nodal-agents 0.7.95 → 0.8.0

package/cli.js

@@ -11040,7 +11040,7 @@ var init_types2 = __esm({
 
 // ../../packages/shared/src/enums.ts
 import { z as z2 } from "zod";
-var JOB_CHANNELS, JobChannelSchema, JOB_STATUSES, JobStatusSchema, TASK_STATUSES, TaskStatusSchema, TASK_PRIORITIES, TaskPrioritySchema, AGENT_ROLES, AgentRoleSchema, ORCHESTRATOR_MODES, OrchestratorModeSchema, CONNECTOR_AUTH_TYPES, ConnectorAuthTypeSchema, APPROVAL_STATUSES, ApprovalStatusSchema, APPROVAL_RULE_ACTIONS, ApprovalRuleActionSchema, MEMORY_CATEGORIES, MemoryCategorySchema, MEMORY_SOURCES, MemorySourceSchema, MEMORY_LAYERS, MemoryLayerSchema, SCHEDULE_TYPES, ScheduleTypeSchema, SCHEDULE_LAST_STATUSES, ScheduleLastStatusSchema, ENTITY_MEMBER_ROLES, EntityMemberRoleSchema, ENTITY_INDUSTRIES, EntityIndustrySchema, OPERATION_RISK_LEVELS, OperationRiskLevelSchema, PLUGIN_TYPES, PluginTypeSchema, PLUGIN_HOOKS, PluginHookSchema, MCP_TRANSPORTS, McpTransportSchema;
+var JOB_CHANNELS, JobChannelSchema, JOB_STATUSES, JobStatusSchema, TASK_STATUSES, TaskStatusSchema, TASK_PRIORITIES, TaskPrioritySchema, AGENT_ROLES, AgentRoleSchema, ORCHESTRATOR_MODES, OrchestratorModeSchema, CONNECTOR_AUTH_TYPES, ConnectorAuthTypeSchema, APPROVAL_STATUSES, ApprovalStatusSchema, APPROVAL_RULE_ACTIONS, ApprovalRuleActionSchema, MEMORY_CATEGORIES, MemoryCategorySchema, MEMORY_SOURCES, MemorySourceSchema, MEMORY_LAYERS, MemoryLayerSchema, SCHEDULE_TYPES, ScheduleTypeSchema, SCHEDULE_LAST_STATUSES, ScheduleLastStatusSchema, ENTITY_MEMBER_ROLES, EntityMemberRoleSchema, ENTITY_INDUSTRIES, EntityIndustrySchema, OPERATION_RISK_LEVELS, OperationRiskLevelSchema, MCP_TRANSPORTS, McpTransportSchema;
 var init_enums = __esm({
   "../../packages/shared/src/enums.ts"() {
     "use strict";
@@ -11104,16 +11104,6 @@ var init_enums = __esm({
     EntityIndustrySchema = z2.enum(ENTITY_INDUSTRIES);
     OPERATION_RISK_LEVELS = ["read", "write", "destructive"];
     OperationRiskLevelSchema = z2.enum(OPERATION_RISK_LEVELS);
-    PLUGIN_TYPES = ["webhook", "transform", "schedule"];
-    PluginTypeSchema = z2.enum(PLUGIN_TYPES);
-    PLUGIN_HOOKS = [
-      "pre_task",
-      "post_task",
-      "pre_tool",
-      "post_tool",
-      "on_memory_save"
-    ];
-    PluginHookSchema = z2.enum(PLUGIN_HOOKS);
     MCP_TRANSPORTS = ["http", "stdio"];
     McpTransportSchema = z2.enum(MCP_TRANSPORTS);
   }
@@ -11240,7 +11230,6 @@ var init_agent = __esm({
       telegram_bot_token: z6.string().nullable(),
       telegram_bot_username: z6.string().nullable(),
       telegram_offset: z6.number().int().nonnegative().nullable(),
-      requires_approval: z6.array(z6.string()),
       capabilities: z6.array(z6.string()),
       task_context_template: z6.string().nullable(),
       avatar_url: z6.string().nullable(),
@@ -11264,7 +11253,6 @@ var init_agent = __esm({
       orchestrator_mode: OrchestratorModeSchema.nullable().optional(),
       telegram_bot_token: z6.string().nullable().optional(),
       telegram_bot_username: z6.string().nullable().optional(),
-      requires_approval: z6.array(z6.string()).default([]),
       task_context_template: z6.string().nullable().optional(),
       avatar_url: z6.string().nullable().optional(),
       max_tokens_per_job: z6.number().int().min(0).max(5e5).default(0)
@@ -11440,7 +11428,12 @@ var CREDENTIAL_TYPES, CredentialSchema, GoogleOauthPayloadSchema;
 var init_credential = __esm({
   "../../packages/shared/src/entities/credential.ts"() {
     "use strict";
-    CREDENTIAL_TYPES = ["google-oauth", "notion-oauth", "airtable-oauth"];
+    CREDENTIAL_TYPES = [
+      "google-oauth",
+      "notion-oauth",
+      "airtable-oauth",
+      "microsoft-oauth"
+    ];
     CredentialSchema = z9.object({
       id: z9.string().guid(),
       owner_user_id: z9.string().guid(),
@@ -11727,7 +11720,6 @@ var init_skill = __esm({
       entity_id: z15.string().guid(),
       agent_id: z15.string().guid(),
       skill_id: z15.string().guid(),
-      approval_overrides: z15.record(z15.string(), z15.boolean()),
       use_custom_instructions: z15.boolean(),
       // NULL = all operations enabled; [] = none enabled
       enabled_operations: z15.array(z15.string()).nullable(),
@@ -11737,7 +11729,6 @@ var init_skill = __esm({
       id: true,
       created_at: true
     }).extend({
-      approval_overrides: z15.record(z15.string(), z15.boolean()).default({}),
       use_custom_instructions: z15.boolean().default(false),
       enabled_operations: z15.array(z15.string()).nullable().optional()
     });
@@ -12034,6 +12025,38 @@ var init_providers = __esm({
         supportsRefresh: true,
         authExtraParams: { response_type: "code" },
         credentialType: "airtable-oauth"
+      },
+      "outlook-mail": {
+        slug: "outlook-mail",
+        label: "Outlook Mail",
+        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        scopes: [
+          "offline_access",
+          "openid",
+          "email",
+          "profile",
+          "https://graph.microsoft.com/Mail.ReadWrite",
+          "https://graph.microsoft.com/Mail.Send",
+          "https://graph.microsoft.com/MailboxSettings.Read"
+        ],
+        pkce: "pkce-s256",
+        tokenAuth: "body",
+        tokenBodyType: "form",
+        // Graph's /v1.0/me requires the User.Read delegated permission, which our
+        // scopes don't request — that would 403 on every connection. The OIDC
+        // userinfo endpoint is covered by the openid/profile/email scopes we
+        // already ask for. `email` is null on some personal Microsoft accounts —
+        // nameField is set to `preferred_username` (always present, looks like an
+        // email) so the generic `accountName = email ?? name` resolver in
+        // callback/route.ts falls back to it automatically. No route.ts changes needed.
+        accountInfo: {
+          url: "https://graph.microsoft.com/oidc/userinfo",
+          nameField: "preferred_username",
+          emailField: "email"
+        },
+        supportsRefresh: true,
+        credentialType: "microsoft-oauth"
       }
     };
   }
@@ -12113,7 +12136,13 @@ var init_model_catalog = __esm({
           // in the request (the deepseek.ts provider sets this automatically when
           // reasoning:true). Also requires reasoning_content to be echoed back on
           // assistant messages with tool_calls (the deepseek fetch shim handles this).
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // DeepSeek's native API has no intensity knob — thinking is on or off.
+            reasoningControl: { kind: "onoff" }
+          },
           contextWindow: 128e3,
           pricing: { inputPerMillionUsd: 0.55, outputPerMillionUsd: 2.19 }
         }
@@ -12138,7 +12167,17 @@ var init_model_catalog = __esm({
           modelId: "MiniMax-M3",
           label: "MiniMax M3",
           // Newest flagship — a reasoning model (adaptive `thinking`), 1M context.
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            // minimax.ts injects thinking.budget_tokens (today fixed at 8000 =
+            // this scale's 'medium'); ladder mirrors Hermes' Anthropic budgets.
+            reasoningControl: {
+              kind: "budget",
+              budgets: { low: 4e3, medium: 8e3, high: 16e3, max: 32e3 }
+            }
+          },
           contextWindow: 1048576
         },
         {
@@ -12172,47 +12211,112 @@ var init_model_catalog = __esm({
         {
           modelId: "kimi-k2.6",
           label: "Kimi K2.6",
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          // K2-line: mandatory thinking mode (`thinking:{type:'enabled'}`), no
+          // intensity knob, cannot be disabled.
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "onoff", mandatory: true }
+          },
           contextWindow: 262144
         },
         {
           modelId: "kimi-k2.7-code",
           label: "Kimi K2.7 Code",
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "onoff", mandatory: true }
+          },
           contextWindow: 262144
+        },
+        {
+          modelId: "kimi-k3",
+          label: "Kimi K3",
+          // Released 2026-07-16. Verified against platform.kimi.ai/docs/pricing/
+          // chat-k3: 1M context, multimodal, always reasons server-side with a
+          // top-level `reasoning_effort` control (currently `max` only) — NOT the
+          // K2-line `thinking` field, so moonshot.ts deliberately does not inject
+          // `thinking` for it (K2-line gate). reasoning:true is still required so
+          // the runtime round-trips reasoning content.
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            // K3 always reasons server-side; its only accepted level today is 'max'.
+            reasoningControl: { kind: "effort", levels: ["max"], mandatory: true }
+          },
+          contextWindow: 1048576
         }
       ],
+      // Anthropic — every current Claude supports extended thinking. Auto (no
+      // agent setting) keeps today's behavior: NO thinking injected. Models ≥4.6
+      // take the adaptive `output_config.effort`; Haiku 4.5 (<4.6) takes a
+      // `thinking.budget_tokens` ladder (mirrors Hermes' anthropic_adapter table).
       anthropic: [
         {
           modelId: "claude-opus-4-8",
           label: "Claude Opus 4.8",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: { kind: "adaptive-effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 2e5
         },
         {
           modelId: "claude-sonnet-4-6",
           label: "Claude Sonnet 4.6",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: { kind: "adaptive-effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 2e5
         },
         {
           modelId: "claude-haiku-4-5-20251001",
           label: "Claude Haiku 4.5",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: {
+              kind: "budget",
+              budgets: { low: 4e3, medium: 8e3, high: 16e3, max: 32e3 }
+            }
+          },
           contextWindow: 2e5
         }
       ],
+      // OpenAI — GPT-5 line takes `reasoning_effort`. Auto = today's behavior
+      // (nothing sent, provider default). 'off' is not offered: the line always
+      // reasons (minimal ≠ none), hence mandatory.
       openai: [
         {
           modelId: "gpt-5",
           label: "GPT-5",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high"], mandatory: true }
+          },
           contextWindow: 4e5
         },
         {
           modelId: "gpt-5-mini",
           label: "GPT-5 mini",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high"], mandatory: true }
+          },
           contextWindow: 4e5
         }
       ],
@@ -12229,17 +12333,30 @@ var init_model_catalog = __esm({
       // fetch shim injects generationConfig.thinkingConfig for these two entries
       // (reasoning:true gates it) so the API returns the chain-of-thought the
       // execute.ts round-trip needs across tool-call turns.
+      // Reasoning control: Gemini 3.x takes `thinkingConfig.thinking_level`
+      // (low/medium/high per ai.google.dev — MEDIUM available on 3.1 Pro and
+      // 3 Flash+); thinking cannot be fully disabled on this line → mandatory.
       google: [
         {
           modelId: "gemini-3.5-flash",
           label: "Gemini 3.5 Flash",
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high"], mandatory: true }
+          },
           contextWindow: 1048576
         },
         {
           modelId: "gemini-3.1-pro-preview",
           label: "Gemini 3.1 Pro (preview)",
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high"], mandatory: true }
+          },
           contextWindow: 1048576
         }
       ],
@@ -12265,41 +12382,68 @@ var init_model_catalog = __esm({
       // MiniMax M3 does not (some of its OpenRouter endpoints reject the forced
       // value), so it runs on 'auto' + the runtime floor.
       openrouter: [
-        // Anthropic
+        // Anthropic — reasoningControl WITHOUT the `reasoning` flag, on purpose:
+        // the flag would flip openrouter.ts's always-on default injection; here
+        // thinking is engaged only when the agent explicitly sets an effort.
+        // OpenRouter's unified `reasoning.effort` reaches Claude (max → xhigh).
         {
           modelId: "anthropic/claude-haiku-4.5",
           label: "Claude Haiku 4.5",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 2e5
         },
         {
           modelId: "anthropic/claude-opus-4.7",
           label: "Claude Opus 4.7",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1e6
         },
         {
           modelId: "anthropic/claude-opus-4.7-fast",
           label: "Claude Opus 4.7 (fast)",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1e6
         },
         {
           modelId: "anthropic/claude-opus-4.8",
           label: "Claude Opus 4.8",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1e6
         },
         {
           modelId: "anthropic/claude-opus-4.8-fast",
           label: "Claude Opus 4.8 (fast)",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1e6
         },
         {
           modelId: "anthropic/claude-sonnet-4.6",
           label: "Claude Sonnet 4.6",
-          capabilities: { tools: true, forcedToolChoice: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1e6
         },
         // DeepSeek
@@ -12316,14 +12460,28 @@ var init_model_catalog = __esm({
           // Flagging reasoning makes the OpenRouter provider enable reasoning + round-trip
           // its reasoning_details across tool calls — without it the model misbehaves
           // (gathers then emits no answer). Matches how Hermes drives DeepSeek.
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // OpenRouter unified `reasoning.effort` (max → xhigh); OpenRouter maps
+            // a requested effort to the nearest level the upstream really supports.
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576,
           providerOrder: ["deepseek"]
         },
         {
           modelId: "deepseek/deepseek-v4-pro",
           label: "DeepSeek V4 Pro",
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // OpenRouter unified `reasoning.effort` (max → xhigh); OpenRouter maps
+            // a requested effort to the nearest level the upstream really supports.
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576,
           providerOrder: ["deepseek"]
         },
@@ -12338,19 +12496,40 @@ var init_model_catalog = __esm({
         {
           modelId: "google/gemini-3.1-flash-lite-preview",
           label: "Gemini 3.1 Flash Lite (preview)",
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // OpenRouter unified `reasoning.effort` (max → xhigh); OpenRouter maps
+            // a requested effort to the nearest level the upstream really supports.
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576
         },
         {
           modelId: "google/gemini-3.1-pro-preview",
           label: "Gemini 3.1 Pro (preview)",
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // OpenRouter unified `reasoning.effort` (max → xhigh); OpenRouter maps
+            // a requested effort to the nearest level the upstream really supports.
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576
         },
         {
           modelId: "google/gemini-3.5-flash",
           label: "Gemini 3.5 Flash",
-          capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            // OpenRouter unified `reasoning.effort` (max → xhigh); OpenRouter maps
+            // a requested effort to the nearest level the upstream really supports.
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576
         },
         {
@@ -12367,7 +12546,12 @@ var init_model_catalog = __esm({
           // tool_choice ('required') → we send 'auto' (forcedToolChoice:false).
           // reasoning:true makes the provider return reasoning_details so the runner
           // can round-trip them across tool-call turns.
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
           contextWindow: 1048576
         },
         // Z.ai (GLM)
@@ -12378,7 +12562,18 @@ var init_model_catalog = __esm({
           // use. reasoning:true → provider returns reasoning_details for round-trip.
           // forcedToolChoice:false: send 'auto' (don't risk a rejected 'required' on
           // a reasoning model; workers are 'auto' after turn 1 anyway).
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            // GLM 5.2 always reasons; upstream accepts high/xhigh — OpenRouter
+            // normalizes lower requests up to its floor.
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
           contextWindow: 1048576
         },
         // Moonshot (Kimi)
@@ -12392,7 +12587,16 @@ var init_model_catalog = __esm({
           // this file's other OpenRouter entries carry one (OpenRouter self-reports
           // real cost via providerMetadata.openrouter.usage.cost — see
           // estimateModelCostUsd's doc comment).
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
           contextWindow: 262144
         },
         {
@@ -12402,8 +12606,86 @@ var init_model_catalog = __esm({
           // turns (like DeepSeek) → reasoning:true is required so the provider
           // round-trips reasoning_details. forcedToolChoice:false for the same reason
           // as the other reasoning models.
-          capabilities: { tools: true, forcedToolChoice: false, reasoning: true },
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
           contextWindow: 262144
+        },
+        // xAI — grok-4.5 verified via OpenRouter /api/v1/models (2026-07-20):
+        // 500K context, text+image, tools + tool_choice + reasoning params.
+        // Reasoning control cross-checked against Hermes (model_metadata.py,
+        // verified live by them 2026-07-08): accepts effort low/medium/high,
+        // REJECTS 'none' → mandatory (no Off), no xhigh → no 'max' level.
+        {
+          modelId: "x-ai/grok-4.5",
+          label: "Grok 4.5",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high"],
+              mandatory: true
+            }
+          },
+          contextWindow: 5e5
+        },
+        // Qwen — both verified via OpenRouter /api/v1/models (2026-07-20): 1M
+        // context, tools + tool_choice + reasoning params (no native
+        // reasoning_effort — OpenRouter's unified param drives the hybrid
+        // thinking mode). Same pattern as the Claude routes above:
+        // reasoningControl WITHOUT the always-on `reasoning` flag — Auto keeps
+        // the provider's default behavior, thinking engages only on explicit
+        // effort. Hermes catalogs both as plain OpenRouter models (no adapter).
+        // qwen3.7-max is TEXT-ONLY (no image input); qwen3.7-plus is multimodal.
+        {
+          modelId: "qwen/qwen3.7-max",
+          label: "Qwen 3.7 Max",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
+          contextWindow: 1048576
+        },
+        {
+          modelId: "qwen/qwen3.7-plus",
+          label: "Qwen 3.7 Plus",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
+          contextWindow: 1048576
+        },
+        {
+          modelId: "moonshotai/kimi-k3",
+          label: "Kimi K3",
+          // Released 2026-07-16, verified via OpenRouter /api/v1/models: 1,048,576
+          // context, text+image input, supports tools/tool_choice/reasoning params.
+          // Above the K2.7 native-tool_calls cutoff — detectAgenticFamily
+          // (openrouter.ts) only matches `moonshotai/kimi-k2*`, so K3 correctly
+          // falls through to native tool_calls with no textual-markup middleware
+          // (the kimi-* tool-schema sanitizer still applies).
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 1048576
         }
       ]
     };
@@ -12422,6 +12704,11 @@ var init_model_catalog = __esm({
       "minimax/minimax-m3",
       "moonshotai/kimi-k2.6",
       "moonshotai/kimi-k2.7-code",
+      "moonshotai/kimi-k3",
+      // Verified via OpenRouter /api/v1/models input_modalities (2026-07-20).
+      // qwen/qwen3.7-max is deliberately absent — text-only per the same source.
+      "x-ai/grok-4.5",
+      "qwen/qwen3.7-plus",
       // Native-provider forms
       "claude-opus-4-8",
       "claude-sonnet-4-6",
@@ -12433,7 +12720,8 @@ var init_model_catalog = __esm({
       "mistral-large-latest",
       "MiniMax-M3",
       "kimi-k2.6",
-      "kimi-k2.7-code"
+      "kimi-k2.7-code",
+      "kimi-k3"
     ]);
     for (const entries of Object.values(MODEL_CATALOG)) {
       for (const e of entries) e.capabilities.vision = VISION_MODEL_IDS.has(e.modelId);
@@ -12723,6 +13011,10 @@ var init_agents = __esm({
         slug: text("slug").notNull(),
         personality: text("personality").notNull(),
         model: text("model").default("claude-sonnet-4-6-20260217"),
+        // Reasoning effort for the PRIMARY model ('off'|'low'|'medium'|'high'|'max').
+        // NULL = Auto (provider default — pre-feature behavior). Validated at the
+        // app layer against the model's reasoningControl (model-catalog.ts).
+        reasoningEffort: text("reasoning_effort"),
         llmKeyId: uuid("llm_key_id").references(() => entityLlmKeys.id, { onDelete: "set null" }),
         // Ordered LLM-key fallback chain (Guard 2). When the primary key
         // (llmKeyId) exhausts retries / times out / hits quota mid-job, the runner
@@ -12744,7 +13036,6 @@ var init_agents = __esm({
         // Last chat_id seen in an inbound DM — populated by the runner poller.
         // Used to inject the delivery target into dashboard-originated jobs.
         lastSeenChatIdTelegram: text("last_seen_chat_id_telegram"),
-        requiresApproval: text("requires_approval").array().default(sql`'{}'::text[]`),
         capabilities: text("capabilities").array().default(sql`'{}'::text[]`),
         taskContextTemplate: text("task_context_template"),
         avatarUrl: text("avatar_url"),
@@ -13045,6 +13336,11 @@ var init_jobs = __esm({
         // outnumber the still-open ones, so a partial index keyed on the open set
         // stays small regardless of table growth.
         index("idx_agent_jobs_completed_at_null").on(table.completedAt).where(sql`${table.completedAt} IS NULL`),
+        // Migration 0070: run-schedules.ts filters by schedule_id every tick — the
+        // no-overlap guard (schedule_id + status) and the daily budget rollup
+        // (schedule_id + created_at range SUM) had no usable index and seq-scanned
+        // the whole table. The (schedule_id, created_at) prefix serves both.
+        index("idx_agent_jobs_schedule_created").on(table.scheduleId, table.createdAt),
         check(
           "agent_jobs_status_check",
           sql`${table.status} IN ('pending','processing','completed','failed','awaiting_approval','awaiting_delegation','cancelled')`
@@ -13151,7 +13447,7 @@ var init_credentials = __esm({
         index("idx_credentials_type").on(table.type),
         check(
           "credentials_type_check",
-          sql`${table.type} IN ('google-oauth','notion-oauth','airtable-oauth')`
+          sql`${table.type} IN ('google-oauth','notion-oauth','airtable-oauth','microsoft-oauth')`
         )
       ]
     );
@@ -13195,10 +13491,19 @@ var init_connectors = __esm({
         check(
           "connectors_auth_type_check",
           sql`${table.authType} IN ('api_key','oauth2','bearer','basic','none')`
-        )
+        ),
         // Multi-instance brique (migration 0016): the (entity_id, slug) UNIQUE
         // constraint was dropped to allow multiple instances of the same connector
         // type per entity (e.g. several Gmail accounts).
+        //
+        // P0-S1 (2026-07-22 incident): create_connector inserted blindly with no
+        // existence check and no DB constraint, so a stuttering agent call
+        // created 8 identical duplicate "Tavily" rows (same entity, same slug,
+        // same name). This index keys on (entity_id, slug, name) — it blocks an
+        // exact-duplicate stutter while fully preserving legitimate multi-instance
+        // (a second connector with the same slug but a DIFFERENT name still
+        // succeeds). It does NOT re-introduce what 0016 dropped.
+        uniqueIndex("connectors_entity_slug_name_unique").on(table.entityId, table.slug, table.name)
       ]
     );
   }
@@ -13478,7 +13783,21 @@ var init_skills = __esm({
         // user as a warning, since the runtime does NOT execute skill scripts.
         isCommunity: boolean("is_community").notNull().default(false),
         source: text("source"),
+        // `sha256` is the ORIGIN hash of each script at install/update time — the
+        // baseline for the three-way update check (computeScriptsState). Optional:
+        // rows installed before the three-way check have no hashes and fall back
+        // to the historical local-vs-upstream compare until their next apply.
         installedScripts: jsonb("installed_scripts").$type(),
+        // ─── Community skill update tracking (migration 0069) ───────────────────
+        // updateAvailable: set by checkSkillUpdate (skills/check-updates.ts) when
+        //   the upstream source diverges from what's installed (content and/or
+        //   scripts). Surfaced in the dashboard so the owner can review + apply.
+        // updateDetail: what the last check found — null before the first check.
+        // lastUpdateCheckAt: throttle timestamp for the cron phase
+        //   (run-skill-update-check.ts) — NULL means never checked.
+        updateAvailable: boolean("update_available").notNull().default(false),
+        updateDetail: jsonb("update_detail").$type(),
+        lastUpdateCheckAt: timestamp("last_update_check_at", { withTimezone: true }),
         // ─── Learning-loop columns (Phase A) ─────────────────────────────────────
         // createdBy: provenance — 'user' (default) | 'system' | 'agent'
         // state: lifecycle — 'active' (default) | 'stale' | 'archived'
@@ -13552,7 +13871,6 @@ var init_skills = __esm({
         entityId: uuid("entity_id").notNull().references(() => entities.id, { onDelete: "cascade" }),
         agentId: uuid("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
         skillId: uuid("skill_id").notNull().references(() => agentSkills.id, { onDelete: "cascade" }),
-        approvalOverrides: jsonb("approval_overrides").default(sql`'{}'::jsonb`),
         useCustomInstructions: boolean("use_custom_instructions").notNull().default(false),
         enabledOperations: text("enabled_operations").array(),
         // Per-skill × per-agent authorization to EXECUTE the skill's bundled scripts
@@ -13673,74 +13991,6 @@ var init_mcp = __esm({
   }
 });
 
-// ../../packages/db/src/schema/misc.ts
-var configuratorSessions, agentPlugins, rateLimits;
-var init_misc = __esm({
-  "../../packages/db/src/schema/misc.ts"() {
-    "use strict";
-    init_pg_core();
-    init_drizzle_orm();
-    init_entities();
-    init_agents();
-    configuratorSessions = pgTable(
-      "configurator_sessions",
-      {
-        id: uuid("id").primaryKey().defaultRandom(),
-        entityId: uuid("entity_id").notNull().references(() => entities.id, { onDelete: "cascade" }),
-        agentId: uuid("agent_id").references(() => agents.id, { onDelete: "cascade" }),
-        messages: jsonb("messages").notNull().default(sql`'[]'::jsonb`),
-        status: text("status").notNull().default("active"),
-        turnCount: integer("turn_count").notNull().default(0),
-        createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-        updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-      },
-      (table) => [
-        index("idx_configurator_sessions_entity").on(table.entityId),
-        index("idx_configurator_sessions_agent").on(table.agentId)
-      ]
-    );
-    agentPlugins = pgTable(
-      "agent_plugins",
-      {
-        id: uuid("id").primaryKey().defaultRandom(),
-        entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
-        name: text("name").notNull(),
-        slug: text("slug").notNull(),
-        description: text("description"),
-        pluginType: text("plugin_type").notNull(),
-        config: jsonb("config").default(sql`'{}'::jsonb`),
-        active: boolean("active").default(true),
-        hook: text("hook").notNull(),
-        webhookUrl: text("webhook_url"),
-        createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
-        updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
-      },
-      (table) => [
-        check(
-          "agent_plugins_plugin_type_check",
-          sql`${table.pluginType} IN ('webhook','transform','schedule')`
-        ),
-        check(
-          "agent_plugins_hook_check",
-          sql`${table.hook} IN ('pre_task','post_task','pre_tool','post_tool','on_memory_save')`
-        ),
-        // R5 (audit #2 follow-up): the pglite test DDL (packages/db/src/tests/
-        // helpers.ts) already assumed a per-entity unique slug here — same class
-        // of phantom-constraint bug as DB-2/F-18 (test mock ahead of the real
-        // schema/migration). entityId is nullable (no `.notNull()` above), so
-        // NULLS NOT DISTINCT closes the same NULL-entity gap as DB-1's
-        // approval_rules constraint.
-        unique("agent_plugins_entity_slug_unique").on(table.entityId, table.slug).nullsNotDistinct()
-      ]
-    );
-    rateLimits = pgTable("rate_limits", {
-      key: text("key").primaryKey(),
-      count: integer("count").default(1),
-      windowStart: timestamp("window_start", { withTimezone: true }).defaultNow()
-    });
-  }
-});
-
 // ../../packages/db/src/schema/auth.ts
 var sessions, accounts, verifications;
 var init_auth = __esm({
@@ -14095,8 +14345,6 @@ __export(schema_exports, {
   MEMORY_SOURCES: () => MEMORY_SOURCES,
   OPERATION_RISK_LEVELS: () => OPERATION_RISK_LEVELS,
   ORCHESTRATOR_MODES: () => ORCHESTRATOR_MODES,
-  PLUGIN_HOOKS: () => PLUGIN_HOOKS,
-  PLUGIN_TYPES: () => PLUGIN_TYPES,
   SCHEDULE_LAST_STATUSES: () => SCHEDULE_LAST_STATUSES,
   SCHEDULE_TYPES: () => SCHEDULE_TYPES,
   TASK_PRIORITIES: () => TASK_PRIORITIES,
@@ -14108,7 +14356,6 @@ __export(schema_exports, {
   agentJobs: () => agentJobs,
   agentMcpServers: () => agentMcpServers,
   agentMemory: () => agentMemory,
-  agentPlugins: () => agentPlugins,
   agentSchedules: () => agentSchedules,
   agentSkillAssignments: () => agentSkillAssignments,
   agentSkills: () => agentSkills,
@@ -14121,7 +14368,6 @@ __export(schema_exports, {
   channelAllowedConversations: () => channelAllowedConversations,
   channelBindings: () => channelBindings,
   chatMessages: () => chatMessages,
-  configuratorSessions: () => configuratorSessions,
   connectors: () => connectors,
   conversations: () => conversations,
   credentials: () => credentials,
@@ -14131,7 +14377,6 @@ __export(schema_exports, {
   entitySettings: () => entitySettings,
   mcpConnections: () => mcpConnections,
   mcpServers: () => mcpServers,
-  rateLimits: () => rateLimits,
   sessions: () => sessions,
   skillConnectors: () => skillConnectors,
   skillVersions: () => skillVersions,
@@ -14161,7 +14406,6 @@ var init_schema2 = __esm({
     init_schedules();
     init_llm_keys();
     init_mcp();
-    init_misc();
     init_auth();
     init_agent_connector_assignments();
     init_agent_workspaces();