@desplega.ai/agent-swarm 2.4.3 → 2.4.5

package/dist/{http-q813tmya.js → http-pk972xyw.js}

@@ -42,6 +42,9 @@ import {
   recordUnmappedIdentity,
   MAX_TASK_ATTACHMENT_BYTES,
   recordTaskAttachmentUpload,
+  scopeFromAttachment,
+  backingProviderId,
+  transcribeAudioNotes,
   handleWebhookTrigger,
   verifyHmacSignature,
   WebhookError,
@@ -168,15 +171,22 @@ import {
   handleAgentSessionPrompted,
   isLinearEnabled,
   initLinear,
-  parseCookieHeader,
+  isCookieSafePageId,
+  extractPageSession,
+  extractLegacyPageSession,
   extractAndVerifyCookie,
-  issuePageSessionCookie,
+  pageSessionSetCookies,
   resolveHttpRequestAuth,
   loadGlobalConfigsIntoEnv,
   reloadGlobalConfigsAndIntegrations,
   scheduleIntegrationsReload,
   handleCore,
+  MCP_MAX_TOOL_INPUT_ELEMENTS,
+  MCP_MAX_REQUEST_BODY_BYTES,
   userCtx,
+  requestPrincipal,
+  agentFirstPrincipal,
+  rejectGuest,
   handleApps,
   cancelApprovalRequest,
   getUserCommsPrefs,
@@ -202,6 +212,9 @@ import {
   hydrateOAuthAppFromPreset,
   scopedResourceScopeIdSchema,
   resolveScopedResourceId,
+  MemoryKeyError,
+  refreshLinks,
+  indexMemoryContent,
   dedupeMemoryDocumentIds,
   recordMemoryAccesses,
   recordRetrievals,
@@ -218,12 +231,9 @@ import {
   reservedRoomKeyError,
   updateMcpServerChecked,
   updateTouchesStdioExecution,
-  MemoryKeyError,
-  refreshLinks,
   canReadMemory,
   getLinksForMemory,
   expandCandidatesWithGraph,
-  indexMemoryContent,
   isApiDraining,
   drainApi,
   markKapsoMessageRead,
@@ -280,7 +290,7 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-kgnkyabk.js";
+} from "./cli-n72rg53p.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -446,6 +456,7 @@ import {
   reservedKeyError,
   MAX_DB_RETENTION_DAYS,
   DB_RETENTION_TUNING_BOUNDS,
+  CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS,
   validateConfigValue,
   validateExportToEnv,
   init_swarm_config_guard,
@@ -476,6 +487,8 @@ import {
   init_key_paths,
   rerank,
   init_reranker,
+  searchMemoryCandidates,
+  init_search_candidates,
   getEmbeddingProvider2,
   getMemoryStore2,
   init_memory,
@@ -716,26 +729,26 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-wt0jf9hm.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-qp2m4btv.js";
-import"./cli-1n9gdg56.js";
+} from "./cli-kpw04va0.js";
+import"./cli-43x64hv3.js";
 import {
   normalizeModelKey
-} from "./cli-vq9gqarq.js";
+} from "./cli-dk44dxec.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-npfe9t1s.js";
+} from "./cli-bnes4z6b.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-1eszr343.js";
+} from "./cli-qfxc84gh.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -747,7 +760,7 @@ import {
   cancelWorkflowRun2,
   TriggerSchemaError,
   startWorkflowExecution2
-} from "./cli-0dxxwfkt.js";
+} from "./cli-9hstj09h.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -827,14 +840,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-73ezfhha.js";
+} from "./cli-st8aw1m6.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-pygdsgh8.js";
+} from "./cli-a92r1127.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -862,14 +875,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-tkf4x6ha.js";
-import"./cli-v87dr6e3.js";
+} from "./cli-37j04k05.js";
+import"./cli-3a45zcgm.js";
 import {
   createApprovalFollowUpTask,
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-s9rr4gr2.js";
+} from "./cli-xpa64rek.js";
 import"./cli-8nyhf7za.js";
 import {
   _fetchHolder,
@@ -897,6 +910,7 @@ import {
   wireHttpSpanLifecycle,
   safeRequestUrlForLog,
   agentWithCapacity,
+  RequestBodyTooLargeError,
   parseBody,
   BODY_TOO_LARGE,
   enforceContentLengthCap,
@@ -922,12 +936,13 @@ import {
   canReadSession2,
   readableByFor2,
   SESSION_WRITE_DENIED2,
+  denyParentAttach2,
   runtimeInstanceHeader,
   bodyTask,
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-6eyncg0y.js";
+} from "./cli-018r4jq6.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-e8xyjvfc.js";
@@ -937,7 +952,7 @@ import {
   agentFsRequestTimeoutMs,
   AgentFsProvider,
   getFileStorageProvider2
-} from "./cli-qje9k2nh.js";
+} from "./cli-g9ypd5en.js";
 import {
   RuntimePoolError2,
   mintControllerToken,
@@ -958,7 +973,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-gx0j2khs.js";
+} from "./cli-j99azg3g.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -974,8 +989,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-8y99kfey.js";
-import"./cli-mzkwkbdy.js";
+} from "./cli-ms85309d.js";
+import"./cli-f0g3pgvf.js";
 import {
   import_websocket,
   import_websocket_server
@@ -984,7 +999,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-f0p0f6ja.js";
+} from "./cli-1sp861s4.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1004,14 +1019,14 @@ import {
   memoryRelevance,
   isUnknownModelError,
   writeSkillsToFilesystem
-} from "./cli-6aen3ezb.js";
+} from "./cli-v8fjakwf.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-p0qerd2r.js";
+} from "./cli-4zfqgjc5.js";
 import {
   Anthropic
-} from "./cli-er83cjbn.js";
+} from "./cli-k8g16gz3.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1041,9 +1056,13 @@ import {
   mintSessionToken,
   mintRuntimeToken,
   revokeSessionToken,
+  AgentTokenExistsError,
+  mintAgentToken,
+  rotateAgentToken,
+  revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-sds5zzs8.js";
+} from "./cli-1f3qzw6y.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import {
@@ -1057,7 +1076,7 @@ import {
   clearAuditSink,
   can,
   init_rbac
-} from "./cli-8vverzf7.js";
+} from "./cli-ba8ne1es.js";
 import {
   isSafeBundlePath,
   init_bundle_path,
@@ -1199,7 +1218,7 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-836ehxmt.js";
+} from "./cli-eww120g8.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
@@ -1272,7 +1291,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1xsraagq.js";
+} from "./cli-94gwyg7m.js";
 import {
   realtimeBus,
   init_bus
@@ -2454,8 +2473,7 @@ async function authenticate(req) {
     const page = await getPage2(pageId);
     if (!page)
       throw new Error("Page not found");
-    const cookie = await extractAndVerifyCookie(req);
-    const session = cookie?.pageId === pageId ? cookie : null;
+    const session = await extractAndVerifyCookie(req, pageId);
     if (!session && page.authMode !== "public")
       throw new Error("Page session required");
     if (session?.uid && (await findUserById(session.uid))?.status !== "active")
@@ -6511,47 +6529,6 @@ init_db2();
 init_rbac();
 init_types();
 init_request_auth_context();
-
-// src/http/request-principal.ts
-init_db3();
-init_request_auth_context();
-async function requestPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "controller")
-    return { kind: "guest" };
-  if (auth?.kind === "operator")
-    return { kind: "operator" };
-  if (auth?.kind === "user")
-    return { kind: "user", userId: auth.userId };
-  if (auth?.kind === "guest")
-    return { kind: "guest" };
-  if (!myAgentId)
-    return null;
-  const agent = await getAgentById2(myAgentId);
-  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
-}
-async function agentFirstPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "controller")
-    return { kind: "guest" };
-  if (auth?.kind === "user")
-    return { kind: "user", userId: auth.userId };
-  if (auth?.kind === "guest")
-    return { kind: "guest" };
-  const agentId = auth?.kind === "agent" ? auth.agentId : myAgentId;
-  if (!agentId)
-    return { kind: "operator" };
-  const agent = await getAgentById2(agentId);
-  return { kind: "agent", agentId, isLead: agent?.isLead === true };
-}
-function rejectGuest(req, res) {
-  if (getRequestAuth(req)?.kind !== "guest")
-    return false;
-  jsonError(res, "Forbidden", 403);
-  return true;
-}
-
-// src/http/assets.ts
 var AssetKeyAuditIssueSchema = object2({
   severity: _enum2(["fatal", "warning"]),
   code: _enum2([
@@ -8150,7 +8127,7 @@ async function requestSecretReadScope(req, resolvedScope) {
       source: "http"
     }).allow)
       return "all";
-    if (!auth.runtimeId || resolvedScope?.agentId !== auth.agentId)
+    if (auth.tokenKind === "task" || resolvedScope?.agentId !== auth.agentId)
       return "none";
     return "self";
   }
@@ -8168,7 +8145,7 @@ async function resolveSecretsRead(req, includeSecrets, resolvedScope) {
   const auth = getRequestAuth(req);
   return {
     effectiveIncludeSecrets: includeSecrets && scope !== "none",
-    includeRepoSecrets: !(auth?.kind === "agent" && auth.runtimeId && scope !== "all"),
+    includeRepoSecrets: !(auth?.kind === "agent" && auth.tokenKind !== "task" && scope !== "all"),
     secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : ""
   };
 }
@@ -8350,7 +8327,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     const key = parsed.query.key;
     const auth = getRequestAuth(req);
     const resolvedScope = {
-      agentId: parsed.query.agentId || (auth?.kind === "agent" && auth.runtimeId ? auth.agentId : undefined),
+      agentId: parsed.query.agentId || (auth?.kind === "agent" && auth.tokenKind !== "task" ? auth.agentId : undefined),
       repoId: parsed.query.repoId || undefined
     };
     const { effectiveIncludeSecrets, includeRepoSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets, resolvedScope);
@@ -8824,10 +8801,18 @@ async function handleCodexOAuthDevice(req, res, pathSegments, queryParams) {
 // src/http/codex-oauth-keep-warm.ts
 init_zod();
 init_db3();
+init_swarm_config_guard();
 init_api_key();
 init_codex_auth_failure();
 init_constants2();
-var KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+var DEFAULT_KEEP_WARM_MAX_AGE_HOURS = 120;
+function keepWarmMaxAgeMs(env = process.env) {
+  const raw = env.CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS?.trim();
+  const { min, max } = CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS;
+  const value = raw && /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+  const hours = value >= min && value <= max ? value : DEFAULT_KEEP_WARM_MAX_AGE_HOURS;
+  return hours * 60 * 60 * 1000;
+}
 var slotOutcomeSchema = discriminatedUnion("outcome", [
   object2({ slot: number2(), keySuffix: string2(), outcome: literal2("warm") }),
   object2({ slot: number2(), keySuffix: string2(), outcome: literal2("refreshed") }),
@@ -8845,7 +8830,7 @@ var keepWarmRoute = route({
   path: "/api/oauth/keep-warm/codex",
   pattern: ["api", "oauth", "keep-warm", "codex"],
   summary: "Locked keep-warm refresh sweep across all Codex OAuth pool slots",
-  description: "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
+  description: "Enumerates codex_oauth_* slots and refreshes any older than CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS (default 120 hours) through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
   tags: ["OAuth"],
   responses: {
     200: {
@@ -8862,6 +8847,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
     return true;
   const apiUrl = getMcpBaseUrl();
   const apiKey = getApiKey();
+  const maxAgeMs = keepWarmMaxAgeMs();
   const slots = await loadAllCodexOAuthSlots(apiUrl, apiKey);
   const results = [];
   for (const { slot, creds } of slots) {
@@ -8872,9 +8858,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
     }
     try {
       const beforeAccess = creds.access;
-      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, {
-        maxAgeMs: KEEP_WARM_MAX_AGE_MS
-      });
+      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, { maxAgeMs });
       if (!refreshed) {
         results.push({ slot, outcome: "no-credentials" });
       } else {
@@ -9721,6 +9705,7 @@ declare module "swarm-extension" {
     sourceTaskId?: string | undefined;
     outputSchema?: Record<string, unknown> | undefined;
     inheritParentOutputSchema?: boolean | undefined;
+    inheritParentRequester?: boolean | undefined;
     inheritParentRoutingAffinity?: boolean | undefined;
     inheritParentFollowUpConfig?: boolean | undefined;
     followUpConfig?:
@@ -10139,8 +10124,15 @@ declare module "swarm-extension" {
     userName?: string;
     /** The buffered messages, joined. */
     text: string;
+    /** True for an @mention and for a reply to one of the bot's messages. */
     botMentioned: boolean;
     isDirectMessage: boolean;
+    /** Platform chat type, such as Telegram \`private\`, \`group\`, \`supergroup\` or \`channel\`. */
+    chatType?: string;
+    /** Set for a Telegram supergroup with topics. */
+    isForum?: boolean;
+    /** A buffered message replies to one of the bot's own messages. */
+    replyToBot: boolean;
     /** Set when earlier swarm tasks exist in this thread. */
     threadContext?: {
       adapter: string;
@@ -11467,8 +11459,8 @@ export default extension;
     manifest: {
       $schema: "../manifest.schema.json",
       name: "slack-reply-gate",
-      description: "Asks Jev (TypeSafe or OpenRouter) whether Lead should answer a buffered Slack thread follow-up, and drops the wake-up when it should not",
-      version: "1.2.0",
+      description: "Asks a SystemOne decision model (Jev or Clef) whether Lead should answer a buffered Slack thread follow-up, and drops the wake-up when it should not",
+      version: "1.3.0",
       runtime: "api",
       assets: {
         hooks: "hooks.ts"
@@ -11483,8 +11475,9 @@ import { z } from "zod";
  *
  * Every human message in a Slack thread the swarm takes part in is buffered and
  * flushed into a Lead task ("[Thread follow-up — N message(s) buffered]"), even
- * "lol", ":joy:" or two people bantering. This hook asks TypeSafe Jev whether
- * Lead should answer, and drops the wake-up when the answer is no.
+ * "lol", ":joy:" or two people bantering. This hook asks a SystemOne decision
+ * model (Jev or Clef) whether Lead should answer, and drops the wake-up when the
+ * answer is no.
  *
  * Hook: \`pre.task.create\`, origin "slack", description carrying the
  * thread-buffer header. \`pre.slack.route\` cannot be used: the buffered thread
@@ -11492,17 +11485,20 @@ import { z } from "zod";
  * re-target a message, never drop it.
  *
  * Rules:
- *   - A message that @mentions Lead passes without a Jev call.
- *   - Otherwise one Jev \`choice\` question classifies the message into a reason;
+ *   - A message that @mentions Lead passes without a decision call.
+ *   - Otherwise one \`choice\` question classifies the message into a reason;
  *     reply=false only for reaction_only | banter_between_others |
  *     not_addressed_to_lead, and only when the summed probability of those
  *     three labels is >= minConfidence (a banter/reaction split is still a skip).
  *   - Fails OPEN on every error, timeout or missing key.
  *
- * Transport (config.provider): Jev is served by TypeSafe directly and by
- * OpenRouter's Decisions endpoint. Both take the same {model, state, questions}
- * body and return the same \`answers\` shape. \`auto\` uses TYPESAFE_API_KEY when
- * set, else OPENROUTER_API_KEY.
+ * Provider (config.provider): the decision is made server-side by the
+ * \`system-one-decide\` tool (\`ctx.swarm.systemOne_decide\`), the same path as a
+ * \`system-one-decision\` workflow node, so every SystemOne host works and no key
+ * enters this hook. \`auto\` picks the first host with a configured credential:
+ * typesafe (Jev, TYPESAFE_API_KEY), openrouter (Jev, OPENROUTER_API_KEY), then
+ * cloudflare (Clef, CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY, plus
+ * CLOUDFLARE_ACCOUNT_ID). laya and openai are explicit choices only.
  *
  * modes (config.mode):
  *   off     -> never evaluate
@@ -11525,17 +11521,19 @@ import { z } from "zod";
 export const config = z.object({
   mode: z.enum(["off", "shadow", "enforce"]).default("shadow"),
   timeoutMs: z.number().int().positive().default(3000),
-  provider: z.enum(["auto", "typesafe", "openrouter"]).default("auto"),
-  /** Jev model on the TypeSafe transport. */
+  provider: z
+    .enum(["auto", "typesafe", "openrouter", "cloudflare", "laya", "openai"])
+    .default("auto"),
+  /** Jev model on TypeSafe. */
   model: z.string().default("jev-latest"),
-  /** Jev model on the OpenRouter transport. */
+  /** Jev model on OpenRouter. */
   openrouterModel: z.string().default("typesafe/jev-1.13"),
+  /** Clef model on Cloudflare Workers AI: clef or clef-flash. */
+  cloudflareModel: z.string().default("clef"),
   minConfidence: z.number().min(0).max(1).default(0.55),
   contextMessages: z.number().int().min(0).max(20).default(6),
   leadAliases: z.array(z.string()).default(["lead"]),
   botSlackUserIds: z.array(z.string()).default([]),
-  /** Explicit TypeSafe key; otherwise TYPESAFE_API_KEY from the API process env. */
-  apiKey: z.string().optional(),
   /**
    * Reaction for a dropped message in enforce mode. "" only removes the bot's
    * acceptance reaction(s) and adds nothing.
@@ -11548,13 +11546,13 @@ type Cfg = z.infer<typeof config>;
 type Swarm = ApiCtx["swarm"];
 
