@desplega.ai/agent-swarm 2.5.3 → 2.6.0

package/dist/{http-mxcqhhcs.js → http-9c6medda.js}

@@ -150,6 +150,8 @@ import {
   TelegramBotApiError,
   callTelegramBotApi,
   isTrustedTeamsServiceUrl,
+  getSessionLabels,
+  rememberSessionLabel,
   isChatSdkStopping,
   startChatSdk,
   getChatInstance,
@@ -176,6 +178,7 @@ import {
   extractAndVerifyCookie,
   pageSessionSetCookies,
   resolveHttpRequestAuth,
+  getDeploymentEnvValue,
   loadGlobalConfigsIntoEnv,
   reloadGlobalConfigsAndIntegrations,
   scheduleIntegrationsReload,
@@ -227,6 +230,7 @@ import {
   getTasksOutputSchema,
   getTasksHandler,
   reservedNamespaceError,
+  privateNamespaceError,
   reservedRoomKeyError,
   updateMcpServerChecked,
   updateTouchesStdioExecution,
@@ -289,17 +293,23 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-aecdcr77.js";
+} from "./cli-4hxrf0p4.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
   pageContextKey,
   init_context_key,
+  sourceOfKey,
+  SOURCE_GROUPS_READ_ONLY,
+  sourceMoveError,
+  init_source_key,
   init_catalog,
   catalog_default,
   COMPANY_TEAM_SIZES,
   COMPANY_USE_CASES,
   USER_FUNCTIONS,
+  reportedUseCase,
+  reportedUserFunction,
   init_company_profile,
   TELEMETRY_PROXY_ORIGIN,
   normalizeOrgWebsite,
@@ -347,6 +357,7 @@ import {
   resolveTriggerSurface,
   emitTaskTelemetry,
   init_telemetry_trigger,
+  CODEX_AUTH_FAILURE_BENCH_THRESHOLD,
   CODEX_AUTH_WATCH_NAMESPACE,
   codexAuthBenchMarkerKey,
   init_codex_auth_failure,
@@ -410,6 +421,7 @@ import {
   listPrefixRoots,
   listSharedPrefixRoots,
   init_session_moves,
+  getSessionGroupKey,
   getSessionReadState,
   getSessionTree,
   triageSessionList,
@@ -440,6 +452,17 @@ import {
   getPausedTasksForAgent2,
   resetOrphanedInProgressTasksForAgent2,
   updateTaskProgress2,
+  IdempotencyKeyTakenError,
+  workflowRequestFingerprint,
+  findAcceptedWorkflowOperation,
+  assertWorkflowIdempotencyKeyUnused,
+  recordAcceptedWorkflowOperation,
+  init_workflow_idempotency,
+  getWorkflowRunSummary,
+  getWorkflowRunStepsSlimByRunId,
+  WORKFLOW_RUN_TREE_MAX_DEPTH,
+  WorkflowRunTreeError,
+  getWorkflowRunTree,
   getWorkflowRunParent,
   init_workflow_runs,
   CHAT_SDK_ADAPTER_NAMES,
@@ -531,6 +554,9 @@ import {
   init_steering,
   refreshActiveSessionOnActivity2,
   recordKeySeatMismatch2,
+  recordKeyValidation2,
+  retirePoolKeyStatus,
+  init_api_keys,
   getScriptRunExecutionArgs2,
   updateTaskVcs2,
   upsertAssetKeyMapping2,
@@ -737,7 +763,7 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-kxawjrxg.js";
+} from "./cli-g8ka5j4j.js";
 import {
   PRIMARY_ROLE_NAMES2,
   getUserGrant2,
@@ -748,22 +774,26 @@ import {
   assertNotLastAdmin2,
   setUserRoles2,
   init_rbac_roles
-} from "./cli-99xgw26r.js";
-import"./cli-210xd1f4.js";
+} from "./cli-a2rr0fmg.js";
+import"./cli-03gg9pd1.js";
 import {
   normalizeModelKey
-} from "./cli-fsdprwrg.js";
+} from "./cli-5sckpqcx.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-n45mr7zh.js";
+} from "./cli-aj8djyqt.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-9s05422w.js";
+} from "./cli-bqztfyve.js";
+import {
+  workflowEventBus2,
+  init_event_bus
+} from "./cli-kt907da6.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -799,7 +829,7 @@ import {
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-jjznk3f7.js";
+} from "./cli-3fwqy71j.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -879,14 +909,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-p9rafdrb.js";
+} from "./cli-3gfvmzht.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-egjggehm.js";
+} from "./cli-kf4jree9.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -914,31 +944,31 @@ import {
   getTaskCitationsForTasks,
   initialize,
   ensure,
+  callSlackWithRetry2,
+  slackErrorCode2,
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-ce0ak9ms.js";
-import"./cli-s53vp709.js";
-import"./cli-qqzmjxkf.js";
+} from "./cli-g20jjwt4.js";
+import"./cli-gnsb1zxa.js";
+import"./cli-v49fkghp.js";
 import {
   _fetchHolder,
   CLIENT_ID,
+  decodeJwt,
   exchangeAuthorizationCode2,
   getAccountId,
+  extractChatgptPlanType,
   deriveCodexKeySuffix,
   MAX_CODEX_OAUTH_SLOT,
   codexOAuthKeyForSlot,
   loadAllCodexOAuthSlots,
   getValidCodexOAuth
-} from "./cli-kxpfx2xr.js";
-import {
-  workflowEventBus2,
-  init_event_bus
-} from "./cli-dabehxhp.js";
+} from "./cli-0z1xjzwa.js";
 import {
   retryFailedRun2,
   cancelWorkflowRun2
-} from "./cli-e2ar4bp1.js";
+} from "./cli-3aqd4jaa.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -983,7 +1013,7 @@ import {
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-1fc85mvt.js";
+} from "./cli-art7c1zh.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -1011,13 +1041,13 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-vwn81jbs.js";
+} from "./cli-gf95q3bm.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
 } from "./cli-3h26v7yj.js";
-import"./cli-pasyvjmm.js";
+import"./cli-737pyqxr.js";
 import {
   startPoolRouting,
   stopPoolRouting,
@@ -1027,8 +1057,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-z21whrrg.js";
-import"./cli-6n8axjv1.js";
+} from "./cli-emhjcj2y.js";
+import"./cli-d2dpf95n.js";
 import {
   import_websocket,
   import_websocket_server
@@ -1037,18 +1067,18 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-svrj71pg.js";
+} from "./cli-c2habvsf.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-5kqnemen.js";
+} from "./cli-yvy48785.js";
 import {
   reasoningCapability,
   supportedReasoningLevels
-} from "./cli-bn0rewsy.js";
+} from "./cli-c081bj3b.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
-} from "./cli-gx4rm0qx.js";
+} from "./cli-7enjwya9.js";
 import {
   isLeadChannelMonitoringEnabled,
   ORG_IDENTITY_KEYS,
@@ -1056,15 +1086,16 @@ import {
   SIMILARITY_THRESHOLD,
   memoryRelevance,
   isUnknownModelError,
+  checkProviderPoolKey,
   writeSkillsToFilesystem
-} from "./cli-hcpj2xqz.js";
+} from "./cli-n7asmce6.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-3ngdk5te.js";
+} from "./cli-6y51ryva.js";
 import {
   Anthropic
-} from "./cli-p6zs9h4y.js";
+} from "./cli-rr7zx19j.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1093,6 +1124,7 @@ import {
   InvalidRuntimeTokenError,
   mintSessionToken,
   mintRuntimeToken,
+  isScriptRunToken,
   revokeSessionToken,
   AgentTokenExistsError,
   mintAgentToken,
@@ -1100,7 +1132,7 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-e8jyq7d8.js";
+} from "./cli-esakngh8.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import"./cli-1f0gp9vz.js";
@@ -1228,6 +1260,7 @@ import {
   ScriptRunListItemSchema,
   ScriptRunJournalEntrySchema,
   WorkflowRunStepSchema,
+  WorkflowRunStepSlimSchema,
   PromptTemplateSchema,
   PromptTemplateHistorySchema,
   ScriptScopeSchema,
@@ -1264,45 +1297,49 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-mz9afxxf.js";
+} from "./cli-4rf0f5vg.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-gpv60278.js";
-import {
-  getSlackConfiguration,
-  init_config
-} from "./cli-qeaq3j6t.js";
+} from "./cli-hfeb68z4.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
 } from "./cli-4sydckyj.js";
 import {
-  interpolate,
-  init_template,
-  getTemplateDefinition,
-  getAllTemplateDefinitions,
-  init_registry,
-  resolveTemplate,
-  init_resolver,
-  init_session_templates
-} from "./cli-tx00c0h6.js";
-import {
-  MODEL_SCOPED_WINDOWS,
-  activeModelBlocks,
-  init_model_rate_limit_windows
-} from "./cli-7421jzsw.js";
+  getSlackConfiguration,
+  init_config
+} from "./cli-qeaq3j6t.js";
 import {
   SUBSCRIPTION_PLANS_CHECKED_AT,
   SUBSCRIPTION_PLANS,
   isSubscriptionPlanId,
   init_subscription_plans
 } from "./cli-7akn6ze9.js";
+import {
+  MODEL_SCOPED_WINDOWS,
+  activeModelBlocks,
+  init_model_rate_limit_windows,
+  CREDENTIAL_POOL_VARS,
+  splitCredentialPool,
+  selectCredential,
+  init_credentials
+} from "./cli-1tem6ns9.js";
 import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-dfyv0jdy.js";
+import {
+  interpolate,
+  init_template,
+  getTemplateDefinition,
+  getAllTemplateDefinitions,
+  init_registry,
+  resolveTemplate,
+  init_resolver,
+  init_session_templates
+} from "./cli-dqygeeh5.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -1337,7 +1374,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-y561h5a9.js";
+} from "./cli-nn6vx2mq.js";
 import {
   realtimeBus,
   init_bus
@@ -1365,12 +1402,15 @@ import {
   findSecretsIn,
   scrubObject,
   registerVolatileSecret,
+  registerEnvSecrets,
   init_secret_scrubber
-} from "./cli-n4c8e3s5.js";
+} from "./cli-708wdy32.js";
 import {
   isAlias,
+  baseUrlEnvVar,
+  providerForKeyVar,
   init_src2
-} from "./cli-nwyw3zhg.js";
+} from "./cli-gxee0bqa.js";
 import {
   __toESM
 } from "./cli-242037k3.js";
@@ -1428,6 +1468,7 @@ init_db3();
 
 // src/be/db-retention.ts
 import { AsyncLocalStorage } from "node:async_hooks";
+init_types();
 init_env_flag();
 init_secret_scrubber();
 init_db3();
@@ -1472,6 +1513,19 @@ var DB_RETENTION_TABLES = [
     metricsKey: "contextVersions",
     initialBatchSize: 50,
     maxBatchSize: 100
+  },
+  {
+    table: "script_runs",
+    policy: "age",
+    timeColumn: "startedAt",
+    cutoffFormat: "sqliteDatetime",
+    statusColumn: "status",
+    terminalStatuses: TERMINAL_SCRIPT_RUN_STATUSES,
+    keepWhenSet: "idempotencyKey",
+    envKey: "SCRIPT_RUNS_RETENTION_DAYS",
+    metricsKey: "scriptRuns",
+    initialBatchSize: 100,
+    maxBatchSize: 500
   }
 ];
 
@@ -1605,13 +1659,26 @@ function sweepStatements(table, value, now) {
       params: [value]
     };
   }
-  const cutoff = new Date(now.getTime() - value * DAY_MS).toISOString();
+  const iso = new Date(now.getTime() - value * DAY_MS).toISOString();
+  const cutoff = "cutoffFormat" in table ? `${iso.slice(0, 10)} ${iso.slice(11, 19)}` : iso;
+  const conditions = [];
+  const params = [];
+  if ("terminalStatuses" in table) {
+    conditions.push(`${table.statusColumn} IN (${table.terminalStatuses.map(() => "?").join(", ")})`);
+    params.push(...table.terminalStatuses);
+  }
+  conditions.push(`${table.timeColumn} < ?`);
+  params.push(cutoff);
+  if ("keepWhenSet" in table) {
+    conditions.push(`rowid NOT IN (SELECT rowid FROM ${table.table} WHERE ${table.keepWhenSet} IS NOT NULL)`);
+  }
+  const where = conditions.join(" AND ");
   return {
-    backlogSql: `SELECT COUNT(*) AS n FROM ${table.table} WHERE ${table.timeColumn} < ?`,
+    backlogSql: `SELECT COUNT(*) AS n FROM ${table.table} WHERE ${where}`,
     deleteSql: `DELETE FROM ${table.table} WHERE rowid IN (
-         SELECT rowid FROM ${table.table} WHERE ${table.timeColumn} < ? ORDER BY ${table.timeColumn} LIMIT ?
