@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/src/be/boot-scrub-sweep.ts

@@ -0,0 +1,302 @@
+/**
+ * Versioned boot retro-sweep: re-scrub stored free-text columns whenever the
+ * redaction rules change.
+ *
+ * Rows written before a scrubber rule existed keep the secret it would now
+ * catch. This sweep re-runs `scrubSecrets` over every target column once per
+ * `SCRUBBER_RULES_VERSION` and redacts matching rows IN PLACE (irreversible;
+ * a redaction, not a deletion). The done marker is
+ * `seed_state(kind='maintenance', key='boot-scrub-v<N>')`, so bumping the
+ * version re-runs it on the next boot.
+ *
+ * Restart-safe: each target keeps an id cursor in seed_state
+ * (`boot-scrub-v<N>:<table>:cursor`), saved in the same transaction as the
+ * batch's writes, so a restart resumes after the last committed batch.
+ *
+ * Non-blocking: the regexes run OUTSIDE the write lock. Each batch is read,
+ * scrubbed in JS, and only the changed rows plus the cursor go into one short
+ * transaction. Every UPDATE is compare-and-set on the value that was read, so
+ * a row a concurrent writer moved in between is skipped, never clobbered. The
+ * loop yields between batches so /health and probes stay responsive.
+ *
+ * Replay state: `workflow_run_steps.output` and `workflow_runs.context` are
+ * also replayed by resume and recovery. A row written before the sealed
+ * `*_replay` columns existed has only the plain value, so before redacting it
+ * the sweep seals the original into the empty replay column (same CAS write).
+ *
+ * Logs counts only, never content.
+ */
+
+import { contentSha256 } from "@/commands/profile-sync";
+import { SCRUBBER_RULES_VERSION, scrubSecrets } from "../utils/secret-scrubber";
+import { getDbClient } from "./db";
+import type { DbExecutor, DbParam } from "./db-client";
+import { getMemoryStore } from "./memory";
+import type { MemoryScrubFields } from "./memory/types";
+import { breaksJsonValidity } from "./scrub-json";
+import { sealJson } from "./sealed-json";
+
+const DEFAULT_BATCH_SIZE = 200;
+
+/** Yield to the event loop so probes can respond. */
+const yieldTick = () => new Promise<void>((r) => setTimeout(r, 5));
+
+type SweepTarget = {
+  table: string;
+  columns: string[];
+  /** Recompute `hashColumn = sha256(sourceColumn)` when the source changes. */
+  hash?: { column: string; of: string };
+  /** Route writes through the memory store (FTS sync + embedding reset). */
+  memory?: boolean;
+  /**
+   * `column -> sealed replay column`. When the sweep redacts `column` and the
+   * replay column is NULL, it seals the original there first.
+   */
+  replay?: Record<string, string>;
+};
+
+/** Swept in this order. Every table has a TEXT `id` primary key. */
+export const BOOT_SCRUB_TARGETS: readonly SweepTarget[] = [
+  { table: "session_logs", columns: ["content"] },
+  { table: "agent_tasks", columns: ["task", "output", "failureReason", "progress"] },
+  { table: "agent_memory", columns: ["name", "content", "summary"], memory: true },
+  {
+    table: "agent_memory_version",
+    columns: ["content"],
+    hash: { column: "contentHash", of: "content" },
+  },
+  { table: "events", columns: ["data"] },
+  {
+    table: "workflow_run_steps",
+    columns: ["input", "output", "error", "diagnostics"],
+    replay: { output: "output_replay" },
+  },
+  {
+    table: "workflow_runs",
+    columns: ["triggerData", "context", "error"],
+    replay: { context: "context_replay" },
+  },
+];
+
+export type BootScrubTableStats = {
+  table: string;
+  scanned: number;
+  changed: number;
+  skippedInvalidJson: number;
+};
+
+export type BootScrubSweepOptions = {
+  /** Rules version to key on. Defaults to `SCRUBBER_RULES_VERSION` (tests inject). */
+  version?: number;
+  batchSize?: number;
+  /** Scrub function. Defaults to `scrubSecrets` (tests inject to force edge cases). */
+  scrub?: (text: string) => string;
+  /**
+   * Test hook, called after each batch commits with the ids it scanned. A
+   * throw aborts the run with the cursor already saved.
+   */
+  afterBatch?: (info: { table: string; ids: string[] }) => void | Promise<void>;
+  /** Re-embed redacted memory rows after the sweep. Default true. */
+  reembed?: boolean;
+};
+
+export function bootScrubDoneKey(version: number): string {
+  return `boot-scrub-v${version}`;
+}
+
+export function bootScrubCursorKey(version: number, table: string): string {
+  return `boot-scrub-v${version}:${table}:cursor`;
+}
+
+/**
+ * Run the sweep for the current rules version. Returns per-table stats, or
+ * null when this version was already swept.
+ */
+export async function runBootScrubSweep(
+  opts: BootScrubSweepOptions = {},
+): Promise<BootScrubTableStats[] | null> {
+  const version = opts.version ?? SCRUBBER_RULES_VERSION;
+  const doneKey = bootScrubDoneKey(version);
+  const done = await getDbClient().get<{ key: string }>(
+    "SELECT key FROM seed_state WHERE kind = 'maintenance' AND key = ?",
+    [doneKey],
+  );
+  if (done) return null;
+
+  const tag = `boot-scrub-v${version}`;
+  console.log(`[${tag}] starting`);
+
+  const stats: BootScrubTableStats[] = [];
+  for (const target of BOOT_SCRUB_TARGETS) {
+    const tableStats = await sweepTarget(target, version, opts);
+    stats.push(tableStats);
+    console.log(
+      `${tag}: ${target.table} scanned=${tableStats.scanned} changed=${tableStats.changed} skipped_invalid_json=${tableStats.skippedInvalidJson}`,
+    );
+  }
+
+  await getDbClient().transaction(async (tx) => {
+    await tx.run(
+      `INSERT INTO seed_state (kind, key, seededHash, seededAt)
+       VALUES ('maintenance', ?, 'done', datetime('now'))
+       ON CONFLICT (kind, key) DO UPDATE SET seededHash = 'done', seededAt = datetime('now')`,
+      [doneKey],
+    );
+    await tx.run("DELETE FROM seed_state WHERE kind = 'maintenance' AND key LIKE ? ESCAPE '!'", [
+      `${doneKey.replace(/[!%_]/g, "!$&")}:%:cursor`,
+    ]);
+  });
+  console.log(`[${tag}] complete`);
+
+  const memoryChanged = stats.find((s) => s.table === "agent_memory")?.changed ?? 0;
+  if (memoryChanged > 0 && opts.reembed !== false) {
+    // Redacted memory rows lost their embedding; regenerate from scrubbed text.
+    const { runBootReembed } = await import("./memory/boot-reembed");
+    await runBootReembed();
+  }
+
+  return stats;
+}
+
+async function sweepTarget(
+  target: SweepTarget,
+  version: number,
+  opts: BootScrubSweepOptions,
+): Promise<BootScrubTableStats> {
+  const client = getDbClient();
+  const scrub = opts.scrub ?? scrubSecrets;
+  const batchSize = opts.batchSize ?? DEFAULT_BATCH_SIZE;
+  const cursorKey = bootScrubCursorKey(version, target.table);
+  const stats: BootScrubTableStats = {
+    table: target.table,
+    scanned: 0,
+    changed: 0,
+    skippedInvalidJson: 0,
+  };
+
+  let cursor =
+    (
+      await client.get<{ seededHash: string }>(
+        "SELECT seededHash FROM seed_state WHERE kind = 'maintenance' AND key = ?",
+        [cursorKey],
+      )
+    )?.seededHash ?? "";
+
+  const selectCols = [
+    "id",
+    ...target.columns,
+    ...(target.hash && !target.columns.includes(target.hash.column) ? [target.hash.column] : []),
+    ...Object.values(target.replay ?? {}),
+  ];
+
+  for (;;) {
+    const rows = await client.query<Record<string, string | null>>(
+      `SELECT ${selectCols.join(", ")} FROM ${target.table}
+       WHERE id > ? ORDER BY id ASC LIMIT ?`,
+      [cursor, batchSize],
+    );
+    if (rows.length === 0) break;
+
+    // Scrub outside the transaction: regexes never run under the write lock.
+    const pending: {
+      id: string;
+      before: Record<string, string | null>;
+      after: Record<string, string | null>;
+    }[] = [];
+    for (const row of rows) {
+      const after: Record<string, string | null> = {};
+      let differs = false;
+      let breaksJson = false;
+      for (const col of target.columns) {
+        const value = row[col];
+        if (typeof value !== "string" || value.length === 0) {
+          after[col] = value ?? null;
+          continue;
+        }
+        const cleaned = scrub(value);
+        after[col] = cleaned;
+        if (cleaned !== value) {
+          differs = true;
+          if (breaksJsonValidity(value, cleaned)) breaksJson = true;
+        }
+      }
+      if (!differs) continue;
+      if (breaksJson) {
+        stats.skippedInvalidJson++;
+        continue;
+      }
+      for (const [col, replayCol] of Object.entries(target.replay ?? {})) {
+        const value = row[col];
+        if (after[col] === value || typeof value !== "string" || row[replayCol] != null) continue;
+        try {
+          after[replayCol] = sealJson(JSON.parse(value));
+        } catch {
+          // Not JSON, so nothing replays it.
+        }
+      }
+      pending.push({ id: row.id as string, before: row, after });
+    }
+
+    const batchLastId = rows[rows.length - 1]!.id as string;
+    await client.transaction(async (tx) => {
+      for (const { id, before, after } of pending) {
+        const wrote = target.memory
+          ? await rewriteMemoryRow(id, before, after)
+          : await rewriteRow(tx, target, id, before, after);
+        if (wrote) stats.changed++;
+      }
+      await tx.run(
+        `INSERT INTO seed_state (kind, key, seededHash, seededAt)
+         VALUES ('maintenance', ?, ?, datetime('now'))
+         ON CONFLICT (kind, key) DO UPDATE SET seededHash = excluded.seededHash, seededAt = datetime('now')`,
+        [cursorKey, batchLastId],
+      );
+    });
+
+    stats.scanned += rows.length;
+    cursor = batchLastId;
+    await opts.afterBatch?.({ table: target.table, ids: rows.map((r) => r.id as string) });
+    await yieldTick();
+  }
+
+  return stats;
+}
+
+async function rewriteRow(
+  tx: DbExecutor,
+  target: SweepTarget,
+  id: string,
+  before: Record<string, string | null>,
+  after: Record<string, string | null>,
+): Promise<boolean> {
+  const changedCols = target.columns.filter((c) => after[c] !== before[c]);
+  // Replay columns the sweep fills: only while still NULL (guarded below).
+  const sealedCols = Object.values(target.replay ?? {}).filter((c) => after[c] !== undefined);
+  const sets = [...changedCols, ...sealedCols].map((c) => `${c} = ?`);
+  const params: DbParam[] = [...changedCols, ...sealedCols].map((c) => after[c] ?? null);
+  if (target.hash && changedCols.includes(target.hash.of)) {
+    sets.push(`${target.hash.column} = ?`);
+    params.push(contentSha256(after[target.hash.of] ?? ""));
+  }
+  // Compare-and-set on every changed column.
+  const guards = [...changedCols.map((c) => `${c} IS ?`), ...sealedCols.map((c) => `${c} IS NULL`)];
+  params.push(id, ...changedCols.map((c) => before[c] ?? null));
+  const result = await tx.run(
+    `UPDATE ${target.table} SET ${sets.join(", ")} WHERE id = ? AND ${guards.join(" AND ")}`,
+    params,
+  );
+  return result.changes > 0;
+}
+
+async function rewriteMemoryRow(
+  id: string,
+  before: Record<string, string | null>,
+  after: Record<string, string | null>,
+): Promise<boolean> {
+  const pick = (r: Record<string, string | null>): MemoryScrubFields => ({
+    name: r.name ?? "",
+    content: r.content ?? "",
+    summary: r.summary ?? null,
+  });
+  return getMemoryStore().rewriteForScrub(id, pick(before), pick(after));
+}

package/src/be/crypto/key-bootstrap.ts

@@ -116,7 +116,7 @@ export function resolveEncryptionKey(
 
   if (!allowGenerate) {
     throw new Error(
-      `Refusing to auto-generate ${KEY_FILENAME} for an existing database with encrypted secret rows. Restore ${ENV_KEY}, ${ENV_KEY_FILE}, or ${keyFilePath} before booting.`,
+      `Refusing to auto-generate ${KEY_FILENAME} for an existing database with encrypted secret rows or sealed replay values. Restore ${ENV_KEY}, ${ENV_KEY_FILE}, or ${keyFilePath} before booting.`,
     );
   }
 

package/src/be/db/approvals.ts

@@ -1,4 +1,6 @@
+import { type ScrubbedText, scrubObject, scrubSecrets } from "../../utils/secret-scrubber";
 import { normalizeDate, normalizeDateRequired } from "../date-utils";
+import { breaksJsonValidity } from "../scrub-json";
 import { getDbClient } from "./runtime";
 
 /**
@@ -126,7 +128,19 @@ export async function recordApprovalVotes(id: string, approvals: ApprovalVote[])
        SET approvals = ?, updatedAt = ?
        WHERE id = ? AND status = 'pending'
        RETURNING id`,
-    [JSON.stringify(approvals), new Date().toISOString(), id],
+    [scrubApprovalVotesJson(approvals), new Date().toISOString(), id],
   );
   return row !== null && row !== undefined;
 }
+
+/**
+ * Serializes votes for the `approvals` column with free-text answers scrubbed.
+ * Falls back to a per-value scrub when a redaction would break the JSON, so
+ * readers can always parse the column.
+ */
+export function scrubApprovalVotesJson(approvals: ApprovalVote[]): ScrubbedText {
+  const raw = JSON.stringify(approvals);
+  const scrubbed = scrubSecrets(raw);
+  if (!breaksJsonValidity(raw, scrubbed)) return scrubbed;
+  return JSON.stringify(scrubObject(approvals)) as ScrubbedText;
+}

package/src/be/db/codex-oauth-device-flows.ts

@@ -0,0 +1,40 @@
+import { getDbClient } from "./runtime";
+
+/**
+ * Encrypted Codex device-login flow state. Kept out of `kv_entries` so
+ * db-query can deny it by table. Returns null if missing or expired; an
+ * expired row is deleted inline.
+ */
+export async function getCodexDeviceFlow(
+  flowId: string,
+): Promise<{ state: string; expiresAt: number } | null> {
+  const row = await getDbClient().get<{ state: string; expires_at: number }>(
+    "SELECT state, expires_at FROM codex_oauth_device_flows WHERE flow_id = ?",
+    [flowId],
+  );
+  if (!row) return null;
+  if (row.expires_at <= Date.now()) {
+    await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE flow_id = ?", [flowId]);
+    return null;
+  }
+  return { state: row.state, expiresAt: row.expires_at };
+}
+
+/** Upsert one device-login flow and drop every expired flow. */
+export async function upsertCodexDeviceFlow(input: {
+  flowId: string;
+  state: string;
+  expiresAt: number;
+}): Promise<void> {
+  const now = Date.now();
+  await getDbClient().run("DELETE FROM codex_oauth_device_flows WHERE expires_at <= ?", [now]);
+  await getDbClient().run(
+    `INSERT INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(flow_id) DO UPDATE SET
+         state = excluded.state,
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`,
+    [input.flowId, input.state, input.expiresAt, now, now],
+  );
+}

package/src/be/db/config-secrets.ts

@@ -0,0 +1,31 @@
+import { decryptSecret, getEncryptionKey } from "../crypto";
+import { isReservedConfigKey } from "../swarm-config-guard";
+import { getDbClient } from "./runtime";
+
+/**
+ * Every stored secret config value (all scopes, incl. derived
+ * `connection.<slug>.secret` rows), decrypted, for the secret registry
+ * (src/be/secret-registry.ts). Reserved env-only keys are skipped: their live
+ * value is in env. A row that fails to decrypt is counted, not thrown, so one
+ * bad row cannot hide the rest.
+ */
+export async function listStoredConfigSecrets(): Promise<{
+  secrets: { key: string; value: string }[];
+  failed: number;
+}> {
+  const rows = await getDbClient().query<{ key: string; value: string; encrypted: number }>(
+    "SELECT key, value, encrypted FROM swarm_config WHERE isSecret = 1 OR encrypted = 1",
+  );
+  const secrets: { key: string; value: string }[] = [];
+  let failed = 0;
+  for (const row of rows) {
+    if (isReservedConfigKey(row.key)) continue;
+    try {
+      const value = row.encrypted === 1 ? decryptSecret(row.value, getEncryptionKey()) : row.value;
+      if (value) secrets.push({ key: row.key, value });
+    } catch {
+      failed++;
+    }
+  }
+  return { secrets, failed };
+}

package/src/be/db/runtime.ts

@@ -7,6 +7,7 @@ import { resolveEncryptionKey } from "../crypto";
 import { createBunSqliteClient, type DbClient } from "../db-client";
 import { runMigrations } from "../migrations/runner";
 import { autoEncryptLegacyOAuthSecrets } from "../oauth-encryption-backfill";
+import { sealedReplayExistsSql } from "../sealed-json";
 
 let db: Database | null = null;
 let sqliteVecAvailable = false;
@@ -233,6 +234,9 @@ export function initDb(dbPath = "./agent-swarm-db.sqlite"): Database {
              WHERE clientSecretEncrypted = 1 AND clientSecret IS NOT NULL
            UNION ALL
            SELECT 1 FROM oauth_authorizations WHERE tokensEncrypted = 1
+           ${sealedReplayExistsSql()
+             .map((arm) => `UNION ALL ${arm}`)
+             .join("\n           ")}
          ) AS present`,
       )
       .get()?.present ?? 0) === 1;

package/src/be/db/script-runs.ts

@@ -0,0 +1,15 @@
+import { openSealedJson } from "../sealed-json";
+import { getDbClient } from "./runtime";
+
+/**
+ * The exact args a run executes with, or `undefined` when the run has no row.
+ * Only the supervisor may call this: everything else reads the redacted view
+ * on `ScriptRun.args`.
+ */
+export async function getScriptRunExecutionArgs(id: string): Promise<unknown> {
+  const row = await getDbClient().get<{ args: string }>(
+    "SELECT args FROM script_runs WHERE id = ?",
+    [id],
+  );
+  return row ? openSealedJson(row.args) : undefined;
+}

package/src/be/db/tasks/write.ts

@@ -87,7 +87,7 @@ export async function createTask(
       id,
       defaultAssetKey("task", id),
       agentId,
-      task,
+      scrubSecrets(task),
       "pending",
       source,
       options?.slackChannelId ?? null,

package/src/be/db-queries/mcp-oauth.ts

@@ -2,6 +2,7 @@ import { scrubSecrets } from "../../utils/secret-scrubber";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { normalizeDateRequired } from "../date-utils";
 import { getDbClient } from "../db";
+import { oauthSecretName, registerStoredSecret } from "../secret-registry";
 import {
   type OAuthAuthorizationStatus,
   updateAuthorizationTokens,
@@ -266,6 +267,10 @@ async function upsertMcpApp(input: {
     input.dcrClientSecret == null || input.dcrClientSecret === ""
       ? (existing?.clientSecret ?? null)
       : encryptSecret(input.dcrClientSecret, getEncryptionKey());
+  registerStoredSecret(
+    input.dcrClientSecret,
+    oauthSecretName(`mcp-${input.mcpServerId}`, "client_secret"),
+  );
   // MCP OAuth applications are DCR-owned storage rows even when the client
   // credentials were supplied manually or preregistered. Preserve that exact
   // distinction in metadata for the legacy adapter boundary.

package/src/be/db-queries/oauth.ts

@@ -2,6 +2,7 @@ import type { OAuthApp, OAuthTokens } from "../../tracker/types";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { normalizeDateRequired } from "../date-utils";
 import { getDbClient } from "../db";
+import { oauthSecretName, registerStoredSecret } from "../secret-registry";
 
 type OAuthAppRow = Omit<
   OAuthApp,
@@ -241,6 +242,7 @@ async function writeOAuthApp(
   const metadataProvided = data.metadata !== undefined;
   const lifted = metadataProvided ? storageMetadata(data.metadata as string) : null;
   const encryptedSecret = encryptSecret(data.clientSecret, getEncryptionKey());
+  registerStoredSecret(data.clientSecret, oauthSecretName(provider, "client_secret"));
   const scopeSeparator =
     data.scopeSeparator ?? existing?.scopeSeparator ?? (provider === "linear" ? "," : " ");
   const rotation =
@@ -373,6 +375,79 @@ export async function getAuthorizationById(id: string): Promise<OAuthAuthorizati
   return row ? normalizeAuthorization(row) : null;
 }
 
+/** Register an authorization's new plaintext tokens with the secret registry,
+ * named by the owning app's provider (`mcp-<serverId>` for MCP apps). */
+async function registerAuthorizationSecrets(
+  appId: string,
+  accessToken: string,
+  refreshToken: string | null | undefined,
+): Promise<void> {
+  const app = await getDbClient().get<{ provider: string }>(
+    "SELECT provider FROM oauth_apps WHERE id = ?",
+    [appId],
+  );
+  const provider = app?.provider ?? appId;
+  registerStoredSecret(accessToken, oauthSecretName(provider, "access_token"));
+  registerStoredSecret(refreshToken, oauthSecretName(provider, "refresh_token"));
+}
+
+export type StoredOAuthSecretKind = "client_secret" | "access_token" | "refresh_token";
+
+/**
+ * Every stored OAuth credential, decrypted, for the secret registry
+ * (src/be/secret-registry.ts): client secrets of all apps (provider and
+ * MCP-managed) and the tokens of all authorizations, whatever their status.
+ * A row that fails to decrypt is counted, not thrown.
+ */
+export async function listStoredOAuthSecrets(): Promise<{
+  secrets: { provider: string; kind: StoredOAuthSecretKind; value: string }[];
+  failed: number;
+}> {
+  const secrets: { provider: string; kind: StoredOAuthSecretKind; value: string }[] = [];
+  let failed = 0;
+
+  const apps = await getDbClient().query<OAuthAppRow>("SELECT * FROM oauth_apps");
+  for (const row of apps) {
+    try {
+      const app = normalizeOAuthApp(row);
+      if (app.clientSecret) {
+        secrets.push({ provider: app.provider, kind: "client_secret", value: app.clientSecret });
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  const authorizations = await getDbClient().query<OAuthAuthorizationRow & { provider: string }>(
+    `SELECT z.*, a.provider AS provider
+       FROM oauth_authorizations z
+       JOIN oauth_apps a ON a.id = z.appId`,
+  );
+  for (const row of authorizations) {
+    try {
+      const authorization = normalizeAuthorization(row);
+      if (authorization.accessToken) {
+        secrets.push({
+          provider: row.provider,
+          kind: "access_token",
+          value: authorization.accessToken,
+        });
+      }
+      if (authorization.refreshToken) {
+        secrets.push({
+          provider: row.provider,
+          kind: "refresh_token",
+          value: authorization.refreshToken,
+        });
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  return { secrets, failed };
+}
+
 export async function upsertAuthorization(data: {
   id?: string;
   appId: string;
@@ -402,6 +477,7 @@ export async function upsertAuthorization(data: {
       : data.refreshToken == null
         ? null
         : encryptSecret(data.refreshToken, key);
+  await registerAuthorizationSecrets(data.appId, data.accessToken, data.refreshToken);
 
   if (existing) {
     await getDbClient().run(
@@ -486,6 +562,7 @@ export async function updateAuthorizationTokens(
       : data.refreshToken == null
         ? null
         : encryptSecret(data.refreshToken, key);
+  await registerAuthorizationSecrets(existing.appId, data.accessToken, data.refreshToken);
   const result = await getDbClient().run(
     `UPDATE oauth_authorizations SET
          accessToken = ?, refreshToken = ?, expiresAt = ?, scope = ?,