@desplega.ai/agent-swarm 2.4.5 → 2.5.0

package/dist/{http-pk972xyw.js → http-fc1k6ec8.js}

@@ -1,6 +1,7 @@
 import {
   bedrockProviderModule
-} from "./cli-dvkmp9bt.js";
+} from "./cli-6ctwrf1z.js";
+import"./cli-2nf3b08t.js";
 import"./cli-kvzgak7c.js";
 import"./cli-445c1vp7.js";
 import"./cli-qz93y3x5.js";
@@ -129,6 +130,16 @@ import {
   getTelemetryIngestAnchor,
   initApiTelemetry,
   syncTelemetryEnabled,
+  isBitbucketEnabled,
+  initBitbucket,
+  verifyBitbucketWebhook,
+  isDuplicateDelivery,
+  markDeliveryProcessed,
+  pullRequestEventOf,
+  pullRequestCommentEventOf,
+  handlePullRequestCreated2,
+  handlePullRequestCommentCreated,
+  handlePullRequestClosed,
   handlePullRequest,
   handleIssue,
   handleComment,
@@ -290,7 +301,7 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-n72rg53p.js";
+} from "./cli-5kzk3472.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -385,6 +396,7 @@ import {
   listApprovalRequestSummaries2,
   getPendingApprovalVoteState2,
   recordApprovalVotes2,
+  getPendingApprovalsForTasks2,
   computeContentHash2,
   getTaskById2,
   TASK_LINEAGE_LIMITS2,
@@ -404,6 +416,15 @@ import {
   deleteModelProfile,
   taskProfileError,
   init_model_profiles,
+  AssetKeyMovesBlockedError2,
+  assertAssetKeyMovesAllowed2,
+  moveSessionChains,
+  listPrefixRoots,
+  listSharedPrefixRoots,
+  init_session_moves,
+  getSessionReadState,
+  getSessionTree,
+  init_session_tree,
   setHumanFreeQueueListener,
   drainHumanFreeReclassifyQueue,
   init_human_free,
@@ -729,38 +750,40 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-wt0jf9hm.js";
+} from "./cli-fcc5qe3f.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-kpw04va0.js";
-import"./cli-43x64hv3.js";
+} from "./cli-0z3vjrpm.js";
+import"./cli-36j4jnk3.js";
 import {
   normalizeModelKey
-} from "./cli-dk44dxec.js";
+} from "./cli-0y6f0ckq.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-bnes4z6b.js";
+} from "./cli-y9jvxfhk.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-qfxc84gh.js";
+} from "./cli-jpxsrxcb.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
   getAutomationSetupStates,
   listEnabledAutomationPreflightInputs,
+  createApprovalFollowUpTask,
   validateJsonSchema,
   workflowSaveWarnings,
-  retryFailedRun2,
-  cancelWorkflowRun2,
   TriggerSchemaError,
-  startWorkflowExecution2
-} from "./cli-9hstj09h.js";
+  startWorkflowExecution2,
+  generateEdges,
+  definitionNodeIds,
+  validateDefinition
+} from "./cli-92mqenkc.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -840,14 +863,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-st8aw1m6.js";
+} from "./cli-we0ra057.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-a92r1127.js";
+} from "./cli-s4sntwt4.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -875,15 +898,9 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-37j04k05.js";
-import"./cli-3a45zcgm.js";
-import {
-  createApprovalFollowUpTask,
-  generateEdges,
-  definitionNodeIds,
-  validateDefinition
-} from "./cli-xpa64rek.js";
-import"./cli-8nyhf7za.js";
+} from "./cli-fy1jyyym.js";
+import"./cli-ftmq4nvk.js";
+import"./cli-qqzmjxkf.js";
 import {
   _fetchHolder,
   CLIENT_ID,
@@ -894,11 +911,15 @@ import {
   codexOAuthKeyForSlot,
   loadAllCodexOAuthSlots,
   getValidCodexOAuth
-} from "./cli-ejs3m1sx.js";
+} from "./cli-kxpfx2xr.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-wt645v7q.js";
+} from "./cli-dabehxhp.js";
+import {
+  retryFailedRun2,
+  cancelWorkflowRun2
+} from "./cli-3zwye9sn.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -936,13 +957,14 @@ import {
   canReadSession2,
   readableByFor2,
   SESSION_WRITE_DENIED2,
+  hasSessionWrite2,
   denyParentAttach2,
   runtimeInstanceHeader,
   bodyTask,
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-018r4jq6.js";
+} from "./cli-9ce2xw98.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-e8xyjvfc.js";
@@ -973,13 +995,13 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-j99azg3g.js";
+} from "./cli-5rvg1ddk.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
 } from "./cli-3h26v7yj.js";
-import"./cli-smvcw9z5.js";
+import"./cli-pasyvjmm.js";
 import {
   startPoolRouting,
   stopPoolRouting,
@@ -989,8 +1011,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-ms85309d.js";
-import"./cli-f0g3pgvf.js";
+} from "./cli-7g40g8hq.js";
+import"./cli-xd4eqtr2.js";
 import {
   import_websocket,
   import_websocket_server
@@ -999,7 +1021,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-1sp861s4.js";
+} from "./cli-x6vf4sad.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1019,14 +1041,14 @@ import {
   memoryRelevance,
   isUnknownModelError,
   writeSkillsToFilesystem
-} from "./cli-v8fjakwf.js";
+} from "./cli-4w24f7z3.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-4zfqgjc5.js";
