@desplega.ai/agent-swarm 2.5.2 → 2.5.4

package/dist/{cli-h5d22pfs.js → cli-asq5ydm4.js}

@@ -111,6 +111,10 @@ import {
   cancelTask2,
   getRecentlyCancelledTasksForAgent2,
   updateTaskProgress2,
+  getRunLineageBlock,
+  getWorkflowRunStatus,
+  disarmWorkflowTreeRetries,
+  getRunningSubWorkflowSteps,
   getSettledChildRunParentSteps,
   init_workflow_runs,
   CHAT_SDK_ADAPTER_NAMES,
@@ -283,7 +287,6 @@ import {
   getApprovalRequestById2,
   resolveApprovalRequest2,
   cancelApprovalRequestById2,
-  listCancelledApprovalRequestsForRun2,
   getStuckApprovalRuns2,
   getDueWaitStates2,
   getStuckWaitRuns2,
@@ -336,19 +339,19 @@ import {
   recordInlineScriptRun2,
   exports_db,
   init_db3
-} from "./cli-csh8fnbg.js";
+} from "./cli-jb30dzvk.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-86zpfje5.js";
+} from "./cli-ff1tm9n9.js";
 import {
   ensurePricingSeeded2,
   ensureRbacSeeded2,
   ensureModelProfilesSeeded2
-} from "./cli-3e9vs93g.js";
+} from "./cli-c61mbdds.js";
 import {
   loadModelsDevCache
-} from "./cli-bpbcpd8b.js";
+} from "./cli-sbwsxvtd.js";
 import {
   buildCatalogEntries,
   listModelCatalog,
@@ -358,12 +361,16 @@ import {
   loadModelsCatalog,
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-0vgy5wfw.js";
+} from "./cli-bvpgr9ny.js";
 import {
   ampPinProviderError,
   ampPinCatalogError,
   ampModelError
-} from "./cli-xw9q173h.js";
+} from "./cli-9s05422w.js";
+import {
+  workflowEventBus2,
+  init_event_bus
+} from "./cli-dabehxhp.js";
 import {
   notifyAutomationPreflightFailure,
   isNeedsSetupFailure,
@@ -373,6 +380,16 @@ import {
   schedulePreflightInput,
   recordSchedulePreflightFailure,
   BaseExecutor,
+  AGENT_MAX_TASKS_CONFIG_KEY,
+  resetAgentMaxTasksMirror,
+  upsertSwarmConfigWithPolicyMirror,
+  getRuntimeInstanceById,
+  markRuntimeTerminated,
+  touchRuntimeInstance,
+  markRuntimeInstanceOffline,
+  reconcileAgentStatusFromRuntimes,
+  ConfigQuestionSettingsSchema,
+  normalizeApprovalQuestions,
   resolveSlackConversationId,
   postApprovalCancellationUpdates,
   createApprovalFollowUpTask,
@@ -400,6 +417,7 @@ import {
   startWorkflowExecution2,
   failRunOnUnreadableReplay,
   isWorkflowRunActive,
+  isStepExecuting,
   holdWorkflowRun,
   walkGraph,
   findReadyNodes,
@@ -409,6 +427,7 @@ import {
   isForeachChildOwned,
   parkAndDriveForeach,
   runForeachDrive,
+  resolveForeachParent,
   stepFailureMode,
   generateEdges,
   resolveValidationPort,
@@ -416,7 +435,7 @@ import {
   definitionNodeIds,
   validateDefinition,
   applyDefinitionPatch
-} from "./cli-j3dwd4kz.js";
+} from "./cli-gbfxp48k.js";
 import {
   require_dist2,
   publicEndpointSsrfOptions,
@@ -476,19 +495,22 @@ import {
   deleteApp,
   typecheckScript,
   parseSkillContent
-} from "./cli-e91vshb1.js";
+} from "./cli-7p4jxgtt.js";
 import {
   buildAuthorizationUrl,
   onAuthorizationRefreshed,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow
-} from "./cli-6y43v79h.js";
+} from "./cli-tsma7p8v.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
   terminateProcessGroup
 } from "./cli-3ggwdtb0.js";
+import {
+  isMultiRuntimeEnabled
+} from "./cli-e8xyjvfc.js";
 import {
   noteSlackInboundSideEffect,
   terminalReactionEvent,
@@ -514,18 +536,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-15xd0j7w.js";
+} from "./cli-abs8ndtr.js";
 import {
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin,
   externalChannelToolError2,
   getChannelBlockReason2
-} from "./cli-b63d08rs.js";
-import {
-  workflowEventBus2,
-  init_event_bus
-} from "./cli-dabehxhp.js";
+} from "./cli-eftzyh9y.js";
 import {
   shapeApprovalResolution,
   SubWorkflowExecutor,
@@ -539,11 +557,12 @@ import {
   retryFailedRun2,
   cancelWorkflowRunRows2,
   cancelWorkflowRun2,
+  postTreeApprovalCancellations2,
   resumeWaitState2,
   recoverResolvedWaitState2,
   resumeFromChildRun2,
   initWaitBusSubscriptions2
-} from "./cli-y3dzwyy3.js";
+} from "./cli-x0f2v69c.js";
 import {
   duplicateGuardedQueryKey,
   parseQueryParams,
@@ -570,10 +589,7 @@ import {
   isPublicRoute,
   findRoute,
   route
-} from "./cli-d172svcw.js";
-import {
-  isMultiRuntimeEnabled
-} from "./cli-e8xyjvfc.js";
+} from "./cli-gwhjmh8g.js";
 import {
   FilesError,
   providerPath,
@@ -584,7 +600,7 @@ import {
 import {
   getRuntimePool2,
   init_db
-} from "./cli-4qkg9968.js";
+} from "./cli-19202kew.js";
 import {
   getMemoryRaterNames,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -609,7 +625,7 @@ import {
 import {
   canProvisionKind,
   init_runtime_providers
-} from "./cli-p859hcc8.js";
+} from "./cli-dew6x255.js";
 import {
   findUserById,
   findUserByExternalId,
@@ -621,11 +637,10 @@ import {
   linkIdentity,
   unlinkIdentity,
   resolveUserByToken,
-  revokeRuntimeTokensForRuntime,
   resolveSessionToken,
   fingerprintApiKey,
   init_users
-} from "./cli-b6tnjdvx.js";
+} from "./cli-6a1xg1p7.js";
 import {
   isRbacEnabled,
   decideAdmission,
@@ -694,7 +709,7 @@ import {
   KvNamespaceSchema,
   KvKeySchema,