 const NS = "ext:slack-reply-gate";
-const TYPESAFE_ENDPOINT = "https://api.typesafe.ai/v1/systemone";
-const OPENROUTER_ENDPOINT = "https://openrouter.ai/api/alpha/decisions";
 const HEADER_LINE_RE = /(?:^|\\n)\\[Thread follow-up — \\d+ message\\(s\\) buffered\\]\\n/g;
 const CTX_OPEN = "<thread_context>";
 const CTX_CLOSE = "</thread_context>";
 // The dispatcher cancels a handler after 5 s; leave room for the KV writes.
 const MAX_TIMEOUT_MS = 4000;
+// The smallest time budget system-one-decide accepts.
+const MIN_DECIDE_TIMEOUT_MS = 1000;
 
 export const REASONS = {
   direct_ask:
@@ -11656,14 +11654,14 @@ const usable = (v: string): boolean => Boolean(v) && !v.startsWith("[REDACTED");
 const envOf = (name: string): string => String(process.env[name] ?? "");
 
 /**
- * Resolve a secret: explicit value, then the API process env. The API process loads
- * global swarm_config rows into process.env at boot and on config reload.
+ * Resolve a secret from the API process env. The API process loads global
+ * swarm_config rows into process.env at boot and on config reload.
  * ctx.swarm.config_get cannot serve it: the SDK scrubs secrets to "[REDACTED:<name>]".
  */
-const secret = (name: string, explicit?: string): string => {
+const secret = (name: string): string => {
   const cached = secretCache.get(name);
   if (cached && Date.now() - cached.at < KEY_TTL_MS) return cached.value;
-  const value = [String(explicit ?? ""), envOf(name)].find(usable) ?? "";
+  const value = usable(envOf(name)) ? envOf(name) : "";
   if (usable(value)) secretCache.set(name, { value, at: Date.now() });
   return value;
 };
@@ -11673,46 +11671,51 @@ export const resetKeyCache = (): void => {
   secretCache.clear();
 };
 
-export type JevTransport = {
-  provider: "typesafe" | "openrouter";
-  endpoint: string;
-  key: string;
-  model: string;
-};
+export type ProviderId = Exclude<Cfg["provider"], "auto">;
+
+/** Where the decision is made. No model means the provider's own default. */
+export type DecisionTarget = { provider: ProviderId; model?: string };
+
+/** What \`auto\` needs per provider: every group must have one usable value. */
+const AUTO_CREDENTIALS: ReadonlyArray<[ProviderId, string[][]]> = [
+  ["typesafe", [["TYPESAFE_API_KEY"]]],
+  ["openrouter", [["OPENROUTER_API_KEY"]]],
+  ["cloudflare", [["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_API_KEY"], ["CLOUDFLARE_ACCOUNT_ID"]]],
+];
+
+const modelFor = (provider: ProviderId, cfg: Cfg): string | undefined =>
+  provider === "typesafe"
+    ? cfg.model
+    : provider === "openrouter"
+      ? cfg.openrouterModel
+      : provider === "cloudflare"
+        ? cfg.cloudflareModel
+        : undefined;
 
 /**
- * Pick the Jev transport. \`auto\` prefers TypeSafe and falls back to OpenRouter.
- * Throws when the chosen provider has no usable key; the handler fails open.
+ * The decision providers to try, in order. An explicit one is used as is: the
+ * server checks its credential. \`auto\` lists every provider in \`AUTO_CREDENTIALS\`
+ * whose credential is set and throws when none is; the handler then fails open.
  */
-export const resolveTransport = (cfg: Cfg): JevTransport => {
-  const typesafe = (): JevTransport | null => {
-    const key = secret("TYPESAFE_API_KEY", cfg.apiKey);
-    return usable(key)
-      ? { provider: "typesafe", endpoint: TYPESAFE_ENDPOINT, key, model: cfg.model }
-      : null;
-  };
-  const openrouter = (): JevTransport | null => {
-    const key = secret("OPENROUTER_API_KEY");
-    return usable(key)
-      ? { provider: "openrouter", endpoint: OPENROUTER_ENDPOINT, key, model: cfg.openrouterModel }
-      : null;
-  };
-  const transport =
-    cfg.provider === "typesafe"
-      ? typesafe()
-      : cfg.provider === "openrouter"
-        ? openrouter()
-        : (typesafe() ?? openrouter());
-  if (transport) return transport;
+export const resolveProviders = (cfg: Cfg): DecisionTarget[] => {
+  if (cfg.provider !== "auto") {
+    return [{ provider: cfg.provider, model: modelFor(cfg.provider, cfg) }];
+  }
+  const targets = AUTO_CREDENTIALS.filter(([, groups]) =>
+    groups.every((keys) => keys.some((key) => usable(secret(key)))),
+  ).map(([provider]) => ({ provider, model: modelFor(provider, cfg) }));
+  if (targets.length > 0) return targets;
   throw new Error(
-    cfg.provider === "typesafe"
-      ? "no TYPESAFE_API_KEY"
-      : cfg.provider === "openrouter"
-        ? "no OPENROUTER_API_KEY"
-        : "no TYPESAFE_API_KEY or OPENROUTER_API_KEY",
+    "no TYPESAFE_API_KEY, OPENROUTER_API_KEY, or CLOUDFLARE_API_TOKEN with CLOUDFLARE_ACCOUNT_ID",
   );
 };
 
+/** The first provider \`resolveProviders\` would try. */
+export const resolveProvider = (cfg: Cfg): DecisionTarget => resolveProviders(cfg)[0]!;
+
+/** The server refused the provider for a deployment setting and sent nothing. */
+export class ProviderUnavailableError extends Error {}
+
 const SLACK_API = "https://slack.com/api";
 // The engine's acceptance reactions (src/slack/reaction-shortcode.ts), by config key.
 const ACCEPTANCE_REACTIONS: ReadonlyArray<[string, string]> = [
@@ -11800,7 +11803,7 @@ export const settleMutes = async (): Promise<void> => {
   await Promise.allSettled([...pendingMutes]);
 };
 
-export type JevVerdict = {
+export type Verdict = {
   reason: string;
   confidence: number | null;
   probabilities: Record<string, number> | null;
@@ -11808,56 +11811,73 @@ export type JevVerdict = {
 };
 
 /**
- * One Jev call: classify the newest message into a reason. Throws on any failure.
- * TypeSafe and OpenRouter share the request body and the \`answers\` response shape.
+ * One decision: classify the newest message into a reason. Throws on any failure.
+ * The server makes the call (\`system-one-decide\`), so every provider returns the
+ * same \`answers\` shape. The time budget is enforced here and on the server.
  */
-export const askJev = async (
+export const askModel = async (
+  swarm: Swarm,
   input: {
     messages: string[];
     context: string[];
     sender: string;
     leadNames: readonly string[];
   },
-  transport: JevTransport,
+  target: DecisionTarget,
   cfg: Cfg,
   outer?: AbortSignal,
-): Promise<JevVerdict> => {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS));
-  const onOuterAbort = () => controller.abort();
-  outer?.addEventListener("abort", onOuterAbort);
+): Promise<Verdict> => {
+  const budgetMs = Math.min(cfg.timeoutMs, MAX_TIMEOUT_MS);
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let onOuterAbort: (() => void) | undefined;
+  const stop = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error(\`timed out after \${budgetMs}ms\`)), budgetMs);
+    onOuterAbort = () => reject(new Error("aborted"));
+    outer?.addEventListener("abort", onOuterAbort);
+  });
   const t0 = Date.now();
   try {
-    const res = await fetch(transport.endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: \`Bearer \${transport.key}\`,
+    const call = swarm.systemOne_decide({
+      provider: target.provider,
+      ...(target.model ? { model: target.model } : {}),
+      state: {
+        role: "Decide whether Lead, the coordinating AI agent of a team's agent swarm, should answer a new Slack message in a thread it takes part in. Lead is woken by every message in the thread, including ones not meant for it. Answering noise wastes everyone's time; missing a real ask is worse.",
+        lead_names: [...input.leadNames],
+        recent_thread_messages: input.context,
+        new_message: input.messages.join("\\n---\\n"),
+        new_message_sender: input.sender,
       },
-      body: JSON.stringify({
-        state: {
-          role: "Decide whether Lead, the coordinating AI agent of a team's agent swarm, should answer a new Slack message in a thread it takes part in. Lead is woken by every message in the thread, including ones not meant for it. Answering noise wastes everyone's time; missing a real ask is worse.",
-          lead_names: input.leadNames,
-          recent_thread_messages: input.context,
-          new_message: input.messages.join("\\n---\\n"),
-          new_message_sender: input.sender,
+      questions: {
+        reason: {
+          type: "choice",
+          instructions:
+            "Which label best describes new_message from Lead's point of view? Use recent_thread_messages to tell who it is talking to. Lines starting with [Agent] are swarm bots.",
+          criteria: REASONS,
         },
-        model: transport.model,
-        questions: {
-          reason: {
-            type: "choice",
-            instructions:
-              "Which label best describes new_message from Lead's point of view? Use recent_thread_messages to tell who it is talking to. Lines starting with [Agent] are swarm bots.",
-            criteria: REASONS,
-          },
-        },
-      }),
-      signal: controller.signal,
+      },
+      timeoutMs: Math.max(budgetMs, MIN_DECIDE_TIMEOUT_MS),
+      maxRetries: 0,
     });
-    if (!res.ok) throw new Error(\`\${transport.provider} \${res.status}\`);
-    const body = (await res.json()) as {
+    // After a timeout nobody awaits the call; its late failure must not go unhandled.
+    call.catch(() => {});
+    const res = (await Promise.race([call, stop])) as {
+      success?: boolean;
+      status?: number;
+      data?: unknown;
+    } | null;
+    const body = (res?.data ?? res) as {
+      success?: boolean;
+      message?: unknown;
+      error?: unknown;
+      providerUnavailable?: unknown;
       answers?: { reason?: { choice?: unknown; confidence?: unknown; probabilities?: unknown } };
     } | null;
+    if (res?.success === false || body?.success === false) {
+      const why = \`\${target.provider}: \${String(body?.message ?? body?.error ?? \`HTTP \${res?.status}\`).slice(0, 200)}\`;
+      throw body?.providerUnavailable === true
+        ? new ProviderUnavailableError(why)
+        : new Error(why);
+    }
     const answer = body?.answers?.reason;
     const reason = typeof answer?.choice === "string" ? answer.choice : "";
     if (!(reason in REASONS)) throw new Error(\`unexpected choice: \${String(reason).slice(0, 60)}\`);
@@ -11869,12 +11889,34 @@ export const askJev = async (
     return { reason, confidence, probabilities, latencyMs: Date.now() - t0 };
   } finally {
     clearTimeout(timer);
-    outer?.removeEventListener("abort", onOuterAbort);
+    if (onOuterAbort) outer?.removeEventListener("abort", onOuterAbort);
   }
 };
 
+/**
+ * \`askModel\` on each target in turn, moving on only when the server refused the
+ * provider for a deployment setting (no request was sent). Any other failure, or
+ * a refusal of the last target, throws.
+ */
+export const askFirstAvailable = async (
+  swarm: Swarm,
+  input: Parameters<typeof askModel>[1],
+  targets: readonly DecisionTarget[],
+  cfg: Cfg,
+  outer?: AbortSignal,
+): Promise<{ verdict: Verdict; target: DecisionTarget }> => {
+  for (const [i, target] of targets.entries()) {
+    try {
+      return { verdict: await askModel(swarm, input, target, cfg, outer), target };
+    } catch (err) {
+      if (!(err instanceof ProviderUnavailableError) || i === targets.length - 1) throw err;
+    }
+  }
+  throw new Error("no decision provider");
+};
+
 /** Probability that the message needs no reply: the summed mass of the skip labels. */
-export const skipProbability = (verdict: JevVerdict): number | null => {
+export const skipProbability = (verdict: Verdict): number | null => {
   if (verdict.probabilities) {
     let sum = 0;
     for (const [label, p] of Object.entries(verdict.probabilities)) {
@@ -11885,9 +11927,9 @@ export const skipProbability = (verdict: JevVerdict): number | null => {
   return verdict.confidence;
 };
 
-/** Map a Jev verdict to the typed decision. An unsure skip verdict replies. */
+/** Map a verdict to the typed decision. An unsure skip verdict replies. */
 export const decide = (
-  verdict: JevVerdict,
+  verdict: Verdict,
   minConfidence: number,
 ): { reply: boolean; reason: Reason; skipP: number | null; lowConfidence: boolean } => {
   const reason = verdict.reason as Reason;
@@ -11984,7 +12026,7 @@ const extension: SwarmExtension = (api) => {
         return;
       }
 
-      const transport = resolveTransport(cfg);
+      const targets = resolveProviders(cfg);
 
       const sender =
         opts.slackUserId && cfg.botSlackUserIds.includes(opts.slackUserId)
@@ -11993,14 +12035,15 @@ const extension: SwarmExtension = (api) => {
             ? "human (known teammate)"
             : "unknown (not a known teammate; may be a bot or an external person)";
 
-      const verdict = await askJev(
+      const { verdict, target } = await askFirstAvailable(
+        ctx.swarm,
         {
           messages,
           context: context.slice(-cfg.contextMessages).map((m) => m.slice(0, 500)),
           sender,
           leadNames: cfg.leadAliases,
         },
-        transport,
+        targets,
         cfg,
         ctx.signal,
       );
@@ -12019,7 +12062,7 @@ const extension: SwarmExtension = (api) => {
           skipP: decision.skipP,
           lowConfidence: decision.lowConfidence,
           latencyMs: verdict.latencyMs,
-          provider: transport.provider,
+          provider: target.provider,
           sender,
           preview,
         },
@@ -12059,7 +12102,7 @@ const extension: SwarmExtension = (api) => {
 export default extension;
 `
     },
-    readme: '# slack-reply-gate\n\nLead is woken by every human message in a Slack thread the swarm takes part in, including "lol", an emoji, or two people chatting with each other. This extension asks Jev, [TypeSafe](https://typesafe.ai)\'s decision model, whether Lead should answer a new thread message, and drops the wake-up when it should not.\n\nInstall config:\n\n```json\n{ "mode": "shadow" }\n```\n\nStart in `shadow`, read the decisions in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks Jev and records the verdict. Never blocks. |\n| `enforce` | Asks Jev, records the verdict, and blocks the Lead task when the answer is no. The message gets :mute: instead: no Lead task, no reply, no outcome card. |\n\n## What it gates\n\nHook: `pre.task.create`, for tasks with origin `slack` whose description carries the thread buffer\'s header `[Thread follow-up — N message(s) buffered]`. Those are the non-mention thread replies that `src/slack/thread-buffer.ts` batches into a Lead task. A direct @mention of the bot creates a task without that header and is never gated.\n\nThe header counts only at the start of the description or right after the closing `</thread_context>`. Thread context quotes old messages verbatim, and an older Lead reply can quote the header itself, so a header inside the context is ignored. Only the text after the real header is treated as new.\n\n## Decision\n\n1. A follow-up with downloaded files (status `draft`) passes without a Jev call.\n2. **@mention pass-through.** A new message that @mentions Lead passes without a Jev call. A mention is the bot mention the engine rewrites to `<@U…> (that\'s you)`, a resolved `<@U…|lead>`, or a literal `@lead` (any name in `leadAliases`). Only the new messages are scanned, never the thread context, so an old mention earlier in the thread does not pass later banter.\n3. Otherwise one Jev call (one `choice` question, see [Jev transport](#jev-transport)) with the new message(s), the sender kind, and the last `contextMessages` thread messages. Labels: `direct_ask`, `followup_to_lead`, `instruction_to_lead`, `reaction_only`, `banter_between_others`, `not_addressed_to_lead`, `other`.\n4. The answer is no only when the top label is `reaction_only`, `banter_between_others`, or `not_addressed_to_lead`, and the summed probability of those three labels is at least `minConfidence`. A split between two skip labels is still a skip. An unsure verdict replies.\n\nSeveral buffered messages are judged together. One mention in any of them passes the batch.\n\n## Jev transport\n\nJev is reachable two ways. Both take the same request and return the same answer, so the decision is identical whichever one runs.\n\n| `provider` | Endpoint | Key | Model |\n|---|---|---|---|\n| `typesafe` | `POST https://api.typesafe.ai/v1/systemone` | `TYPESAFE_API_KEY` (or `apiKey`) | `model`, default `jev-latest` |\n| `openrouter` | `POST https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `openrouterModel`, default `typesafe/jev-1.13` |\n| `auto` (default) | TypeSafe when its key is set, else OpenRouter | | |\n\nUnder `auto`, `TYPESAFE_API_KEY` wins when both keys are set. With neither key, every message fails open and the KV row names both secrets. Each decision row records the `provider` that answered.\n\n## Fail open\n\nEvery error lets the task through: a missing key, a TypeSafe HTTP error, a network error, a timeout, a malformed answer, or an unknown label. The handler never throws, so an outage cannot auto-disable the extension. Each failure is recorded as `fail-open` in KV and logged as a warning.\n\n## :mute: on drop (enforce)\n\nNo swarm tool or extension `ctx` method adds a Slack reaction, so the hook calls the Slack Web API with the bot token. It needs the `reactions:write` scope, which the Slack app already uses for its acceptance reactions.\n\n1. `reactions.remove` for each acceptance reaction the engine may have put on the triggering message: `eyes`, `heavy_plus_sign`, `zap`, `speech_balloon`, or their `SLACK_REACTION_ACCEPTED`, `SLACK_REACTION_BUFFERED`, `SLACK_REACTION_NOW`, and `SLACK_REACTION_STEERED` overrides. Slack only removes the bot\'s own reaction, so a human\'s :eyes: stays.\n2. `reactions.add` with `muteReaction` (default `mute`). `already_reacted` counts as success. Skipped when `muteReaction` is `""`.\n\nThe block returns first and the Slack calls run after it. A slow or failing Slack call never delays the drop or turns it back into a task. Set `muteReaction` to `""` for a true no-op: step 1 still clears the bot\'s acceptance reaction(s), and nothing is added.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `timeoutMs` | `3000` | Jev call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `provider` | `auto` | `auto`, `typesafe`, or `openrouter`. See [Jev transport](#jev-transport) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `minConfidence` | `0.55` | Minimum summed skip probability to skip |\n| `contextMessages` | `6` | Thread messages sent to Jev, 0 to 20 |\n| `leadAliases` | `["lead"]` | A literal `@alias` in a new message counts as a mention |\n| `botSlackUserIds` | `[]` | Slack user ids labelled `bot` as the sender for Jev |\n| `apiKey` | unset | Explicit TypeSafe key. Prefer the `TYPESAFE_API_KEY` secret below |\n| `muteReaction` | `mute` | Reaction for a dropped message; `""` only removes the acceptance reaction(s) |\n| `slackTimeoutMs` | `5000` | Timeout per Slack call |\n\n## Required secrets\n\nAll are read from the API process environment at call time. Set them as global `swarm_config` secrets: the API process loads global rows into `process.env` at boot and on config reload.\n\n- `TYPESAFE_API_KEY` or `OPENROUTER_API_KEY`: one is required for any evaluation. Under `auto`, TypeSafe wins when both are set. Without either, every message fails open.\n- `SLACK_BOT_TOKEN`: the Slack app\'s bot token. A swarm with Slack connected already has it. Without it, `enforce` still drops the message but cannot touch its reactions, and logs a `mute-error`.\n\nNo key is written to config, KV, logs, or a description.\n\n## KV namespace `ext:slack-reply-gate`\n\n- `d:<epochMs>:<channel>_<threadTs>`: one row per decision, with `action` (`pass`, `shadow-skip`, `skipped`, `fail-open`), `provider`, `reason`, `confidence`, `skipP`, `latencyMs`, `sender`, and a 300-character `preview`.\n- `m:<epochMs>:<channel>_<threadTs>`: one row per mute attempt, with `action` (`muted`, `unreacted` when `muteReaction` is `""`, `mute-error`), `removed`, `added`, and `errors`.\n- `last`: the latest decision. Mute rows never overwrite it.\n- Counters: `total`, `mention`, `files`, `reply`, `shadow-skip`, `skipped`, `error`, `muted`, `unreacted`, `mute-error`, and `reason:<label>`.\n\n## Known limits\n\n- When Lead already has an active task in the thread, the buffer steers that task instead of creating one, so `pre.task.create` does not fire and the gate does not run.\n- A blocked flush makes the thread buffer log a `TaskCreationBlockedError`. Nothing is lost: the next follow-up\'s `<thread_context>` carries the earlier messages.\n- A flush of several messages mutes only the triggering (last) message. The others keep their acceptance reaction.\n'
+    readme: '# slack-reply-gate\n\nLead is woken by every human message in a Slack thread the swarm takes part in, including "lol", an emoji, or two people chatting with each other. This extension asks a SystemOne decision model, Jev ([TypeSafe](https://typesafe.ai)) or Clef (Cloudflare Workers AI), whether Lead should answer a new thread message, and drops the wake-up when it should not.\n\nInstall config:\n\n```json\n{ "mode": "shadow" }\n```\n\nStart in `shadow`, read the decisions in KV for a few days, then switch to `enforce`.\n\n## Modes\n\n| `mode` | Effect |\n|---|---|\n| `off` | Never evaluates. |\n| `shadow` (default) | Asks the model and records the verdict. Never blocks. |\n| `enforce` | Asks the model, records the verdict, and blocks the Lead task when the answer is no. The message gets :mute: instead: no Lead task, no reply, no outcome card. |\n\n## What it gates\n\nHook: `pre.task.create`, for tasks with origin `slack` whose description carries the thread buffer\'s header `[Thread follow-up — N message(s) buffered]`. Those are the non-mention thread replies that `src/slack/thread-buffer.ts` batches into a Lead task. A direct @mention of the bot creates a task without that header and is never gated.\n\nThe header counts only at the start of the description or right after the closing `</thread_context>`. Thread context quotes old messages verbatim, and an older Lead reply can quote the header itself, so a header inside the context is ignored. Only the text after the real header is treated as new.\n\n## Decision\n\n1. A follow-up with downloaded files (status `draft`) passes without a decision call.\n2. **@mention pass-through.** A new message that @mentions Lead passes without a decision call. A mention is the bot mention the engine rewrites to `<@U…> (that\'s you)`, a resolved `<@U…|lead>`, or a literal `@lead` (any name in `leadAliases`). Only the new messages are scanned, never the thread context, so an old mention earlier in the thread does not pass later banter.\n3. Otherwise one decision call (one `choice` question, see [Provider](#provider)) with the new message(s), the sender kind, and the last `contextMessages` thread messages. Labels: `direct_ask`, `followup_to_lead`, `instruction_to_lead`, `reaction_only`, `banter_between_others`, `not_addressed_to_lead`, `other`.\n4. The answer is no only when the top label is `reaction_only`, `banter_between_others`, or `not_addressed_to_lead`, and the summed probability of those three labels is at least `minConfidence`. A split between two skip labels is still a skip. An unsure verdict replies.\n\nSeveral buffered messages are judged together. One mention in any of them passes the batch.\n\n## Provider\n\nThe decision is made on the API server by the `system-one-decide` tool (`ctx.swarm.systemOne_decide`), the same path a `system-one-decision` workflow node takes. The server reads the provider\'s credential, sends the request, and validates the answer, so every SystemOne host works and no key enters the hook.\n\n| `provider` | Model | Credential |\n|---|---|---|\n| `typesafe` | Jev, `model` (default `jev-latest`) | `TYPESAFE_API_KEY` |\n| `openrouter` | Jev, `openrouterModel` (default `typesafe/jev-1.13`) | `OPENROUTER_API_KEY` |\n| `cloudflare` | Clef, `cloudflareModel` (default `clef`, or `clef-flash`) | `CLOUDFLARE_API_TOKEN` (or `CLOUDFLARE_API_KEY`) and `CLOUDFLARE_ACCOUNT_ID` |\n| `laya`, `openai` | The host\'s default model | See the workflows guide |\n| `auto` (default) | The first of typesafe, openrouter, cloudflare whose credential is set. A provider the server refuses for a deployment setting (openrouter when `OPENROUTER_BASE_URL` points at a gateway) is skipped for the next one | |\n\nWith no credential for `auto`, every message fails open and the KV row names the secrets. Each decision row records the `provider` that answered. `minConfidence` was tuned on Jev; check Clef\'s verdicts in `shadow` before you enforce on it.\n\n## Fail open\n\nEvery error lets the task through: a missing key, a provider error relayed by the server, a network error, a timeout, a malformed answer, or an unknown label. The handler never throws, so an outage cannot auto-disable the extension. Each failure is recorded as `fail-open` in KV and logged as a warning.\n\n## :mute: on drop (enforce)\n\nNo swarm tool or extension `ctx` method adds a Slack reaction, so the hook calls the Slack Web API with the bot token. It needs the `reactions:write` scope, which the Slack app already uses for its acceptance reactions.\n\n1. `reactions.remove` for each acceptance reaction the engine may have put on the triggering message: `eyes`, `heavy_plus_sign`, `zap`, `speech_balloon`, or their `SLACK_REACTION_ACCEPTED`, `SLACK_REACTION_BUFFERED`, `SLACK_REACTION_NOW`, and `SLACK_REACTION_STEERED` overrides. Slack only removes the bot\'s own reaction, so a human\'s :eyes: stays.\n2. `reactions.add` with `muteReaction` (default `mute`). `already_reacted` counts as success. Skipped when `muteReaction` is `""`.\n\nThe block returns first and the Slack calls run after it. A slow or failing Slack call never delays the drop or turns it back into a task. Set `muteReaction` to `""` for a true no-op: step 1 still clears the bot\'s acceptance reaction(s), and nothing is added.\n\n## Config\n\n| Key | Default | Notes |\n|---|---|---|\n| `mode` | `shadow` | `off`, `shadow`, or `enforce` |\n| `timeoutMs` | `3000` | Decision call timeout, capped at 4000 (the dispatcher cancels a handler at 5 s) |\n| `provider` | `auto` | `auto`, `typesafe`, `openrouter`, `cloudflare`, `laya`, or `openai`. See [Provider](#provider) |\n| `model` | `jev-latest` | Jev model on TypeSafe |\n| `openrouterModel` | `typesafe/jev-1.13` | Jev model on OpenRouter |\n| `cloudflareModel` | `clef` | Clef model on Cloudflare Workers AI |\n| `minConfidence` | `0.55` | Minimum summed skip probability to skip |\n| `contextMessages` | `6` | Thread messages sent to the model, 0 to 20 |\n| `leadAliases` | `["lead"]` | A literal `@alias` in a new message counts as a mention |\n| `botSlackUserIds` | `[]` | Slack user ids labelled `bot` as the sender for the model |\n| `muteReaction` | `mute` | Reaction for a dropped message; `""` only removes the acceptance reaction(s) |\n| `slackTimeoutMs` | `5000` | Timeout per Slack call |\n\n## Required secrets\n\nSet them as global `swarm_config` values. The server reads the provider credential from the global row when it makes the decision. `auto` and the Slack token read the API process environment, which loads global rows at boot and on config reload.\n\n- One provider credential from the [Provider](#provider) table is required for any evaluation. Without one, every message fails open. The `apiKey` config field of earlier versions is gone: the hook never holds a key, so store it as the global `TYPESAFE_API_KEY` secret.\n- `SLACK_BOT_TOKEN`: the Slack app\'s bot token. A swarm with Slack connected already has it. Without it, `enforce` still drops the message but cannot touch its reactions, and logs a `mute-error`.\n\nNo key is written to config, KV, logs, or a description.\n\n## KV namespace `ext:slack-reply-gate`\n\n- `d:<epochMs>:<channel>_<threadTs>`: one row per decision, with `action` (`pass`, `shadow-skip`, `skipped`, `fail-open`), `provider`, `reason`, `confidence`, `skipP`, `latencyMs`, `sender`, and a 300-character `preview`.\n- `m:<epochMs>:<channel>_<threadTs>`: one row per mute attempt, with `action` (`muted`, `unreacted` when `muteReaction` is `""`, `mute-error`), `removed`, `added`, and `errors`.\n- `last`: the latest decision. Mute rows never overwrite it.\n- Counters: `total`, `mention`, `files`, `reply`, `shadow-skip`, `skipped`, `error`, `muted`, `unreacted`, `mute-error`, and `reason:<label>`.\n\n## Known limits\n\n- When Lead already has an active task in the thread, the buffer steers that task instead of creating one, so `pre.task.create` does not fire and the gate does not run.\n- A blocked flush makes the thread buffer log a `TaskCreationBlockedError`. Nothing is lost: the next follow-up\'s `<thread_context>` carries the earlier messages.\n- A flush of several messages mutes only the triggering (last) message. The others keep their acceptance reaction.\n'
   },
   "task-digest": {
     manifestFile: "manifest.yaml",
@@ -13245,6 +13288,17 @@ async function handleFleetBenchmark(req, res, pathSegments, queryParams) {
 // src/http/fs.ts
 init_zod();
 init_db3();
+
+// src/be/db/tasks/draft-text.ts
+init_runtime();
+async function appendDraftTaskText(taskId, block) {
+  const result = await getDbClient2().run("UPDATE agent_tasks SET task = task || ?, lastUpdatedAt = ? WHERE id = ? AND status = 'draft'", [`
+
+${block}`, new Date().toISOString(), taskId]);
+  return result.changes > 0;
+}
+
+// src/http/fs.ts
 init_rbac();
 init_types();
 
@@ -13368,7 +13422,7 @@ var uploadTaskFileRoute = route({
   pattern: ["api", "fs", "tasks", null, "files"],
   session: { taskParam: "taskId" },
   summary: "Upload a binary task file attachment",
-  description: "Accepts a raw binary request body. Pass the display/path name as the `name` query parameter.",
+  description: "Accepts a raw binary request body. Pass the display/path name as the `name` query parameter. An `audio/*` file uploaded to a `draft` task gets a `[File: …]` line and its transcript (or why there is none) appended to the task text before the response; a failed transcription never fails the upload.",
   tags: ["FS"],
   params: taskParams,
   query: uploadQuery,
@@ -13529,7 +13583,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
       return notFound(res, "Task not found");
     if (!await canMutateTask(task, myAgentId, req))
       return forbidden(res);
-    return sendUpload(req, res, parsed.params.taskId, parsed.query, myAgentId ?? null);
+    return sendUpload(req, res, parsed.params.taskId, parsed.query, myAgentId ?? null, task.status === "draft");
   }
   if (listTaskFilesRoute.match(req.method, pathSegments)) {
     const parsed = await listTaskFilesRoute.parse(req, res, pathSegments, queryParams);
@@ -13556,7 +13610,7 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
   }
   return false;
 }
-async function sendUpload(req, res, taskId, query, agentId) {
+async function sendUpload(req, res, taskId, query, agentId, isDraft) {
   const body = await readRawBody(req, MAX_TASK_ATTACHMENT_BYTES);
   if (body === BODY_TOO_LARGE) {
     jsonError(res, `Payload too large (max ${MAX_TASK_ATTACHMENT_BYTES} bytes)`, 413);
@@ -13597,9 +13651,27 @@ async function sendUpload(req, res, taskId, query, agentId) {
     isPrimary: query.isPrimary === "true",
     createdBy: auth?.kind === "user" ? auth.userId : undefined
   });
+  const mimeType = contentType.split(";")[0].trim().toLowerCase();
+  if (isDraft && mimeType.startsWith("audio/")) {
+    await appendAudioTranscript(taskId, query.name, mimeType, body);
+  }
   uploadTaskFileRoute.respond(res, 201, attachment);
   return true;
 }
+async function appendAudioTranscript(taskId, name, mimeType, body) {
+  try {
+    const notes = await transcribeAudioNotes([{ key: name, name, data: new Blob([body], { type: mimeType }), mimeType }], "[fs]");
+    const note = notes.get(name);
+    if (!note)
+      return;
+    if (!await appendDraftTaskText(taskId, `[File: ${name} (${mimeType})]
+${note}`)) {
+      console.warn(`[fs] task ${taskId} left draft before the transcript of ${name} was added`);
+    }
+  } catch (error) {
+    console.warn(scrubSecrets(`[fs] could not add the transcript of ${name} to task ${taskId}: ${error instanceof Error ? error.message : String(error)}`));
+  }
+}
 async function sendDownload(res, attachment) {
   const provider = getFileStorageProvider2();
   if (backingProviderId(attachment) !== provider.id) {
@@ -13659,23 +13731,6 @@ async function sendDelete(res, attachment) {
   res.end();
   return true;
 }
-function scopeFromAttachment(attachment) {
-  const storedKey = attachment.providerKey ?? attachment.path ?? "";
-  return {
-    taskId: attachment.taskId,
-    name: attachment.name,
-    key: storedKey.trim() ? storedKey : undefined,
-    orgId: attachment.orgId,
-    driveId: attachment.driveId
-  };
-}
-function backingProviderId(attachment) {
-  if (attachment.kind === "agent-fs")
-    return attachment.providerId ?? "agent-fs";
-  if (attachment.providerId === "local-fs")
-    return "local-fs";
-  return null;
-}
 async function findAttachment(req, myAgentId, taskId, attachmentId, res) {
   if (!await getTaskById2(taskId)) {
     notFound(res, "Task not found");
@@ -16433,6 +16488,29 @@ init_db3();
 init_env_flag();
 init_request_auth_context();
 init_task_tool_manifest();
+
+// src/http/mcp-body.ts
+var MCP_BODY_TOO_LARGE = Symbol("mcp-body-too-large");
+async function readMcpBody(req, res) {
+  try {
+    return await parseBody(req, MCP_MAX_REQUEST_BODY_BYTES);
+  } catch (error) {
+    if (!(error instanceof RequestBodyTooLargeError))
+      throw error;
+    res.writeHead(413, { "Content-Type": "application/json", Connection: "close" });
+    res.end(JSON.stringify({
+      jsonrpc: "2.0",
+      error: {
+        code: -32000,
+        message: `Payload Too Large: Request body must not exceed ${MCP_MAX_REQUEST_BODY_BYTES} bytes`
+      },
+      id: null
+    }));
+    return MCP_BODY_TOO_LARGE;
+  }
+}
+
+// src/http/mcp.ts
 var DEFAULT_MCP_TRANSPORT_IDLE_TIMEOUT_MS = 2 * 60 * 60 * 1000;
 function respondNoMcpSession(res, sessionId) {
   const notFound = Boolean(sessionId);
@@ -16532,17 +16610,16 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
   if (agentMismatch)
     return true;
   if (req.method === "POST") {
-    const chunks = [];
-    for await (const chunk of req) {
-      chunks.push(chunk);
-    }
-    const body = JSON.parse(Buffer.concat(chunks).toString());
-    if (!sessionId && body.method === "server/discover") {
+    const body = await readMcpBody(req, res);
+    if (body === MCP_BODY_TOO_LARGE)
+      return true;
+    const rpc = body;
+    if (!sessionId && rpc?.method === "server/discover") {
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({
         jsonrpc: "2.0",
         error: { code: -32601, message: "Method not found" },
-        id: body.id ?? null
+        id: rpc.id ?? null
       }));
       return true;
     }
@@ -17879,7 +17956,8 @@ function createUserServer(user) {
   }, {
     capabilities: {
       logging: {}
-    }
+    },
+    maxToolInputElements: MCP_MAX_TOOL_INPUT_ELEMENTS
   });
   const registerTool = createToolRegistrar(server);
   const sendTaskConfig = {
@@ -17997,11 +18075,9 @@ async function handleMcpUser(req, res, transports, sessionUsers, sessionActivity
     return unauthorized2(res);
   }
   if (req.method === "POST") {
-    const chunks = [];
-    for await (const chunk of req) {
-      chunks.push(chunk);
-    }
-    const body = JSON.parse(Buffer.concat(chunks).toString());
+    const body = await readMcpBody(req, res);
+    if (body === MCP_BODY_TOO_LARGE)
+      return true;
     let transport;
     if (sessionId && transports[sessionId]) {
       transport = transports[sessionId];
@@ -18143,6 +18219,9 @@ async function hasRetrievalForTask(taskId, memoryId) {
   return row != null;
 }
 
+// src/http/memory.ts
+init_search_candidates();
+
 // src/be/memory/usefulness-stats.ts
 init_db3();
 async function getUsefulnessStats(options = {}) {
@@ -18983,7 +19062,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
       const store = getMemoryStore2();
       const queryEmbedding = await provider.embed(query);
       const candidateLimit = Math.min(limit, 20) * CANDIDATE_SET_MULTIPLIER;
-      const candidates = await store.search(queryEmbedding ?? new Float32Array(0), myAgentId, {
+      const candidates = await searchMemoryCandidates(store, queryEmbedding ?? new Float32Array(0), myAgentId, {
         scope,
         limit: candidateLimit,
         source,
@@ -19064,7 +19143,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
         const provider = getEmbeddingProvider2();
         const queryEmbedding = await provider.embed(query.trim());
         const candidateLimit = Math.min(4096, Math.max(offset + pageLimit, pageLimit) * CANDIDATE_SET_MULTIPLIER);
-        let candidates = await store.search(queryEmbedding ?? new Float32Array(0), viewer.agentId, {
+        let candidates = await searchMemoryCandidates(store, queryEmbedding ?? new Float32Array(0), viewer.agentId, {
           scope,
           limit: candidateLimit,
           isLead: viewer.seesAll,
@@ -21999,6 +22078,35 @@ route({
   auth: { apiKey: false }
 });
 var PROXY_PREFIX = "/@swarm/api/";
+var PAGE_ID_REQUEST_HEADER = "x-swarm-page-id";
+var PAGE_PATH_RE = /^\/p\/([^/.]+)/;
+function requestedPageId(req) {
+  const raw = req.headers[PAGE_ID_REQUEST_HEADER];
+  const fromHeader = Array.isArray(raw) ? raw[0] : raw;
+  if (fromHeader !== undefined)
+    return isCookieSafePageId(fromHeader) ? fromHeader : null;
+  const referer = req.headers.referer;
+  if (!referer)
+    return;
+  let refererUrl;
+  try {
+    refererUrl = new URL(referer);
+  } catch {
+    return;
+  }
+  if (refererUrl.host !== req.headers.host)
+    return;
+  const match = PAGE_PATH_RE.exec(refererUrl.pathname);
+  if (!match)
+    return;
+  let fromReferer;
+  try {
+    fromReferer = decodeURIComponent(match[1]);
+  } catch {
+    return;
+  }
+  return isCookieSafePageId(fromReferer) ? fromReferer : undefined;
+}
 function isSafeProxySuffix(suffix) {
   if (suffix.length === 0)
     return true;
@@ -22037,11 +22145,13 @@ async function handlePageProxy(req, res) {
     jsonError(res, "not found", 404);
     return true;
   }
-  const payload = await extractAndVerifyCookie(req);
-  if (!payload) {
+  const claimedPageId = requestedPageId(req);
+  const session = claimedPageId === undefined ? await extractLegacyPageSession(req) : claimedPageId === null ? null : await extractPageSession(req, claimedPageId);
+  if (!session) {
     jsonError(res, "no page session", 401);
     return true;
   }
+  const { payload } = session;
   const page = await getPage2(payload.pageId);
   if (!page) {
     jsonError(res, "page session no longer valid", 401);
@@ -22059,7 +22169,7 @@ async function handlePageProxy(req, res) {
   const headers = {
     Authorization: `Bearer ${apiKey}`,
     "X-Page-Id": page.id,
-    "X-Page-Session": parseCookieHeader(req.headers.cookie, "page_session") ?? ""
+    "X-Page-Session": session.token
   };
   const reqContentType = req.headers["content-type"];
   if (reqContentType) {
@@ -22736,10 +22846,6 @@ var updateTaskTitleRoute = route({
     ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only"
   }
 });
-async function hasSessionWrite(req, myAgentId, taskId) {
-  const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
-  return hasSessionAccess(access, "write");
-}
 async function canSteerTask(req, myAgentId, task, sessionAccess = "none") {
   const auth = getRequestAuth(req);
   const resource = {
@@ -22919,23 +23025,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     }
     const parentTask = parsed.body.parentTaskId ? await getTaskById2(parsed.body.parentTaskId) : null;
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
-    if (parentTask && !can({
-      principal,
-      verb: "task.parent.attach",
-      resource: {
-        kind: "task",
-        taskId: parentTask.id,
-        requestedByUserId: parentTask.requestedByUserId,
-        creatorAgentId: parentTask.creatorAgentId,
-        agentId: parentTask.agentId
-      },
-      source: "http"
-    }).allow) {
-      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
-      return true;
-    }
-    if (parentTask && !await hasSessionWrite(req, myAgentId, parentTask.id)) {
-      jsonError(res, SESSION_WRITE_DENIED2, 403);
+    if (parentTask && await denyParentAttach2(req, res, myAgentId, parentTask, principal)) {
       return true;
     }
     if (principal.kind === "agent" && parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" }).allow) {
@@ -24423,12 +24513,12 @@ ${defuseFeedbackTags(note)}
     }
     const auth = getRequestAuth(req);
     const identity = auth?.kind === "user" ? { uid: auth.userId, name: auth.user.name } : auth?.kind === "operator" ? { name: `guest-${randomUUID4().slice(0, 8)}`, op: true } : undefined;
-    const cookie = await issuePageSessionCookie(page.id, {
+    const cookies = await pageSessionSetCookies(req, page.id, {
       dev: isDevRequest(req),
       ...identity
     });
     applyLaunchCors(req, res);
-    res.setHeader("Set-Cookie", cookie);
+    res.setHeader("Set-Cookie", cookies);
     res.writeHead(204);
     res.end();
     return true;
@@ -24450,10 +24540,15 @@ class SwarmSDK {
     this.channel = async (name) => (await loadRealtime()).channel(name);
 
     const base = '/@swarm/api';
+    // Each page has its own session cookie. Naming the page tells the proxy
+    // which one to read; the cookie's signed payload must still match it.
+    const pathParts = typeof location === 'undefined' ? [] : location.pathname.split('/');
+    const pageId = pathParts[1] === 'p' && pathParts[2] ? pathParts[2].split('.')[0] : '';
     const call = async (method, path, body) => {
-      const init = { method };
+      const init = { method, headers: {} };
+      if (pageId) init.headers['X-Swarm-Page-Id'] = pageId;
       if (body !== undefined) {
-        init.headers = { 'Content-Type': 'application/json' };
+        init.headers['Content-Type'] = 'application/json';
         init.body = JSON.stringify(body);
       }
       const res = await fetch(base + path, init);
@@ -25638,7 +25733,7 @@ var FEEDBACK_OVERLAY_JS = `
     return fetch('/@swarm/api/pages/' + encodeURIComponent(pageId) + '/feedback', {
       method: 'POST',
       credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-Swarm-Page-Id': pageId },
       body: JSON.stringify(payload),
     }).then(function (res) {
       return res.text().then(function (text) {
@@ -26024,23 +26119,8 @@ function buildCsp() {
 function isAccessible(page, cookiePayload) {
   if (page.authMode === "public")
     return { ok: true };
-  if (cookiePayload) {
-    if (cookiePayload.pageId === page.id)
-      return { ok: true };
-    if (page.authMode === "password") {
-      return {
-        ok: false,
-        status: 401,
-        reason: "password required",
-        needsPassword: true
-      };
-    }
-    return {
-      ok: false,
-      status: 403,
-      reason: "page-session cookie scoped to a different page id"
-    };
-  }
+  if (cookiePayload?.pageId === page.id)
+    return { ok: true };
   if (page.authMode === "authed") {
     return {
       ok: false,
@@ -26115,9 +26195,9 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
     res.end(JSON.stringify({ error: "Page not found" }));
     return true;
   }
-  const cookiePayload = await extractAndVerifyCookie(req);
+  const cookiePayload = await extractAndVerifyCookie(req, page.id);
   const access = isAccessible(page, cookiePayload);
-  let inlineSetCookie = "";
+  let inlineSetCookie = [];
   if (!access.ok) {
     if (access.needsPassword) {
       const candidate = extractPasswordCandidate(req, queryParams);
@@ -26129,7 +26209,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
           matched = false;
         }
         if (matched) {
-          inlineSetCookie = await issuePageSessionCookie(page.id, {
+          inlineSetCookie = await pageSessionSetCookies(req, page.id, {
             dev: isLocalhostRequest(req)
           });
         } else {
@@ -26156,7 +26236,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
   }
   if (isJsonRoute) {
     res.setHeader("Cache-Control", "no-store");
-    if (inlineSetCookie)
+    if (inlineSetCookie.length > 0)
       res.setHeader("Set-Cookie", inlineSetCookie);
     publicPageJsonRoute.respond(res, 200, {
       id: page.id,
@@ -26177,7 +26257,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
       "X-Content-Type-Options": "nosniff",
       "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
     };
-    if (inlineSetCookie)
+    if (inlineSetCookie.length > 0)
       headers["Set-Cookie"] = inlineSetCookie;
     res.writeHead(200, headers);
     res.end(page.body);
@@ -26193,15 +26273,17 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
         "Content-Security-Policy": buildCsp(),
         "X-Content-Type-Options": "nosniff"
       };
-      if (inlineSetCookie)
+      if (inlineSetCookie.length > 0)
         headers["Set-Cookie"] = inlineSetCookie;
       res.writeHead(200, headers);
       res.end(printableJsonPageHtml(page));
       await bumpViewCount(page.id);
       return true;
     }
-    const headers = { Location: `${getAppBaseUrl2()}/pages/${page.id}` };
-    if (inlineSetCookie)
+    const headers = {
+      Location: `${getAppBaseUrl2()}/pages/${page.id}`
+    };
+    if (inlineSetCookie.length > 0)
       headers["Set-Cookie"] = inlineSetCookie;
     res.writeHead(302, headers);
     res.end();
@@ -26215,7 +26297,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
     "Content-Security-Policy": buildCsp(),
     "X-Content-Type-Options": "nosniff"
   };
-  if (inlineSetCookie)
+  if (inlineSetCookie.length > 0)
     headers["Set-Cookie"] = inlineSetCookie;
   res.writeHead(200, headers);
   res.end(html);
@@ -31182,6 +31264,7 @@ var agentTaskBodySchema = object2({
   routingNote: string2().max(200).optional(),
   tags: array2(string2()).optional(),
   priority: number2().int().min(0).max(100).optional(),
+  dependsOn: array2(uuid()).optional(),
   offerMode: boolean().optional(),
   dir: string2().min(1).optional(),
   vcsRepo: string2().min(1).optional(),
@@ -31662,6 +31745,7 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
           routingSource: parsed.body.routingReason ? "declared" : parsed.body.agentId ? "engine_default" : undefined,
           tags: parsed.body.tags,
           priority: parsed.body.priority,
+          dependsOn: parsed.body.dependsOn,
           offeredTo: parsed.body.offerMode ? parsed.body.agentId : undefined,
           taskType: "script-run-step",
           source: "mcp",
@@ -33147,6 +33231,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, myAgentId)
 // src/http/sessions.ts
 init_zod();
 init_db3();
+init_rbac_roles();
 init_steering();
 init_users();
 init_rbac();
@@ -33203,7 +33288,7 @@ var mintSessionTokenRoute = route({
     none: "user tokens cannot mint: the handler admits only the operator key or the task's own runtime"
   },
   summary: "Mint an ephemeral task or runtime token",
-  description: "Operators can mint task or runtime tokens. Runtime tokens can mint task tokens for their own assigned tasks. Child tokens expire with their parent runtime.",
+  description: "Operators can mint task or runtime tokens. Runtime and agent tokens can mint task tokens for their own assigned tasks. A child token never outlives its parent and is revoked with it.",
   tags: ["Sessions"],
   body: object2({
     agentId: string2().min(1),
@@ -33229,7 +33314,7 @@ var mintSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token minting for its own assigned task, enforced in the handler"
+    ungated: "operator, or a runtime or agent token minting for its own assigned task, enforced in the handler"
   }
 });
 var revokeSessionTokenRoute = route({
@@ -33237,7 +33322,7 @@ var revokeSessionTokenRoute = route({
   path: "/api/sessions/tokens/{tokenId}",
   pattern: ["api", "sessions", "tokens", null],
   summary: "Revoke an ephemeral session token",
-  description: "Operators can revoke any ephemeral token. With runtime pools enabled, runtime tokens can revoke their own child task tokens. Repeated revocation has no effect.",
+  description: "Operators can revoke any ephemeral token. Agent tokens, and runtime tokens when runtime pools are enabled, can revoke their own child task tokens. Repeated revocation has no effect.",
   tags: ["Sessions"],
   params: object2({ tokenId: string2() }),
   responses: {
@@ -33247,9 +33332,188 @@ var revokeSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token revoking its own child, enforced in the handler"
+    ungated: "operator, or a runtime or agent token revoking its own child, enforced in the handler"
   }
 });
+var AGENT_TOKEN_ROTATE_GRACE_SEC = 300;
+var AgentTokenSchema = object2({
+  agentId: string2(),
+  tokenId: string2(),
+  plaintext: string2(),
+  expiresAt: string2().nullable().describe("null when the token does not expire")
+});
+var agentTokenTtl = number2().int().positive().optional().describe("Token lifetime in ms. Omit for the default (no expiry).");
+var mintAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_mintWorkerToken",
+  summary: "Mint an agent-bound worker token",
+  description: "Returns the token once. A worker runs on it in place of the swarm API key and acts only as this agent. Creates the agent when it does not exist and `name` is given. Fails with 409 when the agent already holds an active token.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  body: object2({ name: string2().min(1).optional(), ttlMs: agentTokenTtl }).strict().optional(),
+  responses: {
+    200: {
+      description: "Minted worker token",
+      schema: AgentTokenSchema.extend({ agentCreated: boolean() })
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent not found and no name given" },
+    409: { description: "Agent already holds an active token" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var rotateAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token/rotate",
+  pattern: ["api", "agents", null, "token", "rotate"],
+  operationId: "agents_rotateWorkerToken",
+  summary: "Rotate an agent-bound worker token",
+  description: "Returns a new token once. The previous token keeps working for `graceSec` (default 300), then expires. Use revoke for a token that must stop now.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  body: object2({ graceSec: number2().int().min(0).max(86400).optional(), ttlMs: agentTokenTtl }).strict().optional(),
+  responses: {
+    200: {
+      description: "New worker token",
+      schema: AgentTokenSchema.extend({ previousExpiresAt: string2() })
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent holds no active token" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var revokeAgentTokenRoute = route({
+  method: "delete",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_revokeWorkerToken",
+  summary: "Revoke an agent-bound worker token",
+  description: "Revokes every active worker token of the agent and the task tokens they minted. Open realtime connections on them close.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  responses: {
+    200: {
+      description: "Number of worker tokens revoked (0 when none was active)",
+      schema: object2({ revoked: number2().int() })
+    },
+    403: { description: "Operator or user credentials required" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var AGENT_TOKEN_ROUTES = [mintAgentTokenRoute, rotateAgentTokenRoute, revokeAgentTokenRoute];
+async function ensureAgentTokenManager(req, res, agentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "operator" && auth?.kind !== "user") {
+    jsonError(res, "Worker tokens require operator or user credentials", 403);
+    return false;
+  }
+  const header = req.headers["x-agent-id"];
+  const decision = can({
+    principal: await agentFirstPrincipal(req, Array.isArray(header) ? header[0] : header),
+    verb: "agent.token.manage",
+    resource: { kind: "agent", agentId },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, decision.reason, 403);
+    return false;
+  }
+  if (auth.kind === "user" && isRbacEnabled()) {
+    const grant = await getUserGrant2(auth.userId);
+    if (!grant.grantsAll) {
+      const target = await getAgentById2(agentId);
+      const targetActsOnAny = can({
+        principal: { kind: "agent", agentId, isLead: target?.isLead ?? false },
+        verb: "agent.act.any",
+        resource: { kind: "agent", agentId },
+        source: "http"
+      }).allow;
+      if (targetActsOnAny) {
+        jsonError(res, "A lead agent's worker token requires a grant-all role", 403);
+        return false;
+      }
+      const missing = ["agent.act.any", "config.read.secrets"].filter((verb) => !grant.verbs.has(verb));
+      if (missing.length > 0) {
+        jsonError(res, `Worker tokens also require: ${missing.join(", ")}`, 403);
+        return false;
+      }
+    }
+  }
+  return true;
+}
+async function handleAgentTokens(req, res, pathSegments, queryParams) {
+  const matched = AGENT_TOKEN_ROUTES.find((def) => def.match(req.method, pathSegments));
+  if (!matched)
+    return false;
+  if (!await ensureAgentTokenManager(req, res, pathSegments[2]))
+    return true;
+  res.setHeader("Cache-Control", "no-store");
+  if (matched === mintAgentTokenRoute) {
+    const parsed = await mintAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const agentId = parsed.params.id;
+    const result = await getDbClient2().transaction(async () => {
+      let agentCreated = false;
+      if (!await getAgentById2(agentId)) {
+        if (!parsed.body?.name)
+          return { status: 404 };
+        await createAgent2({
+          id: agentId,
+          name: parsed.body.name,
+          isLead: false,
+          status: "offline",
+          capabilities: [],
+          maxTasks: 1
+        });
+        agentCreated = true;
+      }
+      return {
+        status: 200,
+        agentCreated,
+        token: await mintAgentToken(agentId, parsed.body?.ttlMs)
+      };
+    }).catch((error) => {
+      if (error instanceof AgentTokenExistsError)
+        return { status: 409 };
+      throw error;
+    });
+    if (result.status === 404) {
+      jsonError(res, "Agent not found; pass name to create it", 404);
+      return true;
+    }
+    if (result.status === 409) {
+      jsonError(res, "Agent already holds an active worker token; rotate or revoke it", 409);
+      return true;
+    }
+    mintAgentTokenRoute.respond(res, 200, {
+      agentId,
+      ...result.token,
+      agentCreated: result.agentCreated
+    });
+    return true;
+  }
+  if (matched === rotateAgentTokenRoute) {
+    const parsed = await rotateAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const graceSec = parsed.body?.graceSec ?? AGENT_TOKEN_ROTATE_GRACE_SEC;
+    const token = await rotateAgentToken(parsed.params.id, graceSec * 1000, parsed.body?.ttlMs);
+    if (!token) {
+      jsonError(res, "Agent holds no active worker token", 404);
+      return true;
+    }
+    rotateAgentTokenRoute.respond(res, 200, { agentId: parsed.params.id, ...token });
+    return true;
+  }
+  const parsed = await revokeAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed)
+    return true;
+  revokeAgentTokenRoute.respond(res, 200, { revoked: await revokeAgentTokens(parsed.params.id) });
+  return true;
+}
 var listSessions = route({
   method: "get",
   path: "/api/sessions",
@@ -33347,9 +33611,11 @@ async function accessForRoot(actor, root) {
   return actor.kind === "bypass" ? "owner" : sessionAccessForRoot(actor.userId, root);
 }
 async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
+  if (await handleAgentTokens(req, res, pathSegments, queryParams))
+    return true;
   if (mintSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
-    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.runtimeId)) {
+    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.tokenKind !== "task")) {
       jsonError(res, "Unauthorized", 401);
       return true;
     }
@@ -33394,7 +33660,7 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
   }
   if (revokeSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
-    if (auth?.kind !== "operator" && !(isRuntimePoolsEnabled() && auth?.kind === "agent" && auth.runtimeId)) {
+    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && (auth.tokenKind === "agent" || auth.tokenKind === "runtime" && isRuntimePoolsEnabled()))) {
       jsonError(res, "Unauthorized", 401);
       return true;
     }
@@ -33403,7 +33669,8 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     const revoked = await getDbClient2().transaction(async (client) => {
       if (auth.kind === "agent") {
-        const child = await client.get("SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND parentRuntimeId = ? AND taskId IS NOT NULL", [parsed.params.tokenId, auth.agentId, auth.runtimeId]);
+        const child = await client.get(`SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND taskId IS NOT NULL
+           AND ${auth.runtimeId ? "parentRuntimeId" : "parentTokenId"} = ?`, [parsed.params.tokenId, auth.agentId, auth.runtimeId ?? auth.tokenId]);
         if (!child)
           return false;
       }
@@ -36431,7 +36698,17 @@ var deleteIdentityRoute = route({
   },
   auth: { apiKey: true }
 });
-var UNMAPPED_KINDS = ["slack", "github", "gitlab", "azure-devops", "linear", "kapso"];
+var UNMAPPED_KINDS = [
+  "slack",
+  "github",
+  "gitlab",
+  "azure-devops",
+  "linear",
+  "kapso",
+  "telegram",
+  "discord",
+  "teams"
+];
 async function collectUnmappedForKind(kind, limit) {
   const namespace = `integration:unmapped:${kind}`;
   const rows = await listKv2(namespace, { limit: Math.min(limit * 2, 1000), offset: 0 });
@@ -39126,7 +39403,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-5rgq2hfk.js");
+var { attachControllerTransport } = await import("./controllers-connect-9ftpex99.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -39155,7 +39432,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-wbbs14c5.js");
+    const { stopScheduler } = await import("./index-bgdyvcnv.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -39167,7 +39444,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-y5t1my7m.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-7yrng7px.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -39247,21 +39524,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-37sp626b.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-j2273s54.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-ygd362ep.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-d2b5my0y.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-37sp626b.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-j2273s54.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-37sp626b.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-j2273s54.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -39269,7 +39546,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-220tk9bw.js");
+  const { runAllSeeders } = await import("./index-jwxkkex2.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -39331,39 +39608,39 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-wbbs14c5.js");
-    const { getExecutorRegistry } = await import("./index-m0a4ydqj.js");
+    const { startScheduler } = await import("./index-bgdyvcnv.js");
+    const { getExecutorRegistry } = await import("./index-gabbcdn2.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-d0g18bax.js");
+    const { startHeartbeat } = await import("./index-tfb26zhy.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-y5t1my7m.js");
+    const { startOAuthKeepalive } = await import("./keepalive-7yrng7px.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-909jmn12.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-yw3xdbcj.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-y3m0ydzj.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-b9c3az3c.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-gvxjs2py.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-qdkvxeem.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-1j9mk05f.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-m3wh8eks.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {