@desplega.ai/agent-swarm 2.7.6 → 2.7.7

package/dist/{cli-8bc1w0tw.js → cli-nmzhp1b5.js}

@@ -56,22 +56,21 @@ import {
   releaseApprovalCancellationNotificationClaim2,
   updateApprovalRequestNotifications2,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   externalChannelToolError2,
   isBlockExternalEnabled2,
   getChannelBlockReason2,
   init_external_channel
-} from "./cli-w6dt9ged.js";
+} from "./cli-rtt8g4v9.js";
 import {
   getSlackApp2,
   init_app3
-} from "./cli-waqbxg08.js";
+} from "./cli-cppkf404.js";
 import {
-  DEFAULT_MODEL,
   resolveCredential,
   init_credentials
-} from "./cli-436532ck.js";
+} from "./cli-excnnjg2.js";
 import {
   isMultiRuntimeEnabled,
   init_multi_runtime2
@@ -79,16 +78,19 @@ import {
 import {
   revokeRuntimeTokensForRuntime,
   init_users
-} from "./cli-drr5v6av.js";
+} from "./cli-5jnhv72d.js";
 import {
   TERMINAL_TASK_STATUSES,
   init_types4
-} from "./cli-nhrvpaj7.js";
+} from "./cli-n6bv12jn.js";
 import {
   getSlackConfiguration,
   isSlackConfigured,
   init_config4
 } from "./cli-eetzmsy5.js";
+import {
+  DEFAULT_MODEL
+} from "./cli-82j36f2m.js";
 import {
   DEFAULT_OPENROUTER_BASE_URL,
   getOpenRouterBaseUrl,
@@ -127,7 +129,7 @@ import {
 import {
   getAppUrl,
   init_constants3
-} from "./cli-611a1294.js";
+} from "./cli-k0wwfqbg.js";
 import {
   isEnvFlagEnabled,
   init_env_flag
@@ -155,7 +157,7 @@ async function notifyAutomationPreflightFailure(preflight) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-909e97cr.js");
+    const { getSlackApp } = await import("./app-nky4378f.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Automation Preflight] Slack not available, cannot send notification");
@@ -4551,7 +4553,7 @@ async function runClaimedStep(def, runId, ctx, node, registry, existingStep, ste
     }
     const waiting = await checkpointStepWaiting(runId, stepId, ctx);
     if (waiting && result.waitFor === "workflow.child.finished") {
-      const { resumeFromChildRun } = await import("./resume-wd30wx23.js");
+      const { resumeFromChildRun } = await import("./resume-adda0bwy.js");
       await resumeFromChildRun(stepId, registry);
     }
     return { outcome: waiting ? "waiting" : "completed", successors: [] };
@@ -5056,7 +5058,7 @@ async function runForeachDrive(runId, parentNodeId, registry) {
     if (drive.successors.length > 0) {
       await walkGraph(workflow.definition, runId, ctx, drive.successors, registry, workflow.id, getSecretInputKeys(workflow.input));
     } else {
-      const { finalizeOrWait } = await import("./resume-wd30wx23.js");
+      const { finalizeOrWait } = await import("./resume-adda0bwy.js");
       await finalizeOrWait(runId);
     }
     return drive;
@@ -5199,7 +5201,7 @@ async function startChild(input) {
     const parked = await getDbClient2().get("UPDATE workflow_run_steps SET status = 'waiting' WHERE id = ? AND status = 'running' RETURNING id", [child.id]);
     if (parked && result.waitFor === "workflow.child.finished") {
       ownedChildren.delete(child.id);
-      const { resumeFromChildRun } = await import("./resume-wd30wx23.js");
+      const { resumeFromChildRun } = await import("./resume-adda0bwy.js");
       await resumeFromChildRun(child.id, registry);
     }
     return null;

package/dist/{cli-0yv5z2pg.js → cli-p82cnnjq.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-e3r2neck.js";
+} from "./cli-6pfd54vx.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-c60vetmm.js → cli-pc6n7fre.js}

@@ -1,7 +1,7 @@
 import {
   getDb2,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   openAICompatibleProviderIds,
   withRegistryCatalogSections,

package/dist/{cli-xds5f77d.js → cli-pjctyea3.js}

@@ -6,11 +6,11 @@ import {
   getResolvedConfig2,
   getAllUsers2,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-rmmmrjkd.js";
+} from "./cli-jtjtabxe.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{cli-xbbndvjy.js → cli-pq73h5mz.js}

@@ -2,19 +2,19 @@ import {
   getKv2,
   upsertKv2,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   resolveIdentity,
   init_identity,
   recordUnmappedIdentity,
   init_unmapped_identities
-} from "./cli-shpbx5ee.js";
+} from "./cli-ws19768n.js";
 import {
   findUserByExternalId,
   findOrCreateUserByEmail,
   linkIdentity,
   init_users
-} from "./cli-drr5v6av.js";
+} from "./cli-5jnhv72d.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-aa6yxc7m.js → cli-pz4rk021.js}

@@ -1,7 +1,7 @@
 import {
   lazyApi,
   init_lazy
-} from "./cli-1h3wcpbw.js";
+} from "./cli-snpj5zbj.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-xnqgpshy.js → cli-q3tkegby.js}

@@ -9,7 +9,7 @@ import {
   acquireOAuthRefreshLock,
   releaseOAuthRefreshLock,
   init_oauth
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   generateRandomCodeVerifier,
   generateRandomState,

package/dist/cli-qghe0h66.js

@@ -0,0 +1,67 @@
+import {
+  completeStructuredWithModel
+} from "./cli-vz22fyqv.js";
+import {
+  SummaryWithRatingsSchema,
+  BASE_SUMMARIZE_PROMPT,
+  buildSummaryWithRatingsPrompt,
+  init_llm
+} from "./cli-rvtm68yy.js";
+import {
+  _Array_,
+  Optional,
+  _Object_,
+  Number2,
+  String2,
+  init_build,
+  init_credentials
+} from "./cli-excnnjg2.js";
+import {
+  init_models2
+} from "./cli-82j36f2m.js";
+
+// src/utils/internal-ai/index.ts
+init_credentials();
+init_models2();
+
+// src/utils/internal-ai/summarize-session.ts
+init_build();
+init_llm();
+var summaryToolSchema = _Object_({
+  summary: String2(),
+  ratings: _Array_(_Object_({
+    id: String2({ minLength: 1 }),
+    score: Number2({ minimum: 0, maximum: 1 }),
+    reasoning: String2({ minLength: 1, maxLength: 500 }),
+    referencesSource: Optional(String2({ maxLength: 512 }))
+  }))
+});
+async function summarizeSession(opts) {
+  if (opts.transcript.length <= 100)
+    return null;
+  const taskLine = opts.taskContext.prompt ? `
+Task: ${opts.taskContext.prompt}` : "";
+  const basePrompt = `${BASE_SUMMARIZE_PROMPT}${taskLine}
+
+Transcript:
+${opts.transcript}`;
+  const userPrompt = buildSummaryWithRatingsPrompt(basePrompt, opts.retrievals);
+  const runner = opts._completeStructured ?? completeStructuredWithModel;
+  const result = await runner({
+    zodSchema: SummaryWithRatingsSchema,
+    toolSchema: summaryToolSchema,
+    toolName: "record_session_summary",
+    toolDescription: "Record the high-value learnings extracted from this session, plus per-memory ratings of any retrievals.",
+    systemPrompt: "You are an expert at extracting durable, generalizable learnings from agent sessions.",
+    userPrompt,
+    callerTag: `session-summary:${opts.harness}`,
+    apiUrl: opts.apiUrl,
+    apiKey: opts.apiKey,
+    env: opts.env,
+    signal: opts.signal,
+    retries: 3,
+    ...opts._credentialOverride ? { _credentialOverride: opts._credentialOverride } : {}
+  });
+  return result ? { ...result.data, model: result.model } : null;
+}
+export { summarizeSession };