   init_types
-} from "./cli-mntxtkhn.js";
+} from "./cli-mz9afxxf.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -703,7 +718,7 @@ import {
   taskAttachmentFetchCommand,
   taskAttachmentDisplayUrl,
   init_task_attachment_links
-} from "./cli-gpv60278.js";
+} from "./cli-e42vss7b.js";
 import {
   getSlackConfiguration,
   init_config
@@ -721,7 +736,7 @@ import {
   init_registry,
   resolveTemplate,
   init_resolver
-} from "./cli-tx00c0h6.js";
+} from "./cli-dqygeeh5.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -763,7 +778,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-kcnwn85g.js";
+} from "./cli-xtrz6bzs.js";
 import {
   realtimeBus,
   init_bus
@@ -20071,6 +20086,7 @@ async function poolHarnessModelError(model) {
 // src/extensions/apply-task-create.ts
 init_types();
 init_secret_scrubber();
+init_event_bus();
 
 // src/extensions/dispatcher.ts
 init_db_client();
@@ -20140,6 +20156,7 @@ async function recoverIncompleteRuns(registry) {
     }
   }
   recovered += await recoverForeachFanouts(registry);
+  recovered += await recoverOrphanedSubWorkflowSteps(registry);
   if (recovered > 0) {
     console.log(`[workflows] Recovered ${recovered} incomplete run(s)`);
   }
@@ -20155,6 +20172,10 @@ async function recoverRunningRuns(registry) {
       const run = await getWorkflowRun2(runId);
       if (!run || run.status !== "running")
         continue;
+      if (run.parentStepId && run.context === undefined) {
+        await failRunningRun(runId, "Child workflow run lost its initial context in a restart");
+        continue;
+      }
       const workflow = await getWorkflow2(run.workflowId);
       if (!workflow)
         continue;
@@ -20181,6 +20202,43 @@ async function recoverRunningRuns(registry) {
   }
   return recovered;
 }
+async function failRunningRun(runId, error) {
+  await getDbClient2().transaction(async () => {
+    const run = await getWorkflowRun2(runId);
+    if (run?.status !== "running")
+      return;
+    await updateWorkflowRun2(runId, {
+      status: "failed",
+      error,
+      finishedAt: new Date().toISOString()
+    });
+  });
+}
+async function recoverOrphanedSubWorkflowSteps(registry) {
+  let recovered = 0;
+  for (const row of await getRunningSubWorkflowSteps()) {
+    try {
+      if (isWorkflowRunActive(row.runId) || isStepExecuting(row.stepId))
+        continue;
+      const run = await getWorkflowRun2(row.runId);
+      if (!run || run.status !== "running" && run.status !== "waiting")
+        continue;
+      const workflow = await getWorkflow2(run.workflowId);
+      const node = workflow?.definition.nodes.find((n) => n.id === row.nodeId);
+      if (!workflow || !node)
+        continue;
+      if (isWorkflowRunActive(row.runId))
+        continue;
+      await walkGraph(workflow.definition, row.runId, run.context ?? {}, [node], registry, workflow.id, getSecretInputKeys(workflow.input));
+      recovered++;
+    } catch (err) {
+      if (await failRunOnUnreadableReplay(row.runId, err))
+        continue;
+      console.error(`[workflows] Failed to recover sub-workflow step ${row.stepId}:`, err);
+    }
+  }
+  return recovered;
+}
 function retryPendingNodeIds(steps) {
   const nodeIds = new Set;
   for (const step of steps) {
@@ -20194,6 +20252,8 @@ async function completeIfSettled(runId, ctx) {
     const run = await getWorkflowRun2(runId);
     if (run?.status !== "running")
       return false;
+    if (await getRunLineageBlock(runId))
+      return false;
     const steps = await getWorkflowRunStepsByRunId2(runId);
     if (retryPendingNodeIds(steps).size > 0)
       return false;
@@ -20386,6 +20446,7 @@ async function getRunIdsByStatus(status) {
 }
 // src/workflows/retry-poller.ts
 init_db3();
+init_workflow_runs();
 var pollerTimeout = null;
 function startRetryPoller(registry, intervalMs = 5000) {
   if (pollerTimeout !== null)
@@ -20402,6 +20463,14 @@ function startRetryPoller(registry, intervalMs = 5000) {
           const workflow = await getWorkflow2(run.workflowId);
           if (!workflow)
             continue;
+          const foreachParent = resolveForeachParent(workflow.definition, step.nodeId);
+          if (foreachParent) {
+            if (!await claimRetry(run.id, step.id, { requeueForeachChild: true }))
+              continue;
+            console.log(`[workflows] Retrying foreach item ${step.nodeId} (attempt ${step.retryCount}) for run ${step.runId}`);
+            await runForeachDrive(run.id, foreachParent.id, registry);
+            continue;
+          }
           const node = workflow.definition.nodes.find((n) => n.id === step.nodeId);
           if (!node)
             continue;
@@ -20409,6 +20478,7 @@ function startRetryPoller(registry, intervalMs = 5000) {
           release = holdWorkflowRun(run.id);
           if (!await claimRetry(run.id, step.id))
             continue;
+          const fence = { retryCount: step.retryCount };
           const {
             ctx,
             inputCtx,
@@ -20416,7 +20486,7 @@ function startRetryPoller(registry, intervalMs = 5000) {
             scriptBodyUnresolved
           } = await rebuildNodeExecutionInput(workflow.definition, run, node, registry);
           if (scriptBodyUnresolved && scriptBodyUnresolved.length > 0) {
-            await checkpointStepFailure(run.id, step.id, scriptBodyInterpolationError(node.id, scriptBodyUnresolved), step.retryCount);
+            await checkpointStepFailure(run.id, step.id, scriptBodyInterpolationError(node.id, scriptBodyUnresolved), step.retryCount, undefined, { fence });
             continue;
           }
           const executor = registry.get(node.type);
@@ -20436,8 +20506,8 @@ function startRetryPoller(registry, intervalMs = 5000) {
               meta
             });
             if (result.status === "failed") {
-              const retryPolicy = node.retry || executor.retryPolicy;
-              await checkpointStepFailure(run.id, step.id, result.error || "Retry failed", step.retryCount, retryPolicy);
+              const retryPolicy = result.retryable === false ? undefined : node.retry || executor.retryPolicy;
+              await checkpointStepFailure(run.id, step.id, result.error || "Retry failed", step.retryCount, retryPolicy, { fence, output: result.output });
             } else if ("async" in result && result.async && result.waitFor === FOREACH_ITEMS_WAIT_FOR) {
               const drive = await parkAndDriveForeach({
                 runId: run.id,
@@ -20457,12 +20527,16 @@ function startRetryPoller(registry, intervalMs = 5000) {
               const waiting = await checkpointStepWaiting(run.id, step.id, ctx);
               if (!waiting)
                 continue;
+              if (result.waitFor === "workflow.child.finished") {
+                const { resumeFromChildRun } = await import("./resume-frdtgfa0.js");
+                await resumeFromChildRun(step.id, registry);
+              }
             } else {
               let validationPassed;
               if (node.validation) {
                 const validationResult = await runStepValidation(registry, node, result.output, ctx, meta);
                 if (validationResult.outcome === "halt") {
-                  await checkpointStepFailure(run.id, step.id, "Validation failed (mustPass)", step.retryCount);
+                  await checkpointStepFailure(run.id, step.id, "Validation failed (mustPass)", step.retryCount, undefined, { fence });
                   continue;
                 }
                 if (validationResult.outcome === "retry") {
@@ -20472,13 +20546,15 @@ function startRetryPoller(registry, intervalMs = 5000) {
                     ctx[historyKey] = [...existing, validationResult.retryContext];
                   }
                   const retryPolicy = node.validation.retry || node.retry;
-                  await checkpointStepFailure(run.id, step.id, "Validation failed, retrying", step.retryCount, retryPolicy);
+                  await checkpointStepFailure(run.id, step.id, "Validation failed, retrying", step.retryCount, retryPolicy, { fence });
                   continue;
                 }
                 validationPassed = validationResult.passed;
               }
               result.nextPort = resolveValidationPort(node.next, result.nextPort, validationPassed);
-              await checkpointStep(run.id, step.id, step.nodeId, result, ctx);
+              if (!await checkpointStep(run.id, step.id, step.nodeId, result, ctx, { fence })) {
+                continue;
+              }
               const port = result.nextPort || "default";
               const successors = getSuccessors(workflow.definition, step.nodeId, port);
               if (successors.length > 0) {
@@ -20492,7 +20568,9 @@ function startRetryPoller(registry, intervalMs = 5000) {
               continue;
             const errorMsg = err instanceof Error ? err.message : String(err);
             const retryPolicy = node.retry || executor.retryPolicy;
-            await checkpointStepFailure(run.id, step.id, errorMsg, step.retryCount, retryPolicy);
+            await checkpointStepFailure(run.id, step.id, errorMsg, step.retryCount, retryPolicy, {
+              fence
+            });
           }
         } catch (err) {
           if (await failRunOnUnreadableReplay(step.runId, err, step.id))
@@ -20509,13 +20587,23 @@ function startRetryPoller(registry, intervalMs = 5000) {
   }
   pollerTimeout = setTimeout(poll, intervalMs);
 }
-async function claimRetry(runId, stepId) {
+async function claimRetry(runId, stepId, options = {}) {
   return getDbClient2().transaction(async () => {
     const run = await getWorkflowRun2(runId);
     if (!run || !RETRYABLE_RUN_STATUSES.has(run.status))
       return false;
+    if (await getRunLineageBlock(runId)) {
+      await disarmWorkflowTreeRetries([runId], new Date().toISOString());
+      return false;
+    }
+    if (options.requeueForeachChild && run.status === "failed") {
+      await getDbClient2().run(`UPDATE workflow_run_steps SET nextRetryAt = NULL, finishedAt = ?
+          WHERE id = ? AND runId = ? AND status = 'failed' AND nextRetryAt IS NOT NULL`, [new Date().toISOString(), stepId, runId]);
+      return false;
+    }
+    const set = options.requeueForeachChild ? "status = 'pending', nextRetryAt = NULL, error = NULL" : "status = 'running', nextRetryAt = NULL";
     const claimed = await getDbClient2().get(`UPDATE workflow_run_steps
-          SET status = 'running', nextRetryAt = NULL
+          SET ${set}
         WHERE id = ? AND runId = ? AND status = 'failed' AND nextRetryAt IS NOT NULL
         RETURNING id`, [stepId, runId]);
     if (!claimed)
@@ -20531,6 +20619,8 @@ async function completeRunIfSettled(runId, ctx) {
     const run = await getWorkflowRun2(runId);
     if (!run || run.status !== "running" && run.status !== "waiting")
       return;
+    if (await getRunLineageBlock(runId))
+      return;
     const steps = await getWorkflowRunStepsByRunId2(runId);
     const live = steps.some((s) => s.status === "running" || s.status === "waiting" || s.status === "failed" && s.nextRetryAt != null);
     if (live)
@@ -21121,7 +21211,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-ft6r6v23.js");
+        const { getSlackApp } = await import("./app-ctn8gsgx.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -21247,7 +21337,7 @@ var RawLlmOutputSchema = object2({
 async function executeRawLlm(config) {
   let modelName = config.model ?? "google/gemini-3-flash-preview";
   try {
-    const { createOpenAI } = await import("./index-6srwvd5b.js");
+    const { createOpenAI } = await import("./index-p4xfz37z.js");
     const llmConfig = await resolveWorkflowLlmConfig(config.model);
     modelName = llmConfig.model;
     const provider = createOpenAI({
@@ -21257,7 +21347,7 @@ async function executeRawLlm(config) {
     });
     const model = provider(llmConfig.model);
     if (config.schema) {
-      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
+      const { generateObject, jsonSchema } = await import("./index-9pn1pfkf.js");
       const { object } = await generateObject({
         model,
         schema: jsonSchema(config.schema),
@@ -21271,7 +21361,7 @@ async function executeRawLlm(config) {
         output: { result: object, model: modelName }
       };
     }
-    const { generateText } = await import("./index-cbxkmfc5.js");
+    const { generateText } = await import("./index-9pn1pfkf.js");
     const { text } = await generateText({
       model,
       prompt: config.prompt
@@ -21711,8 +21801,8 @@ class ValidateExecutor extends BaseExecutor {
     const interpolatedPrompt = this.deps.interpolate(prompt, context);
     const outputStr = typeof targetOutput === "string" ? targetOutput : JSON.stringify(targetOutput);
     try {
-      const { createOpenAI } = await import("./index-6srwvd5b.js");
-      const { generateObject, jsonSchema } = await import("./index-cbxkmfc5.js");
+      const { createOpenAI } = await import("./index-p4xfz37z.js");
+      const { generateObject, jsonSchema } = await import("./index-9pn1pfkf.js");
       const llmConfig = await resolveWorkflowLlmConfig();
       const provider = createOpenAI({
         baseURL: llmConfig.baseURL,
@@ -24505,7 +24595,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-trtcrqae.js");
+  const dispatcher = await import("./dispatcher-7b8e4z2j.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -25540,6 +25630,10 @@ var onTaskCreated = observed("task.created", async (data) => {
   if (task)
     await dispatchPost2("post.task.created", { task }, { skipExtensionId: extensionIdForAgent2(task.creatorAgentId) });
 });
+var onTaskBlocked = observed("task.create_blocked", async (data) => {
+  const { skipExtensionId, ...event } = data;
+  await dispatchPost2("post.task.blocked", event, { skipExtensionId });
+});
 var onTaskCompleted = observed("task.completed", async (data) => {
   const task = await taskFrom(data);
   if (!task)
@@ -25767,6 +25861,7 @@ function initExtensionPostBridge() {
     return;
   subscribed = true;
   workflowEventBus2.on("task.created", onTaskCreated);
+  workflowEventBus2.on("task.create_blocked", onTaskBlocked);
   workflowEventBus2.on("task.completed", onTaskCompleted);
   workflowEventBus2.on("task.failed", onTaskFailed);
   workflowEventBus2.on("task.cancelled", onTaskCancelled);
@@ -25787,6 +25882,7 @@ function teardownExtensionPostBridge() {
     return;
   subscribed = false;
   workflowEventBus2.off("task.created", onTaskCreated);
+  workflowEventBus2.off("task.create_blocked", onTaskBlocked);
   workflowEventBus2.off("task.completed", onTaskCompleted);
   workflowEventBus2.off("task.failed", onTaskFailed);
   workflowEventBus2.off("task.cancelled", onTaskCancelled);
@@ -26322,6 +26418,10 @@ function runContext2(event, payload) {
       agentId = requestAgent ?? stringField(payload, "options", "agentId");
       subject = `${stringField(payload, "origin") ?? "?"}: ${snippet(field(payload, "description"))}`;
       break;
+    case "post.task.blocked":
+      agentId = stringField(payload, "requester", "agentId");
+      subject = `${stringField(payload, "origin") ?? "?"}: ${stringField(payload, "extension", "name") ?? "?"}`;
+      break;
     case "pre.task.followUp":
       agentId = stringField(payload, "workerAgentId");
       subject = `task ${stringField(payload, "completedTask", "id") ?? "?"} ${stringField(payload, "status") ?? ""}`.trim();
@@ -26603,10 +26703,48 @@ var MODIFIABLE_OPTION_KEY_SET = new Set(MODIFIABLE_OPTION_KEYS);
 function warnDroppedKey(extensionName, key) {
   console.warn(scrubSecrets(`[extensions] pre.task.create ignored disallowed key "${key}" from extension "${extensionName}"`));
 }
+function scrubFields(fields) {
+  return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined).map(([key, value]) => [key, typeof value === "string" ? scrubSecrets(value) : value]));
+}
 async function applyPreTaskCreate(args) {
   const creatingExtensionId = extensionIdForAgent2(args.requestInfo?.agentId);
   const creatingExtension = creatingExtensionId ? listRegistered2().find((loaded) => loaded.record.id === creatingExtensionId) : undefined;
   const origin = creatingExtension ? `extension:${creatingExtension.record.name}` : args.origin;
+  const blocked = (reason, extension) => {
+    const { options, requestInfo } = args;
+    const event = {
+      extension,
+      reason: scrubSecrets(reason),
+      origin,
+      source: options.source,
+      requester: scrubFields({
+        userId: options.requestedByUserId,
+        agentId: requestInfo?.agentId ?? options.creatorAgentId,
+        slackUserId: options.slackUserId
+      }),
+      context: scrubFields({
+        contextKey: options.contextKey ?? requestInfo?.contextKey,
+        scheduleId: options.scheduleId,
+        workflowRunId: options.workflowRunId,
+        workflowRunStepId: options.workflowRunStepId,
+        parentTaskId: options.parentTaskId,
+        vcsRepo: options.vcsRepo,
+        vcsNumber: options.vcsNumber,
+        slackChannelId: options.slackChannelId,
+        slackThreadTs: options.slackThreadTs
+      }),
+      description: scrubSecrets(args.description).slice(0, 500)
+    };
+    try {
+      workflowEventBus2.emit("task.create_blocked", {
+        ...event,
+        skipExtensionId: creatingExtensionId
+      });
+    } catch (error) {
+      console.error("[extensions] task.create_blocked event not emitted:", scrubSecrets(error instanceof Error ? error.message : String(error)));
+    }
+    return { kind: "blocked", reason: event.reason, extension };
+  };
   let modelEditor;
   const result = await dispatchPre2("pre.task.create", {
     description: args.description,
@@ -26641,11 +26779,7 @@ async function applyPreTaskCreate(args) {
     }
   });
   if (result.action === "block") {
-    return {
-      kind: "blocked",
-      reason: result.reason,
-      extension: result.extension
-    };
+    return blocked(result.reason, result.extension);
   }
   if (result.action === "continue") {
     return { kind: "proceed", description: args.description, options: args.options };
@@ -26659,11 +26793,7 @@ async function applyPreTaskCreate(args) {
       agentId: options.agentId
     });
     if (modelError) {
-      return {
-        kind: "blocked",
-        reason: `pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`,
-        extension: modelEditor
-      };
+      return blocked(`pre.task.create rewrite from extension "${modelEditor.name}" is invalid: ${modelError}`, modelEditor);
     }
   }
   return {
@@ -28610,240 +28740,6 @@ function teardownAzureDevOpsOutbound() {
 // src/http/core.ts
 init_db3();
 
-// src/be/multi-runtime.ts
-init_secret_scrubber();
-init_db3();
-init_users();
-var AGENT_MAX_TASKS_CONFIG_KEY = "AGENT_MAX_TASKS";
-function parseAgentMaxTasksValue(raw) {
-  const str = raw.trim();
-  if (!/^\d+$/.test(str))
-    return null;
-  const value = Number(str);
-  return value >= 1 && value <= 100 ? value : null;
-}
-function defaultMaxTasksForAgent(agent) {
-  return agent.isLead ? 2 : 1;
-}
-async function getAgentMaxTasksConfig(agentId) {
-  return (await getSwarmConfigs2({ scope: "agent", scopeId: agentId, key: AGENT_MAX_TASKS_CONFIG_KEY }))[0] ?? null;
-}
-async function reconcileAgentMaxTasksPolicy(agentId) {
-  const agent = await getAgentById2(agentId);
-  if (!agent)
-    return;
-  const existing = await getAgentMaxTasksConfig(agentId);
-  if (existing) {
-    const authoritative = parseAgentMaxTasksValue(existing.value);
-    if (authoritative !== null && authoritative !== (agent.maxTasks ?? 1)) {
-      await updateAgentMaxTasks2(agentId, authoritative);
-    }
-    return;
-  }
-  await upsertSwarmConfig2({
-    scope: "agent",
-    scopeId: agentId,
-    key: AGENT_MAX_TASKS_CONFIG_KEY,
-    value: String(agent.maxTasks ?? defaultMaxTasksForAgent(agent)),
-    description: "Logical agent max-tasks policy (seeded from agents.maxTasks)"
-  });
-}
-async function resetAgentMaxTasksMirror(agentId) {
-  const agent = await getAgentById2(agentId);
-  if (!agent)
-    return;
-  await updateAgentMaxTasks2(agentId, defaultMaxTasksForAgent(agent));
-}
-async function upsertSwarmConfigWithPolicyMirror(data) {
-  const scopeId = data.scope === "agent" ? data.scopeId : null;
-  if (!scopeId || data.key !== AGENT_MAX_TASKS_CONFIG_KEY) {
-    return upsertSwarmConfig2(data);
-  }
-  return await getDbClient2().transaction(async () => {
-    const row = await upsertSwarmConfig2(data);
-    const value = parseAgentMaxTasksValue(data.value);
-    if (value !== null)
-      await updateAgentMaxTasks2(scopeId, value);
-    return row;
-  });
-}
-function rowToRuntimeInstance(row) {
-  let metadata = null;
-  if (row.metadata) {
-    try {
-      metadata = JSON.parse(row.metadata);
-    } catch {
-      metadata = null;
-    }
-  }
-  return {
-    id: row.id,
-    agentId: row.agent_id,
-    poolId: row.pool_id ?? null,
-    controllerId: row.controller_id ?? null,
-    externalHandle: row.external_handle ? JSON.parse(row.external_handle) : null,
-    provisionAttempts: row.provision_attempts ?? 0,
-    provisionError: row.provision_error ?? null,
-    provisionRequestedAt: row.provision_requested_at ?? null,
-    draining: row.draining === 1,
-    idleSince: row.idle_since ?? null,
-    leaseExpiresAt: row.lease_expires_at ?? null,
-    taskId: row.task_id ?? null,
-    status: row.status,
-    reportedSlots: row.reported_slots,
-    credentialReady: row.credential_ready === null ? null : row.credential_ready === 1,
-    metadata,
-    lastSeenAt: row.last_seen_at,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
-function runtimeStaleThresholdMinutes() {
-  return Number(process.env.RUNTIME_STALE_THRESHOLD_MIN) || 5;
-}
-function runtimeLivenessCutoff() {
-  return new Date(Date.now() - runtimeStaleThresholdMinutes() * 60 * 1000).toISOString();
-}
-async function upsertRuntimeInstance(instance) {
-  const metadataJson = instance.metadata ? JSON.stringify(instance.metadata) : null;
-  const row = await getDbClient2().transaction(async (tx) => {
-    const provisioning = await tx.get("SELECT id FROM runtime_instances WHERE id = ? AND status = 'provisioning' AND agent_id = ?", [instance.id, instance.agentId]);
-    const row = await tx.get(`INSERT INTO runtime_instances (id, agent_id, status, reported_slots, metadata)
-     VALUES (?, ?, 'active', ?, ?)
-     ON CONFLICT(id) DO UPDATE SET
-       status = 'active',
-       reported_slots = excluded.reported_slots,
-       metadata = COALESCE(excluded.metadata, runtime_instances.metadata),
-       last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
-       updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-     WHERE runtime_instances.agent_id = excluded.agent_id
-     RETURNING *`, [instance.id, instance.agentId, instance.reportedSlots, metadataJson]);
-    if (row?.pool_id && provisioning) {
-      await tx.run("UPDATE agents SET runtime_provision_attempts = 0, runtime_provision_retry_at = NULL WHERE id = ?", [row.agent_id]);
-      await tx.run("UPDATE runtime_pools SET consecutive_failures = 0, circuit_open_until = NULL WHERE id = ?", [row.pool_id]);
-    }
-    return row;
-  });
-  return row ? rowToRuntimeInstance(row) : null;
-}
-async function getRuntimeInstanceById(id) {
-  const row = await getDbClient2().get("SELECT * FROM runtime_instances WHERE id = ?", [id]);
-  return row ? rowToRuntimeInstance(row) : null;
-}
-async function insertProvisioningRuntime(instance) {
-  const row = await getDbClient2().get(`INSERT INTO runtime_instances (id, agent_id, pool_id, controller_id, status,
-       reported_slots, provision_requested_at)
-     VALUES (?, ?, ?, ?, 'provisioning', ?, ?) RETURNING *`, [
-    instance.id,
-    instance.agentId,
-    instance.poolId,
-    instance.controllerId,
-    instance.reportedSlots ?? 1,
-    new Date().toISOString()
-  ]);
-  return rowToRuntimeInstance(row);
-}
-async function markRuntimeTerminated(id, reason) {
-  await getDbClient2().transaction(async () => {
-    const runtime = await getRuntimeInstanceById(id);
-    if (!runtime)
-      return;
-    await markRuntimeInstanceOffline(id, runtime.agentId);
-    if (runtime.status === "provisioning") {
-      await getDbClient2().run("UPDATE runtime_instances SET provision_error = ? WHERE id = ?", [
-        scrubSecrets(reason),
-        id
-      ]);
-    }
-    await reconcileAgentStatusFromRuntimes(runtime.agentId);
-    await revokeRuntimeTokensForRuntime(id);
-  });
-}
-async function touchRuntimeInstance(id, agentId) {
-  const result = await getDbClient2().run(`UPDATE runtime_instances
-     SET last_seen_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
-         updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [id, agentId, runtimeLivenessCutoff()]);
-  return result.changes > 0;
-}
-async function markRuntimeInstanceOffline(id, agentId) {
-  const row = await getDbClient2().get(`UPDATE runtime_instances
-     SET status = 'offline', updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-     WHERE id = ? AND agent_id = ? RETURNING *`, [id, agentId]);
-  return row ? rowToRuntimeInstance(row) : null;
-}
-async function countActiveRuntimeInstancesForAgent(agentId) {
-  const result = await getDbClient2().get(`SELECT COUNT(*) as count FROM runtime_instances
-     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [agentId, runtimeLivenessCutoff()]);
-  return result?.count ?? 0;
-}
-async function listRuntimeInstancesForAgent(agentId) {
-  const rows = await getDbClient2().query(`SELECT *, (status = 'active' AND last_seen_at >= ?) AS is_live
-     FROM runtime_instances
-     WHERE agent_id = ?
-     ORDER BY created_at ASC, id ASC`, [runtimeLivenessCutoff(), agentId]);
-  return rows.map((row) => ({ ...rowToRuntimeInstance(row), isLive: row.is_live === 1 }));
-}
-async function setRuntimeCredentialReady(id, agentId, ready) {
-  const result = await getDbClient2().run(`UPDATE runtime_instances
-     SET credential_ready = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-     WHERE id = ? AND agent_id = ? AND status = 'active' AND last_seen_at >= ?`, [ready ? 1 : 0, id, agentId, runtimeLivenessCutoff()]);
-  return result.changes > 0;
-}
-async function hasReadyLiveRuntime(agentId) {
-  const row = await getDbClient2().get(`SELECT COUNT(*) c FROM runtime_instances
-     WHERE agent_id = ? AND status = 'active' AND last_seen_at >= ?
-       AND (credential_ready IS NULL OR credential_ready = 1)`, [agentId, runtimeLivenessCutoff()]);
-  return (row?.c ?? 0) > 0;
-}
-async function reconcileAgentStatusFromRuntimes(agentId) {
-  await getDbClient2().transaction(async () => {
-    const agent = await getAgentById2(agentId);
-    if (!agent)
-      return;
-    if (await countActiveRuntimeInstancesForAgent(agentId) === 0) {
-      if (agent.status !== "offline")
-        await updateAgentStatus2(agentId, "offline");
-      return;
-    }
-    if (!await hasReadyLiveRuntime(agentId)) {
-      if (agent.status !== "waiting_for_credentials") {
-        await updateAgentStatus2(agentId, "waiting_for_credentials");
-      }
-      return;
-    }
-    const next = await getActiveTaskCount2(agentId) > 0 ? "busy" : "idle";
-    if (agent.status !== next)
-      await updateAgentStatus2(agentId, next);
-  });
-}
-async function agentsWithLiveRuntime() {
-  const rows = await getDbClient2().query(`SELECT DISTINCT agent_id FROM runtime_instances
-     WHERE status = 'active' AND last_seen_at >= ?`, [runtimeLivenessCutoff()]);
-  return new Set(rows.map((r) => r.agent_id));
-}
-async function expireStaleRuntimeInstances() {
-  if (!isMultiRuntimeEnabled()) {
-    return { expired: 0, agentsOffline: 0, pruned: 0 };
-  }
-  return await getDbClient2().transaction(async (tx) => {
-    const cutoff = runtimeLivenessCutoff();
-    const stale = await tx.query(`SELECT id, agent_id FROM runtime_instances
-       WHERE status = 'active' AND last_seen_at < ? AND pool_id IS NULL`, [cutoff]);
-    const pruned = (await tx.run("DELETE FROM runtime_instances WHERE last_seen_at < ? AND status != 'provisioning' AND (pool_id IS NULL OR status = 'offline')", [cutoff])).changes;
-    let agentsOffline = 0;
-    for (const agentId of new Set(stale.map((r) => r.agent_id))) {
-      await reconcileAgentStatusFromRuntimes(agentId);
-      if ((await getAgentById2(agentId))?.status === "offline")
-        agentsOffline++;
-    }
-    return { expired: stale.length, agentsOffline, pruned };
-  });
-}
-async function listRuntimeInstancesForPool(poolId) {
-  return (await getDbClient2().query("SELECT * FROM runtime_instances WHERE pool_id = ? ORDER BY created_at", [poolId])).map(rowToRuntimeInstance);
-}
-
 // src/be/rbac-audit.ts
 init_env_flag();
 init_db3();
@@ -33556,7 +33452,7 @@ async function handleChatInbound(thread, message, kind) {
     }
   }
   if (text || attachments.length > 0) {
-    const acknowledge = kind !== "subscribed";
+    const acknowledge = kind !== "subscribed" || isDirectMessage || mentioned || facts.replyToBot;
     bufferChatMessage(thread.id, {
       messageId: message.id,
       channelId: thread.channelId,
@@ -35130,7 +35026,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-ft6r6v23.js");
+    const { getSlackApp } = await import("./app-ctn8gsgx.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -35201,7 +35097,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient } = await import("./db-v5ytg5pw.js");
+  const { getDbClient } = await import("./db-w759qmx0.js");
   await getDbClient().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -108596,7 +108492,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-a9nsavhx.js");
+  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-3n8m9ea2.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -108612,10 +108508,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-r3e808ky.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-w75maga2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-tgrfy27t.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-dwzfttdr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -113625,6 +113521,7 @@ init_db3();
 
 // src/workflows/approval-cancel.ts
 init_db3();
+init_workflow_runs();
 init_rbac();
 var LIVE_RUN_STATUSES = new Set(["running", "waiting"]);
 async function cancelApprovalRequest(input) {
@@ -113699,19 +113596,23 @@ async function cancelApprovalRequestAndRun(id, data) {
     if (!request)
       return null;
     let runCancelled = false;
+    let treeRunIds = [];
     const runId = request.workflowRunId;
     if (runId) {
-      const run = await getWorkflowRun2(runId);
-      if (run && LIVE_RUN_STATUSES.has(run.status)) {
-        runCancelled = await cancelWorkflowRunRows2(runId, data.reason);
+      const status = await getWorkflowRunStatus(runId);
+      if (status && LIVE_RUN_STATUSES.has(status)) {
+        const result = await cancelWorkflowRunRows2(runId, data.reason);
+        runCancelled = result.cancelled;
+        treeRunIds = result.runIds;
       }
     }
     const slackReason = data.slackReason ?? data.reason;
     client.afterCommit(async () => {
       await postApprovalCancellationUpdates([request], slackReason);
-      if (runCancelled && runId) {
-        const others = (await listCancelledApprovalRequestsForRun2(runId)).filter((row) => row.id !== request.id);
-        await postApprovalCancellationUpdates(others, data.reason);
+      if (runCancelled) {
+        await postTreeApprovalCancellations2(treeRunIds, data.reason, {
+          exceptRequestId: request.id
+        });
       }
     });
     return { request, runCancelled };
@@ -122359,8 +122260,8 @@ init_db3();
 init_constants2();
 var QuestionSchema = object2({
   id: string2().describe("Unique ID for the question (used as key in responses)"),
-  type: _enum2(["approval", "text", "single-select", "multi-select", "boolean"]).describe("Question type"),
-  label: string2().describe("The question text displayed to the user"),
+  type: _enum2(["approval", "text", "single-select", "multi-select", "boolean", "config"]).describe("Question type"),
+  label: string2().optional().describe("The question text displayed to the user (required except for config, which defaults to the key)"),
   required: boolean().optional().describe("Whether this question is required (default: true)"),
   description: string2().optional().describe("Optional help text, rendered as markdown (code fences, images)"),
   placeholder: string2().optional().describe("Placeholder text (for text type)"),
@@ -122372,13 +122273,14 @@ var QuestionSchema = object2({
   })).optional().describe("Options (for single-select/multi-select types)"),
   minSelections: number2().int().min(0).optional().describe("Min selections (for multi-select)"),
   maxSelections: number2().int().min(1).optional().describe("Max selections (for multi-select)"),
-  defaultValue: boolean().optional().describe("Default value (for boolean type)")
+  defaultValue: boolean().optional().describe("Default value (for boolean type)"),
+  config: ConfigQuestionSettingsSchema.optional().describe("Settings for a config question: the key and scope to set, plus options or defaultValue for non-secret keys")
 });
 var registerRequestHumanInputTool = (server) => {
   createToolRegistrar(server)("request-human-input", {
     title: "Request human input",
     annotations: { destructiveHint: false },
-    description: "Create an approval request and return at once with the request id and URL. The answer arrives later as a hitl-follow-up task. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, and boolean. Returns the request ID and URL for the human to respond. " + "The dashboard renders each label and description as markdown: put long content in description, fence code with a language, and put an image URL alone on its own line to show it. " + "No Slack message is sent; share the URL yourself.",
+    description: "Create an approval request and return at once with the request id and URL. The answer arrives later as a hitl-follow-up task. " + "Supports multiple question types: approval (yes/no), text, single-select, " + "multi-select, boolean, and config. Returns the request ID and URL for the human to respond. " + "config asks a person to set one swarm config key on the dashboard; secrets are stored encrypted and you receive only {key, scope, isSecret, status, updatedAt}, never the value. " + "The dashboard renders each label and description as markdown: put long content in description, fence code with a language, and put an image URL alone on its own line to show it. " + "No Slack message is sent; share the URL yourself.",
     inputSchema: object2({
       title: string2().min(1).describe("Title of the approval request"),
       questions: array2(QuestionSchema).min(1).describe("Questions to ask the human"),
@@ -122401,12 +122303,20 @@ var registerRequestHumanInputTool = (server) => {
         sourceTaskId = currentTask.id;
       }
     }
+    const approvers = { policy: "any" };
+    const normalized = await normalizeApprovalQuestions(questions, {
+      approvers,
+      callerAgentId: requestInfo.agentId
+    });
+    if (!normalized.ok) {
+      return toolErr(normalized.error, { data: { yourAgentId: requestInfo.agentId } });
+    }
     const id = crypto.randomUUID();
     const request = await createApprovalRequest2({
       id,
       title,
-      questions,
-      approvers: { policy: "any" },
+      questions: normalized.questions,
+      approvers,
       sourceTaskId: sourceTaskId ?? undefined,
       timeoutSeconds,
       createdBy: await resolveTaskAuditUserId(sourceTaskId, requestInfo.agentId) ?? undefined
@@ -136523,7 +136433,7 @@ var registerCancelWorkflowRunTool = (server) => {
   createToolRegistrar(server)("cancel-workflow-run", {
     title: "Cancel Workflow Run",
     annotations: { destructiveHint: true },
-    description: "Cancel a running or waiting workflow run. Cancels all non-terminal steps and their associated tasks.",
+    description: "Cancel a running or waiting workflow run and every child run below it. Cancels their non-terminal steps, tasks, pending approvals and queued retries in one transaction; finished child runs keep their status. Repeating the cancel on a cancelled run finishes any child runs still open.",
     inputSchema: object2({
       runId: string2().uuid().describe("Workflow run ID to cancel"),
       reason: string2().optional().describe("Optional reason for cancellation")
@@ -137635,4 +137545,4 @@ async function createServer(opts = {}) {
   return server;
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, scopeFromAttachment, backingProviderId, transcribeAudioNotes, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, isBitbucketEnabled, initBitbucket, verifyBitbucketWebhook, isDuplicateDelivery, markDeliveryProcessed, pullRequestEventOf, pullRequestCommentEventOf, handlePullRequestCreated2, handlePullRequestCommentCreated, handlePullRequestClosed, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, isCookieSafePageId, extractPageSession, extractLegacyPageSession, extractAndVerifyCookie, pageSessionSetCookies, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, MCP_MAX_TOOL_INPUT_ELEMENTS, MCP_MAX_REQUEST_BODY_BYTES, userCtx, requestPrincipal, agentFirstPrincipal, rejectGuest, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, MemoryKeyError, refreshLinks, indexMemoryContent, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, scopeFromAttachment, backingProviderId, transcribeAudioNotes, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, isBitbucketEnabled, initBitbucket, verifyBitbucketWebhook, isDuplicateDelivery, markDeliveryProcessed, pullRequestEventOf, pullRequestCommentEventOf, handlePullRequestCreated2, handlePullRequestCommentCreated, handlePullRequestClosed, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, isCookieSafePageId, extractPageSession, extractLegacyPageSession, extractAndVerifyCookie, pageSessionSetCookies, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, MCP_MAX_TOOL_INPUT_ELEMENTS, MCP_MAX_REQUEST_BODY_BYTES, userCtx, requestPrincipal, agentFirstPrincipal, rejectGuest, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, MemoryKeyError, refreshLinks, indexMemoryContent, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };