@desplega.ai/agent-swarm 2.0.0 → 2.1.0

package/dist/{cli-bzszjf2p.js → cli-vgqzp4em.js}

@@ -2,12 +2,12 @@ import {
   COMPOSIO_HTTP_METHODS,
   composioArgsFromParts,
   executeComposioRequest
-} from "./cli-zkpks3r3.js";
+} from "./cli-h1arqn31.js";
 import {
   ampModelError,
   ampPinCatalogError,
   ampPinProviderError
-} from "./cli-hnhtk6cj.js";
+} from "./cli-8wwxw8a3.js";
 import {
   LlmRater,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -26,7 +26,7 @@ import {
   requestModelCatalogRefresh,
   startPricingRefreshLoop,
   upsertModelCatalogOverlay
-} from "./cli-z5jjpaxw.js";
+} from "./cli-0pd8hzhc.js";
 import {
   AppDefinitionSchema,
   AppElementsSchema,
@@ -74,6 +74,7 @@ import {
   runSavedScriptAsAgent,
   runScript,
   sandboxSpawnEnv,
+  scriptCompatWarnings,
   setScriptConnectionEnabled,
   snapshotCapped,
   typecheckScript,
@@ -83,7 +84,7 @@ import {
   upsertScriptConnection,
   validateScriptImports,
   writeBareImportShim
-} from "./cli-ee9gtz70.js";
+} from "./cli-4mengw46.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -95,14 +96,15 @@ import {
   ensureToken,
   ensureTokenOrThrow,
   onAuthorizationRefreshed
-} from "./cli-6razj6t4.js";
+} from "./cli-711vwbxn.js";
 import {
+  ensureModelProfilesSeeded,
   ensurePricingSeeded,
   ensureRbacSeeded
-} from "./cli-5t4f29ez.js";
+} from "./cli-wfnemr1t.js";
 import {
   loadModelsDevCache
-} from "./cli-r62a35ea.js";
+} from "./cli-hqr88ew6.js";
 import {
   require_fast_deep_equal
 } from "./cli-6cvfxs8r.js";
@@ -161,10 +163,13 @@ import {
   walkGraph,
   withSaveWarnings,
   workflowSaveWarnings
-} from "./cli-1e4b6bzh.js";
+} from "./cli-naqzr17j.js";
 import {
   BaseExecutor,
   HumanInTheLoopExecutor,
+  SYSTEM_ONE_DECISION_NODE_TYPE,
+  SYSTEM_ONE_PROVIDER_IDS,
+  SystemOneDecisionConfigSchema,
   SystemOneDecisionExecutor,
   applyDefinitionPatch,
   createApprovalFollowUpTask,
@@ -175,7 +180,7 @@ import {
   resolveValidationPort,
   resolveWorkflowLlmConfig,
   validateDefinition
-} from "./cli-v1yb0rqb.js";
+} from "./cli-20krdhz5.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -206,14 +211,14 @@ import {
   taskCitationWarnings,
   upsertTaskCitations,
   withSpan
-} from "./cli-skxvvpap.js";
+} from "./cli-cvv9k0hh.js";
 import {
   externalChannelToolError,
   getChannelBlockReason,
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin
-} from "./cli-k3dp5tpf.js";
+} from "./cli-r610p9bs.js";
 import {
   findOrCreateUserByEmail,
   findUserByEmail,
@@ -231,15 +236,15 @@ import {
   resolveUserByToken,
   revokeRuntimeTokensForRuntime,
   unlinkIdentity
-} from "./cli-eejsgvm4.js";
+} from "./cli-mgz4nbgg.js";
 import {
   canProvisionKind,
   init_runtime_providers
-} from "./cli-ra0xzggj.js";
+} from "./cli-j67mh2vg.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-74ahz61x.js";
+} from "./cli-d9286m9h.js";
 import {
   can,
   decideAdmission,
@@ -248,7 +253,7 @@ import {
   init_rbac,
   isRbacEnabled,
   revokeLeadEquivalence
-} from "./cli-przpmdgr.js";
+} from "./cli-sksetb2q.js";
 import {
   API_DRAIN_MAX_MS_LIMIT,
   CANDIDATE_SET_MULTIPLIER,
@@ -333,6 +338,7 @@ import {
   getActiveTaskCount,
   getAgentById,
   getAgentCurrentTask,
+  getAgentDefaultProfileName,
   getAgentMailInboxMapping,
   getAgentMailInboxMappingsByAgent,
   getAgentMcpServers,
@@ -381,6 +387,7 @@ import {
   getMetric,
   getMetricBySlug,
   getMetricVersions,
+  getModelProfileByName,
   getOAuthApp,
   getOAuthAppById,
   getOAuthAppIdByProvider,
@@ -451,6 +458,7 @@ import {
   init_enabled_tools,
   init_key_paths,
   init_memory,
+  init_model_profiles,
   init_model_tier_keys,
   init_oauth,
   init_request_auth_context,
@@ -490,6 +498,7 @@ import {
   listCancelledApprovalRequestsForRun,
   listKv,
   listMcpServers,
+  listModelProfiles,
   listSkills,
   listWorkflowRunsPage,
   listWorkflows,
@@ -501,6 +510,7 @@ import {
   markSteeringHandled,
   markTaskSlackReplySent,
   maskSecrets,
+  modelProfileRefError,
   moveTaskFromBacklog,
   moveTaskToBacklog,
   normalizeDateRequired,
@@ -520,6 +530,7 @@ import {
   rejectTask,
   releaseMentionProcessing,
   releaseTask,
+  repoModelOverrideKeys,
   requestSteering,
   rerank,
   reservedKeyError,
@@ -538,6 +549,7 @@ import {
   shouldBlockPolling,
   startTask,
   sweepExpiredKvPrefix,
+  taskProfileError,
   telemetry,
   tierConfigKey,
   touchScratchScriptLastUsed,
@@ -569,7 +581,7 @@ import {
   validateConfigValue,
   validateExportToEnv,
   workflowContextKey
-} from "./cli-ef1hg1wv.js";
+} from "./cli-y3167wt1.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -629,7 +641,7 @@ import {
   parseAssetKey,
   parseModelTier,
   splitLegacyModelAlias
-} from "./cli-cgtksawx.js";
+} from "./cli-pe05f8yk.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -638,7 +650,7 @@ import {
   init_task_attachment_links,
   taskAttachmentDisplayUrl,
   taskAttachmentFetchCommand
-} from "./cli-s2sp957d.js";
+} from "./cli-78vv7446.js";
 import {
   getSlackConfiguration,
   init_config
@@ -710,11 +722,11 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-k382tshb.js";
+} from "./cli-r35rw5de.js";
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-9nfx44eh.js";
+} from "./cli-z780ec7c.js";
 import {
   init_bus,
   realtimeBus
@@ -747,7 +759,7 @@ import {
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-p1x85d2t.js";
+} from "./cli-shk7r5cs.js";
 import {
   buildClaudeShortnameMap,
   claudeCatalogModelId,
@@ -15265,12 +15277,14 @@ function resumedTaskModelSelection(task) {
 
 // src/be/model-validation.ts
 init_db3();
+init_model_profiles();
 
 // src/be/model-tier-resolution.ts
 init_src();
 init_zod();
 init_types();
 init_db3();
+init_model_profiles();
 
 // src/be/harness-model-support.ts
 init_src();
@@ -15602,11 +15616,73 @@ async function applyCliSupport(resolution, harness, cliVersion) {
   if (!fallback)
     return resolution;
   noticeCliUnsupported(harness, cliVersion, resolution.resolvedModel, fallback);
-  const modelSource = resolution.modelSource === "model" ? "fallback:cli-unsupported:model" : "fallback:cli-unsupported";
+  const modelSource = resolution.modelSource.startsWith("profile:") ? resolution.modelSource : resolution.modelSource === "model" ? "fallback:cli-unsupported:model" : "fallback:cli-unsupported";
   return { ...resolution, resolvedModel: fallback, modelSource };
 }
-async function recordClaimModelResolution(task, agent) {
+async function resolveClaimProfile(name, source, harness) {
+  const isTask = source === "profile:task";
+  const profile = await getModelProfileByName(name);
+  if (!profile) {
+    return isTask ? { modelUnsupported: `[model-profile-missing] Model profile "${name}" no longer exists.` } : null;
+  }
+  if (profile.harness !== harness) {
+    if (!isTask)
+      return null;
+    return {
+      modelUnsupported: `[model-harness-mismatch] Model profile "${name}" runs on the ${profile.harness} harness, not on the ${harness ?? "unknown"} harness of this worker. Re-create the task with a ${harness ?? "matching"} profile.`
+    };
+  }
+  let resolution = {
+    resolvedModel: profile.model,
+    modelSource: source,
+    modelAlias: null
+  };
+  if (isAlias(profile.model)) {
+    const resolved = await resolveLatestAlias(profile.model);
+    if (!resolved) {
+      if (!isTask)
+        return null;
+      return {
+        modelUnsupported: `[model-profile-unresolved] Model profile "${name}" names ${profile.model}, which resolves to no usable model.`
+      };
+    }
+    resolution = {
+      resolvedModel: resolved,
+      modelSource: source,
+      modelAlias: profile.model.trim().toLowerCase()
+    };
+  }
+  return { profile: { name: profile.name, effort: profile.effort }, resolution };
+}
+async function recordClaimModelResolution(task, agent, { includeRepoSecrets = true } = {}) {
   const harnessProvider = agent.harnessProvider ?? agent.provider ?? null;
+  if (!task.model?.trim()) {
+    const taskProfile = task.profile?.trim();
+    const agentDefault = taskProfile || parseModelTier(task.modelTier) ? null : await getAgentDefaultProfileName(agent.id);
+    const repoKeys = agentDefault ? await repoModelOverrideKeys(task.vcsRepo, { includeSecrets: includeRepoSecrets }) : new Set;
+    const defaultProfile = repoKeys.has("MODEL_OVERRIDE") ? null : agentDefault;
+    const picked = taskProfile ? await resolveClaimProfile(taskProfile, "profile:task", harnessProvider) : defaultProfile ? await resolveClaimProfile(defaultProfile, "profile:agent-default", harnessProvider) : null;
+    if (picked && "modelUnsupported" in picked)
+      return { modelUnsupported: picked.modelUnsupported };
+    if (picked) {
+      const checked2 = await applyCliSupport(picked.resolution, harnessProvider, await getAgentHarnessCliVersion(agent.id));
+      const resolution2 = "unsupported" in checked2 ? picked.resolution : checked2;
+      await getDbClient().run("UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ?, resolvedProfile = ? WHERE id = ?", [
+        resolution2.resolvedModel,
+        resolution2.modelSource,
+        resolution2.modelAlias,
+        picked.profile.name,
+        task.id
+      ]);
+      return {
+        resolvedModel: resolution2.resolvedModel,
+        modelSource: resolution2.modelSource,
+        ...resolution2.modelAlias ? { modelAlias: resolution2.modelAlias } : {},
+        resolvedProfile: picked.profile.name,
+        ...!task.effort && picked.profile.effort && !repoKeys.has("REASONING_EFFORT_OVERRIDE") ? { effort: picked.profile.effort } : {}
+      };
+    }
+  }
   const resolved = await resolveTaskModel({
     model: task.model,
     modelTier: task.modelTier,
@@ -15614,8 +15690,9 @@ async function recordClaimModelResolution(task, agent) {
     workerOverrides: await getAgentModelTierOverrides(agent.id)
   });
   if (!resolved) {
-    await getDbClient().run(`UPDATE agent_tasks SET resolvedModel = NULL, modelSource = NULL, modelAlias = NULL
-         WHERE id = ? AND (resolvedModel IS NOT NULL OR modelSource IS NOT NULL OR modelAlias IS NOT NULL)`, [task.id]);
+    await getDbClient().run(`UPDATE agent_tasks SET resolvedModel = NULL, modelSource = NULL, modelAlias = NULL, resolvedProfile = NULL
+         WHERE id = ? AND (resolvedModel IS NOT NULL OR modelSource IS NOT NULL OR modelAlias IS NOT NULL
+           OR resolvedProfile IS NOT NULL)`, [task.id]);
     return {};
   }
   if ("harnessMismatch" in resolved)
@@ -15625,7 +15702,7 @@ async function recordClaimModelResolution(task, agent) {
     return { modelUnsupported: checked.unsupported };
   }
   const resolution = checked;
-  await getDbClient().run("UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ? WHERE id = ?", [resolution.resolvedModel, resolution.modelSource, resolution.modelAlias, task.id]);
+  await getDbClient().run("UPDATE agent_tasks SET resolvedModel = ?, modelSource = ?, modelAlias = ?, resolvedProfile = NULL WHERE id = ?", [resolution.resolvedModel, resolution.modelSource, resolution.modelAlias, task.id]);
   return resolution.modelAlias ? resolution : { resolvedModel: resolution.resolvedModel, modelSource: resolution.modelSource };
 }
 
@@ -15663,6 +15740,11 @@ async function harnessModelErrorFor(model, harness) {
   return harnessModelMismatch(model, harness, providers, {});
 }
 async function poolTaskRunsOnHarness(task, harness) {
+  const profileName = task?.profile?.trim();
+  if (profileName) {
+    const profile = await getModelProfileByName(profileName);
+    return !profile || !harness || profile.harness === harness;
+  }
   const model = taskModelPin(task ?? {})?.trim();
   if (!model)
     return true;
@@ -16058,15 +16140,22 @@ async function prepareDeferredWakeTask(scheduleId, reason, extraTags) {
   return await prepareStandaloneScheduleTask(wakeSchedule(schedule, resolved.cause), extraTags);
 }
 var DEFERRED_WAIT_WOKE_EVENT = "task_deferred_wait_woke";
-async function dispatchDeferredTaskWait(scheduleId, reason, extraTags = [], triggerTaskId) {
+async function prepareDeferredTaskWait(scheduleId, reason, extraTags = []) {
   const client = getDbClient();
   if (!await client.get("SELECT * FROM deferred_task_waits WHERE scheduleId = ?", [
     scheduleId
   ]))
     return;
-  const preparedForWait = await prepareDeferredWakeTask(scheduleId, reason, extraTags);
+  return { task: await prepareDeferredWakeTask(scheduleId, reason, extraTags) };
+}
+async function dispatchDeferredTaskWait(scheduleId, reason, extraTags = [], triggerTaskId, prepared) {
+  const preparation = prepared ?? await prepareDeferredTaskWait(scheduleId, reason, extraTags);
+  if (!preparation)
+    return;
+  const preparedForWait = preparation.task;
   if (!preparedForWait)
     return {};
+  const client = getDbClient();
   return client.transaction(async () => {
     const resolved = await resolveWaitCause(scheduleId, reason);
     if (!resolved)
@@ -16374,13 +16463,14 @@ async function throwIfWorkflowNeedsSetup(scheduleId, runIds) {
   }
 }
 async function claimScheduleOccurrence(snapshot, extraTags) {
+  const preparedWait = await prepareDeferredTaskWait(snapshot.id, "ceiling", extraTags);
   return getDbClient().transaction(async () => {
     const current = await getScheduledTaskById(snapshot.id);
     if (!current?.enabled || !current.nextRunAt || current.nextRunAt !== snapshot.nextRunAt) {
       return null;
     }
     const schedule = renderScheduledTaskParams(current);
-    const deferred = await dispatchDeferredTaskWait(schedule.id, "ceiling", extraTags);
+    const deferred = preparedWait ? await dispatchDeferredTaskWait(schedule.id, "ceiling", extraTags, undefined, preparedWait) : undefined;
     if (deferred) {
       return {
         schedule,
@@ -22712,23 +22802,25 @@ function extractNameFromField(from) {
   const name = angleMatch?.[1]?.trim();
   return name && name.length > 0 ? name : undefined;
 }
+function matchesAddressFilter(email, filter) {
+  const address = email.trim().toLowerCase();
+  const domain = address.split("@")[1];
+  if (!domain)
+    return false;
+  return filter.split(",").map((entry) => entry.trim().toLowerCase()).some((entry) => entry.includes("@") ? entry === address : entry === domain);
+}
 function isInboxAllowed(inboxId, filter) {
   if (!filter)
     return true;
-  const allowedDomains = filter.split(",").map((d) => d.trim().toLowerCase());
-  const inboxDomain = inboxId.split("@")[1]?.toLowerCase();
-  return !!inboxDomain && allowedDomains.includes(inboxDomain);
+  return matchesAddressFilter(inboxId, filter);
 }
 function isSenderAllowed(from, filter) {
   if (!filter)
     return true;
-  const allowedDomains = filter.split(",").map((d) => d.trim().toLowerCase());
   const fromAddresses = Array.isArray(from) ? from : [from || ""];
   return fromAddresses.some((addr) => {
     const emailMatch = addr.match(/<([^>]+)>/);
-    const email = emailMatch?.[1] ?? addr;
-    const domain = email.split("@")[1]?.toLowerCase();
-    return !!domain && allowedDomains.includes(domain);
+    return matchesAddressFilter(emailMatch?.[1] ?? addr, filter);
   });
 }
 var processedEvents = new Map;
@@ -22935,6 +23027,9 @@ async function handleMessageReceived(payload) {
   console.log(`[AgentMail] Created unassigned task ${task.id} (no lead or mapping available)`);
   return { created: true, taskId: task.id };
 }
+// src/azure-devops/api.ts
+init_secret_scrubber();
+
 // src/azure-devops/auth.ts
 init_env_flag();
 var initialized3 = false;
@@ -23099,12 +23194,32 @@ async function likeAzureDevOpsComment(ref, threadId, commentId) {
   try {
     const resp = await fetch(url, { method: "POST", headers: headers() });
     if (!resp.ok) {
-      console.error(`[AzureDevOps] Failed to like comment: ${resp.status} ${await resp.text()}`);
+      console.error(`[AzureDevOps] Failed to like comment: ${resp.status} ${scrubSecrets(await resp.text())}`);
     }
   } catch (err) {
     console.error(`[AzureDevOps] Error liking comment:`, err);
   }
 }
+async function updateWorkItemFields(orgBaseUrl, workItemId, ops) {
+  const orgUrl2 = credentialedOrgUrl(orgBaseUrl);
+  if (!orgUrl2)
+    return false;
+  try {
+    const resp = await fetch(`${orgUrl2}/_apis/wit/workitems/${workItemId}?api-version=${API_VERSION}`, {
+      method: "PATCH",
+      headers: { ...headers(), "Content-Type": "application/json-patch+json" },
+      body: JSON.stringify(ops),
+      redirect: "error"
+    });
+    if (!resp.ok) {
+      console.error(`[AzureDevOps] Failed to update work item #${workItemId}: ${resp.status} ${scrubSecrets(await resp.text())}`);
+    }
+    return resp.ok;
+  } catch (err) {
+    console.error(`[AzureDevOps] Error updating work item #${workItemId}:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
+    return false;
+  }
+}
 // src/azure-devops/boards-sync.ts
 init_db3();
 
@@ -23254,6 +23369,7 @@ async function createTrackerAgentMapping(data) {
 init_resolver();
 init_context_key();
 init_types();
+init_event_bus();
 
 // src/azure-devops/handlers.ts
 init_db3();
@@ -24078,7 +24194,7 @@ async function handleWorkItemUpdated(event) {
   const org = orgFor(event);
   if (!org)
     return dropUntrustedOrg(event.eventType);
-  return await handleDelivery(org, event.id, update.workItemId, async () => {
+  const routeAssignment = async () => {
     const bot = await resolveBot(org.url);
     if (!isBotString(change.newValue, bot) || isBotString(change.oldValue, bot)) {
       return { created: false };
@@ -24093,6 +24209,19 @@ async function handleWorkItemUpdated(event) {
       org,
       actor: update.revisedBy ?? null
     }, "assigned");
+  };
+  return await handleDelivery(org, event.id, update.workItemId, async () => {
+    const result = await routeAssignment();
+    workflowEventBus.emit("azure-devops.work_item.assigned", {
+      work_item_id: update.workItemId,
+      title: update.revision.fields["System.Title"],
+      project: update.revision.fields["System.TeamProject"],
+      action: "assigned",
+      assigned_to: change.newValue,
+      previous_assignee: change.oldValue,
+      user_login: update.revisedBy?.uniqueName ?? update.revisedBy?.id
+    });
+    return result;
   });
 }
 async function handleWorkItemCommented(event) {
@@ -24107,8 +24236,7 @@ async function handleWorkItemCommented(event) {
   const org = orgFor(event);
   if (!org)
     return dropUntrustedOrg(event.eventType);
-  const commentKey = ref ? `comment:${trackerKey(org, item.id)}:${ref.commentId}` : undefined;
-  return await handleDelivery(org, event.id, item.id, async () => {
+  const routeComment = async () => {
     const bot = await resolveBot(org.url);
     const actor = parseIdentityString(item.fields["System.ChangedBy"]);
     if (isBotIdentity(actor, bot))
@@ -24124,6 +24252,19 @@ async function handleWorkItemCommented(event) {
       org,
       actor
     }, "mentioned_comment", text);
+  };
+  const commentKey = ref ? `comment:${trackerKey(org, item.id)}:${ref.commentId}` : undefined;
+  return await handleDelivery(org, event.id, item.id, async () => {
+    const result = await routeComment();
+    workflowEventBus.emit("azure-devops.work_item.commented", {
+      work_item_id: item.id,
+      title: item.fields["System.Title"],
+      project: item.fields["System.TeamProject"],
+      action: "commented",
+      comment: item.fields["System.History"],
+      user_login: item.fields["System.ChangedBy"]
+    });
+    return result;
   }, commentKey);
 }
 async function handleWorkItemDeleted(event) {
@@ -24194,6 +24335,74 @@ async function handleWorkItemRestored(event) {
     return { created: true, taskId };
   });
 }
+// src/azure-devops/outbound.ts
+init_db3();
+init_task_lifecycle_events();
+init_secret_scrubber();
+init_event_bus();
+var PROVIDER2 = "azure-devops";
+function getWorkItemState(which) {
+  return process.env[`AZURE_DEVOPS_WORKITEM_STATE_${which}`]?.trim() || null;
+}
+async function transitionLinkedWorkItem(taskId, state) {
+  const sync = await getTrackerSync(PROVIDER2, "task", taskId);
+  if (!sync)
+    return;
+  const [orgKey, id] = sync.externalId.split("#");
+  const workItemId = Number(id);
+  if (!orgKey || !Number.isInteger(workItemId))
+    return;
+  const ok = await updateWorkItemFields(`https://${orgKey}`, workItemId, [
+    { op: "add", path: "/fields/System.State", value: state }
+  ]);
+  if (ok) {
+    console.log(scrubSecrets(`[AzureDevOps] Work item #${workItemId} -> ${state} (task ${taskId})`));
+  }
+}
+var transitionChains = new Map;
+function enqueueTransition(taskId, state, eventName) {
+  const run = (transitionChains.get(taskId) ?? Promise.resolve()).then(() => transitionLinkedWorkItem(taskId, state)).catch((error) => report(eventName, error));
+  transitionChains.set(taskId, run);
+  run.then(() => {
+    if (transitionChains.get(taskId) === run)
+      transitionChains.delete(taskId);
+  });
+}
+function report(eventName, error) {
+  console.error(`[AzureDevOps Outbound] ${eventName} handler failed:`, scrubSecrets(error instanceof Error ? error.message : String(error)));
+}
+function handleTaskStarted(task) {
+  const state = getWorkItemState("STARTED");
+  if (state)
+    enqueueTransition(task.id, state, "task.started");
+}
+var onTaskCompleted = (data) => {
+  const { taskId } = data ?? {};
+  const state = getWorkItemState("DONE");
+  if (taskId && state)
+    enqueueTransition(taskId, state, "task.completed");
+};
+var subscribed = false;
+var startedHookRegistered = false;
+function initAzureDevOpsOutbound() {
+  if (subscribed)
+    return;
+  subscribed = true;
+  if (!startedHookRegistered) {
+    startedHookRegistered = true;
+    onTaskStarted((task) => {
+      if (subscribed)
+        getDbClient().afterCommit(() => handleTaskStarted(task));
+    });
+  }
+  workflowEventBus.on("task.completed", onTaskCompleted);
+}
+function teardownAzureDevOpsOutbound() {
+  if (!subscribed)
+    return;
+  subscribed = false;
+  workflowEventBus.off("task.completed", onTaskCompleted);
+}
 // src/http/core.ts
 init_db3();
 
@@ -28798,7 +29007,7 @@ async function jiraFetch(path, init) {
 }
 
 // src/jira/outbound.ts
-var subscribed = false;
+var subscribed2 = false;
 var LOOP_PREVENTION_WINDOW_MS = 5000;
 var OUTPUT_TRUNCATE_CHARS = 4000;
 function observed(eventName, handler) {
@@ -28809,25 +29018,25 @@ function observed(eventName, handler) {
   };
 }
 var onTaskCreated = observed("task.created", handleTaskCreated);
-var onTaskCompleted = observed("task.completed", handleTaskCompleted);
+var onTaskCompleted2 = observed("task.completed", handleTaskCompleted);
 var onTaskFailed = observed("task.failed", handleTaskFailed);
 var onTaskCancelled = observed("task.cancelled", handleTaskCancelled);
 function initJiraOutboundSync() {
-  if (subscribed)
+  if (subscribed2)
     return;
-  subscribed = true;
+  subscribed2 = true;
   workflowEventBus.on("task.created", onTaskCreated);
-  workflowEventBus.on("task.completed", onTaskCompleted);
+  workflowEventBus.on("task.completed", onTaskCompleted2);
   workflowEventBus.on("task.failed", onTaskFailed);
   workflowEventBus.on("task.cancelled", onTaskCancelled);
   console.log("[Jira] Outbound sync subscribed to event bus");
 }
 function teardownJiraOutboundSync() {
-  if (!subscribed)
+  if (!subscribed2)
     return;
-  subscribed = false;
+  subscribed2 = false;
   workflowEventBus.off("task.created", onTaskCreated);
-  workflowEventBus.off("task.completed", onTaskCompleted);
+  workflowEventBus.off("task.completed", onTaskCompleted2);
   workflowEventBus.off("task.failed", onTaskFailed);
   workflowEventBus.off("task.cancelled", onTaskCancelled);
   console.log("[Jira] Outbound sync unsubscribed from event bus");
@@ -29406,7 +29615,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-kfvgbvzy.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-7k8s9w5p.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -29477,7 +29686,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-ww5d7jq3.js");
+  const { getDbClient: getDbClient2 } = await import("./db-eywwsnjw.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -101949,7 +102158,7 @@ async function handleAgentSessionPrompted(event) {
 }
 
 // src/linear/outbound.ts
-var subscribed2 = false;
+var subscribed3 = false;
 var LOOP_PREVENTION_WINDOW_MS2 = 5000;
 function observed2(eventName, handler) {
   return (data) => {
@@ -101959,27 +102168,27 @@ function observed2(eventName, handler) {
   };
 }
 var onTaskCreated2 = observed2("task.created", handleTaskCreated2);
-var onTaskCompleted2 = observed2("task.completed", handleTaskCompleted2);
+var onTaskCompleted3 = observed2("task.completed", handleTaskCompleted2);
 var onTaskFailed2 = observed2("task.failed", handleTaskFailed2);
 var onTaskCancelled2 = observed2("task.cancelled", handleTaskCancelled2);
 var onTaskProgress = observed2("task.progress", handleTaskProgress);
 function initLinearOutboundSync() {
-  if (subscribed2)
+  if (subscribed3)
     return;
-  subscribed2 = true;
+  subscribed3 = true;
   workflowEventBus.on("task.created", onTaskCreated2);
-  workflowEventBus.on("task.completed", onTaskCompleted2);
+  workflowEventBus.on("task.completed", onTaskCompleted3);
   workflowEventBus.on("task.failed", onTaskFailed2);
   workflowEventBus.on("task.cancelled", onTaskCancelled2);
   workflowEventBus.on("task.progress", onTaskProgress);
   console.log("[Linear] Outbound sync subscribed to event bus");
 }
 function teardownLinearOutboundSync() {
-  if (!subscribed2)
+  if (!subscribed3)
     return;
-  subscribed2 = false;
+  subscribed3 = false;
   workflowEventBus.off("task.created", onTaskCreated2);
-  workflowEventBus.off("task.completed", onTaskCompleted2);
+  workflowEventBus.off("task.completed", onTaskCompleted3);
   workflowEventBus.off("task.failed", onTaskFailed2);
   workflowEventBus.off("task.cancelled", onTaskCancelled2);
   workflowEventBus.off("task.progress", onTaskProgress);
@@ -103292,7 +103501,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-zk96aq1k.js");
+  const { getEmbeddingProvider: getEmbeddingProvider2, resetEmbeddingProvider } = await import("./index-vxvhxxbn.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider2().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -103308,10 +103517,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-5c2z0mbe.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-whzbdthj.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-j8xa181e.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-9apm9qw6.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -103330,6 +103539,9 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
   initAzureDevOps();
   if (isAzureDevOpsEnabled())
     integrations.push("azure-devops");
+  teardownAzureDevOpsOutbound();
+  if (isAzureDevOpsEnabled())
+    initAzureDevOpsOutbound();
   resetLinear();
   if (await initLinear())
     integrations.push("linear");
@@ -104493,7 +104705,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-e8gq5m68.js");
+  const dispatcher = await import("./dispatcher-w94kc575.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -106034,13 +106246,13 @@ function affectedModelNames(previousDefinition, nextDefinition, migration) {
     });
   }).sort();
 }
-function applyDirective(rows, modelName, columnName, directive, oldColumn, nextColumn, oldModel, nextModel, report, issues, path2) {
+function applyDirective(rows, modelName, columnName, directive, oldColumn, nextColumn, oldModel, nextModel, report2, issues, path2) {
   if (isPurgeDirective(directive)) {
     for (const row of rows) {
       if (!Object.hasOwn(row, columnName))
         continue;
       delete row[columnName];
-      report.purgedValues += 1;
+      report2.purgedValues += 1;
     }
     return;
   }
@@ -106049,7 +106261,7 @@ function applyDirective(rows, modelName, columnName, directive, oldColumn, nextC
   if ("set" in directive) {
     for (const row of rows) {
       row[columnName] = directive.set;
-      report.backfilled += 1;
+      report2.backfilled += 1;
     }
     return;
   }
@@ -106074,13 +106286,13 @@ function applyDirective(rows, modelName, columnName, directive, oldColumn, nextC
         value = directive.map[String(sourceValue)];
         if (columnAccepts(nextColumn, value)) {
           resolved = true;
-          report.mapped += 1;
+          report2.mapped += 1;
         }
       } else if (!directive.map && sourceValue !== undefined) {
         value = sourceValue;
         if (columnAccepts(nextColumn, value)) {
           resolved = true;
-          report.mapped += 1;
+          report2.mapped += 1;
         }
       }
     } else {
@@ -106090,14 +106302,14 @@ function applyDirective(rows, modelName, columnName, directive, oldColumn, nextC
         value = converted;
         resolved = true;
         if (!Object.is(converted, sourceValue))
-          report.coerced += 1;
+          report2.coerced += 1;
       }
     }
     if (!resolved) {
       if (hasExplicitElse) {
         value = directive.else;
         resolved = true;
-        report.elsed += 1;
+        report2.elsed += 1;
       } else if ("from" in directive && (nextColumn.hidden === true || nextColumn.required !== true)) {
         if (Object.hasOwn(row, columnName))
           delete row[columnName];
@@ -106131,7 +106343,7 @@ function ownSource(model, sourceName) {
   const sources = model?.sources;
   return sources && Object.hasOwn(sources, sourceName) ? sources[sourceName] : undefined;
 }
-function planSources(modelName, oldModel, nextModel, rows, report, issues) {
+function planSources(modelName, oldModel, nextModel, rows, report2, issues) {
   const sourceNames = new Set([
     ...Object.keys(oldModel?.sources ?? {}),
     ...Object.keys(nextModel?.sources ?? {})
@@ -106148,7 +106360,7 @@ function planSources(modelName, oldModel, nextModel, rows, report, issues) {
         delete row.source;
         delete row.syncedAt;
         delete row.stale;
-        report.detachedRows += 1;
+        report2.detachedRows += 1;
       }
       continue;
     }
@@ -106166,20 +106378,20 @@ function planSources(modelName, oldModel, nextModel, rows, report, issues) {
     }
   }
 }
-async function planModel(appId2, modelName, oldModel, nextModel, migration, oldSideUnparseable, report, orphanFields, appliedDirectives) {
+async function planModel(appId2, modelName, oldModel, nextModel, migration, oldSideUnparseable, report2, orphanFields, appliedDirectives) {
   const persistedRows = await listAllAppRowsForMigrationUnlocked(appId2, modelName);
   const rows = persistedRows.map((row) => structuredClone(row));
   const issues = [];
   const changedColumns = changedColumnNames(oldModel, nextModel);
   const rebuildColumns = new Set(changedColumns);
-  report.scanned += rows.length;
+  report2.scanned += rows.length;
   if (oldModel && !nextModel && rows.length > 0) {
     issues.push({
       path: `models.${modelName}`,
       message: `model holds ${rows.length} ${rows.length === 1 ? "row" : "rows"} — delete its rows before removing the model`
     });
   }
-  planSources(modelName, oldModel, nextModel, rows, report, issues);
+  planSources(modelName, oldModel, nextModel, rows, report2, issues);
   for (const columnName of changedColumns) {
     const oldColumn = ownColumn(oldModel, columnName);
     const nextColumn = ownColumn(nextModel, columnName);
@@ -106236,7 +106448,7 @@ async function planModel(appId2, modelName, oldModel, nextModel, migration, oldS
           if (Object.hasOwn(row, columnName) && row[columnName] !== null)
             continue;
           row[columnName] = nextColumn.default;
-          report.backfilled += 1;
+          report2.backfilled += 1;
         }
       } else {
         issues.push({
@@ -106276,7 +106488,7 @@ async function planModel(appId2, modelName, oldModel, nextModel, migration, oldS
     if (nextColumn) {
       issues.push(...validateDirectiveValues(modelName, columnName, nextColumn, directive));
     }
-    applyDirective(rows, modelName, columnName, directive, oldColumn, nextColumn, oldModel, nextModel, report, issues, `migration.${columnName}`);
+    applyDirective(rows, modelName, columnName, directive, oldColumn, nextColumn, oldModel, nextModel, report2, issues, `migration.${columnName}`);
     rebuildColumns.add(columnName);
   }
   if (nextModel) {
@@ -106303,12 +106515,12 @@ async function buildPlan(appId2, previousDefinition, previousRawDefinition, next
     ...validateDirectiveOrder(migration),
     ...await exportedElementCompatibilityIssues(appId2, previousDefinition, previousRawDefinition, nextDefinition, forceElementBreak)
   ];
-  const report = structuredClone(EMPTY_REPORT);
+  const report2 = structuredClone(EMPTY_REPORT);
   const userConfigNames = new Set([
     ...Object.keys(previousDefinition?.userConfig ?? {}),
     ...Object.keys(nextDefinition.userConfig ?? {})
   ]);
-  report.userConfigChanged = [...userConfigNames].filter((name) => !definitionsEqual(previousDefinition?.userConfig?.[name], nextDefinition.userConfig?.[name])).sort();
+  report2.userConfigChanged = [...userConfigNames].filter((name) => !definitionsEqual(previousDefinition?.userConfig?.[name], nextDefinition.userConfig?.[name])).sort();
   const oldSideUnparseable = previousDefinition === undefined;
   const affected = affectedModelNames(previousDefinition, nextDefinition, migration);
   const orphanFields = new Set;
@@ -106317,9 +106529,9 @@ async function buildPlan(appId2, previousDefinition, previousRawDefinition, next
   for (const modelName of affected) {
     const previousModel = modelAt(previousDefinition, modelName);
     const nextModel = modelAt(nextDefinition, modelName);
-    const plan = await planModel(appId2, modelName, previousModel, nextModel, migration, oldSideUnparseable, report, orphanFields, appliedDirectives);
+    const plan = await planModel(appId2, modelName, previousModel, nextModel, migration, oldSideUnparseable, report2, orphanFields, appliedDirectives);
     issues.push(...plan.issues);
-    report.idxRebuilt += plan.rebuildColumns.length;
+    report2.idxRebuilt += plan.rebuildColumns.length;
     models.push(plan);
   }
   for (const [columnName, directive] of Object.entries(migration)) {
@@ -106333,11 +106545,11 @@ async function buildPlan(appId2, previousDefinition, previousRawDefinition, next
     });
   }
   const sortedOrphans = [...orphanFields].sort();
-  report.orphanFields = sortedOrphans.slice(0, sortedOrphans.length > MAX_ORPHAN_FIELDS ? MAX_ORPHAN_FIELDS - 1 : MAX_ORPHAN_FIELDS);
+  report2.orphanFields = sortedOrphans.slice(0, sortedOrphans.length > MAX_ORPHAN_FIELDS ? MAX_ORPHAN_FIELDS - 1 : MAX_ORPHAN_FIELDS);
   if (sortedOrphans.length > MAX_ORPHAN_FIELDS) {
-    report.orphanFields.push(`…and ${sortedOrphans.length - (MAX_ORPHAN_FIELDS - 1)} more`);
+    report2.orphanFields.push(`…and ${sortedOrphans.length - (MAX_ORPHAN_FIELDS - 1)} more`);
   }
-  return { issues, models, report };
+  return { issues, models, report: report2 };
 }
 var APP_DEFINITION_LOCK_SENTINEL = "__definition__";
 function withAppDefinitionLock(appId2, operation) {
@@ -106953,9 +107165,11 @@ var AppUserConfigFieldSchema = object({
   label: string().optional()
 });
 var AppUserConfigSchema = record(AppNameSchema, AppUserConfigFieldSchema);
+var compatWarningsSchema = array(string()).optional().describe("Advisory quickjs-executor compatibility findings for the app's scripts.");
 var appWriteResponseSchema = object({
   app: AppRecordSchema,
-  migration: AppMigrationReportSchema
+  migration: AppMigrationReportSchema,
+  warnings: compatWarningsSchema
 });
 var userConfigBodySchema = object({ values: record(string(), unknown()) }).strict();
 var getUserConfigRoute = route({
@@ -107026,7 +107240,10 @@ var createAppRoute = route({
     forceElementBreak: ForceElementBreakSchema.optional()
   }),
   responses: {
-    201: { description: "Created app", schema: object({ app: AppRecordSchema }) },
+    201: {
+      description: "Created app",
+      schema: object({ app: AppRecordSchema, warnings: compatWarningsSchema })
+    },
     400: { description: "Invalid app definition" },
     403: { description: "Permission denied" }
   },
@@ -107591,12 +107808,14 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       invalidDefinition(res, definition.issues);
       return true;
     }
+    const warnings = await scriptCompatWarnings(definition.definition);
     createAppRoute.respond(res, 201, {
       app: await createApp({
         name: parsed.body.name,
         description: parsed.body.description,
         definition: definition.definition
-      })
+      }),
+      ...warnings.length > 0 ? { warnings } : {}
     });
     return true;
   }
@@ -107978,6 +108197,7 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     let app = null;
     let migration;
+    let writtenDefinition;
     let responseHandled = false;
     try {
       await withAppDefinitionLock(parsed.params.id, async () => {
@@ -108009,6 +108229,8 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
           responseHandled = true;
           return;
         }
+        if (parsed.body.definition !== undefined)
+          writtenDefinition = definition.definition;
         const migrated = await migrateAppSchema({
           appId: parsed.params.id,
           previousDefinition: existing.definition,
@@ -108049,7 +108271,12 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "app not found", 404);
       return true;
     }
-    patchAppRoute.respond(res, 200, { app, migration });
+    const warnings = writtenDefinition === undefined ? [] : await scriptCompatWarnings(writtenDefinition);
+    patchAppRoute.respond(res, 200, {
+      app,
+      migration,
+      ...warnings.length > 0 ? { warnings } : {}
+    });
     return true;
   }
   if (updateAppRoute.match(req.method, pathSegments)) {
@@ -108066,6 +108293,7 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     let app = null;
     let migration;
+    let writtenDefinition;
     let responseHandled = false;
     try {
       await withAppDefinitionLock(parsed.params.id, async () => {
@@ -108095,6 +108323,7 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
           return;
         }
         const nextDefinition = definition ?? existing.definition;
+        writtenDefinition = definition;
         const migrated = await migrateAppSchema({
           appId: parsed.params.id,
           previousDefinition: appDefinitionNeedsRepair(existing) ? undefined : existing.definition,
@@ -108135,7 +108364,12 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "app not found", 404);
       return true;
     }
-    updateAppRoute.respond(res, 200, { app, migration });
+    const warnings = writtenDefinition === undefined ? [] : await scriptCompatWarnings(writtenDefinition);
+    updateAppRoute.respond(res, 200, {
+      app,
+      migration,
+      ...warnings.length > 0 ? { warnings } : {}
+    });
     return true;
   }
   if (deleteAppRoute.match(req.method, pathSegments)) {
@@ -111487,7 +111721,8 @@ function inheritedModelSelection(parent) {
   const model = taskModelPin(parent);
   return {
     ...model ? { model } : {},
-    ...parent.modelTier ? { modelTier: parent.modelTier } : {}
+    ...parent.modelTier ? { modelTier: parent.modelTier } : {},
+    ...parent.profile ? { profile: parent.profile } : {}
   };
 }
 function attachmentPointer(a) {
@@ -115919,6 +116154,46 @@ var registerModelCatalogOverlayUpsertTool = (server) => {
   });
 };
 
+// src/tools/model-profiles/list-model-profiles.ts
+init_zod();
+init_model_profiles();
+init_types();
+var registerListModelProfilesTool = (server) => {
+  createToolRegistrar(server)("list-model-profiles", {
+    title: "List Model Profiles",
+    description: "List model profiles: named harness + model + effort combinations. Pass a profile's name as `profile` on send-task to run that task on it, or set it as an agent's default through PATCH /api/agents/{id}/runtime. A profile runs only on its own harness. Filter by `harness` to see what an agent on that harness can run.",
+    annotations: { readOnlyHint: true },
+    inputSchema: object({
+      harness: ProviderNameSchema.optional().describe("Only profiles for this harness (claude, codex, pi, ...).")
+    }),
+    outputSchema: swarmToolOutputSchema({
+      profiles: array(looseObject({
+        name: string().optional(),
+        harness: string().optional(),
+        model: string().optional(),
+        effort: string().nullable().optional(),
+        description: string().nullable().optional()
+      })).optional()
+    })
+  }, async ({ harness }) => {
+    const profiles = await listModelProfiles({ harness });
+    const lines = profiles.map((p) => `${p.name}: ${p.harness} / ${p.model}${p.effort ? ` / effort ${p.effort}` : ""}${p.description ? ` (${p.description})` : ""}`);
+    return toolOk(`${profiles.length} model profile(s)${harness ? ` for ${harness}` : ""}.`, {
+      details: lines.join(`
+`),
+      data: {
+        profiles: profiles.map((p) => ({
+          name: p.name,
+          harness: p.harness,
+          model: p.model,
+          effort: p.effort,
+          description: p.description
+        }))
+      }
+    });
+  });
+};
+
 // src/tools/my-agent-info.ts
 init_zod();
 init_db3();
@@ -117538,19 +117813,20 @@ var registerRequestHumanInputTool = (server) => {
     inputSchema: object({
       title: string().min(1).describe("Title of the approval request"),
       questions: array(QuestionSchema).min(1).describe("Questions to ask the human"),
-      timeoutSeconds: number().int().min(1).optional().describe("Seconds until the request expires. After that the request becomes 'timeout' and you get a hitl-follow-up task. A request with no timeout is cancelled after APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS days (default 7).")
+      timeoutSeconds: number().int().min(1).optional().describe("Seconds until the request expires. After that the request becomes 'timeout' and you get a hitl-follow-up task. A request with no timeout is cancelled after APPROVAL_REQUEST_AUTO_CANCELLATION_DAYS days (default 7)."),
+      detached: boolean().optional().describe("Do not attach the request to your current task, so no hitl-follow-up task is created. For scripts that read the request's status themselves.")
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string().optional(),
       requestId: string().optional(),
       url: string().optional()
     })
-  }, async ({ title, questions, timeoutSeconds }, requestInfo) => {
+  }, async ({ title, questions, timeoutSeconds, detached }, requestInfo) => {
     if (!requestInfo.agentId) {
       return toolErr('Agent ID not found. The MCP client should define the "X-Agent-ID" header.', { data: { yourAgentId: requestInfo.agentId } });
     }
-    let sourceTaskId = requestInfo.sourceTaskId;
-    if (!sourceTaskId && requestInfo.agentId) {
+    let sourceTaskId = detached ? undefined : requestInfo.sourceTaskId;
+    if (!sourceTaskId && !detached && requestInfo.agentId) {
       const currentTask = await getAgentCurrentTask(requestInfo.agentId);
       if (currentTask) {
         sourceTaskId = currentTask.id;
@@ -125737,7 +126013,13 @@ var registerScriptApisTool = (server) => {
           agentId: args2.agentId
         },
         requestInfo,
-        successMessage: (data) => `Endpoint ${data.id} created.`,
+        successMessage: (data) => {
+          const warnings = data.warnings ?? [];
+          const note = warnings.length > 0 ? `
+${warnings.join(`
+`)}` : "";
+          return `Endpoint ${data.id} created.${note}`;
+        },
         successDetails: (data) => {
           const token = data.token;
           return token ? `Bearer token (shown once — save it now): ${token}` : undefined;
@@ -126405,7 +126687,11 @@ var registerScriptUpsertTool = (server) => {
       const name = typeof body.name === "string" ? body.name : args2.name;
       const version = typeof body.version === "number" ? ` v${body.version}` : "";
       const deduped = body.contentDeduped ? " (content unchanged — deduped)" : "";
-      return `Script \`${name}\`${version} saved.${deduped}`;
+      const warnings = Array.isArray(body.warnings) ? body.warnings.map(String) : [];
+      const note = warnings.length > 0 ? `
+${warnings.join(`
+`)}` : "";
+      return `Script \`${name}\`${version} saved.${deduped}${note}`;
     }
   }));
 };
@@ -126413,6 +126699,7 @@ var registerScriptUpsertTool = (server) => {
 // src/tools/send-task.ts
 init_zod();
 init_db3();
+init_model_profiles();
 init_rbac();
 init_slack_routing();
 
@@ -126494,6 +126781,7 @@ var sendTaskInputSchema = object({
   modelTier: ModelTierSchema.optional().describe("Portable model tier for this task: 'smol', 'regular', 'smart', or 'ultra'. Resolved at claim/run time using the assignee's harness/provider. Legacy model shortnames map as haiku→smol, sonnet→regular, opus→smart, fable→ultra."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet (a fresh launch, a private deployment)."),
   effort: ReasoningEffortSchema.optional().describe("Reasoning effort for this task: 'off', 'low', 'medium', 'high', 'xhigh', or 'max'. If omitted, the assignee's REASONING_EFFORT_OVERRIDE/default applies."),
+  profile: string().trim().min(1).optional().describe("Model profile name (see list-model-profiles): a named harness + model + effort, applied when the task is claimed. Must run on the assignee's harness. Exclusive with model and modelTier. A set `effort` still wins over the profile's."),
   allowDuplicate: boolean().default(false).describe("If true, skip duplicate detection and create the task even if a similar one exists."),
   slackChannelId: string().optional().describe("Slack channel ID to post progress updates to. Use this to propagate Slack context when delegating from a Slack thread."),
   slackThreadTs: string().optional().describe("Slack thread timestamp. Required with slackChannelId for thread-level updates."),
@@ -126569,6 +126857,7 @@ async function sendTaskHandler(ctx, {
   modelTier,
   allowCustomModel,
   effort,
+  profile,
   allowDuplicate,
   slackChannelId,
   slackThreadTs,
@@ -126693,6 +126982,14 @@ async function sendTaskHandler(ctx, {
   });
   if (modelError)
     return toolErr(modelError, { data: { yourAgentId: creatorAgentId } });
+  const profileError = await taskProfileError({
+    profile,
+    model: normalizedModel.model,
+    modelTier: normalizedModel.modelTier,
+    agentId: effectiveAgentId
+  });
+  if (profileError)
+    return toolErr(profileError, { data: { yourAgentId: creatorAgentId } });
   const effectiveRoutingReason = requestedAgentId !== undefined ? requestedRoutingReason : effectiveAgentId ? "continuity" : undefined;
   const effectiveRoutingNote = effectiveRoutingReason ? requestedRoutingNote : undefined;
   const effectiveRoutingSource = ctx.kind === "user" ? "engine_default" : requestedAgentId !== undefined ? "declared" : effectiveAgentId ? "engine_default" : undefined;
@@ -126714,6 +127011,7 @@ async function sendTaskHandler(ctx, {
     model: normalizedModel.model,
     modelTier: normalizedModel.modelTier,
     effort,
+    profile,
     slackChannelId,
     slackThreadTs,
     slackUserId,
@@ -126790,7 +127088,7 @@ async function sendTaskHandler(ctx, {
     };
     return guard.ok ? toolOk(guard.message, { data: guardData }) : toolErr(guard.message, { data: guardData });
   }
-  const result = await getDbClient().transaction(async () => {
+  const created = getDbClient().transaction(async () => {
     const raced = await evaluateDedupGuards();
     if (raced)
       return { success: raced.ok, message: raced.message, task: raced.task };
@@ -126865,6 +127163,11 @@ async function sendTaskHandler(ctx, {
       task: newTask
     };
   });
+  const result = await created.catch((error) => {
+    if (modelProfileRefError(error) !== "missing")
+      throw error;
+    return { success: false, message: `Unknown model profile "${profile}".`, task: undefined };
+  });
   const data = {
     yourAgentId: creatorAgentId,
     task: result.task
@@ -130408,6 +130711,64 @@ var registerSwarmXTool = (server) => {
   });
 };
 
+// src/tools/system-one-decide.ts
+init_zod();
+var registerSystemOneDecideTool = (server) => {
+  createToolRegistrar(server)("system-one-decide", {
+    title: "Ask a SystemOne decision model",
+    annotations: { destructiveHint: false, openWorldHint: true },
+    description: "Send a state and typed questions (noul, choice, score) to a SystemOne decision host such as Jev, and return the validated answers. " + "Same request, provider list, credentials and validation as the `system-one-decision` workflow node, without its human review band. " + "The provider credential is a global secret that stays on the server; this tool never returns it.",
+    inputSchema: object({
+      provider: _enum(SYSTEM_ONE_PROVIDER_IDS).optional().describe("Decision host (default typesafe)"),
+      model: string().min(1).optional().describe("Provider model id (default: the provider's)"),
+      state: union([string(), array(string()), record(string(), unknown())]).describe("The state to decide on"),
+      questions: record(string(), record(string(), unknown())).describe("Questions by id, each `{ type: 'noul' | 'choice' | 'score', instructions, criteria }`"),
+      timeoutMs: number().int().optional().describe("Time budget for the call, retries included (default 30000)"),
+      maxRetries: number().int().optional().describe("Retries on transient failures inside the time budget (default 2)")
+    }),
+    outputSchema: swarmToolOutputSchema({
+      model: string().optional(),
+      answers: record(string(), unknown()).optional(),
+      usage: record(string(), unknown()).optional(),
+      requestId: string().optional()
+    })
+  }, async ({ provider, model, state: state2, questions, timeoutMs, maxRetries }, requestInfo) => {
+    if (!requestInfo.agentId) {
+      return toolErr('Agent ID not found. The MCP client should define the "X-Agent-ID" header.');
+    }
+    const returns = Object.fromEntries(Object.entries(questions).map(([id2, question]) => [id2, { type: question.type }]));
+    const parsed = SystemOneDecisionConfigSchema.safeParse({
+      provider,
+      model,
+      state: state2,
+      questions,
+      returns,
+      timeoutMs,
+      maxRetries
+    });
+    if (!parsed.success) {
+      const issues = parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+      return toolErr(`Invalid decision request: ${issues}`.slice(0, 1000));
+    }
+    const executor = getExecutorRegistry().get(SYSTEM_ONE_DECISION_NODE_TYPE);
+    if (!(executor instanceof SystemOneDecisionExecutor)) {
+      return toolErr("The system-one-decision executor is not available");
+    }
+    const decided = await executor.decide(parsed.data);
+    if (!decided.ok)
+      return toolErr(decided.error);
+    const { output } = decided;
+    return toolOk(`Decision from ${output.model}`, {
+      data: {
+        model: output.model,
+        answers: output.answers,
+        usage: output.usage,
+        requestId: output.requestId
+      }
+    });
+  });
+};
+
 // src/tools/task-action.ts
 init_zod();
 
@@ -130530,7 +130891,7 @@ async function emitBudgetRefusalSideEffects(ctx, inserted) {
       console.warn(`[budget-refusal-notify] Failed to create follow-up task for budget refusal (task=${ctx.task.id.slice(0, 8)}): ${err}`);
     }
   }
-  import("./event-bus-6axnngdj.js").then(({ workflowEventBus: workflowEventBus2 }) => {
+  import("./event-bus-j2jdg3qb.js").then(({ workflowEventBus: workflowEventBus2 }) => {
     workflowEventBus2.emit("task.budget_refused", {
       taskId: ctx.task.id,
       agentId: ctx.agentId,
@@ -130548,6 +130909,7 @@ async function emitBudgetRefusalSideEffects(ctx, inserted) {
 
 // src/tools/task-action.ts
 init_db3();
+init_model_profiles();
 init_types();
 var TaskActionSchema = _enum([
   "create",
@@ -130573,6 +130935,7 @@ var taskActionInputSchema = object({
   modelTier: ModelTierSchema.optional().describe("Portable model tier for the created task: 'smol', 'regular', 'smart', or 'ultra'. Resolved when a worker claims/runs the task. Only used with 'create' action."),
   allowCustomModel: boolean().optional().describe("Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only used with 'create' action."),
   effort: ReasoningEffortSchema.optional().describe("Reasoning effort for the created task: 'off', 'low', 'medium', 'high', 'xhigh', or 'max'. Only used with 'create' action."),
+  profile: string().trim().min(1).optional().describe("Model profile name for the created pool task (see list-model-profiles); only workers on its harness claim it. Exclusive with model and modelTier. Only used with 'create' action."),
   requiredCapabilities: array(string()).optional().describe("Capabilities required for pool routing."),
   leadOnly: boolean().default(false).describe("Structured authorization constraint: only Lead agents may claim this privileged task.")
 });
@@ -130700,6 +131063,13 @@ async function taskActionHandler(ctx, input) {
     });
     if (modelError)
       return taskActionResult({ success: false, message: modelError }, agentId);
+    const profileError = await taskProfileError({
+      profile: input.profile,
+      model: normalizedModel.model,
+      modelTier: normalizedModel.modelTier
+    });
+    if (profileError)
+      return taskActionResult({ success: false, message: profileError }, agentId);
     try {
       assetKey = key ? await authorizeAssetKeyWrite(key, await resolveTaskAuditUserId(ctx.sourceTaskId, agentId)) : undefined;
     } catch (error) {
@@ -130720,6 +131090,7 @@ async function taskActionHandler(ctx, input) {
         model: normalizedModel.model,
         modelTier: normalizedModel.modelTier,
         effort: input.effort,
+        profile: input.profile,
         routingAffinity: leadOnly || requiredCapabilities?.length ? { leadOnly, capabilities: requiredCapabilities ?? [] } : undefined
       },
       origin: "mcp",
@@ -130734,7 +131105,7 @@ async function taskActionHandler(ctx, input) {
       options: preCreate.options
     };
   }
-  const result = await getDbClient().transaction(async () => {
+  const transacted = getDbClient().transaction(async () => {
     switch (action) {
       case "create": {
         const newTask = await createTaskExtended(preparedCreate.description, preparedCreate.options);
@@ -131002,6 +131373,11 @@ async function taskActionHandler(ctx, input) {
         return { success: false, message: `Unknown action: ${action}` };
     }
   });
+  const result = await transacted.catch((error) => {
+    if (modelProfileRefError(error) !== "missing")
+      throw error;
+    return { success: false, message: `Unknown model profile "${input.profile}".` };
+  });
   if ("refusalSideEffects" in result && result.refusalSideEffects && typeof result.refusalSideEffects === "object") {
     const sideEffects = result.refusalSideEffects;
     await emitBudgetRefusalSideEffects(sideEffects.context, sideEffects.inserted);
@@ -132356,6 +132732,11 @@ async function createServer(opts = {}) {
   initDb(process.env.DATABASE_PATH);
   ensurePricingSeeded();
   startPricingRefreshLoop();
+  try {
+    await ensureModelProfilesSeeded();
+  } catch (err) {
+    console.error("[server] Failed to seed model profiles:", err);
+  }
   try {
     ensureRbacSeeded();
   } catch (err) {
@@ -132399,6 +132780,7 @@ async function createServer(opts = {}) {
     registerGetTasksTool(server);
     registerGetMetricsTool(server);
     registerSendTaskTool(server);
+    registerListModelProfilesTool(server);
     registerGetTaskDetailsTool(server);
     registerStoreProgressTool(server);
     registerMyAgentInfoTool(server);
@@ -132503,6 +132885,7 @@ async function createServer(opts = {}) {
     registerGetWorkflowRunTool(server);
     registerRetryWorkflowRunTool(server);
     registerCancelWorkflowRunTool(server);
+    registerSystemOneDecideTool(server);
     registerRequestHumanInputTool(server);
     registerCancelApprovalRequestTool(server);
   }
@@ -132674,6 +133057,7 @@ var SDK_TOOL_NAME_MAP = {
   config_delete: "delete-config",
   modelCatalog_refresh: "model-catalog-refresh",
   modelCatalog_overlayUpsert: "model-catalog-overlay-upsert",
+  modelProfile_list: "list-model-profiles",
   slack_read: "slack-read",
   slack_listChannels: "slack-list-channels",
   slack_post: "slack-post",
@@ -132749,7 +133133,8 @@ var SDK_TOOL_NAME_MAP = {
   page_delete: "delete-page",
   metric_create: "create_metric",
   request_humanInput: "request-human-input",
-  approval_cancel: "cancel-approval-request"
+  approval_cancel: "cancel-approval-request",
+  systemOne_decide: "system-one-decide"
 };
 var SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP);
 var MCP_TOOL_NAMES = new Set(Object.values(SDK_TOOL_NAME_MAP));
@@ -133540,7 +133925,7 @@ async function deactivateExtensionAgent(name) {
 
 // src/extensions/loader.ts
 import { tmpdir as tmpdir5 } from "node:os";
-import { resolve as resolve2 } from "node:path";
+import { dirname as dirname2, isAbsolute, relative, resolve as resolve2, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 init_types();
 init_secret_scrubber();
@@ -133610,11 +133995,12 @@ async function removeExtensionTmpRoot() {
 }
 async function loadExtension(input) {
   const { record: record3 } = input;
-  const directory = `${EXTENSIONS_TMP_ROOT}/${record3.name}/${record3.contentHash}`;
+  const directory = resolve2(EXTENSIONS_TMP_ROOT, record3.name, record3.contentHash);
   try {
     const bundlePath = (path2) => {
       const filePath = resolve2(directory, path2);
-      if (!isSafeBundlePath(path2) || !filePath.startsWith(`${directory}/`)) {
+      const relativePath = relative(directory, filePath);
+      if (!isSafeBundlePath(path2) || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
         throw new Error(`Unsafe bundle file path: ${JSON.stringify(path2)}`);
       }
       return filePath;
@@ -133623,8 +134009,7 @@ async function loadExtension(input) {
     const files = Object.entries(input.files).map(([path2, content]) => [bundlePath(path2), content]);
     await Bun.$`mkdir -p ${directory}`.quiet();
     for (const [filePath, content] of files) {
-      const parent = filePath.slice(0, filePath.lastIndexOf("/"));
-      await Bun.$`mkdir -p ${parent}`.quiet();
+      await Bun.$`mkdir -p ${dirname2(filePath)}`.quiet();
       await Bun.write(filePath, content);
     }
     await writeRuntimeShims(directory);
@@ -133684,7 +134069,7 @@ async function loadExtension(input) {
 init_db3();
 init_secret_scrubber();
 init_event_bus();
-var subscribed3 = false;
+var subscribed4 = false;
 function observed3(eventName, handler) {
   return (data) => {
     handler(data).catch((error) => {
@@ -133703,7 +134088,7 @@ var onTaskCreated3 = observed3("task.created", async (data) => {
   if (task)
     await dispatchPost("post.task.created", { task }, { skipExtensionId: extensionIdForAgent(task.creatorAgentId) });
 });
-var onTaskCompleted3 = observed3("task.completed", async (data) => {
+var onTaskCompleted4 = observed3("task.completed", async (data) => {
   const task = await taskFrom(data);
   if (!task)
     return;
@@ -133925,11 +134310,11 @@ var onVcsEvent = (name, data) => {
   });
 };
 function initExtensionPostBridge() {
-  if (subscribed3)
+  if (subscribed4)
     return;
-  subscribed3 = true;
+  subscribed4 = true;
   workflowEventBus.on("task.created", onTaskCreated3);
-  workflowEventBus.on("task.completed", onTaskCompleted3);
+  workflowEventBus.on("task.completed", onTaskCompleted4);
   workflowEventBus.on("task.failed", onTaskFailed3);
   workflowEventBus.on("task.cancelled", onTaskCancelled3);
   workflowEventBus.on("task.superseded", onTaskSuperseded);
@@ -133945,11 +134330,11 @@ function initExtensionPostBridge() {
     workflowEventBus.onPrefix(prefix, onVcsEvent);
 }
 function teardownExtensionPostBridge() {
-  if (!subscribed3)
+  if (!subscribed4)
     return;
-  subscribed3 = false;
+  subscribed4 = false;
   workflowEventBus.off("task.created", onTaskCreated3);
-  workflowEventBus.off("task.completed", onTaskCompleted3);
+  workflowEventBus.off("task.completed", onTaskCompleted4);
   workflowEventBus.off("task.failed", onTaskFailed3);
   workflowEventBus.off("task.cancelled", onTaskCancelled3);
   workflowEventBus.off("task.superseded", onTaskSuperseded);
@@ -135199,7 +135584,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp: getSlackApp2 } = await import("./app-kfvgbvzy.js");
+        const { getSlackApp: getSlackApp2 } = await import("./app-7k8s9w5p.js");
         const app = getSlackApp2();
         if (!app) {
           return {
@@ -135311,6 +135696,7 @@ function evaluateCondition(op, actual, expected) {
 
 // src/workflows/executors/raw-llm.ts
 init_zod();
+init_secret_scrubber();
 var RawLlmConfigSchema = exports_external.object({
   prompt: exports_external.string(),
   model: exports_external.string().optional(),
@@ -135359,7 +135745,7 @@ async function executeRawLlm(config) {
     };
   } catch (err) {
     const httpStatus = err?.status ?? err?.statusCode;
-    const isRateLimited = httpStatus === 429 || httpStatus === 529 || err instanceof Error && /rate.?limit|too many requests|529/i.test(err.message);
+    const isRateLimited = httpStatus === 429 || httpStatus === 529 || err instanceof Error && /rate.?limit|too many requests|\b529\b/i.test(err.message);
     if (isRateLimited) {
       throw err;
     }
@@ -135367,12 +135753,12 @@ async function executeRawLlm(config) {
       return {
         status: "success",
         output: { result: null, model: modelName },
-        error: `LLM call failed, using fallback port: ${err instanceof Error ? err.message : String(err)}`
+        error: scrubSecrets(`LLM call failed, using fallback port: ${err instanceof Error ? err.message : String(err)}`)
       };
     }
     return {
       status: "failed",
-      error: `LLM call failed: ${err instanceof Error ? err.message : String(err)}`
+      error: scrubSecrets(`LLM call failed: ${err instanceof Error ? err.message : String(err)}`)
     };
   }
 }
@@ -135974,7 +136360,12 @@ function createExecutorRegistry(deps) {
 
 // src/workflows/index.ts
 var _registry = null;
-var slackMessageTriggerListenerInitialized = false;
+var eventTriggerListenersInitialized = false;
+var EVENT_TRIGGER_NAMES = [
+  "slack.message",
+  "azure-devops.work_item.assigned",
+  "azure-devops.work_item.commented"
+];
 function createBuiltInExecutorRegistry() {
   return createExecutorRegistry({
     db: exports_db,
@@ -135986,20 +136377,22 @@ function getExecutorRegistry() {
   _registry ??= createBuiltInExecutorRegistry();
   return _registry;
 }
-function setupSlackMessageTriggerListener() {
-  if (slackMessageTriggerListenerInitialized)
+function setupEventTriggerListeners() {
+  if (eventTriggerListenersInitialized)
     return;
-  workflowEventBus.on("slack.message", (payload) => {
-    handleEventTrigger("slack.message", payload, getExecutorRegistry()).catch((err) => {
-      console.error("[workflows] Failed to dispatch slack.message event trigger:", scrubSecrets(err instanceof Error ? err.message : String(err)));
+  for (const eventName of EVENT_TRIGGER_NAMES) {
+    workflowEventBus.on(eventName, (payload) => {
+      handleEventTrigger(eventName, payload, getExecutorRegistry()).catch((err) => {
+        console.error(`[workflows] Failed to dispatch ${eventName} event trigger:`, scrubSecrets(err instanceof Error ? err.message : String(err)));
+      });
     });
-  });
-  slackMessageTriggerListenerInitialized = true;
+  }
+  eventTriggerListenersInitialized = true;
 }
 async function initWorkflows() {
   _registry = getExecutorRegistry();
   setupWorkflowResumeListener(workflowEventBus, _registry);
-  setupSlackMessageTriggerListener();
+  setupEventTriggerListeners();
   recoverIncompleteRuns(_registry).catch((err) => {
     console.error("[workflows] Failed to recover incomplete runs on startup:", err);
   });
@@ -136009,4 +136402,4 @@ async function initWorkflows() {
   logOpenWebhookTriggers();
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity2 as recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity2 as recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, logOpenWebhookTriggers, handleEventTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, snapshotAndUpdateWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry, initWorkflows, dispatchScheduleTarget, calculateNextRun, startScheduler, stopScheduler, runScheduleNow, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError, isRegistered, isExtensionAgentId, getExtensionBridgeToken, resolveBridgeCallOrigin, extensionIdForAgent, runContext, registerLoaded, unregister, listRegistered, dispatchPre, dispatchPost, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };