@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/dist/{cli-3fwqy71j.js → cli-dv11pgpv.js}

@@ -17,6 +17,7 @@ import {
   getWorkflowRunStatus,
   getChildWorkflowRunId,
   isParentStepAttemptCurrent,
+  emitRunFinished,
   createForeachChildSteps,
   init_workflow_runs,
   isApiOnlyConfigKey,
@@ -55,30 +56,30 @@ import {
   releaseApprovalCancellationNotificationClaim2,
   updateApprovalRequestNotifications2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-e8xyjvfc.js";
 import {
   getSlackApp2
-} from "./cli-g20jjwt4.js";
+} from "./cli-thsaq4pd.js";
 import {
   externalChannelToolError2,
   isBlockExternalEnabled2,
   getChannelBlockReason2
-} from "./cli-gnsb1zxa.js";
+} from "./cli-vhpckzvp.js";
 import {
   DEFAULT_MODEL,
   resolveCredential
-} from "./cli-v49fkghp.js";
+} from "./cli-ekptgk2m.js";
 import {
   revokeRuntimeTokensForRuntime,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-nf6k60sn.js";
 import {
   TERMINAL_TASK_STATUSES,
   init_types
-} from "./cli-4rf0f5vg.js";
+} from "./cli-s504c3w7.js";
 import {
   getSlackConfiguration,
   isSlackConfigured,
@@ -87,7 +88,7 @@ import {
 import {
   selectCredential,
   init_credentials
-} from "./cli-1tem6ns9.js";
+} from "./cli-gt4h8cxw.js";
 import {
   DEFAULT_OPENROUTER_BASE_URL,
   getOpenRouterBaseUrl,
@@ -99,7 +100,7 @@ import {
   init_template,
   resolveTemplate,
   init_resolver
-} from "./cli-dqygeeh5.js";
+} from "./cli-b41p764a.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -122,7 +123,7 @@ import {
 import {
   getAppUrl,
   init_constants2
-} from "./cli-gf2850q7.js";
+} from "./cli-3cywb44q.js";
 import {
   isEnvFlagEnabled,
   init_env_flag
@@ -149,7 +150,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-k8a5cgpp.js");
+    const { getSlackApp } = await import("./app-d53yhykk.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -176,6 +177,7 @@ init_config();
 init_env_flag();
 init_secret_scrubber();
 init_db3();
+init_workflow_runs();
 init_oauth();
 init_scrub_json();
 var NEEDS_SETUP_PREFIX = "needs_setup:";
@@ -438,6 +440,7 @@ async function recordWorkflowPreflightFailure(input) {
       timestamp,
       timestamp
     ]);
+    emitRunFinished(runId, input.workflowId, "failed");
     return {
       runId,
       recorded: await isFirstWorkflowPreflightFailureToday(input.workflowId, runId, now)
@@ -3812,6 +3815,18 @@ function resolveNodeTimeoutMs(node) {
     return config.timeout;
   return DEFAULT_NODE_TIMEOUT_MS;
 }
+function startStepDeadline(timeoutMs) {
+  const controller = new AbortController;
+  let timer;
+  const expired = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const error = new Error(`Step timed out after ${timeoutMs}ms`);
+      reject(error);
+      controller.abort(error);
+    }, timeoutMs);
+  });
+  return { signal: controller.signal, expired, clear: () => clearTimeout(timer) };
+}
 
