@desplega.ai/agent-swarm 2.5.1 → 2.5.2

package/dist/{cli-mz2ygeyq.js → cli-0vgy5wfw.js}

@@ -4,11 +4,11 @@ import {
   getActivePricingRow2,
   insertPricingRow2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   loadModelsDevCache,
   buildModelsDevSeedRows
-} from "./cli-9mm5ade4.js";
+} from "./cli-bpbcpd8b.js";
 import {
   setRuntimeModelCatalog,
   init_runtime_model_catalog

package/dist/{cli-eym3jg7w.js → cli-14v1sxxy.js}

@@ -10,7 +10,7 @@ import {
   getMostRecentTaskInThread2,
   reactionName,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   TaskCreationBlockedError,
   buildEffectiveText,
@@ -23,7 +23,7 @@ import {
   extractTaskFromMessage,
   extractSlackMessageText,
   dispatchPre2
-} from "./cli-kcsd1ez8.js";
+} from "./cli-h5d22pfs.js";
 import {
   noteSlackInboundSideEffect,
   ignoreSlackInbound,
@@ -34,14 +34,14 @@ import {
   isSlackRenderV2Enabled2,
   ensureSlackThreadTree2,
   registerTreeMessage
-} from "./cli-e9btqw4y.js";
+} from "./cli-15xd0j7w.js";
 import {
   isBlockExternalEnabled2,
   invalidateChannelExternality2,
   getChannelBlockReason2,
   shouldBlockChannel2,
   leaveExternalChannel2
-} from "./cli-xc65x52q.js";
+} from "./cli-b63d08rs.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -50,7 +50,7 @@ import {
   enrichSlackUserEmail,
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-sn1vbtg2.js";
+} from "./cli-vaxw3bg0.js";
 import {
   wasEventSeen,
   requestSlackThreadSteering,
@@ -58,7 +58,7 @@ import {
   bufferThreadMessage,
   getBufferMessageCount,
   instantFlush
-} from "./cli-cah5detr.js";
+} from "./cli-edtm741g.js";
 import {
   resolveTemplate,
   init_resolver

package/dist/{cli-e9btqw4y.js → cli-15xd0j7w.js}

@@ -47,10 +47,10 @@ import {
   checkDependencies2,
   emitBuiltInIntegrationConnectedOnce2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   getChannelBlockReason2
-} from "./cli-xc65x52q.js";
+} from "./cli-b63d08rs.js";
 import {
   require_dist5,
   require_axios,
@@ -67,7 +67,7 @@ import {
 import {
   isTerminalTaskStatus,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mntxtkhn.js";
 import {
   taskAttachmentDisplayUrl,
   init_task_attachment_links
@@ -6197,6 +6197,11 @@ init_db3();
 // src/slack/ack.ts
 init_db3();
 
