@desplega.ai/agent-swarm 2.4.2 → 2.4.4

package/dist/{cli-5rk36sjf.js → cli-v3yr2gbg.js}

@@ -332,19 +332,19 @@ import {
   recordInlineScriptRun2,
   exports_db,
   init_db3
-} from "./cli-d3qqdy4c.js";
+} from "./cli-p20r8w42.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-7awf1fp8.js";
+} from "./cli-4dg55wsk.js";
 import {
   ensurePricingSeeded2,
   ensureRbacSeeded2,
   ensureModelProfilesSeeded2
-} from "./cli-faypxz7q.js";
+} from "./cli-t7cyef5g.js";
 import {
   loadModelsDevCache
-} from "./cli-h93c9vb3.js";
+} from "./cli-amyhm3gj.js";
 import {
   buildCatalogEntries,
   listModelCatalog,
@@ -354,12 +354,12 @@ import {
   loadModelsCatalog,
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-saw9a6f6.js";
+} from "./cli-xc27fwzg.js";
 import {
   ampPinProviderError,
   ampPinCatalogError,
   ampModelError
-} from "./cli-sv5gb0yb.js";
+} from "./cli-2zqpkvtt.js";
 import {
   notifyAutomationPreflightFailure,
   isNeedsSetupFailure,
@@ -411,7 +411,7 @@ import {
   buildNodeInterpolationCtx,
   interpolateNodeConfig,
   scriptBodyInterpolationError
-} from "./cli-y2x52gs2.js";
+} from "./cli-51y09c6p.js";
 import {
   require_dist2,
   publicEndpointSsrfOptions,
@@ -471,14 +471,14 @@ import {
   deleteApp,
   typecheckScript,
   parseSkillContent
-} from "./cli-h38rjv87.js";
+} from "./cli-2y91wnbh.js";
 import {
   buildAuthorizationUrl,
   onAuthorizationRefreshed,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow
-} from "./cli-s6vr7r2d.js";
+} from "./cli-esxerzg7.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -508,14 +508,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-nn47d7e8.js";
+} from "./cli-qkhc5aqy.js";
 import {
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin,
   externalChannelToolError2,
   getChannelBlockReason2
-} from "./cli-pkht5hap.js";
+} from "./cli-1d70crsy.js";
 import {
   BaseExecutor,
   postApprovalCancellationUpdates,
@@ -523,6 +523,7 @@ import {
   HumanInTheLoopExecutor,
   resolveWorkflowLlmConfig,
   SYSTEM_ONE_PROVIDER_IDS,
+  SystemOneExtractionExecutor,
   SYSTEM_ONE_DECISION_NODE_TYPE,
   SystemOneDecisionConfigSchema,
   SystemOneDecisionExecutor,
@@ -532,7 +533,7 @@ import {
   definitionNodeIds,
   validateDefinition,
   applyDefinitionPatch
-} from "./cli-02qm7src.js";
+} from "./cli-q6r7t299.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -554,17 +555,19 @@ import {
   SESSION_READ_DENIED2,
   canReadSession2,
   readableByFor2,
+  denyParentAttach2,
   pathSessionDenial2,
   userAgentIdentityDenial2,
   runtimeInstanceHeader,
+  bodyTask,
   routeRegistry,
   isPublicRoute,
   findRoute,
   route
-} from "./cli-efaqv1c7.js";
+} from "./cli-cynvc9fj.js";
 import {
   isMultiRuntimeEnabled
-} from "./cli-7a91w22y.js";
+} from "./cli-e8xyjvfc.js";
 import {
   providerPath,
   AgentFsProvider,
@@ -573,7 +576,7 @@ import {
 import {
   getRuntimePool2,
   init_db
-} from "./cli-n85dqg6d.js";
+} from "./cli-w6nadkh4.js";
 import {
   getMemoryRaterNames,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -598,7 +601,7 @@ import {
 import {
   canProvisionKind,
   init_runtime_providers
-} from "./cli-pw7v69vp.js";
+} from "./cli-625tb7aq.js";
 import {
   findUserById,
   findUserByExternalId,
@@ -614,7 +617,7 @@ import {
   resolveSessionToken,
   fingerprintApiKey,
   init_users
-} from "./cli-nmqdc2t3.js";
+} from "./cli-9fhkkpj5.js";
 import {
   isRbacEnabled,
   decideAdmission,
@@ -623,7 +626,7 @@ import {
   init_elevated_agents,
   can,
   init_rbac
-} from "./cli-1pa3rz69.js";
+} from "./cli-ba8ne1es.js";
 import {
   normalizeAssetKey,
   parseAssetKey,
@@ -683,7 +686,7 @@ import {
   KvNamespaceSchema,
   KvKeySchema,
   init_types
-} from "./cli-fpmsqq59.js";
+} from "./cli-nc35pxb7.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -692,15 +695,15 @@ import {
   taskAttachmentFetchCommand,
   taskAttachmentDisplayUrl,
   init_task_attachment_links
-} from "./cli-x5mq1fyq.js";
+} from "./cli-74c1wpm0.js";
 import {
   getSlackConfiguration,
   init_config
-} from "./cli-2wag8973.js";
+} from "./cli-qeaq3j6t.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
-} from "./cli-mhywgrrz.js";
+} from "./cli-4sydckyj.js";
 import {
   findInterpolationTokens,
   interpolate,
@@ -754,7 +757,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-shvfedvm.js";
+} from "./cli-pccfmtb5.js";
 import {
   realtimeBus,
   init_bus
@@ -770,12 +773,12 @@ import {
   getAgentFsDefaultDriveId,
   isCombEnabled,
   init_constants2
-} from "./cli-w9g4sz81.js";
+} from "./cli-gf2850q7.js";
 import {
   parseEnvFlag,
   isEnvFlagEnabled,
   init_env_flag
-} from "./cli-0hyhdkdk.js";
+} from "./cli-cebvbc9t.js";
 import {
   getApiKey,
   init_api_key
@@ -21146,7 +21149,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-9h14qvr6.js");
+        const { getSlackApp } = await import("./app-rb7vc02s.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -21272,7 +21275,7 @@ var RawLlmOutputSchema = object2({
 async function executeRawLlm(config) {
   let modelName = config.model ?? "google/gemini-3-flash-preview";
   try {
-    const { createOpenAI } = await import("./index-va3y63es.js");
+    const { createOpenAI } = await import("./index-6srwvd5b.js");
     const llmConfig = await resolveWorkflowLlmConfig(config.model);
     modelName = llmConfig.model;
     const provider = createOpenAI({
@@ -21282,7 +21285,7 @@ async function executeRawLlm(config) {
     });
     const model = provider(llmConfig.model);
     if (config.schema) {
-      const { generateObject, jsonSchema } = await import("./index-s98037v0.js");
+      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
       const { object } = await generateObject({
         model,
         schema: jsonSchema(config.schema),
@@ -21296,7 +21299,7 @@ async function executeRawLlm(config) {
         output: { result: object, model: modelName }
       };
     }
-    const { generateText } = await import("./index-s98037v0.js");
+    const { generateText } = await import("./index-cbxkmfc5.js");
     const { text } = await generateText({
       model,
       prompt: config.prompt
@@ -21736,8 +21739,8 @@ class ValidateExecutor extends BaseExecutor {
     const interpolatedPrompt = this.deps.interpolate(prompt, context);
     const outputStr = typeof targetOutput === "string" ? targetOutput : JSON.stringify(targetOutput);
     try {
-      const { createOpenAI } = await import("./index-va3y63es.js");
-      const { generateObject, jsonSchema } = await import("./index-s98037v0.js");
+      const { createOpenAI } = await import("./index-6srwvd5b.js");
+      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
       const llmConfig = await resolveWorkflowLlmConfig();
       const provider = createOpenAI({
         baseURL: llmConfig.baseURL,
@@ -21909,6 +21912,7 @@ function createExecutorRegistry(deps) {
   registry.register(new NotifyExecutor(deps));
   registry.register(new RawLlmExecutor(deps));
   registry.register(new SystemOneDecisionExecutor(deps));
+  registry.register(new SystemOneExtractionExecutor(deps));
   registry.register(new ScriptExecutor(deps));
   registry.register(new SwarmScriptExecutor(deps));
   registry.register(new VcsExecutor(deps));
@@ -24508,7 +24512,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-0a9wwjcx.js");
+  const dispatcher = await import("./dispatcher-x0jfw2c9.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -29128,6 +29132,7 @@ init_db3();
 init_users();
 init_resolver();
 init_context_key();
+init_env_flag();
 
 // src/github/mentions.ts
 var GITHUB_BOT_NAME = process.env.GITHUB_BOT_NAME || "agent-swarm-bot";
@@ -29608,7 +29613,7 @@ function buildGithubContextKey(fullName, kind, number) {
 }
 async function cancelFlagEnabled(key) {
   const row = (await getSwarmConfigs2({ scope: "global", key }))[0];
-  return row?.value !== "false";
+  return parseEnvFlag(row?.value, true);
 }
 var cancelOnUnassignEnabled = () => cancelFlagEnabled("github.cancelOnUnassign");
 var cancelOnReviewRequestRemovedEnabled = () => cancelFlagEnabled("github.cancelOnReviewRequestRemoved");
@@ -30305,7 +30310,7 @@ var PR_REVIEW_ACTION_ITEMS_QUERY = `query($owner: String!, $name: String!, $numb
   }
 }`;
 function skipNoopApprovalsEnabled() {
-  return process.env.GITHUB_SKIP_NOOP_APPROVALS?.trim().toLowerCase() !== "false";
+  return parseEnvFlag(process.env.GITHUB_SKIP_NOOP_APPROVALS, true);
 }
 async function fetchPrReviewActionCounts(repo, prNumber, installationId) {
   const [owner, name] = repo.split("/");
@@ -33821,7 +33826,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-9h14qvr6.js");
+    const { getSlackApp } = await import("./app-rb7vc02s.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -33892,7 +33897,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient } = await import("./db-nn0hcmx5.js");
+  const { getDbClient } = await import("./db-xsjg9jqq.js");
   await getDbClient().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -107242,7 +107247,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-smxyk04s.js");
+  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-ww2vznkp.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -107258,10 +107263,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-6yn53ms9.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-srp6v6af.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-7fcka4z5.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-xns7h5h9.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -107452,6 +107457,8 @@ async function handleCore(req, res, myAgentId, apiKey) {
         return true;
       }
       req.headers["x-runtime-instance-id"] = auth.runtimeId;
+    }
+    if (auth.tokenKind !== "task") {
       const sourceHeader = req.headers["x-source-task-id"];
       const taskId = Array.isArray(sourceHeader) ? sourceHeader[0] : sourceHeader;
       if (taskId !== undefined && (await getTaskById2(taskId))?.agentId !== auth.agentId) {
@@ -108787,6 +108794,7 @@ async function runAppAction({
   app,
   name,
   input = {},
+  parentTaskId,
   caller,
   actor
 }) {
@@ -108873,7 +108881,8 @@ async function runAppAction({
     routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
     routingSource: action.agentId || lead ? "engine_default" : undefined,
     key: normalizeAssetKey(`shared/app:${app.id}/action:${name}/`),
-    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
+    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {},
+    ...parentTaskId ? { parentTaskId } : {}
   }, { origin: "app" });
   return {
     status: 200,
@@ -110044,6 +110053,47 @@ init_rbac();
 init_types();
 init_request_auth_context();
 init_secret_scrubber();
+
+// src/http/request-principal.ts
+init_db3();
+init_request_auth_context();
+async function requestPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "controller")
+    return { kind: "guest" };
+  if (auth?.kind === "operator")
+    return { kind: "operator" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (auth?.kind === "guest")
+    return { kind: "guest" };
+  if (!myAgentId)
+    return null;
+  const agent = await getAgentById2(myAgentId);
+  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
+}
+async function agentFirstPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "controller")
+    return { kind: "guest" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (auth?.kind === "guest")
+    return { kind: "guest" };
+  const agentId = auth?.kind === "agent" ? auth.agentId : myAgentId;
+  if (!agentId)
+    return { kind: "operator" };
+  const agent = await getAgentById2(agentId);
+  return { kind: "agent", agentId, isLead: agent?.isLead === true };
+}
+function rejectGuest(req, res) {
+  if (getRequestAuth(req)?.kind !== "guest")
+    return false;
+  jsonError(res, "Forbidden", 403);
+  return true;
+}
+
+// src/http/apps.ts
 var MAX_APP_BODY_BYTES = 5 * 1024 * 1024;
 var MAX_APP_ROW_BODY_BYTES = 1 * 1024 * 1024;
 var MAX_APP_BULK_ROWS_BODY_BYTES = 10 * 1024 * 1024;
@@ -110492,17 +110542,23 @@ var runActionRoute = route({
   method: "post",
   path: "/api/apps/{id}/actions/{name}",
   pattern: ["api", "apps", null, "actions", null],
+  session: bodyTask("parentTaskId"),
   summary: "Run a custom app action",
   description: "Runs the saved script, or creates the agent task, named by the app definition.",
   tags: ["Apps"],
   params: object2({ id: string2().min(1), name: AppNameSchema }),
-  body: object2({ input: record2(string2(), unknown()).optional() }),
+  body: object2({
+    input: record2(string2(), unknown()).optional(),
+    parentTaskId: string2().min(1).optional()
+  }),
   responses: {
     200: { description: "Action invoked", schema: runActionResultSchema },
-    400: { description: "Invalid action input or stale script reference" },
+    400: {
+      description: "Invalid action input, stale script reference, or parentTaskId on a non-task action"
+    },
     403: { description: "Permission denied" },
     409: { description: "App definition needs repair" },
-    404: { description: "App or action not found" }
+    404: { description: "App, action, or parent task not found" }
   },
   rbac: { permission: "app.use" }
 });
@@ -111071,10 +111127,29 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     if (definitionNeedsRepair(res, app))
       return true;
+    if (parsed.body.parentTaskId) {
+      const actions = app.definition.actions;
+      const action = actions && Object.hasOwn(actions, parsed.params.name) ? actions[parsed.params.name] : undefined;
+      if (action && action.kind !== "task") {
+        jsonError(res, "parentTaskId is only supported for task-kind actions", 400);
+        return true;
+      }
+      if (action) {
+        const parentTask = await getTaskById2(parsed.body.parentTaskId);
+        if (!parentTask) {
+          jsonError(res, "parent task not found", 404);
+          return true;
+        }
+        const principal = await agentFirstPrincipal(req, myAgentId);
+        if (await denyParentAttach2(req, res, myAgentId, parentTask, principal))
+          return true;
+      }
+    }
     const output = await runAppAction({
       app,
       name: parsed.params.name,
       input: parsed.body.input,
+      parentTaskId: parsed.body.parentTaskId,
       caller,
       actor
     });
@@ -136121,4 +136196,4 @@ async function createServer(opts = {}) {
   return server;
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, requestPrincipal, agentFirstPrincipal, rejectGuest, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };

package/dist/{cli-239yjk27.js → cli-vdm20wej.js}

@@ -1,6 +1,6 @@
 import {
   runStopHookSessionSummarySubprocess
-} from "./cli-ahtpy9kf.js";
+} from "./cli-55qmbp6z.js";
 import {
   CONTEXT_FORMULA,
   getContextWindowSize,
@@ -15,7 +15,7 @@ import {
 } from "./cli-gx4rm0qx.js";
 import {
   swarmRuntimeInstanceId
-} from "./cli-7a91w22y.js";
+} from "./cli-e8xyjvfc.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -47,7 +47,7 @@ import {
 import {
   withFileLock,
   init_file_lock
-} from "./cli-x5mq1fyq.js";
+} from "./cli-74c1wpm0.js";
 import {
   CLAUDE_CREDENTIALS_HINT,
   validateClaudeCredentials,
@@ -66,7 +66,7 @@ import {
 import {
   isEnvFlagEnabled,
   init_env_flag
-} from "./cli-0hyhdkdk.js";
+} from "./cli-cebvbc9t.js";
 import {
   scrubSecrets,
   init_secret_scrubber
@@ -1236,7 +1236,7 @@ class ClaudeAdapter2 {
     if (transport === "sdk" && isClaudeBridgeEffective(sourceEnv)) {
       throw new Error("CLAUDE_TRANSPORT=sdk cannot run with an effective Claude Bridge configuration. Select CLI transport or disable the bridge.");
     }
-    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-s2k1qd8y.js") : undefined;
+    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-2j3j4kwn.js") : undefined;
     claudeSdk?.validateClaudeSdkAdditionalArgs([
       ...claudeBinaryArgv.slice(1),
       ...config.additionalArgs ?? []

package/dist/{cli-zfg9enh9.js → cli-vfha21c9.js}

@@ -21,6 +21,10 @@ import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-dfyv0jdy.js";
+import {
+  isSessionSummarySkipped,
+  init_env_flag
+} from "./cli-cebvbc9t.js";
 import {
   scrubSecrets,
   init_secret_scrubber
@@ -46,6 +50,7 @@ Current Progress: ${task.progress}` : ""
 }
 
 // src/providers/pi-mono-extension.ts
+init_env_flag();
 init_openrouter_base_url();
 init_secret_scrubber();
 function apiHeaders(config) {
@@ -509,7 +514,7 @@ function createSwarmHooksExtension(config) {
       await syncIdentityFilesToServer(config);
       await syncSetupScriptToServer(config);
       const sessionFile = ctx.sessionManager.getSessionFile?.();
-      if (!process.env.SKIP_SESSION_SUMMARY) {
+      if (!isSessionSummarySkipped()) {
         await summarizeSessionForPi(config, sessionFile);
       } else {
         console.debug("session_summary skipped (pi): SKIP_SESSION_SUMMARY is set");

package/dist/{cli-rdyw3mct.js → cli-vq97g1jq.js}

@@ -22,7 +22,7 @@ import {
 } from "./cli-pnp2j5zg.js";
 import {
   swarmRuntimeInstanceId
-} from "./cli-7a91w22y.js";
+} from "./cli-e8xyjvfc.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -52,7 +52,7 @@ import {
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-fpmsqq59.js";
+} from "./cli-nc35pxb7.js";
 import {
   runtimeCatalogModel,
   init_runtime_model_catalog
@@ -60,11 +60,12 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-shvfedvm.js";
+} from "./cli-pccfmtb5.js";
 import {
   isEnvFlagEnabled,
+  isSessionSummarySkipped,
   init_env_flag
-} from "./cli-0hyhdkdk.js";
+} from "./cli-cebvbc9t.js";
 import {
   getApiKey,
   init_api_key
@@ -1693,7 +1694,7 @@ class CodexSession {
       });
     } finally {
       const sessionWasAborted = this.aborted || this.abortController?.signal.aborted === true || this.pendingResult?.exitCode === 130;
-      if (process.env.SKIP_SESSION_SUMMARY !== "1" && !sessionWasAborted) {
+      if (!isSessionSummarySkipped() && !sessionWasAborted) {
         try {
           await this.summarizeAtEnd();
         } catch (err) {

package/dist/{cli-n85dqg6d.js → cli-w6nadkh4.js}

@@ -15,17 +15,17 @@ import {
   init_secret_registry,
   upsertSwarmConfig2,
   init_db3
-} from "./cli-d3qqdy4c.js";
+} from "./cli-p20r8w42.js";
 import {
   createRuntimeProvider,
   init_runtime_providers
-} from "./cli-pw7v69vp.js";
+} from "./cli-625tb7aq.js";
 import {
   closeSessionTokenConnections,
   init_session_token_connections,
   insertSessionToken,
   init_users
-} from "./cli-nmqdc2t3.js";
+} from "./cli-9fhkkpj5.js";
 import {
   RuntimeControllerCreateSchema,
   RuntimeControllerUpdateSchema,
@@ -33,7 +33,7 @@ import {
   RuntimePoolUpdateSchema,
   RuntimePoolCreateAgentSchema,
   init_types
-} from "./cli-fpmsqq59.js";
+} from "./cli-nc35pxb7.js";
 import {
   scrubSecrets,
   registerVolatileSecret,

package/dist/{cli-99jez72r.js → cli-w9etnnxk.js}

@@ -3,7 +3,8 @@ import {
 } from "./cli-f49w2hk5.js";
 import {
   toJSONSchema,
-  safeParseAsync2
+  safeParseAsync2,
+  init_external
 } from "./cli-d9f7gzeq.js";
 
 // node_modules/@ai-sdk/provider/dist/index.mjs
@@ -338,6 +339,10 @@ function isJSONObject(value) {
   return value != null && typeof value === "object" && Object.entries(value).every(([key, val]) => typeof key === "string" && (val === undefined || isJSONValue(val)));
 }
 
+// node_modules/zod/v4/classic/index.js
+init_external();
+init_external();
+
 // node_modules/eventsource-parser/dist/index.js
 class ParseError extends Error {
   constructor(message, options) {

package/dist/{cli-saw9a6f6.js → cli-xc27fwzg.js}

@@ -4,11 +4,11 @@ import {
   getActivePricingRow2,
   insertPricingRow2,
   init_db3
-} from "./cli-d3qqdy4c.js";
+} from "./cli-p20r8w42.js";
 import {
   loadModelsDevCache,
   buildModelsDevSeedRows
-} from "./cli-h93c9vb3.js";
+} from "./cli-amyhm3gj.js";
 import {
   setRuntimeModelCatalog,
   init_runtime_model_catalog

package/dist/{cli-ftyypbg5.js → cli-xj0re5tm.js}

@@ -4,7 +4,7 @@ import {
 import {
   normalizeOrgWebsite,
   init_org_website
-} from "./cli-d3qqdy4c.js";
+} from "./cli-p20r8w42.js";
 
 // src/utils/lead-monitor-channels.ts
 function isLeadChannelMonitoringEnabled(env = process.env) {