@desplega.ai/agent-swarm 1.104.0 → 1.106.0

package/dist/{http-59ygpn2h.js → http-naqhj1n0.js}

@@ -9,6 +9,7 @@ import {
   applyRating,
   assertSelectOnlyQuery,
   canClaim,
+  canReadMemory,
   cancelTaskHandler,
   cancelTaskInputSchema,
   cancelTaskOutputSchema,
@@ -79,6 +80,7 @@ import {
   parseQueryParams,
   parseSkillContent,
   recordRetrievals,
+  recordSessionCost,
   registerJiraWebhook,
   reloadGlobalConfigsAndIntegrations,
   resolveHttpAuditUserId,
@@ -106,7 +108,7 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-qvzgncd8.js";
+} from "./cli-v90vvqt8.js";
 import {
   BROWSER_SDK_JS,
   SWARM_UI_JS
@@ -129,27 +131,27 @@ import {
   generateRandomState,
   getOAuthApp,
   getOAuthTokens
-} from "./cli-2g9jf9ek.js";
-import"./cli-w1nfskkg.js";
+} from "./cli-842gfjn1.js";
+import"./cli-sp3c9fwf.js";
 import {
   normalizeModelKey
-} from "./cli-7v4y3hyd.js";
+} from "./cli-xgssgdqn.js";
 import {
   SCRIPT_STDLIB_TYPES,
   extractArgsJsonSchema,
   extractScriptSignature,
   scriptSdkTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-t9v14cnd.js";
+} from "./cli-wfhe4tgs.js";
 import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-d4z1csms.js";
+} from "./cli-qtr61agf.js";
 import {
   createResumeFollowUp,
   createWorkerTaskFollowUp
-} from "./cli-s42f54ja.js";
+} from "./cli-f7ypwjgh.js";
 import {
   RawLlmConfigSchema,
   buildScriptCredentialBindings,
@@ -160,23 +162,31 @@ import {
   retryFailedRun,
   runScript,
   snapshotWorkflow
-} from "./cli-54h5daha.js";
+} from "./cli-n38fcvhe.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
+  createScriptApi,
   deleteScript,
+  deleteScriptApi,
   getScript,
+  getScriptApiById,
   getScriptApiConnectionDescriptors,
+  getScriptApiSecret,
   getScriptApiTypes,
   getScriptById,
+  listScriptApisForScript,
   listScriptVersions,
   listScripts,
+  recordScriptApiUsage,
+  rotateScriptApiSecret,
+  updateScriptApi,
   upsertScriptByName
-} from "./cli-v1syqkcb.js";
+} from "./cli-84gyjn6h.js";
 import {
   searchScripts
-} from "./cli-5pf0b84v.js";
+} from "./cli-4fwzc50f.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -184,7 +194,7 @@ import {
   init_constants,
   init_reranker,
   rerank
-} from "./cli-p4cj4vhc.js";
+} from "./cli-hmqkes02.js";
 import"./cli-3j01d33e.js";
 import"./cli-fad8m16k.js";
 import {
@@ -193,7 +203,7 @@ import {
   ensure,
   initialize,
   require_dist
-} from "./cli-y9p3e94h.js";
+} from "./cli-08fnz4jm.js";
 import {
   TriggerSchemaError,
   WebhookError,
@@ -205,18 +215,18 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-zghef0em.js";
-import"./cli-nzc0h54v.js";
+} from "./cli-v9853xza.js";
+import"./cli-8fhhmzbh.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-zaxksbgj.js";
+} from "./cli-rp5kaak8.js";
 import"./cli-fete3y1e.js";
 import"./cli-b0p7rfnd.js";
 import {
   recordUnmappedIdentity
-} from "./cli-gj2n2ec1.js";
+} from "./cli-tfcrm7ds.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -230,7 +240,7 @@ import {
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-yvektv79.js";
+} from "./cli-pxddwmyc.js";
 import"./cli-z92pkwzn.js";
 import {
   getAppUrl,
@@ -243,7 +253,7 @@ import {
   createTaskWithSiblingAwareness,
   gitlabContextKey,
   pageContextKey
-} from "./cli-e7bwjntj.js";
+} from "./cli-6hqvenfv.js";
 import {
   AgentCredStatusSchema,
   AgentLatestModelSchema,
@@ -280,6 +290,7 @@ import {
   RepoGuidelinesSchema,
   RepoHooksSchema,
   ResumeReasonSchema,
+  ScriptApiAuthModeSchema,
   ScriptFsModeSchema,
   ScriptRunStatusSchema,
   ScriptScopeSchema,
@@ -536,7 +547,7 @@ import {
   upsertSkillFiles,
   upsertSwarmConfig,
   validateConfigValue
-} from "./cli-0jw6j755.js";
+} from "./cli-6xn2xv4r.js";
 import"./cli-z2zcxes1.js";
 import {
   init_zod
@@ -551,7 +562,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-yjt8a36k.js";
+} from "./cli-39jaysbv.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -565,17 +576,18 @@ import {
 } from "./cli-9aryf9tv.js";
 import {
   bedrockProviderModule
-} from "./cli-jntqphs0.js";
+} from "./cli-ygcrdkqt.js";
 import"./cli-jvv0g8bh.js";
 import {
   setBedrockProviderModule
 } from "./cli-xw7p4wkq.js";
 import"./cli-6kqcg4zv.js";
 import"./cli-cwy5hqbq.js";
+import"./cli-pscrc6tw.js";
 import"./cli-4wgngmwv.js";
 import"./cli-vapyk8sw.js";
 import"./cli-zyxs93y9.js";
-import"./cli-2q1ct4en.js";
+import"./cli-bsyka9ta.js";
 import"./cli-y2apkfe2.js";
 import"./cli-m6pzzhqr.js";
 import"./cli-7sgrxg9a.js";
@@ -5071,6 +5083,7 @@ class StreamableHTTPServerTransport {
 }
 
 // src/http/mcp.ts
+init_db();
 var DEFAULT_MCP_TRANSPORT_IDLE_TIMEOUT_MS = 2 * 60 * 60 * 1000;
 function markMcpTransportActivity(sessionActivity, sessionId, now = Date.now()) {
   if (sessionId) {
@@ -5102,11 +5115,45 @@ function closeIdleMcpTransports(transports, sessionActivity, options = {}) {
   }
   return closed;
 }
-async function handleMcp(req, res, transports, sessionActivity = {}) {
+function unauthorized(res, message = "Unauthorized") {
+  res.writeHead(401, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: message }));
+  return true;
+}
+function headerValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function requireKnownAgent(req, res) {
+  const agentId = headerValue(req.headers["x-agent-id"]);
+  if (!agentId)
+    return unauthorized(res, "Missing X-Agent-ID header");
+  if (!getAgentById(agentId))
+    return unauthorized(res, "Agent not found");
+  return agentId;
+}
+function validateBoundAgent(req, res, sessionId, sessionAgents) {
+  if (!sessionId)
+    return;
+  const boundAgentId = sessionAgents[sessionId];
+  if (!boundAgentId)
+    return;
+  const agentId = headerValue(req.headers["x-agent-id"]);
+  if (!agentId) {
+    return unauthorized(res, "Missing X-Agent-ID header");
+  }
+  if (agentId !== boundAgentId) {
+    return unauthorized(res, "X-Agent-ID does not match MCP session");
+  }
+  return;
+}
+async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgents = {}) {
   const sessionId = req.headers["mcp-session-id"];
   if (req.url !== "/mcp") {
     return false;
   }
+  const agentMismatch = validateBoundAgent(req, res, sessionId, sessionAgents);
+  if (agentMismatch)
+    return true;
   if (req.method === "POST") {
     const chunks = [];
     for await (const chunk of req) {
@@ -5118,20 +5165,26 @@ async function handleMcp(req, res, transports, sessionActivity = {}) {
       transport = transports[sessionId];
       markMcpTransportActivity(sessionActivity, sessionId);
     } else if (!sessionId && isInitializeRequest(body)) {
+      const agentId = requireKnownAgent(req, res);
+      if (agentId === true)
+        return true;
       transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (id) => {
           transports[id] = transport;
+          sessionAgents[id] = agentId;
           markMcpTransportActivity(sessionActivity, id);
         },
         onsessionclosed: (id) => {
           delete transports[id];
+          delete sessionAgents[id];
           delete sessionActivity[id];
         }
       });
       transport.onclose = () => {
         if (transport.sessionId) {
           delete transports[transport.sessionId];
+          delete sessionAgents[transport.sessionId];
           delete sessionActivity[transport.sessionId];
         }
       };
@@ -6824,7 +6877,7 @@ function createUserServer(user) {
 }
 
 // src/http/mcp-user.ts
-function unauthorized(res) {
+function unauthorized2(res) {
   res.writeHead(401, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: "Unauthorized" }));
   return true;
@@ -6852,9 +6905,9 @@ async function handleMcpUser(req, res, transports, sessionUsers, sessionActivity
   }
   const user = resolveActiveUser(req);
   if (!user)
-    return unauthorized(res);
+    return unauthorized2(res);
   if (sessionId && transports[sessionId] && sessionUsers[sessionId] !== user.id) {
-    return unauthorized(res);
+    return unauthorized2(res);
   }
   if (req.method === "POST") {
     const chunks = [];
@@ -7385,6 +7438,7 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
       persistMemory,
       contextKey
     } = parsed.body;
+    const memoryAgentId = agentId ?? (scope === "agent" ? myAgentId : undefined);
     if (source === "session_summary" && sourceTaskId) {
       const sourceTask = getTaskById(sourceTaskId);
       if (sourceTask && !shouldPersistAutomaticTaskMemory(sourceTask, persistMemory)) {
@@ -7403,11 +7457,11 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
     }
     const store = getMemoryStore();
     const provider = getEmbeddingProvider();
-    if (sourcePath && agentId && contentChunks.length === 1) {
-      const existing = store.list(agentId, {
+    if (sourcePath && memoryAgentId && contentChunks.length === 1) {
+      const existing = store.list(memoryAgentId, {
         scope,
         limit: 2,
-        ownerAgentId: agentId,
+        ownerAgentId: memoryAgentId,
         sourcePath
       }).filter((memory) => memory.sourcePath === sourcePath);
       if (existing.length === 1 && existing[0]?.totalChunks === 1) {
@@ -7422,7 +7476,7 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
         if (embedding)
           store.updateEmbedding(result.memory.id, embedding, provider.name);
         try {
-          storeLinks(result.memory.id, agentId, result.memory.content);
+          storeLinks(result.memory.id, memoryAgentId, result.memory.content);
         } catch (err) {
           console.error(`[memory] Link resolution failed for ${result.memory.id}:`, err.message);
         }
@@ -7430,13 +7484,13 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
         return true;
       }
     }
-    if (sourcePath && agentId) {
-      store.deleteBySourcePath(sourcePath, agentId);
+    if (sourcePath && memoryAgentId) {
+      store.deleteBySourcePath(sourcePath, memoryAgentId);
     }
     const headerContextKey = req.headers["x-context-key"];
     const resolvedContextKey = contextKey ?? (Array.isArray(headerContextKey) ? headerContextKey[0] : headerContextKey) ?? undefined;
     const memories = store.storeBatch(contentChunks.map((chunk) => ({
-      agentId: agentId || null,
+      agentId: memoryAgentId || null,
       content: chunk.content,
       name,
       scope,
@@ -7450,10 +7504,10 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
       intent: "index memory content",
       key: sourcePath || null
     })));
-    if (agentId) {
+    if (memoryAgentId) {
       for (const memory of memories) {
         try {
-          storeLinks(memory.id, agentId, memory.content);
+          storeLinks(memory.id, memoryAgentId, memory.content);
         } catch (err) {
           console.error(`[memory] Link resolution failed for ${memory.id}:`, err.message);
         }
@@ -7819,11 +7873,17 @@ async function handleMemory(req, res, pathSegments, myAgentId) {
     const parsed = await getMemoryById.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const memory = getMemoryStore().get(parsed.params.id);
-    if (!memory) {
+    const store = getMemoryStore();
+    const memoryForAuth = store.peek(parsed.params.id);
+    if (!memoryForAuth) {
       jsonError(res, "Memory not found", 404);
       return true;
     }
+    if (!canReadMemory(memoryForAuth, myAgentId)) {
+      jsonError(res, "Not authorized", 403);
+      return true;
+    }
+    const memory = store.get(parsed.params.id);
     const { intent } = parsed.query;
     const sourceTaskIdHeader = req.headers["x-source-task-id"];
     const sourceTaskId = Array.isArray(sourceTaskIdHeader) ? sourceTaskIdHeader[0] : sourceTaskIdHeader;
@@ -9076,6 +9136,86 @@ function injectBrowserSdk(html) {
   }
   return injection + html;
 }
+var PRINT_AUTOTRIGGER_SCRIPT = `<script>
+  (function () {
+    function print() { setTimeout(function () { window.print(); }, 400); }
+    window.addEventListener("load", function () {
+      var fonts = document.fonts;
+      if (fonts && fonts.ready && typeof fonts.ready.then === "function") {
+        fonts.ready.then(print, print);
+      } else {
+        print();
+      }
+    });
+  })();
+</script>`;
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+}
+function printableJsonPageHtml(page) {
+  let body = page.body;
+  try {
+    body = JSON.stringify(JSON.parse(page.body), null, 2);
+  } catch {}
+  const description = page.description ? `<p class="description">${escapeHtml(page.description)}</p>` : "";
+  return `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>${escapeHtml(page.title)}</title>
+    <style>
+      body {
+        color: #111827;
+        font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        line-height: 1.5;
+        margin: 0;
+        padding: 24px;
+      }
+      h1 {
+        font-size: 24px;
+        line-height: 1.2;
+        margin: 0 0 8px;
+      }
+      .description {
+        color: #4b5563;
+        margin: 0 0 20px;
+      }
+      pre {
+        background: #f8fafc;
+        border: 1px solid #e5e7eb;
+        border-radius: 6px;
+        color: #111827;
+        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+        font-size: 11px;
+        line-height: 1.45;
+        margin: 0;
+        overflow-wrap: anywhere;
+        padding: 16px;
+        white-space: pre-wrap;
+      }
+    </style>
+  </head>
+  <body>
+    <h1>${escapeHtml(page.title)}</h1>
+    ${description}
+    <pre>${escapeHtml(body)}</pre>
+    ${PRINT_AUTOTRIGGER_SCRIPT}
+  </body>
+</html>`;
+}
 function stripJsonSuffix(idSegment) {
   return idSegment.endsWith(".json") ? idSegment.slice(0, -".json".length) : null;
 }
@@ -9257,7 +9397,22 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
     bumpViewCount(page.id);
     return true;
   }
+  const wantsPrint = queryParams.get("print") === "1";
   if (page.contentType === "application/json") {
+    if (wantsPrint) {
+      const headers4 = {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Content-Security-Policy": buildCsp(),
+        "X-Content-Type-Options": "nosniff"
+      };
+      if (inlineSetCookie)
+        headers4["Set-Cookie"] = inlineSetCookie;
+      res.writeHead(200, headers4);
+      res.end(printableJsonPageHtml(page));
+      bumpViewCount(page.id);
+      return true;
+    }
     const headers3 = { Location: `${getAppBaseUrl2()}/pages/${page.id}` };
     if (inlineSetCookie)
       headers3["Set-Cookie"] = inlineSetCookie;
@@ -9265,7 +9420,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
     res.end();
     return true;
   }
-  const html = injectBrowserSdk(page.body);
+  const html = injectBrowserSdk(page.body) + (wantsPrint ? PRINT_AUTOTRIGGER_SCRIPT : "");
   const headers2 = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
@@ -11519,6 +11674,102 @@ var listVersionsRoute = route({
     404: { description: "Script not found" }
   }
 });
+var apiEndpointParamsSchema = exports_external.object({
+  id: exports_external.string().uuid(),
+  endpointId: exports_external.string()
+});
+var createScriptApiBodySchema = exports_external.object({
+  authMode: ScriptApiAuthModeSchema.default("bearer"),
+  label: exports_external.string().max(200).optional(),
+  agentId: exports_external.string().optional()
+});
+var patchScriptApiBodySchema = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  label: exports_external.string().max(200).nullable().optional()
+});
+var createScriptApiRoute = route({
+  method: "post",
+  path: "/api/scripts/{id}/apis",
+  pattern: ["api", "scripts", null, "apis"],
+  operationId: "scripts_api_create",
+  summary: "Expose a script as an external HTTP API endpoint",
+  description: "Returns the endpoint plus the plaintext bearer token (when authMode is 'bearer').",
+  tags: ["Scripts"],
+  params: idParamsSchema2,
+  body: createScriptApiBodySchema,
+  responses: {
+    201: { description: "Endpoint created" },
+    400: { description: "Validation error or script has no owning agent" },
+    404: { description: "Script not found" }
+  }
+});
+var listScriptApisRoute = route({
+  method: "get",
+  path: "/api/scripts/{id}/apis",
+  pattern: ["api", "scripts", null, "apis"],
+  operationId: "scripts_api_list",
+  summary: "List external API endpoints for a script",
+  tags: ["Scripts"],
+  params: idParamsSchema2,
+  responses: {
+    200: { description: "Endpoints (without secrets)" },
+    404: { description: "Script not found" }
+  }
+});
+var revealScriptApiSecretRoute = route({
+  method: "get",
+  path: "/api/scripts/{id}/apis/{endpointId}/secret",
+  pattern: ["api", "scripts", null, "apis", null, "secret"],
+  operationId: "scripts_api_reveal_secret",
+  summary: "Reveal an endpoint's bearer token",
+  tags: ["Scripts"],
+  params: apiEndpointParamsSchema,
+  responses: {
+    200: { description: "Decrypted token (null when authMode is 'none')" },
+    404: { description: "Endpoint not found" }
+  }
+});
+var patchScriptApiRoute = route({
+  method: "patch",
+  path: "/api/scripts/{id}/apis/{endpointId}",
+  pattern: ["api", "scripts", null, "apis", null],
+  operationId: "scripts_api_update",
+  summary: "Enable/disable or relabel an external API endpoint",
+  tags: ["Scripts"],
+  params: apiEndpointParamsSchema,
+  body: patchScriptApiBodySchema,
+  responses: {
+    200: { description: "Updated endpoint" },
+    404: { description: "Endpoint not found" }
+  }
+});
+var rotateScriptApiRoute = route({
+  method: "post",
+  path: "/api/scripts/{id}/apis/{endpointId}/rotate",
+  pattern: ["api", "scripts", null, "apis", null, "rotate"],
+  operationId: "scripts_api_rotate",
+  summary: "Rotate an endpoint's bearer token",
+  tags: ["Scripts"],
+  params: apiEndpointParamsSchema,
+  responses: {
+    200: { description: "Endpoint with new plaintext token" },
+    400: { description: "Endpoint uses 'none' auth — nothing to rotate" },
+    404: { description: "Endpoint not found" }
+  }
+});
+var deleteScriptApiRoute = route({
+  method: "delete",
+  path: "/api/scripts/{id}/apis/{endpointId}",
+  pattern: ["api", "scripts", null, "apis", null],
+  operationId: "scripts_api_delete",
+  summary: "Delete an external API endpoint",
+  tags: ["Scripts"],
+  params: apiEndpointParamsSchema,
+  responses: {
+    200: { description: "Deleted" },
+    404: { description: "Endpoint not found" }
+  }
+});
 function requireAgent2(res, agentId) {
   if (!agentId) {
     jsonError(res, "X-Agent-ID required for scripts API", 400);
@@ -11834,6 +12085,99 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     json(res, { deleted });
     return true;
   }
+  if (createScriptApiRoute.match(req.method, pathSegments)) {
+    const parsed = await createScriptApiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const script = getScriptById(parsed.params.id);
+    if (!script) {
+      jsonError(res, "Script not found", 404);
+      return true;
+    }
+    const runAsAgentId = parsed.body.agentId ?? script.scopeId ?? script.createdByAgentId;
+    if (!runAsAgentId) {
+      jsonError(res, "agentId is required: this script has no owning agent to run as", 400);
+      return true;
+    }
+    const endpoint = createScriptApi({
+      scriptId: script.id,
+      agentId: runAsAgentId,
+      authMode: parsed.body.authMode,
+      label: parsed.body.label ?? null,
+      createdBy: resolveHttpAuditUserId(req, agentId)
+    });
+    json(res, endpoint, 201);
+    return true;
+  }
+  if (listScriptApisRoute.match(req.method, pathSegments)) {
+    const parsed = await listScriptApisRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!getScriptById(parsed.params.id)) {
+      jsonError(res, "Script not found", 404);
+      return true;
+    }
+    json(res, { apis: listScriptApisForScript(parsed.params.id) });
+    return true;
+  }
+  if (revealScriptApiSecretRoute.match(req.method, pathSegments)) {
+    const parsed = await revealScriptApiSecretRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const endpoint = getScriptApiById(parsed.params.endpointId);
+    if (!endpoint || endpoint.scriptId !== parsed.params.id) {
+      jsonError(res, "Endpoint not found", 404);
+      return true;
+    }
+    json(res, { token: getScriptApiSecret(endpoint.id) });
+    return true;
+  }
+  if (rotateScriptApiRoute.match(req.method, pathSegments)) {
+    const parsed = await rotateScriptApiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const endpoint = getScriptApiById(parsed.params.endpointId);
+    if (!endpoint || endpoint.scriptId !== parsed.params.id) {
+      jsonError(res, "Endpoint not found", 404);
+      return true;
+    }
+    const rotated = rotateScriptApiSecret(endpoint.id, resolveHttpAuditUserId(req, agentId));
+    if (!rotated) {
+      jsonError(res, "Cannot rotate a token on a 'none' auth endpoint", 400);
+      return true;
+    }
+    json(res, rotated);
+    return true;
+  }
+  if (patchScriptApiRoute.match(req.method, pathSegments)) {
+    const parsed = await patchScriptApiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const endpoint = getScriptApiById(parsed.params.endpointId);
+    if (!endpoint || endpoint.scriptId !== parsed.params.id) {
+      jsonError(res, "Endpoint not found", 404);
+      return true;
+    }
+    const updated = updateScriptApi(endpoint.id, {
+      enabled: parsed.body.enabled,
+      label: parsed.body.label,
+      updatedBy: resolveHttpAuditUserId(req, agentId)
+    });
+    json(res, updated);
+    return true;
+  }
+  if (deleteScriptApiRoute.match(req.method, pathSegments)) {
+    const parsed = await deleteScriptApiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const endpoint = getScriptApiById(parsed.params.endpointId);
+    if (!endpoint || endpoint.scriptId !== parsed.params.id) {
+      jsonError(res, "Endpoint not found", 404);
+      return true;
+    }
+    json(res, { deleted: deleteScriptApi(endpoint.id) });
+    return true;
+  }
   return false;
 }
 
@@ -12025,6 +12369,21 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
         isError: parsed.body.isError ?? false,
         costSource
       });
+      recordSessionCost({
+        totalCostUsd,
+        harness: parsed.body.provider ?? "unknown",
+        model,
+        costSource,
+        isError: parsed.body.isError ?? false,
+        tokens: {
+          input: inputTokens,
+          output: outputTokens,
+          cacheRead: cachedInputTokens,
+          cacheWrite: parsed.body.cacheWriteTokens ?? 0,
+          reasoning: parsed.body.reasoningOutputTokens ?? 0,
+          thinking: parsed.body.thinkingTokens ?? 0
+        }
+      });
       incrementServerSessionsProcessed();
       json(res, { success: true, cost }, 201);
     } catch (error) {
@@ -16918,6 +17277,167 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
   return false;
 }
 
+// src/http/x.ts
+init_zod();
+init_db();
+import { timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+init_secret_scrubber();
+var DEFAULT_TIMEOUT_MS = 60000;
+var MIN_TIMEOUT_MS = 1000;
+var MAX_TIMEOUT_MS = 300000;
+var TIMEOUT_HEADER = "x-swarm-timeout-ms";
+var MAX_BODY_BYTES = 1 * 1024 * 1024;
+var scriptApiRoute = route({
+  method: "post",
+  path: "/api/x/script/{endpointId}",
+  pattern: ["api", "x", "script", null],
+  operationId: "x_script_run",
+  summary: "Invoke an externally-exposed swarm script",
+  description: "Runs the script bound to this endpoint and returns a JSON envelope " + "`{ ok, result, error, durationMs }` (HTTP 200) once execution is reached. " + "Auth/routing failures use 401 (bad/missing bearer) and 404 (unknown or " + "disabled endpoint). Optional `X-Swarm-Timeout-Ms` header (default 60000, " + "clamped 1000–300000) sets the wall-clock timeout.",
+  tags: ["External APIs"],
+  params: exports_external.object({ endpointId: exports_external.string() }),
+  auth: { apiKey: false },
+  responses: {
+    200: { description: "Script executed — see `ok` in the envelope" },
+    401: { description: "Missing or invalid bearer token" },
+    404: { description: "Endpoint not found or disabled" },
+    501: { description: "workspace-rw scripts are not supported" }
+  }
+});
+function extractBearer3(req) {
+  const raw = req.headers.authorization;
+  const header = Array.isArray(raw) ? raw[0] : raw;
+  if (!header)
+    return null;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  return match?.[1] ?? null;
+}
+function timingSafeEqualStr(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length)
+    return false;
+  return timingSafeEqual3(ab, bb);
+}
+function resolveTimeoutMs(req) {
+  const raw = req.headers[TIMEOUT_HEADER];
+  const val = Array.isArray(raw) ? raw[0] : raw;
+  if (!val)
+    return DEFAULT_TIMEOUT_MS;
+  const n = Number(val);
+  if (!Number.isFinite(n))
+    return DEFAULT_TIMEOUT_MS;
+  return Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, Math.floor(n)));
+}
+function buildExecutionError(output) {
+  if (output.runtimeError) {
+    return {
+      type: "runtime_error",
+      message: `${output.runtimeError.name}: ${output.runtimeError.message}`
+    };
+  }
+  switch (output.error) {
+    case "timeout":
+      return { type: "timeout", message: "Script timed out" };
+    case "import_violation":
+      return { type: "import_violation", message: output.stderr || "Disallowed import" };
+    default:
+      return {
+        type: "runtime_error",
+        message: output.error ? `Script failed: ${output.error}` : `Script exited with code ${output.exitCode}`
+      };
+  }
+}
+async function handleX(req, res, pathSegments) {
+  if (!scriptApiRoute.match(req.method, pathSegments))
+    return false;
+  const endpointId = pathSegments[3] ?? "";
+  const endpoint = getScriptApiById(endpointId);
+  if (!endpoint || !endpoint.enabled) {
+    json(res, { error: { type: "not_found", message: "Endpoint not found" } }, 404);
+    return true;
+  }
+  if (endpoint.authMode === "bearer") {
+    const provided = extractBearer3(req);
+    const expected = getScriptApiSecret(endpointId);
+    if (!provided || !expected || !timingSafeEqualStr(provided, expected)) {
+      json(res, { error: { type: "unauthorized", message: "Invalid or missing bearer token" } }, 401);
+      return true;
+    }
+  }
+  if (enforceContentLengthCap(req, res, MAX_BODY_BYTES) === BODY_TOO_LARGE)
+    return true;
+  let args;
+  try {
+    args = await parseBody(req);
+  } catch {
+    json(res, {
+      ok: false,
+      result: null,
+      error: { type: "invalid_json", message: "Request body must be valid JSON" },
+      durationMs: 0
+    });
+    return true;
+  }
+  const script = getScriptById(endpoint.scriptId);
+  if (!script) {
+    json(res, { error: { type: "not_found", message: "Script not found" } }, 404);
+    return true;
+  }
+  if (script.fsMode === "workspace-rw") {
+    jsonError(res, "workspace-rw scripts are not supported", 501);
+    return true;
+  }
+  if (script.argsJsonSchema) {
+    try {
+      const schema = JSON.parse(script.argsJsonSchema);
+      const errors = validateJsonSchema(schema, args ?? null);
+      if (errors.length > 0) {
+        json(res, {
+          ok: false,
+          result: null,
+          error: { type: "args_validation", message: errors.join("; "), details: errors },
+          durationMs: 0
+        });
+        return true;
+      }
+    } catch {}
+  }
+  const timeoutMs = resolveTimeoutMs(req);
+  const startedAt = new Date().toISOString();
+  const output = await runScript({
+    source: script.source,
+    args: args ?? null,
+    fsMode: "none",
+    agentId: endpoint.agentId,
+    timeoutMs,
+    egressSecrets: buildScriptCredentialBindings({ agentId: endpoint.agentId }),
+    apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId })
+  });
+  const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
+  const error = ok ? null : buildExecutionError(output);
+  try {
+    recordScriptApiUsage(endpointId);
+  } catch {}
+  try {
+    recordInlineScriptRun({
+      id: crypto.randomUUID(),
+      agentId: endpoint.agentId,
+      source: script.source,
+      args: scrubObject(args ?? null),
+      scriptName: script.name,
+      status: ok ? "completed" : "failed",
+      output: scrubObject(output.result),
+      error: ok ? undefined : scrubSecrets(error?.message ?? "Script failed"),
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      apiEndpointId: endpointId
+    });
+  } catch {}
+  json(res, scrubObject({ ok, result: ok ? output.result : null, error, durationMs: output.durationMs }));
+  return true;
+}
+
 // src/http/index.ts
 process.on("uncaughtException", (err) => {
   console.error("[fatal] uncaughtException:", err);
@@ -16958,7 +17478,10 @@ function startApiGcInterval() {
   const interval = setInterval(() => {
     const closedOwnerTransports = closeIdleMcpTransports(transports, transportActivity, {
       idleTimeoutMs: MCP_TRANSPORT_IDLE_TIMEOUT_MS,
-      label: "MCP"
+      label: "MCP",
+      onClose: (id) => {
+        delete mcpSessionAgents[id];
+      }
     });
     const closedUserTransports = closeIdleMcpUserTransports(transportsUser, sessionUsers, transportActivityUser, { idleTimeoutMs: MCP_TRANSPORT_IDLE_TIMEOUT_MS });
     if (closedOwnerTransports > 0 || closedUserTransports > 0) {
@@ -16974,6 +17497,7 @@ if (globalState.__httpServer) {
   globalState.__httpServer.close();
 }
 var transports = globalState.__transports ?? {};
+var mcpSessionAgents = globalState.__mcpSessionAgents ?? {};
 var transportsUser = globalState.__transportsUser ?? {};
 var sessionUsers = globalState.__sessionUsers ?? {};
 var transportActivity = globalState.__transportActivity ?? {};
@@ -17071,6 +17595,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleSkills(req, res, pathSegments, queryParams, myAgentId),
         () => handleScriptRuns(req, res, pathSegments, queryParams, myAgentId),
         () => handleScripts(req, res, pathSegments, queryParams, myAgentId),
+        () => handleX(req, res, pathSegments),
         () => handleMcpBridge(req, res, pathSegments, queryParams, myAgentId),
         () => handleMcpServers(req, res, pathSegments, queryParams),
         () => handleMcpOAuth(req, res, pathSegments, queryParams),
@@ -17085,7 +17610,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleSessions(req, res, pathSegments, queryParams),
         () => handleInboxState(req, res, pathSegments, queryParams),
         () => handleTaskTemplates(req, res, pathSegments, queryParams),
-        () => handleMcp(req, res, transports, transportActivity),
+        () => handleMcp(req, res, transports, transportActivity, mcpSessionAgents),
         () => handleMcpUser(req, res, transportsUser, sessionUsers, transportActivityUser)
       ];
       try {
@@ -17120,6 +17645,7 @@ var httpServer = createHttpServer(async (req, res) => {
 globalState.__httpServer = httpServer;
 globalState.__transports = transports;
 globalState.__transportsUser = transportsUser;
+globalState.__mcpSessionAgents = mcpSessionAgents;
 globalState.__sessionUsers = sessionUsers;
 globalState.__transportActivity = transportActivity;
 globalState.__transportActivityUser = transportActivityUser;
@@ -17131,14 +17657,14 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-xf6fp4y1.js");
+    const { stopScheduler } = await import("./index-45bqm6xc.js");
     stopScheduler();
   }
   stopHeartbeat();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-mj4302vw.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-8gbgeg21.js");
     await stopOAuthKeepalive();
   }
   stopMcpOAuthPendingGc();
@@ -17151,6 +17677,7 @@ async function shutdown() {
     console.log(`[HTTP] Closing transport ${id}`);
     transport.close();
     delete transports[id];
+    delete mcpSessionAgents[id];
     delete transportActivity[id];
   }
   for (const [id, transport] of Object.entries(transportsUser)) {
@@ -17190,15 +17717,15 @@ try {
   throw err;
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-w3x550cj.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-3tqmbe0p.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-nqyf8bkb.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-f6cgj5br.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { runAllSeeders } = await import("./index-jca7jdpt.js");
+  const { runAllSeeders } = await import("./index-jscerv2x.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -17231,31 +17758,31 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-xf6fp4y1.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-881c1baf.js");
+    const { startScheduler } = await import("./index-45bqm6xc.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-v3r40ak0.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (process.env.HEARTBEAT_DISABLE !== "true") {
-    const { startHeartbeat } = await import("./index-xz8vaa5c.js");
+    const { startHeartbeat } = await import("./index-f5e873a5.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-mj4302vw.js");
+    const { startOAuthKeepalive } = await import("./keepalive-8gbgeg21.js");
     startOAuthKeepalive();
   }
   startMcpOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-9kt97g1z.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-atv4kcrh.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-3q1aywnz.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-zanbm36c.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-vskq108e.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-asq051ff.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {