@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/dist/{cli-tgpfnm6r.js → cli-ef1hg1wv.js}

@@ -1,7 +1,7 @@
 import {
   ALL_TOOLS,
   init_tool_config
-} from "./cli-ywm1azg9.js";
+} from "./cli-hnmhtzvh.js";
 import {
   AgentAvatarSchema,
   CreateTaskOptionsSchema,
@@ -22,7 +22,7 @@ import {
   normalizeAssetKey,
   parseAssetKey,
   parseModelTier
-} from "./cli-hsem16hb.js";
+} from "./cli-cgtksawx.js";
 import {
   IdentityFieldBudgetError,
   checkIdentityFieldBudget,
@@ -36,22 +36,22 @@ import {
   init_profile_sync,
   matchesDefaultClaudeMd,
   matchesDefaultIdentityMd
-} from "./cli-nyhb1r6x.js";
-import {
-  init_steering_enabled,
-  isSteeringEnabled
-} from "./cli-7mm2r1kp.js";
+} from "./cli-s2sp957d.js";
 import {
   init_config,
   isSlackConfigured
 } from "./cli-dmtrxqhg.js";
 import {
-  init_templates
-} from "./cli-mvzyxwg3.js";
+  init_steering_enabled,
+  isSteeringEnabled
+} from "./cli-7mm2r1kp.js";
 import {
   deriveProviderFromKeyType,
   init_credentials
-} from "./cli-tadfgd0t.js";
+} from "./cli-5hkm7whv.js";
+import {
+  init_templates
+} from "./cli-mvzyxwg3.js";
 import {
   configureDbResolver,
   getAllTemplateDefinitions,
@@ -75,13 +75,9 @@ import {
   init_openrouter_base_url
 } from "./cli-a35hzdve.js";
 import {
-  harnessModelMismatch,
   init_runtime_model_catalog,
-  init_src,
-  isAlias,
-  parseAlias,
   runtimeHarnessSections
-} from "./cli-014vns2y.js";
+} from "./cli-stfs0k5s.js";
 import {
   init_zod
 } from "./cli-sd0mxa3c.js";
@@ -94,10 +90,14 @@ import {
   string,
   union
 } from "./cli-w5e1d1vv.js";
+import {
+  getNodeEnv,
+  init_node_env
+} from "./cli-p0sg24zp.js";
 import {
   init_package,
   package_default
-} from "./cli-esnpehf5.js";
+} from "./cli-k382tshb.js";
 import {
   init_bus,
   realtimeBus
@@ -112,7 +112,13 @@ import {
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
+import {
+  harnessModelMismatch,
+  init_src,
+  isAlias,
+  parseAlias
+} from "./cli-e3g5mbkz.js";
 import {
   __commonJS,
   __esm,
@@ -8290,6 +8296,26 @@ function slackContextKey(input) {
   const threadTs = assertSafePart(input.threadTs, "threadTs");
   return ["task", "slack", channelId, threadTs].join(SEPARATOR);
 }
+function chatSdkContextKey(threadId) {
+  const raw = typeof threadId === "string" ? threadId : "";
+  const separatorIndex = raw.indexOf(SEPARATOR);
+  if (separatorIndex <= 0 || separatorIndex === raw.length - 1) {
+    throw new Error(`context-key: chat-sdk thread id must be "<adapter>:<id>" (got ${JSON.stringify(threadId)})`);
+  }
+  const adapter = assertSafePart(raw.slice(0, separatorIndex), "adapter");
+  const rest = encodeURIComponent(raw.slice(separatorIndex + 1));
+  return ["task", "chat-sdk", adapter, rest].join(SEPARATOR);
+}
+function chatThreadOfContextKey(key) {
+  if (!key)
+    return null;
+  try {
+    const parsed = parseContextKey(key);
+    return parsed.family === "chat-sdk" ? parsed.parts : null;
+  } catch {
+    return null;
+  }
+}
 function agentmailContextKey(input) {
   const threadId = assertSafePart(input.threadId, "threadId");
   return ["task", "agentmail", threadId].join(SEPARATOR);
@@ -8327,6 +8353,14 @@ function azureDevOpsContextKey(input) {
   }
   return ["task", "trackers", "azure-devops", repositoryId, "pr", pullRequestId].join(SEPARATOR);
 }
+function azureDevOpsWorkItemContextKey(input) {
+  const organization = assertSafePart(input.organization, "organization");
+  const workItemId = assertSafePart(input.workItemId, "workItemId");
+  if (!/^\d+$/.test(workItemId)) {
+    throw new Error(`context-key: azure-devops "workItemId" must be a positive integer (got ${JSON.stringify(workItemId)})`);
+  }
+  return ["task", "trackers", "azure-devops", organization, "workitem", workItemId].join(SEPARATOR);
+}
 function linearContextKey(input) {
   const issueIdentifier = assertSafePart(input.issueIdentifier, "issueIdentifier");
   return ["task", "trackers", "linear", issueIdentifier].join(SEPARATOR);
@@ -8376,6 +8410,19 @@ function parseContextKey(key) {
       }
       return { family: "agentmail", parts: { threadId: parts[2] } };
     }
+    case "chat-sdk": {
+      if (parts.length !== 4 || !parts[2] || !parts[3]) {
+        throw new Error(`context-key: malformed chat-sdk key: ${JSON.stringify(key)}`);
+      }
+      const adapter = parts[2];
+      let rest;
+      try {
+        rest = decodeURIComponent(parts[3]);
+      } catch {
+        throw new Error(`context-key: malformed chat-sdk key: ${JSON.stringify(key)}`);
+      }
+      return { family: "chat-sdk", parts: { adapter, threadId: `${adapter}:${rest}` } };
+    }
     case "schedule": {
       if (parts.length !== 3) {
         throw new Error(`context-key: malformed schedule key: ${JSON.stringify(key)}`);
@@ -8432,10 +8479,21 @@ function parseContextKey(key) {
         };
       }
       if (subFamily === "azure-devops") {
-        if (parts.length !== 6 || parts[4] !== "pr") {
+        if (parts.length !== 6 || parts[4] !== "pr" && parts[4] !== "workitem") {
           throw new Error(`context-key: malformed azure-devops key: ${JSON.stringify(key)}`);
         }
         const idStr = parts[5];
+        if (parts[4] === "workitem") {
+          const workItemId = Number.parseInt(idStr, 10);
+          if (!/^\d+$/.test(idStr) || !Number.isFinite(workItemId)) {
+            throw new Error(`context-key: malformed azure-devops workItemId "${idStr}": ${JSON.stringify(key)}`);
+          }
+          return {
+            family: "trackers",
+            subFamily: "azure-devops",
+            parts: { organization: parts[3], kind: "workitem", workItemId }
+          };
+        }
         const pullRequestId = Number.parseInt(idStr, 10);
         if (!Number.isFinite(pullRequestId)) {
           throw new Error(`context-key: malformed azure-devops pullRequestId "${idStr}": ${JSON.stringify(key)}`);
@@ -10463,8 +10521,8 @@ function getTelemetryEnvironment() {
   const explicit = process.env.DESPLEGA_TELEMETRY_ENV?.trim();
   if (explicit)
     return explicit;
-  if (false)
-    ;
+  if (getNodeEnv() === "test")
+    return "test";
   return "production";
 }
 function track(options) {
@@ -10557,6 +10615,7 @@ var init_telemetry = __esm(() => {
   init_config();
   init_telemetry_context();
   init_env_flag();
+  init_node_env();
   init_org_website();
   init_request_auth_context();
   CLOUD_HOST_EXACT = new Set([
@@ -12198,7 +12257,20 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
   }
   db = new Database(dbPath, { create: true });
   console.log(`Database initialized at ${dbPath}`);
-  const database = db;
+  const opened = db;
+  try {
+    return bootOpenedDb(opened, dbPath, resolvePromptTemplate, autoEncryptLegacyPlaintextSecrets);
+  } catch (error2) {
+    if (db === opened) {
+      db = null;
+      try {
+        opened.close();
+      } catch {}
+    }
+    throw error2;
+  }
+}
+function bootOpenedDb(database, dbPath, resolvePromptTemplate, autoEncryptLegacyPlaintextSecrets) {
   database.run("PRAGMA journal_mode = WAL;");
   database.run("PRAGMA busy_timeout = 5000;");
   database.run("PRAGMA foreign_keys = ON;");
@@ -12220,20 +12292,20 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
   }
   ensureAgentProfileColumns(database);
   try {
-    const taskSchemaInfo = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'agent_tasks'").get();
+    const taskSchemaInfo = database.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'agent_tasks'").get();
     const schemaSql = taskSchemaInfo?.sql ?? "";
     const hasStatusCheck = /status\s+TEXT\b[^,]*\bCHECK\s*\(\s*status\s+IN\s*\(/i.test(schemaSql);
     const statusAllowsCancelled = /status\s+IN\s*\([^)]*'cancelled'/i.test(schemaSql);
     const needsStatusMigration = hasStatusCheck && !statusAllowsCancelled;
     if (needsStatusMigration) {
       console.log("[Migration] Removing restrictive CHECK constraint on agent_tasks.status");
-      db.run("PRAGMA foreign_keys=off");
+      database.run("PRAGMA foreign_keys=off");
       const rebuiltSchemaSql = schemaSql.replace(/^(CREATE TABLE\s+(?:IF NOT EXISTS\s+)?)(?:"agent_tasks"|agent_tasks)/i, "$1agent_tasks_new").replace(/\s+CHECK\s*\(\s*status\s+IN\s*\([^)]*\)\s*\)/i, "");
       if (rebuiltSchemaSql === schemaSql || !/agent_tasks_new/i.test(rebuiltSchemaSql)) {
         throw new Error("Could not derive agent_tasks schema without legacy status CHECK");
       }
-      const columns = db.prepare('PRAGMA table_info("agent_tasks")').all().map((column) => `"${column.name.replaceAll('"', '""')}"`).join(", ");
-      const schemaObjects = db.prepare(`SELECT sql FROM sqlite_master
+      const columns = database.prepare('PRAGMA table_info("agent_tasks")').all().map((column) => `"${column.name.replaceAll('"', '""')}"`).join(", ");
+      const schemaObjects = database.prepare(`SELECT sql FROM sqlite_master
            WHERE tbl_name = 'agent_tasks'
              AND type IN ('index', 'trigger')
              AND sql IS NOT NULL
@@ -12247,13 +12319,13 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
         for (const sql of schemaObjects)
           database.run(sql);
       })();
-      db.run("PRAGMA foreign_keys=on");
+      database.run("PRAGMA foreign_keys=on");
       console.log("[Migration] Successfully removed CHECK constraint on agent_tasks.status");
     }
   } catch (e) {
     console.error("[Migration] Failed to update agent_tasks CHECK constraint:", e);
     try {
-      db.run("PRAGMA foreign_keys=on");
+      database.run("PRAGMA foreign_keys=on");
     } catch (cleanupError) {
       console.error("[Migration] Failed to re-enable SQLite foreign_keys pragma:", cleanupError);
     }
@@ -12294,7 +12366,7 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
     console.error(`[credential-bindings] FATAL: failed to migrate legacy credential binding blob: ${err.message}`);
     throw err;
   }
-  return db;
+  return database;
 }
 function getDb(path3) {
   if (!db) {
@@ -12370,7 +12442,7 @@ var init_runtime = __esm(() => {
 // src/telemetry-identity.ts
 async function loadUserRole(userId) {
   try {
-    const { getUserGrant } = await import("./rbac-roles-q5gb5e8v.js");
+    const { getUserGrant } = await import("./rbac-roles-3mraey52.js");
     const grant = await getUserGrant(userId);
     const role = grant.grantsAll ? "admin" : "member";
     if (roleCache.size >= ROLE_CACHE_LIMIT) {
@@ -12530,6 +12602,47 @@ var init_codex_auth_failure = __esm(() => {
   ];
 });
 
+// src/utils/config-env-export.ts
+function isEnvExportRestrictedKey(key) {
+  return ENV_EXPORT_RESTRICTED_KEYS.has(key.toUpperCase()) || CONNECTION_SECRET_KEY.test(key);
+}
+function defaultExportToEnv(key) {
+  const upper = key.toUpperCase();
+  return !isEnvExportRestrictedKey(key) && !ENV_EXPORT_DEFAULT_OFF_KEYS.has(upper) && !ENV_EXPORT_DEFAULT_OFF_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+function envExportRestrictedError(key) {
+  return `Key '${key}' is read only by the API server and can never be exported to agent env; store it with exportToEnv: false.`;
+}
+function effectiveExportToEnv(key, stored) {
+  return stored && !isEnvExportRestrictedKey(key);
+}
+var ENV_EXPORT_RESTRICTED_KEYS, ENV_EXPORT_DEFAULT_OFF_KEYS, CONNECTION_SECRET_KEY, ENV_EXPORT_DEFAULT_OFF_PREFIXES;
+var init_config_env_export = __esm(() => {
+  ENV_EXPORT_RESTRICTED_KEYS = new Set([
+    "SLACK_APP_TOKEN",
+    "SLACK_SIGNING_SECRET",
+    "GITHUB_APP_PRIVATE_KEY",
+    "GITHUB_WEBHOOK_SECRET",
+    "GITLAB_WEBHOOK_SECRET",
+    "LINEAR_CLIENT_SECRET",
+    "LINEAR_SIGNING_SECRET",
+    "JIRA_CLIENT_SECRET",
+    "JIRA_WEBHOOK_TOKEN",
+    "AZURE_DEVOPS_WEBHOOK_SECRET",
+    "AGENTMAIL_WEBHOOK_SECRET",
+    "API_AGENT_FS_API_KEY"
+  ]);
+  ENV_EXPORT_DEFAULT_OFF_KEYS = new Set([
+    "KAPSO_WEBHOOK_HMAC_SECRET",
+    "SENTRY_TEST_APP_WEBHOOK_SECRET",
+    "TELEMETRY_CH_AUTH",
+    "HACK_AGENT_FS_ADMIN_KEY",
+    "X_CLIENT_SECRET"
+  ]);
+  CONNECTION_SECRET_KEY = /^connection\..+\.secret$/;
+  ENV_EXPORT_DEFAULT_OFF_PREFIXES = ["CHAT_SDK_"];
+});
+
 // src/utils/config-secrets.ts
 var MASKED_SECRET_VALUE = "********";
 var init_config_secrets = () => {};
@@ -13412,6 +13525,7 @@ function rowToAgentTask(row) {
     modelSource: row.modelSource ?? undefined,
     modelAlias: row.modelAlias ?? undefined,
     effort: ReasoningEffortSchema.safeParse(row.effort).success ? row.effort : undefined,
+    resolvedEffort: ReasoningEffortSchema.safeParse(row.resolvedEffort).success ? row.resolvedEffort : undefined,
     scheduleId: row.scheduleId ?? undefined,
     workflowRunId: row.workflowRunId ?? undefined,
     workflowRunStepId: row.workflowRunStepId ?? undefined,
@@ -13468,6 +13582,7 @@ function rowToAgentTaskSummary(row) {
     modelSource: row.modelSource ?? undefined,
     modelAlias: row.modelAlias ?? undefined,
     effort: ReasoningEffortSchema.safeParse(row.effort).success ? row.effort : undefined,
+    resolvedEffort: ReasoningEffortSchema.safeParse(row.resolvedEffort).success ? row.resolvedEffort : undefined,
     provider: row.provider ?? undefined,
     requestedByUserId: row.requestedByUserId ?? undefined,
     progress: row.progress ?? undefined,
@@ -13840,6 +13955,78 @@ async function markFinalizedSlackRelaysDelivered() {
        )`, [now, now]);
   return result.changes;
 }
+async function getPendingChatRelayTasks(now = Date.now(), limit2 = 200, adapters = []) {
+  if (adapters.length === 0)
+    return [];
+  for (const adapter of adapters) {
+    if (!/^[a-z]+$/.test(adapter))
+      throw new Error(`invalid chat adapter name: ${adapter}`);
+  }
+  const adapterFilter = adapters.map(() => "task.contextKey GLOB ?").join(" OR ");
+  const rows = await getDbClient().query(`SELECT task.*,
+            obligation.created_at AS relay_created_at,
+            obligation.last_error AS relay_last_error
+       FROM chat_relay_obligations obligation
+       JOIN agent_tasks task ON task.id = obligation.task_id
+       WHERE obligation.delivered_at IS NULL
+       AND obligation.given_up_at IS NULL
+       AND task.status IN ('completed', 'failed', 'cancelled')
+       AND (${adapterFilter})
+       AND ${CHAT_RELAY_ELIGIBLE_SQL}
+       ORDER BY obligation.last_attempt_at IS NOT NULL,
+                obligation.last_attempt_at ASC,
+                obligation.created_at ASC
+       LIMIT ?`, [
+    ...adapters.map((adapter) => `task:chat-sdk:${adapter}:*`),
+    new Date(now).toISOString(),
+    limit2
+  ]);
+  return rows.map((row) => ({
+    task: rowToAgentTask(row),
+    createdAt: row.relay_created_at,
+    lastError: row.relay_last_error
+  }));
+}
+async function giveUpStaleChatRelays(now, olderThanMs) {
+  const at = new Date(now).toISOString();
+  const cutoff = new Date(now - olderThanMs).toISOString();
+  const result = await getDbClient().run(`UPDATE chat_relay_obligations
+       SET given_up_at = ?, last_error = 'gave up: older than 24h', updated_at = ?
+       WHERE delivered_at IS NULL AND given_up_at IS NULL AND created_at < ?`, [at, at, cutoff]);
+  return result.changes;
+}
+async function markChatRelayAttempted(taskId, now = Date.now()) {
+  const at = new Date(now).toISOString();
+  const result = await getDbClient().run(`UPDATE chat_relay_obligations AS obligation
+       SET attempt_count = attempt_count + 1,
+           last_attempt_at = ?,
+           updated_at = ?
+       WHERE task_id = ?
+       AND delivered_at IS NULL
+       AND given_up_at IS NULL
+       AND ${CHAT_RELAY_ELIGIBLE_SQL}`, [at, at, taskId, at]);
+  return result.changes > 0;
+}
+async function recordChatRelayError(taskId, error2, now = Date.now()) {
+  const result = await getDbClient().run(`UPDATE chat_relay_obligations
+       SET last_error = ?, updated_at = ?
+       WHERE task_id = ? AND delivered_at IS NULL`, [scrubSecrets(error2), new Date(now).toISOString(), taskId]);
+  return result.changes > 0;
+}
+async function markChatRelayDelivered(taskId, now = Date.now()) {
+  const at = new Date(now).toISOString();
+  const result = await getDbClient().run(`UPDATE chat_relay_obligations
+       SET delivered_at = ?, updated_at = ?
+       WHERE task_id = ? AND delivered_at IS NULL`, [at, at, taskId]);
+  return result.changes > 0;
+}
+async function markChatRelayGivenUp(taskId, error2, now = Date.now()) {
+  const at = new Date(now).toISOString();
+  const result = await getDbClient().run(`UPDATE chat_relay_obligations
+       SET given_up_at = ?, last_error = ?, updated_at = ?
+       WHERE task_id = ? AND delivered_at IS NULL AND given_up_at IS NULL`, [at, scrubSecrets(error2), at, taskId]);
+  return result.changes > 0;
+}
 async function getRecentlyFinishedWorkerTasks() {
   const rows = await getDbClient().query(`SELECT t.* FROM agent_tasks t
        LEFT JOIN agents a ON t.agentId = a.id
@@ -14011,6 +14198,36 @@ async function getLatestLeadTaskInThread(channelId, threadTs) {
        LIMIT 1`, [channelId, threadTs]);
   return row ? rowToAgentTask(row) : null;
 }
+async function getAgentWorkingOnContextKey(contextKey, source2) {
+  const taskRow = await getDbClient().get(`SELECT agentId FROM agent_tasks
+       WHERE contextKey = ?
+       AND (? IS NULL OR source = ?)
+       ORDER BY createdAt DESC, rowid DESC
+       LIMIT 1`, [contextKey, source2 ?? null, source2 ?? null]);
+  if (taskRow?.agentId)
+    return getAgentById(taskRow.agentId);
+  return null;
+}
+async function getLatestActiveTaskByContextKey(contextKey, source2) {
+  const row = await getDbClient().get(`SELECT * FROM agent_tasks
+       WHERE contextKey = ?
+       AND (? IS NULL OR source = ?)
+       AND status IN ('in_progress', 'pending')
+       ORDER BY createdAt DESC, rowid DESC
+       LIMIT 1`, [contextKey, source2 ?? null, source2 ?? null]);
+  return row ? rowToAgentTask(row) : null;
+}
+async function getLatestLeadTaskByContextKey(contextKey, source2) {
+  const row = await getDbClient().get(`SELECT t.*
+       FROM agent_tasks t
+       JOIN agents a ON a.id = t.agentId
+       WHERE t.contextKey = ?
+         AND (? IS NULL OR t.source = ?)
+         AND a.isLead = 1
+       ORDER BY t.createdAt DESC, t.rowid DESC
+       LIMIT 1`, [contextKey, source2 ?? null, source2 ?? null]);
+  return row ? rowToAgentTask(row) : null;
+}
 async function getMostRecentTaskInThread(channelId, threadTs) {
   const row = await getDbClient().get(`SELECT * FROM agent_tasks
        WHERE slackChannelId = ?
@@ -14052,11 +14269,15 @@ async function findRecentCancelledTaskInThread(channelId, threadTs, windowMinute
        LIMIT 1`, [channelId, threadTs, since]);
   return row ? rowToAgentTask(row) : null;
 }
-var dependencies2, TASK_PREVIEW_LENGTH = 300, TASK_PREVIEW_BYTES, TASK_PREVIEW_SQL, taskPreviewDecoder, LIST_COLUMNS, NEVER_STARTED_TASK_STATUSES, findTaskByGitHub, LINEAR_TRACKER_CONTEXT_KEY_PREFIX = "task:trackers:linear:";
+var dependencies2, TASK_PREVIEW_LENGTH = 300, TASK_PREVIEW_BYTES, TASK_PREVIEW_SQL, taskPreviewDecoder, LIST_COLUMNS, NEVER_STARTED_TASK_STATUSES, findTaskByGitHub, CHAT_RELAY_ELIGIBLE_SQL = `(obligation.last_attempt_at IS NULL
+         OR (julianday(?) - julianday(obligation.last_attempt_at)) * 86400000.0 >=
+            CASE WHEN obligation.attempt_count >= 8 THEN 600000
+                 ELSE 3000 * (1 << obligation.attempt_count) END)`, LINEAR_TRACKER_CONTEXT_KEY_PREFIX = "task:trackers:linear:";
 var init_read = __esm(() => {
   init_key();
   init_types();
   init_provider_metadata();
+  init_secret_scrubber();
   init_agents();
   init_runtime();
   TASK_PREVIEW_BYTES = 4 * (TASK_PREVIEW_LENGTH + 1);
@@ -14070,6 +14291,7 @@ var init_read = __esm(() => {
     agent_tasks.offeredTo, agent_tasks.acceptedAt, agent_tasks.parentTaskId,
     agent_tasks.scheduleId, agent_tasks.model, agent_tasks.modelTier,
     agent_tasks.resolvedModel, agent_tasks.modelSource, agent_tasks.modelAlias, agent_tasks.effort,
+    agent_tasks.resolvedEffort,
     agent_tasks.provider, agent_tasks.requestedByUserId, agent_tasks.progress,
     agent_tasks.createdAt, agent_tasks.lastUpdatedAt, agent_tasks.finishedAt,
     agent_tasks.peakContextPercent`,
@@ -14310,7 +14532,7 @@ async function startTask(taskId) {
   }
   return result;
 }
-async function updateTaskClaudeSessionId(taskId, claudeSessionId, provider, providerMeta, model, harnessVariant, harnessVariantMeta) {
+async function updateTaskClaudeSessionId(taskId, claudeSessionId, provider, providerMeta, model, harnessVariant, harnessVariantMeta, resolvedEffort) {
   const setClauses = ["claudeSessionId = ?", "lastUpdatedAt = ?"];
   const params = [claudeSessionId, new Date().toISOString()];
   if (provider !== undefined) {
@@ -14333,6 +14555,10 @@ async function updateTaskClaudeSessionId(taskId, claudeSessionId, provider, prov
     setClauses.push("harnessVariantMeta = ?");
     params.push(JSON.stringify(harnessVariantMeta));
   }
+  if (resolvedEffort !== undefined) {
+    setClauses.push("resolvedEffort = ?");
+    params.push(resolvedEffort);
+  }
   params.push(taskId);
   const row = await getDbClient().get(`UPDATE agent_tasks SET ${setClauses.join(", ")} WHERE id = ? RETURNING *`, params);
   return row ? rowToAgentTask(row) : null;
@@ -14406,7 +14632,7 @@ async function completeTask(id, output, options) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.completed", {
           taskId: id,
           output: scrubbedOutput,
@@ -14461,7 +14687,7 @@ async function failTask(id, reason, opts = {}) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.failed", {
           taskId: id,
           failureReason: scrubbedReason,
@@ -14543,7 +14769,7 @@ async function cancelTask(id, reason) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.cancelled", {
           taskId: id,
           agentId: row.agentId,
@@ -14600,7 +14826,7 @@ async function supersedeTask(id, args) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.superseded", {
           taskId: id,
           reason: args.reason,
@@ -14812,7 +15038,7 @@ async function updateTaskProgress(id, progress) {
       });
     } catch {}
     getDbClient().afterCommit(() => {
-      import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+      import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
         workflowEventBus.emit("task.progress", {
           taskId: id,
           progress: scrubbedProgress,
@@ -14883,7 +15109,7 @@ function emitChildRunFinished(childRunId, parentStepId, status) {
 }
 function emitAfterCommit(childRunId, parentStepId) {
   getDbClient().afterCommit(() => {
-    import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+    import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
       workflowEventBus.emit("workflow.child.finished", { childRunId, parentStepId });
     }).catch((err) => console.error("[db] workflow.child.finished event not emitted:", scrubSecrets(err instanceof Error ? err.message : String(err))));
   });
@@ -14900,6 +15126,164 @@ var init_workflow_runs = __esm(() => {
   ]);
 });
 
+// src/integrations/chat-sdk/schema.ts
+function forbiddenKeyIssues(value, ctx) {
+  for (const key of FORBIDDEN_ADAPTER_KEYS) {
+    if (key in value) {
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `${key} is not allowed in CHAT_SDK_ADAPTERS`
+      });
+    }
+  }
+}
+function adapterSchema(shape) {
+  return exports_external.looseObject({ ...shape, ...COMMON_SHAPE }).superRefine(forbiddenKeyIssues);
+}
+function draftShape(shape) {
+  return Object.fromEntries(Object.entries(shape).map(([key, field]) => [key, field.optional()]));
+}
+function discordPublicKeyIssue(value, ctx) {
+  if (typeof value.publicKey === "string" && !DISCORD_PUBLIC_KEY_PATTERN.test(value.publicKey)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["publicKey"],
+      message: "publicKey must be 64 hex characters (the application's Ed25519 public key)"
+    });
+  }
+}
+function valueAt(input, path3) {
+  let current = input;
+  for (const key of path3) {
+    if (current === null || typeof current !== "object")
+      return;
+    current = current[key];
+  }
+  return current;
+}
+function firstIssueText(error2, prefix = "CHAT_SDK_ADAPTERS", input) {
+  const issue = error2.issues[0];
+  if (!issue)
+    return `${prefix} is invalid`;
+  const path3 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+  const missing = input !== undefined && issue.path.length > 0 && valueAt(input, issue.path) === undefined;
+  return `${prefix}.${path3}: ${missing ? "required" : issue.message}`;
+}
+function formFields(shape) {
+  return Object.keys(shape).filter((key) => key !== "enabled");
+}
+function isAdapterEntryEnabled(entry) {
+  return entry !== undefined && entry.enabled !== false;
+}
+function validateChatSdkAdaptersValue(value) {
+  if (typeof value !== "string")
+    return "CHAT_SDK_ADAPTERS must be a JSON string";
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch (error2) {
+    return `CHAT_SDK_ADAPTERS is not valid JSON: ${error2 instanceof Error ? error2.message : String(error2)}`;
+  }
+  const result = ChatSdkAdaptersDraftSchema.safeParse(parsed);
+  return result.success ? null : firstIssueText(result.error);
+}
+var CHAT_SDK_ADAPTER_NAMES, ConfigRefSchema, Str, FORBIDDEN_ADAPTER_KEYS, COMMON_SHAPE, TELEGRAM_SHAPE, SLACK_SHAPE, TelegramAdapterSchema, SlackAdapterSchema, DISCORD_PUBLIC_KEY_PATTERN, DISCORD_SHAPE, DiscordAdapterSchema, TEAMS_SHAPE, TeamsAdapterSchema, ChatSdkAdaptersSchema, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, CHAT_SDK_ADAPTER_FIELDS;
+var init_schema = __esm(() => {
+  init_zod();
+  CHAT_SDK_ADAPTER_NAMES = ["telegram", "slack", "discord", "teams"];
+  ConfigRefSchema = exports_external.strictObject({ $config: exports_external.string().min(1) });
+  Str = exports_external.union([exports_external.string().trim().min(1), ConfigRefSchema]);
+  FORBIDDEN_ADAPTER_KEYS = [
+    "apiUrl",
+    "apiBaseUrl",
+    "webhookVerifier",
+    "allowUnverifiedWebhooks"
+  ];
+  COMMON_SHAPE = {
+    userName: exports_external.string().min(1).optional(),
+    enabled: exports_external.boolean().optional()
+  };
+  TELEGRAM_SHAPE = {
+    botToken: Str,
+    secretToken: Str.optional(),
+    mode: exports_external.enum(["webhook", "polling"]).default("webhook"),
+    allowedUserIds: exports_external.array(exports_external.union([exports_external.string(), exports_external.number()])).optional()
+  };
+  SLACK_SHAPE = {
+    botToken: Str,
+    signingSecret: Str.optional(),
+    appToken: Str.optional(),
+    mode: exports_external.enum(["webhook", "socket"]).default("webhook")
+  };
+  TelegramAdapterSchema = adapterSchema(TELEGRAM_SHAPE);
+  SlackAdapterSchema = adapterSchema(SLACK_SHAPE).superRefine((value, ctx) => {
+    if (value.mode === "webhook" && value.signingSecret === undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["signingSecret"],
+        message: "signingSecret is required in webhook mode"
+      });
+    }
+    if (value.mode === "socket" && value.appToken === undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["appToken"],
+        message: "appToken is required in socket mode"
+      });
+    }
+  });
+  DISCORD_PUBLIC_KEY_PATTERN = /^[0-9a-fA-F]{64}$/;
+  DISCORD_SHAPE = {
+    botToken: Str,
+    publicKey: Str,
+    applicationId: Str,
+    respondToChannelIds: exports_external.array(exports_external.string()).optional(),
+    respondToGlobalMentions: exports_external.boolean().optional(),
+    mentionRoleIds: exports_external.array(exports_external.string()).optional()
+  };
+  DiscordAdapterSchema = adapterSchema(DISCORD_SHAPE).superRefine(discordPublicKeyIssue);
+  TEAMS_SHAPE = {
+    appId: Str,
+    appPassword: Str,
+    appTenantId: Str.optional(),
+    appType: exports_external.enum(["MultiTenant", "SingleTenant"]).default("MultiTenant")
+  };
+  TeamsAdapterSchema = adapterSchema(TEAMS_SHAPE).superRefine((value, ctx) => {
+    if (value.appType === "SingleTenant" && value.appTenantId === undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["appTenantId"],
+        message: "appTenantId is required for a SingleTenant app"
+      });
+    }
+  });
+  ChatSdkAdaptersSchema = exports_external.strictObject({
+    telegram: TelegramAdapterSchema,
+    slack: SlackAdapterSchema,
+    discord: DiscordAdapterSchema,
+    teams: TeamsAdapterSchema
+  }).partial();
+  CHAT_SDK_ADAPTER_SCHEMAS = {
+    telegram: TelegramAdapterSchema,
+    slack: SlackAdapterSchema,
+    discord: DiscordAdapterSchema,
+    teams: TeamsAdapterSchema
+  };
+  ChatSdkAdaptersDraftSchema = exports_external.strictObject({
+    telegram: adapterSchema(draftShape(TELEGRAM_SHAPE)),
+    slack: adapterSchema(draftShape(SLACK_SHAPE)),
+    discord: adapterSchema(draftShape(DISCORD_SHAPE)).superRefine(discordPublicKeyIssue),
+    teams: adapterSchema(draftShape(TEAMS_SHAPE))
+  }).partial();
+  CHAT_SDK_ADAPTER_FIELDS = {
+    telegram: formFields(TelegramAdapterSchema.shape),
+    slack: formFields(SlackAdapterSchema.shape),
+    discord: formFields(DiscordAdapterSchema.shape),
+    teams: formFields(TeamsAdapterSchema.shape)
+  };
+});
+
 // src/scripts-runtime/executors/quickjs-pool-config.ts
 function validateQuickJSPoolSize(value) {
   const error2 = `Invalid SCRIPT_QUICKJS_POOL_SIZE (must be an integer between 1 and ${MAX_QUICKJS_POOL_SIZE})`;
@@ -14991,20 +15375,26 @@ var init_enabled_tools = () => {};
 function parseTaskToolManifest(value) {
   return taskToolManifestSchema.parse(JSON.parse(value));
 }
+function isChatSdkTask(task) {
+  return chatThreadOfContextKey(task.contextKey) !== null;
+}
 function selectTaskTools(manifest, task) {
   const fromSchedule = task.scheduleId && Object.hasOwn(manifest.schedules ?? {}, task.scheduleId) ? manifest.schedules?.[task.scheduleId] : undefined;
   const fromType = task.taskType && Object.hasOwn(manifest.taskTypes ?? {}, task.taskType) ? manifest.taskTypes?.[task.taskType] : undefined;
-  return [...new Set(fromSchedule ?? fromType ?? [])].filter((name) => !name.startsWith("slack-") || Boolean(task.slackChannelId));
+  const chatTask = isChatSdkTask(task);
+  return [...new Set(fromSchedule ?? fromType ?? [])].filter((name) => (!name.startsWith("slack-") || Boolean(task.slackChannelId)) && (chatTask || !CHAT_TASK_ONLY_TOOLS.includes(name)));
 }
-var toolNames, taskToolManifestSchema;
+var toolNames, taskToolManifestSchema, CHAT_TASK_ONLY_TOOLS;
 var init_task_tool_manifest = __esm(() => {
   init_zod();
+  init_context_key();
   init_tool_config();
   toolNames = exports_external.array(exports_external.string().refine((name) => ALL_TOOLS.has(name), "Unknown swarm tool")).max(16);
   taskToolManifestSchema = exports_external.strictObject({
     taskTypes: exports_external.record(exports_external.string().min(1).max(50), toolNames).optional(),
     schedules: exports_external.record(exports_external.uuid(), toolNames).optional()
   });
+  CHAT_TASK_ONLY_TOOLS = ["chat-reply"];
 });
 
 // src/be/model-tier-keys.ts
@@ -15044,6 +15434,12 @@ var init_model_tier_keys = __esm(() => {
 });
 
 // src/be/swarm-config-guard.ts
+function teamsSdkEnvKeysSql() {
+  return TEAMS_SDK_ENV_KEYS.map((key) => `'${key}'`).join(", ");
+}
+function isApiOnlyConfigKey(key) {
+  return API_ONLY_CONFIG_KEYS.has(key);
+}
 function isInternalConfigKey(key) {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
 }
@@ -15151,22 +15547,37 @@ function validateConfigValue(key, value) {
   const validator = VALIDATED_KEYS[key.toUpperCase()];
   return validator ? validator(value) : null;
 }
-var RESERVED_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, validateControllerTokenTtlDays, validateControllerGraceSec, VALIDATED_KEYS;
+function validateExportToEnv(key, exportToEnv) {
+  return exportToEnv === true && isEnvExportRestrictedKey(key) ? envExportRestrictedError(key) : null;
+}
+var TEAMS_SDK_ENV_KEYS, RESERVED_KEYS, API_ONLY_CONFIG_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, validateControllerTokenTtlDays, validateControllerGraceSec, VALIDATED_KEYS;
 var init_swarm_config_guard = __esm(() => {
+  init_schema();
   init_quickjs_pool_config();
   init_reaction_shortcode();
   init_types();
   init_api_drain();
+  init_config_env_export();
   init_enabled_tools();
   init_org_website();
   init_task_tool_manifest();
   init_model_tier_keys();
+  TEAMS_SDK_ENV_KEYS = [
+    "SERVICE_URL",
+    "TENANT_ID",
+    "CLIENT_ID",
+    "CLIENT_SECRET",
+    "MANAGED_IDENTITY_CLIENT_ID",
+    "CLOUD"
+  ];
   RESERVED_KEYS = new Set([
     "API_KEY",
     "SECRETS_ENCRYPTION_KEY",
     "CORS_ALLOW_ANY_ORIGIN",
-    "EXTENSION_ALLOW_LEAD_ACTIVATION"
+    "EXTENSION_ALLOW_LEAD_ACTIVATION",
+    "CHAT_SDK_API_URL_OVERRIDES"
   ]);
+  API_ONLY_CONFIG_KEYS = new Set(["API_AGENT_FS_API_KEY", "SLACK_SIGNING_SECRET"]);
   INTERNAL_CONFIG_KEYS = new Set(["onboarding_state", "runtime_owner_id"]);
   BOOLEAN_LITERALS = ["true", "false", "1", "0"];
   DB_RETENTION_TUNING_BOUNDS = {
@@ -15198,6 +15609,7 @@ var init_swarm_config_guard = __esm(() => {
     ], 1),
     ...integerValidators(["RUNTIME_SOCKET_GRACE_SEC"], 0),
     ...integerValidators(["RUNTIME_WAKE_GRACE_SEC", "RUNTIME_WAKE_REROUTE_SEC", "RUNTIME_ROUTING_INTERVAL_MS"], 0),
+    CHAT_SDK_ADAPTERS: validateChatSdkAdaptersValue,
     TASK_TOOL_MANIFESTS: (value) => {
       try {
         if (typeof value !== "string")
@@ -15295,8 +15707,10 @@ var init_swarm_config_guard = __esm(() => {
       "OPENROUTER_APP_ATTRIBUTION",
       "CURSOR_NATIVE_SYSTEM_PROMPT",
       "SLACK_DISABLE",
+      "CHAT_SDK_ENABLED",
       "SLACK_RENDER_V2",
       "SLACK_RENDER_V2_DELEGATION",
+      "SLACK_BLOCK_EXTERNAL_CHANNELS",
       "GITHUB_DISABLE",
       "GITLAB_DISABLE",
       "AZURE_DEVOPS_DISABLE",
@@ -15368,6 +15782,7 @@ var init_swarm_config_guard = __esm(() => {
     ...integerValidators(["MODEL_LATEST_SOAK_DAYS"], 0),
     ...integerValidators(["APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS"], 0),
     ...boundedIntegerValidators(["API_DRAIN_MAX_MS"], 0, API_DRAIN_MAX_MS_LIMIT),
+    ...boundedIntegerValidators(["CHAT_SDK_BUFFER_MS"], 1, 600000),
     ...boundedIntegerValidators(["CONTEXT_PREAMBLE_MAX_TOKENS"], 100, 20000),
     MEMORY_MIN_SIMILARITY: (value) => validateFloatRange("MEMORY_MIN_SIMILARITY", value, 0, 1, "between 0 and 1 inclusive"),
     MEMORY_ACCESS_BOOST_MAX: (value) => validateFloatRange("MEMORY_ACCESS_BOOST_MAX", value, 1, Number.POSITIVE_INFINITY, "a number >= 1")
@@ -16580,7 +16995,7 @@ async function loadSecretRegistry() {
     result.failed += 1;
   }
   try {
-    const { loadRuntimeControllerSecrets } = await import("./db-hkqvrdcb.js");
+    const { loadRuntimeControllerSecrets } = await import("./db-k8ankj20.js");
     const loaded = await loadRuntimeControllerSecrets();
     result.runtimeController = loaded.count;
     result.failed += loaded.failed;
@@ -17003,6 +17418,7 @@ __export(exports_db, {
   getAgentSkills: () => getAgentSkills,
   getAgentStatusCounts: () => getAgentStatusCounts,
   getAgentWithTasks: () => getAgentWithTasks,
+  getAgentWorkingOnContextKey: () => getAgentWorkingOnContextKey,
   getAgentWorkingOnThread: () => getAgentWorkingOnThread,
   getAllAgentMailInboxMappings: () => getAllAgentMailInboxMappings,
   getAllAgents: () => getAllAgents,
@@ -17064,8 +17480,10 @@ __export(exports_db, {
   getLastReadAt: () => getLastReadAt,
   getLastRunStart: () => getLastRunStart,
   getLastSuccessfulRun: () => getLastSuccessfulRun,
+  getLatestActiveTaskByContextKey: () => getLatestActiveTaskByContextKey,
   getLatestActiveTaskInThread: () => getLatestActiveTaskInThread,
   getLatestContextVersion: () => getLatestContextVersion,
+  getLatestLeadTaskByContextKey: () => getLatestLeadTaskByContextKey,
   getLatestLeadTaskInThread: () => getLatestLeadTaskInThread,
   getLatestPageBySlug: () => getLatestPageBySlug,
   getLatestScriptRunStepTaskByContextKey: () => getLatestScriptRunStepTaskByContextKey,
@@ -17095,6 +17513,7 @@ __export(exports_db, {
   getPageVersions: () => getPageVersions,
   getPausedTasksForAgent: () => getPausedTasksForAgent,
   getPendingApprovalVoteState: () => getPendingApprovalVoteState,
+  getPendingChatRelayTasks: () => getPendingChatRelayTasks,
   getPendingEventWaitNames: () => getPendingEventWaitNames,
   getPendingSlackRelayTasks: () => getPendingSlackRelayTasks,
   getPendingSteeringForAgent: () => getPendingSteeringForAgent,
@@ -17192,6 +17611,7 @@ __export(exports_db, {
   getWorkflowVersion: () => getWorkflowVersion,
   getWorkflowVersions: () => getWorkflowVersions,
   getWorkflowsByScheduleId: () => getWorkflowsByScheduleId,
+  giveUpStaleChatRelays: () => giveUpStaleChatRelays,
   hasBudgetRefusalNotificationToday: () => hasBudgetRefusalNotificationToday,
   hasCapacity: () => hasCapacity,
   hasFirstCompletedTask: () => hasFirstCompletedTask,
@@ -17243,6 +17663,9 @@ __export(exports_db, {
   listWorkflowRuns: () => listWorkflowRuns,
   listWorkflowRunsPage: () => listWorkflowRunsPage,
   listWorkflows: () => listWorkflows,
+  markChatRelayAttempted: () => markChatRelayAttempted,
+  markChatRelayDelivered: () => markChatRelayDelivered,
+  markChatRelayGivenUp: () => markChatRelayGivenUp,
   markFinalizedSlackRelaysDelivered: () => markFinalizedSlackRelaysDelivered,
   markInboxMessageDelegated: () => markInboxMessageDelegated,
   markInboxMessageRead: () => markInboxMessageRead,
@@ -17271,6 +17694,7 @@ __export(exports_db, {
   reassociateSessionLogs: () => reassociateSessionLogs,
   recordApprovalVotes: () => recordApprovalVotes,
   recordBudgetRefusalNotification: () => recordBudgetRefusalNotification,
+  recordChatRelayError: () => recordChatRelayError,
   recordInlineScriptRun: () => recordInlineScriptRun,
   recordKeyAuthFailure: () => recordKeyAuthFailure,
   recordKeyRateLimitWindows: () => recordKeyRateLimitWindows,
@@ -17582,15 +18006,30 @@ async function getSlackOutcomeMessage(taskId) {
   return row ? rowToSlackMessage(row) : null;
 }
 async function getResolvableDeferralOutcomes(limit2 = 50) {
-  const rows = await getDbClient().query(`SELECT card.*, wake.id AS wake_task_id
-       FROM slack_messages card
-       JOIN agent_tasks deferred ON deferred.id = card.task_id
-       JOIN agent_tasks wake ON wake.parentTaskId = deferred.id AND wake.taskType = 'deferred'
+  const rows = await getDbClient().query(`WITH RECURSIVE chain(card_id, task_id) AS (
+         SELECT card.id, deferred.id FROM slack_messages card
+         JOIN agent_tasks deferred ON deferred.id = card.task_id
+         WHERE card.kind = 'outcome' AND deferred.deferredAt IS NOT NULL
+           AND card.deferral_resolved_at IS NULL AND card.finalized_at IS NOT NULL
+           AND card.ts NOT LIKE 'pending:%'
+         UNION
+         SELECT chain.card_id, wake.id FROM chain
+         JOIN agent_tasks parent ON parent.id = chain.task_id AND parent.deferredAt IS NOT NULL
+         JOIN agent_tasks wake ON wake.parentTaskId = parent.id AND wake.taskType = 'deferred'
+       )
+       SELECT card.*, wake.id AS wake_task_id
+       FROM chain
+       JOIN slack_messages card ON card.id = chain.card_id
+       JOIN agent_tasks wake ON wake.id = chain.task_id AND wake.id != card.task_id
        WHERE card.kind = 'outcome'
          AND card.finalized_at IS NOT NULL
          AND card.deferral_resolved_at IS NULL
          AND card.ts NOT LIKE 'pending:%'
-         AND deferred.deferredAt IS NOT NULL
+         AND NOT EXISTS (
+           SELECT 1 FROM agent_tasks child
+           WHERE child.parentTaskId = wake.id AND child.taskType = 'deferred'
+         )
+         AND (wake.deferredAt IS NULL OR wake.finishedAt > card.updated_at)
          AND wake.status IN ('completed', 'failed', 'cancelled')
        ORDER BY wake.finishedAt ASC
        LIMIT ?`, [limit2]);
@@ -18863,7 +19302,7 @@ async function createTaskExtended(task, options) {
     priority: row.priority
   }, (task2) => task2 !== null, row.requestedByUserId);
   getDbClient().afterCommit(() => {
-    import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => {
+    import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => {
       workflowEventBus.emit("task.created", {
         taskId: row.id,
         task: row.task,
@@ -18945,7 +19384,7 @@ async function releaseTask(taskId, wakeSnapshot) {
     } catch {}
     if (isRuntimePoolsEnabled() && !wakeSnapshot)
       getDbClient().afterCommit(() => {
-        import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
+        import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
       });
   }
   return row ? rowToAgentTask(row) : null;
@@ -19015,7 +19454,7 @@ async function rejectTask(taskId, agentId, reason) {
     } catch {}
     if (isRuntimePoolsEnabled())
       getDbClient().afterCommit(() => {
-        import("./event-bus-vjtv82gm.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
+        import("./event-bus-6axnngdj.js").then(({ workflowEventBus }) => workflowEventBus.emit("task.unassigned", { taskId })).catch((error2) => console.error("[db] Routing event failed:", scrubSecrets(String(error2))));
       });
   }
   return row ? rowToAgentTask(row) : null;
@@ -20693,7 +21132,8 @@ function rowToSwarmConfig(row) {
       description: row.description ?? null,
       createdAt: row.createdAt,
       lastUpdatedAt: row.lastUpdatedAt,
-      encrypted: isEncrypted
+      encrypted: isEncrypted,
+      exportToEnv: effectiveExportToEnv(row.key, row.exportToEnv !== 0)
     };
   }
   let value = row.value;
@@ -20715,7 +21155,8 @@ function rowToSwarmConfig(row) {
     description: row.description ?? null,
     createdAt: row.createdAt,
     lastUpdatedAt: row.lastUpdatedAt,
-    encrypted: isEncrypted
+    encrypted: isEncrypted,
+    exportToEnv: effectiveExportToEnv(row.key, row.exportToEnv !== 0)
   };
 }
 function autoEncryptLegacyPlaintextSecrets(database, dbPath, options = {}) {
@@ -20816,7 +21257,7 @@ async function getSwarmConfigs(filters) {
 async function getInjectableGlobalConfigs() {
   const rows = await getDbClient().query(`SELECT * FROM swarm_config
        WHERE scope = 'global'
-         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN', 'EXTENSION_ALLOW_LEAD_ACTIVATION')
+         AND UPPER(key) NOT IN ('API_KEY', 'SECRETS_ENCRYPTION_KEY', 'CORS_ALLOW_ANY_ORIGIN', 'EXTENSION_ALLOW_LEAD_ACTIVATION', 'CHAT_SDK_API_URL_OVERRIDES', ${teamsSdkEnvKeysSql()})
        ORDER BY key ASC`);
   return rows.filter((row) => !isInternalConfigKey(row.key)).map(rowToSwarmConfig);
 }
@@ -20843,6 +21284,10 @@ async function upsertSwarmConfig(data) {
   if (isReservedConfigKey(data.key)) {
     throw reservedKeyError(data.key);
   }
+  if (data.exportToEnv === true && isEnvExportRestrictedKey(data.key)) {
+    throw new Error(envExportRestrictedError(data.key));
+  }
+  const restricted = isEnvExportRestrictedKey(data.key);
   const now = new Date().toISOString();
   const scopeId = data.scope === "global" ? null : data.scopeId ?? null;
   const isSecret = data.isSecret ? 1 : 0;
@@ -20853,12 +21298,24 @@ async function upsertSwarmConfig(data) {
   const row = await getDbClient().transaction(async () => {
     const existing = scopeId === null ? await getDbClient().get("SELECT id FROM swarm_config WHERE scope = ? AND scopeId IS NULL AND key = ?", [data.scope, data.key]) : await getDbClient().get("SELECT id FROM swarm_config WHERE scope = ? AND scopeId = ? AND key = ?", [data.scope, scopeId, data.key]);
     if (existing) {
-      return await getDbClient().get(`UPDATE swarm_config SET value = ?, isSecret = ?, envPath = ?, description = ?, encrypted = ?, lastUpdatedAt = ?
-         WHERE id = ? RETURNING *`, [storedValue, isSecret, envPath, description, encryptedFlag, now, existing.id]);
+      return await getDbClient().get(`UPDATE swarm_config SET value = ?, isSecret = ?, envPath = ?, description = ?, encrypted = ?, lastUpdatedAt = ?,
+           exportToEnv = CASE WHEN ? THEN 0 ELSE COALESCE(?, exportToEnv) END
+         WHERE id = ? RETURNING *`, [
+        storedValue,
+        isSecret,
+        envPath,
+        description,
+        encryptedFlag,
+        now,
+        restricted ? 1 : 0,
+        data.exportToEnv === undefined ? null : data.exportToEnv ? 1 : 0,
+        existing.id
+      ]);
     }
     const id = crypto.randomUUID();
-    return await getDbClient().get(`INSERT INTO swarm_config (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`, [
+    const exportToEnv = restricted ? 0 : data.exportToEnv ?? defaultExportToEnv(data.key) ? 1 : 0;
+    return await getDbClient().get(`INSERT INTO swarm_config (id, scope, scopeId, key, value, isSecret, envPath, description, createdAt, lastUpdatedAt, encrypted, exportToEnv)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`, [
       id,
       data.scope,
       scopeId,
@@ -20869,7 +21326,8 @@ async function upsertSwarmConfig(data) {
       description,
       now,
       now,
-      encryptedFlag
+      encryptedFlag,
+      exportToEnv
     ]);
   });
   if (!row)
@@ -24942,6 +25400,7 @@ var init_db2 = __esm(() => {
   init_telemetry_trigger();
   init_types();
   init_codex_auth_failure();
+  init_config_env_export();
   init_config_secrets();
   init_credentials();
   init_github_pull_request();
@@ -26151,4 +26610,4 @@ function getMemoryStore() {
 var embeddingProvider2 = null, memoryStore = null;
 var init_memory = () => {};
 
-export { slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, init_templates3 as init_templates1, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, init_runtime, cachedUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, init_agents, listApprovalRequestSummaries, getPendingApprovalVoteState, recordApprovalVotes, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, rowToAgentTask, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, isLinearTrackerContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, init_read, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, recordTaskProviderIfUnset, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, getChildWorkflowRunId, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, init_workflow_runs, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider, resetEmbeddingProvider, getMemoryStore, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings2 as init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS, refreshActiveSessionOnActivity, recordKeySeatMismatch, getScriptRunExecutionArgs, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db2 as init_db1 };
+export { slackContextKey, chatSdkContextKey, chatThreadOfContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, azureDevOpsWorkItemContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates2 as init_templates, init_templates3 as init_templates1, isSqliteVecAvailable, resolveSqliteVecExtensionPath, __resetSqliteVecExtensionPathCacheForTests, initDb, getDb, closeDb, getDbClient, init_runtime, cachedUserRole, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, isEnvExportRestrictedKey, init_config_env_export, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState, updateAgentCredentialMissing, createAgent, getAgentById, EXTENSION_AGENT_ROLE, NOT_EXTENSION_AGENT_SQL, isExtensionAgent, extensionAgentAssignmentError, ReservedAgentRoleError, reservedRoleViolation, ExtensionAgentAssignmentError, getAllAgents, getAgentStatusCounts, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, getAgentDailyTaskCounts, init_agents, listApprovalRequestSummaries, getPendingApprovalVoteState, recordApprovalVotes, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, rowToAgentTask, getTaskById, getChildTasks, hasNonTerminalResumeChild, getSupersededTasksWithoutResume, getSupersededTasksWithUnsettledDependents, hasNonTerminalRerouteDecisionChild, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getPendingSlackRelayTasks, markSlackRelayAttempted, markSlackRelayDelivered, markFinalizedSlackRelaysDelivered, getPendingChatRelayTasks, giveUpStaleChatRelays, markChatRelayAttempted, recordChatRelayError, markChatRelayDelivered, markChatRelayGivenUp, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getSlackTasksMissingTree, getInProgressTasksByContextKey, isLinearTrackerContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getLatestScriptRunStepTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getLatestLeadTaskInThread, getAgentWorkingOnContextKey, getLatestActiveTaskByContextKey, getLatestLeadTaskByContextKey, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, init_read, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, updateTaskClaudeSessionId, recordTaskProviderIfUnset, updateTaskTitle, completeTask, failTask, overwriteTerminalTaskResultText, cancelTask, supersedeTask, settleSupersededTaskDependents, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, getChildWorkflowRunId, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, init_workflow_runs, CHAT_SDK_ADAPTER_NAMES, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, firstIssueText, isAdapterEntryEnabled, init_schema, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, CHAT_TASK_ONLY_TOOLS, isChatSdkTask, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isApiOnlyConfigKey, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, validateExportToEnv, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider, resetEmbeddingProvider, getMemoryStore, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings2 as init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, SteeringRequestError, isSteeringEnabled2 as isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS, refreshActiveSessionOnActivity, recordKeySeatMismatch, getScriptRunExecutionArgs, getSlackRenderV2ActivatedAt, ensureSlackRenderV2Activation, getSlackDelegationActivatedAt, ensureSlackDelegationActivation, isPendingSlackMessage, isSettledSlackMessage, recordSlackMessage, reserveSlackMessage, bindSlackMessageTimestamp, updateSlackMessageRecord, markSlackTreeRendered, deleteSlackMessageRecord, getSlackTreeMessage, getSlackTreeMessageByThread, getSlackOutcomeMessage, getResolvableDeferralOutcomes, markSlackDeferralResolved, noteSlackOutcomeDeliveryFailure, abandonSlackOutcomeDelivery, getSlackTreeMessages, getSlackMessageByChannelTs, getSlackTasksInThread, listSlackThreadsAwaitingHuman, isSlackThreadAwaitingHuman, markTaskSlackReplySent, setSlackMessageTracking, updateTaskVcs, insertTaskAttachment, recordTaskPullRequestAttachments, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, createSteeringMessage, getSteeringMessagesForTask, getSteeringMessageById, getPendingSteeringForTask, getPendingSteeringForAgent, markSteeringDelivered, markSteeringHandled, markSteeringPromoted, cancelPendingSteeringForTask, hasPendingSteering, getAgentWithTasks, getAllAgentsWithTasks, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdAndEventType, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, promoteDraftTask, refreshDraftTaskLease, promoteAbandonedDraftTasks, releaseStaleReviewingTasks, releaseStaleOfferedTasksForOfflineAgents, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, UNATTRIBUTED_USER_ID, getSessionCostSummary, getAttributionByPerson, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, emitBuiltInIntegrationConnectedOnce, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, countWorkflowRuns, listWorkflowRunsPage, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, detachTaskFromWorkflowRunStep, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, getCurrentStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createAppVersion, getAppVersions, getAppVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, cancelApprovalRequestById, cancelPendingApprovalRequestsForRun, listCancelledApprovalRequestsForRun, listCancelledApprovalRequestsForStep, claimApprovalCancellationNotification, completeApprovalCancellationNotificationClaim, releaseApprovalCancellationNotificationClaim, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, getStaleApprovalRequests, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, emitMcpServerConnectedTelemetry, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, setApiKeyPlan, markKeyRateLimited, recordKeyAuthFailure, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getReadyAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, sweepExpiredKv, sweepExpiredKvPrefix, upsertKv, claimKv, deleteKv, KvTypeCollisionError, incrKv, kvPrefixUpperBound, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, updateScriptRunIfNotTerminal, updateScriptRunIfRunning, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db2 as init_db1 };