@desplega.ai/agent-swarm 2.4.3 → 2.4.5

package/dist/{cli-kgnkyabk.js → cli-n72rg53p.js}

@@ -155,6 +155,8 @@ import {
   computeScore,
   rerank,
   init_reranker,
+  searchMemoryCandidates,
+  init_search_candidates,
   rowToCandidate,
   init_sqlite_store,
   getEmbeddingProvider2,
@@ -332,19 +334,19 @@ import {
   recordInlineScriptRun2,
   exports_db,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-wt0jf9hm.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-qp2m4btv.js";
+} from "./cli-kpw04va0.js";
 import {
   ensurePricingSeeded2,
   ensureRbacSeeded2,
   ensureModelProfilesSeeded2
-} from "./cli-1n9gdg56.js";
+} from "./cli-43x64hv3.js";
 import {
   loadModelsDevCache
-} from "./cli-vq9gqarq.js";
+} from "./cli-dk44dxec.js";
 import {
   buildCatalogEntries,
   listModelCatalog,
@@ -354,12 +356,12 @@ import {
   loadModelsCatalog,
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-npfe9t1s.js";
+} from "./cli-bnes4z6b.js";
 import {
   ampPinProviderError,
   ampPinCatalogError,
   ampModelError
-} from "./cli-1eszr343.js";
+} from "./cli-qfxc84gh.js";
 import {
   notifyAutomationPreflightFailure,
   isNeedsSetupFailure,
@@ -411,7 +413,7 @@ import {
   buildNodeInterpolationCtx,
   interpolateNodeConfig,
   scriptBodyInterpolationError
-} from "./cli-0dxxwfkt.js";
+} from "./cli-9hstj09h.js";
 import {
   require_dist2,
   publicEndpointSsrfOptions,
@@ -471,14 +473,14 @@ import {
   deleteApp,
   typecheckScript,
   parseSkillContent
-} from "./cli-73ezfhha.js";
+} from "./cli-st8aw1m6.js";
 import {
   buildAuthorizationUrl,
   onAuthorizationRefreshed,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow
-} from "./cli-pygdsgh8.js";
+} from "./cli-a92r1127.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -508,14 +510,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-tkf4x6ha.js";
+} from "./cli-37j04k05.js";
 import {
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin,
   externalChannelToolError2,
   getChannelBlockReason2
-} from "./cli-v87dr6e3.js";
+} from "./cli-3a45zcgm.js";
 import {
   BaseExecutor,
   postApprovalCancellationUpdates,
@@ -523,6 +525,7 @@ import {
   HumanInTheLoopExecutor,
   resolveWorkflowLlmConfig,
   SYSTEM_ONE_PROVIDER_IDS,
+  SystemOneExtractionExecutor,
   SYSTEM_ONE_DECISION_NODE_TYPE,
   SystemOneDecisionConfigSchema,
   SystemOneDecisionExecutor,
@@ -532,7 +535,7 @@ import {
   definitionNodeIds,
   validateDefinition,
   applyDefinitionPatch
-} from "./cli-s9rr4gr2.js";
+} from "./cli-xpa64rek.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -554,26 +557,30 @@ import {
   SESSION_READ_DENIED2,
   canReadSession2,
   readableByFor2,
+  denyParentAttach2,
   pathSessionDenial2,
   userAgentIdentityDenial2,
   runtimeInstanceHeader,
+  bodyTask,
   routeRegistry,
   isPublicRoute,
   findRoute,
   route
-} from "./cli-6eyncg0y.js";
+} from "./cli-018r4jq6.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-e8xyjvfc.js";
 import {
+  FilesError,
   providerPath,
+  normalizeStoredKey,
   AgentFsProvider,
   getFileStorageProvider2
-} from "./cli-qje9k2nh.js";
+} from "./cli-g9ypd5en.js";
 import {
   getRuntimePool2,
   init_db
-} from "./cli-gx0j2khs.js";
+} from "./cli-j99azg3g.js";
 import {
   getMemoryRaterNames,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -614,7 +621,7 @@ import {
   resolveSessionToken,
   fingerprintApiKey,
   init_users
-} from "./cli-sds5zzs8.js";
+} from "./cli-1f3qzw6y.js";
 import {
   isRbacEnabled,
   decideAdmission,
@@ -623,7 +630,7 @@ import {
   init_elevated_agents,
   can,
   init_rbac
-} from "./cli-8vverzf7.js";
+} from "./cli-ba8ne1es.js";
 import {
   normalizeAssetKey,
   parseAssetKey,
@@ -683,7 +690,7 @@ import {
   KvNamespaceSchema,
   KvKeySchema,
   init_types
-} from "./cli-836ehxmt.js";
+} from "./cli-eww120g8.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -754,7 +761,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1xsraagq.js";
+} from "./cli-94gwyg7m.js";
 import {
   realtimeBus,
   init_bus
@@ -783,6 +790,7 @@ import {
 import {
   scrubSecrets,
   scrubObject,
+  createValueScrubber,
   refreshSecretScrubberCache,
   registerVolatileSecret,
   registerSensitiveKeyName,
@@ -16806,6 +16814,9 @@ class Protocol {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -16836,12 +16847,12 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -16878,7 +16889,7 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -17001,6 +17012,19 @@ class Protocol {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== undefined) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === undefined) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -17010,7 +17034,10 @@ class Protocol {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error) => this._onerror(new Error(`Failed to send an error response: ${error}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -17061,7 +17088,10 @@ class Protocol {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -17096,7 +17126,7 @@ class Protocol {
           ...error["data"] !== undefined && { data: error["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -17484,7 +17514,7 @@ class Protocol {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   async _clearTaskQueue(taskId, sessionId) {
     if (this._taskMessageQueue) {
@@ -17503,10 +17533,10 @@ class Protocol {
       }
     }
   }
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1000;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -18175,6 +18205,42 @@ class ExperimentalMcpServerTasks {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 init_zod();
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === undefined || value === Infinity)
+    return;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 
 class McpServer {
   constructor(serverInfo, options) {
@@ -18187,6 +18253,7 @@ class McpServer {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   get experimental() {
     if (!this._experimental) {
@@ -18293,12 +18360,15 @@ class McpServer {
     };
   }
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== undefined && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error);
@@ -18523,7 +18593,7 @@ class McpServer {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error);
@@ -21146,7 +21216,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-6sv8mhzm.js");
+        const { getSlackApp } = await import("./app-353vre8g.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -21272,7 +21342,7 @@ var RawLlmOutputSchema = object2({
 async function executeRawLlm(config) {
   let modelName = config.model ?? "google/gemini-3-flash-preview";
   try {
-    const { createOpenAI } = await import("./index-va3y63es.js");
+    const { createOpenAI } = await import("./index-6srwvd5b.js");
     const llmConfig = await resolveWorkflowLlmConfig(config.model);
     modelName = llmConfig.model;
     const provider = createOpenAI({
@@ -21282,7 +21352,7 @@ async function executeRawLlm(config) {
     });
     const model = provider(llmConfig.model);
     if (config.schema) {
-      const { generateObject, jsonSchema } = await import("./index-s98037v0.js");
+      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
       const { object } = await generateObject({
         model,
         schema: jsonSchema(config.schema),
@@ -21296,7 +21366,7 @@ async function executeRawLlm(config) {
         output: { result: object, model: modelName }
       };
     }
-    const { generateText } = await import("./index-s98037v0.js");
+    const { generateText } = await import("./index-cbxkmfc5.js");
     const { text } = await generateText({
       model,
       prompt: config.prompt
@@ -21736,8 +21806,8 @@ class ValidateExecutor extends BaseExecutor {
     const interpolatedPrompt = this.deps.interpolate(prompt, context);
     const outputStr = typeof targetOutput === "string" ? targetOutput : JSON.stringify(targetOutput);
     try {
-      const { createOpenAI } = await import("./index-va3y63es.js");
-      const { generateObject, jsonSchema } = await import("./index-s98037v0.js");
+      const { createOpenAI } = await import("./index-6srwvd5b.js");
+      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
       const llmConfig = await resolveWorkflowLlmConfig();
       const provider = createOpenAI({
         baseURL: llmConfig.baseURL,
@@ -21909,6 +21979,7 @@ function createExecutorRegistry(deps) {
   registry.register(new NotifyExecutor(deps));
   registry.register(new RawLlmExecutor(deps));
   registry.register(new SystemOneDecisionExecutor(deps));
+  registry.register(new SystemOneExtractionExecutor(deps));
   registry.register(new ScriptExecutor(deps));
   registry.register(new SwarmScriptExecutor(deps));
   registry.register(new VcsExecutor(deps));
@@ -24508,7 +24579,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-zthpy4m1.js");
+  const dispatcher = await import("./dispatcher-c155xz0p.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -31264,7 +31335,11 @@ async function loadAdapter(name, config, logger) {
   switch (name) {
     case "telegram": {
       const { createTelegramAdapter } = await import("./index-g216q6jr.js");
-      return createTelegramAdapter({ ...base, allowUnverifiedWebhooks: false });
+      return createTelegramAdapter({
+        ...base,
+        allowUnverifiedWebhooks: false,
+        mentionOnReply: true
+      });
     }
     case "slack": {
       const { createSlackAdapter } = await import("./index-zgvqzjsw.js");
@@ -31866,6 +31941,43 @@ function resetDiscordGatewayHealth() {
 // src/integrations/chat-sdk/inbound.ts
 init_zod();
 init_db3();
+
+// src/be/unmapped-identities.ts
+init_db3();
+var TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function namespace(kind) {
+  return `integration:unmapped:${kind}`;
+}
+async function recordUnmappedIdentity(kind, externalId, meta) {
+  const ns = namespace(kind);
+  const now = new Date().toISOString();
+  const expiresAt = Date.now() + TTL_MS;
+  const countKey = `${externalId}:count`;
+  const countBefore = await getKv2(ns, countKey);
+  await upsertKv2({
+    namespace: ns,
+    key: `${externalId}:meta`,
+    value: {
+      lastSeenAt: now,
+      sampleEventType: meta.sampleEventType,
+      sampleContext: meta.sampleContext.slice(0, 100)
+    },
+    valueType: "json",
+    expiresAt
+  });
+  const incremented = await incrKv2(ns, countKey, 1);
+  if (countBefore === null) {
+    await upsertKv2({
+      namespace: ns,
+      key: countKey,
+      value: Number(incremented.value),
+      valueType: "integer",
+      expiresAt
+    });
+  }
+}
+
+// src/integrations/chat-sdk/inbound.ts
 init_resolver();
 init_context_key();
 init_secret_scrubber();
@@ -31914,10 +32026,191 @@ async function recordTaskAttachmentUpload(input) {
     throw error;
   }
 }
+function scopeFromAttachment(attachment) {
+  const storedKey = attachment.providerKey ?? attachment.path ?? "";
+  return {
+    taskId: attachment.taskId,
+    name: attachment.name,
+    key: storedKey.trim() ? storedKey : undefined,
+    orgId: attachment.orgId,
+    driveId: attachment.driveId
+  };
+}
+function backingProviderId(attachment) {
+  if (attachment.kind === "agent-fs")
+    return attachment.providerId ?? "agent-fs";
+  if (attachment.providerId === "local-fs")
+    return "local-fs";
+  return null;
+}
+
+// src/utils/transcription.ts
+init_secret_scrubber();
+var TRANSCRIPTION_TIMEOUT_MS = 60000;
+var TRANSCRIPTION_API_KEY_ENV = "TRANSCRIPTION_API_KEY";
+var openAIShape = {
+  path: "/audio/transcriptions",
+  modelField: "model",
+  authHeaders: (apiKey) => ({ authorization: `Bearer ${apiKey}` })
+};
+var PROVIDERS = {
+  openai: {
+    keyEnv: "OPENAI_API_KEY",
+    defaultBaseUrl: "https://api.openai.com/v1",
+    defaultModel: "whisper-1",
+    ...openAIShape
+  },
+  groq: {
+    keyEnv: "GROQ_API_KEY",
+    defaultBaseUrl: "https://api.groq.com/openai/v1",
+    defaultModel: "whisper-large-v3-turbo",
+    ...openAIShape
+  },
+  elevenlabs: {
+    keyEnv: "ELEVENLABS_API_KEY",
+    defaultBaseUrl: "https://api.elevenlabs.io/v1",
+    defaultModel: "scribe_v2",
+    path: "/speech-to-text",
+    modelField: "model_id",
+    authHeaders: (apiKey) => ({ "xi-api-key": apiKey })
+  }
+};
+var AUTO_DETECT_ORDER = ["elevenlabs", "openai", "groq"];
+var TRANSCRIPTION_ENV_KEYS = [
+  TRANSCRIPTION_API_KEY_ENV,
+  "TRANSCRIPTION_PROVIDER",
+  "TRANSCRIPTION_BASE_URL",
+  "TRANSCRIPTION_MODEL",
+  ...AUTO_DETECT_ORDER.map((name) => PROVIDERS[name].keyEnv)
+];
+
+class TranscriptionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TranscriptionError";
+  }
+}
+function envValue(key) {
+  return process.env[key]?.trim() || undefined;
+}
+function resolveTranscriptionConfig() {
+  const pinned = envValue("TRANSCRIPTION_PROVIDER")?.toLowerCase();
+  const explicitKey = envValue(TRANSCRIPTION_API_KEY_ENV);
+  if (explicitKey) {
+    return {
+      provider: pinned ?? "openai",
+      apiKey: explicitKey,
+      keyEnv: TRANSCRIPTION_API_KEY_ENV,
+      source: "explicit"
+    };
+  }
+  const candidates = pinned ? AUTO_DETECT_ORDER.filter((name) => name === pinned) : AUTO_DETECT_ORDER;
+  for (const name of candidates) {
+    const { keyEnv } = PROVIDERS[name];
+    const apiKey = envValue(keyEnv);
+    if (apiKey)
+      return { provider: name, apiKey, keyEnv, source: "auto" };
+  }
+  return null;
+}
+function isTranscriptionConfigured() {
+  return resolveTranscriptionConfig() !== null;
+}
+function providerSpec(name) {
+  if (!Object.hasOwn(PROVIDERS, name)) {
+    throw new TranscriptionError(`TRANSCRIPTION_PROVIDER "${name}" is not supported (use ${Object.keys(PROVIDERS).join(", ")})`);
+  }
+  return PROVIDERS[name];
+}
+function errorDetail(payload, status) {
+  const error = payload?.error;
+  if (typeof error?.message === "string")
+    return error.message;
+  const detail = payload?.detail;
+  if (typeof detail === "string")
+    return detail;
+  if (typeof detail?.message === "string")
+    return detail.message;
+  return `HTTP ${status}`;
+}
+async function transcribeAudio(input) {
+  const config = resolveTranscriptionConfig();
+  if (!config)
+    throw new TranscriptionError("no transcription provider key is set");
+  const { apiKey } = config;
+  const provider = providerSpec(config.provider);
+  const baseUrlOverride = config.source === "explicit" ? process.env.TRANSCRIPTION_BASE_URL?.trim() : undefined;
+  const baseUrl = (baseUrlOverride || provider.defaultBaseUrl).replace(/\/+$/, "");
+  const keyScrubber = createValueScrubber([{ value: apiKey, name: config.keyEnv }]);
+  const scrub = (text) => scrubSecrets(keyScrubber.text(text));
+  const form = new FormData;
+  const type = input.mimeType ?? input.data.type;
+  form.append("file", type ? new Blob([input.data], { type }) : input.data, input.filename);
+  form.append(provider.modelField, process.env.TRANSCRIPTION_MODEL?.trim() || provider.defaultModel);
+  let response;
+  try {
+    response = await fetch(`${baseUrl}${provider.path}`, {
+      method: "POST",
+      headers: provider.authHeaders(apiKey),
+      body: form,
+      signal: AbortSignal.timeout(TRANSCRIPTION_TIMEOUT_MS)
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "TimeoutError") {
+      throw new TranscriptionError(`no answer within ${TRANSCRIPTION_TIMEOUT_MS / 1000} s`);
+    }
+    throw new TranscriptionError(scrub(error instanceof Error ? error.message : String(error)));
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok || typeof payload?.text !== "string") {
+    throw new TranscriptionError(scrub(errorDetail(payload, response.status)));
+  }
+  return payload.text.trim();
+}
+var NOT_TRANSCRIBED_NOTE = `(not transcribed: no transcription provider configured, set ${TRANSCRIPTION_API_KEY_ENV} or one of ${AUTO_DETECT_ORDER.map((name) => PROVIDERS[name].keyEnv).join(", ")})`;
+var AUDIO_EXTENSIONS = {
+  "audio/ogg": "ogg",
+  "audio/opus": "ogg",
+  "audio/mpeg": "mp3",
+  "audio/mp4": "m4a",
+  "audio/x-m4a": "m4a",
+  "audio/wav": "wav",
+  "audio/x-wav": "wav",
+  "audio/webm": "webm"
+};
+async function transcribeAudioNotes(files, logPrefix) {
+  const notes = new Map;
+  if (files.length === 0)
+    return notes;
+  if (!isTranscriptionConfigured()) {
+    for (const file of files)
+      notes.set(file.key, NOT_TRANSCRIBED_NOTE);
+    return notes;
+  }
+  for (const file of files) {
+    const extension = AUDIO_EXTENSIONS[file.mimeType ?? ""] ?? "ogg";
+    const filename = /\.\w+$/.test(file.name) ? file.name : `${file.name}.${extension}`;
+    try {
+      const text = await transcribeAudio({ data: file.data, filename, mimeType: file.mimeType });
+      notes.set(file.key, `[Transcript of ${file.name}]
+${text || "(no speech recognized)"}`);
+    } catch (error) {
+      const reason = scrubSecrets(error instanceof Error ? error.message : String(error));
+      console.warn(`${logPrefix} could not transcribe file ${file.key}: ${reason}`);
+      notes.set(file.key, `(transcription failed: ${reason})`);
+    }
+  }
+  return notes;
+}
 
 // src/integrations/chat-sdk/attachments.ts
 var DRAFT_LEASE_REFRESH_MS = 60000;
 var SHARED_FILE_INTENT = "user-upload";
+var MB = 1024 * 1024;
+var CHAT_INBOUND_FILE_LIMITS = { telegram: 20 * MB };
+function chatInboundFileLimit(adapter) {
+  return Math.min(CHAT_INBOUND_FILE_LIMITS[adapter] ?? MAX_TASK_ATTACHMENT_BYTES, MAX_TASK_ATTACHMENT_BYTES);
+}
 function formatFileSize(bytes) {
   if (bytes < 1024)
     return `${bytes} B`;
@@ -31938,16 +32231,42 @@ function toChatFiles(adapter, messageId, attachments) {
     attachment
   }));
 }
-function buildChatAttachmentText(files, failed = []) {
+function buildChatAttachmentText(files, failed = [], notes = new Map) {
   const reasons = new Map(failed.map((f) => [f.file.id, f.reason]));
   return files.map((f) => {
     const size = typeof f.size === "number" ? formatFileSize(f.size) : "unknown size";
     const line = `[File: ${f.name} (${f.mimeType ?? "unknown type"}, ${size}) id=${f.id}]`;
     const reason = reasons.get(f.id);
-    return reason ? `${line} (not attached: ${reason})` : line;
+    const note = notes.get(f.id);
+    return [reason ? `${line} (not attached: ${reason})` : line, note].filter(Boolean).join(`
+`);
   }).join(`
 `);
 }
+function markdownLiteral(value) {
+  const text = value.replace(/[\r\n]+/g, " ");
+  const longestRun = Math.max(0, ...(text.match(/`+/g) ?? []).map((run) => run.length));
+  const fence = "`".repeat(longestRun + 1);
+  const pad = /^[` ]|[` ]$/.test(text) ? " " : "";
+  return `${fence}${pad}${text}${pad}${fence}`;
+}
+function formatTooLargeReply(failed) {
+  const lines = failed.map((f) => `- ${markdownLiteral(f.file.name)}: ${f.reason}`);
+  return [
+    `Too large to read, so the swarm did not get ${failed.length === 1 ? "this file" : "these files"}:`,
+    ...lines,
+    "Send a smaller file or a link."
+  ].join(`
+`);
+}
+async function transcribeChatAudio(fetched) {
+  return transcribeAudioNotes(fetched.filter(({ file }) => file.attachment.type === "audio").map(({ file, path }) => ({
+    key: file.id,
+    name: file.name,
+    data: Bun.file(path),
+    mimeType: file.mimeType
+  })), "[chat-sdk]");
+}
 async function readAttachment(attachment) {
   if (attachment.data instanceof Blob)
     return new Uint8Array(await attachment.data.arrayBuffer());
@@ -31971,17 +32290,25 @@ async function fetchChatFiles(files) {
   };
   if (files.length === 0)
     return result;
-  const limit = `larger than the ${MAX_TASK_ATTACHMENT_BYTES / (1024 * 1024)} MB limit`;
+  const tooLarge = (file, size) => {
+    const limit = chatInboundFileLimit(file.adapter);
+    const platform = file.adapter.charAt(0).toUpperCase() + file.adapter.slice(1);
+    return {
+      file,
+      reason: `too large (${formatFileSize(size)}, the limit for files sent to the ${platform} bot is ${formatFileSize(limit)})`,
+      tooLarge: true
+    };
+  };
   dir = await mkdtemp(join(tmpdir2(), "chat-files-"));
   for (const [index, file] of files.entries()) {
-    if (typeof file.size === "number" && file.size > MAX_TASK_ATTACHMENT_BYTES) {
-      result.failed.push({ file, reason: limit });
+    if (typeof file.size === "number" && file.size > chatInboundFileLimit(file.adapter)) {
+      result.failed.push(tooLarge(file, file.size));
       continue;
     }
     try {
       const bytes = await readAttachment(file.attachment);
-      if (bytes.byteLength > MAX_TASK_ATTACHMENT_BYTES) {
-        result.failed.push({ file, reason: limit });
+      if (bytes.byteLength > chatInboundFileLimit(file.adapter)) {
+        result.failed.push(tooLarge(file, bytes.byteLength));
         continue;
       }
       const path = join(dir, String(index));
@@ -32056,6 +32383,63 @@ async function attachChatFilesToTask(taskId, fetched) {
   return unattached;
 }
 
+// src/integrations/chat-sdk/facts.ts
+var SNIPPET_MAX = 80;
+function snippet2(text) {
+  const flat = text?.replace(/\s+/g, " ").trim();
+  if (!flat)
+    return;
+  return flat.length > SNIPPET_MAX ? `${flat.slice(0, SNIPPET_MAX)}...` : flat;
+}
+function personLabel(name, username, fallback) {
+  if (name && username && name !== username)
+    return `${name} (@${username})`;
+  if (username)
+    return `@${username}`;
+  return name || fallback;
+}
+function telegramFacts(raw, message, botUserId) {
+  const reply = raw.reply_to_message;
+  const replyIsTopicRoot = reply !== undefined && (reply.forum_topic_created !== undefined || raw.is_topic_message === true && reply.message_id === raw.message_thread_id);
+  const realReply = reply && !replyIsTopicRoot ? reply : undefined;
+  const topicName = replyIsTopicRoot ? reply?.forum_topic_created?.name : undefined;
+  const name = [raw.from?.first_name, raw.from?.last_name].filter(Boolean).join(" ").trim();
+  return {
+    chatType: raw.chat?.type,
+    isForum: raw.chat?.is_forum === true ? true : undefined,
+    title: raw.chat?.title,
+    topic: raw.is_topic_message === true && raw.message_thread_id !== undefined ? topicName ? `"${topicName}"` : `#${raw.message_thread_id}` : undefined,
+    from: personLabel(name || undefined, raw.from?.username, message.author.userId),
+    replyToBot: realReply?.from?.id !== undefined && botUserId !== undefined && String(realReply.from.id) === botUserId,
+    replyToSnippet: snippet2(realReply?.text ?? realReply?.caption)
+  };
+}
+function readChatMessageFacts(thread, message) {
+  const raw = message.raw;
+  if (thread.adapter.name === "telegram" && raw && typeof raw === "object") {
+    return telegramFacts(raw, message, thread.adapter.botUserId);
+  }
+  const { fullName, userName, userId } = message.author;
+  return {
+    chatType: thread.isDM ? "dm" : undefined,
+    from: personLabel(fullName || undefined, userName || undefined, userId),
+    replyToBot: message.replyTo?.author.isMe === true,
+    replyToSnippet: snippet2(message.replyTo?.text)
+  };
+}
+function formatChatHeaderFacts(adapter, facts, addressed) {
+  const oneLine = (text) => text.replace(/\s+/g, " ").trim();
+  const parts = [adapter];
+  if (facts.chatType)
+    parts.push(facts.title ? `${facts.chatType} "${oneLine(facts.title)}"` : facts.chatType);
+  if (facts.isForum)
+    parts.push(facts.topic ? `forum topic ${oneLine(facts.topic)}` : "forum");
+  parts.push(`from: ${oneLine(facts.from)}`, `addressed: ${addressed}`);
+  if (facts.replyToSnippet)
+    parts.push(`reply-to: "${facts.replyToSnippet}"`);
+  return parts.join(" · ");
+}
+
 // src/integrations/chat-sdk/outbound.ts
 init_secret_scrubber();
 init_event_bus();
@@ -32071,6 +32455,17 @@ var FALLBACK_LIMIT = 2000;
 function chatMessageLimit(adapter) {
   return CHAT_MESSAGE_LIMITS[adapter] ?? FALLBACK_LIMIT;
 }
+var MB2 = 1024 * 1024;
+var CHAT_UPLOAD_LIMITS = {
+  telegram: 50 * MB2,
+  discord: 10 * MB2
+};
+var FALLBACK_UPLOAD_LIMIT = 50 * MB2;
+var TELEGRAM_PHOTO_LIMIT = 10 * MB2;
+function chatUploadLimit(adapter) {
+  return CHAT_UPLOAD_LIMITS[adapter] ?? FALLBACK_UPLOAD_LIMIT;
+}
+var CHAT_FILES_PER_MESSAGE = 10;
 function splitChatMessage(text, limit) {
   if (limit <= 0)
     throw new Error("splitChatMessage: limit must be positive");
@@ -32111,6 +32506,15 @@ function adapterOfChatId(id) {
   const index = id.indexOf(":");
   return index === -1 ? id : id.slice(0, index);
 }
+
+class ChatFileTooLargeError extends Error {
+  sizeBytes;
+  constructor(sizeBytes) {
+    super(`file is ${formatFileSize(sizeBytes)}`);
+    this.sizeBytes = sizeBytes;
+    this.name = "ChatFileTooLargeError";
+  }
+}
 async function postChunks(adapter, target, text) {
   const messageIds = [];
   let threadId;
@@ -32121,6 +32525,125 @@ async function postChunks(adapter, target, text) {
   }
   return { messageIds, threadId };
 }
+function resolveMimeType(name, ...candidates) {
+  for (const candidate of candidates) {
+    const type = candidate?.split(";")[0]?.trim().toLowerCase();
+    if (type && type !== "application/octet-stream")
+      return type;
+  }
+  return Bun.file(name).type.split(";")[0] ?? "application/octet-stream";
+}
+function telegramAttachmentType(mimeType, sizeBytes) {
+  if ((mimeType === "image/jpeg" || mimeType === "image/png") && sizeBytes <= TELEGRAM_PHOTO_LIMIT) {
+    return "image";
+  }
+  if (mimeType === "video/mp4")
+    return "video";
+  if (mimeType === "audio/mpeg" || mimeType === "audio/mp4" || mimeType === "audio/x-m4a") {
+    return "audio";
+  }
+  return "file";
+}
+function fileGroupKey(adapter, file) {
+  if (adapter !== "telegram")
+    return "files";
+  const type = telegramAttachmentType(file.mimeType, file.data.byteLength);
+  return type === "image" || type === "video" ? "visual" : type;
+}
+function fileMessage(adapter, files) {
+  if (adapter === "telegram") {
+    return {
+      markdown: "",
+      attachments: files.map((file) => ({
+        type: telegramAttachmentType(file.mimeType, file.data.byteLength),
+        name: file.name,
+        mimeType: file.mimeType,
+        size: file.data.byteLength,
+        data: file.data
+      }))
+    };
+  }
+  return {
+    markdown: "",
+    files: files.map((file) => ({ data: file.data, filename: file.name, mimeType: file.mimeType }))
+  };
+}
+function platformName(adapter) {
+  return adapter.charAt(0).toUpperCase() + adapter.slice(1);
+}
+async function postFiles(adapter, target, files) {
+  const limit = chatUploadLimit(adapter);
+  const tooLarge = (size) => `${formatFileSize(size)}, over the ${formatFileSize(limit)} upload limit of ${platformName(adapter)}`;
+  const messageIds = [];
+  const unsent = [];
+  const groups = new Map;
+  const send = async (group) => {
+    try {
+      const sent = await target.post(fileMessage(adapter, group));
+      messageIds.push(sent.id);
+    } catch (error) {
+      const reason = `refused by ${platformName(adapter)} (${scrubSecrets(errorMessage(error))})`;
+      for (const file of group)
+        unsent.push({ name: file.name, reason });
+    }
+  };
+  for (const file of files) {
+    if (file.sizeBytes !== undefined && file.sizeBytes > limit) {
+      unsent.push({ name: file.name, reason: tooLarge(file.sizeBytes) });
+      continue;
+    }
+    let loaded;
+    try {
+      const { data, mimeType } = await file.load(limit);
+      if (data.byteLength > limit)
+        throw new ChatFileTooLargeError(data.byteLength);
+      loaded = {
+        name: file.name,
+        mimeType: resolveMimeType(file.name, file.mimeType, mimeType),
+        data: Buffer.from(data.buffer, data.byteOffset, data.byteLength)
+      };
+    } catch (error) {
+      unsent.push({
+        name: file.name,
+        reason: error instanceof ChatFileTooLargeError ? tooLarge(error.sizeBytes) : `could not be read (${scrubSecrets(errorMessage(error))})`
+      });
+      continue;
+    }
+    const key = fileGroupKey(adapter, loaded);
+    const group = [...groups.get(key) ?? [], loaded];
+    if (group.length === CHAT_FILES_PER_MESSAGE) {
+      groups.delete(key);
+      await send(group);
+    } else {
+      groups.set(key, group);
+    }
+  }
+  for (const group of groups.values())
+    await send(group);
+  return { messageIds, unsent };
+}
+function unsentFilesSummary(unsent) {
+  return unsent.length === 0 ? "" : ` ${formatUnsentFilesNote(unsent)}`;
+}
+function singleLine(text) {
+  return text.replace(/[\u0000-\u001f\u007f\u2028\u2029]+/g, " ").trim();
+}
+function breakMentions(text) {
+  return text.replace(/@/g, "@​").replace(/<!/g, "<​!");
+}
+function codeSpan(text) {
+  const value = breakMentions(singleLine(text)) || "(unnamed)";
+  const longestRun = Math.max(0, ...(value.match(/`+/g) ?? []).map((run) => run.length));
+  const fence = "`".repeat(longestRun + 1);
+  const pad = value.startsWith("`") || value.endsWith("`") ? " " : "";
+  return `${fence}${pad}${value}${pad}${fence}`;
+}
+function formatUnsentFilesNote(unsent) {
+  const lines = unsent.map((file) => `- ${codeSpan(file.name)}: ${breakMentions(singleLine(file.reason))}`);
+  const count = unsent.length === 1 ? "1 file" : `${unsent.length} files`;
+  return [`Could not send ${count}:`, ...lines].join(`
+`);
+}
 async function postChatMessage(args) {
   assertTrustedChatTarget(args.threadId ?? args.channelId ?? "");
   const chat = getChatInstance(args.adapter);
@@ -32128,27 +32651,42 @@ async function postChatMessage(args) {
     throw new ChatAdapterUnavailableError(args.adapter);
   const text = scrubSecrets(args.text);
   let result;
+  let target;
   if (args.threadId) {
     const thread = chat.thread(args.threadId);
+    target = thread;
     const sent = await postChunks(args.adapter, thread, text);
     result = {
       adapter: args.adapter,
       threadId: thread.id,
       channelId: thread.channelId,
-      messageIds: sent.messageIds
+      messageIds: sent.messageIds,
+      unsentFiles: []
     };
   } else if (args.channelId) {
     const channel = chat.channel(args.channelId);
+    target = channel;
     const sent = await postChunks(args.adapter, channel, text);
     result = {
       adapter: args.adapter,
       threadId: sent.threadId ?? channel.id,
       channelId: channel.id,
-      messageIds: sent.messageIds
+      messageIds: sent.messageIds,
+      unsentFiles: []
     };
   } else {
     throw new Error("postChatMessage needs a threadId or a channelId");
   }
+  if (args.files?.length) {
+    const sent = await postFiles(args.adapter, target, args.files);
+    result.messageIds.push(...sent.messageIds);
+    result.unsentFiles = sent.unsent;
+    if (sent.unsent.length > 0) {
+      const note = formatUnsentFilesNote(sent.unsent);
+      const noted = await postChunks(args.adapter, target, scrubSecrets(note));
+      result.messageIds.push(...noted.messageIds);
+    }
+  }
   emitChatMessageSent({
     adapter: result.adapter,
     channelId: result.channelId,
@@ -32214,9 +32752,19 @@ async function putChatChannelMapping(adapter, channelId, mapping) {
 async function deleteChatChannelMapping(adapter, channelId) {
   return deleteKv2(CHAT_CHANNELS_NAMESPACE, chatChannelKey(adapter, channelId));
 }
+function hasRoutingToken(text) {
+  return /swarm#(?:[a-f0-9-]{36}|all)/i.test(text);
+}
 function stripRoutingTokens(text) {
   return text.replace(/swarm#[a-f0-9-]{36}/gi, "").replace(/swarm#all/gi, "").trim();
 }
+var DEFAULT_OWNER_WINDOW_MINUTES = 15;
+function chatOwnerWindowStart(now = Date.now()) {
+  const raw = process.env.CHAT_SDK_OWNER_WINDOW_MIN?.trim();
+  const value = raw ? Number(raw) : Number.NaN;
+  const minutes = Number.isFinite(value) && value >= 0 ? value : DEFAULT_OWNER_WINDOW_MINUTES;
+  return new Date(now - minutes * 60000).toISOString();
+}
 async function leadMatch(reachable, matchedText) {
   const lead = reachable.find((agent) => agent.isLead) ?? await getLeadAgent2();
   return { agent: lead, reason: "skill", matchedText };
@@ -32258,7 +32806,7 @@ async function routeChatMessage(text, ctx) {
     }
     console.warn(scrubSecrets(`[chat-sdk] Channel mapping for ${ctx.channelId} names unknown agent ${mapping.agentId}; using the default route`));
   }
-  const owner = await getAgentWorkingOnContextKey2(chatSdkContextKey(ctx.threadId), "chat");
+  const owner = await getAgentWorkingOnContextKey2(chatSdkContextKey(ctx.threadId), "chat", ctx.adapter === "telegram" && !ctx.isDirectMessage ? chatOwnerWindowStart() : undefined);
   if (owner && await isAgentReachable(owner)) {
     return {
       kind: "agents",
@@ -32288,6 +32836,9 @@ async function requestChatThreadSteering(args) {
   const task = await getLatestLeadTaskByContextKey2(args.contextKey, "chat");
   if (!task || task.status !== "in_progress")
     return null;
+  const senderUserId = await args.resolveSender();
+  if (senderUserId !== task.requestedByUserId)
+    return null;
   try {
     const result = await requestSteering({
       taskId: task.id,
@@ -32295,7 +32846,8 @@ async function requestChatThreadSteering(args) {
       mode: "queue",
       onUnsupported: "degrade",
       source: "chat",
-      createdByKind: "user"
+      createdByKind: "user",
+      createdByUserId: senderUserId
     });
     return { task, result };
   } catch (error) {
@@ -32389,6 +32941,18 @@ registerTemplate({
   ],
   category: "system"
 });
+registerTemplate({
+  eventType: "chat.message.header",
+  header: "",
+  defaultBody: "[chat] {{chat_facts}}",
+  variables: [
+    {
+      name: "chat_facts",
+      description: "Adapter, chat type and title, forum topic, sender, why the message was taken (addressed) and the replied-to snippet, joined with ' · '"
+    }
+  ],
+  category: "system"
+});
 
 // src/integrations/chat-sdk/inbound.ts
 var ChatRouteModifySchema = object2({
@@ -32433,10 +32997,24 @@ async function handleChatInbound(thread, message, kind) {
   if (immediate)
     text = text.replace(/^!now\s*/i, "").trim();
   const attachments = message.attachments ?? [];
+  const facts = readChatMessageFacts(thread, message);
+  const isDirectMessage = kind === "dm" || thread.isDM;
+  const mentioned = kind === "mention" || message.isMention === true;
+  let addressed = isDirectMessage ? "dm" : facts.replyToBot ? "reply-to-bot" : mentioned ? "mention" : "none";
+  if (addressed === "none" && (facts.chatType === "group" || facts.chatType === "supergroup")) {
+    const unaddressed = await classifyUnaddressedGroupMessage(thread, message.author.userId, text);
+    if (unaddressed === "chatter") {
+      console.log(`[chat-sdk] ${thread.id}: unaddressed group message from a non-requester, ignored`);
+      return;
+    }
+    if (unaddressed === "requester-follow-up")
+      addressed = unaddressed;
+  }
   if (!immediate && attachments.length === 0 && text && !isChatThreadBuffered(thread.id)) {
     const steering = await requestChatThreadSteering({
       contextKey: chatSdkContextKey(thread.id),
-      message: text
+      message: text,
+      resolveSender: () => resolveChatSender(adapter, message.author.userId)
     });
     if (steering) {
       console.log(`[chat-sdk] ${adapter} message steered task ${steering.task.id} (${steering.result.outcome})`);
@@ -32465,8 +33043,10 @@ async function handleChatInbound(thread, message, kind) {
       text,
       userId: message.author.userId,
       userName: message.author.userName || undefined,
-      botMentioned: kind === "mention" || message.isMention === true,
-      isDirectMessage: kind === "dm" || thread.isDM,
+      botMentioned: mentioned || facts.replyToBot,
+      isDirectMessage,
+      addressed,
+      facts,
       attachments
     });
     if (kind !== "subscribed")
@@ -32475,6 +33055,47 @@ async function handleChatInbound(thread, message, kind) {
   if (immediate)
     await instantFlushChat(thread.id);
 }
+var REQUESTER_KEY_PREFIX = "swarm:requester:";
+var REQUESTER_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+async function rememberChatThreadRequester(threadId, userId) {
+  try {
+    await new SqliteChatState().set(`${REQUESTER_KEY_PREFIX}${threadId}`, userId, REQUESTER_TTL_MS);
+  } catch (error) {
+    console.warn(`[chat-sdk] Could not store the thread requester: ${errorMessage(error)}`);
+  }
+}
+async function classifyUnaddressedGroupMessage(thread, senderId, text) {
+  if (hasRoutingToken(text))
+    return "routable";
+  if ((await getChatChannelMapping(thread.adapter.name, thread.channelId))?.agentId) {
+    return "routable";
+  }
+  const owner = await getAgentWorkingOnContextKey2(chatSdkContextKey(thread.id), "chat", chatOwnerWindowStart());
+  if (!owner)
+    return "chatter";
+  const requester = await new SqliteChatState().get(`${REQUESTER_KEY_PREFIX}${thread.id}`);
+  return requester === senderId ? "requester-follow-up" : "chatter";
+}
+async function resolveChatRequester(adapter, item) {
+  return resolveChatSender(adapter, item.userId, {
+    sampleEventType: "chat.message",
+    sampleContext: `${item.facts.from}: ${item.text}`
+  });
+}
+async function resolveChatSender(adapter, userId, sample) {
+  if (!userId || userId.startsWith("chat:"))
+    return;
+  try {
+    const resolution = await resolveIdentity(adapter, userId);
+    if (resolution.status === "resolved")
+      return resolution.userId;
+    if (sample)
+      await recordUnmappedIdentity(adapter, userId, sample);
+  } catch (error) {
+    console.warn(`[chat-sdk] Could not resolve the requester: ${errorMessage(error)}`);
+  }
+  return;
+}
 async function getChatThreadContext(thread, exclude, since) {
   try {
     await thread.refresh();
@@ -32545,6 +33166,8 @@ async function flushChatThread(threadId, items, immediate) {
 `);
     const botMentioned = items.some((item) => item.botMentioned);
     const isDirectMessage = items.some((item) => item.isDirectMessage);
+    const requester = items.find((item) => item.addressed !== "none") ?? first;
+    const otherSenders = new Set(items.map((item) => item.userId)).size - 1;
     const resetAt = await getChatThreadResetAt(threadId);
     const previousTask = await getLatestTaskByContextKey2(contextKey);
     const mostRecentTask = previousTask && resetAt && new Date(previousTask.createdAt).getTime() <= resetAt.getTime() ? null : previousTask;
@@ -32557,6 +33180,9 @@ async function flushChatThread(threadId, items, immediate) {
       text: rawText,
       botMentioned,
       isDirectMessage,
+      ...first.facts.chatType ? { chatType: first.facts.chatType } : {},
+      ...first.facts.isForum ? { isForum: true } : {},
+      replyToBot: items.some((item) => item.facts.replyToBot),
       ...mostRecentTask ? { threadContext: { adapter, threadId } } : {}
     }, {
       validateModify: (data) => {
@@ -32607,7 +33233,16 @@ async function flushChatThread(threadId, items, immediate) {
     const body = stripRoutingTokens(rawText);
     const files = items.flatMap((item) => toChatFiles(adapter, item.messageId, item.attachments));
     const inbound = __using(__stack, await fetchChatFiles(files), 1);
-    const fileText = buildChatAttachmentText(inbound.files, inbound.failed);
+    const tooLarge = inbound.failed.filter((failure) => failure.tooLarge);
+    if (tooLarge.length > 0) {
+      try {
+        await postChatMessage({ adapter, threadId, text: formatTooLargeReply(tooLarge) });
+      } catch (error) {
+        console.warn(`[chat-sdk] ${threadId}: could not post the too-large reply: ${errorMessage(error)}`);
+      }
+    }
+    const notes = await transcribeChatAudio(inbound.fetched);
+    const fileText = buildChatAttachmentText(inbound.files, inbound.failed, notes);
     const combined = [body, fileText].filter(Boolean).join(`
 
 `);
@@ -32615,9 +33250,17 @@ async function flushChatThread(threadId, items, immediate) {
 
 ${combined}` : combined;
     const threadContext = mostRecentTask && thread ? await getChatThreadContext(thread, new Set(items.map((item) => item.messageId)), resetAt) : "";
-    const description = threadContext ? `${resolveTemplate("chat.message.thread_context", { thread_messages: threadContext }).text}
+    const header = resolveTemplate("chat.message.header", {
+      chat_facts: formatChatHeaderFacts(adapter, otherSenders > 0 ? { ...requester.facts, from: `${requester.facts.from} +${otherSenders} more` } : requester.facts, requester.addressed)
+    }).text;
+    const description = [
+      header,
+      threadContext ? resolveTemplate("chat.message.thread_context", { thread_messages: threadContext }).text : "",
+      marked
+    ].filter(Boolean).join(`
 
-${marked}` : marked;
+`);
+    const requestedByUserId = otherSenders > 0 ? undefined : await resolveChatRequester(adapter, requester);
     const latestActive = await getLatestActiveTaskByContextKey2(contextKey, "chat");
     const dependsOn = !immediate && latestActive ? [latestActive.id] : undefined;
     let created = 0;
@@ -32632,7 +33275,9 @@ ${marked}` : marked;
         priority: 70,
         contextKey,
         dependsOn,
+        requestedByUserId,
         parentTaskId: mostRecentTask?.id,
+        inheritParentRequester: false,
         inheritParentOutputSchema: false
       };
       try {
@@ -32648,6 +33293,7 @@ ${marked}` : marked;
       }
     }
     if (created > 0) {
+      await rememberChatThreadRequester(threadId, requester.userId);
       await subscribe(thread);
       startTypingKeepalive(adapter, threadId);
     } else {
@@ -32693,6 +33339,127 @@ init_db3();
 init_context_key();
 init_secret_scrubber();
 init_event_bus();
+
+// src/integrations/chat-sdk/outbound-files.ts
+init_db3();
+init_secret_scrubber();
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function download(scope, maxBytes, provider = getFileStorageProvider2()) {
+  const response = await provider.download(scope);
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > maxBytes) {
+    await response.body?.cancel();
+    throw new ChatFileTooLargeError(length);
+  }
+  const data = new Uint8Array(await response.arrayBuffer());
+  if (data.byteLength > maxBytes)
+    throw new ChatFileTooLargeError(data.byteLength);
+  return { data, mimeType: response.headers.get("content-type") ?? undefined };
+}
+function chatFileOfTaskAttachment(attachment) {
+  if (backingProviderId(attachment) !== getFileStorageProvider2().id)
+    return;
+  return {
+    name: attachment.name,
+    mimeType: attachment.mimeType,
+    sizeBytes: attachment.sizeBytes,
+    load: (maxBytes) => download(scopeFromAttachment(attachment), maxBytes)
+  };
+}
+function pathSegments(path) {
+  return normalizeStoredKey(path).split("/").map((segment) => {
+    let decoded = segment;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {}
+    if (!decoded || decoded === "." || decoded === ".." || /[/\\\0]/.test(decoded)) {
+      throw new FilesError("Provider", "Path must not contain empty, `.` or `..` segments, or encoded separators");
+    }
+    return decoded;
+  });
+}
+async function callerAgentFs(agentId) {
+  if (!agentId)
+    return;
+  const configs = await getResolvedConfig2(agentId);
+  const value = (key) => configs.find((c) => c.key === key)?.value?.trim();
+  const apiUrl = value("AGENT_FS_API_URL") || process.env.AGENT_FS_API_URL?.trim();
+  const apiKey = value("AGENT_FS_API_KEY");
+  const orgId = value("AGENT_FS_DEFAULT_ORG_ID");
+  const driveId = value("AGENT_FS_DEFAULT_DRIVE_ID");
+  return apiUrl && apiKey && orgId && driveId ? { apiUrl, apiKey, orgId, driveId } : undefined;
+}
+function chatFileOfPath(path, access) {
+  const segments = pathSegments(path);
+  const name = segments.at(-1);
+  const key = segments.map(encodeURIComponent).join("/");
+  const keyScrubber = createValueScrubber([{ value: access.apiKey, name: "AGENT_FS_API_KEY" }]);
+  return {
+    name,
+    load: async (maxBytes) => {
+      try {
+        return await download({ taskId: "chat", name, key, orgId: access.orgId, driveId: access.driveId }, maxBytes, new AgentFsProvider(access));
+      } catch (error) {
+        if (error instanceof ChatFileTooLargeError)
+          throw error;
+        if (error instanceof FilesError && error.code === "Unauthorized") {
+          throw new Error("your agent-fs credential cannot read this path");
+        }
+        throw new Error(keyScrubber.text(error instanceof Error ? error.message : String(error)));
+      }
+    }
+  };
+}
+async function resolveChatAttachmentRefs(refs, taskId, agentId) {
+  let taskAttachments;
+  let access = null;
+  const files = [];
+  for (const ref of refs) {
+    if (UUID_PATTERN.test(ref)) {
+      if (!taskId)
+        return { error: `Attachment ${ref}: no current task to look it up in.` };
+      taskAttachments ??= await getTaskAttachments2(taskId);
+      const attachment = taskAttachments.find((a) => a.id === ref);
+      if (!attachment)
+        return { error: `Attachment ${ref} is not an attachment of task ${taskId}.` };
+      const file = chatFileOfTaskAttachment(attachment);
+      if (!file) {
+        return {
+          error: `Attachment ${ref} (${attachment.kind}) is not stored in the swarm file provider, so it cannot be sent as a file. Post its link instead.`
+        };
+      }
+      files.push(file);
+      continue;
+    }
+    if (access === null)
+      access = await callerAgentFs(agentId);
+    if (!access) {
+      return {
+        error: `Path ${ref}: you have no agent-fs credential and drive to read it with. Attach the file to your task and send its attachment id.`
+      };
+    }
+    try {
+      files.push(chatFileOfPath(ref, access));
+    } catch (error) {
+      return { error: `Path ${ref}: ${errorMessage(error)}` };
+    }
+  }
+  return { files };
+}
+var FETCHED_SLACK_FILE_INTENT = "slack-file";
+async function taskOutputChatFiles(taskId) {
+  return (await getTaskAttachments2(taskId)).flatMap((attachment) => {
+    if (attachment.agentId === null)
+      return [];
+    if (attachment.intent === SHARED_FILE_INTENT || attachment.intent === FETCHED_SLACK_FILE_INTENT) {
+      return [];
+    }
+    const file = chatFileOfTaskAttachment(attachment);
+    return file ? [file] : [];
+  });
+}
+
+// src/integrations/chat-sdk/relay.ts
 var RELAY_GIVE_UP_AFTER_MS = 24 * 60 * 60 * 1000;
 var SWEEP_EVERY_N_TICKS = 20;
 var EARLY_TICK_DEBOUNCE_MS = 250;
@@ -32742,7 +33509,8 @@ async function processPendingChatRelays(now = Date.now(), signal) {
         adapter: target.adapter,
         threadId: target.threadId,
         text: formatChatRelayText(task),
-        taskId: task.id
+        taskId: task.id,
+        files: await taskOutputChatFiles(task.id)
       });
       stopTypingKeepalive(target.threadId);
       await markChatRelayDelivered2(task.id, now);
@@ -33400,43 +34168,6 @@ Original issue: {{issue_key}} — {{issue_summary}}`,
 // src/jira/sync.ts
 init_db3();
 init_oauth();
-
-// src/be/unmapped-identities.ts
-init_db3();
-var TTL_MS = 30 * 24 * 60 * 60 * 1000;
-function namespace(kind) {
-  return `integration:unmapped:${kind}`;
-}
-async function recordUnmappedIdentity(kind, externalId, meta) {
-  const ns = namespace(kind);
-  const now = new Date().toISOString();
-  const expiresAt = Date.now() + TTL_MS;
-  const countKey = `${externalId}:count`;
-  const countBefore = await getKv2(ns, countKey);
-  await upsertKv2({
-    namespace: ns,
-    key: `${externalId}:meta`,
-    value: {
-      lastSeenAt: now,
-      sampleEventType: meta.sampleEventType,
-      sampleContext: meta.sampleContext.slice(0, 100)
-    },
-    valueType: "json",
-    expiresAt
-  });
-  const incremented = await incrKv2(ns, countKey, 1);
-  if (countBefore === null) {
-    await upsertKv2({
-      namespace: ns,
-      key: countKey,
-      value: Number(incremented.value),
-      valueType: "integer",
-      expiresAt
-    });
-  }
-}
-
-// src/jira/sync.ts
 init_users();
 init_resolver();
 init_context_key();
@@ -33822,7 +34553,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-6sv8mhzm.js");
+    const { getSlackApp } = await import("./app-353vre8g.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -33893,7 +34624,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient } = await import("./db-6nf1207q.js");
+  const { getDbClient } = await import("./db-6sfrn9g3.js");
   await getDbClient().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -106993,11 +107724,34 @@ function parseCookieHeader(cookieHeader, name) {
   const match = header.match(re);
   return match ? match[1] : undefined;
 }
-async function extractAndVerifyCookie(req) {
-  const token = parseCookieHeader(req.headers.cookie, "page_session");
-  if (!token)
+var LEGACY_PAGE_SESSION_COOKIE = "page_session";
+var COOKIE_SAFE_PAGE_ID = /^[A-Za-z0-9_-]{1,64}$/;
+function isCookieSafePageId(pageId) {
+  return COOKIE_SAFE_PAGE_ID.test(pageId);
+}
+function pageSessionCookieName(pageId) {
+  return `${LEGACY_PAGE_SESSION_COOKIE}_${pageId}`;
+}
+async function verifyNamedCookie(req, name) {
+  const token = parseCookieHeader(req.headers.cookie, name);
+  const payload = await verifyPageSession(token);
+  return payload && token ? { token, payload } : null;
+}
+async function extractPageSession(req, pageId) {
+  if (!isCookieSafePageId(pageId))
     return null;
-  return verifyPageSession(token);
+  for (const name of [pageSessionCookieName(pageId), LEGACY_PAGE_SESSION_COOKIE]) {
+    const session = await verifyNamedCookie(req, name);
+    if (session?.payload.pageId === pageId)
+      return session;
+  }
+  return null;
+}
+async function extractLegacyPageSession(req) {
+  return verifyNamedCookie(req, LEGACY_PAGE_SESSION_COOKIE);
+}
+async function extractAndVerifyCookie(req, pageId) {
+  return (await extractPageSession(req, pageId))?.payload ?? null;
 }
 var PAGE_SESSION_TTL_SECONDS = 3600;
 async function issuePageSessionCookie(pageId, opts) {
@@ -107009,13 +107763,11 @@ async function issuePageSessionCookie(pageId, opts) {
     ...opts.name ? { name: opts.name } : {},
     ...opts.op ? { op: true } : {}
   });
-  const attrs = [
-    `page_session=${token}`,
-    "HttpOnly",
-    "Path=/",
-    `Max-Age=${PAGE_SESSION_TTL_SECONDS}`
-  ];
-  if (opts.dev) {
+  return buildCookie(pageSessionCookieName(pageId), token, PAGE_SESSION_TTL_SECONDS, opts.dev);
+}
+function buildCookie(name, value, maxAge, dev) {
+  const attrs = [`${name}=${value}`, "HttpOnly", "Path=/", `Max-Age=${maxAge}`];
+  if (dev) {
     attrs.push("SameSite=Lax");
   } else {
     attrs.push("SameSite=None");
@@ -107023,6 +107775,30 @@ async function issuePageSessionCookie(pageId, opts) {
   }
   return attrs.join("; ");
 }
+var MAX_PAGE_SESSION_COOKIES = 20;
+var PAGE_SESSION_COOKIE_RE = new RegExp(`(?:^|;\\s*)(${LEGACY_PAGE_SESSION_COOKIE}_[A-Za-z0-9_-]{1,64})=([^;]*)`, "g");
+async function pageSessionSetCookies(req, pageId, opts) {
+  const issued = await issuePageSessionCookie(pageId, opts);
+  const header = Array.isArray(req.headers.cookie) ? req.headers.cookie.join("; ") : req.headers.cookie ?? "";
+  const keep = [];
+  const evict = new Set;
+  const seen = new Set([pageSessionCookieName(pageId)]);
+  for (const [, name, token] of header.matchAll(PAGE_SESSION_COOKIE_RE)) {
+    if (!name || seen.has(name))
+      continue;
+    seen.add(name);
+    const payload = await verifyPageSession(token);
+    if (payload && name === pageSessionCookieName(payload.pageId)) {
+      keep.push({ name, exp: payload.exp, order: keep.length });
+    } else {
+      evict.add(name);
+    }
+  }
+  keep.sort((a, b) => b.exp - a.exp || b.order - a.order);
+  for (const { name } of keep.slice(MAX_PAGE_SESSION_COOKIES - 1))
+    evict.add(name);
+  return [issued, ...[...evict].map((name) => buildCookie(name, "", 0, opts.dev))];
+}
 
 // src/http/auth.ts
 function extractBearer(req) {
@@ -107243,14 +108019,14 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-x8xbyn1t.js");
+  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-arytgj5q.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
     console.error("[config-reload] telemetry re-init failed (non-fatal):", err);
   });
   await stopSlackApp2();
-  const { resetFileStorageProvider } = await import("./registry-rxw10xzg.js");
+  const { resetFileStorageProvider } = await import("./registry-ajhexe44.js");
   resetFileStorageProvider();
   resetEmbeddingProvider();
   const isEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
@@ -107259,10 +108035,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-y3m0ydzj.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-b9c3az3c.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-gvxjs2py.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-qdkvxeem.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -107453,6 +108229,8 @@ async function handleCore(req, res, myAgentId, apiKey) {
         return true;
       }
       req.headers["x-runtime-instance-id"] = auth.runtimeId;
+    }
+    if (auth.tokenKind !== "task") {
       const sourceHeader = req.headers["x-source-task-id"];
       const taskId = Array.isArray(sourceHeader) ? sourceHeader[0] : sourceHeader;
       if (taskId !== undefined && (await getTaskById2(taskId))?.agentId !== auth.agentId) {
@@ -107672,6 +108450,10 @@ async function handleCore(req, res, myAgentId, apiKey) {
   return false;
 }
 
+// src/mcp-limits.ts
+var MCP_MAX_TOOL_INPUT_ELEMENTS = 25000;
+var MCP_MAX_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
+
 // src/server.ts
 init_resolver();
 init_rbac();
@@ -108788,6 +109570,7 @@ async function runAppAction({
   app,
   name,
   input = {},
+  parentTaskId,
   caller,
   actor
 }) {
@@ -108874,7 +109657,8 @@ async function runAppAction({
     routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
     routingSource: action.agentId || lead ? "engine_default" : undefined,
     key: normalizeAssetKey(`shared/app:${app.id}/action:${name}/`),
-    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
+    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {},
+    ...parentTaskId ? { parentTaskId } : {}
   }, { origin: "app" });
   return {
     status: 200,
@@ -110045,6 +110829,47 @@ init_rbac();
 init_types();
 init_request_auth_context();
 init_secret_scrubber();
+
+// src/http/request-principal.ts
+init_db3();
+init_request_auth_context();
+async function requestPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "controller")
+    return { kind: "guest" };
+  if (auth?.kind === "operator")
+    return { kind: "operator" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (auth?.kind === "guest")
+    return { kind: "guest" };
+  if (!myAgentId)
+    return null;
+  const agent = await getAgentById2(myAgentId);
+  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
+}
+async function agentFirstPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "controller")
+    return { kind: "guest" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (auth?.kind === "guest")
+    return { kind: "guest" };
+  const agentId = auth?.kind === "agent" ? auth.agentId : myAgentId;
+  if (!agentId)
+    return { kind: "operator" };
+  const agent = await getAgentById2(agentId);
+  return { kind: "agent", agentId, isLead: agent?.isLead === true };
+}
+function rejectGuest(req, res) {
+  if (getRequestAuth(req)?.kind !== "guest")
+    return false;
+  jsonError(res, "Forbidden", 403);
+  return true;
+}
+
+// src/http/apps.ts
 var MAX_APP_BODY_BYTES = 5 * 1024 * 1024;
 var MAX_APP_ROW_BODY_BYTES = 1 * 1024 * 1024;
 var MAX_APP_BULK_ROWS_BODY_BYTES = 10 * 1024 * 1024;
@@ -110493,17 +111318,23 @@ var runActionRoute = route({
   method: "post",
   path: "/api/apps/{id}/actions/{name}",
   pattern: ["api", "apps", null, "actions", null],
+  session: bodyTask("parentTaskId"),
   summary: "Run a custom app action",
   description: "Runs the saved script, or creates the agent task, named by the app definition.",
   tags: ["Apps"],
   params: object2({ id: string2().min(1), name: AppNameSchema }),
-  body: object2({ input: record2(string2(), unknown()).optional() }),
+  body: object2({
+    input: record2(string2(), unknown()).optional(),
+    parentTaskId: string2().min(1).optional()
+  }),
   responses: {
     200: { description: "Action invoked", schema: runActionResultSchema },
-    400: { description: "Invalid action input or stale script reference" },
+    400: {
+      description: "Invalid action input, stale script reference, or parentTaskId on a non-task action"
+    },
     403: { description: "Permission denied" },
     409: { description: "App definition needs repair" },
-    404: { description: "App or action not found" }
+    404: { description: "App, action, or parent task not found" }
   },
   rbac: { permission: "app.use" }
 });
@@ -111072,10 +111903,29 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     if (definitionNeedsRepair(res, app))
       return true;
+    if (parsed.body.parentTaskId) {
+      const actions = app.definition.actions;
+      const action = actions && Object.hasOwn(actions, parsed.params.name) ? actions[parsed.params.name] : undefined;
+      if (action && action.kind !== "task") {
+        jsonError(res, "parentTaskId is only supported for task-kind actions", 400);
+        return true;
+      }
+      if (action) {
+        const parentTask = await getTaskById2(parsed.body.parentTaskId);
+        if (!parentTask) {
+          jsonError(res, "parent task not found", 404);
+          return true;
+        }
+        const principal = await agentFirstPrincipal(req, myAgentId);
+        if (await denyParentAttach2(req, res, myAgentId, parentTask, principal))
+          return true;
+      }
+    }
     const output = await runAppAction({
       app,
       name: parsed.params.name,
       input: parsed.body.input,
+      parentTaskId: parsed.body.parentTaskId,
       caller,
       actor
     });
@@ -112652,9 +113502,11 @@ var registerCancelTaskTool = (server) => {
 init_zod();
 
 // src/tools/chat-access.ts
+init_zod();
 init_db3();
 init_rbac();
 init_context_key();
+var chatAttachmentsSchema = array2(string2().min(1)).max(10).optional().describe("Files to send after the text, up to 10: attachment ids of your current task (from get-task-details) or file paths in your agent-fs drive, such as thoughts/<agent-id>/report.pdf, read with your own agent-fs credential. Telegram shows JPEG and PNG as photos, MP4 as video, MP3 and M4A as audio, and anything else as a document. A file over the platform upload limit (Telegram 50 MB, Discord 10 MB) is not sent, and the thread gets a note naming it.");
 async function callerChatThread(requestInfo) {
   if (!requestInfo.agentId)
     return null;
@@ -112735,16 +113587,18 @@ var registerChatPostTool = (server) => {
       adapter: _enum2(CHAT_SDK_ADAPTER_NAMES).describe("Chat SDK adapter name."),
       threadId: string2().min(1).optional().describe("Full SDK thread id, such as telegram:12345 or slack:C123:1700000000.000100."),
       channelId: string2().min(1).optional().describe("Full SDK channel id, such as slack:C123. Ignored when threadId is set."),
-      text: string2().min(1).max(20000).describe("Markdown text to post.")
+      text: string2().min(1).max(20000).describe("Markdown text to post."),
+      attachments: chatAttachmentsSchema
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string2().optional(),
       messageId: string2().optional(),
       adapter: string2().optional(),
       threadId: string2().optional(),
-      channelId: string2().optional()
+      channelId: string2().optional(),
+      unsentFiles: array2(looseObject({ name: string2().optional(), reason: string2().optional() })).optional()
     })
-  }, async ({ adapter, threadId, channelId, text }, requestInfo) => {
+  }, async ({ adapter, threadId, channelId, text, attachments }, requestInfo) => {
     const data = { yourAgentId: requestInfo.agentId };
     const target = threadId ?? channelId;
     if (!target)
@@ -112755,20 +113609,25 @@ var registerChatPostTool = (server) => {
     if (!await canUseChatVerb(requestInfo, "integration.chat.post")) {
       return toolErr("Permission denied. Only the lead can post outside the thread of its task. Use chat-reply for the thread of your current task.", { data });
     }
+    const resolved = await resolveChatAttachmentRefs(attachments ?? [], requestInfo.sourceTaskId, requestInfo.agentId);
+    if ("error" in resolved)
+      return toolErr(resolved.error, { data });
     try {
       const sent = await postChatMessage({
         adapter,
         ...threadId ? { threadId } : { channelId },
         text,
-        taskId: requestInfo.sourceTaskId
+        taskId: requestInfo.sourceTaskId,
+        files: resolved.files
       });
-      return toolOk(`Posted to ${adapter} ${threadId ? "thread" : "channel"} ${target}.`, {
+      return toolOk(`Posted to ${adapter} ${threadId ? "thread" : "channel"} ${target}.${unsentFilesSummary(sent.unsentFiles)}`, {
         data: {
           ...data,
           messageId: sent.messageIds.at(-1),
           adapter: sent.adapter,
           threadId: sent.threadId,
-          channelId: sent.channelId
+          channelId: sent.channelId,
+          unsentFiles: sent.unsentFiles
         }
       });
     } catch (error) {
@@ -112849,18 +113708,20 @@ init_context_key();
 var registerChatReplyTool = (server) => {
   createToolRegistrar(server)("chat-reply", {
     title: "Reply in the chat thread of this task",
-    description: "Post a message to the Telegram, Slack, Discord or Teams thread your current task came from. Works only on a task whose contextKey starts with task:chat-sdk:. The task's final output is posted to the thread automatically when the task ends, so use this only for a question to the user or a short progress note on long work. Markdown is supported; long text is split into several messages.",
+    description: "Post a message to the Telegram, Slack, Discord or Teams thread your current task came from. Works only on a task whose contextKey starts with task:chat-sdk:. The task's final output is posted to the thread automatically when the task ends, so use this only for a question to the user, a short progress note on long work, or to send files (attachments). Markdown is supported; long text is split into several messages. When the final output of a task is posted, the files attached to that task go with it.",
     annotations: { openWorldHint: true },
     inputSchema: object2({
-      text: string2().min(1).max(20000).describe("Markdown text to post to the thread.")
+      text: string2().min(1).max(20000).describe("Markdown text to post to the thread."),
+      attachments: chatAttachmentsSchema
     }),
     outputSchema: swarmToolOutputSchema({
       yourAgentId: string2().optional(),
       messageId: string2().optional(),
       adapter: string2().optional(),
-      threadId: string2().optional()
+      threadId: string2().optional(),
+      unsentFiles: array2(looseObject({ name: string2().optional(), reason: string2().optional() })).optional()
     })
-  }, async ({ text }, requestInfo) => {
+  }, async ({ text, attachments }, requestInfo) => {
     if (!requestInfo.agentId)
       return toolErr("Agent ID not found.");
     const data = { yourAgentId: requestInfo.agentId };
@@ -112874,19 +113735,24 @@ var registerChatReplyTool = (server) => {
     if (!thread) {
       return toolErr(`Task ${task.id} did not come from a chat thread (no task:chat-sdk contextKey). Use the tool of the channel the task came from.`, { data });
     }
+    const resolved = await resolveChatAttachmentRefs(attachments ?? [], task.id, requestInfo.agentId);
+    if ("error" in resolved)
+      return toolErr(resolved.error, { data });
     try {
       const sent = await postChatMessage({
         adapter: thread.adapter,
         threadId: thread.threadId,
         text,
-        taskId: task.id
+        taskId: task.id,
+        files: resolved.files
       });
-      return toolOk(`Posted to ${thread.adapter} thread ${sent.threadId}.`, {
+      return toolOk(`Posted to ${thread.adapter} thread ${sent.threadId}.${unsentFilesSummary(sent.unsentFiles)}`, {
         data: {
           ...data,
           messageId: sent.messageIds.at(-1),
           adapter: sent.adapter,
-          threadId: sent.threadId
+          threadId: sent.threadId,
+          unsentFiles: sent.unsentFiles
         }
       });
     } catch (error) {
@@ -114374,8 +115240,523 @@ init_db3();
 
 // src/tasks/task-terminal-effects.ts
 init_db3();
+
+// src/be/chunking.ts
+var MAX_CHUNK_SIZE = 2000;
+var CHUNK_OVERLAP = 100;
+var MIN_CHUNK_SIZE = 50;
+function chunkContent(text) {
+  const trimmed = text.trim();
+  if (!trimmed || trimmed.length < MIN_CHUNK_SIZE) {
+    return [];
+  }
+  if (trimmed.length <= MAX_CHUNK_SIZE) {
+    return [{ content: trimmed, chunkIndex: 0, totalChunks: 1, headings: [] }];
+  }
+  const sections = splitByHeaders(trimmed);
+  const rawChunks = [];
+  for (const section of sections) {
+    if (section.content.length <= MAX_CHUNK_SIZE) {
+      rawChunks.push(section);
+    } else {
+      const subChunks = recursiveSplit(section.content);
+      for (const sub of subChunks) {
+        rawChunks.push({ content: sub, headings: section.headings });
+      }
+    }
+  }
+  const packed = packSmallSections(rawChunks);
+  return packed.map((c, i) => ({
+    content: c.content,
+    chunkIndex: i,
+    totalChunks: packed.length,
+    headings: c.headings
+  }));
+}
+function renderSection(section) {
+  return section.headings.length > 0 ? `${section.headings.join(" > ")}
+
+${section.content}` : section.content;
+}
+function packSmallSections(sections) {
+  const out = [];
+  let pending = null;
+  const flush = () => {
+    if (pending)
+      out.push({ content: pending.parts.join(`
+
+`), headings: pending.headings });
+    pending = null;
+  };
+  for (const section of sections) {
+    const rendered = renderSection(section);
+    if (section.content.trim().length >= MIN_CHUNK_SIZE) {
+      flush();
+      out.push({ content: rendered, headings: section.headings });
+      continue;
+    }
+    if (pending && pending.length + 2 + rendered.length > MAX_CHUNK_SIZE)
+      flush();
+    if (pending) {
+      pending.parts.push(rendered);
+      pending.length += 2 + rendered.length;
+    } else {
+      pending = { parts: [rendered], length: rendered.length, headings: section.headings };
+    }
+  }
+  flush();
+  return out;
+}
+function splitByHeaders(text) {
+  const lines = text.split(`
+`);
+  const sections = [];
+  let currentContent = [];
+  const headingStack = [];
+  for (const line of lines) {
+    const headingMatch = line.match(/^(#{1,3})\s+(.+)$/);
+    if (headingMatch) {
+      if (currentContent.length > 0) {
+        const content = currentContent.join(`
+`).trim();
+        if (content) {
+          sections.push({ content, headings: [...headingStack] });
+        }
+        currentContent = [];
+      }
+      const level = headingMatch[1].length;
+      const title = headingMatch[2].trim();
+      while (headingStack.length >= level) {
+        headingStack.pop();
+      }
+      headingStack.push(`${"#".repeat(level)} ${title}`);
+    } else {
+      currentContent.push(line);
+    }
+  }
+  if (currentContent.length > 0) {
+    const content = currentContent.join(`
+`).trim();
+    if (content) {
+      sections.push({ content, headings: [...headingStack] });
+    }
+  }
+  if (sections.length === 0) {
+    return [{ content: text, headings: [] }];
+  }
+  return sections;
+}
+var SEPARATORS = [`
+
+`, `
+`, ". ", " "];
+function recursiveSplit(text) {
+  return recursiveSplitWithSeparators(text, 0);
+}
+function recursiveSplitWithSeparators(text, separatorIndex) {
+  if (text.length <= MAX_CHUNK_SIZE) {
+    return [text.trim()].filter((s) => s.length > 0);
+  }
+  if (separatorIndex >= SEPARATORS.length) {
+    return hardSplit(text);
+  }
+  const separator = SEPARATORS[separatorIndex];
+  const parts = text.split(separator);
+  if (parts.length <= 1) {
+    return recursiveSplitWithSeparators(text, separatorIndex + 1);
+  }
+  const chunks = [];
+  let current = "";
+  for (const part of parts) {
+    const candidate = current ? current + separator + part : part;
+    if (candidate.length <= MAX_CHUNK_SIZE) {
+      current = candidate;
+    } else {
+      if (current) {
+        chunks.push(current.trim());
+      }
+      if (part.length > MAX_CHUNK_SIZE) {
+        chunks.push(...recursiveSplitWithSeparators(part, separatorIndex + 1));
+        current = "";
+      } else {
+        current = part;
+      }
+    }
+  }
+  if (current.trim()) {
+    chunks.push(current.trim());
+  }
+  return addOverlap(chunks, text);
+}
+function hardSplit(text) {
+  const chunks = [];
+  let start = 0;
+  while (start < text.length) {
+    const end = Math.min(start + MAX_CHUNK_SIZE, text.length);
+    chunks.push(text.slice(start, end).trim());
+    if (end === text.length)
+      break;
+    start = end - CHUNK_OVERLAP;
+  }
+  return chunks.filter((c) => c.length > 0);
+}
+function addOverlap(chunks, _originalText) {
+  if (chunks.length <= 1)
+    return chunks;
+  const result = [chunks[0]];
+  for (let i = 1;i < chunks.length; i++) {
+    const prevChunk = chunks[i - 1];
+    const chunk = chunks[i];
+    const overlapText = prevChunk.slice(-CHUNK_OVERLAP);
+    if (overlapText.length + chunk.length <= MAX_CHUNK_SIZE + CHUNK_OVERLAP) {
+      result.push(overlapText + chunk);
+    } else {
+      result.push(chunk);
+    }
+  }
+  return result;
+}
+
+// src/be/memory/index-content.ts
 init_memory();
 
+// src/be/memory/key-guard.ts
+init_rbac();
+init_key_paths();
+
+class MemoryKeyError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "MemoryKeyError";
+  }
+}
+var NO_AUTHORITY = {
+  principal: { kind: "agent", agentId: "", isLead: false },
+  source: "http"
+};
+function shapeError(key, origin) {
+  if (key.length <= MEMORY_KEY_MAX_LENGTH && MEMORY_KEY_PATTERN.test(key))
+    return null;
+  const subject = origin === "sourcePath" ? `sourcePath "${key}" starts with ${LONGTERM_ROOT}, so it is used as the key, but it is not a valid key.` : `Key "${key}" is not a valid key.`;
+  return `${subject} ${MEMORY_KEY_PATTERN_MESSAGE}`;
+}
+function assertKeyWritable(key, origin, writer) {
+  if (origin === "sourcePath" && !isLongtermKey(key))
+    return;
+  const shape = shapeError(key, origin);
+  if (shape)
+    throw new MemoryKeyError(shape, "invalid");
+  const pathError = longtermKeyError(key);
+  if (pathError)
+    throw new MemoryKeyError(pathError, "invalid");
+  if (!isConsolidatedKey(key))
+    return;
+  const { principal, source } = writer ?? NO_AUTHORITY;
+  const decision = can({
+    principal,
+    verb: "memory.write.consolidated",
+    resource: { kind: "none" },
+    source
+  });
+  if (!decision.allow)
+    throw new MemoryKeyError(consolidatedKeyMessage(key), "forbidden");
+}
+
+// src/be/memory/link-resolver.ts
+init_db3();
+init_constants2();
+var WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
+var PR_HASH_RE = /(?:^|[\s(])#(\d{1,5})(?=[\s,.)!?]|$)/gm;
+var PR_PREFIX_RE = /\bPR\s*#(\d{1,5})\b/gi;
+var GITHUB_PR_URL_RE = /https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+)\/pull\/(\d+)/g;
+var AGENT_FS_LIVE_HOSTS = String.raw`agent-fs|live\.agent-fs\.dev`;
+var AGENT_FS_FILE_ROUTE = String.raw`\/file\/~\/([a-f0-9-]+)\/([a-f0-9-]+)\/([\w/.%-]+)`;
+var AGENT_UI_PAGE_RE = /(?:app\.[^/]+|localhost:\d+)\/pages\/([a-f0-9-]+)/g;
+var AGENT_UI_TASK_RE = /(?:app\.[^/]+|localhost:\d+)\/tasks\/([a-f0-9-]+)/g;
+var wikilinkMatcher = (content) => {
+  const results = [];
+  for (const match of content.matchAll(WIKILINK_RE)) {
+    const name = match[1].trim();
+    if (!name)
+      continue;
+    results.push({
+      linkType: "wikilink",
+      targetKind: "memory",
+      targetId: name,
+      sourceText: match[0],
+      resolver: "wikilink"
+    });
+  }
+  return results;
+};
+var prMatcher = (content) => {
+  const results = [];
+  const seen = new Set;
+  for (const match of content.matchAll(GITHUB_PR_URL_RE)) {
+    const id = `github:${match[1]}/${match[2]}#${match[3]}`;
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    results.push({
+      linkType: "pr",
+      targetKind: "pr",
+      targetId: id,
+      sourceText: match[0],
+      resolver: "pr-url",
+      metadata: { owner: match[1], repo: match[2], number: Number(match[3]) }
+    });
+  }
+  for (const match of content.matchAll(PR_PREFIX_RE)) {
+    const id = `pr:${match[1]}`;
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    results.push({
+      linkType: "pr",
+      targetKind: "pr",
+      targetId: id,
+      sourceText: match[0].trim(),
+      resolver: "pr-prefix",
+      metadata: { number: Number(match[1]) }
+    });
+  }
+  for (const match of content.matchAll(PR_HASH_RE)) {
+    const id = `pr:${match[1]}`;
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    results.push({
+      linkType: "pr",
+      targetKind: "pr",
+      targetId: id,
+      sourceText: `#${match[1]}`,
+      resolver: "pr-hash",
+      metadata: { number: Number(match[1]) }
+    });
+  }
+  return results;
+};
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
+function agentFsPathRegex() {
+  const appHosts = getConfiguredAppUrls().flatMap((value) => {
+    try {
+      const url = new URL(value);
+      return [escapeRegExp2(`${url.host}${url.pathname.replace(/\/+$/, "")}`)];
+    } catch {
+      return [];
+    }
+  });
+  const hosts = [AGENT_FS_LIVE_HOSTS, ...appHosts, String.raw`localhost:\d+`].join("|");
+  return new RegExp(`(?<![\\w.-])(?:${hosts})${AGENT_FS_FILE_ROUTE}`, "gi");
+}
+var agentFsMatcher = (content) => {
+  const results = [];
+  for (const match of content.matchAll(agentFsPathRegex())) {
+    const orgId = match[1];
+    const driveId = match[2];
+    const path = match[3];
+    results.push({
+      linkType: "agent-fs-file",
+      targetKind: "agent-fs-file",
+      targetId: `${orgId}/${driveId}/${path}`,
+      sourceText: match[0],
+      resolver: "agent-fs-path",
+      metadata: { orgId, driveId, path }
+    });
+  }
+  return results;
+};
+var agentUiMatcher = (content) => {
+  const results = [];
+  for (const match of content.matchAll(AGENT_UI_PAGE_RE)) {
+    results.push({
+      linkType: "agent-ui",
+      targetKind: "agent-ui",
+      targetId: `page:${match[1]}`,
+      sourceText: match[0],
+      resolver: "agent-ui-page"
+    });
+  }
+  for (const match of content.matchAll(AGENT_UI_TASK_RE)) {
+    results.push({
+      linkType: "agent-ui",
+      targetKind: "agent-ui",
+      targetId: `task:${match[1]}`,
+      sourceText: match[0],
+      resolver: "agent-ui-task"
+    });
+  }
+  return results;
+};
+var MATCHERS = [wikilinkMatcher, prMatcher, agentFsMatcher, agentUiMatcher];
+function resolveLinks(content) {
+  const results = [];
+  for (const matcher of MATCHERS) {
+    for (const link of matcher(content)) {
+      results.push({ ...link, strength: 1 });
+    }
+  }
+  return results;
+}
+async function resolveWikilinksToMemoryIds(agentId, links) {
+  const db = getDbClient2();
+  const resolved = [];
+  for (const link of links) {
+    if (link.linkType !== "wikilink") {
+      resolved.push(link);
+      continue;
+    }
+    const row = await db.get("SELECT id FROM agent_memory WHERE name = ? AND (agentId = ? OR scope = 'swarm') LIMIT 1", [link.targetId, agentId]);
+    resolved.push(row ? { ...link, targetId: row.id } : link);
+  }
+  return resolved;
+}
+var INSERT_LINK_SQL = `INSERT OR IGNORE INTO memory_link
+   (id, from_memory_id, linkType, targetKind, targetId, strength, resolver, sourceText, metadata, createdAt, updatedAt)
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+function insertLinkArgs(memoryId, link, now) {
+  return [
+    crypto.randomUUID(),
+    memoryId,
+    link.linkType,
+    link.targetKind,
+    link.targetId,
+    link.strength,
+    link.resolver,
+    link.sourceText,
+    link.metadata ? JSON.stringify(link.metadata) : null,
+    now,
+    now
+  ];
+}
+async function storeLinks(memoryId, agentId, content) {
+  const links = resolveLinks(content);
+  if (links.length === 0)
+    return;
+  const resolved = await resolveWikilinksToMemoryIds(agentId, links);
+  const now = new Date().toISOString();
+  await getDbClient2().transaction(async (tx) => {
+    for (const link of resolved) {
+      await tx.run(INSERT_LINK_SQL, insertLinkArgs(memoryId, link, now));
+    }
+  });
+}
+function linkIdentity2(link) {
+  return JSON.stringify([link.linkType, link.targetKind, link.targetId, link.sourceText ?? null]);
+}
+async function refreshLinks(memoryId, agentId, content) {
+  const resolved = await resolveWikilinksToMemoryIds(agentId, resolveLinks(content));
+  const nextIdentities = new Set(resolved.map((link) => linkIdentity2(link)));
+  const now = new Date().toISOString();
+  await getDbClient2().transaction(async (tx) => {
+    const existing = await tx.query(`SELECT id, linkType, targetKind, targetId, sourceText
+       FROM memory_link
+      WHERE from_memory_id = ? AND linkType != 'sequel'`, [memoryId]);
+    for (const row of existing) {
+      if (!nextIdentities.has(linkIdentity2(row))) {
+        await tx.run("DELETE FROM memory_link WHERE id = ?", [row.id]);
+      }
+    }
+    for (const link of resolved) {
+      await tx.run(INSERT_LINK_SQL, insertLinkArgs(memoryId, link, now));
+    }
+  });
+}
+
+// src/be/memory/index-content.ts
+init_secret_scrubber();
+function taskCompletionMemoryKey(taskId) {
+  return `/task-completions/${taskId.toLowerCase().replace(/[^a-z0-9._-]/g, "-")}`;
+}
+async function indexMemoryContent(params) {
+  const { agentId, content, name, scope, source, sourceTaskId, sourcePath, tags } = params;
+  const rowKey = params.key ?? (sourcePath || null);
+  if (rowKey)
+    assertKeyWritable(rowKey, params.key != null ? "key" : "sourcePath", params.writer);
+  const contentChunks = chunkContent(content);
+  if (contentChunks.length === 0) {
+    contentChunks.push({
+      content: content.trim(),
+      chunkIndex: 0,
+      totalChunks: 1,
+      headings: []
+    });
+  }
+  const store = getMemoryStore2();
+  const provider = getEmbeddingProvider2();
+  if (sourcePath && agentId && contentChunks.length === 1) {
+    const existing = (await store.list(agentId, {
+      scope,
+      limit: 2,
+      ownerAgentId: agentId,
+      sourcePath
+    })).filter((memory) => memory.sourcePath === sourcePath);
+    if (existing.length === 1 && existing[0]?.totalChunks === 1) {
+      const result = await store.edit({
+        id: existing[0].id,
+        mode: "replace",
+        content: contentChunks[0].content,
+        intent: "re-index memory source path",
+        changedByAgentId: agentId
+      });
+      const embedding = await provider.embed(result.memory.content);
+      if (embedding)
+        await store.updateEmbedding(result.memory.id, embedding, provider.name);
+      try {
+        await refreshLinks(result.memory.id, agentId, result.memory.content);
+      } catch (err) {
+        console.error(`[memory] Link resolution failed for ${result.memory.id}:`, err.message);
+      }
+      return { queued: false, memoryIds: [result.memory.id], edited: result.changed, chunks: 1 };
+    }
+  }
+  if (sourcePath && agentId) {
+    await store.deleteBySourcePath(sourcePath, agentId);
+  }
+  const inputs = contentChunks.map((chunk) => ({
+    agentId: agentId || null,
+    content: chunk.content,
+    name,
+    scope,
+    source,
+    sourcePath: sourcePath || null,
+    sourceTaskId: sourceTaskId || null,
+    chunkIndex: chunk.chunkIndex,
+    totalChunks: chunk.totalChunks,
+    tags: tags || [],
+    contextKey: params.contextKey ?? null,
+    intent: params.intent ?? "index memory content",
+    key: rowKey
+  }));
+  const memories = params.replaceExisting && params.key ? await store.replaceDocument({ key: params.key, scope, agentId: agentId || null, source }, inputs) : await store.storeBatch(inputs);
+  if (agentId) {
+    for (const memory of memories) {
+      try {
+        await storeLinks(memory.id, agentId, memory.content);
+      } catch (err) {
+        console.error(`[memory] Link resolution failed for ${memory.id}:`, err.message);
+      }
+    }
+  }
+  (async () => {
+    try {
+      const embeddings = await provider.embedBatch(memories.map((m) => m.content));
+      for (let i = 0;i < embeddings.length; i++) {
+        if (embeddings[i]) {
+          await store.updateEmbedding(memories[i].id, embeddings[i], provider.name);
+        }
+      }
+    } catch (err) {
+      console.error("[memory] Batch embedding failed:", err.message);
+    }
+  })().catch((err) => console.error("[memory] batch embed failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
+  return { queued: true, memoryIds: memories.map((m) => m.id), chunks: contentChunks.length };
+}
+
 // src/be/memory/raters/retrieval.ts
 init_db3();
 function dedupeMemoryDocumentIds(memories) {
@@ -115131,40 +116512,39 @@ ${safeFailureReason || "No reason provided"}
 This task failed. Learn from this to avoid repeating the mistake.`;
         if (taskContent.length < 30)
           return;
-        const store = getMemoryStore2();
-        const provider = getEmbeddingProvider2();
-        const memory = await store.store({
+        const key = taskCompletionMemoryKey(taskId);
+        await indexMemoryContent({
           agentId: agentId ?? null,
           content: taskContent,
           name: `Task: ${safeTask.slice(0, 80)}`,
           scope: "agent",
           source: "task_completion",
-          sourceTaskId: taskId
+          sourceTaskId: taskId,
+          key,
+          intent: "task completion memory",
+          replaceExisting: true
         });
-        const embedding = await provider.embed(taskContent);
-        if (embedding) {
-          await store.updateEmbedding(memory.id, embedding, provider.name);
-        }
         const shouldShareWithSwarm = status === "completed" && (task.taskType === "research" || task.tags?.includes("knowledge") || task.tags?.includes("shared"));
         if (shouldShareWithSwarm) {
           try {
-            const swarmMemory = await store.store({
+            await indexMemoryContent({
               agentId: agentId ?? null,
-              scope: "swarm",
-              name: `Shared: ${safeTask.slice(0, 80)}`,
               content: `Task completed by agent ${agentId}:
 
 ${taskContent}`,
+              name: `Shared: ${safeTask.slice(0, 80)}`,
+              scope: "swarm",
               source: "task_completion",
-              sourceTaskId: taskId
+              sourceTaskId: taskId,
+              key,
+              intent: "task completion memory",
+              replaceExisting: true
             });
-            const swarmEmbedding = await provider.embed(taskContent);
-            if (swarmEmbedding) {
-              await store.updateEmbedding(swarmMemory.id, swarmEmbedding, provider.name);
-            }
           } catch {}
         }
-      } catch {}
+      } catch (err) {
+        console.error("[task-terminal-effects] task completion memory write failed:", scrubSecrets(err instanceof Error ? err.message : String(err)));
+      }
     })().catch((err) => console.error("[task-terminal-effects] task completion memory write failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
   }
   (async () => {
@@ -117855,258 +119235,7 @@ var registerMemoryDeleteTool = (server) => {
 init_zod();
 init_db3();
 init_memory();
-
-// src/be/memory/key-guard.ts
-init_rbac();
 init_key_paths();
-
-class MemoryKeyError extends Error {
-  reason;
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "MemoryKeyError";
-  }
-}
-var NO_AUTHORITY = {
-  principal: { kind: "agent", agentId: "", isLead: false },
-  source: "http"
-};
-function shapeError(key, origin) {
-  if (key.length <= MEMORY_KEY_MAX_LENGTH && MEMORY_KEY_PATTERN.test(key))
-    return null;
-  const subject = origin === "sourcePath" ? `sourcePath "${key}" starts with ${LONGTERM_ROOT}, so it is used as the key, but it is not a valid key.` : `Key "${key}" is not a valid key.`;
-  return `${subject} ${MEMORY_KEY_PATTERN_MESSAGE}`;
-}
-function assertKeyWritable(key, origin, writer) {
-  if (origin === "sourcePath" && !isLongtermKey(key))
-    return;
-  const shape = shapeError(key, origin);
-  if (shape)
-    throw new MemoryKeyError(shape, "invalid");
-  const pathError = longtermKeyError(key);
-  if (pathError)
-    throw new MemoryKeyError(pathError, "invalid");
-  if (!isConsolidatedKey(key))
-    return;
-  const { principal, source } = writer ?? NO_AUTHORITY;
-  const decision = can({
-    principal,
-    verb: "memory.write.consolidated",
-    resource: { kind: "none" },
-    source
-  });
-  if (!decision.allow)
-    throw new MemoryKeyError(consolidatedKeyMessage(key), "forbidden");
-}
-
-// src/tools/memory-edit.ts
-init_key_paths();
-
-// src/be/memory/link-resolver.ts
-init_db3();
-init_constants2();
-var WIKILINK_RE = /\[\[([^\]]+)\]\]/g;
-var PR_HASH_RE = /(?:^|[\s(])#(\d{1,5})(?=[\s,.)!?]|$)/gm;
-var PR_PREFIX_RE = /\bPR\s*#(\d{1,5})\b/gi;
-var GITHUB_PR_URL_RE = /https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+)\/pull\/(\d+)/g;
-var AGENT_FS_LIVE_HOSTS = String.raw`agent-fs|live\.agent-fs\.dev`;
-var AGENT_FS_FILE_ROUTE = String.raw`\/file\/~\/([a-f0-9-]+)\/([a-f0-9-]+)\/([\w/.%-]+)`;
-var AGENT_UI_PAGE_RE = /(?:app\.[^/]+|localhost:\d+)\/pages\/([a-f0-9-]+)/g;
-var AGENT_UI_TASK_RE = /(?:app\.[^/]+|localhost:\d+)\/tasks\/([a-f0-9-]+)/g;
-var wikilinkMatcher = (content) => {
-  const results = [];
-  for (const match of content.matchAll(WIKILINK_RE)) {
-    const name = match[1].trim();
-    if (!name)
-      continue;
-    results.push({
-      linkType: "wikilink",
-      targetKind: "memory",
-      targetId: name,
-      sourceText: match[0],
-      resolver: "wikilink"
-    });
-  }
-  return results;
-};
-var prMatcher = (content) => {
-  const results = [];
-  const seen = new Set;
-  for (const match of content.matchAll(GITHUB_PR_URL_RE)) {
-    const id = `github:${match[1]}/${match[2]}#${match[3]}`;
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    results.push({
-      linkType: "pr",
-      targetKind: "pr",
-      targetId: id,
-      sourceText: match[0],
-      resolver: "pr-url",
-      metadata: { owner: match[1], repo: match[2], number: Number(match[3]) }
-    });
-  }
-  for (const match of content.matchAll(PR_PREFIX_RE)) {
-    const id = `pr:${match[1]}`;
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    results.push({
-      linkType: "pr",
-      targetKind: "pr",
-      targetId: id,
-      sourceText: match[0].trim(),
-      resolver: "pr-prefix",
-      metadata: { number: Number(match[1]) }
-    });
-  }
-  for (const match of content.matchAll(PR_HASH_RE)) {
-    const id = `pr:${match[1]}`;
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    results.push({
-      linkType: "pr",
-      targetKind: "pr",
-      targetId: id,
-      sourceText: `#${match[1]}`,
-      resolver: "pr-hash",
-      metadata: { number: Number(match[1]) }
-    });
-  }
-  return results;
-};
-function escapeRegExp2(value) {
-  return value.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
-}
-function agentFsPathRegex() {
-  const appHosts = getConfiguredAppUrls().flatMap((value) => {
-    try {
-      const url = new URL(value);
-      return [escapeRegExp2(`${url.host}${url.pathname.replace(/\/+$/, "")}`)];
-    } catch {
-      return [];
-    }
-  });
-  const hosts = [AGENT_FS_LIVE_HOSTS, ...appHosts, String.raw`localhost:\d+`].join("|");
-  return new RegExp(`(?<![\\w.-])(?:${hosts})${AGENT_FS_FILE_ROUTE}`, "gi");
-}
-var agentFsMatcher = (content) => {
-  const results = [];
-  for (const match of content.matchAll(agentFsPathRegex())) {
-    const orgId = match[1];
-    const driveId = match[2];
-    const path = match[3];
-    results.push({
-      linkType: "agent-fs-file",
-      targetKind: "agent-fs-file",
-      targetId: `${orgId}/${driveId}/${path}`,
-      sourceText: match[0],
-      resolver: "agent-fs-path",
-      metadata: { orgId, driveId, path }
-    });
-  }
-  return results;
-};
-var agentUiMatcher = (content) => {
-  const results = [];
-  for (const match of content.matchAll(AGENT_UI_PAGE_RE)) {
-    results.push({
-      linkType: "agent-ui",
-      targetKind: "agent-ui",
-      targetId: `page:${match[1]}`,
-      sourceText: match[0],
-      resolver: "agent-ui-page"
-    });
-  }
-  for (const match of content.matchAll(AGENT_UI_TASK_RE)) {
-    results.push({
-      linkType: "agent-ui",
-      targetKind: "agent-ui",
-      targetId: `task:${match[1]}`,
-      sourceText: match[0],
-      resolver: "agent-ui-task"
-    });
-  }
-  return results;
-};
-var MATCHERS = [wikilinkMatcher, prMatcher, agentFsMatcher, agentUiMatcher];
-function resolveLinks(content) {
-  const results = [];
-  for (const matcher of MATCHERS) {
-    for (const link of matcher(content)) {
-      results.push({ ...link, strength: 1 });
-    }
-  }
-  return results;
-}
-async function resolveWikilinksToMemoryIds(agentId, links) {
-  const db = getDbClient2();
-  const resolved = [];
-  for (const link of links) {
-    if (link.linkType !== "wikilink") {
-      resolved.push(link);
-      continue;
-    }
-    const row = await db.get("SELECT id FROM agent_memory WHERE name = ? AND (agentId = ? OR scope = 'swarm') LIMIT 1", [link.targetId, agentId]);
-    resolved.push(row ? { ...link, targetId: row.id } : link);
-  }
-  return resolved;
-}
-var INSERT_LINK_SQL = `INSERT OR IGNORE INTO memory_link
-   (id, from_memory_id, linkType, targetKind, targetId, strength, resolver, sourceText, metadata, createdAt, updatedAt)
- VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
-function insertLinkArgs(memoryId, link, now) {
-  return [
-    crypto.randomUUID(),
-    memoryId,
-    link.linkType,
-    link.targetKind,
-    link.targetId,
-    link.strength,
-    link.resolver,
-    link.sourceText,
-    link.metadata ? JSON.stringify(link.metadata) : null,
-    now,
-    now
-  ];
-}
-async function storeLinks(memoryId, agentId, content) {
-  const links = resolveLinks(content);
-  if (links.length === 0)
-    return;
-  const resolved = await resolveWikilinksToMemoryIds(agentId, links);
-  const now = new Date().toISOString();
-  await getDbClient2().transaction(async (tx) => {
-    for (const link of resolved) {
-      await tx.run(INSERT_LINK_SQL, insertLinkArgs(memoryId, link, now));
-    }
-  });
-}
-function linkIdentity2(link) {
-  return JSON.stringify([link.linkType, link.targetKind, link.targetId, link.sourceText ?? null]);
-}
-async function refreshLinks(memoryId, agentId, content) {
-  const resolved = await resolveWikilinksToMemoryIds(agentId, resolveLinks(content));
-  const nextIdentities = new Set(resolved.map((link) => linkIdentity2(link)));
-  const now = new Date().toISOString();
-  await getDbClient2().transaction(async (tx) => {
-    const existing = await tx.query(`SELECT id, linkType, targetKind, targetId, sourceText
-       FROM memory_link
-      WHERE from_memory_id = ? AND linkType != 'sequel'`, [memoryId]);
-    for (const row of existing) {
-      if (!nextIdentities.has(linkIdentity2(row))) {
-        await tx.run("DELETE FROM memory_link WHERE id = ?", [row.id]);
-      }
-    }
-    for (const link of resolved) {
-      await tx.run(INSERT_LINK_SQL, insertLinkArgs(memoryId, link, now));
-    }
-  });
-}
-
-// src/tools/memory-edit.ts
 init_rbac();
 init_types();
 var agentMemoryOutputSchema = looseObject({
@@ -118670,6 +119799,7 @@ async function expandCandidatesWithGraph(candidates, agentId, options = {}) {
 // src/tools/memory-search.ts
 init_key_paths();
 init_reranker();
+init_search_candidates();
 init_types();
 var NUDGE_ELIGIBLE_SOURCES2 = new Set(["manual", "file_index"]);
 function rateHintFor(memoryId) {
@@ -118725,7 +119855,7 @@ var registerMemorySearchTool = (server) => {
     const store = getMemoryStore2();
     const queryEmbedding = await provider.embed(query);
     const candidateLimit = limit * CANDIDATE_SET_MULTIPLIER;
-    const candidates = await store.search(queryEmbedding ?? new Float32Array(0), requestInfo.agentId, {
+    const candidates = await searchMemoryCandidates(store, queryEmbedding ?? new Float32Array(0), requestInfo.agentId, {
       scope,
       limit: candidateLimit,
       source,
@@ -118813,242 +119943,6 @@ var registerMemorySearchTool = (server) => {
 // src/tools/memory-store.ts
 init_zod();
 init_db3();
-
-// src/be/chunking.ts
-var MAX_CHUNK_SIZE = 2000;
-var CHUNK_OVERLAP = 100;
-var MIN_CHUNK_SIZE = 50;
-function chunkContent(text) {
-  const trimmed = text.trim();
-  if (!trimmed || trimmed.length < MIN_CHUNK_SIZE) {
-    return [];
-  }
-  if (trimmed.length <= MAX_CHUNK_SIZE) {
-    return [{ content: trimmed, chunkIndex: 0, totalChunks: 1, headings: [] }];
-  }
-  const sections = splitByHeaders(trimmed);
-  const rawChunks = [];
-  for (const section of sections) {
-    if (section.content.length <= MAX_CHUNK_SIZE) {
-      rawChunks.push(section);
-    } else {
-      const subChunks = recursiveSplit(section.content);
-      for (const sub of subChunks) {
-        rawChunks.push({ content: sub, headings: section.headings });
-      }
-    }
-  }
-  const filtered = rawChunks.filter((c) => c.content.trim().length >= MIN_CHUNK_SIZE);
-  if (filtered.length === 0) {
-    return [{ content: trimmed, chunkIndex: 0, totalChunks: 1, headings: [] }];
-  }
-  return filtered.map((c, i) => ({
-    content: c.headings.length > 0 ? `${c.headings.join(" > ")}
-
-${c.content}` : c.content,
-    chunkIndex: i,
-    totalChunks: filtered.length,
-    headings: c.headings
-  }));
-}
-function splitByHeaders(text) {
-  const lines = text.split(`
-`);
-  const sections = [];
-  let currentContent = [];
-  const headingStack = [];
-  for (const line of lines) {
-    const headingMatch = line.match(/^(#{1,3})\s+(.+)$/);
-    if (headingMatch) {
-      if (currentContent.length > 0) {
-        const content = currentContent.join(`
-`).trim();
-        if (content) {
-          sections.push({ content, headings: [...headingStack] });
-        }
-        currentContent = [];
-      }
-      const level = headingMatch[1].length;
-      const title = headingMatch[2].trim();
-      while (headingStack.length >= level) {
-        headingStack.pop();
-      }
-      headingStack.push(`${"#".repeat(level)} ${title}`);
-    } else {
-      currentContent.push(line);
-    }
-  }
-  if (currentContent.length > 0) {
-    const content = currentContent.join(`
-`).trim();
-    if (content) {
-      sections.push({ content, headings: [...headingStack] });
-    }
-  }
-  if (sections.length === 0) {
-    return [{ content: text, headings: [] }];
-  }
-  return sections;
-}
-var SEPARATORS = [`
-
-`, `
-`, ". ", " "];
-function recursiveSplit(text) {
-  return recursiveSplitWithSeparators(text, 0);
-}
-function recursiveSplitWithSeparators(text, separatorIndex) {
-  if (text.length <= MAX_CHUNK_SIZE) {
-    return [text.trim()].filter((s) => s.length > 0);
-  }
-  if (separatorIndex >= SEPARATORS.length) {
-    return hardSplit(text);
-  }
-  const separator = SEPARATORS[separatorIndex];
-  const parts = text.split(separator);
-  if (parts.length <= 1) {
-    return recursiveSplitWithSeparators(text, separatorIndex + 1);
-  }
-  const chunks = [];
-  let current = "";
-  for (const part of parts) {
-    const candidate = current ? current + separator + part : part;
-    if (candidate.length <= MAX_CHUNK_SIZE) {
-      current = candidate;
-    } else {
-      if (current) {
-        chunks.push(current.trim());
-      }
-      if (part.length > MAX_CHUNK_SIZE) {
-        chunks.push(...recursiveSplitWithSeparators(part, separatorIndex + 1));
-        current = "";
-      } else {
-        current = part;
-      }
-    }
-  }
-  if (current.trim()) {
-    chunks.push(current.trim());
-  }
-  return addOverlap(chunks, text);
-}
-function hardSplit(text) {
-  const chunks = [];
-  let start = 0;
-  while (start < text.length) {
-    const end = Math.min(start + MAX_CHUNK_SIZE, text.length);
-    chunks.push(text.slice(start, end).trim());
-    if (end === text.length)
-      break;
-    start = end - CHUNK_OVERLAP;
-  }
-  return chunks.filter((c) => c.length > 0);
-}
-function addOverlap(chunks, _originalText) {
-  if (chunks.length <= 1)
-    return chunks;
-  const result = [chunks[0]];
-  for (let i = 1;i < chunks.length; i++) {
-    const prevChunk = chunks[i - 1];
-    const chunk = chunks[i];
-    const overlapText = prevChunk.slice(-CHUNK_OVERLAP);
-    if (overlapText.length + chunk.length <= MAX_CHUNK_SIZE + CHUNK_OVERLAP) {
-      result.push(overlapText + chunk);
-    } else {
-      result.push(chunk);
-    }
-  }
-  return result;
-}
-
-// src/be/memory/index-content.ts
-init_memory();
-init_secret_scrubber();
-async function indexMemoryContent(params) {
-  const { agentId, content, name, scope, source, sourceTaskId, sourcePath, tags } = params;
-  const rowKey = params.key ?? (sourcePath || null);
-  if (rowKey)
-    assertKeyWritable(rowKey, params.key != null ? "key" : "sourcePath", params.writer);
-  const contentChunks = chunkContent(content);
-  if (contentChunks.length === 0) {
-    contentChunks.push({
-      content: content.trim(),
-      chunkIndex: 0,
-      totalChunks: 1,
-      headings: []
-    });
-  }
-  const store = getMemoryStore2();
-  const provider = getEmbeddingProvider2();
-  if (sourcePath && agentId && contentChunks.length === 1) {
-    const existing = (await store.list(agentId, {
-      scope,
-      limit: 2,
-      ownerAgentId: agentId,
-      sourcePath
-    })).filter((memory) => memory.sourcePath === sourcePath);
-    if (existing.length === 1 && existing[0]?.totalChunks === 1) {
-      const result = await store.edit({
-        id: existing[0].id,
-        mode: "replace",
-        content: contentChunks[0].content,
-        intent: "re-index memory source path",
-        changedByAgentId: agentId
-      });
-      const embedding = await provider.embed(result.memory.content);
-      if (embedding)
-        await store.updateEmbedding(result.memory.id, embedding, provider.name);
-      try {
-        await refreshLinks(result.memory.id, agentId, result.memory.content);
-      } catch (err) {
-        console.error(`[memory] Link resolution failed for ${result.memory.id}:`, err.message);
-      }
-      return { queued: false, memoryIds: [result.memory.id], edited: result.changed, chunks: 1 };
-    }
-  }
-  if (sourcePath && agentId) {
-    await store.deleteBySourcePath(sourcePath, agentId);
-  }
-  const memories = await store.storeBatch(contentChunks.map((chunk) => ({
-    agentId: agentId || null,
-    content: chunk.content,
-    name,
-    scope,
-    source,
-    sourcePath: sourcePath || null,
-    sourceTaskId: sourceTaskId || null,
-    chunkIndex: chunk.chunkIndex,
-    totalChunks: chunk.totalChunks,
-    tags: tags || [],
-    contextKey: params.contextKey ?? null,
-    intent: params.intent ?? "index memory content",
-    key: rowKey
-  })));
-  if (agentId) {
-    for (const memory of memories) {
-      try {
-        await storeLinks(memory.id, agentId, memory.content);
-      } catch (err) {
-        console.error(`[memory] Link resolution failed for ${memory.id}:`, err.message);
-      }
-    }
-  }
-  (async () => {
-    try {
-      const embeddings = await provider.embedBatch(memories.map((m) => m.content));
-      for (let i = 0;i < embeddings.length; i++) {
-        if (embeddings[i]) {
-          await store.updateEmbedding(memories[i].id, embeddings[i], provider.name);
-        }
-      }
-    } catch (err) {
-      console.error("[memory] Batch embedding failed:", err.message);
-    }
-  })().catch((err) => console.error("[memory] batch embed failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-  return { queued: true, memoryIds: memories.map((m) => m.id), chunks: contentChunks.length };
-}
-
-// src/tools/memory-store.ts
 init_key_paths();
 init_types();
 var registerMemoryStoreTool = (server) => {
@@ -131584,33 +132478,35 @@ function formatFileSize2(bytes) {
     return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
   return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
 }
-function buildAttachmentText(files, failed = []) {
+function buildAttachmentText(files, failed = [], notes = new Map) {
   const reasons = new Map(failed.map((f) => [f.file.id, f.reason]));
   return files.map((f) => {
     const size = typeof f.size === "number" ? formatFileSize2(f.size) : "unknown size";
     const line = `[File: ${f.name ?? f.id} (${f.mimetype ?? "unknown type"}, ${size}) id=${f.id}]`;
     const reason = reasons.get(f.id);
-    return reason ? `${line} (not attached: ${reason})` : line;
+    const note = notes.get(f.id);
+    return [reason ? `${line} (not attached: ${reason})` : line, note].filter(Boolean).join(`
+`);
   }).join(`
 `);
 }
-function buildEffectiveText(text, files, failed) {
+function buildEffectiveText(text, files, failed, notes) {
   const hasText = !!text?.trim();
   const hasFiles = files && files.length > 0;
   if (hasText && hasFiles) {
     return `${text}
 
-${buildAttachmentText(files, failed)}`;
+${buildAttachmentText(files, failed, notes)}`;
   }
   if (hasFiles) {
-    return buildAttachmentText(files, failed);
+    return buildAttachmentText(files, failed, notes);
   }
   return text || "";
 }
 function bufferedFileFailures(files) {
   return (files ?? []).map((file) => ({ file, reason: BUFFERED_REASON }));
 }
-async function fetchSlackFiles(client, files) {
+async function fetchSlackFiles(client, files, options = {}) {
   let dir;
   const result = {
     files: [],
@@ -131636,8 +132532,19 @@ async function fetchSlackFiles(client, files) {
       result.fetched.push({ file, ...outcome });
     }
   }
+  if (options.transcribe) {
+    result.notes = await transcribeAudioNotes(result.fetched.filter(({ file }) => isSlackAudio(file)).map(({ file, path }) => ({
+      key: file.id,
+      name: file.name ?? file.id,
+      data: Bun.file(path),
+      mimeType: file.mimetype
+    })), "[Slack]");
+  }
   return result;
 }
+function isSlackAudio(file) {
+  return file.subtype === "slack_audio" || Boolean(file.mimetype?.startsWith("audio/"));
+}
 function looksLikeSignIn(head) {
   const joined = new Uint8Array(head.reduce((total, part) => total + part.byteLength, 0));
   let offset = 0;
@@ -133851,9 +134758,9 @@ var registerSystemOneDecideTool = (server) => {
   createToolRegistrar(server)("system-one-decide", {
     title: "Ask a SystemOne decision model",
     annotations: { destructiveHint: false, openWorldHint: true },
-    description: "Send a state and typed questions (noul, choice, score) to a SystemOne decision host such as Jev, and return the validated answers. " + "Same request, provider list, credentials and validation as the `system-one-decision` workflow node, without its human review band. " + "The provider credential is a global secret that stays on the server; this tool never returns it.",
+    description: "Send a state and typed questions (noul, choice, score) to a SystemOne decision host such as Jev or Clef, and return the validated answers. " + "Same request, provider list, credentials and validation as the `system-one-decision` workflow node, without its human review band. " + "The provider credential is a global secret that stays on the server; this tool never returns it.",
     inputSchema: object2({
-      provider: _enum2(SYSTEM_ONE_PROVIDER_IDS).optional().describe("Decision host (default typesafe)"),
+      provider: _enum2(SYSTEM_ONE_PROVIDER_IDS).optional().describe("Decision host (default: the SYSTEM_ONE_DEFAULT_PROVIDER global config, typesafe when unset)"),
       model: string2().min(1).optional().describe("Provider model id (default: the provider's)"),
       state: union2([string2(), array2(string2()), record2(string2(), unknown())]).describe("The state to decide on"),
       questions: record2(string2(), record2(string2(), unknown())).describe("Questions by id, each `{ type: 'noul' | 'choice' | 'score', instructions, criteria }`"),
@@ -133864,7 +134771,8 @@ var registerSystemOneDecideTool = (server) => {
       model: string2().optional(),
       answers: record2(string2(), unknown()).optional(),
       usage: record2(string2(), unknown()).optional(),
-      requestId: string2().optional()
+      requestId: string2().optional(),
+      providerUnavailable: boolean().optional().describe("On an error: true when this deployment refuses the provider (e.g. OpenRouter behind a gateway) and no request was sent, so a caller choosing automatically can try its next provider")
     })
   }, async ({ provider, model, state, questions, timeoutMs, maxRetries }, requestInfo) => {
     if (!requestInfo.agentId) {
@@ -133889,8 +134797,9 @@ var registerSystemOneDecideTool = (server) => {
       return toolErr("The system-one-decision executor is not available");
     }
     const decided = await executor.decide(parsed.data);
-    if (!decided.ok)
-      return toolErr(decided.error);
+    if (!decided.ok) {
+      return toolErr(decided.error, decided.deploymentRefused ? { data: { providerUnavailable: true } } : {});
+    }
     const { output } = decided;
     return toolOk(`Decision from ${output.model}`, {
       data: {
@@ -135887,7 +136796,8 @@ async function createServer(opts = {}) {
     ...opts.preloadedTools?.length ? { instructions: resolveTemplate("system.agent.tool_preload", {}).text } : {},
     capabilities: {
       logging: {}
-    }
+    },
+    maxToolInputElements: MCP_MAX_TOOL_INPUT_ELEMENTS
   });
   if (opts.preloadedTools?.length)
     setPreloadedTools(server, opts.preloadedTools);
@@ -136122,4 +137032,4 @@ async function createServer(opts = {}) {
   return server;
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, scopeFromAttachment, backingProviderId, transcribeAudioNotes, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, isCookieSafePageId, extractPageSession, extractLegacyPageSession, extractAndVerifyCookie, pageSessionSetCookies, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, MCP_MAX_TOOL_INPUT_ELEMENTS, MCP_MAX_REQUEST_BODY_BYTES, userCtx, requestPrincipal, agentFirstPrincipal, rejectGuest, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, MemoryKeyError, refreshLinks, indexMemoryContent, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };