@desplega.ai/agent-swarm 1.124.0 → 1.125.0

package/dist/{oauth-refresh-sweep-shm0nzm4.js → oauth-refresh-sweep-90h9rzx8.js}

@@ -1,13 +1,14 @@
 import {
   forceRefreshAuthorizationOrThrow
-} from "./cli-h89g0qrd.js";
+} from "./cli-v292k2fv.js";
 import {
   getAuthorizationById,
   listAuthorizationSweepRows
-} from "./cli-mcez7z4p.js";
-import"./cli-3z4q09tn.js";
+} from "./cli-vvbwy286.js";
+import"./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{onboard-py9dnf54.js → onboard-20reqz6j.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-perb20ma.js";
+} from "./cli-tar44ekp.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-p0zgv8pj.js";
+} from "./cli-8vzddbs7.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-7yjkfg68.js → otel-impl-vja8f9mm.js}

@@ -9,7 +9,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-p0zgv8pj.js";
+} from "./cli-8vzddbs7.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{pricing-refresh-3snb6370.js → pricing-refresh-34mbexgm.js}

@@ -2,11 +2,12 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-qf7acvyr.js";
-import"./cli-gzjsamwc.js";
-import"./cli-3z4q09tn.js";
+} from "./cli-94796kxr.js";
+import"./cli-q92pr3rt.js";
+import"./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import"./cli-4j2mrzag.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";

package/dist/{rbac-roles-gqxdp8st.js → rbac-roles-s1qnewkt.js}

@@ -7,11 +7,12 @@ import {
   getUserGrant,
   listUserRoles,
   runRbacCliCommand
-} from "./cli-zxb72ctk.js";
-import"./cli-y43n987v.js";
-import"./cli-3z4q09tn.js";
+} from "./cli-3x5aphbt.js";
+import"./cli-gbx122ge.js";
+import"./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import"./cli-4j2mrzag.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";

package/dist/{rbac-roles-5e72bbpk.js → rbac-roles-sa59eyp4.js}

@@ -1,12 +1,13 @@
 import {
   PermissionVerbSchema
-} from "./cli-y43n987v.js";
+} from "./cli-gbx122ge.js";
 import {
   getDb,
   init_db
-} from "./cli-3z4q09tn.js";
+} from "./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import"./cli-4j2mrzag.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";

package/dist/{seed-pricing-bg42d7h2.js → seed-pricing-p5fnj0qd.js}

@@ -1,10 +1,11 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-gzjsamwc.js";
-import"./cli-3z4q09tn.js";
+} from "./cli-q92pr3rt.js";
+import"./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import"./cli-4j2mrzag.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";

package/dist/{setup-nzk3kbbq.js → setup-p9yq3mb2.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-perb20ma.js";
+} from "./cli-tar44ekp.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-0p1jdzkm.js → worker-21zrq8cd.js}

@@ -1,7 +1,8 @@
 import {
   runAgent
-} from "./cli-ykthjw29.js";
-import"./cli-exfs8aym.js";
+} from "./cli-jcavqvh7.js";
+import"./cli-wdrrgv4m.js";
+import"./cli-3y8xyp0b.js";
 import"./cli-jj1arm18.js";
 import"./cli-07er7wrs.js";
 import"./cli-w5r4wfm5.js";
@@ -14,7 +15,7 @@ import"./cli-d6n0thxw.js";
 import"./cli-v1mwc5v2.js";
 import {
   getEnabledCapabilities
-} from "./cli-x268say8.js";
+} from "./cli-wbcsjpyv.js";
 import"./cli-1z7048dy.js";
 import"./cli-gz9sbyk3.js";
 import"./cli-ftyf58xj.js";
@@ -25,36 +26,37 @@ import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
 import"./cli-cw70hymf.js";
 import"./cli-e61fs2hp.js";
-import"./cli-2yr6edr7.js";
-import"./cli-qf7acvyr.js";
-import"./cli-gzjsamwc.js";
-import"./cli-zxb72ctk.js";
-import"./cli-y43n987v.js";
-import"./cli-gkvf8d83.js";
-import"./cli-kk58tg33.js";
+import"./cli-4xft7caa.js";
+import"./cli-94796kxr.js";
+import"./cli-q92pr3rt.js";
+import"./cli-3x5aphbt.js";
+import"./cli-gbx122ge.js";
+import"./cli-n02497b2.js";
+import"./cli-5a4nmfrn.js";
 import"./cli-f14fvzag.js";
 import"./cli-3dpj7atn.js";
-import"./cli-h89g0qrd.js";
-import"./cli-wn3m6q54.js";
+import"./cli-v292k2fv.js";
+import"./cli-dbmh9yqn.js";
 import"./cli-jkhwmmgg.js";
-import"./cli-mmk5vagg.js";
-import"./cli-p0ec4vv6.js";
+import"./cli-qzy21svh.js";
+import"./cli-ff8b5cbe.js";
 import"./cli-q25ejbyn.js";
-import"./cli-mcez7z4p.js";
+import"./cli-vvbwy286.js";
 import"./cli-fad8m16k.js";
 import"./cli-7zd05xb4.js";
-import"./cli-92bqgbgy.js";
-import"./cli-0925phzv.js";
-import"./cli-qwsagsmg.js";
-import"./cli-dq2ssyf0.js";
+import"./cli-zhp3t49e.js";
+import"./cli-0w3mk6r2.js";
+import"./cli-k5c6jfzn.js";
+import"./cli-refygp3c.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-5ncdb7ff.js";
 import"./cli-wspgs9bt.js";
 import"./cli-dh55d5fg.js";
-import"./cli-3z4q09tn.js";
+import"./cli-yr11vvst.js";
+import"./cli-k1py8264.js";
 import"./cli-z2zcxes1.js";
-import"./cli-p0zgv8pj.js";
+import"./cli-8vzddbs7.js";
 import"./cli-4j2mrzag.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.124.0",
+    "version": "1.125.0",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.124.0",
+  "version": "1.125.0",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",
@@ -65,6 +65,7 @@
     "mono:test": "turbo run test",
     "mono:lint": "turbo run lint",
     "mono:dev": "turbo run dev",
+    "test:root": "bash scripts/run-bun-tests.sh",
     "prepack": "bun run build:cli",
     "tsc:check": "bun tsc --noEmit",
     "check:db-boundary": "bash scripts/check-db-boundary.sh",

package/src/be/db.ts

@@ -13657,6 +13657,36 @@ export function getKv(namespace: string, key: string): KvEntry | null {
   return decodeKvRow(row);
 }
 
+/** Delete expired entries in one namespace. Used by internal TTL-backed stores
+ * that need proactive cleanup rather than waiting for a point read. */
+export function sweepExpiredKv(namespace: string, now = Date.now()): number {
+  const result = getDb()
+    .prepare<unknown, [string, number]>(
+      `DELETE FROM kv_entries
+        WHERE namespace = ?
+          AND expires_at IS NOT NULL
+          AND expires_at <= ?`,
+    )
+    .run(namespace, now);
+  return result.changes;
+}
+
+/** Delete expired entries across a namespace family (`prefix` and
+ * `prefix:*`). Used by per-agent internal stores whose inactive owners may
+ * never return to trigger a namespace-local sweep. */
+export function sweepExpiredKvPrefix(prefix: string, now = Date.now()): number {
+  const escaped = prefix.replace(/[\\%_]/g, "\\$&");
+  const result = getDb()
+    .prepare<unknown, [string, string, number]>(
+      `DELETE FROM kv_entries
+        WHERE (namespace = ? OR namespace LIKE ? ESCAPE '\\')
+          AND expires_at IS NOT NULL
+          AND expires_at <= ?`,
+    )
+    .run(prefix, `${escaped}:%`, now);
+  return result.changes;
+}
+
 /**
  * Upsert a KV entry. Caller passes the decoded value + valueType; we encode
  * before storing. `expiresAt` is unix-ms (NULL means no expiry).

package/src/cli.tsx

@@ -244,6 +244,13 @@ const COMMAND_HELP: Record<
     options: "  -h, --help             Show this help",
     examples: `  ${binName} hook`,
   },
+  "codex-hook": {
+    usage: `${binName} codex-hook`,
+    description:
+      "Handle Codex CLI hook events from stdin (steering delivery).\nUsed internally by the codex hooks registered in the worker image.",
+    options: "  -h, --help             Show this help",
+    examples: `  ${binName} codex-hook`,
+  },
   artifact: {
     usage: `${binName} artifact <subcommand> [options]`,
     description: "Manage agent artifacts (serve, list, etc.).",
@@ -383,6 +390,7 @@ function printHelp(command?: string) {
     ["api", "Start the API + MCP HTTP server"],
     ["claude", "Run Claude CLI"],
     ["hook", "Handle Claude Code hook events (stdin)"],
+    ["codex-hook", "Handle Codex CLI hook events (stdin, steering delivery)"],
     ["artifact", "Manage agent artifacts"],
     ["x", "Execute external command routes"],
     ["scripts", "Reusable scripts maintenance"],
@@ -672,6 +680,10 @@ if (args.showHelp || args.command === "help" || args.command === undefined) {
 } else if (args.command === "hook") {
   const { runHook } = await import("./commands/hook.ts");
   await runHook();
+} else if (args.command === "codex-hook") {
+  const { handleCodexHook } = await import("./hooks/codex-hook.ts");
+  await handleCodexHook();
+  process.exit(0);
 } else if (args.command === "artifact") {
   // Pass all args after "artifact" directly
   const artifactArgs = process.argv.slice(process.argv.indexOf("artifact") + 1);

package/src/commands/runner.ts

@@ -21,6 +21,7 @@ import {
 } from "../prompts/defaults.ts";
 import { renderMemoriesPrompt } from "../prompts/memories.ts";
 import { configureHttpResolver, resolveTemplateAsync } from "../prompts/resolver.ts";
+import { renderSteeringDelivery } from "../prompts/steering-delivery.ts";
 import { authJsonToCredentialSelection } from "../providers/codex-oauth/auth-json.js";
 import { materializeCodexAuthJson } from "../providers/codex-oauth/auth-json-fs.js";
 import { loadAllCodexOAuthSlots } from "../providers/codex-oauth/storage.js";
@@ -486,29 +487,10 @@ export function createSteeringDispatchState(): SteeringDispatchState {
   };
 }
 
-/**
- * Wrap a steering body in the registered delivery envelope so the injected
- * message carries its own ID. `accept-steer` takes that ID, and it is the only
- * route to `handled` — without the envelope the agent obeys the message but
- * can never acknowledge it, and the row sits at `delivered` forever.
- *
- * Falls back to the bare body if template resolution fails: delivering an
- * un-acknowledgeable message beats not delivering one at all.
- */
-export async function renderSteeringDelivery(
-  steeringMessageId: string,
-  body: string,
-): Promise<string> {
-  try {
-    const result = await resolveTemplateAsync("system.agent.steering.delivery", {
-      steeringMessageId,
-      body,
-    });
-    return result.skipped || !result.text.trim() ? body : result.text;
-  } catch {
-    return body;
-  }
-}
+// Moved to src/prompts/steering-delivery.ts so the codex-hook can render the
+// same envelope without importing the whole runner. Re-exported for existing
+// consumers (steering-transport tests).
+export { renderSteeringDelivery };
 
 export async function pollAndDispatchSteering(
   config: ApiConfig,
@@ -518,6 +500,12 @@ export async function pollAndDispatchSteering(
   fetchImpl: typeof fetch = fetch,
 ): Promise<void> {
   if (!isSteeringEnabled()) return;
+  // Harness-side delivery (codex hooks): the hook polls pending rows and
+  // injects them itself. Dispatching here would race it into a false
+  // "Provider session does not support live steering" undeliverable →
+  // premature promotion. Leave the rows pending; the terminal sweep still
+  // promotes anything the hook never delivered.
+  if (session.steeringDeliveredExternally) return;
 
   const headers = {
     Authorization: `Bearer ${config.apiKey}`,

package/src/hooks/codex-hook.ts

@@ -0,0 +1,157 @@
+#!/usr/bin/env bun
+
+/**
+ * Codex lifecycle hook — harness-side steering delivery.
+ *
+ * Codex has no in-process steering channel: `@openai/codex-sdk` drives
+ * `codex exec` with stdin written once and closed, and the app-server's
+ * native `turn/steer` is not reachable through the SDK (issue #1034). So
+ * delivery happens here instead: this hook runs inside the codex lifecycle
+ * (registered for SessionStart / PostToolUse / Stop via the managed
+ * `/etc/codex/requirements.toml` in the worker image), polls the API for
+ * pending steering rows, marks them `delivered`, and injects the rendered
+ * envelope into the model's context:
+ *
+ *   - SessionStart / PostToolUse → `hookSpecificOutput.additionalContext`
+ *     (verified to reach the model at codex-cli 0.146.0; PreToolUse drops
+ *     additionalContext upstream, so it is deliberately not registered).
+ *   - Stop → `{"decision":"block","reason":...}` so a session about to end
+ *     still receives the message and continues to act on it.
+ *
+ * One-shot guarantee: a message is included in hook output only after its
+ * `/delivered` POST succeeded, so a message is injected at most once. A
+ * failed POST leaves the row `pending` for the next lifecycle event; rows a
+ * dying session never picks up are promoted by the server's terminal sweep.
+ * The runner's dispatch poll skips codex sessions entirely
+ * (`ProviderSession.steeringDeliveredExternally`).
+ */
+
+import { renderSteeringDelivery } from "../prompts/steering-delivery.ts";
+import type { SteeringMessage } from "../types";
+import { getApiKey } from "../utils/api-key";
+import { getMcpBaseUrl } from "../utils/constants";
+import { isSteeringEnabled } from "../utils/steering-enabled";
+
+const FETCH_TIMEOUT_MS = 5_000;
+
+export interface CodexHookMessage {
+  hook_event_name?: string;
+  stop_hook_active?: boolean;
+}
+
+export interface CodexHookConfig {
+  apiUrl: string;
+  apiKey: string;
+  agentId: string;
+}
+
+export function resolveCodexHookConfig(
+  env: Record<string, string | undefined> = process.env,
+): CodexHookConfig | null {
+  const agentId = env.AGENT_ID;
+  const apiKey = getApiKey(env);
+  const apiUrl = getMcpBaseUrl();
+  if (!agentId || !apiKey || !apiUrl) return null;
+  return { apiUrl, apiKey, agentId };
+}
+
+/**
+ * Fetch the agent's pending steering rows, mark each `delivered`, and return
+ * the rendered envelopes of the ones whose delivered-POST succeeded.
+ *
+ * Any error yields an empty result — a hook must never take the harness down
+ * over steering, and `pending` rows are retried on the next lifecycle event.
+ */
+export async function collectDeliverableSteering(
+  config: CodexHookConfig,
+  fetchImpl: typeof fetch = fetch,
+): Promise<string[]> {
+  const headers = {
+    Authorization: `Bearer ${config.apiKey}`,
+    "X-Agent-ID": config.agentId,
+  };
+
+  let messages: SteeringMessage[];
+  try {
+    const response = await fetchImpl(`${config.apiUrl}/api/steering-messages`, {
+      headers,
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!response.ok) return [];
+    const data = (await response.json()) as { messages?: SteeringMessage[] };
+    messages = (data.messages ?? []).filter((message) => message.status === "pending");
+  } catch {
+    return [];
+  }
+
+  const delivered: string[] = [];
+  for (const message of messages) {
+    // Mark delivered BEFORE injecting: if the POST fails the row stays
+    // pending and is retried later; the inverse order could inject the same
+    // message on every tool call ("no polluting").
+    try {
+      const report = await fetchImpl(
+        `${config.apiUrl}/api/steering-messages/${encodeURIComponent(message.id)}/delivered`,
+        {
+          method: "POST",
+          headers: { ...headers, "Content-Type": "application/json" },
+          body: JSON.stringify({ mode: "queue" }),
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        },
+      );
+      if (!report.ok) continue;
+    } catch {
+      continue;
+    }
+    delivered.push(await renderSteeringDelivery(message.id, message.body));
+  }
+  return delivered;
+}
+
+/**
+ * Handle one codex hook event. Returns the JSON object to print to stdout
+ * (codex reads hook responses from stdout), or null for no output.
+ */
+export async function handleCodexHookEvent(
+  msg: CodexHookMessage,
+  config: CodexHookConfig | null,
+  env: Record<string, string | undefined> = process.env,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Record<string, unknown> | null> {
+  const event = msg.hook_event_name;
+  if (!event || !config || !isSteeringEnabled(env)) return null;
+  if (event !== "SessionStart" && event !== "PostToolUse" && event !== "Stop") return null;
+
+  const envelopes = await collectDeliverableSteering(config, fetchImpl);
+  if (envelopes.length === 0) return null;
+  const additionalContext = envelopes.join("\n\n");
+
+  if (event === "Stop") {
+    // Delivered rows are marked before this block fires, so the next Stop
+    // finds nothing pending and lets the session end — no block loop.
+    return {
+      decision: "block",
+      reason: `Steering message(s) arrived before you finished:\n\n${additionalContext}`,
+    };
+  }
+
+  return {
+    hookSpecificOutput: { hookEventName: event, additionalContext },
+  };
+}
+
+/** stdin/stdout entry point used by the `codex-hook` CLI command. */
+export async function handleCodexHook(): Promise<void> {
+  let msg: CodexHookMessage;
+  try {
+    msg = (await Bun.stdin.json()) as CodexHookMessage;
+  } catch {
+    return;
+  }
+  try {
+    const output = await handleCodexHookEvent(msg, resolveCodexHookConfig());
+    if (output) console.log(JSON.stringify(output));
+  } catch {
+    // Never fail the harness over steering delivery.
+  }
+}

package/src/http/kv.ts

@@ -11,6 +11,7 @@ import {
   listKv,
   upsertKv,
 } from "../be/db";
+import { mcpOverflowAuthError } from "../kv-overflow";
 import { can } from "../rbac";
 import { agentContextKey, pageContextKey } from "../tasks/context-key";
 import { KvKeySchema, KvNamespaceSchema, KvValueTypeSchema } from "../types";
@@ -321,6 +322,10 @@ function authorizeWrite(
   namespace: string,
   ctx: AuthCtx,
 ): { status: number; message: string } | null {
+  const overflowAuthErr = mcpOverflowAuthError(namespace, ctx.callerAgentId);
+  if (overflowAuthErr) {
+    return { status: 403, message: overflowAuthErr };
+  }
   if (namespace.startsWith("task:page:")) {
     if (!ctx.hasPageHeader) {
       return { status: 403, message: "task:page:* writes require a page-proxy request" };
@@ -349,6 +354,14 @@ function authorizeWrite(
   return null;
 }
 
+function authorizeRead(
+  namespace: string,
+  ctx: AuthCtx,
+): { status: number; message: string } | null {
+  const overflowAuthErr = mcpOverflowAuthError(namespace, ctx.callerAgentId);
+  return overflowAuthErr ? { status: 403, message: overflowAuthErr } : null;
+}
+
 function encodeValueOrError(
   res: ServerResponse,
   value: unknown,
@@ -435,7 +448,7 @@ export async function handleKv(
     if (!ns) return true;
     const key = decodeKvSegment(res, parsed.params.key, "key");
     if (!key) return true;
-    return sendGet(res, ns, key);
+    return sendGet(req, res, ns, key);
   }
   if (putKvExplicit.match(req.method, pathSegments)) {
     if (enforceContentLengthCap(req, res, MAX_KV_BODY_BYTES) === BODY_TOO_LARGE) return true;
@@ -461,7 +474,7 @@ export async function handleKv(
     if (!parsed) return true;
     const ns = decodeKvSegment(res, parsed.params.namespace, "namespace");
     if (!ns) return true;
-    return sendList(res, ns, parsed.query);
+    return sendList(req, res, ns, parsed.query);
   }
 
