@desplega.ai/agent-swarm 1.172.0 → 1.173.0

package/dist/{cli-ztrv9y21.js → cli-rfz2ve55.js}

@@ -20,7 +20,7 @@ import {
 import {
   ensurePricingSeeded,
   ensureRbacSeeded
-} from "./cli-6jb2rf77.js";
+} from "./cli-42qhyvwx.js";
 import {
   buildCatalogEntries,
   getCatalogGeneration,
@@ -30,10 +30,10 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-gp1rtyvk.js";
+} from "./cli-9xf7fdtp.js";
 import {
   loadModelsDevCache
-} from "./cli-r8smj8b8.js";
+} from "./cli-jpc4r224.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -90,7 +90,7 @@ import {
   upsertScriptConnection,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-j6kpj9az.js";
+} from "./cli-7a93cv8c.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -102,7 +102,7 @@ import {
   ensureToken,
   ensureTokenOrThrow,
   onAuthorizationRefreshed
-} from "./cli-388egyf6.js";
+} from "./cli-w1apjecb.js";
 import {
   AgentFsProvider,
   getFileStorageProvider,
@@ -158,7 +158,7 @@ import {
   walkGraph,
   withSaveWarnings,
   workflowSaveWarnings
-} from "./cli-kb4ehzx5.js";
+} from "./cli-1w0vj3gw.js";
 import {
   BaseExecutor,
   HumanInTheLoopExecutor,
@@ -172,11 +172,14 @@ import {
   resolveValidationPort,
   resolveWorkflowLlmConfig,
   validateDefinition
-} from "./cli-aspcaef3.js";
+} from "./cli-6r2f7edk.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
 } from "./cli-fad8m16k.js";
+import {
+  require_dist
+} from "./cli-51tf7ac3.js";
 import {
   CitationInputSchema,
   MAX_TASK_CITATIONS,
@@ -200,10 +203,14 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-9xsmdpdt.js";
+} from "./cli-tcc4wd5d.js";
 import {
-  require_dist
-} from "./cli-51tf7ac3.js";
+  externalChannelToolError,
+  getChannelBlockReason,
+  slackCode,
+  slackMissingScopeMessage,
+  withAutoJoin
+} from "./cli-v3zhnxsb.js";
 import {
   findOrCreateUserByEmail,
   findUserByEmail,
@@ -221,7 +228,7 @@ import {
   resolveUserByToken,
   revokeRuntimeTokensForRuntime,
   unlinkIdentity
-} from "./cli-e0a9sk00.js";
+} from "./cli-3nxdmjrc.js";
 import {
   canProvisionKind,
   init_runtime_providers
@@ -229,7 +236,7 @@ import {
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-qsztpfry.js";
+} from "./cli-anzdk0z4.js";
 import {
   can,
   decideAdmission,
@@ -255,6 +262,7 @@ import {
   agentContextKey,
   agentmailContextKey,
   azureDevOpsContextKey,
+  azureDevOpsWorkItemContextKey,
   beginRequestAuthScope,
   breaksJsonValidity,
   buildJiraContextKey,
@@ -546,7 +554,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   workflowContextKey
-} from "./cli-tgpfnm6r.js";
+} from "./cli-fmhj1ehj.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -616,7 +624,7 @@ import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
-} from "./cli-nyhb1r6x.js";
+} from "./cli-r4fqfpwf.js";
 import {
   getSlackConfiguration,
   init_config
@@ -690,10 +698,14 @@ import {
   unknown,
   uuid
 } from "./cli-w5e1d1vv.js";
+import {
+  getNodeEnv,
+  init_node_env
+} from "./cli-p0sg24zp.js";
 import {
   init_package,
   package_default
-} from "./cli-esnpehf5.js";
+} from "./cli-5er5gjbm.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -23010,6 +23022,32 @@ function normalizeOrgUrl(url) {
   const trimmed = url?.trim().replace(/\/+$/, "");
   return trimmed ? trimmed : null;
 }
+function orgKeyOf(url) {
+  if (!url)
+    return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password)
+    return null;
+  const host = parsed.host.toLowerCase();
+  if (host !== "dev.azure.com")
+    return host;
+  const org = parsed.pathname.split("/").find(Boolean);
+  return org ? `${host}/${org.toLowerCase()}` : null;
+}
+function isTrustedOrgUrl(url) {
+  const key = orgKeyOf(url);
+  if (!key)
+    return false;
+  const configured = orgKeyOf(orgUrl);
+  if (orgUrl)
+    return key === configured;
+  return key.startsWith("dev.azure.com/") || key.endsWith(".visualstudio.com");
+}
 var AZURE_DEVOPS_BOT_NAME = process.env.AZURE_DEVOPS_BOT_NAME ?? "agent-swarm-bot";
 function resetAzureDevOps() {
   initialized3 = false;
@@ -23033,35 +23071,69 @@ function headers() {
 function pullRequestBase(ref) {
   return `${ref.orgUrl}/${encodeURIComponent(ref.projectId)}/_apis/git/repositories/` + `${encodeURIComponent(ref.repositoryId)}/pullRequests/${ref.pullRequestId}`;
 }
-var cachedBotId = null;
+
+class AzureDevOpsLookupError extends Error {
+}
+var cachedBotIdentity = null;
+function credentialedOrgUrl(orgBaseUrl) {
+  const orgUrl2 = normalizeOrgUrl(orgBaseUrl) ?? getAzureDevOpsOrgUrl();
+  if (!orgUrl2 || !getAzureDevOpsToken())
+    return null;
+  if (!isTrustedOrgUrl(orgUrl2)) {
+    console.error("[AzureDevOps] Refusing to send credentials to an untrusted organization URL");
+    return null;
+  }
+  return orgUrl2;
+}
+async function loadBotIdentity(orgUrl2) {
+  if (cachedBotIdentity?.orgUrl === orgUrl2)
+    return cachedBotIdentity.identity;
+  let data;
+  try {
+    const resp = await fetch(`${orgUrl2}/_apis/connectionData`, {
+      headers: headers(),
+      redirect: "error"
+    });
+    if (!resp.ok)
+      throw new AzureDevOpsLookupError(`connectionData returned ${resp.status}`);
+    data = await resp.json();
+  } catch (err) {
+    if (err instanceof AzureDevOpsLookupError)
+      throw err;
+    throw new AzureDevOpsLookupError(`connectionData request failed: ${String(err)}`);
+  }
+  const identity = {
+    id: data.authenticatedUser?.id ?? null,
+    uniqueName: data.authenticatedUser?.properties?.Account?.$value?.trim() || null
+  };
+  if (identity.id || identity.uniqueName)
+    cachedBotIdentity = { orgUrl: orgUrl2, identity };
+  return identity;
+}
 async function resolveAzureDevOpsBotId(orgBaseUrl) {
   const fromEnv = process.env.AZURE_DEVOPS_BOT_ID?.trim();
   if (fromEnv)
     return fromEnv;
-  const orgUrl2 = normalizeOrgUrl(orgBaseUrl) ?? getAzureDevOpsOrgUrl();
-  if (!orgUrl2 || !getAzureDevOpsToken())
+  const orgUrl2 = credentialedOrgUrl(orgBaseUrl);
+  if (!orgUrl2)
     return null;
-  if (cachedBotId?.orgUrl === orgUrl2)
-    return cachedBotId.id;
   try {
-    const resp = await fetch(`${orgUrl2}/_apis/connectionData`, { headers: headers() });
-    if (!resp.ok) {
-      console.error(`[AzureDevOps] Failed to resolve bot identity: ${resp.status}`);
-      return null;
-    }
-    const data = await resp.json();
-    const id = data.authenticatedUser?.id;
-    if (!id)
-      return null;
-    cachedBotId = { orgUrl: orgUrl2, id };
-    return id;
+    return (await loadBotIdentity(orgUrl2)).id;
   } catch (err) {
-    console.error(`[AzureDevOps] Error resolving bot identity:`, err);
+    console.error(`[AzureDevOps] Failed to resolve bot identity:`, err);
     return null;
   }
 }
+async function resolveAzureDevOpsBotIdentity(orgBaseUrl) {
+  const fromEnv = process.env.AZURE_DEVOPS_BOT_ID?.trim() || null;
+  const orgUrl2 = credentialedOrgUrl(orgBaseUrl);
+  if (!orgUrl2)
+    return { id: fromEnv, uniqueName: null };
+  const identity = await loadBotIdentity(orgUrl2);
+  return { id: fromEnv ?? identity.id, uniqueName: identity.uniqueName };
+}
 function resetAzureDevOpsBotIdCache() {
-  cachedBotId = null;
+  cachedBotIdentity = null;
 }
 async function likeAzureDevOpsComment(ref, threadId, commentId) {
   const url = `${pullRequestBase(ref)}/threads/${threadId}/comments/${commentId}/likes?api-version=${API_VERSION}`;
@@ -23074,6 +23146,156 @@ async function likeAzureDevOpsComment(ref, threadId, commentId) {
     console.error(`[AzureDevOps] Error liking comment:`, err);
   }
 }
+// src/azure-devops/boards-sync.ts
+init_db3();
+
+// src/be/db-queries/tracker.ts
+init_date_utils();
+init_db3();
+function normalizeTrackerSync(row) {
+  return {
+    ...row,
+    lastSyncedAt: normalizeDateRequired(row.lastSyncedAt),
+    createdAt: normalizeDateRequired(row.createdAt)
+  };
+}
+function normalizeTrackerAgentMapping(row) {
+  return {
+    ...row,
+    createdAt: normalizeDateRequired(row.createdAt)
+  };
+}
+async function getTrackerSync(provider, entityType, swarmId) {
+  const row = await getDbClient().get("SELECT * FROM tracker_sync WHERE provider = ? AND entityType = ? AND swarmId = ?", [provider, entityType, swarmId]);
+  return row ? normalizeTrackerSync(row) : null;
+}
+async function getTrackerSyncByExternalId(provider, entityType, externalId) {
+  const row = await getDbClient().get("SELECT * FROM tracker_sync WHERE provider = ? AND entityType = ? AND externalId = ?", [provider, entityType, externalId]);
+  return row ? normalizeTrackerSync(row) : null;
+}
+async function createTrackerSyncIfAbsent(data) {
+  const insertResult = await getDbClient().get(`INSERT INTO tracker_sync (provider, entityType, providerEntityType, swarmId, externalId, externalIdentifier, externalUrl, lastSyncOrigin, lastDeliveryId, syncDirection)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (provider, entityType, externalId) DO NOTHING
+       RETURNING *`, [
+    data.provider,
+    data.entityType,
+    data.providerEntityType ?? null,
+    data.swarmId,
+    data.externalId,
+    data.externalIdentifier ?? null,
+    data.externalUrl ?? null,
+    data.lastSyncOrigin ?? null,
+    data.lastDeliveryId ?? null,
+    data.syncDirection ?? "inbound"
+  ]);
+  if (insertResult) {
+    return { inserted: true, sync: normalizeTrackerSync(insertResult) };
+  }
+  const existing = await getTrackerSyncByExternalId(data.provider, data.entityType, data.externalId);
+  if (!existing) {
+    throw new Error(`[tracker] createTrackerSyncIfAbsent: ON CONFLICT fired but no existing row found for (${data.provider}, ${data.entityType}, ${data.externalId})`);
+  }
+  return { inserted: false, sync: existing };
+}
+async function updateTrackerSyncSwarmId(id, swarmId) {
+  await getDbClient().run("UPDATE tracker_sync SET swarmId = ? WHERE id = ?", [swarmId, id]);
+}
+async function repointTrackerSyncBySwarmId(oldSwarmId, newSwarmId) {
+  const result = await getDbClient().run("UPDATE tracker_sync SET swarmId = ? WHERE swarmId = ?", [
+    newSwarmId,
+    oldSwarmId
+  ]);
+  return Number(result.changes ?? 0);
+}
+async function createTrackerSync(data) {
+  const result = await getDbClient().get(`INSERT INTO tracker_sync (provider, entityType, providerEntityType, swarmId, externalId, externalIdentifier, externalUrl, lastSyncOrigin, lastDeliveryId, syncDirection)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       RETURNING *`, [
+    data.provider,
+    data.entityType,
+    data.providerEntityType ?? null,
+    data.swarmId,
+    data.externalId,
+    data.externalIdentifier ?? null,
+    data.externalUrl ?? null,
+    data.lastSyncOrigin ?? null,
+    data.lastDeliveryId ?? null,
+    data.syncDirection ?? "inbound"
+  ]);
+  return normalizeTrackerSync(result);
+}
+async function updateTrackerSync(id, data) {
+  const sets = [];
+  const values = [];
+  if (data.lastSyncedAt !== undefined) {
+    sets.push("lastSyncedAt = ?");
+    values.push(data.lastSyncedAt);
+  }
+  if (data.lastSyncOrigin !== undefined) {
+    sets.push("lastSyncOrigin = ?");
+    values.push(data.lastSyncOrigin);
+  }
+  if (data.lastDeliveryId !== undefined) {
+    sets.push("lastDeliveryId = ?");
+    values.push(data.lastDeliveryId);
+  }
+  if (data.syncDirection !== undefined) {
+    sets.push("syncDirection = ?");
+    values.push(data.syncDirection);
+  }
+  if (data.externalUrl !== undefined) {
+    sets.push("externalUrl = ?");
+    values.push(data.externalUrl);
+  }
+  if (data.externalIdentifier !== undefined) {
+    sets.push("externalIdentifier = ?");
+    values.push(data.externalIdentifier);
+  }
+  if (sets.length === 0)
+    return;
+  values.push(id);
+  await getDbClient().run(`UPDATE tracker_sync SET ${sets.join(", ")} WHERE id = ?`, values);
+}
+async function deleteTrackerSync(id) {
+  await getDbClient().run("DELETE FROM tracker_sync WHERE id = ?", [id]);
+}
+async function hasTrackerDelivery(provider, deliveryId) {
+  if (!deliveryId)
+    return false;
+  const row = await getDbClient().get("SELECT 1 AS hit FROM tracker_sync WHERE provider = ? AND lastDeliveryId = ? LIMIT 1", [provider, deliveryId]);
+  return !!row;
+}
+async function markTrackerDelivery(provider, entityType, externalId, deliveryId) {
+  await getDbClient().run("UPDATE tracker_sync SET lastDeliveryId = ? WHERE provider = ? AND entityType = ? AND externalId = ?", [deliveryId, provider, entityType, externalId]);
+}
+async function getAllTrackerSyncs(provider, entityType) {
+  const conditions = [];
+  const values = [];
+  if (provider) {
+    conditions.push("provider = ?");
+    values.push(provider);
+  }
+  if (entityType) {
+    conditions.push("entityType = ?");
+    values.push(entityType);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  const rows = await getDbClient().query(`SELECT * FROM tracker_sync ${where} ORDER BY createdAt DESC`, values);
+  return rows.map(normalizeTrackerSync);
+}
+async function createTrackerAgentMapping(data) {
+  const result = await getDbClient().get(`INSERT INTO tracker_agent_mapping (provider, agentId, externalUserId, agentName)
+       VALUES (?, ?, ?, ?)
+       RETURNING *`, [data.provider, data.agentId, data.externalUserId, data.agentName]);
+  return normalizeTrackerAgentMapping(result);
+}
+
+// src/azure-devops/boards-sync.ts
+init_resolver();
+init_context_key();
+init_types();
+
 // src/azure-devops/handlers.ts
 init_db3();
 init_users();
@@ -23210,6 +23432,81 @@ Comment:
   ],
   category: "event"
 });
+registerTemplate({
+  eventType: "common.command_suggestions.azure_devops_work_item",
+  header: "",
+  defaultBody: 'Workers have the `az` CLI with the azure-devops extension, authenticated with the swarm PAT. Inspect the work item with `az boards work-item show --id {{work_item_id}}`. To reply on it, run `az boards work-item update --id {{work_item_id}} --discussion "<reply>"`.',
+  variables: [{ name: "work_item_id", description: "Work item ID" }],
+  category: "common"
+});
+var WORK_ITEM_VARIABLES = [
+  { name: "work_item_id", description: "Work item ID" },
+  { name: "work_item_type", description: "Work item type (Task, Bug, Issue, ...)" },
+  { name: "title", description: "Work item title" },
+  { name: "state", description: "Work item state" },
+  { name: "project", description: "Azure DevOps project name" },
+  { name: "work_item_url", description: "Work item web URL" },
+  {
+    name: "username",
+    description: "Actor identity — resolved canonical name (e.g. 'Luis (azure-devops:luis@example.com)') or the UNKNOWN sentinel"
+  }
+];
+registerTemplate({
+  eventType: "azure-devops.work_item.assigned",
+  header: "[Azure DevOps {{work_item_type}} #{{work_item_id}}] {{title}}",
+  defaultBody: `Project: {{project}}
+State: {{state}}
+Triggered by: {{username}} ({{trigger}})
+URL: {{work_item_url}}
+
+{{description_section}}{{@template[common.command_suggestions.azure_devops_work_item]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...WORK_ITEM_VARIABLES,
+    { name: "trigger", description: "Why the task was created (assigned to the bot, mentioned)" },
+    {
+      name: "description_section",
+      description: "Description section (HTML stripped) or empty string"
+    }
+  ],
+  category: "event"
+});
+registerTemplate({
+  eventType: "azure-devops.work_item.commented",
+  header: "[Azure DevOps {{work_item_type}} #{{work_item_id}}] {{username}} mentioned bot",
+  defaultBody: `Project: {{project}}
+Title: {{title}}
+State: {{state}}
+URL: {{work_item_url}}
+
+Comment:
+{{context}}{{existing_task_note}}
+
+{{@template[common.command_suggestions.azure_devops_work_item]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...WORK_ITEM_VARIABLES,
+    { name: "context", description: "Comment text with the bot mention removed" },
+    { name: "existing_task_note", description: "Note about an active task, or empty string" }
+  ],
+  category: "event"
+});
+registerTemplate({
+  eventType: "azure-devops.work_item.followup",
+  header: "[Azure DevOps {{work_item_type}} #{{work_item_id}}] Follow-up: {{title}}",
+  defaultBody: `Project: {{project}}
+State: {{state}}
+Trigger: {{trigger}} by {{username}}
+URL: {{work_item_url}}
+
+{{user_message}}
+
+{{@template[common.command_suggestions.azure_devops_work_item]}}{{@template[common.delegation_instruction.azure_devops]}}`,
+  variables: [
+    ...WORK_ITEM_VARIABLES,
+    { name: "trigger", description: "What re-engaged the swarm" },
+    { name: "user_message", description: "Comment text, or empty string" }
+  ],
+  category: "event"
+});
 
 // src/azure-devops/handlers.ts
 var processedEvents2 = new Map;
@@ -23305,6 +23602,10 @@ async function resolveAzureDevOpsSender(identity, sampleEventType, sampleContext
     await linkIdentity(linked.id, "azure-devops", externalId, AZURE_DEVOPS_WEBHOOK_ACTOR);
     return linked.id;
   }
+  await recordUnmappedIdentity(externalId, sampleEventType, sampleContext);
+  return;
+}
+async function recordUnmappedIdentity(externalId, sampleEventType, sampleContext) {
   await upsertKv({
     namespace: UNMAPPED_NAMESPACE,
     key: `${externalId}:meta`,
@@ -23317,7 +23618,18 @@ async function resolveAzureDevOpsSender(identity, sampleEventType, sampleContext
     expiresAt: Date.now() + UNMAPPED_TTL_MS
   });
   await incrKv(UNMAPPED_NAMESPACE, `${externalId}:count`, 1);
-  return;
+}
+async function authorizeAzureDevOpsActor(identity, sampleEventType, sampleContext) {
+  const externalId = externalIdOf(identity);
+  const known = await findUserByExternalId("azure-devops", externalId) ?? (externalId.includes("@") ? await findUserByEmail(externalId) : null);
+  if (known)
+    return known.id;
+  const allowed = (process.env.AZURE_DEVOPS_ALLOWED_ACTORS ?? "").split(",").map((name) => name.trim().toLowerCase()).filter(Boolean);
+  if (allowed.includes(externalId.toLowerCase())) {
+    return await resolveAzureDevOpsSender(identity, sampleEventType, sampleContext) ?? null;
+  }
+  await recordUnmappedIdentity(externalId, sampleEventType, sampleContext);
+  return null;
 }
 async function renderAzureDevOpsIdentity(identity) {
   return renderIdentity(await resolveIdentity("azure-devops", externalIdOf(identity)));
@@ -23469,6 +23781,460 @@ _Note: There's an active task (${existingTask.id}) for this PR #${pr.pullRequest
   }
   return { created: true, taskId: task.id };
 }
+
+// src/azure-devops/html.ts
+var ENTITIES = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'",
+  "&nbsp;": " "
+};
+function htmlToText(html) {
+  if (!html)
+    return "";
+  return html.replace(/<br\s*\/?>|<\/(?:div|p|li|h[1-6])>/gi, `
+`).replace(/<[^>]*>/g, "").replace(/&(?:amp|lt|gt|quot|#39|nbsp);/g, (entity) => ENTITIES[entity] ?? entity).replace(/[ \t]+/g, " ").replace(/ ?\n ?/g, `
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
+
+// src/azure-devops/boards-sync.ts
+var PROVIDER = "azure-devops";
+var DELETED_REASON = "Azure DevOps work item deleted";
+var DESCRIPTION_LIMIT = 4000;
+function hasFields(value) {
+  return typeof value === "object" && value !== null;
+}
+function workItemOf(event) {
+  const resource = event?.resource;
+  if (typeof event?.id !== "string" || typeof resource?.id !== "number")
+    return null;
+  return hasFields(resource.fields) ? resource : null;
+}
+function updatedPayloadOf(event) {
+  const resource = event?.resource;
+  if (typeof event?.id !== "string" || typeof resource?.workItemId !== "number")
+    return null;
+  return hasFields(resource.revision?.fields) ? resource : null;
+}
+function parseIdentityString(value) {
+  if (typeof value !== "string" || !value.trim())
+    return null;
+  const match = value.match(/^(.*?)\s*<([^>]+)>\s*$/);
+  const displayName = (match?.[1] || value).trim();
+  const uniqueName = match?.[2]?.trim();
+  return { id: uniqueName ?? displayName, displayName, uniqueName };
+}
+async function resolveBot(orgUrl2) {
+  return await resolveAzureDevOpsBotIdentity(orgUrl2);
+}
+function isBotIdentity(identity, bot) {
+  if (!identity)
+    return false;
+  if (bot.id && identity.id.toLowerCase() === bot.id.toLowerCase())
+    return true;
+  const name = identity.uniqueName?.toLowerCase();
+  return !!name && !!bot.uniqueName && name === bot.uniqueName.toLowerCase();
+}
+function isBotString(value, bot) {
+  return isBotIdentity(parseIdentityString(value), bot);
+}
+function pickerMentionPattern(botId) {
+  return new RegExp(`<a\\b[^>]*data-vss-mention="version:[\\d.]+,${escapeRegExp(botId)}"[^>]*>.*?</a>`, "gi");
+}
+function plainMentionPatterns(bot) {
+  const names = [AZURE_DEVOPS_BOT_NAME];
+  const local = bot.uniqueName?.split("@")[0];
+  if (local)
+    names.push(local);
+  return names.map((name) => new RegExp(`@${escapeRegExp(name)}(?![\\w-])`, "gi"));
+}
+function inspectMention(html, bot) {
+  if (!html)
+    return { mentioned: false, text: "" };
+  let withoutPicker = html;
+  let mentioned = false;
+  if (bot.id) {
+    const re = pickerMentionPattern(bot.id);
+    mentioned = re.test(html);
+    withoutPicker = html.replace(re, "");
+  }
+  let text = htmlToText(withoutPicker);
+  const plain = plainMentionPatterns(bot);
+  if (plain.some((re) => re.test(text)) || detectMention(text, null)) {
+    mentioned = true;
+  }
+  for (const re of plain)
+    text = text.replace(re, "");
+  return { mentioned, text: text.trim() };
+}
+function orgFor(event) {
+  const containers = event.resourceContainers;
+  const fromUrl = event.resource?.url?.split("/_apis/")[0];
+  const candidates = [
+    containers?.account?.baseUrl,
+    containers?.collection?.baseUrl,
+    fromUrl?.includes("://") ? fromUrl : undefined
+  ].map((url2) => normalizeOrgUrl(url2)).filter((url2) => !!url2);
+  const configured = getAzureDevOpsOrgUrl();
+  const url = candidates[0] ?? configured;
+  if (!url || !isTrustedOrgUrl(url))
+    return null;
+  const key = orgKeyOf(url);
+  if (!key || candidates.some((c) => orgKeyOf(c) !== key))
+    return null;
+  return { url, key };
+}
+function dropUntrustedOrg(eventType) {
+  console.warn(`[AzureDevOps] Dropping ${eventType} event from an untrusted organization`);
+  return { created: false };
+}
+function trackerKey(org, workItemId) {
+  return `${org.key}#${workItemId}`;
+}
+function organizationOf(orgUrl2) {
+  if (!orgUrl2)
+    return "unknown";
+  try {
+    const url = new URL(orgUrl2);
+    const segment = url.pathname.split("/").find(Boolean);
+    return (segment ?? url.hostname.split(".")[0] ?? "unknown").replace(/:/g, "_");
+  } catch {
+    return "unknown";
+  }
+}
+function workItemUrl(ctx) {
+  const project = ctx.fields["System.TeamProject"];
+  const base = ctx.org.url;
+  return project ? `${base}/${encodeURIComponent(project)}/_workitems/edit/${ctx.workItemId}` : `${base}/_workitems/edit/${ctx.workItemId}`;
+}
+var RECEIPT_NAMESPACE = "integration:azure-devops:deliveries";
+var RECEIPT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+var inFlight = new Map;
+function withReceipt(key, fn) {
+  const pending = inFlight.get(key);
+  if (pending)
+    return pending.then(() => ({ created: false }));
+  const attempt = (async () => {
+    if (await getKv(RECEIPT_NAMESPACE, key) || await hasTrackerDelivery(PROVIDER, key)) {
+      return { created: false };
+    }
+    const result = await fn();
+    await upsertKv({
+      namespace: RECEIPT_NAMESPACE,
+      key,
+      value: { handledAt: new Date().toISOString() },
+      valueType: "json",
+      expiresAt: Date.now() + RECEIPT_TTL_MS
+    });
+    return result;
+  })().finally(() => {
+    inFlight.delete(key);
+  });
+  inFlight.set(key, attempt);
+  return attempt;
+}
+var workItemLocks = new Map;
+async function withWorkItemLock(key, fn) {
+  const run = (workItemLocks.get(key) ?? Promise.resolve()).then(fn);
+  const tail = run.catch(() => {});
+  workItemLocks.set(key, tail);
+  try {
+    return await run;
+  } finally {
+    if (workItemLocks.get(key) === tail)
+      workItemLocks.delete(key);
+  }
+}
+async function handleDelivery(org, eventId, workItemId, fn, extraReceiptKey) {
+  const locked = () => withWorkItemLock(trackerKey(org, workItemId), fn);
+  return await withReceipt(eventId, () => extraReceiptKey ? withReceipt(extraReceiptKey, locked) : locked());
+}
+var TRIGGER_LABEL = {
+  assigned: "work item assigned to the bot",
+  mentioned_description: "bot mentioned in the description",
+  mentioned_comment: "bot mentioned in a comment",
+  restored: "work item restored"
+};
+async function createWorkItemTask(ctx, trigger, opts) {
+  const { fields } = ctx;
+  const description = htmlToText(fields["System.Description"]).slice(0, DESCRIPTION_LIMIT);
+  const common = {
+    work_item_id: ctx.workItemId,
+    work_item_type: fields["System.WorkItemType"] ?? "Work item",
+    title: fields["System.Title"] ?? "(no title)",
+    state: fields["System.State"] ?? "unknown",
+    project: fields["System.TeamProject"] ?? "unknown",
+    work_item_url: workItemUrl(ctx),
+    username: ctx.actor ? await renderAzureDevOpsIdentity(ctx.actor) : "UNKNOWN"
+  };
+  const templateName = opts.followup ? "azure-devops.work_item.followup" : trigger === "mentioned_comment" ? "azure-devops.work_item.commented" : "azure-devops.work_item.assigned";
+  const variables = templateName === "azure-devops.work_item.followup" ? { ...common, trigger: TRIGGER_LABEL[trigger], user_message: opts.commentText ?? "" } : templateName === "azure-devops.work_item.commented" ? {
+    ...common,
+    context: opts.commentText ?? "",
+    existing_task_note: opts.existingTaskId ? `
+
+_Note: There's an active task (${opts.existingTaskId}) for this work item._` : ""
+  } : {
+    ...common,
+    trigger: TRIGGER_LABEL[trigger],
+    description_section: description ? `Description:
+${description}
+
+` : ""
+  };
+  const result = resolveTemplate(templateName, variables);
+  if (result.skipped)
+    return null;
+  const lead = await findLeadAgent2();
+  const task = await createTaskWithSiblingAwareness(result.text, {
+    agentId: lead?.id ?? null,
+    routingReason: lead ? "skill" : undefined,
+    routingSource: lead ? "engine_default" : undefined,
+    source: "azure-devops",
+    taskType: "azure-devops-work-item",
+    requestedByUserId: opts.requestedByUserId,
+    parentTaskId: opts.parentTaskId,
+    contextKey: azureDevOpsWorkItemContextKey({
+      organization: organizationOf(ctx.org.url),
+      workItemId: ctx.workItemId
+    })
+  }, { origin: "webhook" });
+  return task.id;
+}
+async function authorizeActor(ctx, trigger) {
+  const userId = ctx.actor ? await authorizeAzureDevOpsActor(ctx.actor, "work_item", `${trigger} #${ctx.workItemId}`) : null;
+  if (!userId) {
+    console.warn(`[AzureDevOps] Ignoring ${TRIGGER_LABEL[trigger]} on work item #${ctx.workItemId}: actor is not a known swarm user`);
+  }
+  return userId;
+}
+async function routeToTask(ctx, trigger, commentText) {
+  const requestedByUserId = await authorizeActor(ctx, trigger);
+  if (!requestedByUserId)
+    return { created: false };
+  const externalId = trackerKey(ctx.org, ctx.workItemId);
+  const claim = await createTrackerSyncIfAbsent({
+    provider: PROVIDER,
+    entityType: "task",
+    providerEntityType: "WorkItem",
+    swarmId: `pending:${PROVIDER}:${externalId}`,
+    externalId,
+    externalIdentifier: `${ctx.fields["System.TeamProject"] ?? "unknown"}#${ctx.workItemId}`,
+    externalUrl: workItemUrl(ctx),
+    lastSyncOrigin: "external",
+    syncDirection: "inbound"
+  });
+  const mentioned = trigger === "mentioned_comment" || trigger === "mentioned_description";
+  if (claim.inserted) {
+    let taskId2 = null;
+    try {
+      taskId2 = await createWorkItemTask(ctx, trigger, {
+        followup: false,
+        requestedByUserId,
+        commentText
+      });
+      if (taskId2) {
+        await updateTrackerSyncSwarmId(claim.sync.id, taskId2);
+        await markTrackerDelivery(PROVIDER, "task", externalId, ctx.eventId);
+      }
+    } finally {
+      if (!taskId2)
+        await deleteTrackerSync(claim.sync.id);
+    }
+    return taskId2 ? { created: true, taskId: taskId2 } : { created: false };
+  }
+  const prior = claim.sync.swarmId && !claim.sync.swarmId.startsWith("pending:") ? await getTaskById(claim.sync.swarmId) : null;
+  if (prior && !isTerminalTaskStatus(prior.status)) {
+    if (!mentioned) {
+      console.log(`[AzureDevOps] Work item #${ctx.workItemId} re-triggered but task ${prior.id} is ${prior.status}, ignoring`);
+      return { created: false };
+    }
+    const taskId2 = await createWorkItemTask(ctx, trigger, {
+      followup: false,
+      requestedByUserId,
+      commentText,
+      parentTaskId: prior.id,
+      existingTaskId: prior.id
+    });
+    if (taskId2)
+      await markTrackerDelivery(PROVIDER, "task", externalId, ctx.eventId);
+    return taskId2 ? { created: true, taskId: taskId2 } : { created: false };
+  }
+  const taskId = await createWorkItemTask(ctx, trigger, {
+    followup: true,
+    requestedByUserId,
+    commentText
+  });
+  if (!taskId)
+    return { created: false };
+  await updateTrackerSyncSwarmId(claim.sync.id, taskId);
+  await markTrackerDelivery(PROVIDER, "task", externalId, ctx.eventId);
+  return { created: true, taskId };
+}
+async function triggerFromFields(fields, bot) {
+  if (isBotString(fields["System.AssignedTo"], bot))
+    return "assigned";
+  return inspectMention(fields["System.Description"], bot).mentioned ? "mentioned_description" : null;
+}
+async function handleWorkItemCreated(event) {
+  const item = workItemOf(event);
+  if (!item) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const org = orgFor(event);
+  if (!org)
+    return dropUntrustedOrg(event.eventType);
+  return await handleDelivery(org, event.id, item.id, async () => {
+    const bot = await resolveBot(org.url);
+    const actor = parseIdentityString(item.fields["System.ChangedBy"]);
+    if (isBotIdentity(actor, bot))
+      return { created: false };
+    const trigger = await triggerFromFields(item.fields, bot);
+    if (!trigger)
+      return { created: false };
+    return await routeToTask({
+      eventId: event.id,
+      eventType: event.eventType,
+      workItemId: item.id,
+      fields: item.fields,
+      org,
+      actor
+    }, trigger);
+  });
+}
+async function handleWorkItemUpdated(event) {
+  const update = updatedPayloadOf(event);
+  if (!update) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const change = update.fields?.["System.AssignedTo"];
+  if (!change)
+    return { created: false };
+  const org = orgFor(event);
+  if (!org)
+    return dropUntrustedOrg(event.eventType);
+  return await handleDelivery(org, event.id, update.workItemId, async () => {
+    const bot = await resolveBot(org.url);
+    if (!isBotString(change.newValue, bot) || isBotString(change.oldValue, bot)) {
+      return { created: false };
+    }
+    if (isBotIdentity(update.revisedBy ?? null, bot))
+      return { created: false };
+    return await routeToTask({
+      eventId: event.id,
+      eventType: event.eventType,
+      workItemId: update.workItemId,
+      fields: update.revision.fields,
+      org,
+      actor: update.revisedBy ?? null
+    }, "assigned");
+  });
+}
+async function handleWorkItemCommented(event) {
+  const item = workItemOf(event);
+  if (!item) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const ref = item.commentVersionRef;
+  if (ref && ref.version > 1)
+    return { created: false };
+  const org = orgFor(event);
+  if (!org)
+    return dropUntrustedOrg(event.eventType);
+  const commentKey = ref ? `comment:${trackerKey(org, item.id)}:${ref.commentId}` : undefined;
+  return await handleDelivery(org, event.id, item.id, async () => {
+    const bot = await resolveBot(org.url);
+    const actor = parseIdentityString(item.fields["System.ChangedBy"]);
+    if (isBotIdentity(actor, bot))
+      return { created: false };
+    const { mentioned, text } = inspectMention(item.fields["System.History"], bot);
+    if (!mentioned)
+      return { created: false };
+    return await routeToTask({
+      eventId: event.id,
+      eventType: event.eventType,
+      workItemId: item.id,
+      fields: item.fields,
+      org,
+      actor
+    }, "mentioned_comment", text);
+  }, commentKey);
+}
+async function handleWorkItemDeleted(event) {
+  const item = workItemOf(event);
+  if (!item) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const org = orgFor(event);
+  if (!org)
+    return dropUntrustedOrg(event.eventType);
+  return await handleDelivery(org, event.id, item.id, async () => {
+    const externalId = trackerKey(org, item.id);
+    const sync = await getTrackerSyncByExternalId(PROVIDER, "task", externalId);
+    if (!sync)
+      return { created: false };
+    const task = sync.swarmId && !sync.swarmId.startsWith("pending:") ? await getTaskById(sync.swarmId) : null;
+    if (task && !isTerminalTaskStatus(task.status)) {
+      await cancelTask(task.id, DELETED_REASON);
+      console.log(`[AzureDevOps] Cancelled task ${task.id} (work item #${item.id} deleted)`);
+    }
+    await markTrackerDelivery(PROVIDER, "task", externalId, event.id);
+    return { created: false };
+  });
+}
+async function handleWorkItemRestored(event) {
+  const item = workItemOf(event);
+  if (!item) {
+    warnMalformed(event);
+    return { created: false };
+  }
+  const org = orgFor(event);
+  if (!org)
+    return dropUntrustedOrg(event.eventType);
+  return await handleDelivery(org, event.id, item.id, async () => {
+    const bot = await resolveBot(org.url);
+    const actor = parseIdentityString(item.fields["System.ChangedBy"]);
+    const ctx = {
+      eventId: event.id,
+      eventType: event.eventType,
+      workItemId: item.id,
+      fields: item.fields,
+      org,
+      actor
+    };
+    const externalId = trackerKey(org, item.id);
+    const sync = await getTrackerSyncByExternalId(PROVIDER, "task", externalId);
+    if (!sync) {
+      if (isBotIdentity(actor, bot))
+        return { created: false };
+      const trigger = await triggerFromFields(item.fields, bot);
+      return trigger ? await routeToTask(ctx, trigger) : { created: false };
+    }
+    const task = sync.swarmId && !sync.swarmId.startsWith("pending:") ? await getTaskById(sync.swarmId) : null;
+    const cancelledByDelete = task?.status === "cancelled" && task.failureReason === DELETED_REASON;
+    if (!cancelledByDelete || !isBotString(item.fields["System.AssignedTo"], bot)) {
+      await markTrackerDelivery(PROVIDER, "task", externalId, event.id);
+      return { created: false };
+    }
+    const requestedByUserId = await authorizeActor(ctx, "restored");
+    if (!requestedByUserId)
+      return { created: false };
+    const taskId = await createWorkItemTask(ctx, "restored", { followup: true, requestedByUserId });
+    if (!taskId)
+      return { created: false };
+    await updateTrackerSyncSwarmId(sync.id, taskId);
+    await markTrackerDelivery(PROVIDER, "task", externalId, event.id);
+    return { created: true, taskId };
+  });
+}
 // src/http/core.ts
 init_db3();
 
@@ -25858,6 +26624,7 @@ async function handlePipeline(event) {
   return { created: true, taskId: task.id };
 }
 // src/jira/adf.ts
+init_node_env();
 function isNode(value) {
   return !!value && typeof value === "object";
 }
@@ -25924,7 +26691,7 @@ function extractText(adf) {
         return;
       }
       default: {
-        if (type) {
+        if (getNodeEnv() !== "production" && type) {
           console.log(`[jira.adf] unknown node type: ${type}`);
         }
         for (const child of asNodeArray(node.content))
@@ -25958,148 +26725,6 @@ init_oauth();
 init_constants();
 init_env_flag();
 
-// src/be/db-queries/tracker.ts
-init_date_utils();
-init_db3();
-function normalizeTrackerSync(row) {
-  return {
-    ...row,
-    lastSyncedAt: normalizeDateRequired(row.lastSyncedAt),
-    createdAt: normalizeDateRequired(row.createdAt)
-  };
-}
-function normalizeTrackerAgentMapping(row) {
-  return {
-    ...row,
-    createdAt: normalizeDateRequired(row.createdAt)
-  };
-}
-async function getTrackerSync(provider, entityType, swarmId) {
-  const row = await getDbClient().get("SELECT * FROM tracker_sync WHERE provider = ? AND entityType = ? AND swarmId = ?", [provider, entityType, swarmId]);
-  return row ? normalizeTrackerSync(row) : null;
-}
-async function getTrackerSyncByExternalId(provider, entityType, externalId) {
-  const row = await getDbClient().get("SELECT * FROM tracker_sync WHERE provider = ? AND entityType = ? AND externalId = ?", [provider, entityType, externalId]);
-  return row ? normalizeTrackerSync(row) : null;
-}
-async function createTrackerSyncIfAbsent(data) {
-  const insertResult = await getDbClient().get(`INSERT INTO tracker_sync (provider, entityType, providerEntityType, swarmId, externalId, externalIdentifier, externalUrl, lastSyncOrigin, lastDeliveryId, syncDirection)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT (provider, entityType, externalId) DO NOTHING
-       RETURNING *`, [
-    data.provider,
-    data.entityType,
-    data.providerEntityType ?? null,
-    data.swarmId,
-    data.externalId,
-    data.externalIdentifier ?? null,
-    data.externalUrl ?? null,
-    data.lastSyncOrigin ?? null,
-    data.lastDeliveryId ?? null,
-    data.syncDirection ?? "inbound"
-  ]);
-  if (insertResult) {
-    return { inserted: true, sync: normalizeTrackerSync(insertResult) };
-  }
-  const existing = await getTrackerSyncByExternalId(data.provider, data.entityType, data.externalId);
-  if (!existing) {
-    throw new Error(`[tracker] createTrackerSyncIfAbsent: ON CONFLICT fired but no existing row found for (${data.provider}, ${data.entityType}, ${data.externalId})`);
-  }
-  return { inserted: false, sync: existing };
-}
-async function updateTrackerSyncSwarmId(id, swarmId) {
-  await getDbClient().run("UPDATE tracker_sync SET swarmId = ? WHERE id = ?", [swarmId, id]);
-}
-async function repointTrackerSyncBySwarmId(oldSwarmId, newSwarmId) {
-  const result = await getDbClient().run("UPDATE tracker_sync SET swarmId = ? WHERE swarmId = ?", [
-    newSwarmId,
-    oldSwarmId
-  ]);
-  return Number(result.changes ?? 0);
-}
-async function createTrackerSync(data) {
-  const result = await getDbClient().get(`INSERT INTO tracker_sync (provider, entityType, providerEntityType, swarmId, externalId, externalIdentifier, externalUrl, lastSyncOrigin, lastDeliveryId, syncDirection)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`, [
-    data.provider,
-    data.entityType,
-    data.providerEntityType ?? null,
-    data.swarmId,
-    data.externalId,
-    data.externalIdentifier ?? null,
-    data.externalUrl ?? null,
-    data.lastSyncOrigin ?? null,
-    data.lastDeliveryId ?? null,
-    data.syncDirection ?? "inbound"
-  ]);
-  return normalizeTrackerSync(result);
-}
-async function updateTrackerSync(id, data) {
-  const sets = [];
-  const values = [];
-  if (data.lastSyncedAt !== undefined) {
-    sets.push("lastSyncedAt = ?");
-    values.push(data.lastSyncedAt);
-  }
-  if (data.lastSyncOrigin !== undefined) {
-    sets.push("lastSyncOrigin = ?");
-    values.push(data.lastSyncOrigin);
-  }
-  if (data.lastDeliveryId !== undefined) {
-    sets.push("lastDeliveryId = ?");
-    values.push(data.lastDeliveryId);
-  }
-  if (data.syncDirection !== undefined) {
-    sets.push("syncDirection = ?");
-    values.push(data.syncDirection);
-  }
-  if (data.externalUrl !== undefined) {
-    sets.push("externalUrl = ?");
-    values.push(data.externalUrl);
-  }
-  if (data.externalIdentifier !== undefined) {
-    sets.push("externalIdentifier = ?");
-    values.push(data.externalIdentifier);
-  }
-  if (sets.length === 0)
-    return;
-  values.push(id);
-  await getDbClient().run(`UPDATE tracker_sync SET ${sets.join(", ")} WHERE id = ?`, values);
-}
-async function deleteTrackerSync(id) {
-  await getDbClient().run("DELETE FROM tracker_sync WHERE id = ?", [id]);
-}
-async function hasTrackerDelivery(provider, deliveryId) {
-  if (!deliveryId)
-    return false;
-  const row = await getDbClient().get("SELECT 1 AS hit FROM tracker_sync WHERE provider = ? AND lastDeliveryId = ? LIMIT 1", [provider, deliveryId]);
-  return !!row;
-}
-async function markTrackerDelivery(provider, entityType, externalId, deliveryId) {
-  await getDbClient().run("UPDATE tracker_sync SET lastDeliveryId = ? WHERE provider = ? AND entityType = ? AND externalId = ?", [deliveryId, provider, entityType, externalId]);
-}
-async function getAllTrackerSyncs(provider, entityType) {
-  const conditions = [];
-  const values = [];
-  if (provider) {
-    conditions.push("provider = ?");
-    values.push(provider);
-  }
-  if (entityType) {
-    conditions.push("entityType = ?");
-    values.push(entityType);
-  }
-  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const rows = await getDbClient().query(`SELECT * FROM tracker_sync ${where} ORDER BY createdAt DESC`, values);
-  return rows.map(normalizeTrackerSync);
-}
-async function createTrackerAgentMapping(data) {
-  const result = await getDbClient().get(`INSERT INTO tracker_agent_mapping (provider, agentId, externalUserId, agentName)
-       VALUES (?, ?, ?, ?)
-       RETURNING *`, [data.provider, data.agentId, data.externalUserId, data.agentName]);
-  return normalizeTrackerAgentMapping(result);
-}
-
 // src/jira/outbound.ts
 init_secret_scrubber();
 init_event_bus();
@@ -26411,7 +27036,7 @@ var TTL_MS = 30 * 24 * 60 * 60 * 1000;
 function namespace(kind) {
   return `integration:unmapped:${kind}`;
 }
-async function recordUnmappedIdentity(kind, externalId, meta2) {
+async function recordUnmappedIdentity2(kind, externalId, meta2) {
   const ns = namespace(kind);
   const now = new Date().toISOString();
   const expiresAt = Date.now() + TTL_MS;
@@ -26462,7 +27087,7 @@ async function resolveJiraActor(accountId, email, name, sampleEventType, sampleC
     }
     return user.id;
   }
-  await recordUnmappedIdentity("jira", accountId, { sampleEventType, sampleContext });
+  await recordUnmappedIdentity2("jira", accountId, { sampleEventType, sampleContext });
   return;
 }
 async function renderJiraIdentity(accountId) {
@@ -26826,7 +27451,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-wmf0m843.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-km9qnv2f.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -26897,7 +27522,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-4w7tmt1g.js");
+  const { getDbClient: getDbClient2 } = await import("./db-qfpq4bt7.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -100117,6 +100742,7 @@ init_zod_openapi();
 
 // src/http/route-def.ts
 init_zod();
+init_node_env();
 init_secret_scrubber();
 
 // src/http/utils.ts
@@ -100514,7 +101140,7 @@ function describeRequestRoute(method, pathSegments, hasQueryString = false, hasT
   const first = pathSegments[0];
   return { spanName: first ? `${m} /${first}` : m };
 }
-var VALIDATE_RESPONSES = true;
+var VALIDATE_RESPONSES = getNodeEnv() === "test" || getNodeEnv() === "development" || process.env.VALIDATE_HTTP_RESPONSES === "true";
 function route(def) {
   routeRegistry.push(def);
   return {
@@ -100526,7 +101152,9 @@ function route(def) {
           const result = schema.safeParse(data);
           if (!result.success) {
             const detail = `Response schema violation: ${def.method.toUpperCase()} ${def.path} ${code} — ` + result.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
-            if (false) {}
+            if (getNodeEnv() === "test") {
+              throw new Error(detail);
+            }
             console.error(`[route-def] ${scrubSecrets(detail)}`);
           }
         }
@@ -100727,7 +101355,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-ffqzqgwb.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-jd7sejm2.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -100743,10 +101371,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-1de4f4aj.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-swwzdgd7.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-4ymn9atn.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-16rv9843.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -101926,7 +102554,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-5sd69y14.js");
+  const dispatcher = await import("./dispatcher-x0x7qfcq.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -102968,7 +103596,7 @@ function reconcile(args) {
     });
   });
 }
-var inFlight = new Map;
+var inFlight2 = new Map;
 function passBase(args) {
   return {
     model: args.model,
@@ -103047,7 +103675,7 @@ async function executePass(args) {
 }
 async function runPass(args) {
   const key = `${args.appId}:${args.model}:${args.sourceName}`;
-  if (inFlight.has(key)) {
+  if (inFlight2.has(key)) {
     return scrubObject({
       ...passBase({
         model: args.model,
@@ -103061,12 +103689,12 @@ async function runPass(args) {
     });
   }
   const pass = executePass(args);
-  inFlight.set(key, pass);
+  inFlight2.set(key, pass);
   try {
     return await pass;
   } finally {
-    if (inFlight.get(key) === pass)
-      inFlight.delete(key);
+    if (inFlight2.get(key) === pass)
+      inFlight2.delete(key);
   }
 }
 function noPairIssue(input) {
@@ -109349,6 +109977,17 @@ var registerDeferTaskTool = (server) => {
     const { tz: requesterTz, isFallback: isFallbackTz } = await resolveRequesterTimezone(task.requestedByUserId);
     try {
       const committed = await getDbClient().transaction(async () => {
+        if (watchedTaskIds.length) {
+          const existing = await getDbClient().get(`SELECT w.scheduleId, s.parentTaskId FROM deferred_task_waits w
+               JOIN scheduled_tasks s ON s.id = w.scheduleId
+               JOIN deferred_task_wait_members m ON m.scheduleId = w.scheduleId
+               WHERE w.status = 'pending' AND s.enabled = 1 AND s.targetAgentId = ?
+                 AND m.taskId IN (${watchedTaskIds.map(() => "?").join(", ")})
+               LIMIT 1`, [agent.id, ...watchedTaskIds]);
+          if (existing) {
+            throw new DeferAbortedError(`Pending watcher ${existing.scheduleId} (task ${existing.parentTaskId}) already watches these tasks for this agent.`);
+          }
+        }
         const watchedAgentNames = [];
         for (const watchedId of watchedTaskIds) {
           if (watchedId === taskId)
@@ -110501,7 +111140,8 @@ init_db3();
 var RESERVED_FAMILIES = new Map([
   ["apps", "namespace is reserved for swarm apps; use the app row endpoints"],
   ["comb", "namespace is reserved for Comb; use POST /api/comb/review-batches"],
-  ["worker", "namespace is reserved for worker nudges"]
+  ["worker", "namespace is reserved for worker nudges"],
+  ["slack-external-alert", "namespace is reserved for Slack external channel alerts"]
 ]);
 function reservedNamespaceError(namespace2) {
   return RESERVED_FAMILIES.get(namespace2.split(":", 1)[0] ?? "") ?? null;
@@ -124910,57 +125550,6 @@ init_zod();
 init_db3();
 init_rbac();
 
-// src/slack/channel-join.ts
-var logger = console;
-function slackErrorData(error) {
-  if (!(error instanceof Error))
-    return;
-  return error.data;
-}
-function slackCode(error) {
-  const d = slackErrorData(error);
-  return typeof d?.error === "string" ? d.error : undefined;
-}
-function slackMissingScopeMessage(error) {
-  const data = slackErrorData(error);
-  if (data?.error !== "missing_scope" || typeof data.needed !== "string")
-    return;
-  const needed = data.needed.trim();
-  if (!needed)
-    return;
-  return `Slack requires the \`${needed}\` scope. Add it to slack-manifest.json, apply the updated manifest to the Slack app, then reinstall the app to the workspace for the change to take effect.`;
-}
-async function isKnownExternalChannel(client, channelId) {
-  try {
-    const resp = await client.conversations.info({ channel: channelId });
-    const ch = resp.channel ?? {};
-    return ch.is_ext_shared === true || ch.is_pending_ext_shared === true;
-  } catch (error) {
-    logger.warn(`[Slack] conversations.info failed for ${channelId}; attempting join fallback:`, error);
-    return false;
-  }
-}
-async function withAutoJoin(client, channelId, fn) {
-  try {
-    return await fn();
-  } catch (error) {
-    if (slackCode(error) !== "not_in_channel")
-      throw error;
-    if (await isKnownExternalChannel(client, channelId)) {
-      throw new Error(`Cannot auto-join external channel ${channelId} — invite the bot with /invite @<bot-name> first.`);
-    }
-    try {
-      await client.conversations.join({ channel: channelId });
-    } catch (joinError) {
-      if (slackCode(joinError) === "method_not_supported_for_channel_type") {
-        throw new Error(`Cannot access private channel ${channelId} — invite the bot with /invite @<bot-name> first.`);
-      }
-      throw joinError;
-    }
-    return await fn();
-  }
-}
-
 // src/slack/channel-lifecycle.ts
 function normalizeChannelName(name) {
   const normalized = name.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 80).replace(/[-_]+$/g, "");
@@ -126024,6 +126613,10 @@ var registerSlackPostTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    const blockReason = await getChannelBlockReason(app.client, channelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(channelId, blockReason));
+    }
     try {
       const slackMessage = markdownToSlack(message);
       const sourceTask = requestInfo.sourceTaskId ? await getTaskById(requestInfo.sourceTaskId) : undefined;
@@ -126190,6 +126783,12 @@ var registerSlackReadTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.", { data: { messages: [] } });
     }
+    const blockReason = await getChannelBlockReason(app.client, slackChannelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(slackChannelId, blockReason), {
+        data: { messages: [] }
+      });
+    }
     try {
       const client = app.client;
       let rawMessages = [];
@@ -126382,6 +126981,10 @@ var registerSlackReplyTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    const blockReason = await getChannelBlockReason(app.client, slackChannelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(slackChannelId, blockReason));
+    }
     try {
       const citations = taskId ? await getTaskCitations(taskId) : [];
       const slackMessage = renderTaskCitations(markdownToSlack(message), citations, "slack", false);
@@ -126499,6 +127102,10 @@ var registerSlackStartThreadTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    const blockReason = await getChannelBlockReason(app.client, channelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(channelId, blockReason));
+    }
     try {
       const slackMessage = markdownToSlack(message);
       const messageBlocks = blocks ?? [
@@ -126586,6 +127193,10 @@ var registerSlackUpdateTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    const blockReason = await getChannelBlockReason(app.client, channelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(channelId, blockReason));
+    }
     try {
       const ts = parseSlackTs(messageTs);
       const slackMessage = markdownToSlack(message);
@@ -126758,6 +127369,10 @@ var registerSlackUploadFileTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    const blockReason = await getChannelBlockReason(app.client, slackChannelId);
+    if (blockReason) {
+      return toolErr(externalChannelToolError(slackChannelId, blockReason));
+    }
     if (!filePath && !content) {
       return toolErr("Must provide either filePath or content (base64).");
     }
@@ -132592,7 +133207,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-wmf0m843.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-km9qnv2f.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -133401,4 +134016,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, repointTrackerSyncBySwarmId, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity2 as recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, parseSkillContent, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };