@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/dist/cli-jkhwmmgg.js

@@ -0,0 +1,136 @@
+// src/mcp-client/http-client.ts
+function jsonRpcErrorMessage(error) {
+  if (typeof error === "string")
+    return error;
+  return error.message ?? JSON.stringify(error);
+}
+
+class McpHttpClient {
+  baseUrl;
+  apiKey;
+  agentId;
+  taskId;
+  options;
+  sessionId = null;
+  nextId = 1;
+  customHeaders = {};
+  useRawUrl = false;
+  constructor(baseUrl, apiKey, agentId, taskId, options = {}) {
+    this.baseUrl = baseUrl;
+    this.apiKey = apiKey;
+    this.agentId = agentId;
+    this.taskId = taskId;
+    this.options = options;
+  }
+  async send(body) {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream"
+    };
+    if (this.apiKey || !this.options.omitEmptyAuthHeaders) {
+      headers.Authorization = `Bearer ${this.apiKey}`;
+    }
+    if (this.agentId || !this.options.omitEmptyAuthHeaders) {
+      headers["X-Agent-ID"] = this.agentId;
+    }
+    Object.assign(headers, this.customHeaders);
+    if (this.taskId) {
+      headers["X-Source-Task-Id"] = this.taskId;
+    }
+    if (this.sessionId) {
+      headers["mcp-session-id"] = this.sessionId;
+    }
+    const controller = this.options.timeoutMs ? new AbortController : null;
+    const timeout = controller ? setTimeout(() => controller.abort(), this.options.timeoutMs) : null;
+    const url = this.useRawUrl ? this.baseUrl : `${this.baseUrl}/mcp`;
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: controller?.signal
+      });
+      if (!res.ok) {
+        throw new Error(`MCP request failed: ${res.status} ${res.statusText}`);
+      }
+      const sid = res.headers.get("mcp-session-id");
+      if (sid)
+        this.sessionId = sid;
+      const contentType = res.headers.get("content-type") || "";
+      if (contentType.includes("text/event-stream")) {
+        const text2 = await res.text();
+        const dataLines = text2.split(`
+`).filter((line) => line.startsWith("data: ")).map((line) => line.slice(6));
+        const lastData = dataLines[dataLines.length - 1];
+        return { data: lastData ? JSON.parse(lastData) : null, headers: res.headers };
+      }
+      const text = await res.text();
+      const data = text.trim() ? JSON.parse(text) : null;
+      return { data, headers: res.headers };
+    } catch (err) {
+      if (err instanceof DOMException && err.name === "AbortError") {
+        throw new Error(`MCP request timed out after ${this.options.timeoutMs}ms`);
+      }
+      throw err;
+    } finally {
+      if (timeout)
+        clearTimeout(timeout);
+    }
+  }
+  async initialize() {
+    const { data } = await this.send({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method: "initialize",
+      params: {
+        protocolVersion: this.options.protocolVersion ?? "2025-03-26",
+        capabilities: {},
+        clientInfo: this.options.clientInfo ?? {
+          name: "agent-swarm-pi-mono",
+          version: "1.0.0"
+        }
+      }
+    });
+    if (!data || typeof data !== "object" || !("result" in data)) {
+      throw new Error(`MCP initialize failed: ${JSON.stringify(data)}`);
+    }
+    await this.send({
+      jsonrpc: "2.0",
+      method: "notifications/initialized"
+    });
+  }
+  async listTools() {
+    const { data } = await this.send({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method: "tools/list",
+      params: {}
+    });
+    const result = data;
+    if (result?.error) {
+      throw new Error(`MCP tools/list failed: ${jsonRpcErrorMessage(result.error)}`);
+    }
+    return result?.result?.tools ?? [];
+  }
+  async callToolRaw(name, args) {
+    const { data } = await this.send({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method: "tools/call",
+      params: { name, arguments: args }
+    });
+    const response = data;
+    if (response?.error)
+      return { ok: false, error: response.error };
+    return {
+      ok: true,
+      result: response?.result ?? { content: [{ type: "text", text: "No result" }] }
+    };
+  }
+  async callTool(name, args) {
+    const envelope = await this.callToolRaw(name, args);
+    return envelope.ok ? envelope.result : { content: [{ type: "text", text: "No result" }] };
+  }
+}
+
+export { McpHttpClient };

package/dist/{cli-y4ycrnjc.js → cli-k3y4z3h5.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 
 // src/tasks/context-key.ts
 var SEPARATOR = ":";

package/dist/{cli-6xd0bvf8.js → cli-ma04faw5.js}

@@ -294,4 +294,4 @@ function buildTreeBlocks(roots) {
   return blocks;
 }
 
-export { getTaskLink, markdownToSlack, formatAttachmentsBlockForSlack, formatDuration, buildCompletedBlocks, buildCompletedBlockBatches, buildFailedBlocks, buildProgressBlocks, buildCancelledBlocks, buildBufferFlushBlocks, buildTreeBlocks };
+export { getTaskLink, markdownToSlack, splitSlackSectionText, formatAttachmentsBlockForSlack, formatDuration, buildCompletedBlocks, buildCompletedBlockBatches, buildFailedBlocks, buildProgressBlocks, buildCancelledBlocks, buildBufferFlushBlocks, buildTreeBlocks };

package/dist/{cli-2fc97xm5.js → cli-mnbgv3w7.js}

@@ -1,3 +1,6 @@
+import {
+  fetchInstalledMcpServers
+} from "./cli-tng3131n.js";
 import {
   SessionErrorTracker,
   buildOtelTraceparentEnv,
@@ -5,9 +8,6 @@ import {
   parseStderrForErrors,
   trackErrorFromJson
 } from "./cli-psrqtw2m.js";
-import {
-  fetchInstalledMcpServers
-} from "./cli-tng3131n.js";
 import {
   CTX_MODE_NUDGE_EVERY
 } from "./cli-zm7njwzd.js";
@@ -19,7 +19,7 @@ import {
 } from "./cli-tghre7g6.js";
 import {
   applyReasoningEffort
-} from "./cli-tkmm5nf9.js";
+} from "./cli-e61fs2hp.js";
 import {
   init_credentials,
   validateClaudeCredentials

package/dist/{cli-trmapn9k.js → cli-pet3aev6.js}

@@ -14,8 +14,10 @@ import {
   buildTreeBlocks,
   formatAttachmentsBlockForSlack,
   formatDuration,
-  markdownToSlack
-} from "./cli-6xd0bvf8.js";
+  getTaskLink,
+  markdownToSlack,
+  splitSlackSectionText
+} from "./cli-ma04faw5.js";
 import {
   getAgentById,
   getChildTasks,
@@ -25,7 +27,7 @@ import {
   getTaskById,
   init_db,
   setSlackMessageTracking
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 import {
   require_receiver,
   require_sender,
@@ -54212,9 +54214,89 @@ function classifySlackUpdateError(error) {
   return "failed";
 }
 var isDev = process.env.ENV === "development";
+var MIN_INLINE_OUTPUT_LENGTH = 20;
+var MAX_INLINE_OUTPUT_MESSAGE_LENGTH = 4000;
+var INLINE_OUTPUT_FALLBACKS = new Set([
+  "done",
+  "completed",
+  "complete",
+  "task completed",
+  "process completed successfully",
+  "process completed successfully (no output captured)"
+]);
 function getAgentDisplayName(agent) {
   return isDev ? `(dev) ${agent.name}` : agent.name;
 }
+function shouldPostInlineCompletionOutput(task, attachments) {
+  if (task.status !== "completed")
+    return false;
+  if (!task.slackChannelId || !task.slackThreadTs)
+    return false;
+  if (task.slackReplySent)
+    return false;
+  const output = task.output?.trim();
+  if (!output || output.length < MIN_INLINE_OUTPUT_LENGTH)
+    return false;
+  if (INLINE_OUTPUT_FALLBACKS.has(output.toLowerCase()))
+    return false;
+  return !attachments.some((attachment) => attachment.isPrimary);
+}
+function formatInlineCompletionOutputText(opts) {
+  const header = `✅ *${opts.agentName}* completed with output (${getTaskLink(opts.taskId)}):
+
+`;
+  const tail = `
+
+…(full output in task ${getTaskLink(opts.taskId)})`;
+  const slackOutput = markdownToSlack(opts.output.trim());
+  const maxBodyLength = MAX_INLINE_OUTPUT_MESSAGE_LENGTH - header.length;
+  if (slackOutput.length <= maxBodyLength) {
+    return header + slackOutput;
+  }
+  const maxTruncatedBodyLength = Math.max(0, maxBodyLength - tail.length);
+  let cut = slackOutput.lastIndexOf(`
+`, maxTruncatedBodyLength);
+  if (cut < maxTruncatedBodyLength / 2) {
+    cut = slackOutput.lastIndexOf(" ", maxTruncatedBodyLength);
+  }
+  if (cut < maxTruncatedBodyLength / 2) {
+    cut = maxTruncatedBodyLength;
+  }
+  return header + slackOutput.slice(0, cut).trimEnd() + tail;
+}
+async function sendInlineTaskOutput(task) {
+  const app = getSlackApp();
+  if (!app || !task.slackChannelId || !task.slackThreadTs || !task.agentId || !task.output) {
+    return false;
+  }
+  const agent = getAgentById(task.agentId);
+  if (!agent) {
+    console.error(`[Slack] Agent not found for task ${task.id}`);
+    return false;
+  }
+  const text = formatInlineCompletionOutputText({
+    agentName: agent.name,
+    taskId: task.id,
+    output: task.output
+  });
+  try {
+    await sendWithPersona(app.client, {
+      channel: task.slackChannelId,
+      thread_ts: task.slackThreadTs,
+      text,
+      username: getAgentDisplayName(agent),
+      icon_emoji: getAgentEmoji(agent),
+      blocks: splitSlackSectionText(text).map((chunk) => ({
+        type: "section",
+        text: { type: "mrkdwn", text: chunk }
+      }))
+    });
+    return true;
+  } catch (error) {
+    console.error(`[Slack] Failed to send inline output for task ${task.id}:`, error);
+    return false;
+  }
+}
 async function sendTaskResponse(task) {
   const app = getSlackApp();
   if (!app || !task.slackChannelId || !task.slackThreadTs) {
@@ -54904,7 +54986,8 @@ function startTaskWatcher(intervalMs = 3000) {
         if (lastSent && now2 - lastSent < MIN_SEND_INTERVAL)
           continue;
         if (taskToTree.has(task.id)) {
-          if (task.status !== "completed" || task.slackReplySent) {
+          const attachments = task.status === "completed" ? getTaskAttachments(task.id) : [];
+          if (!shouldPostInlineCompletionOutput(task, attachments)) {
             notifiedCompletions.set(task.id, now2);
             continue;
           }
@@ -54912,8 +54995,10 @@ function startTaskWatcher(intervalMs = 3000) {
           notifiedCompletions.set(task.id, now2);
           lastSendTime.set(completionKey, now2);
           try {
-            await sendTaskResponse(task);
-            console.log(`[Slack] Sent full tree-tracked completion for task ${task.id.slice(0, 8)}`);
+            const sent = await sendInlineTaskOutput(task);
+            if (!sent)
+              throw new Error("sendInlineTaskOutput returned false");
+            console.log(`[Slack] Sent inline output for tree-tracked completion ${task.id.slice(0, 8)}`);
           } catch (error) {
             notifiedCompletions.delete(task.id);
             lastSendTime.delete(completionKey);
@@ -54988,13 +55073,13 @@ async function initSlackApp() {
     socketMode: true,
     logLevel: import_bolt.LogLevel.DEBUG
   });
-  const { registerMessageHandler } = await import("./handlers-6b44317z.js");
-  const { registerCommandHandler } = await import("./commands-z5dbwta3.js");
-  const { registerActionHandlers } = await import("./actions-q4n7cz6e.js");
+  const { registerMessageHandler } = await import("./handlers-9er4zx9q.js");
+  const { registerCommandHandler } = await import("./commands-hch4e2k1.js");
+  const { registerActionHandlers } = await import("./actions-17ya5wde.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
-  const { createAssistant } = await import("./assistant-0x8ey0vs.js");
+  const { createAssistant } = await import("./assistant-ah7csnjz.js");
   app.assistant(createAssistant());
   return app;
 }

package/dist/{cli-z46pnksz.js → cli-q1rx7g0d.js}

@@ -6,14 +6,23 @@ import {
   DEFAULT_CREDENTIAL_BINDINGS,
   SwarmConfigCredentialBindingStore,
   getScript,
+  getScriptApiConnectionDescriptors,
+  getScriptMcpConnectionDescriptors,
   getScriptVersion,
   listRelationalCredentialBindings,
   validateScriptImports
-} from "./cli-qwgtacd6.js";
+} from "./cli-r9f6ngrf.js";
+import {
+  ensureTokenOrThrow,
+  getOAuthApp,
+  getOAuthTokens,
+  isTokenExpiringSoon,
+  oauthAppRowToProviderConfig
+} from "./cli-t0vqevnm.js";
 import {
   withSiblingAwareness,
   workflowContextKey
-} from "./cli-y4ycrnjc.js";
+} from "./cli-k3y4z3h5.js";
 import {
   getAppUrl
 } from "./cli-dh55d5fg.js";
@@ -62,13 +71,13 @@ import {
   telemetry,
   updateWorkflowRun,
   updateWorkflowRunStep
-} from "./cli-ncfgsqbd.js";
+} from "./cli-15y7qhzp.js";
 import {
   init_zod
-} from "./cli-q21d49ac.js";
+} from "./cli-bw80ck94.js";
 import {
   exports_external
-} from "./cli-anrj584m.js";
+} from "./cli-xz9aq0rf.js";
 import {
   init_secret_scrubber,
   isSensitiveKey,
@@ -2083,6 +2092,51 @@ function resolveHmacSecret(raw) {
   }
   return raw;
 }
+function verifyWebhookRequest(trigger, rawBody, headers) {
+  if (!trigger.hmacSecret) {
+    if (trigger.verification) {
+      throw new WebhookError("Webhook trigger has `verification` configured but no `hmacSecret`; refusing to accept unverified requests", 500);
+    }
+    return;
+  }
+  const secret = resolveHmacSecret(trigger.hmacSecret);
+  const verification = trigger.verification;
+  if (!verification) {
+    const hmacHeader = trigger.hmacHeader || DEFAULT_HMAC_HEADER;
+    const signature2 = resolveSignature(headers, hmacHeader);
+    if (!signature2) {
+      throw new WebhookError("Missing signature", 401);
+    }
+    if (!verifyHmacSignature(secret, rawBody, signature2)) {
+      throw new WebhookError("Invalid signature", 401);
+    }
+    return;
+  }
+  const header = verification.header || DEFAULT_HMAC_HEADER;
+  const signature = getHeader(headers, header);
+  if (!signature) {
+    throw new WebhookError("Missing signature", 401);
+  }
+  let isValid = false;
+  switch (verification.format) {
+    case "hmac-sha256":
+      isValid = verifyHmacSignature(secret, rawBody, signature);
+      break;
+    case "timestamped-hmac-sha256":
+      isValid = verifyTimestampedHmacSignature(secret, rawBody, signature, {
+        timestampKey: verification.timestampKey,
+        signatureKey: verification.signatureKey,
+        toleranceSeconds: verification.toleranceSeconds
+      });
+      break;
+    case "token-equality":
+      isValid = verifyTokenEquality(secret, signature);
+      break;
+  }
+  if (!isValid) {
+    throw new WebhookError("Invalid signature", 401);
+  }
+}
 async function handleWebhookTrigger(workflowId, payload, headers, registry) {
   const workflow = getWorkflow(workflowId);
   if (!workflow) {
@@ -2092,17 +2146,8 @@ async function handleWebhookTrigger(workflowId, payload, headers, registry) {
     throw new WebhookError("Workflow is disabled", 400);
   }
   const webhookTrigger = workflow.triggers.find((t) => t.type === "webhook");
-  if (webhookTrigger && webhookTrigger.type === "webhook" && webhookTrigger.hmacSecret) {
-    const hmacHeader = webhookTrigger.hmacHeader || DEFAULT_HMAC_HEADER;
-    const signature = resolveSignature(headers, hmacHeader);
-    if (!signature) {
-      throw new WebhookError("Missing signature", 401);
-    }
-    const secret = resolveHmacSecret(webhookTrigger.hmacSecret);
-    const isValid = verifyHmacSignature(secret, typeof payload === "string" ? payload : JSON.stringify(payload), signature);
-    if (!isValid) {
-      throw new WebhookError("Invalid signature", 401);
-    }
+  if (webhookTrigger && webhookTrigger.type === "webhook" && (webhookTrigger.hmacSecret || webhookTrigger.verification)) {
+    verifyWebhookRequest(webhookTrigger, typeof payload === "string" ? payload : JSON.stringify(payload), headers);
   }
   const triggerData = parseTriggerPayload(payload);
   const runId = await startWorkflowExecution(workflow, triggerData, registry, {
@@ -2149,6 +2194,57 @@ function verifyHmacSignature(secret, body, providedSignature) {
     return false;
   }
 }
+function verifyTimestampedHmacSignature(secret, body, headerValue, opts = {}, nowMs = Date.now()) {
+  const timestampKey = opts.timestampKey ?? "t";
+  const signatureKey = opts.signatureKey ?? "v1";
+  const toleranceSeconds = opts.toleranceSeconds ?? 300;
+  const parsed = parseSignatureHeader(headerValue);
+  const timestampValue = parsed.get(timestampKey)?.[0];
+  const signatures = parsed.get(signatureKey) ?? [];
+  if (!timestampValue || signatures.length === 0 || !/^\d+$/.test(timestampValue)) {
+    return false;
+  }
+  const timestampSeconds = Number(timestampValue);
+  if (!Number.isSafeInteger(timestampSeconds)) {
+    return false;
+  }
+  const ageSeconds = Math.abs(nowMs / 1000 - timestampSeconds);
+  if (ageSeconds > toleranceSeconds) {
+    return false;
+  }
+  const hmac = crypto2.createHmac("sha256", secret);
+  hmac.update(`${timestampValue}.${body}`);
+  const expectedHex = hmac.digest("hex");
+  const expected = Buffer.from(expectedHex, "hex");
+  return signatures.some((signature) => timingSafeEqualHex(signature, expected));
+}
+function verifyTokenEquality(secret, providedToken) {
+  const secretDigest = crypto2.createHash("sha256").update(secret).digest();
+  const providedDigest = crypto2.createHash("sha256").update(providedToken).digest();
+  return crypto2.timingSafeEqual(providedDigest, secretDigest);
+}
+function parseSignatureHeader(headerValue) {
+  const parsed = new Map;
+  for (const part of headerValue.split(",")) {
+    const trimmed = part.trim();
+    const separatorIndex = trimmed.indexOf("=");
+    if (separatorIndex <= 0)
+      continue;
+    const key = trimmed.slice(0, separatorIndex).trim();
+    const value = trimmed.slice(separatorIndex + 1).trim();
+    const values = parsed.get(key) ?? [];
+    values.push(value);
+    parsed.set(key, values);
+  }
+  return parsed;
+}
+function timingSafeEqualHex(providedHex, expected) {
+  try {
+    return crypto2.timingSafeEqual(Buffer.from(providedHex, "hex"), expected);
+  } catch {
+    return false;
+  }
+}
 
 class WebhookError extends Error {
   statusCode;
@@ -2487,7 +2583,8 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       workflowRunId: meta.runId,
       workflowRunStepId: meta.stepId,
       timeoutSeconds: config.timeout?.seconds,
-      notificationChannels: config.notifications
+      notificationChannels: config.notifications,
+      createdBy: meta.requestedByUserId
     });
     if (config.notifications?.length) {
       this.dispatchNotifications(requestId, config, db).catch((err) => {
@@ -2515,7 +2612,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp } = await import("./app-es4nzc71.js");
+          const { getSlackApp } = await import("./app-4f718yk0.js");
           const slackApp = getSlackApp();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -2629,7 +2726,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-es4nzc71.js");
+        const { getSlackApp } = await import("./app-4f718yk0.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -2752,14 +2849,14 @@ var RawLlmOutputSchema = exports_external.object({
 async function executeRawLlm(config) {
   const modelName = config.model ?? "google/gemini-3-flash-preview";
   try {
-    const { createOpenAI } = await import("./index-wz1ea15p.js");
+    const { createOpenAI } = await import("./index-2dgfj9av.js");
     const openrouter = createOpenAI({
       baseURL: "https://openrouter.ai/api/v1",
       apiKey: process.env.OPENROUTER_API_KEY
     });
     const model = openrouter(modelName);
     if (config.schema) {
-      const { generateObject, jsonSchema } = await import("./index-ykvs43z4.js");
+      const { generateObject, jsonSchema } = await import("./index-t2snazez.js");
       const { object } = await generateObject({
         model,
         schema: jsonSchema(config.schema),
@@ -2773,7 +2870,7 @@ async function executeRawLlm(config) {
         output: { result: object, model: modelName }
       };
     }
-    const { generateText } = await import("./index-ykvs43z4.js");
+    const { generateText } = await import("./index-t2snazez.js");
     const { text } = await generateText({
       model,
       prompt: config.prompt
@@ -2926,6 +3023,33 @@ init_zod();
 // src/be/script-credential-broker.ts
 init_secret_scrubber();
 init_db();
+
+// src/be/oauth-credential-bindings.ts
+var OAUTH_BINDING_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+function getOAuthProviderConfig(provider) {
+  const app = getOAuthApp(provider);
+  return app ? oauthAppRowToProviderConfig(app) : null;
+}
+function getOAuthBindingTokenStatus(provider) {
+  if (!getOAuthApp(provider))
+    return "missing";
+  if (!getOAuthTokens(provider))
+    return "missing";
+  return isTokenExpiringSoon(provider, OAUTH_BINDING_REFRESH_BUFFER_MS) ? "expiring" : "ok";
+}
+async function resolveOAuthBindingToken(provider) {
+  if (!getOAuthApp(provider))
+    return;
+  const initialTokens = getOAuthTokens(provider);
+  if (!initialTokens)
+    return;
+  if (isTokenExpiringSoon(provider, OAUTH_BINDING_REFRESH_BUFFER_MS)) {
+    await ensureTokenOrThrow(provider, OAUTH_BINDING_REFRESH_BUFFER_MS);
+  }
+  return getOAuthTokens(provider)?.accessToken;
+}
+
+// src/be/script-credential-broker.ts
 class RelationalCredentialBindingStore extends SwarmConfigCredentialBindingStore {
   listActiveBindings(context) {
     const relational = listRelationalCredentialBindings(context);
@@ -2934,9 +3058,29 @@ class RelationalCredentialBindingStore extends SwarmConfigCredentialBindingStore
     return super.listActiveBindings(context);
   }
 }
-function buildScriptCredentialBindings(input) {
+async function buildScriptCredentialBindings(input) {
   const resolvedConfigs = getResolvedConfig(input.agentId, input.repoId);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
+  const relationalBindings = listRelationalCredentialBindings(input);
+  for (const binding of relationalBindings) {
+    if (binding.authKind !== "oauth")
+      continue;
+    configMap.set(binding.configKey, "");
+    if (!binding.oauthProvider)
+      continue;
+    let accessToken;
+    try {
+      accessToken = await resolveOAuthBindingToken(binding.oauthProvider);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(`[script-credential-broker] skipping OAuth binding ${binding.configKey}: token refresh for provider ${binding.oauthProvider} failed: ${scrubSecrets(message)}`);
+      continue;
+    }
+    if (!accessToken)
+      continue;
+    configMap.set(binding.configKey, accessToken);
+    registerVolatileSecret(accessToken, binding.configKey);
+  }
   const broker = new CredentialBroker(new RelationalCredentialBindingStore((filters) => getSwarmConfigs(filters)), (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS);
   const bindings = broker.resolveBindings({ agentId: input.agentId, repoId: input.repoId });
   for (const binding of bindings) {
@@ -3211,7 +3355,8 @@ function buildConfigPayload(input) {
     },
     user: input.userConfig ?? {},
     egressSecrets: input.egressSecrets ?? buildEgressSecrets(),
-    apiConnections: input.apiConnections ?? []
+    apiConnections: input.apiConnections ?? [],
+    mcpConnections: input.mcpConnections ?? []
   };
 }
 async function runScript(input) {
@@ -3307,7 +3452,9 @@ class SwarmScriptExecutor extends BaseExecutor {
       args: config.args,
       fsMode: "none",
       agentId: agentId ?? "workflow",
-      egressSecrets: buildScriptCredentialBindings({ agentId: agentId ?? undefined }),
+      egressSecrets: await buildScriptCredentialBindings({ agentId: agentId ?? undefined }),
+      apiConnections: getScriptApiConnectionDescriptors({ agentId: agentId ?? undefined }),
+      mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agentId ?? undefined }),
       timeoutMs: config.timeoutMs
     });
     const workflowOutput = {
@@ -3462,8 +3609,8 @@ class ValidateExecutor extends BaseExecutor {
     const interpolatedPrompt = this.deps.interpolate(prompt, context);
     const outputStr = typeof targetOutput === "string" ? targetOutput : JSON.stringify(targetOutput);
     try {
-      const { createOpenAI } = await import("./index-wz1ea15p.js");
-      const { generateObject, jsonSchema } = await import("./index-ykvs43z4.js");
+      const { createOpenAI } = await import("./index-2dgfj9av.js");
+      const { generateObject, jsonSchema } = await import("./index-t2snazez.js");
       const openrouter = createOpenAI({
         baseURL: "https://openrouter.ai/api/v1",
         apiKey: process.env.OPENROUTER_API_KEY
@@ -3665,4 +3812,4 @@ function initWorkflows() {
   initWaitBusSubscriptions(_registry);
 }
 
-export { buildScriptCredentialBindings, runScript, generateEdges, findEntryNodes, getSuccessors, validateDefinition, applyDefinitionPatch, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, getExecutorRegistry, initWorkflows };
+export { getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindings, runScript, generateEdges, findEntryNodes, getSuccessors, validateDefinition, applyDefinitionPatch, validateJsonSchema, TriggerSchemaError, startWorkflowExecution, setupWorkflowResumeListener, retryFailedRun, cancelWorkflowRun, resumeWaitState, initWaitBusSubscriptions, subscribeWaitToBus, recoverIncompleteRuns, startRetryPoller, stopRetryPoller, validateTemplateVariables, instantiateTemplate, handleWebhookTrigger, handleScheduleTrigger, verifyHmacSignature, WebhookError, snapshotWorkflow, startWaitPoller, stopWaitPoller, RawLlmConfigSchema, executeRawLlm, getExecutorRegistry, initWorkflows };