@desplega.ai/agent-swarm 2.3.0 → 2.4.1

package/dist/{http-mzh41mfj.js → http-k2ejbt05.js}

@@ -69,28 +69,6 @@ import {
   resolveKvView,
   toolErr,
   createToolRegistrar,
-  duplicateGuardedQueryKey,
-  warnIfCorsAllowsAnyOrigin,
-  isOriginAllowedForCredentials,
-  allowedCredentialRedirect,
-  setCorsHeaders,
-  parseQueryParams,
-  getPathSegments,
-  wireHttpSpanLifecycle,
-  safeRequestUrlForLog,
-  agentWithCapacity,
-  parseBody,
-  BODY_TOO_LARGE,
-  enforceContentLengthCap,
-  json,
-  jsonError,
-  writeUnhandledError,
-  triggerSchemaErrorResponse,
-  deriveApiBaseUrl,
-  httpServerSemconvAttributes,
-  runtimeInstanceHeader,
-  describeRequestRoute,
-  route,
   handleMcpBridge,
   Redacted,
   SCRIPT_SDK_RESPONSE_LIMIT_BYTES,
@@ -199,9 +177,6 @@ import {
   scheduleIntegrationsReload,
   handleCore,
   userCtx,
-  resolveTaskAuditUserId,
-  resolveHttpAuditUserId,
-  resolveHttpFavoriteOwner,
   handleApps,
   cancelApprovalRequest,
   getUserCommsPrefs,
@@ -262,6 +237,8 @@ import {
   resolveRoomNamespace,
   roomRequestInfo,
   authorizeRoomNamespace,
+  sessionAccessTopic,
+  sessionPresenceRoot,
   RoomOperationSchema,
   removeAwarenessStates,
   roomTopic,
@@ -303,7 +280,7 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-8qsx817b.js";
+} from "./cli-kr2pmfqx.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -311,6 +288,10 @@ import {
   init_context_key,
   init_catalog,
   catalog_default,
+  COMPANY_TEAM_SIZES,
+  COMPANY_USE_CASES,
+  USER_FUNCTIONS,
+  init_company_profile,
   TELEMETRY_PROXY_ORIGIN,
   normalizeOrgWebsite,
   orgLogoUrl,
@@ -325,6 +306,7 @@ import {
   _resolveIntegrationType,
   _resolveIntegrationProvider,
   setTelemetryRoleResolver,
+  setTelemetryFunctionResolver,
   isTelemetryReady,
   trackRelayed,
   telemetry,
@@ -349,6 +331,7 @@ import {
   getDbClient2,
   init_runtime,
   cachedUserRole,
+  cachedUserFunction,
   configureOrgDomainPersistence,
   recomputeOrgDomain,
   init_telemetry_identity,
@@ -440,6 +423,13 @@ import {
   CHAT_SDK_ADAPTER_NAMES,
   isAdapterEntryEnabled,
   init_schema,
+  TELEMETRY_RANKING_KEY,
+  PUBLIC_RANKING_ENABLED_KEY,
+  RANKING_CATEGORIES,
+  readTelemetryRanking,
+  rankingFormSchema,
+  buildListing,
+  init_telemetry_ranking,
   API_DRAINING_HEADER,
   init_api_drain,
   parseTaskToolManifest,
@@ -724,26 +714,26 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-re4wkbzx.js";
+} from "./cli-rqqsfz30.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-6vcyw6v7.js";
-import"./cli-xgn4rwyv.js";
+} from "./cli-nx462e4v.js";
+import"./cli-s48yvzb8.js";
 import {
   normalizeModelKey
-} from "./cli-qrwp40st.js";
+} from "./cli-3p8fqcnh.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-kqypty34.js";
+} from "./cli-k9z4zd4p.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-fhvqt2fp.js";
+} from "./cli-sv5gb0yb.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -755,7 +745,7 @@ import {
   cancelWorkflowRun2,
   TriggerSchemaError,
   startWorkflowExecution2
-} from "./cli-jhmjwqcg.js";
+} from "./cli-kmqgmcnb.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -835,14 +825,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-65q70v2v.js";
+} from "./cli-0bh477zn.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-g6p7c2my.js";
+} from "./cli-sjyetj21.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -870,15 +860,15 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-dxwh4j32.js";
-import"./cli-9e9kjqsj.js";
+} from "./cli-vy0fay6k.js";
+import"./cli-mfe7f7b5.js";
 import {
   createApprovalFollowUpTask,
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-q1812jbw.js";
-import"./cli-8cvvytad.js";
+} from "./cli-tbhwrxpt.js";
+import"./cli-8nyhf7za.js";
 import {
   _fetchHolder,
   CLIENT_ID,
@@ -889,11 +879,53 @@ import {
   codexOAuthKeyForSlot,
   loadAllCodexOAuthSlots,
   getValidCodexOAuth
-} from "./cli-vjfpshn3.js";
+} from "./cli-ejs3m1sx.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-ptkpaqfy.js";
+} from "./cli-wt645v7q.js";
+import {
+  duplicateGuardedQueryKey,
+  warnIfCorsAllowsAnyOrigin,
+  isOriginAllowedForCredentials,
+  allowedCredentialRedirect,
+  setCorsHeaders,
+  parseQueryParams,
+  getPathSegments,
+  wireHttpSpanLifecycle,
+  safeRequestUrlForLog,
+  agentWithCapacity,
+  parseBody,
+  BODY_TOO_LARGE,
+  enforceContentLengthCap,
+  json,
+  jsonError,
+  writeUnhandledError,
+  triggerSchemaErrorResponse,
+  deriveApiBaseUrl,
+  httpServerSemconvAttributes,
+  hasSessionAccess,
+  getSessionRoot,
+  sessionAccessForRoot,
+  listActiveSessionShares,
+  toSessionSharesState,
+  setSessionShares,
+  resolveTaskAuditUserId,
+  resolveHttpAuditUserId,
+  dashboardUserIdHeader,
+  resolveHttpFavoriteOwner,
+  resolveSessionActor2,
+  sessionAccessFor2,
+  SESSION_READ_DENIED2,
+  canReadSession2,
+  readableByFor2,
+  SESSION_WRITE_DENIED2,
+  runtimeInstanceHeader,
+  bodyTask,
+  bodyListTask,
+  describeRequestRoute,
+  route
+} from "./cli-z071fb95.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-7a91w22y.js";
@@ -906,24 +938,6 @@ import {
 } from "./cli-qje9k2nh.js";
 import {
   RuntimePoolError2,
-  registerSessionTokenConnection,
-  init_session_token_connections,
-  findUserById,
-  getUserIdentities,
-  listUserEvents,
-  listUserTokens,
-  recordIdentityEvent,
-  linkIdentity,
-  unlinkIdentity,
-  mintToken,
-  revokeToken,
-  resolveUserByToken,
-  InvalidRuntimeTokenError,
-  mintSessionToken,
-  mintRuntimeToken,
-  revokeSessionToken,
-  fingerprintApiKey,
-  init_users,
   mintControllerToken,
   init_tokens,
   listRuntimeControllers2,
@@ -942,13 +956,13 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-hz64bcnj.js";
+} from "./cli-bn5kevnf.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
 } from "./cli-3h26v7yj.js";
-import"./cli-rdr166ht.js";
+import"./cli-smvcw9z5.js";
 import {
   startPoolRouting,
   stopPoolRouting,
@@ -958,8 +972,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-ka01m5rb.js";
-import"./cli-d43xqzbe.js";
+} from "./cli-rdq7tzwm.js";
+import"./cli-hqhzg1qq.js";
 import {
   import_websocket,
   import_websocket_server
@@ -968,32 +982,34 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-fp4xbw07.js";
+} from "./cli-axh29tyr.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-a49vpbf3.js";
+} from "./cli-5kqnemen.js";
 import {
   reasoningCapability,
   supportedReasoningLevels
-} from "./cli-p22zdvnt.js";
+} from "./cli-bn0rewsy.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
 } from "./cli-gx4rm0qx.js";
-import {
-  inviteEmailToSharedOrg,
-  ensureAgentFsCredentialsForAgent
-} from "./cli-yv3n83x8.js";
-import {
-  Anthropic
-} from "./cli-er83cjbn.js";
 import {
   isLeadChannelMonitoringEnabled,
+  ORG_IDENTITY_KEYS,
+  orgIdentityStatus,
   SIMILARITY_THRESHOLD,
   memoryRelevance,
   isUnknownModelError,
   writeSkillsToFilesystem
-} from "./cli-4g629sgr.js";
+} from "./cli-m2qgh5sv.js";
+import {
+  inviteEmailToSharedOrg,
+  ensureAgentFsCredentialsForAgent
+} from "./cli-syhq378v.js";
+import {
+  Anthropic
+} from "./cli-er83cjbn.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1005,7 +1021,27 @@ import"./cli-13p25grh.js";
 import"./cli-0adyhvq2.js";
 import {
   require_content_type
-} from "./cli-gzvb3d4a.js";
+} from "./cli-1jx0srjt.js";
+import {
+  registerSessionTokenConnection,
+  init_session_token_connections,
+  findUserById,
+  getUserIdentities,
+  listUserEvents,
+  listUserTokens,
+  recordIdentityEvent,
+  linkIdentity,
+  unlinkIdentity,
+  mintToken,
+  revokeToken,
+  resolveUserByToken,
+  InvalidRuntimeTokenError,
+  mintSessionToken,
+  mintRuntimeToken,
+  revokeSessionToken,
+  fingerprintApiKey,
+  init_users
+} from "./cli-fz9kewbh.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import {
@@ -1019,7 +1055,7 @@ import {
   clearAuditSink,
   can,
   init_rbac
-} from "./cli-zj4d6afs.js";
+} from "./cli-1pa3rz69.js";
 import {
   isSafeBundlePath,
   init_bundle_path,
@@ -1039,6 +1075,10 @@ import {
   ProviderNameSchema,
   ModelProfileNameSchema,
   ModelProfileSchema,
+  SessionAccessSchema,
+  SessionOwnerSchema,
+  SessionSharesSchema,
+  SessionSharesUpdateSchema,
   SteerModeSchema,
   SteeringSourceSchema,
   SteeringMessageSchema,
@@ -1093,6 +1133,7 @@ import {
   RuntimePoolSchema,
   RuntimePoolCreateAgentSchema,
   RuntimeInstanceSchema,
+  SUPERSEDED_WORKFLOW_TASK_REASON,
   WorkflowEdgeSchema,
   WorkflowDefinitionSchema,
   WorkflowNodePatchSchema,
@@ -1156,12 +1197,12 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-yv0vgscc.js";
+} from "./cli-fpmsqq59.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-cby329ny.js";
+} from "./cli-x5mq1fyq.js";
 import {
   getSlackConfiguration,
   init_config
@@ -1179,7 +1220,7 @@ import {
   resolveTemplate,
   init_resolver,
   init_session_templates
-} from "./cli-w7z94e6c.js";
+} from "./cli-tx00c0h6.js";
 import {
   MODEL_SCOPED_WINDOWS,
   activeModelBlocks,
@@ -1201,6 +1242,7 @@ import {
 import {
   NEVER,
   toJSONSchema,
+  ZodError,
   string2,
   email,
   uuid,
@@ -1228,7 +1270,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-5d1m1qca.js";
+} from "./cli-ash6xxk7.js";
 import {
   realtimeBus,
   init_bus
@@ -1257,11 +1299,11 @@ import {
   scrubObject,
   registerVolatileSecret,
   init_secret_scrubber
-} from "./cli-4mkvwgzr.js";
+} from "./cli-xf234ws8.js";
 import {
   isAlias,
   init_src2
-} from "./cli-x3en6ct3.js";
+} from "./cli-nwyw3zhg.js";
 import {
   __toESM
 } from "./cli-242037k3.js";
@@ -2367,7 +2409,8 @@ function identityFromHttpAuth(req, auth) {
       agentId,
       sourceTaskId: auth.kind === "agent" ? auth.taskId ?? undefined : header(req, "x-source-task-id"),
       userId: auth.kind === "user" ? auth.userId : undefined,
-      isOperator: auth.kind === "operator"
+      isOperator: auth.kind === "operator",
+      dashboardUserId: auth.kind === "operator" ? auth.dashboardUserId : undefined
     },
     me: {
       userId: auth.kind === "user" ? auth.userId : agentId ?? guestId,
@@ -2560,6 +2603,9 @@ function connect(ws, auth, runtimeId) {
       if (namespace.startsWith("presence:comb:") && msg.name !== "default") {
         throw new Error("Comb presence uses the default room");
       }
+      if (namespace.startsWith("presence:session:") && msg.name !== "default") {
+        throw new Error("Session presence uses the default room");
+      }
       const denied = await authorizeRoomNamespace(namespace, auth.identity, msg.op, msg.name);
       if (denied)
         throw new Error(typeof denied === "string" ? denied : "Forbidden");
@@ -2600,7 +2646,7 @@ function connect(ws, auth, runtimeId) {
           } catch (error) {
             if (!(error instanceof Error) || error.message !== "room does not exist")
               throw error;
-            const creationDenied = await authorizeRoomNamespace(namespace, auth.identity, namespace.startsWith("presence:comb:") ? "join" : true);
+            const creationDenied = await authorizeRoomNamespace(namespace, auth.identity, namespace.startsWith("presence:comb:") || namespace.startsWith("presence:session:") ? "join" : true);
             if (creationDenied)
               throw new Error(creationDenied);
             if (closed)
@@ -2610,6 +2656,8 @@ function connect(ws, auth, runtimeId) {
           if (closed)
             return;
           const stopRoom = realtimeBus.subscribe(key, (event) => {
+            if (rooms.get(key)?.suspended)
+              return;
             const view = event;
             const type = view.type;
             if (type === "deleted") {
@@ -2631,15 +2679,62 @@ function connect(ws, auth, runtimeId) {
               }).catch(() => ws.close(1011, "Room reset failed"));
             }
           });
-          const stopPresence = realtimeBus.subscribe(`presence:${key}`, (peers) => send({ type: "presence", name: msg.name, namespace, peers }));
+          const stopPresence = realtimeBus.subscribe(`presence:${key}`, (peers) => {
+            if (rooms.get(key)?.suspended)
+              return;
+            send({ type: "presence", name: msg.name, namespace, peers });
+          });
+          const sessionRoot = sessionPresenceRoot(namespace);
+          let accessCheck = 0;
+          const stopAccess = sessionRoot ? realtimeBus.subscribe(sessionAccessTopic(sessionRoot), () => {
+            const joined = rooms.get(key);
+            if (!joined)
+              return;
+            joined.suspended = true;
+            const check = ++accessCheck;
+            authorizeRoomNamespace(namespace, auth.identity, "join").catch(() => "Session access check failed").then((denied) => {
+              const current = rooms.get(key);
+              if (closed || !current || check !== accessCheck)
+                return;
+              if (denied) {
+                leave(key);
+                send({ type: "error", name: msg.name, namespace, error: denied });
+                return;
+              }
+              current.suspended = false;
+              send({
+                type: "presence",
+                name: msg.name,
+                namespace,
+                peers: [...current.room.awareness.getStates().values()]
+              });
+            });
+          }) : undefined;
           rooms.set(key, {
             room,
             version: msg.schemaVersion,
             stop: () => {
               stopRoom();
               stopPresence();
-            }
+              stopAccess?.();
+            },
+            suspended: sessionRoot !== undefined
           });
+          if (sessionRoot) {
+            const check = ++accessCheck;
+            const denied = await authorizeRoomNamespace(namespace, auth.identity, "join").catch(() => "Session access check failed");
+            if (closed)
+              return;
+            if (denied) {
+              leave(key);
+              throw new Error(denied);
+            }
+            const current = rooms.get(key);
+            if (!current)
+              throw new Error("You don't have access to this session");
+            if (check === accessCheck)
+              current.suspended = false;
+          }
           room.awareness.states.set(clientId, { ...auth.me, data: {} });
           room.awareness.meta.set(clientId, { clock: 1, lastUpdated: Date.now() });
           publishPresence(room);
@@ -3799,6 +3894,7 @@ function startTelemetryTicker(deps) {
     return;
   stopTelemetryTicker();
   setTelemetryRoleResolver(cachedUserRole);
+  setTelemetryFunctionResolver(cachedUserFunction);
   const tick = async () => {
     try {
       await recomputeOrgDomain();
@@ -3829,6 +3925,7 @@ function stopTelemetryTicker() {
   tickTimer = null;
   firstTimer = null;
   setTelemetryRoleResolver(null);
+  setTelemetryFunctionResolver(null);
   configureOrgDomainPersistence(null);
 }
 
@@ -3863,6 +3960,7 @@ var createActiveSession = route({
   method: "post",
   path: "/api/active-sessions",
   pattern: ["api", "active-sessions"],
+  session: bodyTask("taskId"),
   summary: "Create a new active session",
   tags: ["Active Sessions"],
   body: object2({
@@ -3883,6 +3981,7 @@ var deleteSessionByTask = route({
   method: "delete",
   path: "/api/active-sessions/by-task/{taskId}",
   pattern: ["api", "active-sessions", "by-task", null],
+  session: { taskParam: "taskId" },
   summary: "Delete active session by task ID",
   tags: ["Active Sessions"],
   params: object2({ taskId: string2() }),
@@ -3894,6 +3993,7 @@ var deleteSessionById = route({
   method: "delete",
   path: "/api/active-sessions/{id}",
   pattern: ["api", "active-sessions", null],
+  session: { activeSessionParam: "id" },
   summary: "Delete active session by ID",
   tags: ["Active Sessions"],
   params: object2({ id: string2() }),
@@ -3905,6 +4005,7 @@ var heartbeatSession = route({
   method: "put",
   path: "/api/active-sessions/heartbeat/{taskId}",
   pattern: ["api", "active-sessions", "heartbeat", null],
+  session: { taskParam: "taskId" },
   summary: "Update heartbeat for an active session",
   tags: ["Active Sessions"],
   params: object2({ taskId: string2() }),
@@ -3916,6 +4017,7 @@ var updateProviderSession = route({
   method: "put",
   path: "/api/active-sessions/provider-session/{taskId}",
   pattern: ["api", "active-sessions", "provider-session", null],
+  session: { taskParam: "taskId" },
   summary: "Update provider session ID on an active session",
   tags: ["Active Sessions"],
   params: object2({ taskId: string2() }),
@@ -3928,6 +4030,7 @@ var cleanupSessions = route({
   method: "post",
   path: "/api/active-sessions/cleanup",
   pattern: ["api", "active-sessions", "cleanup"],
+  session: { agentWide: "Deletes every session of an agent, or every stale session." },
   summary: "Clean up stale sessions",
   tags: ["Active Sessions"],
   body: object2({
@@ -3942,6 +4045,7 @@ var recoverOrphanedTasks = route({
   method: "post",
   path: "/api/active-sessions/recover-orphaned-tasks",
   pattern: ["api", "active-sessions", "recover-orphaned-tasks"],
+  session: { none: "Its handler admits only the calling agent, never a user." },
   summary: "Recover orphaned in-progress tasks for an agent",
   tags: ["Active Sessions"],
   body: object2({
@@ -3961,7 +4065,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
     const parsed = await listActiveSessions.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const sessions = await getActiveSessions2(parsed.query.agentId || undefined);
+    const sessions = await getActiveSessions2(parsed.query.agentId || undefined, readableByFor2(await resolveSessionActor2(req, myAgentId)));
     listActiveSessions.respond(res, 200, { sessions });
     return true;
   }
@@ -4610,14 +4714,17 @@ async function handleAgentRegister(req, res, pathSegments, myAgentId) {
   }
   return false;
 }
-async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId) {
+async function handleAgentsRest(req, res, pathSegments, queryParams, myAgentId) {
   if (listAgents.match(req.method, pathSegments)) {
     const parsed = await listAgents.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
     const includeTasks = parsed.query.include === "tasks";
     const slim = parsed.query.fields !== "full";
-    const agents = includeTasks ? await getAllAgentsWithTasks2({ slim }) : await getAllAgents2({ slim });
+    const agents = includeTasks ? await getAllAgentsWithTasks2({
+      slim,
+      readableBy: readableByFor2(await resolveSessionActor2(req, myAgentId))
+    }) : await getAllAgents2({ slim });
     const [agentsWithCapacity, transports] = await Promise.all([
       Promise.all(agents.map(agentWithCapacity)),
       resolveListClaudeTransports(agents)
@@ -5118,6 +5225,7 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
         reportedAt: parsed.body.latest_model?.reportedAt ?? parsed.body.acp.reportedAt,
         reportKind: "post_task",
         bedrock: null,
+        opencodeGo: null,
         acp: null
       };
       finalAgent = await updateAgentCredStatus2(parsed.params.id, {
@@ -5155,7 +5263,7 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
     if (!parsed)
       return true;
     const includeTasks = parsed.query.include === "tasks";
-    const agent = includeTasks ? await getAgentWithTasks2(parsed.params.id) : await getAgentById2(parsed.params.id);
+    const agent = includeTasks ? await getAgentWithTasks2(parsed.params.id, readableByFor2(await resolveSessionActor2(req, myAgentId))) : await getAgentById2(parsed.params.id);
     if (!agent) {
       jsonError(res, "Agent not found", 404);
       return true;
@@ -5234,6 +5342,7 @@ var reportUsage = route({
   method: "post",
   path: "/api/keys/report-usage",
   pattern: ["api", "keys", "report-usage"],
+  session: bodyTask("taskId"),
   summary: "Record which API key was used for a task",
   tags: ["API Keys"],
   body: object2({
@@ -5277,6 +5386,7 @@ var reportAuthFailure = route({
   method: "post",
   path: "/api/keys/report-auth-failure",
   pattern: ["api", "keys", "report-auth-failure"],
+  session: bodyTask("taskId"),
   summary: "Record an auth failure for a pooled key; bench it after 2 in a row",
   tags: ["API Keys"],
   body: object2({
@@ -5974,6 +6084,7 @@ var createRoute = route({
   method: "post",
   path: "/api/approval-requests",
   pattern: ["api", "approval-requests"],
+  session: bodyTask("sourceTaskId"),
   summary: "Create a new approval request",
   tags: ["ApprovalRequests"],
   body: object2({
@@ -7295,6 +7406,10 @@ function deriveState(state, signals, funnelEvents) {
   if (state.steps.connect.status !== "done") {
     changed = completeStep(state, "connect", "api_key", true, events) || changed;
   }
+  const orgName = process.env.SWARM_ORG_NAME?.trim();
+  if (state.steps.name.status !== "done" && orgName && orgName !== "Your Swarm") {
+    changed = completeStep(state, "name", "custom_name", true, events) || changed;
+  }
   if (state.steps.ai.status !== "done" && signals.providers.some((entry) => entry.state === "verified")) {
     changed = completeStep(state, "ai", inferAiMethod(signals), true, events) || changed;
   }
@@ -7590,6 +7705,417 @@ init_rbac();
 init_types();
 init_request_auth_context();
 init_secret_scrubber();
+
+// src/http/ranking.ts
+init_zod();
+init_db3();
+init_telemetry_ranking();
+init_telemetry();
+init_env_flag();
+
+// src/http/global-config.ts
+init_db3();
+async function globalConfig(key) {
+  const stored = (await getSwarmConfigs2({ scope: "global", key }))?.[0]?.value;
+  return (stored ?? process.env[key])?.trim() || undefined;
+}
+
+// src/http/used-by.ts
+init_zod();
+init_db3();
+init_telemetry();
+init_company_profile();
+init_org_website();
+var CONSENT_KEY = "SWARM_USED_BY_CONSENT";
+var CONSENT_AT_KEY = "SWARM_USED_BY_CONSENT_AT";
+var GRANTED_NAME_KEY = "SWARM_USED_BY_ORG_NAME";
+var GRANTED_WEBSITE_KEY = "SWARM_USED_BY_ORG_WEBSITE";
+var CONTACT_EMAIL_KEY = "SWARM_USED_BY_CONTACT_EMAIL";
+var CONTACT_FUNCTION_KEY = "SWARM_USED_BY_CONTACT_FUNCTION";
+var QUOTE_KEY = "SWARM_USED_BY_QUOTE";
+var TIMEOUT_MS = 1e4;
+var usedBy = route({
+  method: "post",
+  path: "/api/used-by",
+  pattern: ["api", "used-by"],
+  summary: "Grant or revoke the 'used by' logo consent",
+  description: "Records consent to show the organization's logo on agent-swarm.dev. A grant requires a valid contact email. It sends organization identity, contact details, and an optional quote to the proxy for manual review. This explicit admin action works when telemetry is off. A revoke clears the stored contact details and quote.",
+  tags: ["Telemetry"],
+  body: object2({
+    granted: boolean(),
+    contactEmail: string2().max(320, "Contact email must be at most 320 characters").email("Contact email must be a valid email address").optional(),
+    contactFunction: _enum2(USER_FUNCTIONS).optional(),
+    quote: string2().max(280).optional()
+  }).refine((body) => !body.granted || body.contactEmail !== undefined, {
+    path: ["contactEmail"],
+    message: "Contact email is required when granting logo consent"
+  }),
+  responses: {
+    200: {
+      description: "Consent recorded",
+      schema: object2({ granted: boolean(), changedAt: string2() })
+    },
+    400: {
+      description: "Invalid contact details, or missing organization name or website"
+    },
+    401: { description: "Unauthorized" },
+    403: { description: "Only a config admin can change the consent" },
+    502: { description: "The telemetry proxy did not accept the consent" }
+  },
+  rbac: { permission: "config.write.any" }
+});
+async function telemetryProxyEndpoint(path) {
+  const feedback = await globalConfig("feedback_endpoint");
+  if (feedback && /^https?:\/\/[^/]+\/v1\/feedback\/?$/.test(feedback)) {
+    return feedback.replace(/\/v1\/feedback\/?$/, path);
+  }
+  return `${TELEMETRY_PROXY_ORIGIN}${path}`;
+}
+function usedByEndpoint() {
+  return telemetryProxyEndpoint("/v1/used-by");
+}
+async function handleUsedBy(req, res, pathSegments, queryParams, myAgentId) {
+  if (!usedBy.match(req.method, pathSegments))
+    return false;
+  const parsed = await usedBy.parse(req, res, pathSegments, queryParams);
+  if (!parsed)
+    return true;
+  if (!await ensureConfigAdmin(req, res, "config.write.any"))
+    return true;
+  const { granted, contactEmail, contactFunction, quote } = parsed.body;
+  const current = orgIdentityStatus({
+    SWARM_ORG_NAME: await globalConfig("SWARM_ORG_NAME"),
+    SWARM_ORG_WEBSITE: await globalConfig("SWARM_ORG_WEBSITE")
+  });
+  const currentName = current.name ?? undefined;
+  const currentWebsite = current.website;
+  const grantedName = granted ? undefined : await globalConfig(GRANTED_NAME_KEY);
+  const grantedWebsite = granted ? null : normalizeOrgWebsite(await globalConfig(GRANTED_WEBSITE_KEY));
+  const [orgName, orgWebsite] = grantedName && grantedWebsite ? [grantedName, grantedWebsite] : [currentName, currentWebsite];
+  if (!orgName || !orgWebsite) {
+    jsonError(res, "Set the organization name and website first", 400);
+    return true;
+  }
+  const installId = isTelemetryEnabled() ? await globalConfig("telemetry_installation_id") : undefined;
+  const orgDomain = await globalConfig("telemetry_org_domain");
+  const changedAt = new Date().toISOString();
+  try {
+    const response = await fetch(await usedByEndpoint(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...installId ? { install_id: installId } : {},
+        org_name: orgName,
+        org_website: orgWebsite,
+        ...orgDomain ? { org_domain: orgDomain } : {},
+        granted,
+        ...granted ? { contact_email: contactEmail, contact_function: contactFunction, quote } : {},
+        changed_at: changedAt
+      }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      jsonError(res, `The telemetry proxy answered ${response.status}`, 502);
+      return true;
+    }
+  } catch {
+    jsonError(res, "Could not reach the telemetry proxy", 502);
+    return true;
+  }
+  await getDbClient2().transaction(async () => {
+    await upsertSwarmConfig2({ scope: "global", key: CONSENT_KEY, value: String(granted) });
+    await upsertSwarmConfig2({ scope: "global", key: CONSENT_AT_KEY, value: changedAt });
+    if (granted) {
+      await upsertSwarmConfig2({ scope: "global", key: GRANTED_NAME_KEY, value: orgName });
+      await upsertSwarmConfig2({ scope: "global", key: GRANTED_WEBSITE_KEY, value: orgWebsite });
+    }
+    for (const [key, value, isSecret] of [
+      [CONTACT_EMAIL_KEY, contactEmail, true],
+      [CONTACT_FUNCTION_KEY, contactFunction, false],
+      [QUOTE_KEY, quote, false]
+    ]) {
+      await upsertSwarmConfig2({
+        scope: "global",
+        key,
+        value: granted ? value ?? "" : "",
+        isSecret,
+        exportToEnv: false
+      });
+    }
+  });
+  scheduleIntegrationsReload();
+  const owner = await resolveHttpFavoriteOwner(req, myAgentId);
+  trackRelayed("used_by.consent_changed", {
+    granted,
+    has_quote: granted && Boolean(quote),
+    has_function: granted && Boolean(contactFunction)
+  }, { actor: owner?.userId ? { userId: owner.userId } : undefined, emitter: "ui" });
+  usedBy.respond(res, 200, { granted, changedAt });
+  return true;
+}
+
+// src/http/ranking.ts
+var ListingSchema = object2({
+  v: literal2(1),
+  name: string2(),
+  domain: string2(),
+  category: _enum2(RANKING_CATEGORIES),
+  subcategory: string2().nullable(),
+  description: string2().nullable(),
+  sourceCodeUrl: string2().nullable(),
+  updatedAt: string2()
+});
+var RankingStateSchema = object2({
+  eligible: boolean(),
+  missing: array2(_enum2(ORG_IDENTITY_KEYS)),
+  telemetryOn: boolean(),
+  enabled: boolean(),
+  name: string2().nullable(),
+  domain: string2().nullable(),
+  listing: ListingSchema.nullable(),
+  listingMatchesDomain: boolean(),
+  verifyUrl: string2().nullable()
+});
+var OptInResponseSchema = object2({
+  domain: string2(),
+  listing: ListingSchema,
+  verifyUrl: string2()
+});
+var OptOutResponseSchema = object2({
+  enabled: literal2(false)
+});
+var getRanking = route({
+  method: "get",
+  path: "/api/ranking",
+  pattern: ["api", "ranking"],
+  summary: "Public ranking state",
+  description: "Whether this install can join the public agent-swarm.dev ranking (telemetry on, organization name and website set), whether it is opted in, and its stored listing. Only a config admin can read it.",
+  tags: ["Telemetry"],
+  responses: {
+    200: { description: "Ranking state", schema: RankingStateSchema },
+    401: { description: "Unauthorized" },
+    403: { description: "Only a config admin can read the ranking state" }
+  },
+  rbac: { permission: "config.write.any" }
+});
+var optIn = route({
+  method: "post",
+  path: "/api/ranking/opt-in",
+  pattern: ["api", "ranking", "opt-in"],
+  summary: "Opt this install into the public ranking",
+  description: "Builds the telemetry_ranking listing from the organization name and website plus the chosen category, stores it, turns PUBLIC_RANKING_ENABLED on and sends ranking.opted_in. That is the whole opt-in: the install shows on agent-swarm.dev/ranking at the next hourly refresh.",
+  tags: ["Telemetry"],
+  body: rankingFormSchema,
+  responses: {
+    200: { description: "Opted in", schema: OptInResponseSchema },
+    400: { description: "A listing field is invalid" },
+    401: { description: "Unauthorized" },
+    403: { description: "Only a config admin can opt in" },
+    409: {
+      description: "telemetry_off: telemetry is off or the install has no ID. org_identity_missing: the organization name or website is not set (`missing` lists which)."
+    }
+  },
+  rbac: { permission: "config.write.any" }
+});
+var optOut = route({
+  method: "post",
+  path: "/api/ranking/opt-out",
+  pattern: ["api", "ranking", "opt-out"],
+  summary: "Leave the public ranking",
+  description: "Turns PUBLIC_RANKING_ENABLED off and sends ranking.opted_out, so workers stop sending ranking.usage. The install leaves agent-swarm.dev/ranking at the next hourly refresh.",
+  tags: ["Telemetry"],
+  responses: {
+    200: { description: "Opted out", schema: OptOutResponseSchema },
+    401: { description: "Unauthorized" },
+    403: { description: "Only a config admin can opt out" }
+  },
+  rbac: { permission: "config.write.any" }
+});
+var RANKING_CONFIG_KEYS = new Set([...ORG_IDENTITY_KEYS, PUBLIC_RANKING_ENABLED_KEY]);
+async function currentIdentity(changed) {
+  const read = async (key) => changed?.key === key ? changed.value : await globalConfig(key);
+  return orgIdentityStatus({
+    SWARM_ORG_NAME: await read("SWARM_ORG_NAME"),
+    SWARM_ORG_WEBSITE: await read("SWARM_ORG_WEBSITE")
+  });
+}
+async function storedListing() {
+  return readTelemetryRanking(await globalConfig(TELEMETRY_RANKING_KEY));
+}
+async function rankingEnabled() {
+  const raw = await globalConfig(PUBLIC_RANKING_ENABLED_KEY);
+  return isEnvFlagEnabled(PUBLIC_RANKING_ENABLED_KEY, false, {
+    [PUBLIC_RANKING_ENABLED_KEY]: raw
+  });
+}
+async function telemetryReady() {
+  return isTelemetryEnabled() && Boolean(await globalConfig("telemetry_installation_id"));
+}
+async function verifyUrl(domain) {
+  const params = new URLSearchParams({ domain });
+  return `${await telemetryProxyEndpoint("/v1/ranking/verify")}?${params.toString()}`;
+}
+function withoutClaim(listing) {
+  const { claim: _claim, ...rest } = listing;
+  return rest;
+}
+async function setEnabled(enabled) {
+  await upsertSwarmConfig2({
+    scope: "global",
+    key: PUBLIC_RANKING_ENABLED_KEY,
+    value: String(enabled)
+  });
+}
+function emitOptedIn(listing) {
+  telemetry.ranking("opted_in", { listing: JSON.stringify(withoutClaim(listing)) }, { orgName: listing.name, orgWebsite: listing.domain });
+}
+function emitOptedOut(domain) {
+  telemetry.ranking("opted_out", { domain });
+}
+async function buildRankingState() {
+  const [identity, listing, enabled, telemetryOn] = await Promise.all([
+    currentIdentity(),
+    storedListing(),
+    rankingEnabled(),
+    telemetryReady()
+  ]);
+  const listingMatchesDomain = Boolean(listing && listing.domain === identity.website);
+  const current = listingMatchesDomain ? listing : null;
+  return {
+    eligible: telemetryOn && identity.ok,
+    missing: identity.missing,
+    telemetryOn,
+    enabled: enabled && listingMatchesDomain,
+    name: identity.name,
+    domain: identity.website,
+    listing: listing ? withoutClaim(listing) : null,
+    listingMatchesDomain,
+    verifyUrl: current ? await verifyUrl(current.domain) : null
+  };
+}
+async function syncRankingAfterConfigChange(key, value) {
+  if (!RANKING_CONFIG_KEYS.has(key))
+    return;
+  const listing = await storedListing();
+  if (!listing)
+    return;
+  if (key === PUBLIC_RANKING_ENABLED_KEY) {
+    if (!isEnvFlagEnabled(key, false, { [key]: value ?? undefined })) {
+      emitOptedOut(listing.domain);
+    }
+    return;
+  }
+  if (!await rankingEnabled())
+    return;
+  const identity = await currentIdentity({ key, value });
+  let rebuilt = null;
+  if (identity.ok && identity.website === listing.domain) {
+    if (identity.name === listing.name)
+      return;
+    try {
+      rebuilt = buildListing(identity, listing);
+    } catch {}
+  }
+  if (!rebuilt) {
+    await setEnabled(false);
+    emitOptedOut(listing.domain);
+    return;
+  }
+  await upsertSwarmConfig2({
+    scope: "global",
+    key: TELEMETRY_RANKING_KEY,
+    value: JSON.stringify(rebuilt)
+  });
+  emitOptedIn(rebuilt);
+}
+function conflict(res, body) {
+  res.writeHead(409, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+async function handleRanking(req, res, pathSegments, queryParams) {
+  if (getRanking.match(req.method, pathSegments)) {
+    const parsed = await getRanking.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.write.any"))
+      return true;
+    getRanking.respond(res, 200, await buildRankingState());
+    return true;
+  }
+  if (optIn.match(req.method, pathSegments)) {
+    const parsed = await optIn.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.write.any"))
+      return true;
+    if (!await telemetryReady()) {
+      conflict(res, {
+        error: "telemetry_off",
+        message: "Turn telemetry on first: the ranking counts tokens from telemetry."
+      });
+      return true;
+    }
+    const identity = await currentIdentity();
+    if (!identity.ok || !identity.website) {
+      conflict(res, {
+        error: "org_identity_missing",
+        message: "Set the organization name and website first",
+        missing: identity.missing
+      });
+      return true;
+    }
+    const db = getDbClient2();
+    const built = await db.transaction(async () => {
+      let listing;
+      try {
+        listing = buildListing(identity, parsed.body);
+      } catch (error) {
+        return { ok: false, error };
+      }
+      await upsertSwarmConfig2({
+        scope: "global",
+        key: TELEMETRY_RANKING_KEY,
+        value: JSON.stringify(listing)
+      });
+      await setEnabled(true);
+      db.afterCommit(() => emitOptedIn(listing));
+      return { ok: true, listing };
+    });
+    if (!built.ok) {
+      const issue = built.error instanceof ZodError ? built.error.issues[0] : undefined;
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        error: issue ? `Invalid ${issue.path.join(".") || "listing"}: ${issue.message}` : "Invalid listing"
+      }));
+      return true;
+    }
+    const { listing } = built;
+    scheduleIntegrationsReload();
+    optIn.respond(res, 200, {
+      domain: listing.domain,
+      listing,
+      verifyUrl: await verifyUrl(listing.domain)
+    });
+    return true;
+  }
+  if (optOut.match(req.method, pathSegments)) {
+    const parsed = await optOut.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.write.any"))
+      return true;
+    const listing = await storedListing();
+    await setEnabled(false);
+    if (listing)
+      emitOptedOut(listing.domain);
+    scheduleIntegrationsReload();
+    optOut.respond(res, 200, { enabled: false });
+    return true;
+  }
+  return false;
+}
+
+// src/http/config.ts
 var MAX_ENV_PRESENCE_KEYS = 200;
 var SECRETS_FORCE_MASK_NOTE = " (secret values masked: this token cannot read secrets in this scope)";
 function stripApiOnlyKeys(configs) {
@@ -7959,6 +8485,8 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
         await fillOrgLogoFromWebsite(String(value));
       }
+      if (scope === "global")
+        await syncRankingAfterConfigChange(key, String(value));
       if (scope === "global") {
         scheduleIntegrationsReload();
       }
@@ -7994,6 +8522,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       return true;
     }
     if (existing.scope === "global") {
+      await syncRankingAfterConfigChange(existing.key, null);
       scheduleIntegrationsReload();
     }
     if (existing.scope === "agent" && existing.scopeId && existing.key === AGENT_MAX_TASKS_CONFIG_KEY) {
@@ -8830,6 +9359,7 @@ var postContext = route({
   method: "post",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Record a context usage snapshot for a task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -8856,6 +9386,7 @@ var getContext = route({
   method: "get",
   path: "/api/tasks/{id}/context",
   pattern: ["api", "tasks", null, "context"],
+  session: { taskParam: "id" },
   summary: "Get context usage history for a task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -8936,6 +9467,7 @@ var createEventRoute = route({
   method: "post",
   path: "/api/events",
   pattern: ["api", "events"],
+  session: bodyTask("taskId"),
   summary: "Store a single event",
   tags: ["Events"],
   body: eventBodySchema,
@@ -8952,6 +9484,7 @@ var createEventsBatchRoute = route({
   method: "post",
   path: "/api/events/batch",
   pattern: ["api", "events", "batch"],
+  session: bodyListTask("events", "taskId"),
   summary: "Store multiple events in a batch",
   tags: ["Events"],
   body: object2({
@@ -9026,7 +9559,7 @@ var getEventCountsRoute = route({
   auth: { apiKey: true }
 });
 var MAX_LATEST_PAIRS = 50;
-async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
+async function handleEvents(req, res, pathSegments, queryParams, myAgentId) {
   if (createEventsBatchRoute.match(req.method, pathSegments)) {
     const parsed = await createEventsBatchRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -9100,7 +9633,8 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
       until: parsed.query.until || undefined,
       limit: parsed.query.limit ?? 100,
       events: eventFilter,
-      latestPerDataField: latestPerDataField ? { events: latestEvents, dataFields } : undefined
+      latestPerDataField: latestPerDataField ? { events: latestEvents, dataFields } : undefined,
+      readableBy: readableByFor2(await resolveSessionActor2(req, myAgentId))
     });
     getEventsRoute.respond(res, 200, latestPerDataField ? { events, latestPerDataField: true } : { events });
     return true;
@@ -12423,7 +12957,6 @@ async function handleFavorites(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/fleet-benchmark.ts
 init_zod();
-init_db3();
 
 // src/fleet-benchmark.ts
 var FLEET_WINDOW_DAYS = 30;
@@ -12502,8 +13035,8 @@ function round(value, decimals) {
 
 // src/be/fleet-benchmark-stats.ts
 init_runtime();
-async function getLocalFleetStats(now = new Date) {
-  const start = fleetCountStart(await getTelemetryIngestAnchor(), now);
+async function getLocalFleetStats(now = new Date, { requireIngestAnchor = true } = {}) {
+  const start = requireIngestAnchor ? fleetCountStart(await getTelemetryIngestAnchor(), now) : new Date(now.getTime() - FLEET_WINDOW_DAYS * 86400000);
   if (!start)
     return null;
   const since = start.toISOString();
@@ -12524,110 +13057,8 @@ async function getLocalFleetStats(now = new Date) {
 
 // src/http/fleet-benchmark.ts
 init_telemetry();
-
-// src/http/used-by.ts
-init_zod();
-init_db3();
-init_telemetry();
+init_company_profile();
 init_org_website();
-var CONSENT_KEY = "SWARM_USED_BY_CONSENT";
-var CONSENT_AT_KEY = "SWARM_USED_BY_CONSENT_AT";
-var GRANTED_NAME_KEY = "SWARM_USED_BY_ORG_NAME";
-var GRANTED_WEBSITE_KEY = "SWARM_USED_BY_ORG_WEBSITE";
-var TIMEOUT_MS = 1e4;
-var usedBy = route({
-  method: "post",
-  path: "/api/used-by",
-  pattern: ["api", "used-by"],
-  summary: "Grant or revoke the 'used by' logo consent",
-  description: "Records whether agent-swarm.dev may show this organization's logo as a company that uses Agent Swarm. Sends the organization name and website to the telemetry proxy, where a person approves each logo by hand. An explicit admin action, so it is not gated by the telemetry opt-out.",
-  tags: ["Telemetry"],
-  body: object2({ granted: boolean() }),
-  responses: {
-    200: {
-      description: "Consent recorded",
-      schema: object2({ granted: boolean(), changedAt: string2() })
-    },
-    400: {
-      description: "Organization name or website is not set (a revoke falls back to the identity of the last grant)"
-    },
-    401: { description: "Unauthorized" },
-    403: { description: "Only a config admin can change the consent" },
-    502: { description: "The telemetry proxy did not accept the consent" }
-  },
-  rbac: { permission: "config.write.any" }
-});
-async function globalConfig(key) {
-  const stored = (await getSwarmConfigs2({ scope: "global", key }))?.[0]?.value?.trim();
-  return stored || process.env[key]?.trim() || undefined;
-}
-async function telemetryProxyEndpoint(path) {
-  const feedback = await globalConfig("feedback_endpoint");
-  if (feedback && /^https?:\/\/[^/]+\/v1\/feedback\/?$/.test(feedback)) {
-    return feedback.replace(/\/v1\/feedback\/?$/, path);
-  }
-  return `${TELEMETRY_PROXY_ORIGIN}${path}`;
-}
-function usedByEndpoint() {
-  return telemetryProxyEndpoint("/v1/used-by");
-}
-async function handleUsedBy(req, res, pathSegments, queryParams, myAgentId) {
-  if (!usedBy.match(req.method, pathSegments))
-    return false;
-  const parsed = await usedBy.parse(req, res, pathSegments, queryParams);
-  if (!parsed)
-    return true;
-  if (!await ensureConfigAdmin(req, res, "config.write.any"))
-    return true;
-  const { granted } = parsed.body;
-  const currentName = await globalConfig("SWARM_ORG_NAME");
-  const currentWebsite = normalizeOrgWebsite(await globalConfig("SWARM_ORG_WEBSITE"));
-  const grantedName = granted ? undefined : await globalConfig(GRANTED_NAME_KEY);
-  const grantedWebsite = granted ? null : normalizeOrgWebsite(await globalConfig(GRANTED_WEBSITE_KEY));
-  const [orgName, orgWebsite] = grantedName && grantedWebsite ? [grantedName, grantedWebsite] : [currentName, currentWebsite];
-  if (!orgName || !orgWebsite) {
-    jsonError(res, "Set the organization name and website first", 400);
-    return true;
-  }
-  const installId = isTelemetryEnabled() ? await globalConfig("telemetry_installation_id") : undefined;
-  const orgDomain = await globalConfig("telemetry_org_domain");
-  const changedAt = new Date().toISOString();
-  try {
-    const response = await fetch(await usedByEndpoint(), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        ...installId ? { install_id: installId } : {},
-        org_name: orgName,
-        org_website: orgWebsite,
-        ...orgDomain ? { org_domain: orgDomain } : {},
-        granted,
-        changed_at: changedAt
-      }),
-      signal: AbortSignal.timeout(TIMEOUT_MS)
-    });
-    if (!response.ok) {
-      jsonError(res, `The telemetry proxy answered ${response.status}`, 502);
-      return true;
-    }
-  } catch {
-    jsonError(res, "Could not reach the telemetry proxy", 502);
-    return true;
-  }
-  await upsertSwarmConfig2({ scope: "global", key: CONSENT_KEY, value: String(granted) });
-  await upsertSwarmConfig2({ scope: "global", key: CONSENT_AT_KEY, value: changedAt });
-  if (granted) {
-    await upsertSwarmConfig2({ scope: "global", key: GRANTED_NAME_KEY, value: orgName });
-    await upsertSwarmConfig2({ scope: "global", key: GRANTED_WEBSITE_KEY, value: orgWebsite });
-  }
-  scheduleIntegrationsReload();
-  const owner = await resolveHttpFavoriteOwner(req, myAgentId);
-  trackRelayed("used_by.consent_changed", { granted }, { actor: owner?.userId ? { userId: owner.userId } : undefined, emitter: "ui" });
-  usedBy.respond(res, 200, { granted, changedAt });
-  return true;
-}
-
-// src/http/fleet-benchmark.ts
 var FLEET_TTL_MS = 24 * 60 * 60 * 1000;
 var FLEET_FAILURE_TTL_MS = 60 * 60 * 1000;
 var LOCAL_TTL_MS = 10 * 60 * 1000;
@@ -12641,6 +13072,12 @@ var FleetStateSchema = _enum2([
 ]);
 var FleetBenchmarkResponseSchema = object2({
   state: FleetStateSchema,
+  level: _enum2(["basic", "full"]),
+  peerGroup: object2({
+    teamSize: string2().nullable(),
+    useCase: string2().nullable(),
+    orgs: number2().int()
+  }).nullable(),
   local: object2({
     tasksPerWeek: number2(),
     taskSuccessRate: number2().nullable(),
@@ -12664,7 +13101,7 @@ var fleetBenchmark = route({
   path: "/api/fleet-benchmark",
   pattern: ["api", "fleet-benchmark"],
   summary: "Compare this swarm with similar swarms",
-  description: "Places this swarm's tasks per week and task success rate (last 30 days) in the fleet percentiles published by the telemetry proxy, against swarms with the same agent count when enough exist. Needs telemetry on and an organization name; otherwise `state` says what is missing and the proxy is not called. `unavailable` also covers an install whose first event the proxy saw cannot be established locally (until 30 days after the first accepted event). The fleet numbers are cached for a day.",
+  description: "Compares local task volume and success rate with fleet percentiles over the last 30 days. Comparisons require telemetry, an organization name, and a known proxy ingest date. A website, team size, and use case enable full comparisons with peer filters. The response includes the proxy's peer group when available. With telemetry off, it returns local DB counts without a proxy request. The fleet cache key includes the peer filters.",
   tags: ["Telemetry"],
   responses: {
     200: {
@@ -12700,48 +13137,64 @@ var ProxyFleetBenchmarksSchema = object2({
     "1": ProxyBlockSchema.optional(),
     "2-5": ProxyBlockSchema.optional(),
     "6+": ProxyBlockSchema.optional()
-  })
-});
-async function fleetBenchmarks(now) {
-  if (fleetCache && fleetCache.until > now)
+  }),
+  peer_group: object2({
+    team_size: string2().nullable(),
+    use_case: string2().nullable(),
+    orgs: number2().int().nonnegative()
+  }).nullable().optional()
+});
+async function fleetBenchmarks(now, peerGroup) {
+  const endpoint = new URL(await telemetryProxyEndpoint("/v1/fleet/benchmarks"));
+  endpoint.searchParams.set("window", "30d");
+  if (peerGroup) {
+    endpoint.searchParams.set("team_size", peerGroup.teamSize);
+    endpoint.searchParams.set("use_case", peerGroup.useCase);
+  }
+  const key = endpoint.toString();
+  if (fleetCache?.key === key && fleetCache.until > now)
     return fleetCache.value;
   let value = null;
   try {
-    const response = await fetch(`${await telemetryProxyEndpoint("/v1/fleet/benchmarks")}?window=30d`, {
-      signal: AbortSignal.timeout(TIMEOUT_MS2)
-    });
+    const response = await fetch(key, { signal: AbortSignal.timeout(TIMEOUT_MS2) });
     if (response.ok) {
       const parsed = ProxyFleetBenchmarksSchema.safeParse(await response.json());
       if (parsed.success)
         value = parsed.data;
     }
   } catch {}
-  fleetCache = { value, until: now + (value ? FLEET_TTL_MS : FLEET_FAILURE_TTL_MS) };
+  fleetCache = { key, value, until: now + (value ? FLEET_TTL_MS : FLEET_FAILURE_TTL_MS) };
   return value;
 }
-async function localStats(now) {
-  if (localCache && localCache.until > now.getTime())
+async function localStats(now, requireIngestAnchor = true) {
+  if (localCache?.requireIngestAnchor === requireIngestAnchor && localCache.until > now.getTime())
     return localCache.value;
-  const value = await getLocalFleetStats(now);
-  localCache = { value, until: now.getTime() + LOCAL_TTL_MS };
+  const value = await getLocalFleetStats(now, { requireIngestAnchor });
+  localCache = { requireIngestAnchor, value, until: now.getTime() + LOCAL_TTL_MS };
   return value;
 }
-async function orgName() {
-  const stored = (await getSwarmConfigs2({ scope: "global", key: "SWARM_ORG_NAME" }))?.[0]?.value?.trim();
-  return stored || process.env.SWARM_ORG_NAME?.trim() || undefined;
-}
 async function buildFleetBenchmarkResponse(now = new Date) {
+  const [name, website, teamSize, useCase] = await Promise.all([
+    globalConfig("SWARM_ORG_NAME"),
+    globalConfig("SWARM_ORG_WEBSITE"),
+    globalConfig("SWARM_ORG_TEAM_SIZE"),
+    globalConfig("SWARM_ORG_USE_CASE")
+  ]);
+  const team = _enum2(COMPANY_TEAM_SIZES).safeParse(teamSize);
+  const use = _enum2(COMPANY_USE_CASES).safeParse(useCase);
+  const peerGroup = normalizeOrgWebsite(website) && team.success && use.success ? { teamSize: team.data, useCase: use.data } : null;
   const empty = {
+    level: peerGroup ? "full" : "basic",
+    peerGroup: null,
     local: null,
     minFinishedTasks: FLEET_MIN_FINISHED_TASKS,
     generatedAt: null,
     comparisons: []
   };
-  if (!isTelemetryEnabled())
-    return { state: "telemetry_off", ...empty };
-  if (!await orgName())
+  const telemetryEnabled = isTelemetryEnabled();
+  if (telemetryEnabled && !name)
     return { state: "no_org_name", ...empty };
-  const stats = await localStats(now);
+  const stats = await localStats(now, telemetryEnabled);
   if (!stats)
     return { state: "unavailable", ...empty };
   const finishedTasks = stats.tasksCompleted + stats.tasksFailed;
@@ -12752,14 +13205,23 @@ async function buildFleetBenchmarkResponse(now = new Date) {
     agents: stats.agents,
     bucket: fleetBucketFor(stats.agents)
   };
+  if (!telemetryEnabled)
+    return { ...empty, state: "telemetry_off", local };
   if (finishedTasks < FLEET_MIN_FINISHED_TASKS)
     return { ...empty, state: "not_enough_tasks", local };
-  const fleet = await fleetBenchmarks(now.getTime());
+  const fleet = await fleetBenchmarks(now.getTime(), peerGroup);
+  const responsePeerGroup = peerGroup && fleet?.peer_group ? {
+    teamSize: fleet.peer_group.team_size,
+    useCase: fleet.peer_group.use_case,
+    orgs: fleet.peer_group.orgs
+  } : null;
   const comparisons = fleet ? compareWithFleet(stats, fleet, now) : [];
   if (!fleet || comparisons.length === 0)
-    return { ...empty, state: "unavailable", local };
+    return { ...empty, state: "unavailable", local, peerGroup: responsePeerGroup };
   return {
+    ...empty,
     state: "ready",
+    peerGroup: responsePeerGroup,
     local,
     minFinishedTasks: FLEET_MIN_FINISHED_TASKS,
     generatedAt: fleet.generatedAt,
@@ -12886,6 +13348,7 @@ var listTaskFilesRoute = route({
   method: "get",
   path: "/api/fs/tasks/{taskId}/files",
   pattern: ["api", "fs", "tasks", null, "files"],
+  session: { taskParam: "taskId" },
   summary: "List task file attachments",
   tags: ["FS"],
   params: taskParams,
@@ -12901,6 +13364,7 @@ var uploadTaskFileRoute = route({
   method: "post",
   path: "/api/fs/tasks/{taskId}/files",
   pattern: ["api", "fs", "tasks", null, "files"],
+  session: { taskParam: "taskId" },
   summary: "Upload a binary task file attachment",
   description: "Accepts a raw binary request body. Pass the display/path name as the `name` query parameter.",
   tags: ["FS"],
@@ -12920,6 +13384,7 @@ var getTaskFileRoute = route({
   method: "get",
   path: "/api/fs/tasks/{taskId}/files/{attachmentId}",
   pattern: ["api", "fs", "tasks", null, "files", null],
+  session: { taskParam: "taskId" },
   summary: "Get task file attachment metadata",
   tags: ["FS"],
   params: attachmentParams,
@@ -12932,6 +13397,7 @@ var downloadTaskFileRoute = route({
   method: "get",
   path: "/api/fs/tasks/{taskId}/files/{attachmentId}/raw",
   pattern: ["api", "fs", "tasks", null, "files", null, "raw"],
+  session: { taskParam: "taskId" },
   summary: "Download raw task file bytes",
   description: "Streams raw bytes. File content is not secret-scrubbed.",
   tags: ["FS"],
@@ -12948,6 +13414,7 @@ var signedUrlTaskFileRoute = route({
   method: "get",
   path: "/api/fs/tasks/{taskId}/files/{attachmentId}/signed-url",
   pattern: ["api", "fs", "tasks", null, "files", null, "signed-url"],
+  session: { taskParam: "taskId" },
   summary: "Create a provider signed GET URL for a task file",
   tags: ["FS"],
   params: attachmentParams,
@@ -12962,6 +13429,7 @@ var deleteTaskFileRoute = route({
   method: "delete",
   path: "/api/fs/tasks/{taskId}/files/{attachmentId}",
   pattern: ["api", "fs", "tasks", null, "files", null],
+  session: { taskParam: "taskId" },
   summary: "Delete a task file attachment",
   tags: ["FS"],
   params: attachmentParams,
@@ -13010,7 +13478,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await downloadTaskFileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const attachment = await findAttachment(parsed.params.taskId, parsed.params.attachmentId, res);
+    const attachment = await findAttachment(req, myAgentId, parsed.params.taskId, parsed.params.attachmentId, res);
     if (!attachment)
       return true;
     return sendDownload(res, attachment);
@@ -13019,7 +13487,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await signedUrlTaskFileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const attachment = await findAttachment(parsed.params.taskId, parsed.params.attachmentId, res);
+    const attachment = await findAttachment(req, myAgentId, parsed.params.taskId, parsed.params.attachmentId, res);
     if (!attachment)
       return true;
     return sendSignedUrl(res, attachment, parsed.query.expiresIn);
@@ -13028,7 +13496,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await getTaskFileRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const attachment = await findAttachment(parsed.params.taskId, parsed.params.attachmentId, res);
+    const attachment = await findAttachment(req, myAgentId, parsed.params.taskId, parsed.params.attachmentId, res);
     if (!attachment)
       return true;
     getTaskFileRoute.respond(res, 200, attachment);
@@ -13067,6 +13535,10 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     if (!await getTaskById2(parsed.params.taskId))
       return notFound(res, "Task not found");
+    if (!await canReadSession2(req, myAgentId, parsed.params.taskId)) {
+      jsonError(res, SESSION_READ_DENIED2, 403);
+      return true;
+    }
     listTaskFilesRoute.respond(res, 200, {
       attachments: await getTaskAttachments2(parsed.params.taskId)
     });
@@ -13202,11 +13674,15 @@ function backingProviderId(attachment) {
     return "local-fs";
   return null;
 }
-async function findAttachment(taskId, attachmentId, res) {
+async function findAttachment(req, myAgentId, taskId, attachmentId, res) {
   if (!await getTaskById2(taskId)) {
     notFound(res, "Task not found");
     return null;
   }
+  if (!await canReadSession2(req, myAgentId, taskId)) {
+    jsonError(res, SESSION_READ_DENIED2, 403);
+    return null;
+  }
   const attachment = (await getTaskAttachments2(taskId)).find((item) => item.id === attachmentId);
   if (!attachment) {
     notFound(res, "Attachment not found");
@@ -17846,6 +18322,7 @@ var indexMemory = route({
   method: "post",
   path: "/api/memory/index",
   pattern: ["api", "memory", "index"],
+  session: bodyTask("sourceTaskId"),
   summary: "Ingest content into memory system (async embedding)",
   tags: ["Memory"],
   rbac: { permission: "memory.write.consolidated" },
@@ -18323,6 +18800,7 @@ var rateMemory = route({
   method: "post",
   path: "/api/memory/rate",
   pattern: ["api", "memory", "rate"],
+  session: { none: "worker-only: it needs X-Agent-ID, which a user token cannot send" },
   summary: "Submit RatingEvents to update memory usefulness posteriors",
   tags: ["Memory"],
   auth: { apiKey: true, agentId: true },
@@ -21770,7 +22248,7 @@ var listTasks = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   summary: "List tasks with filters",
-  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
+  description: "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Every shape gives a user caller only tasks of sessions they can read. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
   tags: ["Tasks"],
   query: object2({
     status: string2().optional(),
@@ -21809,6 +22287,7 @@ var createTask = route({
   method: "post",
   path: "/api/tasks",
   pattern: ["api", "tasks"],
+  session: bodyTask("parentTaskId"),
   summary: "Create a new task",
   tags: ["Tasks"],
   body: object2({
@@ -21864,6 +22343,7 @@ var promoteDraftTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/promote-draft",
   pattern: ["api", "tasks", null, "promote-draft"],
+  session: { taskParam: "id" },
   summary: "Promote a draft task out of the pre-dispatch draft state",
   description: "Transitions a `draft` task (#1240 — created with attachments still uploading) to its normal dispatch-eligible status: `offered` if it was offered to an agent, `pending` if it has an owning agent (the common case — UI-composer tasks default to Lead), otherwise `unassigned`. Called by the UI composer once its attachment upload batch settles, whether every file uploaded, some failed, or all failed — a draft must never be stranded by an upload error. Idempotent: calling it on a task that already left `draft` returns the current task unchanged rather than erroring, so a retried request is safe.",
   tags: ["Tasks"],
@@ -21879,6 +22359,7 @@ var updateSession = route({
   method: "put",
   path: "/api/tasks/{id}/session",
   pattern: ["api", "tasks", null, "session"],
+  session: { taskParam: "id" },
   summary: "Update provider session ID and harness metadata for a task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -21912,6 +22393,7 @@ var cancelTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/cancel",
   pattern: ["api", "tasks", null, "cancel"],
+  session: { taskParam: "id" },
   summary: "Cancel a pending or in-progress task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -21926,6 +22408,7 @@ var steerTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/steer",
   pattern: ["api", "tasks", null, "steer"],
+  session: { taskParam: "id" },
   summary: "Deliver a steering message to a running task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -21954,6 +22437,7 @@ var getTaskSteeringMessagesRoute = route({
   method: "get",
   path: "/api/tasks/{id}/steering-messages",
   pattern: ["api", "tasks", null, "steering-messages"],
+  session: { taskParam: "id" },
   summary: "List steering messages for a task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -21980,6 +22464,7 @@ var markSteeringDeliveredRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/delivered",
   pattern: ["api", "steering-messages", null, "delivered"],
+  session: { steeringParam: "id" },
   summary: "Mark a steering message delivered",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22003,6 +22488,7 @@ var markSteeringHandledRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/handled",
   pattern: ["api", "steering-messages", null, "handled"],
+  session: { steeringParam: "id" },
   summary: "Mark a steering message handled",
   description: "Optionally accepts a JSON body `{ note?: string }` — a short acceptance note describing how the steering was incorporated, persisted as `handledNote`.",
   tags: ["Tasks"],
@@ -22025,6 +22511,7 @@ var markSteeringUndeliverableRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/undeliverable",
   pattern: ["api", "steering-messages", null, "undeliverable"],
+  session: { steeringParam: "id" },
   summary: "Promote an undeliverable steering message",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22048,6 +22535,7 @@ var getTask = route({
   method: "get",
   path: "/api/tasks/{id}",
   pattern: ["api", "tasks", null],
+  session: { taskParam: "id" },
   summary: "Get task details with logs and attachments",
   description: "Returns the full `AgentTask` row decorated with `logs` (capped by `logsLimit`) and `attachments` (pointer-based artifacts stored on the task, ordered by `created_at`).",
   tags: ["Tasks"],
@@ -22057,6 +22545,7 @@ var getTask = route({
   }),
   responses: {
     200: { description: "Task with logs and attachments", schema: GetTaskResponseSchema },
+    403: { description: "A user caller cannot read the task's session" },
     404: { description: "Task not found" }
   }
 });
@@ -22064,6 +22553,7 @@ var updateTaskProgressRoute = route({
   method: "post",
   path: "/api/tasks/{id}/progress",
   pattern: ["api", "tasks", null, "progress"],
+  session: { taskParam: "id" },
   summary: "Update task progress text",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22081,6 +22571,7 @@ var finishTask = route({
   method: "post",
   path: "/api/tasks/{id}/finish",
   pattern: ["api", "tasks", null, "finish"],
+  session: { taskParam: "id" },
   summary: "Mark task as completed or failed (runner endpoint)",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22126,6 +22617,7 @@ var pauseTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/pause",
   pattern: ["api", "tasks", null, "pause"],
+  session: { taskParam: "id" },
   summary: "Pause an in-progress task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22140,6 +22632,7 @@ var resumeTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/resume",
   pattern: ["api", "tasks", null, "resume"],
+  session: { taskParam: "id" },
   summary: "Resume a paused task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22154,6 +22647,7 @@ var supersedeTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/supersede",
   pattern: ["api", "tasks", null, "supersede"],
+  session: { taskParam: "id" },
   summary: "Supersede an in-progress task (terminate + spawn resume follow-up)",
   description: 'Marks the original task `superseded` (terminal) and creates a fresh `taskType="resume"` follow-up so a worker can pick up the work in a new provider session. Workflow-step tasks (those with `workflowRunStepId`) are carved out: the original is marked `failed` with reason `superseded_workflow_task` and no follow-up is created — the workflow engine\'s retry/failure policy applies.',
   tags: ["Tasks"],
@@ -22174,6 +22668,7 @@ var updateTaskVcsRoute = route({
   method: "patch",
   path: "/api/tasks/{id}/vcs",
   pattern: ["api", "tasks", null, "vcs"],
+  session: { taskParam: "id" },
   summary: "Update VCS (PR/MR) info for a task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -22194,6 +22689,7 @@ var updateTaskTitleRoute = route({
   method: "patch",
   path: "/api/tasks/{id}/title",
   pattern: ["api", "tasks", null, "title"],
+  session: { taskParam: "id" },
   summary: "Set or clear a task's display title (session rename)",
   description: "Sets a human-facing display title override on a task. The sessions UI only reads this from root tasks (session list items), but titles on child tasks are harmless. Pass `title: null` (or an empty string) to clear the override and fall back to the task prompt.",
   tags: ["Tasks"],
@@ -22210,17 +22706,21 @@ var updateTaskTitleRoute = route({
     ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only"
   }
 });
-async function canSteerTask(req, myAgentId, task) {
+async function hasSessionWrite(req, myAgentId, taskId) {
+  const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
+  return hasSessionAccess(access, "write");
+}
+async function canSteerTask(req, myAgentId, task, sessionAccess = "none") {
+  const auth = getRequestAuth(req);
   const resource = {
     kind: "task",
     taskId: task.id,
-    requestedByUserId: task.requestedByUserId,
+    requestedByUserId: auth?.kind === "user" && sessionAccess === "write" ? auth.userId : task.requestedByUserId,
     creatorAgentId: task.creatorAgentId,
     agentId: task.agentId
   };
   let principal;
   let verb;
-  const auth = getRequestAuth(req);
   if (auth?.kind === "operator") {
     principal = { kind: "operator" };
     verb = "task.steer.own";
@@ -22329,6 +22829,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       if (validated.length > 0)
         source = validated;
     }
+    const actor = await resolveSessionActor2(req, myAgentId);
     const filters = {
       status,
       agentId: parsed.query.agentId || undefined,
@@ -22344,7 +22845,8 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       requestedByUserIdIsNull: parsed.query.requestedByUserId === "none" || undefined,
       orderBy: parsed.query.orderBy,
       limit: parsed.query.limit,
-      offset: parsed.query.offset
+      offset: parsed.query.offset,
+      readableBy: actor.kind === "user" ? { userId: actor.userId } : undefined
     };
     const tasks = parsed.query.fields === "full" ? await getAllTasks2(filters) : parsed.query.fields === "timeline" ? await getAllTasks2(filters, { fields: "timeline" }) : await getAllTasks2(filters, { slim: true });
     if (parsed.query.includeTotal === "true") {
@@ -22402,6 +22904,10 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
       return true;
     }
+    if (parentTask && !await hasSessionWrite(req, myAgentId, parentTask.id)) {
+      jsonError(res, SESSION_WRITE_DENIED2, 403);
+      return true;
+    }
     if (principal.kind === "agent" && parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" }).allow) {
       jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
       return true;
@@ -22601,7 +23107,13 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
-    if (!await canSteerTask(req, myAgentId, task)) {
+    const sessionActor = await resolveSessionActor2(req, myAgentId);
+    const steerAccess = await sessionAccessFor2(sessionActor, task.id);
+    if (!hasSessionAccess(steerAccess, "write")) {
+      jsonError(res, SESSION_WRITE_DENIED2, 403);
+      return true;
+    }
+    if (!await canSteerTask(req, myAgentId, task, steerAccess)) {
       jsonError(res, "Forbidden: caller cannot steer this task", 403);
       return true;
     }
@@ -22641,6 +23153,10 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (!await canReadSession2(req, myAgentId, parsed.params.id)) {
+      jsonError(res, SESSION_READ_DENIED2, 403);
+      return true;
+    }
     getTaskSteeringMessagesRoute.respond(res, 200, {
       messages: await getSteeringMessagesForTask2(parsed.params.id)
     });
@@ -22659,13 +23175,18 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     if (parsed.query.taskId) {
+      if (!await canReadSession2(req, myAgentId, parsed.query.taskId)) {
+        jsonError(res, SESSION_READ_DENIED2, 403);
+        return true;
+      }
       const task = await getTaskById2(parsed.query.taskId);
       const messages = task?.agentId === myAgentId ? await getPendingSteeringForTask2(parsed.query.taskId) : [];
       getPendingSteeringMessagesRoute.respond(res, 200, { messages });
       return true;
     }
+    const actor = await resolveSessionActor2(req, myAgentId);
     getPendingSteeringMessagesRoute.respond(res, 200, {
-      messages: await getPendingSteeringForAgent2(myAgentId)
+      messages: await getPendingSteeringForAgent2(myAgentId, readableByFor2(actor))
     });
     return true;
   }
@@ -22806,6 +23327,11 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    const readAccess = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), task.id);
+    if (!hasSessionAccess(readAccess, "read")) {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
     const logs = await getLogsByTaskId2(parsed.params.id, parsed.query.logsLimit ?? 200);
     const attachments = await getTaskAttachments2(parsed.params.id);
     getTask.respond(res, 200, {
@@ -22957,7 +23483,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Missing X-Agent-ID header", 400);
       return true;
     }
-    const pausedTasks = await getPausedTasksForAgent2(myAgentId);
+    const pausedTasks = await getPausedTasksForAgent2(myAgentId, readableByFor2(await resolveSessionActor2(req, myAgentId)));
     const tasks = await Promise.all(pausedTasks.map(async (task) => {
       const requestedBy = await buildTaskRequestedBy(task);
       return {
@@ -23112,7 +23638,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     }
     if (task.workflowRunStepId != null) {
-      const failed = await failTask2(parsed.params.id, "superseded_workflow_task");
+      const failed = await failTask2(parsed.params.id, SUPERSEDED_WORKFLOW_TASK_REASON);
       ensure({
         id: "task.workflow_step_failed_on_supersede",
         flow: "task",
@@ -26820,6 +27346,7 @@ ${templateBody}` : templateBody;
 
 // src/http/realtime.ts
 init_zod();
+init_users();
 init_rbac();
 
 // src/realtime/browser.generated.txt
@@ -26833,14 +27360,14 @@ var realtimeTicketRoute = route({
   pattern: ["api", "realtime", "ticket"],
   summary: "Issue a one-shot dashboard realtime ticket",
   tags: ["Rooms"],
-  rbac: { permission: "comb.presence" },
+  description: "The ticket authorizes one dashboard socket for presence rooms: Comb drives (`comb.presence`) and sessions (`session.presence`). An operator-key tab's picked user (`X-Swarm-User-Id`) rides on the ticket so session presence can check that user's access.",
+  rbac: { permission: "session.presence", alsoAdmits: ["comb.presence"] },
   responses: {
     200: {
       description: "One-shot realtime ticket",
       schema: object2({ ticket: string2(), expiresAt: number2().int() })
     },
-    403: { description: "Comb presence is not allowed" },
-    404: { description: "Comb is not enabled" }
+    403: { description: "Presence is not allowed" }
   }
 });
 route({
@@ -26857,29 +27384,28 @@ route({
 async function handleRealtimeTicket(req, res, pathSegments, queryParams) {
   if (!realtimeTicketRoute.match(req.method, pathSegments))
     return false;
-  if (!getCombConfig().enabled) {
-    jsonError(res, "Comb is not enabled", 404);
-    return true;
-  }
   const parsed = await realtimeTicketRoute.parse(req, res, pathSegments, queryParams);
   if (!parsed)
     return true;
   const auth = getRequestAuth(req);
   if (!auth || auth.kind === "agent" || auth.kind === "guest" || auth.kind === "controller") {
-    jsonError(res, "Comb presence requires dashboard authentication", 403);
+    jsonError(res, "Presence requires dashboard authentication", 403);
     return true;
   }
   const principal = auth.kind === "operator" ? { kind: "operator" } : { kind: "user", userId: auth.userId };
-  if (!can({
-    principal,
-    verb: "comb.presence",
-    resource: { kind: "none" },
-    source: "http"
-  }).allow) {
-    jsonError(res, "Comb presence requires the comb.presence permission", 403);
+  const allowed = (verb) => can({ principal, verb, resource: { kind: "none" }, source: "http" }).allow;
+  if (!allowed("comb.presence") && !allowed("session.presence")) {
+    jsonError(res, "Presence requires the comb.presence or session.presence permission", 403);
     return true;
   }
-  realtimeTicketRoute.respond(res, 200, issueRealtimeTicket(auth));
+  let dashboardUserId;
+  if (auth.kind === "operator" && !auth.page) {
+    const picked = dashboardUserIdHeader(req);
+    const user = picked ? await findUserById(picked) : null;
+    if (user?.status === "active")
+      dashboardUserId = user.id;
+  }
+  realtimeTicketRoute.respond(res, 200, issueRealtimeTicket(dashboardUserId ? { ...auth, dashboardUserId } : auth));
   return true;
 }
 async function handleRealtimeAsset(req, res) {
@@ -30768,6 +31294,7 @@ var agentTaskRoute = route({
   method: "post",
   path: "/api/internal/script-runs/{runId}/agent-task",
   pattern: ["api", "internal", "script-runs", null, "agent-task"],
+  session: bodyTask("parentTaskId"),
   operationId: "script_runs_internal_agent_task",
   summary: "Create or wait for a script workflow agent task step",
   tags: ["Script Runs"],
@@ -31247,6 +31774,9 @@ var upsertRoute2 = route({
   method: "post",
   path: "/api/scripts/upsert",
   pattern: ["api", "scripts", "upsert"],
+  auth: {
+    userNamesAgent: "dashboard script playground: a user runs or saves a script in a chosen agent's scope"
+  },
   operationId: "scripts_upsert",
   summary: "Create or update a reusable script",
   description: "Explicit script upserts run a TypeScript typecheck before writing.",
@@ -31271,6 +31801,9 @@ var runRoute = route({
   method: "post",
   path: "/api/scripts/run",
   pattern: ["api", "scripts", "run"],
+  auth: {
+    userNamesAgent: "dashboard script playground: a user runs or saves a script in a chosen agent's scope"
+  },
   operationId: "scripts_run",
   summary: "Run a reusable or inline script",
   description: "Inline source skips typecheck and is auto-saved as a scratch script only on success.",
@@ -32241,6 +32774,7 @@ var createSessionLogsRoute = route({
   method: "post",
   path: "/api/session-logs",
   pattern: ["api", "session-logs"],
+  session: bodyTask("taskId"),
   summary: "Store session logs",
   tags: ["Session Data"],
   body: object2({
@@ -32262,6 +32796,7 @@ var getSessionLogsByTask = route({
   method: "get",
   path: "/api/tasks/{taskId}/session-logs",
   pattern: ["api", "tasks", null, "session-logs"],
+  session: { taskParam: "taskId" },
   summary: "Get session logs for a task",
   tags: ["Session Data"],
   params: object2({ taskId: string2() }),
@@ -32280,6 +32815,7 @@ var createSessionCostRoute = route({
   method: "post",
   path: "/api/session-costs",
   pattern: ["api", "session-costs"],
+  session: bodyTask("taskId"),
   summary: "Store session cost record",
   tags: ["Session Data"],
   body: object2({
@@ -32378,7 +32914,7 @@ var listSessionCosts = route({
     }
   }
 });
-async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId) {
+async function handleSessionData(req, res, pathSegments, queryParams, myAgentId) {
   if (createSessionLogsRoute.match(req.method, pathSegments)) {
     const parsed = await createSessionLogsRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -32417,6 +32953,10 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (!await canReadSession2(req, myAgentId, task.id)) {
+      jsonError(res, SESSION_READ_DENIED2, 403);
+      return true;
+    }
     const logs = await getSessionLogsByTaskId2(parsed.params.taskId, parsed.query?.limit);
     getSessionLogsByTask.respond(res, 200, { logs });
     return true;
@@ -32563,6 +33103,8 @@ init_zod();
 init_db3();
 init_steering();
 init_users();
+init_rbac();
+init_bus();
 init_types();
 init_request_auth_context();
 init_runtime_pools_flag();
@@ -32611,6 +33153,9 @@ var mintSessionTokenRoute = route({
   method: "post",
   path: "/api/sessions/tokens",
   pattern: ["api", "sessions", "tokens"],
+  session: {
+    none: "user tokens cannot mint: the handler admits only the operator key or the task's own runtime"
+  },
   summary: "Mint an ephemeral task or runtime token",
   description: "Operators can mint task or runtime tokens. Runtime tokens can mint task tokens for their own assigned tasks. Child tokens expire with their parent runtime.",
   tags: ["Sessions"],
@@ -32673,7 +33218,8 @@ var listSessions = route({
     q: string2().optional(),
     requestedByUserId: string2().min(1).optional(),
     contextKeyPrefix: string2().min(1).optional(),
-    fields: _enum2(["full", "slim"]).optional()
+    fields: _enum2(["full", "slim"]).optional(),
+    scope: _enum2(["mine", "shared"]).optional()
   }),
   responses: {
     200: {
@@ -32693,23 +33239,68 @@ var getSession = route({
   method: "get",
   path: "/api/sessions/{rootTaskId}",
   pattern: ["api", "sessions", null],
+  session: { taskParam: "rootTaskId" },
   summary: "Get a session — root task + the entire descendant chain",
   tags: ["Sessions"],
   params: object2({ rootTaskId: string2() }),
   responses: {
     200: {
-      description: "Root task + chain (ordered by createdAt)",
+      description: "Root task + chain (ordered by createdAt), plus the caller's `access` and the session `owner`",
       schema: object2({
         root: TaskWithSteeringSchema,
-        chain: array2(TaskWithSteeringSchema)
+        chain: array2(TaskWithSteeringSchema),
+        access: SessionAccessSchema,
+        owner: SessionOwnerSchema.nullable()
       })
     },
     401: { description: "Unauthorized" },
+    403: { description: "The caller has no access to this session" },
+    404: { description: "Root task not found" }
+  },
+  auth: { apiKey: true }
+});
+var getSessionShares = route({
+  method: "get",
+  path: "/api/sessions/{rootTaskId}/shares",
+  pattern: ["api", "sessions", null, "shares"],
+  session: { taskParam: "rootTaskId" },
+  summary: "List a session's active shares",
+  description: "Active shares only. `everyone` is the access every user has; `users` are per-person shares. A session with no shares is private to its owner.",
+  tags: ["Sessions"],
+  params: object2({ rootTaskId: string2() }),
+  responses: {
+    200: { description: "Active shares", schema: SessionSharesSchema },
+    401: { description: "Unauthorized" },
+    403: { description: "The caller has no access to this session" },
     404: { description: "Root task not found" }
   },
   auth: { apiKey: true }
 });
-async function handleSessions(req, res, pathSegments, queryParams) {
+var putSessionShares = route({
+  method: "put",
+  path: "/api/sessions/{rootTaskId}/shares",
+  pattern: ["api", "sessions", null, "shares"],
+  session: { taskParam: "rootTaskId" },
+  summary: "Set who can view or edit a session",
+  description: "Owner only. The body is the full desired state: users left out lose access. Changed targets have their active share revoked and a new one inserted in one transaction; shares are never deleted.",
+  tags: ["Sessions"],
+  params: object2({ rootTaskId: string2() }),
+  body: SessionSharesUpdateSchema,
+  responses: {
+    200: { description: "Active shares after the change", schema: SessionSharesSchema },
+    400: { description: "Validation error or unknown user" },
+    401: { description: "Unauthorized" },
+    403: { description: "Only the session owner can share it" },
+    404: { description: "Root task not found" },
+    409: { description: "The session has no owner, so it is already open to everyone" }
+  },
+  auth: { apiKey: true },
+  rbac: { permission: "session.share" }
+});
+async function accessForRoot(actor, root) {
+  return actor.kind === "bypass" ? "owner" : sessionAccessForRoot(actor.userId, root);
+}
+async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
   if (mintSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
     if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.runtimeId)) {
@@ -32786,21 +33377,30 @@ async function handleSessions(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const sources = parsed.query.source ? parsed.query.source.split(",").map((s) => s.trim()).filter(Boolean) : undefined;
-    const baseOpts = {
-      limit: parsed.query.limit,
-      offset: parsed.query.offset,
+    const actor = await resolveSessionActor2(req, myAgentId);
+    if (actor.kind === "bypass" && parsed.query.scope) {
+      listSessions.respond(res, 200, {
+        sessions: [],
+        total: 0,
+        limit: parsed.query.limit ?? 25,
+        offset: parsed.query.offset ?? 0
+      });
+      return true;
+    }
+    const filterOpts = {
       source: sources,
       q: parsed.query.q,
       requestedByUserId: parsed.query.requestedByUserId,
-      contextKeyPrefix: parsed.query.contextKeyPrefix
+      contextKeyPrefix: parsed.query.contextKeyPrefix,
+      ...actor.kind === "user" ? { viewer: { userId: actor.userId, scope: parsed.query.scope ?? "all" } } : {}
+    };
+    const baseOpts = {
+      ...filterOpts,
+      limit: parsed.query.limit,
+      offset: parsed.query.offset
     };
     const sessions = parsed.query.fields === "full" ? await listRecentSessions2(baseOpts) : await listRecentSessions2({ ...baseOpts, slim: true });
-    const total = await countSessions2({
-      source: sources,
-      q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId,
-      contextKeyPrefix: parsed.query.contextKeyPrefix
-    });
+    const total = await countSessions2(filterOpts);
     listSessions.respond(res, 200, {
       sessions,
       total,
@@ -32818,6 +33418,20 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       jsonError(res, "Root task not found", 404);
       return true;
     }
+    const sessionRoot = await getSessionRoot(root.id) ?? {
+      id: root.id,
+      requestedByUserId: root.requestedByUserId ?? null
+    };
+    const access = await accessForRoot(await resolveSessionActor2(req, myAgentId), sessionRoot);
+    if (access === "none") {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
+    const ownerUser = sessionRoot.requestedByUserId ? await findUserById(sessionRoot.requestedByUserId) : null;
+    const owner = sessionRoot.requestedByUserId ? {
+      id: sessionRoot.requestedByUserId,
+      name: ownerUser?.name ?? sessionRoot.requestedByUserId
+    } : null;
     const chain = await getRootTaskChain2(parsed.params.rootTaskId);
     const tasks = [root, ...chain];
     const [steering, citations] = await Promise.all([
@@ -32829,7 +33443,69 @@ async function handleSessions(req, res, pathSegments, queryParams) {
       ...steering.get(task.id),
       citations: citations.get(task.id)
     });
-    getSession.respond(res, 200, { root: decorate(root), chain: chain.map(decorate) });
+    getSession.respond(res, 200, {
+      root: decorate(root),
+      chain: chain.map(decorate),
+      access,
+      owner
+    });
+    return true;
+  }
+  if (getSessionShares.match(req.method, pathSegments)) {
+    const parsed = await getSessionShares.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const root = await getSessionRoot(parsed.params.rootTaskId);
+    if (!root) {
+      jsonError(res, "Root task not found", 404);
+      return true;
+    }
+    const access = await accessForRoot(await resolveSessionActor2(req, myAgentId), root);
+    if (access === "none") {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
+    getSessionShares.respond(res, 200, toSessionSharesState(await listActiveSessionShares(root.id)));
+    return true;
+  }
+  if (putSessionShares.match(req.method, pathSegments)) {
+    const parsed = await putSessionShares.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const auth = getRequestAuth(req);
+    const actor = await resolveSessionActor2(req, myAgentId);
+    const principal = auth?.kind === "user" ? { kind: "user", userId: auth.userId } : auth?.kind === "operator" && !myAgentId ? { kind: "operator" } : null;
+    if (!principal || !can({ principal, verb: "session.share", resource: { kind: "none" }, source: "http" }).allow) {
+      jsonError(res, "Only the session owner can share it", 403);
+      return true;
+    }
+    const root = await getSessionRoot(parsed.params.rootTaskId);
+    if (!root) {
+      jsonError(res, "Root task not found", 404);
+      return true;
+    }
+    if (!root.requestedByUserId) {
+      jsonError(res, "This session has no owner, so it is already open to everyone", 409);
+      return true;
+    }
+    if (actor.kind === "user" && actor.userId !== root.requestedByUserId) {
+      jsonError(res, "Only the session owner can share it", 403);
+      return true;
+    }
+    const userIds = [...new Set(parsed.body.users.map((user) => user.userId))];
+    if (userIds.length !== parsed.body.users.length) {
+      jsonError(res, "Each user may appear only once", 400);
+      return true;
+    }
+    for (const userId of userIds) {
+      if (!await findUserById(userId)) {
+        jsonError(res, `Unknown user ${userId}`, 400);
+        return true;
+      }
+    }
+    const state = await setSessionShares(root, parsed.body, actor.kind === "user" ? actor.userId : null);
+    realtimeBus.publish(sessionAccessTopic(root.id), null);
+    putSessionShares.respond(res, 200, state);
     return true;
   }
   return false;
@@ -34231,11 +34907,12 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     const limit = parsed.query.limit ?? 100;
     const agentId = parsed.query.agentId;
+    const readableBy = readableByFor2(await resolveSessionActor2(req, myAgentId));
     let logs = [];
     if (agentId) {
-      logs = (await getLogsByAgentId2(agentId)).slice(0, limit);
+      logs = (await getLogsByAgentId2(agentId, readableBy)).slice(0, limit);
     } else {
-      logs = await getAllLogs2(limit);
+      logs = await getAllLogs2(limit, readableBy);
     }
     listLogs.respond(res, 200, { logs });
     return true;
@@ -34291,7 +34968,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (getConcurrentContextRoute.match(req.method, pathSegments)) {
-    const context = await getConcurrentContext2();
+    const context = await getConcurrentContext2(readableByFor2(await resolveSessionActor2(req, myAgentId)));
     getConcurrentContextRoute.respond(res, 200, context);
     return true;
   }
@@ -34354,9 +35031,8 @@ function uiEventEmitter(event) {
   return relayable.get(event)?.source;
 }
 function resolveSpec(spec) {
-  if (!spec.ref)
-    return spec;
-  return { ...file.definitions[spec.ref], ...spec };
+  const resolved = spec.ref ? { ...file.definitions[spec.ref], ...spec } : spec;
+  return resolved.items ? { ...resolved, items: resolveSpec(resolved.items) } : resolved;
 }
 function typeMatches(type, value) {
   switch (type) {
@@ -34401,6 +35077,12 @@ function validateUiEvent(event, properties) {
     if (spec.enum && !spec.enum.includes(value)) {
       problems.push(`"${key}" must be one of ${spec.enum.join(", ")}`);
     }
+    if (Array.isArray(value) && spec.items?.enum) {
+      const allowed = spec.items.enum;
+      if (value.some((item) => !allowed.includes(item))) {
+        problems.push(`"${key}" items must be one of ${allowed.join(", ")}`);
+      }
+    }
     if (typeof spec.minimum === "number" && typeof value === "number" && value < spec.minimum) {
       problems.push(`"${key}" must be at least ${spec.minimum}`);
     }
@@ -34441,7 +35123,7 @@ var enableTelemetry = route({
   summary: "Turn telemetry on",
   description: "Stores `ANONYMIZED_TELEMETRY=true` and applies it to the running server: the install ID is minted if needed and `telemetry.enabled` is sent once, so no restart is needed.",
   tags: ["Telemetry"],
-  body: object2({ via: _enum2(["banner", "settings"]).default("banner") }),
+  body: object2({ via: _enum2(["banner", "settings", "benchmark"]).default("banner") }),
   responses: {
     200: {
       description: "Telemetry is on",
@@ -35392,7 +36074,7 @@ var createUserRoute = route({
   tags: ["Users"],
   body: object2({
     name: string2().min(1),
-    email: string2().optional(),
+    email: string2().email("Email must be a valid email address").optional(),
     role: string2().optional(),
     notes: string2().optional(),
     emailAliases: array2(string2()).optional(),
@@ -35487,7 +36169,7 @@ var updateUserRoute = route({
   params: object2({ id: string2() }),
   body: object2({
     name: string2().min(1).optional(),
-    email: string2().optional(),
+    email: string2().email("Email must be a valid email address").nullable().optional(),
     role: string2().optional(),
     notes: string2().optional(),
     emailAliases: array2(string2()).optional(),
@@ -38362,10 +39044,11 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleExtensions(req, res, pathSegments, queryParams, myAgentId),
         () => handleFavorites(req, res, pathSegments, queryParams, myAgentId),
         () => handleUsers(req, res, pathSegments, queryParams),
-        () => handleSessions(req, res, pathSegments, queryParams),
+        () => handleSessions(req, res, pathSegments, queryParams, myAgentId),
         () => handleInboxState(req, res, pathSegments, queryParams),
         () => handleTelemetryUi(req, res, pathSegments, queryParams, myAgentId),
         () => handleUsedBy(req, res, pathSegments, queryParams, myAgentId),
+        () => handleRanking(req, res, pathSegments, queryParams),
         () => handleFleetBenchmark(req, res, pathSegments, queryParams),
         () => handleTaskTemplates(req, res, pathSegments, queryParams),
         () => handleMcp(req, res, transports, transportActivity, mcpSessionAgents),
@@ -38397,7 +39080,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-ymw5541d.js");
+var { attachControllerTransport } = await import("./controllers-connect-bg33ae53.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -38426,7 +39109,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-vjn3wbzf.js");
+    const { stopScheduler } = await import("./index-h2ek08d6.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -38438,7 +39121,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-4djvbm2j.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-nhvpw10z.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -38518,21 +39201,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-gbedmamp.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-6wxqkfk2.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-sdcf5yaz.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-3cqx3f3x.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-gbedmamp.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-6wxqkfk2.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-gbedmamp.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-6wxqkfk2.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -38540,7 +39223,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-6rmnn89d.js");
+  const { runAllSeeders } = await import("./index-2z710v4x.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -38602,39 +39285,39 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-vjn3wbzf.js");
-    const { getExecutorRegistry } = await import("./index-xmmkyx82.js");
+    const { startScheduler } = await import("./index-h2ek08d6.js");
+    const { getExecutorRegistry } = await import("./index-dgz61nff.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-nyfcdpky.js");
+    const { startHeartbeat } = await import("./index-pqfwh9nn.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-4djvbm2j.js");
+    const { startOAuthKeepalive } = await import("./keepalive-nhvpw10z.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-fpd6x6rw.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-4dcbhtn0.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-p666cw5n.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-e53x6b9v.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-w6pm64j4.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-f6z923ny.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-jcyjagn3.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-0538vsb7.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {