@desplega.ai/agent-swarm 1.131.0 → 1.131.1

package/dist/{lead-1n8x30xe.js → lead-r2yqfmx7.js}

@@ -1,19 +1,19 @@
 import {
   runAgent
-} from "./cli-e7ckcg4v.js";
+} from "./cli-6pcz9h15.js";
 import"./cli-f1am9szv.js";
-import"./cli-5kx36evn.js";
-import"./cli-qmdnhpej.js";
+import"./cli-793jvbsh.js";
+import"./cli-wz9115x0.js";
 import"./cli-07er7wrs.js";
 import"./cli-9b13ggd1.js";
 import"./cli-n6h8qt8n.js";
 import"./cli-yazx6hap.js";
 import"./cli-r94z9p1z.js";
 import"./cli-d6n0thxw.js";
-import"./cli-3kf51j15.js";
-import"./cli-70xqj0z3.js";
+import"./cli-kd1ck4rx.js";
+import"./cli-2rk0cx7s.js";
 import"./cli-psrqtw2m.js";
-import"./cli-0rcyq6d9.js";
+import"./cli-w2wxd56v.js";
 import"./cli-yv9dttkh.js";
 import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
@@ -21,44 +21,44 @@ import"./cli-cw70hymf.js";
 import"./cli-v1mwc5v2.js";
 import {
   getEnabledCapabilities
-} from "./cli-t76vw5db.js";
+} from "./cli-jevgrb4w.js";
 import"./cli-1z7048dy.js";
 import"./cli-gz9sbyk3.js";
 import"./cli-2wadx7p2.js";
 import"./cli-e7d20cty.js";
 import"./cli-8whqavk2.js";
-import"./cli-nm5gtp1x.js";
-import"./cli-5ze9rv97.js";
-import"./cli-t55yw3a1.js";
-import"./cli-t1xze5qh.js";
-import"./cli-5v4rw6yd.js";
+import"./cli-3ty0t082.js";
+import"./cli-ycrnynpw.js";
+import"./cli-t8d349cy.js";
+import"./cli-114fvtmj.js";
+import"./cli-sy7jk3tx.js";
 import"./cli-bqw0mt1n.js";
-import"./cli-2q72qz2s.js";
-import"./cli-yw8vghx2.js";
+import"./cli-gecy3z2s.js";
+import"./cli-jbcva0xj.js";
 import"./cli-3dpj7atn.js";
-import"./cli-pm6xbh84.js";
+import"./cli-6dp3ydxa.js";
 import"./cli-epan13p1.js";
 import"./cli-f14fvzag.js";
-import"./cli-qv61hp37.js";
-import"./cli-rzbpmxdr.js";
+import"./cli-g1re8r05.js";
+import"./cli-se2p6rkb.js";
 import"./cli-0258203w.js";
-import"./cli-g6b8x1h8.js";
+import"./cli-nrkkknat.js";
 import"./cli-fad8m16k.js";
 import"./cli-7zd05xb4.js";
-import"./cli-d3x3x1c9.js";
-import"./cli-psh3c4va.js";
-import"./cli-cdeg08wx.js";
-import"./cli-cvgjwnh1.js";
+import"./cli-6dpytdr2.js";
+import"./cli-aca5pz9f.js";
+import"./cli-2f07m0xr.js";
+import"./cli-rgrfzg8z.js";
 import"./cli-k9qkf1hw.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-t930g0xh.js";
-import"./cli-a4jzdpa3.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/dist/{maintenance-gvev11sa.js → maintenance-mw70k468.js}

@@ -1,15 +1,15 @@
 import {
   reembedAllScripts
-} from "./cli-qv61hp37.js";
-import"./cli-rzbpmxdr.js";
+} from "./cli-g1re8r05.js";
+import"./cli-se2p6rkb.js";
 import"./cli-0258203w.js";
-import"./cli-a4jzdpa3.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{oauth-refresh-sweep-s9ecsvh0.js → oauth-refresh-sweep-yecgjpk4.js}

@@ -2,8 +2,8 @@ import {
   forceRefreshAuthorizationOrThrow,
   getAuthorizationById,
   listAuthorizationSweepRows
-} from "./cli-g6b8x1h8.js";
-import"./cli-a4jzdpa3.js";
+} from "./cli-nrkkknat.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
@@ -12,7 +12,7 @@ import {
   init_secret_scrubber,
   scrubSecrets
 } from "./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{onboard-pvm5b38w.js → onboard-xj0f73f9.js}

@@ -3,7 +3,7 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-fywms69x.js";
+} from "./cli-pxfxkx5m.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-72q8m8gk.js";
+} from "./cli-ccf9vy7q.js";
 import {
   Box_default,
   Select,

package/dist/{otel-impl-p6jvgd9c.js → otel-impl-nxg0n0b3.js}

@@ -13,7 +13,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-72q8m8gk.js";
+} from "./cli-ccf9vy7q.js";
 import {
   exports_supports_color,
   init_supports_color

package/dist/{pi-mono-adapter-t091s27g.js → pi-mono-adapter-4g5kby31.js}

@@ -29,7 +29,7 @@ import {
   streamSimple,
   summarizeSession,
   validateToolArguments
-} from "./cli-0rcyq6d9.js";
+} from "./cli-w2wxd56v.js";
 import {
   checkToolLoop,
   clearToolHistory

package/dist/{pricing-refresh-k49rcyed.js → pricing-refresh-2cn6effr.js}

@@ -2,15 +2,15 @@ import {
   PRICING_REFRESH_INTERVAL_MS,
   refreshPricingFromModelsDev,
   startPricingRefreshLoop
-} from "./cli-t55yw3a1.js";
-import"./cli-t1xze5qh.js";
-import"./cli-a4jzdpa3.js";
+} from "./cli-t8d349cy.js";
+import"./cli-114fvtmj.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{rbac-roles-cr80g96t.js → rbac-roles-1hcxdtg7.js}

@@ -4,13 +4,13 @@ import {
 import {
   getDb,
   init_db
-} from "./cli-a4jzdpa3.js";
+} from "./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{rbac-roles-30pspvy7.js → rbac-roles-vynday5g.js}

@@ -7,15 +7,15 @@ import {
   getUserGrant,
   listUserRoles,
   runRbacCliCommand
-} from "./cli-5v4rw6yd.js";
+} from "./cli-sy7jk3tx.js";
 import"./cli-bqw0mt1n.js";
-import"./cli-a4jzdpa3.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{render-v2-xm457ng1.js → render-v2-tc0bh8kk.js}

@@ -7,17 +7,17 @@ import {
   processSlackRenderV2,
   renderThreadTree,
   streamOutcomeCard
-} from "./cli-cvgjwnh1.js";
+} from "./cli-rgrfzg8z.js";
 import"./cli-k9qkf1hw.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-t930g0xh.js";
-import"./cli-a4jzdpa3.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-e15jhafb.js";
 import"./cli-3fj60etf.js";

package/dist/{seed-pricing-yhpv35fr.js → seed-pricing-8kceb43f.js}

@@ -1,14 +1,14 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-t1xze5qh.js";
-import"./cli-a4jzdpa3.js";
+} from "./cli-114fvtmj.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{setup-nytnmwwr.js → setup-46xtgq3c.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-fywms69x.js";
+} from "./cli-pxfxkx5m.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-msytr2cw.js → worker-qrbz6hmv.js}

