@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/src/be/memory/providers/sqlite-store.ts

@@ -2,6 +2,7 @@ import { getDb, getDbClient, isSqliteVecAvailable } from "@/be/db";
 import { cosineSimilarity, deserializeEmbedding, serializeEmbedding } from "@/be/embedding";
 import { contentSha256 } from "@/commands/profile-sync";
 import type { AgentMemory, AgentMemoryScope, AgentMemorySource } from "@/types";
+import { scrubSecrets } from "@/utils/secret-scrubber";
 import {
   EMBEDDING_DIMENSIONS,
   isHybridSearchEnabled,
@@ -19,6 +20,7 @@ import type {
   MemoryInput,
   MemoryListOptions,
   MemoryRetrievalSource,
+  MemoryScrubFields,
   MemorySearchOptions,
   MemoryStats,
   MemoryStore,
@@ -437,7 +439,12 @@ export class SqliteMemoryStore implements MemoryStore {
     const now = new Date().toISOString();
     const key = input.key ?? `${input.scope}/${input.source}/${id}`;
     const expiresAt = computeExpiresAt(input.source, key);
-    const contentHash = contentSha256(input.content);
+    // Scrub before the hash, the FTS sync and the caller's embedding (callers
+    // embed the returned row's content), so all of them see the same text.
+    const name = scrubSecrets(input.name);
+    const content = scrubSecrets(input.content);
+    const summary = input.summary == null ? null : scrubSecrets(input.summary);
+    const contentHash = contentSha256(content);
     const version = 1;
 
     const row = await getDbClient().transaction(async (tx) => {
@@ -449,15 +456,15 @@ export class SqliteMemoryStore implements MemoryStore {
           input.agentId ?? null,
           input.scope,
           key,
-          input.name,
-          input.content,
-          input.summary ?? null,
+          name,
+          content,
+          summary,
           input.source,
           input.sourceTaskId ?? null,
           input.sourcePath ?? null,
           input.chunkIndex ?? 0,
           input.totalChunks ?? 1,
-          JSON.stringify(input.tags ?? []),
+          JSON.stringify((input.tags ?? []).map((tag) => scrubSecrets(tag))),
           now,
           now,
           now,
@@ -478,7 +485,7 @@ export class SqliteMemoryStore implements MemoryStore {
           crypto.randomUUID(),
           inserted.id,
           version,
-          input.content,
+          content,
           contentHash,
           input.intent ?? "create memory",
           input.agentId ?? null,
@@ -1009,13 +1016,17 @@ export class SqliteMemoryStore implements MemoryStore {
 
       const previousVersion = row.version ?? 1;
       const moving = input.newKey !== undefined && input.newKey !== row.key;
+      // Scrub the edited text before the hash and FTS sync; callers embed the
+      // returned content, so the vector matches the stored row.
       const nextContent = moveOnly
         ? row.content
-        : applyEditMode(input.mode, row.content, {
-            content: input.content,
-            oldString: input.oldString,
-            newString: input.newString,
-          });
+        : scrubSecrets(
+            applyEditMode(input.mode, row.content, {
+              content: input.content,
+              oldString: input.oldString,
+              newString: input.newString,
+            }),
+          );
 
       const nextHash = contentSha256(nextContent);
       const contentChanged = !moveOnly && nextHash !== row.contentHash;
@@ -1268,6 +1279,47 @@ export class SqliteMemoryStore implements MemoryStore {
     }
   }
 
+  async rewriteForScrub(
+    id: string,
+    before: MemoryScrubFields,
+    after: MemoryScrubFields,
+  ): Promise<boolean> {
+    const contentChanged = after.content !== before.content;
+    return getDbClient().transaction(async (tx) => {
+      // Compare-and-set: the sweep scrubbed `before` outside the write lock, so
+      // skip the row if a concurrent write moved it since.
+      const result = await tx.run(
+        `UPDATE agent_memory
+         SET name = ?, content = ?, summary = ?, contentHash = ?,
+             embedding = CASE WHEN ? = 1 THEN NULL ELSE embedding END,
+             embeddingModel = CASE WHEN ? = 1 THEN NULL ELSE embeddingModel END
+         WHERE id = ? AND name IS ? AND content IS ? AND summary IS ?`,
+        [
+          after.name,
+          after.content,
+          after.summary,
+          contentSha256(after.content),
+          contentChanged ? 1 : 0,
+          contentChanged ? 1 : 0,
+          id,
+          before.name,
+          before.content,
+          before.summary,
+        ],
+      );
+      if (result.changes === 0) return false;
+      // The vector embeds the old (secret-bearing) content. Drop it; the
+      // re-embed backfill picks the row up via `embedding IS NULL`.
+      if (contentChanged && this.vecInitialized && this.getVecTableSchema()) {
+        await tx.run("DELETE FROM memory_vec WHERE memory_id = ?", [id]);
+      }
+      if (after.name !== before.name || contentChanged) {
+        await this.syncFtsRow(id, after.name, after.content);
+      }
+      return true;
+    });
+  }
+
   async getStats(agentId: string): Promise<MemoryStats> {
     const db = getDbClient();
 

package/src/be/memory/types.ts

@@ -40,6 +40,17 @@ export interface MemoryStore {
   deleteBySourcePath(sourcePath: string, agentId: string): Promise<number>;
   purgeExpired(): Promise<number>;
   updateEmbedding(id: string, embedding: Float32Array, model: string): Promise<void>;
+  /**
+   * Redact a row in place (boot retro-sweep). Writes only if the row still
+   * holds `before`; keeps FTS in sync and drops the embedding when the
+   * content changed so the re-embed backfill regenerates it. Returns whether
+   * the row was written.
+   */
+  rewriteForScrub(
+    id: string,
+    before: MemoryScrubFields,
+    after: MemoryScrubFields,
+  ): Promise<boolean>;
   getStats(agentId: string): Promise<MemoryStats>;
   getHealth(): MemoryHealth;
 }
@@ -48,6 +59,9 @@ export interface MemoryStore {
 // Supporting types
 // ============================================================================
 
+/** The free-text `agent_memory` columns the boot retro-sweep redacts. */
+export type MemoryScrubFields = { name: string; content: string; summary: string | null };
+
 export interface MemoryInput {
   agentId: string | null;
   scope: AgentMemoryScope;

package/src/be/migrations/201_workflow_replay_columns.sql

@@ -0,0 +1,10 @@
+-- Byte-exact replay state for workflow runs, sealed at rest.
+--
+-- `workflow_run_steps.output` and `workflow_runs.context` are scrubbed at write
+-- for display and SQL filters (`json_extract(context, '$.swarm.requestedByUserId')`).
+-- Resume, retry, dedup and recovery rebuild the live ctx from these values, so
+-- they need the exact value: these columns hold it, encrypted with `sealJson`
+-- (src/be/sealed-json.ts). NULL for rows written before this migration; their
+-- readers fall back to the plain column.
+ALTER TABLE workflow_run_steps ADD COLUMN output_replay TEXT;
+ALTER TABLE workflow_runs ADD COLUMN context_replay TEXT;

package/src/be/migrations/202_codex_oauth_device_flows.sql

@@ -0,0 +1,24 @@
+-- Codex device-login flow state, moved out of `kv_entries`.
+--
+-- `state` is the encrypted flow (device auth id, user code, poll lease). It
+-- lived in `kv_entries` namespace 'codex-oauth-device', which db-query must
+-- keep readable for general KV debugging. A dedicated table lets db-query deny
+-- this store by table name, with no SQL-text parsing.
+--
+-- expires_at: unix-ms. Expired rows are deleted on read and on every write.
+
+CREATE TABLE IF NOT EXISTS codex_oauth_device_flows (
+  flow_id     TEXT PRIMARY KEY,
+  state       TEXT NOT NULL,
+  expires_at  INTEGER NOT NULL,
+  created_at  INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  updated_at  INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+
+INSERT OR IGNORE INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+  SELECT key, value, expires_at, created_at, updated_at
+    FROM kv_entries
+   WHERE namespace = 'codex-oauth-device'
+     AND expires_at IS NOT NULL;
+
+DELETE FROM kv_entries WHERE namespace = 'codex-oauth-device';

package/src/be/scripts/db.ts

@@ -8,10 +8,10 @@ import type {
   ScriptScope,
   ScriptVersionRecord,
 } from "../../types";
-import { registerVolatileSecret } from "../../utils/secret-scrubber";
 import { generateBearerToken, generateShortId } from "../../utils/short-id";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { computeContentHash, getDbClient } from "../db";
+import { registerStoredSecret, scriptApiSecretName } from "../secret-registry";
 import { embedScript } from "./embeddings";
 
 type ScriptRow = Omit<ScriptRecord, "isScratch" | "typeChecked"> & {
@@ -517,7 +517,7 @@ export async function createScriptApi(args: {
         ],
       );
       if (!row) throw new Error("Failed to create script API endpoint");
-      if (token) registerVolatileSecret(token, `script-api:${id}`);
+      registerStoredSecret(token, scriptApiSecretName(id));
       return { ...rowToScriptApi(row), token };
     } catch (err) {
       if (isUniqueConstraintError(err) && attempt < 4) continue;
@@ -527,6 +527,30 @@ export async function createScriptApi(args: {
   throw new Error("Failed to allocate a unique script API endpoint id");
 }
 
+/**
+ * Every stored script API bearer token, decrypted, for the secret registry
+ * (src/be/secret-registry.ts). A row that fails to decrypt is counted, not thrown.
+ */
+export async function listStoredScriptApiSecrets(): Promise<{
+  secrets: { id: string; token: string }[];
+  failed: number;
+}> {
+  const rows = await getDbClient().query<{ id: string; bearerTokenEncrypted: string }>(
+    "SELECT id, bearerTokenEncrypted FROM script_apis WHERE bearerTokenEncrypted IS NOT NULL",
+  );
+  const secrets: { id: string; token: string }[] = [];
+  let failed = 0;
+  for (const row of rows) {
+    try {
+      const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
+      if (token) secrets.push({ id: row.id, token });
+    } catch {
+      failed++;
+    }
+  }
+  return { secrets, failed };
+}
+
 export async function listScriptApisForScript(scriptId: string): Promise<ScriptApiRecord[]> {
   const rows = await getDbClient().query<ScriptApiRow>(
     "SELECT * FROM script_apis WHERE scriptId = ? ORDER BY createdAt DESC",
@@ -554,7 +578,7 @@ export async function getScriptApiSecret(id: string): Promise<string | null> {
   );
   if (!row?.bearerTokenEncrypted) return null;
   const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
-  registerVolatileSecret(token, `script-api:${id}`);
+  registerStoredSecret(token, scriptApiSecretName(id));
   return token;
 }
 
@@ -604,7 +628,7 @@ export async function rotateScriptApiSecret(
     [encrypted, updatedBy ?? null, id],
   );
   if (!row) return null;
-  registerVolatileSecret(token, `script-api:${id}`);
+  registerStoredSecret(token, scriptApiSecretName(id));
   return { ...rowToScriptApi(row), token };
 }
 

package/src/be/scripts/source-secrets.ts

@@ -0,0 +1,37 @@
+import { findSecretsIn } from "../../utils/secret-scrubber";
+
+/**
+ * Executable source is stored and served verbatim (`scripts.source`,
+ * `script_versions.source`, `script_runs.source`): redacting it would change
+ * what runs, and sealing it would hide reviewed code. So a source that embeds
+ * a secret is refused at write instead, before anything runs or persists.
+ *
+ * Checked: every registered secret value, in each encoded form the known-value
+ * matcher holds, and the gitleaks vendor-token rules. The refusal names the
+ * secret's key or the rule id, never the value. Rows written before this check
+ * are left as they are.
+ */
+export interface SourceSecretRefusal {
+  error: "source_contains_secret";
+  message: string;
+  findings: { kind: "registered-secret" | "gitleaks-rule"; id: string }[];
+}
+
+export function refuseSourceWithSecrets(source: string): SourceSecretRefusal | null {
+  const { knownValues, gitleaksRules } = findSecretsIn(source);
+  if (knownValues.length === 0 && gitleaksRules.length === 0) return null;
+  const findings = [
+    ...knownValues.map((id) => ({ kind: "registered-secret" as const, id })),
+    ...gitleaksRules.map((id) => ({ kind: "gitleaks-rule" as const, id })),
+  ];
+  const named = findings
+    .map((f) =>
+      f.kind === "registered-secret" ? `registered secret ${f.id}` : `gitleaks rule ${f.id}`,
+    )
+    .join(", ");
+  return {
+    error: "source_contains_secret",
+    message: `Script source contains a secret (${named}); nothing was saved or run. Source is stored and shown verbatim, so read secrets at run time instead: a credential binding (ctx.api.<slug> / ctx.mcp.<slug>) or ctx.swarm.config.get("<KEY>").`,
+    findings,
+  };
+}

package/src/be/scrub-json.ts

@@ -0,0 +1,32 @@
+import { type ScrubbedText, scrubObject, scrubSecrets } from "../utils/secret-scrubber";
+
+/** True when `before` parsed as JSON and `after` no longer does. */
+export function breaksJsonValidity(before: string, after: string): boolean {
+  try {
+    JSON.parse(before);
+  } catch {
+    return false;
+  }
+  try {
+    JSON.parse(after);
+    return false;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * Serialize `value` for a JSON TEXT column with secrets redacted.
+ *
+ * Scrubs the serialized text first, so context-keyed passes (`"password":
+ * "..."`, auth headers) see the key next to its value. When a redaction breaks
+ * JSON validity (a marker swallowed a quote or brace), falls back to scrubbing
+ * each string leaf, which always serializes cleanly. Readers keep `JSON.parse`.
+ */
+export function scrubJsonValue(value: unknown): ScrubbedText {
+  const raw = JSON.stringify(value);
+  const scrubbed = scrubSecrets(raw);
+  if (!breaksJsonValidity(raw, scrubbed)) return scrubbed;
+  // Every string leaf went through scrubSecrets; the brand holds.
+  return JSON.stringify(scrubObject(value)) as ScrubbedText;
+}

package/src/be/sealed-json.ts

@@ -0,0 +1,59 @@
+import { decryptSecret, encryptSecret, getEncryptionKey } from "./crypto";
+import { scrubJsonValue } from "./scrub-json";
+
+/**
+ * Sealed JSON: byte-exact replay state, encrypted at rest.
+ *
+ * Some JSON columns are execution inputs, not records. The supervisor relaunches
+ * a durable script run from `script_runs.args`, and the harness replays
+ * `script_run_journal.result` as a step's return value. Redacting them would
+ * change what the script sees after a restart, and storing them raw leaves a
+ * secret at rest. Sealing keeps the exact bytes for the replay readers and
+ * nothing readable for anything that scans the database.
+ *
+ * Readers pick a view: `openSealedJson` (replay, exact value) or
+ * `sealedJsonForDisplay` (API/UI, redacted). Rows written before sealing are
+ * plain JSON and both readers still accept them.
+ */
+
+const SEALED_PREFIX = "sealed:v1:";
+
+/**
+ * Every column a writer fills with `sealJson`. Boot counts a sealed value here
+ * as encrypted data, like an encrypted config or OAuth row: with the key
+ * missing, startup refuses instead of generating a replacement key that could
+ * never open them. Add a column here when a writer starts sealing it.
+ */
+export const SEALED_REPLAY_COLUMNS: readonly { table: string; column: string }[] = [
+  { table: "script_runs", column: "args" },
+  { table: "script_run_journal", column: "result" },
+  { table: "workflow_run_steps", column: "output_replay" },
+  { table: "workflow_runs", column: "context_replay" },
+  { table: "approval_requests", column: "responses" },
+];
+
+/** SQL `EXISTS` arms matching a sealed value in each `SEALED_REPLAY_COLUMNS` entry. */
+export function sealedReplayExistsSql(): string[] {
+  return SEALED_REPLAY_COLUMNS.map(
+    ({ table, column }) => `SELECT 1 FROM ${table} WHERE ${column} GLOB '${SEALED_PREFIX}*'`,
+  );
+}
+
+export function sealJson(value: unknown): string {
+  return SEALED_PREFIX + encryptSecret(JSON.stringify(value), getEncryptionKey());
+}
+
+export function isSealedJson(text: string): boolean {
+  return text.startsWith(SEALED_PREFIX);
+}
+
+/** The exact stored value. Only execution and replay paths may call this. */
+export function openSealedJson(text: string): unknown {
+  if (!isSealedJson(text)) return JSON.parse(text);
+  return JSON.parse(decryptSecret(text.slice(SEALED_PREFIX.length), getEncryptionKey()));
+}
+
+/** The stored value with secrets redacted, for API responses and the UI. */
+export function sealedJsonForDisplay(text: string): unknown {
+  return JSON.parse(scrubJsonValue(openSealedJson(text)));
+}

package/src/be/secret-registry.ts

@@ -0,0 +1,131 @@
+/**
+ * API-side registry of every stored secret value.
+ *
+ * The scrubber's exact-match pass only knows sensitive env values and values
+ * registered at runtime. Without this registry, a secret stored before the
+ * last restart (an agent-scoped config secret, an OAuth or MCP OAuth token, a
+ * script API bearer token) stays unknown until something reads it again, and
+ * the boot retro-sweep cannot redact a value it does not know.
+ *
+ * At boot, `loadSecretRegistry()` decrypts every stored secret and registers
+ * it. Each encrypt site calls `registerStoredSecret()` with the new plaintext,
+ * so a write after boot is covered without a reload.
+ *
+ * Feeds the scrubber only through `registerVolatileSecret`, so worker-side
+ * code is untouched. Append-only: a deleted or rotated secret stays
+ * registered, since redacting a revoked value is still correct. Never logs a
+ * value: names are source markers (`config:<KEY>`, `oauth:<provider>:…`,
+ * `script-api:<id>`), and load results are counts.
+ */
+import { registerVolatileSecret } from "../utils/secret-scrubber";
+import { listStoredConfigSecrets } from "./db/config-secrets";
+import { listStoredOAuthSecrets, type StoredOAuthSecretKind } from "./db-queries/oauth";
+import { listStoredScriptApiSecrets } from "./scripts/db";
+
+export function configSecretName(key: string): string {
+  return `config:${key}`;
+}
+
+export function oauthSecretName(provider: string, kind: StoredOAuthSecretKind): string {
+  return `oauth:${provider}:${kind}`;
+}
+
+export function scriptApiSecretName(id: string): string {
+  return `script-api:${id}`;
+}
+
+/**
+ * Base64 text that encodes `value` wherever it sits in a larger byte string.
+ * Base64 maps 3 bytes to 4 chars, so the chars depend on the value's byte
+ * offset mod 3. For each offset, keep only the chars computed from the value's
+ * bytes alone: drop the leading chars that mix in preceding bytes and the
+ * trailing chars that depend on following bytes. Offset 0 also keeps the whole
+ * padded encoding (the value encoded on its own). This catches
+ * `Basic base64(user:secret)` and a secret inside an encoded JSON blob.
+ */
+function base64Forms(value: string): string[] {
+  const bytes = Buffer.from(value, "utf8");
+  const forms = [bytes.toString("base64")];
+  for (const offset of [0, 1, 2]) {
+    const shifted = Buffer.concat([Buffer.alloc(offset), bytes]);
+    // Offset 1 mixes the prefix into the first 2 chars, offset 2 into the first 3.
+    const skip = offset === 0 ? 0 : offset + 1;
+    const end = Math.floor(shifted.length / 3) * 4;
+    forms.push(shifted.toString("base64").slice(skip, end));
+  }
+  const urlSafe = forms.map((form) =>
+    form.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""),
+  );
+  return [...forms, ...urlSafe];
+}
+
+/**
+ * Encoded forms of a known value: base64 (std and url-safe, see
+ * `base64Forms`) and URL percent-encoding. Shell and JSON escaping are not
+ * repeated here: `registerVolatileSecret` already adds those forms (and
+ * drops any form shorter than the scrubber's minimum length).
+ */
+export function encodedForms(value: string): string[] {
+  const forms = new Set(base64Forms(value));
+  const uriEncoded = encodeURIComponent(value);
+  if (uriEncoded !== value) forms.add(uriEncoded);
+  forms.delete(value);
+  forms.delete("");
+  return [...forms];
+}
+
+/** Register a stored secret value, plus its encoded forms, with the scrubber. */
+export function registerStoredSecret(value: string | null | undefined, name: string): void {
+  if (!value) return;
+  registerVolatileSecret(value, name);
+  for (const form of encodedForms(value)) registerVolatileSecret(form, name);
+}
+
+export interface SecretRegistryLoadResult {
+  config: number;
+  oauth: number;
+  scriptApi: number;
+  /** Rows that could not be read or decrypted (wrong or missing key). */
+  failed: number;
+}
+
+/**
+ * Register every stored secret. Called once at API boot, before the boot
+ * retro-sweep. A row that fails to decrypt is counted and skipped; a source
+ * that fails as a whole (e.g. no encryption key resolved) is counted as one
+ * failure and the other sources still load.
+ */
+export async function loadSecretRegistry(): Promise<SecretRegistryLoadResult> {
+  const result: SecretRegistryLoadResult = { config: 0, oauth: 0, scriptApi: 0, failed: 0 };
+
+  try {
+    const { secrets, failed } = await listStoredConfigSecrets();
+    for (const { key, value } of secrets) registerStoredSecret(value, configSecretName(key));
+    result.config = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  try {
+    const { secrets, failed } = await listStoredOAuthSecrets();
+    for (const { provider, kind, value } of secrets) {
+      registerStoredSecret(value, oauthSecretName(provider, kind));
+    }
+    result.oauth = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  try {
+    const { secrets, failed } = await listStoredScriptApiSecrets();
+    for (const { id, token } of secrets) registerStoredSecret(token, scriptApiSecretName(id));
+    result.scriptApi = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  return result;
+}

package/src/be/workflow-replay.ts

@@ -0,0 +1,77 @@
+import { openSealedJson } from "./sealed-json";
+
+/**
+ * Which copy of a workflow payload a reader gets.
+ *
+ * - `replay`: the exact value from the sealed `*_replay` column. Resume, retry,
+ *   dedup and recovery rebuild the live ctx from it, so a downstream consumer
+ *   sees the same bytes after a restart as in the uninterrupted run.
+ * - `display`: the scrubbed column, for API responses, MCP tools and the UI.
+ */
+export type WorkflowPayloadView = "replay" | "display";
+
+/**
+ * A sealed replay copy exists but cannot be opened (missing or rotated
+ * encryption key, corrupt ciphertext). The scrubbed copy holds redaction
+ * markers, so replaying it would silently feed them to downstream nodes: the
+ * run fails with this error instead.
+ */
+export class WorkflowReplayStateError extends Error {
+  constructor(
+    readonly runId: string,
+    readonly target: string,
+    cause: unknown,
+  ) {
+    super(
+      `Workflow run ${runId} cannot replay ${target}: its sealed replay copy could not be opened (${
+        cause instanceof Error ? cause.message : String(cause)
+      }). The redacted copy is never replayed. Restore the SECRETS_ENCRYPTION_KEY that sealed it, then retry the run.`,
+    );
+    this.name = "WorkflowReplayStateError";
+  }
+}
+
+/**
+ * Set `target[key]` from a workflow payload pair.
+ *
+ * `display` parses the scrubbed column. `replay` opens the sealed column
+ * lazily, on first read of the property: status-only readers (cancel, polls,
+ * cooldown) never decrypt and keep working without the key. Rows written before
+ * the replay columns existed have no sealed copy and fall back to the plain
+ * column.
+ */
+export function defineWorkflowPayload<T extends object>(
+  target: T,
+  key: keyof T & string,
+  plain: string | null | undefined,
+  sealed: string | null | undefined,
+  view: WorkflowPayloadView,
+  where: { runId: string; target: string },
+): T {
+  if (view === "display" || !sealed) {
+    (target as Record<string, unknown>)[key] = plain ? JSON.parse(plain) : undefined;
+    return target;
+  }
+  let opened = false;
+  let value: unknown;
+  Object.defineProperty(target, key, {
+    enumerable: true,
+    configurable: true,
+    get() {
+      if (!opened) {
+        try {
+          value = openSealedJson(sealed);
+        } catch (err) {
+          throw new WorkflowReplayStateError(where.runId, where.target, err);
+        }
+        opened = true;
+      }
+      return value;
+    },
+    set(next: unknown) {
+      value = next;
+      opened = true;
+    },
+  });
+  return target;
+}

package/src/http/codex-oauth-device.ts

@@ -1,7 +1,8 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../be/crypto";
-import { getDbClient, getKv, upsertKv, upsertSwarmConfig } from "../be/db";
+import { getDbClient, upsertSwarmConfig } from "../be/db";
+import { getCodexDeviceFlow, upsertCodexDeviceFlow } from "../be/db/codex-oauth-device-flows";
 import { updateOnboardingAiFromCodexDevice } from "../be/onboarding";
 import {
   CODEX_DEVICE_VERIFICATION_URL,
@@ -17,7 +18,6 @@ import { ensureConfigAdmin } from "./config";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
-const FLOW_NAMESPACE = "codex-oauth-device";
 const FLOW_TTL_MS = 15 * 60 * 1_000;
 const POLL_LEASE_MS = 45_000;
 
@@ -85,10 +85,10 @@ function registerFlowSecrets(state: FlowState): void {
 }
 
 async function readFlow(flowId: string): Promise<FlowState | null> {
-  const entry = await getKv(FLOW_NAMESPACE, flowId);
-  if (!entry || typeof entry.value !== "string") return null;
+  const entry = await getCodexDeviceFlow(flowId);
+  if (!entry) return null;
   try {
-    const plaintext = decryptSecret(entry.value, getEncryptionKey());
+    const plaintext = decryptSecret(entry.state, getEncryptionKey());
     const parsed = FlowStateSchema.safeParse(JSON.parse(plaintext));
     if (!parsed.success) return null;
     registerFlowSecrets(parsed.data);
@@ -99,11 +99,9 @@ async function readFlow(flowId: string): Promise<FlowState | null> {
 }
 
 async function writeFlow(flowId: string, state: FlowState): Promise<void> {
-  await upsertKv({
-    namespace: FLOW_NAMESPACE,
-    key: flowId,
-    value: encryptSecret(JSON.stringify(state), getEncryptionKey()),
-    valueType: "string",
+  await upsertCodexDeviceFlow({
+    flowId,
+    state: encryptSecret(JSON.stringify(state), getEncryptionKey()),
     expiresAt: state.expiresAt,
   });
 }

package/src/http/db-query-bounded.ts

@@ -37,6 +37,7 @@
 import { getDb, resolveSqliteVecExtensionPath } from "../be/db";
 import type { DbQueryResult } from "./db-query-shared";
 import {
+  assertNoDeniedTables,
   assertSingleStatement,
   DbQueryConcurrencyCapError,
   DbQueryTimeoutError,
@@ -203,6 +204,8 @@ export async function executeReadOnlyQueryBounded(
   maxRows?: number,
 ): Promise<DbQueryResult> {
   assertSingleStatement(sql);
+  // The child opens its own connection, so the parent checks the program first.
+  assertNoDeniedTables(sql);
   acquireBoundedQuerySlot();
 
   try {