@desplega.ai/agent-swarm 1.117.0 → 1.119.0

package/dist/{cli-r06ed00c.js → cli-h1gg78hv.js}

@@ -10,14 +10,14 @@ import {
 } from "./cli-ftyf58xj.js";
 import {
   startPricingRefreshLoop
-} from "./cli-fep22bhf.js";
+} from "./cli-mxennm5t.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-q0yn57de.js";
+} from "./cli-vfq38b3e.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-kfjs4fjw.js";
+} from "./cli-hyn69s0c.js";
 import {
   can,
   decideAdmission,
@@ -37,7 +37,7 @@ import {
   repointTrackerSyncBySwarmId,
   updateTrackerSync,
   updateTrackerSyncSwarmId
-} from "./cli-yarjrgd5.js";
+} from "./cli-9ed8efw3.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
@@ -47,7 +47,7 @@ import {
   ensure,
   require_dist,
   runScheduleNow
-} from "./cli-t6n84nqv.js";
+} from "./cli-chs2zh28.js";
 import {
   TriggerSchemaError,
   applyDefinitionPatch,
@@ -61,7 +61,7 @@ import {
   startWorkflowExecution,
   validateDefinition,
   validateJsonSchema
-} from "./cli-e0xv4nd4.js";
+} from "./cli-jy7w6z37.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -81,7 +81,7 @@ import {
   setScriptConnectionEnabled,
   upsertCredentialBinding,
   upsertScriptConnection
-} from "./cli-vwhg6sbn.js";
+} from "./cli-bx96sw2z.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   computeScore,
@@ -93,7 +93,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-rymspw51.js";
+} from "./cli-qcm02dkk.js";
 import {
   buildAuthorizationUrl,
   ensureToken,
@@ -101,17 +101,17 @@ import {
   getOAuthApp,
   getOAuthTokens,
   upsertOAuthApp
-} from "./cli-hmw1vk30.js";
+} from "./cli-dqxwy0td.js";
 import {
   createAdditiveBuffer,
   extractSlackMessageText,
   parseSlackTs
-} from "./cli-9kk0xa5w.js";
+} from "./cli-06xdf1gz.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-jkp1gndy.js";
+} from "./cli-15m4y05s.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -127,13 +127,13 @@ import {
   resolveIdentityByEmail,
   resolveUserByToken,
   unlinkIdentity
-} from "./cli-w5axeg22.js";
+} from "./cli-txxvn1zb.js";
 import {
   markdownToSlack
 } from "./cli-ma04faw5.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-5ekf4gcj.js";
+} from "./cli-qf35kzka.js";
 import {
   getAppUrl,
   getMcpBaseUrl,
@@ -147,6 +147,7 @@ import {
   AgentSchema,
   AgentTaskSchema,
   AgentTaskStatusSchema,
+  AssetKeySchema,
   AttachmentInputSchema,
   BudgetRefusalCauseSchema,
   ChannelMessageSchema,
@@ -188,6 +189,7 @@ import {
   agentContextKey,
   agentmailContextKey,
   buildJiraContextKey,
+  canWriteAssetKey,
   cancelTask,
   checkDependencies,
   checkSlackRoutingCoherence,
@@ -306,6 +308,7 @@ import {
   init_context_key,
   init_db,
   init_defaults,
+  init_key,
   init_registry,
   init_request_auth_context,
   init_resolver,
@@ -332,7 +335,9 @@ import {
   maskSecrets,
   moveTaskFromBacklog,
   moveTaskToBacklog,
+  normalizeAssetKey,
   onTaskStarted,
+  parseAssetKey,
   postMessage,
   reassociateSessionLogs,
   recordBudgetRefusalNotification,
@@ -372,7 +377,7 @@ import {
   upsertService,
   upsertSwarmConfig,
   validateConfigValue
-} from "./cli-s5q026mr.js";
+} from "./cli-j12px91x.js";
 import {
   init_zod
 } from "./cli-bw80ck94.js";
@@ -417,7 +422,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-xcp5dmts.js";
+} from "./cli-9kbww4vb.js";
 import {
   init_secret_scrubber,
   refreshSecretScrubberCache,
@@ -19705,7 +19710,7 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     return;
   initialized2 = true;
   try {
-    const impl = await import("./otel-impl-726bmdyc.js");
+    const impl = await import("./otel-impl-3e0t0kga.js");
     await impl.boot(serviceRole);
     realWithSpan = impl.withSpan;
     realStartSpan = impl.startSpan;
@@ -20782,6 +20787,74 @@ var registerCreateMetricTool = (server) => {
 
 // src/tools/create-page.ts
 init_zod();
+
+// src/be/asset-key-auth.ts
+init_key();
+class AssetKeyAuthorizationError extends Error {
+  statusCode;
+  constructor(message, statusCode) {
+    super(message);
+    this.name = "AssetKeyAuthorizationError";
+    this.statusCode = statusCode;
+  }
+}
+function authorizeAssetKeyWrite(input, trustedUserId) {
+  let key;
+  try {
+    key = normalizeAssetKey(input);
+  } catch (error) {
+    throw new AssetKeyAuthorizationError(error instanceof Error ? error.message : "Invalid asset namespace key", 400);
+  }
+  const parsed = parseAssetKey(key);
+  if (parsed.root === "shared")
+    return key;
+  if (!findUserById(parsed.userId)) {
+    throw new AssetKeyAuthorizationError("Personal namespace user does not exist", 400);
+  }
+  if (!canWriteAssetKey(key, trustedUserId)) {
+    throw new AssetKeyAuthorizationError("Personal namespace writes require the matching trusted user", 403);
+  }
+  return key;
+}
+
+// src/be/audit-user.ts
+init_request_auth_context();
+init_db();
+function resolveTaskAuditUserId(sourceTaskId, callerAgentId) {
+  if (!callerAgentId)
+    return null;
+  let resolvedSourceTaskId = sourceTaskId;
+  if (!resolvedSourceTaskId) {
+    const currentTask = getAgentCurrentTask(callerAgentId);
+    if (currentTask)
+      resolvedSourceTaskId = currentTask.id;
+  }
+  if (!resolvedSourceTaskId)
+    return null;
+  const task = getTaskById(resolvedSourceTaskId);
+  if (!task)
+    return null;
+  if (task.agentId !== callerAgentId)
+    return null;
+  if (task.requestedByUserId)
+    return task.requestedByUserId;
+  if (task.slackUserId) {
+    const user = findUserByExternalId("slack", task.slackUserId);
+    if (user)
+      return user.id;
+  }
+  return null;
+}
+function resolveHttpAuditUserId(req, callerAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "user")
+    return auth.userId;
+  const header = req.headers["x-source-task-id"];
+  const sourceTaskId = Array.isArray(header) ? header[0] : header;
+  return resolveTaskAuditUserId(sourceTaskId, callerAgentId);
+}
+
+// src/tools/create-page.ts
 init_db();
 
 // src/pages/version.ts
@@ -20833,6 +20906,7 @@ var registerCreatePageTool = (server) => {
     description: "Stores an HTML or JSON page in the swarm and returns shareable URLs. " + "Calls are upsert-by-(agent, slug): if you previously created a page " + "with the same slug, its prior state is snapshotted and the row is " + "updated. Use this for static reports, dashboards, or JSON action " + "specs that don't need a long-lived process.",
     annotations: { destructiveHint: false },
     inputSchema: object({
+      key: AssetKeySchema.optional().describe("Logical namespace. Defaults to a shared/page:<id>/ resource key."),
       title: string().min(1).describe("Human-readable title shown in listings."),
       slug: string().min(1).optional().describe("URL slug. Defaults to the kebab-cased title. Same slug → updates the existing row."),
       body: string().min(1).describe("Full page body (HTML document or JSON-render spec, per contentType)."),
@@ -20845,6 +20919,7 @@ var registerCreatePageTool = (server) => {
     outputSchema: object({
       yourAgentId: string(),
       id: string(),
+      key: AssetKeySchema.optional(),
       version: number(),
       app_url: string(),
       api_url: string()
@@ -20874,12 +20949,35 @@ var registerCreatePageTool = (server) => {
     }
     const needsCredentialsNames = input.needsCredentials?.map((c) => c.name);
     const existing = getPageBySlug(requestInfo.agentId, finalSlug);
+    const trustedUserId = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId);
+    let assetKey;
+    try {
+      if (input.key !== undefined || !existing) {
+        assetKey = input.key ? authorizeAssetKeyWrite(input.key, trustedUserId) : undefined;
+      }
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      return {
+        content: [{ type: "text", text: msg }],
+        structuredContent: {
+          yourAgentId: requestInfo.agentId,
+          id: existing?.id ?? "",
+          version: 0,
+          app_url: "",
+          api_url: "",
+          success: false,
+          message: msg
+        },
+        isError: true
+      };
+    }
     let id;
     if (existing) {
       try {
         snapshotPage(existing.id, requestInfo.agentId);
       } catch {}
       const updated = updatePage(existing.id, {
+        key: assetKey,
         title: input.title,
         description: input.description,
         contentType: input.contentType,
@@ -20908,6 +21006,7 @@ var registerCreatePageTool = (server) => {
     } else {
       try {
         const created = createPage({
+          key: assetKey,
           agentId: requestInfo.agentId,
           slug: finalSlug,
           title: input.title,
@@ -20969,6 +21068,7 @@ var registerCreatePageTool = (server) => {
       structuredContent: {
         yourAgentId: requestInfo.agentId,
         id,
+        key: fresh.key,
         version,
         app_url: appUrl,
         api_url: apiUrl
@@ -21825,6 +21925,7 @@ init_db();
 init_types();
 var TaskSummarySchema = object({
   id: string(),
+  key: AssetKeySchema,
   agentId: string().nullable(),
   task: string().optional(),
   taskPreview: string().optional(),
@@ -21849,6 +21950,8 @@ var getTasksInputSchema = object({
   tags: array(string()).optional().describe("Filter by any matching tag."),
   search: string().optional().describe("Search in task description."),
   scheduleId: string().uuid().optional().describe("Filter by schedule ID to find tasks created by a specific schedule."),
+  key: AssetKeySchema.optional().describe("Filter by exact logical namespace."),
+  keyPrefix: AssetKeySchema.optional().describe("Filter by namespace subtree."),
   includeHeartbeat: boolean().optional().describe("Include heartbeat/system tasks in results (excluded by default)."),
   limit: number().int().min(1).max(100).optional().describe("Max tasks to return (default: 25, max: 100)."),
   includeFull: boolean().optional().describe("Return the full `task` text instead of a ~300-char `taskPreview`. Default false.")
@@ -21867,6 +21970,8 @@ async function getTasksHandler(ctx, {
   tags,
   search,
   scheduleId,
+  key,
+  keyPrefix,
   includeHeartbeat,
   limit,
   includeFull
@@ -21882,6 +21987,8 @@ async function getTasksHandler(ctx, {
     tags,
     search,
     scheduleId,
+    key,
+    keyPrefix,
     includeHeartbeat,
     limit,
     requestedByUserId: ctx.kind === "user" ? ctx.userId : undefined
@@ -21889,6 +21996,7 @@ async function getTasksHandler(ctx, {
   const tasks = includeFull ? getAllTasks(taskFilters) : getAllTasks(taskFilters, { slim: true });
   const taskSummaries = tasks.map((t) => ({
     id: t.id,
+    key: t.key,
     agentId: t.agentId,
     ...includeFull ? { task: t.task } : { taskPreview: t.task },
     status: t.status,
@@ -21921,6 +22029,10 @@ async function getTasksHandler(ctx, {
     filters.push(`search='${search}'`);
   if (scheduleId)
     filters.push(`scheduleId='${scheduleId}'`);
+  if (key)
+    filters.push(`key='${key}'`);
+  if (keyPrefix)
+    filters.push(`keyPrefix='${keyPrefix}'`);
   const filterMsg = filters.length > 0 ? ` (${filters.join(", ")})` : "";
   const structuredContent = {
     yourAgentId: agentId,
@@ -26225,45 +26337,6 @@ var registerUpdateRepoTool = (server) => {
 };
 // src/tools/request-human-input.ts
 init_zod();
-
-// src/be/audit-user.ts
-init_request_auth_context();
-init_db();
-function resolveTaskAuditUserId(sourceTaskId, callerAgentId) {
-  if (!callerAgentId)
-    return null;
-  let resolvedSourceTaskId = sourceTaskId;
-  if (!resolvedSourceTaskId) {
-    const currentTask = getAgentCurrentTask(callerAgentId);
-    if (currentTask)
-      resolvedSourceTaskId = currentTask.id;
-  }
-  if (!resolvedSourceTaskId)
-    return null;
-  const task = getTaskById(resolvedSourceTaskId);
-  if (!task)
-    return null;
-  if (task.agentId !== callerAgentId)
-    return null;
-  if (task.requestedByUserId)
-    return task.requestedByUserId;
-  if (task.slackUserId) {
-    const user = findUserByExternalId("slack", task.slackUserId);
-    if (user)
-      return user.id;
-  }
-  return null;
-}
-function resolveHttpAuditUserId(req, callerAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "user")
-    return auth.userId;
-  const header = req.headers["x-source-task-id"];
-  const sourceTaskId = Array.isArray(header) ? header[0] : header;
-  return resolveTaskAuditUserId(sourceTaskId, callerAgentId);
-}
-
-// src/tools/request-human-input.ts
 init_db();
 var QuestionSchema = object({
   id: string().describe("Unique ID for the question (used as key in responses)"),
@@ -26424,6 +26497,7 @@ var import_cron_parser = __toESM(require_dist(), 1);
 init_db();
 init_types();
 var createScheduleInputSchema = object({
+  key: AssetKeySchema.optional().describe("Logical namespace. Defaults to a shared/schedule:<id>/ resource key."),
   name: string().min(1).max(100).describe("Unique name for the schedule (e.g., 'daily-cleanup')"),
   taskTemplate: string().min(1).optional().describe("The task description that will be created each time. Required when targetType is 'agent-task' (the default)."),
   targetType: ScheduledTaskTargetTypeSchema.default("agent-task").optional().describe("Execution target. Use 'workflow' + workflowId when the schedule only starts a workflow; " + "use 'script' + scriptName/scriptArgs when it only runs a catalog script; " + "use 'agent-task' only when a reasoning agent genuinely needs to be in the loop. " + "Do not create an agent-task whose taskTemplate just tells an agent to trigger a workflow or script."),
@@ -26457,6 +26531,7 @@ var registerCreateScheduleTool = (server) => {
       message: string(),
       schedule: object({
         id: string(),
+        key: AssetKeySchema,
         name: string(),
         description: string().optional(),
         cronExpression: string().optional(),
@@ -26483,6 +26558,7 @@ var registerCreateScheduleTool = (server) => {
       }).optional()
     })
   }, async ({
+    key,
     name,
     taskTemplate,
     targetType,
@@ -26685,7 +26761,9 @@ var registerCreateScheduleTool = (server) => {
         nextRunAt = calculateNextRun(tempSchedule, new Date);
       }
       const createdBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      const assetKey = key ? authorizeAssetKeyWrite(key, createdBy) : undefined;
       const schedule = createScheduledTask({
+        key: assetKey,
         name,
         taskTemplate,
         targetType,
@@ -26992,6 +27070,7 @@ var registerDeleteScheduleTool = (server) => {
 // src/tools/schedules/list-schedules.ts
 init_zod();
 init_db();
+init_types();
 var registerListSchedulesTool = (server) => {
   createToolRegistrar(server)("list-schedules", {
     title: "List Scheduled Tasks",
@@ -27000,6 +27079,8 @@ var registerListSchedulesTool = (server) => {
     inputSchema: object({
       enabled: boolean().optional().describe("Filter by enabled status"),
       name: string().optional().describe("Filter by name (partial match)"),
+      key: AssetKeySchema.optional().describe("Filter by exact namespace."),
+      keyPrefix: AssetKeySchema.optional().describe("Filter by namespace subtree."),
       scheduleType: _enum(["recurring", "one_time"]).optional().describe("Filter by schedule type"),
       hideCompleted: boolean().default(true).optional().describe("Hide completed one-time schedules (default: true)"),
       consecutiveErrorsMin: number().int().min(0).optional().describe("Only return schedules with at least this many consecutive errors."),
@@ -27012,6 +27093,7 @@ var registerListSchedulesTool = (server) => {
       message: string(),
       schedules: array(object({
         id: string(),
+        key: AssetKeySchema,
         name: string(),
         description: string().optional(),
         cronExpression: string().optional(),
@@ -27039,6 +27121,8 @@ var registerListSchedulesTool = (server) => {
   }, async ({
     enabled: enabled2,
     name,
+    key,
+    keyPrefix,
     scheduleType,
     hideCompleted,
     consecutiveErrorsMin,
@@ -27060,6 +27144,8 @@ var registerListSchedulesTool = (server) => {
       const filters = {
         enabled: enabled2,
         name,
+        key,
+        keyPrefix,
         scheduleType,
         hideCompleted,
         consecutiveErrorsMin,
@@ -27130,6 +27216,7 @@ function validateRecurringTiming(merged) {
 // src/tools/schedules/patch-schedule.ts
 init_types();
 var patchScheduleInputSchema = object({
+  key: AssetKeySchema.optional().describe("Move to a logical namespace."),
   scheduleId: string().uuid().optional().describe("Schedule ID to patch"),
   name: string().optional().describe("Schedule name to patch (alternative to ID)"),
   newName: string().min(1).max(100).optional().describe("New name for the schedule"),
@@ -27162,6 +27249,7 @@ var registerPatchScheduleTool = (server) => {
       message: string(),
       schedule: object({
         id: string(),
+        key: AssetKeySchema,
         name: string(),
         description: string().optional(),
         cronExpression: string().optional(),
@@ -27188,6 +27276,7 @@ var registerPatchScheduleTool = (server) => {
       }).optional()
     })
   }, async ({
+    key,
     scheduleId,
     name,
     newName,
@@ -27411,6 +27500,8 @@ var registerPatchScheduleTool = (server) => {
         }
       }
       const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      if (key !== undefined)
+        updateData.key = authorizeAssetKeyWrite(key, updatedBy);
       const updated = updateScheduledTask(schedule.id, { ...updateData, updatedBy });
       if (!updated) {
         return {
@@ -27553,6 +27644,7 @@ var import_cron_parser3 = __toESM(require_dist(), 1);
 init_db();
 init_types();
 var updateScheduleInputSchema = object({
+  key: AssetKeySchema.optional().describe("Move to a logical namespace."),
   scheduleId: string().uuid().optional().describe("Schedule ID to update"),
   name: string().optional().describe("Schedule name to update (alternative to ID)"),
   newName: string().min(1).max(100).optional().describe("New name for the schedule"),
@@ -27585,6 +27677,7 @@ var registerUpdateScheduleTool = (server) => {
       message: string(),
       schedule: object({
         id: string(),
+        key: AssetKeySchema,
         name: string(),
         description: string().optional(),
         cronExpression: string().optional(),
@@ -27611,6 +27704,7 @@ var registerUpdateScheduleTool = (server) => {
       }).optional()
     })
   }, async ({
+    key,
     scheduleId,
     name,
     newName,
@@ -27834,6 +27928,8 @@ var registerUpdateScheduleTool = (server) => {
         }
       }
       const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      if (key !== undefined)
+        updateData.key = authorizeAssetKeyWrite(key, updatedBy);
       const updated = updateScheduledTask(schedule.id, { ...updateData, updatedBy });
       if (!updated) {
         return {
@@ -28667,6 +28763,7 @@ init_types();
 var sendTaskInputSchema = object({
   agentId: uuid().optional().describe("The agent to assign/offer task to. Omit to create unassigned task for pool."),
   task: string().min(1).describe("The task description to send."),
+  key: AssetKeySchema.optional().describe("Logical namespace key. Child tasks inherit their parent namespace when provided."),
   offerMode: boolean().default(false).describe("If true, offer the task instead of direct assign (agent must accept/reject)."),
   taskType: string().max(50).optional().describe("Task type (e.g., 'bug', 'feature', 'review')."),
   tags: array(string()).optional().describe("Tags for filtering (e.g., ['urgent', 'frontend'])."),
@@ -28723,6 +28820,7 @@ function transferTrackerSyncToResumeChild(args) {
 async function sendTaskHandler(ctx, {
   agentId,
   task,
+  key,
   offerMode,
   taskType,
   tags,
@@ -28802,6 +28900,19 @@ async function sendTaskHandler(ctx, {
   } else if (slackChannelId || slackThreadTs) {
     console.log(`[send-task] slack-context override: creatorAgentId=${creatorAgentId ?? "n/a"} slackChannelId=${slackChannelId ?? "n/a"} slackThreadTs=${slackThreadTs ?? "n/a"} parentTaskId=${effectiveParentTaskId ?? "n/a"}`);
   }
+  let assetKey;
+  try {
+    const trustedUserId = ctx.kind === "user" ? ctx.userId : resolveTaskAuditUserId(sourceTaskId, creatorAgentId);
+    const requestedKey = key ?? effectiveParentTask?.key;
+    assetKey = requestedKey ? authorizeAssetKeyWrite(requestedKey, trustedUserId) : undefined;
+  } catch (error) {
+    const message = error instanceof AssetKeyAuthorizationError ? error.message : error instanceof Error ? error.message : String(error);
+    return {
+      isError: true,
+      content: [{ type: "text", text: message }],
+      structuredContent: { yourAgentId: creatorAgentId, success: false, message }
+    };
+  }
   let effectiveAgentId = agentId;
   if (effectiveParentTaskId && !agentId) {
     if (effectiveParentTask?.agentId) {
@@ -28865,6 +28976,7 @@ async function sendTaskHandler(ctx, {
     const finalTags = tags;
     if (!effectiveAgentId) {
       const newTask2 = createTaskExtended(task, {
+        key: assetKey,
         creatorAgentId,
         requestedByUserId,
         sourceTaskId,
@@ -28918,6 +29030,7 @@ async function sendTaskHandler(ctx, {
     }
     if (offerMode) {
       const newTask2 = createTaskExtended(task, {
+        key: assetKey,
         offeredTo: effectiveAgentId,
         creatorAgentId,
         requestedByUserId,
@@ -28950,6 +29063,7 @@ async function sendTaskHandler(ctx, {
       };
     }
     const newTask = createTaskExtended(task, {
+      key: assetKey,
       agentId: effectiveAgentId,
       creatorAgentId,
       requestedByUserId,
@@ -34883,7 +34997,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-976fykvr.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-w2067dt3.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -34952,7 +35066,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDb: getDb2 } = await import("./db-6xw82vz3.js");
+  const { getDb: getDb2 } = await import("./db-kmemzvqt.js");
   const db = getDb2();
   const txn = db.transaction(() => {
     const row = db.query("SELECT metadata FROM oauth_apps WHERE provider = 'jira'").get();
@@ -110096,6 +110210,7 @@ var TaskActionSchema = _enum([
 var taskActionInputSchema = object({
   action: TaskActionSchema.describe("The action to perform: 'create' creates an unassigned task, 'claim' takes a task from pool, 'release' returns task to pool, 'accept' accepts offered task, 'reject' declines offered task, 'to_backlog' moves task to backlog, 'from_backlog' moves task from backlog to pool."),
   task: string().min(1).optional().describe("Task description (required for 'create')."),
+  key: AssetKeySchema.optional().describe("Logical namespace for a created task. Defaults to a shared/task:<id>/ resource key."),
   taskType: string().max(50).optional().describe("Task type (e.g., 'bug', 'feature')."),
   tags: array(string()).optional().describe("Tags for filtering (e.g., ['urgent', 'frontend'])."),
   priority: number().int().min(0).max(100).optional().describe("Priority 0-100, default 50."),
@@ -110155,6 +110270,7 @@ async function taskActionHandler(ctx, input) {
   const {
     action,
     task,
+    key,
     taskType,
     tags,
     priority,
@@ -110226,6 +110342,15 @@ async function taskActionHandler(ctx, input) {
     };
   }
   const agentId = ctx.agentId;
+  let assetKey;
+  if (action === "create") {
+    try {
+      assetKey = key ? authorizeAssetKeyWrite(key, resolveTaskAuditUserId(ctx.sourceTaskId, agentId)) : undefined;
+    } catch (error) {
+      const message = error instanceof AssetKeyAuthorizationError ? error.message : error instanceof Error ? error.message : String(error);
+      return taskActionCallResult({ success: false, message }, agentId);
+    }
+  }
   const txn = getDb().transaction(() => {
     switch (action) {
       case "create": {
@@ -110236,6 +110361,7 @@ async function taskActionHandler(ctx, input) {
           };
         }
         const newTask = createTaskExtended(task, {
+          key: assetKey,
           creatorAgentId: agentId,
           taskType,
           tags,
@@ -111365,6 +111491,7 @@ var registerCreateWorkflowTool = (server) => {
 ` + "- WAIT NODE: type 'wait' pauses a workflow for a duration or until a named workflowEventBus event arrives. " + "See runbooks/workflows.md#wait-nodes for config shapes, ordering caveats, and built-in event names.",
     inputSchema: exports_external.object({
       name: exports_external.string().describe("Unique name for the workflow"),
+      key: AssetKeySchema.optional().describe("Logical namespace. Defaults to a shared/workflow:<id>/ resource key."),
       description: exports_external.string().optional().describe("Description of what this workflow does"),
       definition: WorkflowDefinitionSchema.describe("The workflow definition with nodes (each node has id, type, config, and optional next/retry/validation)"),
       triggers: exports_external.array(TriggerConfigSchema).optional().describe("Optional trigger configurations (webhook, schedule). Webhook verification formats: legacy omitted verification, hmac-sha256, timestamped-hmac-sha256, token-equality."),
@@ -111380,7 +111507,18 @@ var registerCreateWorkflowTool = (server) => {
       message: exports_external.string(),
       workflow: exports_external.unknown().optional()
     })
-  }, async ({ name, description, definition, triggers, cooldown, input, dir, vcsRepo, triggerSchema }, requestInfo) => {
+  }, async ({
+    name,
+    key,
+    description,
+    definition,
+    triggers,
+    cooldown,
+    input,
+    dir,
+    vcsRepo,
+    triggerSchema
+  }, requestInfo) => {
     if (!requestInfo.agentId) {
       return {
         content: [{ type: "text", text: "Agent ID required." }],
@@ -111404,7 +111542,9 @@ var registerCreateWorkflowTool = (server) => {
         };
       }
       const createdBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      const assetKey = key ? authorizeAssetKeyWrite(key, createdBy) : undefined;
       const workflow = createWorkflow({
+        key: assetKey,
         name,
         description,
         definition,
@@ -111623,6 +111763,8 @@ var registerListWorkflowsTool = (server) => {
     description: "List all automation workflows, optionally filtered by enabled status. Returns SLIM rows WITHOUT the full `definition` (DAG) — each row carries a `nodeCount` instead. To inspect or patch a workflow's nodes/triggers, call `get-workflow` by id, or pass `includeFull: true` here.",
     inputSchema: exports_external.object({
       enabled: exports_external.boolean().optional().describe("Filter by enabled status (omit to return all)"),
+      key: AssetKeySchema.optional().describe("Filter by exact namespace."),
+      keyPrefix: AssetKeySchema.optional().describe("Filter by namespace subtree."),
       consecutiveErrorsMin: exports_external.number().int().min(0).optional().describe("Only return workflows with at least this many latest consecutive failed runs."),
       lastRunStatus: WorkflowRunStatusSchema.optional().describe("Only return workflows whose latest run has this status."),
       includeFull: exports_external.boolean().optional().describe("Return the full workflow `definition` + trigger config instead of slim rows. Default false — prefer `get-workflow` to fetch a single workflow in full.")
@@ -111632,9 +111774,9 @@ var registerListWorkflowsTool = (server) => {
       message: exports_external.string(),
       workflows: exports_external.array(exports_external.unknown())
     })
-  }, async ({ enabled: enabled2, consecutiveErrorsMin, lastRunStatus, includeFull }) => {
+  }, async ({ enabled: enabled2, key, keyPrefix, consecutiveErrorsMin, lastRunStatus, includeFull }) => {
     try {
-      const filters = { enabled: enabled2, consecutiveErrorsMin, lastRunStatus };
+      const filters = { enabled: enabled2, key, keyPrefix, consecutiveErrorsMin, lastRunStatus };
       const workflows = includeFull ? listWorkflows(filters) : listWorkflows(filters, { slim: true });
       return {
         content: [{ type: "text", text: `Found ${workflows.length} workflow(s).` }],
@@ -111663,6 +111805,7 @@ var registerPatchWorkflowTool = (server) => {
     description: "Partially update a workflow by creating, updating, or deleting individual nodes, " + "and/or by setting/clearing the trigger payload schema. " + "DAG operations are applied in order: delete → create → update. " + "`triggerSchema` is independent of DAG ops: pass an object to set/replace, " + "pass null to clear, or omit to leave unchanged. " + "Validator subset for `triggerSchema`: type, required, properties, enum, const, items. " + "Other JSON-Schema keywords are silently ignored. " + "Creates a version snapshot before applying changes.",
     inputSchema: exports_external.object({
       id: exports_external.string().uuid().describe("Workflow ID to patch"),
+      key: AssetKeySchema.optional().describe("Move to a logical namespace."),
       update: exports_external.array(exports_external.object({
         nodeId: exports_external.string(),
         node: WorkflowNodePatchSchema
@@ -111688,7 +111831,7 @@ var registerPatchWorkflowTool = (server) => {
       nodesUpdated: exports_external.number().optional(),
       nodesDeleted: exports_external.number().optional()
     })
-  }, async ({ id, update, delete: del, create, onNodeFailure, triggerSchema }, requestInfo) => {
+  }, async ({ id, key, update, delete: del, create, onNodeFailure, triggerSchema }, requestInfo) => {
     try {
       const existing = getWorkflow(id);
       if (!existing) {
@@ -111723,6 +111866,9 @@ var registerPatchWorkflowTool = (server) => {
       const updateArgs = {
         definition: patchResult.definition
       };
+      if (key !== undefined) {
+        updateArgs.key = authorizeAssetKeyWrite(key, updatedBy);
+      }
       if (triggerSchema !== undefined) {
         updateArgs.triggerSchema = triggerSchema;
       }
@@ -111989,6 +112135,7 @@ var registerUpdateWorkflowTool = (server) => {
     description: "Update an existing workflow's name, description, definition, triggers, cooldown, input, triggerSchema, or enabled state. " + "Creates a version snapshot before applying changes. " + "TRIGGER SCHEMA: pass 'triggerSchema' as a JSON-Schema object to set/replace, or 'null' to clear. " + "Supported JSON-Schema keywords: type, required, properties, enum, const, items (recursive into arrays). " + "Other JSON-Schema keywords (oneOf/anyOf/$ref/pattern/format/additionalProperties) are silently ignored. " + "WEBHOOK VERIFICATION: webhook triggers use hmacSecret for all verification formats. " + "Omit verification for legacy HMAC-SHA256 over the raw body with fallback header scanning; " + "or set verification to { format: 'hmac-sha256', header }, { format: 'timestamped-hmac-sha256', header, toleranceSeconds? }, " + "or { format: 'token-equality', header }.",
     inputSchema: exports_external.object({
       id: exports_external.string().uuid().describe("Workflow ID to update"),
+      key: AssetKeySchema.optional().describe("Move to a logical namespace."),
       name: exports_external.string().optional().describe("New name for the workflow"),
       description: exports_external.string().optional().describe("New description"),
       definition: WorkflowDefinitionSchema.optional().describe("New workflow definition"),
@@ -112008,6 +112155,7 @@ var registerUpdateWorkflowTool = (server) => {
     })
   }, async ({
     id,
+    key,
     name,
     description,
     definition,
@@ -112046,7 +112194,9 @@ var registerUpdateWorkflowTool = (server) => {
       }
       const version = snapshotWorkflow(id, requestInfo.agentId);
       const updatedBy = resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+      const assetKey = key === undefined ? undefined : authorizeAssetKeyWrite(key, updatedBy);
       const workflow = updateWorkflow(id, {
+        key: assetKey,
         name,
         description,
         definition,
@@ -112087,6 +112237,15 @@ var registerUpdateWorkflowTool = (server) => {
     }
   });
 };
+// src/utils/scripts-only-mode.ts
+function resolveScriptsOnlyMode(opts) {
+  if (opts.env)
+    return opts.env === "true";
+  if (opts.configValue)
+    return opts.configValue === "true";
+  return false;
+}
+
 // src/server.ts
 var DEFAULT_CAPABILITIES = "core,task-pool,profiles,services,scheduling,memory,workflows,pages,metrics,kv";
 var CAPABILITIES = new Set((process.env.CAPABILITIES || DEFAULT_CAPABILITIES).split(",").map((s) => s.trim()));
@@ -112096,7 +112255,10 @@ function hasCapability(cap) {
 function getEnabledCapabilities() {
   return Array.from(CAPABILITIES);
 }
-function createServer() {
+function isScriptsOnlyMcp() {
+  return resolveScriptsOnlyMode({ env: process.env.SCRIPTS_ONLY_MCP });
+}
+function createServer(opts = {}) {
   initDb(process.env.DATABASE_PATH);
   seedPricingFromModelsDev();
   startPricingRefreshLoop();
@@ -112117,6 +112279,15 @@ function createServer() {
       logging: {}
     }
   });
+  if (opts.scriptsOnly ?? isScriptsOnlyMcp()) {
+    registerScriptSearchTool(server);
+    registerScriptRunTool(server);
+    registerScriptUpsertTool(server);
+    registerScriptDeleteTool(server);
+    registerScriptQueryTypesTool(server);
+    registerScriptRunsTools(server);
+    return server;
+  }
   registerJoinSwarmTool(server);
   registerPollTaskTool(server);
   registerGetSwarmTool(server);
@@ -112398,4 +112569,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, snapshotPage, assertOAuthProviderIsNotReserved, assertOAuthAppUrlsSafe, scopedResourceScopeIdSchema, resolveScopedResourceId, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, storeLinks, refreshLinks, canReadMemory, getLinksForMemory, recordRetrievals, expandCandidatesWithGraph, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveTaskAuditUserId, resolveHttpAuditUserId, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, userCtx, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, createToolRegistrar, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, setCorsHeaders, parseQueryParams, getPathSegments, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, describeRequestRoute, route, assertSelectOnlyQuery, executeReadOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, resolveTaskAuditUserId, resolveHttpAuditUserId, snapshotPage, assertOAuthProviderIsNotReserved, assertOAuthAppUrlsSafe, scopedResourceScopeIdSchema, resolveScopedResourceId, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, storeLinks, refreshLinks, canReadMemory, getLinksForMemory, recordRetrievals, expandCandidatesWithGraph, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, resolveScriptsOnlyMode, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };