@desplega.ai/agent-swarm 1.130.0 → 1.131.1

package/dist/{http-xdbbtmhx.js → http-9xh6ta4r.js}

@@ -152,7 +152,7 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-haanc4qd.js";
+} from "./cli-jevgrb4w.js";
 import"./cli-1z7048dy.js";
 import {
   Anthropic
@@ -173,34 +173,34 @@ import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-z9q7pb38.js";
+} from "./cli-g74vpjp2.js";
 import {
   createResumeFollowUp,
   createWorkerTaskFollowUp
-} from "./cli-tfw3c0y1.js";
+} from "./cli-3ty0t082.js";
 import {
   calculateNextRun,
   dispatchScheduleTarget,
   ensure,
   initialize,
   require_dist
-} from "./cli-dakxgk70.js";
+} from "./cli-ycrnynpw.js";
 import {
   getModelsCatalog
-} from "./cli-qbb2ten8.js";
+} from "./cli-t8d349cy.js";
 import {
   normalizeModelKey
-} from "./cli-vr2f46zj.js";
+} from "./cli-114fvtmj.js";
 import {
   getUserGrant
-} from "./cli-tp519bjz.js";
+} from "./cli-sy7jk3tx.js";
 import {
   can,
   clearAuditSink,
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-hntzdchd.js";
+} from "./cli-bqw0mt1n.js";
 import {
   ensureAgentFsCredentialsForAgent,
   extractArgsJsonSchema,
@@ -210,11 +210,12 @@ import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-fs153s3x.js";
+} from "./cli-4rkfg1wx.js";
 import {
   collectScriptReferences,
+  getApp,
   listAppRecords
-} from "./cli-brebbsen.js";
+} from "./cli-gecy3z2s.js";
 import {
   RawLlmConfigSchema,
   RawLlmOutputSchema,
@@ -234,7 +235,7 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-xdrmxvd4.js";
+} from "./cli-jbcva0xj.js";
 import"./cli-3dpj7atn.js";
 import {
   ConnectionAuthInputSchema,
@@ -242,6 +243,7 @@ import {
   MIN_SCRIPT_WALL_CLOCK_MS,
   applyMcpOAuthRefresh,
   assertUrlSafe,
+  authMethodForStoredClient,
   buildAuthorizeUrl,
   buildSandboxedCommand,
   buildScriptCredentialBindingsWithFailures,
@@ -281,6 +283,7 @@ import {
   listScripts,
   listVendoredOpenapiEntries,
   markMcpOAuthTokenStatus,
+  normalizeTokenEndpointAuthMethod,
   oauthAppToProviderConfig,
   publicEndpointSsrfOptions,
   readStreamCapped,
@@ -289,25 +292,29 @@ import {
   refreshScriptConnection,
   registerClient,
   require_typescript,
+  resolveAdvertisedTokenEndpointAuthMethod,
+  restoreScratchScriptLastUsedIfUnchanged,
   revokeMcpToken,
   rotateScriptApiSecret,
   runScript,
   sandboxSpawnEnv,
+  selectDcrTokenEndpointAuthMethod,
   setMcpServerAuthMethod,
   setScriptConnectionEnabled,
+  touchScratchScriptLastUsed,
   updateScriptApi,
   upsertCredentialBinding,
   upsertMcpOAuthToken,
   upsertScriptByName,
   upsertScriptConnection
-} from "./cli-q8zwffx0.js";
+} from "./cli-6dp3ydxa.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
   searchScripts
-} from "./cli-1px8pn1s.js";
+} from "./cli-g1re8r05.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -315,7 +322,7 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-mf009e0j.js";
+} from "./cli-se2p6rkb.js";
 import"./cli-0258203w.js";
 import {
   acquireOAuthRefreshLock,
@@ -340,14 +347,14 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-1mj7yz1r.js";
+} from "./cli-nrkkknat.js";
 import"./cli-fad8m16k.js";
 import {
   FilesError,
   getFileStorageProvider,
   normalizeFilesError
 } from "./cli-bnx54kxv.js";
-import"./cli-r62me33w.js";
+import"./cli-6dpytdr2.js";
 import {
   findUserById,
   fingerprintApiKey,
@@ -363,15 +370,15 @@ import {
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-m8fs5ttq.js";
+} from "./cli-aca5pz9f.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-mhr8tq3v.js";
+} from "./cli-2f07m0xr.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-qcsjdppx.js";
+} from "./cli-rgrfzg8z.js";
 import"./cli-k9qkf1hw.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-t930g0xh.js";
@@ -749,7 +756,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-s18zzkfp.js";
+} from "./cli-50vbt00w.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -762,7 +769,7 @@ import {
   isEnvFlagEnabled,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -784,7 +791,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-7v5dhmc8.js";
+} from "./cli-ccf9vy7q.js";
 import {
   array,
   exports_external,
@@ -799,20 +806,20 @@ import {
 } from "./cli-9aryf9tv.js";
 import {
   bedrockProviderModule
-} from "./cli-t5tsq67k.js";
+} from "./cli-9dr5qzc0.js";
 import"./cli-cwy5hqbq.js";
 import {
   setBedrockProviderModule
-} from "./cli-6nh2qxvh.js";
+} from "./cli-darcwax3.js";
 import"./cli-jvv0g8bh.js";
 import"./cli-r6kqqbj0.js";
-import"./cli-ch7t5v7n.js";
+import"./cli-6map995v.js";
 import"./cli-4wgngmwv.js";
 import"./cli-vapyk8sw.js";
 import"./cli-zyxs93y9.js";
-import"./cli-vgexpfsr.js";
+import"./cli-57khth04.js";
 import"./cli-y2apkfe2.js";
-import"./cli-w10fkrf1.js";
+import"./cli-akdvwc9v.js";
 import"./cli-8wrympd7.js";
 import"./cli-7sgrxg9a.js";
 import"./cli-3fj60etf.js";
@@ -836,6 +843,107 @@ import {
 } from "node:http";
 init_db();
 
+// src/be/scripts/retention.ts
+init_db();
+var SCRATCH_RETENTION_DAYS = 14;
+var SCRATCH_GC_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var scratchGcTimer = null;
+function appReferencedScriptIds(candidateIds) {
+  const ids = new Set;
+  for (const app of listAppRecords()) {
+    for (const scriptId of collectScriptReferences(app.definition).keys()) {
+      ids.add(scriptId);
+    }
+    if (app.definitionError === undefined)
+      continue;
+    const serialized = JSON.stringify(app.definition ?? null);
+    for (const id of candidateIds) {
+      if (!ids.has(id) && serialized.includes(id))
+        ids.add(id);
+    }
+  }
+  return ids;
+}
+function scriptApiReferencedScriptIds() {
+  const rows = getDb().prepare("SELECT DISTINCT scriptId FROM script_apis").all();
+  return new Set(rows.map((row) => row.scriptId));
+}
+function workflowReferencedAgentScriptKeys() {
+  const keys = new Set;
+  for (const workflow of listWorkflows()) {
+    if (!workflow.createdByAgentId)
+      continue;
+    for (const node of workflow.definition.nodes) {
+      if (node.type !== "swarm-script")
+        continue;
+      const scriptName = node.config.scriptName;
+      const scope = node.config.scope;
+      if (typeof scriptName !== "string" || scope === "global")
+        continue;
+      keys.add(`${scriptName}::${workflow.createdByAgentId}`);
+    }
+  }
+  return keys;
+}
+function workflowReferencedScratchNamesForOwnerlessWorkflows() {
+  const names = new Set;
+  for (const workflow of listWorkflows()) {
+    if (workflow.createdByAgentId)
+      continue;
+    for (const node of workflow.definition.nodes) {
+      if (node.type !== "swarm-script")
+        continue;
+      const scriptName = node.config.scriptName;
+      const scope = node.config.scope;
+      if (typeof scriptName !== "string" || scope === "global")
+        continue;
+      names.add(scriptName);
+    }
+  }
+  return names;
+}
+function purgeExpiredScratchScripts(now = new Date) {
+  const cutoff = new Date(now.getTime() - SCRATCH_RETENTION_DAYS * 24 * 60 * 60 * 1000).toISOString();
+  const candidates = getDb().prepare(`SELECT id, name, scopeId FROM scripts
+       WHERE scope = 'agent'
+         AND isScratch = 1
+         AND name GLOB 'scratch-*'
+         AND updatedAt < ?`).all(cutoff);
+  if (candidates.length === 0)
+    return 0;
+  const referenced = appReferencedScriptIds(candidates.map((row) => row.id));
+  const apiReferenced = scriptApiReferencedScriptIds();
+  const workflowReferenced = workflowReferencedAgentScriptKeys();
+  const ownerlessWorkflowReferencedNames = workflowReferencedScratchNamesForOwnerlessWorkflows();
+  const idsToDelete = candidates.filter((row) => !referenced.has(row.id)).filter((row) => !apiReferenced.has(row.id)).filter((row) => !(row.scopeId && workflowReferenced.has(`${row.name}::${row.scopeId}`))).filter((row) => !ownerlessWorkflowReferencedNames.has(row.name)).map((row) => row.id);
+  if (idsToDelete.length === 0)
+    return 0;
+  const placeholders = idsToDelete.map(() => "?").join(",");
+  return getDb().prepare(`DELETE FROM scripts WHERE id IN (${placeholders}) RETURNING id`).all(...idsToDelete).length;
+}
+function runScratchScriptGc(label) {
+  try {
+    const purged = purgeExpiredScratchScripts();
+    console.log(`[scratch-script-gc] ${label} purge removed ${purged} scratch script row(s)`);
+  } catch (err) {
+    console.error(`[scratch-script-gc] ${label} purge failed:`, err.message);
+  }
+}
+function startScratchScriptGc(intervalMs = SCRATCH_GC_INTERVAL_MS) {
+  if (scratchGcTimer)
+    return;
+  runScratchScriptGc("Initial");
+  scratchGcTimer = setInterval(() => runScratchScriptGc("Periodic"), intervalMs);
+  if (typeof scratchGcTimer.unref === "function")
+    scratchGcTimer.unref();
+}
+function stopScratchScriptGc() {
+  if (!scratchGcTimer)
+    return;
+  clearInterval(scratchGcTimer);
+  scratchGcTimer = null;
+}
+
 // src/be/seed-capabilities.ts
 init_db();
 var LEGACY_ALWAYS_ON_DEFAULTS = [
@@ -2619,7 +2727,7 @@ var listAssetsRoute = route({
   tags: ["Assets"],
   query: exports_external.object({
     keyPrefix: AssetKeySchema.optional(),
-    types: exports_external.string().optional().describe("Comma-separated task,workflow,schedule,page,file list"),
+    types: exports_external.string().optional().describe("Comma-separated task,workflow,schedule,page,app,script,file list"),
     limit: exports_external.coerce.number().int().min(1).max(1000).optional()
   }),
   responses: {
@@ -2659,6 +2767,41 @@ function ensureOperator(req, res) {
   jsonError(res, "Operator access required", 403);
   return false;
 }
+var moveAssetBodySchema = exports_external.object({ key: AssetKeySchema });
+var moveAssetSuccessSchema = exports_external.object({
+  entityType: AssetEntityTypeSchema,
+  id: exports_external.string(),
+  key: AssetKeySchema
+});
+var moveAssetResponses = {
+  200: { description: "Asset namespace updated", schema: moveAssetSuccessSchema },
+  400: { description: "Invalid namespace" },
+  403: { description: "Move not authorized" },
+  404: { description: "Asset not found" },
+  409: { description: "Moves blocked until audit warnings are repaired" }
+};
+var moveAppAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/app/{id}/key",
+  pattern: ["api", "assets", "app", null, "key"],
+  summary: "Move an app to another logical namespace",
+  tags: ["Assets"],
+  params: exports_external.object({ id: exports_external.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "app.manage" }
+});
+var moveScriptAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/script/{id}/key",
+  pattern: ["api", "assets", "script", null, "key"],
+  summary: "Move a script to another logical namespace",
+  tags: ["Assets"],
+  params: exports_external.object({ id: exports_external.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "script.global.write" }
+});
 var moveAssetRoute = route({
   method: "patch",
   path: "/api/assets/{entityType}/{id}/key",
@@ -2667,25 +2810,23 @@ var moveAssetRoute = route({
   description: "Updates namespace metadata only. Provider-backed files keep the same provider key, org, and drive; no remote move occurs. Personal keys are labels, not a privacy guarantee.",
   tags: ["Assets"],
   params: exports_external.object({ entityType: AssetEntityTypeSchema, id: exports_external.string().min(1) }),
-  body: exports_external.object({ key: AssetKeySchema }),
-  responses: {
-    200: {
-      description: "Asset namespace updated",
-      schema: exports_external.object({
-        entityType: AssetEntityTypeSchema,
-        id: exports_external.string(),
-        key: AssetKeySchema
-      })
-    },
-    400: { description: "Invalid namespace" },
-    403: { description: "Move not authorized" },
-    404: { description: "Asset not found" },
-    409: { description: "Moves blocked until audit warnings are repaired" }
-  },
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
   rbac: {
-    ungated: "preserves each entity's current mutation posture; task moves additionally use task.fs.mutate, file moves require operator authentication, and personal destinations require a matching trusted user"
+    ungated: "preserves each entity's current mutation posture; task moves use task.fs.mutate, app moves use app.manage, scripts preserve agent ownership/global-lead rules, file moves require operator authentication, and personal destinations require a matching trusted user"
   }
 });
+function assetMovePrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator")
+    return { kind: "operator" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (!myAgentId)
+    return null;
+  const agent = getAgentById(myAgentId);
+  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
+}
 function canMutateTaskNamespace(task, myAgentId, req) {
   const resource = {
     kind: "task",
@@ -2693,20 +2834,32 @@ function canMutateTaskNamespace(task, myAgentId, req) {
     agentId: task.agentId,
     creatorAgentId: task.creatorAgentId
   };
-  const auth = getRequestAuth(req);
-  let principal;
-  if (auth?.kind === "operator") {
-    principal = { kind: "operator" };
-  } else if (auth?.kind === "user") {
-    principal = { kind: "user", userId: auth.userId };
-  } else {
-    if (!myAgentId)
-      return false;
-    const agent = getAgentById(myAgentId);
-    principal = { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
-  }
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal)
+    return false;
   return can({ principal, verb: "task.fs.mutate", resource, source: "http" }).allow;
 }
+function canManageAppNamespace(id, req, myAgentId) {
+  const principal = assetMovePrincipal(req, myAgentId);
+  return !!principal && can({ principal, verb: "app.manage", resource: { kind: "app", appId: id }, source: "http" }).allow;
+}
+function canManageScriptNamespace(script, req, myAgentId) {
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal)
+    return false;
+  if (principal.kind === "operator")
+    return true;
+  if (principal.kind !== "agent")
+    return false;
+  if (script.scope === "agent")
+    return script.scopeId === principal.agentId;
+  return can({
+    principal,
+    verb: "script.global.write",
+    resource: { kind: "owned", scope: "global" },
+    source: "http"
+  }).allow;
+}
 async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
   if (keyAuditRoute.match(req.method, pathSegments)) {
     const parsed = await keyAuditRoute.parse(req, res, pathSegments, queryParams);
@@ -2768,7 +2921,7 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
     }
     return true;
   }
-  if (moveAssetRoute.match(req.method, pathSegments)) {
+  if (moveAppAssetRoute.match(req.method, pathSegments) || moveScriptAssetRoute.match(req.method, pathSegments) || moveAssetRoute.match(req.method, pathSegments)) {
     const parsed = await moveAssetRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
@@ -2785,6 +2938,27 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
         return true;
       }
     }
+    if (parsed.params.entityType === "app") {
+      if (!getApp(parsed.params.id)) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageAppNamespace(parsed.params.id, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this app namespace", 403);
+        return true;
+      }
+    }
+    if (parsed.params.entityType === "script") {
+      const script = getScriptById(parsed.params.id);
+      if (!script) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageScriptNamespace(script, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this script namespace", 403);
+        return true;
+      }
+    }
     try {
       const actor = resolveHttpAuditUserId(req, myAgentId);
       const key = authorizeAssetKeyWrite(parsed.body.key, actor);
@@ -6589,7 +6763,8 @@ var DiscoveryResultSchema = exports_external.object({
   scopes: exports_external.array(exports_external.string()),
   requiresOAuth: exports_external.literal(true),
   dcrSupported: exports_external.boolean(),
-  bearerMethodsSupported: exports_external.array(exports_external.string()).nullable()
+  bearerMethodsSupported: exports_external.array(exports_external.string()).nullable(),
+  tokenEndpointAuthMethodsSupported: exports_external.array(exports_external.string()).nullable()
 });
 var MetadataResponseSchema = exports_external.union([
   exports_external.object({ requiresOAuth: exports_external.literal(false) }),
@@ -6645,7 +6820,8 @@ function manualClientFromToken(token) {
     authorizeUrl: token.authorizeUrl,
     tokenUrl: token.tokenUrl,
     revocationUrl: token.revocationUrl,
-    scopes: splitScopes(token.scope)
+    scopes: splitScopes(token.scope),
+    tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod)
   };
 }
 async function discoverForMcp(resourceUrl) {
@@ -6667,7 +6843,8 @@ async function discoverForMcp(resourceUrl) {
     scopes: prmd.scopes_supported ?? as.scopes_supported ?? [],
     requiresOAuth: true,
     dcrSupported: !!as.registration_endpoint,
-    bearerMethodsSupported: prmd.bearer_methods_supported ?? null
+    bearerMethodsSupported: prmd.bearer_methods_supported ?? null,
+    tokenEndpointAuthMethodsSupported: as.token_endpoint_auth_methods_supported ?? null
   };
 }
 function getMcpOrError(res, mcpServerId) {
@@ -6824,7 +7001,8 @@ var manualClientRoute = route({
     authorizeUrl: exports_external.string().url().optional(),
     tokenUrl: exports_external.string().url().optional(),
     revocationUrl: exports_external.string().url().optional(),
-    scopes: exports_external.array(exports_external.string()).optional()
+    scopes: exports_external.array(exports_external.string()).optional(),
+    tokenEndpointAuthMethod: exports_external.enum(["client_secret_basic", "client_secret_post", "none"]).optional()
   }),
   responses: {
     200: {
@@ -6886,7 +7064,8 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
         authorizeUrl: discovery.authorizeUrl,
         tokenUrl: discovery.tokenUrl,
         revocationUrl: discovery.revocationUrl,
-        scopes: reusable.scopes.length > 0 ? reusable.scopes : discovery.scopes
+        scopes: reusable.scopes.length > 0 ? reusable.scopes : discovery.scopes,
+        tokenEndpointAuthMethod: authMethodForStoredClient(reusable.tokenEndpointAuthMethod)
       };
     }
   }
@@ -6900,15 +7079,17 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
       return null;
     }
     const scopes2 = q.scopes ? splitScopes(q.scopes) : discovery.scopes;
+    const requestedAuthMethod = selectDcrTokenEndpointAuthMethod(discovery.tokenEndpointAuthMethodsSupported ?? undefined);
     const dcr = await registerClient(discovery.registrationEndpoint, {
       client_name: `agent-swarm (${server.name})`,
       redirect_uris: [callbackRedirectUri()],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      token_endpoint_auth_method: "client_secret_basic",
+      token_endpoint_auth_method: requestedAuthMethod,
       application_type: "web",
       scope: scopes2.join(" ") || undefined
     });
+    const registeredAuthMethod = dcr.token_endpoint_auth_method ? resolveAdvertisedTokenEndpointAuthMethod(dcr.token_endpoint_auth_method, "returned") : requestedAuthMethod;
     registeredScopes = scopes2;
     client = {
       clientId: dcr.client_id,
@@ -6918,7 +7099,8 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
       authorizeUrl: discovery.authorizeUrl,
       tokenUrl: discovery.tokenUrl,
       revocationUrl: discovery.revocationUrl,
-      scopes: scopes2
+      scopes: scopes2,
+      tokenEndpointAuthMethod: registeredAuthMethod
     };
   }
   const scopes = q.scopes ? splitScopes(q.scopes) : client.scopes;
@@ -6957,6 +7139,7 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
     registeredScopes,
     dcrClientId: client.clientId,
     dcrClientSecret: client.clientSecret,
+    tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
     redirectUri: callbackRedirectUri(),
     finalRedirect: q.redirect ?? null
   });
@@ -6996,6 +7179,7 @@ async function completeMcpOAuthCallback(res, query) {
       tokenUrl: pending.tokenUrl,
       clientId: pending.dcrClientId ?? "",
       clientSecret: pending.dcrClientSecret ?? undefined,
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       redirectUri: pending.redirectUri,
       code: query.code,
       codeVerifier: pending.codeVerifier,
@@ -7021,6 +7205,7 @@ async function completeMcpOAuthCallback(res, query) {
       registeredScopes: pending.registeredScopes ?? undefined,
       dcrClientId: pending.dcrClientId,
       dcrClientSecret: pending.dcrClientSecret,
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       clientSource,
       lastRefreshedAt: new Date().toISOString()
     });
@@ -7166,6 +7351,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         tokenUrl: existing.tokenUrl,
         clientId: existing.dcrClientId ?? "",
         clientSecret: existing.dcrClientSecret ?? undefined,
+        tokenEndpointAuthMethod: authMethodForStoredClient(existing.tokenEndpointAuthMethod),
         refreshToken: existing.refreshToken,
         resource: existing.resourceUrl
       });
@@ -7208,7 +7394,8 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
           token: token.accessToken,
           tokenTypeHint: "access_token",
           clientId: token.dcrClientId ?? "",
-          clientSecret: token.dcrClientSecret ?? undefined
+          clientSecret: token.dcrClientSecret ?? undefined,
+          tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod)
         });
       } catch (err) {
         console.warn("[mcp-oauth] revocation call failed (continuing with local delete):", err instanceof Error ? err.message : err);
@@ -7234,6 +7421,8 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
       let authorizationServerIssuer = overrides.authorizationServerIssuer ?? null;
       let resourceUrl = server.url;
       let scopes = overrides.scopes ?? [];
+      let tokenEndpointAuthMethod = overrides.tokenEndpointAuthMethod ? normalizeTokenEndpointAuthMethod(overrides.tokenEndpointAuthMethod) : undefined;
+      let advertisedAuthMethods = null;
       if (!authorizeUrl || !tokenUrl) {
         const discovery = await discoverForMcp(server.url);
         if (!discovery) {
@@ -7247,6 +7436,11 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         resourceUrl = discovery.resourceUrl;
         if (scopes.length === 0)
           scopes = discovery.scopes;
+        advertisedAuthMethods = discovery.tokenEndpointAuthMethodsSupported;
+      }
+      if (!tokenEndpointAuthMethod) {
+        const postUnsupported = advertisedAuthMethods !== null && advertisedAuthMethods.length > 0 && !advertisedAuthMethods.includes("client_secret_post");
+        tokenEndpointAuthMethod = postUnsupported ? selectDcrTokenEndpointAuthMethod(advertisedAuthMethods ?? undefined) : authMethodForStoredClient(undefined);
       }
       if (!authorizationServerIssuer) {
         jsonError(res, "authorizationServerIssuer is required when endpoints are provided manually.", 400);
@@ -7265,6 +7459,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         revocationUrl,
         dcrClientId: overrides.clientId,
         dcrClientSecret: overrides.clientSecret ?? null,
+        tokenEndpointAuthMethod,
         clientSource: "manual",
         status: "error",
         lastErrorMessage: "Manual client pre-registered; awaiting authorize flow."
@@ -16464,12 +16659,14 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       return true;
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
+    let namedScript = null;
     if (parsed.body.name) {
       const script = resolveScript(parsed.body.name, agent.id, parsed.body.scope);
       if (!script) {
         jsonError(res, "Script not found", 404);
         return true;
       }
+      namedScript = script;
       source = script.source;
       fsMode = script.fsMode;
     }
@@ -16478,6 +16675,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       return true;
     }
     const startedAt = new Date().toISOString();
+    const runStartTouch = namedScript?.isScratch ? touchScratchScriptLastUsed(namedScript.id) : null;
     const credentials = await buildScriptCredentialBindingsWithFailures({ agentId: agent.id });
     const output = await runScript({
       source,
@@ -16489,8 +16687,14 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agent.id })
     });
+    const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
+    if (namedScript?.isScratch && ok) {
+      touchScratchScriptLastUsed(namedScript.id);
+    } else if (namedScript?.isScratch && runStartTouch) {
+      restoreScratchScriptLastUsedIfUnchanged(namedScript.id, namedScript.updatedAt, runStartTouch);
+    }
     let kvSaved;
-    if (parsed.body.idempotencyKey && !output.error && output.exitCode === 0) {
+    if (parsed.body.idempotencyKey && ok) {
       const kvNamespace = `script:executions`;
       const kvKey = parsed.body.idempotencyKey;
       const kvValue = {
@@ -16509,7 +16713,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       kvSaved = { namespace: kvNamespace, key: kvKey };
     }
     let autoSaved;
-    if (parsed.body.source && !output.error && output.exitCode === 0) {
+    if (parsed.body.source && ok) {
       const slug = scratchSlug(parsed.body.intent, parsed.body.source);
       await upsertScriptByName({
         name: slug,
@@ -16527,7 +16731,6 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       });
       autoSaved = { slug, reason: "successful_inline_run" };
     }
-    const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
     const runError = ok ? undefined : scrubSecrets([
       output.error,
       output.runtimeError ? `${output.runtimeError.name}: ${output.runtimeError.message}` : undefined
@@ -20766,6 +20969,7 @@ async function handleTrackers(req, res, pathSegments) {
 init_zod();
 init_db();
 init_types();
+init_request_auth_context();
 
 // src/http/operator-actor.ts
 init_request_auth_context();
@@ -20852,6 +21056,24 @@ var UnmappedIdentitySchema = exports_external.object({
   sampleEventType: exports_external.string().nullable(),
   sampleContext: exports_external.unknown().nullable()
 });
+var whoamiRoute = route({
+  method: "get",
+  path: "/api/whoami",
+  pattern: ["api", "whoami"],
+  summary: "Resolve the authenticated principal behind the presented bearer",
+  tags: ["Users"],
+  responses: {
+    200: {
+      description: "Authenticated principal",
+      schema: exports_external.object({
+        kind: exports_external.enum(["operator", "user"]),
+        user: exports_external.union([UserSchema, exports_external.null()])
+      })
+    },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true }
+});
 var listUsers = route({
   method: "get",
   path: "/api/users",
@@ -21165,6 +21387,18 @@ function collectUnmappedForKind(kind, limit) {
   return Array.from(byId.values());
 }
 async function handleUsers(req, res, pathSegments, queryParams) {
+  if (whoamiRoute.match(req.method, pathSegments)) {
+    const parsed = await whoamiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const auth = getRequestAuth(req);
+    if (auth?.kind === "user") {
+      whoamiRoute.respond(res, 200, { kind: "user", user: auth.user });
+    } else {
+      whoamiRoute.respond(res, 200, { kind: "operator", user: null });
+    }
+    return true;
+  }
   if (listUsers.match(req.method, pathSegments)) {
     const parsed = await listUsers.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -23077,6 +23311,7 @@ async function handleX(req, res, pathSegments) {
   }
   const timeoutMs = resolveTimeoutMs(req);
   const startedAt = new Date().toISOString();
+  const runStartTouch = script.isScratch ? touchScratchScriptLastUsed(script.id) : null;
   const credentials = await buildScriptCredentialBindingsWithFailures({
     agentId: endpoint.agentId
   });
@@ -23093,6 +23328,11 @@ async function handleX(req, res, pathSegments) {
   });
   const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
   const error = ok ? null : buildExecutionError(output);
+  if (ok) {
+    touchScratchScriptLastUsed(script.id);
+  } else if (script.isScratch && runStartTouch) {
+    restoreScratchScriptLastUsedIfUnchanged(script.id, script.updatedAt, runStartTouch);
+  }
   try {
     recordScriptApiUsage(endpointId);
   } catch {}
@@ -23345,18 +23585,19 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-9vnkprkh.js");
+    const { stopScheduler } = await import("./index-25wjsdv2.js");
     stopScheduler();
   }
   stopHeartbeat();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-fc7a2hw9.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-vc7s2aa6.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
   stopMemoryGc();
+  stopScratchScriptGc();
   stopAuditGc();
   stopAuditWriter();
   flushAuditBuffer();
@@ -23414,15 +23655,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-47q77nw4.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-8kceb43f.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-n0ve0kh6.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-2cn6effr.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-bbwb4wrm.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-vynday5g.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -23430,7 +23671,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-5fdsemf0.js");
+  const { runAllSeeders } = await import("./index-eaxyqcmj.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -23438,6 +23679,7 @@ try {
 setAuditSink(enqueueAuditRow);
 startAuditWriter();
 startAuditGc();
+startScratchScriptGc();
 initialize();
 await initOtel("api");
 httpServer.listen(port, async () => {
@@ -23466,35 +23708,35 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-9vnkprkh.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-c0qedjh6.js");
+    const { startScheduler } = await import("./index-25wjsdv2.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-ywds4812.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-fnack5vh.js");
+    const { startHeartbeat } = await import("./index-vg4snay4.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-fc7a2hw9.js");
+    const { startOAuthKeepalive } = await import("./keepalive-vc7s2aa6.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-f9rptqbt.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-yecgjpk4.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-5bgan3cd.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-q7mp8hcr.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-z7ykyeq8.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-xmw8wcx6.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-b2rjk8mv.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-dsqrv79n.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {