@rudderhq/cli 0.6.1 → 0.6.2-canary.0

package/README.md

@@ -36,8 +36,6 @@ Rudder turns those coordination patterns into product primitives for agent teams
 
 ![Rudder calendar](./doc/assets/readme_imgs/9.png)
 
-![Rudder organization structure](./doc/assets/readme_imgs/10.png)
-
 ![Rudder approvals](./doc/assets/readme_imgs/2.png)
 
 ![Rudder issue proposal](./doc/assets/readme_imgs/3.png)
@@ -52,19 +50,18 @@ Rudder turns those coordination patterns into product primitives for agent teams
 
 - work belongs to an organization, not a loose thread
 - every issue should trace back to a goal
-- agents have roles, runtime config, reporting lines, and skills
+- agents have roles, runtime config, capabilities, and skills
 - chat and issues provide conversational and structured ways to move work forward, with execution attached to inspectable runs, outputs, reviews, and history
 - autonomy stays legible, governable, and budget-aware
 
 ## What Rudder Is
 
-Rudder is open-source software for assigning, running, reviewing, and improving agent work. One Rudder instance can run one or many organizations, each with its own goal, org structure, agents, issues, budgets, approvals, feedback, and governance.
+Rudder is open-source software for assigning, running, reviewing, and improving agent work. One Rudder instance can run one or many organizations, each with its own goal, agents, issues, budgets, approvals, feedback, and governance.
 
 | Human team pattern | Rudder equivalent |
 | --- | --- |
 | Mission | Organization goal |
 | Employees | AI agents |
-| Org chart | Agent reporting structure |
 | Work ownership | Issues and assignments |
 | Team workflow | Workflow definitions and execution paths |
 | Operational memory | Comments, documents, run history, activity, and skills |

package/dist/index.js

@@ -43,7 +43,7 @@ var init_chat_work_manifest = __esm({
 });
 
 // ../packages/shared/dist/constants.js
-var ORGANIZATION_STATUSES, ORGANIZATION_INTELLIGENCE_PROFILE_PURPOSES, ORGANIZATION_INTELLIGENCE_PROFILE_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_RUNTIME_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, AGENT_OREO_ICON_PREFIX, AGENT_OREO_SHAPE_IDS, AGENT_OREO_PALETTE_IDS, AGENT_DICEBEAR_NOTIONISTS_ICON_PREFIX, AGENT_AVATAR_BACKGROUND_PRESET_IDS, ISSUE_STATUSES, ISSUE_PRIORITIES, AGENT_INTEGRATION_PROVIDERS, AGENT_INTEGRATION_STATUSES, AGENT_INTEGRATION_TRANSPORTS, AGENT_INTEGRATION_PROVIDER_REGIONS, AGENT_INTEGRATION_CHAT_TYPES, AGENT_INTEGRATION_DROP_REASONS, AGENT_INTEGRATION_OUTBOUND_STATUSES, RUDDER_AGENT_V1_MCP_TOOL_NAMES, RUDDER_BROWSER_MCP_TOOL_NAMES2, RUDDER_CORE_MCP_TOOL_NAMES2, CUSTOM_INTEGRATION_KINDS, CUSTOM_INTEGRATION_SCOPES, CUSTOM_INTEGRATION_STATUSES, CUSTOM_INTEGRATION_TOOL_STATUSES, CUSTOM_INTEGRATION_BINDING_STATUSES, CUSTOM_INTEGRATION_TOOL_CALL_STATUSES, MCP_CONNECTION_PROVIDERS, MCP_CONNECTION_TRANSPORTS, MCP_CONNECTION_ACCESS_MODES, MCP_CONNECTION_STATUSES, MCP_OAUTH_GRANT_STATUSES, MCP_AGENT_BINDING_STATUSES, MCP_OAUTH_SESSION_TTL_MS, MCP_PROVIDER_CATALOG, CALENDAR_SOURCE_TYPES, CALENDAR_OWNER_TYPES, CALENDAR_VISIBILITIES, CALENDAR_SOURCE_STATUSES, CALENDAR_EVENT_KINDS, CALENDAR_EVENT_STATUSES, CALENDAR_SOURCE_MODES, CHAT_CONVERSATION_STATUSES, CHAT_ISSUE_CREATION_MODES, CHAT_MESSAGE_ROLES, CHAT_MESSAGE_KINDS, CHAT_MESSAGE_STATUSES, CHAT_CONTEXT_ENTITY_TYPES, GOAL_LEVELS, GOAL_STATUSES, PROJECT_STATUSES, ORGANIZATION_RESOURCE_KINDS, ORGANIZATION_RESOURCE_SOURCE_TYPES, PROJECT_RESOURCE_ATTACHMENT_ROLES, AUTOMATION_STATUSES, AUTOMATION_CONCURRENCY_POLICIES, AUTOMATION_CATCH_UP_POLICIES, AUTOMATION_OUTPUT_MODES, AUTOMATION_TRIGGER_SIGNING_MODES, PROJECT_COLORS, PROJECT_ICONS, APPROVAL_TYPES, SECRET_PROVIDERS, STORAGE_PROVIDERS, BILLING_TYPES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS, PLUGIN_STATUSES, PLUGIN_CATEGORIES, PLUGIN_CAPABILITIES, PLUGIN_UI_SLOT_TYPES, PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS, PLUGIN_LAUNCHER_PLACEMENT_ZONES, PLUGIN_LAUNCHER_ACTIONS, PLUGIN_LAUNCHER_BOUNDS, PLUGIN_LAUNCHER_RENDER_ENVIRONMENTS, PLUGIN_UI_SLOT_ENTITY_TYPES, PLUGIN_STATE_SCOPE_KINDS;