+} from "./cli-1pr672hz.js";
 import {
   Anthropic
-} from "./cli-k8g16gz3.js";
+} from "./cli-3qv8naq8.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1062,12 +1084,13 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-1f3qzw6y.js";
+} from "./cli-xt768r5m.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
+import"./cli-1f0gp9vz.js";
 import {
   setBedrockProviderModule
-} from "./cli-qwkcwjdn.js";
+} from "./cli-rycdaj0a.js";
 import {
   isRbacEnabled,
   decideToolAdmission,
@@ -1078,6 +1101,11 @@ import {
   init_rbac
 } from "./cli-ba8ne1es.js";
 import {
+  ASSET_KEY_MAX_LENGTH,
+  normalizeAssetKey,
+  defaultAssetKey,
+  parseAssetKey,
+  init_key,
   isSafeBundlePath,
   init_bundle_path,
   init_zod_openapi,
@@ -1218,12 +1246,12 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-eww120g8.js";
+} from "./cli-rh5smt8t.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-74c1wpm0.js";
+} from "./cli-gpv60278.js";
 import {
   getSlackConfiguration,
   init_config
@@ -1291,7 +1319,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-94gwyg7m.js";
+} from "./cli-179xcyky.js";
 import {
   realtimeBus,
   init_bus
@@ -1320,7 +1348,7 @@ import {
   scrubObject,
   registerVolatileSecret,
   init_secret_scrubber
-} from "./cli-xf234ws8.js";
+} from "./cli-n4c8e3s5.js";
 import {
   isAlias,
   init_src2
@@ -6778,6 +6806,10 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
         jsonError(res, "Asset not found", 404);
         return true;
       }
+      if (!await hasSessionWrite2(req, myAgentId, task.id)) {
+        jsonError(res, await canReadSession2(req, myAgentId, task.id) ? "You can view this session but not move it." : SESSION_READ_DENIED2, 403);
+        return true;
+      }
       const tasks = parsed.body.cascade ? await getRootTaskChain2(task.id) : [task];
       for (const target of tasks) {
         if (!await canMutateTaskNamespace(target, myAgentId, req)) {
@@ -6834,7 +6866,7 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
         return true;
       }
       const message = error instanceof Error ? error.message : String(error);
-      jsonError(res, message, message.includes("blocked until") ? 409 : 400);
+      jsonError(res, message, error instanceof AssetKeyMovesBlockedError2 ? 409 : 400);
     }
     return true;
   }
@@ -7085,6 +7117,7 @@ var OnboardingIntegrationMethodSchema = _enum2([
   "slack",
   "github",
   "gitlab",
+  "bitbucket",
   "linear_oauth",
   "jira_oauth"
 ]);
@@ -7152,6 +7185,7 @@ var OnboardingSignalsSchema = object2({
     slack: boolean(),
     github: boolean(),
     gitlab: boolean(),
+    bitbucket: boolean(),
     linear: boolean(),
     jira: boolean()
   }),
@@ -7373,6 +7407,8 @@ function inferIntegrationMethod(signals) {
     return "github";
   if (signals.integrations.gitlab)
     return "gitlab";
+  if (signals.integrations.bitbucket)
+    return "bitbucket";
   if (signals.integrations.linear)
     return "linear_oauth";
   if (signals.integrations.jira)
@@ -9653,6 +9689,7 @@ declare module "swarm-extension" {
       | "github"
       | "gitlab"
       | "azure-devops"
+      | "bitbucket"
       | "system"
       | "linear"
       | "jira"
@@ -9679,7 +9716,7 @@ declare module "swarm-extension" {
     slackTriggerMessageTs?: string | undefined;
     slackUserId?: string | undefined;
     overrideSlackContext?: boolean | undefined;
-    vcsProvider?: "github" | "gitlab" | "azure-devops" | undefined;
+    vcsProvider?: "github" | "gitlab" | "azure-devops" | "bitbucket" | undefined;
     vcsRepo?: string | undefined;
     vcsEventType?: string | undefined;
     vcsNumber?: number | undefined;
@@ -9770,6 +9807,7 @@ declare module "swarm-extension" {
       | "github"
       | "gitlab"
       | "azure-devops"
+      | "bitbucket"
       | "system"
       | "linear"
       | "jira"
@@ -9810,7 +9848,7 @@ declare module "swarm-extension" {
     slackUserId?: string | undefined;
     slackProgressMessageTs?: string | undefined;
     slackTreeRootMessageTs?: string | undefined;
-    vcsProvider?: "github" | "gitlab" | "azure-devops" | undefined;
+    vcsProvider?: "github" | "gitlab" | "azure-devops" | "bitbucket" | undefined;
     vcsRepo?: string | undefined;
     vcsEventType?: string | undefined;
     vcsNumber?: number | undefined;
@@ -10263,7 +10301,7 @@ declare module "swarm-extension" {
     /** The text, or a placeholder naming the type for a non-text message. */
     text: string;
   }
-  export type VcsProvider = "github" | "gitlab" | "azure-devops";
+  export type VcsProvider = "github" | "gitlab" | "azure-devops" | "bitbucket";
   /**
    * The provider object the event is about, as the provider names it. GitLab
    * calls a pull request a merge request, and a comment a \`note\`.
@@ -10286,7 +10324,7 @@ declare module "swarm-extension" {
     provider: VcsProvider;
     kind: VcsEventKind;
     action: string;
-    /** \`owner/name\` on GitHub and GitLab, the repository URL on Azure DevOps. */
+    /** \`owner/name\` on GitHub and GitLab, \`workspace/repo_slug\` on Bitbucket, the repository URL on Azure DevOps. */
     repo: string;
     /** The PR, merge request, or issue number. Absent for a pipeline outside a merge request. */
     number?: number;
@@ -21779,6 +21817,7 @@ async function buildSignals(state) {
       slack: integrations.slack === "configured",
       github: Boolean(process.env.GITHUB_TOKEN?.trim()) || integrations.github === "verified",
       gitlab: Boolean(process.env.GITLAB_TOKEN?.trim()),
+      bitbucket: Boolean(process.env.BITBUCKET_TOKEN?.trim()),
       linear: integrations.linear === "verified",
       jira: integrations.jira === "verified"
     },
@@ -22813,7 +22852,7 @@ var updateTaskVcsRoute = route({
   tags: ["Tasks"],
   params: object2({ id: string2() }),
   body: object2({
-    vcsProvider: _enum2(["github", "gitlab", "azure-devops"]),
+    vcsProvider: _enum2(["github", "gitlab", "azure-devops", "bitbucket"]),
     vcsRepo: string2(),
     vcsNumber: number2().int().positive(),
     vcsUrl: string2().url()
@@ -33230,7 +33269,10 @@ async function handleSessionData(req, res, pathSegments, queryParams, myAgentId)
 
 // src/http/sessions.ts
 init_zod();
+init_key();
 init_db3();
+init_session_moves();
+init_session_tree();
 init_rbac_roles();
 init_steering();
 init_users();
@@ -33272,7 +33314,54 @@ var SessionListItemSchema = object2({
   root: union2([AgentTaskSchema, AgentTaskSummarySchema2]),
   chainTaskCount: number2().int(),
   lastActivityAt: string2(),
-  latestStatus: AgentTaskStatusSchema
+  latestStatus: AgentTaskStatusSchema,
+  readState: _enum2(["unread", "read", "later", "done"]).optional(),
+  snoozeUntil: string2().nullable().optional(),
+  needsYou: boolean().optional(),
+  groupKey: string2().optional(),
+  shared: boolean().optional(),
+  people: array2(object2({ id: string2(), name: string2() })).optional(),
+  peopleCount: number2().int().optional(),
+  preview: string2().nullable().optional(),
+  shares: array2(object2({
+    userId: string2().nullable(),
+    name: string2().nullable(),
+    access: _enum2(["read", "write"])
+  })).optional()
+});
+var SessionSectionCountsSchema = object2({
+  total: number2().int(),
+  unread: number2().int(),
+  running: number2().int(),
+  needsYou: number2().int()
+});
+var SessionTreeGroupSchema = SessionSectionCountsSchema.extend({
+  key: string2(),
+  lastActivityAt: string2()
+});
+var SessionTreeResponseSchema = object2({
+  groups: array2(SessionTreeGroupSchema),
+  inbox: SessionSectionCountsSchema,
+  later: SessionSectionCountsSchema,
+  done: SessionSectionCountsSchema,
+  noGroup: SessionSectionCountsSchema
+});
+var SessionApprovalSchema = object2({
+  id: string2(),
+  status: literal2("pending"),
+  sourceTaskId: string2(),
+  title: string2()
+});
+var SessionKeyFilterSchema = string2().transform((value, ctx) => {
+  try {
+    return normalizeAssetKey(value);
+  } catch (error) {
+    ctx.addIssue({
+      code: "custom",
+      message: error instanceof Error ? error.message : "Invalid asset key"
+    });
+    return NEVER;
+  }
 });
 var TaskWithSteeringSchema = AgentTaskSchema.extend({
   citations: array2(TaskCitationSchema),
@@ -33528,8 +33617,14 @@ var listSessions = route({
     q: string2().optional(),
     requestedByUserId: string2().min(1).optional(),
     contextKeyPrefix: string2().min(1).optional(),
+    keyPrefix: SessionKeyFilterSchema.optional(),
+    groupKey: SessionKeyFilterSchema.optional(),
+    noGroup: _enum2(["true", "false"]).transform((v) => v === "true").optional(),
+    triage: _enum2(["inbox", "later", "done", "unread"]).optional(),
+    status: _enum2(["running", "failed", "needs"]).optional(),
+    withUserId: string2().min(1).optional(),
     fields: _enum2(["full", "slim"]).optional(),
-    scope: _enum2(["mine", "shared"]).optional()
+    scope: _enum2(["mine", "shared", "tree"]).optional().describe("mine: owned sessions. shared: sessions shared with me. tree: Sessions that GET /api/session-tree counts: mine plus shared with me, no ownerless roots. A bypass actor sees every root with tree scope.")
   }),
   responses: {
     200: {
@@ -33545,6 +33640,110 @@ var listSessions = route({
   },
   auth: { apiKey: true }
 });
+var sessionTree = route({
+  method: "get",
+  path: "/api/session-tree",
+  pattern: ["api", "session-tree"],
+  summary: "Get session groups and triage counts",
+  tags: ["Sessions"],
+  responses: {
+    200: { description: "Visible groups and section counts", schema: SessionTreeResponseSchema },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true }
+});
+var SESSION_MOVE_LIMIT = 200;
+var SESSION_MOVE_OWNER_ONLY = "Only the session owner can move this group";
+var SESSION_MOVE_UNAVAILABLE = "Session not found or not accessible";
+var SessionMoveResultSchema = object2({
+  moved: array2(string2()),
+  skipped: array2(object2({ rootTaskId: string2(), reason: string2() }))
+});
+var sessionMoveRbac = {
+  ungated: "per-session access, per-task task.fs.mutate, and asset-key write checks in the handler, as PATCH /api/assets/task/{id}/key"
+};
+var sessionMoveResponses = {
+  400: { description: "Invalid namespace or request" },
+  403: { description: "Personal destination not authorized" },
+  409: { description: "Moves blocked until audit warnings are repaired" }
+};
+var moveSessions = route({
+  method: "post",
+  path: "/api/session-moves",
+  pattern: ["api", "session-moves"],
+  summary: "Move sessions into a group or reset their keys",
+  tags: ["Sessions"],
+  session: { none: "The handler checks each root and reports denied roots as skipped" },
+  body: object2({
+    rootTaskIds: array2(string2().min(1)).min(1).max(SESSION_MOVE_LIMIT),
+    groupKey: AssetKeySchema.nullable()
+  }),
+  responses: {
+    200: { description: "Moved and skipped sessions", schema: SessionMoveResultSchema },
+    ...sessionMoveResponses
+  },
+  auth: { apiKey: true },
+  rbac: sessionMoveRbac
+});
+var moveSessionPrefix = route({
+  method: "post",
+  path: "/api/session-moves/prefix",
+  pattern: ["api", "session-moves", "prefix"],
+  summary: "Rename or delete a session group",
+  tags: ["Sessions"],
+  body: object2({ from: AssetKeySchema, to: AssetKeySchema.nullable() }),
+  responses: {
+    200: {
+      description: "Moved and skipped sessions and remaining movable roots",
+      schema: SessionMoveResultSchema.extend({ remaining: number2().int().min(0) })
+    },
+    ...sessionMoveResponses
+  },
+  auth: { apiKey: true },
+  rbac: sessionMoveRbac
+});
+async function withSessionMove(req, res, myAgentId, destination, run) {
+  try {
+    const changedBy = await resolveHttpAuditUserId(req, myAgentId);
+    const actor = await resolveSessionActor2(req, myAgentId);
+    const key = destination === null ? null : await authorizeAssetKeyWrite(destination, changedBy);
+    await assertAssetKeyMovesAllowed2();
+    await run({ actor, changedBy: changedBy ?? undefined, key });
+  } catch (error) {
+    if (error instanceof AssetKeyAuthorizationError) {
+      jsonError(res, error.message, error.statusCode);
+    } else if (error instanceof AssetKeyMovesBlockedError2) {
+      jsonError(res, error.message, 409);
+    } else {
+      throw error;
+    }
+  }
+}
+async function checkSessionMove(rootTaskId, actor, req, myAgentId, options = {}) {
+  const root = await getTaskById2(rootTaskId);
+  if (!root)
+    return { reason: SESSION_MOVE_UNAVAILABLE };
+  if (options.ownerOnly) {
+    if (actor.kind === "user" && (!actor.userId || root.requestedByUserId !== actor.userId)) {
+      return { reason: SESSION_MOVE_OWNER_ONLY };
+    }
+  } else {
+    const access = await sessionAccessFor2(actor, root.id);
+    if (access === "none")
+      return { reason: SESSION_MOVE_UNAVAILABLE };
+    if (!hasSessionAccess(access, "write"))
+      return { reason: "Session write access required" };
+  }
+  if (root.parentTaskId)
+    return { reason: "Task is not a session root" };
+  const tasks = await getRootTaskChain2(root.id);
+  for (const task of tasks) {
+    if (!await canMutateTaskNamespace(task, myAgentId, req)) {
+      return { reason: "Not authorized to move this task namespace" };
+    }
+  }
+  return { taskIds: tasks.map((task) => task.id) };
+}
 var getSession = route({
   method: "get",
   path: "/api/sessions/{rootTaskId}",
@@ -33560,7 +33759,10 @@ var getSession = route({
         root: TaskWithSteeringSchema,
         chain: array2(TaskWithSteeringSchema),
         access: SessionAccessSchema,
-        owner: SessionOwnerSchema.nullable()
+        owner: SessionOwnerSchema.nullable(),
+        approvals: array2(SessionApprovalSchema).optional(),
+        readState: _enum2(["unread", "read", "later", "done"]).optional(),
+        lastActivityAt: string2().optional()
       })
     },
     401: { description: "Unauthorized" },
@@ -33691,11 +33893,12 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     const sources = parsed.query.source ? parsed.query.source.split(",").map((s) => s.trim()).filter(Boolean) : undefined;
     const actor = await resolveSessionActor2(req, myAgentId);
-    if (actor.kind === "bypass" && parsed.query.scope) {
+    const limit = Math.min(200, Math.max(0, parsed.query.limit ?? 25));
+    if (actor.kind === "bypass" && parsed.query.scope && parsed.query.scope !== "tree") {
       listSessions.respond(res, 200, {
         sessions: [],
         total: 0,
-        limit: parsed.query.limit ?? 25,
+        limit,
         offset: parsed.query.offset ?? 0
       });
       return true;
@@ -33705,11 +33908,24 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       q: parsed.query.q,
       requestedByUserId: parsed.query.requestedByUserId,
       contextKeyPrefix: parsed.query.contextKeyPrefix,
-      ...actor.kind === "user" ? { viewer: { userId: actor.userId, scope: parsed.query.scope ?? "all" } } : {}
+      keyPrefix: parsed.query.keyPrefix,
+      groupKey: parsed.query.groupKey,
+      noGroup: parsed.query.noGroup,
+      triage: parsed.query.triage,
+      status: parsed.query.status,
+      withUserId: parsed.query.withUserId,
+      now: new Date().toISOString(),
+      tree: parsed.query.scope === "tree",
+      ...actor.kind === "user" ? {
+        viewer: {
+          userId: actor.userId,
+          scope: parsed.query.scope === "tree" ? "all" : parsed.query.scope ?? "all"
+        }
+      } : {}
     };
     const baseOpts = {
       ...filterOpts,
-      limit: parsed.query.limit,
+      limit,
       offset: parsed.query.offset
     };
     const sessions = parsed.query.fields === "full" ? await listRecentSessions2(baseOpts) : await listRecentSessions2({ ...baseOpts, slim: true });
@@ -33717,11 +33933,104 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
     listSessions.respond(res, 200, {
       sessions,
       total,
-      limit: parsed.query.limit ?? 25,
+      limit,
       offset: parsed.query.offset ?? 0
     });
     return true;
   }
+  if (sessionTree.match(req.method, pathSegments)) {
+    const parsed = await sessionTree.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    sessionTree.respond(res, 200, await getSessionTree(await resolveSessionActor2(req, myAgentId)));
+    return true;
+  }
+  if (moveSessions.match(req.method, pathSegments)) {
+    const parsed = await moveSessions.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    await withSessionMove(req, res, myAgentId, parsed.body.groupKey, async ({ actor, changedBy, key }) => {
+      const skipped = [];
+      const moves = [];
+      for (const rootId of new Set(parsed.body.rootTaskIds)) {
+        const checked = await checkSessionMove(rootId, actor, req, myAgentId);
+        if ("reason" in checked) {
+          skipped.push({ rootTaskId: rootId, reason: checked.reason });
+        } else {
+          moves.push({
+            rootId,
+            taskIds: checked.taskIds,
+            key: key ?? defaultAssetKey("task", rootId)
+          });
+        }
+      }
+      const moved = await moveSessionChains({ moves, changedBy });
+      moveSessions.respond(res, 200, { moved, skipped });
+    });
+    return true;
+  }
+  if (moveSessionPrefix.match(req.method, pathSegments)) {
+    const parsed = await moveSessionPrefix.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const from = normalizeAssetKey(parsed.body.from);
+    if (parseAssetKey(from).relativeSegments.length === 0) {
+      jsonError(res, "Cannot move a namespace root", 400);
+      return true;
+    }
+    await withSessionMove(req, res, myAgentId, parsed.body.to, async ({ actor, changedBy, key }) => {
+      if (key?.startsWith(from)) {
+        jsonError(res, "Destination must be outside the source prefix", 400);
+        return;
+      }
+      const skipped = actor.kind === "user" ? (await listSharedPrefixRoots({ from, userId: actor.userId })).map((root) => ({
+        rootTaskId: root.id,
+        reason: SESSION_MOVE_OWNER_ONLY
+      })) : [];
+      const moves = [];
+      let remaining = 0;
+      for (let offset = 0;; offset += SESSION_MOVE_LIMIT) {
+        const roots = await listPrefixRoots({
+          from,
+          userId: actor.kind === "user" ? actor.userId : undefined,
+          limit: SESSION_MOVE_LIMIT,
+          offset
+        });
+        for (const root of roots) {
+          const nextKey = key === null ? defaultAssetKey("task", root.id) : key + root.key.slice(from.length);
+          if (nextKey.startsWith(from)) {
+            skipped.push({
+              rootTaskId: root.id,
+              reason: "The new key stays inside the source group"
+            });
+            continue;
+          }
+          if (nextKey.length > ASSET_KEY_MAX_LENGTH) {
+            skipped.push({
+              rootTaskId: root.id,
+              reason: `Asset key cannot exceed ${ASSET_KEY_MAX_LENGTH} characters`
+            });
+            continue;
+          }
+          const checked = await checkSessionMove(root.id, actor, req, myAgentId, {
+            ownerOnly: true
+          });
+          if ("reason" in checked) {
+            skipped.push({ rootTaskId: root.id, reason: checked.reason });
+          } else if (moves.length < SESSION_MOVE_LIMIT) {
+            moves.push({ rootId: root.id, taskIds: checked.taskIds, key: nextKey });
+          } else {
+            remaining++;
+          }
+        }
+        if (roots.length < SESSION_MOVE_LIMIT)
+          break;
+      }
+      const moved = await moveSessionChains({ moves, changedBy });
+      moveSessionPrefix.respond(res, 200, { moved, skipped, remaining });
+    });
+    return true;
+  }
   if (getSession.match(req.method, pathSegments)) {
     const parsed = await getSession.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -33735,7 +34044,8 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       id: root.id,
       requestedByUserId: root.requestedByUserId ?? null
     };
-    const access = await accessForRoot(await resolveSessionActor2(req, myAgentId), sessionRoot);
+    const actor = await resolveSessionActor2(req, myAgentId);
+    const access = await accessForRoot(actor, sessionRoot);
     if (access === "none") {
       jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
       return true;
@@ -33747,9 +34057,11 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
     } : null;
     const chain = await getRootTaskChain2(parsed.params.rootTaskId);
     const tasks = [root, ...chain];
-    const [steering, citations] = await Promise.all([
+    const [steering, citations, approvals, read] = await Promise.all([
       getTaskSteeringFieldsForTasks(tasks),
-      getTaskCitationsForTasks(tasks.map((task) => task.id))
+      getTaskCitationsForTasks(tasks.map((task) => task.id)),
+      getPendingApprovalsForTasks2(tasks.map((task) => task.id)),
+      actor.kind === "user" && actor.userId ? getSessionReadState(sessionRoot.id, actor.userId) : Promise.resolve(null)
     ]);
     const decorate = (task) => ({
       ...task,
@@ -33760,7 +34072,9 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       root: decorate(root),
       chain: chain.map(decorate),
       access,
-      owner
+      owner,
+      ...approvals.length ? { approvals } : {},
+      ...read ?? {}
     });
     return true;
   }
@@ -33849,8 +34163,7 @@ async function syncSkillsToFilesystem(agentId, harnessType = "all", homeOverride
   })));
   return writeSkillsToFilesystem(entries, harnessType, home);
 }
-async function computeAgentSkillsSignature(agentId) {
-  const skills = await getAgentSkills2(agentId);
+function computeSkillsSignature(skills) {
   const sorted = [...skills].sort((a, b) => a.id.localeCompare(b.id));
   const canonical = JSON.stringify(sorted.map((s) => [
     s.id,
@@ -33865,6 +34178,18 @@ async function computeAgentSkillsSignature(agentId) {
   const hash = new Bun.CryptoHasher("sha256").update(canonical).digest("hex");
   return { hash, count: sorted.length };
 }
+async function computeAgentSkillsSignature(agentId) {
+  return computeSkillsSignature(await getAgentSkills2(agentId));
+}
+async function buildSkillsBundle(readSkills, readFiles) {
+  const skills = await readSkills();
+  const signature = computeSkillsSignature(skills).hash;
+  const entries = await Promise.all(skills.map(async (skill) => ({
+    ...skill,
+    files: skill.isComplex ? await readFiles(skill.id) : []
+  })));
+  return { skills: entries, total: entries.length, signature };
+}
 
 // src/be/skill-usage.ts
 init_db3();
@@ -34150,6 +34475,13 @@ var agentSkillsListResponseSchema = object2({
   total: number2(),
   signature: string2()
 });
+var agentSkillsBundleResponseSchema = object2({
+  skills: array2(SkillWithInstallInfoSchema.extend({
+    files: array2(SkillFileSchema)
+  })),
+  total: number2(),
+  signature: string2()
+});
 var agentSkillsSignatureResponseSchema = object2({
   hash: string2(),
   count: number2(),
@@ -34544,7 +34876,28 @@ var getAgentSkillsSignatureRoute = route({
     200: { description: "Skills signature", schema: agentSkillsSignatureResponseSchema }
   }
 });
+var getAgentSkillsBundleRoute = route({
+  method: "get",
+  path: "/api/agents/{id}/skills/bundle",
+  pattern: ["api", "agents", null, "skills", "bundle"],
+  summary: "Get an agent's installed skills together with their bundled files",
+  description: "Single-request boot payload: every installed-and-enabled skill with the full content of its bundled files, plus the same signature the cheap probe returns. Lets a worker sync its local skill tree without an N+1 file fan-out.",
+  tags: ["Skills"],
+  auth: { apiKey: true },
+  params: object2({ id: string2() }),
+  responses: {
+    200: { description: "Agent skills bundle", schema: agentSkillsBundleResponseSchema }
+  }
+});
 async function handleSkills(req, res, pathSegments, queryParams, myAgentId) {
+  if (getAgentSkillsBundleRoute.match(req.method, pathSegments)) {
+    const parsed = await getAgentSkillsBundleRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const bundle = await buildSkillsBundle(() => getAgentSkills2(parsed.params.id), (skillId) => getSkillFiles2(skillId));
+    getAgentSkillsBundleRoute.respond(res, 200, bundle);
+    return true;
+  }
   if (getAgentSkillsSignatureRoute.match(req.method, pathSegments)) {
     const parsed = await getAgentSkillsSignatureRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -36703,6 +37056,7 @@ var UNMAPPED_KINDS = [
   "github",
   "gitlab",
   "azure-devops",
+  "bitbucket",
   "linear",
   "kapso",
   "telegram",
@@ -37485,6 +37839,24 @@ var azureDevOpsWebhook = route({
     503: { description: "Azure DevOps integration not configured" }
   }
 });
+var bitbucketWebhook = route({
+  method: "post",
+  path: "/api/bitbucket/webhook",
+  pattern: ["api", "bitbucket", "webhook"],
+  summary: "Handle Bitbucket Cloud webhook events",
+  tags: ["Webhooks"],
+  auth: { apiKey: false },
+  rbac: {
+    ungated: "provider webhook: authenticated by the per-webhook HMAC secret, not a swarm principal"
+  },
+  responses: {
+    200: { description: "Event processed", schema: WebhookDispatchResultSchema },
+    401: { description: "Invalid signature" },
+    413: { description: "Body exceeds 1 MiB" },
+    503: { description: "Bitbucket integration not configured" }
+  }
+});
+var BITBUCKET_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
 var agentmailWebhook = route({
   method: "post",
   path: "/api/agentmail/webhook",
@@ -37941,6 +38313,101 @@ async function handleWebhooks(req, res, pathSegments) {
     }
     return true;
   }
+  if (bitbucketWebhook.match(req.method, pathSegments)) {
+    if (!isBitbucketEnabled()) {
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Bitbucket integration not configured" }));
+      return true;
+    }
+    if (enforceContentLengthCap(req, res, BITBUCKET_WEBHOOK_MAX_BODY_BYTES) === BODY_TOO_LARGE) {
+      return true;
+    }
+    const chunks = [];
+    let receivedBytes = 0;
+    let tooLarge = false;
+    for await (const chunk of req) {
+      if (tooLarge)
+        continue;
+      receivedBytes += chunk.byteLength;
+      if (receivedBytes > BITBUCKET_WEBHOOK_MAX_BODY_BYTES) {
+        tooLarge = true;
+        chunks.length = 0;
+        jsonError(res, `Payload too large (max ${BITBUCKET_WEBHOOK_MAX_BODY_BYTES} bytes)`, 413);
+        continue;
+      }
+      chunks.push(chunk);
+    }
+    if (tooLarge)
+      return true;
+    const rawBody = Buffer.concat(chunks).toString();
+    const signature = req.headers["x-hub-signature"];
+    if (!verifyBitbucketWebhook(rawBody, signature)) {
+      console.log("[Bitbucket] Invalid webhook signature");
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid signature" }));
+      return true;
+    }
+    let body;
+    try {
+      body = JSON.parse(rawBody);
+    } catch {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Invalid JSON body" }));
+      return true;
+    }
+    const eventKey = req.headers["x-event-key"];
+    const requestUuid = req.headers["x-request-uuid"];
+    if (isDuplicateDelivery(requestUuid)) {
+      console.log(`[Bitbucket] Skipping duplicate delivery ${requestUuid}`);
+      bitbucketWebhook.respond(res, 200, { created: false });
+      return true;
+    }
+    console.log(`[Bitbucket] Received ${eventKey} event`);
+    try {
+      const result = await runBlockableHandler("Bitbucket", async () => {
+        switch (eventKey) {
+          case "pullrequest:created":
+            return await handlePullRequestCreated2(body);
+          case "pullrequest:comment_created":
+            return await handlePullRequestCommentCreated(body);
+          case "pullrequest:fulfilled":
+            return await handlePullRequestClosed(body, "merged");
+          case "pullrequest:rejected":
+            return await handlePullRequestClosed(body, "declined");
+          default:
+            console.log(`[Bitbucket] Ignoring unsupported event type: ${eventKey}`);
+            return { created: false };
+        }
+      });
+      const workflowEvent = {
+        "pullrequest:created": "created",
+        "pullrequest:comment_created": "commented",
+        "pullrequest:fulfilled": "merged",
+        "pullrequest:rejected": "declined"
+      }[eventKey ?? ""];
+      const prEvent = workflowEvent ? pullRequestEventOf(body) : null;
+      if (workflowEvent && prEvent) {
+        const pr = prEvent.pullrequest;
+        const comment = workflowEvent === "commented" ? pullRequestCommentEventOf(body)?.comment : undefined;
+        const user = comment?.user ?? prEvent.actor;
+        workflowEventBus2.emit(`bitbucket.pull_request.${workflowEvent}`, {
+          repo: prEvent.repository.full_name,
+          number: pr.id,
+          ...workflowEvent === "commented" ? { body: comment?.content.raw } : { title: pr.title, body: pr.description ?? undefined },
+          action: workflowEvent,
+          user_login: user.account_id ?? user.nickname ?? user.display_name
+        });
+      }
+      markDeliveryProcessed(requestUuid);
+      bitbucketWebhook.respond(res, 200, result);
+    } catch (err) {
+      const errorMessage = err instanceof Error ? err.message : String(err);
+      console.error(`[Bitbucket] Error handling ${eventKey} event: ${scrubSecrets(errorMessage)}`);
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Internal server error" }));
+    }
+    return true;
+  }
   if (agentmailWebhook.match(req.method, pathSegments)) {
     if (!isAgentMailEnabled()) {
       res.writeHead(503, { "Content-Type": "application/json" });
@@ -39403,7 +39870,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-9ftpex99.js");
+var { attachControllerTransport } = await import("./controllers-connect-tw1dan9r.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -39432,7 +39899,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-bgdyvcnv.js");
+    const { stopScheduler } = await import("./index-07ef7nkm.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -39444,7 +39911,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-7yrng7px.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-5nh2rhmr.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -39524,21 +39991,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-j2273s54.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-3vn0m9sg.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-d2b5my0y.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-nevhat8h.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-j2273s54.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-3vn0m9sg.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-j2273s54.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-3vn0m9sg.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -39546,7 +40013,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-jwxkkex2.js");
+  const { runAllSeeders } = await import("./index-zdycv3ja.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -39602,45 +40069,46 @@ httpServer.listen(port, async () => {
   initGitLab();
   initAzureDevOps();
   initAzureDevOpsOutbound();
+  initBitbucket();
   initAgentMail();
   await initLinear();
   await initJira();
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-bgdyvcnv.js");
-    const { getExecutorRegistry } = await import("./index-gabbcdn2.js");
+    const { startScheduler } = await import("./index-07ef7nkm.js");
+    const { getExecutorRegistry } = await import("./index-q3t40ryv.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-tfb26zhy.js");
+    const { startHeartbeat } = await import("./index-7yts8n9s.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-7yrng7px.js");
+    const { startOAuthKeepalive } = await import("./keepalive-5nh2rhmr.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-yw3xdbcj.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-y3n1knmd.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-b9c3az3c.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-n4wq5dd2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-qdkvxeem.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-4xwq5tg0.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-m3wh8eks.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-69h90xcq.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {