuntimePoolsEnabled() && !wakeSnapshot)
+      getDbClient().afterCommit(() => {
+        import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
+      });
   }
   return row ? rowToAgentTask(row) : null;
 }
@@ -18500,6 +18989,7 @@ async function acceptTask(taskId, agentId) {
         newValue: "pending"
       });
     } catch {}
+    getDbClient().afterCommit(() => publishWorkerNudge(agentId, { kind: "work", taskId }));
   }
   return row ? rowToAgentTask(row) : null;
 }
@@ -18512,7 +19002,7 @@ async function rejectTask(taskId, agentId, reason) {
   const now = new Date().toISOString();
   const row = await getDbClient().get(`UPDATE agent_tasks SET
         status = 'unassigned', offeredTo = NULL, offeredAt = NULL,
-        rejectionReason = ?, lastUpdatedAt = ?
+        rejectionReason = ?, lastUpdatedAt = ?, pool_wake_at = NULL
        WHERE id = ? AND status IN ('offered', 'reviewing') RETURNING *`, [reason ?? null, now, taskId]);
   if (row) {
     try {
@@ -18525,6 +19015,10 @@ async function rejectTask(taskId, agentId, reason) {
         metadata: reason ? { reason } : undefined
       });
     } catch {}
+    if (isRuntimePoolsEnabled())
+      getDbClient().afterCommit(() => {
+        import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
+      });
   }
   return row ? rowToAgentTask(row) : null;
 }
@@ -18617,15 +19111,23 @@ async function releaseStaleReviewingTasks(timeoutMinutes = 30) {
      WHERE status = 'reviewing' AND lastUpdatedAt < ?`, [now, cutoffTime]);
   return result.changes;
 }
-async function releaseStaleOfferedTasksForOfflineAgents() {
+async function releaseStaleOfferedTasksForOfflineAgents(isReachable) {
   const now = new Date().toISOString();
+  const reachable = [];
+  if (isRuntimePoolsEnabled() && isReachable) {
+    for (const agent of await getAllAgents()) {
+      if (agent.status === "offline" && await isReachable(agent))
+        reachable.push(agent.id);
+    }
+  }
   const result = await getDbClient().run(`UPDATE agent_tasks
      SET status = 'unassigned', offeredTo = NULL, offeredAt = NULL, lastUpdatedAt = ?
      WHERE status = 'offered'
        AND offeredTo IS NOT NULL
+       ${reachable.length ? `AND offeredTo NOT IN (${reachable.map(() => "?").join(",")})` : ""}
        AND NOT EXISTS (
          SELECT 1 FROM agents WHERE agents.id = agent_tasks.offeredTo AND agents.status != 'offline'
-       )`, [now]);
+       )`, [now, ...reachable]);
   return result.changes;
 }
 async function getOfferedTasksForAgent(agentId) {
@@ -18968,6 +19470,11 @@ async function postMessage(channelId, agentId, content, options) {
       targetMentions = parentMessage.mentions;
     }
   }
+  getDbClient().afterCommit(() => {
+    for (const mentionedAgentId of new Set(targetMentions)) {
+      publishWorkerNudge(mentionedAgentId, { kind: "work" });
+    }
+  });
   if (isTaskMessage && targetMentions.length > 0) {
     const sender = agentId ? await getAgentById(agentId) : null;
     const channel = await getChannelById(channelId);
@@ -19423,7 +19930,7 @@ function rowToSessionCost(row) {
   };
 }
 async function createSessionCost(input) {
-  const id = crypto.randomUUID();
+  const id = input.id ?? crypto.randomUUID();
   const costSource = input.costSource ?? "harness";
   const reasoningOutputTokens = input.reasoningOutputTokens ?? 0;
   const thinkingTokens = input.thinkingTokens ?? 0;
@@ -19436,7 +19943,8 @@ async function createSessionCost(input) {
          costSource, harnessCostUsd, cacheWrite5mTokens, cacheWrite1hTokens,
          modelBreakdown, createdAt
        )
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`, [
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       ON CONFLICT(id) DO NOTHING`, [
     id,
     input.sessionId,
     input.taskId ?? null,
@@ -19458,29 +19966,12 @@ async function createSessionCost(input) {
     input.cacheWrite1hTokens ?? null,
     input.modelBreakdown ? JSON.stringify(input.modelBreakdown) : null
   ]);
-  return {
-    id,
-    sessionId: input.sessionId,
-    taskId: input.taskId,
-    agentId: input.agentId,
-    totalCostUsd: input.totalCostUsd,
-    inputTokens: input.inputTokens ?? 0,
-    outputTokens: input.outputTokens ?? 0,
-    cacheReadTokens: input.cacheReadTokens ?? 0,
-    cacheWriteTokens: input.cacheWriteTokens ?? 0,
-    reasoningOutputTokens,
-    thinkingTokens,
-    durationMs: input.durationMs,
-    numTurns: input.numTurns,
-    model: input.model,
-    isError: input.isError ?? false,
-    costSource,
-    harnessCostUsd: input.harnessCostUsd ?? null,
-    cacheWrite5mTokens: input.cacheWrite5mTokens ?? null,
-    cacheWrite1hTokens: input.cacheWrite1hTokens ?? null,
-    modelBreakdown: input.modelBreakdown ?? null,
-    createdAt: new Date().toISOString()
-  };
+  const row = await getDbClient().get("SELECT * FROM session_costs WHERE id = ?", [
+    id
+  ]);
+  if (!row)
+    throw new Error("Session cost record is missing after insertion.");
+  return rowToSessionCost(row);
 }
 async function getSessionCostsByTaskId(taskId, limit2 = 500) {
   const rows = await getDbClient().query("SELECT * FROM session_costs WHERE taskId = ? ORDER BY createdAt DESC LIMIT ?", [taskId, limit2]);
@@ -20177,8 +20668,11 @@ async function updateScheduledTask(id, data) {
   return row ? rowToScheduledTask(row) : null;
 }
 async function deleteScheduledTask(id) {
-  const result = await getDbClient().run("DELETE FROM scheduled_tasks WHERE id = ?", [id]);
-  return result.changes > 0;
+  return await getDbClient().transaction(async (tx) => {
+    await tx.run("DELETE FROM user_favorites WHERE itemType = 'schedule' AND itemId = ?", [id]);
+    const result = await tx.run("DELETE FROM scheduled_tasks WHERE id = ?", [id]);
+    return result.changes > 0;
+  });
 }
 async function getDueScheduledTasks() {
   const now = new Date().toISOString();
@@ -20266,7 +20760,7 @@ function autoEncryptLegacyPlaintextSecrets(database, dbPath, options = {}) {
   console.log(`[secrets] Auto-migrated ${rows.length} secret(s) to encrypted storage.`);
 }
 function maskSecrets(configs) {
-  return configs.map((c) => c.isSecret ? { ...c, value: "********" } : c);
+  return configs.map((c) => c.isSecret ? { ...c, value: MASKED_SECRET_VALUE } : c);
 }
 function writeEnvFile(configs) {
   const { readFileSync: readFileSync3, writeFileSync: writeFileSync2 } = __require("node:fs");
@@ -20394,6 +20888,7 @@ async function upsertSwarmConfig(data) {
     registerStoredSecret(config.value, configSecretName(config.key));
     registerSensitiveKeyName(config.key);
   }
+  getDbClient().afterCommit(() => publishWorkerConfigNudge(config.scope, config.scopeId));
   return config;
 }
 async function emitBuiltInIntegrationConnectedOnce(provider) {
@@ -20407,8 +20902,10 @@ async function emitBuiltInIntegrationConnectedOnce(provider) {
   } catch {}
 }
 async function deleteSwarmConfig(id) {
-  const result = await getDbClient().run("DELETE FROM swarm_config WHERE id = ?", [id]);
-  return result.changes > 0;
+  const row = await getDbClient().get("DELETE FROM swarm_config WHERE id = ? RETURNING scope, scopeId", [id]);
+  if (row)
+    getDbClient().afterCommit(() => publishWorkerConfigNudge(row.scope, row.scopeId));
+  return row !== null;
 }
 async function deleteSwarmConfigByKey(scope, scopeId, key) {
   const resolvedScopeId = scope === "global" ? null : scopeId;
@@ -20417,7 +20914,7 @@ async function deleteSwarmConfigByKey(scope, scopeId, key) {
     return false;
   return await deleteSwarmConfig(existing.id);
 }
-async function getResolvedConfig(agentId, repoId) {
+async function getResolvedConfig(agentId, repoId, options = {}) {
   const configMap = new Map;
   const globalConfigs = await getSwarmConfigs({ scope: "global" });
   for (const config of globalConfigs) {
@@ -20432,6 +20929,8 @@ async function getResolvedConfig(agentId, repoId) {
   if (repoId) {
     const repoConfigs = await getSwarmConfigs({ scope: "repo", scopeId: repoId });
     for (const config of repoConfigs) {
+      if (config.isSecret && options.includeRepoSecrets === false)
+        continue;
       configMap.set(config.key, config);
     }
   }
@@ -20919,9 +21418,11 @@ async function deleteWorkflowRows(id, source2) {
   const client = getDbClient();
   const linkedTaskIds = (await client.query(`SELECT id FROM agent_tasks WHERE workflowRunId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id])).map((row) => row.id);
   await client.run(`UPDATE agent_tasks SET workflowRunId = NULL, workflowRunStepId = NULL WHERE workflowRunId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id]);
+  await wakeParentsOfDeletedRuns(id);
   await client.run(`DELETE FROM workflow_run_steps WHERE runId IN (SELECT id FROM workflow_runs WHERE workflowId = ?)`, [id]);
   await client.run("DELETE FROM workflow_runs WHERE workflowId = ?", [id]);
   await reclassifyTaskHumanFree(linkedTaskIds);
+  await client.run("DELETE FROM user_favorites WHERE itemType = 'workflow' AND itemId = ?", [id]);
   const result = await client.run("DELETE FROM workflows WHERE id = ?", [id]);
   const deleted = result.changes > 0;
   if (deleted) {
@@ -20948,7 +21449,8 @@ function rowToWorkflowRun(row, view = "replay") {
     createdBy: row.created_by ?? undefined,
     startedAt: normalizeDateRequired(row.startedAt),
     lastUpdatedAt: normalizeDateRequired(row.lastUpdatedAt),
-    finishedAt: normalizeDate(row.finishedAt) ?? undefined
+    finishedAt: normalizeDate(row.finishedAt) ?? undefined,
+    parentStepId: row.parentStepId ?? undefined
   };
   return defineWorkflowPayload(run, "context", row.context, row.context_replay, view, {
     runId: row.id,
@@ -20957,13 +21459,14 @@ function rowToWorkflowRun(row, view = "replay") {
 }
 async function createWorkflowRun(data) {
   const now = new Date().toISOString();
-  const row = await getDbClient().get(`INSERT INTO workflow_runs (id, workflowId, triggerType, startedAt, triggerData, created_by) VALUES (?, ?, ?, ?, ?, ?) RETURNING *`, [
+  const row = await getDbClient().get(`INSERT INTO workflow_runs (id, workflowId, triggerType, startedAt, triggerData, created_by, parentStepId) VALUES (?, ?, ?, ?, ?, ?, ?) RETURNING *`, [
     data.id,
     data.workflowId,
     data.triggerType ?? "manual",
     now,
     data.triggerData ? scrubJsonValue(data.triggerData) : null,
-    data.createdBy ?? null
+    data.createdBy ?? null,
+    data.parentStepId ?? null
   ]);
   if (!row)
     throw new Error("Failed to create workflow run");
@@ -21025,6 +21528,8 @@ async function updateWorkflowRun(id, data) {
   if (data.status === "completed" || data.status === "failed") {
     emitWorkflowTerminalTelemetry(run);
   }
+  if (row.parentStepId)
+    emitChildRunFinished(id, row.parentStepId, run.status);
   return run;
 }
 async function listWorkflowRuns(workflowId, options = {}) {
@@ -24439,12 +24944,14 @@ var init_db2 = __esm(() => {
   init_telemetry_trigger();
   init_types();
   init_codex_auth_failure();
+  init_config_secrets();
   init_credentials();
   init_github_pull_request();
   init_heartbeat_expiry();
   init_identity_field_budget();
   init_model_rate_limit_windows();
   init_request_auth_context();
+  init_runtime_pools_flag();
   init_secret_scrubber();
   init_subscription_plans();
   init_asset_key_audit();
@@ -24457,12 +24964,14 @@ var init_db2 = __esm(() => {
   init_human_free();
   init_read();
   init_write();
+  init_workflow_runs();
   init_scrub_json();
   init_sealed_json();
   init_secret_registry();
   init_steering();
   init_swarm_config_guard();
   init_task_lifecycle_events();
+  init_worker_nudges();
   init_workflow_replay();
   init_active_sessions();
   init_agents();
@@ -25644,4 +26153,4 @@ function getMemoryStore() {
 var embeddingProvider2 = null, memoryStore = null;
 var init_memory = () => {};
 
-export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, mapTriggerSurface, init_telemetry_context, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, isTelemetryReady, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, init_templates3 as init_templates1, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, init_runtime, cachedUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, HeartbeatExpiryError, init_heartbeat_expiry, normalizeDate, normalizeDateRequired, init_date_utils, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, listApprovalRequestSummaries, getPendingApprovalVoteState, recordApprovalVotes, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, isLinearTrackerContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, onTaskStarted, init_task_lifecycle_events, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, recordTaskProviderIfUnset, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateConfigValue, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider, resetEmbeddingProvider, getMemoryStore, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings2 as init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS, refreshActiveSessionOnActivity, recordKeySeatMismatch, getScriptRunExecutionArgs, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db2 as init_db1 };
+export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, init_templates3 as init_templates1, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, init_runtime, cachedUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, init_agents, listApprovalRequestSummaries, getPendingApprovalVoteState, recordApprovalVotes, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, rowToAgentTask, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, isLinearTrackerContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, init_read, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, recordTaskProviderIfUnset, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, getChildWorkflowRunId, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, init_workflow_runs, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider, resetEmbeddingProvider, getMemoryStore, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings2 as init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS, refreshActiveSessionOnActivity, recordKeySeatMismatch, getScriptRunExecutionArgs, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db2 as init_db1 };