+var ORGANIZATION_STATUSES, ORGANIZATION_INTELLIGENCE_PROFILE_PURPOSES, ORGANIZATION_INTELLIGENCE_PROFILE_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_RUNTIME_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, AGENT_OREO_ICON_PREFIX, AGENT_OREO_SHAPE_IDS, AGENT_OREO_PALETTE_IDS, AGENT_DICEBEAR_NOTIONISTS_ICON_PREFIX, AGENT_AVATAR_BACKGROUND_PRESET_IDS, ISSUE_STATUSES, ISSUE_PRIORITIES, AGENT_INTEGRATION_PROVIDERS, AGENT_INTEGRATION_STATUSES, AGENT_INTEGRATION_TRANSPORTS, AGENT_INTEGRATION_PROVIDER_REGIONS, AGENT_INTEGRATION_CHAT_TYPES, AGENT_INTEGRATION_DROP_REASONS, AGENT_INTEGRATION_OUTBOUND_STATUSES, RUDDER_AGENT_V1_MCP_TOOL_NAMES, RUDDER_BROWSER_MCP_TOOL_NAMES2, RUDDER_CORE_MCP_TOOL_NAMES2, CUSTOM_INTEGRATION_KINDS, CUSTOM_INTEGRATION_SCOPES, CUSTOM_INTEGRATION_STATUSES, CUSTOM_INTEGRATION_TOOL_STATUSES, CUSTOM_INTEGRATION_BINDING_STATUSES, CUSTOM_INTEGRATION_TOOL_CALL_STATUSES, MCP_CONNECTION_PROVIDERS, MCP_CONNECTION_TRANSPORTS, MCP_CONNECTION_ACCESS_MODES, MCP_AGENT_ACCESS_MODES, MCP_CONNECTION_CANONICAL_STATES, MCP_PROVIDER_SCOPE_MODES, MCP_PROVIDER_ORGANIZATION_STATES, MCP_TOOL_CAPABILITY_CLASSES, MCP_CONNECTION_STATUSES, MCP_OAUTH_GRANT_STATUSES, MCP_AGENT_BINDING_STATUSES, MCP_OAUTH_SESSION_TTL_MS, MCP_PROVIDER_CATALOG, CALENDAR_SOURCE_TYPES, CALENDAR_OWNER_TYPES, CALENDAR_VISIBILITIES, CALENDAR_SOURCE_STATUSES, CALENDAR_EVENT_KINDS, CALENDAR_EVENT_STATUSES, CALENDAR_SOURCE_MODES, CHAT_CONVERSATION_STATUSES, CHAT_ISSUE_CREATION_MODES, CHAT_MESSAGE_ROLES, CHAT_MESSAGE_KINDS, CHAT_MESSAGE_STATUSES, CHAT_CONTEXT_ENTITY_TYPES, GOAL_LEVELS, GOAL_STATUSES, PROJECT_STATUSES, ORGANIZATION_RESOURCE_KINDS, ORGANIZATION_RESOURCE_SOURCE_TYPES, PROJECT_RESOURCE_ATTACHMENT_ROLES, AUTOMATION_STATUSES, AUTOMATION_CONCURRENCY_POLICIES, AUTOMATION_CATCH_UP_POLICIES, AUTOMATION_OUTPUT_MODES, AUTOMATION_TRIGGER_SIGNING_MODES, PROJECT_COLORS, PROJECT_ICONS, APPROVAL_TYPES, SECRET_PROVIDERS, STORAGE_PROVIDERS, BILLING_TYPES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS, PLUGIN_STATUSES, PLUGIN_CATEGORIES, PLUGIN_CAPABILITIES, PLUGIN_UI_SLOT_TYPES, PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS, PLUGIN_LAUNCHER_PLACEMENT_ZONES, PLUGIN_LAUNCHER_ACTIONS, PLUGIN_LAUNCHER_BOUNDS, PLUGIN_LAUNCHER_RENDER_ENVIRONMENTS, PLUGIN_UI_SLOT_ENTITY_TYPES, PLUGIN_STATE_SCOPE_KINDS;
 var init_constants = __esm({
   "../packages/shared/dist/constants.js"() {
     "use strict";
@@ -323,6 +323,29 @@ var init_constants = __esm({
     MCP_CONNECTION_PROVIDERS = ["supabase", "linear", "notion", "custom"];
     MCP_CONNECTION_TRANSPORTS = ["stdio", "streamable_http", "legacy_manual"];
     MCP_CONNECTION_ACCESS_MODES = ["provider_default", "read_only", "read_write"];
+    MCP_AGENT_ACCESS_MODES = [
+      "none",
+      "read_only",
+      "read_write",
+      "provider_granted",
+      "full"
+    ];
+    MCP_CONNECTION_CANONICAL_STATES = ["canonical", "superseded"];
+    MCP_PROVIDER_SCOPE_MODES = ["account", "workspace", "legacy_project"];
+    MCP_PROVIDER_ORGANIZATION_STATES = [
+      "not_connected",
+      "connecting",
+      "connected",
+      "needs_attention",
+      "disconnected"
+    ];
+    MCP_TOOL_CAPABILITY_CLASSES = [
+      "read",
+      "normal_write",
+      "destructive",
+      "admin_or_billing",
+      "unknown"
+    ];
     MCP_CONNECTION_STATUSES = [
       "draft",
       "authorizing",
@@ -997,7 +1020,7 @@ function validateConnectionSecretMutation(value, ctx) {
     }
   }
 }
-var uuidSchema, timestampSchema, connectionNameSchema, reservedMcpConnectionNames, environmentNameSchema, externalMcpToolNameSchema, externalMcpToolFilterSchema, mcpConnectionProviderSchema, mcpConnectionTransportSchema, mcpConnectionAccessModeSchema, mcpConnectionStatusSchema, mcpOAuthGrantStatusSchema, mcpAgentBindingStatusSchema, stringMapSchema, environmentValueMapSchema, safeHeaderSchema, mcpStdioSafeConfigSchema, mcpStreamableHttpSafeConfigSchema, mcpConnectionSecretsMutationSchema, mcpLegacyManualSafeConfigSchema, mcpCuratedSafeConfigSchema, mcpConnectionSafeConfigSchema, mcpConnectionInputFields, providerAccessModes, createMcpConnectionSchema, updateMcpConnectionSchema, mcpConnectionMergedConfigFields, mcpConnectionMergedConfigSchema, mcpConnectionMutationConfigSchema, mcpConnectionSummarySchema, mcpProviderCatalogEntrySchema, mcpProviderCatalogSchema, mcpOAuthStartSchema, mcpOAuthStartResponseSchema, mcpOAuthCallbackSchema, mcpScopeSelectionSchema, mcpExternalScopeOptionSchema, mcpOAuthGrantSummarySchema, mcpDiscoveredToolSchema, mcpAgentBindingSchema, mcpAgentConnectionSummarySchema, upsertMcpAgentBindingSchema, updateMcpAgentBindingSchema, managedExternalMcpBindingSchema, managedExternalMcpBindingsSchema;
+var uuidSchema, timestampSchema, connectionNameSchema, reservedMcpConnectionNames, environmentNameSchema, externalMcpToolNameSchema, externalMcpToolFilterSchema, mcpConnectionProviderSchema, mcpConnectionTransportSchema, mcpConnectionAccessModeSchema, mcpAgentAccessModeSchema, mcpConnectionCanonicalStateSchema, mcpProviderScopeModeSchema, mcpProviderOrganizationStateSchema, mcpToolCapabilityClassSchema, mcpProviderMaxAccessSchema, mcpConnectionStatusSchema, mcpOAuthGrantStatusSchema, mcpAgentBindingStatusSchema, stringMapSchema, environmentValueMapSchema, safeHeaderSchema, mcpStdioSafeConfigSchema, mcpStreamableHttpSafeConfigSchema, mcpConnectionSecretsMutationSchema, mcpLegacyManualSafeConfigSchema, mcpCuratedSafeConfigSchema, mcpConnectionSafeConfigSchema, mcpConnectionInputFields, providerAccessModes, createMcpConnectionSchema, updateMcpConnectionSchema, mcpConnectionMergedConfigFields, mcpConnectionMergedConfigSchema, mcpConnectionMutationConfigSchema, mcpConnectionSummarySchema, mcpProviderCatalogEntrySchema, mcpProviderCatalogSchema, mcpOAuthStartSchema, mcpOAuthStartResponseSchema, mcpOAuthCallbackSchema, mcpScopeSelectionSchema, mcpExternalScopeOptionSchema, mcpOAuthGrantSummarySchema, mcpDiscoveredToolSchema, mcpAgentBindingSchema, mcpAgentConnectionSummarySchema, upsertMcpAgentBindingSchema, updateMcpAgentBindingSchema, managedExternalMcpBindingSchema, managedExternalMcpBindingsSchema, mcpProviderAvailabilitySchema;
 var init_mcp = __esm({
   "../packages/shared/dist/validators/mcp.js"() {
     "use strict";
@@ -1012,6 +1035,12 @@ var init_mcp = __esm({
     mcpConnectionProviderSchema = z2.enum(MCP_CONNECTION_PROVIDERS);
     mcpConnectionTransportSchema = z2.enum(MCP_CONNECTION_TRANSPORTS);
     mcpConnectionAccessModeSchema = z2.enum(MCP_CONNECTION_ACCESS_MODES);
+    mcpAgentAccessModeSchema = z2.enum(MCP_AGENT_ACCESS_MODES);
+    mcpConnectionCanonicalStateSchema = z2.enum(MCP_CONNECTION_CANONICAL_STATES);
+    mcpProviderScopeModeSchema = z2.enum(MCP_PROVIDER_SCOPE_MODES);
+    mcpProviderOrganizationStateSchema = z2.enum(MCP_PROVIDER_ORGANIZATION_STATES);
+    mcpToolCapabilityClassSchema = z2.enum(MCP_TOOL_CAPABILITY_CLASSES);
+    mcpProviderMaxAccessSchema = z2.enum(["read_only", "read_write", "provider_granted"]);
     mcpConnectionStatusSchema = z2.enum(MCP_CONNECTION_STATUSES);
     mcpOAuthGrantStatusSchema = z2.enum(MCP_OAUTH_GRANT_STATUSES);
     mcpAgentBindingStatusSchema = z2.enum(MCP_AGENT_BINDING_STATUSES);
@@ -1270,6 +1299,9 @@ var init_mcp = __esm({
       description: z2.string().max(4e3).nullable(),
       inputSchema: z2.record(z2.unknown()),
       outputSchema: z2.record(z2.unknown()).nullable(),
+      capabilityClass: mcpToolCapabilityClassSchema,
+      policyRevision: z2.number().int().positive(),
+      catalogRevision: z2.number().int().positive(),
       enabled: z2.boolean(),
       removedAt: timestampSchema.nullable()
     }).strict();
@@ -1278,19 +1310,26 @@ var init_mcp = __esm({
       connectionId: uuidSchema,
       agentId: uuidSchema,
       status: mcpAgentBindingStatusSchema,
+      accessMode: mcpAgentAccessModeSchema,
+      policyRevision: z2.number().int().positive(),
       enabledToolIds: z2.array(uuidSchema).max(500)
     }).strict();
     mcpAgentConnectionSummarySchema = z2.object({
       connection: mcpConnectionSummarySchema,
       binding: mcpAgentBindingSchema.nullable(),
-      tools: z2.array(mcpDiscoveredToolSchema).max(500)
+      tools: z2.array(mcpDiscoveredToolSchema).max(500),
+      reviewRequired: z2.boolean()
     }).strict();
     upsertMcpAgentBindingSchema = z2.object({
       status: mcpAgentBindingStatusSchema.optional(),
+      accessMode: mcpAgentAccessModeSchema.optional(),
+      expectedRevision: z2.number().int().positive().optional(),
       enabledToolIds: z2.array(uuidSchema).max(500).optional()
     }).strict();
     updateMcpAgentBindingSchema = z2.object({
       status: mcpAgentBindingStatusSchema.optional(),
+      accessMode: mcpAgentAccessModeSchema.optional(),
+      expectedRevision: z2.number().int().positive().optional(),
       enabledToolIds: z2.array(uuidSchema).max(500).optional()
     }).strict().refine((value) => Object.keys(value).length > 0, {
       message: "At least one binding field is required"
@@ -1298,6 +1337,7 @@ var init_mcp = __esm({
     managedExternalMcpBindingSchema = z2.object({
       bindingId: uuidSchema,
       serverName: connectionNameSchema,
+      accessMode: mcpAgentAccessModeSchema,
       toolPolicy: z2.object({
         mode: z2.literal("allowlist"),
         allowedToolNames: z2.array(z2.string().min(1).max(320)).max(500)
@@ -1307,6 +1347,66 @@ var init_mcp = __esm({
       toolTimeoutMs: z2.number().int().positive()
     }).strict();
     managedExternalMcpBindingsSchema = z2.array(managedExternalMcpBindingSchema).max(100);
+    mcpProviderAvailabilitySchema = z2.object({
+      provider: z2.enum(["supabase", "linear", "notion"]),
+      organization: z2.object({
+        state: mcpProviderOrganizationStateSchema,
+        connectionId: uuidSchema.nullable(),
+        maxAccess: mcpProviderMaxAccessSchema.nullable(),
+        scopeMode: mcpProviderScopeModeSchema.nullable(),
+        revision: z2.number().int().positive().nullable(),
+        affectedAgentCount: z2.number().int().nonnegative().optional(),
+        historicalGrantConnectionIds: z2.array(uuidSchema).max(100).optional()
+      }).strict(),
+      agent: z2.object({
+        access: mcpAgentAccessModeSchema,
+        activeRunUsesOlderPolicy: z2.boolean()
+      }).strict().optional()
+    }).strict().superRefine((value, ctx) => {
+      const connectedState = value.organization.state === "connected";
+      if (connectedState && (value.organization.connectionId === null || value.organization.maxAccess === null || value.organization.scopeMode === null || value.organization.revision === null)) {
+        ctx.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: ["organization"],
+          message: "Connected providers require a connection, access, scope, and revision"
+        });
+      }
+      const maxAccess = value.organization.maxAccess;
+      if (value.provider === "notion" && maxAccess !== null && maxAccess !== "provider_granted") {
+        ctx.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: ["organization", "maxAccess"],
+          message: "Notion exposes provider-granted access"
+        });
+      }
+      if (value.provider !== "notion" && maxAccess !== null && maxAccess === "provider_granted") {
+        ctx.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: ["organization", "maxAccess"],
+          message: `${value.provider} requires explicit read-only or read-write access`
+        });
+      }
+      const scopeMode = value.organization.scopeMode;
+      const validScope = scopeMode === null || (value.provider === "supabase" ? scopeMode === "account" || scopeMode === "legacy_project" : scopeMode === "workspace");
+      if (!validScope) {
+        ctx.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: ["organization", "scopeMode"],
+          message: `${value.provider} does not support ${scopeMode}`
+        });
+      }
+      const agentAccess = value.agent?.access;
+      if (agentAccess !== void 0) {
+        const validAgentAccess = agentAccess === "none" || (value.provider === "notion" ? agentAccess === "provider_granted" : agentAccess === "read_only" || agentAccess === "read_write" && value.organization.maxAccess === "read_write");
+        if (!validAgentAccess) {
+          ctx.addIssue({
+            code: z2.ZodIssueCode.custom,
+            path: ["agent", "access"],
+            message: `${value.provider} agent access exceeds or conflicts with organization access`
+          });
+        }
+      }
+    });
   }
 });
 
@@ -1423,7 +1523,7 @@ function createChatInlineAnnotationsSchema(annotationSchema) {
     }
   });
 }
-var chatConversationStatusSchema, chatIssueCreationModeSchema, chatMessageRoleSchema, chatMessageKindSchema, chatMessageStatusSchema, chatContextEntityTypeSchema, chatGenerationStatusSchema, chatGenerationControlStateSchema, chatQueueDeliveryIntentSchema, chatControlDispositionSchema, chatProviderControlDispositionSchema, chatControlActionKindSchema, chatGenerationEventKindSchema, chatTerminalOutboxStatusSchema, chatQueuedMessageStatusSchema, chatControlActionIdSchema, chatBodyHashSchema, MAX_CHAT_INLINE_ANNOTATIONS, MAX_CHAT_INLINE_ANNOTATION_SELECTED_TEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_COMMENT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_TOTAL_TEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_CONTEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_ATTACHMENTS, chatInlineAnnotationCommentSchema, chatInlineAnnotationSelectedTextSchema, chatInlineAnnotationSourceHashSchema, chatInlineAnnotationShape, chatAssistantInlineAnnotationSchema, chatProcessInlineAnnotationSchema, chatInlineAnnotationSchema, chatAssistantInlineAnnotationInputSchema, chatProcessInlineAnnotationInputSchema, chatInlineAnnotationInputSchema, chatInlineAnnotationsSchema, chatInlineAnnotationsInputSchema, createChatContextLinkSchema, chatDraftSchema, createChatConversationSchema, createChatFirstTurnSchema, setChatProjectContextSchema, updateChatConversationSchema, forkChatConversationSchema, createSideChatSchema, addChatMessageSchema, chatQueuedMessagePayloadSchema, createChatQueuedMessageSchema, chatQueuedMessageUpdatePayloadSchema, updateChatQueuedMessageSchema, cancelChatQueuedMessageSchema, steerChatQueuedMessageSchema, stopChatGenerationSchema, chatClientCheckpointSchema, appendChatGenerationEventSchema, chatRichReferenceDisplaySchema, chatIssueIdentifierSchema, chatAskUserIdentifierSchema, chatAskUserOptionSchema, chatAskUserQuestionSchema, chatAskUserRequestSchema, chatIssueRichReferenceSchema, chatIssueCommentRichReferenceSchema, chatRichReferenceSchema, chatRichReferencesSchema, chatAutomationCreateSchema, createChatAttachmentMetadataSchema, chatIssueProposalSchema, convertChatToIssueSchema, chatOperationProposalSchema, resolveChatOperationProposalSchema, updateChatConversationUserStateSchema, updateMessengerThreadUserStateSchema, createMessengerCustomGroupSchema, messengerItemKeySchema, messengerItemKeysSchema, createMessengerCustomGroupWithEntriesSchema, updateMessengerCustomGroupSchema, reorderMessengerCustomGroupsSchema, assignMessengerCustomGroupEntrySchema, reorderMessengerCustomGroupEntriesSchema;
+var chatConversationStatusSchema, chatIssueCreationModeSchema, chatMessageRoleSchema, chatMessageKindSchema, chatMessageStatusSchema, chatContextEntityTypeSchema, chatGenerationStatusSchema, chatGenerationControlStateSchema, chatQueueDeliveryIntentSchema, chatControlDispositionSchema, chatProviderControlDispositionSchema, chatControlActionKindSchema, chatGenerationEventKindSchema, chatTerminalOutboxStatusSchema, chatQueuedMessageStatusSchema, chatControlActionIdSchema, chatBodyHashSchema, MAX_CHAT_INLINE_ANNOTATIONS, MAX_CHAT_INLINE_ANNOTATION_SELECTED_TEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_COMMENT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_TOTAL_TEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_CONTEXT_LENGTH, MAX_CHAT_INLINE_ANNOTATION_ATTACHMENTS, chatInlineAnnotationCommentSchema, chatInlineAnnotationSelectedTextSchema, chatInlineAnnotationSourceHashSchema, chatInlineAnnotationShape, chatAssistantInlineAnnotationSchema, chatProcessInlineAnnotationSchema, chatInlineAnnotationSchema, chatAssistantInlineAnnotationInputSchema, chatProcessInlineAnnotationInputSchema, chatInlineAnnotationInputSchema, chatInlineAnnotationsSchema, chatInlineAnnotationsInputSchema, createChatContextLinkSchema, chatModelOverrideSchema, chatEffortOverrideSchema, chatDraftSchema, createChatConversationSchema, createChatFirstTurnSchema, setChatProjectContextSchema, updateChatConversationSchema, forkChatConversationSchema, createSideChatSchema, addChatMessageSchema, chatQueuedMessagePayloadSchema, createChatQueuedMessageSchema, chatQueuedMessageUpdatePayloadSchema, updateChatQueuedMessageSchema, cancelChatQueuedMessageSchema, steerChatQueuedMessageSchema, stopChatGenerationSchema, chatClientCheckpointSchema, appendChatGenerationEventSchema, chatRichReferenceDisplaySchema, chatIssueIdentifierSchema, chatAskUserIdentifierSchema, chatAskUserOptionSchema, chatAskUserQuestionSchema, chatAskUserRequestSchema, chatIssueRichReferenceSchema, chatIssueCommentRichReferenceSchema, chatRichReferenceSchema, chatRichReferencesSchema, chatAutomationCreateSchema, createChatAttachmentMetadataSchema, chatIssueProposalSchema, convertChatToIssueSchema, chatOperationProposalSchema, resolveChatOperationProposalSchema, updateChatConversationUserStateSchema, updateMessengerThreadUserStateSchema, createMessengerCustomGroupSchema, messengerItemKeySchema, messengerItemKeysSchema, createMessengerCustomGroupWithEntriesSchema, updateMessengerCustomGroupSchema, reorderMessengerCustomGroupsSchema, assignMessengerCustomGroupEntrySchema, reorderMessengerCustomGroupEntriesSchema;
 var init_chat = __esm({
   "../packages/shared/dist/validators/chat.js"() {
     "use strict";
@@ -1589,10 +1689,14 @@ var init_chat = __esm({
       entityId: z3.string().min(1),
       metadata: z3.record(z3.unknown()).optional().nullable()
     });
+    chatModelOverrideSchema = z3.string().trim().min(1).max(120).nullable();
+    chatEffortOverrideSchema = z3.string().trim().min(1).max(120).nullable();
     chatDraftSchema = z3.object({
       title: z3.string().trim().min(1).max(200).optional(),
       summary: z3.string().trim().max(5e3).optional().nullable(),
       preferredAgentId: z3.string().uuid().optional().nullable(),
+      modelOverride: chatModelOverrideSchema.optional(),
+      effortOverride: chatEffortOverrideSchema.optional(),
       issueCreationMode: chatIssueCreationModeSchema.optional(),
       planMode: z3.boolean().optional(),
       contextLinks: z3.array(createChatContextLinkSchema).optional().default([])
@@ -1620,7 +1724,10 @@ var init_chat = __esm({
     });
     createSideChatSchema = z3.object({
       sourceMessageId: z3.string().uuid(),
-      clientMutationId: z3.string().trim().min(1).max(120)
+      clientMutationId: z3.string().trim().min(1).max(120),
+      preferredAgentId: z3.string().uuid().optional(),
+      modelOverride: chatModelOverrideSchema.optional(),
+      effortOverride: chatEffortOverrideSchema.optional()
     });
     addChatMessageSchema = z3.object({
       body: z3.string().trim().max(2e4).default(""),
@@ -1643,6 +1750,7 @@ var init_chat = __esm({
       projectId: z3.string().uuid().optional().nullable(),
       skillRefs: z3.array(z3.string().trim().min(1).max(240)).optional().default([]),
       accessMode: z3.string().trim().min(1).max(120).optional().nullable(),
+      agentId: z3.string().uuid().optional().nullable(),
       model: z3.string().trim().min(1).max(120).optional().nullable(),
       effort: z3.string().trim().min(1).max(120).optional().nullable(),
       metadata: z3.record(z3.unknown()).optional().nullable()
@@ -1667,6 +1775,7 @@ var init_chat = __esm({
       projectId: z3.string().uuid().optional().nullable(),
       skillRefs: z3.array(z3.string().trim().min(1).max(240)).optional().default([]),
       accessMode: z3.string().trim().min(1).max(120).optional().nullable(),
+      agentId: z3.string().uuid().optional().nullable(),
       model: z3.string().trim().min(1).max(120).optional().nullable(),
       effort: z3.string().trim().min(1).max(120).optional().nullable(),
       metadata: z3.record(z3.unknown()).optional().nullable()
@@ -2552,7 +2661,7 @@ var init_organization_portability = __esm({
       title: z12.string().nullable(),
       icon: z12.string().nullable(),
       capabilities: z12.string().nullable(),
-      reportsToSlug: z12.string().min(1).nullable(),
+      reportsToSlug: z12.string().min(1).nullable().optional().default(null),
       agentRuntimeType: z12.string().min(1),
       agentRuntimeConfig: z12.record(z12.unknown()),
       runtimeConfig: z12.record(z12.unknown()),
@@ -3024,7 +3133,6 @@ var init_agent = __esm({
       role: z15.enum(AGENT_ROLES).optional().default("general"),
       title: z15.string().optional().nullable(),
       icon: agentIconSchema.optional(),
-      reportsTo: z15.string().uuid().optional().nullable(),
       capabilities: z15.string().optional().nullable(),
       desiredSkills: z15.array(z15.string().min(1)).optional(),
       agentRuntimeType: z15.enum(AGENT_RUNTIME_TYPES).optional().default("process"),
@@ -4974,7 +5082,7 @@ var init_env = __esm({
 // src/runtime/postgres-payload.ts
 import { cp, mkdir, stat } from "node:fs/promises";
 import path6 from "node:path";
-async function copyRuntimePostgresPayloadLibraries(sourceRuntimeDir, targetRuntimeDir) {
+async function copyRuntimePostgresPayload(sourceRuntimeDir, targetRuntimeDir, sourceShareDir = path6.join(sourceRuntimeDir, "share")) {
   await mkdir(targetRuntimeDir, { recursive: true });
   for (const directoryName of ["bin", "lib"]) {
     const sourceDirectory = path6.join(sourceRuntimeDir, directoryName);
@@ -4985,6 +5093,11 @@ async function copyRuntimePostgresPayloadLibraries(sourceRuntimeDir, targetRunti
       { recursive: true, dereference: true }
     );
   }
+  await cp(
+    sourceShareDir,
+    path6.join(targetRuntimeDir, "share"),
+    { recursive: true, dereference: true }
+  );
 }
 var init_postgres_payload = __esm({
   "src/runtime/postgres-payload.ts"() {
@@ -4994,7 +5107,7 @@ var init_postgres_payload = __esm({
 
 // src/runtime/install.ts
 import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
-import { copyFile, cp as cp2, mkdir as mkdir2, mkdtemp, readFile, readdir, realpath, rename, rm, stat as stat2, symlink, writeFile } from "node:fs/promises";
+import { copyFile, mkdir as mkdir2, mkdtemp, readFile, readdir, realpath, rename, rm, stat as stat2, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import path7 from "node:path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
@@ -5513,6 +5626,10 @@ async function resolveRuntimePostgresTemplateDir(binDir) {
     return null;
   }
 }
+function resolveRuntimePostgresShareDir(binDir, templateDir) {
+  const adjacentShareDir = path7.resolve(binDir, "..", "share");
+  return pathIsInside(templateDir, adjacentShareDir) ? adjacentShareDir : templateDir;
+}
 async function assertRuntimePostgresBinDirComplete(cacheDir, binDir) {
   const requiredBinaries = ["initdb", "pg_ctl", "postgres"];
   const missing = [];
@@ -5533,10 +5650,17 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir) {
     } catch {
       missing.push(path7.join(templateDir, "postgresql.conf.sample"));
     }
+    const shareDir = resolveRuntimePostgresShareDir(binDir, templateDir);
+    try {
+      const timezoneStats = await stat2(path7.join(shareDir, "timezone"));
+      if (!timezoneStats.isDirectory()) missing.push(path7.join(shareDir, "timezone"));
+    } catch {
+      missing.push(path7.join(shareDir, "timezone"));
+    }
   }
   if (missing.length > 0) {
     throw new RuntimeInstallError(
-      `${RUDDER_POSTGRES_BIN_DIR_ENV} must contain PostgreSQL 18.4 initdb, pg_ctl, postgres binaries, and initdb template files; missing ${missing.join(", ")}`,
+      `${RUDDER_POSTGRES_BIN_DIR_ENV} must contain PostgreSQL 18.4 initdb, pg_ctl, postgres binaries, initdb templates, and runtime support files; missing ${missing.join(", ")}`,
       { cacheDir, command: "validate PostgreSQL 18.4 runtime payload", output: "" }
     );
   }
@@ -5825,12 +5949,12 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
     await rm(previousPlatformRoot, { recursive: true, force: true });
     try {
       const temporaryRuntimeDir = temporaryPlatformRoot;
-      await copyRuntimePostgresPayloadLibraries(sourceRuntimeDir, temporaryRuntimeDir);
-      const temporaryShareDir = path7.join(temporaryRuntimeDir, "share");
-      const temporaryTemplateDir = path7.join(temporaryShareDir, "postgresql");
-      await rm(temporaryShareDir, { recursive: true, force: true });
-      await mkdir2(path7.dirname(temporaryTemplateDir), { recursive: true });
-      await cp2(sourceTemplateDir, temporaryTemplateDir, { recursive: true });
+      const sourceShareDir = resolveRuntimePostgresShareDir(sourceBinDir, sourceTemplateDir);
+      await copyRuntimePostgresPayload(
+        sourceRuntimeDir,
+        temporaryRuntimeDir,
+        sourceShareDir
+      );
       const temporaryBinDir = path7.join(temporaryRuntimeDir, "bin");
       await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe);
       try {
@@ -8702,7 +8826,7 @@ var RUDDER_MCP_TOOL_DESCRIPTORS = [
   {
     "capabilityId": "agent.me",
     "name": "rudder_agent_me",
-    "description": "Show the authenticated agent identity, budget, and chain of command.",
+    "description": "Show the authenticated agent identity and budget.",
     "mutating": false,
     "requiresOrgId": false,
     "requiresAgentId": false,
@@ -9870,7 +9994,6 @@ function rudderMcpInputSchemaForCapability(id) {
     slug: "Slug.",
     markdown: "Direct Markdown content.",
     role: "Agent role.",
-    reportsTo: "Manager or reporting agent reference.",
     capabilities: "Agent capability summary.",
     wakeCommentId: "Issue comment id that triggered the wake.",
     expectedStatuses: "Comma-separated checkout precondition statuses.",
@@ -10030,7 +10153,7 @@ var AGENT_CLI_CAPABILITIES = [
     id: "agent.me",
     command: "rudder agent me",
     category: "agent",
-    description: "Show the authenticated agent identity, budget, and chain of command.",
+    description: "Show the authenticated agent identity and budget.",
     mutating: false,
     contract: "agent-v1",
     requiresOrgId: false,
@@ -11874,6 +11997,7 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
   const capabilityId = toolNameToCapabilityId(toolName);
   if (!capabilityId) return null;
   const input = isRecord2(rawArgs) ? rawArgs : {};
+  if (hasLocalImageInputs(input.images)) return null;
   const api = mcpApiClient(env, signal);
   const success = (data) => mcpSuccess(
     data,
@@ -11991,6 +12115,9 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
       return null;
   }
 }
+function hasLocalImageInputs(value) {
+  return Array.isArray(value) && value.some((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
 function mcpApiClient(env, signal) {
   const apiBase = optionalString(env.RUDDER_API_URL);
   if (!apiBase) {
@@ -12078,10 +12205,8 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
       pushOptional(args, "--role", input.role);
       pushOptional(args, "--title", input.title);
       pushOptional(args, "--capabilities", input.capabilities ?? input.description);
-      pushOptional(args, "--reports-to", input.reportsTo);
       pushBoolean(args, "--clear-title", input.clearTitle);
       pushBoolean(args, "--clear-capabilities", input.clearCapabilities ?? input.clearDescription);
-      pushBoolean(args, "--clear-reports-to", input.clearReportsTo);
       return args;
     }
     case "agent.skills.create": {
@@ -13974,7 +14099,6 @@ function registerAgentCommands(program) {
               name: row.name,
               role: row.role,
               status: row.status,
-              reportsTo: row.reportsTo,
               budgetMonthlyCents: row.budgetMonthlyCents,
               spentMonthlyCents: row.spentMonthlyCents
             })
@@ -14031,7 +14155,6 @@ function registerAgentCommands(program) {
               role: row.role,
               status: row.status,
               agentRuntimeType: row.agentRuntimeType,
-              reportsTo: row.reportsTo,
               updatedAt: row.updatedAt
             })
           );
@@ -14196,7 +14319,7 @@ function registerAgentCommands(program) {
     })
   );
   addCommonClientOptions(
-    agent.command("update").description(getAgentCliCapabilityById("agent.update").description).argument("[agentId]", "Agent ID or shortname/url-key; defaults to RUDDER_AGENT_ID").option("-O, --org-id <id>", "Organization ID").option("--name <name>", "Agent display name").option("--role <role>", "Agent organization role").option("--title <title>", "Agent title shown in mentions and agent labels").option("--clear-title", "Clear the agent title").option("--capabilities <text>", "Agent capabilities/description text").option("--capabilities-file <path>", "Read agent capabilities/description from a local file").option("--description <text>", "Alias for --capabilities").option("--description-file <path>", "Alias for --capabilities-file").option("--clear-capabilities", "Clear the agent capabilities/description").option("--clear-description", "Alias for --clear-capabilities").option("--reports-to <agent-id>", "Manager agent ID").option("--clear-reports-to", "Clear the manager relationship").action(async (agentIdArg, opts) => {
+    agent.command("update").description(getAgentCliCapabilityById("agent.update").description).argument("[agentId]", "Agent ID or shortname/url-key; defaults to RUDDER_AGENT_ID").option("-O, --org-id <id>", "Organization ID").option("--name <name>", "Agent display name").option("--role <role>", "Agent organization role").option("--title <title>", "Agent title shown in mentions and agent labels").option("--clear-title", "Clear the agent title").option("--capabilities <text>", "Agent capabilities/description text").option("--capabilities-file <path>", "Read agent capabilities/description from a local file").option("--description <text>", "Alias for --capabilities").option("--description-file <path>", "Alias for --capabilities-file").option("--clear-capabilities", "Clear the agent capabilities/description").option("--clear-description", "Alias for --clear-capabilities").action(async (agentIdArg, opts) => {
       try {
         const ctx = resolveCommandContext(opts);
         const agentId = agentIdArg?.trim() || ctx.agentId;
@@ -14206,7 +14329,7 @@ function registerAgentCommands(program) {
         const patch = await buildAgentUpdatePatch(opts);
         if (Object.keys(patch).length === 0) {
           throw new Error(
-            "No agent fields to update. Pass --name, --role, --title, --capabilities, --description, or --reports-to."
+            "No agent fields to update. Pass --name, --role, --title, --capabilities, or --description."
           );
         }
         const query = new URLSearchParams();
@@ -14329,11 +14452,6 @@ async function buildAgentUpdatePatch(opts) {
   }
   if (opts.title !== void 0) rawPatch.title = opts.title;
   if (opts.clearTitle) rawPatch.title = null;
-  if (opts.reportsTo !== void 0 && opts.clearReportsTo) {
-    throw new Error("Pass only one of --reports-to or --clear-reports-to.");
-  }
-  if (opts.reportsTo !== void 0) rawPatch.reportsTo = opts.reportsTo;
-  if (opts.clearReportsTo) rawPatch.reportsTo = null;
   const capabilitiesInputs = [
     opts.capabilities !== void 0 ? "--capabilities" : null,
     opts.capabilitiesFile !== void 0 ? "--capabilities-file" : null,
@@ -15523,7 +15641,7 @@ var IMPORT_INCLUDE_OPTIONS = [
   { value: "organization", label: "Organization", hint: "name, branding, and organization settings" },
   { value: "projects", label: "Projects", hint: "projects and workspace metadata" },
   { value: "issues", label: "Tasks", hint: "tasks and recurring automations" },
-  { value: "agents", label: "Agents", hint: "agent records and organization structure" },
+  { value: "agents", label: "Agents", hint: "agent records and configuration" },
   { value: "skills", label: "Skills", hint: "organization skill packages and references" }
 ];
 var IMPORT_PREVIEW_SAMPLE_LIMIT = 6;
@@ -19193,7 +19311,7 @@ import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash2, randomUUID } from "node:crypto";
 import { createWriteStream, constants as fsConstants, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { access, chmod, copyFile as copyFile2, cp as cp3, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import { access, chmod, copyFile as copyFile2, cp as cp2, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import path23 from "node:path";
 import { Readable, Transform } from "node:stream";
@@ -20419,7 +20537,7 @@ async function copyPortableAppBundle(sourcePath, destinationPath) {
     if (isSuccessfulRobocopyExitCode(result.status)) return;
     throw new Error(formatCommandFailure(command.command, command.args, result.stdout, result.stderr));
   }
-  await cp3(sourcePath, destinationPath, { recursive: true, verbatimSymlinks: true });
+  await cp2(sourcePath, destinationPath, { recursive: true, verbatimSymlinks: true });
 }
 async function removeMacQuarantine(paths, target) {
   if (target.platform !== "macos") return;