@desplega.ai/agent-swarm 2.7.4 → 2.7.6

package/dist/{http-xzxk9mst.js → http-mhz9vw1f.js}

@@ -68,10 +68,6 @@ import {
   resolveTriggerSurface,
   emitTaskTelemetry,
   init_telemetry_trigger,
-  CODEX_AUTH_FAILURE_BENCH_THRESHOLD,
-  CODEX_AUTH_WATCH_NAMESPACE,
-  codexAuthBenchMarkerKey,
-  init_codex_auth_failure,
   HeartbeatExpiryError,
   init_heartbeat_expiry,
   isRuntimePoolsEnabled,
@@ -231,14 +227,6 @@ import {
   init_db3,
   loadSecretRegistry,
   init_secret_registry,
-  STEERING_MOVED_ERROR,
-  SteeringRequestError,
-  isSteeringEnabled,
-  getTaskSteeringFields,
-  getTaskSteeringFieldsForTasks,
-  markSteeringUndeliverable,
-  requestSteering,
-  init_steering2,
   getWorkflowRunSummary,
   getWorkflowRunStepsSlimByRunId,
   WORKFLOW_RUN_TREE_MAX_DEPTH,
@@ -247,6 +235,14 @@ import {
   getWorkflowRunParent,
   init_workflow_runs,
   refreshActiveSessionOnActivity2,
+  STEERING_MOVED_ERROR,
+  SteeringRequestError,
+  isSteeringEnabled,
+  getTaskSteeringFields,
+  getTaskSteeringFieldsForTasks,
+  markSteeringUndeliverable,
+  requestSteering,
+  init_steering2,
   getPendingTaskForAgent2,
   startTask2,
   updateTaskClaudeSessionId2,
@@ -273,6 +269,8 @@ import {
   retirePoolKeyStatus,
   init_api_keys,
   getScriptRunExecutionArgs2,
+  getScriptRunFollowUpGuard2,
+  setScriptRunFollowUpGuard2,
   updateTaskVcs2,
   upsertAssetKeyMapping2,
   listAssetSummaries2,
@@ -479,7 +477,7 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db4
-} from "./cli-1s1dqn1j.js";
+} from "./cli-k2gzwsj2.js";
 import {
   PRIMARY_ROLE_NAMES2,
   getUserGrant2,
@@ -490,8 +488,8 @@ import {
   assertNotLastAdmin2,
   setUserRoles2,
   init_rbac_roles
-} from "./cli-bq2pcphn.js";
-import"./cli-36g23z21.js";
+} from "./cli-rmmmrjkd.js";
+import"./cli-zbbwez0r.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
@@ -499,13 +497,14 @@ import {
   init_model_catalog_store,
   requestModelCatalogRefresh2,
   init_pricing_refresh
-} from "./cli-wcmnan2g.js";
+} from "./cli-89knwags.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-eny54typ.js";
-import"./cli-a1fhj4n9.js";
+} from "./cli-wx3rhnm0.js";
+import"./cli-w6dt9ged.js";
 import {
+  require_dist4,
   getSlackConnectionState,
   init_connection_state,
   getSlackInboundDiagnostics,
@@ -534,12 +533,12 @@ import {
   startSlackApp2,
   stopSlackApp2,
   init_app3
-} from "./cli-1gm8jcyr.js";
+} from "./cli-waqbxg08.js";
 import {
   retryFailedRun2,
   cancelWorkflowRun2,
   init_resume
-} from "./cli-mvckssyq.js";
+} from "./cli-m48g6p95.js";
 import {
   DEFAULT_NEGOTIATED_PROTOCOL_VERSION,
   SUPPORTED_PROTOCOL_VERSIONS,
@@ -918,6 +917,9 @@ import {
   mergeScheduleTiming,
   validateRecurringTiming,
   init_validate,
+  followUpThreadForSourceTask,
+  evaluateFollowUpRedelegation,
+  init_follow_up_redelegation_guard,
   checkOutputSchemaShape,
   sendTaskOutputSchema,
   sendTaskHandler,
@@ -945,7 +947,7 @@ import {
   getEnabledCapabilities,
   createServer,
   init_server
-} from "./cli-1yekbyqm.js";
+} from "./cli-shpbx5ee.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -977,7 +979,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db2
-} from "./cli-cq1pf336.js";
+} from "./cli-yn4kxs06.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -1031,7 +1033,7 @@ import {
   describeRequestRoute,
   route,
   init_route_def
-} from "./cli-7n5sbw0z.js";
+} from "./cli-4necwtsv.js";
 import {
   startPoolRouting,
   stopPoolRouting,
@@ -1044,24 +1046,24 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-ktmvb20s.js";
-import"./cli-0fgr1w9b.js";
+} from "./cli-zm72anhg.js";
