@desplega.ai/agent-swarm 1.103.0 → 1.104.0

package/README.md

@@ -123,10 +123,12 @@ Check [our templates](https://templates.agent-swarm.dev) for a quick start.
 
 - **Lead/worker orchestration in Docker** — isolated dev environments, priority queues, pause/resume across deploys. [Architecture →](https://docs.agent-swarm.dev/docs/architecture/overview)
 - **Compounding memory & persistent identity** — agents remember past sessions and evolve their own persona, expertise, and notes. [Memory →](https://docs.agent-swarm.dev/docs/architecture/memory) · [Agents →](https://docs.agent-swarm.dev/docs/architecture/agents)
+- **Hybrid memory recall + in-place edits** — memory retrieval can blend vector and full-text ranking, and agents can correct an existing memory without losing its ID or history. [Memory →](https://docs.agent-swarm.dev/docs/architecture/memory) · [MCP tools →](https://docs.agent-swarm.dev/docs/reference/mcp-tools#memory-tools)
 - **Multi-channel inputs** — Slack, GitHub, GitLab, email, WhatsApp, Linear, Jira, and the HTTP API all create tasks. [Integrations](#integrations)
 - **Workflow engine with Human-in-the-Loop** — DAG-based automation with approval gates, retries, and structured I/O. [Workflows →](https://docs.agent-swarm.dev/docs/concepts/workflows)
 - **Scheduled & recurring tasks** — cron-based automation for standing work. [Scheduling →](https://docs.agent-swarm.dev/docs/concepts/scheduling)
 - **Durable script workflows** — launch background script runs, inspect their journals, and track them from the dashboard when a one-shot `script-run` is too small. [Guide →](https://docs.agent-swarm.dev/docs/guides/script-workflow-runs)
+- **Typed script API connections** — lead-managed OpenAPI connections let scripts call approved external APIs through generated `ctx.api.*` clients while credential bindings keep raw secrets out of source and args. [Guide →](https://docs.agent-swarm.dev/docs/guides/scripts-credential-broker)
 - **E2B-backed eval harness** — run a scenario × harness-config matrix against real swarm stacks, capture transcripts/artifacts, and grade outcomes with deterministic checks plus LLM or agentic judges. [Guide →](https://docs.agent-swarm.dev/docs/guides/evals-harness)
 - **Harness & LLM agnostic** — run with Claude Code, Claude Bridge, OpenAI Codex, pi-mono (Anthropic, OpenRouter, or Amazon Bedrock), Devin, Claude Managed Agents, raw LLMs, or opencode. Tasks, schedules, and workflow agent-task nodes can use portable `modelTier` intent (`smol`, `regular`, `smart`, `ultra`) and resolve it per worker/provider at run time. [Harness config →](https://docs.agent-swarm.dev/docs/guides/harness-configuration) · [Add a new provider →](https://docs.agent-swarm.dev/docs/guides/harness-providers)
 - **Follow-up continuity across all harnesses** — child tasks inherit a bounded prior-task context preamble built from the task chain, so continuity survives restarts and works the same across every provider. [Task lifecycle →](https://docs.agent-swarm.dev/docs/concepts/task-lifecycle)

package/dist/{actions-7txktrdj.js → actions-2expzt47.js}

@@ -1,8 +1,8 @@
 import {
   resolveSlackUserId
-} from "./cli-rvae030h.js";
-import"./cli-2qynerth.js";
-import"./cli-yfwwjeft.js";
+} from "./cli-2hap19dv.js";
+import"./cli-gj2n2ec1.js";
+import"./cli-yvektv79.js";
 import {
   buildCancelledBlocks,
   getTaskLink
@@ -11,18 +11,18 @@ import"./cli-dh55d5fg.js";
 import {
   createTaskWithSiblingAwareness,
   slackContextKey
-} from "./cli-jt9d9fjw.js";
+} from "./cli-e7bwjntj.js";
 import {
   cancelTask,
   getAgentById,
   getLeadAgent,
   getTaskById,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import"./cli-3pp1362w.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{app-xm3xsdye.js → app-dr8hwx7z.js}

@@ -3,16 +3,16 @@ import {
   initSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-kk51f3tf.js";
+} from "./cli-zaxksbgj.js";
 import"./cli-fete3y1e.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-z92pkwzn.js";
 import"./cli-dh55d5fg.js";
-import"./cli-fedn86nz.js";
+import"./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import"./cli-3pp1362w.js";
 import"./cli-e15jhafb.js";
 import"./cli-p9swy5t3.js";

package/dist/{assistant-qpv63wk6.js → assistant-9rhgsw7v.js}

@@ -1,27 +1,26 @@
 import {
   bufferThreadMessage,
   wasEventSeen
-} from "./cli-s14sb64w.js";
+} from "./cli-etvgz5x8.js";
 import {
   hasOtherUserMention
-} from "./cli-dz3d6zjg.js";
-import"./cli-2deg0cen.js";
+} from "./cli-nzc0h54v.js";
 import {
   require_dist
-} from "./cli-kk51f3tf.js";
+} from "./cli-zaxksbgj.js";
 import"./cli-fete3y1e.js";
 import"./cli-b0p7rfnd.js";
 import {
   resolveSlackUserId
-} from "./cli-rvae030h.js";
-import"./cli-2qynerth.js";
-import"./cli-yfwwjeft.js";
+} from "./cli-2hap19dv.js";
+import"./cli-gj2n2ec1.js";
+import"./cli-yvektv79.js";
 import"./cli-z92pkwzn.js";
 import"./cli-dh55d5fg.js";
 import {
   createTaskWithSiblingAwareness,
   slackContextKey
-} from "./cli-jt9d9fjw.js";
+} from "./cli-e7bwjntj.js";
 import {
   getAgentWorkingOnThread,
   getLeadAgent,
@@ -29,11 +28,11 @@ import {
   init_db,
   init_resolver,
   resolveTemplate
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import"./cli-3pp1362w.js";
 import"./cli-e15jhafb.js";
 import {

package/dist/{boot-reembed-chxhrwv8.js → boot-reembed-3q1aywnz.js}

@@ -1,16 +1,17 @@
 import {
   embedScript,
   embeddingProvider
-} from "./cli-fygaw191.js";
-import"./cli-8w95v19d.js";
+} from "./cli-5pf0b84v.js";
+import"./cli-p4cj4vhc.js";
+import"./cli-3j01d33e.js";
 import {
   getDb,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import"./cli-3pp1362w.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{boot-reembed-9cxqka3e.js → boot-reembed-9kt97g1z.js}

@@ -3,15 +3,16 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   init_constants
-} from "./cli-8w95v19d.js";
+} from "./cli-p4cj4vhc.js";
+import"./cli-3j01d33e.js";
 import {
   getDb,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import"./cli-3pp1362w.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{boot-scrub-logs-8qtfkcz8.js → boot-scrub-logs-vskq108e.js}

@@ -1,11 +1,11 @@
 import {
   getDb,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import"./cli-z2zcxes1.js";
 import"./cli-q21d49ac.js";
 import"./cli-anrj584m.js";
-import"./cli-85pf4z38.js";
+import"./cli-yjt8a36k.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-fedn86nz.js → cli-0jw6j755.js}

@@ -25,7 +25,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-85pf4z38.js";
+} from "./cli-yjt8a36k.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -990,7 +990,8 @@ var init_types = __esm(() => {
     "system.boot",
     "system.migration",
     "system.error",
-    "script.global_upsert"
+    "script.global_upsert",
+    "schedule.deleted"
   ]);
   SwarmEventSchema = object({
     id: uuid(),
@@ -1086,6 +1087,7 @@ var init_types = __esm(() => {
     id: string().uuid(),
     agentId: string().uuid().nullable(),
     scope: AgentMemoryScopeSchema,
+    key: string().nullable().optional(),
     name: string().min(1).max(500),
     content: string(),
     summary: string().nullable(),
@@ -1096,10 +1098,13 @@ var init_types = __esm(() => {
     totalChunks: number().int().min(1).default(1),
     tags: array(string()),
     createdAt: string(),
+    updatedAt: string().nullable().optional(),
     accessedAt: string(),
     expiresAt: string().nullable().optional(),
     accessCount: number().int().min(0).default(0).optional(),
-    embeddingModel: string().nullable().optional()
+    embeddingModel: string().nullable().optional(),
+    contentHash: string().nullable().optional(),
+    version: number().int().min(1).default(1).optional()
   });
   ActiveSessionSchema = object({
     id: uuid(),

package/dist/{cli-yeemwevj.js → cli-23zk7xqy.js}

@@ -1,9 +1,3 @@
-import {
-  contentSha256,
-  resolveClaudeMdPath,
-  syncProfileFilesToServer,
-  writeIdentityBaselines
-} from "./cli-wjyyv518.js";
 import {
   authJsonToCredentialSelection,
   checkCodexCredentials,
@@ -29,7 +23,7 @@ import {
   withSpan,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-2307phk1.js";
+} from "./cli-qvzgncd8.js";
 import {
   checkClaudeCredentials
 } from "./cli-p04j6hjv.js";
@@ -46,13 +40,20 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import {
+  contentSha256,
+  init_profile_sync,
+  resolveClaudeMdPath,
+  syncProfileFilesToServer,
+  writeIdentityBaselines
+} from "./cli-3j01d33e.js";
 import {
   ensure,
   initialize
-} from "./cli-ns0r7mkr.js";
+} from "./cli-y9p3e94h.js";
 import {
   validateJsonSchema
-} from "./cli-rttgde5f.js";
+} from "./cli-zghef0em.js";
 import {
   getMcpBaseUrl
 } from "./cli-dh55d5fg.js";
@@ -75,7 +76,7 @@ import {
   resolveTaskModelSelection,
   resolveTemplateAsync,
   telemetry
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import {
   init_credentials,
   resolveCredentialPools
@@ -1463,6 +1464,9 @@ async function awaitCredentials(opts) {
   return status;
 }
 
+// src/commands/runner.ts
+init_profile_sync();
+
 // src/commands/resume-session.ts
 var RESUME_DEPRECATED_REASON = "native resume deprecated — using context preamble";
 function resolveResumeSession(_currentProvider, candidates) {
@@ -1539,7 +1543,7 @@ async function readClaudeMd(clonePath, role) {
 }
 async function listSwarmAutostashes(clonePath, role) {
   try {
-    const result = await Bun.$`cd ${clonePath} && git stash list --format=%gd%x09%s`.quiet();
+    const result = await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} stash list --format=%gd%x09%s`.quiet();
     return result.text().split(`
 `).map((line) => line.trim()).filter((line) => line.includes("swarm-autostash")).flatMap((line) => {
       const [ref, ...messageParts] = line.split("\t");
@@ -1554,14 +1558,14 @@ async function listSwarmAutostashes(clonePath, role) {
 }
 async function refreshExistingRepoForTask(repoConfig, role) {
   const { name, clonePath, defaultBranch } = repoConfig;
-  const statusResult = await Bun.$`cd ${clonePath} && git status --porcelain`.quiet();
+  const statusResult = await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} status --porcelain`.quiet();
   const statusOutput = statusResult.text().trim();
   let stashMessage = null;
   if (statusOutput !== "") {
     stashMessage = `swarm-autostash ${defaultBranch} ${new Date().toISOString()}`;
     try {
       console.log(`[${role}] Auto-stashing pending work in ${name}: ${stashMessage}`);
-      await Bun.$`cd ${clonePath} && git stash push --include-untracked -m ${stashMessage}`.quiet();
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} stash push --include-untracked -m ${stashMessage}`.quiet();
       console.log(`[${role}] Auto-stashed pending work in ${name}`);
     } catch (err) {
       const errorMsg = scrubSecrets(err.message);
@@ -1573,15 +1577,15 @@ async function refreshExistingRepoForTask(repoConfig, role) {
     console.log(`[${role}] Refreshing ${name} from origin/${defaultBranch}...`);
     const fetchSpec = `${defaultBranch}:refs/remotes/origin/${defaultBranch}`;
     const remoteRef = `refs/remotes/origin/${defaultBranch}`;
-    await Bun.$`cd ${clonePath} && git fetch origin ${fetchSpec}`.quiet();
-    await Bun.$`cd ${clonePath} && git merge --no-edit --no-stat ${remoteRef}`.quiet();
+    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} fetch origin ${fetchSpec}`.quiet();
+    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --no-edit --no-stat ${remoteRef}`.quiet();
     console.log(`[${role}] Refreshed ${name}`);
     return null;
   } catch (err) {
     const errorMsg = scrubSecrets(err.message);
     console.warn(`[${role}] Could not refresh ${name}: ${errorMsg}`);
     try {
-      await Bun.$`cd ${clonePath} && git merge --abort`.quiet();
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --abort`.quiet();
     } catch {}
     const stashNote = stashMessage ? ` Pending work was preserved in git stash "${stashMessage}".` : "";
     return `The repo "${name}" at ${clonePath} could not be refreshed from origin/${defaultBranch}: ${errorMsg}.${stashNote}`;

package/dist/{cli-v9283nma.js → cli-2g9jf9ek.js}

@@ -3,7 +3,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 
 // src/be/db-queries/oauth.ts
 init_date_utils();

package/dist/{cli-rvae030h.js → cli-2hap19dv.js}

@@ -1,16 +1,16 @@
 import {
   recordUnmappedIdentity
-} from "./cli-2qynerth.js";
+} from "./cli-gj2n2ec1.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
   linkIdentity
-} from "./cli-yfwwjeft.js";
+} from "./cli-yvektv79.js";
 import {
   getKv,
   init_db,
   upsertKv
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 
 // src/slack/enrich.ts
 init_db();

package/dist/{cli-wjyyv518.js → cli-3j01d33e.js}

@@ -2,15 +2,11 @@ import {
   init_secret_scrubber,
   scrubSecrets
 } from "./cli-3pp1362w.js";
+import {
+  __esm
+} from "./cli-p9swy5t3.js";
 
 // src/commands/profile-sync.ts
-init_secret_scrubber();
-var SOUL_MD_PATH = "/workspace/SOUL.md";
-var IDENTITY_MD_PATH = "/workspace/IDENTITY.md";
-var TOOLS_MD_PATH = "/workspace/TOOLS.md";
-var HEARTBEAT_MD_PATH = "/workspace/HEARTBEAT.md";
-var SETUP_SCRIPT_PATH = "/workspace/start-up.sh";
-var IDENTITY_BASELINES_PATH = "/tmp/identity-baselines.json";
 function contentSha256(content) {
   return new Bun.CryptoHasher("sha256").update(content).digest("hex");
 }
@@ -27,12 +23,6 @@ async function readIdentityBaselines(readFile = readFileIfExists) {
     return null;
   }
 }
-var CLAUDE_MD_PATH = `${process.env.HOME}/.claude/CLAUDE.md`;
-var WORKSPACE_CLAUDE_MD_PATH = "/workspace/CLAUDE.md";
-var IDENTITY_FILE_MIN_LENGTH = 500;
-var MAX_FILE_LENGTH = 65536;
-var SETUP_MARKER_START = "# === Agent-managed setup (from DB) ===";
-var SETUP_MARKER_END = "# === End agent-managed setup ===";
 function resolveClaudeMdPath(completedProviders) {
   const anyNonClaude = completedProviders.some((p) => p !== "claude");
   return anyNonClaude ? WORKSPACE_CLAUDE_MD_PATH : CLAUDE_MD_PATH;
@@ -163,5 +153,10 @@ async function syncProfileFilesToServer(opts) {
     await postProfileUpdate(opts, payload);
   }
 }
+var SOUL_MD_PATH = "/workspace/SOUL.md", IDENTITY_MD_PATH = "/workspace/IDENTITY.md", TOOLS_MD_PATH = "/workspace/TOOLS.md", HEARTBEAT_MD_PATH = "/workspace/HEARTBEAT.md", SETUP_SCRIPT_PATH = "/workspace/start-up.sh", IDENTITY_BASELINES_PATH = "/tmp/identity-baselines.json", CLAUDE_MD_PATH, WORKSPACE_CLAUDE_MD_PATH = "/workspace/CLAUDE.md", IDENTITY_FILE_MIN_LENGTH = 500, MAX_FILE_LENGTH = 65536, SETUP_MARKER_START = "# === Agent-managed setup (from DB) ===", SETUP_MARKER_END = "# === End agent-managed setup ===";
+var init_profile_sync = __esm(() => {
+  init_secret_scrubber();
+  CLAUDE_MD_PATH = `${process.env.HOME}/.claude/CLAUDE.md`;
+});
 
-export { contentSha256, writeIdentityBaselines, readIdentityBaselines, resolveClaudeMdPath, syncProfileFilesToServer };
+export { contentSha256, writeIdentityBaselines, readIdentityBaselines, resolveClaudeMdPath, syncProfileFilesToServer, init_profile_sync };

package/dist/{cli-8hyv6c2v.js → cli-54h5daha.js}

@@ -2,10 +2,14 @@ import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
+  CredentialBroker,
+  DEFAULT_CREDENTIAL_BINDINGS,
+  SwarmConfigCredentialBindingStore,
   getScript,
   getScriptVersion,
+  listRelationalCredentialBindings,
   validateScriptImports
-} from "./cli-gzepjz54.js";
+} from "./cli-v1syqkcb.js";
 import {
   checkpointStep,
   checkpointStepFailure,
@@ -15,14 +19,14 @@ import {
   interpolateNodeConfig,
   runStepValidation,
   walkGraph
-} from "./cli-rttgde5f.js";
+} from "./cli-zghef0em.js";
 import {
   getAppUrl
 } from "./cli-dh55d5fg.js";
 import {
   withSiblingAwareness,
   workflowContextKey
-} from "./cli-jt9d9fjw.js";
+} from "./cli-e7bwjntj.js";
 import {
   FollowUpConfigSchema,
   ModelTierSchema,
@@ -34,10 +38,12 @@ import {
   getDueWaitStates,
   getPendingEventWaitNames,
   getPendingWaitsByEvent,
+  getResolvedConfig,
   getRetryableSteps,
   getStuckApprovalRuns,
   getStuckWaitRuns,
   getStuckWorkflowRuns,
+  getSwarmConfigs,
   getTaskByWorkflowRunStepId,
   getWaitStateById,
   getWorkflow,
@@ -53,7 +59,7 @@ import {
   splitLegacyModelAlias,
   updateWorkflowRun,
   updateWorkflowRunStep
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import {
   init_zod
 } from "./cli-q21d49ac.js";
@@ -62,6 +68,7 @@ import {
 } from "./cli-anrj584m.js";
 import {
   init_secret_scrubber,
+  registerVolatileSecret,
   scrubObject,
   scrubSecrets
 } from "./cli-3pp1362w.js";
@@ -1421,7 +1428,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp } = await import("./app-xm3xsdye.js");
+          const { getSlackApp } = await import("./app-dr8hwx7z.js");
           const slackApp = getSlackApp();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -1535,7 +1542,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-xm3xsdye.js");
+        const { getSlackApp } = await import("./app-dr8hwx7z.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -1829,6 +1836,28 @@ class ScriptExecutor extends BaseExecutor {
 // src/workflows/executors/swarm-script.ts
 init_zod();
 
+// src/be/script-credential-broker.ts
+init_secret_scrubber();
+init_db();
+class RelationalCredentialBindingStore extends SwarmConfigCredentialBindingStore {
+  listActiveBindings(context) {
+    const relational = listRelationalCredentialBindings(context);
+    if (relational.length > 0)
+      return relational;
+    return super.listActiveBindings(context);
+  }
+}
+function buildScriptCredentialBindings(input) {
+  const resolvedConfigs = getResolvedConfig(input.agentId, input.repoId);
+  const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
+  const broker = new CredentialBroker(new RelationalCredentialBindingStore((filters) => getSwarmConfigs(filters)), (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS);
+  const bindings = broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
+  for (const binding of bindings) {
+    registerVolatileSecret(binding.value, binding.configKey);
+  }
+  return bindings;
+}
+
 // src/scripts-runtime/executors/types.ts
 var DEFAULT_SCRIPT_RESOURCES = {
   memoryMb: 512,
@@ -1844,22 +1873,9 @@ var DEFAULT_SCRIPT_RESOURCES = {
 init_secret_scrubber();
 
 // src/scripts-runtime/egress-secrets.ts
-var EGRESS_ALLOWLIST = {
-  GITHUB_TOKEN: ["api.github.com"]
-};
 function buildEgressSecrets() {
-  const entries = [];
-  for (const [envKey, hosts] of Object.entries(EGRESS_ALLOWLIST)) {
-    const value = process.env[envKey];
-    if (!value)
-      continue;
-    entries.push({
-      placeholder: `[REDACTED:${envKey}]`,
-      hosts,
-      value
-    });
-  }
-  return entries;
+  const broker = new CredentialBroker({ listActiveBindings: () => [] }, (configKey) => process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS);
+  return broker.resolveBindings({});
 }
 
 // src/scripts-runtime/executors/native.ts
@@ -2107,7 +2123,8 @@ function buildConfigPayload(input) {
       }
     },
     user: input.userConfig ?? {},
-    egressSecrets: buildEgressSecrets()
+    egressSecrets: input.egressSecrets ?? buildEgressSecrets(),
+    apiConnections: input.apiConnections ?? []
   };
 }
 async function runScript(input) {
@@ -2203,6 +2220,7 @@ class SwarmScriptExecutor extends BaseExecutor {
       args: config.args,
       fsMode: "none",
       agentId: agentId ?? "workflow",
+      egressSecrets: buildScriptCredentialBindings({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs
     });
     const workflowOutput = {
@@ -2560,4 +2578,4 @@ function initWorkflows() {
   initWaitBusSubscriptions(_registry);
 }
 
-export { setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, runScript, getExecutorRegistry, initWorkflows };
+export { setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, buildScriptCredentialBindings, runScript, getExecutorRegistry, initWorkflows };

package/dist/{cli-fygaw191.js → cli-5pf0b84v.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-8w95v19d.js";
+} from "./cli-p4cj4vhc.js";
 import {
   getDb,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-m8f6qzck.js → cli-7v4y3hyd.js}

@@ -1,7 +1,7 @@
 import {
   getDb,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 
 // src/be/seed-pricing.ts
 init_db();

package/dist/{cli-fwxdt7kt.js → cli-d4z1csms.js}

@@ -4,11 +4,11 @@ import {
   getNextResumeGeneration,
   getResumeGeneration,
   repointTrackerSyncBySwarmId
-} from "./cli-4fnp2tc3.js";
+} from "./cli-s42f54ja.js";
 import {
   getExecutorRegistry,
   recoverIncompleteRuns
-} from "./cli-8hyv6c2v.js";
+} from "./cli-54h5daha.js";
 import {
   assignUnassignedTaskPending,
   backfillSupersedeTaskResumeTaskId,
@@ -43,7 +43,7 @@ import {
   resolveTemplate,
   supersedeTask,
   updateAgentStatus
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 
 // src/heartbeat/heartbeat.ts
 init_db();
@@ -347,6 +347,18 @@ function remediateCrashedWorkerTask(findings, task, opts) {
   if (remaining === 0)
     updateAgentStatus(task.agentId, "idle");
 }
+function getBootEpochMs() {
+  const gs = globalThis;
+  const runId = gs.__runId;
+  if (!runId || typeof runId !== "string")
+    return null;
+  const match = runId.match(/^run_(\d+)$/);
+  if (!match)
+    return null;
+  const epoch = Number(match[1]);
+  return Number.isFinite(epoch) ? epoch : null;
+}
+var BOOT_EPOCH_SKEW_MS = 5000;
 async function runRebootSweep() {
   if (isSweeping) {
     console.log("[Heartbeat] Reboot sweep skipped — another sweep is running");
@@ -361,14 +373,27 @@ async function runRebootSweep() {
       return;
     }
     const reason = "Auto-failed by reboot sweep: worker session not found after server restart";
+    const bootEpoch = getBootEpochMs();
+    if (bootEpoch === null) {
+      console.warn("[Heartbeat] Reboot sweep: could not parse boot epoch from __runId — falling back to legacy session-exists check");
+    }
     for (const task of allInProgress) {
       if (!task.agentId) {
         console.warn(`[Heartbeat] Reboot sweep: skipping task ${task.id} — in_progress with no agentId`);
         continue;
       }
       const session = getActiveSessionForTask(task.id);
+      if (session) {
+        if (bootEpoch === null) {
+          continue;
+        }
+        const sessionLastSeen = new Date(session.lastHeartbeatAt).getTime();
+        if (sessionLastSeen >= bootEpoch - BOOT_EPOCH_SKEW_MS) {
+          continue;
+        }
+      }
       if (session)
-        continue;
+        deleteActiveSession(task.id);
       const failed = failTask(task.id, reason);
       if (!failed)
         continue;
@@ -850,4 +875,4 @@ function stopHeartbeatChecklist() {
     console.log("[Heartbeat] Checklist stopped");
   }
 }
-export { runRebootSweep, getRebootAffectedTasks, checkHeartbeatChecklist, runHeartbeatSweep, startHeartbeat, stopHeartbeat };
+export { getBootEpochMs, runRebootSweep, getRebootAffectedTasks, checkHeartbeatChecklist, runHeartbeatSweep, startHeartbeat, stopHeartbeat };

package/dist/{cli-jt9d9fjw.js → cli-e7bwjntj.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-fedn86nz.js";
+} from "./cli-0jw6j755.js";
 
 // src/tasks/context-key.ts
 var SEPARATOR = ":";