package/dist/{cli-zbbwez0r.js → cli-qh4d4tvk.js}

@@ -7,21 +7,21 @@ import {
   tierConfigKey,
   init_model_tier_keys,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   ensureRbacSeedsSynced2,
   init_rbac_roles
-} from "./cli-rmmmrjkd.js";
+} from "./cli-jtjtabxe.js";
 import {
   seedPricingFromModelsDev,
   init_seed_pricing
-} from "./cli-c60vetmm.js";
+} from "./cli-pc6n7fre.js";
 import {
   MODEL_TIERS,
   DEFAULT_MODEL_TIER_MAP,
   ProviderNameSchema,
   init_types4
-} from "./cli-nhrvpaj7.js";
+} from "./cli-n6bv12jn.js";
 import {
   __esm
 } from "./cli-242037k3.js";

package/dist/{cli-w6dt9ged.js → cli-rtt8g4v9.js}

@@ -4,7 +4,7 @@ import {
   claimKv2,
   deleteKv2,
   init_db4
-} from "./cli-k2gzwsj2.js";
+} from "./cli-wk5yrfwd.js";
 import {
   isEnvFlagEnabled,
   init_env_flag

package/dist/{cli-1h3wcpbw.js → cli-snpj5zbj.js}

@@ -1566,7 +1566,7 @@ function modelsAreEqual(a, b) {
   return getModelType(a) === getModelType(b) && a.id === b.id && a.provider === b.provider;
 }
 var KNOWN_MODEL_TYPES, EXTENDED_THINKING_LEVELS;
-var init_models2 = __esm(() => {
+var init_models = __esm(() => {
   init_lazy();
   init_context();
   init_credential_store();
@@ -1584,4 +1584,4 @@ var init_models2 = __esm(() => {
   EXTENDED_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 });
 
-export { lazyStream, lazyApi, init_lazy, defaultProviderAuthContext, init_context, InMemoryCredentialStore, init_credential_store, ModelsError, InMemoryModelsStore, init_models_store, AI_TELEMETRY_SCHEMA, getModelType, isModelType, assertChatModel, assertImageModel, assertClassifierModel, assertClassifierInputSupported, imageErrorResult, classifierErrorResult, init_model_operations, contentText, getSystemMessageText, renderSystemMessageUpdate, init_text, createInitialSystemMessage, normalizeContext, getInitialSystemMessage, withoutInitialSystemMessage, getCurrentTools, getCurrentSystemMessage, getCurrentSystemPrompt, collapseSystemMessages, resolveTranscript, toToolDeclaration, declarationsEqual, getToolStateChanges, getDeclaredTools, hasToolRedefinitions, hasNonAdditiveToolChanges, resolveTranscriptTools, init_transcript, createModels, createProvider, hasApi, calculateCost, getSupportedThinkingLevels, clampThinkingLevel, modelsAreEqual, exports_models, init_models2 };
+export { lazyStream, lazyApi, init_lazy, defaultProviderAuthContext, init_context, InMemoryCredentialStore, init_credential_store, ModelsError, InMemoryModelsStore, init_models_store, AI_TELEMETRY_SCHEMA, getModelType, isModelType, assertChatModel, assertImageModel, assertClassifierModel, assertClassifierInputSupported, imageErrorResult, classifierErrorResult, init_model_operations, contentText, getSystemMessageText, renderSystemMessageUpdate, init_text, createInitialSystemMessage, normalizeContext, getInitialSystemMessage, withoutInitialSystemMessage, getCurrentTools, getCurrentSystemMessage, getCurrentSystemPrompt, collapseSystemMessages, resolveTranscript, toToolDeclaration, declarationsEqual, getToolStateChanges, getDeclaredTools, hasToolRedefinitions, hasNonAdditiveToolChanges, resolveTranscriptTools, init_transcript, createModels, createProvider, hasApi, calculateCost, getSupportedThinkingLevels, clampThinkingLevel, modelsAreEqual, exports_models, init_models };

package/dist/{cli-a7v854rf.js → cli-tgrv9cjx.js}

@@ -7,9 +7,8 @@ import {
   init_steering_enabled
 } from "./cli-4sydckyj.js";
 import {
-  init_templates4
-} from "./cli-2pnswgh8.js";
-import {
+  registerTemplate,
+  init_registry3,
   resolveTemplateAsync,
   init_resolver,
   init_session_templates
@@ -22,7 +21,7 @@ import {
   buildAgentFsLiveUrl,
   buildCombFileUrl,
   init_constants3
-} from "./cli-611a1294.js";
+} from "./cli-k0wwfqbg.js";
 import {
   scrubSecrets,
   init_secret_scrubber
@@ -254,6 +253,186 @@ what you learned about your strengths. Edit this file directly.
 }
 var init_defaults = () => {};
 
+// src/commands/templates.ts
+var init_templates4 = __esm(() => {
+  init_registry3();
+  registerTemplate({
+    eventType: "task.trigger.assigned",
+    header: "",
+    defaultBody: `{{work_on_task_cmd}} {{task_id}}{{task_desc_section}}{{attachments_section}}{{output_instructions}}`,
+    variables: [
+      { name: "work_on_task_cmd", description: "Formatted /work-on-task command" },
+      { name: "task_id", description: "Task ID" },
+      { name: "task_desc_section", description: "Task description section or empty string" },
+      {
+        name: "attachments_section",
+        description: "Ready-to-run fetch recipe per task attachment (or empty string if none) — lets the agent download an attachment in one call instead of discovering the path/provider itself"
+      },
+      {
+        name: "output_instructions",
+        description: "Output format instructions (with outputSchema if present, or generic store-progress)"
+      }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.trigger.offered",
+    header: "",
+    defaultBody: `{{review_offered_task_cmd}} {{task_id}}{{task_desc_section}}
+
+Accept if you have capacity and skills. Reject with a reason if you cannot handle it.`,
+    variables: [
+      { name: "review_offered_task_cmd", description: "Formatted /review-offered-task command" },
+      { name: "task_id", description: "Task ID" },
+      { name: "task_desc_section", description: "Task description section or empty string" }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.profile_sync_rejection",
+    header: "",
+    defaultBody: `=== PERSISTED PROFILE SYNC REJECTION ===
+A {{timestamp}} sync of {{field_label}} did not reach the database. Disk size: {{disk_size}}; DB size: {{db_size}}; budget: {{budget}}; delta: {{delta}}.
+Audit event: {{event_id}}. {{recovery_guidance}}
+=== END PROFILE SYNC REJECTION ===
+
+`,
+    variables: [
+      { name: "timestamp", description: "UTC timestamp of the rejected sync" },
+      { name: "field_label", description: "Profile field and its harness-specific file path" },
+      { name: "disk_size", description: "Rejected local file size" },
+      { name: "db_size", description: "Stored database field size" },
+      { name: "budget", description: "Configured field budget" },
+      { name: "delta", description: "Signed size delta" },
+      { name: "event_id", description: "Persisted audit event ID" },
+      { name: "recovery_guidance", description: "Accurate field-specific recovery instructions" }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.nudge.empty_final_turn",
+    header: "",
+    defaultBody: `Your last turn returned no text and no tool call. Finish now: if the task needs a result, call store-progress with it.`,
+    variables: [],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.trigger.unread_mentions",
+    header: "",
+    defaultBody: `You have {{mention_count}} mention(s) in chat channels.
+
+1. Use \`read-messages\` with unreadOnly: true to see them
+2. Respond to questions or requests directed at you
+3. If a message requires work, create a task using \`send-task\``,
+    variables: [{ name: "mention_count", description: "Number of unread mentions or 'unread'" }],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.trigger.pool_available",
+    header: "",
+    defaultBody: `{{task_count}} task(s) available in the pool.
+
+1. Run \`get-tasks\` with unassigned: true to browse
+2. Pick one matching your skills
+3. Run \`task-action\` with action: "claim" and taskId: "<id>"
+
+Note: Claims are first-come-first-serve. If claim fails, pick another.`,
+    variables: [{ name: "task_count", description: "Number of available pool tasks" }],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.trigger.channel_activity",
+    header: "",
+    defaultBody: `## Slack Channel Activity
+
+{{message_count}} new message(s) in monitored Slack channels:
+
+{{messages_detail}}
+## Your Task
+
+Review these messages and decide if any require action:
+1. If a message is a question or request, respond using \`slack-reply\` or create a task with \`send-task\`
+2. If a message is informational, no action needed
+3. Use \`slack-read\` with the channelId to get more context if needed`,
+    variables: [
+      { name: "message_count", description: "Number of new messages" },
+      {
+        name: "messages_detail",
+        description: "Formatted list of messages with channel and user info"
+      }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.resumption.with_progress",
+    header: "",
+    defaultBody: `{{work_on_task_cmd}} {{task_id}}
+
+**RESUMED TASK** - This task was interrupted during a deployment and is being resumed.
+
+Task: "{{task_description}}"{{attachments_section}}
+
+Previous Progress:
+{{progress}}
+
+Continue from where you left off. Review the progress above and complete the remaining work.{{completion_instructions}}`,
+    variables: [
+      { name: "work_on_task_cmd", description: "Formatted /work-on-task command" },
+      { name: "task_id", description: "Task ID" },
+      { name: "task_description", description: "Original task description" },
+      { name: "attachments_section", description: "Task attachment fetch recipes" },
+      { name: "progress", description: "Previous progress text" },
+      {
+        name: "completion_instructions",
+        description: "Completion instructions (empty for providers without MCP)"
+      }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.resumption.no_progress",
+    header: "",
+    defaultBody: `{{work_on_task_cmd}} {{task_id}}
+
+**RESUMED TASK** - This task was interrupted during a deployment and is being resumed.
+
+Task: "{{task_description}}"{{attachments_section}}
+
+No progress was saved before the interruption. Start the task fresh but be aware files may have been partially modified.{{completion_instructions}}`,
+    variables: [
+      { name: "work_on_task_cmd", description: "Formatted /work-on-task command" },
+      { name: "task_id", description: "Task ID" },
+      { name: "task_description", description: "Original task description" },
+      { name: "attachments_section", description: "Task attachment fetch recipes" },
+      {
+        name: "completion_instructions",
+        description: "Completion instructions (empty for providers without MCP)"
+      }
+    ],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.output.schema",
+    header: "",
+    defaultBody: `
+
+**Required Output Format**: When completing this task, you MUST call store-progress with output that is valid JSON conforming to this schema:
+\`\`\`json
+{{schema}}
+\`\`\`
+Call store-progress with status "completed" and your JSON output. If your output doesn't match the schema, the tool call will fail and you should fix and retry.`,
+    variables: [{ name: "schema", description: "Required output JSON schema" }],
+    category: "task_lifecycle"
+  });
+  registerTemplate({
+    eventType: "task.output.generic",
+    header: "",
+    defaultBody: '\n\nWhen done, use `store-progress` with status: "completed" and include your output.',
+    variables: [],
+    category: "task_lifecycle"
+  });
+});
+
 // src/prompts/base-prompt.ts
 function claudeMdSourcePath(provider) {
   return provider === "claude" ? "~/.claude/CLAUDE.md" : "/workspace/CLAUDE.md";
@@ -1031,6 +1210,7 @@ var init_context_preamble = __esm(() => {
 });
 
 // src/commands/profile-sync.ts
+import { rename } from "node:fs/promises";
 function contentSha256(content) {
   return new Bun.CryptoHasher("sha256").update(content).digest("hex");
 }
@@ -1154,7 +1334,30 @@ async function prependProfileSyncRejectionBanner(prompt, config, fetchImpl = fet
   return banner ? { prompt: prependContextPreamble(prompt, banner), injected: true } : { prompt, injected: false };
 }
 async function writeIdentityBaselines(baselines) {
-  await Bun.write(IDENTITY_BASELINES_PATH, JSON.stringify(baselines));
+  const write = () => writeFileAtomic(IDENTITY_BASELINES_PATH, JSON.stringify(baselines));
+  const locked = await withFileLock(IDENTITY_BASELINES_LOCK_PATH, write, {
+    waitMs: BASELINES_LOCK_WAIT_MS
+  });
+  if (!locked.acquired)
+    await write();
+}
+function bootIdentityBaselines(profile, setupScriptFile, agentId = "unknown") {
+  const baselines = {};
+  if (profile.soulMd)
+    baselines.soulMd = contentSha256(profile.soulMd);
+  if (profile.identityMd)
+    baselines.identityMd = contentSha256(profile.identityMd);
+  if (profile.toolsMd)
+    baselines.toolsMd = contentSha256(profile.toolsMd);
+  if (typeof profile.heartbeatMd === "string") {
+    baselines.heartbeatMd = contentSha256(profile.heartbeatMd);
+  }
+  if (profile.claudeMd)
+    baselines.claudeMd = contentSha256(profile.claudeMd);
+  const setupContent = setupScriptFile === undefined ? null : extractSetupScriptContent(setupScriptFile, agentId);
+  if (setupContent)
+    baselines.setupScript = contentSha256(setupContent);
+  return baselines;
 }
 async function readIdentityBaselines(readFile = readFileIfExists) {
   try {
@@ -1166,6 +1369,30 @@ async function readIdentityBaselines(readFile = readFileIfExists) {
     return null;
   }
 }
+async function advanceIdentityBaselines(synced, io = PROFILE_FILE_IO) {
+  if (Object.keys(synced).length === 0)
+    return;
+  const update = async () => {
+    const baselines = await readIdentityBaselines(io.readFile) ?? {};
+    for (const [field, content] of Object.entries(synced)) {
+      baselines[field] = contentSha256(content);
+    }
+    await io.writeFile(IDENTITY_BASELINES_PATH, JSON.stringify(baselines));
+  };
+  try {
+    const locked = await withFileLock(io.baselinesLockPath ?? IDENTITY_BASELINES_LOCK_PATH, update, {
+      waitMs: BASELINES_LOCK_WAIT_MS
+    });
+    if (locked.acquired)
+      return;
+    if (locked.reason === "unsupported")
+      return await update();
+    console.warn(`[profile-sync] identity baselines not advanced: lock ${locked.reason}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(scrubSecrets(`[profile-sync] identity baselines not advanced: ${msg}`));
+  }
+}
 function fetchWithSyncTimeout(fetchImpl = fetch) {
   return (input, init) => fetchImpl(input, {
     ...init,
@@ -1326,9 +1553,14 @@ async function readFileIfExists(path) {
     return;
   }
 }
+async function writeFileAtomic(path, content) {
+  const tmp = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  await Bun.write(tmp, content);
+  await rename(tmp, path);
+}
 async function collectProfilePayloads(fields, changeSource, readFile = readFileIfExists, claudeMdPath = CLAUDE_MD_PATH, agentId = "unknown") {
   const payloads = [];
-  const baselines = changeSource === "session_sync" ? await readIdentityBaselines(readFile) : null;
+  const baselines = await readIdentityBaselines(readFile);
   if (fields.includes("identity")) {
     const updates = buildIdentityPayload({
       soulMd: await readFile(SOUL_MD_PATH),
@@ -1355,7 +1587,7 @@ async function collectProfilePayloads(fields, changeSource, readFile = readFileI
     const raw = await readFile(SETUP_SCRIPT_PATH);
     if (raw !== undefined) {
       const content = extractSetupScriptContent(raw, agentId);
-      if (content !== null) {
+      if (content !== null && baselines?.setupScript !== contentSha256(content)) {
         payloads.push({ label: "setup", body: { setupScript: content, changeSource } });
       }
     }
@@ -1381,10 +1613,20 @@ async function postProfileUpdate(opts, payload) {
       } catch {}
       console.warn(scrubSecrets(`[profile-sync] ${payload.label} sync failed: HTTP ${resp.status}${detail ? ` — ${detail}` : ""}`));
     }
+    return resp.ok;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(scrubSecrets(`[profile-sync] ${payload.label} sync errored: ${msg}`));
+    return false;
+  }
+}
+function baselineFieldsOf(payload) {
+  const fields = {};
+  for (const [field, value] of Object.entries(payload.body)) {
+    if (field !== "changeSource" && typeof value === "string")
+      fields[field] = value;
   }
+  return fields;
 }
 async function syncProfileFilesToServer(opts) {
   const changeSource = opts.changeSource ?? "session_sync";
@@ -1392,15 +1634,19 @@ async function syncProfileFilesToServer(opts) {
   const claudeMdPath = opts.claudeMdPath ?? CLAUDE_MD_PATH;
   const claudeUnderLock = fields.includes("claude") && syncsHookOwnedClaudeMd(claudeMdPath, changeSource);
   const unlockedFields = claudeUnderLock ? fields.filter((f) => f !== "claude") : fields;
-  const payloads = await collectProfilePayloads(unlockedFields, changeSource, readFileIfExists, claudeMdPath, opts.agentId);
+  const io = opts.io ?? PROFILE_FILE_IO;
+  const payloads = await collectProfilePayloads(unlockedFields, changeSource, io.readFile, claudeMdPath, opts.agentId);
+  const synced = {};
   for (const payload of payloads) {
-    await postProfileUpdate(opts, payload);
+    if (await postProfileUpdate(opts, payload))
+      Object.assign(synced, baselineFieldsOf(payload));
   }
+  await advanceIdentityBaselines(synced, io);
   if (claudeUnderLock) {
     const { path: lockPath = CLAUDE_MD_LOCK_PATH, waitMs = RUNNER_LOCK_WAIT_MS } = opts.claudeMdLock ?? {};
     const bounded = { ...opts, fetchImpl: fetchWithSyncTimeout(opts.fetchImpl) };
     const locked = await withFileLock(lockPath, async () => {
-      const claude = await collectProfilePayloads(["claude"], changeSource, readFileIfExists, claudeMdPath, opts.agentId);
+      const claude = await collectProfilePayloads(["claude"], changeSource, io.readFile, claudeMdPath, opts.agentId);
       for (const payload of claude)
         await postProfileUpdate(bounded, payload);
     }, { waitMs });
@@ -1410,7 +1656,7 @@ async function syncProfileFilesToServer(opts) {
     }
   }
 }
-var SOUL_MD_PATH = "/workspace/SOUL.md", IDENTITY_MD_PATH = "/workspace/IDENTITY.md", TOOLS_MD_PATH = "/workspace/TOOLS.md", HEARTBEAT_MD_PATH = "/workspace/HEARTBEAT.md", SETUP_SCRIPT_PATH = "/workspace/start-up.sh", IDENTITY_BASELINES_PATH = "/tmp/identity-baselines.json", PROFILE_FIELD_DETAILS, PROFILE_SYNC_REJECTED = "system.profile_sync_rejected", PROFILE_SYNC_RECONCILED = "system.profile_sync_reconciled", CLAUDE_MD_PATH, CLAUDE_MD_LINEAGE_PATH, CLAUDE_MD_LOCK_PATH, CLAUDE_MD_SYNC_TIMEOUT_MS = 1e4, RUNNER_LOCK_WAIT_MS = 15000, SHA256_HEX, WORKSPACE_CLAUDE_MD_PATH = "/workspace/CLAUDE.md", IDENTITY_FILE_MIN_LENGTH = 500, SETUP_MARKER_START = "# === Agent-managed setup (from DB) ===", SETUP_MARKER_END = "# === End agent-managed setup ===";
+var SOUL_MD_PATH = "/workspace/SOUL.md", IDENTITY_MD_PATH = "/workspace/IDENTITY.md", TOOLS_MD_PATH = "/workspace/TOOLS.md", HEARTBEAT_MD_PATH = "/workspace/HEARTBEAT.md", SETUP_SCRIPT_PATH = "/workspace/start-up.sh", IDENTITY_BASELINES_PATH = "/tmp/identity-baselines.json", PROFILE_FIELD_DETAILS, PROFILE_SYNC_REJECTED = "system.profile_sync_rejected", PROFILE_SYNC_RECONCILED = "system.profile_sync_reconciled", IDENTITY_BASELINES_LOCK_PATH, BASELINES_LOCK_WAIT_MS = 5000, PROFILE_FILE_IO, CLAUDE_MD_PATH, CLAUDE_MD_LINEAGE_PATH, CLAUDE_MD_LOCK_PATH, CLAUDE_MD_SYNC_TIMEOUT_MS = 1e4, RUNNER_LOCK_WAIT_MS = 15000, SHA256_HEX, WORKSPACE_CLAUDE_MD_PATH = "/workspace/CLAUDE.md", IDENTITY_FILE_MIN_LENGTH = 500, SETUP_MARKER_START = "# === Agent-managed setup (from DB) ===", SETUP_MARKER_END = "# === End agent-managed setup ===";
 var init_profile_sync = __esm(() => {
   init_resolver();
   init_constants3();
@@ -1437,10 +1683,15 @@ var init_profile_sync = __esm(() => {
       recoveryGuidance: `Inspect and shrink the live ${TOOLS_MD_PATH} first, moving durable tail content into memory. After a worker restart, use ${TOOLS_MD_PATH}.pre-boot-<timestamp>.bak as the fallback copy of the rejected content.`
     }
   };
+  IDENTITY_BASELINES_LOCK_PATH = `${IDENTITY_BASELINES_PATH}.lock`;
+  PROFILE_FILE_IO = {
+    readFile: readFileIfExists,
+    writeFile: writeFileAtomic
+  };
   CLAUDE_MD_PATH = `${process.env.HOME}/.claude/CLAUDE.md`;
   CLAUDE_MD_LINEAGE_PATH = `${CLAUDE_MD_PATH}.lineage.json`;
   CLAUDE_MD_LOCK_PATH = `${CLAUDE_MD_PATH}.lock`;
   SHA256_HEX = /^[0-9a-f]{64}$/;
 });
 
-export { generateDefaultClaudeMd2, generateDefaultSoulMd2, generateDefaultIdentityMd2, generateDefaultToolsMd2, matchesDefaultIdentityMd, matchesDefaultClaudeMd, init_defaults, getBasePrompt, getTaskContextPrompt, init_base_prompt, IDENTITY_FIELD_BUDGETS, checkIdentityFieldBudget, IdentityFieldBudgetError, init_identity_field_budget, withFileLock, init_file_lock, taskAttachmentFetchCommand, taskAttachmentDisplayUrl, init_task_attachment_links, prependContextPreamble, buildContextPreamble, buildResumeContextPreamble, init_context_preamble, contentSha256, prependProfileSyncRejectionBanner, writeIdentityBaselines, readIdentityBaselines, CLAUDE_MD_PATH, CLAUDE_MD_LINEAGE_PATH, CLAUDE_MD_LOCK_PATH, fetchWithSyncTimeout, parseClaudeMdLineage, claudeMdPendingRecord, parseClaudeMdPendingRecord, hookWrittenLineage, effectiveClaudeMdLineage, claudeMdLineageOf, planClaudeMdSync, WORKSPACE_CLAUDE_MD_PATH, warnProfileFileTooLarge, writeProfileFileFromDb, resolveClaudeMdPath, buildIndependentIdentityPayloads, syncProfileFilesToServer, init_profile_sync };
+export { generateDefaultClaudeMd2, generateDefaultSoulMd2, generateDefaultIdentityMd2, generateDefaultToolsMd2, matchesDefaultIdentityMd, matchesDefaultClaudeMd, init_defaults, init_templates4, getBasePrompt, getTaskContextPrompt, init_base_prompt, IDENTITY_FIELD_BUDGETS, checkIdentityFieldBudget, IdentityFieldBudgetError, init_identity_field_budget, withFileLock, init_file_lock, taskAttachmentFetchCommand, taskAttachmentDisplayUrl, init_task_attachment_links, prependContextPreamble, buildContextPreamble, buildResumeContextPreamble, init_context_preamble, contentSha256, prependProfileSyncRejectionBanner, PROFILE_FILE_IO, writeIdentityBaselines, bootIdentityBaselines, readIdentityBaselines, advanceIdentityBaselines, CLAUDE_MD_PATH, CLAUDE_MD_LINEAGE_PATH, CLAUDE_MD_LOCK_PATH, fetchWithSyncTimeout, parseClaudeMdLineage, claudeMdPendingRecord, parseClaudeMdPendingRecord, hookWrittenLineage, effectiveClaudeMdLineage, claudeMdLineageOf, planClaudeMdSync, WORKSPACE_CLAUDE_MD_PATH, warnProfileFileTooLarge, writeProfileFileFromDb, resolveClaudeMdPath, buildIndependentIdentityPayloads, syncProfileFilesToServer, init_profile_sync };