@agenticmail/enterprise 0.5.16 → 0.5.17

package/src/dashboard/pages/knowledge.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, Fragment, useApp, engineCall } from '../components/utils.js';
+import { h, useState, useEffect, Fragment, useApp, engineCall , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 
@@ -13,7 +13,7 @@ export function KnowledgeBasePage() {
 
   const create = async () => {
     try {
-      await engineCall('/knowledge-bases', { method: 'POST', body: JSON.stringify({ name: form.name, description: form.description, orgId: 'default' }) });
+      await engineCall('/knowledge-bases', { method: 'POST', body: JSON.stringify({ name: form.name, description: form.description, orgId: getOrgId() }) });
       toast('Knowledge base created', 'success');
       setCreating(false); setForm({ name: '', description: '' }); load();
     } catch (e) { toast(e.message, 'error'); }

package/src/dashboard/pages/messages.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useRef, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge } from '../components/utils.js';
+import { h, useState, useEffect, useRef, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 
 export function MessagesPage() {
@@ -9,19 +9,19 @@ export function MessagesPage() {
   const [mainTab, setMainTab] = useState('messages');
   const [subTab, setSubTab] = useState('all');
   const [showModal, setShowModal] = useState(false);
-  const [form, setForm] = useState({ orgId: 'default', fromAgentId: '', toAgentId: '', subject: '', content: '', priority: 'normal' });
+  const [form, setForm] = useState({ orgId: getOrgId(), fromAgentId: '', toAgentId: '', subject: '', content: '', priority: 'normal' });
   const [selectedNode, setSelectedNode] = useState(null);
   const [nodePositions, setNodePositions] = useState([]);
   const svgRef = useRef(null);
 
   const loadMessages = () => {
-    engineCall('/messages?orgId=default&limit=100').then(d => setMessages(d.messages || [])).catch(() => {});
+    engineCall('/messages?orgId=' + getOrgId() + '&limit=100').then(d => setMessages(d.messages || [])).catch(() => {});
   };
   const loadAgents = () => {
-    engineCall('/agents?orgId=default').then(d => setAgents(d.agents || [])).catch(() => {});
+    engineCall('/agents?orgId=' + getOrgId()).then(d => setAgents(d.agents || [])).catch(() => {});
   };
   const loadTopology = () => {
-    engineCall('/messages/topology?orgId=default').then(d => setTopology(d.topology || null)).catch(() => {});
+    engineCall('/messages/topology?orgId=' + getOrgId()).then(d => setTopology(d.topology || null)).catch(() => {});
   };
   useEffect(() => { loadMessages(); loadAgents(); loadTopology(); }, []);
 

package/src/dashboard/pages/settings.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, apiCall, engineCall, applyBrandColor, showConfirm } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, apiCall, engineCall, applyBrandColor, showConfirm , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 import { TagInput } from '../components/tag-input.js';
@@ -65,7 +65,7 @@ export function SettingsPage() {
         oidcClientId: sso.oidc?.clientId || '', oidcClientSecret: sso.oidc?.clientSecret || '', oidcDiscoveryUrl: sso.oidc?.discoveryUrl || '',
       }));
     }).catch(() => {});
-    engineCall('/deploy-credentials?orgId=default').then(d => setDeployCreds(d.credentials || [])).catch(() => {});
+    engineCall('/deploy-credentials?orgId=' + getOrgId()).then(d => setDeployCreds(d.credentials || [])).catch(() => {});
     apiCall('/settings/tool-security').then(d => {
       var cfg = d.toolSecurityConfig || {};
       setToolSec({
@@ -150,11 +150,11 @@ export function SettingsPage() {
 
   const createDeployCred = async () => {
     try {
-      await engineCall('/deploy-credentials', { method: 'POST', body: JSON.stringify({ orgId: 'default', name: deployForm.name, targetType: deployForm.targetType, config: deployForm.config }) });
+      await engineCall('/deploy-credentials', { method: 'POST', body: JSON.stringify({ orgId: getOrgId(), name: deployForm.name, targetType: deployForm.targetType, config: deployForm.config }) });
       toast('Credential created', 'success');
       setShowDeployModal(false);
       setDeployForm({ name: '', targetType: 'docker', config: {} });
-      engineCall('/deploy-credentials?orgId=default').then(d => setDeployCreds(d.credentials || [])).catch(() => {});
+      engineCall('/deploy-credentials?orgId=' + getOrgId()).then(d => setDeployCreds(d.credentials || [])).catch(() => {});
     } catch (e) { toast(e.message, 'error'); }
   };
 
