agent-relay-server 0.62.3 → 0.63.1

package/src/notification-router.ts

@@ -57,7 +57,7 @@ export interface NotificationScope {
   paths?: string[];
 }
 
-export interface NotificationMessage {
+interface NotificationMessage {
   subject?: string;
   body: string;
   payload?: Record<string, unknown>;
@@ -67,7 +67,7 @@ export interface NotificationMessage {
   replyExpected?: boolean;
 }
 
-export interface RouteNotificationInput {
+interface RouteNotificationInput {
   type: NotificationType;
   scope: NotificationScope;
   /**

package/src/notification-rules.ts

@@ -33,7 +33,7 @@ export interface NotificationRule {
   evaluate(agent: AgentCard, ctx: NotificationRuleContext): RuleDecision;
 }
 
-export interface AudienceMember {
+interface AudienceMember {
   agentId: string;
   /** The rule whose decision was decisive (last non-abstain wins) — carried for explainability (#446). */
   matchedRule: string;
@@ -161,7 +161,7 @@ export function setSubscriptionRules(rules: NotificationRule[]): void {
 }
 
 /** The effective ordered rule list for a type: its registered defaults, then subscription overrides. */
-export function audienceRulesFor(type: NotificationType): NotificationRule[] {
+function audienceRulesFor(type: NotificationType): NotificationRule[] {
   const defaults = audienceRegistry.get(type);
   if (!defaults) return [];
   return subscriptionRules.length === 0 ? defaults : [...defaults, ...subscriptionRules];

package/src/project-ingest.ts

@@ -16,7 +16,7 @@ import type { ProjectEntry } from "./types";
 
 const INGEST_FILENAME = "CLAUDE.md";
 
-export interface ParsedSection {
+interface ParsedSection {
   /** Heading text (the entry title). For pre-heading preamble content: "(preamble)". */
   title: string;
   /** Section body — lines under the heading up to the next heading, trimmed. May be "". */
@@ -25,14 +25,14 @@ export interface ParsedSection {
   anchor: string;
 }
 
-export interface IngestRootResult {
+interface IngestRootResult {
   rootPath: string;
   filePath: string;
   found: boolean;
   sections: number;
 }
 
-export interface IngestResult {
+interface IngestResult {
   projectId: string;
   created: number;
   updated: number;

package/src/project-instructions.ts

@@ -31,7 +31,7 @@ export interface ProjectInstructionPolicy {
   policy?: ProjectInstructionPolicyName;
 }
 
-export interface ComposeProjectInstructionsOptions {
+interface ComposeProjectInstructionsOptions {
   /** Named policy selecting the included source set. Default `all`. */
   policy?: ProjectInstructionPolicyName;
   /** Explicit source set; overrides `policy` when given (the low-level lever). */

package/src/provider-config-store.ts

@@ -3,6 +3,7 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { ValidationError, listOrchestrators } from "./db";
 import { getConfig, listConfig, setConfig } from "./config-store";
+import { providerConfigHomeFromEnv } from "./config";
 import { cleanString, cleanStringArray, optionalEnum } from "./validation";
 import { emitConfigChanged } from "./sse";
 import {
@@ -24,15 +25,15 @@ export const VALID_PROVIDER_CONFIGS = SPAWN_PROVIDERS;
 type ProviderConfigProvider = string;
 type ProviderConfigEntry = ConfigEntry<ProviderConfig>;
 
-export function defaultProviderConfigHost(): string {
+function defaultProviderConfigHost(): string {
   return hostname();
 }
 
-export function providerConfigKey(host: string, provider: string): string {
+function providerConfigKey(host: string, provider: string): string {
   return `${normalizeProviderConfigHost(host)}/${normalizeProviderConfigProvider(provider)}`;
 }
 
-export function parseProviderConfigKey(key: string): { host: string; provider: ProviderConfigProvider } | null {
+function parseProviderConfigKey(key: string): { host: string; provider: ProviderConfigProvider } | null {
   const slash = key.lastIndexOf("/");
   if (slash <= 0 || slash === key.length - 1) return null;
   const host = cleanString(key.slice(0, slash), "host", { required: true, max: 120 })!;
@@ -234,5 +235,5 @@ function maskEnv(env: Record<string, string>): Record<string, string> {
 }
 
 function agentRelayHome(): string {
-  return process.env.AGENT_RELAY_HOME || join(process.env.HOME || ".", ".agent-relay");
+  return providerConfigHomeFromEnv();
 }

package/src/provider-state.ts

@@ -1,4 +1,5 @@
 import { isRecord } from "agent-relay-sdk";
+import { rateLimitFallbackMs } from "./config";
 
 // One server-side home for reading an agent's provider runtime state (the
 // `meta.providerState` that both Claude and Codex ride for blocked/approval
@@ -6,7 +7,7 @@ import { isRecord } from "agent-relay-sdk";
 // the transient-agent reaper (don't reap a held agent), and the rate-limit
 // resume sweep. The dashboard has its own client-side copy in display.ts.
 
-export interface ProviderStateView {
+interface ProviderStateView {
   state: string;
   reason?: string;
   label?: string;
@@ -48,9 +49,6 @@ export function isRateLimitHold(agent: HasMeta | null | undefined): boolean {
 // rather than waiting the full (unknown) limit window. Re-entering the hold on a
 // still-limited retry is cheap, and a subscription limit almost always carries a
 // reset time. Read at call-time so operators/tests can tune it.
-const rateLimitFallbackMs = (): number =>
-  Number(process.env.AGENT_RELAY_RATE_LIMIT_FALLBACK_MS) || 60 * 60 * 1000;
-
 /**
  * When a rate-limit hold should be lifted. The provider's `resetAt` is
  * authoritative; otherwise fall back to `enteredAt + fallback window`. Null only

package/src/reviewer-pipeline.ts

@@ -9,7 +9,7 @@ import type { Command, WorkspaceMergePreview, WorkspaceRecord } from "./types";
 
 type ReviewDecision = "APPROVED" | "CHANGES_REQUESTED" | "REVIEW_REQUIRED";
 
-export function parsePrNumber(prUrl: string | undefined): number | undefined {
+function parsePrNumber(prUrl: string | undefined): number | undefined {
   if (!prUrl) return undefined;
   const match = prUrl.match(/\/pull\/(\d+)(?:\D|$)/);
   if (!match) return undefined;

package/src/routes/agent-sessions.ts

@@ -14,6 +14,7 @@ import { authContextFromRequest } from "../services/auth-context";
 import { ShutdownAuthError, ShutdownTargetError, shutdownAgent } from "../services/shutdown-agent";
 import { type AgentCard, type SpawnApprovalMode } from "../types";
 import { type ProviderEffort } from "agent-relay-sdk/provider-catalog";
+import { relayToken } from "../config";
 
 const CLAUDE_RESUME_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
@@ -486,8 +487,8 @@ async function proxyOrchestratorDelete(req: Request, orchestratorId: string, pat
   const incoming = new URL(req.url);
   const proxyUrl = `${orch.apiUrl}${path}${incoming.search}`;
   const headers: Record<string, string> = {};
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const res = await fetch(proxyUrl, {
       method: "DELETE",
@@ -507,8 +508,8 @@ async function proxyOrchestratorJson(orchestratorId: string, path: string, metho
   if (!orch.apiUrl) return error("orchestrator does not expose an API", 422);
   if (orch.status !== "online") return error("orchestrator is offline", 422);
   const headers: Record<string, string> = { "Content-Type": "application/json" };
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const res = await fetch(`${orch.apiUrl}${path}`, {
       method,

package/src/routes/orchestrator-proxy.ts

@@ -5,6 +5,7 @@ import { authorizeRoute, cleanJsonArray, error, json, type Handler } from "./_sh
 import { cleanStringArray } from "../validation";
 import { emitOrchestratorStatus } from "../sse";
 import { type OrchestratorRuntimeInput, type SpawnProvider } from "../types";
+import { relayToken } from "../config";
 
 export const getOrchestratorDirectories: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
@@ -63,8 +64,8 @@ async function proxyOrchestratorGet(req: Request, orchestratorId: string, path:
   const incoming = new URL(req.url);
   const proxyUrl = `${orch.apiUrl}${path}${incoming.search}`;
   const headers: Record<string, string> = {};
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const res = await fetch(proxyUrl, { headers, signal: AbortSignal.timeout(10_000) });
     const contentType = res.headers.get("content-type") ?? "";
@@ -88,8 +89,8 @@ async function proxyOrchestratorPost(req: Request, orchestratorId: string, path:
   const headers: Record<string, string> = {
     "Content-Type": req.headers.get("content-type") ?? "application/json",
   };
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const body = await req.text();
     const res = await fetch(proxyUrl, {

package/src/routes/workspaces.ts

@@ -13,6 +13,7 @@ import { resolve } from "node:path";
 import { type WorkspaceAutoMergePolicy, type WorkspaceDiagnostics, type WorkspaceGitState, type WorkspaceMergeStrategy, type WorkspaceRecord, type WorkspaceStatus } from "../types";
 import { AUTO_MERGE_POLICIES } from "../workspace-merge";
 import { workspaceActiveClaim } from "../workspace-claim";
+import { relayToken } from "../config";
 
 export const getWorkspaces: Handler = (req) => {
   try {
@@ -50,8 +51,8 @@ async function proxyWorkspaceHostGet(workspaceId: string, hostPath: string, extr
   if (workspace.baseSha) query.set("baseSha", workspace.baseSha);
   for (const [key, value] of Object.entries(extraQuery ?? {})) query.set(key, value);
   const headers: Record<string, string> = {};
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const res = await fetch(`${orch.apiUrl}${hostPath}?${query.toString()}`, {
       headers,
@@ -145,8 +146,8 @@ async function fetchWorkspaceGitState(workspace: WorkspaceRecord): Promise<{ sta
   if (workspace.baseRef) query.set("baseRef", workspace.baseRef);
   if (workspace.baseSha) query.set("baseSha", workspace.baseSha);
   const headers: Record<string, string> = {};
-  const relayToken = process.env.AGENT_RELAY_TOKEN;
-  if (relayToken) headers[RELAY_TOKEN_HEADER] = relayToken;
+  const token = relayToken();
+  if (token) headers[RELAY_TOKEN_HEADER] = token;
   try {
     const res = await fetch(`${orch.apiUrl}/api/workspace/state?${query.toString()}`, { headers, signal: AbortSignal.timeout(10_000) });
     if (!res.ok) return { unavailable: `host returned ${res.status}` };

package/src/security.ts

@@ -1,4 +1,12 @@
-import { AUTH_TOKEN, CORS_ORIGINS, getIntegrationTokens, type IntegrationTokenConfig } from "./config";
+import {
+  CORS_ORIGINS,
+  allowUnauthenticated,
+  corsOriginsFromEnv,
+  getIntegrationTokens,
+  relayToken,
+  tokenSecretFromEnv,
+  type IntegrationTokenConfig,
+} from "./config";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -14,7 +22,7 @@ export function isLoopbackHost(hostname: string): boolean {
 }
 
 export function assertSafeNetworkConfig(host: string): void {
-  if (authToken() || process.env.AGENT_RELAY_ALLOW_UNAUTH === "1") return;
+  if (authToken() || allowUnauthenticated()) return;
   if (isLoopbackHost(host)) return;
   throw new Error(
     `Refusing to bind unauthenticated relay on ${host}. Set AGENT_RELAY_TOKEN or AGENT_RELAY_ALLOW_UNAUTH=1.`,
@@ -407,7 +415,7 @@ export function unauthorized(req: Request): Response {
 }
 
 function authToken(): string {
-  return process.env.AGENT_RELAY_TOKEN ?? AUTH_TOKEN;
+  return relayToken();
 }
 
 function extractToken(req: Request): string | null {
@@ -417,7 +425,7 @@ function extractToken(req: Request): string | null {
 }
 
 function tokenSecret(): string {
-  const env = process.env.AGENT_RELAY_TOKEN_SECRET;
+  const env = tokenSecretFromEnv();
   if (env) return env;
   const path = join(process.env.HOME || ".", ".agent-relay", "token-secret");
   if (existsSync(path)) return readFileSync(path, "utf8").trim();
@@ -542,7 +550,5 @@ function isTokenRevoked(jti: string): boolean {
 }
 
 function corsOrigins(): string[] {
-  const raw = process.env.AGENT_RELAY_CORS_ORIGINS;
-  if (raw === undefined) return CORS_ORIGINS;
-  return raw.split(",").map((origin) => origin.trim()).filter(Boolean);
+  return corsOriginsFromEnv() ?? CORS_ORIGINS;
 }

package/src/self-resume.ts

@@ -14,7 +14,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import type { AgentCard, Command, ContinuationEnvelope, ContinuationLedgerEntry, SelfResumeMode } from "./types";
 
-export interface CompactAndResumeInput {
+interface CompactAndResumeInput {
   agentId: string;
   workingState: string;
   ruledOut?: unknown;
@@ -22,7 +22,7 @@ export interface CompactAndResumeInput {
   objective?: string;
 }
 
-export interface CompactAndResumeResult {
+interface CompactAndResumeResult {
   ok: boolean;
   mode: SelfResumeMode;
   envelope: ContinuationEnvelope;
@@ -110,7 +110,7 @@ export function enqueueContinuationInjectionAfterClear(command: Command): Comman
   return inject;
 }
 
-export function renderContinuation(envelope: ContinuationEnvelope): string {
+function renderContinuation(envelope: ContinuationEnvelope): string {
   const ledger = envelope.ledger.length
     ? envelope.ledger.map((entry) => `- gen ${entry.gen} @ ${new Date(entry.at).toISOString()}: ${entry.ruledOut}${entry.why ? `; why: ${entry.why}` : ""}`).join("\n")
     : "- none";
@@ -231,7 +231,3 @@ function ledgerEntry(ruledOut: string, why: string, generation: number, now: num
   if (!cleaned) throw new ValidationError("ruledOut entries cannot be blank");
   return { gen: generation, ruledOut: cleaned, why, at: now };
 }
-
-export function continuationForAgent(agentId: string): ContinuationEnvelope | null {
-  return getContinuationEnvelope(agentId);
-}

package/src/services/agent-action.ts

@@ -8,7 +8,7 @@ import type { AgentCard, Command } from "../types";
 
 export type AgentAction = "compact" | "clearContext" | "inject";
 
-export interface AgentActionInput {
+interface AgentActionInput {
   agentId: string;
   action: AgentAction;
   message?: string;
@@ -16,7 +16,7 @@ export interface AgentActionInput {
   requestedBy?: string;
 }
 
-export interface AgentActionResult {
+interface AgentActionResult {
   action: AgentAction;
   command: Command;
 }

package/src/services/issue-activity.ts

@@ -24,7 +24,3 @@ export function recordAndEmitIssueActivity(input: RecordIssueActivityInput) {
   emitActivityEvent(event);
   return event;
 }
-
-export function resolveIssueActivityMapping(input: { issueRefId?: string; issueRef?: string; defaultRepo?: string; provider?: IssueProvider }) {
-  return resolveIssueActivityRef(input);
-}

package/src/services/issue-associations.ts

@@ -8,7 +8,7 @@ import { getIssueRef, resolveIssueRefByExternalKey, resolveIssueRefFromString }
 import type { IssueAssociationEntityType, IssueAssociationIssue, IssueProvider } from "../types";
 import { ValidationError } from "../db/connection";
 
-export interface ResolveAssociationIssueInput {
+interface ResolveAssociationIssueInput {
   issueRefId?: string;
   ref?: string;
   defaultRepo?: string;
@@ -19,7 +19,7 @@ export interface ResolveAssociationIssueInput {
   title?: string;
 }
 
-export interface AssociateIssueInput extends ResolveAssociationIssueInput {
+interface AssociateIssueInput extends ResolveAssociationIssueInput {
   entityType: IssueAssociationEntityType;
   entityId: string;
 }

package/src/services/issue-lifecycle.ts

@@ -9,6 +9,7 @@ import {
 import { getIssueRef, resolveIssueRefByExternalKey, resolveIssueRefFromString, updateIssueRef } from "../db/issue-refs";
 import { associateIssue } from "../db/issue-associations";
 import { resolveIssueTrackerAdapter } from "../issue-tracker";
+import { defaultIssueRepo } from "../config";
 import type { IssueTrackerAdapter } from "../issue-tracker";
 import { recordAndEmitIssueActivity } from "./issue-activity";
 import type { IssueAssociationEntityType, IssueProvider, IssueRef, WorkspaceRecord } from "../types";
@@ -17,7 +18,7 @@ type LifecycleWorkspace = Pick<WorkspaceRecord, "id" | "repoRoot" | "branch" | "
 type AdapterResolver = (ref: IssueRef) => IssueTrackerAdapter;
 type LogFn = (message: string) => void;
 
-export interface LandedIssueLifecycleInput {
+interface LandedIssueLifecycleInput {
   workspace: LifecycleWorkspace;
   mergedSha?: string;
   subject?: string;
@@ -31,7 +32,7 @@ export interface LandedIssueLifecycleInput {
   prLand?: boolean;
 }
 
-export interface ReopenIssueLifecycleInput {
+interface ReopenIssueLifecycleInput {
   issueRefId?: string;
   ref?: string;
   defaultRepo?: string;
@@ -46,19 +47,19 @@ export interface ReopenIssueLifecycleInput {
   entityId?: string;
 }
 
-export interface IssueLifecycleOptions {
+interface IssueLifecycleOptions {
   adapterResolver?: AdapterResolver;
   log?: LogFn;
 }
 
-export type LandIssueRefSource = "association" | "commit" | "backlink";
+type LandIssueRefSource = "association" | "commit" | "backlink";
 
-export type CloseIssueLifecycleResult =
+type CloseIssueLifecycleResult =
   | { issueRef: IssueRef; action: "closed"; source: LandIssueRefSource; landKey: string }
   | { issueRef: IssueRef; action: "skipped"; reason: "already-closed" | "already-processed"; landKey: string }
   | { issueRef: IssueRef; action: "failed"; error: string; landKey: string };
 
-export type ReopenIssueLifecycleResult =
+type ReopenIssueLifecycleResult =
   | { issueRef: IssueRef; action: "reopened"; landKey: string }
   | { issueRef: IssueRef; action: "skipped"; reason: "already-open"; landKey: string }
   | { issueRef: IssueRef; action: "failed"; error: string; landKey: string };
@@ -78,10 +79,6 @@ function logFailure(opts: IssueLifecycleOptions, message: string): void {
   else console.warn(message);
 }
 
-function defaultIssueRepo(): string | undefined {
-  return process.env.AGENT_RELAY_DEFAULT_ISSUE_REPO || process.env.GITHUB_REPOSITORY || undefined;
-}
-
 /**
  * `owner/repo` out of any git remote URL form: `git@github.com:owner/repo.git`,
  * `https://github.com/owner/repo.git`, `ssh://git@host/owner/repo`, trailing slash/`.git`
@@ -210,7 +207,7 @@ export function parseBacklinkIssueRefs(text: string | undefined, fallbackDefault
   return issueRefMap(refs);
 }
 
-export function resolveIssueRefsForLand(input: LandedIssueLifecycleInput): { source: LandIssueRefSource; refs: IssueRef[] } {
+function resolveIssueRefsForLand(input: LandedIssueLifecycleInput): { source: LandIssueRefSource; refs: IssueRef[] } {
   const associated = associatedIssueRefs(input.workspace);
   if (associated.length > 0) return { source: "association", refs: associated };
   const fallbackDefaultRepo = landDefaultRepo(input.workspace);

package/src/services/managed-running.ts

@@ -19,7 +19,7 @@ import { emitMessageAvailable, emitMessageDeliveryUpdated, emitNewMessage } from
 import type { AuthContext } from "./auth-context";
 import type { ManagedAgentState } from "../types";
 
-export interface ManagedRunningInput {
+interface ManagedRunningInput {
   policyName?: string;
   spawnRequestId?: string;
   agentId: string;

package/src/services/parity-harness.ts

@@ -15,7 +15,7 @@ import { subscribeRelayEvents } from "../events";
 /** An emitted relay event, normalized to the fields parity compares — volatile
  * `seq`/`timestamp` are deliberately dropped so only behavior, not ordering noise,
  * is asserted. */
-export interface CapturedEvent {
+interface CapturedEvent {
   type: string;
   source: string;
   subject?: string;
@@ -36,7 +36,7 @@ export interface Capture<S> {
  * settled so the harness can snapshot. Keep the abstraction swappable: a later slice
  * can replace a direct-call transport with an end-to-end HTTP one without reshaping
  * the harness. */
-export interface ParityTransport<C> {
+interface ParityTransport<C> {
   id: string;
   invoke(ctx: C): Promise<void>;
 }
@@ -57,7 +57,7 @@ export interface ParityOp<C, S> {
 }
 
 /** Drive one transport in isolation and capture everything it produced. */
-export async function captureTransport<C, S>(
+async function captureTransport<C, S>(
   op: ParityOp<C, S>,
   transportId: string,
   ctx: C,

package/src/services/plan-graph.ts

@@ -4,12 +4,13 @@ import { associateIssue, planNodeIssueEntityId, removeAssociation } from "../db/
 import { resolveIssueRefFromString } from "../db/issue-refs";
 import { emitRelayEvent } from "../events";
 import { cleanString, cleanStringArray, optionalEnum } from "../validation";
+import { defaultIssueRepo } from "../config";
 import type { AuthContext } from "./auth-context";
 import type { AgentCard, Plan, PlanEdge, PlanNode, PlanOwnerRef, PlanStatus } from "../types";
 
 export const PLAN_STATUSES = ["pending", "in-progress", "landed", "blocked"] as const;
 
-export interface PlanNodeInput {
+interface PlanNodeInput {
   id?: unknown;
   label?: unknown;
   scopeBlurb?: unknown;
@@ -21,7 +22,7 @@ export interface PlanNodeInput {
   blackboardRefs?: unknown;
 }
 
-export interface PlanNodePatch {
+interface PlanNodePatch {
   label?: unknown;
   scopeBlurb?: unknown;
   ownerRef?: unknown;
@@ -32,7 +33,7 @@ export interface PlanNodePatch {
   blackboardRefs?: unknown;
 }
 
-export interface PlanCreateInput {
+interface PlanCreateInput {
   threadId: unknown;
   teamId?: unknown;
   channel?: unknown;
@@ -86,10 +87,6 @@ function cleanRefs(value: unknown): PlanNode["refs"] | undefined {
   return Object.keys(out).length ? out : undefined;
 }
 
-function defaultIssueRepo(): string | undefined {
-  return process.env.AGENT_RELAY_DEFAULT_ISSUE_REPO || process.env.GITHUB_REPOSITORY || undefined;
-}
-
 function syncPlanNodeIssueAssociation(planId: string, node: PlanNode): void {
   if (!node.refs?.issueId) return;
   associateIssue(node.refs.issueId, "plan-node", planNodeIssueEntityId(planId, node.id));

package/src/services/send-message.ts

@@ -22,7 +22,14 @@
 // OUT OF SCOPE (transport-edge, excluded from the parity facet): automatic memory injection
 // (needs request-derived context) and per-transport audit (HTTP domain row vs MCP tool-call row).
 import { isMechanicalMessageKind, isRecord, isReservedAgentId } from "agent-relay-sdk";
-import { ValidationError, getMessage, listAgents, sendMessageWithResult, channelObligationAnsweredBy } from "../db";
+import {
+  ValidationError,
+  getMessage,
+  listAgents,
+  sendMessageWithResult,
+  channelObligationAnsweredBy,
+  spawnObligationAnsweredBy,
+} from "../db";
 import { planSend, type DeliveryReceipt } from "../agent-ref";
 import { emitMessageQueued, emitNewMessage } from "../sse";
 import { getLifecycleManager } from "../lifecycle-manager";
@@ -32,14 +39,14 @@ import type { AuthContext } from "./auth-context";
 import type { IntegrationTokenConfig } from "../config";
 import type { Message, SendMessageInput } from "../types";
 
-export interface SendMessageResult {
+interface SendMessageResult {
   message: Message;
   created: boolean;
   /** Synchronous delivery receipt (live recipients / queued / store-ahead). */
   receipt: DeliveryReceipt;
 }
 
-export interface SendMessageOptions {
+interface SendMessageOptions {
   /** The integration token when the MCP caller authenticated with one. AuthContext stays lean
    * (foundation contract) — the integration-specific target policy rides here, not on the ctx. */
   integration?: IntegrationTokenConfig | null;
@@ -159,16 +166,13 @@ export function sendMessageService(
   // Resolve BEFORE authorize so both run against the canonical id (kills the HTTP-authorizes-raw
   // vs MCP-authorizes-resolved drift).
   const receipt = resolveSendTarget(input, input.from);
-  // Channel-answer linking: an agent answering the human through a channel bridge posts a body-less
-  // message to the channel agent (e.g. `agent-relay /message telegram '{"action":"reply",...}'`) that
-  // carries no reply/conversation linkage, so its reply obligation never clears and the Stop hook nags
-  // it into a redundant `/reply` that leaks back to the human as a second message. When the agent has
-  // exactly ONE open obligation on that channel this send is unambiguously the answer — link it here,
-  // at send time, so the obligation clears with no extra message. (`channelObligationAnsweredBy` is a
-  // no-op unless `to` resolved to a channel agent with a single open obligation; deciding at send time
-  // — not query time — keeps a later sibling conversation from retroactively mis-attributing it.)
+  // Reply-obligation linking: some real answers are ordinary sends without replyTo/thread linkage.
+  // Channel bridge replies and spawn report-backs both have a single unambiguous open obligation case;
+  // link those at send time so the obligation clears with one message and the Stop hook does not nag
+  // the agent into a redundant `/reply`.
   if (!input.replyTo && !isMechanicalMessageKind(input.kind)) {
-    const answered = channelObligationAnsweredBy(input.from, input.to);
+    const answered = channelObligationAnsweredBy(input.from, input.to)
+      ?? spawnObligationAnsweredBy(input.from, input.to);
     if (answered !== null) input.replyTo = answered;
   }
   authorizeSend(input, ctx, opts, reservedSink);

package/src/services/shutdown-agent.ts

@@ -50,7 +50,7 @@ export class ShutdownTargetError extends Error {}
 
 type OnlineOrchestrator = NonNullable<ReturnType<typeof getOrchestrator>>;
 
-export interface ShutdownAgentInput {
+interface ShutdownAgentInput {
   agentId?: string;
   policyName?: string;
   spawnRequestId?: string;
@@ -69,7 +69,7 @@ export interface ShutdownAgentInput {
   auditMetadata?: Record<string, unknown>;
 }
 
-export interface ShutdownAgentResult {
+interface ShutdownAgentResult {
   command: Command;
   orchestratorId: string;
   agent: AgentCard | null;

package/src/services/team-templates.ts

@@ -8,7 +8,7 @@ import { setCallerTeamBrief } from "./team";
 import { spawnAgent, type SpawnAgentInput, type SpawnAgentResult } from "./spawn-agent";
 import type { AgentLifecycle, SpawnApprovalMode, SpawnProvider, TeamTemplate, TeamTemplateCompositionEntry, WorkspaceMode } from "../types";
 
-export interface TeamTemplateInstantiateInput {
+interface TeamTemplateInstantiateInput {
   slug: string;
   orchestratorId?: unknown;
   cwd?: unknown;
@@ -19,7 +19,7 @@ export interface TeamTemplateInstantiateInput {
   waitForRegistrationMs?: unknown;
 }
 
-export interface TeamTemplateInstantiateResult {
+interface TeamTemplateInstantiateResult {
   template: TeamTemplate;
   team: ReturnType<typeof setCallerTeamBrief>["team"];
   spawned: SpawnAgentResult[];

package/src/services/team.ts

@@ -7,7 +7,7 @@ import type { Team } from "../types";
 export class TeamAuthError extends Error {}
 export class TeamNotFoundError extends Error {}
 
-export interface TeamPayload {
+interface TeamPayload {
   team: Team;
   roster: ReturnType<typeof getTeamRoster>;
   brief: string | null;
@@ -16,7 +16,7 @@ export interface TeamPayload {
   issues: ReturnType<typeof listIssueRefsForEntity>;
 }
 
-export interface TeamBriefInput {
+interface TeamBriefInput {
   title?: string;
   brief?: string;
   definitionOfDone?: string;

package/src/settings/modules.ts

@@ -73,7 +73,7 @@ export function registerChannelTypeSetting(input: {
   });
 }
 
-export interface ProviderSettingsDeclaration {
+interface ProviderSettingsDeclaration {
   provider: string;
   defaults: ProviderConfig;
   display?: Partial<SettingDisplay>;