 // src/workflows/readiness.ts
 async function findWorkflowReadinessProblems(definition, registry) {
@@ -4011,8 +4026,9 @@ async function startWorkflowExecution2(workflow, triggerData, registry, options
     if (initial.status)
       return runId;
     const walk = walkGraph(workflow.definition, runId, initial.context, findEntryNodes(workflow.definition), registry, workflow.id, getSecretInputKeys(workflow.input), options);
-    if (options.parentStepId) {
-      walk.catch((err) => console.error(`[workflows] Child workflow run ${runId} failed:`, err));
+    if (options.parentStepId || options.detach) {
+      const kind = options.parentStepId ? "Child" : "Detached";
+      walk.catch((err) => console.error(`[workflows] ${kind} workflow run ${runId} failed:`, err));
       return runId;
     }
     await walk;
@@ -4487,17 +4503,17 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     requestedByUserId: options.requestedByUserId,
     inputCtx: interpolationCtx
   };
-  const timeoutMs = resolveNodeTimeoutMs(node);
+  const deadline = startStepDeadline(resolveNodeTimeoutMs(node));
   let result;
   try {
     result = await Promise.race([
       executor.run({
         config: interpolatedConfig,
         context: executionCtx,
-        meta
+        meta: { ...meta, signal: deadline.signal }
       }),
-      timeoutPromise(timeoutMs)
-    ]);
+      deadline.expired
+    ]).finally(deadline.clear);
   } catch (err) {
     const errorMsg = err instanceof Error ? err.message : String(err);
     const retryPolicy = node.retry || executor.retryPolicy;
@@ -4536,7 +4552,7 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     }
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
     if (waiting && result.waitFor === "workflow.child.finished") {
-      const { resumeFromChildRun } = await import("./resume-8ayf37g5.js");
+      const { resumeFromChildRun } = await import("./resume-725g9b0b.js");
       await resumeFromChildRun(stepId, registry);
     }
     return { outcome: waiting ? "waiting" : "completed", successors: [] };
@@ -4741,11 +4757,6 @@ function scriptBodyInterpolationError(nodeId, tokens) {
   const renderedTokens = [...new Set(tokens)].map((token) => `{{${token}}}`).join(", ");
   return `Script body interpolation failed for node "${nodeId}": unresolved or disallowed token(s): ${renderedTokens}. Executable source may interpolate only input, workflow, swarm, or run values. Pass dynamic trigger or upstream values through config.args and read them from argv.`;
 }
-function timeoutPromise(ms) {
-  return new Promise((_, reject) => {
-    setTimeout(() => reject(new Error(`Step timed out after ${ms}ms`)), ms);
-  });
-}
 
 // src/workflows/executors/foreach.ts
 init_zod();
@@ -4998,7 +5009,7 @@ async function runForeachDrive(runId, parentNodeId, registry) {
     if (drive.successors.length > 0) {
       await walkGraph(workflow.definition, runId, ctx, drive.successors, registry, workflow.id, getSecretInputKeys(workflow.input));
     } else {
-      const { finalizeOrWait } = await import("./resume-8ayf37g5.js");
+      const { finalizeOrWait } = await import("./resume-725g9b0b.js");
       await finalizeOrWait(runId);
     }
     return drive;
@@ -5114,25 +5125,21 @@ async function startChild(input) {
     }
   }
   const executor = registry.get(bodyType);
-  const timeoutMs = resolveNodeTimeoutMs({ type: bodyType, config });
-  let timer;
+  const deadline = startStepDeadline(resolveNodeTimeoutMs({ type: bodyType, config }));
   let result;
   try {
     result = await Promise.race([
       executor.run({
         config,
         context: { ...ctx, ...bodyCtx },
-        meta: { ...meta, stepId: child.id, nodeId: child.nodeId }
+        meta: { ...meta, stepId: child.id, nodeId: child.nodeId, signal: deadline.signal }
       }),
-      new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`Step timed out after ${timeoutMs}ms`)), timeoutMs);
-      })
+      deadline.expired
     ]);
   } catch (err) {
     return { status: "failed", error: err instanceof Error ? err.message : String(err) };
   } finally {
-    if (timer)
-      clearTimeout(timer);
+    deadline.clear();
   }
   if (result.status === "failed") {
     return {
@@ -5145,7 +5152,7 @@ async function startChild(input) {
     const parked = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'waiting' WHERE id = ? AND status = 'running' RETURNING id", [child.id]);
     if (parked && result.waitFor === "workflow.child.finished") {
       ownedChildren.delete(child.id);
-      const { resumeFromChildRun } = await import("./resume-8ayf37g5.js");
+      const { resumeFromChildRun } = await import("./resume-725g9b0b.js");
       await resumeFromChildRun(child.id, registry);
     }
     return null;

package/dist/{cli-v49fkghp.js → cli-ekptgk2m.js}

@@ -98,7 +98,7 @@ import {
   init_src,
   selectCredential,
   init_credentials
-} from "./cli-1tem6ns9.js";
+} from "./cli-gt4h8cxw.js";
 import {
   __export
 } from "./cli-242037k3.js";
@@ -13228,9 +13228,9 @@ function registerBunOAuthFlows() {
 }
 
