@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/dist/{http-w40q4w94.js → http-jsmtag08.js}

@@ -10,7 +10,7 @@ import {
 } from "./cli-efnd2kce.js";
 import {
   ACP_TARGET_IDS
-} from "./cli-fw6vdcq5.js";
+} from "./cli-zp67qg5x.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-bqjfjex4.js";
@@ -23,11 +23,11 @@ import {
 } from "./cli-2pdaysab.js";
 import {
   reasoningCapability
-} from "./cli-ttbsse3f.js";
+} from "./cli-tmhsxhb8.js";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg
-} from "./cli-prt9emct.js";
+} from "./cli-c2tpw9ck.js";
 import {
   DEFAULT_CONNECTOR_CODE_LABEL,
   checkHeartbeatChecklist,
@@ -35,10 +35,10 @@ import {
   exchangeConnectorCode,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-ba66wyhy.js";
+} from "./cli-qzmzwegq.js";
 import {
   Anthropic
-} from "./cli-ma3zvh39.js";
+} from "./cli-5qkcdv8c.js";
 import {
   AGENT_MAX_TASKS_CONFIG_KEY,
   ALL_CAPABILITIES,
@@ -335,13 +335,13 @@ import {
   workflowModelErrors,
   workflowSaveWarnings,
   writeUnhandledError
-} from "./cli-50eg13rj.js";
-import"./cli-x7afk5wm.js";
+} from "./cli-wydz3feg.js";
+import"./cli-xvc3q9br.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-420bdgw0.js";
+} from "./cli-mv2520nm.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -350,16 +350,16 @@ import {
 import {
   isMultiRuntimeEnabled
 } from "./cli-re8z5p8p.js";
-import"./cli-k6xx3pve.js";
+import"./cli-tx2zvn23.js";
 import {
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh,
   upsertModelCatalogOverlay
-} from "./cli-e7t4snpa.js";
+} from "./cli-p8rt8spp.js";
 import {
   normalizeModelKey
-} from "./cli-nfygw434.js";
+} from "./cli-v1pwxreq.js";
 import {
   ConnectionAuthInputSchema,
   MAX_SCRIPT_WALL_CLOCK_MS,
@@ -381,11 +381,8 @@ import {
   connectionAuthSummary,
   consumeMcpOAuthPending,
   createApprovalFollowUpTask,
-  createScriptApi,
   definitionNodeIds,
   deleteMcpOAuthToken,
-  deleteScript,
-  deleteScriptApi,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   ensureMcpToken,
@@ -400,13 +397,9 @@ import {
   getCredentialBindingById,
   getMcpOAuthToken,
   getOAuthBindingTokenStatus,
-  getScript,
-  getScriptApiById,
   getScriptApiConnectionDescriptors,
-  getScriptApiSecret,
   getScriptApiTypes,
   getScriptAppTypes,
-  getScriptById,
   getScriptConnectionById,
   getScriptMcpConnectionDescriptors,
   getScriptMcpTypes,
@@ -415,27 +408,21 @@ import {
   isInvalidClientError,
   listAppRecords,
   listRelationalCredentialBindings,
-  listScriptApisForScript,
   listScriptConnections,
   listScriptConnectionsAsync,
-  listScriptVersions,
-  listScripts,
   listVendoredOpenapiEntries,
   markMcpOAuthTokenStatus,
   normalizeTokenEndpointAuthMethod,
   oauthAppToProviderConfig,
   publicEndpointSsrfOptions,
   readStreamCapped,
-  recordScriptApiUsage,
   refreshMcpToken,
   refreshScriptConnection,
   registerClient,
   require_dist,
   require_typescript,
   resolveAdvertisedTokenEndpointAuthMethod,
-  restoreScratchScriptLastUsedIfUnchanged,
   revokeMcpToken,
-  rotateScriptApiSecret,
   runScript,
   sandboxSpawnEnv,
   scriptSdkTypesWithGeneratedApis,
@@ -443,28 +430,18 @@ import {
   selectDcrTokenEndpointAuthMethod,
   setMcpServerAuthMethod,
   setScriptConnectionEnabled,
-  touchScratchScriptLastUsed,
   typecheckScript,
   typecheckWithAmbient,
-  updateScriptApi,
   upsertCredentialBinding,
   upsertMcpOAuthToken,
-  upsertScriptByName,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-xtgtyafv.js";
+} from "./cli-577bxkf6.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import {
-  detachedProcessGroup,
-  forceTerminateProcessGroup,
-  registerProcessGroup,
-  signalProcessGroup,
-  terminateProcessGroup
-} from "./cli-zt3w1cn1.js";
-import"./cli-xb3c6aat.js";
+import"./cli-7mhy3ths.js";
 import {
   CLIENT_ID,
   MAX_CODEX_OAUTH_SLOT,
@@ -475,11 +452,24 @@ import {
   getAccountId,
   getValidCodexOAuth,
   loadAllCodexOAuthSlots
-} from "./cli-ftry7975.js";
-import"./cli-3dpj7atn.js";
-import"./cli-2x0e561b.js";
-import"./cli-pkke6geq.js";
+} from "./cli-v1w7pbd8.js";
+import {
+  detachedProcessGroup,
+  forceTerminateProcessGroup,
+  registerProcessGroup,
+  signalProcessGroup,
+  terminateProcessGroup
+} from "./cli-zt3w1cn1.js";
+import"./cli-km4x66j0.js";
 import"./cli-rb9m6rpe.js";
+import"./cli-2x0e561b.js";
+import {
+  buildAuthorizationUrl,
+  exchangeAuthorizationCode,
+  forceRefreshAuthorizationOrThrow,
+  forceRefreshTokenOrThrow,
+  oauthAppRowToProviderConfig
+} from "./cli-kw0jcfje.js";
 import {
   AgentFsProvider,
   FilesError,
@@ -487,47 +477,6 @@ import {
   getFileStorageProvider,
   normalizeFilesError
 } from "./cli-mzfth0bp.js";
-import {
-  searchScripts
-} from "./cli-jqt9hrnz.js";
-import {
-  CANDIDATE_SET_MULTIPLIER,
-  EMBEDDING_DIMENSIONS,
-  MEMORY_KEY_MAX_LENGTH,
-  OpenAI,
-  getEmbeddingProvider,
-  getMemoryStore,
-  init_constants as init_constants2,