@@ -1,19 +1,19 @@
 import {
   runAgent
-} from "./cli-e7ckcg4v.js";
+} from "./cli-6pcz9h15.js";
 import"./cli-f1am9szv.js";
-import"./cli-5kx36evn.js";
-import"./cli-qmdnhpej.js";
+import"./cli-793jvbsh.js";
+import"./cli-wz9115x0.js";
 import"./cli-07er7wrs.js";
 import"./cli-9b13ggd1.js";
 import"./cli-n6h8qt8n.js";
 import"./cli-yazx6hap.js";
 import"./cli-r94z9p1z.js";
 import"./cli-d6n0thxw.js";
-import"./cli-3kf51j15.js";
-import"./cli-70xqj0z3.js";
+import"./cli-kd1ck4rx.js";
+import"./cli-2rk0cx7s.js";
 import"./cli-psrqtw2m.js";
-import"./cli-0rcyq6d9.js";
+import"./cli-w2wxd56v.js";
 import"./cli-yv9dttkh.js";
 import"./cli-tng3131n.js";
 import"./cli-zm7njwzd.js";
@@ -21,44 +21,44 @@ import"./cli-cw70hymf.js";
 import"./cli-v1mwc5v2.js";
 import {
   getEnabledCapabilities
-} from "./cli-t76vw5db.js";
+} from "./cli-jevgrb4w.js";
 import"./cli-1z7048dy.js";
 import"./cli-gz9sbyk3.js";
 import"./cli-2wadx7p2.js";
 import"./cli-e7d20cty.js";
 import"./cli-8whqavk2.js";
-import"./cli-nm5gtp1x.js";
-import"./cli-5ze9rv97.js";
-import"./cli-t55yw3a1.js";
-import"./cli-t1xze5qh.js";
-import"./cli-5v4rw6yd.js";
+import"./cli-3ty0t082.js";
+import"./cli-ycrnynpw.js";
+import"./cli-t8d349cy.js";
+import"./cli-114fvtmj.js";
+import"./cli-sy7jk3tx.js";
 import"./cli-bqw0mt1n.js";
-import"./cli-2q72qz2s.js";
-import"./cli-yw8vghx2.js";
+import"./cli-gecy3z2s.js";
+import"./cli-jbcva0xj.js";
 import"./cli-3dpj7atn.js";
-import"./cli-pm6xbh84.js";
+import"./cli-6dp3ydxa.js";
 import"./cli-epan13p1.js";
 import"./cli-f14fvzag.js";
-import"./cli-qv61hp37.js";
-import"./cli-rzbpmxdr.js";
+import"./cli-g1re8r05.js";
+import"./cli-se2p6rkb.js";
 import"./cli-0258203w.js";
-import"./cli-g6b8x1h8.js";
+import"./cli-nrkkknat.js";
 import"./cli-fad8m16k.js";
 import"./cli-7zd05xb4.js";
-import"./cli-d3x3x1c9.js";
-import"./cli-psh3c4va.js";
-import"./cli-cdeg08wx.js";
-import"./cli-cvgjwnh1.js";
+import"./cli-6dpytdr2.js";
+import"./cli-aca5pz9f.js";
+import"./cli-2f07m0xr.js";
+import"./cli-rgrfzg8z.js";
 import"./cli-k9qkf1hw.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-t930g0xh.js";
-import"./cli-a4jzdpa3.js";
+import"./cli-50vbt00w.js";
 import"./cli-xpxde7rm.js";
 import"./cli-x23me2mg.js";
 import"./cli-z2zcxes1.js";
 import"./cli-zsspvvm2.js";
 import"./cli-4j2mrzag.js";
-import"./cli-72q8m8gk.js";
+import"./cli-ccf9vy7q.js";
 import"./cli-5dsbcjjw.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.131.0",
+    "version": "1.131.1",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.131.0",
+  "version": "1.131.1",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -176,7 +176,7 @@
     "@linear/sdk": "^77.0.0",
     "@modelcontextprotocol/sdk": "^1.25.1",
     "@openai/codex-sdk": "^0.147.0",
-    "@opencode-ai/sdk": "^1.18.15",
+    "@opencode-ai/sdk": "^1.18.16",
     "@openfort/openfort-node": "^0.9.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",

package/src/be/migrations/130_scratch_script_retention_grace.sql

@@ -0,0 +1,6 @@
+-- Historical inline script runs did not retain the generated scratch slug, so
+-- refresh existing scratch rows once to give them a full retention window
+-- under the new last-used tracking policy.
+UPDATE scripts
+SET updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+WHERE scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*';

package/src/be/scripts/db.ts

@@ -226,11 +226,17 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
       args.signatureJson !== existing.signatureJson ||
       argsJsonSchema !== existing.argsJsonSchema;
     const promotedFromScratch = existing.isScratch && !isScratch;
+    const refreshScratchLastUsed =
+      existing.scope === "agent" &&
+      existing.name.startsWith("scratch-") &&
+      existing.isScratch &&
+      isScratch;
     if (
       fsMode !== existing.fsMode ||
       isScratch !== existing.isScratch ||
       typeChecked !== existing.typeChecked ||
-      trackedMetadataChanged
+      trackedMetadataChanged ||
+      refreshScratchLastUsed
     ) {
       const row = getDb()
         .prepare<
@@ -466,6 +472,42 @@ export function deleteScript(args: ScriptIdentity): boolean {
   return result.changes > 0;
 }
 
+/** Bumps updatedAt and returns the timestamp actually written, or null if the row didn't match. */
+export function touchScratchScriptLastUsed(
+  id: string,
+  at: string = new Date().toISOString(),
+): string | null {
+  const result = getDb()
+    .prepare(
+      `UPDATE scripts SET updatedAt = ?
+       WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*'`,
+    )
+    .run(at, id);
+  return result.changes > 0 ? at : null;
+}
+
+/**
+ * Rolls back an in-flight run-start touch after the run turns out to have
+ * failed, so a failed invocation doesn't extend the retention window the way
+ * a successful one does. Only applies if nothing has touched the row since
+ * (CAS on updatedAt) — a concurrent run's touch, in-flight or successful,
+ * always wins over this rollback.
+ */
+export function restoreScratchScriptLastUsedIfUnchanged(
+  id: string,
+  priorUpdatedAt: string,
+  expectedUpdatedAt: string,
+): boolean {
+  return (
+    getDb()
+      .prepare(
+        `UPDATE scripts SET updatedAt = ?
+         WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*' AND updatedAt = ?`,
+      )
+      .run(priorUpdatedAt, id, expectedUpdatedAt).changes > 0
+  );
+}
+
 // ─── External script APIs (script_apis) ──────────────────────────────────────
 
 type ScriptApiRow = {

package/src/be/scripts/retention.ts

@@ -0,0 +1,164 @@
+import { collectScriptReferences } from "../../apps/definition";
+import { listAppRecords } from "../../apps/store";
+import { getDb, listWorkflows } from "../db";
+
+const SCRATCH_RETENTION_DAYS = 14;
+const SCRATCH_GC_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+let scratchGcTimer: ReturnType<typeof setInterval> | null = null;
+
+/**
+ * Every script id wired into an app definition, as an action or model source.
+ *
+ * `candidateIds` are the GC-candidate scratch scripts this call cares about.
+ * A broken app (invalid stored JSON) decodes with `definition` set to the raw
+ * string itself, not a merge-patch object, so `collectScriptReferences` below
+ * finds nothing for it. Same substring-probe fallback the interactive delete
+ * guard applies via `appScriptReferenceIssues` in src/http/scripts.ts — a
+ * broken app is not consent to break it further.
+ */
+function appReferencedScriptIds(candidateIds: readonly string[]): Set<string> {
+  const ids = new Set<string>();
+  for (const app of listAppRecords()) {
+    for (const scriptId of collectScriptReferences(app.definition).keys()) {
+      ids.add(scriptId);
+    }
+    if (app.definitionError === undefined) continue;
+    const serialized = JSON.stringify(app.definition ?? null);
+    for (const id of candidateIds) {
+      if (!ids.has(id) && serialized.includes(id)) ids.add(id);
+    }
+  }
+  return ids;
+}
+
+/**
+ * Every script id bound to a durable public API endpoint. `script_apis.scriptId`
+ * cascade-deletes with the script (`ON DELETE CASCADE`, src/be/migrations/102_script_apis.sql),
+ * so an unreferenced-looking scratch script backing a live `/api/x/script` endpoint
+ * would otherwise be silently deleted out from under it.
+ */
+function scriptApiReferencedScriptIds(): Set<string> {
+  const rows = getDb()
+    .prepare<{ scriptId: string }, []>("SELECT DISTINCT scriptId FROM script_apis")
+    .all();
+  return new Set(rows.map((row) => row.scriptId));
+}
+
+/**
+ * `(name, agentId)` keys an enabled workflow's `swarm-script` node could resolve at
+ * agent scope. A node's `config.scriptName` resolves by NAME, not id
+ * (src/workflows/executors/swarm-script.ts `resolveScriptSource`), against the
+ * workflow's `createdByAgentId` for `scope: "agent"` or omitted scope — so a
+ * name/scope match against a workflow's owner is the only static signal available;
+ * `scope: "global"` nodes can never resolve an agent-scoped scratch candidate and
+ * are skipped.
+ */
+function workflowReferencedAgentScriptKeys(): Set<string> {
+  const keys = new Set<string>();
+  for (const workflow of listWorkflows()) {
+    if (!workflow.createdByAgentId) continue;
+    for (const node of workflow.definition.nodes) {
+      if (node.type !== "swarm-script") continue;
+      const scriptName = (node.config as { scriptName?: unknown }).scriptName;
+      const scope = (node.config as { scope?: unknown }).scope;
+      if (typeof scriptName !== "string" || scope === "global") continue;
+      keys.add(`${scriptName}::${workflow.createdByAgentId}`);
+    }
+  }
+  return keys;
+}
+
+/**
+ * Script names an enabled `swarm-script` node could resolve at agent scope for a
+ * workflow with no static owner (`createdByAgentId` null — no `X-Agent-ID` at
+ * creation time, or a pre-migration legacy row). `SwarmScriptExecutor` falls back to
+ * `trigger.agentId` at run time for these (src/workflows/executors/swarm-script.ts
+ * `agentIdFromContext`), so the resolving agent isn't knowable statically — this
+ * excludes by NAME alone across every agent scope, which is over-broad (it also
+ * protects a same-named scratch script some *other*, unrelated agent owns) but is
+ * the only sound static signal available; `scope: "global"` nodes are skipped for
+ * the same reason as the owner-keyed variant above.
+ */
+function workflowReferencedScratchNamesForOwnerlessWorkflows(): Set<string> {
+  const names = new Set<string>();
+  for (const workflow of listWorkflows()) {
+    if (workflow.createdByAgentId) continue;
+    for (const node of workflow.definition.nodes) {
+      if (node.type !== "swarm-script") continue;
+      const scriptName = (node.config as { scriptName?: unknown }).scriptName;
+      const scope = (node.config as { scope?: unknown }).scope;
+      if (typeof scriptName !== "string" || scope === "global") continue;
+      names.add(scriptName);
+    }
+  }
+  return names;
+}
+
+/** Delete auto-saved scratch scripts that have not run within the retention window. */
+export function purgeExpiredScratchScripts(now = new Date()): number {
+  const cutoff = new Date(
+    now.getTime() - SCRATCH_RETENTION_DAYS * 24 * 60 * 60 * 1000,
+  ).toISOString();
+  const candidates = getDb()
+    .prepare<{ id: string; name: string; scopeId: string | null }, [string]>(
+      `SELECT id, name, scopeId FROM scripts
+       WHERE scope = 'agent'
+         AND isScratch = 1
+         AND name GLOB 'scratch-*'
+         AND updatedAt < ?`,
+    )
+    .all(cutoff);
+  if (candidates.length === 0) return 0;
+
+  // A scratch script still wired into a durable reference — an app action/model
+  // source, a public API endpoint, or a workflow's swarm-script node — is no
+  // longer "scratch" in effect; deleting it leaves that reference dangling. Same
+  // guard the interactive scripts-API delete route enforces for app references via
+  // appScriptReferenceIssues, applied here to the whole sweep at once, plus the two
+  // durable reference kinds that guard doesn't cover either.
+  const referenced = appReferencedScriptIds(candidates.map((row) => row.id));
+  const apiReferenced = scriptApiReferencedScriptIds();
+  const workflowReferenced = workflowReferencedAgentScriptKeys();
+  const ownerlessWorkflowReferencedNames = workflowReferencedScratchNamesForOwnerlessWorkflows();
+  const idsToDelete = candidates
+    .filter((row) => !referenced.has(row.id))
+    .filter((row) => !apiReferenced.has(row.id))
+    .filter((row) => !(row.scopeId && workflowReferenced.has(`${row.name}::${row.scopeId}`)))
+    .filter((row) => !ownerlessWorkflowReferencedNames.has(row.name))
+    .map((row) => row.id);
+  if (idsToDelete.length === 0) return 0;
+
+  const placeholders = idsToDelete.map(() => "?").join(",");
+  return (
+    getDb()
+      .prepare<{ id: string }, string[]>(
+        `DELETE FROM scripts WHERE id IN (${placeholders}) RETURNING id`,
+      )
+      // RETURNING counts scripts only; SQLite's change count includes cascaded rows.
+      .all(...idsToDelete).length
+  );
+}
+
+function runScratchScriptGc(label: "Initial" | "Periodic"): void {
+  try {
+    const purged = purgeExpiredScratchScripts();
+    console.log(`[scratch-script-gc] ${label} purge removed ${purged} scratch script row(s)`);
+  } catch (err) {
+    console.error(`[scratch-script-gc] ${label} purge failed:`, (err as Error).message);
+  }
+}
+
+/** Start the scratch-script retention GC (daily tick, immediate first run). */
+export function startScratchScriptGc(intervalMs = SCRATCH_GC_INTERVAL_MS): void {
+  if (scratchGcTimer) return;
+  runScratchScriptGc("Initial");
+  scratchGcTimer = setInterval(() => runScratchScriptGc("Periodic"), intervalMs);
+  if (typeof scratchGcTimer.unref === "function") scratchGcTimer.unref();
+}
+
+export function stopScratchScriptGc(): void {
+  if (!scratchGcTimer) return;
+  clearInterval(scratchGcTimer);
+  scratchGcTimer = null;
+}