+         SELECT rowid FROM ${table.table} WHERE ${where} ORDER BY ${table.timeColumn} LIMIT ?
        )`,
-    params: [cutoff]
+    params
   };
 }
 function dryRunEnabled(env = process.env) {
@@ -5448,6 +5515,33 @@ var reportRateLimit = route({
   },
   auth: { apiKey: true }
 });
+var reportValidation = route({
+  method: "post",
+  path: "/api/keys/report-validation",
+  pattern: ["api", "keys", "report-validation"],
+  summary: "Record live validation results for a credential pool",
+  tags: ["API Keys"],
+  body: object2({
+    keyType: string2(),
+    keys: array2(object2({
+      keyIndex: number2().int().min(0),
+      keySuffix: string2().min(1).max(10),
+      ok: boolean(),
+      httpStatus: number2().int().optional()
+    })).min(1).max(100),
+    scope: string2().optional(),
+    scopeId: string2().optional()
+  }),
+  responses: {
+    200: { description: "Validation recorded", schema: successMessageSchema },
+    400: { description: "Validation error" },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true },
+  rbac: {
+    ungated: "worker credential telemetry, same posture as POST /api/keys/report-rate-limit"
+  }
+});
 var reportAuthFailure = route({
   method: "post",
   path: "/api/keys/report-auth-failure",
@@ -5565,6 +5659,7 @@ var getAvailable = route({
       schema: object2({
         success: literal2(true),
         availableIndices: array2(number2().int()),
+        rejectedIndices: array2(number2().int()).optional(),
         totalKeys: number2().int(),
         modelBlockedIndices: array2(number2().int()).optional(),
         earliestModelResetAt: string2().nullable().optional(),
@@ -5599,6 +5694,8 @@ var ApiKeyStatusSchema = object2({
   lastSeatMismatchModel: string2().nullable(),
   consecutiveAuthFailures: number2().int(),
   lastAuthFailureAt: string2().nullable(),
+  lastValidationError: string2().nullable(),
+  lastValidationFailedAt: string2().nullable(),
   modelLimits: array2(object2({
     model: string2(),
     window: string2(),
@@ -5821,6 +5918,19 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     }
     return true;
   }
+  if (reportValidation.match(req.method, pathSegments)) {
+    const parsed = await reportValidation.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { keyType, keys, scope, scopeId } = parsed.body;
+    try {
+      await recordKeyValidation2(keyType, keys, scope, scopeId ?? null);
+      reportValidation.respond(res, 200, { success: true, message: "Key validation recorded" });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : "Failed to record key validation", 500);
+    }
+    return true;
+  }
   if (reportAuthFailure.match(req.method, pathSegments)) {
     const parsed = await reportAuthFailure.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -5882,6 +5992,7 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
       getAvailable.respond(res, 200, {
         success: true,
         availableIndices: result.availableIndices,
+        rejectedIndices: result.rejectedIndices,
         totalKeys,
         authFailureFence: result.authFailureFence,
         ...model !== undefined ? {
@@ -6044,6 +6155,7 @@ async function fillOrgLogoFromWebsite(website) {
 // src/http/config.ts
 init_rbac_roles();
 init_swarm_config_guard();
+init_users();
 init_rbac();
 init_types();
 init_request_auth_context();
@@ -6152,7 +6264,11 @@ async function handleUsedBy(req, res, pathSegments, queryParams, myAgentId) {
         org_website: orgWebsite,
         ...orgDomain ? { org_domain: orgDomain } : {},
         granted,
-        ...granted ? { contact_email: contactEmail, contact_function: contactFunction, quote } : {},
+        ...granted ? {
+          contact_email: contactEmail,
+          contact_function: reportedUserFunction(contactFunction),
+          quote
+        } : {},
         changed_at: changedAt
       }),
       signal: AbortSignal.timeout(TIMEOUT_MS)
@@ -6513,6 +6629,28 @@ async function resolveSecretsRead(req, includeSecrets, resolvedScope) {
     secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : ""
   };
 }
+async function scriptRunHeldConfigIds(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "agent" || auth.tokenKind !== "agent")
+    return;
+  if (!await isScriptRunToken(auth.tokenId))
+    return;
+  const held = stripApiOnlyKeys(await getResolvedConfig2(auth.agentId, undefined, { includeRepoSecrets: false }));
+  return new Set(held.map((config) => config.id));
+}
+async function maskConfigRead(req, configs, includeSecrets) {
+  const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
+  const held = includeSecrets && !effectiveIncludeSecrets ? await scriptRunHeldConfigIds(req) : undefined;
+  const reveal = (config) => effectiveIncludeSecrets || !!held?.has(config.id);
+  const result = configs.map((config) => config.isSecret && !reveal(config) ? maskSecrets2([config])[0] : config);
+  for (const config of result) {
+    if (config.isSecret && config.value && reveal(config)) {
+      registerVolatileSecret(config.value, `config:${config.key}`);
+    }
+  }
+  const anyMasked = result.some((config) => config.isSecret && !reveal(config));
+  return { result, secretsNote: held && !anyMasked ? "" : secretsNote };
+}
 async function ensureConfigAdmin(req, res, verb) {
   return ensureHttpPermission(req, res, verb, verb === "config.write.any" ? "Writing swarm config requires the lead agent" : "Deleting swarm config requires the lead agent");
 }
@@ -6757,13 +6895,9 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       jsonError(res, "Config not found", 404);
       return true;
     }
-    const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
-    const singleResult = effectiveIncludeSecrets ? config : maskSecrets2([config])[0];
-    if (effectiveIncludeSecrets && singleResult.isSecret && singleResult.value) {
-      registerVolatileSecret(singleResult.value, `config:${singleResult.key}`);
-    }
+    const { result, secretsNote } = await maskConfigRead(req, [config], includeSecrets);
     getConfigById.respond(res, 200, {
-      ...singleResult,
+      ...result[0],
       ...secretsNote ? { message: `Found 1 config(s).${secretsNote}` } : {}
     });
     return true;
@@ -6773,20 +6907,12 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
-    const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(await getSwarmConfigs2({
       scope: parsed.query.scope || undefined,
       scopeId: parsed.query.scopeId || undefined,
       key: parsed.query.key
     }));
-    const listResult = effectiveIncludeSecrets ? configs : maskSecrets2(configs);
-    if (effectiveIncludeSecrets) {
-      for (const c of listResult) {
-        if (c.isSecret && c.value) {
-          registerVolatileSecret(c.value, `config:${c.key}`);
-        }
-      }
-    }
+    const { result: listResult, secretsNote } = await maskConfigRead(req, configs, includeSecrets);
     listConfig.respond(res, 200, {
       configs: listResult,
       ...secretsNote ? { message: `Found ${listResult.length} config(s).${secretsNote}` } : {}
@@ -7550,6 +7676,8 @@ async function approvalQuorumMet(approvers, votes) {
 
 // src/http/assets.ts
 init_zod();
+init_key();
+init_source_key();
 init_asset_key_audit();
 init_db3();
 init_db2();
@@ -7809,6 +7937,16 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
         jsonError(res, await canReadSession2(req, myAgentId, task.id) ? "You can view this session but not move it." : SESSION_READ_DENIED2, 403);
         return true;
       }
+      const destination = normalizeAssetKey(parsed.body.key);
+      if (sourceOfKey(destination)) {
+        const rootId = task.parentTaskId ? (await getSessionRoot(task.id))?.id : task.id;
+        const root = rootId === task.id ? task : rootId ? await getTaskById2(rootId) : null;
+        const sourceError = sourceMoveError(destination, root ?? { id: task.id });
+        if (sourceError) {
+          jsonError(res, sourceError, 400);
+          return true;
+        }
+      }
       const tasks = parsed.body.cascade ? await getRootTaskChain2(task.id) : [task];
       for (const target of tasks) {
         if (!await canMutateTaskNamespace(target, myAgentId, req)) {
@@ -8034,6 +8172,165 @@ async function handleBudgets(req, res, pathSegments, queryParams, _myAgentId) {
   return false;
 }
 
+// src/http/codex-oauth-accounts.ts
+init_zod();
+init_crypto();
+init_db3();
+init_api_keys();
+init_codex_auth_failure();
+var CodexAccountSchema = object2({
+  slot: number2().int().min(0),
+  configKey: string2(),
+  legacy: boolean(),
+  suffix: string2().nullable(),
+  plan: string2().nullable(),
+  email: string2().nullable(),
+  status: _enum2(["ok", "needs_login", "unchecked"])
+});
+var CodexAccountsResponseSchema = object2({ accounts: array2(CodexAccountSchema) });
+var listAccounts = route({
+  method: "get",
+  path: "/api/codex-oauth/accounts",
+  pattern: ["api", "codex-oauth", "accounts"],
+  summary: "List stored Codex ChatGPT accounts",
+  tags: ["Codex OAuth"],
+  responses: {
+    200: { description: "Stored account metadata", schema: CodexAccountsResponseSchema },
+    403: { description: "Caller cannot read all secrets" }
+  }
+});
+var deleteAccount = route({
+  method: "delete",
+  path: "/api/codex-oauth/accounts/{slot}",
+  pattern: ["api", "codex-oauth", "accounts", null],
+  summary: "Remove a stored Codex ChatGPT account",
+  tags: ["Codex OAuth"],
+  rbac: { permission: "config.delete.any" },
+  params: object2({ slot: exports_coerce.number().int().min(0).max(MAX_CODEX_OAUTH_SLOT) }),
+  responses: {
+    200: { description: "Remaining accounts", schema: CodexAccountsResponseSchema },
+    403: { description: "Config administration and permission to read all secrets required" },
+    404: { description: "Account slot does not exist" }
+  }
+});
+async function accountRows() {
+  const rows = await getDbClient2().query("SELECT key, value, encrypted FROM swarm_config WHERE scope = 'global' AND (key = 'codex_oauth' OR key GLOB 'codex_oauth_[0-9]*')");
+  const hasSlotZero = rows.some((row) => row.key === "codex_oauth_0");
+  return rows.flatMap((row) => {
+    if (row.key === "codex_oauth") {
+      return hasSlotZero ? [] : [{ ...row, slot: 0, legacy: true }];
+    }
+    const match = /^codex_oauth_(0|[1-9]\d*)$/.exec(row.key);
+    if (!match)
+      return [];
+    const slot = Number(match[1]);
+    return slot <= MAX_CODEX_OAUTH_SLOT ? [{ ...row, slot, legacy: false }] : [];
+  }).sort((a, b) => a.slot - b.slot);
+}
+var AccountCredentialsSchema = object2({
+  access: string2().min(1),
+  refresh: string2().min(1),
+  expires: number2().finite(),
+  accountId: string2().min(1)
+});
+function readCredentials(row) {
+  try {
+    const value = row.encrypted ? decryptSecret(row.value, getEncryptionKey()) : row.value;
+    return AccountCredentialsSchema.parse(JSON.parse(value));
+  } catch {
+    return null;
+  }
+}
+function accountSuffix(row) {
+  const credentials = readCredentials(row);
+  return credentials ? deriveCodexKeySuffix(credentials.access, credentials.accountId) : null;
+}
+async function accountsResponse() {
+  const rows = await accountRows();
+  const statuses = await getKeyStatuses2("CODEX_OAUTH", "global", null);
+  const accounts = [];
+  for (const row of rows) {
+    const account = {
+      slot: row.slot,
+      configKey: row.key,
+      legacy: row.legacy,
+      suffix: null,
+      plan: null,
+      email: null,
+      status: "needs_login"
+    };
+    const credentials = readCredentials(row);
+    if (!credentials) {
+      accounts.push(account);
+      continue;
+    }
+    account.suffix = deriveCodexKeySuffix(credentials.access, credentials.accountId);
+    account.plan = extractChatgptPlanType(credentials.access);
+    const profile = decodeJwt(credentials.access)?.["https://api.openai.com/profile"];
+    if (profile && typeof profile === "object" && "email" in profile) {
+      account.email = typeof profile.email === "string" && profile.email ? profile.email : null;
+    }
+    const status = statuses.find((entry) => entry.keySuffix === account.suffix);
+    const marker = await getKv2(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(account.suffix));
+    const statusBenched = status && status.consecutiveAuthFailures >= CODEX_AUTH_FAILURE_BENCH_THRESHOLD && status.status === "rate_limited";
+    account.status = marker || statusBenched ? "needs_login" : status ? "ok" : "unchecked";
+    accounts.push(account);
+  }
+  return { accounts };
+}
+async function ensureSecretRead(req, res) {
+  if (await requestSecretReadScope(req) === "all")
+    return true;
+  jsonError(res, "Reading Codex accounts requires access to all secrets", 403);
+  return false;
+}
+async function handleCodexOAuthAccounts(req, res, pathSegments, queryParams) {
+  if (listAccounts.match(req.method, pathSegments)) {
+    const parsed = await listAccounts.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureSecretRead(req, res))
+      return true;
+    listAccounts.respond(res, 200, await accountsResponse());
+    return true;
+  }
+  if (deleteAccount.match(req.method, pathSegments)) {
+    const parsed = await deleteAccount.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.delete.any"))
+      return true;
+    if (!await ensureSecretRead(req, res))
+      return true;
+    const deletedKey = await getDbClient2().transaction(async () => {
+      const rows = await accountRows();
+      const account = rows.find((row) => row.slot === parsed.params.slot);
+      if (!account || !await deleteSwarmConfigByKey2("global", null, account.key))
+        return null;
+      const suffix = accountSuffix(account);
+      if (suffix) {
+        const remaining = rows.flatMap((row) => {
+          const keySuffix = row === account ? null : accountSuffix(row);
+          return keySuffix ? [{ keySuffix, keyIndex: row.slot }] : [];
+        });
+        await retirePoolKeyStatus("CODEX_OAUTH", suffix, remaining);
+        if (!remaining.some((row) => row.keySuffix === suffix)) {
+          await deleteKv2(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(suffix));
+        }
+      }
+      return account.key;
+    });
+    if (deletedKey === null) {
+      jsonError(res, "Codex account slot does not exist", 404);
+      return true;
+    }
+    await runConfigWriteSideEffects("global", deletedKey, "");
+    deleteAccount.respond(res, 200, await accountsResponse());
+    return true;
+  }
+  return false;
+}
+
 // src/http/codex-oauth-device.ts
 init_zod();
 init_crypto();
@@ -8174,7 +8471,9 @@ var OnboardingSignalsSchema = object2({
     provider: ProviderNameSchema,
     state: _enum2(["unverified", "configured", "verified"]),
     workers: number2().int().nonnegative(),
-    verifiedWorkers: number2().int().nonnegative()
+    verifiedWorkers: number2().int().nonnegative(),
+    error: string2().nullable(),
+    warning: string2().nullable()
   })),
   embeddings: object2({
     configured: boolean(),
@@ -9099,6 +9398,7 @@ function sentTaskId(thread, replies, serviceUserId) {
 // src/comb/review-batch.ts
 init_templates();
 var REVIEW_BATCH_MAX = 50;
+var REVIEW_NOTE_MAX = 4000;
 var REVIEW_BATCH_READ_CONCURRENCY = 5;
 var SENT_KV_NAMESPACE = "comb:sent";
 var PENDING_CLAIM_MS = 5 * 60000;
@@ -9129,6 +9429,9 @@ async function sendReviewBatch(input, deps = {}) {
   if (ids.length === 0 || ids.length > REVIEW_BATCH_MAX) {
     throw new ReviewBatchError(400, `Send between 1 and ${REVIEW_BATCH_MAX} comments`);
   }
+  if ((input.note?.length ?? 0) > REVIEW_NOTE_MAX) {
+    throw new ReviewBatchError(400, `The note is longer than ${REVIEW_NOTE_MAX} characters`);
+  }
   const agentFs = combAgentFs();
   if (!agentFs)
     throw new ReviewBatchError(503, "agent-fs is not set up for this swarm");
@@ -9162,6 +9465,7 @@ async function sendReviewBatch(input, deps = {}) {
   }
   const wonIds = won.map((read) => read.id);
   let taskId = null;
+  let leadState = "none";
   if (won.length > 0) {
     try {
       const text = await renderTaskText(input, won);
@@ -9172,6 +9476,7 @@ async function sendReviewBatch(input, deps = {}) {
         ]);
       }
       const lead = await getLeadAgent2();
+      leadState = !lead ? "none" : lead.status === "offline" ? "offline" : "online";
       const task = await createTask(text, {
         agentId: lead?.id ?? "",
         routingReason: lead ? "skill" : undefined,
@@ -9208,7 +9513,7 @@ async function sendReviewBatch(input, deps = {}) {
   if (taskId === null && repaired.length === 0) {
     throw new ReviewBatchError(409, "Nothing to send", skipped);
   }
-  return { taskId, sent: wonIds, skipped, repaired };
+  return taskId === null ? { taskId, sent: wonIds, skipped, repaired } : { taskId, sent: wonIds, skipped, repaired, lead: leadState };
 }
 async function mapLimited(items, limit, fn) {
   const results = new Array(items.length);
@@ -9353,6 +9658,7 @@ async function renderTaskText(input, reads) {
     requested_by: await requesterLabel(input.requestedByUserId),
     org_id: input.orgId,
     drive_id: input.driveId,
+    note_block: noteBlock(input.note),
     comments_block: blocks.join(`
 `)
   });
@@ -9367,6 +9673,13 @@ function lineRange(comment) {
   const end = comment.lineEnd ?? comment.lineStart;
   return end === comment.lineStart ? `line ${comment.lineStart}` : `lines ${comment.lineStart}-${end}`;
 }
+function noteBlock(note) {
+  const text = note?.trim();
+  return text ? `
+Note from the sender, about all the comments:
+${fenced(text)}
+` : "";
+}
 function fenced(text) {
   const longest = (text.match(/`+/g) ?? []).reduce((max, run) => Math.max(max, run.length), 0);
   const fence = "`".repeat(Math.max(3, longest + 1));
@@ -9407,7 +9720,8 @@ var resultSchema = object2({
   taskId: string2().nullable(),
   sent: array2(string2()),
   skipped: array2(skippedSchema),
-  repaired: array2(object2({ id: string2(), taskId: string2() }))
+  repaired: array2(object2({ id: string2(), taskId: string2() })),
+  lead: _enum2(["online", "offline", "none"]).optional()
 });
 var batchErrorSchema = object2({ error: string2(), skipped: array2(skippedSchema) });
 function isDrivePath(path) {
@@ -9418,13 +9732,14 @@ var reviewBatchRoute = route({
   path: "/api/comb/review-batches",
   pattern: ["api", "comb", "review-batches"],
   summary: "Send agent-fs comments to the swarm as one lead task",
-  description: "Comb's 'Send to swarm'. The server reads each comment again from agent-fs with its bootstrap key, skips replies, resolved comments, and comments already sent, and creates ONE task for the lead. Each sent comment gets a `[comb:sent task=<id>]` reply from the swarm service account. A comment is sent at most once. When an earlier send lost its reply, the batch posts that reply again (`repaired`). Answers 404 while COMB_ENABLED is off.",
+  description: "Comb's 'Send to swarm'. The server reads each comment again from agent-fs with its bootstrap key, skips replies, resolved comments, and comments already sent, and creates ONE task for the lead. Each sent comment gets a `[comb:sent task=<id>]` reply from the swarm service account. A comment is sent at most once. An optional `note` from the sender goes into the task text. When an earlier send lost its reply, the batch posts that reply again (`repaired`). Answers 404 while COMB_ENABLED is off.",
   tags: ["Comb"],
   body: object2({
     orgId: string2().min(1),
     driveId: string2().min(1),
     commentIds: array2(uuid()).min(1).max(REVIEW_BATCH_MAX),
-    scopePath: string2().min(1).max(1024).refine(isDrivePath, "scopePath must start with '/' and have no '.' or '..' segment")
+    scopePath: string2().min(1).max(1024).refine(isDrivePath, "scopePath must start with '/' and have no '.' or '..' segment"),
+    note: string2().max(REVIEW_NOTE_MAX).optional()
   }),
   responses: {
     200: {
@@ -9814,16 +10129,16 @@ declare module "swarm-extension" {
       | "schedule"
       | "slack"
       | "agentmail"
-      | "mcp"
-      | "api"
-      | "ui"
       | "github"
       | "gitlab"
       | "azure-devops"
       | "bitbucket"
-      | "system"
       | "linear"
       | "jira"
+      | "mcp"
+      | "api"
+      | "ui"
+      | "system"
       | "comb"
       | "chat"
       | undefined;
@@ -9932,16 +10247,16 @@ declare module "swarm-extension" {
       | "schedule"
       | "slack"
       | "agentmail"
-      | "mcp"
-      | "api"
-      | "ui"
       | "github"
       | "gitlab"
       | "azure-devops"
       | "bitbucket"
-      | "system"
       | "linear"
       | "jira"
+      | "mcp"
+      | "api"
+      | "ui"
+      | "system"
       | "comb"
       | "chat";
     tags: string[];
@@ -10206,6 +10521,45 @@ declare module "swarm-extension" {
     description: string;
     origin: TaskCreateOrigin;
     requestInfo?: RequestInfo;
+    /** Slack ingress metadata; not persisted or writable through modify. */
+    slack?: {
+      trigger: "mention" | "thread-buffer";
+      messages: {
+        ts: string;
+        userId: string;
+        text: string;
+      }[];
+    };
+  }
+  /** A pre.task.create hook blocked a task before it was created. */
+  export interface TaskBlockedEvent {
+    /** The extension that blocked, or whose model/agent rewrite was rejected. */
+    extension: {
+      id: string;
+      name: string;
+    };
+    /** The scrubbed block reason. */
+    reason: string;
+    origin: TaskCreateOrigin;
+    source?: AgentTask["source"];
+    requester: {
+      userId?: string;
+      agentId?: string;
+      slackUserId?: string;
+    };
+    context?: {
+      contextKey?: string;
+      scheduleId?: string;
+      workflowRunId?: string;
+      workflowRunStepId?: string;
+      parentTaskId?: string;
+      vcsRepo?: string;
+      vcsNumber?: number;
+      slackChannelId?: string;
+      slackThreadTs?: string;
+    };
+    /** The original task description, scrubbed and cut to 500 characters. */
+    description: string;
   }
   export type TaskCreateModify = Partial<
     Pick<
@@ -10509,6 +10863,11 @@ declare module "swarm-extension" {
       modify: never;
       result: void;
     };
+    "post.task.blocked": {
+      event: TaskBlockedEvent;
+      modify: never;
+      result: void;
+    };
     "post.task.completed": {
       event: TaskCompletedEvent;
       modify: never;
@@ -13600,6 +13959,7 @@ async function buildFleetBenchmarkResponse(now = new Date) {
   const team = _enum2(COMPANY_TEAM_SIZES).safeParse(teamSize);
   const use = _enum2(COMPANY_USE_CASES).safeParse(useCase);
   const peerGroup = normalizeOrgWebsite(website) && team.success && use.success ? { teamSize: team.data, useCase: use.data } : null;
+  const proxyPeerGroup = peerGroup && reportedUseCase(peerGroup.useCase) ? peerGroup : null;
   const empty = {
     level: peerGroup ? "full" : "basic",
     peerGroup: null,
@@ -13626,7 +13986,7 @@ async function buildFleetBenchmarkResponse(now = new Date) {
     return { ...empty, state: "telemetry_off", local };
   if (finishedTasks < FLEET_MIN_FINISHED_TASKS)
     return { ...empty, state: "not_enough_tasks", local };
-  const fleet = await fleetBenchmarks(now.getTime(), peerGroup);
+  const fleet = await fleetBenchmarks(now.getTime(), proxyPeerGroup);
   const responsePeerGroup = peerGroup && fleet?.peer_group ? {
     teamSize: fleet.peer_group.team_size,
     useCase: fleet.peer_group.use_case,
@@ -14683,6 +15043,9 @@ function buildSlackManifest(name) {
   return manifest;
 }
 
+// src/http/integrations.ts
+init_credentials();
+
 // src/http/config-values.ts
 init_db3();
 async function resolveConfigValue(key) {
@@ -14857,7 +15220,7 @@ function createIntegrationsHandler(deps = {}) {
         return true;
       }
       try {
-        const client = buildClient(apiKey);
+        const client = buildClient(selectCredential(apiKey, undefined, "ANTHROPIC_API_KEY").selected);
         const agent = await client.beta.agents.retrieve(agentId);
         const modelId = typeof agent.model === "string" ? agent.model : agent.model?.id ?? null;
         claudeManagedTestRoute.respond(res, 200, {
@@ -15134,8 +15497,8 @@ function authorizeWrite(namespace, ctx) {
   return null;
 }
 function authorizeRead(namespace, ctx) {
-  const overflowAuthErr = mcpOverflowAuthError(namespace, ctx.callerAgentId);
-  return overflowAuthErr ? { status: 403, message: overflowAuthErr } : null;
+  const readErr = privateNamespaceError(namespace) ?? mcpOverflowAuthError(namespace, ctx.callerAgentId);
+  return readErr ? { status: 403, message: readErr } : null;
 }
 function encodeValueOrError(res, value, valueType) {
   try {
@@ -21537,6 +21900,7 @@ init_db3();
 init_memory();
 init_constants();
 init_types();
+init_credentials();
 init_openrouter_base_url();
 
 // src/http/status.ts
@@ -21605,6 +21969,7 @@ var StatusIdentitySchema = object2({
 var StatusActivitySchema = object2({
   agents_online: number2().int().nonnegative(),
   leads_online: number2().int().nonnegative(),
+  leads_ready: number2().int().nonnegative(),
   recent_tasks_count: number2().int().nonnegative()
 });
 var StatusCombSchema = object2({
@@ -21985,7 +22350,7 @@ async function buildSetup(automationSetup) {
     await firstTaskMilestone()
   ];
 }
-function computeHealth(setup) {
+function computeHealth(setup, readyLeads) {
   const byId = new Map(setup.map((m) => [m.id, m]));
   const harness = byId.get("harness");
   const workers = byId.get("workers");
@@ -21993,6 +22358,8 @@ function computeHealth(setup) {
     return "broken";
   if (!workers || workers.state === "unverified")
     return "broken";
+  if (readyLeads === 0)
+    return "degraded";
   if (harness.state === "configured")
     return "degraded";
   for (const id of ["slack", "github", "linear", "jira"]) {
@@ -22010,12 +22377,13 @@ async function buildStatusPayload() {
   const toStatus = ({ failureReason: _, ...status }) => status;
   const automations = automationInputs.map((automation) => toStatus(preflightAutomation(automation, automationSetup))).sort((a, b) => a.name.localeCompare(b.name) || a.kind.localeCompare(b.kind));
   const activity = await getInstanceActivity2();
+  const readyLeads = (await getReadyAgentCounts2()).leads;
   const instance = await getInstanceFeedbackSignals();
   return {
     runtime_pools: { enabled: isRuntimePoolsEnabled(), supervisor: runtimeSupervisorStatus() },
     identity: buildIdentity(),
     setup,
-    activity,
+    activity: { ...activity, leads_ready: readyLeads },
     agent_fs: {
       configured: !!process.env.AGENT_FS_API_URL,
       base_url: process.env.AGENT_FS_API_URL ?? null,
@@ -22023,7 +22391,7 @@ async function buildStatusPayload() {
       comb: getCombStatus(await combServiceUserId)
     },
     automations,
-    health: computeHealth(setup),
+    health: computeHealth(setup, readyLeads),
     telemetry: { enabled: isTelemetryEnabled() },
     instance
   };
@@ -22058,7 +22426,7 @@ var getStatus = route({
   path: "/status",
   pattern: ["status"],
   summary: "Identity + setup readiness + live activity for the swarm dashboard",
-  description: "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set, plus the Comb settings (COMB_ENABLED, the browser-facing agent-fs URL, the shared org and drive ids, and the agent-fs user id of the swarm service account); telemetry reports the effective ANONYMIZED_TELEMETRY opt-out state.",
+  description: "Single source of truth consumed by the UI home page. Identity comes from SWARM_* envs; setup milestones each emit `unverified | configured | verified`; automations report `running | needs_setup` from the same runtime preflight used at dispatch; activity counts agents alive in the last 5 min, leads that can take work (status idle or busy), and tasks created in the last 24h; agent_fs reports whether AGENT_FS_API_URL is set, plus the Comb settings (COMB_ENABLED, the browser-facing agent-fs URL, the shared org and drive ids, and the agent-fs user id of the swarm service account); telemetry reports the effective ANONYMIZED_TELEMETRY opt-out state.",
   tags: ["Status"],
   responses: {
     200: { description: "Status payload", schema: StatusResponseSchema },
@@ -22131,11 +22499,14 @@ async function buildSignals(state) {
     if (!provider.success)
       continue;
     const rollup = await rollupCredStatusForProvider(provider.data);
+    const live = rollup.latestLiveTest;
     providers.push({
       provider: provider.data,
       state: rollup.state,
       workers: rollup.workers,
-      verifiedWorkers: rollup.verifiedWorkers
+      verifiedWorkers: rollup.verifiedWorkers,
+      error: live && !live.ok ? live.error ?? null : null,
+      warning: live?.ok ? live.warning ?? null : null
     });
   }
   const integrations = await getAutomationSetupStates();
@@ -22281,7 +22652,7 @@ async function handleMemoryProbe(body) {
   const canReuseKey = reuseHost === undefined || endpoint.hostname === reuseHost;
   const reusedKey = !explicitKey && body.reuseKey && canReuseKey ? process.env[body.reuseKey] : undefined;
   const implicitKey = body.preset === "existing" ? process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY : undefined;
-  const apiKey = explicitKey ?? reusedKey ?? implicitKey;
+  const apiKey = splitCredentialPool(explicitKey ?? reusedKey ?? implicitKey ?? "")[0];
   if (!apiKey) {
     return {
       ok: false,
@@ -22741,6 +23112,7 @@ var listTasks = route({
     status: string2().optional(),
     agentId: string2().optional(),
     scheduleId: string2().optional(),
+    workflowRunId: string2().uuid().optional(),
     key: AssetKeySchema.optional(),
     keyPrefix: AssetKeySchema.optional(),
     search: string2().optional(),
@@ -23343,6 +23715,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       status,
       agentId: parsed.query.agentId || undefined,
       scheduleId: parsed.query.scheduleId || undefined,
+      workflowRunId: parsed.query.workflowRunId,
       key: parsed.query.key,
       keyPrefix: parsed.query.keyPrefix,
       search: parsed.query.search || undefined,
@@ -27249,6 +27622,298 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
   return false;
 }
 
+// src/http/pool-keys.ts
+init_src2();
+init_zod();
+init_db3();
+init_api_keys();
+init_swarm_config_guard();
+init_credentials();
+init_secret_scrubber();
+var PoolKeyStatusSchema = _enum2(["ok", "rejected", "rate_limited", "unchecked"]);
+var PoolKeySchema = object2({
+  index: number2().int().min(0),
+  suffix: string2(),
+  status: PoolKeyStatusSchema,
+  error: string2().nullable(),
+  checkedAt: string2().nullable(),
+  rateLimitedUntil: string2().nullable()
+});
+var PoolKeysResponseSchema = object2({
+  key: string2(),
+  source: _enum2(["stored", "env", "none"]),
+  readOnly: boolean(),
+  keys: array2(PoolKeySchema)
+});
+var PoolKeyCheckResultSchema = _enum2(["verified", "rejected", "not_tested"]);
+var PoolKeyCheckSchema = object2({
+  suffix: string2(),
+  result: PoolKeyCheckResultSchema,
+  httpStatus: number2().nullable(),
+  error: string2().nullable()
+});
+var poolVar = string2().refine((key) => key !== "CODEX_OAUTH" && CREDENTIAL_POOL_VARS.includes(key), "Choose a credential pool variable.");
+var getPoolKeys = route({
+  method: "get",
+  path: "/api/config/pool-keys",
+  pattern: ["api", "config", "pool-keys"],
+  summary: "List credential pool suffixes and status",
+  tags: ["Config"],
+  query: object2({ key: poolVar }),
+  responses: {
+    200: { description: "Credential pool", schema: PoolKeysResponseSchema },
+    400: { description: "Invalid pool variable" },
+    403: { description: "Secret read permission required" }
+  }
+});
+var addPoolKeys = route({
+  method: "post",
+  path: "/api/config/pool-keys",
+  pattern: ["api", "config", "pool-keys"],
+  summary: "Test and append keys to a credential pool",
+  tags: ["Config"],
+  rbac: { permission: "config.write.any" },
+  body: object2({
+    key: poolVar,
+    value: string2(),
+    baseUrl: string2().nullable().optional().describe("Base URL for the check only. Null tests the provider default. Omit to use the stored URL.")
+  }),
+  responses: {
+    200: {
+      description: "Updated credential pool and checks",
+      schema: PoolKeysResponseSchema.extend({ checks: array2(PoolKeyCheckSchema) })
+    },
+    400: { description: "Invalid key" },
+    403: { description: "Config administration and permission to read all secrets required" },
+    409: { description: "Duplicate key or deployment env pool" },
+    422: {
+      description: "Provider rejected a key. Nothing was saved.",
+      schema: object2({ error: string2(), checks: array2(PoolKeyCheckSchema) })
+    }
+  }
+});
+var deletePoolKey = route({
+  method: "delete",
+  path: "/api/config/pool-keys",
+  pattern: ["api", "config", "pool-keys"],
+  summary: "Remove one credential pool member",
+  tags: ["Config"],
+  rbac: { permission: "config.delete.any" },
+  query: object2({
+    key: poolVar,
+    index: exports_coerce.number().int().min(0),
+    suffix: string2().min(1).max(5)
+  }),
+  responses: {
+    200: { description: "Updated credential pool", schema: PoolKeysResponseSchema },
+    400: { description: "Invalid pool member" },
+    403: { description: "Config administration and permission to read all secrets required" },
+    409: { description: "The pool changed or comes from the deployment env" }
+  }
+});
+var ENV_POOL_ERROR = "These keys come from the deployment env. Change them there.";
+async function readPool(key) {
+  const [row] = await getSwarmConfigs2({ scope: "global", key });
+  const envValue = getDeploymentEnvValue(key);
+  const source = row ? "stored" : envValue ? "env" : "none";
+  const value = row?.value ?? envValue ?? "";
+  registerEnvSecrets({ [key]: value });
+  return { row, source, members: splitCredentialPool(value) };
+}
+async function poolResponse(key) {
+  const pool = await readPool(key);
+  const statuses = await getKeyStatuses2(key, "global", null);
+  return {
+    key,
+    source: pool.source,
+    readOnly: pool.source === "env",
+    keys: pool.members.map((member, index) => {
+      const suffix = member.slice(-5);
+      const row = statuses.find((status) => status.keySuffix === suffix);
+      const rejected = !!row?.lastValidationFailedAt;
+      const limited = row?.status === "rate_limited" && !!row.rateLimitedUntil && Date.parse(row.rateLimitedUntil) > Date.now();
+      return {
+        index,
+        suffix,
+        status: rejected ? "rejected" : limited ? "rate_limited" : row ? "ok" : "unchecked",
+        error: rejected ? scrubSecrets(row?.lastValidationError) || null : null,
+        checkedAt: rejected ? row.lastValidationFailedAt : row?.updatedAt ?? null,
+        rateLimitedUntil: row?.rateLimitedUntil ?? null
+      };
+    })
+  };
+}
+function duplicateError(members, additions) {
+  const seen = new Set(members);
+  for (const member of additions) {
+    if (seen.has(member))
+      return `The key ending ${member.slice(-5)} is already in the pool.`;
+    seen.add(member);
+  }
+  return null;
+}
+async function savePool(key, members, row) {
+  const value = members.join(",");
+  const validationError = validateConfigEntry({
+    scope: "global",
+    key,
+    value,
+    exportToEnv: row?.exportToEnv
+  });
+  if (validationError)
+    return validationError;
+  await upsertSwarmConfigWithPolicyMirror({
+    scope: "global",
+    key,
+    value,
+    isSecret: true,
+    description: row?.description ?? null,
+    envPath: row?.envPath ?? null,
+    exportToEnv: row?.exportToEnv
+  });
+  return null;
+}
+async function ensureSecretRead2(req, res) {
+  if (await requestSecretReadScope(req) === "all")
+    return true;
+  jsonError(res, "Reading credential pools requires permission to read all secrets.", 403);
+  return false;
+}
+async function handlePoolKeys(req, res, pathSegments, queryParams) {
+  if (getPoolKeys.match(req.method, pathSegments)) {
+    const parsed = await getPoolKeys.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureSecretRead2(req, res))
+      return true;
+    getPoolKeys.respond(res, 200, await poolResponse(parsed.query.key));
+    return true;
+  }
+  if (addPoolKeys.match(req.method, pathSegments)) {
+    const parsed = await addPoolKeys.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.write.any"))
+      return true;
+    if (!await ensureSecretRead2(req, res))
+      return true;
+    const { key, value, baseUrl } = parsed.body;
+    const additions = value.split(",").map((part) => part.trim()).filter(Boolean);
+    if (!additions.length) {
+      jsonError(res, "Enter a key.", 400);
+      return true;
+    }
+    if (additions.some((part) => /\s/.test(part))) {
+      jsonError(res, "A key cannot contain spaces or line breaks.", 400);
+      return true;
+    }
+    registerEnvSecrets({ [key]: additions.join(",") });
+    const initial = await readPool(key);
+    if (initial.source === "env") {
+      jsonError(res, ENV_POOL_ERROR, 409);
+      return true;
+    }
+    const duplicate = duplicateError(initial.members, additions);
+    if (duplicate) {
+      jsonError(res, scrubSecrets(duplicate), 409);
+      return true;
+    }
+    const env = { ...process.env };
+    const provider = providerForKeyVar(key);
+    const baseUrlKey = key === "OPENROUTER_API_KEY" ? "OPENROUTER_BASE_URL" : provider ? baseUrlEnvVar(provider) : undefined;
+    if (baseUrlKey && baseUrl !== undefined) {
+      env[baseUrlKey] = baseUrl ?? "";
+    } else if (baseUrlKey) {
+      const [row] = await getSwarmConfigs2({ scope: "global", key: baseUrlKey });
+      if (row)
+        env[baseUrlKey] = row.value;
+    }
+    const checks = await Promise.all(additions.map(async (member) => {
+      try {
+        const probe = await checkProviderPoolKey(key, member, env);
+        return {
+          suffix: member.slice(-5),
+          result: probe.skipped ? "not_tested" : probe.ok ? "verified" : probe.httpStatus === 401 ? "rejected" : "not_tested",
+          httpStatus: probe.httpStatus ?? null,
+          error: scrubSecrets(probe.error?.replaceAll(member, "[REDACTED]")) || null
+        };
+      } catch {
+        return {
+          suffix: member.slice(-5),
+          result: "not_tested",
+          httpStatus: null,
+          error: "The provider check did not complete."
+        };
+      }
+    }));
+    const rejected = checks.find((check) => check.result === "rejected");
+    if (rejected) {
+      addPoolKeys.respond(res, 422, {
+        error: scrubSecrets(`The key ending ${rejected.suffix} was rejected (HTTP 401). Nothing was saved.`),
+        checks
+      });
+      return true;
+    }
+    const result = await getDbClient2().transaction(async () => {
+      const current = await readPool(key);
+      if (current.source === "env")
+        return { error: ENV_POOL_ERROR, status: 409 };
+      const duplicate = duplicateError(current.members, additions);
+      if (duplicate)
+        return { error: duplicate, status: 409 };
+      const members = [...current.members, ...additions];
+      const error = await savePool(key, members, current.row);
+      if (error)
+        return { error, status: 400 };
+      await recordKeyValidation2(key, checks.flatMap((check, index) => check.result === "verified" ? [{ keyIndex: current.members.length + index, keySuffix: check.suffix, ok: true }] : []), "global", null, { retireAbsent: false });
+      return { value: members.join(",") };
+    });
+    if ("error" in result) {
+      jsonError(res, scrubSecrets(result.error), result.status);
+      return true;
+    }
+    await runConfigWriteSideEffects("global", key, result.value);
+    addPoolKeys.respond(res, 200, { ...await poolResponse(key), checks });
+    return true;
+  }
+  if (deletePoolKey.match(req.method, pathSegments)) {
+    const parsed = await deletePoolKey.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureConfigAdmin(req, res, "config.delete.any"))
+      return true;
+    if (!await ensureSecretRead2(req, res))
+      return true;
+    const { key, index, suffix } = parsed.query;
+    const result = await getDbClient2().transaction(async () => {
+      const current = await readPool(key);
+      if (current.source === "env")
+        return { error: ENV_POOL_ERROR, status: 409 };
+      if (!current.members[index] || current.members[index].slice(-5) !== suffix) {
+        return { error: "The key list changed. Reload it and try again.", status: 409 };
+      }
+      const members = current.members.filter((_, position) => position !== index);
+      if (members.length) {
+        const error = await savePool(key, members, current.row);
+        if (error)
+          return { error, status: 400 };
+      } else {
+        await deleteSwarmConfigByKey2("global", null, key);
+      }
+      await retirePoolKeyStatus(key, suffix, members.map((member, keyIndex) => ({ keySuffix: member.slice(-5), keyIndex })));
+      return { value: members.join(",") };
+    });
+    if ("error" in result) {
+      jsonError(res, scrubSecrets(result.error), result.status);
+      return true;
+    }
+    await runConfigWriteSideEffects("global", key, result.value);
+    deletePoolKey.respond(res, 200, await poolResponse(key));
+    return true;
+  }
+  return false;
+}
+
 // src/http/pricing.ts
 init_zod();
 init_db3();
@@ -33619,6 +34284,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, myAgentId)
 // src/http/sessions.ts
 init_zod();
 init_key();
+init_source_key();
 init_db3();
 init_session_moves();
 init_session_tree();
@@ -33627,6 +34293,74 @@ init_steering();
 init_users();
 init_rbac();
 init_bus();
+
+// src/slack/channel-labels.ts
+var LABEL_TTL_MS = 24 * 60 * 60 * 1000;
+var FAILURE_TTL_MS = 10 * 60 * 1000;
+var FAILURE_CACHE_MAX = 500;
+var LOOKUP_QUEUE_MAX = 50;
+var inFlight2 = new Set;
+var failedUntil = new Map;
+var pending = Promise.resolve();
+async function channelLabel(client, id) {
+  const result = await callSlackWithRetry2(client, "conversations.info", {
+    channel: id.toUpperCase()
+  });
+  const channel = result.channel;
+  if (result.ok === false || !channel)
+    throw new Error("Channel lookup failed");
+  if (channel.is_mpim)
+    return "Group DM";
+  if (channel.is_im && channel.user) {
+    const result = await callSlackWithRetry2(client, "users.info", { user: channel.user });
+    const user = result.user;
+    const name = user?.profile?.display_name || user?.real_name || user?.profile?.real_name;
+    if (result.ok !== false && name)
+      return `DM · ${name}`;
+  } else if (channel.name) {
+    return `#${channel.name}`;
+  }
+  throw new Error("Channel label unavailable");
+}
+var CHANNEL_GROUP_KEY = /^shared\/slack\/([^/]+)\/$/;
+function warmSlackChannelLabels(groupKeys) {
+  const client = getSlackApp2()?.client;
+  if (!client)
+    return;
+  for (const groupKey of groupKeys) {
+    const id = CHANNEL_GROUP_KEY.exec(groupKey)?.[1];
+    if (!id)
+      continue;
+    if (inFlight2.has(id) || (failedUntil.get(id) ?? 0) > Date.now())
+      continue;
+    failedUntil.delete(id);
+    if (inFlight2.size >= LOOKUP_QUEUE_MAX)
+      continue;
+    if (failedUntil.size + inFlight2.size >= FAILURE_CACHE_MAX) {
+      const now = Date.now();
+      for (const [failedId, until] of failedUntil) {
+        if (until <= now)
+          failedUntil.delete(failedId);
+      }
+      if (failedUntil.size + inFlight2.size >= FAILURE_CACHE_MAX)
+        continue;
+    }
+    inFlight2.add(id);
+    pending = pending.then(async () => {
+      try {
+        const label = await channelLabel(client, id);
+        await rememberSessionLabel(groupKey, label, LABEL_TTL_MS);
+      } catch (error) {
+        failedUntil.set(id, Date.now() + FAILURE_TTL_MS);
+        console.warn(`[Slack] Could not cache a session channel label: ${slackErrorCode2(error) ?? "unknown error"}`);
+      } finally {
+        inFlight2.delete(id);
+      }
+    });
+  }
+}
+
+// src/http/sessions.ts
 init_types();
 init_request_auth_context();
 init_runtime_pools_flag();
@@ -33689,6 +34423,7 @@ var SessionTreeGroupSchema = SessionSectionCountsSchema.extend({
   lastActivityAt: string2()
 });
 var SessionTreeResponseSchema = object2({
+  labels: record2(string2(), string2()).optional(),
   groups: array2(SessionTreeGroupSchema),
   inbox: SessionSectionCountsSchema,
   later: SessionSectionCountsSchema,
@@ -34126,6 +34861,9 @@ async function checkSessionMove(rootTaskId, actor, req, myAgentId, options = {})
   }
   if (root.parentTaskId)
     return { reason: "Task is not a session root" };
+  const sourceError = sourceMoveError(options.destination ?? null, root);
+  if (sourceError)
+    return { reason: sourceError };
   const tasks = await getRootTaskChain2(root.id);
   for (const task of tasks) {
     if (!await canMutateTaskNamespace(task, myAgentId, req)) {
@@ -34150,6 +34888,7 @@ var getSession = route({
         chain: array2(TaskWithSteeringSchema),
         access: SessionAccessSchema,
         owner: SessionOwnerSchema.nullable(),
+        groupKey: string2(),
         approvals: array2(SessionApprovalSchema).optional(),
         readState: _enum2(["unread", "read", "later", "done"]).optional(),
         lastActivityAt: string2().optional()
@@ -34336,11 +35075,15 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
     if (!parsed)
       return true;
     const actor = await resolveSessionActor2(req, myAgentId);
-    sessionTree.respond(res, 200, await getSessionTree(actor, undefined, {
+    const tree = await getSessionTree(actor, undefined, {
       mine: parsed.query.show !== "all",
       hideSource: parsed.query.hideSource,
       showSource: parsed.query.showSource
-    }));
+    });
+    const { sourceGroups, slackChannels, threadLabels, ...counts } = tree;
+    const labels = { ...threadLabels, ...await getSessionLabels(sourceGroups) };
+    warmSlackChannelLabels(slackChannels.map((id) => `shared/slack/${id}/`).filter((key) => labels[key] === undefined));
+    sessionTree.respond(res, 200, { ...counts, labels });
     return true;
   }
   if (triageSessionListRoute.match(req.method, pathSegments)) {
@@ -34365,7 +35108,9 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       const skipped = [];
       const moves = [];
       for (const rootId of new Set(parsed.body.rootTaskIds)) {
-        const checked = await checkSessionMove(rootId, actor, req, myAgentId);
+        const checked = await checkSessionMove(rootId, actor, req, myAgentId, {
+          destination: key
+        });
         if ("reason" in checked) {
           skipped.push({ rootTaskId: rootId, reason: checked.reason });
         } else {
@@ -34386,6 +35131,10 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
     if (!parsed)
       return true;
     const from = normalizeAssetKey(parsed.body.from);
+    if (sourceOfKey(from) || parsed.body.to && sourceOfKey(normalizeAssetKey(parsed.body.to))) {
+      jsonError(res, SOURCE_GROUPS_READ_ONLY, 400);
+      return true;
+    }
     if (parseAssetKey(from).relativeSegments.length === 0) {
       jsonError(res, "Cannot move a namespace root", 400);
       return true;
@@ -34425,7 +35174,8 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
             continue;
           }
           const checked = await checkSessionMove(root.id, actor, req, myAgentId, {
-            ownerOnly: true
+            ownerOnly: true,
+            destination: nextKey
           });
           if ("reason" in checked) {
             skipped.push({ rootTaskId: root.id, reason: checked.reason });
@@ -34469,11 +35219,12 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
     } : null;
     const chain = await getRootTaskChain2(parsed.params.rootTaskId);
     const tasks = [root, ...chain];
-    const [steering, citations, approvals, read] = await Promise.all([
+    const [steering, citations, approvals, read, groupKey] = await Promise.all([
       getTaskSteeringFieldsForTasks(tasks),
       getTaskCitationsForTasks(tasks.map((task) => task.id)),
       getPendingApprovalsForTasks2(tasks.map((task) => task.id)),
-      actor.kind === "user" && actor.userId ? getSessionReadState(sessionRoot.id, actor.userId) : Promise.resolve(null)
+      actor.kind === "user" && actor.userId ? getSessionReadState(sessionRoot.id, actor.userId) : Promise.resolve(null),
+      getSessionGroupKey(root)
     ]);
     const decorate = (task) => ({
       ...task,
@@ -34485,6 +35236,7 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       chain: chain.map(decorate),
       access,
       owner,
+      groupKey,
       ...approvals.length ? { approvals } : {},
       ...read ?? {}
     });
@@ -35873,7 +36625,8 @@ var SwarmMetricsSchema = object2({
     sessionLogs: RetentionTableStatsSchema.optional(),
     agentLog: RetentionTableStatsSchema.optional(),
     events: RetentionTableStatsSchema.optional(),
-    contextVersions: RetentionTableStatsSchema.optional()
+    contextVersions: RetentionTableStatsSchema.optional(),
+    scriptRuns: RetentionTableStatsSchema.optional()
   })
 });
 var ConcurrentContextSchema = object2({
@@ -39250,8 +40003,66 @@ async function handleWorkflowEvents(req, res, pathSegments, queryParams) {
 // src/http/workflows.ts
 init_zod();
 init_db3();
+init_workflow_idempotency();
 init_workflow_runs();
 init_types();
+
+// src/http/idempotency-key.ts
+init_zod();
+init_workflow_idempotency();
+init_request_auth_context();
+var IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
+var IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";
+var idempotencyKeyHeader = (accepted) => object2({
+  "Idempotency-Key": string2().regex(IDEMPOTENCY_KEY_PATTERN).optional().describe("Optional client-generated key, 1-255 visible ASCII characters (a UUID works). " + `The first request the server accepts under a key ${accepted}; a retry with the same key ` + "and an equivalent body gets that request's status and body back (with " + `\`${IDEMPOTENT_REPLAYED_HEADER}: true\`) and changes nothing. The key is scoped to the ` + "caller's identity and this operation; it is not a credential. The same key with a " + "different body is a 409. A request rejected before it is accepted (validation, auth, " + "not found, disabled) does not use up the key. Accepted keys do not expire.")
+});
+function idempotencyPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  switch (auth?.kind) {
+    case "user":
+      return `user:${auth.userId}`;
+    case "agent":
+      return `agent:${auth.agentId}`;
+    case "controller":
+      return `controller:${auth.controllerId}`;
+    case "guest":
+      return null;
+    default:
+      return myAgentId ? `agent:${myAgentId}` : "operator";
+  }
+}
+function readIdempotencyKey(req, res, myAgentId) {
+  const raw = req.headers["idempotency-key"];
+  if (raw === undefined)
+    return;
+  const key = Array.isArray(raw) ? raw.join(", ") : raw;
+  if (!IDEMPOTENCY_KEY_PATTERN.test(key)) {
+    jsonError(res, "Idempotency-Key must be 1-255 visible ASCII characters", 400);
+    return null;
+  }
+  const principal = idempotencyPrincipal(req, myAgentId);
+  if (!principal) {
+    jsonError(res, "Idempotency-Key needs an identified caller", 400);
+    return null;
+  }
+  return { principal, key };
+}
+async function replayAcceptedOperation(res, claim, send) {
+  const accepted = await findAcceptedWorkflowOperation(claim);
+  if (!accepted)
+    return false;
+  if (accepted.fingerprint !== claim.fingerprint) {
+    jsonError(res, "Idempotency-Key was already used for a different request", 409);
+  } else if (accepted.resourceDeletedAt !== null) {
+    jsonError(res, "The workflow this Idempotency-Key created or triggered was deleted; send a new key to start over", 410);
+  } else {
+    res.setHeader(IDEMPOTENT_REPLAYED_HEADER, "true");
+    send(accepted.body);
+  }
+  return true;
+}
+
+// src/http/workflows.ts
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
   warnings: array2(string2()).optional()
@@ -39280,6 +40091,11 @@ var WorkflowRunPageSchema = object2({
     nextOffset: number2().int().optional()
   })
 });
+var WorkflowRunTreeSchema = object2({
+  rootRunId: string2(),
+  runs: array2(WorkflowRunSummarySchema),
+  hasOpenWork: boolean()
+});
 var SuccessResponseSchema = object2({ success: literal2(true) });
 async function withSaveWarnings(workflow) {
   const warnings = await workflowSaveWarnings(workflow.definition, getExecutorRegistry2());
@@ -39313,6 +40129,7 @@ var createWorkflowRoute = route({
   pattern: ["api", "workflows"],
   summary: "Create a new workflow",
   tags: ["Workflows"],
+  headers: idempotencyKeyHeader("creates one workflow"),
   body: object2({
     name: string2().min(1),
     key: AssetKeySchema.optional(),
@@ -39330,7 +40147,9 @@ var createWorkflowRoute = route({
   }),
   responses: {
     201: { description: "Workflow created", schema: WorkflowSaveResponseSchema },
-    400: { description: "Invalid definition" }
+    400: { description: "Invalid definition, or a malformed Idempotency-Key" },
+    409: { description: "Idempotency-Key was already used for a different request" },
+    410: { description: "The workflow created under this Idempotency-Key was deleted" }
   }
 });
 var getWorkflowRoute = route({
@@ -39434,16 +40253,20 @@ var triggerWorkflowRoute = route({
   path: "/api/workflows/{id}/trigger",
   pattern: ["api", "workflows", null, "trigger"],
   summary: "Trigger a workflow execution",
+  description: "With an `Idempotency-Key`, a retry returns the accepted run's `runId` and `skipped` without starting, resuming or waiting for anything, even after the workflow was disabled or edited and whatever state the run is in now.",
   tags: ["Workflows"],
   params: object2({ id: string2() }),
+  headers: idempotencyKeyHeader("starts one run"),
   responses: {
     201: {
       description: "Workflow run started (or skipped if cooldown active)",
       schema: object2({ runId: string2(), skipped: boolean() })
     },
-    400: { description: "Workflow is disabled" },
+    400: { description: "Workflow is disabled, or a malformed Idempotency-Key" },
     401: { description: "Unauthorized" },
-    404: { description: "Workflow not found" }
+    404: { description: "Workflow not found" },
+    409: { description: "Idempotency-Key was already used for a different request" },
+    410: { description: "The workflow triggered under this Idempotency-Key was deleted" }
   }
 });
 var validateTriggerRoute = route({
@@ -39487,20 +40310,45 @@ var getWorkflowRunRoute = route({
   path: "/api/workflow-runs/{id}",
   pattern: ["api", "workflow-runs", null],
   summary: "Get a workflow run with steps (includes retry columns)",
+  description: "Returns the run with its `context` and every step with its `input` by default. A step's `input` is a snapshot of the context when the step started, so in runs with loops (polling, `wait`, iterations) the response grows with steps × context size. Pass `fields=slim` to drop `run.context` and `steps[].input`; outputs, errors, diagnostics, retry fields and `parent` stay.",
   tags: ["Workflows"],
   params: object2({ id: string2() }),
+  query: object2({
+    fields: _enum2(["full", "slim"]).optional()
+  }),
   responses: {
     200: {
       description: "Workflow run details with steps including retry info",
-      schema: object2({
-        run: WorkflowRunSchema,
-        steps: array2(WorkflowRunStepSchema),
-        parent: WorkflowRunParentSchema.optional()
-      })
+      schema: union2([
+        object2({
+          run: WorkflowRunSchema,
+          steps: array2(WorkflowRunStepSchema),
+          parent: WorkflowRunParentSchema.optional()
+        }),
+        object2({
+          run: WorkflowRunSummarySchema,
+          steps: array2(WorkflowRunStepSlimSchema),
+          parent: WorkflowRunParentSchema.optional()
+        })
+      ])
     },
     404: { description: "Run not found" }
   }
 });
+var getWorkflowRunTreeRoute = route({
+  method: "get",
+  path: "/api/workflow-runs/{id}/tree",
+  pattern: ["api", "workflow-runs", null, "tree"],
+  summary: "Get a workflow run and every sub-workflow run below it",
+  description: `Follows stored parent links (\`parentStepId\` → step → run) through every attempt of every step, terminal runs included. \`runs\` holds list rows without \`context\`, root first. \`hasOpenWork\` is true while any run in the tree is live, has a pending, running or waiting step, a queued retry, an open task or a pending approval; after a cancel it turns false once the tree has settled. Both come from one read snapshot. The tree is not paginated. Links that form a cycle or nest deeper than ${WORKFLOW_RUN_TREE_MAX_DEPTH} levels return 409.`,
+  tags: ["Workflows"],
+  params: object2({ id: string2() }),
+  responses: {
+    200: { description: "The run tree", schema: WorkflowRunTreeSchema },
+    404: { description: "Run not found" },
+    409: { description: "Stored parent links form a cycle or nest past the depth bound" }
+  }
+});
 var retryWorkflowRunRoute = route({
   method: "post",
   path: "/api/workflow-runs/{id}/retry",
@@ -39688,9 +40536,21 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (createWorkflowRoute.match(req.method, pathSegments)) {
+    const idempotency = readIdempotencyKey(req, res, myAgentId);
+    if (idempotency === null)
+      return true;
     const parsed = await createWorkflowRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const claim = idempotency && {
+      ...idempotency,
+      operation: "workflow.create",
+      targetId: "",
+      fingerprint: workflowRequestFingerprint("workflow.create", parsed.body)
+    };
+    const replayCreate = (body) => createWorkflowRoute.respond(res, 201, body);
+    if (claim && await replayAcceptedOperation(res, claim, replayCreate))
+      return true;
     const validation = validateDefinition(parsed.body.definition, getExecutorRegistry2());
     if (!validation.valid) {
       jsonError(res, `Invalid definition: ${validation.errors.join("; ")}`, 400);
@@ -39712,7 +40572,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       }
       throw error;
     }
-    const workflow = await createWorkflow2({
+    const data = {
       key,
       name: parsed.body.name,
       description: parsed.body.description,
@@ -39728,8 +40588,34 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       vcsRepo: parsed.body.vcsRepo,
       createdByAgentId: myAgentId ?? undefined,
       createdBy: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
-    }, "api");
-    createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
+    };
+    if (!claim) {
+      const workflow = await createWorkflow2(data, "api");
+      createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
+      return true;
+    }
+    const warnings = await workflowSaveWarnings(parsed.body.definition, getExecutorRegistry2());
+    let saved;
+    try {
+      saved = await getDbClient2().transaction(async () => {
+        await assertWorkflowIdempotencyKeyUnused(claim);
+        const workflow = await createWorkflow2(data, "api");
+        const body = warnings.length > 0 ? { ...workflow, warnings } : workflow;
+        await recordAcceptedWorkflowOperation(claim, {
+          workflowId: workflow.id,
+          status: 201,
+          body
+        });
+        return body;
+      });
+    } catch (err) {
+      if (err instanceof IdempotencyKeyTakenError) {
+        if (await replayAcceptedOperation(res, claim, replayCreate))
+          return true;
+      }
+      throw err;
+    }
+    createWorkflowRoute.respond(res, 201, saved);
     return true;
   }
   if (getWorkflowRoute.match(req.method, pathSegments)) {
@@ -39931,9 +40817,26 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (triggerWorkflowRoute.match(req.method, pathSegments)) {
+    const idempotency = readIdempotencyKey(req, res, myAgentId);
+    if (idempotency === null)
+      return true;
     const parsed = await triggerWorkflowRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    let claim;
+    let keyedBody;
+    const replayTrigger = (body) => triggerWorkflowRoute.respond(res, 201, body);
+    if (idempotency) {
+      keyedBody = await parseBody(req);
+      claim = {
+        ...idempotency,
+        operation: "workflow.trigger",
+        targetId: parsed.params.id,
+        fingerprint: workflowRequestFingerprint("workflow.trigger", keyedBody)
+      };
+      if (await replayAcceptedOperation(res, claim, replayTrigger))
+        return true;
+    }
     const workflow = await getWorkflow2(parsed.params.id);
     if (!workflow) {
       res.writeHead(404);
@@ -39944,20 +40847,39 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Workflow is disabled", 400);
       return true;
     }
-    const body = await parseBody(req);
+    const body = idempotency ? keyedBody : await parseBody(req);
     let runId;
+    let accepted;
     try {
       runId = await startWorkflowExecution2(workflow, body, getExecutorRegistry2(), {
         triggerType: "api",
-        requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
+        requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined,
+        accept: claim ? async (run) => {
+          const response = { runId: run.runId, skipped: run.skipped };
+          await recordAcceptedWorkflowOperation(claim, {
+            workflowId: workflow.id,
+            runId: run.runId,
+            status: 201,
+            body: response
+          });
+          accepted = response;
+        } : undefined
       });
     } catch (err) {
       if (err instanceof TriggerSchemaError) {
         triggerSchemaErrorResponse(res, err.message, err.validationErrors);
         return true;
       }
+      if (claim && err instanceof IdempotencyKeyTakenError) {
+        if (await replayAcceptedOperation(res, claim, replayTrigger))
+          return true;
+      }
       throw err;
     }
+    if (accepted) {
+      triggerWorkflowRoute.respond(res, 201, accepted);
+      return true;
+    }
     const run = await getWorkflowRun2(runId);
     const skipped = run?.status === "skipped";
     triggerWorkflowRoute.respond(res, 201, { runId, skipped });
@@ -39979,17 +40901,39 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await getWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const run = await getWorkflowRun2(parsed.params.id, "display");
+    const slim = parsed.query.fields === "slim";
+    const run = slim ? await getWorkflowRunSummary(parsed.params.id) : await getWorkflowRun2(parsed.params.id, "display");
     if (!run) {
       res.writeHead(404);
       res.end();
       return true;
     }
-    const steps = await getWorkflowRunStepsByRunId2(parsed.params.id, "display");
+    const steps = slim ? await getWorkflowRunStepsSlimByRunId(parsed.params.id) : await getWorkflowRunStepsByRunId2(parsed.params.id, "display");
     const parent = run.parentStepId ? await getWorkflowRunParent(run.parentStepId) : null;
     getWorkflowRunRoute.respond(res, 200, { run, steps, ...parent ? { parent } : {} });
     return true;
   }
+  if (getWorkflowRunTreeRoute.match(req.method, pathSegments)) {
+    const parsed = await getWorkflowRunTreeRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    let tree;
+    try {
+      tree = await getWorkflowRunTree(parsed.params.id);
+    } catch (err) {
+      if (!(err instanceof WorkflowRunTreeError))
+        throw err;
+      jsonError(res, err.message, 409);
+      return true;
+    }
+    if (!tree) {
+      res.writeHead(404);
+      res.end();
+      return true;
+    }
+    getWorkflowRunTreeRoute.respond(res, 200, tree);
+    return true;
+  }
   if (retryWorkflowRunRoute.match(req.method, pathSegments)) {
     const parsed = await retryWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -40344,6 +41288,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleStatus(req, res, pathSegments, queryParams),
         () => handleOnboarding(req, res, pathSegments, queryParams),
         () => handleCodexOAuthDevice(req, res, pathSegments, queryParams),
+        () => handleCodexOAuthAccounts(req, res, pathSegments, queryParams),
         () => handleActiveSessions(req, res, pathSegments, queryParams, myAgentId),
         () => handlePricing(req, res, pathSegments, queryParams, myAgentId),
         () => handleSchedules(req, res, pathSegments, queryParams, myAgentId),
@@ -40351,6 +41296,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleWorkflowEvents(req, res, pathSegments, queryParams),
         () => handleApprovalRequests(req, res, pathSegments, queryParams),
         () => handleApps(req, res, pathSegments, queryParams, myAgentId),
+        () => handlePoolKeys(req, res, pathSegments, queryParams),
         () => handleConfig(req, res, pathSegments, queryParams),
         () => handleFs(req, res, pathSegments, queryParams, myAgentId),
         () => handleComb(req, res, pathSegments, queryParams, myAgentId),
@@ -40427,7 +41373,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-bqm1rtft.js");
+var { attachControllerTransport } = await import("./controllers-connect-r2za39ef.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -40456,7 +41402,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-spwxjgay.js");
+    const { stopScheduler } = await import("./index-38t35h0n.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -40468,7 +41414,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-dsd8rtgx.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-em0117bp.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -40548,21 +41494,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-9bmkspyw.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-xvak5p4v.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-yb75wv33.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-9bmkspyw.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-9bmkspyw.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -40570,7 +41516,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-n1vbvta9.js");
+  const { runAllSeeders } = await import("./index-qhjf2htm.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -40633,41 +41579,44 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-spwxjgay.js");
-    const { getExecutorRegistry } = await import("./index-srg522m6.js");
+    const { startScheduler } = await import("./index-38t35h0n.js");
+    const { getExecutorRegistry } = await import("./index-k0yt1tvq.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-kw2mmat7.js");
+    const { startHeartbeat } = await import("./index-yqgbfgaj.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-dsd8rtgx.js");
+    const { startOAuthKeepalive } = await import("./keepalive-em0117bp.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-q2c3bnvm.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-xysj4yse.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-5b3d2eea.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-f4nn561n.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-jsmfrpzf.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-6c1sjfnr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-s73gerxy.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-d4w9gajf.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
+  import("./session-source-backfill-qgtc86z1.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
+    console.error("[session-source-backfill] startup run failed (non-fatal):", err);
+  });
 }).on("error", (err) => {
   console.error("HTTP Server Error:", err);
 });