-  init_key_paths,
-  init_openai,
-  init_reranker,
-  rerank
-} from "./cli-yhmwmv0g.js";
-import"./cli-wfajtmf7.js";
-import {
-  acquireOAuthRefreshLock,
-  buildAuthorizationUrl,
-  consumeOAuthPending,
-  createOAuthApp,
-  deleteAuthorizationById,
-  deleteAuthorizationsForApp,
-  deleteOAuthTokens,
-  exchangeAuthorizationCode,
-  forceRefreshAuthorizationOrThrow,
-  forceRefreshTokenOrThrow,
-  gcOAuthPending,
-  getAuthorizationById,
-  getDefaultAuthorizationIdForProvider,
-  getOAuthApp,
-  getOAuthAppById,
-  getOAuthTokens,
-  listAuthorizationsForApp,
-  oauthAppRowToProviderConfig,
-  releaseOAuthRefreshLock,
-  updateAuthorizationIdentity,
-  updateOAuthAppById,
-  upsertAuthorization
-} from "./cli-a87b04k8.js";
 import"./cli-fad8m16k.js";
 import"./cli-bsakbbkm.js";
 import"./cli-zxg80zs9.js";
@@ -546,34 +495,34 @@ import {
   recordDbRetentionStatement,
   recordDbRetentionSweep,
   recordSessionCost,
+  require_content_type,
   startSlackApp,
   startSpan,
   stopSlackApp,
   withRemoteContext,
   withSpan,
   withSpanContext
-} from "./cli-0n4fasz0.js";
+} from "./cli-c8r99akr.js";
 import"./cli-q51yprfq.js";
 import"./cli-3er6gcsn.js";
-import"./cli-cvk6yzw5.js";
 import"./cli-yatxqynm.js";
 import {
   bedrockProviderModule
-} from "./cli-ng97fjq7.js";
+} from "./cli-cmxkbzzs.js";
 import"./cli-yn0a417a.js";
 import"./cli-cgj4hc12.js";
 import"./cli-txgcknmy.js";
 import"./cli-6map995v.js";
-import"./cli-8kt0bmgx.js";
+import"./cli-xf713zz0.js";
 import"./cli-y2apkfe2.js";
 import"./cli-7kyk9jr3.js";
 import {
   setBedrockProviderModule
-} from "./cli-b0f70z24.js";
-import"./cli-nexwh8zg.js";
+} from "./cli-mn8qkd8v.js";
+import"./cli-g7k7zbcz.js";
 import"./cli-btbzvq95.js";
 import"./cli-1m2e086m.js";
-import"./cli-bzr0ftht.js";
+import"./cli-wnb9b2g3.js";
 import"./cli-bd957dgb.js";
 import {
   import_websocket,
@@ -583,7 +532,7 @@ import"./cli-pzxba7gw.js";
 import {
   getUserGrant,
   init_rbac_roles
-} from "./cli-xnzrzets.js";
+} from "./cli-ypgba1a8.js";
 import {
   LEGACY_RULES,
   can,
@@ -595,19 +544,24 @@ import {
 } from "./cli-rfphkzh5.js";
 import {
   API_DRAINING_HEADER,
+  CANDIDATE_SET_MULTIPLIER,
   CODEX_AUTH_WATCH_NAMESPACE,
   CredentialBindingSchema,
   DB_RETENTION_TUNING_BOUNDS,
+  EMBEDDING_DIMENSIONS,
   EXTENSION_AGENT_ROLE,
   ExtensionAgentAssignmentError,
   HeartbeatExpiryError,
   KvTypeCollisionError,
   MAX_DB_RETENTION_DAYS,
+  MEMORY_KEY_MAX_LENGTH,
   NOT_EXTENSION_AGENT_SQL,
+  OpenAI,
   ReservedAgentRoleError,
   SteeringRequestError,
   _resolveIntegrationProvider,
   _resolveIntegrationType,
+  acquireOAuthRefreshLock,
   agentContextKey,
   auditAssetKeys,
   backfillSupersedeTaskResumeTaskId,
@@ -626,6 +580,7 @@ import {
   completeTask,
   computeContentHash,
   configureOrgDomainPersistence,
+  consumeOAuthPending,
   countActiveScriptRuns,
   countAllMetrics,
   countAllPages,
@@ -642,8 +597,10 @@ import {
   createLogEntry,
   createMcpServer,
   createMetric,
+  createOAuthApp,
   createPage,
   createScheduledTask,
+  createScriptApi,
   createScriptRun,
   createSessionCost,
   createSessionLogs,
@@ -655,14 +612,19 @@ import {
   decryptSecret,
   deleteActiveSession,
   deleteActiveSessionById,
+  deleteAuthorizationById,
+  deleteAuthorizationsForApp,
   deleteBudget,
   deleteKv,
   deleteMcpServer,
   deleteMetric,
+  deleteOAuthTokens,
   deletePage,
   deletePricingRow,
   deletePromptTemplate,
   deleteScheduledTask,
+  deleteScript,
+  deleteScriptApi,
   deleteSkill,
   deleteSkillFile,
   deleteSwarmConfig,
@@ -679,6 +641,7 @@ import {
   encryptSecret,
   extensionAgentAssignmentError,
   failTask,
+  gcOAuthPending,
   getActivePricingRow,
   getActiveSessions,
   getAgentById,
@@ -699,6 +662,7 @@ import {
   getAllUsers,
   getApprovalRequestById,
   getAttributionByPerson,
+  getAuthorizationById,
   getAvailableKeyIndices,
   getBudget,
   getBudgets,
@@ -710,6 +674,8 @@ import {
   getDashboardCostSummary,
   getDb,
   getDbClient,
+  getDefaultAuthorizationIdForProvider,
+  getEmbeddingProvider,
   getEncryptionKey,
   getInboxSummary,
   getInstanceActivity,
@@ -723,9 +689,13 @@ import {
   getLogsByAgentId,
   getLogsByTaskId,
   getMcpServerById,
+  getMemoryStore,
   getMetric,
   getMetricVersion,
   getMetricVersions,
+  getOAuthApp,
+  getOAuthAppById,
+  getOAuthTokens,
   getOfferedTasksForAgent,
   getPage,
   getPageBySlug,
@@ -750,8 +720,13 @@ import {
   getScheduledTaskById,
   getScheduledTaskByName,
   getScheduledTasks,
+  getScript,
+  getScriptApiById,
+  getScriptApiSecret,
+  getScriptById,
   getScriptRun,
   getScriptRunByIdempotencyKey,
+  getScriptRunExecutionArgs,
   getScriptRunJournalStep,
   getServicesByAgentId,
   getSessionCostSummary,
@@ -793,16 +768,25 @@ import {
   init_api_drain,
   init_asset_key_audit,
   init_codex_auth_failure,
+  init_constants as init_constants2,
   init_context_key,
   init_credential_broker,
   init_crypto,
   init_date_utils,
   init_db,
+  init_db1 as init_db2,
   init_default_drift,
+  init_embeddings,
   init_heartbeat_expiry,
   init_human_free,
+  init_key_paths,
+  init_memory,
+  init_oauth,
+  init_openai,
   init_request_auth_context,
+  init_reranker,
   init_runtime,
+  init_secret_registry,
   init_steering,
   init_swarm_config_guard,
   init_task_tool_manifest,
@@ -828,6 +812,7 @@ import {
   listApprovalRequestSummaries,
   listApprovalRequests,
   listAssetSummaries,
+  listAuthorizationsForApp,
   listFavorites,
   listInboxState,
   listKv,
@@ -835,13 +820,17 @@ import {
   listMetricsByAgent,
   listPagesByAgent,
   listRecentSessions,
+  listScriptApisForScript,
   listScriptRunJournalSteps,
   listScriptRuns,
+  listScriptVersions,
+  listScripts,
   listSkillFileManifest,
   listSkills,
   listTaskTemplates,
   listWorkflowRunsPage,
   listWorkflows,
+  loadSecretRegistry,
   markKeyRateLimited,
   markSteeringDelivered,
   markSteeringHandled,
@@ -862,9 +851,12 @@ import {
   recordKeyRateLimitWindows,
   recordKeySeatMismatch,
   recordKeyUsage,
+  recordScriptApiUsage,
   recordTaskProviderIfUnset,
   refreshActiveSessionOnActivity,
+  releaseOAuthRefreshLock,
   requestSteering,
+  rerank,
   reservedKeyError,
   resetEmptyPollCount,
   resetOrphanedInProgressTasksForAgent,
@@ -872,7 +864,10 @@ import {
   resolveApprovalRequest,
   resolvePromptTemplate,
   resolveTriggerSurface,
+  restoreScratchScriptLastUsedIfUnchanged,
   resumeTask,
+  rotateScriptApiSecret,
+  searchScripts,
   searchSkills,
   selectTaskTools,
   setAgentHarnessProvider,
@@ -887,6 +882,7 @@ import {
   supersedeTask,
   sweepExpiredKv,
   telemetry,
+  touchScratchScriptLastUsed,
   uninstallMcpServer,
   uninstallSkill,
   updateActiveSessionProviderSessionId,
@@ -900,9 +896,12 @@ import {
   updateAgentProvider,
   updateAgentStatus,
   updateAgentStatusFromCapacity,
+  updateAuthorizationIdentity,
   updateMetric,
+  updateOAuthAppById,
   updatePage,
   updateScheduledTask,
+  updateScriptApi,
   updateScriptRun,
   updateScriptRunIfNotTerminal,
   updateScriptRunIfRunning,
@@ -913,18 +912,21 @@ import {
   updateTaskVcs,
   updateUser,
   upsertAssetKeyMapping,
+  upsertAuthorization,
   upsertBudget,
   upsertChannelActivityCursor,
   upsertInboxState,
   upsertKv,
   upsertPromptTemplate,
+  upsertScriptByName,
   upsertScriptRunJournalStep,
   upsertSkillFile,
   upsertSkillFiles,
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-qdv8kgz7.js";
+} from "./cli-mkdsy1nq.js";
+import"./cli-3qhyh31j.js";
 import {
   ActiveSessionSchema,
   AgentAcpStatusSchema,
@@ -1051,13 +1053,12 @@ import {
   isSafeBundlePath,
   isTerminalTaskStatus,
   splitLegacyModelAlias
-} from "./cli-9s3h836g.js";
-import"./cli-3qhyh31j.js";
+} from "./cli-xvdgasgy.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-3a4m1aws.js";
+} from "./cli-mxvnnv5q.js";
 import {
   init_steering_enabled,
   isSteeringEnabled
@@ -1067,21 +1068,6 @@ import {
   getSlackConfiguration,
   init_config
 } from "./cli-dmtrxqhg.js";
-import"./cli-tadfgd0t.js";
-import {
-  MODEL_SCOPED_WINDOWS,
-  activeModelBlocks,
-  init_model_rate_limit_windows
-} from "./cli-ywybs5as.js";
-import {
-  MAX_PROFILE_FILE_LENGTH,
-  agentFsFileRoute,
-  getAppUrl,
-  getConfiguredAppUrls,
-  getMcpBaseUrl,
-  getPublicMcpBaseUrl,
-  init_constants
-} from "./cli-gd4favx9.js";
 import"./cli-agamgm0p.js";
 import {
   getAllTemplateDefinitions,
@@ -1098,7 +1084,26 @@ import {
   init_subscription_plans,
   isSubscriptionPlanId
 } from "./cli-1a2j50m0.js";
+import"./cli-tadfgd0t.js";
+import {
+  MODEL_SCOPED_WINDOWS,
+  activeModelBlocks,
+  init_model_rate_limit_windows
+} from "./cli-ywybs5as.js";
 import"./cli-f9w1semm.js";
+import {
+  getOpenRouterAttributionHeaders,
+  init_openrouter_base_url
+} from "./cli-a35hzdve.js";
+import {
+  MAX_PROFILE_FILE_LENGTH,
+  agentFsFileRoute,
+  getAppUrl,
+  getConfiguredAppUrls,
+  getMcpBaseUrl,
+  getPublicMcpBaseUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
 import {
   init_env_flag,
   isEnvFlagEnabled,
@@ -1107,7 +1112,7 @@ import {
 import {
   init_src,
   isAlias
-} from "./cli-zsh093hk.js";
+} from "./cli-014vns2y.js";
 import {
   exports_zod,
   init_zod
@@ -1124,21 +1129,22 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1kzfvd1z.js";
+} from "./cli-ymmc1zxg.js";
 import {
   init_event_bus,
   workflowEventBus
-} from "./cli-hpryr6em.js";
+} from "./cli-mb75wpxf.js";
 import {
   init_bus,
   realtimeBus
 } from "./cli-zf8jjwex.js";
 import {
+  findSecretsIn,
   init_secret_scrubber,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-h1spv8v4.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __require,
   __toESM
@@ -1193,13 +1199,13 @@ setBedrockProviderModule(bedrockProviderModule);
 import {
   createServer as createHttpServer
 } from "node:http";
-init_db();
+init_db2();
 
 // src/be/db-retention.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 init_env_flag();
 init_secret_scrubber();
-init_db();
+init_db2();
 init_swarm_config_guard();
 var DAY_MS = 24 * 60 * 60 * 1000;
 var RETENTION_INTERVAL_MS = 60 * 60 * 1000;
@@ -1750,7 +1756,7 @@ function stopHumanFreeDrain() {
 }
 
 // src/be/scripts/retention.ts
-init_db();
+init_db2();
 var SCRATCH_RETENTION_DAYS = 14;
 var SCRATCH_GC_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var scratchGcTimer = null;
@@ -1857,8 +1863,11 @@ function stopScratchScriptGc() {
   scratchGcTimer = null;
 }
 
+// src/http/index.ts
+init_secret_registry();
+
 // src/be/seed-capabilities.ts
-init_db();
+init_db2();
 var LEGACY_ALWAYS_ON_DEFAULTS = [
   "core",
   "config",
@@ -1893,7 +1902,7 @@ async function seedLegacyCapabilitiesConfig() {
 }
 
 // src/queue-stall-alarm.ts
-init_db();
+init_db2();
 init_secret_scrubber();
 var QUEUE_STALL_THRESHOLD_MS = 30 * 60 * 1000;
 var QUEUE_STALL_CHECK_INTERVAL_MS = 5 * 60 * 1000;
@@ -2054,7 +2063,7 @@ init_bus();
 
 // src/realtime/transport.ts
 init_zod();
-init_db();
+init_db2();
 init_secret_scrubber();
 init_bus();
 
@@ -2471,7 +2480,8 @@ function connect(ws, auth) {
 }
 
 // src/script-workflows/supervisor.ts
-init_db();
+init_db2();
+init_secret_scrubber();
 
 // src/script-workflows/executor.ts
 import { randomUUID } from "node:crypto";
@@ -3315,7 +3325,9 @@ async function startScriptRunProcess(run, baseUrl, apiKeyOverride) {
   if (process.env.SCRIPT_WORKFLOW_DEBUG === "true") {
     console.error(`[script-workflows] spawning ${run.id} auth override=${apiKeyOverride ? "yes" : "no"} len=${apiKey.length}`);
   }
-  const execution = await scriptExecutor.start({ run, baseUrl, apiKey });
+  const sealedArgs = await getScriptRunExecutionArgs(run.id);
+  const args = sealedArgs === undefined ? run.args : sealedArgs;
+  const execution = await scriptExecutor.start({ run: { ...run, args }, baseUrl, apiKey });
   managed.set(run.id, { execution });
   await updateScriptRun(run.id, {
     status: "running",
@@ -3326,7 +3338,7 @@ async function startScriptRunProcess(run, baseUrl, apiKeyOverride) {
     const current = await getScriptRun(run.id);
     if (current && current.status === "running") {
       if (exitCode !== 0) {
-        console.error(`[script-workflows] run ${run.id} subprocess exited ${exitCode}: ${stderr.trim() || "(no stderr)"}`);
+        console.error(scrubSecrets(`[script-workflows] run ${run.id} subprocess exited ${exitCode}: ${stderr.trim() || "(no stderr)"}`));
       }
       await updateScriptRunIfRunning(run.id, {
         status: exitCode === 0 ? "completed" : "failed",
@@ -3564,7 +3576,7 @@ init_secret_scrubber();
 
 // src/http/active-sessions.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listActiveSessions = route({
   method: "get",
@@ -3767,7 +3779,7 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
 // src/http/agents.ts
 init_src();
 init_zod();
-init_db();
+init_db2();
 init_telemetry();
 init_types();
 init_constants();
@@ -4847,7 +4859,7 @@ async function handleAgentsRest(req, res, pathSegments, queryParams, _myAgentId)
 
 // src/http/api-keys.ts
 init_zod();
-init_db();
+init_db2();
 init_model_rate_limit_windows();
 init_subscription_plans();
 
@@ -5501,7 +5513,7 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
 
 // src/http/approval-requests.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_request_auth_context();
 init_event_bus();
@@ -6066,13 +6078,14 @@ async function approvalQuorumMet(approvers, votes) {
 // src/http/assets.ts
 init_zod();
 init_asset_key_audit();
+init_db2();
 init_db();
 init_rbac();
 init_types();
 init_request_auth_context();
 
 // src/http/request-principal.ts
-init_db();
+init_db2();
 init_request_auth_context();
 async function requestPrincipal(req, myAgentId) {
   const auth = getRequestAuth(req);
@@ -6406,7 +6419,7 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/budgets.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_secret_scrubber();
 import { createHash } from "node:crypto";
@@ -6569,14 +6582,37 @@ async function handleBudgets(req, res, pathSegments, queryParams, _myAgentId) {
 // src/http/codex-oauth-device.ts
 init_zod();
 init_crypto();
-init_db();
+init_db2();
+
+// src/be/db/codex-oauth-device-flows.ts
+init_runtime();
+async function getCodexDeviceFlow(flowId) {
+  const row = await getDbClient().get("SELECT state, expires_at FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+  if (!row)
+    return null;
+  if (row.expires_at <= Date.now()) {
+    await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+    return null;
+  }
+  return { state: row.state, expiresAt: row.expires_at };
+}
+async function upsertCodexDeviceFlow(input) {
+  const now = Date.now();
+  await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE expires_at <= ?", [now]);
+  await getDbClient().run(`INSERT INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(flow_id) DO UPDATE SET
+         state = excluded.state,
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`, [input.flowId, input.state, input.expiresAt, now, now]);
+}
 
 // src/be/onboarding.ts
 init_telemetry();
 init_types();
 init_request_auth_context();
 init_zod_openapi();
-init_db();
+init_db2();
 init_swarm_config_guard();
 var ONBOARDING_CONFIG_KEY = "onboarding_state";
 var OnboardingStepIdSchema = exports_zod.enum([
@@ -7185,7 +7221,7 @@ init_secret_scrubber();
 
 // src/http/config.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac_roles();
 init_swarm_config_guard();
 init_rbac();
@@ -7568,7 +7604,6 @@ async function handleConfig(req, res, pathSegments, queryParams) {
 }
 
 // src/http/codex-oauth-device.ts
-var FLOW_NAMESPACE = "codex-oauth-device";
 var FLOW_TTL_MS = 15 * 60 * 1000;
 var POLL_LEASE_MS = 45000;
 var FlowStateSchema = exports_external.object({
@@ -7628,11 +7663,11 @@ function registerFlowSecrets(state) {
   registerVolatileSecret(state.userCode, "codex-device-user-code");
 }
 async function readFlow(flowId) {
-  const entry = await getKv(FLOW_NAMESPACE, flowId);
-  if (!entry || typeof entry.value !== "string")
+  const entry = await getCodexDeviceFlow(flowId);
+  if (!entry)
     return null;
   try {
-    const plaintext = decryptSecret(entry.value, getEncryptionKey());
+    const plaintext = decryptSecret(entry.state, getEncryptionKey());
     const parsed = FlowStateSchema.safeParse(JSON.parse(plaintext));
     if (!parsed.success)
       return null;
@@ -7643,11 +7678,9 @@ async function readFlow(flowId) {
   }
 }
 async function writeFlow(flowId, state) {
-  await upsertKv({
-    namespace: FLOW_NAMESPACE,
-    key: flowId,
-    value: encryptSecret(JSON.stringify(state), getEncryptionKey()),
-    valueType: "string",
+  await upsertCodexDeviceFlow({
+    flowId,
+    state: encryptSecret(JSON.stringify(state), getEncryptionKey()),
     expiresAt: state.expiresAt
   });
 }
@@ -7857,7 +7890,7 @@ async function handleCodexOAuthDevice(req, res, pathSegments, queryParams) {
 
 // src/http/codex-oauth-keep-warm.ts
 init_zod();
-init_db();
+init_db2();
 init_codex_auth_failure();
 init_constants();
 var KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -7931,7 +7964,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
 init_zod();
 
 // src/comb/review-batch.ts
-init_db();
+init_db2();
 init_resolver();
 init_constants();
 init_secret_scrubber();
@@ -8372,7 +8405,7 @@ async function handleComb(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/context.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var PostContextResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -8481,7 +8514,7 @@ async function handleContext(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/ecosystem.ts
 init_zod();
-init_db();
+init_db2();
 var EcosystemAppSchema = exports_external.object({
   name: exports_external.string(),
   script: exports_external.string(),
@@ -8731,7 +8764,7 @@ async function handleEvents(req, res, pathSegments, queryParams, _myAgentId) {
 
 // src/http/extensions.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/be/extensions/validate.ts
 init_bundle_path();
@@ -10773,7 +10806,7 @@ async function handleExtensions(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/favorites.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listFavorites2 = route({
   method: "get",
@@ -10873,7 +10906,7 @@ async function handleFavorites(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/fs.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_types();
 
@@ -11418,7 +11451,7 @@ async function handleHeartbeat(req, res, pathSegments) {
 
 // src/http/inbox-state.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listState = route({
   method: "get",
@@ -11628,7 +11661,7 @@ function buildSlackManifest(name) {
 }
 
 // src/http/config-values.ts
-init_db();
+init_db2();
 async function resolveConfigValue(key) {
   const configs = await getResolvedConfig();
   const variants = [key, key.toLowerCase(), key.toUpperCase()];
@@ -11761,7 +11794,7 @@ var handleIntegrations = createIntegrationsHandler();
 
 // src/http/kv.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_context_key();
 init_types();
@@ -12930,6 +12963,85 @@ var getRequestListener = (fetchCallback, options = {}) => {
   };
 };
 
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+var import_content_type = __toESM(require_content_type(), 1);
+function mediaTypeEssence(header2) {
+  if (!header2) {
+    return;
+  }
+  try {
+    return import_content_type.default.parse(header2).type;
+  } catch {
+    const essence = (header2.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header2.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header2) {
+  if (header2 === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header2) === "application/json";
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/requestBody.js
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+var MAX_BATCH_SIZE2 = 100;
+function requestBodyTooLargeMessage(maxBytes) {
+  return `Payload Too Large: Request body must not exceed ${maxBytes} bytes`;
+}
+function resolveMaxRequestBodySize(value) {
+  if (value === undefined) {
+    return DEFAULT_MAX_REQUEST_BODY_SIZE;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`maxRequestBodySize must be a positive number of bytes, got ${String(value)}`);
+  }
+  return value;
+}
+async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE) {
+  if (Number(request.headers.get("content-length")) > maxBytes) {
+    return { tooLarge: true };
+  }
+  if (request.body === null) {
+    return { tooLarge: false, text: "" };
+  }
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder;
+  let received = 0;
+  let text = "";
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      received += value.byteLength;
+      if (received > maxBytes) {
+        return { tooLarge: true };
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return { tooLarge: false, text: text + decoder.decode() };
+}
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000;
+var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
@@ -12937,10 +13049,12 @@ class WebStandardStreamableHTTPServerTransport {
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -12950,6 +13064,23 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+    this._maxRequestBodySize = resolveMaxRequestBodySize(options.maxRequestBodySize);
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -12997,6 +13128,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -13036,6 +13170,7 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
@@ -13063,18 +13198,25 @@ data:
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers2 = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers2["mcp-session-id"] = this.sessionId;
@@ -13083,12 +13225,16 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers: headers2 });
   }
   async replayEvents(lastEventId) {
@@ -13112,20 +13258,33 @@ data:
       const headers2 = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers2["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -13133,19 +13292,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers: headers2 });
     } catch (error) {
       this.onerror?.(error);
@@ -13195,7 +13369,7 @@ data:
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
         this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
@@ -13208,12 +13382,22 @@ data:
         rawMessage = options.parsedBody;
       } else {
         try {
-          rawMessage = await req.json();
+          const body = await readRequestBody(req, this._maxRequestBodySize);
+          if (body.tooLarge) {
+            const message = requestBodyTooLargeMessage(this._maxRequestBodySize);
+            this.onerror?.(new Error(message));
+            return this.createJsonErrorResponse(413, -32000, message);
+          }
+          rawMessage = JSON.parse(body.text);
         } catch {
           this.onerror?.(new Error("Parse error: Invalid JSON"));
           return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
         }
       }
+      if (Array.isArray(rawMessage) && rawMessage.length > MAX_BATCH_SIZE2) {
+        this.onerror?.(new Error(`Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE2} messages`));
+        return this.createJsonErrorResponse(400, -32600, `Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE2} messages`);
+      }
       let messages;
       try {
         if (Array.isArray(rawMessage)) {
@@ -13225,6 +13409,9 @@ data:
         this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
@@ -13251,6 +13438,9 @@ data:
           return protocolError2;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -13281,18 +13471,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers2 = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers2["mcp-session-id"] = this.sessionId;
@@ -13303,6 +13500,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -13312,19 +13512,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+      } catch (error) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
+        }
+        throw error;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers: headers2 });
     } catch (error) {
@@ -13341,9 +13555,12 @@ data:
     if (protocolError2) {
       return protocolError2;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
@@ -13373,11 +13590,16 @@ data:
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -13412,7 +13634,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -13421,13 +13643,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -13435,6 +13663,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -13457,6 +13704,7 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
@@ -13524,7 +13772,7 @@ class StreamableHTTPServerTransport {
 }
 
 // src/http/mcp.ts
-init_db();
+init_db2();
 init_env_flag();
 init_request_auth_context();
 init_task_tool_manifest();
@@ -13691,6 +13939,7 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
       }
       const server = await createServer({
         preloadedTools,
+        enabledTools: configs.find((config) => config.key === "SWARM_ENABLED_TOOLS")?.value ?? process.env.SWARM_ENABLED_TOOLS,
         scriptsOnly: resolveScriptsOnlyMode({
           env: process.env.SCRIPTS_ONLY_MCP,
           configValue
@@ -13719,7 +13968,7 @@ async function handleMcp(req, res, transports, sessionActivity = {}, sessionAgen
 
 // src/http/mcp-oauth.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_env_flag();
@@ -14461,7 +14710,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
 
 // src/http/mcp-servers.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac_roles();
 init_rbac();
 init_types();
@@ -15162,11 +15411,12 @@ function closeIdleMcpUserTransports(transports, sessionUsers, sessionActivity, o
 
 // src/http/memory.ts
 init_zod();
-init_db();
+init_db2();
+init_memory();
 init_constants2();
 
 // src/be/memory/edges-store.ts
-init_db();
+init_db2();
 var USEFULNESS_FLOOR = 1;
 var USEFULNESS_CEILING = 2;
 async function listEdgesForAgent(agentId, memoryId) {
@@ -15202,7 +15452,7 @@ init_key_paths();
 init_reranker();
 
 // src/be/memory/retrieval-store.ts
-init_db();
+init_db2();
 var RETRIEVAL_CONTENT_SNIPPET_CHARS = 500;
 var RETRIEVAL_LIST_LIMIT = 50;
 async function getRetrievalsForAgent(agentId, filter) {
@@ -15245,7 +15495,7 @@ async function hasRetrievalForTask(taskId, memoryId) {
 }
 
 // src/be/memory/usefulness-stats.ts
-init_db();
+init_db2();
 async function getUsefulnessStats(options = {}) {
   const days = options.days ?? 30;
   const threshold = options.threshold ?? 0.6;
@@ -16644,7 +16894,7 @@ function stopMemoryGc() {
 
 // src/http/metrics.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var DEFAULT_METRIC_MAX_ROWS = 100;
 var HARD_METRIC_MAX_ROWS = 500;
@@ -17098,7 +17348,7 @@ async function handleMetrics(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/models-catalog.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_types();
 init_request_auth_context();
@@ -17410,9 +17660,11 @@ async function handleModelsCatalog(req, res, pathSegments, queryParams) {
 
 // src/http/oauth-callback.ts
 init_zod();
-init_db();
+init_db2();
+init_oauth();
 
 // src/jira/oauth.ts
+init_oauth();
 var ACCESSIBLE_RESOURCES_URL = "https://api.atlassian.com/oauth/token/accessible-resources";
 async function getJiraOAuthConfig() {
   const app = await getOAuthApp("jira");
@@ -17453,7 +17705,8 @@ async function resolveAndStoreJiraCloudId(accessToken) {
 }
 
 // src/linear/oauth.ts
-init_db();
+init_db2();
+init_oauth();
 var APP_USER_ID_NAMESPACE = "integration:linear:bot-app-user-id";
 async function getLinearOAuthConfig() {
   const app = await getOAuthApp("linear");
@@ -17880,6 +18133,7 @@ async function handleGenericOAuth(req, res, pathSegments, queryParams) {
 
 // src/http/oauth-locks.ts
 init_zod();
+init_oauth();
 var MAX_LOCK_TTL_MS = 5 * 60 * 1000;
 var LOCK_KEY_PATTERN = /^[a-zA-Z0-9._:-]{1,200}$/;
 var LockKeySchema = exports_external.object({ key: exports_external.string().regex(LOCK_KEY_PATTERN) });
@@ -17946,13 +18200,16 @@ async function handleOAuthLocks(req, res, pathSegments, queryParams) {
 
 // src/http/onboarding.ts
 init_openai();
-init_db();
+init_db2();
+init_memory();
 init_constants2();
 init_types();
+init_openrouter_base_url();
 
 // src/http/status.ts
 init_zod();
-init_db();
+init_db2();
+init_memory();
 init_config();
 init_telemetry();
 init_types();
@@ -18671,6 +18928,7 @@ async function handleMemoryProbe(body) {
     const client = new OpenAI({
       baseURL: endpoint.toString(),
       apiKey,
+      defaultHeaders: getOpenRouterAttributionHeaders(endpoint.toString()),
       timeout: 15000,
       maxRetries: 0,
       fetchOptions: { redirect: "manual" }
@@ -18742,7 +19000,7 @@ async function handleOnboarding(req, res, pathSegments, queryParams) {
 }
 
 // src/http/page-proxy.ts
-init_db();
+init_db2();
 route({
   method: "get",
   path: "/@swarm/api/{path}",
@@ -18931,7 +19189,7 @@ async function handlePageProxy(req, res) {
 // src/http/pages.ts
 init_zod();
 import { randomUUID as randomUUID4 } from "node:crypto";
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_request_auth_context();
@@ -19489,7 +19747,7 @@ async function handlePages(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/pages-public.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_constants();
 init_secret_scrubber();
@@ -19919,7 +20177,7 @@ async function bumpViewCount(pageId) {
 
 // src/http/poll.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/slack/channel-activity.ts
 var cachedBotUserId = null;
@@ -20484,7 +20742,7 @@ async function handlePoll(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/pricing.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_secret_scrubber();
 import { createHash as createHash2 } from "node:crypto";
@@ -20660,7 +20918,7 @@ async function handlePricing(req, res, pathSegments, queryParams, _myAgentId) {
 
 // src/http/prompt-templates.ts
 init_zod();
-init_db();
+init_db2();
 init_default_drift();
 init_registry();
 init_resolver();
@@ -21155,7 +21413,7 @@ async function handleRealtimeAsset(req, res) {
 
 // src/http/repos.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 init_telemetry();
 init_types();
@@ -21635,6 +21893,7 @@ async function handleRooms(req, res, pathSegments, queryParams) {
 // src/http/schedules.ts
 init_zod();
 var import_cron_parser = __toESM(require_dist(), 1);
+init_db2();
 init_db();
 init_types();
 var scheduleUpdateBodySchema = exports_external.object({
@@ -22223,7 +22482,7 @@ async function handleSchedules(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/script-connection-proxy.ts
 init_zod();
-init_db();
+init_db2();
 init_rbac();
 var McpToolCallResultSchema = exports_external.object({
   content: exports_external.array(exports_external.object({ type: exports_external.string(), text: exports_external.string().optional() })),
@@ -22332,7 +22591,8 @@ async function handleScriptConnectionProxy(req, res, pathSegments, queryParams,
 // src/http/script-connections.ts
 init_zod();
 init_date_utils();
-init_db();
+init_db2();
+init_oauth();
 init_rbac();
 init_credential_broker();
 init_telemetry();
@@ -24227,7 +24487,25 @@ async function handleScriptConnections(req, res, pathSegments, queryParams, agen
 
 // src/http/script-runs.ts
 init_zod();
-init_db();
+init_db2();
+
+// src/be/scripts/source-secrets.ts
+init_secret_scrubber();
+function refuseSourceWithSecrets(source) {
+  const { knownValues, gitleaksRules } = findSecretsIn(source);
+  if (knownValues.length === 0 && gitleaksRules.length === 0)
+    return null;
+  const findings = [
+    ...knownValues.map((id) => ({ kind: "registered-secret", id })),
+    ...gitleaksRules.map((id) => ({ kind: "gitleaks-rule", id }))
+  ];
+  const named = findings.map((f) => f.kind === "registered-secret" ? `registered secret ${f.id}` : `gitleaks rule ${f.id}`).join(", ");
+  return {
+    error: "source_contains_secret",
+    message: `Script source contains a secret (${named}); nothing was saved or run. Source is stored and shown verbatim, so read secrets at run time instead: a credential binding (ctx.api.<slug> / ctx.mcp.<slug>) or ctx.swarm.config.get("<KEY>").`,
+    findings
+  };
+}
 
 // src/script-workflows/label-lint.ts
 var import_typescript = __toESM(require_typescript(), 1);
@@ -24300,6 +24578,7 @@ function lintWorkflowLabels(source) {
 // src/http/script-runs.ts
 init_types();
 init_constants();
+init_secret_scrubber();
 var DEFAULT_SCRIPT_RUN_CONCURRENCY_CAP = 10;
 var runIdParamsSchema = exports_external.object({ runId: exports_external.string().uuid() });
 var idParamsSchema3 = exports_external.object({ id: exports_external.string().uuid() });
@@ -24575,6 +24854,11 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
     const agent = await requireAgent(res, agentId);
     if (!agent)
       return true;
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     const lint = lintWorkflowLabels(parsed.body.source);
     if (!lint.ok) {
       json(res, {
@@ -24728,7 +25012,7 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
         config: parsed.body.config ?? {},
         status: parsed.body.status,
         result: parsed.body.result,
-        error: parsed.body.error,
+        error: parsed.body.error === undefined ? undefined : scrubSecrets(parsed.body.error),
         durationMs: parsed.body.durationMs
       });
       return assertRunWithinLimits(run.id);
@@ -24859,7 +25143,9 @@ async function handleScriptRuns(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/scripts.ts
 init_zod();
+init_db2();
 init_db();
+init_embeddings();
 init_rbac();
 init_types();
 init_secret_scrubber();
@@ -25315,6 +25601,11 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
         return true;
       }
     }
+    const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     const typecheck = await typecheckScript(parsed.body.source, { agentId: agent.id });
     if (!typecheck.ok) {
       json(res, {
@@ -25365,6 +25656,11 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     if (!agent)
       return true;
     const runtimeInstanceId = ((h) => Array.isArray(h) ? h[0] : h)(req.headers["x-runtime-instance-id"]);
+    const secretRefusal = parsed.body.source ? refuseSourceWithSecrets(parsed.body.source) : null;
+    if (secretRefusal) {
+      json(res, secretRefusal, 400);
+      return true;
+    }
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
     let namedScript = null;
@@ -25723,7 +26019,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
 
 // src/http/session-data.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 
 // src/http/session-cost-recompute.ts
@@ -26260,7 +26556,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, _myAgentId
 
 // src/http/sessions.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_types();
 init_request_auth_context();
@@ -26481,11 +26777,11 @@ async function handleSessions(req, res, pathSegments, queryParams) {
 
 // src/http/skills.ts
 init_zod();
-init_db();
+init_db2();
 
 // src/be/skill-sync.ts
 import { homedir } from "node:os";
-init_db();
+init_db2();
 async function syncSkillsToFilesystem(agentId, harnessType = "all", homeOverride) {
   const skills = await getAgentSkills(agentId);
   const home = homeOverride ?? homedir();
@@ -27257,7 +27553,7 @@ async function handleSkills(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/stats.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_types();
 init_env_flag();
@@ -27520,7 +27816,7 @@ async function handleStats(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/task-templates.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var listTemplates = route({
   method: "get",
@@ -27560,7 +27856,7 @@ async function handleTaskTemplates(req, res, pathSegments, queryParams) {
 
 // src/http/tasks.ts
 init_zod();
-init_db();
+init_db2();
 init_steering();
 init_rbac();
 init_types();
@@ -28995,6 +29291,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/trackers/jira.ts
 init_zod();
+init_oauth();
 var MANUAL_WEBHOOK_INSTRUCTIONS = "See docs-site/.../integrations/jira.mdx for manual webhook registration steps.";
 var JiraWebhookIdEntrySchema = exports_external.object({
   id: exports_external.number().int(),
@@ -29370,6 +29667,7 @@ async function handleJiraTracker(req, res, pathSegments) {
 
 // src/http/trackers/linear.ts
 init_zod();
+init_oauth();
 
 // src/linear/webhook.ts
 import { createHmac, timingSafeEqual } from "node:crypto";
@@ -29680,7 +29978,7 @@ async function handleTrackers(req, res, pathSegments) {
 
 // src/http/users.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 init_request_auth_context();
 
@@ -30740,7 +31038,7 @@ async function handleUsers(req, res, pathSegments, queryParams) {
 init_zod();
 
 // src/agentmail/inbound-archive.ts
-init_db();
+init_db2();
 init_secret_scrubber();
 import { createHash as createHash3 } from "node:crypto";
 var INBOUND_ARCHIVE_NAMESPACE = "agentmail-inbound";
@@ -31503,7 +31801,7 @@ async function handleWebhooks(req, res, pathSegments) {
 
 // src/http/workflow-events.ts
 init_zod();
-init_db();
+init_db2();
 init_event_bus();
 var runScopedSignalRoute = route({
   method: "post",
@@ -31586,7 +31884,7 @@ async function handleWorkflowEvents(req, res, pathSegments, queryParams) {
 
 // src/http/workflows.ts
 init_zod();
-init_db();
+init_db2();
 init_types();
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: exports_external.boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
@@ -32311,13 +32609,13 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await getWorkflowRunRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const run = await getWorkflowRun(parsed.params.id);
+    const run = await getWorkflowRun(parsed.params.id, "display");
     if (!run) {
       res.writeHead(404);
       res.end();
       return true;
     }
-    const steps = await getWorkflowRunStepsByRunId(parsed.params.id);
+    const steps = await getWorkflowRunStepsByRunId(parsed.params.id, "display");
     getWorkflowRunRoute.respond(res, 200, { run, steps });
     return true;
   }
@@ -32352,8 +32650,9 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
 
 // src/http/x.ts
 init_zod();
-init_db();
+init_db2();
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+init_db();
 init_secret_scrubber();
 var DEFAULT_TIMEOUT_MS = 60000;
 var TIMEOUT_HEADER = "x-swarm-timeout-ms";
@@ -32771,7 +33070,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-9bfssf54.js");
+    const { stopScheduler } = await import("./index-ekywyv2v.js");
     stopScheduler();
   }
   stopHeartbeat();
@@ -32780,7 +33079,7 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-1tj10tf4.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-4aezx4bj.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -32843,21 +33142,27 @@ try {
   throw err;
 }
 warnIfCorsAllowsAnyOrigin();
+try {
+  const loaded = await loadSecretRegistry();
+  console.log(`[secret-registry] registered config=${loaded.config} oauth=${loaded.oauth} scriptApi=${loaded.scriptApi} failed=${loaded.failed}`);
+} catch (err) {
+  console.error("[secret-registry] load failed (non-fatal):", scrubSecrets(err instanceof Error ? err.message : String(err)));
+}
 try {
   await seedLegacyCapabilitiesConfig();
 } catch (err) {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-2bmnh18p.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-22tx8a53.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-9e0q7cwk.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-mjrqvnvw.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-2bmnh18p.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-22tx8a53.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -32865,7 +33170,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-7n70jwbb.js");
+  const { runAllSeeders } = await import("./index-cx1sb9bq.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -32925,38 +33230,38 @@ httpServer.listen(port, async () => {
   await initWorkflows();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-9bfssf54.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-k8xc083e.js");
+    const { startScheduler } = await import("./index-ekywyv2v.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-t4g06w93.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-cj1r9q83.js");
+    const { startHeartbeat } = await import("./index-bt8wkv1w.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-1tj10tf4.js");
+    const { startOAuthKeepalive } = await import("./keepalive-4aezx4bj.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-aefzwvvq.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-wm4ctjfj.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-2ex2mcsh.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-fmp5ww69.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-z158xq32.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-1ze5853n.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-246yn076.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
-    console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
+  import("./boot-scrub-sweep-cbp8xd4e.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+    console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {
   console.error("HTTP Server Error:", err);