@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/src/be/memory/providers/openai-embedding.ts

@@ -1,4 +1,5 @@
 import OpenAI from "openai";
+import { getOpenRouterAttributionHeaders } from "../../../utils/openrouter-base-url";
 import { DEFAULT_EMBEDDING_MODEL, EMBEDDING_DIMENSIONS } from "../constants";
 import type { EmbeddingProvider } from "../types";
 
@@ -34,11 +35,15 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
 
   private getClient(): OpenAI | null {
     if (!this.apiKey) return null;
-    if (!this.client)
+    if (!this.client) {
+      const baseURL = process.env.EMBEDDING_API_BASE_URL; // Optional custom base URL
       this.client = new OpenAI({
-        baseURL: process.env.EMBEDDING_API_BASE_URL, // Optional custom base URL
+        baseURL,
         apiKey: this.apiKey,
+        // Only an openrouter.ai base URL gets attribution; OpenAI and gateways get none.
+        defaultHeaders: getOpenRouterAttributionHeaders(baseURL ?? ""),
       });
+    }
     return this.client;
   }
 

package/src/be/memory/providers/sqlite-store.ts

@@ -2,6 +2,7 @@ import { getDb, getDbClient, isSqliteVecAvailable } from "@/be/db";
 import { cosineSimilarity, deserializeEmbedding, serializeEmbedding } from "@/be/embedding";
 import { contentSha256 } from "@/commands/profile-sync";
 import type { AgentMemory, AgentMemoryScope, AgentMemorySource } from "@/types";
+import { scrubSecrets } from "@/utils/secret-scrubber";
 import {
   EMBEDDING_DIMENSIONS,
   isHybridSearchEnabled,
@@ -19,6 +20,7 @@ import type {
   MemoryInput,
   MemoryListOptions,
   MemoryRetrievalSource,
+  MemoryScrubFields,
   MemorySearchOptions,
   MemoryStats,
   MemoryStore,
@@ -437,7 +439,12 @@ export class SqliteMemoryStore implements MemoryStore {
     const now = new Date().toISOString();
     const key = input.key ?? `${input.scope}/${input.source}/${id}`;
     const expiresAt = computeExpiresAt(input.source, key);
-    const contentHash = contentSha256(input.content);
+    // Scrub before the hash, the FTS sync and the caller's embedding (callers
+    // embed the returned row's content), so all of them see the same text.
+    const name = scrubSecrets(input.name);
+    const content = scrubSecrets(input.content);
+    const summary = input.summary == null ? null : scrubSecrets(input.summary);
+    const contentHash = contentSha256(content);
     const version = 1;
 
     const row = await getDbClient().transaction(async (tx) => {
@@ -449,15 +456,15 @@ export class SqliteMemoryStore implements MemoryStore {
           input.agentId ?? null,
           input.scope,
           key,
-          input.name,
-          input.content,
-          input.summary ?? null,
+          name,
+          content,
+          summary,
           input.source,
           input.sourceTaskId ?? null,
           input.sourcePath ?? null,
           input.chunkIndex ?? 0,
           input.totalChunks ?? 1,
-          JSON.stringify(input.tags ?? []),
+          JSON.stringify((input.tags ?? []).map((tag) => scrubSecrets(tag))),
           now,
           now,
           now,
@@ -478,7 +485,7 @@ export class SqliteMemoryStore implements MemoryStore {
           crypto.randomUUID(),
           inserted.id,
           version,
-          input.content,
+          content,
           contentHash,
           input.intent ?? "create memory",
           input.agentId ?? null,
@@ -1009,13 +1016,17 @@ export class SqliteMemoryStore implements MemoryStore {
 
       const previousVersion = row.version ?? 1;
       const moving = input.newKey !== undefined && input.newKey !== row.key;
+      // Scrub the edited text before the hash and FTS sync; callers embed the
+      // returned content, so the vector matches the stored row.
       const nextContent = moveOnly
         ? row.content
-        : applyEditMode(input.mode, row.content, {
-            content: input.content,
-            oldString: input.oldString,
-            newString: input.newString,
-          });
+        : scrubSecrets(
+            applyEditMode(input.mode, row.content, {
+              content: input.content,
+              oldString: input.oldString,
+              newString: input.newString,
+            }),
+          );
 
       const nextHash = contentSha256(nextContent);
       const contentChanged = !moveOnly && nextHash !== row.contentHash;
@@ -1268,6 +1279,47 @@ export class SqliteMemoryStore implements MemoryStore {
     }
   }
 
+  async rewriteForScrub(
+    id: string,
+    before: MemoryScrubFields,
+    after: MemoryScrubFields,
+  ): Promise<boolean> {
+    const contentChanged = after.content !== before.content;
+    return getDbClient().transaction(async (tx) => {
+      // Compare-and-set: the sweep scrubbed `before` outside the write lock, so
+      // skip the row if a concurrent write moved it since.
+      const result = await tx.run(
+        `UPDATE agent_memory
+         SET name = ?, content = ?, summary = ?, contentHash = ?,
+             embedding = CASE WHEN ? = 1 THEN NULL ELSE embedding END,
+             embeddingModel = CASE WHEN ? = 1 THEN NULL ELSE embeddingModel END
+         WHERE id = ? AND name IS ? AND content IS ? AND summary IS ?`,
+        [
+          after.name,
+          after.content,
+          after.summary,
+          contentSha256(after.content),
+          contentChanged ? 1 : 0,
+          contentChanged ? 1 : 0,
+          id,
+          before.name,
+          before.content,
+          before.summary,
+        ],
+      );
+      if (result.changes === 0) return false;
+      // The vector embeds the old (secret-bearing) content. Drop it; the
+      // re-embed backfill picks the row up via `embedding IS NULL`.
+      if (contentChanged && this.vecInitialized && this.getVecTableSchema()) {
+        await tx.run("DELETE FROM memory_vec WHERE memory_id = ?", [id]);
+      }
+      if (after.name !== before.name || contentChanged) {
+        await this.syncFtsRow(id, after.name, after.content);
+      }
+      return true;
+    });
+  }
+
   async getStats(agentId: string): Promise<MemoryStats> {
     const db = getDbClient();
 

package/src/be/memory/raters/llm-summarizer.ts

@@ -12,7 +12,10 @@
  */
 import { z } from "zod";
 import { MEMORY_RATER_DEFAULT_MODEL } from "../../../utils/internal-ai/models";
-import { getOpenRouterBaseUrl } from "../../../utils/openrouter-base-url";
+import {
+  getOpenRouterAttributionHeaders,
+  getOpenRouterBaseUrl,
+} from "../../../utils/openrouter-base-url";
 import { type SummaryWithRatings, SummaryWithRatingsSchema } from "./llm";
 
 /**
@@ -150,11 +153,13 @@ export async function runMemoryRater(opts: RunMemoryRaterOpts): Promise<RunMemor
   const model = opts.model ?? getMemoryRaterModel();
   const responseLogCap = opts.responseLogCap ?? 200;
 
+  const url = openRouterChatCompletionsUrl();
   let res: Response;
   try {
-    res = await fetchFn(openRouterChatCompletionsUrl(), {
+    res = await fetchFn(url, {
       method: "POST",
       headers: {
+        ...getOpenRouterAttributionHeaders(url),
         "Content-Type": "application/json",
         Authorization: `Bearer ${opts.apiKey}`,
       },

package/src/be/memory/types.ts

@@ -40,6 +40,17 @@ export interface MemoryStore {
   deleteBySourcePath(sourcePath: string, agentId: string): Promise<number>;
   purgeExpired(): Promise<number>;
   updateEmbedding(id: string, embedding: Float32Array, model: string): Promise<void>;
+  /**
+   * Redact a row in place (boot retro-sweep). Writes only if the row still
+   * holds `before`; keeps FTS in sync and drops the embedding when the
+   * content changed so the re-embed backfill regenerates it. Returns whether
+   * the row was written.
+   */
+  rewriteForScrub(
+    id: string,
+    before: MemoryScrubFields,
+    after: MemoryScrubFields,
+  ): Promise<boolean>;
   getStats(agentId: string): Promise<MemoryStats>;
   getHealth(): MemoryHealth;
 }
@@ -48,6 +59,9 @@ export interface MemoryStore {
 // Supporting types
 // ============================================================================
 
+/** The free-text `agent_memory` columns the boot retro-sweep redacts. */
+export type MemoryScrubFields = { name: string; content: string; summary: string | null };
+
 export interface MemoryInput {
   agentId: string | null;
   scope: AgentMemoryScope;

package/src/be/migrations/201_workflow_replay_columns.sql

@@ -0,0 +1,10 @@
+-- Byte-exact replay state for workflow runs, sealed at rest.
+--
+-- `workflow_run_steps.output` and `workflow_runs.context` are scrubbed at write
+-- for display and SQL filters (`json_extract(context, '$.swarm.requestedByUserId')`).
+-- Resume, retry, dedup and recovery rebuild the live ctx from these values, so
+-- they need the exact value: these columns hold it, encrypted with `sealJson`
+-- (src/be/sealed-json.ts). NULL for rows written before this migration; their
+-- readers fall back to the plain column.
+ALTER TABLE workflow_run_steps ADD COLUMN output_replay TEXT;
+ALTER TABLE workflow_runs ADD COLUMN context_replay TEXT;

package/src/be/migrations/202_codex_oauth_device_flows.sql

@@ -0,0 +1,24 @@
+-- Codex device-login flow state, moved out of `kv_entries`.
+--
+-- `state` is the encrypted flow (device auth id, user code, poll lease). It
+-- lived in `kv_entries` namespace 'codex-oauth-device', which db-query must
+-- keep readable for general KV debugging. A dedicated table lets db-query deny
+-- this store by table name, with no SQL-text parsing.
+--
+-- expires_at: unix-ms. Expired rows are deleted on read and on every write.
+
+CREATE TABLE IF NOT EXISTS codex_oauth_device_flows (
+  flow_id     TEXT PRIMARY KEY,
+  state       TEXT NOT NULL,
+  expires_at  INTEGER NOT NULL,
+  created_at  INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER)),
+  updated_at  INTEGER NOT NULL DEFAULT (CAST(unixepoch('subsec') * 1000 AS INTEGER))
+);
+
+INSERT OR IGNORE INTO codex_oauth_device_flows (flow_id, state, expires_at, created_at, updated_at)
+  SELECT key, value, expires_at, created_at, updated_at
+    FROM kv_entries
+   WHERE namespace = 'codex-oauth-device'
+     AND expires_at IS NOT NULL;
+
+DELETE FROM kv_entries WHERE namespace = 'codex-oauth-device';

package/src/be/modelsdev-cache.json

@@ -147175,6 +147175,67 @@
     "name": "Anthropic",
     "doc": "https://docs.anthropic.com/en/docs/about-claude/models",
     "models": {
+      "claude-haiku-5-5": {
+        "id": "claude-haiku-5-5",
+        "name": "Claude Haiku 5.5",
+        "description": "Fast Claude model for responsive assistance, classification, and lightweight agents",
+        "family": "claude-haiku",
+        "attachment": true,
+        "reasoning": true,
+        "reasoning_options": [
+          {
+            "type": "toggle"
+          },
+          {
+            "type": "effort",
+            "values": [
+              "low",
+              "medium",
+              "high",
+              "xhigh",
+              "max"
+            ]
+          }
+        ],
+        "tool_call": true,
+        "structured_output": true,
+        "temperature": false,
+        "knowledge": "2026-06",
+        "modalities": {
+          "input": [
+            "text",
+            "image",
+            "pdf"
+          ],
+          "output": [
+            "text"
+          ]
+        },
+        "open_weights": false,
+        "limit": {
+          "context": 1000000,
+          "output": 128000
+        },
+        "cost": {
+          "input": 0.1,
+          "output": 0.5,
+          "cache_read": 0.01,
+          "cache_write": 0.125,
+          "tiers": [
+            {
+              "input": 0.5,
+              "output": 2.5,
+              "cache_read": 0.05,
+              "cache_write": 0.625,
+              "tier": {
+                "type": "context",
+                "size": 100000
+              }
+            }
+          ]
+        },
+        "canonical_model_id": "anthropic/claude-haiku-5-5"
+      },
       "claude-sonnet-5-5": {
         "id": "claude-sonnet-5-5",
         "name": "Claude Sonnet 5.5",

package/src/be/scripts/db.ts

@@ -8,10 +8,10 @@ import type {
   ScriptScope,
   ScriptVersionRecord,
 } from "../../types";
-import { registerVolatileSecret } from "../../utils/secret-scrubber";
 import { generateBearerToken, generateShortId } from "../../utils/short-id";
 import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { computeContentHash, getDbClient } from "../db";
+import { registerStoredSecret, scriptApiSecretName } from "../secret-registry";
 import { embedScript } from "./embeddings";
 
 type ScriptRow = Omit<ScriptRecord, "isScratch" | "typeChecked"> & {
@@ -517,7 +517,7 @@ export async function createScriptApi(args: {
         ],
       );
       if (!row) throw new Error("Failed to create script API endpoint");
-      if (token) registerVolatileSecret(token, `script-api:${id}`);
+      registerStoredSecret(token, scriptApiSecretName(id));
       return { ...rowToScriptApi(row), token };
     } catch (err) {
       if (isUniqueConstraintError(err) && attempt < 4) continue;
@@ -527,6 +527,30 @@ export async function createScriptApi(args: {
   throw new Error("Failed to allocate a unique script API endpoint id");
 }
 
+/**
+ * Every stored script API bearer token, decrypted, for the secret registry
+ * (src/be/secret-registry.ts). A row that fails to decrypt is counted, not thrown.
+ */
+export async function listStoredScriptApiSecrets(): Promise<{
+  secrets: { id: string; token: string }[];
+  failed: number;
+}> {
+  const rows = await getDbClient().query<{ id: string; bearerTokenEncrypted: string }>(
+    "SELECT id, bearerTokenEncrypted FROM script_apis WHERE bearerTokenEncrypted IS NOT NULL",
+  );
+  const secrets: { id: string; token: string }[] = [];
+  let failed = 0;
+  for (const row of rows) {
+    try {
+      const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
+      if (token) secrets.push({ id: row.id, token });
+    } catch {
+      failed++;
+    }
+  }
+  return { secrets, failed };
+}
+
 export async function listScriptApisForScript(scriptId: string): Promise<ScriptApiRecord[]> {
   const rows = await getDbClient().query<ScriptApiRow>(
     "SELECT * FROM script_apis WHERE scriptId = ? ORDER BY createdAt DESC",
@@ -554,7 +578,7 @@ export async function getScriptApiSecret(id: string): Promise<string | null> {
   );
   if (!row?.bearerTokenEncrypted) return null;
   const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
-  registerVolatileSecret(token, `script-api:${id}`);
+  registerStoredSecret(token, scriptApiSecretName(id));
   return token;
 }
 
@@ -604,7 +628,7 @@ export async function rotateScriptApiSecret(
     [encrypted, updatedBy ?? null, id],
   );
   if (!row) return null;
-  registerVolatileSecret(token, `script-api:${id}`);
+  registerStoredSecret(token, scriptApiSecretName(id));
   return { ...rowToScriptApi(row), token };
 }
 

package/src/be/scripts/source-secrets.ts

@@ -0,0 +1,37 @@
+import { findSecretsIn } from "../../utils/secret-scrubber";
+
+/**
+ * Executable source is stored and served verbatim (`scripts.source`,
+ * `script_versions.source`, `script_runs.source`): redacting it would change
+ * what runs, and sealing it would hide reviewed code. So a source that embeds
+ * a secret is refused at write instead, before anything runs or persists.
+ *
+ * Checked: every registered secret value, in each encoded form the known-value
+ * matcher holds, and the gitleaks vendor-token rules. The refusal names the
+ * secret's key or the rule id, never the value. Rows written before this check
+ * are left as they are.
+ */
+export interface SourceSecretRefusal {
+  error: "source_contains_secret";
+  message: string;
+  findings: { kind: "registered-secret" | "gitleaks-rule"; id: string }[];
+}
+
+export function refuseSourceWithSecrets(source: string): SourceSecretRefusal | null {
+  const { knownValues, gitleaksRules } = findSecretsIn(source);
+  if (knownValues.length === 0 && gitleaksRules.length === 0) return null;
+  const findings = [
+    ...knownValues.map((id) => ({ kind: "registered-secret" as const, id })),
+    ...gitleaksRules.map((id) => ({ kind: "gitleaks-rule" as const, id })),
+  ];
+  const named = findings
+    .map((f) =>
+      f.kind === "registered-secret" ? `registered secret ${f.id}` : `gitleaks rule ${f.id}`,
+    )
+    .join(", ");
+  return {
+    error: "source_contains_secret",
+    message: `Script source contains a secret (${named}); nothing was saved or run. Source is stored and shown verbatim, so read secrets at run time instead: a credential binding (ctx.api.<slug> / ctx.mcp.<slug>) or ctx.swarm.config.get("<KEY>").`,
+    findings,
+  };
+}

package/src/be/scrub-json.ts

@@ -0,0 +1,32 @@
+import { type ScrubbedText, scrubObject, scrubSecrets } from "../utils/secret-scrubber";
+
+/** True when `before` parsed as JSON and `after` no longer does. */
+export function breaksJsonValidity(before: string, after: string): boolean {
+  try {
+    JSON.parse(before);
+  } catch {
+    return false;
+  }
+  try {
+    JSON.parse(after);
+    return false;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * Serialize `value` for a JSON TEXT column with secrets redacted.
+ *
+ * Scrubs the serialized text first, so context-keyed passes (`"password":
+ * "..."`, auth headers) see the key next to its value. When a redaction breaks
+ * JSON validity (a marker swallowed a quote or brace), falls back to scrubbing
+ * each string leaf, which always serializes cleanly. Readers keep `JSON.parse`.
+ */
+export function scrubJsonValue(value: unknown): ScrubbedText {
+  const raw = JSON.stringify(value);
+  const scrubbed = scrubSecrets(raw);
+  if (!breaksJsonValidity(raw, scrubbed)) return scrubbed;
+  // Every string leaf went through scrubSecrets; the brand holds.
+  return JSON.stringify(scrubObject(value)) as ScrubbedText;
+}

package/src/be/sealed-json.ts

@@ -0,0 +1,59 @@
+import { decryptSecret, encryptSecret, getEncryptionKey } from "./crypto";
+import { scrubJsonValue } from "./scrub-json";
+
+/**
+ * Sealed JSON: byte-exact replay state, encrypted at rest.
+ *
+ * Some JSON columns are execution inputs, not records. The supervisor relaunches
+ * a durable script run from `script_runs.args`, and the harness replays
+ * `script_run_journal.result` as a step's return value. Redacting them would
+ * change what the script sees after a restart, and storing them raw leaves a
+ * secret at rest. Sealing keeps the exact bytes for the replay readers and
+ * nothing readable for anything that scans the database.
+ *
+ * Readers pick a view: `openSealedJson` (replay, exact value) or
+ * `sealedJsonForDisplay` (API/UI, redacted). Rows written before sealing are
+ * plain JSON and both readers still accept them.
+ */
+
+const SEALED_PREFIX = "sealed:v1:";
+
+/**
+ * Every column a writer fills with `sealJson`. Boot counts a sealed value here
+ * as encrypted data, like an encrypted config or OAuth row: with the key
+ * missing, startup refuses instead of generating a replacement key that could
+ * never open them. Add a column here when a writer starts sealing it.
+ */
+export const SEALED_REPLAY_COLUMNS: readonly { table: string; column: string }[] = [
+  { table: "script_runs", column: "args" },
+  { table: "script_run_journal", column: "result" },
+  { table: "workflow_run_steps", column: "output_replay" },
+  { table: "workflow_runs", column: "context_replay" },
+  { table: "approval_requests", column: "responses" },
+];
+
+/** SQL `EXISTS` arms matching a sealed value in each `SEALED_REPLAY_COLUMNS` entry. */
+export function sealedReplayExistsSql(): string[] {
+  return SEALED_REPLAY_COLUMNS.map(
+    ({ table, column }) => `SELECT 1 FROM ${table} WHERE ${column} GLOB '${SEALED_PREFIX}*'`,
+  );
+}
+
+export function sealJson(value: unknown): string {
+  return SEALED_PREFIX + encryptSecret(JSON.stringify(value), getEncryptionKey());
+}
+
+export function isSealedJson(text: string): boolean {
+  return text.startsWith(SEALED_PREFIX);
+}
+
+/** The exact stored value. Only execution and replay paths may call this. */
+export function openSealedJson(text: string): unknown {
+  if (!isSealedJson(text)) return JSON.parse(text);
+  return JSON.parse(decryptSecret(text.slice(SEALED_PREFIX.length), getEncryptionKey()));
+}
+
+/** The stored value with secrets redacted, for API responses and the UI. */
+export function sealedJsonForDisplay(text: string): unknown {
+  return JSON.parse(scrubJsonValue(openSealedJson(text)));
+}

package/src/be/secret-registry.ts

@@ -0,0 +1,131 @@
+/**
+ * API-side registry of every stored secret value.
+ *
+ * The scrubber's exact-match pass only knows sensitive env values and values
+ * registered at runtime. Without this registry, a secret stored before the
+ * last restart (an agent-scoped config secret, an OAuth or MCP OAuth token, a
+ * script API bearer token) stays unknown until something reads it again, and
+ * the boot retro-sweep cannot redact a value it does not know.
+ *
+ * At boot, `loadSecretRegistry()` decrypts every stored secret and registers
+ * it. Each encrypt site calls `registerStoredSecret()` with the new plaintext,
+ * so a write after boot is covered without a reload.
+ *
+ * Feeds the scrubber only through `registerVolatileSecret`, so worker-side
+ * code is untouched. Append-only: a deleted or rotated secret stays
+ * registered, since redacting a revoked value is still correct. Never logs a
+ * value: names are source markers (`config:<KEY>`, `oauth:<provider>:…`,
+ * `script-api:<id>`), and load results are counts.
+ */
+import { registerVolatileSecret } from "../utils/secret-scrubber";
+import { listStoredConfigSecrets } from "./db/config-secrets";
+import { listStoredOAuthSecrets, type StoredOAuthSecretKind } from "./db-queries/oauth";
+import { listStoredScriptApiSecrets } from "./scripts/db";
+
+export function configSecretName(key: string): string {
+  return `config:${key}`;
+}
+
+export function oauthSecretName(provider: string, kind: StoredOAuthSecretKind): string {
+  return `oauth:${provider}:${kind}`;
+}
+
+export function scriptApiSecretName(id: string): string {
+  return `script-api:${id}`;
+}
+
+/**
+ * Base64 text that encodes `value` wherever it sits in a larger byte string.
+ * Base64 maps 3 bytes to 4 chars, so the chars depend on the value's byte
+ * offset mod 3. For each offset, keep only the chars computed from the value's
+ * bytes alone: drop the leading chars that mix in preceding bytes and the
+ * trailing chars that depend on following bytes. Offset 0 also keeps the whole
+ * padded encoding (the value encoded on its own). This catches
+ * `Basic base64(user:secret)` and a secret inside an encoded JSON blob.
+ */
+function base64Forms(value: string): string[] {
+  const bytes = Buffer.from(value, "utf8");
+  const forms = [bytes.toString("base64")];
+  for (const offset of [0, 1, 2]) {
+    const shifted = Buffer.concat([Buffer.alloc(offset), bytes]);
+    // Offset 1 mixes the prefix into the first 2 chars, offset 2 into the first 3.
+    const skip = offset === 0 ? 0 : offset + 1;
+    const end = Math.floor(shifted.length / 3) * 4;
+    forms.push(shifted.toString("base64").slice(skip, end));
+  }
+  const urlSafe = forms.map((form) =>
+    form.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""),
+  );
+  return [...forms, ...urlSafe];
+}
+
+/**
+ * Encoded forms of a known value: base64 (std and url-safe, see
+ * `base64Forms`) and URL percent-encoding. Shell and JSON escaping are not
+ * repeated here: `registerVolatileSecret` already adds those forms (and
+ * drops any form shorter than the scrubber's minimum length).
+ */
+export function encodedForms(value: string): string[] {
+  const forms = new Set(base64Forms(value));
+  const uriEncoded = encodeURIComponent(value);
+  if (uriEncoded !== value) forms.add(uriEncoded);
+  forms.delete(value);
+  forms.delete("");
+  return [...forms];
+}
+
+/** Register a stored secret value, plus its encoded forms, with the scrubber. */
+export function registerStoredSecret(value: string | null | undefined, name: string): void {
+  if (!value) return;
+  registerVolatileSecret(value, name);
+  for (const form of encodedForms(value)) registerVolatileSecret(form, name);
+}
+
+export interface SecretRegistryLoadResult {
+  config: number;
+  oauth: number;
+  scriptApi: number;
+  /** Rows that could not be read or decrypted (wrong or missing key). */
+  failed: number;
+}
+
+/**
+ * Register every stored secret. Called once at API boot, before the boot
+ * retro-sweep. A row that fails to decrypt is counted and skipped; a source
+ * that fails as a whole (e.g. no encryption key resolved) is counted as one
+ * failure and the other sources still load.
+ */
+export async function loadSecretRegistry(): Promise<SecretRegistryLoadResult> {
+  const result: SecretRegistryLoadResult = { config: 0, oauth: 0, scriptApi: 0, failed: 0 };
+
+  try {
+    const { secrets, failed } = await listStoredConfigSecrets();
+    for (const { key, value } of secrets) registerStoredSecret(value, configSecretName(key));
+    result.config = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  try {
+    const { secrets, failed } = await listStoredOAuthSecrets();
+    for (const { provider, kind, value } of secrets) {
+      registerStoredSecret(value, oauthSecretName(provider, kind));
+    }
+    result.oauth = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  try {
+    const { secrets, failed } = await listStoredScriptApiSecrets();
+    for (const { id, token } of secrets) registerStoredSecret(token, scriptApiSecretName(id));
+    result.scriptApi = secrets.length;
+    result.failed += failed;
+  } catch {
+    result.failed += 1;
+  }
+
+  return result;
+}