pilotswarm-sdk 0.5.37 → 0.5.39

package/dist/session-manager.js

@@ -1,6 +1,7 @@
 import { CopilotClient } from "@github/copilot-sdk";
 import { ManagedSession } from "./managed-session.js";
 import { SESSION_STATE_MISSING_PREFIX } from "./types.js";
+import { applyReasoningEffortToProviderConfig } from "./model-providers.js";
 import { createFactTools } from "./facts-tools.js";
 import { createGraphTools } from "./graph-tools.js";
 import { createInspectTools, NO_VIEWER } from "./inspect-tools.js";
@@ -69,7 +70,51 @@ function isMissingDehydrateSnapshotError(error) {
     const message = error instanceof Error ? error.message : String(error ?? "");
     return /Session state directory not ready during dehydrate/i.test(message);
 }
-function buildEffectivePromptLayers(workerDefaults, config) {
+/** Key under which a package copy's per-agent config (MCP) is registered. */
+export function packageAgentKey(packageId, agentName) {
+    return `pkg\u0001${packageId}\u0001${agentName}`;
+}
+/** Owner key used to match a session owner against a package copy's owner. */
+export function agentOwnerKey(owner) {
+    return owner?.provider && owner?.subject ? `${owner.provider}\u0001${owner.subject}` : null;
+}
+/**
+ * Which copy of an agent name does THIS session get?
+ *
+ * Runs per turn, so enabling/disabling a copy re-resolves exactly like a
+ * republish does — live sessions follow the registry's current answer, they
+ * are not pinned to a copy.
+ *
+ * FAIL CLOSED, matching resolveAgentDefinitionForCaller: a user-scope copy is
+ * PRIVATE to its owner, and the worker holds every tenant's copies at once.
+ * The order is (1) the session owner's OWN user copy, (2) the best copy that
+ * is public by construction — a deployment agent or a shared package. A
+ * user-scope copy owned by someone ELSE is NEVER served, even when it is the
+ * only copy of the name left: returning it would leak that owner's prompt,
+ * MCP grants, and tool handlers into this session (they all follow the copy
+ * picked here). undefined means "no package overlay for this session" — the
+ * same outcome as the agent having been deleted, which is correct.
+ */
+export function pickAgentCopyForOwner(entry, ownerKey) {
+    if (!entry)
+        return undefined;
+    const copies = entry.copies?.length ? entry.copies : [entry];
+    if (ownerKey) {
+        const own = copies.find((copy) => copy.packageScope === "user" && agentOwnerKey(copy.packageOwner) === ownerKey);
+        if (own)
+            return own;
+    }
+    // The best PUBLIC copy, BY RANK not insertion order: a deployment agent
+    // (no packageScope) outranks a shared package, matching the worker's
+    // _finalizeAgentPromptLookup default. copies[] preserves load order, so
+    // picking by find() alone could hand back a shared package while a
+    // deployment agent of the same name exists — the two would disagree about
+    // which copy is the default. Never a foreign private copy, at any rank.
+    return copies.find((copy) => copy.packageScope == null)
+        ?? copies.find((copy) => copy.packageScope === "shared")
+        ?? undefined;
+}
+function buildEffectivePromptLayers(workerDefaults, config, sessionOwnerKey = null) {
     const boundAgentName = config.boundAgentName;
     const layerKind = config.promptLayering?.kind ?? (boundAgentName ? "app-agent" : undefined);
     const isPilotSwarmSystemAgent = layerKind === "pilotswarm-system-agent";
@@ -79,9 +124,9 @@ function buildEffectivePromptLayers(workerDefaults, config) {
     if (!isPilotSwarmSystemAgent && workerDefaults.appDefaultDescriptor)
         layers.push(workerDefaults.appDefaultDescriptor);
     if (boundAgentName) {
-        const agentDescriptor = workerDefaults.agentPromptLookup?.[boundAgentName]?.descriptor;
-        if (agentDescriptor)
-            layers.push(agentDescriptor);
+        const copy = pickAgentCopyForOwner(workerDefaults.agentPromptLookup?.[boundAgentName], sessionOwnerKey);
+        if (copy?.descriptor)
+            layers.push(copy.descriptor);
     }
     return layers;
 }
@@ -96,6 +141,78 @@ function buildEffectivePromptLayers(workerDefaults, config) {
  *
  * @internal
  */
+/**
+ * Capability declaration for a model the Copilot catalog does not know.
+ *
+ * Returns undefined when the catalog says nothing useful — an empty override
+ * is worse than none, since it would assert "no vision, no reasoning" rather
+ * than "unknown".
+ *
+ * @internal Exported for test/unit/byok-context-window.test.mjs only.
+ */
+export function buildByokModelCapabilities(descriptor, contextTier) {
+    if (!descriptor)
+        return undefined;
+    const supports = {};
+    if (Array.isArray(descriptor.supportedReasoningEfforts) && descriptor.supportedReasoningEfforts.length > 0) {
+        supports.reasoningEffort = true;
+    }
+    if (descriptor.vision)
+        supports.vision = true;
+    const limits = {};
+    const sizes = descriptor.contextWindowSizes;
+    if (sizes && typeof sizes === "object") {
+        // Prefer the session's tier, else the largest declared — the catalog
+        // is stating what the model can do, not what this turn will use.
+        const tierValue = contextTier ? sizes[contextTier] : undefined;
+        const window = Number.isFinite(tierValue)
+            ? Number(tierValue)
+            : Math.max(...Object.values(sizes).map((v) => Number(v)).filter((v) => Number.isFinite(v)), 0);
+        if (window > 0) {
+            limits.max_context_window_tokens = window;
+            // max_prompt_tokens is the one that actually does anything.
+            // Measured against @github/copilot-sdk 1.0.9 with kimi-k3, three
+            // arms, one message each, reading session.usage_info.tokenLimit:
+            //   max_context_window_tokens alone -> 128000 (the runtime default)
+            //   max_prompt_tokens alone         -> 1048576
+            //   both                            -> 1048576
+            // tokenLimit is what the child process divides by to decide when to
+            // compact, so without this line the declaration changes nothing and
+            // a 1M model still compacts at ~102K.
+            limits.max_prompt_tokens = window;
+        }
+    }
+    if (descriptor.vision && typeof descriptor.vision === "object") {
+        const v = {};
+        if (Number.isFinite(descriptor.vision.maxImages))
+            v.max_prompt_images = Number(descriptor.vision.maxImages);
+        if (Number.isFinite(descriptor.vision.maxImageBytes))
+            v.max_prompt_image_size = Number(descriptor.vision.maxImageBytes);
+        if (Array.isArray(descriptor.vision.supportedMediaTypes))
+            v.supported_media_types = descriptor.vision.supportedMediaTypes;
+        if (Object.keys(v).length > 0)
+            limits.vision = v;
+    }
+    // `limits` is the only part that does real work, so a supports-only block
+    // is dropped entirely.
+    //
+    // Declaring supports.reasoningEffort does NOT make the runtime send
+    // reasoning_effort for a BYOK provider — measured five ways, see the note
+    // at the sessionConfig call site. So a block carrying only `supports`
+    // buys nothing, while still overriding runtime state for every BYOK model
+    // in every deployment that has no contextWindowSizes in its catalog.
+    // Measured against waldemort's catalog: 8 of its 14 models declare
+    // supportedReasoningEfforts and no contextWindowSizes, so without this
+    // line they would each start receiving {supports:{reasoningEffort:true}}
+    // for no gain. A model that really can see gets limits.vision, so vision
+    // declarations still survive.
+    if (Object.keys(limits).length === 0)
+        return undefined;
+    return {
+        ...(Object.keys(supports).length > 0 ? { supports } : {}),
+        limits,
+    };
+}
 export class SessionManager {
     githubToken;
     /**
@@ -157,6 +274,10 @@ export class SessionManager {
     sessionConfigs = new Map();
     /** Worker-level tool registry — shared reference from PilotSwarmWorker. */
     toolRegistry = new Map();
+    /** Per-package tool maps, so a session prefers ITS package's handler on a name collision. */
+    packageToolRegistry = null;
+    /** Names registered by deployment code — a package tool must never shadow these. */
+    staticToolNames = null;
     /** Worker-level defaults for building blocks. */
     workerDefaults;
     /** Base directory for local session state files. */
@@ -264,9 +385,11 @@ export class SessionManager {
      */
     async getModelVisionInfo(modelRef, opts) {
         let sdkModelName = String(modelRef || "").trim();
+        // Hoisted out of the try: the declared-capability check below needs it.
+        let descriptor;
         try {
             const normalized = this.normalizeModelRef(modelRef || undefined);
-            const descriptor = this.workerDefaults.modelProviders?.getDescriptor(normalized);
+            descriptor = this.workerDefaults.modelProviders?.getDescriptor(normalized);
             if (descriptor?.modelName)
                 sdkModelName = descriptor.modelName;
             else if (normalized)
@@ -279,6 +402,28 @@ export class SessionManager {
         }
         if (!sdkModelName)
             return { modelId: "", known: false, vision: false };
+        // A DECLARED capability wins, and skips the catalog entirely.
+        //
+        // The catalog below is the Copilot model list. A BYOK model — Fireworks,
+        // a local vLLM — is never in it, so the lookup returns no entry, this
+        // function reports `vision: false`, and the attachment gate drops every
+        // image before its bytes are fetched. No amount of catalog querying can
+        // fix that; only the operator knows, and this is where they say so.
+        //
+        // Absent a declaration nothing changes: Copilot and Azure models keep
+        // resolving from the catalog exactly as before, and an unknown model
+        // still fails closed.
+        if (descriptor?.vision) {
+            const declared = descriptor.vision;
+            return {
+                modelId: sdkModelName,
+                known: true,
+                vision: true,
+                ...(Array.isArray(declared.supportedMediaTypes) ? { supportedMediaTypes: declared.supportedMediaTypes } : {}),
+                ...(Number.isFinite(declared.maxImages) ? { maxImages: Number(declared.maxImages) } : {}),
+                ...(Number.isFinite(declared.maxImageBytes) ? { maxImageBytes: Number(declared.maxImageBytes) } : {}),
+            };
+        }
         // Consult the catalog on the client that will serve this session's
         // turns. Prefer the recorded binding; on a cold worker the gate runs
         // before getOrCreate records one, so fall through to the same
@@ -340,9 +485,18 @@ export class SessionManager {
             ...(Number.isFinite(visionLimits?.max_prompt_image_size) ? { maxImageBytes: Number(visionLimits.max_prompt_image_size) } : {}),
         };
     }
-    /** Set the worker-level tool registry. Called by PilotSwarmWorker. */
-    setToolRegistry(registry) {
+    /**
+     * Set the worker-level tool registry. Called by PilotSwarmWorker.
+     *
+     * `opts.byPackage` carries each agent package's own tool map so a session
+     * bound to a package copy resolves colliding tool names to ITS copy's
+     * handler. `opts.staticNames` marks deployment-registered tools, which win
+     * every collision (a package must not shadow deployment code).
+     */
+    setToolRegistry(registry, opts) {
         this.toolRegistry = registry;
+        this.packageToolRegistry = opts?.byPackage ?? null;
+        this.staticToolNames = opts?.staticNames ?? null;
     }
     /** Set the cluster facts store for always-on facts tools. */
     setFactStore(factStore) {
@@ -848,9 +1002,25 @@ export class SessionManager {
         const effectiveSerializableConfig = inheritedToolNames.length > 0
             ? { ...serializableConfig, toolNames: inheritedToolNames }
             : serializableConfig;
+        // Which copy of the bound agent does this session get? Owner-aware:
+        // the session owner's own user-scope package copy shadows the shared
+        // one, the same rule the registry resolver applies at create time.
+        // Resolved once here; prompt, descriptor, MCP, and tool-handler picks
+        // below all follow the same copy so a session can never mix copies.
+        const boundAgentEntry = effectiveSerializableConfig.boundAgentName
+            ? this.workerDefaults.agentPromptLookup?.[effectiveSerializableConfig.boundAgentName]
+            : undefined;
+        // A PACKAGE agent (as opposed to a deployment/inline agent) carries a
+        // packageId on its entry or on any of its copies. This is load-bearing
+        // for MCP resolution: a package agent must never fall back to the
+        // bare-name MCP key, which another copy of a shadowed name also wrote.
+        const sessionOwnerKey = effectiveSerializableConfig.boundAgentName
+            ? await this._sessionAgentOwnerKey(sessionId)
+            : null;
+        const boundAgentCopy = pickAgentCopyForOwner(boundAgentEntry, sessionOwnerKey);
         // Resolve tools: merge per-session (setConfig) + registry (toolNames)
         const storedConfig = this.sessionConfigs.get(sessionId);
-        const resolvedTools = this._resolveTools(storedConfig, effectiveSerializableConfig);
+        const resolvedTools = this._resolveTools(storedConfig, effectiveSerializableConfig, boundAgentCopy?.packageId);
         const config = {
             ...storedConfig,
             ...effectiveSerializableConfig,
@@ -900,16 +1070,32 @@ export class SessionManager {
         const registry = this.workerDefaults.modelProviders;
         const effectiveModel = this.normalizeModelRef(config.model) || "";
         const resolvedProvider = registry?.resolve(effectiveModel);
-        const resolvedProviderConfig = this._resolveProviderConfig(effectiveModel);
-        let sdkModelName = effectiveModel;
-        let modelDescriptor;
-        if (registry && effectiveModel) {
-            const desc = registry.getDescriptor(effectiveModel);
-            if (desc) {
-                sdkModelName = desc.modelName;
-                modelDescriptor = desc;
+        const baseProviderConfig = this._resolveProviderConfig(effectiveModel);
+        const sdkModelName = effectiveModel && registry?.getDescriptor(effectiveModel)?.modelName
+            ? registry.getDescriptor(effectiveModel).modelName
+            : effectiveModel;
+        const modelDescriptor = registry && effectiveModel
+            ? registry.getDescriptor(effectiveModel)
+            : undefined;
+        // `config.reasoningEffort` is passed to the SDK on its own below, and
+        // for provider `type: github` that is what works. For a provider
+        // declared `type: openai-proxy` the `@github/copilot` child process
+        // drops it before the HTTP request is built, so it rides in the
+        // provider baseUrl as a path prefix and the proxy at that baseUrl
+        // strips it back off. Every other provider type is untouched, and a
+        // session with no effort set is untouched.
+        //
+        // It used to ride in the model NAME. @github/copilot 1.0.79 parses
+        // `model:key=value` as its own model-options syntax and rejects
+        // unknown keys, so every such turn failed with
+        // "Unknown model option key: effort". See
+        // applyReasoningEffortToProviderConfig for the measurements.
+        const resolvedProviderConfig = baseProviderConfig.provider
+            ? {
+                ...baseProviderConfig,
+                provider: applyReasoningEffortToProviderConfig(baseProviderConfig.provider, modelDescriptor, config.reasoningEffort),
             }
-        }
+            : baseProviderConfig;
         // Context-window tier: only models whose catalog entry declares
         // supportedContextTiers get the field at all. An explicit valid tier
         // wins; otherwise fall back to the catalog default ("default" — the
@@ -921,6 +1107,12 @@ export class SessionManager {
                 ? config.contextTier
                 : (modelDescriptor?.defaultContextTier ?? "default"))
             : undefined;
+        // Built from the deployment's own catalog — the only place that knows
+        // anything about a BYOK model. Deliberately AFTER the tier resolution
+        // above: the declared window must match the tier this session actually
+        // runs at, and before normalization config.contextTier can still be
+        // unset or stale. See the modelCapabilities note at the config object.
+        const byokModelCapabilities = buildByokModelCapabilities(modelDescriptor, config.contextTier);
         // Resolve the per-user GitHub Copilot token only when a catalog
         // is wired in. Skipping the await on the no-catalog path matters
         // for the SessionManager unit tests that exercise lock ordering
@@ -963,7 +1155,7 @@ export class SessionManager {
         // whole purpose is to change agents — so the strip applies only to the
         // legacy id, and dies with it.
         const isTunerSession = effectiveSerializableConfig.agentIdentity === "agent-tuner";
-        const mutatingSystemToolNames = new Set(["send_session_message", "reply_session_message", "draw_canvas",
+        const mutatingSystemToolNames = new Set(["send_session_message", "reply_session_message", "draw_canvas", "show_canvas",
             "update_canvas"]);
         const userTools = config.tools ?? [];
         // Canvas tools are ROOT-only, and THIS is the declaration half of that
@@ -975,11 +1167,10 @@ export class SessionManager {
         // dropped by the CLI (no handler, no response, turn hangs), which is
         // strictly worse than an error. Fail open on an unreadable row: the
         // per-turn handler still refuses with a clear message.
-        const canvasToolNames = new Set(["draw_canvas", "update_canvas", "read_canvas"]);
-        const isChildSession = Boolean(catalogRow?.parentSessionId);
+        // Canvas tools are declared for EVERY session now — sub-agents draw
+        // their own canvases (slots 1-5), independent of the parent's.
         const systemTools = ManagedSession.systemToolDefs()
-            .filter((tool) => !isTunerSession || !mutatingSystemToolNames.has(tool.name))
-            .filter((tool) => !isChildSession || !canvasToolNames.has(tool.name));
+            .filter((tool) => !isTunerSession || !mutatingSystemToolNames.has(tool.name));
         const readOnlyTunerSubAgentToolNames = new Set(["check_agents", "list_sessions"]);
         const subAgentTools = ManagedSession.subAgentToolDefs()
             .filter((tool) => !isTunerSession || readOnlyTunerSubAgentToolNames.has(tool.name));
@@ -1108,15 +1299,31 @@ export class SessionManager {
         ];
         config.tools = persistentSessionTools;
         // Build system message: worker base + client override
-        const systemMessage = this._buildSystemMessage(sessionId, config);
+        const systemMessage = this._buildSystemMessage(sessionId, config, sessionOwnerKey);
         // Per-agent MCP (capability-profiles Phase 1): a session gets the
         // base map (base-agent opt-ins + direct worker-config servers) plus
         // its bound agent's resolved server map — resolved worker-side at the
         // same chokepoint as the agent prompt. The deployment catalog is
         // never applied wholesale.
-        const boundAgentMcpServers = effectiveSerializableConfig.boundAgentName
-            ? this.workerDefaults.agentMcpServers?.[effectiveSerializableConfig.boundAgentName]
-            : undefined;
+        //
+        // Read the MCP map of the copy THIS session actually resolved to.
+        // The worker registers a package agent's MCP under a package-qualified
+        // key only, and reserves the bare name for deployment/inline agents —
+        // so the resolved copy's own packageId is the discriminator:
+        //   • package copy resolved  → its qualified key (never the bare name,
+        //     which another copy of a shadowed name could have written);
+        //   • deployment/inline copy → the bare name (its own MCP);
+        //   • no copy resolved (a foreign-private-only name) → no grants.
+        // Keying off `boundAgentCopy.packageId` rather than "is any copy a
+        // package" is load-bearing: when a deployment agent and a package
+        // share a name and this session resolved the DEPLOYMENT copy, it must
+        // still get the deployment agent's bare-key MCP, not an empty
+        // qualified lookup.
+        const boundAgentMcpServers = !effectiveSerializableConfig.boundAgentName || !boundAgentCopy
+            ? undefined
+            : boundAgentCopy.packageId
+                ? this.workerDefaults.agentMcpServers?.[packageAgentKey(boundAgentCopy.packageId, effectiveSerializableConfig.boundAgentName)]
+                : this.workerDefaults.agentMcpServers?.[effectiveSerializableConfig.boundAgentName];
         const effectiveMcpServers = {
             ...(this.workerDefaults.baseMcpServers ?? {}),
             ...(boundAgentMcpServers ?? {}),
@@ -1130,6 +1337,28 @@ export class SessionManager {
             // tool-pinning.ts for the why and the phase-2 opt-out path.
             tools: pinToolsNeverDefer(allTools),
             model: sdkModelName,
+            // Tell the runtime what a BYOK model can do.
+            //
+            // A model outside the Copilot catalog has no capabilities, so the
+            // runtime falls back to defaults — including a 128000 token limit
+            // that makes a 1M-window model compact roughly 8x too early.
+            // Declaring limits.max_prompt_tokens here fixes that; the reported
+            // tokenLimit becomes the real window. Measured, see
+            // buildByokModelCapabilities.
+            //
+            // It does NOT fix reasoning effort. Declaring
+            // supports.reasoningEffort = true still does not put
+            // `reasoning_effort` on the outgoing request for a BYOK provider —
+            // verified on the multi-provider `providers`/`models` surface, with
+            // enableConfigDiscovery on, and via the runtime's own
+            // `model:defaultReasoningEffort=high` option. That is why
+            // applyReasoningEffortToProviderConfig still exists.
+            //
+            // Only for non-github providers: Copilot models have real catalog
+            // data and must not be overridden by our guesses.
+            ...(resolvedProviderConfig.provider && byokModelCapabilities
+                ? { modelCapabilities: byokModelCapabilities }
+                : {}),
             ...(config.reasoningEffort ? { reasoningEffort: config.reasoningEffort } : {}),
             ...(config.contextTier ? { contextTier: config.contextTier } : {}),
             systemMessage: systemMessage
@@ -1593,12 +1822,23 @@ export class SessionManager {
     /**
      * Resolve tools from per-session config + worker-level registry.
      * Per-session tools take precedence over registry tools with the same name.
+     *
+     * `preferredPackageId` is the package copy this session's bound agent
+     * resolved to. On a tool-name collision between two enabled packages
+     * (scope shadowing publishes the same tool name twice), the session gets
+     * ITS copy's handler instead of whichever package loaded last. Deployment
+     * (static) tools still win every collision.
      */
-    _resolveTools(storedConfig, serializableConfig) {
+    _resolveTools(storedConfig, serializableConfig, preferredPackageId) {
         const registryTools = [];
+        const packageTools = preferredPackageId
+            ? this.packageToolRegistry?.get(preferredPackageId)
+            : undefined;
         if (serializableConfig.toolNames?.length) {
             for (const name of serializableConfig.toolNames) {
-                const tool = this.toolRegistry.get(name);
+                const tool = (this.staticToolNames?.has(name) ? this.toolRegistry.get(name) : undefined)
+                    ?? packageTools?.get(name)
+                    ?? this.toolRegistry.get(name);
                 if (tool)
                     registryTools.push(tool);
             }
@@ -1702,8 +1942,12 @@ export class SessionManager {
             action: async (currentContent) => {
                 const latest = this.sessionConfigs.get(sessionId) ?? initialConfig;
                 const runtimeContext = extractPromptContent(latest.systemMessage);
+                // Owner-aware copy pick, re-resolved here because this action
+                // runs per compose: with scope shadowing one agent name can be
+                // served by several packages, and this session must get the
+                // copy its OWNER resolves to — not whichever loaded last.
                 const activeAgentPrompt = latest.boundAgentName
-                    ? this.workerDefaults.agentPromptLookup?.[latest.boundAgentName]?.prompt
+                    ? pickAgentCopyForOwner(this.workerDefaults.agentPromptLookup?.[latest.boundAgentName], await this._sessionAgentOwnerKey(sessionId))?.prompt
                     : undefined;
                 const overlay = mergePromptSections([
                     activeAgentPrompt,
@@ -1714,6 +1958,23 @@ export class SessionManager {
             },
         };
     }
+    /**
+     * The session owner's identity key for agent-copy shadowing, or null when
+     * the session is ownerless/system or the owner is unreadable (fail-safe:
+     * no key means no user-scope copy applies, never the wrong one).
+     * Rides the inspect-viewer TTL cache — one CMS read per session per TTL.
+     */
+    async _sessionAgentOwnerKey(sessionId) {
+        try {
+            const viewer = await this._resolveInspectViewer(sessionId);
+            if (!viewer?.provider || !viewer?.subject || viewer.isSystemPrincipal)
+                return null;
+            return agentOwnerKey({ provider: viewer.provider, subject: viewer.subject });
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Who the inspect tools act as, for one session.
      *
@@ -1814,7 +2075,7 @@ export class SessionManager {
             return false;
         }
     }
-    _buildSystemMessage(sessionId, config) {
+    _buildSystemMessage(sessionId, config, sessionOwnerKey = null) {
         const frameworkBase = this.workerDefaults.frameworkBasePrompt ?? this.workerDefaults.systemMessage;
         const boundAgentName = config.boundAgentName;
         const layerKind = config.promptLayering?.kind ?? (boundAgentName ? "app-agent" : undefined);
@@ -1824,7 +2085,7 @@ export class SessionManager {
             ? { tool_instructions: knowledgeToolInstructions, last_instructions: lastInstructions }
             : { last_instructions: lastInstructions };
         const isPilotSwarmSystemAgent = layerKind === "pilotswarm-system-agent";
-        const layerManifest = buildEffectivePromptLayers(this.workerDefaults, config);
+        const layerManifest = buildEffectivePromptLayers(this.workerDefaults, config, sessionOwnerKey);
         return composeStructuredSystemMessage({
             frameworkBase,
             appDefault: isPilotSwarmSystemAgent