@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/dist/{http-2xz43gz3.js → http-809fvtz2.js}

@@ -7,14 +7,14 @@ import {
   SUPPORTED_PROTOCOL_VERSIONS,
   agentWithCapacity,
   applyRating,
+  assertOAuthAppUrlsSafe,
+  assertOAuthProviderIsNotReserved,
   assertSelectOnlyQuery,
-  can,
   canClaim,
   canReadMemory,
   cancelTaskHandler,
   cancelTaskInputSchema,
   cancelTaskOutputSchema,
-  clearAuditSink,
   clearJiraMetadata,
   createEvent,
   createEventsBatch,
@@ -25,8 +25,11 @@ import {
   describeRequestRoute,
   emitBudgetRefusalSideEffects,
   enforceContentLengthCap,
+  enqueueAdmissionRow,
+  enqueueAuditRow,
   executeReadOnlyQuery,
   expandCandidatesWithGraph,
+  flushAuditBuffer,
   getEnabledCapabilities,
   getEventCountsFiltered,
   getEventsFiltered,
@@ -89,18 +92,24 @@ import {
   registerJiraWebhook,
   reloadGlobalConfigsAndIntegrations,
   resolveHttpAuditUserId,
+  resolveScopedResourceId,
+  resolveTaskAuditUserId,
   route,
   safeRequestUrlForLog,
   scheduleIntegrationsReload,
+  scopedResourceScopeIdSchema,
   sendKapsoReaction,
   sendTaskHandler,
   sendTaskOutputSchema,
-  setAuditSink,
   setCorsHeaders,
   shouldPersistAutomaticTaskMemory,
   snapshotMetric,
   snapshotPage,
+  startAuditGc,
+  startAuditWriter,
   startSpan,
+  stopAuditGc,
+  stopAuditWriter,
   storeLinks,
   taskActionHandler,
   taskActionInputSchema,
@@ -114,16 +123,16 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-4xyj9jtq.js";
+} from "./cli-hrhye2rm.js";
+import"./cli-1z7048dy.js";
 import {
   BROWSER_SDK_JS,
   SWARM_UI_JS
 } from "./cli-xm2tyqfe.js";
-import"./cli-1z7048dy.js";
 import {
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
-} from "./cli-dcfyyh3t.js";
+} from "./cli-ftyf58xj.js";
 import {
   deriveCodexKeySuffix,
   getValidCodexOAuth,
@@ -134,41 +143,38 @@ import {
 } from "./cli-gz9sbyk3.js";
 import {
   reasoningCapability
-} from "./cli-tkmm5nf9.js";
-import {
-  acquireOAuthRefreshLock,
-  buildAuthorizationUrl,
-  calculatePKCECodeChallenge,
-  deleteOAuthTokens,
-  ensureTokenOrThrow,
-  exchangeCode,
-  generateRandomCodeVerifier,
-  generateRandomState,
-  getOAuthApp,
-  getOAuthTokens,
-  releaseOAuthRefreshLock
-} from "./cli-bgef578c.js";
-import"./cli-36ymmpmp.js";
+} from "./cli-e61fs2hp.js";
+import"./cli-3samkyap.js";
 import {
   normalizeModelKey
-} from "./cli-tbw13sx8.js";
+} from "./cli-tece6zgm.js";
+import {
+  getUserGrant
+} from "./cli-52fg7s7x.js";
+import {
+  can,
+  clearAuditSink,
+  decideToolAdmission,
+  isRbacEnabled,
+  setAuditSink
+} from "./cli-86fdnerz.js";
 import {
-  SCRIPT_STDLIB_TYPES,
   ensureAgentFsCredentialsForAgent,
   extractArgsJsonSchema,
   extractScriptSignature,
   scriptSdkTypesWithGeneratedApis,
+  scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-hsetkkd3.js";
+} from "./cli-12vb0xg6.js";
 import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-bnzbn8j8.js";
+} from "./cli-beea4a3y.js";
 import {
   createResumeFollowUp,
   createWorkerTaskFollowUp
-} from "./cli-r5g6ngtn.js";
+} from "./cli-dcca6j8m.js";
 import"./cli-fad8m16k.js";
 import {
   calculateNextRun,
@@ -176,7 +182,7 @@ import {
   ensure,
   initialize,
   require_dist
-} from "./cli-gtkqc144.js";
+} from "./cli-shvaxw27.js";
 import {
   RawLlmConfigSchema,
   TriggerSchemaError,
@@ -187,6 +193,8 @@ import {
   executeRawLlm,
   generateEdges,
   getExecutorRegistry,
+  getOAuthBindingTokenStatus,
+  getOAuthProviderConfig,
   handleWebhookTrigger,
   initWorkflows,
   retryFailedRun,
@@ -196,31 +204,63 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-z46pnksz.js";
+} from "./cli-q1rx7g0d.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
+  CredentialBindingSchema,
+  applyMcpOAuthRefresh,
+  assertUrlSafe,
+  buildAuthorizeUrl,
+  callMcpServerTool,
+  computeExpiresAt,
+  consumeMcpOAuthPending,
   createScriptApi,
+  deleteMcpOAuthToken,
   deleteScript,
   deleteScriptApi,
+  discoverAuthorizationServerMetadata,
+  discoverProtectedResourceMetadata,
+  ensureMcpToken,
+  exchangeCodeForTokens,
+  gcMcpOAuthPending,
+  getMcpOAuthToken,
   getScript,
   getScriptApiById,
   getScriptApiConnectionDescriptors,
   getScriptApiSecret,
   getScriptApiTypes,
   getScriptById,
+  getScriptConnectionById,
+  getScriptMcpConnectionDescriptors,
+  getScriptMcpTypes,
+  insertMcpOAuthPending,
+  listRelationalCredentialBindings,
   listScriptApisForScript,
+  listScriptConnections,
   listScriptVersions,
   listScripts,
+  placeholderForConfigKey,
+  publicEndpointSsrfOptions,
   recordScriptApiUsage,
+  refreshMcpToken,
+  refreshScriptConnection,
+  registerClient,
+  revokeMcpToken,
   rotateScriptApiSecret,
+  setMcpServerAuthMethod,
+  setScriptConnectionEnabled,
   updateScriptApi,
-  upsertScriptByName
-} from "./cli-qwgtacd6.js";
+  upsertCredentialBinding,
+  upsertMcpOAuthToken,
+  upsertScriptByName,
+  upsertScriptConnection
+} from "./cli-r9f6ngrf.js";
+import"./cli-jkhwmmgg.js";
 import {
   searchScripts
-} from "./cli-30bbaveh.js";
+} from "./cli-cmw9rzy5.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -228,22 +268,33 @@ import {
   init_constants,
   init_reranker,
   rerank
-} from "./cli-f3qa069v.js";
+} from "./cli-7xje5amz.js";
 import"./cli-q25ejbyn.js";
-import"./cli-bgvskydy.js";
+import {
+  acquireOAuthRefreshLock,
+  buildAuthorizationUrl,
+  deleteOAuthTokens,
+  ensureTokenOrThrow,
+  exchangeCode,
+  forceRefreshTokenOrThrow,
+  getOAuthApp,
+  getOAuthTokens,
+  releaseOAuthRefreshLock,
+  upsertOAuthApp
+} from "./cli-t0vqevnm.js";
+import"./cli-0pygq9r1.js";
+import"./cli-tffvrh6j.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-trmapn9k.js";
+} from "./cli-pet3aev6.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import {
-  recordUnmappedIdentity
-} from "./cli-c9mtm09b.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
+  findUserById,
   fingerprintApiKey,
   getUserIdentities,
   linkIdentity,
@@ -251,18 +302,21 @@ import {
   listUserTokens,
   mintToken,
   recordIdentityEvent,
+  recordUnmappedIdentity,
+  renderIdentity,
+  resolveIdentity,
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-h3k622d0.js";
-import"./cli-6xd0bvf8.js";
+} from "./cli-6aq8xhvm.js";
+import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import {
   agentContextKey,
   createTaskWithSiblingAwareness,
   gitlabContextKey,
   pageContextKey
-} from "./cli-y4ycrnjc.js";
+} from "./cli-k3y4z3h5.js";
 import {
   getAppUrl,
   getConfiguredAppUrls,
@@ -357,7 +411,6 @@ import {
   createTaskExtended,
   createUser,
   createWorkflow,
-  decryptSecret,
   deleteActiveSession,
   deleteActiveSessionById,
   deleteBudget,
@@ -376,7 +429,6 @@ import {
   deleteTaskAttachment,
   deleteUser,
   deleteWorkflow,
-  encryptSecret,
   failTask,
   findTaskByVcs,
   getActivePricingRow,
@@ -406,7 +458,6 @@ import {
   getCurrentRequestAuth,
   getDashboardCostSummary,
   getDb,
-  getEncryptionKey,
   getInboxSummary,
   getInstanceActivity,
   getKeyCostSummary,
@@ -464,7 +515,7 @@ import {
   getTaskStats,
   getTasksCount,
   getTemplateDefinition,
-  getUnassignedTaskIds,
+  getUnassignedTaskIdsForAgent,
   getUserById,
   getWorkflow,
   getWorkflowRun,
@@ -477,7 +528,6 @@ import {
   incrKv,
   incrementPageViewCount,
   initTelemetry,
-  init_crypto,
   init_date_utils,
   init_db,
   init_registry,
@@ -516,7 +566,7 @@ import {
   listWorkflows,
   markKeyRateLimited,
   maskSecrets,
-  normalizeDateRequired,
+  normalizeDate,
   pauseTask,
   recordBudgetRefusalNotification,
   recordInlineScriptRun,
@@ -574,22 +624,22 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 import"./cli-z2zcxes1.js";
 import {
   init_zod
-} from "./cli-q21d49ac.js";
+} from "./cli-bw80ck94.js";
 import {
   array,
   exports_external,
   number,
   object,
   string
-} from "./cli-anrj584m.js";
+} from "./cli-xz9aq0rf.js";
 import {
   init_package,
   package_default
-} from "./cli-c3frqf65.js";
+} from "./cli-b23axgz4.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
@@ -603,18 +653,18 @@ import {
 } from "./cli-9aryf9tv.js";
 import {
   bedrockProviderModule
-} from "./cli-vbraamxr.js";
+} from "./cli-6b4wwmm8.js";
+import"./cli-cwy5hqbq.js";
 import"./cli-jvv0g8bh.js";
 import {
   setBedrockProviderModule
 } from "./cli-xw7p4wkq.js";
 import"./cli-hv2fndhm.js";
-import"./cli-cwy5hqbq.js";
 import"./cli-pscrc6tw.js";
-import"./cli-4wgngmwv.js";
-import"./cli-vapyk8sw.js";
 import"./cli-zyxs93y9.js";
+import"./cli-4wgngmwv.js";
 import"./cli-bsyka9ta.js";
+import"./cli-vapyk8sw.js";
 import"./cli-y2apkfe2.js";
 import"./cli-m6pzzhqr.js";
 import"./cli-7wmybrt5.js";
@@ -639,146 +689,6 @@ import {
 } from "node:http";
 init_db();
 
-// src/be/rbac-audit.ts
-init_db();
-var FLUSH_INTERVAL_MS = 2000;
-var FLUSH_MAX_ROWS = 200;
-var AUDIT_GC_INTERVAL_MS = 24 * 60 * 60 * 1000;
-var DEFAULT_RETENTION_DAYS = 30;
-var buffer = [];
-var flushTimer = null;
-var auditGcTimer = null;
-var thresholdFlushScheduled = false;
-function isAuditDisabled() {
-  return process.env.RBAC_AUDIT_DISABLED === "true";
-}
-function principalIdOf(principal) {
-  switch (principal.kind) {
-    case "agent":
-      return principal.agentId;
-    case "user":
-      return principal.userId;
-    case "operator":
-      return null;
-  }
-}
-function resourceIdOf(resource) {
-  if (!resource)
-    return null;
-  switch (resource.kind) {
-    case "task":
-      return resource.taskId;
-    case "agent":
-      return resource.agentId;
-    case "kv-namespace":
-      return resource.namespace;
-    case "owned":
-      return resource.ownerAgentId ?? null;
-    case "none":
-      return null;
-  }
-}
-function toRow(check, decision) {
-  return {
-    principalType: check.principal.kind,
-    principalId: principalIdOf(check.principal),
-    originatorUserId: null,
-    verb: check.verb,
-    resourceType: check.resource?.kind ?? null,
-    resourceId: resourceIdOf(check.resource),
-    decision: decision.allow ? "allow" : "deny",
-    reason: decision.allow ? null : decision.reason,
-    source: check.source
-  };
-}
-function enqueueAuditRow(check, decision) {
-  if (isAuditDisabled())
-    return;
-  try {
-    buffer.push(toRow(check, decision));
-    if (buffer.length >= FLUSH_MAX_ROWS && !thresholdFlushScheduled) {
-      thresholdFlushScheduled = true;
-      const t = setTimeout(() => {
-        thresholdFlushScheduled = false;
-        flushAuditBuffer();
-      }, 0);
-      if (typeof t.unref === "function")
-        t.unref();
-    }
-  } catch (err) {
-    console.warn("[rbac-audit] enqueue failed, dropping row:", err.message);
-  }
-}
-function flushAuditBuffer() {
-  if (buffer.length === 0)
-    return;
-  const rows = buffer;
-  buffer = [];
-  try {
-    const db = getDb();
-    const stmt = db.prepare(`INSERT INTO permission_audit
-         (principalType, principalId, originatorUserId, verb, resourceType, resourceId, decision, reason, source)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
-    const insertAll = db.transaction((batch) => {
-      for (const r of batch) {
-        stmt.run(r.principalType, r.principalId, r.originatorUserId, r.verb, r.resourceType, r.resourceId, r.decision, r.reason, r.source);
-      }
-    });
-    insertAll(rows);
-  } catch (err) {
-    console.warn(`[rbac-audit] flush failed, dropping ${rows.length} row(s):`, err.message);
-  }
-}
-function flushIntervalMs() {
-  const v = Number(process.env.RBAC_AUDIT_FLUSH_MS);
-  return Number.isFinite(v) && v > 0 ? v : FLUSH_INTERVAL_MS;
-}
-function startAuditWriter(intervalMs = flushIntervalMs()) {
-  if (flushTimer)
-    return;
-  flushTimer = setInterval(() => flushAuditBuffer(), intervalMs);
-  if (typeof flushTimer?.unref === "function")
-    flushTimer.unref();
-}
-function stopAuditWriter() {
-  if (flushTimer) {
-    clearInterval(flushTimer);
-    flushTimer = null;
-  }
-}
-function purgeExpiredAuditRows() {
-  try {
-    const days = Number(process.env.RBAC_AUDIT_RETENTION_DAYS) || DEFAULT_RETENTION_DAYS;
-    const result = getDb().prepare("DELETE FROM permission_audit WHERE ts < datetime('now', ?)").run(`-${days} days`);
-    return result.changes;
-  } catch (err) {
-    console.warn("[rbac-audit] retention purge failed:", err.message);
-    return 0;
-  }
-}
-function startAuditGc(intervalMs = AUDIT_GC_INTERVAL_MS) {
-  if (auditGcTimer)
-    return;
-  const purged = purgeExpiredAuditRows();
-  if (purged > 0) {
-    console.log(`[rbac-audit] Initial retention purge removed ${purged} audit row(s)`);
-  }
-  auditGcTimer = setInterval(() => {
-    const n = purgeExpiredAuditRows();
-    if (n > 0) {
-      console.log(`[rbac-audit] Retention purge removed ${n} audit row(s)`);
-    }
-  }, intervalMs);
-  if (typeof auditGcTimer?.unref === "function")
-    auditGcTimer.unref();
-}
-function stopAuditGc() {
-  if (auditGcTimer) {
-    clearInterval(auditGcTimer);
-    auditGcTimer = null;
-  }
-}
-
 // src/gitlab/auth.ts
 var initialized = false;
 var webhookSecret = null;
@@ -896,7 +806,7 @@ registerTemplate({
   eventType: "gitlab.merge_request.opened",
   header: "[GitLab MR #{{mr_iid}}] {{mr_title}}",
   defaultBody: `Repo: {{repo}}
-Author: @{{username}}
+Author: {{username}}
 Branch: {{source_branch}} → {{target_branch}}
 URL: {{mr_url}}
 
@@ -905,7 +815,10 @@ URL: {{mr_url}}
     { name: "mr_iid", description: "Merge request IID" },
     { name: "mr_title", description: "Merge request title" },
     { name: "repo", description: "Project path with namespace" },
-    { name: "username", description: "Event sender username" },
+    {
+      name: "username",
+      description: "Author identity — resolved canonical name (e.g. 'Luis (gitlab:username)') or the UNKNOWN sentinel"
+    },
     { name: "source_branch", description: "Source branch name" },
     { name: "target_branch", description: "Target branch name" },
     { name: "mr_url", description: "Merge request URL" },
@@ -917,7 +830,7 @@ registerTemplate({
   eventType: "gitlab.issue.assigned",
   header: "[GitLab Issue #{{issue_iid}}] {{issue_title}}",
   defaultBody: `Repo: {{repo}}
-Author: @{{username}}
+Author: {{username}}
 URL: {{issue_url}}
 
 {{context_section}}{{@template[common.command_suggestions.gitlab_issue]}}{{@template[common.delegation_instruction.gitlab]}}`,
@@ -925,7 +838,10 @@ URL: {{issue_url}}
     { name: "issue_iid", description: "Issue IID" },
     { name: "issue_title", description: "Issue title" },
     { name: "repo", description: "Project path with namespace" },
-    { name: "username", description: "Event sender username" },
+    {
+      name: "username",
+      description: "Author identity — resolved canonical name (e.g. 'Luis (gitlab:username)') or the UNKNOWN sentinel"
+    },
     { name: "issue_url", description: "Issue URL" },
     { name: "context_section", description: "Context section with description or empty string" }
   ],
@@ -933,7 +849,7 @@ URL: {{issue_url}}
 });
 registerTemplate({
   eventType: "gitlab.comment.mentioned",
-  header: "[GitLab Comment on {{entity_label}}] @{{username}} mentioned bot",
+  header: "[GitLab Comment on {{entity_label}}] {{username}} mentioned bot",
   defaultBody: `Repo: {{repo}}
 URL: {{target_url}}
 
@@ -941,7 +857,10 @@ Comment:
 {{context}}{{existing_task_note}}{{@template[common.delegation_instruction.gitlab]}}`,
   variables: [
     { name: "entity_label", description: "Entity label (e.g. 'MR #1' or 'Issue #2')" },
-    { name: "username", description: "Comment author username" },
+    {
+      name: "username",
+      description: "Comment author identity — resolved canonical name (e.g. 'Luis (gitlab:username)') or the UNKNOWN sentinel"
+    },
     { name: "repo", description: "Project path with namespace" },
     { name: "target_url", description: "Target entity URL" },
     { name: "context", description: "Extracted mention context from comment" },
@@ -1025,6 +944,9 @@ function resolveGitLabSender(user, sampleEventType, sampleContext) {
   incrKv(UNMAPPED_NAMESPACE, `${user.username}:count`, 1);
   return;
 }
+function renderGitLabIdentity(username) {
+  return renderIdentity(resolveIdentity("gitlab", username));
+}
 async function handleMergeRequest(event) {
   const { user, project, object_attributes: mr } = event;
   const action = mr.action;
@@ -1052,7 +974,7 @@ async function handleMergeRequest(event) {
         mr_iid: mr.iid,
         mr_title: mr.title,
         repo,
-        username: user.username,
+        username: renderGitLabIdentity(user.username),
         source_branch: mr.source_branch,
         target_branch: mr.target_branch,
         mr_url: mr.url,
@@ -1135,7 +1057,7 @@ async function handleIssue2(event) {
         issue_iid: issue.iid,
         issue_title: issue.title,
         repo,
-        username: user.username,
+        username: renderGitLabIdentity(user.username),
         issue_url: issue.url,
         context_section: contextSection
       });
@@ -1179,7 +1101,7 @@ async function handleIssue2(event) {
 async function handleNote(event) {
   const { user, project, object_attributes: note } = event;
   const repo = project.path_with_namespace;
-  const _requestedByUserId = resolveGitLabSender(user, "note", note.note);
+  const requestedByUserId = resolveGitLabSender(user, "note", note.note);
   if (!detectMention(note.note)) {
     return { created: false };
   }
@@ -1214,7 +1136,7 @@ async function handleNote(event) {
 _Note: There's an active task (${existingTask.id}) for this ${entityLabel}._` : "";
   const noteResult = resolveTemplate("gitlab.comment.mentioned", {
     entity_label: entityLabel,
-    username: user.username,
+    username: renderGitLabIdentity(user.username),
     repo,
     target_url: targetUrl,
     context,
@@ -1233,6 +1155,7 @@ _Note: There's an active task (${existingTask.id}) for this ${entityLabel}._` :
     vcsNumber: targetNumber,
     vcsCommentId: note.id,
     vcsAuthor: user.username,
+    requestedByUserId,
     vcsUrl: targetUrl,
     parentTaskId: existingTask?.id,
     contextKey: targetNumber ? gitlabContextKey({
@@ -1247,8 +1170,9 @@ _Note: There's an active task (${existingTask.id}) for this ${entityLabel}._` :
   return { created: true, taskId: task.id };
 }
 async function handlePipeline(event) {
-  const { project, object_attributes: pipeline } = event;
+  const { user, project, object_attributes: pipeline } = event;
   const repo = project.path_with_namespace;
+  const requestedByUserId = resolveGitLabSender(user, "pipeline", `Pipeline #${pipeline.id}`);
   if (pipeline.status !== "failed") {
     return { created: false };
   }
@@ -1286,6 +1210,7 @@ async function handlePipeline(event) {
     vcsEventType: "pipeline",
     vcsNumber: mrIid,
     vcsAuthor: "",
+    requestedByUserId,
     vcsUrl: event.merge_request.url,
     parentTaskId: existingTask.id,
     contextKey: gitlabContextKey({
@@ -2539,6 +2464,7 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
 init_zod();
 init_db();
 init_resolver();
+init_request_auth_context();
 init_event_bus();
 var QuestionSchema = exports_external.object({
   id: exports_external.string(),
@@ -2723,6 +2649,10 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const id = crypto.randomUUID();
+    const auth = getRequestAuth(req);
+    const rawCallerAgentId = req.headers["x-agent-id"];
+    const callerAgentId = Array.isArray(rawCallerAgentId) ? rawCallerAgentId[0] : rawCallerAgentId;
+    const createdBy = auth?.kind === "user" ? auth.userId : resolveTaskAuditUserId(parsed.body.sourceTaskId, callerAgentId) ?? undefined;
     const request = createApprovalRequest({
       id,
       title: parsed.body.title,
@@ -2732,7 +2662,8 @@ async function handleApprovalRequests(req, res, pathSegments, queryParams) {
       workflowRunStepId: parsed.body.workflowRunStepId,
       sourceTaskId: parsed.body.sourceTaskId,
       timeoutSeconds: parsed.body.timeoutSeconds,
-      notificationChannels: parsed.body.notifications
+      notificationChannels: parsed.body.notifications,
+      createdBy
     });
     res.writeHead(201, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ approvalRequest: request }));
@@ -2991,6 +2922,7 @@ init_swarm_config_guard();
 init_request_auth_context();
 init_secret_scrubber();
 var MAX_ENV_PRESENCE_KEYS = 200;
+var SECRETS_FORCE_MASK_NOTE = " (secret values masked: reading unmasked secrets requires the lead agent)";
 var API_ONLY_CONFIG_KEYS = new Set(["API_AGENT_FS_API_KEY"]);
 function stripApiOnlyKeys(configs) {
   return configs.filter((config) => !API_ONLY_CONFIG_KEYS.has(config.key));
@@ -2999,6 +2931,23 @@ function singleHeader(req, name) {
   const raw = req.headers[name];
   return Array.isArray(raw) ? raw[0] : raw;
 }
+function userMayReadSecrets(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator")
+    return true;
+  if (auth?.kind !== "user")
+    return true;
+  if (!isRbacEnabled())
+    return true;
+  const grant = getUserGrant(auth.userId);
+  return grant.grantsAll || grant.verbs.has("config.read.secrets");
+}
+function resolveSecretsRead(req, includeSecrets) {
+  if (!includeSecrets || userMayReadSecrets(req)) {
+    return { effectiveIncludeSecrets: includeSecrets, secretsNote: "" };
+  }
+  return { effectiveIncludeSecrets: false, secretsNote: SECRETS_FORCE_MASK_NOTE };
+}
 function ensureConfigAdmin(req, res, verb) {
   const auth = getRequestAuth(req);
   if (auth?.kind === "operator" || auth?.kind === "user")
@@ -3128,16 +3077,20 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(getResolvedConfig(parsed.query.agentId || undefined, parsed.query.repoId || undefined));
-    const result = includeSecrets ? configs : maskSecrets(configs);
-    if (includeSecrets) {
+    const result = effectiveIncludeSecrets ? configs : maskSecrets(configs);
+    if (effectiveIncludeSecrets) {
       for (const c of result) {
         if (c.isSecret && c.value) {
           registerVolatileSecret(c.value, `config:${c.key}`);
         }
       }
     }
-    json(res, { configs: result });
+    json(res, {
+      configs: result,
+      ...secretsNote ? { message: `Found ${result.length} config(s).${secretsNote}` } : {}
+    });
     return true;
   }
   if (envPresence.match(req.method, pathSegments)) {
@@ -3178,11 +3131,15 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       jsonError(res, "Config not found", 404);
       return true;
     }
-    const singleResult = includeSecrets ? config : maskSecrets([config])[0];
-    if (includeSecrets && singleResult.isSecret && singleResult.value) {
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
+    const singleResult = effectiveIncludeSecrets ? config : maskSecrets([config])[0];
+    if (effectiveIncludeSecrets && singleResult.isSecret && singleResult.value) {
       registerVolatileSecret(singleResult.value, `config:${singleResult.key}`);
     }
-    json(res, singleResult);
+    json(res, {
+      ...singleResult,
+      ...secretsNote ? { message: `Found 1 config(s).${secretsNote}` } : {}
+    });
     return true;
   }
   if (listConfig.match(req.method, pathSegments)) {
@@ -3190,19 +3147,23 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
+    const { effectiveIncludeSecrets, secretsNote } = resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(getSwarmConfigs({
       scope: parsed.query.scope || undefined,
       scopeId: parsed.query.scopeId || undefined
     }));
-    const listResult = includeSecrets ? configs : maskSecrets(configs);
-    if (includeSecrets) {
+    const listResult = effectiveIncludeSecrets ? configs : maskSecrets(configs);
+    if (effectiveIncludeSecrets) {
       for (const c of listResult) {
         if (c.isSecret && c.value) {
           registerVolatileSecret(c.value, `config:${c.key}`);
         }
       }
     }
-    json(res, { configs: listResult });
+    json(res, {
+      configs: listResult,
+      ...secretsNote ? { message: `Found ${listResult.length} config(s).${secretsNote}` } : {}
+    });
     return true;
   }
   if (upsertConfig.match(req.method, pathSegments)) {
@@ -3592,7 +3553,7 @@ var putFavorite = route({
   pattern: ["api", "favorites"],
   summary: "Set favorite state for an item",
   tags: ["Favorites"],
-  rbac: { ungated: "self-scoped to the authenticated user; no cross-principal access" },
+  rbac: { permission: "favorite.write.own" },
   body: exports_external.object({
     itemType: FavoriteItemTypeSchema,
     itemId: exports_external.string().min(1),
@@ -4472,11 +4433,11 @@ async function readRawBody(req, maxBytes) {
   const chunks = [];
   let total = 0;
   for await (const chunk of req) {
-    const buffer2 = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    total += buffer2.byteLength;
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += buffer.byteLength;
     if (total > maxBytes)
       return BODY_TOO_LARGE;
-    chunks.push(buffer2);
+    chunks.push(buffer);
   }
   return Buffer.concat(chunks);
 }
@@ -6559,6 +6520,7 @@ var SDK_TOOL_NAME_MAP = {
   mcpServer_install: "mcp-server-install",
   mcpServer_uninstall: "mcp-server-uninstall",
   page_create: "create_page",
+  page_delete: "delete-page",
   metric_create: "create_metric",
   request_humanInput: "request-human-input"
 };
@@ -6651,466 +6613,6 @@ async function handleMcpBridge(req, res, pathSegments, _queryParams, myAgentId)
 // src/http/mcp-oauth.ts
 init_zod();
 init_db();
-
-// src/be/db-queries/mcp-oauth.ts
-init_crypto();
-init_date_utils();
-init_db();
-function encryptOrNull(plaintext) {
-  if (plaintext == null || plaintext === "")
-    return null;
-  return encryptSecret(plaintext, getEncryptionKey());
-}
-function decryptOrNull(ciphertext) {
-  if (ciphertext == null || ciphertext === "")
-    return null;
-  return decryptSecret(ciphertext, getEncryptionKey());
-}
-function decryptTokenRow(row) {
-  const key = getEncryptionKey();
-  return {
-    ...row,
-    accessToken: decryptSecret(row.accessToken, key),
-    refreshToken: decryptOrNull(row.refreshToken),
-    dcrClientSecret: decryptOrNull(row.dcrClientSecret),
-    createdAt: normalizeDateRequired(row.createdAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  };
-}
-function getMcpOAuthToken(mcpServerId, userId = null) {
-  const row = getDb().query(userId == null ? "SELECT * FROM mcp_oauth_tokens WHERE mcpServerId = ? AND userId IS NULL" : "SELECT * FROM mcp_oauth_tokens WHERE mcpServerId = ? AND userId = ?").get(...userId == null ? [mcpServerId] : [mcpServerId, userId]);
-  return row ? decryptTokenRow(row) : null;
-}
-function upsertMcpOAuthToken(input) {
-  const userId = input.userId ?? null;
-  const encryptedAccess = encryptSecret(input.accessToken, getEncryptionKey());
-  const encryptedRefresh = encryptOrNull(input.refreshToken);
-  const encryptedClientSecret = encryptOrNull(input.dcrClientSecret);
-  const existing = getMcpOAuthToken(input.mcpServerId, userId);
-  if (!existing) {
-    getDb().query(`INSERT INTO mcp_oauth_tokens (
-          mcpServerId, userId,
-          accessToken, refreshToken, tokenType, expiresAt, scope,
-          resourceUrl, authorizationServerIssuer, authorizeUrl, tokenUrl, revocationUrl,
-          dcrClientId, dcrClientSecret, clientSource,
-          status, lastErrorMessage, lastRefreshedAt, connectedByUserId
-        )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.mcpServerId, userId, encryptedAccess, encryptedRefresh, input.tokenType ?? "Bearer", input.expiresAt ?? null, input.scope ?? null, input.resourceUrl, input.authorizationServerIssuer, input.authorizeUrl, input.tokenUrl, input.revocationUrl ?? null, input.dcrClientId ?? null, encryptedClientSecret, input.clientSource, input.status ?? "connected", input.lastErrorMessage ?? null, input.lastRefreshedAt ?? null, input.connectedByUserId ?? null);
-    return;
-  }
-  getDb().query(`UPDATE mcp_oauth_tokens SET
-        accessToken = ?,
-        refreshToken = COALESCE(?, refreshToken),
-        tokenType = ?,
-        expiresAt = ?,
-        scope = COALESCE(?, scope),
-        resourceUrl = ?,
-        authorizationServerIssuer = ?,
-        authorizeUrl = ?,
-        tokenUrl = ?,
-        revocationUrl = ?,
-        dcrClientId = COALESCE(?, dcrClientId),
-        dcrClientSecret = COALESCE(?, dcrClientSecret),
-        clientSource = ?,
-        status = ?,
-        lastErrorMessage = ?,
-        lastRefreshedAt = ?,
-        connectedByUserId = COALESCE(?, connectedByUserId),
-        updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-      WHERE id = ?`).run(encryptedAccess, encryptedRefresh, input.tokenType ?? "Bearer", input.expiresAt ?? null, input.scope ?? null, input.resourceUrl, input.authorizationServerIssuer, input.authorizeUrl, input.tokenUrl, input.revocationUrl ?? null, input.dcrClientId ?? null, encryptedClientSecret, input.clientSource, input.status ?? "connected", input.lastErrorMessage ?? null, input.lastRefreshedAt ?? null, input.connectedByUserId ?? null, existing.id);
-}
-function applyMcpOAuthRefresh(id, data) {
-  const key = getEncryptionKey();
-  const encryptedAccess = encryptSecret(data.accessToken, key);
-  const encryptedRefresh = data.refreshToken === undefined ? undefined : data.refreshToken == null ? null : encryptSecret(data.refreshToken, key);
-  if (encryptedRefresh === undefined) {
-    getDb().query(`UPDATE mcp_oauth_tokens
-         SET accessToken = ?,
-             expiresAt = COALESCE(?, expiresAt),
-             scope = COALESCE(?, scope),
-             status = 'connected',
-             lastErrorMessage = NULL,
-             lastRefreshedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
-             updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-         WHERE id = ?`).run(encryptedAccess, data.expiresAt ?? null, data.scope ?? null, id);
-  } else {
-    getDb().query(`UPDATE mcp_oauth_tokens
-         SET accessToken = ?,
-             refreshToken = ?,
-             expiresAt = COALESCE(?, expiresAt),
-             scope = COALESCE(?, scope),
-             status = 'connected',
-             lastErrorMessage = NULL,
-             lastRefreshedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
-             updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-         WHERE id = ?`).run(encryptedAccess, encryptedRefresh, data.expiresAt ?? null, data.scope ?? null, id);
-  }
-}
-function markMcpOAuthTokenStatus(id, status, errorMessage) {
-  getDb().query(`UPDATE mcp_oauth_tokens
-       SET status = ?,
-           lastErrorMessage = ?,
-           updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ?`).run(status, errorMessage ?? null, id);
-}
-function deleteMcpOAuthToken(mcpServerId, userId = null) {
-  const result = getDb().query(userId == null ? "DELETE FROM mcp_oauth_tokens WHERE mcpServerId = ? AND userId IS NULL" : "DELETE FROM mcp_oauth_tokens WHERE mcpServerId = ? AND userId = ?").run(...userId == null ? [mcpServerId] : [mcpServerId, userId]);
-  return result.changes > 0;
-}
-function isMcpTokenExpiringSoon(token, bufferMs = 5 * 60 * 1000) {
-  if (!token.expiresAt)
-    return false;
-  const expiresAt = new Date(token.expiresAt).getTime();
-  if (Number.isNaN(expiresAt))
-    return true;
-  return expiresAt - Date.now() < bufferMs;
-}
-function insertMcpOAuthPending(input) {
-  const key = getEncryptionKey();
-  getDb().query(`INSERT INTO mcp_oauth_pending (
-        state, mcpServerId, userId,
-        codeVerifier, nonce,
-        resourceUrl, authorizationServerIssuer, authorizeUrl, tokenUrl, revocationUrl,
-        scopes, dcrClientId, dcrClientSecret, redirectUri, finalRedirect
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.state, input.mcpServerId, input.userId ?? null, encryptSecret(input.codeVerifier, key), input.nonce ?? null, input.resourceUrl, input.authorizationServerIssuer, input.authorizeUrl, input.tokenUrl, input.revocationUrl ?? null, input.scopes ?? null, input.dcrClientId ?? null, encryptOrNull(input.dcrClientSecret), input.redirectUri, input.finalRedirect ?? null);
-}
-function consumeMcpOAuthPending(state) {
-  const row = getDb().query("SELECT * FROM mcp_oauth_pending WHERE state = ?").get(state);
-  if (!row)
-    return null;
-  getDb().query("DELETE FROM mcp_oauth_pending WHERE state = ?").run(state);
-  const key = getEncryptionKey();
-  return {
-    ...row,
-    codeVerifier: decryptSecret(row.codeVerifier, key),
-    dcrClientSecret: decryptOrNull(row.dcrClientSecret)
-  };
-}
-function gcMcpOAuthPending(olderThanMs = 10 * 60 * 1000) {
-  const cutoff = new Date(Date.now() - olderThanMs).toISOString();
-  const result = getDb().query("DELETE FROM mcp_oauth_pending WHERE createdAt < ?").run(cutoff);
-  return result.changes;
-}
-function setMcpServerAuthMethod(mcpServerId, authMethod) {
-  getDb().query("UPDATE mcp_servers SET authMethod = ?, lastUpdatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?").run(authMethod, mcpServerId);
-}
-
-// src/oauth/mcp-wrapper.ts
-var PRIVATE_IPV4_BLOCKS = [
-  { prefix: "10.", mask: 8 },
-  { prefix: "127.", mask: 8 },
-  { prefix: "169.254.", mask: 16 },
-  { prefix: "172.16.", mask: 12 },
-  { prefix: "192.168.", mask: 16 },
-  { prefix: "0.", mask: 8 }
-];
-function isPrivateIPv4(host) {
-  if (host === "127.0.0.1")
-    return true;
-  if (host.startsWith("169.254."))
-    return true;
-  if (host.startsWith("10."))
-    return true;
-  if (host.startsWith("192.168."))
-    return true;
-  if (host.startsWith("0."))
-    return true;
-  if (host.startsWith("172.")) {
-    const parts = host.split(".");
-    const second = parseInt(parts[1] ?? "", 10);
-    if (Number.isFinite(second) && second >= 16 && second <= 31)
-      return true;
-  }
-  for (const block of PRIVATE_IPV4_BLOCKS) {
-    if (block.prefix !== "172." && host.startsWith(block.prefix))
-      return true;
-  }
-  return false;
-}
-function isPrivateIPv6(host) {
-  const lower = host.toLowerCase();
-  if (lower === "::1" || lower === "[::1]")
-    return true;
-  if (lower.startsWith("fe80:") || lower.startsWith("[fe80:"))
-    return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd"))
-    return true;
-  if (lower.startsWith("[fc") || lower.startsWith("[fd"))
-    return true;
-  return false;
-}
-function assertUrlSafe(rawUrl, opts = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new Error(`Invalid URL: ${rawUrl}`);
-  }
-  const allowPrivate = opts.allowPrivateHosts === true;
-  const allowInsecure = opts.allowInsecure === true;
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new Error(`Refusing unsupported protocol: ${parsed.protocol}`);
-  }
-  if (parsed.protocol === "http:" && !allowInsecure) {
-    throw new Error(`Refusing insecure (http://) URL in production: ${rawUrl}`);
-  }
-  const host = parsed.hostname;
-  if (!host) {
-    throw new Error(`Missing hostname: ${rawUrl}`);
-  }
-  if (host === "localhost" && !allowPrivate) {
-    throw new Error(`Refusing loopback hostname: ${host}`);
-  }
-  if (isPrivateIPv4(host) && !allowPrivate) {
-    throw new Error(`Refusing private IPv4 host: ${host}`);
-  }
-  if (isPrivateIPv6(host) && !allowPrivate) {
-    throw new Error(`Refusing private IPv6 host: ${host}`);
-  }
-  return parsed;
-}
-function defaultSsrfOptions() {
-  return {
-    allowPrivateHosts: process.env.MCP_OAUTH_ALLOW_PRIVATE_HOSTS === "true",
-    allowInsecure: true
-  };
-}
-async function safeFetch(url, init) {
-  assertUrlSafe(url, defaultSsrfOptions());
-  return fetch(url, init);
-}
-async function discoverProtectedResourceMetadata(resourceUrl) {
-  const base = new URL(resourceUrl);
-  const wellKnown = new URL("/.well-known/oauth-protected-resource", base).toString();
-  try {
-    const res = await safeFetch(wellKnown, {
-      headers: { Accept: "application/json" }
-    });
-    if (res.ok) {
-      return await res.json();
-    }
-  } catch {}
-  try {
-    const probe = await safeFetch(resourceUrl, { method: "HEAD" });
-    const wwwAuth = probe.headers.get("www-authenticate");
-    if (wwwAuth) {
-      const match = /resource_metadata="([^"]+)"/i.exec(wwwAuth);
-      if (match) {
-        const metaRes = await safeFetch(match[1], {
-          headers: { Accept: "application/json" }
-        });
-        if (metaRes.ok) {
-          return await metaRes.json();
-        }
-      }
-    }
-  } catch {}
-  return null;
-}
-async function discoverAuthorizationServerMetadata(issuer) {
-  const issuerUrl = new URL(issuer);
-  const candidates = [
-    new URL("/.well-known/oauth-authorization-server", issuerUrl).toString(),
-    new URL("/.well-known/openid-configuration", issuerUrl).toString()
-  ];
-  let lastError = null;
-  for (const candidate of candidates) {
-    try {
-      const res = await safeFetch(candidate, {
-        headers: { Accept: "application/json" }
-      });
-      if (res.ok) {
-        return await res.json();
-      }
-      lastError = new Error(`Metadata fetch ${candidate} → ${res.status}`);
-    } catch (err) {
-      lastError = err instanceof Error ? err : new Error(String(err));
-    }
-  }
-  throw lastError ?? new Error(`Authorization server metadata not found at ${issuer}`);
-}
-async function registerClient(registrationEndpoint, req) {
-  const res = await safeFetch(registrationEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    },
-    body: JSON.stringify(req)
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(`Dynamic client registration failed (${res.status}): ${body}`);
-  }
-  return await res.json();
-}
-async function buildAuthorizeUrl(input) {
-  const state = input.state ?? generateRandomState();
-  const codeVerifier = generateRandomCodeVerifier();
-  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
-  const url = new URL(input.authorizeUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", input.clientId);
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  if (input.scopes.length > 0) {
-    url.searchParams.set("scope", input.scopes.join(" "));
-  }
-  url.searchParams.set("state", state);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("resource", input.resource);
-  if (input.extraParams) {
-    const RESERVED = new Set([
-      "response_type",
-      "client_id",
-      "redirect_uri",
-      "scope",
-      "state",
-      "code_challenge",
-      "code_challenge_method",
-      "resource"
-    ]);
-    for (const [k, v] of Object.entries(input.extraParams)) {
-      if (RESERVED.has(k.toLowerCase())) {
-        console.warn(`[mcp-oauth] extraParams key "${k}" is reserved and skipped`);
-        continue;
-      }
-      url.searchParams.set(k, v);
-    }
-  }
-  return { url: url.toString(), state, codeVerifier, codeChallenge };
-}
-async function exchangeCodeForTokens(input) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.redirectUri,
-    client_id: input.clientId,
-    code_verifier: input.codeVerifier,
-    resource: input.resource
-  });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
-  const res = await safeFetch(input.tokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: body.toString()
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Token exchange failed (${res.status}): ${text}`);
-  }
-  return await res.json();
-}
-async function refreshMcpToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: input.refreshToken,
-    client_id: input.clientId,
-    resource: input.resource
-  });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
-  if (input.scopes && input.scopes.length > 0)
-    body.set("scope", input.scopes.join(" "));
-  const res = await safeFetch(input.tokenUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: body.toString()
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Token refresh failed (${res.status}): ${text}`);
-  }
-  return await res.json();
-}
-async function revokeMcpToken(input) {
-  const body = new URLSearchParams({
-    token: input.token,
-    client_id: input.clientId
-  });
-  if (input.tokenTypeHint)
-    body.set("token_type_hint", input.tokenTypeHint);
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
-  const res = await safeFetch(input.revocationUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: body.toString()
-  });
-  if (!res.ok && res.status !== 200 && res.status !== 204) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Token revocation failed (${res.status}): ${text}`);
-  }
-}
-function computeExpiresAt(expiresInSeconds) {
-  if (!expiresInSeconds || expiresInSeconds <= 0)
-    return null;
-  return new Date(Date.now() + expiresInSeconds * 1000).toISOString();
-}
-
-// src/oauth/ensure-mcp-token.ts
-var inflight = new Map;
-async function ensureMcpToken(mcpServerId, opts = {}) {
-  const userId = opts.userId ?? null;
-  const key = `${mcpServerId}::${userId ?? "_"}`;
-  const existing = inflight.get(key);
-  if (existing)
-    return existing;
-  const work = (async () => {
-    const token = getMcpOAuthToken(mcpServerId, userId);
-    if (!token)
-      return null;
-    if (token.status === "revoked")
-      return token;
-    if (!isMcpTokenExpiringSoon(token, opts.bufferMs))
-      return token;
-    if (!token.refreshToken) {
-      markMcpOAuthTokenStatus(token.id, "expired", "No refresh token available; reconnect required.");
-      return { ...token, status: "expired" };
-    }
-    try {
-      const refreshed = await refreshMcpToken({
-        tokenUrl: token.tokenUrl,
-        clientId: token.dcrClientId ?? "",
-        clientSecret: token.dcrClientSecret ?? undefined,
-        refreshToken: token.refreshToken,
-        resource: token.resourceUrl,
-        scopes: token.scope ? token.scope.split(" ").filter(Boolean) : undefined
-      });
-      applyMcpOAuthRefresh(token.id, {
-        accessToken: refreshed.access_token,
-        refreshToken: refreshed.refresh_token ?? undefined,
-        expiresAt: computeExpiresAt(refreshed.expires_in),
-        scope: refreshed.scope ?? null
-      });
-      return getMcpOAuthToken(mcpServerId, userId);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      markMcpOAuthTokenStatus(token.id, "error", message);
-      console.error(`[mcp-oauth] refresh failed for ${mcpServerId}: ${message}`);
-      return { ...token, status: "error", lastErrorMessage: message };
-    }
-  })();
-  inflight.set(key, work);
-  try {
-    return await work;
-  } finally {
-    inflight.delete(key);
-  }
-}
-
-// src/http/mcp-oauth.ts
 function ssrfOptions() {
   return {
     allowPrivateHosts: process.env.MCP_OAUTH_ALLOW_PRIVATE_HOSTS === "true",
@@ -7227,6 +6729,7 @@ var authorizeRoute = route({
     userId: exports_external.string().optional(),
     scopes: exports_external.string().optional()
   }),
+  rbac: { permission: "mcp-oauth.authorize.any" },
   responses: {
     302: { description: "Redirect to authorization server" },
     400: { description: "MCP has no URL / does not require OAuth" },
@@ -7246,6 +6749,7 @@ var authorizeUrlRoute = route({
     userId: exports_external.string().optional(),
     scopes: exports_external.string().optional()
   }),
+  rbac: { permission: "mcp-oauth.authorize.any" },
   responses: {
     200: { description: "{ providerUrl: string }" },
     400: { description: "MCP has no URL / does not require OAuth" },
@@ -7713,6 +7217,7 @@ function stopMcpOAuthPendingGc() {
 // src/http/mcp-servers.ts
 init_zod();
 init_db();
+init_request_auth_context();
 var listMcpServersRoute = route({
   method: "get",
   path: "/api/mcp-servers",
@@ -7767,7 +7272,8 @@ var createMcpServerRoute = route({
   responses: {
     201: { description: "MCP server created" },
     400: { description: "Validation error" }
-  }
+  },
+  rbac: { permission: "mcp-server.create.swarm" }
 });
 var updateMcpServerRoute = route({
   method: "put",
@@ -7781,7 +7287,8 @@ var updateMcpServerRoute = route({
   responses: {
     200: { description: "MCP server updated" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.update.any" }
 });
 var deleteMcpServerRoute = route({
   method: "delete",
@@ -7794,7 +7301,8 @@ var deleteMcpServerRoute = route({
   responses: {
     200: { description: "MCP server deleted" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.delete.any" }
 });
 var installMcpServerRoute = route({
   method: "post",
@@ -7810,7 +7318,8 @@ var installMcpServerRoute = route({
   responses: {
     200: { description: "MCP server installed" },
     404: { description: "MCP server not found" }
-  }
+  },
+  rbac: { permission: "mcp-server.install.any" }
 });
 var uninstallMcpServerRoute = route({
   method: "delete",
@@ -7822,7 +7331,8 @@ var uninstallMcpServerRoute = route({
   params: exports_external.object({ id: exports_external.string(), agentId: exports_external.string() }),
   responses: {
     200: { description: "MCP server uninstalled" }
-  }
+  },
+  rbac: { permission: "mcp-server.uninstall.any" }
 });
 var getAgentMcpServersRoute = route({
   method: "get",
@@ -7839,14 +7349,39 @@ var getAgentMcpServersRoute = route({
     200: { description: "Agent MCP servers list" }
   }
 });
-async function handleMcpServers(req, res, pathSegments, queryParams) {
-  if (getAgentMcpServersRoute.match(req.method, pathSegments)) {
-    const parsed = await getAgentMcpServersRoute.parse(req, res, pathSegments, queryParams);
-    if (!parsed)
-      return true;
+function canResolveMcpSecretsForHttpUser(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user")
+    return true;
+  if (!isRbacEnabled())
+    return true;
+  const verb = "mcp-server.read.secrets";
+  const grant = getUserGrant(auth.userId);
+  const decision = grant.grantsAll || grant.verbs.has(verb) ? { allow: true, verb } : {
+    allow: false,
+    reason: `admission: missing permission '${verb}'`,
+    verb
+  };
+  enqueueAdmissionRow({
+    userId: auth.userId,
+    decision,
+    method: req.method,
+    route: getAgentMcpServersRoute.def.path
+  });
+  return decision.allow;
+}
+async function handleMcpServers(req, res, pathSegments, queryParams) {
+  if (getAgentMcpServersRoute.match(req.method, pathSegments)) {
+    const parsed = await getAgentMcpServersRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
     const servers = getAgentMcpServers(parsed.params.id);
     const resolveSecrets = parsed.query.resolveSecrets === "true";
     if (resolveSecrets) {
+      if (!canResolveMcpSecretsForHttpUser(req)) {
+        jsonError(res, "Forbidden: admission: missing permission 'mcp-server.read.secrets'", 403);
+        return true;
+      }
       const configs = getResolvedConfig(parsed.params.id);
       const configMap = new Map(configs.map((c) => [c.key, c.value]));
       const serversWithSecrets = await Promise.all(servers.map(async (server) => {
@@ -8034,12 +7569,15 @@ async function handleMcpServers(req, res, pathSegments, queryParams) {
     const parsed = await deleteMcpServerRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const deleted = deleteMcpServer(parsed.params.id);
-    if (!deleted) {
+    const result = deleteMcpServer(parsed.params.id);
+    if (!result.deleted) {
       jsonError(res, "MCP server not found", 404);
       return true;
     }
-    json(res, { success: true });
+    json(res, {
+      success: true,
+      deletedScriptConnectionCount: result.deletedScriptConnectionCount
+    });
     return true;
   }
   return false;
@@ -8060,6 +7598,33 @@ var userSendTaskInputSchema = object({
   model: string().trim().min(1).optional().describe("Concrete model override interpreted by the assignee's harness/provider."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier: 'smol', 'regular', 'smart', or 'ultra'. Resolved by the assignee's harness/provider.")
 });
+function permission(verb) {
+  return { permission: verb };
+}
+async function maybeDenyUserToolAdmission(user, toolName, config) {
+  if (!isRbacEnabled())
+    return;
+  const grant = getUserGrant(user.id);
+  if (grant.grantsAll)
+    return;
+  const decision = decideToolAdmission({
+    rbac: config.rbac,
+    readOnly: config.annotations?.readOnlyHint ?? false,
+    grant
+  });
+  enqueueAdmissionRow({
+    userId: user.id,
+    decision,
+    source: "mcp",
+    toolName
+  });
+  if (decision.allow)
+    return;
+  return {
+    isError: true,
+    content: [{ type: "text", text: `Forbidden: ${decision.reason}` }]
+  };
+}
 function createUserServer(user) {
   const server = new McpServer({
     name: `${package_default.name}-user`,
@@ -8071,44 +7636,77 @@ function createUserServer(user) {
     }
   });
   const registerTool = createToolRegistrar(server);
-  registerTool("send-task", {
+  const sendTaskConfig = {
     title: "Send a task",
     annotations: { destructiveHint: false },
+    rbac: permission("task.create.own"),
     description: "Creates an unassigned task requested by the authenticated user.",
     inputSchema: userSendTaskInputSchema,
     outputSchema: sendTaskOutputSchema
-  }, async (args, info, _meta) => sendTaskHandler(userCtx(user, info.sessionId), {
-    offerMode: false,
-    allowDuplicate: false,
-    ...args
-  }));
-  registerTool("get-tasks", {
+  };
+  registerTool("send-task", sendTaskConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "send-task", sendTaskConfig);
+    if (denied)
+      return denied;
+    return sendTaskHandler(userCtx(user, info.sessionId), {
+      offerMode: false,
+      allowDuplicate: false,
+      ...args
+    });
+  });
+  const getTasksConfig = {
     title: "Get tasks",
     description: "Returns tasks requested by the authenticated user.",
     annotations: { readOnlyHint: true },
     inputSchema: getTasksInputSchema,
     outputSchema: getTasksOutputSchema
-  }, async (args, info, _meta) => getTasksHandler(userCtx(user, info.sessionId), args));
-  registerTool("get-task-details", {
+  };
+  registerTool("get-tasks", getTasksConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "get-tasks", getTasksConfig);
+    if (denied)
+      return denied;
+    return getTasksHandler(userCtx(user, info.sessionId), args);
+  });
+  const getTaskDetailsConfig = {
     title: "Get task details",
     description: "Returns detailed information about one of your tasks.",
     annotations: { readOnlyHint: true },
     inputSchema: getTaskDetailsInputSchema,
     outputSchema: getTaskDetailsOutputSchema
-  }, async (args, info, _meta) => getTaskDetailsHandler(userCtx(user, info.sessionId), args));
-  registerTool("cancel-task", {
+  };
+  registerTool("get-task-details", getTaskDetailsConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "get-task-details", getTaskDetailsConfig);
+    if (denied)
+      return denied;
+    return getTaskDetailsHandler(userCtx(user, info.sessionId), args);
+  });
+  const cancelTaskConfig = {
     title: "Cancel Task",
     description: "Cancel one of your pending or in-progress tasks.",
     annotations: { destructiveHint: true },
+    rbac: permission("task.cancel.own"),
     inputSchema: cancelTaskInputSchema,
     outputSchema: cancelTaskOutputSchema
-  }, async (args, info, _meta) => cancelTaskHandler(userCtx(user, info.sessionId), args));
-  registerTool("task-action", {
+  };
+  registerTool("cancel-task", cancelTaskConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "cancel-task", cancelTaskConfig);
+    if (denied)
+      return denied;
+    return cancelTaskHandler(userCtx(user, info.sessionId), args);
+  });
+  const taskActionConfig = {
     title: "Task Pool Action",
     description: "Move one of your tasks to or from backlog.",
+    rbac: permission("task.action.own"),
     inputSchema: taskActionInputSchema,
     outputSchema: taskActionOutputSchema
-  }, async (args, info, _meta) => taskActionHandler(userCtx(user, info.sessionId), args));
+  };
+  registerTool("task-action", taskActionConfig, async (args, info, _meta) => {
+    const denied = await maybeDenyUserToolAdmission(user, "task-action", taskActionConfig);
+    if (denied)
+      return denied;
+    return taskActionHandler(userCtx(user, info.sessionId), args);
+  });
   return server;
 }
 
@@ -9731,6 +9329,82 @@ async function handleMetrics(req, res, pathSegments, queryParams, myAgentId) {
   return false;
 }
 
+// src/http/oauth-generic.ts
+init_zod();
+var DEDICATED_CALLBACK_PROVIDERS = new Set(["linear"]);
+var genericOAuthCallbackRoute = route({
+  method: "get",
+  path: "/api/oauth/{provider}/callback",
+  pattern: ["api", "oauth", null, "callback"],
+  operationId: "oauth_generic_callback",
+  summary: "Generic OAuth redirect target for script credential bindings",
+  tags: ["OAuth"],
+  auth: { apiKey: false },
+  params: exports_external.object({
+    provider: exports_external.string().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/)
+  }),
+  query: exports_external.object({
+    code: exports_external.string().optional(),
+    state: exports_external.string().optional(),
+    error: exports_external.string().optional(),
+    error_description: exports_external.string().optional()
+  }),
+  responses: {
+    200: { description: "OAuth authorization completed" },
+    400: { description: "Missing or invalid OAuth callback parameters" },
+    404: { description: "OAuth app not configured" },
+    409: { description: "Provider has a dedicated OAuth callback" },
+    502: { description: "Token exchange failed" }
+  }
+});
+function sendAuthorizedHtml(res, provider) {
+  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+  res.end(`<!DOCTYPE html>
+<html>
+<head><title>OAuth Authorized</title></head>
+<body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;">
+  <main style="text-align: center;">
+    <h1>${provider} authorized</h1>
+    <p>You can close this tab.</p>
+  </main>
+</body>
+</html>`);
+}
+async function handleGenericOAuth(req, res, pathSegments, queryParams) {
+  if (!genericOAuthCallbackRoute.match(req.method, pathSegments))
+    return false;
+  const parsed = await genericOAuthCallbackRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed)
+    return true;
+  const { provider } = parsed.params;
+  if (DEDICATED_CALLBACK_PROVIDERS.has(provider)) {
+    jsonError(res, "Provider linear uses the dedicated OAuth flow at /api/trackers/linear/authorize and /api/trackers/linear/callback.", 409);
+    return true;
+  }
+  if (parsed.query.error) {
+    jsonError(res, parsed.query.error_description ?? parsed.query.error, 400);
+    return true;
+  }
+  if (!parsed.query.code || !parsed.query.state) {
+    jsonError(res, "Missing code or state parameter", 400);
+    return true;
+  }
+  const config = getOAuthProviderConfig(provider);
+  if (!config) {
+    jsonError(res, `OAuth app ${provider} is not configured`, 404);
+    return true;
+  }
+  try {
+    await exchangeCode(config, parsed.query.code, parsed.query.state);
+    sendAuthorizedHtml(res, provider);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const status = message.includes("Invalid or expired OAuth state") ? 400 : 502;
+    jsonError(res, status === 400 ? "Invalid or expired OAuth state" : `Token exchange failed: ${message}`, status);
+  }
+  return true;
+}
+
 // src/http/oauth-locks.ts
 init_zod();
 var MAX_LOCK_TTL_MS = 5 * 60 * 1000;
@@ -11186,6 +10860,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
             });
             const requestedByUser = pendingTask.requestedByUserId ? getUserById(pendingTask.requestedByUserId) : undefined;
             const requestedByNotes = getRequesterNotes(requestedByUser?.notes);
+            const requestedByUnknownName = !requestedByUser && pendingTask.slackUserId ? renderIdentity(resolveIdentity("slack", pendingTask.slackUserId)) : undefined;
             return {
               trigger: {
                 type: "task_assigned",
@@ -11202,6 +10877,9 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
                     role: requestedByUser.role,
                     notes: requestedByNotes
                   }
+                },
+                ...requestedByUnknownName && {
+                  requestedBy: { name: requestedByUnknownName }
                 }
               }
             };
@@ -11220,7 +10898,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
         }
         if (agent.isLead) {} else {
           if (hasCapacity(myAgentId)) {
-            const unassignedIds = getUnassignedTaskIds(5);
+            const unassignedIds = getUnassignedTaskIdsForAgent(myAgentId, 5);
             if (unassignedIds.length > 0) {
               const candidateId = unassignedIds[0];
               const candidateTask = getTaskById(candidateId);
@@ -12348,182 +12026,1501 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
     }
     return true;
   }
-  if (runScheduleNow.match(req.method, pathSegments)) {
-    const parsed = await runScheduleNow.parse(req, res, pathSegments, queryParams);
+  if (runScheduleNow.match(req.method, pathSegments)) {
+    const parsed = await runScheduleNow.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const schedule = getScheduledTaskById(parsed.params.id);
+    if (!schedule) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
+    if (!schedule.enabled) {
+      jsonError(res, "Schedule is disabled", 400);
+      return true;
+    }
+    try {
+      const { workflowRunIds, task } = await dispatchScheduleTarget(schedule, ["manual-run"]);
+      const now = new Date().toISOString();
+      if (schedule.scheduleType === "one_time") {
+        updateScheduledTask(schedule.id, {
+          lastRunAt: now,
+          nextRunAt: null,
+          enabled: false,
+          lastUpdatedAt: now
+        });
+      } else {
+        updateScheduledTask(schedule.id, {
+          lastRunAt: now,
+          lastUpdatedAt: now
+        });
+      }
+      const updatedSchedule = getScheduledTaskById(parsed.params.id);
+      json(res, { schedule: updatedSchedule, workflowRunIds, task });
+    } catch (error) {
+      jsonError(res, error instanceof Error ? error.message : "Failed to run schedule", 500);
+    }
+    return true;
+  }
+  if (getSchedule.match(req.method, pathSegments)) {
+    const parsed = await getSchedule.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const schedule = getScheduledTaskById(parsed.params.id);
+    if (!schedule) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
+    const userId = resolveHttpAuditUserId(req, myAgentId);
+    const [decorated] = withFavoriteFlags([schedule], { userId, itemType: "schedule" });
+    json(res, decorated ?? schedule);
+    return true;
+  }
+  if (updateSchedule.match(req.method, pathSegments) || patchSchedule.match(req.method, pathSegments)) {
+    const routeHandle = updateSchedule.match(req.method, pathSegments) ? updateSchedule : patchSchedule;
+    const parsed = await routeHandle.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const body = parsed.body;
+    if (parsed.body.model !== undefined || parsed.body.modelTier !== undefined) {
+      const normalizedModel = splitLegacyModelAlias({
+        model: parsed.body.model,
+        modelTier: parsed.body.modelTier
+      });
+      if (parsed.body.model !== undefined)
+        body.model = normalizedModel.model ?? null;
+      if (parsed.body.modelTier !== undefined || normalizedModel.modelTier) {
+        body.modelTier = normalizedModel.modelTier ?? null;
+      }
+    }
+    const existing = getScheduledTaskById(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
+    if (existing.scheduleType === "one_time" && !existing.enabled && existing.lastRunAt) {
+      jsonError(res, "One-time schedule has already executed. Create a new one instead.", 400);
+      return true;
+    }
+    if (existing.scheduleType !== "one_time") {
+      const timing = mergeScheduleTiming({
+        cronExpression: existing.cronExpression ?? null,
+        intervalMs: existing.intervalMs ?? null
+      }, { cronExpression: parsed.body.cronExpression, intervalMs: parsed.body.intervalMs });
+      if (validateRecurringTiming(timing)) {
+        jsonError(res, "At least one of intervalMs or cronExpression must be set", 400);
+        return true;
+      }
+    }
+    if (parsed.body.cronExpression) {
+      try {
+        import_cron_parser.CronExpressionParser.parse(parsed.body.cronExpression);
+      } catch {
+        jsonError(res, "Invalid cron expression", 400);
+        return true;
+      }
+    }
+    if (parsed.body.targetAgentId) {
+      const agent = getAgentById(parsed.body.targetAgentId);
+      if (!agent) {
+        jsonError(res, "Target agent not found", 400);
+        return true;
+      }
+    }
+    const mergedTargetType = parsed.body.targetType ?? existing.targetType;
+    const mergedTaskTemplate = parsed.body.taskTemplate !== undefined ? parsed.body.taskTemplate : existing.taskTemplate;
+    const mergedWorkflowId = parsed.body.workflowId !== undefined ? parsed.body.workflowId : existing.workflowId;
+    const mergedScriptName = parsed.body.scriptName !== undefined ? parsed.body.scriptName : existing.scriptName;
+    if (mergedTargetType === "agent-task" && !mergedTaskTemplate) {
+      jsonError(res, "taskTemplate is required when targetType is 'agent-task'.", 400);
+      return true;
+    }
+    if (mergedTargetType === "workflow") {
+      if (!mergedWorkflowId) {
+        jsonError(res, "workflowId is required when targetType is 'workflow'.", 400);
+        return true;
+      }
+      if (!getWorkflow(mergedWorkflowId)) {
+        jsonError(res, `Workflow not found: ${mergedWorkflowId}`, 400);
+        return true;
+      }
+    }
+    if (mergedTargetType === "script") {
+      if (!mergedScriptName) {
+        jsonError(res, "scriptName is required when targetType is 'script'.", 400);
+        return true;
+      }
+      if (!getScript({ name: mergedScriptName, scope: "global" })) {
+        jsonError(res, `Script not found: ${mergedScriptName}`, 400);
+        return true;
+      }
+    }
+    if (parsed.body.name && parsed.body.name !== existing.name) {
+      const nameConflict = getScheduledTaskByName(parsed.body.name);
+      if (nameConflict) {
+        jsonError(res, "Schedule with this name already exists", 409);
+        return true;
+      }
+    }
+    const newEnabled = parsed.body.enabled !== undefined ? parsed.body.enabled : existing.enabled;
+    if (existing.scheduleType === "one_time") {
+      if (!newEnabled) {
+        body.nextRunAt = null;
+      }
+    } else {
+      if (!newEnabled) {
+        body.nextRunAt = null;
+      } else if (parsed.body.cronExpression !== undefined || parsed.body.intervalMs !== undefined || parsed.body.enabled === true && !existing.enabled) {
+        const timing = mergeScheduleTiming({
+          cronExpression: existing.cronExpression ?? null,
+          intervalMs: existing.intervalMs ?? null
+        }, { cronExpression: parsed.body.cronExpression, intervalMs: parsed.body.intervalMs });
+        const mergedTimezone = parsed.body.timezone !== undefined ? parsed.body.timezone : existing.timezone;
+        if (timing.mergedCron || timing.mergedInterval) {
+          body.nextRunAt = calculateNextRun({
+            cronExpression: timing.mergedCron,
+            intervalMs: timing.mergedInterval,
+            timezone: mergedTimezone
+          });
+        }
+      }
+    }
+    const updatedBy = resolveHttpAuditUserId(req, myAgentId);
+    if (updatedBy !== null)
+      body.updatedBy = updatedBy;
+    const schedule = updateScheduledTask(parsed.params.id, body);
+    json(res, schedule);
+    return true;
+  }
+  if (deleteSchedule.match(req.method, pathSegments)) {
+    const parsed = await deleteSchedule.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const deleted = deleteScheduledTask(parsed.params.id);
+    if (!deleted) {
+      jsonError(res, "Schedule not found", 404);
+      return true;
+    }
+    json(res, { success: true });
+    return true;
+  }
+  return false;
+}
+
+// src/http/script-connection-proxy.ts
+init_zod();
+init_db();
+var mcpCallRoute = route({
+  method: "post",
+  path: "/api/script-connections/{id}/mcp-call",
+  pattern: ["api", "script-connections", null, "mcp-call"],
+  summary: "Invoke a tool on an MCP script connection",
+  tags: ["Script Connections"],
+  auth: { apiKey: true, agentId: true },
+  rbac: { permission: "script-connection.invoke" },
+  params: exports_external.object({ id: exports_external.string().uuid() }),
+  body: exports_external.object({
+    tool: exports_external.string().min(1),
+    arguments: exports_external.record(exports_external.string(), exports_external.unknown()).optional()
+  }),
+  responses: {
+    200: { description: "MCP call result" },
+    400: { description: "Invalid MCP connection or request" },
+    403: { description: "Not allowed to invoke this MCP connection" },
+    404: { description: "Script connection or agent not found" }
+  }
+});
+function connectionScopeMatches(connection, agentId, syntheticPrincipal) {
+  if (connection.scope === "global")
+    return true;
+  if (connection.scope === "agent")
+    return !syntheticPrincipal && connection.scopeId === agentId;
+  if (connection.scope === "repo")
+    return true;
+  return false;
+}
+function isSyntheticScriptPrincipal(agentId) {
+  return agentId === "schedule" || agentId === "workflow";
+}
+async function handleScriptConnectionProxy(req, res, pathSegments, queryParams, agentId) {
+  if (!mcpCallRoute.match(req.method, pathSegments))
+    return false;
+  const parsed = await mcpCallRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed)
+    return true;
+  if (!agentId) {
+    jsonError(res, "X-Agent-ID required for script connection MCP proxy", 400);
+    return true;
+  }
+  const syntheticPrincipal = isSyntheticScriptPrincipal(agentId);
+  const agent = syntheticPrincipal ? null : getAgentById(agentId);
+  if (!agent && !syntheticPrincipal) {
+    jsonError(res, "Agent not found", 404);
+    return true;
+  }
+  const decision = can({
+    principal: { kind: "agent", agentId, isLead: agent?.isLead ?? false },
+    verb: "script-connection.invoke",
+    resource: { kind: "none" },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, decision.reason, 403);
+    return true;
+  }
+  const connection = getScriptConnectionById(parsed.params.id);
+  if (!connection) {
+    jsonError(res, "Script connection not found", 404);
+    return true;
+  }
+  if (!connection.enabled) {
+    jsonError(res, "Script connection is disabled", 403);
+    return true;
+  }
+  if (connection.kind !== "mcp") {
+    jsonError(res, "Script connection is not an MCP connection", 400);
+    return true;
+  }
+  if (!connectionScopeMatches(connection, agentId, syntheticPrincipal)) {
+    jsonError(res, "Script connection is not available to this agent", 403);
+    return true;
+  }
+  if (!connection.mcpServerId) {
+    jsonError(res, "Script MCP connection is missing mcpServerId", 400);
+    return true;
+  }
+  try {
+    const result = await callMcpServerTool(connection.mcpServerId, parsed.body.tool, parsed.body.arguments ?? {}, { agentId, timeoutMs: 30000 });
+    json(res, result);
+  } catch (err) {
+    json(res, { ok: false, error: err instanceof Error ? err.message : String(err) });
+  }
+  return true;
+}
+
+// src/http/script-connections.ts
+init_zod();
+init_date_utils();
+init_db();
+init_request_auth_context();
+init_secret_scrubber();
+var providerSchema = exports_external.string().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/);
+var scopeSchema = exports_external.enum(["global", "agent", "repo"]);
+var connectionKindSchema = exports_external.enum(["openapi", "graphql", "mcp"]);
+var idParamsSchema = exports_external.object({ id: exports_external.string().uuid() });
+var providerParamsSchema = exports_external.object({ provider: providerSchema });
+var listConnectionsQuerySchema = exports_external.object({
+  kind: connectionKindSchema.optional(),
+  scope: scopeSchema.optional(),
+  scopeId: exports_external.string().optional()
+});
+var connectionBaseBodySchema = exports_external.object({
+  id: exports_external.string().uuid().optional(),
+  slug: exports_external.string().min(1).max(80),
+  displayName: exports_external.string().max(160).optional(),
+  scope: scopeSchema.optional(),
+  scopeId: scopedResourceScopeIdSchema.nullable().optional(),
+  allowedHosts: exports_external.array(exports_external.string().min(1)).optional(),
+  credentialBindingId: exports_external.string().uuid().nullable().optional(),
+  configKey: exports_external.string().min(1).max(255).optional(),
+  headerTemplate: exports_external.string().min(1).optional(),
+  queryTemplate: exports_external.string().min(1).optional(),
+  authKind: exports_external.enum(["config", "oauth"]).optional(),
+  oauthProvider: providerSchema.optional(),
+  enabled: exports_external.boolean().optional()
+});
+var upsertConnectionBodySchema = exports_external.discriminatedUnion("kind", [
+  connectionBaseBodySchema.extend({
+    kind: exports_external.literal("openapi"),
+    baseUrl: exports_external.string().url(),
+    openapiSpecUrl: exports_external.string().url().optional(),
+    openapiSpecJson: exports_external.string().optional()
+  }),
+  connectionBaseBodySchema.extend({
+    kind: exports_external.literal("graphql"),
+    baseUrl: exports_external.string().url(),
+    allowedHosts: exports_external.array(exports_external.string().min(1)).min(1)
+  }),
+  connectionBaseBodySchema.extend({
+    kind: exports_external.literal("mcp"),
+    mcpServerId: exports_external.string().uuid()
+  })
+]);
+var disableConnectionBodySchema = exports_external.object({ enabled: exports_external.boolean() });
+var credentialBindingBodySchema = exports_external.object({
+  id: exports_external.string().uuid().optional(),
+  configKey: exports_external.string().min(1).max(255),
+  allowedHosts: exports_external.array(exports_external.string().min(1)).min(1),
+  headerTemplate: exports_external.string().min(1).optional(),
+  queryTemplate: exports_external.string().min(1).optional(),
+  scope: scopeSchema.default("global").optional(),
+  scopeId: scopedResourceScopeIdSchema.nullable().optional(),
+  active: exports_external.boolean().default(true).optional(),
+  authKind: exports_external.enum(["config", "oauth"]).default("config").optional(),
+  oauthProvider: providerSchema.optional()
+});
+var oauthAppBodySchema = exports_external.object({
+  provider: providerSchema,
+  clientId: exports_external.string().min(1),
+  clientSecret: exports_external.string().min(1).optional(),
+  authorizeUrl: exports_external.string().url(),
+  tokenUrl: exports_external.string().url(),
+  scopes: exports_external.array(exports_external.string().min(1)).default([]).optional(),
+  extraParams: exports_external.record(exports_external.string(), exports_external.string()).optional(),
+  tokenAuthStyle: exports_external.enum(["body", "basic"]).optional(),
+  tokenBodyFormat: exports_external.enum(["form", "json"]).optional()
+});
+var discoverOAuthAppBodySchema = exports_external.object({
+  url: exports_external.string().url()
+});
+var listConnectionsRoute = route({
+  method: "get",
+  path: "/api/script-connections",
+  pattern: ["api", "script-connections"],
+  operationId: "script_connections_list",
+  summary: "List script connections",
+  description: "Dashboard read of OpenAPI, GraphQL, and MCP script connections with credential summaries.",
+  tags: ["Script Connections"],
+  query: listConnectionsQuerySchema,
+  responses: {
+    200: { description: "Script connections" },
+    400: { description: "Validation error" }
+  }
+});
+var getConnectionRoute = route({
+  method: "get",
+  path: "/api/script-connections/{id}",
+  pattern: ["api", "script-connections", null],
+  operationId: "script_connections_get",
+  summary: "Get script connection detail",
+  tags: ["Script Connections"],
+  params: idParamsSchema,
+  responses: {
+    200: { description: "Script connection detail" },
+    404: { description: "Script connection not found" }
+  }
+});
+var upsertConnectionRoute = route({
+  method: "post",
+  path: "/api/script-connections",
+  pattern: ["api", "script-connections"],
+  operationId: "script_connections_upsert",
+  summary: "Create or update a script connection",
+  tags: ["Script Connections"],
+  body: upsertConnectionBodySchema,
+  responses: {
+    200: { description: "Saved script connection" },
+    400: { description: "Validation or generation error" },
+    403: { description: "Only the lead agent can manage script connections" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var refreshConnectionRoute = route({
+  method: "post",
+  path: "/api/script-connections/{id}/refresh",
+  pattern: ["api", "script-connections", null, "refresh"],
+  operationId: "script_connections_refresh",
+  summary: "Refresh a script connection",
+  tags: ["Script Connections"],
+  params: idParamsSchema,
+  responses: {
+    200: { description: "Refreshed script connection" },
+    400: { description: "Connection cannot be refreshed" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "Script connection not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var setConnectionEnabledRoute = route({
+  method: "post",
+  path: "/api/script-connections/{id}/disable",
+  pattern: ["api", "script-connections", null, "disable"],
+  operationId: "script_connections_set_enabled",
+  summary: "Enable or disable a script connection",
+  tags: ["Script Connections"],
+  params: idParamsSchema,
+  body: disableConnectionBodySchema,
+  responses: {
+    200: { description: "Updated script connection" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "Script connection not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var listCredentialBindingsRoute = route({
+  method: "get",
+  path: "/api/credential-bindings",
+  pattern: ["api", "credential-bindings"],
+  operationId: "credential_bindings_list",
+  summary: "List script credential bindings",
+  tags: ["Script Connections"],
+  responses: {
+    200: { description: "Credential bindings" }
+  }
+});
+var upsertCredentialBindingRoute = route({
+  method: "post",
+  path: "/api/credential-bindings",
+  pattern: ["api", "credential-bindings"],
+  operationId: "credential_bindings_upsert",
+  summary: "Create or update a script credential binding",
+  tags: ["Script Connections"],
+  body: credentialBindingBodySchema,
+  responses: {
+    200: { description: "Saved credential binding" },
+    400: { description: "Validation error" },
+    403: { description: "Only the lead agent can manage script connections" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var listOAuthAppsRoute = route({
+  method: "get",
+  path: "/api/oauth-apps",
+  pattern: ["api", "oauth-apps"],
+  operationId: "oauth_apps_list",
+  summary: "List OAuth apps for script credential bindings",
+  tags: ["Script Connections"],
+  responses: {
+    200: { description: "OAuth apps without client secrets" }
+  }
+});
+var upsertOAuthAppRoute = route({
+  method: "post",
+  path: "/api/oauth-apps",
+  pattern: ["api", "oauth-apps"],
+  operationId: "oauth_apps_upsert",
+  summary: "Create or update an OAuth app for script credential bindings",
+  tags: ["Script Connections"],
+  body: oauthAppBodySchema,
+  responses: {
+    200: { description: "Saved OAuth app without client secret" },
+    400: { description: "Validation error" },
+    403: { description: "Only the lead agent can manage script connections" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var discoverOAuthAppRoute = route({
+  method: "post",
+  path: "/api/oauth-apps/discover",
+  pattern: ["api", "oauth-apps", "discover"],
+  operationId: "oauth_apps_discover",
+  summary: "Discover OAuth endpoints from provider metadata",
+  tags: ["Script Connections"],
+  body: discoverOAuthAppBodySchema,
+  responses: {
+    200: { description: "Discovered OAuth metadata" },
+    400: { description: "Discovery failed" },
+    403: { description: "Only the lead agent can manage script connections" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var deleteOAuthAppRoute = route({
+  method: "delete",
+  path: "/api/oauth-apps/{provider}",
+  pattern: ["api", "oauth-apps", null],
+  operationId: "oauth_apps_delete",
+  summary: "Delete an OAuth app and its tokens",
+  tags: ["Script Connections"],
+  params: providerParamsSchema,
+  responses: {
+    200: { description: "OAuth app deleted" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "OAuth app not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var authorizeUrlRoute2 = route({
+  method: "post",
+  path: "/api/oauth-apps/{provider}/authorize-url",
+  pattern: ["api", "oauth-apps", null, "authorize-url"],
+  operationId: "oauth_apps_authorize_url",
+  summary: "Build an OAuth authorization URL",
+  tags: ["Script Connections"],
+  params: providerParamsSchema,
+  responses: {
+    200: { description: "OAuth authorization URL" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "OAuth app not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var integrationsCatalogRoute = route({
+  method: "get",
+  path: "/api/integrations-catalog",
+  pattern: ["api", "integrations-catalog"],
+  operationId: "integrations_catalog_list",
+  summary: "Proxy integrations.sh catalog entries",
+  tags: ["Script Connections"],
+  responses: {
+    200: { description: "Integrations catalog entries" },
+    502: { description: "Catalog upstream unavailable" }
+  }
+});
+var surfaceDomainSchema = exports_external.string().min(1).max(255).regex(/^[a-z0-9.-]+$/i);
+var integrationsSurfaceRoute = route({
+  method: "get",
+  path: "/api/integrations-catalog/{domain}/surface",
+  pattern: ["api", "integrations-catalog", null, "surface"],
+  operationId: "integrations_catalog_surface",
+  summary: "Proxy integrations.sh per-domain surface details (trimmed for the Add Connection flow)",
+  tags: ["Script Connections"],
+  params: exports_external.object({ domain: surfaceDomainSchema }),
+  responses: {
+    200: { description: "Trimmed integration surface details for a domain" },
+    404: { description: "No surface data for this domain" },
+    502: { description: "Surface upstream unavailable" }
+  }
+});
+var disconnectOAuthAppRoute = route({
+  method: "delete",
+  path: "/api/oauth-apps/{provider}/tokens",
+  pattern: ["api", "oauth-apps", null, "tokens"],
+  operationId: "oauth_app_disconnect",
+  summary: "Disconnect an OAuth app: delete stored tokens (best-effort remote revocation when a revocation endpoint is known)",
+  tags: ["Script Connections"],
+  params: providerParamsSchema,
+  responses: {
+    200: { description: "Disconnect result" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "OAuth app not found" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var refreshOAuthAppTokensRoute = route({
+  method: "post",
+  path: "/api/oauth-apps/{provider}/refresh",
+  pattern: ["api", "oauth-apps", null, "refresh"],
+  operationId: "oauth_app_refresh_tokens",
+  summary: "Force-refresh the stored OAuth tokens for a provider (never returns token values)",
+  tags: ["Script Connections"],
+  params: providerParamsSchema,
+  responses: {
+    200: { description: "Refresh result with token status and new expiry" },
+    400: { description: "No stored tokens or provider does not support refresh" },
+    403: { description: "Only the lead agent can manage script connections" },
+    404: { description: "OAuth app not found" },
+    502: { description: "Provider token endpoint rejected the refresh" }
+  },
+  rbac: { permission: "script-connection.manage" }
+});
+var DISCOVERY_TIMEOUT_MS = 1e4;
+var INTEGRATIONS_CATALOG_TIMEOUT_MS = 15000;
+var INTEGRATIONS_CATALOG_TTL_MS = 60 * 60 * 1000;
+var SPEC_PREVIEW_MAX_BYTES = 50 * 1024;
+var integrationsCatalogCache = null;
+var INTEGRATIONS_SURFACE_CACHE_MAX_ENTRIES = 200;
+var integrationsSurfaceCache = new Map;
+
+class SurfaceNotFoundError extends Error {
+}
+function singleHeader4(req, name) {
+  const raw = req.headers[name];
+  return Array.isArray(raw) ? raw[0] : raw;
+}
+function ensureConnectionAdmin(req, res, agentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator" || auth?.kind === "user")
+    return true;
+  const callerAgentId = agentId ?? singleHeader4(req, "x-agent-id");
+  const agent = callerAgentId ? getAgentById(callerAgentId) : undefined;
+  const decision = can({
+    principal: {
+      kind: "agent",
+      agentId: callerAgentId ?? "",
+      isLead: agent?.isLead ?? false
+    },
+    verb: "script-connection.manage",
+    resource: { kind: "none" },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, "Only the lead can manage script connections.", 403);
+    return false;
+  }
+  return true;
+}
+function tokenStatusForBinding(binding) {
+  return binding.authKind === "oauth" && binding.oauthProvider ? getOAuthBindingTokenStatus(binding.oauthProvider) : undefined;
+}
+function decorateBinding(binding) {
+  const tokenStatus = tokenStatusForBinding(binding);
+  return tokenStatus ? { ...binding, tokenStatus } : binding;
+}
+function bindingSummary(binding) {
+  if (!binding)
+    return null;
+  const tokenStatus = tokenStatusForBinding(binding);
+  return {
+    id: binding.id,
+    configKey: binding.configKey,
+    authKind: binding.authKind ?? "config",
+    ...binding.oauthProvider ? { oauthProvider: binding.oauthProvider } : {},
+    ...tokenStatus ? { tokenStatus } : {}
+  };
+}
+function runtimeCounts(connection) {
+  if (!connection.generatedRuntimeJson) {
+    return { operationCount: 0, toolCount: 0 };
+  }
+  try {
+    const runtime = JSON.parse(connection.generatedRuntimeJson);
+    const operationCount = Array.isArray(runtime.operations) ? runtime.operations.length : connection.kind === "graphql" ? 1 : 0;
+    const toolCount = Array.isArray(runtime.tools) ? runtime.tools.length : 0;
+    return { operationCount, toolCount };
+  } catch {
+    return { operationCount: 0, toolCount: 0 };
+  }
+}
+function parseRecord(value) {
+  if (!value)
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function connectionDetail(connection) {
+  const decorated = decorateConnections([connection])[0];
+  if (!decorated)
+    throw new Error("Failed to decorate connection detail.");
+  const runtime = parseRecord(connection.generatedRuntimeJson);
+  const operations = Array.isArray(runtime?.operations) ? runtime.operations.filter((operation) => {
+    return operation !== null && typeof operation === "object" && !Array.isArray(operation);
+  }).map((operation) => ({
+    name: String(operation.name ?? ""),
+    method: String(operation.method ?? ""),
+    path: String(operation.path ?? ""),
+    ...Array.isArray(operation.parameters) ? {
+      parameters: operation.parameters.filter((param) => {
+        return param !== null && typeof param === "object" && !Array.isArray(param);
+      }).map((param) => ({
+        name: String(param.name ?? ""),
+        in: String(param.in ?? "query"),
+        required: param.required === true,
+        ...param.schema !== undefined ? { schema: param.schema } : {}
+      })).filter((param) => param.name)
+    } : {},
+    ...typeof operation.hasBody === "boolean" ? { hasBody: operation.hasBody } : {},
+    ...typeof operation.successStatus === "string" ? { successStatus: operation.successStatus } : {},
+    ...operation.requestBodySchema !== undefined ? { requestBodySchema: operation.requestBodySchema } : {},
+    ...operation.responseSchema !== undefined ? { responseSchema: operation.responseSchema } : {}
+  })).filter((operation) => operation.name && operation.method && operation.path) : [];
+  const tools = Array.isArray(runtime?.tools) ? runtime.tools.filter((tool) => {
+    return tool !== null && typeof tool === "object" && !Array.isArray(tool);
+  }).map((tool) => ({
+    name: String(tool.name ?? ""),
+    ...typeof tool.description === "string" ? { description: tool.description } : {},
+    ...tool.inputSchema !== undefined ? { inputSchema: tool.inputSchema } : {}
+  })).filter((tool) => tool.name) : [];
+  const detail = {
+    ...decorated,
+    operations,
+    tools,
+    graphql: connection.kind === "graphql",
+    generatedTypes: connection.generatedTypes ?? ""
+  };
+  if (connection.kind === "openapi" && connection.openapiSpecJson) {
+    try {
+      const spec = JSON.parse(connection.openapiSpecJson);
+      const info = spec.info && typeof spec.info === "object" && !Array.isArray(spec.info) ? spec.info : {};
+      const paths = spec.paths && typeof spec.paths === "object" && !Array.isArray(spec.paths) ? spec.paths : {};
+      const pretty = JSON.stringify(spec, null, 2);
+      const truncated = pretty.length > SPEC_PREVIEW_MAX_BYTES;
+      detail.specSummary = {
+        ...typeof info.title === "string" ? { title: info.title } : {},
+        ...typeof info.version === "string" ? { version: info.version } : {},
+        pathCount: Object.keys(paths).length
+      };
+      detail.specPreview = {
+        json: truncated ? pretty.slice(0, SPEC_PREVIEW_MAX_BYTES) : pretty,
+        truncated
+      };
+    } catch {
+      detail.specPreview = {
+        json: connection.openapiSpecJson.slice(0, SPEC_PREVIEW_MAX_BYTES),
+        truncated: connection.openapiSpecJson.length > SPEC_PREVIEW_MAX_BYTES
+      };
+    }
+  }
+  return detail;
+}
+function decorateConnections(connections) {
+  const bindings = new Map(listRelationalCredentialBindings({ includeInactive: true }).map((binding) => [
+    binding.id,
+    binding
+  ]));
+  return connections.map((connection) => {
+    const {
+      openapiSpecJson: _openapiSpecJson,
+      generatedTypes: _generatedTypes,
+      generatedRuntimeJson: _generatedRuntimeJson,
+      ...safeConnection
+    } = connection;
+    return {
+      ...safeConnection,
+      ...runtimeCounts(connection),
+      credentialBinding: bindingSummary(connection.credentialBindingId ? bindings.get(connection.credentialBindingId) : undefined)
+    };
+  });
+}
+function listConnections(query) {
+  const connections = listScriptConnections({
+    includeDisabled: true,
+    allScopes: true,
+    kind: query.kind
+  }).filter((connection) => {
+    if (query.scope && connection.scope !== query.scope)
+      return false;
+    if (query.scopeId && connection.scopeId !== query.scopeId)
+      return false;
+    return true;
+  });
+  return decorateConnections(connections);
+}
+function connectionScopeId(scope, scopeId, subject = "connections") {
+  return resolveScopedResourceId(scope, scopeId, subject);
+}
+function validateCredentialTemplate(input) {
+  if (input.requireTemplate && !input.headerTemplate && !input.queryTemplate) {
+    throw new Error("At least one of headerTemplate or queryTemplate is required.");
+  }
+  const placeholder = placeholderForConfigKey(input.configKey);
+  if (input.headerTemplate && !input.headerTemplate.includes(placeholder)) {
+    throw new Error(`headerTemplate must include ${placeholder}.`);
+  }
+  if (input.queryTemplate && !input.queryTemplate.includes(placeholder)) {
+    throw new Error(`queryTemplate must include ${placeholder}.`);
+  }
+}
+function maybeCreateInlineBinding(data, resolvedScope, resolvedScopeId) {
+  if (data.credentialBindingId || !data.configKey)
+    return data.credentialBindingId ?? null;
+  const scope = resolvedScope ?? data.scope ?? "global";
+  const scopeId = resolvedScopeId !== undefined ? resolvedScopeId : connectionScopeId(scope, data.scopeId, "bindings");
+  const allowedHosts = data.allowedHosts ?? ("baseUrl" in data ? [new URL(data.baseUrl).hostname] : []);
+  const authKind = data.authKind ?? "config";
+  const placeholder = placeholderForConfigKey(data.configKey);
+  const headerTemplate = data.headerTemplate ?? (data.queryTemplate ? undefined : `Authorization: Bearer ${placeholder}`);
+  validateCredentialTemplate({
+    configKey: data.configKey,
+    headerTemplate,
+    queryTemplate: data.queryTemplate
+  });
+  if (authKind === "oauth" && !data.oauthProvider) {
+    throw new Error("oauthProvider is required for oauth credential bindings.");
+  }
+  return upsertCredentialBinding({
+    configKey: data.configKey,
+    allowedHosts,
+    headerTemplate,
+    queryTemplate: data.queryTemplate,
+    scope,
+    scopeId,
+    active: true,
+    authKind,
+    oauthProvider: data.oauthProvider ?? null
+  }).id;
+}
+function parseMetadata(metadata) {
+  try {
+    const parsed = JSON.parse(metadata);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function parseScopes(scopes) {
+  return scopes.split(",").map((scope) => scope.trim()).filter(Boolean);
+}
+function sanitizeOAuthApp(row) {
+  const metadata = parseMetadata(row.metadata);
+  const extraParams = metadata.extraParams && typeof metadata.extraParams === "object" && !Array.isArray(metadata.extraParams) ? Object.fromEntries(Object.entries(metadata.extraParams).filter((entry) => typeof entry[1] === "string")) : undefined;
+  return {
+    id: row.id,
+    provider: row.provider,
+    clientId: row.clientId,
+    authorizeUrl: row.authorizeUrl,
+    tokenUrl: row.tokenUrl,
+    redirectUri: row.redirectUri,
+    scopes: parseScopes(row.scopes),
+    extraParams,
+    tokenAuthStyle: metadata.tokenAuthStyle === "basic" ? "basic" : "body",
+    tokenBodyFormat: metadata.tokenBodyFormat === "json" ? "json" : "form",
+    tokenStatus: getOAuthBindingTokenStatus(row.provider),
+    expiresAt: row.tokenExpiresAt,
+    lastRefreshedAt: normalizeDate(row.tokenUpdatedAt),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function listOAuthApps() {
+  const rows = getDb().prepare(`SELECT a.id, a.provider, a.clientId, a.authorizeUrl, a.tokenUrl, a.redirectUri,
+              a.scopes, a.metadata, t.expiresAt AS tokenExpiresAt,
+              t.updatedAt AS tokenUpdatedAt, a.createdAt, a.updatedAt
+       FROM oauth_apps a
+       LEFT JOIN oauth_tokens t ON t.provider = a.provider
+       ORDER BY a.provider ASC`).all();
+  return rows.map(sanitizeOAuthApp);
+}
+async function attemptRemoteRevocation(app, accessToken) {
+  const metadata = parseMetadata(app.metadata);
+  const revocationUrl = typeof metadata.revocationUrl === "string" ? metadata.revocationUrl : undefined;
+  if (!revocationUrl)
+    return false;
+  const body = new URLSearchParams({
+    token: accessToken,
+    token_type_hint: "access_token"
+  });
+  const headers2 = {
+    "content-type": "application/x-www-form-urlencoded"
+  };
+  if (metadata.tokenAuthStyle === "basic") {
+    headers2.authorization = `Basic ${Buffer.from(`${app.clientId}:${app.clientSecret}`).toString("base64")}`;
+  } else {
+    body.set("client_id", app.clientId);
+    body.set("client_secret", app.clientSecret);
+  }
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), 5000);
+  try {
+    await fetch(revocationUrl, {
+      method: "POST",
+      headers: headers2,
+      body: body.toString(),
+      signal: controller.signal
+    });
+  } catch (err) {
+    console.warn(scrubSecrets(`OAuth token revocation request failed for provider ${app.provider}: ${err instanceof Error ? err.message : String(err)}`));
+  } finally {
+    clearTimeout(timeout);
+  }
+  return true;
+}
+function genericOAuthRedirectUri(provider) {
+  return `${getPublicMcpBaseUrl()}/api/oauth/${encodeURIComponent(provider)}/callback`;
+}
+function oauthDiscoveryUrls(inputUrl) {
+  const parsed = new URL(inputUrl);
+  const pathname = parsed.pathname.replace(/\/+$/, "");
+  const base = `${parsed.origin}${pathname === "/" ? "" : pathname}`;
+  return [
+    `${base}/.well-known/oauth-authorization-server`,
+    `${base}/.well-known/openid-configuration`,
+    parsed.toString()
+  ].filter((url, index, urls) => urls.indexOf(url) === index);
+}
+async function fetchJsonMetadata(url, signal) {
+  let current = assertUrlSafe(url, publicEndpointSsrfOptions());
+  let response = null;
+  for (let hop = 0;hop <= 5; hop += 1) {
+    response = await fetch(current, {
+      headers: { accept: "application/json" },
+      signal,
+      redirect: "manual"
+    });
+    if (response.status < 300 || response.status >= 400 || response.status === 304)
+      break;
+    const location = response.headers.get("location");
+    if (!location) {
+      throw new Error(`HTTP ${response.status} redirect missing Location header`);
+    }
+    current = assertUrlSafe(new URL(location, current).toString(), publicEndpointSsrfOptions());
+    if (hop === 5)
+      throw new Error("OAuth discovery exceeded 5 redirects.");
+  }
+  if (!response)
+    throw new Error("OAuth discovery failed before receiving a response.");
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error("Response was not JSON.");
+  }
+}
+function extractOAuthDiscovery(metadata) {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
+    return null;
+  const record = metadata;
+  if (typeof record.authorization_endpoint !== "string" || typeof record.token_endpoint !== "string") {
+    return null;
+  }
+  const scopes = Array.isArray(record.scopes_supported) ? record.scopes_supported.filter((scope) => typeof scope === "string") : [];
+  return {
+    authorizeUrl: record.authorization_endpoint,
+    tokenUrl: record.token_endpoint,
+    scopes
+  };
+}
+async function discoverOAuthApp(url) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+  const failures = [];
+  try {
+    for (const candidate of oauthDiscoveryUrls(url)) {
+      try {
+        const metadata = await fetchJsonMetadata(candidate, controller.signal);
+        const discovered = extractOAuthDiscovery(metadata);
+        if (discovered) {
+          assertOAuthAppUrlsSafe(discovered);
+          return { ...discovered, sourceUrl: candidate };
+        }
+        failures.push(`${candidate}: missing authorization_endpoint or token_endpoint`);
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError") {
+          throw new Error("OAuth discovery timed out after 10s.");
+        }
+        if (isUrlSafetyError(error))
+          throw error;
+        failures.push(`${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+  throw new Error(`OAuth discovery failed. ${failures.join(" ")}`);
+}
+function isUrlSafetyError(error) {
+  if (!(error instanceof Error))
+    return false;
+  return error.message.startsWith("Refusing ") || error.message.startsWith("Invalid URL:") || error.message.startsWith("Missing hostname:");
+}
+function stringFromCatalogEntry(entry, keys) {
+  for (const key of keys) {
+    const value = entry[key];
+    if (typeof value === "string")
+      return value;
+  }
+  return "";
+}
+function stringArrayFromCatalogEntry(entry, key) {
+  const value = entry[key];
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((item) => typeof item === "string");
+}
+function normalizeCatalogEntry(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  const kind = stringFromCatalogEntry(record, ["kind", "type"]);
+  if (!kind || kind === "cli")
+    return null;
+  const slug = stringFromCatalogEntry(record, ["slug", "id", "name"]);
+  const name = stringFromCatalogEntry(record, ["name", "title"]) || slug;
+  const domain = stringFromCatalogEntry(record, ["domain", "hostname"]);
+  return {
+    id: stringFromCatalogEntry(record, ["id", "slug"]) || slug || name,
+    kind,
+    slug,
+    name,
+    description: stringFromCatalogEntry(record, ["description", "summary"]),
+    url: stringFromCatalogEntry(record, ["url", "homepage", "baseUrl"]),
+    icon: stringFromCatalogEntry(record, ["icon", "logo"]) || null,
+    domain,
+    categories: stringArrayFromCatalogEntry(record, "categories"),
+    feeds: stringArrayFromCatalogEntry(record, "feeds")
+  };
+}
+function catalogEntriesFromPayload(payload) {
+  if (Array.isArray(payload))
+    return payload;
+  if (!payload || typeof payload !== "object")
+    return [];
+  const record = payload;
+  for (const key of ["entries", "integrations", "data", "items"]) {
+    if (Array.isArray(record[key]))
+      return record[key];
+  }
+  return [];
+}
+async function fetchIntegrationsCatalog() {
+  const now = Date.now();
+  if (integrationsCatalogCache && integrationsCatalogCache.expiresAtMs > now) {
+    return integrationsCatalogCache.payload;
+  }
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), INTEGRATIONS_CATALOG_TIMEOUT_MS);
+  try {
+    const response = await fetch("https://integrations.sh/api.json", {
+      headers: { accept: "application/json" },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`integrations.sh returned HTTP ${response.status}`);
+    }
+    const payload = await response.json();
+    const entries = catalogEntriesFromPayload(payload).map(normalizeCatalogEntry).filter((entry) => Boolean(entry));
+    const cachedAt = new Date().toISOString();
+    integrationsCatalogCache = {
+      expiresAtMs: now + INTEGRATIONS_CATALOG_TTL_MS,
+      payload: { entries, cachedAt }
+    };
+    return integrationsCatalogCache.payload;
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      throw new Error("Timed out fetching integrations catalog after 15s.");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function stringOrNull(value) {
+  return typeof value === "string" && value ? value : null;
+}
+function trimSurfacePayload(domain, payload) {
+  const record = payload && typeof payload === "object" ? payload : {};
+  const rawSurfaces = Array.isArray(record.surfaces) ? record.surfaces : [];
+  const surfaces = [];
+  const referencedCredentialIds = new Set;
+  for (const raw of rawSurfaces) {
+    if (!raw || typeof raw !== "object")
+      continue;
+    const surface = raw;
+    const type = typeof surface.type === "string" ? surface.type : "";
+    if (type !== "http" && type !== "mcp")
+      continue;
+    const auth = surface.auth && typeof surface.auth === "object" ? surface.auth : {};
+    const entries = Array.isArray(auth.entries) ? auth.entries : [];
+    const credentialIds = [];
+    let mechanics = null;
+    for (const entry of entries) {
+      if (!entry || typeof entry !== "object")
+        continue;
+      const uses = Array.isArray(entry.use) ? entry.use : [];
+      for (const use of uses) {
+        if (!use || typeof use !== "object")
+          continue;
+        const useRecord = use;
+        const id = typeof useRecord.id === "string" ? useRecord.id : "";
+        if (id && !credentialIds.includes(id))
+          credentialIds.push(id);
+        const rawMechanics = useRecord.mechanics && typeof useRecord.mechanics === "object" ? useRecord.mechanics : {};
+        const mechanicsIn = typeof rawMechanics.in === "string" ? rawMechanics.in : "";
+        if (mechanicsIn && (!mechanics || mechanics.in !== "header" && mechanicsIn === "header")) {
+          mechanics = {
+            in: mechanicsIn,
+            headerName: stringOrNull(rawMechanics.headerName),
+            scheme: stringOrNull(rawMechanics.scheme)
+          };
+        }
+      }
+    }
+    for (const id of credentialIds)
+      referencedCredentialIds.add(id);
+    surfaces.push({
+      type,
+      name: typeof surface.name === "string" ? surface.name : "",
+      url: stringOrNull(surface.url),
+      docs: stringOrNull(surface.docs),
+      spec: stringOrNull(surface.spec),
+      auth: { required: auth.status === "required", credentialIds, mechanics }
+    });
+  }
+  const rawCredentials = record.credentials && typeof record.credentials === "object" ? record.credentials : {};
+  const credentials = {};
+  for (const [id, raw] of Object.entries(rawCredentials)) {
+    if (!referencedCredentialIds.has(id) || !raw || typeof raw !== "object")
+      continue;
+    const credential = raw;
+    credentials[id] = {
+      type: typeof credential.type === "string" ? credential.type : "unknown",
+      label: typeof credential.label === "string" ? credential.label : id,
+      generateUrl: stringOrNull(credential.generateUrl),
+      setup: stringOrNull(credential.setup)
+    };
+  }
+  return {
+    domain: typeof record.domain === "string" && record.domain ? record.domain : domain,
+    summary: typeof record.summary === "string" ? record.summary : "",
+    surfaces,
+    credentials
+  };
+}
+async function fetchIntegrationsSurface(domain) {
+  const cacheKey2 = domain.toLowerCase();
+  const now = Date.now();
+  const cached = integrationsSurfaceCache.get(cacheKey2);
+  if (cached && cached.expiresAtMs > now)
+    return cached.payload;
+  integrationsSurfaceCache.delete(cacheKey2);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), INTEGRATIONS_CATALOG_TIMEOUT_MS);
+  try {
+    const response = await fetch(`https://integrations.sh/api/${encodeURIComponent(cacheKey2)}/surface`, { headers: { accept: "application/json" }, signal: controller.signal });
+    if (response.status === 404) {
+      throw new SurfaceNotFoundError(`No integration surface found for ${domain}.`);
+    }
+    if (!response.ok) {
+      throw new Error(`integrations.sh returned HTTP ${response.status}`);
+    }
+    const payload = trimSurfacePayload(cacheKey2, await response.json());
+    if (integrationsSurfaceCache.size >= INTEGRATIONS_SURFACE_CACHE_MAX_ENTRIES) {
+      const oldestKey = integrationsSurfaceCache.keys().next().value;
+      if (oldestKey !== undefined)
+        integrationsSurfaceCache.delete(oldestKey);
+    }
+    integrationsSurfaceCache.set(cacheKey2, {
+      expiresAtMs: now + INTEGRATIONS_CATALOG_TTL_MS,
+      payload
+    });
+    return payload;
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      throw new Error("Timed out fetching integration surface after 15s.");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function deleteOAuthApp(provider) {
+  const existing = getOAuthApp(provider);
+  if (!existing)
+    return false;
+  const tx = getDb().transaction(() => {
+    deleteOAuthTokens(provider);
+    getDb().query("DELETE FROM oauth_apps WHERE provider = ?").run(provider);
+  });
+  tx();
+  return true;
+}
+async function refreshHttpConnection(id, userId, agentId) {
+  return refreshScriptConnection(id, userId, agentId);
+}
+async function handleScriptConnections(req, res, pathSegments, queryParams, agentId) {
+  if (listConnectionsRoute.match(req.method, pathSegments)) {
+    const parsed = await listConnectionsRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    json(res, { connections: listConnections(parsed.query) });
+    return true;
+  }
+  if (getConnectionRoute.match(req.method, pathSegments)) {
+    const parsed = await getConnectionRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const connection = listScriptConnections({ includeDisabled: true, allScopes: true }).find((candidate) => candidate.id === parsed.params.id) ?? null;
+    if (!connection) {
+      jsonError(res, "Script connection not found.", 404);
+      return true;
+    }
+    json(res, { connection: connectionDetail(connection) });
+    return true;
+  }
+  if (upsertConnectionRoute.match(req.method, pathSegments)) {
+    const parsed = await upsertConnectionRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const schedule = getScheduledTaskById(parsed.params.id);
-    if (!schedule) {
-      jsonError(res, "Schedule not found", 404);
-      return true;
-    }
-    if (!schedule.enabled) {
-      jsonError(res, "Schedule is disabled", 400);
+    if (!ensureConnectionAdmin(req, res, agentId))
       return true;
-    }
     try {
-      const { workflowRunIds, task } = await dispatchScheduleTarget(schedule, ["manual-run"]);
-      const now = new Date().toISOString();
-      if (schedule.scheduleType === "one_time") {
-        updateScheduledTask(schedule.id, {
-          lastRunAt: now,
-          nextRunAt: null,
-          enabled: false,
-          lastUpdatedAt: now
-        });
-      } else {
-        updateScheduledTask(schedule.id, {
-          lastRunAt: now,
-          lastUpdatedAt: now
-        });
+      if (parsed.body.kind === "openapi" && Boolean(parsed.body.openapiSpecJson) && Boolean(parsed.body.openapiSpecUrl)) {
+        jsonError(res, "Provide exactly one of openapiSpecJson or openapiSpecUrl.", 400);
+        return true;
       }
-      const updatedSchedule = getScheduledTaskById(parsed.params.id);
-      json(res, { schedule: updatedSchedule, workflowRunIds, task });
-    } catch (error) {
-      jsonError(res, error instanceof Error ? error.message : "Failed to run schedule", 500);
+      const existingConnection = parsed.body.id ? getScriptConnectionById(parsed.body.id) : null;
+      const existingOpenapiConnection = existingConnection?.kind === "openapi" ? existingConnection : null;
+      if (parsed.body.kind === "openapi" && !parsed.body.openapiSpecJson && !parsed.body.openapiSpecUrl && !existingOpenapiConnection) {
+        jsonError(res, "Provide exactly one of openapiSpecJson or openapiSpecUrl.", 400);
+        return true;
+      }
+      const scopeWasProvided = Object.hasOwn(parsed.body, "scope");
+      const scopeIdWasProvided = Object.hasOwn(parsed.body, "scopeId");
+      const enabledWasProvided = Object.hasOwn(parsed.body, "enabled");
+      const scope = (scopeWasProvided ? parsed.body.scope : existingConnection?.scope) ?? "global";
+      const scopeIdInput = scopeIdWasProvided ? parsed.body.scopeId : existingConnection && scope === existingConnection.scope ? existingConnection.scopeId : null;
+      const scopeId = connectionScopeId(scope, scopeIdInput);
+      const enabled = enabledWasProvided ? parsed.body.enabled !== false : existingConnection?.enabled ?? true;
+      const credentialBindingId = maybeCreateInlineBinding(parsed.body, scope, scopeId);
+      const userId = resolveHttpAuditUserId(req, agentId);
+      const openapiSpecUrl = parsed.body.kind === "openapi" ? parsed.body.openapiSpecUrl : undefined;
+      const openapiSpecJson = parsed.body.kind === "openapi" ? parsed.body.openapiSpecJson : undefined;
+      const openapiSpecUrlChanged = parsed.body.kind === "openapi" && Boolean(openapiSpecUrl) && openapiSpecUrl !== existingOpenapiConnection?.openapiSpecSource;
+      const reuseExistingOpenapiSpec = parsed.body.kind === "openapi" && Boolean(existingOpenapiConnection) && openapiSpecJson === undefined && !openapiSpecUrlChanged;
+      const connection = await upsertScriptConnection({
+        id: parsed.body.id,
+        slug: parsed.body.slug,
+        displayName: parsed.body.displayName,
+        kind: parsed.body.kind,
+        scope,
+        scopeId,
+        baseUrl: "baseUrl" in parsed.body ? parsed.body.baseUrl : null,
+        allowedHosts: parsed.body.allowedHosts ?? ("baseUrl" in parsed.body ? [new URL(parsed.body.baseUrl).hostname] : []),
+        credentialBindingId,
+        openapiSpecSourceKind: reuseExistingOpenapiSpec && !openapiSpecUrl ? existingOpenapiConnection?.openapiSpecSourceKind : undefined,
+        openapiSpecSource: reuseExistingOpenapiSpec && !openapiSpecUrl ? existingOpenapiConnection?.openapiSpecSource : undefined,
+        openapiSpecUrl,
+        openapiSpecJson: parsed.body.kind === "openapi" ? openapiSpecJson ?? (reuseExistingOpenapiSpec ? existingOpenapiConnection?.openapiSpecJson ?? undefined : undefined) : undefined,
+        openapiSpecEtag: reuseExistingOpenapiSpec ? existingOpenapiConnection?.openapiSpecEtag : undefined,
+        openapiSpecFetchedAt: reuseExistingOpenapiSpec ? existingOpenapiConnection?.openapiSpecFetchedAt : undefined,
+        mcpServerId: parsed.body.kind === "mcp" ? parsed.body.mcpServerId : null,
+        enabled,
+        agentId,
+        userId
+      });
+      json(res, { connection: decorateConnections([connection])[0] });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : String(err), 400);
     }
     return true;
   }
-  if (getSchedule.match(req.method, pathSegments)) {
-    const parsed = await getSchedule.parse(req, res, pathSegments, queryParams);
+  if (refreshConnectionRoute.match(req.method, pathSegments)) {
+    const parsed = await refreshConnectionRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const schedule = getScheduledTaskById(parsed.params.id);
-    if (!schedule) {
-      jsonError(res, "Schedule not found", 404);
+    if (!ensureConnectionAdmin(req, res, agentId))
       return true;
+    try {
+      const refreshed = await refreshHttpConnection(parsed.params.id, resolveHttpAuditUserId(req, agentId), agentId);
+      if (!refreshed) {
+        jsonError(res, "Script connection not found.", 404);
+        return true;
+      }
+      json(res, { connection: decorateConnections([refreshed])[0] });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : String(err), 400);
     }
-    const userId = resolveHttpAuditUserId(req, myAgentId);
-    const [decorated] = withFavoriteFlags([schedule], { userId, itemType: "schedule" });
-    json(res, decorated ?? schedule);
     return true;
   }
-  if (updateSchedule.match(req.method, pathSegments) || patchSchedule.match(req.method, pathSegments)) {
-    const routeHandle = updateSchedule.match(req.method, pathSegments) ? updateSchedule : patchSchedule;
-    const parsed = await routeHandle.parse(req, res, pathSegments, queryParams);
+  if (setConnectionEnabledRoute.match(req.method, pathSegments)) {
+    const parsed = await setConnectionEnabledRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const body = parsed.body;
-    if (parsed.body.model !== undefined || parsed.body.modelTier !== undefined) {
-      const normalizedModel = splitLegacyModelAlias({
-        model: parsed.body.model,
-        modelTier: parsed.body.modelTier
-      });
-      if (parsed.body.model !== undefined)
-        body.model = normalizedModel.model ?? null;
-      if (parsed.body.modelTier !== undefined || normalizedModel.modelTier) {
-        body.modelTier = normalizedModel.modelTier ?? null;
-      }
-    }
-    const existing = getScheduledTaskById(parsed.params.id);
-    if (!existing) {
-      jsonError(res, "Schedule not found", 404);
+    if (!ensureConnectionAdmin(req, res, agentId))
       return true;
-    }
-    if (existing.scheduleType === "one_time" && !existing.enabled && existing.lastRunAt) {
-      jsonError(res, "One-time schedule has already executed. Create a new one instead.", 400);
+    const updated = setScriptConnectionEnabled(parsed.params.id, parsed.body.enabled, resolveHttpAuditUserId(req, agentId));
+    if (!updated) {
+      jsonError(res, "Script connection not found.", 404);
       return true;
     }
-    if (existing.scheduleType !== "one_time") {
-      const timing = mergeScheduleTiming({
-        cronExpression: existing.cronExpression ?? null,
-        intervalMs: existing.intervalMs ?? null
-      }, { cronExpression: parsed.body.cronExpression, intervalMs: parsed.body.intervalMs });
-      if (validateRecurringTiming(timing)) {
-        jsonError(res, "At least one of intervalMs or cronExpression must be set", 400);
+    json(res, { connection: decorateConnections([updated])[0] });
+    return true;
+  }
+  if (listCredentialBindingsRoute.match(req.method, pathSegments)) {
+    json(res, {
+      bindings: listRelationalCredentialBindings({ includeInactive: true }).map(decorateBinding)
+    });
+    return true;
+  }
+  if (upsertCredentialBindingRoute.match(req.method, pathSegments)) {
+    const parsed = await upsertCredentialBindingRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    try {
+      const scope = parsed.body.scope ?? "global";
+      const scopeId = connectionScopeId(scope, parsed.body.scopeId, "bindings");
+      if (!parsed.body.headerTemplate && !parsed.body.queryTemplate) {
+        jsonError(res, "At least one of headerTemplate or queryTemplate is required.", 400);
         return true;
       }
-    }
-    if (parsed.body.cronExpression) {
-      try {
-        import_cron_parser.CronExpressionParser.parse(parsed.body.cronExpression);
-      } catch {
-        jsonError(res, "Invalid cron expression", 400);
+      if ((parsed.body.authKind ?? "config") === "oauth" && !parsed.body.oauthProvider) {
+        jsonError(res, "oauthProvider is required for oauth credential bindings.", 400);
         return true;
       }
+      validateCredentialTemplate({
+        configKey: parsed.body.configKey,
+        headerTemplate: parsed.body.headerTemplate,
+        queryTemplate: parsed.body.queryTemplate,
+        requireTemplate: true
+      });
+      const nextBinding = CredentialBindingSchema.parse({
+        configKey: parsed.body.configKey,
+        allowedHosts: parsed.body.allowedHosts,
+        headerTemplate: parsed.body.headerTemplate,
+        queryTemplate: parsed.body.queryTemplate,
+        scope,
+        scopeId,
+        active: parsed.body.active ?? true,
+        authKind: parsed.body.authKind ?? "config",
+        oauthProvider: parsed.body.oauthProvider
+      });
+      const binding = upsertCredentialBinding({
+        id: parsed.body.id,
+        configKey: nextBinding.configKey,
+        allowedHosts: nextBinding.allowedHosts,
+        headerTemplate: nextBinding.headerTemplate,
+        queryTemplate: nextBinding.queryTemplate,
+        scope: nextBinding.scope,
+        scopeId: nextBinding.scopeId ?? null,
+        active: nextBinding.active,
+        authKind: nextBinding.authKind,
+        oauthProvider: nextBinding.oauthProvider ?? null,
+        userId: resolveHttpAuditUserId(req, agentId)
+      });
+      json(res, { binding: decorateBinding(binding) });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : String(err), 400);
     }
-    if (parsed.body.targetAgentId) {
-      const agent = getAgentById(parsed.body.targetAgentId);
-      if (!agent) {
-        jsonError(res, "Target agent not found", 400);
+    return true;
+  }
+  if (listOAuthAppsRoute.match(req.method, pathSegments)) {
+    json(res, { oauthApps: listOAuthApps() });
+    return true;
+  }
+  if (upsertOAuthAppRoute.match(req.method, pathSegments)) {
+    const parsed = await upsertOAuthAppRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    try {
+      assertOAuthProviderIsNotReserved(parsed.body.provider);
+      assertOAuthAppUrlsSafe(parsed.body);
+      const existing = getOAuthApp(parsed.body.provider);
+      const clientSecret = parsed.body.clientSecret ?? existing?.clientSecret;
+      if (!clientSecret) {
+        jsonError(res, "clientSecret is required when creating a new OAuth app.", 400);
         return true;
       }
+      const redirectUri = genericOAuthRedirectUri(parsed.body.provider);
+      upsertOAuthApp(parsed.body.provider, {
+        clientId: parsed.body.clientId,
+        clientSecret,
+        authorizeUrl: parsed.body.authorizeUrl,
+        tokenUrl: parsed.body.tokenUrl,
+        redirectUri,
+        scopes: (parsed.body.scopes ?? []).join(","),
+        ...parsed.body.extraParams || parsed.body.tokenAuthStyle || parsed.body.tokenBodyFormat ? {
+          metadata: JSON.stringify({
+            ...parsed.body.extraParams ? { extraParams: parsed.body.extraParams } : {},
+            ...parsed.body.tokenAuthStyle ? { tokenAuthStyle: parsed.body.tokenAuthStyle } : {},
+            ...parsed.body.tokenBodyFormat ? { tokenBodyFormat: parsed.body.tokenBodyFormat } : {}
+          })
+        } : {}
+      });
+      const app = listOAuthApps().find((row) => row.provider === parsed.body.provider);
+      json(res, { oauthApp: app });
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : String(err), 400);
     }
-    const mergedTargetType = parsed.body.targetType ?? existing.targetType;
-    const mergedTaskTemplate = parsed.body.taskTemplate !== undefined ? parsed.body.taskTemplate : existing.taskTemplate;
-    const mergedWorkflowId = parsed.body.workflowId !== undefined ? parsed.body.workflowId : existing.workflowId;
-    const mergedScriptName = parsed.body.scriptName !== undefined ? parsed.body.scriptName : existing.scriptName;
-    if (mergedTargetType === "agent-task" && !mergedTaskTemplate) {
-      jsonError(res, "taskTemplate is required when targetType is 'agent-task'.", 400);
+    return true;
+  }
+  if (discoverOAuthAppRoute.match(req.method, pathSegments)) {
+    const parsed = await discoverOAuthAppRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
       return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    try {
+      const discovered = await discoverOAuthApp(parsed.body.url);
+      json(res, discovered);
+    } catch (err) {
+      jsonError(res, err instanceof Error ? err.message : String(err), 400);
     }
-    if (mergedTargetType === "workflow") {
-      if (!mergedWorkflowId) {
-        jsonError(res, "workflowId is required when targetType is 'workflow'.", 400);
-        return true;
-      }
-      if (!getWorkflow(mergedWorkflowId)) {
-        jsonError(res, `Workflow not found: ${mergedWorkflowId}`, 400);
-        return true;
-      }
+    return true;
+  }
+  if (deleteOAuthAppRoute.match(req.method, pathSegments)) {
+    const parsed = await deleteOAuthAppRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    if (!deleteOAuthApp(parsed.params.provider)) {
+      jsonError(res, `OAuth app ${parsed.params.provider} not found.`, 404);
+      return true;
     }
-    if (mergedTargetType === "script") {
-      if (!mergedScriptName) {
-        jsonError(res, "scriptName is required when targetType is 'script'.", 400);
-        return true;
-      }
-      if (!getScript({ name: mergedScriptName, scope: "global" })) {
-        jsonError(res, `Script not found: ${mergedScriptName}`, 400);
-        return true;
-      }
+    json(res, { success: true });
+    return true;
+  }
+  if (authorizeUrlRoute2.match(req.method, pathSegments)) {
+    const parsed = await authorizeUrlRoute2.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    const config = getOAuthProviderConfig(parsed.params.provider);
+    if (!config) {
+      jsonError(res, `OAuth app ${parsed.params.provider} is not configured.`, 404);
+      return true;
     }
-    if (parsed.body.name && parsed.body.name !== existing.name) {
-      const nameConflict = getScheduledTaskByName(parsed.body.name);
-      if (nameConflict) {
-        jsonError(res, "Schedule with this name already exists", 409);
+    const result = await buildAuthorizationUrl(config);
+    json(res, { authorizeUrl: result.url, redirectUri: config.redirectUri });
+    return true;
+  }
+  if (integrationsCatalogRoute.match(req.method, pathSegments)) {
+    try {
+      json(res, await fetchIntegrationsCatalog());
+    } catch (err) {
+      jsonError(res, `Failed to fetch integrations catalog: ${err instanceof Error ? err.message : String(err)}`, 502);
+    }
+    return true;
+  }
+  if (integrationsSurfaceRoute.match(req.method, pathSegments)) {
+    const parsed = await integrationsSurfaceRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    try {
+      json(res, await fetchIntegrationsSurface(parsed.params.domain));
+    } catch (err) {
+      if (err instanceof SurfaceNotFoundError) {
+        jsonError(res, err.message, 404);
         return true;
       }
+      jsonError(res, `Failed to fetch integration surface: ${err instanceof Error ? err.message : String(err)}`, 502);
     }
-    const newEnabled = parsed.body.enabled !== undefined ? parsed.body.enabled : existing.enabled;
-    if (existing.scheduleType === "one_time") {
-      if (!newEnabled) {
-        body.nextRunAt = null;
-      }
-    } else {
-      if (!newEnabled) {
-        body.nextRunAt = null;
-      } else if (parsed.body.cronExpression !== undefined || parsed.body.intervalMs !== undefined || parsed.body.enabled === true && !existing.enabled) {
-        const timing = mergeScheduleTiming({
-          cronExpression: existing.cronExpression ?? null,
-          intervalMs: existing.intervalMs ?? null
-        }, { cronExpression: parsed.body.cronExpression, intervalMs: parsed.body.intervalMs });
-        const mergedTimezone = parsed.body.timezone !== undefined ? parsed.body.timezone : existing.timezone;
-        if (timing.mergedCron || timing.mergedInterval) {
-          body.nextRunAt = calculateNextRun({
-            cronExpression: timing.mergedCron,
-            intervalMs: timing.mergedInterval,
-            timezone: mergedTimezone
-          });
-        }
-      }
+    return true;
+  }
+  if (disconnectOAuthAppRoute.match(req.method, pathSegments)) {
+    const parsed = await disconnectOAuthAppRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    const app = getOAuthApp(parsed.params.provider);
+    if (!app) {
+      jsonError(res, `OAuth app ${parsed.params.provider} is not configured.`, 404);
+      return true;
     }
-    const updatedBy = resolveHttpAuditUserId(req, myAgentId);
-    if (updatedBy !== null)
-      body.updatedBy = updatedBy;
-    const schedule = updateScheduledTask(parsed.params.id, body);
-    json(res, schedule);
+    const tokens = getOAuthTokens(parsed.params.provider);
+    if (!tokens) {
+      json(res, { disconnected: false, message: "no stored tokens" });
+      return true;
+    }
+    const revocationAttempted = await attemptRemoteRevocation(app, tokens.accessToken);
+    deleteOAuthTokens(parsed.params.provider);
+    json(res, { disconnected: true, revocationAttempted });
     return true;
   }
-  if (deleteSchedule.match(req.method, pathSegments)) {
-    const parsed = await deleteSchedule.parse(req, res, pathSegments, queryParams);
+  if (refreshOAuthAppTokensRoute.match(req.method, pathSegments)) {
+    const parsed = await refreshOAuthAppTokensRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const deleted = deleteScheduledTask(parsed.params.id);
-    if (!deleted) {
-      jsonError(res, "Schedule not found", 404);
+    if (!ensureConnectionAdmin(req, res, agentId))
+      return true;
+    const provider = parsed.params.provider;
+    if (!getOAuthApp(provider)) {
+      jsonError(res, `OAuth app ${provider} is not configured.`, 404);
       return true;
     }
-    json(res, { success: true });
+    const tokens = getOAuthTokens(provider);
+    if (!tokens) {
+      jsonError(res, "Nothing to refresh — authorize first.", 400);
+      return true;
+    }
+    if (!tokens.refreshToken) {
+      jsonError(res, `OAuth app ${provider} does not support refresh (no refresh token stored).`, 400);
+      return true;
+    }
+    try {
+      await forceRefreshTokenOrThrow(provider);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      jsonError(res, scrubSecrets(`Token refresh failed: ${message}`), 502);
+      return true;
+    }
+    json(res, {
+      refreshed: true,
+      tokenStatus: getOAuthBindingTokenStatus(provider),
+      expiresAt: getOAuthTokens(provider)?.expiresAt ?? null
+    });
     return true;
   }
   return false;
@@ -12579,7 +13576,7 @@ function lintWorkflowLabels(source) {
 init_types();
 var DEFAULT_SCRIPT_RUN_CONCURRENCY_CAP = 10;
 var runIdParamsSchema = exports_external.object({ runId: exports_external.string().uuid() });
-var idParamsSchema = exports_external.object({ id: exports_external.string().uuid() });
+var idParamsSchema2 = exports_external.object({ id: exports_external.string().uuid() });
 var stepParamsSchema = exports_external.object({
   runId: exports_external.string().uuid(),
   stepKey: exports_external.string().min(1)
@@ -12663,7 +13660,7 @@ var getScriptRunRoute = route({
   operationId: "script_runs_get",
   summary: "Get a script workflow run with journal",
   tags: ["Script Runs"],
-  params: idParamsSchema,
+  params: idParamsSchema2,
   responses: {
     200: { description: "Script run detail" },
     404: { description: "Script run not found" }
@@ -12676,7 +13673,7 @@ var deleteScriptRunRoute = route({
   operationId: "script_runs_cancel",
   summary: "Cancel a script workflow run",
   tags: ["Script Runs"],
-  params: idParamsSchema,
+  params: idParamsSchema2,
   responses: {
     204: { description: "Script run cancelled, or already terminal" },
     404: { description: "Script run not found" }
@@ -13089,7 +14086,7 @@ var searchBodySchema = exports_external.object({
 var nameParamsSchema = exports_external.object({ name: scriptNameSchema });
 var scopeQuerySchema = exports_external.object({ scope: ScriptScopeSchema.default("agent") });
 var optionalScopeQuerySchema = exports_external.object({ scope: ScriptScopeSchema.optional() });
-var idParamsSchema2 = exports_external.object({ id: exports_external.string().uuid() });
+var idParamsSchema3 = exports_external.object({ id: exports_external.string().uuid() });
 var listScriptsQuerySchema = exports_external.object({
   scope: ScriptScopeSchema.optional(),
   includeScratch: exports_external.enum(["true", "false"]).optional()
@@ -13138,7 +14135,8 @@ var searchRoute = route({
   responses: {
     200: { description: "Matching scripts" },
     400: { description: "Validation error" }
-  }
+  },
+  rbac: { permission: "script.search" }
 });
 var deleteRoute = route({
   method: "delete",
@@ -13204,7 +14202,7 @@ var getScriptByIdRoute = route({
   summary: "Get a saved script by id",
   description: "Dashboard read: full record including source and parsed signature.",
   tags: ["Scripts"],
-  params: idParamsSchema2,
+  params: idParamsSchema3,
   responses: {
     200: { description: "Script detail" },
     404: { description: "Script not found" }
@@ -13218,7 +14216,7 @@ var listVersionsRoute = route({
   summary: "List versions of a saved script",
   description: "Dashboard read: version history, newest first.",
   tags: ["Scripts"],
-  params: idParamsSchema2,
+  params: idParamsSchema3,
   responses: {
     200: { description: "Script versions" },
     404: { description: "Script not found" }
@@ -13245,13 +14243,14 @@ var createScriptApiRoute = route({
   summary: "Expose a script as an external HTTP API endpoint",
   description: "Returns the endpoint plus the plaintext bearer token (when authMode is 'bearer').",
   tags: ["Scripts"],
-  params: idParamsSchema2,
+  params: idParamsSchema3,
   body: createScriptApiBodySchema,
   responses: {
     201: { description: "Endpoint created" },
     400: { description: "Validation error or script has no owning agent" },
     404: { description: "Script not found" }
-  }
+  },
+  rbac: { permission: "script.api.create" }
 });
 var listScriptApisRoute = route({
   method: "get",
@@ -13260,7 +14259,7 @@ var listScriptApisRoute = route({
   operationId: "scripts_api_list",
   summary: "List external API endpoints for a script",
   tags: ["Scripts"],
-  params: idParamsSchema2,
+  params: idParamsSchema3,
   responses: {
     200: { description: "Endpoints (without secrets)" },
     404: { description: "Script not found" }
@@ -13277,7 +14276,8 @@ var revealScriptApiSecretRoute = route({
   responses: {
     200: { description: "Decrypted token (null when authMode is 'none')" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.read.secrets" }
 });
 var patchScriptApiRoute = route({
   method: "patch",
@@ -13291,7 +14291,8 @@ var patchScriptApiRoute = route({
   responses: {
     200: { description: "Updated endpoint" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.update" }
 });
 var rotateScriptApiRoute = route({
   method: "post",
@@ -13305,7 +14306,8 @@ var rotateScriptApiRoute = route({
     200: { description: "Endpoint with new plaintext token" },
     400: { description: "Endpoint uses 'none' auth — nothing to rotate" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.rotate" }
 });
 var deleteScriptApiRoute = route({
   method: "delete",
@@ -13318,7 +14320,8 @@ var deleteScriptApiRoute = route({
   responses: {
     200: { description: "Deleted" },
     404: { description: "Endpoint not found" }
-  }
+  },
+  rbac: { permission: "script.api.delete" }
 });
 function requireAgent2(res, agentId) {
   if (!agentId) {
@@ -13454,8 +14457,9 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       args: parsed.body.args,
       fsMode,
       agentId: agent.id,
-      egressSecrets: buildScriptCredentialBindings({ agentId: agent.id }),
-      apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id })
+      egressSecrets: await buildScriptCredentialBindings({ agentId: agent.id }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agent.id })
     });
     let kvSaved;
     if (parsed.body.idempotencyKey && !output.error && output.exitCode === 0) {
@@ -13578,9 +14582,11 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     return true;
   }
   if (typeDefsRoute.match(req.method, pathSegments)) {
+    const apiTypes = getScriptApiTypes();
+    const mcpTypes = getScriptMcpTypes();
     json(res, {
-      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes()),
-      stdlibTypes: SCRIPT_STDLIB_TYPES
+      sdkTypes: scriptSdkTypesWithGeneratedApis(apiTypes, mcpTypes),
+      stdlibTypes: scriptStdlibTypesWithGeneratedApis(apiTypes, mcpTypes)
     });
     return true;
   }
@@ -13627,8 +14633,8 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     json(res, {
       signature: JSON.parse(script.signatureJson),
       argsJsonSchema: script.argsJsonSchema ? JSON.parse(script.argsJsonSchema) : null,
-      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes({ agentId: agent.id })),
-      stdlibTypes: SCRIPT_STDLIB_TYPES
+      sdkTypes: scriptSdkTypesWithGeneratedApis(getScriptApiTypes({ agentId: agent.id }), getScriptMcpTypes({ agentId: agent.id })),
+      stdlibTypes: scriptStdlibTypesWithGeneratedApis(getScriptApiTypes({ agentId: agent.id }), getScriptMcpTypes({ agentId: agent.id }))
     });
     return true;
   }
@@ -14202,6 +15208,7 @@ var bulkUpsertSkillFilesRoute = route({
   summary: "Bulk upsert bundled files for a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.object({
     files: exports_external.array(skillFileWithPathSchema).max(100)
@@ -14234,6 +15241,7 @@ var upsertSkillFileRoute = route({
   summary: "Upsert a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string(), path: exports_external.string() }),
   body: skillFileBodySchema,
   responses: {
@@ -14250,6 +15258,7 @@ var deleteSkillFileRoute = route({
   summary: "Delete a bundled skill file",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string(), path: exports_external.string() }),
   responses: {
     200: { description: "Skill file deleted" },
@@ -14263,6 +15272,7 @@ var createSkillRoute = route({
   summary: "Create a new skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.create.swarm" },
   body: exports_external.object({
     content: exports_external.string().min(1),
     type: exports_external.string().optional(),
@@ -14282,6 +15292,7 @@ var updateSkillRoute = route({
   summary: "Update a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.record(exports_external.string(), exports_external.unknown()),
   responses: {
@@ -14297,6 +15308,7 @@ var deleteSkillRoute = route({
   summary: "Delete a skill",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.delete.any" },
   params: exports_external.object({ id: exports_external.string() }),
   responses: {
     200: { description: "Skill deleted" },
@@ -14311,6 +15323,7 @@ var installSkillRoute = route({
   summary: "Install skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.any" },
   params: exports_external.object({ id: exports_external.string() }),
   body: exports_external.object({
     agentId: exports_external.string()
@@ -14327,6 +15340,7 @@ var uninstallSkillRoute = route({
   summary: "Uninstall skill for an agent",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.uninstall.any" },
   params: exports_external.object({ id: exports_external.string(), agentId: exports_external.string() }),
   responses: {
     200: { description: "Skill uninstalled" }
@@ -14339,6 +15353,7 @@ var installRemoteRoute = route({
   summary: "Install a remote skill from GitHub",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.install.global" },
   body: exports_external.object({
     sourceRepo: exports_external.string(),
     sourcePath: exports_external.string().optional(),
@@ -14357,6 +15372,7 @@ var syncRemoteRoute = route({
   summary: "Trigger remote skill sync",
   tags: ["Skills"],
   auth: { apiKey: true },
+  rbac: { permission: "skill.update.any" },
   body: exports_external.object({
     skillId: exports_external.string().optional(),
     force: exports_external.boolean().optional()
@@ -14372,6 +15388,7 @@ var syncFilesystemRoute = route({
   summary: "Sync installed skills to agent filesystem",
   tags: ["Skills"],
   auth: { apiKey: true, agentId: true },
+  rbac: { ungated: "self-scoped: syncs the caller's own agent FS" },
   responses: {
     200: { description: "Filesystem sync results" }
   }
@@ -15450,7 +16467,6 @@ async function handleTaskTemplates(req, res, pathSegments, queryParams) {
 init_zod();
 init_db();
 init_types();
-init_request_auth_context();
 var listTasks = route({
   method: "get",
   path: "/api/tasks",
@@ -15465,7 +16481,9 @@ var listTasks = route({
     search: exports_external.string().optional(),
     includeHeartbeat: exports_external.enum(["true", "false"]).optional(),
     createdAfter: exports_external.string().datetime().optional(),
+    createdBefore: exports_external.string().datetime().optional(),
     source: exports_external.string().optional(),
+    orderBy: exports_external.enum(["lastUpdatedAt", "createdAt"]).optional(),
     limit: exports_external.coerce.number().int().optional(),
     offset: exports_external.coerce.number().int().optional(),
     fields: exports_external.enum(["full", "slim"]).optional()
@@ -15714,7 +16732,9 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       search: parsed.query.search || undefined,
       includeHeartbeat: parsed.query.includeHeartbeat === "true" || undefined,
       createdAfter: parsed.query.createdAfter || undefined,
+      createdBefore: parsed.query.createdBefore || undefined,
       source,
+      orderBy: parsed.query.orderBy,
       limit: parsed.query.limit,
       offset: parsed.query.offset
     };
@@ -15727,11 +16747,12 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await createTask.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const auth = getRequestAuth(req);
-    let requestedByUserId = auth?.kind === "user" ? auth.userId : parsed.body.requestedByUserId || undefined;
-    if (requestedByUserId && !getUserById(requestedByUserId)) {
-      console.warn(`[tasks] requestedByUserId ${requestedByUserId} does not exist — coercing to NULL`);
-      requestedByUserId = undefined;
+    let requestedByUserId = resolveHttpAuditUserId(req, myAgentId) ?? undefined;
+    const trustBodyRequestedByUserId = process.env.TRUST_BODY_REQUESTED_BY_USER_ID === "true";
+    if (trustBodyRequestedByUserId && !requestedByUserId && parsed.body.requestedByUserId) {
+      const candidate = findUserById(parsed.body.requestedByUserId);
+      if (candidate)
+        requestedByUserId = candidate.id;
     }
     let defaultAgentId = parsed.body.agentId || undefined;
     if (!defaultAgentId) {
@@ -17655,11 +18676,13 @@ function extractText(message) {
 function buildTaskDescription(payload) {
   const message = payload.message ?? {};
   const conversation = payload.conversation ?? {};
+  const externalId = normalizeKapsoSender(payload);
+  const contactDisplay = externalId ? renderIdentity(resolveKapsoIdentity(externalId)) : "(unknown user)";
   return resolveTemplate("kapso.message.received", {
     conversation_id: conversation.id ?? "unknown",
     inbound_wamid: message.id ?? "unknown",
     sender_phone: message.from ?? conversation.phone_number ?? "unknown",
-    contact_name: conversation.contact_name ?? "unknown",
+    contact_name: contactDisplay,
     phone_number_id: payload.phone_number_id ?? "unknown",
     test_note: payload.test ? `
 - test: true (do NOT send a real WhatsApp reply)` : "",
@@ -17671,13 +18694,22 @@ function normalizeKapsoSender(payload) {
   const digits = raw.replace(/\D/g, "");
   return digits || null;
 }
+function resolveKapsoIdentity(externalId) {
+  const kapsoResolution = resolveIdentity(KAPSO_IDENTITY_KIND, externalId);
+  if (kapsoResolution.status === "resolved")
+    return kapsoResolution;
+  const whatsappResolution = resolveIdentity(WHATSAPP_IDENTITY_KIND, externalId);
+  if (whatsappResolution.status === "resolved")
+    return whatsappResolution;
+  return kapsoResolution;
+}
 function resolveKapsoRequestedByUserId(payload) {
   const externalId = normalizeKapsoSender(payload);
   if (!externalId)
     return;
-  const mapped = findUserByExternalId(KAPSO_IDENTITY_KIND, externalId) ?? findUserByExternalId(WHATSAPP_IDENTITY_KIND, externalId);
-  if (mapped)
-    return mapped.id;
+  const resolution = resolveKapsoIdentity(externalId);
+  if (resolution.status === "resolved")
+    return resolution.userId;
   recordUnmappedIdentity(KAPSO_IDENTITY_KIND, externalId, {
     sampleEventType: "kapso.message.received",
     sampleContext: [
@@ -19030,8 +20062,9 @@ async function handleX(req, res, pathSegments) {
     fsMode: "none",
     agentId: endpoint.agentId,
     timeoutMs,
-    egressSecrets: buildScriptCredentialBindings({ agentId: endpoint.agentId }),
-    apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId })
+    egressSecrets: await buildScriptCredentialBindings({ agentId: endpoint.agentId }),
+    apiConnections: getScriptApiConnectionDescriptors({ agentId: endpoint.agentId }),
+    mcpConnections: getScriptMcpConnectionDescriptors({ agentId: endpoint.agentId })
   });
   const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
   const error = ok ? null : buildExecutionError(output);
@@ -19213,6 +20246,8 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleMetrics(req, res, pathSegments, queryParams, myAgentId),
         () => handleRepos(req, res, pathSegments, queryParams),
         () => handleSkills(req, res, pathSegments, queryParams, myAgentId),
+        () => handleScriptConnections(req, res, pathSegments, queryParams, myAgentId),
+        () => handleScriptConnectionProxy(req, res, pathSegments, queryParams, myAgentId),
         () => handleScriptRuns(req, res, pathSegments, queryParams, myAgentId),
         () => handleScripts(req, res, pathSegments, queryParams, myAgentId),
         () => handleX(req, res, pathSegments),
@@ -19221,6 +20256,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handleMcpOAuth(req, res, pathSegments, queryParams),
         () => handleMemory(req, res, pathSegments, myAgentId),
         () => handleOAuthLocks(req, res, pathSegments, queryParams),
+        () => handleGenericOAuth(req, res, pathSegments, queryParams),
         () => handleCodexOAuthKeepWarm(req, res, pathSegments),
         () => handlePagesPublic(req, res, pathSegments, queryParams),
         () => handlePageProxy(req, res),
@@ -19280,14 +20316,14 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-0gzmqj4k.js");
+    const { stopScheduler } = await import("./index-9ht8gr56.js");
     stopScheduler();
   }
   stopHeartbeat();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-62gfj91d.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-3cps6e3e.js");
     await stopOAuthKeepalive();
   }
   stopMcpOAuthPendingGc();
@@ -19344,15 +20380,23 @@ try {
   throw err;
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-1r1y1xkq.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-h2kdq4cq.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-cgtkffpa.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-0hvazmkf.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { runAllSeeders } = await import("./index-vfedgdw6.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-kfesjy9y.js");
+  ensureRbacSeedsSynced();
+} catch (err) {
+  console.error("[startup] Failed to sync RBAC seed rows:", err);
+  if (isRbacEnabled())
+    throw err;
+}
+try {
+  const { runAllSeeders } = await import("./index-rm85cfdx.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -19388,31 +20432,35 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-0gzmqj4k.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-5ghxn8s6.js");
+    const { startScheduler } = await import("./index-9ht8gr56.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-9fqaktjr.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (process.env.HEARTBEAT_DISABLE !== "true") {
-    const { startHeartbeat } = await import("./index-nhat35em.js");
+    const { startHeartbeat } = await import("./index-47em3d2n.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-62gfj91d.js");
+    const { startOAuthKeepalive } = await import("./keepalive-3cps6e3e.js");
     startOAuthKeepalive();
   }
+  if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-sycqtbph.js");
+    startOAuthRefreshSweep();
+  }
   startMcpOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-p0ny05t8.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-qata34xa.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-69agkhv6.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-4jpxhb25.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-yybrkmvr.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-tv48nn3z.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {