@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/http/stats.ts

@@ -3,7 +3,6 @@ import { z } from "zod";
 import {
   getAgentStatusCounts,
   getAllLogs,
-  getAllServices,
   getConcurrentContext,
   getLogsByAgentId,
   getScheduledTasks,
@@ -14,7 +13,7 @@ import {
 import { getDbRetentionStats } from "../be/db-retention";
 import { isSteeringEnabled } from "../be/steering";
 import type { AgentLog } from "../types";
-import { AgentLogSchema, ScheduledTaskSchema, ServiceSchema } from "../types";
+import { AgentLogSchema, ScheduledTaskSchema } from "../types";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
@@ -166,22 +165,6 @@ const getMetrics = route({
   },
 });
 
-const listServices = route({
-  method: "get",
-  path: "/api/services",
-  pattern: ["api", "services"],
-  summary: "List all registered services",
-  tags: ["Stats"],
-  query: z.object({
-    status: z.string().optional(),
-    agentId: z.string().optional(),
-    name: z.string().optional(),
-  }),
-  responses: {
-    200: { description: "Service list", schema: z.object({ services: z.array(ServiceSchema) }) },
-  },
-});
-
 const listScheduledTasks = route({
   method: "get",
   path: "/api/scheduled-tasks",
@@ -295,18 +278,6 @@ export async function handleStats(
     return true;
   }
 
-  if (listServices.match(req.method, pathSegments)) {
-    const parsed = await listServices.parse(req, res, pathSegments, queryParams);
-    if (!parsed) return true;
-    const services = await getAllServices({
-      status: (parsed.query.status as import("../types").ServiceStatus) || undefined,
-      agentId: parsed.query.agentId || undefined,
-      name: parsed.query.name || undefined,
-    });
-    listServices.respond(res, 200, { services });
-    return true;
-  }
-
   if (listScheduledTasks.match(req.method, pathSegments)) {
     const parsed = await listScheduledTasks.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;

package/src/http/tasks.ts

@@ -45,6 +45,7 @@ import {
 import { getTaskCitations, TaskCitationSchema } from "../be/task-citations";
 import { findUserById } from "../be/users";
 import { can, type RbacPrincipal, type RbacResource } from "../rbac";
+import { chatThreadOfContextKey } from "../tasks/context-key";
 import { TaskCreationBlockedError } from "../tasks/errors";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { guardTerminalTaskResultWrite } from "../tasks/terminal-result-guard";
@@ -76,6 +77,7 @@ import { ensure } from "../utils/business-use";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { rejectGuest } from "./request-principal";
+import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { route } from "./route-def";
 import { jsonError, parseBody } from "./utils";
 
@@ -110,6 +112,7 @@ const AgentTaskSummarySchema = AgentTaskSchema.pick({
   modelSource: true,
   modelAlias: true,
   effort: true,
+  resolvedEffort: true,
   provider: true,
   requestedByUserId: true,
   progress: true,
@@ -308,6 +311,10 @@ const createTask = route({
       description:
         "Validation error, an unknown `model` (set `allowCustomModel` to store a custom id), or agentId/offeredTo targets an extension identity",
     },
+    403: {
+      description:
+        "An agent caller names a parentTaskId it neither owns nor created, or a non-lead agent binds the task to a chat thread",
+    },
     422: {
       description: "Task creation blocked by an extension",
       schema: z.object({
@@ -357,6 +364,8 @@ const updateSession = route({
       claudeSessionId: z.string().min(1),
       provider: ProviderNameSchema.exclude(["devin"]).optional(),
       model: z.string().optional(),
+      // Effort the session runs at; null when the harness default applies.
+      effort: ReasoningEffortSchema.nullable().optional(),
       providerMeta: z.object({ transport: z.enum(["cli", "sdk"]).optional() }).optional(),
       harnessVariant: z.string().optional(),
       harnessVariantMeta: z.record(z.string(), z.unknown()).optional(),
@@ -592,7 +601,14 @@ const listPausedTasks = route({
     200: {
       description: "Paused task list",
       schema: z.object({
-        tasks: z.array(AgentTaskSchema.extend({ attachments: z.array(TaskAttachmentSchema) })),
+        tasks: z.array(
+          AgentTaskSchema.extend({
+            attachments: z.array(TaskAttachmentSchema),
+            // Same requester projection a fresh task_assigned trigger carries,
+            // so a resumed session gets the same requester-profile prompt.
+            requestedBy: TaskRequestedBySchema.optional(),
+          }),
+        ),
       }),
     },
   },
@@ -954,6 +970,41 @@ export async function handleTasks(
     const parentTask = parsed.body.parentTaskId
       ? await getTaskById(parsed.body.parentTaskId)
       : null;
+    // The child inherits the parent's thread context, so an agent caller must own or
+    // have created the parent. Operator and user callers keep their access.
+    const principal = await resolveTaskWritePrincipal(req, myAgentId);
+    if (
+      parentTask &&
+      !can({
+        principal,
+        verb: "task.parent.attach",
+        resource: {
+          kind: "task",
+          taskId: parentTask.id,
+          requestedByUserId: parentTask.requestedByUserId,
+          creatorAgentId: parentTask.creatorAgentId,
+          agentId: parentTask.agentId,
+        },
+        source: "http",
+      }).allow
+    ) {
+      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
+      return true;
+    }
+    // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator
+    // may then read and post to. An agent may only name a thread other than the parent's
+    // with the lead's chat post permission.
+    if (
+      principal.kind === "agent" &&
+      parsed.body.contextKey &&
+      parsed.body.contextKey !== parentTask?.contextKey &&
+      chatThreadOfContextKey(parsed.body.contextKey) &&
+      !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" })
+        .allow
+    ) {
+      jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
+      return true;
+    }
     let assetKey: string | undefined;
     try {
       const inheritedKey = parentTask?.key;
@@ -1083,6 +1134,7 @@ export async function handleTasks(
       parsed.body.model,
       "harnessVariant" in parsed.body ? parsed.body.harnessVariant : undefined,
       "harnessVariantMeta" in parsed.body ? parsed.body.harnessVariantMeta : undefined,
+      "effort" in parsed.body ? parsed.body.effort : undefined,
     );
     if (!task) {
       jsonError(res, "Task not found", 404);
@@ -1667,10 +1719,14 @@ export async function handleTasks(
     }
     const pausedTasks = await getPausedTasksForAgent(myAgentId);
     const tasks = await Promise.all(
-      pausedTasks.map(async (task) => ({
-        ...task,
-        attachments: await getTaskAttachments(task.id),
-      })),
+      pausedTasks.map(async (task) => {
+        const requestedBy = await buildTaskRequestedBy(task);
+        return {
+          ...task,
+          attachments: await getTaskAttachments(task.id),
+          ...(requestedBy && { requestedBy }),
+        };
+      }),
     );
     listPausedTasks.respond(res, 200, { tasks });
     return true;

package/src/http/utils.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { getActiveTaskCount } from "../be/db";
 import type { SwarmSpan } from "../otel";
 import { isEnvFlagEnabled } from "../utils/env-flag";
+import { getNodeEnv } from "../utils/node-env";
 import { scrubSecrets } from "../utils/secret-scrubber";
 
 export function duplicateGuardedQueryKey(query: URLSearchParams): string | undefined {
@@ -41,6 +42,18 @@ function getAllowedOrigins(): string[] {
     .filter(Boolean);
 }
 
+/**
+ * Loopback origins on any port are trusted in local development
+ * (`NODE_ENV=development`, set by `start:http` and `dev:http`). The dashboard
+ * dev server, Playwright, or a second worktree pick arbitrary ports, and every
+ * loopback page already runs on the developer's machine. The production binary
+ * and the Docker image run without NODE_ENV, so this never applies there.
+ */
+function isDevLoopbackOrigin(origin: string): boolean {
+  if (getNodeEnv() !== "development") return false;
+  return /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d{1,5})?$/.test(origin);
+}
+
 /**
  * Decide whether `origin` may receive credentialed CORS headers.
  * Unset or blank uses the built-in hosted/dev allowlist. Exact entries retain
@@ -50,6 +63,7 @@ function getAllowedOrigins(): string[] {
  * Bare `*`, `https://*`, other wildcard positions, and non-origin URLs are ignored.
  */
 function originAllowedForCredentials(origin: string): boolean {
+  if (isDevLoopbackOrigin(origin)) return true;
   return getAllowedOrigins().some((entry) => {
     if (!entry.includes("*")) return entry === origin;
 

package/src/http/webhooks.ts

@@ -9,12 +9,25 @@ import {
   verifyAgentMailWebhook,
 } from "../agentmail";
 import { archiveInboundMessage } from "../agentmail/inbound-archive";
-import type { PullRequestCommentedEvent, PullRequestCreatedEvent } from "../azure-devops";
+import type {
+  PullRequestCommentedEvent,
+  PullRequestCreatedEvent,
+  WorkItemCommentedEvent,
+  WorkItemCreatedEvent,
+  WorkItemDeletedEvent,
+  WorkItemRestoredEvent,
+  WorkItemUpdatedEvent,
+} from "../azure-devops";
 import {
   commentedPayloadOf,
   createdPullRequestOf,
   handlePullRequestCommented,
   handlePullRequestCreated,
+  handleWorkItemCommented,
+  handleWorkItemCreated,
+  handleWorkItemDeleted,
+  handleWorkItemRestored,
+  handleWorkItemUpdated,
   isAzureDevOpsEnabled,
   verifyAzureDevOpsWebhook,
 } from "../azure-devops";
@@ -53,6 +66,14 @@ import {
   verifyGitLabWebhook,
 } from "../gitlab";
 import { gitlabWorkflowActionName } from "../gitlab/workflow-action-name";
+import { trackBackground } from "../integrations/chat-sdk/background";
+import { isChatSdkEnabled } from "../integrations/chat-sdk/config";
+import {
+  getChatInstance,
+  isChatAdapterConfigured,
+  isChatSdkStopping,
+} from "../integrations/chat-sdk/runtime";
+import { isTrustedTeamsServiceUrl } from "../integrations/chat-sdk/teams-origin";
 import {
   type KapsoMessageActionResult,
   markKapsoMessageRead,
@@ -63,11 +84,14 @@ import { getKapsoConfig } from "../integrations/kapso/config";
 import type { KapsoWebhookPayload } from "../integrations/kapso/inbound";
 import { resolveKapsoRequestedByUserId, routeKapsoInbound } from "../integrations/kapso/inbound";
 import { TaskCreationBlockedError } from "../tasks/errors";
+import { getPublicMcpBaseUrl } from "../utils/constants";
+import { scrubSecrets } from "../utils/secret-scrubber";
 import { canonicalAzureDevOpsRepoUrl } from "../vcs/azure-devops";
 import { getExecutorRegistry } from "../workflows";
 import { workflowEventBus } from "../workflows/event-bus";
 import { handleWebhookTrigger, verifyHmacSignature, WebhookError } from "../workflows/triggers";
 import { route } from "./route-def";
+import { BODY_TOO_LARGE, enforceContentLengthCap, jsonError } from "./utils";
 
 // ─── Route Definitions (documentation only — webhooks handle their own body parsing) ─
 
@@ -190,8 +214,75 @@ const kapsoWebhook = route({
   },
 });
 
+const chatSdkWebhook = route({
+  method: "post",
+  path: "/api/integrations/chat/{adapter}/webhook",
+  pattern: ["api", "integrations", "chat", null, "webhook"],
+  summary: "Handle Chat SDK platform webhooks (Telegram, Slack, Discord, Teams)",
+  tags: ["Webhooks"],
+  params: z.object({ adapter: z.string().describe("Chat SDK adapter name, e.g. telegram") }),
+  auth: { apiKey: false },
+  rbac: {
+    ungated:
+      "provider webhook: the Chat SDK adapter verifies the platform signature (Telegram secret token, Slack signing secret, Discord Ed25519, Teams JWT)",
+  },
+  responses: {
+    200: { description: "Adapter response", unstructured: "adapter response proxied as-is" },
+    401: { description: "Invalid platform signature or secret token" },
+    403: { description: "Teams activity whose serviceUrl is not a Bot Framework host" },
+    404: { description: "Chat SDK disabled or adapter not configured" },
+    413: { description: "Body exceeds 1 MiB" },
+    503: { description: "Adapter configured but failed to start" },
+  },
+});
+
+/**
+ * Upper bound for a Chat SDK webhook body. Platform payloads are a few KB and
+ * files travel by URL, so anything larger is not a platform delivery.
+ */
+const CHAT_SDK_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
+/** False when a Teams activity body carries a `serviceUrl` that is not a Bot Framework host. */
+function hasTrustedTeamsServiceUrl(body: Buffer): boolean {
+  let serviceUrl: unknown;
+  try {
+    serviceUrl = (JSON.parse(body.toString("utf-8")) as { serviceUrl?: unknown } | null)
+      ?.serviceUrl;
+  } catch {
+    // Not JSON: the adapter rejects it.
+    return true;
+  }
+  if (serviceUrl === undefined || serviceUrl === null || serviceUrl === "") return true;
+  return typeof serviceUrl === "string" && isTrustedTeamsServiceUrl(serviceUrl);
+}
+
+/**
+ * Rebuild a Fetch `Request` from the raw Node request. Headers come from
+ * `rawHeaders` pairs: building `Headers` from `IncomingMessage.headers`
+ * comma-joins repeated values, which breaks signature checks.
+ */
+function toFetchRequest(req: IncomingMessage, rawBody: Buffer, fallbackPath: string): Request {
+  const headers = new Headers();
+  if (Array.isArray(req.rawHeaders) && req.rawHeaders.length > 0) {
+    for (let i = 0; i + 1 < req.rawHeaders.length; i += 2) {
+      headers.append(req.rawHeaders[i] as string, req.rawHeaders[i + 1] as string);
+    }
+  } else {
+    for (const [name, value] of Object.entries(req.headers)) {
+      for (const item of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+        headers.append(name, item);
+      }
+    }
+  }
+  return new Request(`${getPublicMcpBaseUrl()}${req.url ?? fallbackPath}`, {
+    method: req.method ?? "POST",
+    headers,
+    body: rawBody.length > 0 ? new Uint8Array(rawBody) : undefined,
+  });
+}
+
 function logKapsoAckResult(action: string, result: KapsoMessageActionResult): void {
   if (result.ok) return;
   console.warn(
@@ -303,7 +394,8 @@ export async function handleWebhooks(
       return true;
     }
 
-    console.log(`[GitHub] Received ${eventType} event`);
+    const deliveryId = req.headers["x-github-delivery"] as string | undefined;
+    console.log(`[GitHub] Received ${eventType} event (delivery ${deliveryId ?? "unknown"})`);
 
     let result: WebhookDispatchResult = { created: false };
 
@@ -560,6 +652,16 @@ export async function handleWebhooks(
             return await handlePullRequestCreated(body as PullRequestCreatedEvent);
           case "ms.vss-code.git-pullrequest-comment-event":
             return await handlePullRequestCommented(body as PullRequestCommentedEvent);
+          case "workitem.created":
+            return await handleWorkItemCreated(body as WorkItemCreatedEvent);
+          case "workitem.updated":
+            return await handleWorkItemUpdated(body as WorkItemUpdatedEvent);
+          case "workitem.commented":
+            return await handleWorkItemCommented(body as WorkItemCommentedEvent);
+          case "workitem.deleted":
+            return await handleWorkItemDeleted(body as WorkItemDeletedEvent);
+          case "workitem.restored":
+            return await handleWorkItemRestored(body as WorkItemRestoredEvent);
           default:
             console.log(`[AzureDevOps] Ignoring unsupported event type: ${eventType}`);
             return { created: false };
@@ -795,5 +897,84 @@ export async function handleWebhooks(
     return true;
   }
 
+  // Chat SDK webhook: the adapter verifies the platform signature over the raw
+  // body, so the request is proxied as-is and the adapter's response returned.
+  if (chatSdkWebhook.match(req.method, pathSegments)) {
+    const adapterName = pathSegments[3] ?? "";
+    if (!isChatSdkEnabled() || !isChatAdapterConfigured(adapterName)) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK adapter not configured" }));
+      return true;
+    }
+    if (isChatSdkStopping()) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK is shutting down" }));
+      return true;
+    }
+    const chat = getChatInstance(adapterName);
+    const handler = chat?.webhooks[adapterName];
+    if (!handler) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Chat SDK adapter failed to start" }));
+      return true;
+    }
+
+    // The route is unauthenticated and the adapter verifies the signature over
+    // the buffered body, so the body is bounded before it is buffered. An
+    // oversized stream is answered at once and drained without buffering, the
+    // same way `parseBody` keeps the connection usable.
+    if (enforceContentLengthCap(req, res, CHAT_SDK_WEBHOOK_MAX_BODY_BYTES) === BODY_TOO_LARGE) {
+      return true;
+    }
+    const chunks: Buffer[] = [];
+    let receivedBytes = 0;
+    let tooLarge = false;
+    for await (const chunk of req) {
+      if (tooLarge) continue;
+      receivedBytes += (chunk as Buffer).byteLength;
+      if (receivedBytes > CHAT_SDK_WEBHOOK_MAX_BODY_BYTES) {
+        tooLarge = true;
+        chunks.length = 0;
+        jsonError(res, `Payload too large (max ${CHAT_SDK_WEBHOOK_MAX_BODY_BYTES} bytes)`, 413);
+        continue;
+      }
+      chunks.push(chunk as Buffer);
+    }
+    if (tooLarge) return true;
+    const rawBody = Buffer.concat(chunks);
+    // The Teams adapter replies, reads history and downloads files with the
+    // bot token at the activity's serviceUrl, and caches it for DMs. Refuse an
+    // untrusted one before the adapter sees the activity.
+    if (adapterName === "teams" && !hasTrustedTeamsServiceUrl(rawBody)) {
+      console.warn("[chat-sdk] teams webhook refused: serviceUrl is not a Bot Framework host");
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Untrusted Teams serviceUrl" }));
+      return true;
+    }
+    const request = toFetchRequest(req, rawBody, `/api/integrations/chat/${adapterName}/webhook`);
+
+    try {
+      const response = await handler(request, {
+        // Handler errors are logged by `trackBackground` in `handlers.ts`.
+        waitUntil: trackBackground,
+      });
+      const responseHeaders: Record<string, string> = {};
+      response.headers.forEach((value, name) => {
+        responseHeaders[name] = value;
+      });
+      const body = Buffer.from(await response.arrayBuffer());
+      res.writeHead(response.status, responseHeaders);
+      res.end(body);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[chat-sdk] ${adapterName} webhook failed: ${scrubSecrets(message)}`);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+      }
+      res.end(JSON.stringify({ error: "Chat SDK webhook failed" }));
+    }
+    return true;
+  }
+
   return false;
 }

package/src/http/x.ts

@@ -255,6 +255,7 @@ export async function handleX(
     timeoutMs,
     egressSecrets: credentials.egressSecrets,
     failedBindings: credentials.failedBindings,
+    userConfig: credentials.userConfig,
     apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId }),
     mcpConnections: getScriptMcpConnectionDescriptors({ agentId: endpoint.agentId }),
   });

package/src/integrations/chat-sdk/adapters.ts

@@ -0,0 +1,129 @@
+import type { Adapter, Logger } from "chat";
+import { type ChatSdkAdapterName, type ResolvedAdapterConfig, readApiUrlOverrides } from "./config";
+import { withInfoFilter } from "./logger";
+import { getChatSdkTestHooks } from "./test-hooks";
+
+/**
+ * Platform API bases passed explicitly so the adapters never fall back to
+ * `TELEGRAM_API_BASE_URL` / `SLACK_API_URL` / `DISCORD_API_URL` /
+ * `TEAMS_API_URL` from `process.env`. Global swarm_config rows are injected
+ * into `process.env`, so an env fallback would let a config row redirect bot
+ * tokens to another host. Teams gets "" which blocks only `TEAMS_API_URL`.
+ * The other Teams SDK env fallbacks (`SERVICE_URL`, `TENANT_ID`, `CLIENT_ID`,
+ * `CLIENT_SECRET`, `MANAGED_IDENTITY_CLIENT_ID`, `CLOUD`) are closed by the
+ * injection denylist in `getInjectableGlobalConfigs` (`src/be/db.ts`).
+ * Deployment env can still set them on purpose.
+ */
+const DEFAULT_API_URLS: Record<ChatSdkAdapterName, string> = {
+  telegram: "https://api.telegram.org",
+  slack: "https://slack.com/api/",
+  discord: "https://discord.com/api/v10",
+  teams: "",
+};
+
+/**
+ * Discord adapter info lines dropped from the logs. They fire per event and
+ * carry guild message content (first 100 chars), or the public key and
+ * signature prefix of every interaction. Warn and error lines are kept.
+ */
+const DISCORD_NOISY_INFO_PREFIXES = [
+  "Discord Gateway message received",
+  "Discord webhook received",
+  "Discord signature verification",
+  "Discord interaction parsed",
+  "Discord PING received",
+];
+
+export function keepDiscordInfoLine(message: string): boolean {
+  return !DISCORD_NOISY_INFO_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+
+/**
+ * Platform API base for one adapter: the env-only `CHAT_SDK_API_URL_OVERRIDES`
+ * entry, else the platform default. The adapters and the Telegram
+ * register-webhook route use the same base.
+ */
+export function resolveAdapterApiUrl(name: ChatSdkAdapterName): string {
+  return readApiUrlOverrides()[name] ?? DEFAULT_API_URLS[name];
+}
+
+/**
+ * Construct one adapter. Each branch is a literal-path dynamic import so
+ * `bun build --compile` bundles it (a computed specifier is not bundled).
+ * `apiUrl` comes only from the env-only `CHAT_SDK_API_URL_OVERRIDES`.
+ */
+export async function loadAdapter(
+  name: ChatSdkAdapterName,
+  config: ResolvedAdapterConfig,
+  logger: Logger,
+): Promise<Adapter> {
+  const apiUrl = resolveAdapterApiUrl(name);
+  const base = { ...config, apiUrl, logger };
+  switch (name) {
+    case "telegram": {
+      const { createTelegramAdapter } = await import("@chat-adapter/telegram");
+      // Explicit `false` blocks the TELEGRAM_ALLOW_UNVERIFIED_WEBHOOKS env fallback.
+      return createTelegramAdapter({ ...base, allowUnverifiedWebhooks: false } as Parameters<
+        typeof createTelegramAdapter
+      >[0]);
+    }
+    case "slack": {
+      const { createSlackAdapter } = await import("@chat-adapter/slack");
+      // "" (not undefined) blocks each `?? process.env.SLACK_*` fallback, which
+      // would pick up the built-in Slack app's secrets. Socket forwarding and
+      // the installation encryption key are multi-workspace features we do not
+      // use; "" turns both off.
+      return createSlackAdapter({
+        ...base,
+        signingSecret: config.signingSecret ?? "",
+        appToken: config.appToken ?? "",
+        socketForwardingSecret: "",
+        encryptionKey: "",
+      } as Parameters<typeof createSlackAdapter>[0]);
+    }
+    case "discord": {
+      const { createDiscordAdapter } = await import("@chat-adapter/discord");
+      // `[]` (not undefined) blocks the DISCORD_RESPOND_TO_CHANNEL_IDS and
+      // DISCORD_MENTION_ROLE_IDS env fallbacks.
+      return createDiscordAdapter({
+        ...base,
+        logger: withInfoFilter(logger, keepDiscordInfoLine),
+        respondToChannelIds: config.respondToChannelIds ?? [],
+        mentionRoleIds: config.mentionRoleIds ?? [],
+      } as Parameters<typeof createDiscordAdapter>[0]);
+    }
+    case "teams": {
+      const { createTeamsAdapter } = await import("@chat-adapter/teams");
+      // `webhookVerifier` replaces the Bot Framework JWT check and `token` the
+      // bot token call. Only tests set them (test-hooks.ts); the operator
+      // schema rejects `webhookVerifier`, and `token` is a function.
+      const { teamsWebhookVerifier, teamsToken } = getChatSdkTestHooks();
+      return createTeamsAdapter({
+        ...base,
+        ...(teamsWebhookVerifier ? { webhookVerifier: teamsWebhookVerifier } : {}),
+        ...(teamsToken ? { token: teamsToken } : {}),
+      } as Parameters<typeof createTeamsAdapter>[0]);
+    }
+  }
+}
+
+type SocketClientLike = { on(event: string, listener: () => void): unknown };
+
+/**
+ * Slack socket mode reconnects on its own and logs through its own logger,
+ * not ours. Surface hard failures through the scrubbing logger so adapter
+ * health (`lastWarning`) shows them. A failed first connect rejects
+ * `initialize()` for auth errors. Network failures go through the WebClient
+ * retry policy and can take long before they surface here.
+ * `reconnecting` also fires on Slack's routine connection refresh, so it is
+ * logged at info only and never reaches health.
+ */
+export function watchSocketConnection(adapter: Adapter, logger: Logger): void {
+  const client = (adapter as { socketClient?: SocketClientLike }).socketClient;
+  if (!client) return;
+  client.on("reconnecting", () => logger.info("Slack socket mode reconnecting"));
+  client.on("unable_to_socket_mode_start", () =>
+    logger.warn("Slack socket mode unable to start, retrying"),
+  );
+  client.on("error", () => logger.warn("Slack socket mode error"));
+}