@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/src/be/crypto/key-bootstrap.ts

@@ -116,7 +116,7 @@ export function resolveEncryptionKey(
 
   if (!allowGenerate) {
     throw new Error(
-      `Refusing to auto-generate ${KEY_FILENAME} for an existing database with encrypted secret rows. Restore ${ENV_KEY}, ${ENV_KEY_FILE}, or ${keyFilePath} before booting.`,
+      `Refusing to auto-generate ${KEY_FILENAME} for an existing database with encrypted secret rows or sealed replay values. Restore ${ENV_KEY}, ${ENV_KEY_FILE}, or ${keyFilePath} before booting.`,
     );
   }
 

package/src/be/db/approvals.ts

@@ -1,4 +1,6 @@
+import { type ScrubbedText, scrubObject, scrubSecrets } from "../../utils/secret-scrubber";
 import { normalizeDate, normalizeDateRequired } from "../date-utils";
+import { breaksJsonValidity } from "../scrub-json";
 import { getDbClient } from "./runtime";
 
 /**
@@ -126,7 +128,19 @@ export async function recordApprovalVotes(id: string, approvals: ApprovalVote[])
        SET approvals = ?, updatedAt = ?
        WHERE id = ? AND status = 'pending'
        RETURNING id`,
-    [JSON.stringify(approvals), new Date().toISOString(), id],
+    [scrubApprovalVotesJson(approvals), new Date().toISOString(), id],
   );
   return row !== null && row !== undefined;
 }
+
+/**
+ * Serializes votes for the `approvals` column with free-text answers scrubbed.
+ * Falls back to a per-value scrub when a redaction would break the JSON, so
+ * readers can always parse the column.
+ */
+export function scrubApprovalVotesJson(approvals: ApprovalVote[]): ScrubbedText {
+  const raw = JSON.stringify(approvals);
+  const scrubbed = scrubSecrets(raw);
+  if (!breaksJsonValidity(raw, scrubbed)) return scrubbed;
+  return JSON.stringify(scrubObject(approvals)) as ScrubbedText;
+}

package/src/be/db/codex-oauth-device-flows.ts

@@ -0,0 +1,40 @@
+import { getDbClient } from "./runtime";
+
+/**
+ * Encrypted Codex device-login flow state. Kept out of `kv_entries` so
+ * db-query can deny it by table. Returns null if missing or expired; an
+ * expired row is deleted inline.
+ */
+export async function getCodexDeviceFlow(
+  flowId: string,
+): Promise<{ state: string; expiresAt: number } | null> {
+  const row = await getDbClient().get<{ state: string; expires_at: number }>(
+    "SELECT state, expires_at FROM codex_oauth_device_flows WHERE flow_id = ?",
+    [flowId],
+  );
+  if (!row) return null;
+  if (row.expires_at <= Date.now()) {
+    await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+    return null;
+  }
+  return { state: row.state, expiresAt: row.expires_at };
+}
+
+/** Upsert one device-login flow and drop every expired flow. */
+export async function upsertCodexDeviceFlow(input: {
+  flowId: string;
+  state: string;
+  expiresAt: number;
+}): Promise<void> {
+  const now = Date.now();
+  await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE expires_at <= ?", [now]);
+  await getDbClient().run(
+    `INSERT INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(flow_id) DO UPDATE SET
+         state = excluded.state,
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`,
+    [input.flowId, input.state, input.expiresAt, now, now],
+  );
+}

package/src/be/db/config-secrets.ts

@@ -0,0 +1,31 @@
+import { decryptSecret, getEncryptionKey } from "../crypto";
+import { isReservedConfigKey } from "../swarm-config-guard";
+import { getDbClient } from "./runtime";
+
+/**
+ * Every stored secret config value (all scopes, incl. derived
+ * `connection.<slug>.secret` rows), decrypted, for the secret registry
+ * (src/be/secret-registry.ts). Reserved env-only keys are skipped: their live
+ * value is in env. A row that fails to decrypt is counted, not thrown, so one
+ * bad row cannot hide the rest.
+ */
+export async function listStoredConfigSecrets(): Promise<{
+  secrets: { key: string; value: string }[];
+  failed: number;
+}> {
+  const rows = await getDbClient().query<{ key: string; value: string; encrypted: number }>(
+    "SELECT key, value, encrypted FROM swarm_config WHERE isSecret = 1 OR encrypted = 1",
+  );
+  const secrets: { key: string; value: string }[] = [];
+  let failed = 0;
+  for (const row of rows) {
+    if (isReservedConfigKey(row.key)) continue;
+    try {
+      const value = row.encrypted === 1 ? decryptSecret(row.value, getEncryptionKey()) : row.value;
+      if (value) secrets.push({ key: row.key, value });
+    } catch {
+      failed++;
+    }
+  }
+  return { secrets, failed };
+}

package/src/be/db/runtime.ts

@@ -7,6 +7,7 @@ import { resolveEncryptionKey } from "../crypto";
 import { createBunSqliteClient, type DbClient } from "../db-client";
 import { runMigrations } from "../migrations/runner";
 import { autoEncryptLegacyOAuthSecrets } from "../oauth-encryption-backfill";
+import { sealedReplayExistsSql } from "../sealed-json";
 
 let db: Database | null = null;
 let sqliteVecAvailable = false;
@@ -233,6 +234,9 @@ export function initDb(dbPath = "./agent-swarm-db.sqlite"): Database {
              WHERE clientSecretEncrypted = 1 AND clientSecret IS NOT NULL
            UNION ALL
            SELECT 1 FROM oauth_authorizations WHERE tokensEncrypted = 1
+           ${sealedReplayExistsSql()
+             .map((arm) => `UNION ALL ${arm}`)
+             .join("\n           ")}
          ) AS present`,
       )
       .get()?.present ?? 0) === 1;

package/src/be/db/script-runs.ts

@@ -0,0 +1,15 @@
+import { openSealedJson } from "../sealed-json";
+import { getDbClient } from "./runtime";
+
+/**
+ * The exact args a run executes with, or `undefined` when the run has no row.
+ * Only the supervisor may call this: everything else reads the redacted view
+ * on `ScriptRun.args`.
+ */
+export async function getScriptRunExecutionArgs(id: string): Promise<unknown> {
+  const row = await getDbClient().get<{ args: string }>(
+    "SELECT args FROM script_runs WHERE id = ?",
+    [id],
+  );
+  return row ? openSealedJson(row.args) : undefined;
+}

package/src/be/db/tasks/write.ts

@@ -87,7 +87,7 @@ export async function createTask(
       id,
       defaultAssetKey("task", id),
       agentId,
-      task,
+      scrubSecrets(task),
       "pending",
       source,
       options?.slackChannelId ?? null,

package/src/be/db-queries/mcp-oauth.ts

@@ -2,6 +2,7 @@ import { scrubSecrets } from "../../utils/secret-scrubber";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { normalizeDateRequired } from "../date-utils";
 import { getDbClient } from "../db";
+import { oauthSecretName, registerStoredSecret } from "../secret-registry";
 import {
   type OAuthAuthorizationStatus,
   updateAuthorizationTokens,
@@ -266,6 +267,10 @@ async function upsertMcpApp(input: {
     input.dcrClientSecret == null || input.dcrClientSecret === ""
       ? (existing?.clientSecret ?? null)
       : encryptSecret(input.dcrClientSecret, getEncryptionKey());
+  registerStoredSecret(
+    input.dcrClientSecret,
+    oauthSecretName(`mcp-${input.mcpServerId}`, "client_secret"),
+  );
   // MCP OAuth applications are DCR-owned storage rows even when the client
   // credentials were supplied manually or preregistered. Preserve that exact
   // distinction in metadata for the legacy adapter boundary.

package/src/be/db-queries/oauth.ts

@@ -2,6 +2,7 @@ import type { OAuthApp, OAuthTokens } from "../../tracker/types";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { normalizeDateRequired } from "../date-utils";
 import { getDbClient } from "../db";
+import { oauthSecretName, registerStoredSecret } from "../secret-registry";
 
 type OAuthAppRow = Omit<
   OAuthApp,
@@ -241,6 +242,7 @@ async function writeOAuthApp(
   const metadataProvided = data.metadata !== undefined;
   const lifted = metadataProvided ? storageMetadata(data.metadata as string) : null;
   const encryptedSecret = encryptSecret(data.clientSecret, getEncryptionKey());
+  registerStoredSecret(data.clientSecret, oauthSecretName(provider, "client_secret"));
   const scopeSeparator =
     data.scopeSeparator ?? existing?.scopeSeparator ?? (provider === "linear" ? "," : " ");
   const rotation =
@@ -373,6 +375,79 @@ export async function getAuthorizationById(id: string): Promise<OAuthAuthorizati
   return row ? normalizeAuthorization(row) : null;
 }
 
+/** Register an authorization's new plaintext tokens with the secret registry,
+ * named by the owning app's provider (`mcp-<serverId>` for MCP apps). */
+async function registerAuthorizationSecrets(
+  appId: string,
+  accessToken: string,
+  refreshToken: string | null | undefined,
+): Promise<void> {
+  const app = await getDbClient().get<{ provider: string }>(
+    "SELECT provider FROM oauth_apps WHERE id = ?",
+    [appId],
+  );
+  const provider = app?.provider ?? appId;
+  registerStoredSecret(accessToken, oauthSecretName(provider, "access_token"));
+  registerStoredSecret(refreshToken, oauthSecretName(provider, "refresh_token"));
+}
+
+export type StoredOAuthSecretKind = "client_secret" | "access_token" | "refresh_token";
+
+/**
+ * Every stored OAuth credential, decrypted, for the secret registry
+ * (src/be/secret-registry.ts): client secrets of all apps (provider and
+ * MCP-managed) and the tokens of all authorizations, whatever their status.
+ * A row that fails to decrypt is counted, not thrown.
+ */
+export async function listStoredOAuthSecrets(): Promise<{
+  secrets: { provider: string; kind: StoredOAuthSecretKind; value: string }[];
+  failed: number;
+}> {
+  const secrets: { provider: string; kind: StoredOAuthSecretKind; value: string }[] = [];
+  let failed = 0;
+
+  const apps = await getDbClient().query<OAuthAppRow>("SELECT * FROM oauth_apps");
+  for (const row of apps) {
+    try {
+      const app = normalizeOAuthApp(row);
+      if (app.clientSecret) {
+        secrets.push({ provider: app.provider, kind: "client_secret", value: app.clientSecret });
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  const authorizations = await getDbClient().query<OAuthAuthorizationRow & { provider: string }>(
+    `SELECT z.*, a.provider AS provider
+       FROM oauth_authorizations z
+       JOIN oauth_apps a ON a.id = z.appId`,
+  );
+  for (const row of authorizations) {
+    try {
+      const authorization = normalizeAuthorization(row);
+      if (authorization.accessToken) {
+        secrets.push({
+          provider: row.provider,
+          kind: "access_token",
+          value: authorization.accessToken,
+        });
+      }
+      if (authorization.refreshToken) {
+        secrets.push({
+          provider: row.provider,
+          kind: "refresh_token",
+          value: authorization.refreshToken,
+        });
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  return { secrets, failed };
+}
+
 export async function upsertAuthorization(data: {
   id?: string;
   appId: string;
@@ -402,6 +477,7 @@ export async function upsertAuthorization(data: {
       : data.refreshToken == null
         ? null
         : encryptSecret(data.refreshToken, key);
+  await registerAuthorizationSecrets(data.appId, data.accessToken, data.refreshToken);
 
   if (existing) {
     await getDbClient().run(
@@ -486,6 +562,7 @@ export async function updateAuthorizationTokens(
       : data.refreshToken == null
         ? null
         : encryptSecret(data.refreshToken, key);
+  await registerAuthorizationSecrets(existing.appId, data.accessToken, data.refreshToken);
   const result = await getDbClient().run(
     `UPDATE oauth_authorizations SET
          accessToken = ?, refreshToken = ?, expiresAt = ?, scope = ?,