@desplega.ai/agent-swarm 1.103.0 → 1.104.0

package/src/be/script-credential-broker.ts

@@ -0,0 +1,38 @@
+import {
+  CredentialBroker,
+  DEFAULT_CREDENTIAL_BINDINGS,
+  SwarmConfigCredentialBindingStore,
+} from "@/scripts-runtime/credential-broker";
+import type { EgressSecretEntry } from "@/scripts-runtime/executors/types";
+import { registerVolatileSecret } from "@/utils/secret-scrubber";
+import { getResolvedConfig, getSwarmConfigs } from "./db";
+import { listRelationalCredentialBindings } from "./script-connections";
+
+class RelationalCredentialBindingStore extends SwarmConfigCredentialBindingStore {
+  override listActiveBindings(
+    context: Parameters<SwarmConfigCredentialBindingStore["listActiveBindings"]>[0],
+  ) {
+    const relational = listRelationalCredentialBindings(context);
+    if (relational.length > 0) return relational;
+    return super.listActiveBindings(context);
+  }
+}
+
+export function buildScriptCredentialBindings(input: {
+  agentId?: string;
+  repoId?: string;
+}): EgressSecretEntry[] {
+  const resolvedConfigs = getResolvedConfig(input.agentId, input.repoId);
+  const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
+  const broker = new CredentialBroker(
+    new RelationalCredentialBindingStore((filters) => getSwarmConfigs(filters)),
+    (configKey) => configMap.get(configKey) ?? process.env[configKey],
+    DEFAULT_CREDENTIAL_BINDINGS,
+  );
+
+  const bindings = broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
+  for (const binding of bindings) {
+    registerVolatileSecret(binding.value, binding.configKey);
+  }
+  return bindings;
+}

package/src/be/scripts/typecheck.ts

@@ -1,4 +1,5 @@
 import ts from "typescript";
+import { getScriptApiTypes } from "@/be/script-connections";
 
 /**
  * Structured diagnostic record returned to API callers when typecheck fails.
@@ -108,6 +109,17 @@ export interface SwarmSdk {
 
   // --- write: memory ---
   memory_delete(args: { id: string }): Promise<unknown>;
+  memory_edit(args: {
+    memoryId?: string;
+    key?: string;
+    scope?: "agent" | "swarm";
+    mode?: "replace" | "exact";
+    content?: string;
+    oldString?: string;
+    newString?: string;
+    intent: string;
+    expectedVersion?: number;
+  }): Promise<unknown>;
   inject_learning(args: { content: string; name?: string; scope?: "agent" | "swarm"; source?: string; tags?: string[] }): Promise<unknown>;
 
   // --- write: tasks ---
@@ -261,6 +273,7 @@ export interface ScriptContext {
   run?: ScriptRunContext;
   step?: ScriptWorkflowSteps;
   swarm: SwarmSdk & { config: SwarmConfig };
+  api: ScriptApiRegistry;
   stdlib: ScriptStdlib;
   logger: ScriptLogger;
 }
@@ -269,6 +282,10 @@ export interface ScriptContext {
 export type ScriptMain = (args: any, ctx: ScriptContext) => unknown | Promise<unknown>;
 `;
 
+export function scriptSdkTypesWithGeneratedApis(apiTypes = getScriptApiTypes()): string {
+  return `${SCRIPT_SDK_TYPES}\n${apiTypes}\n`;
+}
+
 export const SCRIPT_STDLIB_TYPES = `
 declare module "stdlib" {
   export interface Redacted<T> {
@@ -764,7 +781,10 @@ function toStructured(diag: ts.Diagnostic): ScriptDiagnostic {
   };
 }
 
-export function typecheckScript(source: string): ScriptTypecheckResult {
+export function typecheckScript(
+  source: string,
+  context: { agentId?: string; repoId?: string } = {},
+): ScriptTypecheckResult {
   const options: ts.CompilerOptions = {
     allowImportingTsExtensions: true,
     lib: ["lib.es2022.d.ts"],
@@ -777,9 +797,10 @@ export function typecheckScript(source: string): ScriptTypecheckResult {
     types: [],
   };
 
+  const sdkTypes = scriptSdkTypesWithGeneratedApis(getScriptApiTypes(context));
   const files = new Map<string, string>([
     [USER_FILE, source],
-    [SDK_FILE, SCRIPT_SDK_TYPES],
+    [SDK_FILE, sdkTypes],
     [STDLIB_FILE, SCRIPT_STDLIB_TYPES],
     [RUNTIME_GLOBALS_FILE, SCRIPT_RUNTIME_GLOBALS],
     [

package/src/be/seed-scripts/catalog/boot-triage.inline.ts

@@ -138,20 +138,32 @@ export default async function bootTriage(args: any, ctx: any) {
     .filter((row) => !BENIGN_FAILURE_RE.test(String(row.failureReason || "")))
     .map(summarizeTask);
 
-  const stuckOfflineRows = await query(
+  // Catches in_progress tasks on offline agents OR tasks whose session is a
+  // pre-boot artifact (stale lastHeartbeatAt). The session check mirrors the
+  // heartbeat.ts runRebootSweep boot-epoch logic — a session that heartbeated
+  // after the stuckMinutes threshold is considered live.
+  const recentThreshold = new Date(nowMs - stuckMinutes * 60 * 1000).toISOString();
+  const stuckRows = await query(
     ctx,
     `SELECT t.id, t.task, t.status, t.taskType, t.agentId, a.name as agentName,
             t.scheduleId, t.parentTaskId, t.failureReason, t.createdAt, t.lastUpdatedAt
      FROM agent_tasks t
      JOIN agents a ON a.id = t.agentId
      WHERE t.status = 'in_progress'
-       AND a.status = 'offline'
        AND datetime(t.lastUpdatedAt) <= datetime(?, ?)
+       AND (
+         a.status = 'offline'
+         OR NOT EXISTS (
+           SELECT 1 FROM active_sessions s
+           WHERE s.taskId = t.id
+             AND datetime(s.lastHeartbeatAt) >= datetime(?)
+         )
+       )
      ORDER BY datetime(t.lastUpdatedAt) ASC
      LIMIT 50`,
-    [now.toISOString(), `-${stuckMinutes} minutes`],
+    [now.toISOString(), `-${stuckMinutes} minutes`, recentThreshold],
   );
-  const stuckInProgressOnOfflineAgents = stuckOfflineRows
+  const stuckInProgressOnOfflineAgents = stuckRows
     .filter((row) => !row.unavailable)
     .map(summarizeTask);
 

package/src/be/seed-scripts/catalog/boot-triage.ts

@@ -138,20 +138,32 @@ export default async function bootTriage(args: any, ctx: any) {
     .filter((row) => !BENIGN_FAILURE_RE.test(String(row.failureReason || "")))
     .map(summarizeTask);
 
-  const stuckOfflineRows = await query(
+  // Catches in_progress tasks on offline agents OR tasks whose session is a
+  // pre-boot artifact (stale lastHeartbeatAt). The session check mirrors the
+  // heartbeat.ts runRebootSweep boot-epoch logic — a session that heartbeated
+  // after the stuckMinutes threshold is considered live.
+  const recentThreshold = new Date(nowMs - stuckMinutes * 60 * 1000).toISOString();
+  const stuckRows = await query(
     ctx,
     `SELECT t.id, t.task, t.status, t.taskType, t.agentId, a.name as agentName,
             t.scheduleId, t.parentTaskId, t.failureReason, t.createdAt, t.lastUpdatedAt
      FROM agent_tasks t
      JOIN agents a ON a.id = t.agentId
      WHERE t.status = 'in_progress'
-       AND a.status = 'offline'
        AND datetime(t.lastUpdatedAt) <= datetime(?, ?)
+       AND (
+         a.status = 'offline'
+         OR NOT EXISTS (
+           SELECT 1 FROM active_sessions s
+           WHERE s.taskId = t.id
+             AND datetime(s.lastHeartbeatAt) >= datetime(?)
+         )
+       )
      ORDER BY datetime(t.lastUpdatedAt) ASC
      LIMIT 50`,
-    [now.toISOString(), `-${stuckMinutes} minutes`],
+    [now.toISOString(), `-${stuckMinutes} minutes`, recentThreshold],
   );
-  const stuckInProgressOnOfflineAgents = stuckOfflineRows
+  const stuckInProgressOnOfflineAgents = stuckRows
     .filter((row) => !row.unavailable)
     .map(summarizeTask);
 

package/src/commands/runner.ts

@@ -171,7 +171,8 @@ export type SwarmAutostash = { ref: string; message: string };
 
 async function listSwarmAutostashes(clonePath: string, role: string): Promise<SwarmAutostash[]> {
   try {
-    const result = await Bun.$`cd ${clonePath} && git stash list --format=%gd%x09%s`.quiet();
+    const result =
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} stash list --format=%gd%x09%s`.quiet();
     return result
       .text()
       .split("\n")
@@ -195,7 +196,8 @@ async function refreshExistingRepoForTask(
   role: string,
 ): Promise<string | null> {
   const { name, clonePath, defaultBranch } = repoConfig;
-  const statusResult = await Bun.$`cd ${clonePath} && git status --porcelain`.quiet();
+  const statusResult =
+    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} status --porcelain`.quiet();
   const statusOutput = statusResult.text().trim();
   let stashMessage: string | null = null;
 
@@ -203,7 +205,7 @@ async function refreshExistingRepoForTask(
     stashMessage = `swarm-autostash ${defaultBranch} ${new Date().toISOString()}`;
     try {
       console.log(`[${role}] Auto-stashing pending work in ${name}: ${stashMessage}`);
-      await Bun.$`cd ${clonePath} && git stash push --include-untracked -m ${stashMessage}`.quiet();
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} stash push --include-untracked -m ${stashMessage}`.quiet();
       console.log(`[${role}] Auto-stashed pending work in ${name}`);
     } catch (err) {
       const errorMsg = scrubSecrets((err as Error).message);
@@ -216,15 +218,15 @@ async function refreshExistingRepoForTask(
     console.log(`[${role}] Refreshing ${name} from origin/${defaultBranch}...`);
     const fetchSpec = `${defaultBranch}:refs/remotes/origin/${defaultBranch}`;
     const remoteRef = `refs/remotes/origin/${defaultBranch}`;
-    await Bun.$`cd ${clonePath} && git fetch origin ${fetchSpec}`.quiet();
-    await Bun.$`cd ${clonePath} && git merge --no-edit --no-stat ${remoteRef}`.quiet();
+    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} fetch origin ${fetchSpec}`.quiet();
+    await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --no-edit --no-stat ${remoteRef}`.quiet();
     console.log(`[${role}] Refreshed ${name}`);
     return null;
   } catch (err) {
     const errorMsg = scrubSecrets((err as Error).message);
     console.warn(`[${role}] Could not refresh ${name}: ${errorMsg}`);
     try {
-      await Bun.$`cd ${clonePath} && git merge --abort`.quiet();
+      await Bun.$`env -u GIT_DIR -u GIT_WORK_TREE -u GIT_INDEX_FILE -u GIT_PREFIX git -C ${clonePath} merge --abort`.quiet();
     } catch {
       // No merge in progress, or abort failed. The original refresh warning is
       // the actionable signal; repo setup remains best-effort.

package/src/heartbeat/heartbeat.ts

@@ -450,9 +450,29 @@ function remediateCrashedWorkerTask(
   if (remaining === 0) updateAgentStatus(task.agentId, "idle");
 }
 
+/**
+ * Parse the API boot epoch from `globalThis.__runId` (format: `run_<epochMs>`).
+ * Returns the epoch in ms, or null if missing/unparseable.
+ */
+export function getBootEpochMs(): number | null {
+  const gs = globalThis as typeof globalThis & { __runId?: string };
+  const runId = gs.__runId;
+  if (!runId || typeof runId !== "string") return null;
+  const match = runId.match(/^run_(\d+)$/);
+  if (!match) return null;
+  const epoch = Number(match[1]);
+  return Number.isFinite(epoch) ? epoch : null;
+}
+
+// API and workers share the same host clock, so skew is minimal.
+// 5s tolerance errs toward NOT failing a borderline-live session.
+const BOOT_EPOCH_SKEW_MS = 5_000;
+
 /**
  * Aggressive sweep that runs once after server restart.
  * Ignores age thresholds — any in_progress task with no active session is auto-failed.
+ * A session is only considered "live" if it heartbeated AFTER the current API boot
+ * (concurrency-safe: workers with multiple tasks keep fresh heartbeats on live ones).
  * Creates exactly one retry task per failed task via parentTaskId.
  */
 export async function runRebootSweep(): Promise<void> {
@@ -474,6 +494,13 @@ export async function runRebootSweep(): Promise<void> {
     }
     const reason = "Auto-failed by reboot sweep: worker session not found after server restart";
 
+    const bootEpoch = getBootEpochMs();
+    if (bootEpoch === null) {
+      console.warn(
+        "[Heartbeat] Reboot sweep: could not parse boot epoch from __runId — falling back to legacy session-exists check",
+      );
+    }
+
     for (const task of allInProgress) {
       if (!task.agentId) {
         console.warn(
@@ -483,7 +510,21 @@ export async function runRebootSweep(): Promise<void> {
       }
 
       const session = getActiveSessionForTask(task.id);
-      if (session) continue; // Session exists — worker might still be alive, skip
+      if (session) {
+        if (bootEpoch === null) {
+          // Legacy fallback: session exists → skip (pre-fix behavior, never more aggressive)
+          continue;
+        }
+        const sessionLastSeen = new Date(session.lastHeartbeatAt).getTime();
+        if (sessionLastSeen >= bootEpoch - BOOT_EPOCH_SKEW_MS) {
+          // Heartbeated after (or within skew of) this boot → genuinely live, skip
+          continue;
+        }
+        // Pre-boot stale session → fall through to auto-fail + reboot-retry child
+      }
+
+      // Clean up pre-boot stale session before failing (if it existed)
+      if (session) deleteActiveSession(task.id);
 
       // Auto-fail the task
       const failed = failTask(task.id, reason);

package/src/heartbeat/index.ts

@@ -1 +1,7 @@
-export { getRebootAffectedTasks, runRebootSweep, startHeartbeat, stopHeartbeat } from "./heartbeat";
+export {
+  getBootEpochMs,
+  getRebootAffectedTasks,
+  runRebootSweep,
+  startHeartbeat,
+  stopHeartbeat,
+} from "./heartbeat";

package/src/http/memory.ts

@@ -72,6 +72,33 @@ const searchMemory = route({
   },
 });
 
+const editMemory = route({
+  method: "post",
+  path: "/api/memory/edit",
+  pattern: ["api", "memory", "edit"],
+  summary:
+    "Edit a single memory in place while preserving its ID and usefulness posterior. Modes: 'replace' overwrites entire content; 'exact' performs surgical find-and-replace of oldString→newString (fails if missing or ambiguous)",
+  tags: ["Memory"],
+  auth: { apiKey: true, agentId: true },
+  body: z.object({
+    memoryId: z.string().uuid().optional(),
+    key: z.string().min(1).optional(),
+    scope: AgentMemoryScopeSchema.optional(),
+    mode: z.enum(["replace", "exact"]).default("replace"),
+    content: z.string().min(1).optional(),
+    oldString: z.string().min(1).optional(),
+    newString: z.string().optional(),
+    intent: z.string().min(1),
+    expectedVersion: z.number().int().min(1).optional(),
+  }),
+  responses: {
+    200: { description: "Memory edited" },
+    400: { description: "Validation error" },
+    404: { description: "Memory not found" },
+    409: { description: "Version conflict" },
+  },
+});
+
 const reEmbedMemory = route({
   method: "post",
   path: "/api/memory/re-embed",
@@ -319,7 +346,39 @@ export async function handleMemory(
     const store = getMemoryStore();
     const provider = getEmbeddingProvider();
 
-    // Dedup — delete old chunks for this source path
+    if (sourcePath && agentId && contentChunks.length === 1) {
+      const existing = store
+        .list(agentId, {
+          scope,
+          limit: 2,
+          ownerAgentId: agentId,
+          sourcePath,
+        })
+        .filter((memory) => memory.sourcePath === sourcePath);
+      if (existing.length === 1 && existing[0]?.totalChunks === 1) {
+        const result = store.edit({
+          id: existing[0].id,
+          mode: "replace",
+          content: contentChunks[0]!.content,
+          intent: "re-index memory source path",
+          changedByAgentId: agentId,
+        });
+        const embedding = await provider.embed(contentChunks[0]!.content);
+        if (embedding) store.updateEmbedding(result.memory.id, embedding, provider.name);
+        try {
+          storeLinks(result.memory.id, agentId, result.memory.content);
+        } catch (err) {
+          console.error(
+            `[memory] Link resolution failed for ${result.memory.id}:`,
+            (err as Error).message,
+          );
+        }
+        json(res, { queued: false, memoryIds: [result.memory.id], edited: result.changed }, 202);
+        return true;
+      }
+    }
+
+    // Dedup multi-chunk or ambiguous source paths via the existing lossy path.
     if (sourcePath && agentId) {
       store.deleteBySourcePath(sourcePath, agentId);
     }
@@ -345,6 +404,8 @@ export async function handleMemory(
         totalChunks: chunk.totalChunks,
         tags: tags || [],
         contextKey: resolvedContextKey ?? null,
+        intent: "index memory content",
+        key: sourcePath || null,
       })),
     );
 
@@ -396,17 +457,13 @@ export async function handleMemory(
       const store = getMemoryStore();
       const queryEmbedding = await provider.embed(query);
 
-      if (!queryEmbedding) {
-        json(res, { results: [] });
-        return true;
-      }
-
       const candidateLimit = Math.min(limit, 20) * CANDIDATE_SET_MULTIPLIER;
-      const candidates = store.search(queryEmbedding, myAgentId, {
+      const candidates = store.search(queryEmbedding ?? new Float32Array(0), myAgentId, {
         scope,
         limit: candidateLimit,
         source,
         isLead: false,
+        queryText: query,
       });
       const ranked = rerank(candidates, { limit: Math.min(limit, 20) });
 
@@ -426,7 +483,11 @@ export async function handleMemory(
           recordRetrievals(
             sourceTaskId,
             myAgentId,
-            ranked.map((r) => ({ memoryId: r.id, similarity: r.similarity })),
+            ranked.map((r) => ({
+              memoryId: r.id,
+              similarity: r.similarity,
+              retrievalSource: r.retrievalSource,
+            })),
             undefined,
             { intent, contextKey, eventType: "search" },
           );
@@ -443,6 +504,7 @@ export async function handleMemory(
           similarity: r.similarity,
           rawSimilarity: r.rawSimilarity,
           compositeScore: r.compositeScore,
+          retrievalSource: r.retrievalSource,
           source: r.source,
           scope: r.scope,
         })),
@@ -470,20 +532,16 @@ export async function handleMemory(
         const provider = getEmbeddingProvider();
         const queryEmbedding = await provider.embed(query.trim());
 
-        if (!queryEmbedding) {
-          json(res, { results: [], total: 0, limit: pageLimit, offset, mode: "semantic" });
-          return true;
-        }
-
         const candidateLimit = Math.min(
           4096,
           Math.max(offset + pageLimit, pageLimit) * CANDIDATE_SET_MULTIPLIER,
         );
-        let candidates = store.search(queryEmbedding, agentId ?? "", {
+        let candidates = store.search(queryEmbedding ?? new Float32Array(0), agentId ?? "", {
           scope,
           limit: candidateLimit,
           isLead: true,
           source,
+          queryText: query.trim(),
         });
         if (agentId) {
           candidates = candidates.filter((c) => c.agentId === agentId);
@@ -505,6 +563,7 @@ export async function handleMemory(
             similarity: r.similarity,
             rawSimilarity: r.rawSimilarity,
             compositeScore: r.compositeScore,
+            retrievalSource: r.retrievalSource,
             createdAt: r.createdAt,
             accessedAt: r.accessedAt,
             accessCount: r.accessCount ?? 0,
@@ -567,6 +626,60 @@ export async function handleMemory(
     return true;
   }
 
+  if (editMemory.match(req.method, pathSegments)) {
+    if (!myAgentId) {
+      jsonError(res, "Missing X-Agent-ID header", 400);
+      return true;
+    }
+
+    const parsed = await editMemory.parse(req, res, pathSegments, new URLSearchParams());
+    if (!parsed) return true;
+
+    const { memoryId, key, scope, mode, content, oldString, newString, intent, expectedVersion } =
+      parsed.body;
+    if (!memoryId && !(key && scope)) {
+      jsonError(res, "memoryId or key+scope required", 400);
+      return true;
+    }
+
+    try {
+      const store = getMemoryStore();
+      const result = store.edit({
+        id: memoryId,
+        key,
+        scope,
+        agentId: myAgentId,
+        mode,
+        content,
+        oldString,
+        newString,
+        intent,
+        expectedVersion,
+        changedByAgentId: myAgentId,
+      });
+      if (result.changed) {
+        const provider = getEmbeddingProvider();
+        const embedding = await provider.embed(result.memory.content);
+        if (embedding) store.updateEmbedding(result.memory.id, embedding, provider.name);
+        try {
+          storeLinks(result.memory.id, myAgentId, result.memory.content);
+        } catch (err) {
+          console.error(
+            `[memory-edit] Link resolution failed for ${result.memory.id}:`,
+            (err as Error).message,
+          );
+        }
+      }
+      json(res, result);
+    } catch (err) {
+      const message = (err as Error).message;
+      if (message.includes("not found")) jsonError(res, message, 404);
+      else if (message.includes("conflict")) jsonError(res, message, 409);
+      else jsonError(res, message, 400);
+    }
+    return true;
+  }
+
   if (memoryHealth.match(req.method, pathSegments)) {
     const parsed = await memoryHealth.parse(req, res, pathSegments, new URLSearchParams());
     if (!parsed) return true;

package/src/http/scripts.ts

@@ -3,6 +3,8 @@ import { z } from "zod";
 import { resolveHttpAuditUserId } from "../be/audit-user";
 import { getAgentById, recordInlineScriptRun, upsertKv } from "../be/db";
 import { createEvent } from "../be/events";
+import { getScriptApiConnectionDescriptors, getScriptApiTypes } from "../be/script-connections";
+import { buildScriptCredentialBindings } from "../be/script-credential-broker";
 import {
   deleteScript,
   getScript,
@@ -13,7 +15,11 @@ import {
 } from "../be/scripts/db";
 import { searchScripts } from "../be/scripts/embeddings";
 import { extractArgsJsonSchema } from "../be/scripts/extract-schema";
-import { SCRIPT_SDK_TYPES, SCRIPT_STDLIB_TYPES, typecheckScript } from "../be/scripts/typecheck";
+import {
+  SCRIPT_STDLIB_TYPES,
+  scriptSdkTypesWithGeneratedApis,
+  typecheckScript,
+} from "../be/scripts/typecheck";
 import { extractScriptSignature } from "../scripts-runtime/extract-signature";
 import { runScript } from "../scripts-runtime/loader";
 import {
@@ -287,12 +293,7 @@ export async function handleScripts(
     const agent = requireAgent(res, agentId);
     if (!agent) return true;
 
-    if (parsed.body.scope === "global" && !agent.isLead) {
-      jsonError(res, "Global scripts require a lead agent", 403);
-      return true;
-    }
-
-    const typecheck = typecheckScript(parsed.body.source);
+    const typecheck = typecheckScript(parsed.body.source, { agentId: agent.id });
     if (!typecheck.ok) {
       json(
         res,
@@ -375,6 +376,8 @@ export async function handleScripts(
       args: parsed.body.args,
       fsMode,
       agentId: agent.id,
+      egressSecrets: buildScriptCredentialBindings({ agentId: agent.id }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
     });
 
     // Persist output to KV when idempotencyKey is provided and run succeeded
@@ -529,7 +532,10 @@ export async function handleScripts(
   // Must be matched before getScriptByIdRoute — its ["api", "scripts", null]
   // pattern would otherwise swallow the literal "type-defs" segment.
   if (typeDefsRoute.match(req.method, pathSegments)) {
-    json(res, { sdkTypes: SCRIPT_SDK_TYPES, stdlibTypes: SCRIPT_STDLIB_TYPES });
+    json(res, {
+      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes()),
+      stdlibTypes: SCRIPT_STDLIB_TYPES,
+    });
     return true;
   }
 
@@ -577,7 +583,7 @@ export async function handleScripts(
     json(res, {
       signature: JSON.parse(script.signatureJson),
       argsJsonSchema: script.argsJsonSchema ? (JSON.parse(script.argsJsonSchema) as unknown) : null,
-      sdkTypes: SCRIPT_SDK_TYPES,
+      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes({ agentId: agent.id })),
       stdlibTypes: SCRIPT_STDLIB_TYPES,
     });
     return true;
@@ -589,11 +595,6 @@ export async function handleScripts(
     const agent = requireAgent(res, agentId);
     if (!agent) return true;
 
-    if (parsed.query.scope === "global" && !agent.isLead) {
-      jsonError(res, "Global scripts require a lead agent", 403);
-      return true;
-    }
-
     const deleted = deleteScript({
       name: parsed.params.name,
       scope: parsed.query.scope,