   // ── Header-resolved variants ──────────────────────────────────────────────
@@ -475,7 +488,7 @@ export async function handleKv(
     }
     const key = decodeKvSegment(res, parsed.params.key, "key");
     if (!key) return true;
-    return sendGet(res, ns, key);
+    return sendGet(req, res, ns, key);
   }
   if (putKvHeader.match(req.method, pathSegments)) {
     if (enforceContentLengthCap(req, res, MAX_KV_BODY_BYTES) === BODY_TOO_LARGE) return true;
@@ -510,16 +523,16 @@ export async function handleKv(
       jsonError(res, "namespace is required (pass X-Source-Task-Id or X-Agent-ID)", 400);
       return true;
     }
-    return sendList(res, ns, parsed.query);
+    return sendList(req, res, ns, parsed.query);
   }
 
   return false;
 }
 
 /**
- * Reads only ever resolve from headers — there's no auth distinction between
- * reading your own ns and someone else's (any authenticated caller may read
- * any namespace).
+ * Reads resolve from headers. Ordinary KV namespaces remain cross-agent
+ * readable by design; `sendGet`/`sendList` separately enforce private
+ * ownership for the internal `mcp:overflow:<agentId>` namespace family.
  */
 function resolveNamespaceForRead(req: IncomingMessage): string | null {
   return resolveNamespaceFromHeaders(req);
@@ -591,7 +604,17 @@ async function handleIncr(
   return true;
 }
 
-function sendGet(res: ServerResponse, namespace: string, key: string): boolean {
+function sendGet(
+  req: IncomingMessage,
+  res: ServerResponse,
+  namespace: string,
+  key: string,
+): boolean {
+  const authErr = authorizeRead(namespace, buildAuthCtx(req));
+  if (authErr) {
+    jsonError(res, authErr.message, authErr.status);
+    return true;
+  }
   const entry = getKv(namespace, key);
   if (!entry) {
     jsonError(res, "not found", 404);
@@ -661,10 +684,16 @@ function sendDelete(
 }
 
 function sendList(
+  req: IncomingMessage,
   res: ServerResponse,
   namespace: string,
   query: z.infer<typeof kvListQuerySchema>,
 ): boolean {
+  const authErr = authorizeRead(namespace, buildAuthCtx(req));
+  if (authErr) {
+    jsonError(res, authErr.message, authErr.status);
+    return true;
+  }
   const limit = Math.min(query.limit ?? 100, MAX_KV_LIST_LIMIT);
   const offset = query.offset ?? 0;
   const prefix = query.prefix && query.prefix.length > 0 ? query.prefix : undefined;

package/src/http/mcp-bridge.ts

@@ -3,6 +3,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { createServer } from "@/server";
 import { isMcpToolAllowedForScripts } from "../scripts-runtime/sdk-allowlist";
+import { markScriptSdkRequestOrigin } from "../tools/utils";
 import { route } from "./route-def";
 import { json, jsonError } from "./utils";
 
@@ -83,7 +84,7 @@ export async function handleMcpBridge(
     ? req.headers["x-source-task-id"][0]
     : (req.headers["x-source-task-id"] as string | undefined);
 
-  const extra = {
+  const extra = markScriptSdkRequestOrigin({
     sessionId: "mcp-bridge",
     requestInfo: {
       headers: {
@@ -91,7 +92,7 @@ export async function handleMcpBridge(
         ...(sourceTaskId ? { "x-source-task-id": sourceTaskId } : {}),
       },
     },
-  };
+  });
 
   try {
     const result = tool.inputSchema