@@ -639,7 +639,7 @@ function IntegrationsTab(props) {
 
   var loadStatuses = useCallback(function() {
     var promises = INTEGRATIONS.map(function(int) {
-      return engineCall('/oauth/status/' + int.skillId + '?orgId=default')
+      return engineCall('/oauth/status/' + int.skillId + '?orgId=' + getOrgId())
         .then(function(d) { return { skillId: int.skillId, connected: d.connected, expiresAt: d.expiresAt }; })
         .catch(function() { return { skillId: int.skillId, connected: false }; });
     });
@@ -660,7 +660,7 @@ function IntegrationsTab(props) {
       return;
     }
     setActionLoading(int.skillId);
-    engineCall('/oauth/authorize/' + int.skillId + '?orgId=default')
+    engineCall('/oauth/authorize/' + int.skillId + '?orgId=' + getOrgId())
       .then(function(d) {
         if (d.authorizationUrl) {
           var popup = window.open(d.authorizationUrl, 'oauth_connect', 'width=600,height=700,popup=yes');
@@ -688,7 +688,7 @@ function IntegrationsTab(props) {
       .then(function(ok) {
         if (!ok) return;
         setActionLoading(int.skillId);
-        engineCall('/oauth/disconnect/' + int.skillId + '?orgId=default', { method: 'DELETE' })
+        engineCall('/oauth/disconnect/' + int.skillId + '?orgId=' + getOrgId() + '', { method: 'DELETE' })
           .then(function() { toast(int.name + ' disconnected', 'success'); loadStatuses(); })
           .catch(function(e) { toast('Failed: ' + e.message, 'error'); })
           .finally(function() { setActionLoading(null); });
@@ -698,7 +698,7 @@ function IntegrationsTab(props) {
   var handleSaveToken = function() {
     if (!tokenModal || !tokenValue.trim()) return;
     setActionLoading(tokenModal.skillId);
-    engineCall('/oauth/authorize/' + tokenModal.skillId + '?orgId=default', {
+    engineCall('/oauth/authorize/' + tokenModal.skillId + '?orgId=' + getOrgId() + '', {
       method: 'POST',
       body: JSON.stringify({ token: tokenValue.trim() })
     })

package/src/dashboard/pages/skills.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 
@@ -52,7 +52,7 @@ export function SkillsPage() {
   // Load installed skills + statuses
   var loadInstalled = useCallback(function() {
     setInstalledLoading(true);
-    engineCall('/community/installed?orgId=default')
+    engineCall('/community/installed?orgId=' + getOrgId())
       .then(function(d) {
         var items = d.installed || [];
         setInstalled(items);
@@ -159,7 +159,7 @@ export function SkillsPage() {
     try {
       await engineCall('/community/skills/' + skillId + '/' + (enable ? 'enable' : 'disable'), {
         method: 'PUT',
-        body: JSON.stringify({ orgId: 'default' })
+        body: JSON.stringify({ orgId: getOrgId() })
       });
       toast('Skill ' + (enable ? 'enabled' : 'disabled'), 'success');
       loadInstalled();
@@ -177,7 +177,7 @@ export function SkillsPage() {
     try {
       await engineCall('/community/skills/' + skillId + '/uninstall', {
         method: 'DELETE',
-        body: JSON.stringify({ orgId: 'default' })
+        body: JSON.stringify({ orgId: getOrgId() })
       });
       toast('Skill uninstalled', 'success');
       loadInstalled();

package/src/dashboard/pages/vault.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { Modal } from '../components/modal.js';
 
@@ -63,7 +63,7 @@ export function VaultPage() {
   // Load secrets
   var loadSecrets = useCallback(function() {
     setLoading(true);
-    engineCall('/vault/secrets?orgId=default')
+    engineCall('/vault/secrets?orgId=' + getOrgId())
       .then(function(d) { setSecrets(d.secrets || d.entries || []); })
       .catch(function(e) { toast(e.message || 'Failed to load secrets', 'error'); })
       .finally(function() { setLoading(false); });
@@ -71,7 +71,7 @@ export function VaultPage() {
 
   var loadAudit = useCallback(function() {
     setAuditLoading(true);
-    engineCall('/vault/audit-log?orgId=default&limit=100')
+    engineCall('/vault/audit-log?orgId=' + getOrgId() + '&limit=100')
       .then(function(d) { setAuditLog(d.entries || d.log || []); })
       .catch(function(e) { toast(e.message || 'Failed to load audit log', 'error'); })
       .finally(function() { setAuditLoading(false); });
@@ -94,7 +94,7 @@ export function VaultPage() {
       await engineCall('/vault/secrets', {
         method: 'POST',
         body: JSON.stringify({
-          orgId: 'default',
+          orgId: getOrgId(),
           name: addForm.name,
           value: addForm.value,
           category: addForm.category
@@ -169,7 +169,7 @@ export function VaultPage() {
     try {
       var d = await engineCall('/vault/rotate-all', {
         method: 'POST',
-        body: JSON.stringify({ orgId: 'default' })
+        body: JSON.stringify({ orgId: getOrgId() })
       });
       toast('Rotated ' + (d.rotated || 0) + ' secrets', 'success');
       loadSecrets();

package/src/dashboard/pages/workforce.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge , getOrgId } from '../components/utils.js';
 import { I } from '../components/icons.js';
 
 export function WorkforcePage() {
@@ -42,7 +42,7 @@ export function WorkforcePage() {
       setSchedules(schedulesRes.schedules || []);
       setBudgetData(budgetRes);
       setClockRecords(recordsRes.records || []);
-      engineCall('/agents?orgId=default').then(d => setAgents(d.agents || [])).catch(() => {});
+      engineCall('/agents?orgId=' + getOrgId()).then(d => setAgents(d.agents || [])).catch(() => {});
     } catch (err) { toast('Failed to load workforce data', 'error'); }
     setLoading(false);
   };

package/src/engine/agent-memory.ts

@@ -16,6 +16,7 @@
 import type { EngineDatabase } from './db-adapter.js';
 import { MemorySearchIndex, tokenize } from '../lib/text-search.js';
 
+function sj(v: string|null|undefined, fb: any = {}): any { if(!v) return fb; try { return JSON.parse(v); } catch { return fb; } }
 // ─── Types ──────────────────────────────────────────────
 
 export type MemoryCategory =
@@ -702,8 +703,8 @@ export class AgentMemoryManager {
       accessCount: row.access_count || 0,
       lastAccessedAt: row.last_accessed_at || undefined,
       expiresAt: row.expires_at || undefined,
-      tags: JSON.parse(row.tags || '[]'),
-      metadata: JSON.parse(row.metadata || '{}'),
+      tags: sj(row.tags || '[]'),
+      metadata: sj(row.metadata || '{}'),
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };

package/src/engine/approvals.ts

@@ -103,6 +103,7 @@ export interface EscalationState {
 
 import type { EngineDatabase } from './db-adapter.js';
 
+function sj(v: string|null|undefined, fb: any = {}): any { if(!v) return fb; try { return JSON.parse(v); } catch { return fb; } }
 export class ApprovalEngine {
   private requests = new Map<string, ApprovalRequest>();
   private policies: ApprovalPolicy[] = [];
@@ -146,7 +147,7 @@ export class ApprovalEngine {
         for (const r of chains) {
           this.escalationChains.set(r.id, {
             id: r.id, orgId: r.org_id, name: r.name, description: r.description,
-            levels: JSON.parse(r.levels), fallbackAction: r.fallback_action,
+            levels: sj(r.levels), fallbackAction: r.fallback_action,
             enabled: !!r.enabled, createdAt: r.created_at, updatedAt: r.updated_at,
           });
         }

package/src/engine/communication.ts

@@ -25,6 +25,7 @@
 import type { EngineDatabase } from './db-adapter.js';
 import type { AgentLifecycleManager } from './lifecycle.js';
 
+function sj(v: string|null|undefined, fb: any = {}): any { if(!v) return fb; try { return JSON.parse(v); } catch { return fb; } }
 // ─── Types ──────────────────────────────────────────────
 
 export type MessageType = 'message' | 'task' | 'handoff' | 'broadcast';
@@ -217,7 +218,7 @@ export class AgentCommunicationBus {
       this.messages = rows.map((r: any) => ({
         id: r.id, orgId: r.org_id, fromAgentId: r.from_agent_id, toAgentId: r.to_agent_id,
         type: r.type, subject: r.subject, content: r.content,
-        metadata: r.metadata ? JSON.parse(r.metadata) : {},
+        metadata: r.metadata ? sj(r.metadata) : {},
         status: r.status, parentId: r.parent_id, priority: r.priority || 'normal',
         direction: r.direction || 'internal', channel: r.channel || 'direct',
         deadline: r.deadline, claimedAt: r.claimed_at, completedAt: r.completed_at,

package/src/engine/compliance.ts

@@ -11,6 +11,7 @@
 
 import type { EngineDatabase } from './db-adapter.js';
 
+function sj(v: string|null|undefined, fb: any = {}): any { if(!v) return fb; try { return JSON.parse(v); } catch { return fb; } }
 // ─── Types ──────────────────────────────────────────────
 
 export interface ComplianceReport {
@@ -47,8 +48,8 @@ export class ComplianceReporter {
       );
       this.reports = rows.map((r: any) => ({
         id: r.id, orgId: r.org_id, type: r.type, title: r.title,
-        parameters: r.parameters ? JSON.parse(r.parameters) : {},
-        status: r.status, data: r.data ? JSON.parse(r.data) : undefined,
+        parameters: r.parameters ? sj(r.parameters) : {},
+        status: r.status, data: r.data ? sj(r.data) : undefined,
         format: r.format || 'json', generatedBy: r.generated_by,
         error: r.error, createdAt: r.created_at, completedAt: r.completed_at,
       }));

package/src/engine/db-adapter.ts

@@ -8,6 +8,12 @@
  */
 
 import type { ManagedAgent, AgentState, StateTransition, AgentUsage, LifecycleEvent } from './lifecycle.js';
+
+/** Safe JSON parse — returns fallback on malformed data instead of throwing */
+function sj(val: string | null | undefined, fallback: any = {}): any {
+  if (!val) return fallback;
+  try { return JSON.parse(val); } catch { return fallback; }
+}
 import type { AgentPermissionProfile } from './skills.js';
 import type { Organization, OrgPlan } from './tenant.js';
 import type { ApprovalRequest, ApprovalPolicy } from './approvals.js';
@@ -292,12 +298,12 @@ export class EngineDatabase {
 
   async getPermissionProfile(id: string): Promise<AgentPermissionProfile | null> {
     const row = await this.db.get<any>('SELECT * FROM permission_profiles WHERE id = ?', [id]);
-    return row ? JSON.parse(row.config) : null;
+    return row ? sj(row.config) : null;
   }
 
   async getPermissionProfilesByOrg(orgId: string): Promise<AgentPermissionProfile[]> {
     const rows = await this.db.all<any>('SELECT config FROM permission_profiles WHERE org_id = ? ORDER BY name', [orgId]);
-    return rows.map(r => JSON.parse(r.config));
+    return rows.map(r => sj(r.config));
   }
 
   async deletePermissionProfile(id: string): Promise<void> {
@@ -365,8 +371,8 @@ export class EngineDatabase {
     if (!row) return null;
     const kb: any = {
       id: row.id, orgId: row.org_id, name: row.name, description: row.description,
-      agentIds: JSON.parse(row.agent_ids), config: JSON.parse(row.config),
-      stats: JSON.parse(row.stats), createdAt: row.created_at, updatedAt: row.updated_at,
+      agentIds: sj(row.agent_ids), config: sj(row.config),
+      stats: sj(row.stats), createdAt: row.created_at, updatedAt: row.updated_at,
       documents: [],
     };
     // Load documents
@@ -378,8 +384,8 @@ export class EngineDatabase {
     const rows = await this.db.all<any>('SELECT * FROM knowledge_bases WHERE org_id = ? ORDER BY name', [orgId]);
     return rows.map(r => ({
       id: r.id, orgId: r.org_id, name: r.name, description: r.description,
-      agentIds: JSON.parse(r.agent_ids), config: JSON.parse(r.config),
-      stats: JSON.parse(r.stats), createdAt: r.created_at, updatedAt: r.updated_at,
+      agentIds: sj(r.agent_ids), config: sj(r.config),
+      stats: sj(r.stats), createdAt: r.created_at, updatedAt: r.updated_at,
       documents: [], // Loaded on demand
     }));
   }
@@ -422,13 +428,13 @@ export class EngineDatabase {
       result.push({
         id: d.id, knowledgeBaseId: d.knowledge_base_id, name: d.name,
         sourceType: d.source_type, sourceUrl: d.source_url, mimeType: d.mime_type,
-        size: d.size, metadata: JSON.parse(d.metadata), status: d.status, error: d.error,
+        size: d.size, metadata: sj(d.metadata), status: d.status, error: d.error,
         createdAt: d.created_at, updatedAt: d.updated_at,
         chunks: chunks.map((c: any) => ({
           id: c.id, documentId: c.document_id, content: c.content,
           tokenCount: c.token_count, position: c.position,
           embedding: c.embedding ? Array.from(new Float32Array(c.embedding)) : undefined,
-          metadata: JSON.parse(c.metadata),
+          metadata: sj(c.metadata),
         })),
       });
     }
@@ -473,10 +479,10 @@ export class EngineDatabase {
     const rows = await this.db.all<any>(`SELECT * FROM tool_calls ${where} ORDER BY created_at DESC LIMIT ?`, params);
     return rows.map(r => ({
       id: r.id, agentId: r.agent_id, orgId: r.org_id, sessionId: r.session_id,
-      toolId: r.tool_id, toolName: r.tool_name, parameters: JSON.parse(r.parameters || '{}'),
-      result: r.result ? JSON.parse(r.result) : undefined,
-      timing: JSON.parse(r.timing), cost: r.cost ? JSON.parse(r.cost) : undefined,
-      permission: JSON.parse(r.permission),
+      toolId: r.tool_id, toolName: r.tool_name, parameters: sj(r.parameters || '{}'),
+      result: r.result ? sj(r.result) : undefined,
+      timing: sj(r.timing), cost: r.cost ? sj(r.cost) : undefined,
+      permission: sj(r.permission),
     }));
   }
 
@@ -501,7 +507,7 @@ export class EngineDatabase {
     const rows = await this.db.all<any>(`SELECT * FROM activity_events ${where} ORDER BY created_at DESC LIMIT ?`, params);
     return rows.map(r => ({
       id: r.id, agentId: r.agent_id, orgId: r.org_id, sessionId: r.session_id,
-      type: r.type, data: JSON.parse(r.data), timestamp: r.created_at,
+      type: r.type, data: sj(r.data), timestamp: r.created_at,
     }));
   }
 
@@ -526,7 +532,7 @@ export class EngineDatabase {
     return rows.map(r => ({
       id: r.id, agentId: r.agent_id, sessionId: r.session_id, role: r.role,
       content: r.content, channel: r.channel, tokenCount: r.token_count,
-      toolCalls: r.tool_calls ? JSON.parse(r.tool_calls) : undefined, timestamp: r.created_at,
+      toolCalls: r.tool_calls ? sj(r.tool_calls) : undefined, timestamp: r.created_at,
     }));
   }
 
@@ -564,9 +570,9 @@ export class EngineDatabase {
     return rows.map(r => ({
       id: r.id, agentId: r.agent_id, agentName: r.agent_name, toolId: r.tool_id,
       toolName: r.tool_name, reason: r.reason, riskLevel: r.risk_level,
-      sideEffects: JSON.parse(r.side_effects), parameters: r.parameters ? JSON.parse(r.parameters) : undefined,
+      sideEffects: sj(r.side_effects), parameters: r.parameters ? sj(r.parameters) : undefined,
       context: r.context, status: r.status,
-      decision: r.decision ? JSON.parse(r.decision) : undefined,
+      decision: r.decision ? sj(r.decision) : undefined,
       createdAt: r.created_at, expiresAt: r.expires_at,
     }));
   }
@@ -594,8 +600,8 @@ export class EngineDatabase {
     const rows = await this.db.all<any>('SELECT * FROM approval_policies WHERE org_id = ? ORDER BY name', [orgId]);
     return rows.map(r => ({
       id: r.id, name: r.name, description: r.description,
-      triggers: JSON.parse(r.triggers), approvers: JSON.parse(r.approvers),
-      timeout: JSON.parse(r.timeout), notify: JSON.parse(r.notify),
+      triggers: sj(r.triggers), approvers: sj(r.approvers),
+      timeout: sj(r.timeout), notify: sj(r.notify),
       enabled: !!r.enabled,
     }));
   }
@@ -604,8 +610,8 @@ export class EngineDatabase {
     const rows = await this.db.all<any>('SELECT * FROM approval_policies WHERE enabled = 1 ORDER BY name');
     return rows.map(r => ({
       id: r.id, name: r.name, description: r.description,
-      triggers: JSON.parse(r.triggers), approvers: JSON.parse(r.approvers),
-      timeout: JSON.parse(r.timeout), notify: JSON.parse(r.notify),
+      triggers: sj(r.triggers), approvers: sj(r.approvers),
+      timeout: sj(r.timeout), notify: sj(r.notify),
       enabled: !!r.enabled,
     }));
   }
@@ -657,7 +663,7 @@ export class EngineDatabase {
   private rowToSso(row: any) {
     return {
       id: row.id, orgId: row.org_id, providerType: row.provider_type,
-      name: row.name, enabled: !!row.enabled, config: JSON.parse(row.config),
+      name: row.name, enabled: !!row.enabled, config: sj(row.config),
       metadataUrl: row.metadata_url, createdAt: row.created_at, updatedAt: row.updated_at,
     };
   }
@@ -739,7 +745,7 @@ export class EngineDatabase {
   private rowToDeployCred(row: any) {
     return {
       id: row.id, orgId: row.org_id, name: row.name, targetType: row.target_type,
-      config: JSON.parse(row.config), createdBy: row.created_by,
+      config: sj(row.config), createdBy: row.created_by,
       createdAt: row.created_at, updatedAt: row.updated_at,
     };
   }
@@ -977,8 +983,8 @@ export class EngineDatabase {
       id: row.id, name: row.name, description: row.description, version: row.version,
       author: row.author, repository: row.repository, license: row.license,
       category: row.category, risk: row.risk, icon: row.icon,
-      tags: JSON.parse(row.tags || '[]'), tools: JSON.parse(row.tools || '[]'),
-      configSchema: JSON.parse(row.config_schema || '{}'),
+      tags: sj(row.tags || '[]'), tools: sj(row.tools || '[]'),
+      configSchema: sj(row.config_schema || '{}'),
       minEngineVersion: row.min_engine_version, homepage: row.homepage,
       downloads: row.downloads, rating: row.rating, ratingCount: row.rating_count,
       verified: !!row.verified, featured: !!row.featured,
@@ -989,7 +995,7 @@ export class EngineDatabase {
   private rowToInstalledSkill(row: any) {
     return {
       id: row.id, orgId: row.org_id, skillId: row.skill_id, version: row.version,
-      enabled: !!row.enabled, config: JSON.parse(row.config || '{}'),
+      enabled: !!row.enabled, config: sj(row.config || '{}'),
       installedBy: row.installed_by, installedAt: row.installed_at, updatedAt: row.updated_at,
     };
   }
@@ -998,11 +1004,11 @@ export class EngineDatabase {
     return {
       id: row.id,
       orgId: row.org_id,
-      config: JSON.parse(row.config),
+      config: sj(row.config),
       state: row.state,
       stateHistory: [], // Loaded separately via getStateHistory
-      health: JSON.parse(row.health || '{}'),
-      usage: JSON.parse(row.usage || '{}'),
+      health: sj(row.health || '{}'),
+      usage: sj(row.usage || '{}'),
       createdAt: row.created_at,
       updatedAt: row.updated_at,
       lastDeployedAt: row.last_deployed_at,
@@ -1017,12 +1023,12 @@ export class EngineDatabase {
       name: row.name,
       slug: row.slug,
       plan: row.plan as OrgPlan,
-      limits: JSON.parse(row.limits || '{}'),
-      usage: JSON.parse(row.usage || '{}'),
-      settings: JSON.parse(row.settings || '{}'),
-      ssoConfig: row.sso_config ? JSON.parse(row.sso_config) : undefined,
-      allowedDomains: JSON.parse(row.allowed_domains || '[]'),
-      billing: row.billing ? JSON.parse(row.billing) : undefined,
+      limits: sj(row.limits || '{}'),
+      usage: sj(row.usage || '{}'),
+      settings: sj(row.settings || '{}'),
+      ssoConfig: row.sso_config ? sj(row.sso_config) : undefined,
+      allowedDomains: sj(row.allowed_domains || '[]'),
+      billing: row.billing ? sj(row.billing) : undefined,
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };