@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/dist/{http-w40q4w94.js → http-3h21z9md.js}

@@ -10,7 +10,7 @@ import {
 } from "./cli-efnd2kce.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-fw6vdcq5.js";
+} from "./cli-zp67qg5x.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-bqjfjex4.js";
@@ -27,7 +27,7 @@ import {
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-prt9emct.js";
+} from "./cli-gt8azyet.js";
 import {
   DEFAULT_CONNECTOR_CODE_LABEL,
   checkHeartbeatChecklist,
@@ -35,10 +35,10 @@ import {
   exchangeConnectorCode,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-ba66wyhy.js";
+} from "./cli-66zh26sp.js";
 import {
   Anthropic
-} from "./cli-ma3zvh39.js";
+} from "./cli-zy7vwsne.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -335,13 +335,13 @@ import {
   workflowModelErrors,
   workflowSaveWarnings,
   writeUnhandledError
-} from "./cli-50eg13rj.js";
-import"./cli-x7afk5wm.js";
+} from "./cli-df56tqdw.js";
+import"./cli-xvc3q9br.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-420bdgw0.js";
+} from "./cli-mv2520nm.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -350,16 +350,16 @@ import {
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-k6xx3pve.js";
+import"./cli-0nhdwxd5.js";
 import {
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh,
   upsertModelCatalogOverlay
-} from "./cli-e7t4snpa.js";
+} from "./cli-rggdq8wq.js";
 import {
   normalizeModelKey
-} from "./cli-nfygw434.js";
+} from "./cli-ysnyhws9.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -381,11 +381,8 @@ import {
   connectionAuthSummary,
   consumeMcpOAuthPending,
   createApprovalFollowUpTask,
-  createScriptApi,
   definitionNodeIds,
   deleteMcpOAuthToken,
-  deleteScript,
-  deleteScriptApi,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   ensureMcpToken,
@@ -400,13 +397,9 @@ import {
   getCredentialBindingById,
   getMcpOAuthToken,
   getOAuthBindingTokenStatus,
-  getScript,
-  getScriptApiById,
   getScriptApiConnectionDescriptors,
-  getScriptApiSecret,
   getScriptApiTypes,
   getScriptAppTypes,
-  getScriptById,
   getScriptConnectionById,
   getScriptMcpConnectionDescriptors,
   getScriptMcpTypes,
@@ -415,27 +408,21 @@ import {
   isInvalidClientError,
   listAppRecords,
   listRelationalCredentialBindings,
-  listScriptApisForScript,
   listScriptConnections,
   listScriptConnectionsAsync,
-  listScriptVersions,
-  listScripts,
   listVendoredOpenapiEntries,
   markMcpOAuthTokenStatus,
   normalizeTokenEndpointAuthMethod,
   oauthAppToProviderConfig,
   publicEndpointSsrfOptions,
   readStreamCapped,
-  recordScriptApiUsage,
   refreshMcpToken,
   refreshScriptConnection,
   registerClient,
   require_dist,
   require_typescript,
   resolveAdvertisedTokenEndpointAuthMethod,
-  restoreScratchScriptLastUsedIfUnchanged,
   revokeMcpToken,
-  rotateScriptApiSecret,
   runScript,
   sandboxSpawnEnv,
   scriptSdkTypesWithGeneratedApis,
@@ -443,16 +430,13 @@ import {
   selectDcrTokenEndpointAuthMethod,
   setMcpServerAuthMethod,
   setScriptConnectionEnabled,
-  touchScratchScriptLastUsed,
   typecheckScript,
   typecheckWithAmbient,
-  updateScriptApi,
   upsertCredentialBinding,
   upsertMcpOAuthToken,
-  upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-xtgtyafv.js";
+} from "./cli-jvj6a0cv.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
@@ -464,7 +448,7 @@ import {
   signalProcessGroup,
   terminateProcessGroup
 } from "./cli-zt3w1cn1.js";
-import"./cli-xb3c6aat.js";
+import"./cli-f2n17zhp.js";
 import {
   CLIENT_ID,
   MAX_CODEX_OAUTH_SLOT,
@@ -475,7 +459,7 @@ import {
   getAccountId,
   getValidCodexOAuth,
   loadAllCodexOAuthSlots
-} from "./cli-ftry7975.js";
+} from "./cli-feh3dkah.js";
 import"./cli-3dpj7atn.js";
 import"./cli-2x0e561b.js";
 import"./cli-pkke6geq.js";
@@ -488,46 +472,12 @@ import {
   normalizeFilesError
 } from "./cli-mzfth0bp.js";
 import {
-  searchScripts
-} from "./cli-jqt9hrnz.js";
-import {
-  CANDIDATE_SET_MULTIPLIER,
-  EMBEDDING_DIMENSIONS,
-  MEMORY_KEY_MAX_LENGTH,
-  OpenAI,
-  getEmbeddingProvider,
-  getMemoryStore,
-  init_constants as init_constants2,
-  init_key_paths,
-  init_openai,
-  init_reranker,
-  rerank
-} from "./cli-yhmwmv0g.js";
-import"./cli-wfajtmf7.js";
-import {
-  acquireOAuthRefreshLock,
   buildAuthorizationUrl,
-  consumeOAuthPending,
-  createOAuthApp,
-  deleteAuthorizationById,
-  deleteAuthorizationsForApp,
-  deleteOAuthTokens,
   exchangeAuthorizationCode,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow,
-  gcOAuthPending,
-  getAuthorizationById,
-  getDefaultAuthorizationIdForProvider,
-  getOAuthApp,
-  getOAuthAppById,
-  getOAuthTokens,
-  listAuthorizationsForApp,
-  oauthAppRowToProviderConfig,
-  releaseOAuthRefreshLock,
-  updateAuthorizationIdentity,
-  updateOAuthAppById,
-  upsertAuthorization
-} from "./cli-a87b04k8.js";
+  oauthAppRowToProviderConfig
+} from "./cli-j2jbr8af.js";
 import"./cli-fad8m16k.js";
 import"./cli-bsakbbkm.js";
 import"./cli-zxg80zs9.js";
@@ -552,10 +502,9 @@ import {
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-0n4fasz0.js";
+} from "./cli-ecknp7p1.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
-import"./cli-cvk6yzw5.js";
 import"./cli-yatxqynm.js";
 import {
   bedrockProviderModule
@@ -583,7 +532,7 @@ import"./cli-pzxba7gw.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-xnzrzets.js";
+} from "./cli-8kgvmkak.js";
 import {
   LEGACY_RULES,
   can,
@@ -595,19 +544,24 @@ import {
 } from "./cli-rfphkzh5.js";
 import {
   API_DRAINING_HEADER,
+  CANDIDATE_SET_MULTIPLIER,
   CODEX_AUTH_WATCH_NAMESPACE,
   CredentialBindingSchema,
   DB_RETENTION_TUNING_BOUNDS,
+  EMBEDDING_DIMENSIONS,
   EXTENSION_AGENT_ROLE,
   ExtensionAgentAssignmentError,
   HeartbeatExpiryError,
   KvTypeCollisionError,
   MAX_DB_RETENTION_DAYS,
+  MEMORY_KEY_MAX_LENGTH,
   NOT_EXTENSION_AGENT_SQL,
+  OpenAI,
   ReservedAgentRoleError,
   SteeringRequestError,
   _resolveIntegrationProvider,
   _resolveIntegrationType,
+  acquireOAuthRefreshLock,
   agentContextKey,
   auditAssetKeys,
   backfillSupersedeTaskResumeTaskId,
@@ -626,6 +580,7 @@ import {
   completeTask,
   computeContentHash,
   configureOrgDomainPersistence,
+  consumeOAuthPending,
   countActiveScriptRuns,
   countAllMetrics,
   countAllPages,
@@ -642,8 +597,10 @@ import {
   createLogEntry,
   createMcpServer,
   createMetric,
+  createOAuthApp,
   createPage,
   createScheduledTask,
+  createScriptApi,
   createScriptRun,
   createSessionCost,
   createSessionLogs,
@@ -655,14 +612,19 @@ import {
   decryptSecret,
   deleteActiveSession,
   deleteActiveSessionById,
+  deleteAuthorizationById,
+  deleteAuthorizationsForApp,
   deleteBudget,
   deleteKv,
   deleteMcpServer,
   deleteMetric,
+  deleteOAuthTokens,
   deletePage,
   deletePricingRow,
   deletePromptTemplate,
   deleteScheduledTask,
+  deleteScript,
+  deleteScriptApi,
   deleteSkill,
   deleteSkillFile,
   deleteSwarmConfig,
@@ -679,6 +641,7 @@ import {
   encryptSecret,
   extensionAgentAssignmentError,
   failTask,
+  gcOAuthPending,
   getActivePricingRow,
   getActiveSessions,
   getAgentById,
@@ -699,6 +662,7 @@ import {
   getAllUsers,
   getApprovalRequestById,
   getAttributionByPerson,
+  getAuthorizationById,
   getAvailableKeyIndices,
   getBudget,
   getBudgets,
@@ -710,6 +674,8 @@ import {
   getDashboardCostSummary,
   getDb,
   getDbClient,
+  getDefaultAuthorizationIdForProvider,
+  getEmbeddingProvider,
   getEncryptionKey,
   getInboxSummary,
   getInstanceActivity,
@@ -723,9 +689,13 @@ import {
   getLogsByAgentId,
   getLogsByTaskId,
   getMcpServerById,
+  getMemoryStore,
   getMetric,
   getMetricVersion,
   getMetricVersions,
+  getOAuthApp,
+  getOAuthAppById,
+  getOAuthTokens,
   getOfferedTasksForAgent,
   getPage,
   getPageBySlug,
@@ -750,8 +720,13 @@ import {
   getScheduledTaskById,
   getScheduledTaskByName,
   getScheduledTasks,
+  getScript,
+  getScriptApiById,
+  getScriptApiSecret,
+  getScriptById,
   getScriptRun,
   getScriptRunByIdempotencyKey,
+  getScriptRunExecutionArgs,
   getScriptRunJournalStep,
   getServicesByAgentId,
   getSessionCostSummary,
@@ -793,16 +768,25 @@ import {
   init_api_drain,
   init_asset_key_audit,
   init_codex_auth_failure,
+  init_constants as init_constants2,
   init_context_key,
   init_credential_broker,
   init_crypto,
   init_date_utils,
   init_db,
+  init_db1 as init_db2,
   init_default_drift,
+  init_embeddings,
   init_heartbeat_expiry,
   init_human_free,
+  init_key_paths,
+  init_memory,
+  init_oauth,
+  init_openai,
   init_request_auth_context,
+  init_reranker,
   init_runtime,
+  init_secret_registry,
   init_steering,
   init_swarm_config_guard,
   init_task_tool_manifest,
@@ -828,6 +812,7 @@ import {
   listApprovalRequestSummaries,
   listApprovalRequests,
   listAssetSummaries,
+  listAuthorizationsForApp,
   listFavorites,
   listInboxState,
   listKv,
@@ -835,13 +820,17 @@ import {
   listMetricsByAgent,
   listPagesByAgent,
   listRecentSessions,
+  listScriptApisForScript,
   listScriptRunJournalSteps,
   listScriptRuns,
+  listScriptVersions,
+  listScripts,
   listSkillFileManifest,
   listSkills,
   listTaskTemplates,
   listWorkflowRunsPage,
   listWorkflows,
+  loadSecretRegistry,
   markKeyRateLimited,
   markSteeringDelivered,
   markSteeringHandled,
@@ -862,9 +851,12 @@ import {
   recordKeyRateLimitWindows,
   recordKeySeatMismatch,
   recordKeyUsage,
+  recordScriptApiUsage,
   recordTaskProviderIfUnset,
   refreshActiveSessionOnActivity,
+  releaseOAuthRefreshLock,
   requestSteering,
+  rerank,
   reservedKeyError,
   resetEmptyPollCount,
   resetOrphanedInProgressTasksForAgent,
@@ -872,7 +864,10 @@ import {
   resolveApprovalRequest,
   resolvePromptTemplate,
   resolveTriggerSurface,
+  restoreScratchScriptLastUsedIfUnchanged,
   resumeTask,
+  rotateScriptApiSecret,
+  searchScripts,
   searchSkills,
   selectTaskTools,
   setAgentHarnessProvider,
@@ -887,6 +882,7 @@ import {
   supersedeTask,
   sweepExpiredKv,
   telemetry,
+  touchScratchScriptLastUsed,
   uninstallMcpServer,
   uninstallSkill,
   updateActiveSessionProviderSessionId,
@@ -900,9 +896,12 @@ import {
   updateAgentProvider,
   updateAgentStatus,
   updateAgentStatusFromCapacity,
+  updateAuthorizationIdentity,
   updateMetric,
+  updateOAuthAppById,
   updatePage,
   updateScheduledTask,
+  updateScriptApi,
   updateScriptRun,
   updateScriptRunIfNotTerminal,
   updateScriptRunIfRunning,
@@ -913,18 +912,20 @@ import {
   updateTaskVcs,
   updateUser,
   upsertAssetKeyMapping,
+  upsertAuthorization,
   upsertBudget,
   upsertChannelActivityCursor,
   upsertInboxState,
   upsertKv,
   upsertPromptTemplate,
+  upsertScriptByName,
   upsertScriptRunJournalStep,
   upsertSkillFile,
   upsertSkillFiles,
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-qdv8kgz7.js";
+} from "./cli-yshaazs1.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -1051,13 +1052,13 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-9s3h836g.js";
+} from "./cli-xvdgasgy.js";
 import"./cli-3qhyh31j.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-3a4m1aws.js";
+} from "./cli-jhm6hzjn.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
@@ -1124,21 +1125,22 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1kzfvd1z.js";
+} from "./cli-4r1sjfc4.js";
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-hpryr6em.js";
+} from "./cli-mb75wpxf.js";
 import {
   init_bus,
   realtimeBus
 } from "./cli-zf8jjwex.js";
 import {
+  findSecretsIn,
   init_secret_scrubber,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-h1spv8v4.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __require,
   __toESM
@@ -1193,13 +1195,13 @@ setBedrockProviderModule(bedrockProviderModule);
 import {
   createServer as createHttpServer
 } from "node:http";
-init_db();
+init_db2();
 
 // src/be/db-retention.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 init_env_flag();
 init_secret_scrubber();
-init_db();
+init_db2();
 init_swarm_config_guard();
 var DAY_MS = 24 * 60 * 60 * 1000;
 var RETENTION_INTERVAL_MS = 60 * 60 * 1000;
@@ -1750,7 +1752,7 @@ function stopHumanFreeDrain() {
 }
 
 // src/be/scripts/retention.ts
-init_db();
+init_db2();
 var SCRATCH_RETENTION_DAYS = 14;
 var SCRATCH_GC_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var scratchGcTimer = null;
@@ -1857,8 +1859,11 @@ function stopScratchScriptGc() {
   scratchGcTimer = null;
 }
 
+// src/http/index.ts
+init_secret_registry();
+
 // src/be/seed-capabilities.ts
-init_db();
+init_db2();
 var LEGACY_ALWAYS_ON_DEFAULTS = [
   "core",
   "config",
@@ -1893,7 +1898,7 @@ async function seedLegacyCapabilitiesConfig() {
 }
 
 // src/queue-stall-alarm.ts
-init_db();
+init_db2();
 init_secret_scrubber();
 var QUEUE_STALL_THRESHOLD_MS = 30 * 60 * 1000;
 var QUEUE_STALL_CHECK_INTERVAL_MS = 5 * 60 * 1000;
@@ -2054,7 +2059,7 @@ init_bus();
 
 // src/realtime/transport.ts
 init_zod();
-init_db();
+init_db2();
 init_secret_scrubber();
 init_bus();
 
@@ -2471,7 +2476,8 @@ function connect(ws, auth) {
 }
 
 // src/script-workflows/supervisor.ts
-init_db();
+init_db2();
+init_secret_scrubber();
 
 // src/script-workflows/executor.ts
 import { randomUUID } from "node:crypto";
@@ -3315,7 +3321,9 @@ async function startScriptRunProcess(run, baseUrl, apiKeyOverride) {
   if (process.env.SCRIPT_WORKFLOW_DEBUG === "true") {
     console.error(`[script-workflows] spawning ${run.id} auth override=${apiKeyOverride ? "yes" : "no"} len=${apiKey.length}`);
   }
-  const execution = await scriptExecutor.start({ run, baseUrl, apiKey });
+  const sealedArgs = await getScriptRunExecutionArgs(run.id);
+  const args = sealedArgs === undefined ? run.args : sealedArgs;
+  const execution = await scriptExecutor.start({ run: { ...run, args }, baseUrl, apiKey });
   managed.set(run.id, { execution });
   await updateScriptRun(run.id, {
     status: "running",
@@ -3326,7 +3334,7 @@ async function startScriptRunProcess(run, baseUrl, apiKeyOverride) {
     const current = await getScriptRun(run.id);
     if (current && current.status === "running") {
       if (exitCode !== 0) {
-        console.error(`[script-workflows] run ${run.id} subprocess exited ${exitCode}: ${stderr.trim() || "(no stderr)"}`);
+        console.error(scrubSecrets(`[script-workflows] run ${run.id} subprocess exited ${exitCode}: ${stderr.trim() || "(no stderr)"}`));
       }
       await updateScriptRunIfRunning(run.id, {
         status: exitCode === 0 ? "completed" : "failed",
@@ -3564,7 +3572,7 @@ init_secret_scrubber();
 
 // src/http/active-sessions.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listActiveSessions = route({
   method: "get",
@@ -3767,7 +3775,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
 // src/http/agents.ts
 init_src();
 init_zod();
-init_db();
+init_db2();
 init_telemetry();
 init_types();
 init_constants();
@@ -4847,7 +4855,7 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
 
 // src/http/api-keys.ts
 init_zod();
-init_db();
+init_db2();
 init_model_rate_limit_windows();
 init_subscription_plans();
 
@@ -5501,7 +5509,7 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
 
 // src/http/approval-requests.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_request_auth_context();
 init_event_bus();
@@ -6066,13 +6074,14 @@ async function approvalQuorumMet(approvers, votes) {
 // src/http/assets.ts
 init_zod();
 init_asset_key_audit();
+init_db2();
 init_db();
 init_rbac();
 init_types();
 init_request_auth_context();
 
 // src/http/request-principal.ts
-init_db();
+init_db2();
 init_request_auth_context();
 async function requestPrincipal(req, myAgentId) {
   const auth = getRequestAuth(req);
@@ -6406,7 +6415,7 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/budgets.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_secret_scrubber();
 import { createHash } from "node:crypto";
@@ -6569,14 +6578,37 @@ async function handleBudgets(req, res, pathSegments, queryParams, _myAgentId) {
 // src/http/codex-oauth-device.ts
 init_zod();
 init_crypto();
-init_db();
+init_db2();
+
+// src/be/db/codex-oauth-device-flows.ts
+init_runtime();
+async function getCodexDeviceFlow(flowId) {
+  const row = await getDbClient().get("SELECT state, expires_at FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+  if (!row)
+    return null;
+  if (row.expires_at <= Date.now()) {
+    await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+    return null;
+  }
+  return { state: row.state, expiresAt: row.expires_at };
+}
+async function upsertCodexDeviceFlow(input) {
+  const now = Date.now();
+  await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE expires_at <= ?", [now]);
+  await getDbClient().run(`INSERT INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(flow_id) DO UPDATE SET
+         state = excluded.state,
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`, [input.flowId, input.state, input.expiresAt, now, now]);
+}
 
 // src/be/onboarding.ts
 init_telemetry();
 init_types();
 init_request_auth_context();
 init_zod_openapi();
-init_db();
+init_db2();
 init_swarm_config_guard();
 var ONBOARDING_CONFIG_KEY = "onboarding_state";
 var OnboardingStepIdSchema = exports_zod.enum([
@@ -7185,7 +7217,7 @@ init_secret_scrubber();
 
 // src/http/config.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac_roles();
 init_swarm_config_guard();
 init_rbac();
@@ -7568,7 +7600,6 @@ async function handleConfig(req, res, pathSegments, queryParams) {
 }
 
 // src/http/codex-oauth-device.ts
-var FLOW_NAMESPACE = "codex-oauth-device";
 var FLOW_TTL_MS = 15 * 60 * 1000;
 var POLL_LEASE_MS = 45000;
 var FlowStateSchema = exports_external.object({
@@ -7628,11 +7659,11 @@ function registerFlowSecrets(state) {
   registerVolatileSecret(state.userCode, "codex-device-user-code");
 }
 async function readFlow(flowId) {
-  const entry = await getKv(FLOW_NAMESPACE, flowId);
-  if (!entry || typeof entry.value !== "string")
+  const entry = await getCodexDeviceFlow(flowId);
+  if (!entry)
     return null;
   try {
-    const plaintext = decryptSecret(entry.value, getEncryptionKey());
+    const plaintext = decryptSecret(entry.state, getEncryptionKey());
     const parsed = FlowStateSchema.safeParse(JSON.parse(plaintext));
     if (!parsed.success)
       return null;
@@ -7643,11 +7674,9 @@ async function readFlow(flowId) {
   }
 }
 async function writeFlow(flowId, state) {
-  await upsertKv({
-    namespace: FLOW_NAMESPACE,
-    key: flowId,
-    value: encryptSecret(JSON.stringify(state), getEncryptionKey()),
-    valueType: "string",
+  await upsertCodexDeviceFlow({
+    flowId,
+    state: encryptSecret(JSON.stringify(state), getEncryptionKey()),
     expiresAt: state.expiresAt
   });
 }
@@ -7857,7 +7886,7 @@ async function handleCodexOAuthDevice(req, res, pathSegments, queryParams) {
 
 // src/http/codex-oauth-keep-warm.ts
 init_zod();
-init_db();
+init_db2();
 init_codex_auth_failure();
 init_constants();
 var KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -7931,7 +7960,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
 init_zod();
 
 // src/comb/review-batch.ts
-init_db();
+init_db2();
 init_resolver();
 init_constants();
 init_secret_scrubber();
@@ -8372,7 +8401,7 @@ async function handleComb(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/context.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var PostContextResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -8481,7 +8510,7 @@ async function handleContext(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/ecosystem.ts
 init_zod();
-init_db();
+init_db2();
 var EcosystemAppSchema = exports_external.object({
   name: exports_external.string(),
   script: exports_external.string(),
@@ -8731,7 +8760,7 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
 
 // src/http/extensions.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/be/extensions/validate.ts
 init_bundle_path();
@@ -10773,7 +10802,7 @@ async function handleExtensions(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/favorites.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listFavorites2 = route({
   method: "get",
@@ -10873,7 +10902,7 @@ async function handleFavorites(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/fs.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_types();
 
@@ -11418,7 +11447,7 @@ async function handleHeartbeat(req, res, pathSegments) {
 
 // src/http/inbox-state.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listState = route({
   method: "get",
@@ -11628,7 +11657,7 @@ function buildSlackManifest(name) {
 }
 
 // src/http/config-values.ts
-init_db();
+init_db2();
 async function resolveConfigValue(key) {
   const configs = await getResolvedConfig();
   const variants = [key, key.toLowerCase(), key.toUpperCase()];
@@ -11761,7 +11790,7 @@ var handleIntegrations = createIntegrationsHandler();
 
 // src/http/kv.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_context_key();
 init_types();
@@ -13524,7 +13553,7 @@ class StreamableHTTPServerTransport {
 }
 
 // src/http/mcp.ts
-init_db();
+init_db2();
 init_env_flag();
 init_request_auth_context();
 init_task_tool_manifest();
@@ -13719,7 +13748,7 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
 
 // src/http/mcp-oauth.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_env_flag();
@@ -14461,7 +14490,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
 
 // src/http/mcp-servers.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac_roles();
 init_rbac();
 init_types();
@@ -15162,11 +15191,12 @@ function closeIdleMcpUserTransports(transports, sessionUsers, sessionActivity, o
 
 // src/http/memory.ts
 init_zod();
-init_db();
+init_db2();
+init_memory();
 init_constants2();
 
 // src/be/memory/edges-store.ts
-init_db();
+init_db2();
 var USEFULNESS_FLOOR = 1;
 var USEFULNESS_CEILING = 2;
 async function listEdgesForAgent(agentId, memoryId) {
@@ -15202,7 +15232,7 @@ init_key_paths();
 init_reranker();
 
 // src/be/memory/retrieval-store.ts
-init_db();
+init_db2();
 var RETRIEVAL_CONTENT_SNIPPET_CHARS = 500;
 var RETRIEVAL_LIST_LIMIT = 50;
 async function getRetrievalsForAgent(agentId, filter) {
@@ -15245,7 +15275,7 @@ async function hasRetrievalForTask(taskId, memoryId) {
 }
 
 // src/be/memory/usefulness-stats.ts
-init_db();
+init_db2();
 async function getUsefulnessStats(options = {}) {
   const days = options.days ?? 30;
   const threshold = options.threshold ?? 0.6;
@@ -16644,7 +16674,7 @@ function stopMemoryGc() {
 
 // src/http/metrics.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var DEFAULT_METRIC_MAX_ROWS = 100;
 var HARD_METRIC_MAX_ROWS = 500;
@@ -17098,7 +17128,7 @@ async function handleMetrics(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/models-catalog.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_types();
 init_request_auth_context();
@@ -17410,9 +17440,11 @@ async function handleModelsCatalog(req, res, pathSegments, queryParams) {
 
 // src/http/oauth-callback.ts
 init_zod();
-init_db();
+init_db2();
+init_oauth();
 
 // src/jira/oauth.ts
+init_oauth();
 var ACCESSIBLE_RESOURCES_URL = "https://api.atlassian.com/oauth/token/accessible-resources";
 async function getJiraOAuthConfig() {
   const app = await getOAuthApp("jira");
@@ -17453,7 +17485,8 @@ async function resolveAndStoreJiraCloudId(accessToken) {
 }
 
 // src/linear/oauth.ts
-init_db();
+init_db2();
+init_oauth();
 var APP_USER_ID_NAMESPACE = "integration:linear:bot-app-user-id";
 async function getLinearOAuthConfig() {
   const app = await getOAuthApp("linear");
@@ -17880,6 +17913,7 @@ async function handleGenericOAuth(req, res, pathSegments, queryParams) {
 
 // src/http/oauth-locks.ts
 init_zod();
+init_oauth();
 var MAX_LOCK_TTL_MS = 5 * 60 * 1000;
 var LOCK_KEY_PATTERN = /^[a-zA-Z0-9._:-]{1,200}$/;
 var LockKeySchema = exports_external.object({ key: exports_external.string().regex(LOCK_KEY_PATTERN) });
@@ -17946,13 +17980,15 @@ async function handleOAuthLocks(req, res, pathSegments, queryParams) {
 
 // src/http/onboarding.ts
 init_openai();
-init_db();
+init_db2();
+init_memory();
 init_constants2();
 init_types();
 
 // src/http/status.ts
 init_zod();
-init_db();
+init_db2();
+init_memory();
 init_config();
 init_telemetry();
 init_types();
@@ -18742,7 +18778,7 @@ async function handleOnboarding(req, res, pathSegments, queryParams) {
 }
 
 // src/http/page-proxy.ts
-init_db();
+init_db2();
 route({
   method: "get",
   path: "/@swarm/api/{path}",
@@ -18931,7 +18967,7 @@ async function handlePageProxy(req, res) {
 // src/http/pages.ts
 init_zod();
 import { randomUUID as randomUUID4 } from "node:crypto";
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_request_auth_context();
@@ -19489,7 +19525,7 @@ async function handlePages(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/pages-public.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_secret_scrubber();
@@ -19919,7 +19955,7 @@ async function bumpViewCount(pageId) {
 
 // src/http/poll.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/slack/channel-activity.ts
 var cachedBotUserId = null;
@@ -20484,7 +20520,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/pricing.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_secret_scrubber();
 import { createHash as createHash2 } from "node:crypto";
@@ -20660,7 +20696,7 @@ async function handlePricing(req, res, pathSegments, queryParams, _myAgentId) {
 
 // src/http/prompt-templates.ts
 init_zod();
-init_db();
+init_db2();
 init_default_drift();
 init_registry();
 init_resolver();
@@ -21155,7 +21191,7 @@ async function handleRealtimeAsset(req, res) {
 
 // src/http/repos.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_telemetry();
 init_types();
@@ -21635,6 +21671,7 @@ async function handleRooms(req, res, pathSegments, queryParams) {
 // src/http/schedules.ts
 init_zod();
 var import_cron_parser = __toESM(require_dist(), 1);
+init_db2();
 init_db();
 init_types();
 var scheduleUpdateBodySchema = exports_external.object({
@@ -22223,7 +22260,7 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/script-connection-proxy.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 var McpToolCallResultSchema = exports_external.object({
   content: exports_external.array(exports_external.object({ type: exports_external.string(), text: exports_external.string().optional() })),
@@ -22332,7 +22369,8 @@ async function handleScriptConnectionProxy(req, res, pathSegments, queryParams,
 // src/http/script-connections.ts
 init_zod();
 init_date_utils();
-init_db();
+init_db2();
+init_oauth();
 init_rbac();
 init_credential_broker();
 init_telemetry();
@@ -24227,7 +24265,25 @@ async function handleScriptConnections(req, res, pathSegments, queryParams, agen
 
 // src/http/script-runs.ts
 init_zod();
-init_db();
+init_db2();
+
+// src/be/scripts/source-secrets.ts
+init_secret_scrubber();
+function refuseSourceWithSecrets(source) {
+  const { knownValues, gitleaksRules } = findSecretsIn(source);
+  if (knownValues.length === 0 && gitleaksRules.length === 0)
+    return null;
+  const findings = [
+    ...knownValues.map((id) => ({ kind: "registered-secret", id })),
+    ...gitleaksRules.map((id) => ({ kind: "gitleaks-rule", id }))
+  ];
+  const named = findings.map((f) => f.kind === "registered-secret" ? `registered secret ${f.id}` : `gitleaks rule ${f.id}`).join(", ");
+  return {
+    error: "source_contains_secret",
+    message: `Script source contains a secret (${named}); nothing was saved or run. Source is stored and shown verbatim, so read secrets at run time instead: a credential binding (ctx.api.<slug> / ctx.mcp.<slug>) or ctx.swarm.config.get("<KEY>").`,
+    findings
+  };
+}
 
 // src/script-workflows/label-lint.ts
 var import_typescript = __toESM(require_typescript(), 1);
@@ -24300,6 +24356,7 @@ function lintWorkflowLabels(source) {
 // src/http/script-runs.ts
 init_types();
 init_constants();
+init_secret_scrubber();
 var DEFAULT_SCRIPT_RUN_CONCURRENCY_CAP = 10;
 var runIdParamsSchema = exports_external.object({ runId: exports_external.string().uuid() });
 var idParamsSchema3 = exports_external.object({ id: exports_external.string().uuid() });
@@ -24575,6 +24632,11 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
     const agent = await requireAgent(res, agentId);
     if (!agent)
       return true;
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     const lint = lintWorkflowLabels(parsed.body.source);
     if (!lint.ok) {
       json(res, {
@@ -24728,7 +24790,7 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
         config: parsed.body.config ?? {},
         status: parsed.body.status,
         result: parsed.body.result,
-        error: parsed.body.error,
+        error: parsed.body.error === undefined ? undefined : scrubSecrets(parsed.body.error),
         durationMs: parsed.body.durationMs
       });
       return assertRunWithinLimits(run.id);
@@ -24859,7 +24921,9 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/scripts.ts
 init_zod();
+init_db2();
 init_db();
+init_embeddings();
 init_rbac();
 init_types();
 init_secret_scrubber();
@@ -25315,6 +25379,11 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
         return true;
       }
     }
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     const typecheck = await typecheckScript(parsed.body.source, { agentId: agent.id });
     if (!typecheck.ok) {
       json(res, {
@@ -25365,6 +25434,11 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     if (!agent)
       return true;
     const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
+    const secretRefusal = parsed.body.source ? refuseSourceWithSecrets(parsed.body.source) : null;
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
     let namedScript = null;
@@ -25723,7 +25797,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/session-data.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 
 // src/http/session-cost-recompute.ts
@@ -26260,7 +26334,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
 
 // src/http/sessions.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_types();
 init_request_auth_context();
@@ -26481,11 +26555,11 @@ async function handleSessions(req, res, pathSegments, queryParams) {
 
 // src/http/skills.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/be/skill-sync.ts
 import { homedir } from "node:os";
-init_db();
+init_db2();
 async function syncSkillsToFilesystem(agentId, harnessType = "all", homeOverride) {
   const skills = await getAgentSkills(agentId);
   const home = homeOverride ?? homedir();
@@ -27257,7 +27331,7 @@ async function handleSkills(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/stats.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_types();
 init_env_flag();
@@ -27520,7 +27594,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/task-templates.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listTemplates = route({
   method: "get",
@@ -27560,7 +27634,7 @@ async function handleTaskTemplates(req, res, pathSegments, queryParams) {
 
 // src/http/tasks.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_rbac();
 init_types();
@@ -28995,6 +29069,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/trackers/jira.ts
 init_zod();
+init_oauth();
 var MANUAL_WEBHOOK_INSTRUCTIONS = "See docs-site/.../integrations/jira.mdx for manual webhook registration steps.";
 var JiraWebhookIdEntrySchema = exports_external.object({
   id: exports_external.number().int(),
@@ -29370,6 +29445,7 @@ async function handleJiraTracker(req, res, pathSegments) {
 
 // src/http/trackers/linear.ts
 init_zod();
+init_oauth();
 
 // src/linear/webhook.ts
 import { createHmac, timingSafeEqual } from "node:crypto";
@@ -29680,7 +29756,7 @@ async function handleTrackers(req, res, pathSegments) {
 
 // src/http/users.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_request_auth_context();
 
@@ -30740,7 +30816,7 @@ async function handleUsers(req, res, pathSegments, queryParams) {
 init_zod();
 
 // src/agentmail/inbound-archive.ts
-init_db();
+init_db2();
 init_secret_scrubber();
 import { createHash as createHash3 } from "node:crypto";
 var INBOUND_ARCHIVE_NAMESPACE = "agentmail-inbound";
@@ -31503,7 +31579,7 @@ async function handleWebhooks(req, res, pathSegments) {
 
 // src/http/workflow-events.ts
 init_zod();
-init_db();
+init_db2();
 init_event_bus();
 var runScopedSignalRoute = route({
   method: "post",
@@ -31586,7 +31662,7 @@ async function handleWorkflowEvents(req, res, pathSegments, queryParams) {
 
 // src/http/workflows.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: exports_external.boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
@@ -32311,13 +32387,13 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await getWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const run = await getWorkflowRun(parsed.params.id);
+    const run = await getWorkflowRun(parsed.params.id, "display");
     if (!run) {
       res.writeHead(404);
       res.end();
       return true;
     }
-    const steps = await getWorkflowRunStepsByRunId(parsed.params.id);
+    const steps = await getWorkflowRunStepsByRunId(parsed.params.id, "display");
     getWorkflowRunRoute.respond(res, 200, { run, steps });
     return true;
   }
@@ -32352,8 +32428,9 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/x.ts
 init_zod();
-init_db();
+init_db2();
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+init_db();
 init_secret_scrubber();
 var DEFAULT_TIMEOUT_MS = 60000;
 var TIMEOUT_HEADER = "x-swarm-timeout-ms";
@@ -32771,7 +32848,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-9bfssf54.js");
+    const { stopScheduler } = await import("./index-bn6cy8ps.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -32780,7 +32857,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-1tj10tf4.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-3xspa9jw.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -32843,21 +32920,27 @@ try {
   throw err;
 }
 warnIfCorsAllowsAnyOrigin();
+try {
+  const loaded = await loadSecretRegistry();
+  console.log(`[secret-registry] registered config=${loaded.config} oauth=${loaded.oauth} scriptApi=${loaded.scriptApi} failed=${loaded.failed}`);
+} catch (err) {
+  console.error("[secret-registry] load failed (non-fatal):", scrubSecrets(err instanceof Error ? err.message : String(err)));
+}
 try {
   await seedLegacyCapabilitiesConfig();
 } catch (err) {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-2bmnh18p.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-vvzs1zhk.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-9e0q7cwk.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-atnkngqs.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-2bmnh18p.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-vvzs1zhk.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -32865,7 +32948,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-7n70jwbb.js");
+  const { runAllSeeders } = await import("./index-f8xnqrye.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -32925,38 +33008,38 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-9bfssf54.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-k8xc083e.js");
+    const { startScheduler } = await import("./index-bn6cy8ps.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-n99fycq7.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-cj1r9q83.js");
+    const { startHeartbeat } = await import("./index-dkfxpkmm.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-1tj10tf4.js");
+    const { startOAuthKeepalive } = await import("./keepalive-3xspa9jw.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-aefzwvvq.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-sh9q25xp.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-2ex2mcsh.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-s7k7c6v2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-z158xq32.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-998jtpdg.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-246yn076.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
-    console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
+  import("./boot-scrub-sweep-nepsk4t1.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+    console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {
   console.error("HTTP Server Error:", err);