@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/dist/{http-jdteeg81.js → http-r7f3eky0.js}

@@ -1,7 +1,3 @@
-import {
-  BROWSER_SDK_JS,
-  SWARM_UI_JS
-} from "./cli-t1ze64h3.js";
 import {
   SIMILARITY_THRESHOLD,
   isLeadChannelMonitoringEnabled,
@@ -11,7 +7,7 @@ import {
 } from "./cli-hz99wfxp.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-7a0sde2x.js";
+} from "./cli-6cagzc96.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-bqjfjex4.js";
@@ -24,11 +20,11 @@ import {
 } from "./cli-2pdaysab.js";
 import {
   reasoningCapability
-} from "./cli-tmhsxhb8.js";
+} from "./cli-n5vwg842.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-gj81e47t.js";
+} from "./cli-r2pnvj8g.js";
 import"./cli-6zx22mv6.js";
 import {
   DEFAULT_CONNECTOR_CODE_LABEL,
@@ -39,16 +35,17 @@ import {
   startPoolRouting,
   stopHeartbeat,
   stopPoolRouting
-} from "./cli-8hzfb6xz.js";
+} from "./cli-tsde1hdr.js";
 import {
   Anthropic
-} from "./cli-gmdajfw5.js";
+} from "./cli-4jxm2qtz.js";
 import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-prrt9fa0.js";
-import"./cli-ppy4nnnh.js";
+} from "./cli-ke896fcf.js";
+import"./cli-f7kr7svz.js";
+import"./cli-knd276ed.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -75,6 +72,7 @@ import {
   SDK_ALLOWLIST,
   SUPPORTED_PROTOCOL_VERSIONS,
   TaskCreationBlockedError,
+  TelegramBotApiError,
   WebhookError,
   activateVersion,
   agentRanModel,
@@ -88,6 +86,7 @@ import {
   authorizeAssetKeyWrite,
   authorizeRoomNamespace,
   calculateNextRun,
+  callTelegramBotApi,
   canClaim,
   canReadMemory,
   cancelApprovalRequest,
@@ -124,6 +123,7 @@ import {
   enforceContentLengthCap,
   enqueueAdmissionRow,
   enqueueAuditRow,
+  errorMessage,
   estimateTokens,
   executeRawLlm,
   executeReadOnlyQuery,
@@ -133,6 +133,9 @@ import {
   extractAndVerifyCookie,
   flushAuditBuffer,
   getAgentHarnessCliVersion,
+  getChatInstance,
+  getChatSdkConfig,
+  getChatSdkHealth,
   getCombConfig,
   getEnabledCapabilities,
   getEventCountsFiltered,
@@ -147,6 +150,7 @@ import {
   getLinksForMemory,
   getMemoryChunks,
   getOAuthPreset,
+  getPageEditCounter,
   getPathSegments,
   getPosteriorsByIds,
   getRoom,
@@ -183,6 +187,11 @@ import {
   handlePullRequestCreated,
   handlePullRequestReview,
   handleWebhookTrigger,
+  handleWorkItemCommented,
+  handleWorkItemCreated,
+  handleWorkItemDeleted,
+  handleWorkItemRestored,
+  handleWorkItemUpdated,
   handleWorkflowRun,
   harnessModelErrorFor,
   hasCapability,
@@ -202,6 +211,9 @@ import {
   isAgentMailEnabled,
   isApiDraining,
   isAzureDevOpsEnabled,
+  isChatAdapterConfigured,
+  isChatSdkEnabled,
+  isChatSdkStopping,
   isGitHubEnabled,
   isGitLabEnabled,
   isInboxAllowed,
@@ -213,6 +225,7 @@ import {
   isLinearEnabled,
   isOriginAllowedForCredentials,
   isSenderAllowed,
+  isTrustedTeamsServiceUrl,
   issuePageSessionCookie,
   json,
   jsonError,
@@ -236,7 +249,6 @@ import {
   parseCookieHeader,
   parseModelTierOverridesHeader,
   parseQueryParams,
-  parseSkillContent,
   patchWorkflowDefinition,
   poolTaskRunsOnHarness,
   posteriorMean,
@@ -262,6 +274,7 @@ import {
   reservedRoomKeyError,
   resetAgentMaxTasksMirror,
   resetRoom,
+  resolveAdapterApiUrl,
   resolveHttpAuditUserId,
   resolveHttpFavoriteOwner,
   resolveHttpRequestAuth,
@@ -296,17 +309,21 @@ import {
   snapshotPage,
   startAuditGc,
   startAuditWriter,
+  startChatSdk,
   steerTaskHandler,
   steerTaskOutputSchema,
   steerTaskUserInputSchema,
   stopAuditGc,
   stopAuditWriter,
+  stopChatSdk,
   stopExtensionRuntime,
   stripSiblingBlock,
   sweepRooms,
   syncTelemetryEnabled,
+  taskModelPin,
   toolErr,
   touchRuntimeInstance,
+  trackBackground,
   triggerSchemaErrorResponse,
   uninstallExtension,
   updateExtensionMeta,
@@ -327,13 +344,13 @@ import {
   wireHttpSpanLifecycle,
   workflowModelErrors,
   writeUnhandledError
-} from "./cli-ztrv9y21.js";
-import"./cli-451ks6aw.js";
+} from "./cli-bzszjf2p.js";
+import"./cli-zkpks3r3.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-2bw3w47j.js";
+} from "./cli-hnhtk6cj.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -342,16 +359,12 @@ import {
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-6jb2rf77.js";
 import {
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh,
   upsertModelCatalogOverlay
-} from "./cli-gp1rtyvk.js";
-import {
-  normalizeModelKey
-} from "./cli-r8smj8b8.js";
+} from "./cli-z5jjpaxw.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -359,6 +372,7 @@ import {
   SCRIPT_SDK_TYPES,
   SCRIPT_STDLIB_MODULE_TYPES,
   ScriptConnectionConflictError,
+  SqlDsnInputSchema,
   applyMcpOAuthRefresh,
   assertUrlSafe,
   authMethodForStoredClient,
@@ -402,8 +416,10 @@ import {
   listScriptConnectionsAsync,
   listVendoredOpenapiEntries,
   markMcpOAuthTokenStatus,
+  mcpOAuthSsrfOptions,
   normalizeTokenEndpointAuthMethod,
   oauthAppToProviderConfig,
+  parseSkillContent,
   publicEndpointSsrfOptions,
   readStreamCapped,
   refreshMcpToken,
@@ -412,7 +428,9 @@ import {
   require_dist,
   require_typescript,
   resolveAdvertisedTokenEndpointAuthMethod,
+  resolveSqlDsn,
   revokeMcpToken,
+  runReadOnlyQuery,
   runScript,
   sandboxSpawnEnv,
   scriptSdkTypesWithGeneratedApis,
@@ -425,7 +443,7 @@ import {
   upsertCredentialBinding,
   upsertMcpOAuthToken,
   upsertScriptConnection
-} from "./cli-j6kpj9az.js";
+} from "./cli-ee9gtz70.js";
 import"./cli-epan13p1.js";
 import {
   detachedProcessGroup,
@@ -440,7 +458,12 @@ import {
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow,
   oauthAppRowToProviderConfig
-} from "./cli-388egyf6.js";
+} from "./cli-6razj6t4.js";
+import"./cli-5t4f29ez.js";
+import {
+  normalizeModelKey
+} from "./cli-r62a35ea.js";
+import"./cli-6cvfxs8r.js";
 import {
   AgentFsProvider,
   FilesError,
@@ -459,14 +482,14 @@ import {
   startWorkflowExecution,
   validateJsonSchema,
   workflowSaveWarnings
-} from "./cli-kb4ehzx5.js";
+} from "./cli-1e4b6bzh.js";
 import {
   createApprovalFollowUpTask,
   definitionNodeIds,
   generateEdges,
   validateDefinition
-} from "./cli-aspcaef3.js";
-import"./cli-xczpdp9e.js";
+} from "./cli-v1yb0rqb.js";
+import"./cli-se8w6wny.js";
 import {
   CLIENT_ID,
   MAX_CODEX_OAUTH_SLOT,
@@ -477,13 +500,14 @@ import {
   getAccountId,
   getValidCodexOAuth,
   loadAllCodexOAuthSlots
-} from "./cli-7jykv7ef.js";
-import"./cli-cceskcvt.js";
-import"./cli-h6vtvt5c.js";
+} from "./cli-e6mpjhed.js";
 import"./cli-2x0e561b.js";
+import"./cli-txqb9s38.js";
+import"./cli-h6vtvt5c.js";
 import"./cli-fad8m16k.js";
 import"./cli-bsakbbkm.js";
 import"./cli-zxg80zs9.js";
+import"./cli-51tf7ac3.js";
 import"./cli-ydt3zkwv.js";
 import {
   TaskCitationSchema,
@@ -499,18 +523,22 @@ import {
   recordDbRetentionStatement,
   recordDbRetentionSweep,
   recordSessionCost,
-  require_content_type,
   startSlackApp,
   startSpan,
   stopSlackApp,
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-9xsmdpdt.js";
-import"./cli-q51yprfq.js";
+} from "./cli-skxvvpap.js";
+import"./cli-n2wq4j7m.js";
+import {
+  require_content_type
+} from "./cli-wmgrkscj.js";
 import"./cli-3er6gcsn.js";
-import"./cli-yatxqynm.js";
-import"./cli-51tf7ac3.js";
+import"./cli-hjwmhcg1.js";
+import"./cli-rhs9pz33.js";
+import"./cli-9ha6hs2d.js";
+import"./cli-k3dp5tpf.js";
 import {
   InvalidRuntimeTokenError,
   RuntimePoolError,
@@ -549,11 +577,11 @@ import {
   unlinkIdentity,
   updateRuntimeController,
   updateRuntimePool
-} from "./cli-e0a9sk00.js";
-import"./cli-cd0hv9nh.js";
+} from "./cli-eejsgvm4.js";
+import"./cli-ra0xzggj.js";
 import {
   bedrockProviderModule
-} from "./cli-4fnb6884.js";
+} from "./cli-hvqbtna4.js";
 import"./cli-phre6gz0.js";
 import"./cli-eh1ytktb.js";
 import"./cli-txgcknmy.js";
@@ -564,11 +592,11 @@ import"./cli-7kyk9jr3.js";
 import {
   setBedrockProviderModule
 } from "./cli-61625k3x.js";
-import"./cli-btbzvq95.js";
 import"./cli-1m2e086m.js";
+import"./cli-btbzvq95.js";
 import"./cli-p7z6q2m6.js";
 import"./cli-wnb9b2g3.js";
-import"./cli-bd957dgb.js";
+import"./cli-f527ce74.js";
 import {
   import_websocket,
   import_websocket_server
@@ -577,7 +605,7 @@ import"./cli-pzxba7gw.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-qsztpfry.js";
+} from "./cli-74ahz61x.js";
 import {
   LEGACY_RULES,
   can,
@@ -586,10 +614,12 @@ import {
   init_rbac,
   isRbacEnabled,
   setAuditSink
-} from "./cli-7pz3b7x5.js";
+} from "./cli-przpmdgr.js";
 import {
   API_DRAINING_HEADER,
   CANDIDATE_SET_MULTIPLIER,
+  CHAT_SDK_ADAPTER_NAMES,
+  CHAT_TASK_ONLY_TOOLS,
   CODEX_AUTH_WATCH_NAMESPACE,
   CredentialBindingSchema,
   DB_RETENTION_TUNING_BOUNDS,
@@ -616,6 +646,7 @@ import {
   cancelTask,
   catalog_default,
   channelTopic,
+  chatThreadOfContextKey,
   checkoutPromptTemplate,
   claimKv,
   claimMentions,
@@ -705,7 +736,6 @@ import {
   getAllChannelActivityCursors,
   getAllLogs,
   getAllPricingRows,
-  getAllServices,
   getAllSessionCosts,
   getAllTasks,
   getAllUsers,
@@ -777,7 +807,6 @@ import {
   getScriptRunByIdempotencyKey,
   getScriptRunExecutionArgs,
   getScriptRunJournalStep,
-  getServicesByAgentId,
   getSessionCostSummary,
   getSessionCostsByAgentId,
   getSessionCostsByTaskId,
@@ -840,6 +869,7 @@ import {
   init_reranker,
   init_runtime,
   init_runtime_pools_flag,
+  init_schema,
   init_secret_registry,
   init_steering,
   init_swarm_config_guard,
@@ -856,6 +886,9 @@ import {
   installMcpServer,
   installSkill,
   internalConfigKeyError,
+  isAdapterEntryEnabled,
+  isApiOnlyConfigKey,
+  isChatSdkTask,
   isExtensionAgent,
   isFilledOrgLogoUrl,
   isInternalConfigKey,
@@ -988,9 +1021,10 @@ import {
   upsertSkillFiles,
   upsertSwarmConfig,
   validateConfigValue,
+  validateExportToEnv,
   withFavoriteFlags
-} from "./cli-tgpfnm6r.js";
-import"./cli-ywm1azg9.js";
+} from "./cli-ef1hg1wv.js";
+import"./cli-hnmhtzvh.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -1086,7 +1120,6 @@ import {
   ScriptRunStatusSchema,
   ScriptScopeSchema,
   ScriptVersionRecordSchema,
-  ServiceSchema,
   SessionCostModelBreakdownSchema,
   SessionCostSchema,
   SessionLogSchema,
@@ -1126,22 +1159,22 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-hsem16hb.js";
+} from "./cli-cgtksawx.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-nyhb1r6x.js";
-import {
-  init_steering_enabled,
-  isSteeringEnabled
-} from "./cli-7mm2r1kp.js";
+} from "./cli-s2sp957d.js";
 import {
   getSlackConfiguration,
   init_config
 } from "./cli-dmtrxqhg.js";
+import {
+  init_steering_enabled,
+  isSteeringEnabled
+} from "./cli-7mm2r1kp.js";
+import"./cli-5hkm7whv.js";
 import"./cli-mvzyxwg3.js";
-import"./cli-tadfgd0t.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -1168,10 +1201,7 @@ import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-a35hzdve.js";
-import {
-  init_src,
-  isAlias
-} from "./cli-014vns2y.js";
+import"./cli-stfs0k5s.js";
 import {
   exports_zod,
   init_zod
@@ -1185,20 +1215,24 @@ import {
   string,
   unknown
 } from "./cli-w5e1d1vv.js";
+import {
+  getNodeEnv,
+  init_node_env
+} from "./cli-p0sg24zp.js";
 import {
   init_package,
   package_default
-} from "./cli-esnpehf5.js";
+} from "./cli-k382tshb.js";
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-81r1wjyv.js";
+} from "./cli-9nfx44eh.js";
 import {
   init_bus,
   realtimeBus
 } from "./cli-zf8jjwex.js";
 import"./cli-h8w3fg83.js";
-import"./cli-db3m6zdt.js";
+import"./cli-d2qr7aj4.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   agentFsFileRoute,
@@ -1214,7 +1248,7 @@ import {
   parseEnvFlag
 } from "./cli-ej6gbxfb.js";
 import"./cli-1srmzpr3.js";
-import"./cli-0p3enk35.js";
+import"./cli-tqaazemc.js";
 import {
   getApiKey,
   init_api_key
@@ -1225,7 +1259,11 @@ import {
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
+import {
+  init_src,
+  isAlias
+} from "./cli-e3g5mbkz.js";
 import {
   __require,
   __toESM
@@ -7508,9 +7546,8 @@ init_request_auth_context();
 init_secret_scrubber();
 var MAX_ENV_PRESENCE_KEYS = 200;
 var SECRETS_FORCE_MASK_NOTE = " (secret values masked: this token cannot read secrets in this scope)";
-var API_ONLY_CONFIG_KEYS = new Set(["API_AGENT_FS_API_KEY", "SLACK_SIGNING_SECRET"]);
 function stripApiOnlyKeys(configs) {
-  return configs.filter((config) => !API_ONLY_CONFIG_KEYS.has(config.key) && !isInternalConfigKey(config.key));
+  return configs.filter((config) => !isApiOnlyConfigKey(config.key) && !isInternalConfigKey(config.key));
 }
 function singleHeader(req, name) {
   const raw = req.headers[name];
@@ -7552,6 +7589,9 @@ async function resolveSecretsRead(req, includeSecrets, resolvedScope) {
   };
 }
 async function ensureConfigAdmin(req, res, verb) {
+  return ensureHttpPermission(req, res, verb, verb === "config.write.any" ? "Writing swarm config requires the lead agent" : "Deleting swarm config requires the lead agent");
+}
+async function ensureHttpPermission(req, res, verb, forbiddenMessage) {
   const auth = getRequestAuth(req);
   if (auth?.kind === "operator" || auth?.kind === "user")
     return true;
@@ -7568,7 +7608,7 @@ async function ensureConfigAdmin(req, res, verb) {
     source: "http"
   });
   if (!decision.allow) {
-    jsonError(res, verb === "config.write.any" ? "Writing swarm config requires the lead agent" : "Deleting swarm config requires the lead agent", 403);
+    jsonError(res, forbiddenMessage, 403);
     return false;
   }
   return true;
@@ -7686,7 +7726,8 @@ var upsertConfig = route({
     value: exports_external.unknown(),
     isSecret: exports_external.boolean().optional(),
     envPath: exports_external.string().nullish(),
-    description: exports_external.string().nullish()
+    description: exports_external.string().nullish(),
+    exportToEnv: exports_external.boolean().optional().describe("Export this row into agent process env (default true on create, false for a few server-side secrets; omitted on update keeps the stored flag). Rejected as true for keys only the API server reads.")
   }),
   responses: {
     200: { description: "Config entry upserted", schema: SwarmConfigSchema },
@@ -7825,7 +7866,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       return true;
     if (!await ensureConfigAdmin(req, res, "config.write.any"))
       return true;
-    const { scope, scopeId, key, value, isSecret, envPath, description } = parsed.body;
+    const { scope, scopeId, key, value, isSecret, envPath, description, exportToEnv } = parsed.body;
     if (scope === "global" && scopeId) {
       jsonError(res, "Global scope must not have scopeId", 400);
       return true;
@@ -7842,7 +7883,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       jsonError(res, internalConfigKeyError(key).message, 400);
       return true;
     }
-    const validationError = validateConfigValue(key, value);
+    const validationError = validateConfigValue(key, value) ?? validateExportToEnv(key, exportToEnv);
     if (validationError) {
       jsonError(res, validationError, 400);
       return true;
@@ -7856,7 +7897,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
         value: String(value),
         isSecret: isSecret || false,
         envPath: envPath || null,
-        description: description || null
+        description: description || null,
+        exportToEnv
       });
       if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
         await fillOrgLogoFromWebsite(String(value));
@@ -8414,7 +8456,7 @@ async function sendReviewBatch(input, deps = {}) {
     const target = targets[index];
     const isRepair = index >= wonIds.length;
     if (reply.status === "rejected") {
-      console.warn(scrubSecrets(`[comb] sent reply failed comment=${target.id} task=${target.taskId}: ${errorMessage(reply.reason)}`));
+      console.warn(scrubSecrets(`[comb] sent reply failed comment=${target.id} task=${target.taskId}: ${errorMessage2(reply.reason)}`));
       if (isRepair)
         skipped.push(alreadySent(target.id, target.taskId));
     } else if (isRepair) {
@@ -8445,7 +8487,7 @@ async function readComment(agentFs, drive, versionOf, id) {
   } catch (error) {
     if (error instanceof FilesError && error.code === "NotFound")
       return { id, thread: null };
-    throw new ReviewBatchError(502, scrubSecrets(`agent-fs could not read comment ${id}: ${errorMessage(error)}`));
+    throw new ReviewBatchError(502, scrubSecrets(`agent-fs could not read comment ${id}: ${errorMessage2(error)}`));
   }
   const { comment } = thread;
   const version = comment.fileVersion ?? (comment.parentId ? undefined : await versionOf(comment));
@@ -8505,7 +8547,7 @@ async function settleClaims(ids, claim, next) {
   settled.forEach((result, index) => {
     if (result.status === "fulfilled" && result.value)
       return;
-    const why = result.status === "rejected" ? errorMessage(result.reason) : "another send holds the claim";
+    const why = result.status === "rejected" ? errorMessage2(result.reason) : "another send holds the claim";
     console.warn(scrubSecrets(`[comb] could not ${next ? "record" : "release"} the claim on comment=${ids[index]}: ${why}`));
   });
 }
@@ -8607,7 +8649,7 @@ async function requesterLabel(userId) {
     return "an operator (swarm API key)";
   return user.email ? `${user.name} <${user.email}>` : user.name;
 }
-function errorMessage(error) {
+function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -8814,64 +8856,6 @@ async function handleContext(req, res, pathSegments, queryParams, myAgentId) {
   return false;
 }
 
-// src/http/ecosystem.ts
-init_zod();
-init_db3();
-var EcosystemAppSchema = exports_external.object({
-  name: exports_external.string(),
-  script: exports_external.string(),
-  cwd: exports_external.string().optional(),
-  interpreter: exports_external.string().optional(),
-  args: exports_external.array(exports_external.string()).optional(),
-  env: exports_external.record(exports_external.string(), exports_external.string()).optional()
-});
-var getEcosystem = route({
-  method: "get",
-  path: "/ecosystem",
-  pattern: ["ecosystem"],
-  summary: "Get PM2 ecosystem config for agent services",
-  tags: ["Ecosystem"],
-  auth: { apiKey: true, agentId: true },
-  responses: {
-    200: {
-      description: "PM2 ecosystem config",
-      schema: exports_external.object({ apps: exports_external.array(EcosystemAppSchema) })
-    },
-    400: { description: "Missing X-Agent-ID" }
-  }
-});
-async function handleEcosystem(req, res, pathSegments, myAgentId) {
-  if (getEcosystem.match(req.method, pathSegments)) {
-    if (!myAgentId) {
-      jsonError(res, "Missing X-Agent-ID header", 400);
-      return true;
-    }
-    const services = await getServicesByAgentId(myAgentId);
-    const ecosystem = {
-      apps: services.filter((s) => s.script).map((s) => {
-        const app = {
-          name: s.name,
-          script: s.script
-        };
-        if (s.cwd)
-          app.cwd = s.cwd;
-        if (s.interpreter)
-          app.interpreter = s.interpreter;
-        if (s.args && s.args.length > 0)
-          app.args = s.args;
-        if (s.env && Object.keys(s.env).length > 0)
-          app.env = s.env;
-        if (s.port)
-          app.env = { ...app.env || {}, PORT: String(s.port) };
-        return app;
-      })
-    };
-    getEcosystem.respond(res, 200, ecosystem);
-    return true;
-  }
-  return false;
-}
-
 // src/http/events.ts
 init_zod();
 init_types();
@@ -9093,6 +9077,7 @@ declare module "swarm-extension" {
       | "linear"
       | "jira"
       | "comb"
+      | "chat"
       | undefined;
     routingReason?:
       | "skill"
@@ -9206,7 +9191,8 @@ declare module "swarm-extension" {
       | "system"
       | "linear"
       | "jira"
-      | "comb";
+      | "comb"
+      | "chat";
     tags: string[];
     priority: number;
     dependsOn: string[];
@@ -9265,6 +9251,7 @@ declare module "swarm-extension" {
     resolvedModel?: string | undefined;
     modelSource?: string | undefined;
     modelAlias?: string | undefined;
+    resolvedEffort?: "off" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
     scheduleId?: string | undefined;
     workflowRunId?: string | null | undefined;
     workflowRunStepId?: string | null | undefined;
@@ -9541,6 +9528,43 @@ declare module "swarm-extension" {
           kind: "broadcast";
         };
   }
+  /** A Chat SDK message after its thread buffer flushed, before routing. */
+  export interface ChatRouteEvent {
+    /** Adapter name, such as \`telegram\` or \`slack\`. */
+    adapter: string;
+    channelId: string;
+    /** The Chat SDK thread id, prefixed with the adapter name. */
+    threadId: string;
+    /** The first buffered sender. */
+    userId: string;
+    userName?: string;
+    /** The buffered messages, joined. */
+    text: string;
+    botMentioned: boolean;
+    isDirectMessage: boolean;
+    /** Set when earlier swarm tasks exist in this thread. */
+    threadContext?: {
+      adapter: string;
+      threadId: string;
+    };
+  }
+  export interface ChatRouteModify {
+    target:
+      | {
+          kind: "agent";
+          agentId: string;
+        }
+      | {
+          kind: "lead";
+        }
+      | {
+          kind: "broadcast";
+        }
+      | {
+          kind: "workflow";
+          workflowId: string;
+        };
+  }
   export type HeartbeatClassification = "no-session" | "stale-session" | "fresh-stalled";
   export type HeartbeatAction = "supersede-resume" | "fail" | "record";
   export interface HeartbeatRemediateEvent {
@@ -9585,6 +9609,18 @@ declare module "swarm-extension" {
     threadTs?: string;
     taskId?: string;
   }
+  /** A Chat SDK message the swarm received or sent. */
+  export interface ChatMessageEvent {
+    adapter: string;
+    channelId: string;
+    threadId: string;
+    /** The sender, for an inbound message. */
+    userId?: string;
+    text: string;
+    direction: "inbound" | "outbound";
+    taskId?: string;
+    messageId?: string;
+  }
   /**
    * A person answered an approval request. Fires for workflow and standalone
    * requests. Timeouts and cancellations do not emit it today.
@@ -9693,6 +9729,11 @@ declare module "swarm-extension" {
       modify: SlackRouteModify;
       result: PreResult<SlackRouteModify>;
     };
+    "pre.chat.route": {
+      event: ChatRouteEvent;
+      modify: ChatRouteModify;
+      result: PreResult<ChatRouteModify>;
+    };
     "pre.heartbeat.remediate": {
       event: HeartbeatRemediateEvent;
       modify: HeartbeatRemediateModify;
@@ -9738,6 +9779,11 @@ declare module "swarm-extension" {
       modify: never;
       result: void;
     };
+    "post.chat.message": {
+      event: ChatMessageEvent;
+      modify: never;
+      result: void;
+    };
     "post.approval.resolved": {
       event: ApprovalResolvedEvent;
       modify: never;
@@ -12794,6 +12840,203 @@ async function handleInboxState(req, res, pathSegments, queryParams) {
 
 // src/http/integrations.ts
 init_zod();
+
+// src/integrations/chat-sdk/status.ts
+init_zod();
+init_constants();
+init_env_flag();
+init_secret_scrubber();
+
+// src/integrations/chat-sdk/discord-api.ts
+init_secret_scrubber();
+var DISCORD_TIMEOUT_MS = 5000;
+var GUILDS_CACHE_MS = 60000;
+var MAX_GUILD_NAMES = 10;
+var cache;
+async function fetchDiscordGuilds(token, now = Date.now()) {
+  if (cache && cache.token === token && now - cache.at < GUILDS_CACHE_MS)
+    return cache.guilds;
+  let guilds;
+  try {
+    const response = await fetch(`${resolveAdapterApiUrl("discord")}/users/@me/guilds`, {
+      headers: { authorization: `Bot ${token}` },
+      signal: AbortSignal.timeout(DISCORD_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      throw new Error(`HTTP ${response.status}`);
+    const payload = await response.json();
+    if (!Array.isArray(payload))
+      throw new Error("unexpected response shape");
+    const names = payload.map((guild) => guild !== null && typeof guild === "object" && typeof guild.name === "string" ? guild.name : undefined).filter((name) => name !== undefined);
+    guilds = { count: payload.length, names: names.slice(0, MAX_GUILD_NAMES) };
+  } catch (error) {
+    console.warn(scrubSecrets(`[chat-sdk] discord: could not list the bot's servers: ${errorMessage(error).replaceAll(token, "[REDACTED]")}`));
+  }
+  cache = { token, at: now, guilds };
+  return guilds;
+}
+
+// src/integrations/chat-sdk/status.ts
+init_schema();
+var ChatSdkStatusSchema = exports_external.object({
+  enabled: exports_external.boolean(),
+  slackClash: exports_external.boolean(),
+  error: exports_external.string().optional(),
+  adapters: exports_external.array(exports_external.object({
+    name: exports_external.enum(CHAT_SDK_ADAPTER_NAMES),
+    configured: exports_external.boolean(),
+    enabled: exports_external.boolean(),
+    health: exports_external.enum(["ok", "error", "disabled", "incomplete"]),
+    error: exports_external.string().optional(),
+    webhookUrl: exports_external.string(),
+    mode: exports_external.string().optional(),
+    gateway: exports_external.object({
+      state: exports_external.enum(["running", "backoff", "stopped"]),
+      since: exports_external.string(),
+      restarts: exports_external.number()
+    }).optional(),
+    guilds: exports_external.object({ count: exports_external.number(), names: exports_external.array(exports_external.string()) }).optional()
+  }))
+});
+var DEFAULT_MODES = {
+  telegram: "webhook",
+  slack: "webhook"
+};
+var NOT_RUNNING = "The adapter is starting, or the last configuration save is still applying. Refresh in a few seconds.";
+var SLACK_CLASH_CAUSE = "the Slack adapter conflicts with the built-in Slack integration (set SLACK_DISABLE=true)";
+var MAX_STATUS_ERROR_CHARS = 300;
+function statusError(message) {
+  return scrubSecrets(message).slice(0, MAX_STATUS_ERROR_CHARS);
+}
+function readRawAdapters() {
+  const raw = process.env.CHAT_SDK_ADAPTERS?.trim();
+  if (!raw)
+    return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const out = {};
+    for (const name of CHAT_SDK_ADAPTER_NAMES) {
+      const value = parsed[name];
+      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        out[name] = value;
+      }
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function chatSdkWebhookUrl(name) {
+  return `${getPublicMcpBaseUrl()}/api/integrations/chat/${name}/webhook`;
+}
+async function discordGuildsFor(config, health) {
+  if (health?.status !== "ok" || health.gateway?.state !== "running")
+    return;
+  const raw = config.adapters.discord?.botToken;
+  const token = typeof raw === "function" ? await raw() : raw;
+  if (typeof token !== "string" || token.length === 0)
+    return;
+  return fetchDiscordGuilds(token);
+}
+async function getChatSdkStatus() {
+  const config = await getChatSdkConfig();
+  const raw = readRawAdapters();
+  const runtimeHealth = getChatSdkHealth();
+  const slackClash = raw.slack !== undefined && !isEnvFlagEnabled("SLACK_DISABLE", false);
+  const blockedCause = config.error ?? (config.enabled && slackClash ? SLACK_CLASH_CAUSE : undefined);
+  const discordGuilds = await discordGuildsFor(config, runtimeHealth.discord);
+  const adapters = CHAT_SDK_ADAPTER_NAMES.map((name) => {
+    const configured = raw[name] !== undefined;
+    const enabled = isAdapterEntryEnabled(raw[name]);
+    const current = runtimeHealth[name];
+    const incomplete = config.incomplete?.[name];
+    const rawMode = raw[name]?.mode;
+    const mode = typeof rawMode === "string" ? rawMode : configured ? DEFAULT_MODES[name] : undefined;
+    let health = "disabled";
+    let error;
+    if (current) {
+      health = current.status;
+      const showWarning = current.status === "error" || current.gateway?.state === "backoff";
+      error = current.error ?? (showWarning ? current.lastWarning : undefined);
+    } else if (incomplete) {
+      health = "incomplete";
+      error = incomplete;
+    } else if (configured && !enabled) {
+      error = "Turned off on the card. The configuration is kept.";
+    } else if (config.enabled && configured) {
+      error = blockedCause ? `Not started: ${blockedCause}` : NOT_RUNNING;
+    }
+    return {
+      name,
+      configured,
+      enabled,
+      health,
+      ...error ? { error: statusError(error) } : {},
+      webhookUrl: chatSdkWebhookUrl(name),
+      ...mode ? { mode } : {},
+      ...current?.gateway ? { gateway: current.gateway } : {},
+      ...name === "discord" && discordGuilds ? { guilds: discordGuilds } : {}
+    };
+  });
+  return {
+    enabled: config.enabled,
+    slackClash,
+    ...config.error ? { error: statusError(config.error) } : {},
+    adapters
+  };
+}
+
+class ChatSdkActionError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "ChatSdkActionError";
+  }
+}
+async function callBotApi(baseUrl, token, method, body) {
+  try {
+    return await callTelegramBotApi(baseUrl, token, method, body);
+  } catch (error) {
+    if (error instanceof TelegramBotApiError)
+      throw new ChatSdkActionError(error.message, 502);
+    throw error;
+  }
+}
+async function registerTelegramWebhook() {
+  const config = await getChatSdkConfig();
+  if (!config.enabled) {
+    throw new ChatSdkActionError("The Chat SDK channel is disabled (CHAT_SDK_ENABLED is not true). Enable it and restart the API first", 400);
+  }
+  if (config.error)
+    throw new ChatSdkActionError(statusError(config.error), 400);
+  const telegram = config.adapters.telegram;
+  if (!telegram) {
+    throw new ChatSdkActionError("Telegram is not configured in CHAT_SDK_ADAPTERS", 400);
+  }
+  if (telegram.mode !== "webhook") {
+    throw new ChatSdkActionError("Telegram runs in polling mode; a registered webhook would stop polling", 400);
+  }
+  const secretToken = telegram.secretToken;
+  if (typeof secretToken !== "string" || secretToken.length === 0) {
+    throw new ChatSdkActionError("Telegram webhook mode needs a secretToken", 400);
+  }
+  const rawToken = telegram.botToken;
+  const token = typeof rawToken === "function" ? await rawToken() : rawToken;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new ChatSdkActionError("Telegram botToken is empty", 400);
+  }
+  const baseUrl = resolveAdapterApiUrl("telegram");
+  const webhookUrl = chatSdkWebhookUrl("telegram");
+  await callBotApi(baseUrl, token, "setWebhook", { url: webhookUrl, secret_token: secretToken });
+  const info = await callBotApi(baseUrl, token, "getWebhookInfo", {});
+  if (info === null || typeof info !== "object" || typeof info.url !== "string") {
+    throw new ChatSdkActionError("Telegram getWebhookInfo returned an unexpected result", 502);
+  }
+  return { webhookUrl, webhookInfo: info };
+}
 // slack-manifest.json
 var slack_manifest_default = {
   display_information: {
@@ -12863,6 +13106,8 @@ var slack_manifest_default = {
         "app_mentions:read",
         "assistant:write",
         "channels:history",
+        "channels:join",
+        "channels:manage",
         "channels:read",
         "chat:write",
         "chat:write.customize",
@@ -12872,6 +13117,7 @@ var slack_manifest_default = {
         "files:write",
         "groups:history",
         "groups:read",
+        "groups:write",
         "im:history",
         "im:read",
         "im:write",
@@ -12893,7 +13139,10 @@ var slack_manifest_default = {
         "message.groups",
         "message.im",
         "message.mpim",
-        "assistant_thread_started"
+        "assistant_thread_started",
+        "member_joined_channel",
+        "channel_shared",
+        "channel_unshared"
       ]
     },
     interactivity: {
@@ -12963,6 +13212,19 @@ var McpUserConfigSchema = exports_external.object({
   mcpUserUrl: exports_external.string()
 });
 var SlackManifestSchema = exports_external.record(exports_external.string(), exports_external.unknown());
+var TelegramRegisterWebhookSchema = exports_external.object({
+  webhookUrl: exports_external.string(),
+  webhookInfo: exports_external.looseObject({
+    url: exports_external.string(),
+    has_custom_certificate: exports_external.boolean().optional(),
+    pending_update_count: exports_external.number().optional(),
+    last_error_date: exports_external.number().optional(),
+    last_error_message: exports_external.string().optional(),
+    max_connections: exports_external.number().optional(),
+    ip_address: exports_external.string().optional(),
+    allowed_updates: exports_external.array(exports_external.string()).optional()
+  })
+});
 var claudeManagedTestRoute = route({
   method: "post",
   path: "/api/integrations/claude-managed/test",
@@ -13001,6 +13263,34 @@ var slackManifestRoute = route({
     200: { description: "Slack app manifest", schema: SlackManifestSchema }
   }
 });
+var chatSdkStatusRoute = route({
+  method: "get",
+  path: "/api/integrations/chat/status",
+  pattern: ["api", "integrations", "chat", "status"],
+  summary: "Chat SDK channel status: enabled flag, Slack clash, per-adapter health and webhook URL.",
+  tags: ["Integrations"],
+  responses: {
+    200: {
+      description: "Per-adapter status. `health` is `disabled` for an adapter that is not running. Never contains secret values.",
+      schema: ChatSdkStatusSchema
+    }
+  }
+});
+var chatSdkTelegramRegisterWebhookRoute = route({
+  method: "post",
+  path: "/api/integrations/chat/telegram/register-webhook",
+  pattern: ["api", "integrations", "chat", "telegram", "register-webhook"],
+  summary: "Register this swarm's public Telegram webhook URL and secret token with the Bot API (setWebhook), then return getWebhookInfo.",
+  tags: ["Integrations"],
+  body: exports_external.object({}).optional(),
+  responses: {
+    200: { description: "Webhook registered", schema: TelegramRegisterWebhookSchema },
+    400: { description: "Telegram is not configured for webhook mode" },
+    403: { description: "Only the lead agent or a dashboard user can register the webhook" },
+    502: { description: "The Telegram Bot API rejected the call" }
+  },
+  rbac: { permission: "integration.chat.manage" }
+});
 function createIntegrationsHandler(deps = {}) {
   const buildClient = deps.buildClient ?? ((apiKey) => new Anthropic({ apiKey }));
   return async function handleIntegrations(req, res, pathSegments, queryParams = new URLSearchParams) {
@@ -13011,6 +13301,26 @@ function createIntegrationsHandler(deps = {}) {
       slackManifestRoute.respond(res, 200, buildSlackManifest(parsed.query.name));
       return true;
     }
+    if (chatSdkStatusRoute.match(req.method, pathSegments)) {
+      chatSdkStatusRoute.respond(res, 200, await getChatSdkStatus());
+      return true;
+    }
+    if (chatSdkTelegramRegisterWebhookRoute.match(req.method, pathSegments)) {
+      const parsed = await chatSdkTelegramRegisterWebhookRoute.parse(req, res, pathSegments, queryParams);
+      if (!parsed)
+        return true;
+      if (!await ensureHttpPermission(req, res, "integration.chat.manage", "Registering the Telegram webhook requires the lead agent")) {
+        return true;
+      }
+      try {
+        chatSdkTelegramRegisterWebhookRoute.respond(res, 200, await registerTelegramWebhook());
+      } catch (error) {
+        if (!(error instanceof ChatSdkActionError))
+          throw error;
+        jsonError(res, error.message, error.status);
+      }
+      return true;
+    }
     if (mcpUserConfigRoute.match(req.method, pathSegments)) {
       const mcpBaseUrl = await resolveMcpBaseUrl();
       mcpUserConfigRoute.respond(res, 200, { mcpBaseUrl, mcpUserUrl: `${mcpBaseUrl}/mcp-user` });
@@ -13642,7 +13952,7 @@ var toRequestError = (e) => {
   return new RequestError(e.message, { cause: e });
 };
 var GlobalRequest = global.Request;
-var Request = class extends GlobalRequest {
+var Request2 = class extends GlobalRequest {
   constructor(input, options) {
     if (typeof input === "object" && getRequestCache in input) {
       input = input[getRequestCache]();
@@ -13673,7 +13983,7 @@ var newRequestFromIncoming = (method, url, headers2, incoming, abortController)
   };
   if (method === "TRACE") {
     init.method = "GET";
-    const req = new Request(url, init);
+    const req = new Request2(url, init);
     Object.defineProperty(req, "method", {
       get() {
         return "TRACE";
@@ -13710,7 +14020,7 @@ var newRequestFromIncoming = (method, url, headers2, incoming, abortController)
       init.body = Readable.toWeb(incoming);
     }
   }
-  return new Request(url, init);
+  return new Request2(url, init);
 };
 var getRequestCache = Symbol("getRequestCache");
 var requestCache = Symbol("requestCache");
@@ -13776,7 +14086,7 @@ Object.defineProperty(requestPrototype, Symbol.for("nodejs.util.inspect.custom")
     return `Request (lightweight) ${inspectFn(props, { ...options, depth: depth == null ? null : depth - 1 })}`;
   }
 });
-Object.setPrototypeOf(requestPrototype, Request.prototype);
+Object.setPrototypeOf(requestPrototype, Request2.prototype);
 var newRequest = (incoming, defaultHostname) => {
   const req = Object.create(requestPrototype);
   req[incomingKey] = incoming;
@@ -13845,12 +14155,12 @@ var Response2 = class _Response {
     }
   }
   get headers() {
-    const cache = this[cacheKey];
-    if (cache) {
-      if (!(cache[2] instanceof Headers)) {
-        cache[2] = new Headers(cache[2] || { "content-type": "text/plain; charset=UTF-8" });
+    const cache2 = this[cacheKey];
+    if (cache2) {
+      if (!(cache2[2] instanceof Headers)) {
+        cache2[2] = new Headers(cache2[2] || { "content-type": "text/plain; charset=UTF-8" });
       }
-      return cache[2];
+      return cache2[2];
     }
     return this[getResponseCache]().headers;
   }
@@ -14138,9 +14448,9 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
 };
 var getRequestListener = (fetchCallback, options = {}) => {
   const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
-  if (options.overrideGlobalObjects !== false && global.Request !== Request) {
+  if (options.overrideGlobalObjects !== false && global.Request !== Request2) {
     Object.defineProperty(global, "Request", {
-      value: Request
+      value: Request2
     });
     Object.defineProperty(global, "Response", {
       value: Response2
@@ -15180,13 +15490,14 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
       const configValue = configs.find((config) => config.key === "SCRIPTS_ONLY_MCP")?.value;
       const preloadEnabled = parseEnvFlag(configs.find((config) => config.key === "TASK_TOOL_PRELOAD_ENABLED")?.value ?? process.env.TASK_TOOL_PRELOAD_ENABLED, true);
       let preloadedTools = [];
+      const sourceTaskId = headerValue(req.headers["x-source-task-id"]);
+      const sourceTask = sourceTaskId ? await getTaskById(sourceTaskId) : undefined;
+      const excludedTools = sourceTask && !isChatSdkTask(sourceTask) ? [...CHAT_TASK_ONLY_TOOLS] : [];
       if (preloadEnabled) {
-        const taskId = headerValue(req.headers["x-source-task-id"]);
-        const task = taskId ? await getTaskById(taskId) : undefined;
-        if (task?.agentId === agentId) {
+        if (sourceTask?.agentId === agentId) {
           const manifestValue = configs.find((config) => config.key === "TASK_TOOL_MANIFESTS")?.value ?? process.env.TASK_TOOL_MANIFESTS ?? "{}";
           try {
-            preloadedTools = selectTaskTools(parseTaskToolManifest(manifestValue), task);
+            preloadedTools = selectTaskTools(parseTaskToolManifest(manifestValue), sourceTask);
           } catch {
             console.warn("[MCP] Invalid TASK_TOOL_MANIFESTS; using ordinary tool discovery");
           }
@@ -15194,6 +15505,7 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
       }
       const server = await createServer({
         preloadedTools,
+        excludedTools,
         enabledTools: configs.find((config) => config.key === "SWARM_ENABLED_TOOLS")?.value ?? process.env.SWARM_ENABLED_TOOLS,
         scriptsOnly: resolveScriptsOnlyMode({
           env: process.env.SCRIPTS_ONLY_MCP,
@@ -15226,13 +15538,6 @@ init_zod();
 init_db3();
 init_types();
 init_constants();
-init_env_flag();
-function ssrfOptions() {
-  return {
-    allowPrivateHosts: isEnvFlagEnabled("MCP_OAUTH_ALLOW_PRIVATE_HOSTS", false),
-    allowInsecure: true
-  };
-}
 function callbackRedirectUri() {
   return `${getPublicMcpBaseUrl()}/api/mcp-oauth/callback`;
 }
@@ -15296,11 +15601,11 @@ function scopesAreCovered(requested, registered) {
 function manualClientFromToken(token) {
   if (!token || token.clientSource !== "manual" || !token.dcrClientId)
     return null;
-  assertUrlSafe(token.resourceUrl, ssrfOptions());
-  assertUrlSafe(token.authorizeUrl, ssrfOptions());
-  assertUrlSafe(token.tokenUrl, ssrfOptions());
+  assertUrlSafe(token.resourceUrl, mcpOAuthSsrfOptions());
+  assertUrlSafe(token.authorizeUrl, mcpOAuthSsrfOptions());
+  assertUrlSafe(token.tokenUrl, mcpOAuthSsrfOptions());
   if (token.revocationUrl)
-    assertUrlSafe(token.revocationUrl, ssrfOptions());
+    assertUrlSafe(token.revocationUrl, mcpOAuthSsrfOptions());
   return {
     clientId: token.dcrClientId,
     clientSecret: token.dcrClientSecret,
@@ -15314,7 +15619,7 @@ function manualClientFromToken(token) {
   };
 }
 async function discoverForMcp(resourceUrl) {
-  assertUrlSafe(resourceUrl, ssrfOptions());
+  assertUrlSafe(resourceUrl, mcpOAuthSsrfOptions());
   const prmd = await discoverProtectedResourceMetadata(resourceUrl);
   if (!prmd)
     return null;
@@ -20482,6 +20787,7 @@ init_resolver();
 init_session_templates();
 init_types();
 init_constants();
+init_node_env();
 init_request_auth_context();
 
 // src/http/tasks.ts
@@ -20490,9 +20796,47 @@ init_db3();
 init_steering();
 init_users();
 init_rbac();
+init_context_key();
 init_types();
 init_request_auth_context();
 init_secret_scrubber();
+
+// src/http/requested-by.ts
+init_zod();
+init_db3();
+init_types();
+var TaskRequestedBySchema = UserSchema.pick({
+  id: true,
+  name: true,
+  email: true,
+  role: true,
+  notes: true
+}).extend({
+  id: exports_external.string().optional(),
+  comms: UserCommsPrefsSchema.optional()
+});
+function getRequesterNotes(notes) {
+  return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
+}
+async function buildTaskRequestedBy(task) {
+  const user = task.requestedByUserId ? await getUserById(task.requestedByUserId) : undefined;
+  if (user) {
+    return {
+      id: user.id,
+      name: user.name,
+      email: user.email,
+      role: user.role,
+      notes: getRequesterNotes(user.notes),
+      comms: getUserCommsPrefs(user)
+    };
+  }
+  if (task.slackUserId) {
+    return { name: renderIdentity(await resolveIdentity("slack", task.slackUserId)) };
+  }
+  return;
+}
+
+// src/http/tasks.ts
 var AgentTaskSummarySchema = AgentTaskSchema.pick({
   id: true,
   key: true,
@@ -20516,6 +20860,7 @@ var AgentTaskSummarySchema = AgentTaskSchema.pick({
   modelSource: true,
   modelAlias: true,
   effort: true,
+  resolvedEffort: true,
   provider: true,
   requestedByUserId: true,
   progress: true,
@@ -20659,6 +21004,9 @@ var createTask = route({
     400: {
       description: "Validation error, an unknown `model` (set `allowCustomModel` to store a custom id), or agentId/offeredTo targets an extension identity"
     },
+    403: {
+      description: "An agent caller names a parentTaskId it neither owns nor created, or a non-lead agent binds the task to a chat thread"
+    },
     422: {
       description: "Task creation blocked by an extension",
       schema: exports_external.object({
@@ -20705,6 +21053,7 @@ var updateSession = route({
       claudeSessionId: exports_external.string().min(1),
       provider: ProviderNameSchema.exclude(["devin"]).optional(),
       model: exports_external.string().optional(),
+      effort: ReasoningEffortSchema.nullable().optional(),
       providerMeta: exports_external.object({ transport: exports_external.enum(["cli", "sdk"]).optional() }).optional(),
       harnessVariant: exports_external.string().optional(),
       harnessVariantMeta: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
@@ -20919,7 +21268,10 @@ var listPausedTasks = route({
     200: {
       description: "Paused task list",
       schema: exports_external.object({
-        tasks: exports_external.array(AgentTaskSchema.extend({ attachments: exports_external.array(TaskAttachmentSchema) }))
+        tasks: exports_external.array(AgentTaskSchema.extend({
+          attachments: exports_external.array(TaskAttachmentSchema),
+          requestedBy: TaskRequestedBySchema.optional()
+        }))
       })
     }
   }
@@ -21179,6 +21531,26 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     const parentTask = parsed.body.parentTaskId ? await getTaskById(parsed.body.parentTaskId) : null;
+    const principal = await resolveTaskWritePrincipal(req, myAgentId);
+    if (parentTask && !can({
+      principal,
+      verb: "task.parent.attach",
+      resource: {
+        kind: "task",
+        taskId: parentTask.id,
+        requestedByUserId: parentTask.requestedByUserId,
+        creatorAgentId: parentTask.creatorAgentId,
+        agentId: parentTask.agentId
+      },
+      source: "http"
+    }).allow) {
+      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
+      return true;
+    }
+    if (principal.kind === "agent" && parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" }).allow) {
+      jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
+      return true;
+    }
     let assetKey;
     try {
       const inheritedKey = parentTask?.key;
@@ -21273,7 +21645,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await updateSession.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const task = await updateTaskClaudeSessionId(parsed.params.id, parsed.body.claudeSessionId, parsed.body.provider, parsed.body.providerMeta, parsed.body.model, "harnessVariant" in parsed.body ? parsed.body.harnessVariant : undefined, "harnessVariantMeta" in parsed.body ? parsed.body.harnessVariantMeta : undefined);
+    const task = await updateTaskClaudeSessionId(parsed.params.id, parsed.body.claudeSessionId, parsed.body.provider, parsed.body.providerMeta, parsed.body.model, "harnessVariant" in parsed.body ? parsed.body.harnessVariant : undefined, "harnessVariantMeta" in parsed.body ? parsed.body.harnessVariantMeta : undefined, "effort" in parsed.body ? parsed.body.effort : undefined);
     if (!task) {
       jsonError(res, "Task not found", 404);
       return true;
@@ -21713,10 +22085,14 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     const pausedTasks = await getPausedTasksForAgent(myAgentId);
-    const tasks = await Promise.all(pausedTasks.map(async (task) => ({
-      ...task,
-      attachments: await getTaskAttachments(task.id)
-    })));
+    const tasks = await Promise.all(pausedTasks.map(async (task) => {
+      const requestedBy = await buildTaskRequestedBy(task);
+      return {
+        ...task,
+        attachments: await getTaskAttachments(task.id),
+        ...requestedBy && { requestedBy }
+      };
+    }));
     listPausedTasks.respond(res, 200, { tasks });
     return true;
   }
@@ -22222,10 +22598,6 @@ function withShareUrls(page) {
     app_url: `${getAppBaseUrl()}/pages/${page.slug}`
   };
 }
-async function pageEditCounter(pageId) {
-  const versions = await getPageVersions(pageId);
-  return versions.length > 0 ? versions[0].version + 1 : 1;
-}
 function defuseFeedbackTags(value) {
   return value.replace(/<(\/?page_feedback)/gi, "‹$1");
 }
@@ -22260,8 +22632,8 @@ function formatFeedbackComments(comments) {
 `);
 }
 function isDevRequest(req) {
-  if (false)
-    ;
+  if (getNodeEnv() === "production")
+    return false;
   const origin = req.headers.origin ?? "";
   return origin === "" || origin.startsWith("http://localhost") || origin.startsWith("http://127.0.0.1");
 }
@@ -22499,7 +22871,7 @@ async function handlePages(req, res, pathSegments, queryParams, myAgentId) {
     updatePageRoute.respond(res, 200, {
       id: updated.id,
       key: updated.key,
-      version: await pageEditCounter(updated.id)
+      version: await getPageEditCounter(updated.id)
     });
     return true;
   }
@@ -22621,8 +22993,819 @@ ${defuseFeedbackTags(note)}
 
 // src/http/pages-public.ts
 init_zod();
+init_db3();
 
-// src/artifact-sdk/feedback-overlay.ts
+// src/pages/browser-sdk.ts
+var BROWSER_SDK_JS = `
+class SwarmSDK {
+  constructor() {
+    let realtime;
+    const loadRealtime = () => realtime || (realtime = import('/@swarm/realtime.js'));
+    this.room = async (name, options) => (await loadRealtime()).room(name, options);
+    this.channel = async (name) => (await loadRealtime()).channel(name);
+
+    const base = '/@swarm/api';
+    const call = async (method, path, body) => {
+      const init = { method };
+      if (body !== undefined) {
+        init.headers = { 'Content-Type': 'application/json' };
+        init.body = JSON.stringify(body);
+      }
+      const res = await fetch(base + path, init);
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try { parsed = JSON.parse(text); } catch { parsed = text; }
+      }
+      if (!res.ok) {
+        const err = new Error('SwarmSDK ' + method + ' ' + path + ': ' + res.status);
+        err.status = res.status;
+        err.response = parsed;
+        throw err;
+      }
+      return parsed;
+    };
+    const qs = (obj) => {
+      if (!obj) return '';
+      const p = new URLSearchParams();
+      for (const [k, v] of Object.entries(obj)) {
+        if (v === undefined || v === null) continue;
+        p.set(k, String(v));
+      }
+      const s = p.toString();
+      return s ? '?' + s : '';
+    };
+    const enc = encodeURIComponent;
+
+    this.tasks = {
+      create: (body) => call('POST', '/tasks', body),
+      list: (filters) => call('GET', '/tasks' + qs(filters)),
+      get: (id) => call('GET', '/tasks/' + enc(id)),
+      storeProgress: (id, data) => call('POST', '/tasks/' + enc(id) + '/progress', data),
+    };
+
+    this.agents = {
+      list: () => call('GET', '/agents'),
+      get: (id) => call('GET', '/agents/' + enc(id)),
+    };
+
+    this.events = {
+      create: (body) => call('POST', '/events', body),
+      list: (filters) => call('GET', '/events' + qs(filters)),
+      batch: (body) => call('POST', '/events/batch', body),
+      counts: (filters) => call('GET', '/events/counts' + qs(filters)),
+    };
+
+    this.memory = {
+      search: (body) => call('POST', '/memory/search', body),
+      list: (filters) => call('GET', '/memory/list' + qs(filters)),
+      get: (id) => call('GET', '/memory/' + enc(id)),
+      rate: (body) => call('POST', '/memory/rate', body),
+    };
+
+    this.repos = {
+      list: () => call('GET', '/repos'),
+      get: (id) => call('GET', '/repos/' + enc(id)),
+      create: (body) => call('POST', '/repos', body),
+      update: (id, body) => call('PUT', '/repos/' + enc(id), body),
+      delete: (id) => call('DELETE', '/repos/' + enc(id)),
+    };
+
+    this.schedules = {
+      list: () => call('GET', '/schedules'),
+      get: (id) => call('GET', '/schedules/' + enc(id)),
+      create: (body) => call('POST', '/schedules', body),
+      update: (id, body) => call('PUT', '/schedules/' + enc(id), body),
+      delete: (id) => call('DELETE', '/schedules/' + enc(id)),
+      run: (id) => call('POST', '/schedules/' + enc(id) + '/run'),
+    };
+
+    this.approvalRequests = {
+      list: (filters) => call('GET', '/approval-requests' + qs(filters)),
+      get: (id) => call('GET', '/approval-requests/' + enc(id)),
+      create: (body) => call('POST', '/approval-requests', body),
+      respond: (id, body) => call('POST', '/approval-requests/' + enc(id) + '/respond', body),
+    };
+
+    this.assets = {
+      list: (filters) => call('GET', '/assets' + qs(filters)),
+      audit: () => call('GET', '/assets/key-audit'),
+      registerMapping: (body) => call('POST', '/assets/mappings', body),
+      move: (entityType, id, key) => call(
+        'PATCH',
+        '/assets/' + enc(entityType) + '/' + enc(id) + '/key',
+        { key },
+      ),
+    };
+
+    // KV store. The namespace is FORCED by the page-proxy to \`task:page:<id>\`
+    // (it injects X-Page-Id which the kv handler treats as highest priority).
+    // No namespace argument is exposed — pages cannot read/write any other
+    // namespace via this SDK.
+    this.kv = {
+      get: (key) => call('GET', '/kv/' + enc(key)),
+      set: (key, value, opts) => call('PUT', '/kv/' + enc(key), {
+        value,
+        valueType: opts && opts.valueType,
+        expiresInSec: opts && opts.expiresInSec,
+      }),
+      del: (key) => call('DELETE', '/kv/' + enc(key)),
+      incr: (key, by) => call('POST', '/kv/' + enc(key) + '/incr', { by: by == null ? 1 : by }),
+      list: (opts) => call('GET', '/kv' + qs(opts)),
+    };
+  }
+}
+
+// Expose BOTH the class (for \`new SwarmSDK()\`) AND a ready-to-use singleton
+// on \`window.swarmSdk\` so pages can call e.g. \`window.swarmSdk.agents.list()\`
+// directly without instantiating.
+window.SwarmSDK = SwarmSDK;
+window.swarmSdk = new SwarmSDK();
+`;
+var SWARM_UI_JS = `
+(function() {
+  if (typeof window === 'undefined' || !window.customElements) return;
+  if (window.customElements.get('swarm-diff')) return;
+
+  // Keep page-owned presence fields alongside the cursor. Room.presence.set
+  // replaces its payload, so retain each room's latest page data and merge
+  // the reserved __cursor field into it when the cursor moves.
+  var roomPresenceTrackers = new WeakMap();
+
+  function clonePresenceRecord(data) {
+    return data && typeof data === 'object' && !Array.isArray(data)
+      ? structuredClone(data)
+      : {};
+  }
+
+  function mergeCursorPresence(data, cursor) {
+    var merged = clonePresenceRecord(data);
+    if (cursor) merged.__cursor = { x: cursor.x, y: cursor.y };
+    else delete merged.__cursor;
+    return merged;
+  }
+
+  function trackRoomPresence(room) {
+    if (!room || !room.presence || typeof room.presence.set !== 'function') return null;
+    var existing = roomPresenceTrackers.get(room);
+    if (existing) return existing;
+
+    var presence = room.presence;
+    var originalSet = presence.set;
+    var pageData = {};
+    var cursor = null;
+    var tracker = {
+      setCursor: function(nextCursor) {
+        cursor = nextCursor;
+        return originalSet.call(presence, mergeCursorPresence(pageData, cursor));
+      },
+      clearCursor: function() {
+        if (!cursor) return;
+        return tracker.setCursor(null);
+      },
+    };
+
+    presence.set = function(data) {
+      pageData = clonePresenceRecord(data);
+      return originalSet.call(presence, cursor ? mergeCursorPresence(pageData, cursor) : data);
+    };
+    roomPresenceTrackers.set(room, tracker);
+    return tracker;
+  }
+
+  // Wrap room creation before page scripts run so presence.set calls made by
+  // page code are tracked even when they happen before <swarm-cursors> connects.
+  var cursorRoomRecords = new Map();
+  var sdkRoomMethods = new WeakMap();
+  var observedRoomClosers = new WeakSet();
+  var originalRoom = null;
+  function roomRecordKey(name) {
+    return name === undefined ? 'default' : name;
+  }
+
+  function observeRoom(record, room) {
+    record.hasResolvedRoom = true;
+    if (!cursorRoomRecords.has(record.name)) cursorRoomRecords.set(record.name, record);
+    trackRoomPresence(room);
+    if (room && typeof room.close === 'function' && !observedRoomClosers.has(room)) {
+      var originalClose = room.close;
+      room.close = function() {
+        if (cursorRoomRecords.get(record.name) === record) cursorRoomRecords.delete(record.name);
+        return originalClose.apply(room, arguments);
+      };
+      observedRoomClosers.add(room);
+    }
+    return room;
+  }
+
+  function observeRoomPromise(record, result) {
+    var observed = Promise.resolve(result).then(function(room) {
+      var resolvedRoom = observeRoom(record, room);
+      record.pageRequests--;
+      record.hasPageUse = true;
+      record.pageUsed = true;
+      record.promise = Promise.resolve(resolvedRoom);
+      return resolvedRoom;
+    }).catch(function(error) {
+      record.pageRequests--;
+      record.pageUsed = record.hasPageUse || record.pageRequests > 0;
+      if (!record.hasResolvedRoom
+        && record.pageRequests === 0
+        && cursorRoomRecords.get(record.name) === record)
+        cursorRoomRecords.delete(record.name);
+      if (record.cursorRefs === 0 && record.openedByCursor && !record.pageUsed)
+        closeCursorRoomIfUnused(record);
+      throw error;
+    });
+    record.pageRequests++;
+    record.pageUsed = true;
+    if (!record.promise) record.promise = observed;
+    return observed;
+  }
+
+  function closeCursorRoomIfUnused(record) {
+    if (record.closing || record.cursorRefs || !record.openedByCursor || record.pageUsed) return;
+    record.closing = true;
+    record.promise.then(function(room) {
+      if (record.cursorRefs || record.pageUsed) {
+        record.closing = false;
+        return;
+      }
+      if (cursorRoomRecords.get(record.name) === record) cursorRoomRecords.delete(record.name);
+      if (room && typeof room.close === 'function') return room.close();
+    }).catch(function() {
+      record.closing = false;
+    });
+  }
+
+  function instrumentSdk(sdk) {
+    if (!sdk || typeof sdk.room !== 'function') return null;
+    var existing = sdkRoomMethods.get(sdk);
+    if (existing) return existing;
+
+    var sdkOriginalRoom = sdk.room;
+    var wrappedRoom = function(name, options) {
+      var key = roomRecordKey(name);
+      var record = cursorRoomRecords.get(key);
+      var result = sdkOriginalRoom.call(sdk, name, options);
+      if (!record) {
+        record = {
+          name: key,
+          cursorRefs: 0,
+          openedByCursor: false,
+          pageUsed: false,
+          hasPageUse: false,
+          pageRequests: 0,
+          hasResolvedRoom: false,
+          promise: null,
+        };
+        cursorRoomRecords.set(key, record);
+      }
+      return observeRoomPromise(record, result);
+    };
+    sdk.room = wrappedRoom;
+    var methods = { original: sdkOriginalRoom, wrapped: wrappedRoom };
+    sdkRoomMethods.set(sdk, methods);
+    return methods;
+  }
+
+  if (window.swarmSdk) {
+    var singletonRoomMethods = instrumentSdk(window.swarmSdk);
+    originalRoom = singletonRoomMethods && singletonRoomMethods.original;
+  }
+  if (typeof window.SwarmSDK === 'function') {
+    var OriginalSwarmSDK = window.SwarmSDK;
+    window.SwarmSDK = new Proxy(OriginalSwarmSDK, {
+      construct: function(target, args, newTarget) {
+        var sdk = Reflect.construct(target, args, newTarget);
+        instrumentSdk(sdk);
+        return sdk;
+      },
+    });
+  }
+
+  function acquireCursorRoom(name, options) {
+    var key = roomRecordKey(name);
+    var record = cursorRoomRecords.get(key);
+    if (record) {
+      record.cursorRefs++;
+      return { record: record, promise: record.promise };
+    }
+
+    record = {
+      name: key,
+      cursorRefs: 1,
+      openedByCursor: true,
+      pageUsed: false,
+      hasPageUse: false,
+      pageRequests: 0,
+      hasResolvedRoom: false,
+      closing: false,
+      promise: null,
+    };
+    cursorRoomRecords.set(key, record);
+    record.promise = Promise.resolve().then(function() {
+      return originalRoom(name, options);
+    }).then(function(room) {
+      return observeRoom(record, room);
+    }).catch(function(error) {
+      if (cursorRoomRecords.get(key) === record) cursorRoomRecords.delete(key);
+      throw error;
+    });
+    return { record: record, promise: record.promise };
+  }
+
+  function releaseCursorRoom(record, presence) {
+    if (!record || record.cursorRefs < 1) return;
+    if (record.cursorRefs === 1 && presence) presence.clearCursor();
+    record.cursorRefs--;
+    closeCursorRoomIfUnused(record);
+  }
+
+  var SEV_COLOR = {
+    error: '#ef4444',
+    warn:  '#f59e0b',
+    info:  '#3b82f6',
+  };
+
+  function esc(s) {
+    return String(s == null ? '' : s)
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
+  }
+
+  function slugifyAttr(s) {
+    return String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  }
+
+  function parseHunks(jsonText) {
+    var trimmed = (jsonText || '').trim();
+    if (!trimmed) return [];
+    try {
+      var parsed = JSON.parse(trimmed);
+      if (parsed && Array.isArray(parsed.hunks)) return parsed.hunks;
+      if (Array.isArray(parsed)) return parsed;
+      return [];
+    } catch (e) {
+      console.warn('[swarm-diff] failed to parse JSON body:', e);
+      return [];
+    }
+  }
+
+  function renderAnnotation(ann) {
+    var color = SEV_COLOR[ann && ann.severity] || SEV_COLOR.info;
+    return (
+      '<span class="swarm-diff-annot no-print" '
+      + 'style="display:inline-block;margin-left:8px;padding:1px 6px;'
+      + 'border-radius:4px;font-size:11px;font-weight:600;'
+      + 'background:' + color + '22;color:' + color + ';border:1px solid ' + color + '55;">'
+      + esc((ann && ann.severity ? ann.severity.toUpperCase() : 'INFO')) + ' · ' + esc(ann && ann.text || '')
+      + '</span>'
+    );
+  }
+
+  function renderHunk(hunk, hunkIdx, file) {
+    var oldLines = hunk.old_lines || 0;
+    var newLines = hunk.new_lines || 0;
+    var oldStart = hunk.old_start || 0;
+    var newStart = hunk.new_start || 0;
+    var lines = Array.isArray(hunk.lines) ? hunk.lines : [];
+    var annotations = Array.isArray(hunk.annotations) ? hunk.annotations : [];
+    // Index annotations by new-side line number for fast lookup per row.
+    var annByLine = {};
+    for (var i = 0; i < annotations.length; i++) {
+      var a = annotations[i];
+      if (a && typeof a.line === 'number') {
+        if (!annByLine[a.line]) annByLine[a.line] = [];
+        annByLine[a.line].push(a);
+      }
+    }
+
+    var rowsHtml = '';
+    var oldN = oldStart;
+    var newN = newStart;
+    for (var j = 0; j < lines.length; j++) {
+      var line = lines[j] || {};
+      var type = line.type || 'context';
+      var text = line.text == null ? '' : line.text;
+      var bg, oldCell, newCell, sign;
+      if (type === 'add') {
+        bg = 'rgba(34,197,94,0.10)';
+        oldCell = '';
+        newCell = String(newN++);
+        sign = '+';
+      } else if (type === 'del') {
+        bg = 'rgba(239,68,68,0.10)';
+        oldCell = String(oldN++);
+        newCell = '';
+        sign = '-';
+      } else {
+        bg = 'transparent';
+        oldCell = String(oldN++);
+        newCell = String(newN++);
+        sign = ' ';
+      }
+
+      var annHtml = '';
+      var anns = annByLine[Number(newCell)] || annByLine[Number(oldCell)] || [];
+      for (var k = 0; k < anns.length; k++) annHtml += renderAnnotation(anns[k]);
+
+      rowsHtml += (
+        '<tr style="background:' + bg + ';">'
+        + '<td class="swarm-diff-gutter" style="user-select:none;text-align:right;padding:0 8px;color:#7c8aa6;font-size:12px;width:48px;">' + esc(oldCell) + '</td>'
+        + '<td class="swarm-diff-gutter" style="user-select:none;text-align:right;padding:0 8px;color:#7c8aa6;font-size:12px;width:48px;">' + esc(newCell) + '</td>'
+        + '<td class="swarm-diff-sign" style="user-select:none;text-align:center;padding:0 4px;color:#7c8aa6;font-size:12px;width:18px;">' + esc(sign) + '</td>'
+        + '<td class="swarm-diff-code" style="padding:0 8px;white-space:pre-wrap;word-break:break-word;font-family:\\'Space Mono\\',ui-monospace,monospace;font-size:12px;">' + esc(text) + annHtml + '</td>'
+        + '</tr>'
+      );
+    }
+
+    var anchorSlug = slugifyAttr((file || 'hunk') + '-' + (oldStart || hunkIdx + 1));
+    var anchorId = 'swarm-diff-' + anchorSlug;
+    var header = (
+      '@@ -' + oldStart + ',' + oldLines + ' +' + newStart + ',' + newLines + ' @@'
+    );
+
+    return (
+      '<a id="' + esc(anchorId) + '" class="swarm-diff-anchor" data-hunk="' + esc(anchorSlug) + '"></a>'
+      + '<div class="swarm-diff-hunk-header" style="padding:6px 12px;background:rgba(124,138,166,0.10);color:#7c8aa6;font-family:\\'Space Mono\\',ui-monospace,monospace;font-size:11px;border-top:1px solid var(--swarm-border,#22304a);">'
+      + esc(header)
+      + '</div>'
+      + '<table class="swarm-diff-table" style="width:100%;border-collapse:collapse;table-layout:fixed;">'
+      + '<tbody>' + rowsHtml + '</tbody>'
+      + '</table>'
+    );
+  }
+
+  function renderDiff(rootEl, diffData) {
+    var hunks = (diffData && Array.isArray(diffData.hunks)) ? diffData.hunks : (Array.isArray(diffData) ? diffData : []);
+    var file = rootEl.getAttribute('file') || '';
+    var baseSha = rootEl.getAttribute('base-sha') || '';
+    var headSha = rootEl.getAttribute('head-sha') || '';
+
+    var shaLine = '';
+    if (baseSha || headSha) {
+      shaLine = '<span class="swarm-diff-sha" style="font-family:\\'Space Mono\\',ui-monospace,monospace;font-size:11px;color:#7c8aa6;">'
+        + esc(baseSha) + ' → ' + esc(headSha)
+        + '</span>';
+    }
+
+    var hunksHtml = '';
+    for (var i = 0; i < hunks.length; i++) {
+      hunksHtml += renderHunk(hunks[i] || {}, i, file);
+    }
+
+    rootEl.innerHTML = (
+      '<div class="swarm-diff-root" style="border:1px solid var(--swarm-border,#22304a);border-radius:8px;background:var(--swarm-card,#121826);overflow:hidden;margin:12px 0;break-inside:avoid;">'
+      + '<div class="swarm-diff-header" style="display:flex;align-items:center;justify-content:space-between;padding:10px 12px;background:rgba(59,130,246,0.10);border-bottom:1px solid var(--swarm-border,#22304a);">'
+      + '<span class="swarm-diff-file" style="font-family:\\'Space Mono\\',ui-monospace,monospace;font-size:13px;font-weight:700;color:var(--swarm-text,#e6eaf2);">' + esc(file || '(untitled)') + '</span>'
+      + shaLine
+      + '</div>'
+      + hunksHtml
+      + '</div>'
+    );
+  }
+
+  // Public function form lives on window.swarmUi so callers can render an
+  // arbitrary root element programmatically. The custom element below is just
+  // a declarative wrapper around the same render function.
+  window.swarmUi = window.swarmUi || {};
+  window.swarmUi.renderDiff = renderDiff;
+
+  // Defer the parse-and-render so the HTML parser has time to finish
+  // appending JSON text children. \`connectedCallback\` fires on the opening
+  // tag — \`this.textContent\` is empty until children parse. Without a
+  // defer, every declarative <swarm-diff> renders an empty header and the
+  // JSON text remains visible as orphan children.
+  //
+  // queueMicrotask alone is NOT enough — Chrome's streaming parser drains
+  // microtasks between chunks, so the microtask can run BEFORE the JSON
+  // child is appended. We need to wait for the parser to finish the current
+  // document load, then read textContent.
+  //
+  //  * \`document.readyState === 'loading'\` ⇒ parser still streaming →
+  //    wait for DOMContentLoaded (fires after all children are parsed).
+  //  * otherwise (element was created/inserted dynamically post-load) ⇒
+  //    queueMicrotask is fine — DOM is stable, just give the caller a tick.
+  //
+  // Re-entrancy (element moved/reconnected) re-fires connectedCallback so
+  // we re-render against current textContent.
+  class SwarmDiffElement extends HTMLElement {
+    connectedCallback() {
+      var self = this;
+      var doRender = function() {
+        if (!self.isConnected) return;
+        var raw = self.textContent || '';
+        renderDiff(self, { hunks: parseHunks(raw) });
+        // Notify <swarm-diff-jumps> instances so they can pick up new anchors.
+        self.dispatchEvent(new CustomEvent('swarm-diff:rendered', { bubbles: true }));
+      };
+      if (typeof document !== 'undefined' && document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', doRender, { once: true });
+      } else {
+        queueMicrotask(doRender);
+      }
+    }
+  }
+  window.customElements.define('swarm-diff', SwarmDiffElement);
+
+  // Sibling-anchor jump list. Walks subsequent siblings, finds every
+  // <swarm-diff data-hunk=...> anchor, and renders a small list of links.
+  //
+  // Same parse-order hazard as <swarm-diff>: <swarm-diff-jumps> usually
+  // appears in the document BEFORE the <swarm-diff> elements it indexes, so
+  // we also defer to a microtask AND re-render whenever a <swarm-diff> in the
+  // document finishes rendering its anchors.
+  class SwarmDiffJumpsElement extends HTMLElement {
+    connectedCallback() {
+      var self = this;
+      var renderJumps = function() {
+        var anchors = document.querySelectorAll('.swarm-diff-anchor[data-hunk]');
+        if (!anchors.length) {
+          self.innerHTML = '<span class="no-print" style="color:#7c8aa6;font-size:12px;">No hunks yet.</span>';
+          return;
+        }
+        var items = '';
+        for (var i = 0; i < anchors.length; i++) {
+          var a = anchors[i];
+          var slug = a.getAttribute('data-hunk') || ('hunk-' + i);
+          // Hunk title = nearest preceding diff's file attribute if available.
+          var diff = a.closest && a.closest('swarm-diff');
+          var file = (diff && diff.getAttribute('file')) || slug;
+          items += '<li style="margin:0;padding:2px 0;"><a href="#' + esc(a.id) + '" style="color:#3b82f6;text-decoration:none;font-family:\\'Space Mono\\',ui-monospace,monospace;font-size:12px;">' + esc(file) + '</a></li>';
+        }
+        self.innerHTML = (
+          '<nav class="swarm-diff-jumps no-print" style="padding:8px 12px;border:1px dashed var(--swarm-border,#22304a);border-radius:8px;background:rgba(124,138,166,0.05);">'
+          + '<div style="font-size:10px;text-transform:uppercase;letter-spacing:0.08em;color:#7c8aa6;margin-bottom:4px;">Jump to</div>'
+          + '<ul style="list-style:none;padding:0;margin:0;">' + items + '</ul>'
+          + '</nav>'
+        );
+      };
+      // Wait for the parser to finish initial load before first query —
+      // <swarm-diff> elements also defer to DOMContentLoaded so we must
+      // run AFTER they finish rendering their anchors. The event listener
+      // below handles the live-update case.
+      if (typeof document !== 'undefined' && document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', function() { queueMicrotask(renderJumps); }, { once: true });
+      } else {
+        queueMicrotask(renderJumps);
+      }
+      // Re-render whenever a sibling <swarm-diff> finishes its async render.
+      self._onDiffRendered = function() { renderJumps(); };
+      document.addEventListener('swarm-diff:rendered', self._onDiffRendered);
+    }
+    disconnectedCallback() {
+      if (this._onDiffRendered) {
+        document.removeEventListener('swarm-diff:rendered', this._onDiffRendered);
+      }
+    }
+  }
+  window.customElements.define('swarm-diff-jumps', SwarmDiffJumpsElement);
+
+  var CURSOR_IDLE_MS = 3000;
+  var CURSOR_SMOOTHING = 0.28;
+
+  function cursorColor(userId) {
+    var hash = 2166136261;
+    var value = String(userId || '');
+    for (var i = 0; i < value.length; i++) {
+      hash ^= value.charCodeAt(i);
+      hash = Math.imul(hash, 16777619);
+    }
+    return 'hsl(' + ((hash >>> 0) % 360) + ', 72%, 42%)';
+  }
+
+  function documentSize() {
+    var root = document.documentElement || {};
+    return {
+      width: Math.max(1, root.scrollWidth || root.clientWidth || window.innerWidth || 1),
+      height: Math.max(1, root.scrollHeight || root.clientHeight || window.innerHeight || 1),
+    };
+  }
+
+  function cursorMarkup(name, color) {
+    // CursorPointer + CursorBody label structure adapted from Kibo UI (MIT):
+    // https://github.com/shadcnblocks/kibo/blob/main/packages/cursor/index.tsx
+    return '<svg aria-hidden="true" focusable="false" height="20" width="20" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg" style="width:20px;height:20px;flex:none;filter:drop-shadow(0 1px 1px rgba(0,0,0,.2));">'
+      + '<path d="M19.438 6.716 1.115.05A.832.832 0 0 0 .05 1.116L6.712 19.45a.834.834 0 0 0 1.557.025l3.198-8 7.995-3.2a.833.833 0 0 0 0-1.559h-.024Z" fill="currentColor"></path>'
+      + '</svg>'
+      + '<span style="position:relative;margin-left:14px;display:flex;flex-direction:column;white-space:nowrap;border-radius:12px;padding:4px 12px 4px 10px;font-family:system-ui,sans-serif;font-size:12px;font-weight:500;line-height:1.4;background:' + color + ';color:#fff;box-shadow:0 2px 6px rgba(0,0,0,.18);">'
+      + esc(name || 'Guest')
+      + '</span>';
+  }
+
+  class SwarmCursorsElement extends HTMLElement {
+    connectedCallback() {
+      if (this._startPromise) return;
+      var roomName = this.getAttribute('room');
+      if (!roomName || !originalRoom) return;
+
+      var self = this;
+      var lifecycle = (this._lifecycle || 0) + 1;
+      this._lifecycle = lifecycle;
+      var begin = function() {
+        self._onDomReady = null;
+      if (!self.isConnected || self._lifecycle !== lifecycle) return;
+        var schemaVersion = self.getAttribute('schema-version');
+        var options = schemaVersion == null ? {} : { schemaVersion: Number(schemaVersion) };
+        var acquired = acquireCursorRoom(roomName, options);
+        self._roomRecord = acquired.record;
+        self._startPromise = acquired.promise.then(function(room) {
+        if (!self.isConnected || self._lifecycle !== lifecycle) return;
+        self._startPromise = null;
+        self._room = room;
+        self._presence = trackRoomPresence(room);
+        if (!self._presence) return;
+        self._pointers = new Map();
+        self._cursorStates = new Map();
+
+        self._overlay = document.createElement('div');
+        self._overlay.setAttribute('aria-hidden', 'true');
+        self._overlay.style.cssText = 'position:fixed;inset:0;z-index:2147483647;pointer-events:none;overflow:hidden;';
+        var parent = document.body || document.documentElement;
+        if (parent) parent.appendChild(self._overlay);
+
+        self._onPresence = function(peers) { self._renderPeers(peers || []); };
+        self._onPointerMove = function(event) {
+          var size = documentSize();
+          var scrollX = window.scrollX || window.pageXOffset || 0;
+          var scrollY = window.scrollY || window.pageYOffset || 0;
+          var pageX = typeof event.pageX === 'number' ? event.pageX : event.clientX + scrollX;
+          var pageY = typeof event.pageY === 'number' ? event.pageY : event.clientY + scrollY;
+          var x = Math.max(0, Math.min(1, pageX / size.width));
+          var y = Math.max(0, Math.min(1, pageY / size.height));
+          self._presence.setCursor({ x: x, y: y });
+        };
+        self._onPointerLeave = function() {
+          self._presence.clearCursor();
+        };
+
+        self._unsubscribe = room.on('presence', self._onPresence);
+        document.addEventListener('pointermove', self._onPointerMove, { passive: true });
+        document.addEventListener('pointerleave', self._onPointerLeave);
+        self._renderPeers(room.presence.peers || []);
+      }).catch(function(error) {
+        self._startPromise = null;
+        console.warn('[swarm-cursors] failed to join room:', error);
+      });
+      };
+      if (document.readyState === 'loading') {
+        this._onDomReady = function() { queueMicrotask(begin); };
+        this._startPromise = Promise.resolve();
+        document.addEventListener('DOMContentLoaded', this._onDomReady, { once: true });
+      } else {
+        begin();
+      }
+    }
+
+    _renderPeers(peers) {
+      if (!this._pointers) return;
+      var seen = new Set();
+      var activePeerIds = new Set();
+      var includeAgents = this.hasAttribute('include-agents');
+      var ownId = this._room && this._room.me && this._room.me.userId;
+      var now = Date.now();
+
+      for (var i = 0; i < peers.length; i++) {
+        var peer = peers[i];
+        if (!peer || !peer.userId || peer.userId === ownId) continue;
+        if (peer.kind === 'agent' && !includeAgents) continue;
+        var data = peer.data && typeof peer.data === 'object' ? peer.data : null;
+        var cursor = data && data.__cursor;
+        if (!cursor || typeof cursor.x !== 'number' || typeof cursor.y !== 'number'
+          || !Number.isFinite(cursor.x) || !Number.isFinite(cursor.y)) continue;
+
+        var id = String(peer.userId);
+        activePeerIds.add(id);
+        var state = this._cursorStates.get(id);
+        if (!state || state.x !== cursor.x || state.y !== cursor.y) {
+          state = { x: cursor.x, y: cursor.y, lastSeen: now };
+          this._cursorStates.set(id, state);
+        }
+        if (now - state.lastSeen > CURSOR_IDLE_MS) continue;
+
+        var entry = this._pointers.get(id);
+        if (!entry) {
+          entry = this._createPointer(peer);
+          this._pointers.set(id, entry);
+        }
+        entry.cursor = { x: state.x, y: state.y };
+        entry.lastSeen = state.lastSeen;
+        if (entry.name !== peer.name) {
+          entry.name = peer.name || 'Guest';
+          entry.node.innerHTML = cursorMarkup(entry.name, entry.color);
+        }
+        seen.add(id);
+      }
+
+      var ids = Array.from(this._pointers.keys());
+      for (var j = 0; j < ids.length; j++) {
+        if (!seen.has(ids[j])) this._removePointer(ids[j]);
+      }
+      var stateIds = Array.from(this._cursorStates.keys());
+      for (var k = 0; k < stateIds.length; k++) {
+        if (!activePeerIds.has(stateIds[k])) this._cursorStates.delete(stateIds[k]);
+      }
+      this._scheduleFrame();
+    }
+
+    _createPointer(peer) {
+      var color = cursorColor(peer.userId);
+      var node = document.createElement('div');
+      node.style.cssText = 'position:absolute;left:0;top:0;display:flex;align-items:flex-start;pointer-events:none;user-select:none;will-change:transform;color:' + color + ';';
+      node.innerHTML = cursorMarkup(peer.name || 'Guest', color);
+      this._overlay.appendChild(node);
+      return {
+        node: node,
+        color: color,
+        name: peer.name || 'Guest',
+        cursor: null,
+        x: null,
+        y: null,
+        lastSeen: Date.now(),
+      };
+    }
+
+    _removePointer(id) {
+      var entry = this._pointers.get(id);
+      if (entry && entry.node.parentNode) entry.node.parentNode.removeChild(entry.node);
+      this._pointers.delete(id);
+    }
+
+    _scheduleFrame() {
+      if (this._frameId != null || !this._pointers || !this._pointers.size
+        || typeof window.requestAnimationFrame !== 'function') return;
+      var self = this;
+      this._frameId = window.requestAnimationFrame(function() { self._animate(); });
+    }
+
+    _animate() {
+      this._frameId = null;
+      if (!this._pointers || !this._overlay) return;
+      var now = Date.now();
+      var size = documentSize();
+      var scrollX = window.scrollX || window.pageXOffset || 0;
+      var scrollY = window.scrollY || window.pageYOffset || 0;
+      var ids = Array.from(this._pointers.keys());
+
+      for (var i = 0; i < ids.length; i++) {
+        var id = ids[i];
+        var entry = this._pointers.get(id);
+        if (now - entry.lastSeen > CURSOR_IDLE_MS) {
+          this._removePointer(id);
+          continue;
+        }
+        var targetX = entry.cursor.x * size.width - scrollX;
+        var targetY = entry.cursor.y * size.height - scrollY;
+        if (entry.x == null || entry.y == null) {
+          entry.x = targetX;
+          entry.y = targetY;
+        } else {
+          // Exponential interpolation keeps 50 ms presence updates from jumping.
+          entry.x += (targetX - entry.x) * CURSOR_SMOOTHING;
+          entry.y += (targetY - entry.y) * CURSOR_SMOOTHING;
+        }
+        entry.node.style.transform = 'translate3d(' + Math.round(entry.x) + 'px,' + Math.round(entry.y) + 'px,0)';
+      }
+      this._scheduleFrame();
+    }
+
+    disconnectedCallback() {
+      this._lifecycle = (this._lifecycle || 0) + 1;
+      this._startPromise = null;
+      if (this._onDomReady) {
+        document.removeEventListener('DOMContentLoaded', this._onDomReady);
+        this._onDomReady = null;
+      }
+      if (this._unsubscribe) this._unsubscribe();
+      if (this._onPointerMove) document.removeEventListener('pointermove', this._onPointerMove);
+      if (this._onPointerLeave) document.removeEventListener('pointerleave', this._onPointerLeave);
+      if (this._roomRecord) releaseCursorRoom(this._roomRecord, this._presence);
+      if (this._frameId != null && typeof window.cancelAnimationFrame === 'function')
+        window.cancelAnimationFrame(this._frameId);
+      if (this._pointers) {
+        var ids = Array.from(this._pointers.keys());
+        for (var i = 0; i < ids.length; i++) this._removePointer(ids[i]);
+      }
+      if (this._overlay && this._overlay.parentNode)
+        this._overlay.parentNode.removeChild(this._overlay);
+      this._room = null;
+      this._roomRecord = null;
+      this._presence = null;
+      this._overlay = null;
+      this._pointers = null;
+      this._cursorStates = null;
+      this._frameId = null;
+    }
+  }
+  window.customElements.define('swarm-cursors', SwarmCursorsElement);
+})();
+`;
+
+// src/pages/feedback-overlay.ts
 var PAGE_FEEDBACK_PARAM = "__swarm-feedback";
 function isPageFeedbackRequested(queryParams) {
   if (!queryParams.has(PAGE_FEEDBACK_PARAM))
@@ -23127,9 +24310,9 @@ function feedbackOverlayScripts(pageId) {
 }
 
 // src/http/pages-public.ts
-init_db3();
 init_types();
 init_constants();
+init_node_env();
 init_secret_scrubber();
 var PublicPageJsonSchema = PageSchema.pick({
   id: true,
@@ -23329,7 +24512,7 @@ function getAppBaseUrl2() {
 }
 function buildCsp() {
   const configured = getConfiguredAppUrls();
-  const devFallbacks = [
+  const devFallbacks = getNodeEnv() === "production" ? [] : [
     "http://localhost:5274",
     "http://localhost:5175",
     "http://127.0.0.1:5274",
@@ -23406,8 +24589,8 @@ function extractPasswordCandidate(req, queryParams) {
   return decoded.slice(colonIdx + 1);
 }
 function isLocalhostRequest(req) {
-  if (false)
-    ;
+  if (getNodeEnv() === "production")
+    return false;
   const origin = req.headers.origin ?? "";
   if (origin === "") {
     const rawHost = req.headers.host;
@@ -23694,21 +24877,11 @@ var PollTriggerAttachmentSchema = TaskAttachmentSchema.pick({
   mimeType: true,
   sizeBytes: true
 });
-var PollRequestedBySchema = UserSchema.pick({
-  id: true,
-  name: true,
-  email: true,
-  role: true,
-  notes: true
-}).extend({
-  id: exports_external.string().optional(),
-  comms: UserCommsPrefsSchema.optional()
-});
 var PollTaskOfferedTriggerSchema = exports_external.object({
   type: exports_external.literal("task_offered"),
   taskId: exports_external.string(),
   task: AgentTaskSchema,
-  requestedBy: PollRequestedBySchema.optional()
+  requestedBy: TaskRequestedBySchema.optional()
 });
 var PollTaskAssignedTriggerSchema = exports_external.object({
   type: exports_external.literal("task_assigned"),
@@ -23717,7 +24890,7 @@ var PollTaskAssignedTriggerSchema = exports_external.object({
   task: AgentTaskSchema.extend({
     attachments: exports_external.array(PollTriggerAttachmentSchema)
   }),
-  requestedBy: PollRequestedBySchema.optional()
+  requestedBy: TaskRequestedBySchema.optional()
 });
 var PollUnreadMentionsTriggerSchema = exports_external.object({
   type: exports_external.literal("unread_mentions"),
@@ -23765,26 +24938,6 @@ var pollTriggers = route({
 });
 var CHANNEL_ACTIVITY_INTERVAL_MS = 60000;
 var lastChannelActivityCheckAt = 0;
-function getRequesterNotes(notes) {
-  return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
-}
-async function buildTriggerRequestedBy(task) {
-  const user = task.requestedByUserId ? await getUserById(task.requestedByUserId) : undefined;
-  if (user) {
-    return {
-      id: user.id,
-      name: user.name,
-      email: user.email,
-      role: user.role,
-      notes: getRequesterNotes(user.notes),
-      comms: getUserCommsPrefs(user)
-    };
-  }
-  if (task.slackUserId) {
-    return { name: renderIdentity(await resolveIdentity("slack", task.slackUserId)) };
-  }
-  return;
-}
 async function attachmentsForTrigger(taskId) {
   return (await getTaskAttachments(taskId)).map((a) => ({
     id: a.id,
@@ -23794,11 +24947,21 @@ async function attachmentsForTrigger(taskId) {
   }));
 }
 async function claimModelFields(task, agent) {
+  const pin = taskModelPin(task);
+  const cleared = {
+    model: pin,
+    resolvedModel: undefined,
+    modelSource: undefined,
+    modelAlias: undefined
+  };
   try {
-    return await recordClaimModelResolution(task, agent);
+    return {
+      ...cleared,
+      ...await recordClaimModelResolution({ ...task, model: pin }, agent)
+    };
   } catch (error) {
     console.warn(`[/api/poll] model resolution failed for task ${task.id}:`, error);
-    return {};
+    return cleared;
   }
 }
 var commitCursorsRoute = route({
@@ -23883,7 +25046,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
           const claimedTask = await claimOfferedTask(firstOfferedTask.id, myAgentId);
           if (claimedTask) {
             await recordRuntimeTask(claimedTask.id);
-            const offeredRequestedBy = await buildTriggerRequestedBy(claimedTask);
+            const offeredRequestedBy = await buildTaskRequestedBy(claimedTask);
             return {
               trigger: {
                 type: "task_offered",
@@ -23963,7 +25126,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                 agentId: myAgentId
               });
             });
-            const assignedRequestedBy = await buildTriggerRequestedBy(pendingTask);
+            const assignedRequestedBy = await buildTaskRequestedBy(pendingTask);
             const assignedTriggerSurface = await resolveTriggerSurface(pendingTask.id, pendingTask.source);
             return {
               trigger: {
@@ -24054,7 +25217,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                     agentId: myAgentId
                   });
                 });
-                const claimedRequestedBy = await buildTriggerRequestedBy(claimed);
+                const claimedRequestedBy = await buildTaskRequestedBy(claimed);
                 const claimedTriggerSurface = await resolveTriggerSurface(claimed.id, claimed.source);
                 return {
                   trigger: {
@@ -26308,6 +27471,7 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
 init_zod();
 init_db3();
 init_rbac();
+init_secret_scrubber();
 var McpToolCallResultSchema = exports_external.object({
   content: exports_external.array(exports_external.object({ type: exports_external.string(), text: exports_external.string().optional() })),
   isError: exports_external.boolean().optional()
@@ -26341,6 +27505,35 @@ var mcpCallRoute = route({
     404: { description: "Script connection or agent not found" }
   }
 });
+var SqlQueryEnvelopeSchema = exports_external.union([
+  exports_external.object({
+    ok: exports_external.literal(true),
+    rows: exports_external.array(exports_external.record(exports_external.string(), exports_external.unknown())),
+    rowCount: exports_external.number(),
+    truncated: exports_external.boolean()
+  }),
+  exports_external.object({ ok: exports_external.literal(false), error: exports_external.string() })
+]);
+var sqlQueryRoute = route({
+  method: "post",
+  path: "/api/script-connections/{id}/sql-query",
+  pattern: ["api", "script-connections", null, "sql-query"],
+  summary: "Run one read-only query on a SQL script connection",
+  tags: ["Script Connections"],
+  auth: { apiKey: true, agentId: true },
+  rbac: { permission: "script-connection.invoke" },
+  params: exports_external.object({ id: exports_external.string().uuid() }),
+  body: exports_external.object({
+    sql: exports_external.string().min(1).max(1e5),
+    params: exports_external.array(exports_external.unknown()).max(100).optional()
+  }),
+  responses: {
+    200: { description: "Query rows or a scrubbed error", schema: SqlQueryEnvelopeSchema },
+    400: { description: "Invalid SQL connection or request" },
+    403: { description: "Not allowed to invoke this SQL connection" },
+    404: { description: "Script connection or agent not found" }
+  }
+});
 function connectionScopeMatches(connection, agentId, syntheticPrincipal) {
   if (connection.scope === "global")
     return true;
@@ -26354,9 +27547,10 @@ function isSyntheticScriptPrincipal(agentId) {
   return agentId === "schedule" || agentId === "workflow";
 }
 async function handleScriptConnectionProxy(req, res, pathSegments, queryParams, agentId) {
-  if (!mcpCallRoute.match(req.method, pathSegments))
+  const isSql = sqlQueryRoute.match(req.method, pathSegments);
+  if (!isSql && !mcpCallRoute.match(req.method, pathSegments))
     return false;
-  const parsed = await mcpCallRoute.parse(req, res, pathSegments, queryParams);
+  const parsed = isSql ? await sqlQueryRoute.parse(req, res, pathSegments, queryParams) : await mcpCallRoute.parse(req, res, pathSegments, queryParams);
   if (!parsed)
     return true;
   if (!agentId) {
@@ -26388,14 +27582,25 @@ async function handleScriptConnectionProxy(req, res, pathSegments, queryParams,
     jsonError(res, "Script connection is disabled", 403);
     return true;
   }
-  if (connection.kind !== "mcp") {
-    jsonError(res, "Script connection is not an MCP connection", 400);
+  if (connection.kind !== (isSql ? "sql" : "mcp")) {
+    jsonError(res, `Script connection is not ${isSql ? "a SQL" : "an MCP"} connection`, 400);
     return true;
   }
   if (!connectionScopeMatches(connection, agentId, syntheticPrincipal)) {
     jsonError(res, "Script connection is not available to this agent", 403);
     return true;
   }
+  if ("sql" in parsed.body) {
+    try {
+      const dsn = await resolveSqlDsn(connection, agentId);
+      const result = await runReadOnlyQuery(dsn, parsed.body.sql, parsed.body.params);
+      sqlQueryRoute.respond(res, 200, { ok: true, ...result });
+    } catch (err) {
+      const error = scrubSecrets(err instanceof Error ? err.message : String(err));
+      sqlQueryRoute.respond(res, 200, { ok: false, error });
+    }
+    return true;
+  }
   if (!connection.mcpServerId) {
     jsonError(res, "Script MCP connection is missing mcpServerId", 400);
     return true;
@@ -26424,7 +27629,7 @@ init_request_auth_context();
 init_secret_scrubber();
 var providerSchema = exports_external.string().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/);
 var scopeSchema = exports_external.enum(["global", "agent", "repo"]);
-var connectionKindSchema = exports_external.enum(["openapi", "graphql", "mcp"]);
+var connectionKindSchema = exports_external.enum(["openapi", "graphql", "mcp", "sql"]);
 var idParamsSchema2 = exports_external.object({ id: exports_external.string().uuid() });
 var providerParamsSchema = exports_external.object({ provider: providerSchema });
 var oauthResourceIdParamsSchema = exports_external.object({ id: exports_external.string().min(1).max(255) });
@@ -26469,7 +27674,8 @@ var upsertConnectionBodySchema = exports_external.discriminatedUnion("kind", [
   connectionBaseBodySchema.extend({
     kind: exports_external.literal("mcp"),
     mcpServerId: exports_external.string().uuid()
-  })
+  }),
+  connectionBaseBodySchema.extend({ kind: exports_external.literal("sql"), dsn: SqlDsnInputSchema.optional() })
 ]);
 var disableConnectionBodySchema = exports_external.object({ enabled: exports_external.boolean() });
 var credentialBindingBodySchema = exports_external.object({
@@ -26532,7 +27738,7 @@ async function countBindingType(type) {
   return (await listRelationalCredentialBindings({ includeInactive: true })).filter((binding) => _resolveIntegrationType(bindingIntegrationProvider(binding)) === type).length;
 }
 var connectionAuthTypeResponseSchema = exports_external.enum(["none", "bearer", "header", "query", "oauth"]);
-var connectionRecordKindSchema = exports_external.enum(["raw", "openapi", "mcp", "graphql"]);
+var connectionRecordKindSchema = exports_external.enum(["raw", "openapi", "mcp", "graphql", "sql"]);
 var bindingSummarySchema = exports_external.object({
   id: exports_external.string(),
   configKey: exports_external.string(),
@@ -27872,6 +29078,7 @@ async function handleScriptConnections(req, res, pathSegments, queryParams, agen
         openapiSpecEtag: reuseExistingOpenapiSpec ? existingOpenapiConnection?.openapiSpecEtag : undefined,
         openapiSpecFetchedAt: reuseExistingOpenapiSpec ? existingOpenapiConnection?.openapiSpecFetchedAt : undefined,
         mcpServerId: parsed.body.kind === "mcp" ? parsed.body.mcpServerId : null,
+        sqlDsn: parsed.body.kind === "sql" ? parsed.body.dsn : undefined,
         enabled,
         agentId,
         userId
@@ -29546,6 +30753,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
       failedBindings: credentials.failedBindings,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agent.id })
     });
@@ -29961,8 +31169,8 @@ async function recomputeSessionCost(input, lookupRate) {
       modelBreakdown
     };
   }
-  if ((input.provider === "amp" || input.provider === "grok") && input.harnessCostUsd > 0) {
-    const priced = await recomputeSessionCost({ ...input, harnessCostUsd: 0 }, lookupRate);
+  if ((input.provider === "amp" || input.provider === "grok" || input.harnessCostBilled) && input.harnessCostUsd > 0) {
+    const priced = await recomputeSessionCost({ ...input, harnessCostUsd: 0, harnessCostBilled: false }, lookupRate);
     return {
       totalCostUsd: input.harnessCostUsd,
       costSource: "harness",
@@ -30144,6 +31352,7 @@ var createSessionCostRoute = route({
     sessionId: exports_external.string().min(1),
     agentId: exports_external.string().min(1),
     totalCostUsd: exports_external.number(),
+    harnessCostBilled: exports_external.boolean().optional(),
     taskId: exports_external.string().optional(),
     inputTokens: exports_external.number().int().nonnegative().optional(),
     outputTokens: exports_external.number().int().nonnegative().optional(),
@@ -30297,6 +31506,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
         provider: parsed.body.provider,
         model,
         harnessCostUsd: parsed.body.totalCostUsd,
+        harnessCostBilled: parsed.body.harnessCostBilled,
         inputTokens,
         outputTokens,
         cacheReadTokens: cachedInputTokens,
@@ -32040,21 +33250,6 @@ var getMetrics = route({
     200: { description: "Swarm metrics counts", schema: SwarmMetricsSchema }
   }
 });
-var listServices = route({
-  method: "get",
-  path: "/api/services",
-  pattern: ["api", "services"],
-  summary: "List all registered services",
-  tags: ["Stats"],
-  query: exports_external.object({
-    status: exports_external.string().optional(),
-    agentId: exports_external.string().optional(),
-    name: exports_external.string().optional()
-  }),
-  responses: {
-    200: { description: "Service list", schema: exports_external.object({ services: exports_external.array(ServiceSchema) }) }
-  }
-});
 var listScheduledTasks = route({
   method: "get",
   path: "/api/scheduled-tasks",
@@ -32140,18 +33335,6 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     });
     return true;
   }
-  if (listServices.match(req.method, pathSegments)) {
-    const parsed = await listServices.parse(req, res, pathSegments, queryParams);
-    if (!parsed)
-      return true;
-    const services = await getAllServices({
-      status: parsed.query.status || undefined,
-      agentId: parsed.query.agentId || undefined,
-      name: parsed.query.name || undefined
-    });
-    listServices.respond(res, 200, { services });
-    return true;
-  }
   if (listScheduledTasks.match(req.method, pathSegments)) {
     const parsed = await listScheduledTasks.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -34297,6 +35480,8 @@ async function routeKapsoInbound(payload) {
 }
 
 // src/http/webhooks.ts
+init_constants();
+init_secret_scrubber();
 init_event_bus();
 var WebhookDispatchResultSchema = exports_external.object({
   created: exports_external.boolean(),
@@ -34392,6 +35577,57 @@ var kapsoWebhook = route({
     503: { description: "Kapso integration not configured" }
   }
 });
+var chatSdkWebhook = route({
+  method: "post",
+  path: "/api/integrations/chat/{adapter}/webhook",
+  pattern: ["api", "integrations", "chat", null, "webhook"],
+  summary: "Handle Chat SDK platform webhooks (Telegram, Slack, Discord, Teams)",
+  tags: ["Webhooks"],
+  params: exports_external.object({ adapter: exports_external.string().describe("Chat SDK adapter name, e.g. telegram") }),
+  auth: { apiKey: false },
+  rbac: {
+    ungated: "provider webhook: the Chat SDK adapter verifies the platform signature (Telegram secret token, Slack signing secret, Discord Ed25519, Teams JWT)"
+  },
+  responses: {
+    200: { description: "Adapter response", unstructured: "adapter response proxied as-is" },
+    401: { description: "Invalid platform signature or secret token" },
+    403: { description: "Teams activity whose serviceUrl is not a Bot Framework host" },
+    404: { description: "Chat SDK disabled or adapter not configured" },
+    413: { description: "Body exceeds 1 MiB" },
+    503: { description: "Adapter configured but failed to start" }
+  }
+});
+var CHAT_SDK_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+function hasTrustedTeamsServiceUrl(body) {
+  let serviceUrl;
+  try {
+    serviceUrl = JSON.parse(body.toString("utf-8"))?.serviceUrl;
+  } catch {
+    return true;
+  }
+  if (serviceUrl === undefined || serviceUrl === null || serviceUrl === "")
+    return true;
+  return typeof serviceUrl === "string" && isTrustedTeamsServiceUrl(serviceUrl);
+}
+function toFetchRequest(req, rawBody, fallbackPath) {
+  const headers2 = new Headers;
+  if (Array.isArray(req.rawHeaders) && req.rawHeaders.length > 0) {
+    for (let i = 0;i + 1 < req.rawHeaders.length; i += 2) {
+      headers2.append(req.rawHeaders[i], req.rawHeaders[i + 1]);
+    }
+  } else {
+    for (const [name, value] of Object.entries(req.headers)) {
+      for (const item of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+        headers2.append(name, item);
+      }
+    }
+  }
+  return new Request(`${getPublicMcpBaseUrl()}${req.url ?? fallbackPath}`, {
+    method: req.method ?? "POST",
+    headers: headers2,
+    body: rawBody.length > 0 ? new Uint8Array(rawBody) : undefined
+  });
+}
 function logKapsoAckResult(action, result) {
   if (result.ok)
     return;
@@ -34475,7 +35711,8 @@ async function handleWebhooks(req, res, pathSegments) {
       res.end(JSON.stringify({ error: "Invalid JSON body" }));
       return true;
     }
-    console.log(`[GitHub] Received ${eventType} event`);
+    const deliveryId = req.headers["x-github-delivery"];
+    console.log(`[GitHub] Received ${eventType} event (delivery ${deliveryId ?? "unknown"})`);
     let result = { created: false };
     try {
       result = await runBlockableHandler("GitHub", async () => {
@@ -34549,13 +35786,13 @@ async function handleWebhooks(req, res, pathSegments) {
       }
       githubWebhook.respond(res, 200, result);
     } catch (err) {
-      const errorMessage2 = err instanceof Error ? err.message : String(err);
-      console.error(`[GitHub] Error handling ${eventType} event: ${errorMessage2}`);
+      const errorMessage3 = err instanceof Error ? err.message : String(err);
+      console.error(`[GitHub] Error handling ${eventType} event: ${errorMessage3}`);
       if (err instanceof Error && err.stack) {
         console.error(err.stack);
       }
       res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Internal server error", message: errorMessage2 }));
+      res.end(JSON.stringify({ error: "Internal server error", message: errorMessage3 }));
     }
     return true;
   }
@@ -34663,8 +35900,8 @@ async function handleWebhooks(req, res, pathSegments) {
       }
       gitlabWebhook.respond(res, 200, result);
     } catch (err) {
-      const errorMessage2 = err instanceof Error ? err.message : String(err);
-      console.error(`[GitLab] Error handling ${objectKind} event: ${errorMessage2}`);
+      const errorMessage3 = err instanceof Error ? err.message : String(err);
+      console.error(`[GitLab] Error handling ${objectKind} event: ${errorMessage3}`);
       if (err instanceof Error && err.stack) {
         console.error(err.stack);
       }
@@ -34708,6 +35945,16 @@ async function handleWebhooks(req, res, pathSegments) {
             return await handlePullRequestCreated(body);
           case "ms.vss-code.git-pullrequest-comment-event":
             return await handlePullRequestCommented(body);
+          case "workitem.created":
+            return await handleWorkItemCreated(body);
+          case "workitem.updated":
+            return await handleWorkItemUpdated(body);
+          case "workitem.commented":
+            return await handleWorkItemCommented(body);
+          case "workitem.deleted":
+            return await handleWorkItemDeleted(body);
+          case "workitem.restored":
+            return await handleWorkItemRestored(body);
           default:
             console.log(`[AzureDevOps] Ignoring unsupported event type: ${eventType}`);
             return { created: false };
@@ -34744,8 +35991,8 @@ async function handleWebhooks(req, res, pathSegments) {
       }
       azureDevOpsWebhook.respond(res, 200, result);
     } catch (err) {
-      const errorMessage2 = err instanceof Error ? err.message : String(err);
-      console.error(`[AzureDevOps] Error handling ${eventType} event: ${errorMessage2}`);
+      const errorMessage3 = err instanceof Error ? err.message : String(err);
+      console.error(`[AzureDevOps] Error handling ${eventType} event: ${errorMessage3}`);
       if (err instanceof Error && err.stack) {
         console.error(err.stack);
       }
@@ -34813,8 +36060,8 @@ async function handleWebhooks(req, res, pathSegments) {
           console.log(`[AgentMail] Ignoring event type: ${payload.event_type}`);
       }
     } catch (err) {
-      const errorMessage2 = err instanceof Error ? err.message : String(err);
-      console.error(`[AgentMail] Error handling ${payload.event_type} event: ${errorMessage2}`);
+      const errorMessage3 = err instanceof Error ? err.message : String(err);
+      console.error(`[AgentMail] Error handling ${payload.event_type} event: ${errorMessage3}`);
       if (err instanceof Error && err.stack) {
         console.error(err.stack);
       }
@@ -34874,16 +36121,84 @@ async function handleWebhooks(req, res, pathSegments) {
       }
       kapsoWebhook.respond(res, 200, { received: true, routing: routing.kind });
     } catch (err) {
-      const errorMessage2 = err instanceof Error ? err.message : String(err);
+      const errorMessage3 = err instanceof Error ? err.message : String(err);
       if (err instanceof WebhookError) {
-        console.warn(`[Kapso] Workflow dispatch rejected: ${errorMessage2}`);
+        console.warn(`[Kapso] Workflow dispatch rejected: ${errorMessage3}`);
       } else {
-        console.error(`[Kapso] Error handling inbound event: ${errorMessage2}`);
+        console.error(`[Kapso] Error handling inbound event: ${errorMessage3}`);
       }
       kapsoWebhook.respond(res, 200, { received: true, routing: "error" });
     }
     return true;
   }
+  if (chatSdkWebhook.match(req.method, pathSegments)) {
+    const adapterName = pathSegments[3] ?? "";
+    if (!isChatSdkEnabled() || !isChatAdapterConfigured(adapterName)) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK adapter not configured" }));
+      return true;
+    }
+    if (isChatSdkStopping()) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK is shutting down" }));
+      return true;
+    }
+    const chat = getChatInstance(adapterName);
+    const handler = chat?.webhooks[adapterName];
+    if (!handler) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK adapter failed to start" }));
+      return true;
+    }
+    if (enforceContentLengthCap(req, res, CHAT_SDK_WEBHOOK_MAX_BODY_BYTES) === BODY_TOO_LARGE) {
+      return true;
+    }
+    const chunks = [];
+    let receivedBytes = 0;
+    let tooLarge = false;
+    for await (const chunk of req) {
+      if (tooLarge)
+        continue;
+      receivedBytes += chunk.byteLength;
+      if (receivedBytes > CHAT_SDK_WEBHOOK_MAX_BODY_BYTES) {
+        tooLarge = true;
+        chunks.length = 0;
+        jsonError(res, `Payload too large (max ${CHAT_SDK_WEBHOOK_MAX_BODY_BYTES} bytes)`, 413);
+        continue;
+      }
+      chunks.push(chunk);
+    }
+    if (tooLarge)
+      return true;
+    const rawBody = Buffer.concat(chunks);
+    if (adapterName === "teams" && !hasTrustedTeamsServiceUrl(rawBody)) {
+      console.warn("[chat-sdk] teams webhook refused: serviceUrl is not a Bot Framework host");
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Untrusted Teams serviceUrl" }));
+      return true;
+    }
+    const request = toFetchRequest(req, rawBody, `/api/integrations/chat/${adapterName}/webhook`);
+    try {
+      const response = await handler(request, {
+        waitUntil: trackBackground
+      });
+      const responseHeaders = {};
+      response.headers.forEach((value, name) => {
+        responseHeaders[name] = value;
+      });
+      const body = Buffer.from(await response.arrayBuffer());
+      res.writeHead(response.status, responseHeaders);
+      res.end(body);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[chat-sdk] ${adapterName} webhook failed: ${scrubSecrets(message)}`);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+      }
+      res.end(JSON.stringify({ error: "Chat SDK webhook failed" }));
+    }
+    return true;
+  }
   return false;
 }
 
@@ -35906,6 +37221,7 @@ async function handleX(req, res, pathSegments) {
     timeoutMs,
     egressSecrets: credentials.egressSecrets,
     failedBindings: credentials.failedBindings,
+    userConfig: credentials.userConfig,
     apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId }),
     mcpConnections: getScriptMcpConnectionDescriptors({ agentId: endpoint.agentId })
   });
@@ -36054,7 +37370,6 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleAgentRegister(req, res, pathSegments, myAgentId),
         () => handlePoll(req, res, pathSegments, queryParams, myAgentId),
         () => handleSessionData(req, res, pathSegments, queryParams, myAgentId),
-        () => handleEcosystem(req, res, pathSegments, myAgentId),
         () => handleTrackers(req, res, pathSegments),
         () => handleWebhooks(req, res, pathSegments),
         () => handleAgentsRest(req, res, pathSegments, queryParams, myAgentId),
@@ -36146,7 +37461,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-y07cqcvy.js");
+var { attachControllerTransport } = await import("./controllers-connect-kwpvj3rf.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -36175,7 +37490,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-e0snym4t.js");
+    const { stopScheduler } = await import("./index-7ep4gzdk.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -36185,8 +37500,9 @@ async function shutdown() {
   await drainApi();
   await stopScriptRunSupervisor();
   await stopSlackApp();
+  await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-jekc896t.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-be9vwy5h.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -36266,15 +37582,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-8q637aew.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-kwjq4d2z.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-s52nsa5q.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-qb0rv0ap.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-8q637aew.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-kwjq4d2z.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -36282,7 +37598,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-6ksewd5y.js");
+  const { runAllSeeders } = await import("./index-s2wxgzr0.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -36330,6 +37646,9 @@ httpServer.listen(port, async () => {
   } catch (err) {
     console.error("[Slack] Failed to start, continuing boot without Slack:", err);
   }
+  startChatSdk().catch((err) => {
+    console.error("[chat-sdk] Failed to start, continuing without Chat SDK:", scrubSecrets(err instanceof Error ? err.message : String(err)));
+  });
   startQueueStallAlarm();
   initGitHub();
   initGitLab();
@@ -36340,39 +37659,39 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-e0snym4t.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-vm3bm9t7.js");
+    const { startScheduler } = await import("./index-7ep4gzdk.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-rmpw9a8q.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-tsszt7g9.js");
+    const { startHeartbeat } = await import("./index-v1v6n7hg.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-jekc896t.js");
+    const { startOAuthKeepalive } = await import("./keepalive-be9vwy5h.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-5gb36kn8.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-cpdnfwdj.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-1de4f4aj.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-5c2z0mbe.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-4ymn9atn.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-j8xa181e.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-adhk1s8c.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-hnkn3rgt.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {