@desplega.ai/agent-swarm 1.129.0 → 1.131.0

package/src/oauth/mcp-wrapper.ts

@@ -1,5 +1,6 @@
 import * as oauth from "oauth4webapi";
 import { isEnvFlagEnabled } from "../utils/env-flag";
+import { registerVolatileSecret, scrubSecrets } from "../utils/secret-scrubber";
 
 /**
  * MCP OAuth 2.1 wrapper.
@@ -54,6 +55,15 @@ function isPrivateIPv6(host: string): boolean {
   return false;
 }
 
+// Deliberately does NOT match "invalid_client_metadata" (a distinct DCR-only
+// error) — the `\b` boundary fails on the following underscore. Shared by
+// every MCP OAuth call site (explicit /refresh route, automatic
+// ensureMcpToken refresh, callback token exchange) that needs to decide
+// whether a provider has disowned a stored DCR client.
+export function isInvalidClientError(message: string): boolean {
+  return /invalid_client\b/i.test(message);
+}
+
 export interface SsrfGuardOptions {
   /** Allow loopback and RFC1918 hosts (dev / self-hosting). Opt-in only. */
   allowPrivateHosts?: boolean;
@@ -119,9 +129,23 @@ function defaultSsrfOptions(): SsrfGuardOptions {
   };
 }
 
-async function safeFetch(url: string, init?: RequestInit): Promise<Response> {
+// Every safeFetch call is bounded so a provider that accepts the connection
+// and never responds can't hang indefinitely. This matters most for the
+// calls made under `withAuthorizeFlowLock` (metadata discovery + DCR POST in
+// mcp-oauth.ts) — an unbounded fetch there would block every subsequent
+// /authorize for that connector+user behind the lock. 15s is generous for
+// OAuth metadata/DCR/token-endpoint round trips while still bounding the
+// lock hold time; token exchange, refresh, and revocation share the same
+// default since none of them should legitimately take longer.
+const DEFAULT_FETCH_TIMEOUT_MS = 15_000;
+
+async function safeFetch(
+  url: string,
+  init?: RequestInit,
+  timeoutMs: number = DEFAULT_FETCH_TIMEOUT_MS,
+): Promise<Response> {
   assertUrlSafe(url, defaultSsrfOptions());
-  return fetch(url, init);
+  return fetch(url, { ...init, signal: init?.signal ?? AbortSignal.timeout(timeoutMs) });
 }
 
 // ─── Protected Resource Metadata (RFC 9728) ──────────────────────────────────
@@ -225,6 +249,179 @@ export async function discoverAuthorizationServerMetadata(
   throw lastError ?? new Error(`Authorization server metadata not found at ${issuer}`);
 }
 
+// ─── Token endpoint client authentication (RFC 6749 §2.3.1 / RFC 7591 §2) ────
+
+/**
+ * The three `token_endpoint_auth_method` values agent-swarm knows how to
+ * apply at the token endpoint. Other RFC 7591 values (e.g. `private_key_jwt`)
+ * are not supported by any MCP provider we've integrated with; they fall
+ * back to the RFC 7591 §2 default below.
+ */
+export type TokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post" | "none";
+
+const KNOWN_TOKEN_ENDPOINT_AUTH_METHODS: readonly TokenEndpointAuthMethod[] = [
+  "client_secret_basic",
+  "client_secret_post",
+  "none",
+];
+
+/** RFC 7591 §2: "client_secret_basic" is the default when unspecified. */
+export const DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD: TokenEndpointAuthMethod = "client_secret_basic";
+
+/** Coerce a value we read back from a provider (or our own storage) to a known method, defaulting per RFC 7591 §2. */
+export function normalizeTokenEndpointAuthMethod(
+  value: string | null | undefined,
+): TokenEndpointAuthMethod {
+  return (KNOWN_TOKEN_ENDPOINT_AUTH_METHODS as readonly string[]).includes(value ?? "")
+    ? (value as TokenEndpointAuthMethod)
+    : DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+}
+
+export class UnsupportedTokenEndpointAuthMethodError extends Error {
+  constructor(value: string, source: string) {
+    super(
+      `Authorization server ${source} token_endpoint_auth_method "${value}", which agent-swarm cannot perform. ` +
+        `Supported methods: ${KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}. ` +
+        `Register a client manually via POST /api/mcp-oauth/:id/manual-client with a supported method.`,
+    );
+    this.name = "UnsupportedTokenEndpointAuthMethodError";
+  }
+}
+
+/**
+ * Resolve a method the authorization server stated EXPLICITLY. An omitted
+ * value falls back to the RFC 7591 §2 default, but a present-and-unsupported
+ * value (e.g. `private_key_jwt`) is an error rather than a silent downgrade:
+ * coercing it to Basic would send credentials in a scheme the AS did not
+ * select, contradicting "server wins" and failing later as invalid_client.
+ */
+export function resolveAdvertisedTokenEndpointAuthMethod(
+  value: string | null | undefined,
+  source: string,
+): TokenEndpointAuthMethod {
+  // An empty string is treated as "not stated", not as an unsupported method.
+  // A provider that serializes the field empty has told us nothing, and the
+  // DCR caller falls back to the method it requested (which the AS advertised)
+  // rather than erroring. Failing here would break such a provider outright
+  // for no safety gain, since we still authenticate the way it advertised.
+  if (value == null || value === "") return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  if (!(KNOWN_TOKEN_ENDPOINT_AUTH_METHODS as readonly string[]).includes(value)) {
+    throw new UnsupportedTokenEndpointAuthMethodError(value, source);
+  }
+  return value as TokenEndpointAuthMethod;
+}
+
+/**
+ * Read the method from a persisted client. Older rows predate this field and
+ * used client_secret_post, so preserve that known-working behavior.
+ */
+export function authMethodForStoredClient(
+  value: string | null | undefined,
+): TokenEndpointAuthMethod {
+  if (value == null || value === "") return "client_secret_post";
+  return normalizeTokenEndpointAuthMethod(value);
+}
+
+/**
+ * Pick the method to REQUEST during DCR from the AS's advertised
+ * `token_endpoint_auth_methods_supported`. Prefers the RFC-preferred Basic
+ * form, then body-post, then public (`none`); falls back to the RFC 7591 §2
+ * default when the AS didn't advertise anything we recognize.
+ */
+export function selectDcrTokenEndpointAuthMethod(
+  supportedMethods: string[] | undefined,
+): TokenEndpointAuthMethod {
+  // An empty advertised list is degenerate rather than a claim to support
+  // nothing, so it takes the RFC 8414 omitted-value default. Only a non-empty
+  // list containing nothing we can perform is a genuine incompatibility.
+  if (!supportedMethods || supportedMethods.length === 0) {
+    return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  }
+  for (const method of KNOWN_TOKEN_ENDPOINT_AUTH_METHODS) {
+    if (supportedMethods.includes(method)) return method;
+  }
+  // The AS advertised a list and none of it is something we can perform.
+  // Defaulting to Basic here would register a client we can never authenticate.
+  throw new UnsupportedTokenEndpointAuthMethodError(supportedMethods.join(", "), "advertises only");
+}
+
+/**
+ * Serialize one credential component per `application/x-www-form-urlencoded`,
+ * which RFC 6749 §2.3.1 requires before Base64-encoding the Basic header.
+ * `encodeURIComponent` is NOT that algorithm: it emits `%20` for a space where
+ * form encoding emits `+`, and it leaves `!'()*` unescaped.
+ */
+function formUrlEncodeComponent(value: string): string {
+  return new URLSearchParams({ v: value }).toString().slice(2);
+}
+
+/**
+ * Redact every credential representation we actually transmitted from an
+ * upstream error body before it can be logged, persisted, or reflected into a
+ * redirect.
+ *
+ * `scrubSecrets` alone is not enough here: `registerVolatileSecret` ignores
+ * values shorter than its minimum length, and RFC 7591 sets no floor on a
+ * `client_secret`. A provider echoing a short secret, or the form-encoded
+ * form of a longer one, would otherwise pass straight through.
+ *
+ * Every value is redacted in BOTH its raw and its form-encoded shape. Anything
+ * we put in a `URLSearchParams` body travels percent-encoded (a token like
+ * `a+b/c=` is sent as `a%2Bb%2Fc%3D`), so a provider that echoes its received
+ * body back would otherwise leak the encoded form. Doing it here rather than
+ * at each call site means a new sensitive field cannot forget one shape.
+ */
+function redactSentCredentials(text: string, sent: Array<string | null | undefined>): string {
+  let out = scrubSecrets(text);
+  for (const value of sent) {
+    if (!value) continue;
+    for (const shape of new Set([value, formUrlEncodeComponent(value)])) {
+      out = out.split(shape).join("[REDACTED]");
+    }
+  }
+  return out;
+}
+
+/**
+ * Apply the client's registered auth method to a token-endpoint request.
+ * Mutates `body` and `headers` in place so callers can build the rest of the
+ * grant-specific params around it.
+ *
+ *   - client_secret_basic → Authorization: Basic header; no creds in body.
+ *   - client_secret_post  → client_id/client_secret in the body; no header.
+ *   - none (public client) → client_id only in the body; no secret anywhere.
+ *
+ * Returns every credential representation it put on the wire so the caller can
+ * redact exactly what it sent, whatever the encoding or length.
+ */
+function applyClientAuthentication(
+  method: TokenEndpointAuthMethod,
+  clientId: string,
+  clientSecret: string | null | undefined,
+  body: URLSearchParams,
+  headers: Record<string, string>,
+): string[] {
+  if (method === "client_secret_basic" && clientSecret) {
+    const encodedSecret = formUrlEncodeComponent(clientSecret);
+    const credentials = `${formUrlEncodeComponent(clientId)}:${encodedSecret}`;
+    const encoded = Buffer.from(credentials).toString("base64");
+    // The Base64 blob is itself a credential. Register it so a provider that
+    // echoes the Authorization header back in an error body gets scrubbed.
+    registerVolatileSecret(encoded, "mcp_oauth_basic_credential");
+    headers.Authorization = `Basic ${encoded}`;
+    return [clientSecret, encodedSecret, encoded, credentials];
+  }
+
+  // A public client must identify itself in the body, whatever method was
+  // recorded for a client with no secret.
+  body.set("client_id", clientId);
+  if (method === "client_secret_post" && clientSecret) {
+    body.set("client_secret", clientSecret);
+    return [clientSecret, formUrlEncodeComponent(clientSecret)];
+  }
+  return [];
+}
+
 // ─── Dynamic Client Registration (RFC 7591) ──────────────────────────────────
 
 export interface DcrRequest {
@@ -329,6 +526,7 @@ export interface ExchangeCodeInput {
   tokenUrl: string;
   clientId: string;
   clientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
   redirectUri: string;
   code: string;
   codeVerifier: string;
@@ -344,27 +542,48 @@ export interface TokenResponse {
 }
 
 export async function exchangeCodeForTokens(input: ExchangeCodeInput): Promise<TokenResponse> {
+  // A provider can echo a submitted credential back verbatim in an error body.
+  // The thrown message is logged by the callback AND reflected into the
+  // dashboard redirect as error_description, so redact before it can escape.
+  if (input.clientSecret) registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "authorization_code",
     code: input.code,
     redirect_uri: input.redirectUri,
-    client_id: input.clientId,
     code_verifier: input.codeVerifier,
     resource: input.resource,
   });
-  if (input.clientSecret) body.set("client_secret", input.clientSecret);
+  const headers: Record<string, string> = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json",
+  };
+  const sentCredentials = applyClientAuthentication(
+    method,
+    input.clientId,
+    input.clientSecret,
+    body,
+    headers,
+  );
 
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-    },
+    headers,
     body: body.toString(),
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token exchange failed (${res.status}): ${text}`);
+    // The code and verifier are single-use but the exchange just failed, so
+    // treat them as live. Both callback sinks (console.error and the dashboard
+    // redirect's error_description) receive this message verbatim.
+    throw new Error(
+      `Token exchange failed (${res.status}): ${redactSentCredentials(text, [
+        ...sentCredentials,
+        input.code,
+        input.codeVerifier,
+      ])}`,
+    );
   }
   return (await res.json()) as TokenResponse;
 }
@@ -373,32 +592,53 @@ export interface RefreshTokenInput {
   tokenUrl: string;
   clientId: string;
   clientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
   refreshToken: string;
   resource: string;
   scopes?: string[];
 }
 
 export async function refreshMcpToken(input: RefreshTokenInput): Promise<TokenResponse> {
+  // A misbehaving/compromised provider can echo a submitted credential back
+  // verbatim in an error body (e.g. "invalid client_secret: <value>"). Both
+  // credentials we send are registered as volatile secrets so the scrub pass
+  // below redacts any echo BEFORE the message is persisted to
+  // lastErrorMessage or returned by the status endpoint.
+  if (input.clientSecret) registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  registerVolatileSecret(input.refreshToken, "mcp_oauth_refresh_token");
+
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: input.refreshToken,
-    client_id: input.clientId,
     resource: input.resource,
   });
-  if (input.clientSecret) body.set("client_secret", input.clientSecret);
   if (input.scopes && input.scopes.length > 0) body.set("scope", input.scopes.join(" "));
+  const headers: Record<string, string> = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json",
+  };
+  const sentCredentials = applyClientAuthentication(
+    method,
+    input.clientId,
+    input.clientSecret,
+    body,
+    headers,
+  );
 
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-    },
+    headers,
     body: body.toString(),
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token refresh failed (${res.status}): ${text}`);
+    throw new Error(
+      `Token refresh failed (${res.status}): ${redactSentCredentials(text, [
+        ...sentCredentials,
+        input.refreshToken,
+      ])}`,
+    );
   }
   return (await res.json()) as TokenResponse;
 }
@@ -409,28 +649,43 @@ export interface RevokeInput {
   tokenTypeHint?: "access_token" | "refresh_token";
   clientId: string;
   clientSecret?: string | null;
+  tokenEndpointAuthMethod?: string | null;
 }
 
 export async function revokeMcpToken(input: RevokeInput): Promise<void> {
-  const body = new URLSearchParams({
-    token: input.token,
-    client_id: input.clientId,
-  });
+  // Same exposure as the exchange path: the caller logs this error verbatim.
+  if (input.clientSecret) registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  registerVolatileSecret(input.token, "mcp_oauth_revoked_token");
+
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
+  const body = new URLSearchParams({ token: input.token });
   if (input.tokenTypeHint) body.set("token_type_hint", input.tokenTypeHint);
-  if (input.clientSecret) body.set("client_secret", input.clientSecret);
+  const headers: Record<string, string> = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json",
+  };
+  const sentCredentials = applyClientAuthentication(
+    method,
+    input.clientId,
+    input.clientSecret,
+    body,
+    headers,
+  );
 
   const res = await safeFetch(input.revocationUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-    },
+    headers,
     body: body.toString(),
   });
   if (!res.ok && res.status !== 200 && res.status !== 204) {
     // RFC 7009: 200 even for already-revoked. Treat any non-2xx as informational only.
     const text = await res.text().catch(() => "");
-    throw new Error(`Token revocation failed (${res.status}): ${text}`);
+    throw new Error(
+      `Token revocation failed (${res.status}): ${redactSentCredentials(text, [
+        ...sentCredentials,
+        input.token,
+      ])}`,
+    );
   }
 }
 

package/src/providers/pi-mono-adapter.ts

@@ -363,7 +363,7 @@ export async function createPiRuntimeAuth(
   for (const [envKey, provider] of PI_RUNTIME_API_KEYS) {
     const apiKey = env[envKey];
     if (apiKey) {
-      await modelRuntime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
+      await modelRuntime.setRuntimeApiKey(provider, apiKey);
     }
   }
 

package/src/scripts-runtime/credential-broker/README.md

@@ -26,7 +26,7 @@ Example binding document:
 }
 ```
 
-Scripts still opt in per request by sending a header value that contains the placeholder from `headerTemplate`. Query-string bindings work the same way: configure `queryTemplate` as `param=[REDACTED:CONFIG_KEY]`, then send a URL with that placeholder-bearing query value. The broker does not auto-add headers or query parameters in this draft.
+A header whose value still contains an unresolved `[REDACTED:...]` placeholder after substitution is dropped before egress — the literal is useless to any provider, and omitting it lets optional-auth APIs (e.g. GitHub public repos) serve unauthenticated requests on installs without the credential. Scripts still opt in per request by sending a header value that contains the placeholder from `headerTemplate`. Query-string bindings work the same way: configure `queryTemplate` as `param=[REDACTED:CONFIG_KEY]`, then send a URL with that placeholder-bearing query value. The broker does not auto-add headers or query parameters in this draft.
 
 ## Management
 

package/src/scripts-runtime/credential-broker/fetch-patch.ts

@@ -83,8 +83,10 @@ export function patchFetchWithCredentialBroker(
   bindings: ResolvedCredentialBinding[],
   failedBindings: FailedCredentialBinding[] = [],
 ): void {
-  if (bindings.length === 0 && failedBindings.length === 0) return;
-
+  // Always install: even with zero resolved bindings (fresh install, identity
+  // without the credential) the wrapper must strip unresolved placeholder
+  // headers below, or the literal placeholder rides to the provider as a
+  // guaranteed 401 and optional-auth APIs stop serving public data.
   const originalFetch = globalThis.fetch;
 
   globalThis.fetch = function patchedFetch(
@@ -112,6 +114,14 @@ export function patchFetchWithCredentialBroker(
           headersModified = true;
         }
       }
+      // A placeholder still present after substitution means the credential is
+      // not configured (or not allowed) for this identity and host: drop the
+      // header instead of sending the literal, so optional-auth providers can
+      // still serve public data unauthenticated.
+      if (value.includes("[REDACTED:")) {
+        headersModified = true;
+        continue;
+      }
       newHeaders.set(key, value);
     }
 

package/src/scripts-runtime/sdk-allowlist.ts

@@ -148,6 +148,7 @@ export const SDK_TOOL_NAME_MAP = {
   app_patch: "app-patch",
   app_query: "app-query",
   app_rollback: "app-rollback",
+  app_sync: "app-sync",
   app_upsert: "app-upsert",
   page_create: "create_page",
   page_delete: "delete-page", // destructive

package/src/scripts-runtime/stdlib/fetch.ts

@@ -11,10 +11,14 @@ export async function runtimeFetch(
   let lastError: unknown;
 
   for (let attempt = 0; attempt < retries; attempt++) {
+    if (signal?.aborted) {
+      throw signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+    }
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     const onAbort = () => controller.abort();
     signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) controller.abort();
 
     try {
       const res = await fetch(input, { ...init, signal: controller.signal });
@@ -24,6 +28,8 @@ export async function runtimeFetch(
       }
       return res;
     } catch (error) {
+      // Caller abort is terminal — only the controller's own timeout abort retries.
+      if (signal?.aborted) throw signal.reason ?? error;
       lastError = error;
       if (attempt === retries - 1) break;
     } finally {

package/src/scripts-runtime/types/stdlib.d.ts

@@ -455,6 +455,7 @@ declare module "swarm-sdk" {
       migration?: Record<string, unknown>;
       forceElementBreak?: string[];
     }): Promise<unknown>;
+    app_sync(args: { appId: string; model?: string; source?: string }): Promise<unknown>;
     app_upsert(args: {
       name: string;
       description?: string;

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -437,6 +437,7 @@ declare module "swarm-sdk" {
       migration?: Record<string, unknown>;
       forceElementBreak?: string[];
     }): Promise<unknown>;
+    app_sync(args: { appId: string; model?: string; source?: string }): Promise<unknown>;
     app_upsert(args: {
       name: string;
       description?: string;

package/src/server.ts

@@ -16,6 +16,7 @@ import { registerAppListTool } from "./tools/app-list";
 import { registerAppPatchTool } from "./tools/app-patch";
 import { registerAppQueryTool } from "./tools/app-query";
 import { registerAppRollbackTool } from "./tools/app-rollback";
+import { registerAppSyncTool } from "./tools/app-sync";
 import { registerAppUpsertTool } from "./tools/app-upsert";
 import { registerCancelTaskTool } from "./tools/cancel-task";
 import { registerContextDiffTool } from "./tools/context-diff";
@@ -477,6 +478,7 @@ export function createServer(opts: { scriptsOnly?: boolean; fullSurface?: boolea
     registerAppPatchTool(server);
     registerAppQueryTool(server);
     registerAppRollbackTool(server);
+    registerAppSyncTool(server);
     registerAppUpsertTool(server);
     registerCreatePageTool(server);
     registerDeletePageTool(server);

package/src/tests/apps-rbac.test.ts

@@ -8,6 +8,7 @@ import {
 } from "node:http";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { closeDb, createAgent, createUser, getDb, getTaskById, initDb } from "../be/db";
+import { upsertScriptByName } from "../be/scripts/db";
 import { type IdentityActor, mintToken } from "../be/users";
 import { handleApps } from "../http/apps";
 import { resolveHttpRequestAuth } from "../http/auth";
@@ -340,3 +341,112 @@ describe("app viewer identity", () => {
     expect(getTaskById(agentAction.body.taskId)?.requestedByUserId).toBeUndefined();
   });
 });
+
+describe("user writers and the script ownership gate", () => {
+  async function saveScript(scope: "agent" | "global", ownerId: string | null): Promise<string> {
+    const result = await upsertScriptByName({
+      name: `apps_rbac_${scope}_${crypto.randomUUID().replaceAll("-", "")}`,
+      scope,
+      scopeId: ownerId,
+      agentId: ownerId,
+      source: "export default function run() { return { ok: true }; }",
+      description: "Ownership-gate fixture",
+      intent: "Prove the user-writer ownership gate",
+      signatureJson: JSON.stringify({ args: { type: "object" }, result: { type: "object" } }),
+      typeChecked: true,
+      embeddingMode: "skip",
+    });
+    return result.script.id;
+  }
+
+  function withSource(scriptId: string) {
+    return {
+      ...definition,
+      models: {
+        note: {
+          columns: {
+            title: { kind: "string" },
+            issueKey: { kind: "string" },
+            body: { kind: "string", source: { of: "gh", field: "body" } },
+          },
+          sources: { gh: { connector: "script", scriptId, joinKey: "issueKey" } },
+        },
+      },
+    };
+  }
+
+  test("a web user cannot wire agent-scoped or catalog scripts; stored paths stay editable", async () => {
+    const ownerId = crypto.randomUUID();
+    createAgent({ id: ownerId, name: "apps-rbac-script-owner", isLead: false, status: "idle" });
+    const foreignId = await saveScript("agent", ownerId);
+    const globalId = await saveScript("global", null);
+    type Issues = { issues?: Array<{ path: string; message: string }> };
+
+    // A user write carries no agent id — it must NOT pass like the operator.
+    const asSource = await request<Issues>("/api/apps", "user", {
+      method: "POST",
+      body: JSON.stringify({ name: "User foreign source", definition: withSource(foreignId) }),
+    });
+    expect(asSource.status).toBe(400);
+    expect(
+      asSource.body.issues?.some(
+        (issue) =>
+          issue.path === "models.note.sources.gh.scriptId" &&
+          issue.message.includes("agent-scoped to another agent"),
+      ),
+    ).toBe(true);
+
+    const asAction = await request<Issues>("/api/apps", "user", {
+      method: "POST",
+      body: JSON.stringify({
+        name: "User foreign action",
+        definition: {
+          ...definition,
+          actions: { steal: { kind: "script", scriptId: foreignId } },
+        },
+      }),
+    });
+    expect(asAction.status).toBe(400);
+    expect(
+      asAction.body.issues?.some(
+        (issue) =>
+          issue.path === "actions.steal.scriptId" &&
+          issue.message.includes("agent-scoped to another agent"),
+      ),
+    ).toBe(true);
+
+    // Owner-less global (catalog) scripts sync with the LEAD's credentials —
+    // a user may not wire those as sources either.
+    const globalApp = await request<Issues>("/api/apps", "user", {
+      method: "POST",
+      body: JSON.stringify({ name: "User global source", definition: withSource(globalId) }),
+    });
+    expect(globalApp.status).toBe(400);
+    expect(
+      globalApp.body.issues?.some(
+        (issue) =>
+          issue.path === "models.note.sources.gh.scriptId" &&
+          issue.message.includes("only that agent or the operator"),
+      ),
+    ).toBe(true);
+
+    // An operator-authored app carrying the foreign script at a stored path
+    // stays editable for users — grandfathering is path-exact, not skipped.
+    const operatorApp = await request<{ app: { id: string } }>("/api/apps", "operator", {
+      method: "POST",
+      body: JSON.stringify({
+        name: "Operator foreign action",
+        definition: { ...definition, actions: { run: { kind: "script", scriptId: foreignId } } },
+      }),
+    });
+    expect(operatorApp.status).toBe(201);
+
+    const edited = await request<Issues>(`/api/apps/${operatorApp.body.app.id}`, "user", {
+      method: "PATCH",
+      body: JSON.stringify({
+        definition: { models: { note: { columns: { extra: { kind: "string" } } } } },
+      }),
+    });
+    expect(edited.status).toBe(200);
+  });
+});

package/src/tests/apps-spike2.test.ts

@@ -1064,7 +1064,7 @@ describe("custom app actions", () => {
     );
     expect(started.status).toBe(200);
     expect(started.body).toMatchObject({ ok: true, status: "pending" });
-    const observed = await request<{ id: string; agentId: string; task: string }>(
+    const observed = await request<{ id: string; agentId: string; task: string; key: string }>(
       `/api/tasks/${started.body.taskId}`,
     );
     expect(observed.status).toBe(200);
@@ -1072,6 +1072,9 @@ describe("custom app actions", () => {
     expect(observed.body.agentId).toBe(LEAD_ID);
     expect(observed.body.task).toContain(`[App action] app=${appId}`);
     expect(observed.body.task).toContain('input={"idea":"42"}');
+    // The app-namespaced asset key lets a swarm-tasks source pull these back
+    // via config.assetKey.
+    expect(observed.body.key).toBe(`shared/app:${appId}/action:investigate/`);
   });
 });