+import"./cli-xnrwazav.js";
 import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-t282jgab.js";
+} from "./cli-8snvgs5r.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-9cctx1tn.js";
+} from "./cli-a22h291q.js";
 import {
   reasoningCapability,
   supportedReasoningLevels
-} from "./cli-vqgnyh76.js";
+} from "./cli-98rw5dt5.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
-} from "./cli-bwty35gx.js";
+} from "./cli-mthwvjre.js";
 import {
   isLeadChannelMonitoringEnabled,
   ORG_IDENTITY_KEYS,
@@ -1071,11 +1073,11 @@ import {
   isUnknownModelError,
   checkProviderPoolKey,
   writeSkillsToFilesystem
-} from "./cli-je8yeyc5.js";
+} from "./cli-bjb3z51z.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-f255yaqn.js";
+} from "./cli-xds5f77d.js";
 import {
   Anthropic
 } from "./cli-318r69gq.js";
@@ -1091,7 +1093,7 @@ import {
   ampBillsCacheWrites,
   resolveAmpModel,
   init_amp_models
-} from "./cli-zn15c46z.js";
+} from "./cli-q0k1w5zd.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -1101,7 +1103,7 @@ import {
 import {
   normalizeModelKey,
   init_pricing_normalize
-} from "./cli-mc97xy2s.js";
+} from "./cli-c60vetmm.js";
 import {
   require_dist2,
   getMcpOAuthToken,
@@ -1190,7 +1192,7 @@ import {
   init_typecheck,
   parseSkillContent,
   init_skill_parser
-} from "./cli-d2pzqej1.js";
+} from "./cli-hr2e2fft.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -1207,7 +1209,7 @@ import {
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow,
   init_ensure_token
-} from "./cli-0sbkss7h.js";
+} from "./cli-xnqgpshy.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -1251,7 +1253,7 @@ import {
   definitionNodeIds,
   validateDefinition,
   init_definition2
-} from "./cli-pwyevs29.js";
+} from "./cli-8bc1w0tw.js";
 import {
   _fetchHolder,
   CLIENT_ID,
@@ -1267,17 +1269,15 @@ import {
   loadAllCodexOAuthSlots,
   getValidCodexOAuth,
   init_storage
-} from "./cli-jg0nfda6.js";
+} from "./cli-75gkpjvw.js";
 import {
   isMultiRuntimeEnabled,
   init_multi_runtime2
 } from "./cli-mdb054w3.js";
 import {
   require_content_type
-} from "./cli-gf5hbmdr.js";
-import {
-  require_dist9
-} from "./cli-w3hcrxht.js";
+} from "./cli-yjdgea32.js";
+import"./cli-gdhpcbhf.js";
 import {
   isInvalidClientError,
   publicEndpointSsrfOptions,
@@ -1295,11 +1295,11 @@ import {
   revokeMcpToken,
   computeExpiresAt,
   init_mcp_wrapper
-} from "./cli-k76tgq03.js";
+} from "./cli-hgaazk69.js";
 import {
   createRuntimeProvider,
   init_runtime_providers
-} from "./cli-b1afgtj3.js";
+} from "./cli-kqdg1bsb.js";
 import {
   registerSessionTokenConnection,
   init_session_token_connections,
@@ -1326,7 +1326,7 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-8yy525ad.js";
+} from "./cli-drr5v6av.js";
 import"./cli-v41kn3cd.js";
 import {
   setBedrockProviderModule,
@@ -1336,7 +1336,7 @@ import {
   import_websocket,
   import_websocket_server,
   init_wrapper2
-} from "./cli-dznrgaep.js";
+} from "./cli-69szn7w7.js";
 import {
   isRbacEnabled,
   decideToolAdmission,
@@ -1498,12 +1498,18 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types4
-} from "./cli-41z8xwj0.js";
+} from "./cli-nhrvpaj7.js";
+import {
+  CODEX_AUTH_FAILURE_BENCH_THRESHOLD,
+  CODEX_AUTH_WATCH_NAMESPACE,
+  codexAuthBenchMarkerKey,
+  init_codex_auth_failure
+} from "./cli-fw2w0kva.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-ycm6180s.js";
+} from "./cli-a7v854rf.js";
 import {
   getSlackConfiguration,
   init_config4
@@ -1530,7 +1536,7 @@ import {
   splitCredentialPool,
   selectCredential,
   init_credentials2
-} from "./cli-aq58fk5m.js";
+} from "./cli-g83s9ewh.js";
 import {
   interpolate,
   init_template2,
@@ -1540,7 +1546,7 @@ import {
   resolveTemplate,
   init_resolver,
   init_session_templates
-} from "./cli-j4kw3rsx.js";
+} from "./cli-cm5yqn35.js";
 import {
   init_zod
 } from "./cli-k5671be5.js";
@@ -1576,7 +1582,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-pe09p6dv.js";
+} from "./cli-e3r2neck.js";
 import {
   realtimeBus,
   init_bus
@@ -1609,13 +1615,13 @@ import {
   registerVolatileSecret,
   registerEnvSecrets,
   init_secret_scrubber
-} from "./cli-a4btqqft.js";
+} from "./cli-1b7btd38.js";
 import {
   isAlias,
   baseUrlEnvVar,
   providerForKeyVar,
   init_src2
-} from "./cli-4r12t6w6.js";
+} from "./cli-5c4hjzne.js";
 import {
   __toESM
 } from "./cli-242037k3.js";
@@ -5047,7 +5053,8 @@ var LocalHarnessProviderSchema = _enum2([
   "dsh",
   "amp",
   "cursor",
-  "grok"
+  "grok",
+  "fx"
 ]);
 var AcpRuntimeConfigSchema = object2({
   target: _enum2(ACP_TARGET_IDS),
@@ -11074,6 +11081,7 @@ declare module "swarm-extension" {
             | "amp"
             | "cursor"
             | "grok"
+            | "fx"
             | undefined;
           leadOnly?: boolean | undefined;
         }
@@ -11209,6 +11217,7 @@ declare module "swarm-extension" {
       | "amp"
       | "cursor"
       | "grok"
+      | "fx"
       | undefined;
     providerMeta?: Record<string, unknown> | undefined;
     harnessVariant?: string | undefined;
@@ -11231,6 +11240,7 @@ declare module "swarm-extension" {
             | "amp"
             | "cursor"
             | "grok"
+            | "fx"
             | undefined;
           leadOnly?: boolean | undefined;
         }
@@ -11252,6 +11262,10 @@ declare module "swarm-extension" {
     runtimeInstanceId?: string | null | undefined;
   };
 
+  export type SteerMode = "steer" | "queue";
+
+  export type SteeringSource = "script" | "slack" | "mcp" | "api" | "ui" | "chat";
+
   export type RequestInfo = {
     sessionId: string | undefined;
     agentId: string | undefined;
@@ -11462,6 +11476,27 @@ declare module "swarm-extension" {
     leadAgentId: string;
     summary: string;
   }
+  export interface TaskSteerEvent {
+    task: AgentTask;
+    message: string;
+    mode: SteerMode;
+    source: SteeringSource;
+    sender: {
+      kind: "user" | "agent" | "system";
+      userId?: string;
+      agentId?: string;
+    };
+    messageTimestamps?: string[];
+    /** Slack ingress metadata; not persisted or writable through modify. */
+    slack?: {
+      channelId: string;
+      threadTs: string;
+      userId?: string;
+    };
+  }
+  export interface TaskSteerModify {
+    message: string;
+  }
   export type TaskFollowUpModify = Partial<
     Pick<CreateTaskOptions, "agentId" | "priority" | "followUpConfig">
   > & {
@@ -11694,6 +11729,11 @@ declare module "swarm-extension" {
       modify: TaskFollowUpModify;
       result: PreResult<TaskFollowUpModify>;
     };
+    "pre.task.steer": {
+      event: TaskSteerEvent;
+      modify: TaskSteerModify;
+      result: PreResult<TaskSteerModify>;
+    };
     "pre.slack.route": {
       event: SlackRouteEvent;
       modify: SlackRouteModify;
@@ -15844,7 +15884,7 @@ async function registerTelegramWebhook() {
 
 // src/slack/app-icon.ts
 init_app3();
-var import_web_api = __toESM(require_dist9(), 1);
+var import_web_api = __toESM(require_dist4(), 1);
 var TTL_MS = 60 * 60 * 1000;
 var REQUEST_TIMEOUT_MS = 2500;
 var cached = null;
@@ -19730,6 +19770,7 @@ function createUserServer(user) {
       offerMode: false,
       leadOnly: false,
       allowDuplicate: false,
+      allowRedelegation: false,
       overrideSlackContext: false
     });
   });
@@ -21339,11 +21380,20 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
 var MEMORY_GC_INTERVAL_MS = 60 * 60 * 1000;
 var memoryGcTimer = null;
 var SEARCH_RETRIEVAL_TTL_DAYS = 90;
-async function purgeStaleSearchRetrievals() {
+var SEARCH_RETRIEVAL_PURGE_BATCH = 2000;
+async function purgeStaleSearchRetrievals(batchSize = SEARCH_RETRIEVAL_PURGE_BATCH) {
   try {
     const cutoff = new Date(Date.now() - SEARCH_RETRIEVAL_TTL_DAYS * 24 * 60 * 60 * 1000).toISOString();
-    const result = await getDbClient2().run("DELETE FROM memory_retrieval WHERE eventType = 'search' AND retrievedAt < ?", [cutoff]);
-    return result.changes;
+    let purged = 0;
+    for (;; ) {
+      const result = await getDbClient2().run(`DELETE FROM memory_retrieval WHERE rowid IN (
+          SELECT rowid FROM memory_retrieval
+          WHERE +eventType = 'search' AND retrievedAt < ? LIMIT ?)`, [cutoff, batchSize]);
+      purged += result.changes;
+      if (result.changes < batchSize)
+        return purged;
+      await new Promise((resolve) => setImmediate(resolve));
+    }
   } catch (err) {
     console.error("[memory-gc] Search retrieval purge failed:", err.message);
     return 0;
@@ -21363,10 +21413,17 @@ async function runMemoryGcTick(label) {
     console.error(`[memory-gc] ${label} purge failed:`, err);
   }
 }
-async function startMemoryGc(intervalMs = MEMORY_GC_INTERVAL_MS) {
+var MEMORY_GC_INITIAL_DELAY_MS = 2 * 60 * 1000;
+var memoryGcInitialTimer = null;
+async function startMemoryGc(intervalMs = MEMORY_GC_INTERVAL_MS, initialDelayMs = MEMORY_GC_INITIAL_DELAY_MS) {
   if (memoryGcTimer)
     return;
-  await runMemoryGcTick("Initial");
+  memoryGcInitialTimer = setTimeout(() => {
+    memoryGcInitialTimer = null;
+    runMemoryGcTick("Initial");
+  }, initialDelayMs);
+  if (typeof memoryGcInitialTimer?.unref === "function")
+    memoryGcInitialTimer.unref();
   memoryGcTimer = setInterval(() => {
     runMemoryGcTick("Periodic");
   }, intervalMs);
@@ -21374,6 +21431,10 @@ async function startMemoryGc(intervalMs = MEMORY_GC_INTERVAL_MS) {
     memoryGcTimer.unref();
 }
 function stopMemoryGc() {
+  if (memoryGcInitialTimer) {
+    clearTimeout(memoryGcInitialTimer);
+    memoryGcInitialTimer = null;
+  }
   if (memoryGcTimer) {
     clearInterval(memoryGcTimer);
     memoryGcTimer = null;
@@ -23020,7 +23081,8 @@ var StatusIdentitySchema = object2({
   is_cloud: boolean(),
   marketing_url: string2().nullable(),
   hide_cloud_promo: boolean(),
-  org_id: string2().nullable()
+  org_id: string2().nullable(),
+  dashboard_url: string2().nullable().optional()
 });
 var StatusActivitySchema = object2({
   agents_online: number2().int().nonnegative(),
@@ -23126,7 +23188,7 @@ async function rollupCredStatusForProvider(provider) {
     oldestReportAgeMs
   };
 }
-function buildIdentity() {
+function buildIdentity(dashboardUrl) {
   const cloudRaw = process.env.SWARM_CLOUD;
   const hideRaw = process.env.SWARM_HIDE_CLOUD_PROMO;
   return {
@@ -23136,7 +23198,8 @@ function buildIdentity() {
     is_cloud: cloudRaw === "true" || cloudRaw === "1",
     marketing_url: process.env.SWARM_MARKETING_URL?.trim() || null,
     hide_cloud_promo: hideRaw === "true" || hideRaw === "1",
-    org_id: process.env.SWARM_ORG_ID?.trim() || null
+    org_id: process.env.SWARM_ORG_ID?.trim() || null,
+    dashboard_url: dashboardUrl
   };
 }
 function describeRoll(roll) {
@@ -23438,7 +23501,7 @@ async function buildStatusPayload() {
   const instance = await getInstanceFeedbackSignals();
   return {
     runtime_pools: { enabled: isRuntimePoolsEnabled(), supervisor: runtimeSupervisorStatus() },
-    identity: buildIdentity(),
+    identity: buildIdentity(await resolveAppUrl()),
     setup,
     activity: { ...activity, leads_ready: readyLeads },
     agent_fs: {
@@ -24141,19 +24204,20 @@ var MAX_ENTRIES2 = 500;
 function filterKey(value) {
   return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a.localeCompare(b))) : v);
 }
-function createListTotalCache(ttlMs = LIST_TOTAL_TTL_MS) {
+function createListTotalCache(ttlMs = LIST_TOTAL_TTL_MS, firstPageTtlMs = 0) {
   const entries = new Map;
   return {
     get(filters, offset, compute) {
       const key = filterKey(filters);
       const now = Date.now();
       const hit = entries.get(key);
-      if (hit && hit.expiresAt > now && (offset ?? 0) > 0)
+      const maxAge = (offset ?? 0) > 0 ? ttlMs : Math.min(ttlMs, firstPageTtlMs);
+      if (hit && hit.countedAt + maxAge > now)
         return hit.total;
       if (hit)
         entries.delete(key);
       const total = compute();
-      entries.set(key, { expiresAt: now + ttlMs, total });
+      entries.set(key, { countedAt: now, total });
       total.catch(() => {
         if (entries.get(key)?.total === total)
           entries.delete(key);
@@ -24299,7 +24363,7 @@ var SupersedeTaskResponseSchema = object2({
   resumeTaskId: string2().nullable(),
   resumeTaskStatus: AgentTaskStatusSchema.optional()
 });
-var taskTotals = createListTotalCache();
+var taskTotals = createListTotalCache(LIST_TOTAL_TTL_MS, 15000);
 var listTasks = route({
   method: "get",
   path: "/api/tasks",
@@ -33462,6 +33526,9 @@ function refuseSourceWithSecrets(source) {
   };
 }
 
+// src/http/script-runs.ts
+init_rbac();
+
 // src/script-workflows/label-lint.ts
 var import_typescript = __toESM(require_typescript2(), 1);
 var ITERATION_CALLBACK_METHODS = new Set([
@@ -33531,6 +33598,7 @@ function lintWorkflowLabels(source) {
 }
 
 // src/http/script-runs.ts
+init_follow_up_redelegation_guard();
 init_types4();
 init_constants3();
 init_secret_scrubber();
@@ -33590,7 +33658,8 @@ var agentTaskBodySchema = object2({
   allowCustomModel: boolean().optional(),
   parentTaskId: string2().uuid().optional(),
   requestedByUserId: string2().optional(),
-  outputSchema: record2(string2(), unknown()).optional()
+  outputSchema: record2(string2(), unknown()).optional(),
+  allowRedelegation: boolean().optional()
 });
 var scriptRunCreatedSchema = object2({
   id: string2().uuid(),
@@ -33756,9 +33825,41 @@ var agentTaskRoute = route({
       description: "Agent task created or still running",
       schema: object2({ taskId: string2(), status: AgentTaskStatusSchema })
     },
-    404: { description: "Script run not found" }
+    403: {
+      description: "Script run belongs to another agent, or the run's agent may not create a child task under parentTaskId"
+    },
+    404: { description: "Script run not found" },
+    409: { description: "Agent task failed, was cancelled, or was superseded" },
+    422: { description: "Blocked by the follow-up re-delegation guard" }
   }
 });
+async function stepParentRefusal(runAgentId, parentTaskId) {
+  const parentTask = await getTaskById2(parentTaskId);
+  if (!parentTask)
+    return null;
+  const runAgent = await getAgentById2(runAgentId);
+  const decision = can({
+    principal: { kind: "agent", agentId: runAgentId, isLead: runAgent?.isLead ?? false },
+    verb: "task.parent.attach",
+    resource: {
+      kind: "task",
+      taskId: parentTask.id,
+      requestedByUserId: parentTask.requestedByUserId,
+      creatorAgentId: parentTask.creatorAgentId,
+      agentId: parentTask.agentId
+    },
+    source: "http"
+  });
+  return decision.allow ? null : `You don't have context for parent task ${parentTaskId}. Only its assignee, its creator, or a lead can create a child task under it.`;
+}
+async function resolveRunSourceTaskId(req, agentId) {
+  const raw = req.headers["x-source-task-id"];
+  const sourceTaskId = Array.isArray(raw) ? raw[0] : raw;
+  if (!sourceTaskId)
+    return;
+  const task = await getTaskById2(sourceTaskId);
+  return task?.agentId === agentId ? task.id : undefined;
+}
 async function requireAgent(res, agentId) {
   if (!agentId) {
     jsonError(res, "X-Agent-ID required for script runs API", 400);
@@ -33836,6 +33937,7 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
       }
     }
     const cap = scriptRunConcurrencyCap();
+    const sourceTaskId = await resolveRunSourceTaskId(req, agent.id);
     const creation = await getDbClient2().transaction(async () => {
       if (await countActiveScriptRuns2() >= cap)
         return null;
@@ -33847,6 +33949,7 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
         scriptName: parsed.body.scriptName,
         idempotencyKey: parsed.body.idempotencyKey,
         requestedByUserId: parsed.body.requestedByUserId,
+        sourceTaskId,
         createdBy: parsed.body.requestedByUserId
       });
     });
@@ -34043,9 +34146,22 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
       jsonError(res, "Script run not found", 404);
       return true;
     }
+    if (agentId !== run.agentId) {
+      jsonError(res, "Script run belongs to another agent", 403);
+      return true;
+    }
+    if (parsed.body.parentTaskId) {
+      const refusal = await stepParentRefusal(run.agentId, parsed.body.parentTaskId);
+      if (refusal) {
+        jsonError(res, refusal, 403);
+        return true;
+      }
+    }
     const contextKey = `script-run:${run.id}:${parsed.body.stepKey}`;
     let task = await getLatestScriptRunStepTaskByContextKey2(contextKey);
+    let dispatchedHere = false;
     if (!task) {
+      const taskDescription = parsed.body.template ?? parsed.body.task ?? parsed.body.stepKey;
       const modelError = await explicitModelErrorForAgent({
         model: parsed.body.model,
         allowCustomModel: parsed.body.allowCustomModel,
@@ -34055,25 +34171,62 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
         jsonError(res, modelError, 400);
         return true;
       }
+      const followUpThread = await followUpThreadForSourceTask(run.sourceTaskId);
+      let dispatched;
       try {
-        task = await createTaskExtended2(parsed.body.template ?? parsed.body.task ?? parsed.body.stepKey, {
-          agentId: parsed.body.agentId,
-          routingReason: parsed.body.routingReason ?? (parsed.body.agentId ? "human_pinned" : undefined),
-          routingNote: parsed.body.routingNote,
-          routingSource: parsed.body.routingReason ? "declared" : parsed.body.agentId ? "engine_default" : undefined,
-          tags: parsed.body.tags,
-          priority: parsed.body.priority,
-          dependsOn: parsed.body.dependsOn,
-          offeredTo: parsed.body.offerMode ? parsed.body.agentId : undefined,
-          taskType: "script-run-step",
-          source: "mcp",
-          dir: parsed.body.dir,
-          vcsRepo: parsed.body.vcsRepo,
-          model: parsed.body.model,
-          parentTaskId: parsed.body.parentTaskId,
-          requestedByUserId: parsed.body.requestedByUserId ?? run.requestedByUserId,
-          outputSchema: parsed.body.outputSchema,
-          contextKey
+        dispatched = await getDbClient2().transaction(async () => {
+          const replayed = await getLatestScriptRunStepTaskByContextKey2(contextKey);
+          if (replayed)
+            return { task: replayed };
+          let override;
+          if (followUpThread) {
+            const decision = await getScriptRunFollowUpGuard2(run.id);
+            if (decision !== "passed") {
+              const blocked = decision === null ? await evaluateFollowUpRedelegation({
+                ...followUpThread,
+                creatorAgentId: run.agentId,
+                taskDescription,
+                targetAgentId: parsed.body.agentId
+              }) : {
+                rule: decision,
+                message: `Blocked by the follow-up re-delegation guard (${decision} rule): an earlier step of this script run was blocked, and a run counts as one dispatch. If it must run, pass allowRedelegation: true.`
+              };
+              if (blocked && !parsed.body.allowRedelegation) {
+                if (decision === null)
+                  await setScriptRunFollowUpGuard2(run.id, blocked.rule);
+                return { blocked };
+              }
+              override = blocked?.rule;
+              await setScriptRunFollowUpGuard2(run.id, "passed");
+            }
+          }
+          const created = await createTaskExtended2(taskDescription, {
+            agentId: parsed.body.agentId,
+            routingReason: parsed.body.routingReason ?? (parsed.body.agentId ? "human_pinned" : undefined),
+            routingNote: parsed.body.routingNote,
+            routingSource: parsed.body.routingReason ? "declared" : parsed.body.agentId ? "engine_default" : undefined,
+            tags: parsed.body.tags,
+            priority: parsed.body.priority,
+            dependsOn: parsed.body.dependsOn,
+            offeredTo: parsed.body.offerMode ? parsed.body.agentId : undefined,
+            taskType: "script-run-step",
+            source: "mcp",
+            creatorAgentId: run.agentId,
+            sourceTaskId: run.sourceTaskId,
+            ...followUpThread ? {
+              slackChannelId: followUpThread.channelId,
+              slackThreadTs: followUpThread.threadTs,
+              slackUserId: followUpThread.userId
+            } : {},
+            dir: parsed.body.dir,
+            vcsRepo: parsed.body.vcsRepo,
+            model: parsed.body.model,
+            parentTaskId: parsed.body.parentTaskId,
+            requestedByUserId: parsed.body.requestedByUserId ?? run.requestedByUserId,
+            outputSchema: parsed.body.outputSchema,
+            contextKey
+          });
+          return { task: created, created: true, override };
         });
       } catch (error) {
         if (error instanceof ExtensionAgentAssignmentError2) {
@@ -34082,6 +34235,22 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
         }
         throw error;
       }
+      if (dispatched.override) {
+        console.log(`[script-runs] follow-up re-delegation override: rule=${dispatched.override} runId=${run.id} creatorAgentId=${run.agentId} sourceTaskId=${run.sourceTaskId} thread=${followUpThread?.channelId}/${followUpThread?.threadTs}`);
+      }
+      if (!dispatched.task) {
+        json(res, { error: dispatched.blocked.message, rule: dispatched.blocked.rule }, 422);
+        return true;
+      }
+      task = dispatched.task;
+      dispatchedHere = dispatched.created === true;
+    }
+    if (!dispatchedHere && task.parentTaskId) {
+      const refusal = await stepParentRefusal(run.agentId, task.parentTaskId);
+      if (refusal) {
+        jsonError(res, refusal, 403);
+        return true;
+      }
     }
     const deadline = Date.now() + 30000;
     while (Date.now() < deadline) {
@@ -42876,7 +43045,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-x9kvvhyk.js");
+var { attachControllerTransport } = await import("./controllers-connect-xx8x64n5.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -42905,7 +43074,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-8k8tmfxd.js");
+    const { stopScheduler } = await import("./index-k08z2cak.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -42917,7 +43086,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
-    const { stopOAuthKeepalive } = await import("./keepalive-w4aakbyk.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-w56f32cg.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -42999,21 +43168,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-ftt9htah.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-yr00k13d.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-m1yhh9ya.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-n2x7jh6k.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-ftt9htah.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-yr00k13d.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-ftt9htah.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-yr00k13d.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -43021,7 +43190,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-9j4zwcht.js");
+  const { runAllSeeders } = await import("./index-rvr00sg7.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -43084,26 +43253,26 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-8k8tmfxd.js");
-    const { getExecutorRegistry } = await import("./index-hq617xdj.js");
+    const { startScheduler } = await import("./index-k08z2cak.js");
+    const { getExecutorRegistry } = await import("./index-4f2pvxae.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-8c1zbz59.js");
+    const { startHeartbeat } = await import("./index-98gz7tmp.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
-    const { startOAuthKeepalive } = await import("./keepalive-w4aakbyk.js");
+    const { startOAuthKeepalive } = await import("./keepalive-w56f32cg.js");
     startOAuthKeepalive();
   }
   if (!isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-217semrv.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-29txy9vk.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
@@ -43112,16 +43281,16 @@ httpServer.listen(port, async () => {
   await startDbRetention();
   startHumanFreeDrain();
   startTaskSearchBackfill();
-  import("./embedding-space-s68v49ct.js").then(({ runEmbeddingMaintenance, setDeploymentEnvReader }) => {
+  import("./embedding-space-ny1e2940.js").then(({ runEmbeddingMaintenance, setDeploymentEnvReader }) => {
     setDeploymentEnvReader(getDeploymentEnvValue);
     return runEmbeddingMaintenance({ backfill: true });
   }).catch((err) => {
     console.error("[embedding-space] startup maintenance failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-8k4q95ap.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-4qfd4kfx.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
-  import("./session-source-backfill-pxbzcsc6.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
+  import("./session-source-backfill-n1czavbr.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
     console.error("[session-source-backfill] startup run failed (non-fatal):", err);
   });
 }).on("error", (err) => {