@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/apps/version.ts

@@ -102,7 +102,11 @@ export function decodeAppVersion(appVersion: AppVersion): AppVersion {
   };
 }
 
-function rollbackSnapshot(version: AppVersion): {
+function rollbackSnapshot(
+  version: AppVersion,
+  writer: { writerAgentId?: string | null; writerIsUser?: boolean },
+  existingDefinition: unknown,
+): {
   name: string;
   description: string | null;
   definition: AppDefinition;
@@ -132,9 +136,16 @@ function rollbackSnapshot(version: AppVersion): {
     ]);
   }
 
+  // A rollback is an ordinary definition write by whoever invoked it, not a
+  // trusted restore: the historical snapshot may reintroduce foreign-owned or
+  // lead-run script references the writer could never add directly, so the
+  // same ownership/grandfathering checks apply against the CURRENT definition.
   const parsed = parseAppDefinition(upgradeAppDefinition(snapshot.definition), {
     currentAppId: version.appId,
     resolveApp: getApp,
+    writerAgentId: writer.writerAgentId ?? null,
+    ...(writer.writerIsUser === undefined ? {} : { writerIsUser: writer.writerIsUser }),
+    existingDefinition,
   });
   if (!parsed.success) throw new AppRollbackDefinitionError(version.version, parsed.issues);
   return {
@@ -155,6 +166,9 @@ export async function rollbackApp(input: {
   migration?: AppMigration;
   forceElementBreak?: string[];
   changedByAgentId?: string;
+  /** Writer principal for the restored definition's ownership checks. */
+  writerAgentId?: string | null;
+  writerIsUser?: boolean;
 }): Promise<{ app: AppRecord; migration: AppMigrationReport }> {
   return withAppDefinitionLock(input.appId, async () => {
     const existing = getApp(input.appId);
@@ -164,7 +178,7 @@ export async function rollbackApp(input: {
       (candidate) => candidate.version === input.version,
     );
     if (!version) throw new AppRollbackVersionNotFoundError(input.version);
-    const snapshot = rollbackSnapshot(version);
+    const snapshot = rollbackSnapshot(version, input, existing.definition);
 
     const migrated = await migrateAppSchema({
       appId: input.appId,

package/src/assets/key.ts

@@ -1,7 +1,14 @@
 export const DEFAULT_ASSET_KEY = "shared/" as const;
 export const ASSET_KEY_MAX_LENGTH = 255;
 
-export type AssetKeyResource = "task" | "workflow" | "schedule" | "page" | `fs:${string}`;
+export type AssetKeyResource =
+  | "task"
+  | "workflow"
+  | "schedule"
+  | "page"
+  | "app"
+  | "script"
+  | `fs:${string}`;
 
 export type SharedAssetNamespace = {
   root: "shared";

package/src/be/asset-key-audit.ts

@@ -12,7 +12,7 @@ export type AssetKeyAuditCode =
 export type AssetKeyAuditIssue = {
   severity: AssetKeyAuditSeverity;
   code: AssetKeyAuditCode;
-  entityType: "task" | "workflow" | "schedule" | "page" | "file";
+  entityType: "task" | "workflow" | "schedule" | "page" | "app" | "script" | "file";
   entityId: string;
   message: string;
 };
@@ -33,6 +33,8 @@ const KEY_TABLES = [
   { entityType: "workflow", sql: 'SELECT id, "key" as key FROM workflows' },
   { entityType: "schedule", sql: 'SELECT id, "key" as key FROM scheduled_tasks' },
   { entityType: "page", sql: 'SELECT id, "key" as key FROM pages' },
+  { entityType: "app", sql: 'SELECT id, "key" as key FROM apps' },
+  { entityType: "script", sql: 'SELECT id, "key" as key FROM scripts' },
   { entityType: "file", sql: 'SELECT id, "key" as key FROM asset_key_mappings' },
 ] as const;
 

package/src/be/db-queries/mcp-oauth.ts

@@ -57,6 +57,7 @@ export interface McpOAuthToken {
   revocationUrl: string | null;
   dcrClientId: string | null;
   dcrClientSecret: string | null;
+  tokenEndpointAuthMethod: string | null;
   clientSource: McpOAuthClientSource;
   status: McpOAuthStatus;
   lastErrorMessage: string | null;
@@ -74,12 +75,15 @@ export interface McpOAuthPendingRow {
   nonce: string | null;
   resourceUrl: string;
   authorizationServerIssuer: string;
+  registrationEndpoint: string | null;
   authorizeUrl: string;
   tokenUrl: string;
   revocationUrl: string | null;
   scopes: string | null;
+  registeredScopes: string[] | null;
   dcrClientId: string | null;
   dcrClientSecret: string | null;
+  tokenEndpointAuthMethod: string | null;
   redirectUri: string;
   finalRedirect: string | null;
   createdAt: string;
@@ -172,6 +176,10 @@ function decryptTokenRow(row: UnifiedMcpTokenRow): McpOAuthToken {
         : clientKey
           ? decryptSecret(row.clientSecret, clientKey)
           : row.clientSecret,
+    tokenEndpointAuthMethod:
+      typeof metadata.tokenEndpointAuthMethod === "string"
+        ? metadata.tokenEndpointAuthMethod
+        : null,
     clientSource,
     status: statusFromUnified(row.status),
     lastErrorMessage: row.lastErrorMessage,
@@ -199,18 +207,28 @@ function upsertMcpApp(input: {
   mcpServerId: string;
   resourceUrl: string;
   authorizationServerIssuer: string;
+  registrationEndpoint?: string | null;
   authorizeUrl: string;
   tokenUrl: string;
   revocationUrl?: string | null;
   scopes?: string | null;
+  // The scope set the client was actually REGISTERED with at the provider —
+  // distinct from `scopes` above, which becomes the token's GRANTED scope
+  // once a callback completes. Omit (undefined) when this call isn't a
+  // fresh registration, so the previously-recorded value survives; pass an
+  // explicit array (possibly empty) only at the point a registration — fresh
+  // or reused-as-is — is known to have happened.
+  registeredScopes?: string[];
   dcrClientId?: string | null;
   dcrClientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
   clientSource: McpOAuthClientSource;
   redirectUri?: string;
 }): string {
-  // An app is reused only through an existing authorization's exact appId.
-  // Looking up by mcpServerId alone would collapse the dormant per-user
-  // dimension and let one user's client context overwrite another's.
+  // An app is reused only through an existing authorization's or pending
+  // attempt's exact appId. Looking up by mcpServerId alone would collapse
+  // the dormant per-user dimension and let one user's client context
+  // overwrite another's.
   const existing = input.appId
     ? (getDb()
         .query(
@@ -225,11 +243,23 @@ function upsertMcpApp(input: {
         scopes: string;
       } | null)
     : null;
+  // A write means the client is currently in use / believed valid — clear
+  // any stale `invalidated` flag left over from a prior provider rejection.
+  const existingMetadata = parseObject(existing?.metadata);
   const metadata = JSON.stringify({
-    ...parseObject(existing?.metadata),
+    ...existingMetadata,
     resourceUrl: input.resourceUrl,
     authorizationServerIssuer: input.authorizationServerIssuer,
+    registrationEndpoint: input.registrationEndpoint ?? null,
     clientSource: input.clientSource,
+    ...(input.tokenEndpointAuthMethod !== undefined
+      ? { tokenEndpointAuthMethod: input.tokenEndpointAuthMethod }
+      : {}),
+    registeredScopes:
+      input.registeredScopes !== undefined
+        ? input.registeredScopes
+        : (existingMetadata.registeredScopes ?? null),
+    invalidated: false,
   });
   const encryptedClientSecret =
     input.dcrClientSecret == null || input.dcrClientSecret === ""
@@ -312,6 +342,185 @@ export function listMcpOAuthTokensForMcp(mcpServerId: string): McpOAuthToken[] {
   return rows.map(decryptTokenRow);
 }
 
+// ─── DCR client reuse (avoid re-registering on every /authorize call) ────────
+
+export interface StoredMcpOAuthClient {
+  appId: string;
+  clientId: string;
+  clientSecret: string | null;
+  authorizeUrl: string;
+  tokenUrl: string;
+  revocationUrl: string | null;
+  redirectUri: string;
+  scopes: string[];
+  // The scope set the client was registered with, tracked separately from
+  // `scopes` (which holds the token's granted scope once connected). Null
+  // means unknown — a legacy row from before this field was recorded.
+  registeredScopes: string[] | null;
+  resourceUrl: string;
+  authorizationServerIssuer: string;
+  registrationEndpoint: string | null;
+  // Null means unknown — a row written before this field was recorded. Callers
+  // must resolve it through authMethodForStoredClient, not the RFC default.
+  tokenEndpointAuthMethod: string | null;
+  clientSource: McpOAuthClientSource;
+}
+
+type RawAppRow = {
+  id: string;
+  clientId: string;
+  clientSecret: string | null;
+  clientSecretEncrypted: number;
+  authorizeUrl: string;
+  tokenUrl: string;
+  revocationUrl: string | null;
+  redirectUri: string;
+  scopes: string;
+  metadata: string;
+};
+
+function readMcpOAuthApp(appId: string): StoredMcpOAuthClient | null {
+  const row = getDb()
+    .query(
+      `SELECT id, clientId, clientSecret, clientSecretEncrypted, authorizeUrl, tokenUrl,
+              revocationUrl, redirectUri, scopes, metadata
+       FROM oauth_apps WHERE id = ?`,
+    )
+    .get(appId) as RawAppRow | null;
+  if (!row || !row.clientId) return null;
+
+  const metadata = parseObject(row.metadata);
+  if (metadata.invalidated === true) return null;
+
+  const clientSource =
+    metadata.clientSource === "manual" ||
+    metadata.clientSource === "dcr" ||
+    metadata.clientSource === "preregistered"
+      ? metadata.clientSource
+      : "dcr";
+  // Manual clients are resolved through manualClientFromToken (http layer);
+  // never surface them through this reuse path.
+  if (clientSource === "manual") return null;
+
+  const clientKey = row.clientSecretEncrypted === 1 ? getEncryptionKey() : null;
+  return {
+    appId: row.id,
+    clientId: row.clientId,
+    clientSecret:
+      row.clientSecret == null
+        ? null
+        : clientKey
+          ? decryptSecret(row.clientSecret, clientKey)
+          : row.clientSecret,
+    authorizeUrl: row.authorizeUrl,
+    tokenUrl: row.tokenUrl,
+    revocationUrl: row.revocationUrl,
+    redirectUri: row.redirectUri,
+    scopes: (() => {
+      try {
+        const parsed = JSON.parse(row.scopes || "[]");
+        return Array.isArray(parsed) ? (parsed as string[]) : [];
+      } catch {
+        return [];
+      }
+    })(),
+    resourceUrl: typeof metadata.resourceUrl === "string" ? metadata.resourceUrl : "",
+    authorizationServerIssuer:
+      typeof metadata.authorizationServerIssuer === "string"
+        ? metadata.authorizationServerIssuer
+        : "",
+    registrationEndpoint:
+      typeof metadata.registrationEndpoint === "string" ? metadata.registrationEndpoint : null,
+    registeredScopes: Array.isArray(metadata.registeredScopes)
+      ? (metadata.registeredScopes as string[])
+      : null,
+    tokenEndpointAuthMethod:
+      typeof metadata.tokenEndpointAuthMethod === "string"
+        ? metadata.tokenEndpointAuthMethod
+        : null,
+    clientSource,
+  };
+}
+
+function rawPendingAppIdForUser(mcpServerId: string, userId: string | null): string | null {
+  const row = getDb()
+    .query(
+      `SELECT p.appId FROM oauth_pending p
+       JOIN oauth_apps a ON a.id = p.appId
+       WHERE p.flow = 'mcp' AND a.mcpServerId = ?
+         AND ${userId == null ? "p.userId IS NULL" : "p.userId = ?"}
+       ORDER BY p.createdAt DESC LIMIT 1`,
+    )
+    .get(...(userId == null ? [mcpServerId] : [mcpServerId, userId])) as { appId: string } | null;
+  return row?.appId ?? null;
+}
+
+/**
+ * Find a previously-registered (or manually-preregistered, excluded here)
+ * DCR client that can be reused for this connector+user instead of running a
+ * fresh RFC 7591 registration. Checks the existing token's app first (covers
+ * re-authorizing an already-connected DCR client), then the most recent
+ * still-live pending attempt's app (covers retrying an abandoned flow before
+ * the 10-minute GC sweep). Callers must still verify AS identity
+ * (issuer/registrationEndpoint/redirectUri) against fresh discovery before
+ * trusting the result — this only returns what's stored.
+ */
+export function findReusableMcpOAuthClient(
+  mcpServerId: string,
+  userId: string | null = null,
+): StoredMcpOAuthClient | null {
+  const tokenRow = rawMcpToken(mcpServerId, userId);
+  if (tokenRow) {
+    const client = readMcpOAuthApp(tokenRow.appId);
+    if (client) return client;
+  }
+  const pendingAppId = rawPendingAppIdForUser(mcpServerId, userId);
+  if (pendingAppId) {
+    const client = readMcpOAuthApp(pendingAppId);
+    if (client) return client;
+  }
+  return null;
+}
+
+/**
+ * Mark an app's stored DCR client as invalid without deleting it (deleting
+ * would cascade and destroy authorization history). Idempotent per
+ * client_id: a client stays the same row's `clientId` until the next
+ * successful registration clears `invalidated` (see `upsertMcpApp`), so once
+ * this fires, later invalid_client errors against that SAME still-stored
+ * client — from the other call sites, or repeated automatic-refresh retries
+ * before the next /authorize re-registers — are no-ops instead of redundant
+ * writes.
+ */
+function invalidateMcpOAuthApp(appId: string): void {
+  const row = getDb().query("SELECT metadata FROM oauth_apps WHERE id = ?").get(appId) as {
+    metadata: string;
+  } | null;
+  if (!row) return;
+
+  const meta = parseObject(row.metadata);
+  if (meta.invalidated === true) return;
+
+  const metadata = JSON.stringify({ ...meta, invalidated: true });
+  getDb()
+    .query(
+      "UPDATE oauth_apps SET metadata = ?, updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?",
+    )
+    .run(metadata, appId);
+}
+
+/**
+ * Mark the stored DCR client for this connector+user as invalid. The next
+ * /authorize call's findReusableMcpOAuthClient will skip it and register
+ * fresh exactly once.
+ */
+export function invalidateMcpOAuthClient(mcpServerId: string, userId: string | null = null): void {
+  const tokenRow = rawMcpToken(mcpServerId, userId);
+  const appId = tokenRow?.appId ?? rawPendingAppIdForUser(mcpServerId, userId);
+  if (!appId) return;
+  invalidateMcpOAuthApp(appId);
+}
+
 export interface UpsertMcpOAuthTokenInput {
   mcpServerId: string;
   userId?: string | null;
@@ -322,16 +531,23 @@ export interface UpsertMcpOAuthTokenInput {
   scope?: string | null;
   resourceUrl: string;
   authorizationServerIssuer: string;
+  registrationEndpoint?: string | null;
   authorizeUrl: string;
   tokenUrl: string;
   revocationUrl?: string | null;
+  // Pass the pending row's registeredScopes (undefined if it doesn't know
+  // one) — never pass an explicit null here, or a reuse flow that already
+  // has a correctly-tracked value on the still-live app row gets clobbered.
+  registeredScopes?: string[];
   dcrClientId?: string | null;
   dcrClientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
   clientSource: McpOAuthClientSource;
   status?: McpOAuthStatus;
   lastErrorMessage?: string | null;
   lastRefreshedAt?: string | null;
   connectedByUserId?: string | null;
+  redirectUri?: string;
 }
 
 export function upsertMcpOAuthToken(input: UpsertMcpOAuthTokenInput): void {
@@ -343,12 +559,16 @@ export function upsertMcpOAuthToken(input: UpsertMcpOAuthTokenInput): void {
       mcpServerId: input.mcpServerId,
       resourceUrl: input.resourceUrl,
       authorizationServerIssuer: input.authorizationServerIssuer,
+      registrationEndpoint: input.registrationEndpoint ?? null,
       authorizeUrl: input.authorizeUrl,
       tokenUrl: input.tokenUrl,
       revocationUrl: input.revocationUrl,
+      redirectUri: input.redirectUri,
       scopes: input.scope,
+      registeredScopes: input.registeredScopes,
       dcrClientId: input.dcrClientId,
       dcrClientSecret: input.dcrClientSecret,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
       clientSource: input.clientSource,
     });
     upsertAuthorization({
@@ -423,6 +643,13 @@ export function deleteMcpOAuthToken(mcpServerId: string, userId: string | null =
        WHERE id = ?`,
     )
     .run(encryptSecret("", getEncryptionKey()), existing.id);
+  if (result.changes === 1) {
+    // Disconnect is the canonical user recovery gesture. Clear the stored
+    // DCR client too, or Reconnect silently hands back the same client_id —
+    // rawMcpToken has no status filter, so findReusableMcpOAuthClient would
+    // otherwise still surface a "revoked" token's client as reusable.
+    invalidateMcpOAuthApp(existing.appId);
+  }
   return result.changes === 1;
 }
 
@@ -441,54 +668,91 @@ export interface InsertMcpOAuthPendingInput {
   nonce?: string | null;
   resourceUrl: string;
   authorizationServerIssuer: string;
+  registrationEndpoint?: string | null;
   authorizeUrl: string;
   tokenUrl: string;
   revocationUrl?: string | null;
   scopes?: string | null;
+  // Set only when this pending attempt just performed a fresh DCR
+  // registration (or is otherwise the authority on what the client was
+  // registered with) — see upsertMcpApp's `registeredScopes` doc.
+  registeredScopes?: string[];
   dcrClientId?: string | null;
   dcrClientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
   redirectUri: string;
   finalRedirect?: string | null;
 }
 
 export function insertMcpOAuthPending(input: InsertMcpOAuthPendingInput): void {
   getDb().transaction(() => {
-    const existingToken = rawMcpToken(input.mcpServerId, input.userId ?? null);
+    const userId = input.userId ?? null;
+    const existingToken = rawMcpToken(input.mcpServerId, userId);
     const clientSource = existingToken
       ? decryptTokenRow(existingToken).clientSource
       : input.dcrClientId
         ? "dcr"
         : "preregistered";
-    // A pending attempt must not mutate the connected app. If no authorization
-    // exists yet, create a short-lived app solely to satisfy oauth_pending's FK;
-    // consume/GC removes it when it remains orphaned.
+    // A pending attempt must not mutate a *valid* connected app — a different
+    // client context might be tried concurrently while the old one keeps
+    // working. But if the connected app was invalidated (provider rejected
+    // it — see invalidateMcpOAuthClient), this pending attempt IS the
+    // recovery registration for that exact appId, so it must update the row
+    // in place; otherwise the invalidated flag never clears and every future
+    // /authorize call re-registers again (an infinite-registration loop).
+    // If no authorization exists yet, reuse the most recent still-live
+    // pending attempt's app for this same connector+user (this is what lets
+    // a retried/abandoned authorize call share one DCR client instead of
+    // registering a fresh one — see findReusableMcpOAuthClient in the http
+    // layer) instead of always creating a new row; consume/GC removes it
+    // once it's orphaned.
+    const existingTokenAppValid = existingToken
+      ? readMcpOAuthApp(existingToken.appId) != null
+      : false;
+    const reuseAppId = existingToken
+      ? existingToken.appId
+      : rawPendingAppIdForUser(input.mcpServerId, userId);
     const appId =
-      existingToken?.appId ??
-      upsertMcpApp({
-        mcpServerId: input.mcpServerId,
-        resourceUrl: input.resourceUrl,
-        authorizationServerIssuer: input.authorizationServerIssuer,
-        authorizeUrl: input.authorizeUrl,
-        tokenUrl: input.tokenUrl,
-        revocationUrl: input.revocationUrl,
-        scopes: input.scopes,
-        dcrClientId: input.dcrClientId,
-        dcrClientSecret: input.dcrClientSecret,
-        clientSource,
-        redirectUri: input.redirectUri,
-      });
+      existingToken && existingTokenAppValid
+        ? existingToken.appId
+        : upsertMcpApp({
+            ...(reuseAppId ? { appId: reuseAppId } : {}),
+            mcpServerId: input.mcpServerId,
+            resourceUrl: input.resourceUrl,
+            authorizationServerIssuer: input.authorizationServerIssuer,
+            registrationEndpoint: input.registrationEndpoint ?? null,
+            authorizeUrl: input.authorizeUrl,
+            tokenUrl: input.tokenUrl,
+            revocationUrl: input.revocationUrl,
+            scopes: input.scopes,
+            registeredScopes: input.registeredScopes,
+            dcrClientId: input.dcrClientId,
+            dcrClientSecret: input.dcrClientSecret,
+            tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
+            clientSource,
+            redirectUri: input.redirectUri,
+          });
     const contextJson = JSON.stringify({
       resourceUrl: input.resourceUrl,
       authorizationServerIssuer: input.authorizationServerIssuer,
+      registrationEndpoint: input.registrationEndpoint ?? null,
       authorizeUrl: input.authorizeUrl,
       tokenUrl: input.tokenUrl,
       revocationUrl: input.revocationUrl ?? null,
       scopes: input.scopes ?? null,
+      // Carried through the pending row so a first-ever connect's callback
+      // can restore it: consumeMcpOAuthPending's deleteOrphanMcpApp deletes
+      // this app the moment the pending row is consumed (no authorization
+      // exists yet), so the metadata written by insertMcpOAuthPending's own
+      // upsertMcpApp call above does not survive to the following
+      // upsertMcpOAuthToken call — it re-creates the row from scratch.
+      registeredScopes: input.registeredScopes ?? null,
       dcrClientId: input.dcrClientId ?? null,
       dcrClientSecret:
         input.dcrClientSecret == null
           ? null
           : encryptSecret(input.dcrClientSecret, getEncryptionKey()),
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? null,
       clientSource,
     });
     getDb()
@@ -501,12 +765,12 @@ export function insertMcpOAuthPending(input: InsertMcpOAuthPendingInput): void {
       .run(
         input.state,
         appId,
-        input.userId ? `user:${input.userId}` : "default",
+        userId ? `user:${userId}` : "default",
         encryptSecret(input.codeVerifier, getEncryptionKey()),
         input.nonce ?? null,
         input.redirectUri,
         input.finalRedirect ?? null,
-        input.userId ?? null,
+        userId,
         contextJson,
       );
   })();
@@ -569,14 +833,23 @@ export function consumeMcpOAuthPending(state: string): McpOAuthPendingRow | null
         typeof context.authorizationServerIssuer === "string"
           ? context.authorizationServerIssuer
           : "",
+      registrationEndpoint:
+        typeof context.registrationEndpoint === "string" ? context.registrationEndpoint : null,
       authorizeUrl: typeof context.authorizeUrl === "string" ? context.authorizeUrl : "",
       tokenUrl: typeof context.tokenUrl === "string" ? context.tokenUrl : "",
       revocationUrl: typeof context.revocationUrl === "string" ? context.revocationUrl : null,
       scopes: typeof context.scopes === "string" ? context.scopes : null,
+      registeredScopes: Array.isArray(context.registeredScopes)
+        ? (context.registeredScopes as string[])
+        : null,
       dcrClientId: typeof context.dcrClientId === "string" ? context.dcrClientId : null,
       dcrClientSecret: encryptedClientSecret
         ? decryptSecret(encryptedClientSecret, getEncryptionKey())
         : null,
+      tokenEndpointAuthMethod:
+        typeof context.tokenEndpointAuthMethod === "string"
+          ? context.tokenEndpointAuthMethod
+          : null,
       redirectUri: row.redirectUri,
       finalRedirect: row.finalRedirect,
       createdAt: normalizeDateRequired(row.createdAt),

package/src/be/db.ts

@@ -3936,6 +3936,22 @@ function assetSummaryQueries(types: Set<AssetEntityType>): string[] {
        FROM pages`,
     );
   }
+  if (types.has("app")) {
+    queries.push(
+      `SELECT 'app' AS entityType, id, "key", name AS label,
+              updated_at AS updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM apps`,
+    );
+  }
+  if (types.has("script")) {
+    queries.push(
+      `SELECT 'script' AS entityType, id, "key", name AS label,
+              updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM scripts`,
+    );
+  }
   if (types.has("file")) {
     queries.push(
       `SELECT 'file' AS entityType, id, "key", provider_key AS label,
@@ -3951,7 +3967,9 @@ function assetSummaryQueries(types: Set<AssetEntityType>): string[] {
 
 export function listAssetSummaries(filters?: AssetSummaryFilters): AssetSummary[] {
   const requestedTypes = new Set<AssetEntityType>(
-    filters?.types?.length ? filters.types : ["task", "workflow", "schedule", "page", "file"],
+    filters?.types?.length
+      ? filters.types
+      : ["task", "workflow", "schedule", "page", "app", "script", "file"],
   );
   const queries = assetSummaryQueries(requestedTypes);
   if (queries.length === 0) return [];
@@ -4014,6 +4032,18 @@ function currentAssetKey(entityType: AssetEntityType, id: string): string | null
           .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM pages WHERE id = ?')
           .get(id)?.key ?? null
       );
+    case "app":
+      return (
+        getDb()
+          .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM apps WHERE id = ?')
+          .get(id)?.key ?? null
+      );
+    case "script":
+      return (
+        getDb()
+          .prepare<{ key: string }, [string]>('SELECT "key" AS key FROM scripts WHERE id = ?')
+          .get(id)?.key ?? null
+      );
     case "file":
       return getAssetKeyMapping(id)?.key ?? null;
   }
@@ -4109,6 +4139,17 @@ export function moveAssetKey(input: {
           input.id,
         ]);
         break;
+      case "app":
+        getDb().run('UPDATE apps SET "key" = ?, updated_at = ? WHERE id = ?', [key, now, input.id]);
+        break;
+      case "script":
+        getDb().run('UPDATE scripts SET "key" = ?, updatedAt = ?, updated_by = ? WHERE id = ?', [
+          key,
+          now,
+          input.changedBy ?? null,
+          input.id,
+        ]);
+        break;
       case "file":
         getDb().run(
           'UPDATE asset_key_mappings SET "key" = ?, updated_at = ?, updated_by = ? WHERE id = ?',