 // node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.lazy.js
-var anthropicMessagesApi = () => lazyApi(() => import("./anthropic-messages-txs190dd.js"));
+var anthropicMessagesApi = () => lazyApi(() => import("./anthropic-messages-n4cby1rz.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/azure-openai-responses.lazy.js
-var azureOpenAIResponsesApi = () => lazyApi(() => import("./azure-openai-responses-9kfwhmn7.js"));
+var azureOpenAIResponsesApi = () => lazyApi(() => import("./azure-openai-responses-43asa23s.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/google-generative-ai.lazy.js
 var googleGenerativeAIApi = () => lazyApi(() => import("./google-generative-ai-mk9vcpe1.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/google-vertex.lazy.js
@@ -13238,11 +13238,11 @@ var googleVertexApi = () => lazyApi(() => import("./google-vertex-q580kz8k.js"))
 // node_modules/@earendil-works/pi-ai/dist/api/mistral-conversations.lazy.js
 var mistralConversationsApi = () => lazyApi(() => import("./mistral-conversations-sd0xf1tn.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/openai-codex-responses.lazy.js
-var openAICodexResponsesApi = () => lazyApi(() => import("./openai-codex-responses-79s8xnbh.js"));
+var openAICodexResponsesApi = () => lazyApi(() => import("./openai-codex-responses-jhr3sjtm.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/openai-completions.lazy.js
-var openAICompletionsApi = () => lazyApi(() => import("./openai-completions-tdbyts0x.js"));
+var openAICompletionsApi = () => lazyApi(() => import("./openai-completions-gs6yn37k.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/openai-responses.lazy.js
-var openAIResponsesApi = () => lazyApi(() => import("./openai-responses-dm3t5vqp.js"));
+var openAIResponsesApi = () => lazyApi(() => import("./openai-responses-jqm9vwwk.js"));
 // node_modules/@earendil-works/pi-ai/dist/api/pi-messages.lazy.js
 var piMessagesApi = () => lazyApi(() => import("./pi-messages-3nf8bq1a.js"));
 // node_modules/@earendil-works/pi-ai/dist/providers/data/amazon-bedrock.json

package/dist/{cli-c2habvsf.js → cli-f3mzy662.js}

@@ -4,7 +4,7 @@ import {
   CONTROLLER_COMMAND_TIMEOUT_MS,
   RuntimeHandleSchema,
   ControllerStatusResultSchema
-} from "./cli-d2dpf95n.js";
+} from "./cli-rg4b2g6j.js";
 import {
   getDbClient2,
   isRuntimePoolsEnabled,
@@ -21,11 +21,11 @@ import {
   upsertSwarmConfig2,
   getResolvedConfig2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   createWorkerTaskFollowUp,
   canClaim
-} from "./cli-4hxrf0p4.js";
+} from "./cli-pzafyqtk.js";
 import {
   getRuntimeController2,
   getRuntimeControllerTarget2,
@@ -36,7 +36,7 @@ import {
   getPoolForAgent2,
   resolvePoolDelivery2,
   init_db
-} from "./cli-gf95q3bm.js";
+} from "./cli-6vwjsetx.js";
 import {
   runtimeStaleThresholdMinutes,
   getRuntimeInstanceById,
@@ -44,7 +44,7 @@ import {
   markRuntimeTerminated,
   listRuntimeInstancesForAgent,
   listRuntimeInstancesForPool
-} from "./cli-3fwqy71j.js";
+} from "./cli-dv11pgpv.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-e8xyjvfc.js";
@@ -55,20 +55,28 @@ import {
 import {
   import_websocket
 } from "./cli-b2mz5mjc.js";
+import {
+  resolveWorkerApiUrl,
+  init_worker_api_url
+} from "./cli-wtjg6je3.js";
+import {
+  buildImageTemplate,
+  init_dispatch
+} from "./cli-tf1n0r0b.js";
 import {
   canProvisionKind,
   createRuntimeProvider,
   init_runtime_providers
-} from "./cli-39aet655.js";
+} from "./cli-m52t4cta.js";
 import {
   mintRuntimeToken,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-nf6k60sn.js";
 import {
   TERMINAL_TASK_STATUSES,
   isTerminalTaskStatus,
   init_types
-} from "./cli-4rf0f5vg.js";
+} from "./cli-s504c3w7.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -81,14 +89,6 @@ import {
   realtimeBus,
   init_bus
 } from "./cli-syfdvhkc.js";
-import {
-  resolveWorkerApiUrl,
-  init_worker_api_url
-} from "./cli-7a6p4e65.js";
-import {
-  buildImageTemplate,
-  init_dispatch
-} from "./cli-tf1n0r0b.js";
 import {
   RUNTIME_LABELS,
   init_types2
@@ -524,7 +524,7 @@ async function recoverSessions(runtimeId, reason) {
   }
   if (!sessions.length)
     return;
-  const { remediateTaskForDeadRuntime } = await import("./heartbeat-vn31xwdk.js");
+  const { remediateTaskForDeadRuntime } = await import("./heartbeat-f928aqyp.js");
   for (const session of sessions) {
     try {
       const task = await getTaskById2(session.taskId);

package/dist/{cli-zqne1qcj.js → cli-fk7k8s9x.js}

@@ -14,7 +14,7 @@ import {
 import {
   applyOpenRouterBaseUrlOverride2,
   buildOpenAICompatibleProviderBlock2
-} from "./cli-9abdgn5t.js";
+} from "./cli-dgtfysne.js";
 import {
   fetchInstalledMcpServers
 } from "./cli-bst1vp7e.js";
@@ -44,7 +44,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-nn6vx2mq.js";
+} from "./cli-swkx9jm2.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{cli-1tem6ns9.js → cli-gt4h8cxw.js}

@@ -750,9 +750,10 @@ async function fetchAvailableIndices(env, apiUrl, apiKey, poolVars = CREDENTIAL_
   for (const envVar of poolVars) {
     const val = env[envVar];
     if (val) {
-      const totalKeys = val.includes(",") ? val.split(",").filter((s) => s.trim()).length : 1;
+      const keySuffixes = splitCredentialPool(val).map((key) => key.slice(-5));
+      const totalKeys = keySuffixes.length;
       try {
-        const resp = await fetch(`${apiUrl}/api/keys/available?keyType=${encodeURIComponent(envVar)}&totalKeys=${totalKeys}${modelParam}`, { headers: { Authorization: `Bearer ${apiKey}` } });
+        const resp = await fetch(`${apiUrl}/api/keys/available?keyType=${encodeURIComponent(envVar)}&totalKeys=${totalKeys}${modelParam}&keySuffixes=${encodeURIComponent(keySuffixes.join(","))}`, { headers: { Authorization: `Bearer ${apiKey}` } });
         if (resp.ok) {
           const data = await resp.json();
           availableIndicesMap[envVar] = {

package/dist/{cli-vbhgkw9h.js → cli-h3e7bhvn.js}

@@ -1,12 +1,12 @@
 import {
-  require_src
-} from "./cli-dv97kdzv.js";
+  require_src2
+} from "./cli-wdxgsdz5.js";
 import {
   __toESM
 } from "./cli-242037k3.js";
 
 // src/providers/otel-env.ts
-var import_api = __toESM(require_src(), 1);
+var import_api = __toESM(require_src2(), 1);
 function isTruthy(value) {
   const v = (value ?? "").toLowerCase();
   return v === "1" || v === "true" || v === "yes" || v === "on";

package/dist/{cli-ffvsj2qw.js → cli-hkxqdmnb.js}

@@ -1,10 +1,10 @@
 import {
   Anthropic
-} from "./cli-rr7zx19j.js";
+} from "./cli-prcyzecg.js";
 import {
   contextBoundNoteThreshold,
   createContextBoundNote
-} from "./cli-nq677csy.js";
+} from "./cli-dscnhn18.js";
 import {
   checkToolLoop
 } from "./cli-0726awxw.js";
@@ -24,7 +24,7 @@ import {
 import {
   selectCredential,
   init_credentials
-} from "./cli-1tem6ns9.js";
+} from "./cli-gt4h8cxw.js";
 import {
   runtimeCatalogModel,
   init_runtime_model_catalog

package/dist/{cli-a2rr0fmg.js → cli-hpkvgdad.js}

@@ -4,11 +4,11 @@ import {
   invalidateTelemetryUserRole,
   init_telemetry_identity,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   PermissionVerbSchema,
   init_rbac
-} from "./cli-4rvr7zfx.js";
+} from "./cli-k4awgvzm.js";
 import {
   init_env_flag
 } from "./cli-cebvbc9t.js";
@@ -276,7 +276,10 @@ var init_rbac_roles = __esm(() => {
         "task.fs.mutate",
         "favorite.write.own",
         "session.share",
-        "session.presence"
+        "session.presence",
+        "task.steer.own",
+        "comb.presence",
+        "fs.join.own"
       ]
     },
     {
@@ -285,7 +288,7 @@ var init_rbac_roles = __esm(() => {
       description: "Read-only: no task, approval or script writes.",
       isBuiltin: true,
       grantsAll: false,
-      verbs: ["favorite.write.own", "session.presence"]
+      verbs: ["favorite.write.own", "session.presence", "comb.presence", "fs.join.own"]
     }
   ];
   PRIMARY_ROLE_NAMES2 = ["admin", "requester", "viewer"];

package/dist/{cli-art7c1zh.js → cli-hq2v4rr5.js}

@@ -9,21 +9,21 @@ import {
   init_active_sessions,
   getSteeringMessageById2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-a2rr0fmg.js";
+} from "./cli-hpkvgdad.js";
 import {
   findUserById,
   findUserByExternalId,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-nf6k60sn.js";
 import {
   isRbacEnabled,
   can,
   init_rbac
-} from "./cli-4rvr7zfx.js";
+} from "./cli-k4awgvzm.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -203,19 +203,33 @@ function wireHttpSpanLifecycle(res, span, getStatusCode, startTime) {
     span.end();
   });
 }
+function redactShareTokenInPath(pathname) {
+  const segments = pathname.split("/");
+  if (segments[1] === "invite" && segments[2]) {
+    segments[2] = "[REDACTED]";
+    return segments.join("/");
+  }
+  const at = segments[1] === "agentfs" ? 2 : 1;
+  if ((segments[at] === "share" || segments[at] === "site") && segments[at + 1]) {
+    segments[at + 1] = "[REDACTED]";
+    return segments.join("/");
+  }
+  return pathname;
+}
 function safeRequestUrlForLog(rawUrl) {
   if (!rawUrl)
     return "";
   try {
     const url = new URL(rawUrl, "http://localhost");
+    const pathname = redactShareTokenInPath(url.pathname);
     const params = Array.from(url.searchParams.keys());
     if (params.length === 0)
-      return url.pathname;
+      return pathname;
     const redactedQuery = params.map((key) => `${key}=[REDACTED]`).join("&");
-    return `${url.pathname}?${redactedQuery}`;
+    return `${pathname}?${redactedQuery}`;
   } catch {
     const pathOnly = rawUrl.split("?")[0] || rawUrl;
-    return scrubSecrets(pathOnly);
+    return scrubSecrets(redactShareTokenInPath(pathOnly));
   }
 }
 async function agentWithCapacity(agent) {
@@ -503,7 +517,7 @@ function route(def) {
       try {
         const rawBody = def.body ? await parseBody(req, def.maxBodyBytes) : undefined;
         if (def.session && "bodyTaskIds" in def.session) {
-          const { bodySessionDenial } = await import("./session-access-fdhp987s.js");
+          const { bodySessionDenial } = await import("./session-access-0j2ezjje.js");
           const denial = await bodySessionDenial(req, def.session.bodyTaskIds(rawBody));
           if (denial) {
             jsonError(res, denial, 403);
@@ -775,6 +789,20 @@ async function hasSessionWrite2(req, myAgentId, taskId) {
   const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
   return hasSessionAccess(access, "write");
 }
+var NOT_YOUR_TASK_DENIED2 = "You can only change tasks you requested, or sessions shared with you to edit.";
+async function deniesNonOwnerTaskWrite2(req, task) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled())
+    return false;
+  if (task.requestedByUserId === auth.userId)
+    return false;
+  if ((await getUserGrant2(auth.userId)).grantsAll)
+    return false;
+  const root = await getSessionRoot(task.id);
+  if (!root?.requestedByUserId)
+    return true;
+  return !hasSessionAccess(await sessionAccessForRoot(auth.userId, root), "write");
+}
 async function denyParentAttach2(req, res, myAgentId, parentTask, principal) {
   const attach = can({
     principal,
@@ -873,4 +901,4 @@ async function userAgentIdentityDenial2(req, def, pathSegments) {
   return USER_AGENT_HEADER_DENIED;
 }
 
-export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, RequestBodyTooLargeError, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, hasSessionWrite2, denyParentAttach2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };
+export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, redactShareTokenInPath, safeRequestUrlForLog, agentWithCapacity, RequestBodyTooLargeError, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, hasSessionWrite2, NOT_YOUR_TASK_DENIED2, deniesNonOwnerTaskWrite2, denyParentAttach2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };

package/dist/{cli-sqma6vw1.js → cli-k1zb7raw.js}

@@ -10,7 +10,7 @@ import {
   init_steering,
   createLogEntry2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   ackSlackMessage,
   buildBufferFlushBlocks,
@@ -20,7 +20,7 @@ import {
   ensureSlackThreadTree2,
   registerTreeMessage,
   getSlackApp2
-} from "./cli-g20jjwt4.js";
+} from "./cli-thsaq4pd.js";
 import {
   createAdditiveBuffer,
   TaskCreationBlockedError,
@@ -30,15 +30,15 @@ import {
   createSlackTaskWithFiles,
   notifySlackFileFailures,
   extractSlackMessageText
-} from "./cli-4hxrf0p4.js";
+} from "./cli-pzafyqtk.js";
 import {
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-24j1jeeb.js";
+} from "./cli-y4tdxsqb.js";
 import {
   findUserByExternalId,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-nf6k60sn.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled

package/dist/{cli-4rvr7zfx.js → cli-k4awgvzm.js}

@@ -306,6 +306,7 @@ var init_legacy_policy = __esm(() => {
     "mcp-oauth.authorize.any": anyAuthenticated,
     "kv.write.any": leadOrOwnNamespace,
     "comb.presence": operatorOrUser,
+    "fs.join.own": anyAuthenticated,
     "page.delete.any": leadOrResourceOwner,
     "app.manage": anyAuthenticated,
     "app.use": anyAuthenticated,
@@ -640,6 +641,10 @@ var init_permissions = __esm(() => {
       description: "Use dashboard presence rooms for Comb drives.",
       namespace: "comb"
     },
+    "fs.join.own": {
+      description: "Join the swarm's shared agent-fs drive with your own account email.",
+      namespace: "fs"
+    },
     "page.delete.any": {
       description: "Delete a page the caller does not own.",
       namespace: "page"

package/dist/{cli-3ndmpxxv.js → cli-k7d3hvya.js}

@@ -9,7 +9,7 @@ import {
   loadMcpConfig,
   addMcpServerConfig,
   removeMcpServerConfig
-} from "./cli-w2656ka1.js";
+} from "./cli-0w4e4v58.js";
 import {
   McpOAuthCredentialStore2,
   McpSignInCancelledError2,
@@ -17,7 +17,7 @@ import {
   McpServerLog2,
   createDefaultTransport2,
   McpServerConnection2
-} from "./cli-683y0b3a.js";
+} from "./cli-0dqtv2jg.js";
 
 // node_modules/@earendil-works/pi-coding-agent/dist/extensions/mcp/cli.js
 import { existsSync } from "node:fs";