+// src/integrations/reaction-events.ts
+function terminalReactionEvent(status) {
+  return status === "completed" ? "completed" : "failed";
+}
+
 // src/otel.ts
 function otelConfigured() {
   return Boolean(process.env.OTEL_EXPORTER_OTLP_ENDPOINT);
@@ -6235,7 +6240,7 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     return;
   initialized = true;
   try {
-    const impl = await import("./otel-impl-ytn9wyv9.js");
+    const impl = await import("./otel-impl-vk32s884.js");
     await impl.boot(serviceRole, {
       exportConsoleLogs: serviceRole === "api" && isApiLogExportEnabled()
     });
@@ -6392,7 +6397,7 @@ async function finalizeSlackMessageReaction(client, channel, timestamp, outcome,
   await addReaction(client, channel, timestamp, outcome, event);
 }
 function terminalReactionChoice(task) {
-  const event = task.status === "completed" ? "completed" : "failed";
+  const event = terminalReactionEvent(task.status);
   return { name: reactionName(event), event };
 }
 async function finalizeSlackSteerReactions(tasks, reactionFor) {
@@ -10080,17 +10085,17 @@ async function initSlackApp2() {
   });
   initialized2 = true;
   app.use(slackInboundOutcomeMiddleware());
-  const { registerMessageHandler } = await import("./handlers-rk9dqech.js");
-  const { registerCommandHandler } = await import("./commands-mbvhbrcy.js");
-  const { registerActionHandlers } = await import("./actions-w8xd014k.js");
-  const { registerWorkObjectHandlers } = await import("./work-objects-44z2yjg8.js");
+  const { registerMessageHandler } = await import("./handlers-ptsraqa8.js");
+  const { registerCommandHandler } = await import("./commands-1cnvseqx.js");
+  const { registerActionHandlers } = await import("./actions-6xx079d1.js");
+  const { registerWorkObjectHandlers } = await import("./work-objects-vn8nkxwn.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
   registerWorkObjectHandlers(app);
-  const { createAssistant } = await import("./assistant-hjmqyscx.js");
+  const { createAssistant } = await import("./assistant-vt2cyfzd.js");
   app.assistant(createAssistant());
-  const { isBlockExternalEnabled, scanExternalChannelsOnBoot } = await import("./external-channel-y8q5z8z2.js");
+  const { isBlockExternalEnabled, scanExternalChannelsOnBoot } = await import("./external-channel-n9bymc2n.js");
   if (isBlockExternalEnabled()) {
     scanExternalChannelsOnBoot(app.client).catch((error) => {
       console.error("[Slack] External channel boot scan failed:", error);
@@ -10103,7 +10108,7 @@ async function startSlackApp2() {
     await initSlackApp2();
   }
   if (app) {
-    const { isSlackRenderV2Enabled } = await import("./render-v2-pyfsg9zk.js");
+    const { isSlackRenderV2Enabled } = await import("./render-v2-0ttsk2j4.js");
     if (isSlackRenderV2Enabled())
       await ensureSlackRenderV2Activation2();
     await app.start();
@@ -10126,4 +10131,4 @@ async function stopSlackApp2() {
   initialized2 = false;
 }
 
-export { require_dist4, getSlackConnectionState, noteSlackInboundSideEffect, ignoreSlackInbound, reportSlackInboundFailure, isAdmittedSlackDelivery, getSlackInboundDiagnostics, isPollTracingEnabled, initOtel, withSpan2, startSpan2, withSpanContext2, withRemoteContext2, injectTraceContext2, recordSessionCost2, recordDbRetentionSweep2, recordDbRetentionStatement2, slackTaskOutput, ackSlackMessage, getTaskLink, getTaskUrl, markdownToSlack, buildMrkdwnSectionBlocks, buildCaptionBlock, buildCancelledBlocks, buildBufferFlushBlocks, buildTreeBlocks, taskCitationIssues, stripInvalidTaskCitations, taskCitationSourceGroups, renderTaskCitations, taskCitationWarnings, MAX_TASK_CITATIONS, CitationInputSchema, TaskCitationSchema, upsertTaskCitations, getTaskCitations, getTaskCitationsForTasks, hasTaskCitationCheckRefusal, initialize, ensure, getAgentDisplayName, getAgentEmoji, markSlackSessionProcessing, isSlackRenderV2Enabled2, ensureSlackThreadTree2, processSlackRenderV22, registerTreeMessage, getSlackApp2, initSlackApp2, startSlackApp2, stopSlackApp2 };
+export { require_dist4, getSlackConnectionState, noteSlackInboundSideEffect, ignoreSlackInbound, reportSlackInboundFailure, isAdmittedSlackDelivery, getSlackInboundDiagnostics, terminalReactionEvent, isPollTracingEnabled, initOtel, withSpan2, startSpan2, withSpanContext2, withRemoteContext2, injectTraceContext2, recordSessionCost2, recordDbRetentionSweep2, recordDbRetentionStatement2, slackTaskOutput, ackSlackMessage, getTaskLink, getTaskUrl, markdownToSlack, buildMrkdwnSectionBlocks, buildCaptionBlock, buildCancelledBlocks, buildBufferFlushBlocks, buildTreeBlocks, taskCitationIssues, stripInvalidTaskCitations, taskCitationSourceGroups, renderTaskCitations, taskCitationWarnings, MAX_TASK_CITATIONS, CitationInputSchema, TaskCitationSchema, upsertTaskCitations, getTaskCitations, getTaskCitationsForTasks, hasTaskCitationCheckRefusal, initialize, ensure, getAgentDisplayName, getAgentEmoji, markSlackSessionProcessing, isSlackRenderV2Enabled2, ensureSlackThreadTree2, processSlackRenderV22, registerTreeMessage, getSlackApp2, initSlackApp2, startSlackApp2, stopSlackApp2 };

package/dist/{cli-v2g93k4v.js → cli-3e9vs93g.js}

@@ -7,20 +7,20 @@ import {
   tierConfigKey,
   init_model_tier_keys,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   ensureRbacSeedsSynced2,
   init_rbac_roles
-} from "./cli-z2dv25mf.js";
+} from "./cli-86zpfje5.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-9mm5ade4.js";
+} from "./cli-bpbcpd8b.js";
 import {
   MODEL_TIERS,
   DEFAULT_MODEL_TIER_MAP,
   ProviderNameSchema,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mntxtkhn.js";
 
 // src/be/boot-seeds.ts
 init_db3();

package/dist/{cli-1dp1zj04.js → cli-4qkg9968.js}

@@ -15,7 +15,7 @@ import {
   init_secret_registry,
   upsertSwarmConfig2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   createRuntimeProvider,
   init_runtime_providers
@@ -25,7 +25,7 @@ import {
   init_session_token_connections,
   insertSessionToken,
   init_users
-} from "./cli-gwcf52gz.js";
+} from "./cli-b6tnjdvx.js";
 import {
   RuntimeControllerCreateSchema,
   RuntimeControllerUpdateSchema,
@@ -33,7 +33,7 @@ import {
   RuntimePoolUpdateSchema,
   RuntimePoolCreateAgentSchema,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mntxtkhn.js";
 import {
   scrubSecrets,
   registerVolatileSecret,

package/dist/{cli-ba8ne1es.js → cli-4rvr7zfx.js}

@@ -317,10 +317,12 @@ var init_legacy_policy = __esm(() => {
     "script.api.update": leadOnly,
     "script.api.rotate": leadOnly,
     "script.api.delete": leadOnly,
+    "schedule.deferral.update.any": leadOrResourceOwner,
     "runtime_pool.write": operatorOrUser,
     "runtime_pool.bind": leadOrOperatorOrUser,
     "runtime_controller.write": operatorOrUser,
     "agent.token.manage": operatorOrUser,
+    "user.role.manage": operatorOrUser,
     "extension.write": extensionWrite,
     "extension.activate": extensionActivation,
     "extension.install.inline": leadOrOperatorOrUser
@@ -374,6 +376,10 @@ var init_permissions = __esm(() => {
       description: "Mint, rotate, or revoke an agent-bound worker token.",
       namespace: "agent"
     },
+    "user.role.manage": {
+      description: "Assign or remove a person's RBAC roles.",
+      namespace: "user"
+    },
     "task.cancel.any": {
       description: "Cancel any task (beyond tasks the caller created).",
       namespace: "task"
@@ -678,6 +684,10 @@ var init_permissions = __esm(() => {
       description: "Delete an external script API endpoint.",
       namespace: "script"
     },
+    "schedule.deferral.update.any": {
+      description: "Change a defer-task schedule the caller did not create.",
+      namespace: "schedule"
+    },
     "runtime_pool.write": {
       description: "Create, update, or delete runtime pools (image, provider kind, placement).",
       namespace: "runtime_pool"

package/dist/{cli-rngde2jv.js → cli-6y43v79h.js}

@@ -9,7 +9,7 @@ import {
   acquireOAuthRefreshLock,
   releaseOAuthRefreshLock,
   init_oauth
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   scrubSecrets,
   registerVolatileSecret,

package/dist/{cli-z63a269p.js → cli-7ccf7akh.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mntxtkhn.js";
 import {
   getOpenRouterBaseUrl,
   getOpenRouterAttributionHeaders,

package/dist/{cli-z2dv25mf.js → cli-86zpfje5.js}

@@ -1,12 +1,14 @@
 import {
   getDb2,
   getDbClient2,
+  invalidateTelemetryUserRole,
+  init_telemetry_identity,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   PermissionVerbSchema,
   init_rbac
-} from "./cli-ba8ne1es.js";
+} from "./cli-4rvr7zfx.js";
 import {
   init_env_flag
 } from "./cli-cebvbc9t.js";
@@ -15,6 +17,16 @@ import {
 } from "./cli-242037k3.js";
 
 // src/be/rbac-roles.ts
+function roleRowToUserRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    isBuiltin: row.isBuiltin === 1,
+    grantsAll: row.grantsAll === 1,
+    createdAt: row.createdAt
+  };
+}
 function validateBuiltinVerb(roleName, verb) {
   const parsed = PermissionVerbSchema.safeParse(verb);
   if (!parsed.success) {
@@ -69,6 +81,88 @@ async function getUserGrant2(userId) {
   }
   return { grantsAll: false, verbs };
 }
+async function listUserRoles2(userId) {
+  const rows = await getDbClient2().query(`SELECT r.id, r.name, r.description, r.isBuiltin, r.grantsAll, r.createdAt
+     FROM principal_roles pr
+     JOIN roles r ON r.id = pr.roleId
+     WHERE pr.principalType = 'user' AND pr.principalId = ?
+     ORDER BY r.name`, [userId]);
+  return rows.map(roleRowToUserRole);
+}
+async function listRbacRoles2() {
+  const client = getDbClient2();
+  const roles = await client.query("SELECT id, name, description, isBuiltin, grantsAll, createdAt FROM roles ORDER BY name");
+  const perms = await client.query("SELECT roleId, verb FROM role_permissions ORDER BY verb");
+  return roles.map((row) => ({
+    ...roleRowToUserRole(row),
+    primary: PRIMARY_ROLE_NAMES2.includes(row.name),
+    verbs: perms.filter((p) => p.roleId === row.id).map((p) => p.verb)
+  }));
+}
+async function assertNotLastAdmin2(userId) {
+  const client = getDbClient2();
+  const self = await client.get(`SELECT COUNT(*) AS n
+     FROM users u
+     JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+     JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+     WHERE u.status = 'active' AND u.id = ?`, [userId]);
+  if ((self?.n ?? 0) === 0)
+    return;
+  const others = await client.get(`SELECT COUNT(DISTINCT u.id) AS n
+     FROM users u
+     JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+     JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+     WHERE u.status = 'active' AND u.id <> ?`, [userId]);
+  if ((others?.n ?? 0) === 0)
+    throw new LastAdminError2;
+}
+async function setUserRoles2(userId, roleNames, actorUserId) {
+  const names = [...new Set(roleNames)];
+  if (names.filter((name) => PRIMARY_ROLE_NAMES2.includes(name)).length !== 1) {
+    throw new InvalidRoleSetError2(`Pick exactly one primary role: ${PRIMARY_ROLE_NAMES2.join(", ")}`);
+  }
+  return getDbClient2().transaction(async (tx) => {
+    const wanted = [];
+    for (const name of names) {
+      const row = await tx.get("SELECT id, name, grantsAll FROM roles WHERE name = ?", [name]);
+      if (!row)
+        throw new InvalidRoleSetError2(`Unknown role: ${name}`);
+      wanted.push(row);
+    }
+    const current = await tx.query(`SELECT r.id, r.name, r.grantsAll
+       FROM principal_roles pr JOIN roles r ON r.id = pr.roleId
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.name`, [userId]);
+    const wantsAll = wanted.some((r) => r.grantsAll === 1);
+    if (current.some((r) => r.grantsAll === 1) && !wantsAll) {
+      const user = await tx.get("SELECT status FROM users WHERE id = ?", [
+        userId
+      ]);
+      if (user?.status === "active") {
+        const others = await tx.get(`SELECT COUNT(DISTINCT u.id) AS n
+           FROM users u
+           JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+           JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+           WHERE u.status = 'active' AND u.id <> ?`, [userId]);
+        if ((others?.n ?? 0) === 0)
+          throw new LastAdminError2;
+      }
+    }
+    const wantedIds = new Set(wanted.map((r) => r.id));
+    for (const row of current) {
+      if (!wantedIds.has(row.id)) {
+        await tx.run(`DELETE FROM principal_roles
+           WHERE principalType = 'user' AND principalId = ? AND roleId = ?`, [userId, row.id]);
+      }
+    }
+    for (const row of wanted) {
+      await tx.run(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId, created_by)
+         VALUES ('user', ?, ?, ?)`, [userId, row.id, actorUserId]);
+    }
+    getDbClient2().afterCommit(() => invalidateTelemetryUserRole(userId));
+    return { before: current.map((r) => r.name), after: wanted.map((r) => r.name).sort() };
+  });
+}
 function ensureRbacSeedsSynced2(opts) {
   const db = getDb2();
   const desiredVerbsByRoleId = validatedBuiltinVerbSets();
@@ -145,7 +239,7 @@ function ensureRbacSeedsSynced2(opts) {
   }
   return stats;
 }
-var DEFAULT_ROLE_ID = "rbac-role-admin", BUILTIN_ROLES, CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
+var DEFAULT_ROLE_ID = "rbac-role-admin", BUILTIN_ROLES, PRIMARY_ROLE_NAMES2, CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
 CREATE TRIGGER IF NOT EXISTS trg_users_default_role
 AFTER INSERT ON users
 BEGIN
@@ -153,9 +247,10 @@ BEGIN
   SELECT 'user', NEW.id, 'rbac-role-admin'
   WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
 END;
-`, loggedInvalidGrantVerbs;
+`, loggedInvalidGrantVerbs, InvalidRoleSetError2, LastAdminError2;
 var init_rbac_roles = __esm(() => {
   init_rbac();
+  init_telemetry_identity();
   init_env_flag();
   init_db3();
   BUILTIN_ROLES = [
@@ -183,9 +278,25 @@ var init_rbac_roles = __esm(() => {
         "session.share",
         "session.presence"
       ]
+    },
+    {
+      id: "rbac-role-viewer",
+      name: "viewer",
+      description: "Read-only: no task, approval or script writes.",
+      isBuiltin: true,
+      grantsAll: false,
+      verbs: ["favorite.write.own", "session.presence"]
     }
   ];
+  PRIMARY_ROLE_NAMES2 = ["admin", "requester", "viewer"];
   loggedInvalidGrantVerbs = new Set;
+  InvalidRoleSetError2 = class InvalidRoleSetError2 extends Error {
+  };
+  LastAdminError2 = class LastAdminError2 extends Error {
+    constructor() {
+      super("last_admin");
+    }
+  };
 });
 
-export { getUserGrant2, ensureRbacSeedsSynced2, init_rbac_roles };
+export { PRIMARY_ROLE_NAMES2, getUserGrant2, listUserRoles2, listRbacRoles2, InvalidRoleSetError2, LastAdminError2, assertNotLastAdmin2, setUserRoles2, ensureRbacSeedsSynced2, init_rbac_roles };

package/dist/{cli-fes51ya2.js → cli-aaqnqpyw.js}

@@ -1,7 +1,7 @@
 import {
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-jpxsrxcb.js";
+} from "./cli-xw9q173h.js";
 import {
   CONTEXT_FORMULA,
   computeContextUsedUnified,
@@ -36,7 +36,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 init_secret_scrubber();
-var AMP_PACKAGE = "@ampcode/cli@0.0.1792670445-ge8d5b3";
+var AMP_PACKAGE = "@ampcode/cli@0.0.1792728062-g40cf3f";
 var AMP_MCP_SERVER_NAME = "agent-swarm";
 var AMP_PLUGIN_MODE_KEY = "agent-swarm";
 var AMP_LIVE_TEST_TIMEOUT_MS = 5000;

package/dist/{cli-qfm6my86.js → cli-b1tv22wr.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-22rmcjkg.js";
+} from "./cli-kcnwn85g.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-xc65x52q.js → cli-b63d08rs.js}

@@ -4,7 +4,7 @@ import {
   claimKv2,
   deleteKv2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   isEnvFlagEnabled,
   init_env_flag

package/dist/{cli-gwcf52gz.js → cli-b6tnjdvx.js}

@@ -5,7 +5,7 @@ import {
   validateRuntimeTokenTtlHours,
   init_swarm_config_guard,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   registerVolatileSecret,
   unregisterVolatileSecret,
@@ -282,7 +282,10 @@ function runtimeTokenTtlMs() {
 async function mintRuntimeToken(agentId, runtimeId, ttlMs = runtimeTokenTtlMs()) {
   return await insertSessionToken(agentId, null, runtimeId, ttlMs);
 }
-async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRuntimeId = null, expiresAtCeiling, controllerId = null, parentTokenId = null) {
+async function mintScriptRunToken(agentId, ttlMs) {
+  return await insertSessionToken(agentId, null, null, ttlMs, null, undefined, null, null, true);
+}
+async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRuntimeId = null, expiresAtCeiling, controllerId = null, parentTokenId = null, scriptRun = false) {
   const plaintext = `${SESSION_TOKEN_PREFIX}${base62(randomBytes(24))}`;
   const tokenId = randomUUID().replace(/-/g, "");
   const hash = sha256Hex(plaintext);
@@ -290,8 +293,8 @@ async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRunti
   const now = new Date;
   const expiresAt = new Date(Math.min(now.getTime() + ttlMs, expiresAtCeiling ? Date.parse(expiresAtCeiling) : Infinity)).toISOString();
   await getDbClient2().run(`INSERT INTO session_tokens
-     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId, parentTokenId)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId, parentTokenId, scriptRun)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     tokenId,
     hash,
     preview,
@@ -302,7 +305,8 @@ async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRunti
     expiresAt,
     now.toISOString(),
     controllerId,
-    parentTokenId
+    parentTokenId,
+    scriptRun ? 1 : 0
   ]);
   return { tokenId, plaintext };
 }
@@ -426,7 +430,7 @@ async function resolveSessionToken(plaintext, options = {}) {
 function fingerprintApiKey(rawKey) {
   return `op:${sha256Hex(rawKey).slice(0, 16)}`;
 }
-var TOKEN_PREFIX = "aswt_", SESSION_TOKEN_PREFIX = "aseph_", InvalidRuntimeTokenError, AGENT_TOKEN_BINDING = "taskId IS NULL AND runtimeId IS NULL AND controllerId IS NULL AND parentRuntimeId IS NULL", AGENT_TOKEN_NO_EXPIRY = "9999-12-31T23:59:59.999Z", AGENT_TOKEN_DEFAULT_TTL_MS = null, AgentTokenExistsError;
+var TOKEN_PREFIX = "aswt_", SESSION_TOKEN_PREFIX = "aseph_", InvalidRuntimeTokenError, AGENT_TOKEN_BINDING = "taskId IS NULL AND runtimeId IS NULL AND controllerId IS NULL AND parentRuntimeId IS NULL AND scriptRun = 0", AGENT_TOKEN_NO_EXPIRY = "9999-12-31T23:59:59.999Z", AGENT_TOKEN_DEFAULT_TTL_MS = null, AgentTokenExistsError;
 var init_users = __esm(() => {
   init_telemetry_identity();
   init_secret_scrubber();
@@ -445,4 +449,4 @@ var init_users = __esm(() => {
   };
 });
 
-export { registerSessionTokenConnection, closeSessionTokenConnections, init_session_token_connections, findUserById, findUserByExternalId, findUserByEmail, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, InvalidRuntimeTokenError, mintSessionToken, mintRuntimeToken, insertSessionToken, revokeSessionToken, revokeRuntimeTokensForRuntime, AgentTokenExistsError, mintAgentToken, rotateAgentToken, revokeAgentTokens, resolveSessionToken, fingerprintApiKey, init_users };
+export { registerSessionTokenConnection, closeSessionTokenConnections, init_session_token_connections, findUserById, findUserByExternalId, findUserByEmail, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, InvalidRuntimeTokenError, mintSessionToken, mintRuntimeToken, mintScriptRunToken, insertSessionToken, revokeSessionToken, revokeRuntimeTokensForRuntime, AgentTokenExistsError, mintAgentToken, rotateAgentToken, revokeAgentTokens, resolveSessionToken, fingerprintApiKey, init_users };

package/dist/{cli-9mm5ade4.js → cli-bpbcpd8b.js}

@@ -1,7 +1,7 @@
 import {
   getDb2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-csh8fnbg.js";
 import {
   openAICompatibleProviderIds,
   withRegistryCatalogSections,

package/dist/{cli-qfjm4gvt.js → cli-cf63dnxj.js}

@@ -1,6 +1,6 @@
 import {
   runStopHookSessionSummarySubprocess
-} from "./cli-ajqhxtnz.js";
+} from "./cli-f3pfn4x3.js";
 import {
   CONTEXT_FORMULA,
   getContextWindowSize,
@@ -1236,7 +1236,7 @@ class ClaudeAdapter2 {
     if (transport === "sdk" && isClaudeBridgeEffective(sourceEnv)) {
       throw new Error("CLAUDE_TRANSPORT=sdk cannot run with an effective Claude Bridge configuration. Select CLI transport or disable the bridge.");
     }
-    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-05kat8rv.js") : undefined;
+    const claudeSdk = transport === "sdk" ? await import("./claude-sdk-session-0zrdzyx2.js") : undefined;
     claudeSdk?.validateClaudeSdkAdditionalArgs([
       ...claudeBinaryArgv.slice(1),
       ...config.additionalArgs ?? []