@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/http/mcp.ts

@@ -7,7 +7,12 @@ import { createServer } from "@/server";
 import { parseEnvFlag } from "@/utils/env-flag";
 import { getRequestAuth } from "@/utils/request-auth-context";
 import { resolveScriptsOnlyMode } from "@/utils/scripts-only-mode";
-import { parseTaskToolManifest, selectTaskTools } from "@/utils/task-tool-manifest";
+import {
+  CHAT_TASK_ONLY_TOOLS,
+  isChatSdkTask,
+  parseTaskToolManifest,
+  selectTaskTools,
+} from "@/utils/task-tool-manifest";
 
 export type McpTransportActivity = Record<string, number>;
 export type McpSessionAgents = Record<string, string>;
@@ -218,18 +223,22 @@ export async function handleMcp(
         true,
       );
       let preloadedTools: string[] = [];
+      const sourceTaskId = headerValue(req.headers["x-source-task-id"]);
+      const sourceTask = sourceTaskId ? await getTaskById(sourceTaskId) : undefined;
+      // A session bound to a non-chat task never sees chat-reply. Without the
+      // header the tool stays, and resolves the agent's current task itself.
+      const excludedTools =
+        sourceTask && !isChatSdkTask(sourceTask) ? [...CHAT_TASK_ONLY_TOOLS] : [];
       if (preloadEnabled) {
-        const taskId = headerValue(req.headers["x-source-task-id"]);
-        const task = taskId ? await getTaskById(taskId) : undefined;
         // Never select a manifest using another agent's task. Session-token
         // identity is also checked above, before any MCP session is created.
-        if (task?.agentId === agentId) {
+        if (sourceTask?.agentId === agentId) {
           const manifestValue =
             configs.find((config) => config.key === "TASK_TOOL_MANIFESTS")?.value ??
             process.env.TASK_TOOL_MANIFESTS ??
             "{}";
           try {
-            preloadedTools = selectTaskTools(parseTaskToolManifest(manifestValue), task);
+            preloadedTools = selectTaskTools(parseTaskToolManifest(manifestValue), sourceTask);
           } catch {
             // An invalid deployment value must not prevent tool discovery.
             // Avoid logging its contents, which may contain misfiled secrets.
@@ -239,6 +248,7 @@ export async function handleMcp(
       }
       const server = await createServer({
         preloadedTools,
+        excludedTools,
         // Agent row, then global row, then deployment env. A blank agent row
         // resolves to "unset" for that agent.
         enabledTools:

package/src/http/page-proxy.ts

@@ -6,10 +6,8 @@ import { route } from "./route-def";
 import { jsonError } from "./utils";
 
 /**
- * `/@swarm/api/*` proxy. Cookie-gated equivalent of the artifact-sdk proxy
- * (src/artifact-sdk/server.ts:42-69), but lives on the MAIN API server and
- * authenticates via the page-session cookie instead of basic-auth + a per-
- * artifact tunnel.
+ * `/@swarm/api/*` proxy. Lives on the MAIN API server and authenticates via
+ * the page-session cookie.
  *
  * Flow:
  *   1. Browser hits `/@swarm/api/<rest>` from inside an iframe of `/p/:id`.

package/src/http/pages-public.ts

@@ -7,7 +7,7 @@
  *
  * Scope of THIS module (step-3):
  *   - `auth_mode === 'public'`: ungated. HTML responses inline-inject the
- *     `BROWSER_SDK_JS` constant from `src/artifact-sdk/browser-sdk.ts` (reused
+ *     `BROWSER_SDK_JS` constant from `src/pages/browser-sdk.ts` (reused
  *     verbatim — no token-injection hook on the client). SVG responses serve
  *     raw bytes with a restrictive CSP and no injected scripts. JSON responses
  *     302-redirect to the SPA `/pages/:id` route (the JSON renderer lives
@@ -23,11 +23,12 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
-import { BROWSER_SDK_JS, SWARM_UI_JS } from "../artifact-sdk/browser-sdk";
-import { feedbackOverlayScripts, isPageFeedbackRequested } from "../artifact-sdk/feedback-overlay";
 import { getPage, incrementPageViewCount } from "../be/db";
+import { BROWSER_SDK_JS, SWARM_UI_JS } from "../pages/browser-sdk";
+import { feedbackOverlayScripts, isPageFeedbackRequested } from "../pages/feedback-overlay";
 import { type Page, PageSchema } from "../types";
 import { getAppUrl, getConfiguredAppUrls } from "../utils/constants";
+import { getNodeEnv } from "../utils/node-env";
 import { extractAndVerifyCookie, issuePageSessionCookie } from "../utils/page-session";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { route } from "./route-def";
@@ -318,7 +319,7 @@ function buildCsp(): string {
   // between Vite ports / portless dev doesn't require restarting the API.
   const configured = getConfiguredAppUrls();
   const devFallbacks =
-    process.env.NODE_ENV === "production"
+    getNodeEnv() === "production"
       ? []
       : [
           "http://localhost:5274",
@@ -459,7 +460,7 @@ function extractPasswordCandidate(
  * `SameSite=Lax` (dev) vs `SameSite=None; Secure` (prod).
  */
 function isLocalhostRequest(req: IncomingMessage): boolean {
-  if (process.env.NODE_ENV === "production") return false;
+  if (getNodeEnv() === "production") return false;
   // Only emit `SameSite=Lax` (no Secure) when the request comes from the
   // SAME http://localhost origin as the API — Lax cookies don't travel on
   // cross-site fetches, so portless `*.localhost` setups (SPA on https

package/src/http/pages.ts

@@ -19,6 +19,7 @@ import {
   updatePage,
   withFavoriteFlags,
 } from "../be/db";
+import { getPageEditCounter } from "../be/db/page-versions";
 import { snapshotPage } from "../pages/version";
 import { resolveTemplate } from "../prompts/resolver";
 // Side-effect import: registers `task.page.feedback`.
@@ -34,6 +35,7 @@ import {
   PageVersionSchema,
 } from "../types";
 import { getAppUrl, getPublicMcpBaseUrl } from "../utils/constants";
+import { getNodeEnv } from "../utils/node-env";
 import { issuePageSessionCookie } from "../utils/page-session";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
@@ -226,7 +228,7 @@ const updatePageRoute = route({
 /**
  * POST /api/pages/:id/feedback — turn the element comments collected by the
  * in-page feedback overlay (`?__swarm-feedback`, see
- * `src/artifact-sdk/feedback-overlay.ts`) into one task for the lead. In the
+ * `src/pages/feedback-overlay.ts`) into one task for the lead. In the
  * dashboard the SPA calls it with its bearer for the page it shows. A page
  * opened directly reaches it through the `/@swarm/api/*` page proxy, which
  * pins `X-Page-Id` to the cookie's page, so a page can only file feedback on
@@ -481,17 +483,6 @@ function withShareUrls<T extends { id: string; slug: string }>(
   };
 }
 
-/**
- * Compute the page's "edit counter" — `MAX(page_versions.version) + 1`. Means
- * "this is the N-th edit since the page was created". After the first PUT the
- * value is 2 (one snapshot row → version 1 → counter becomes 2). This is the
- * value POST and PUT return as `version` on the wire.
- */
-async function pageEditCounter(pageId: string): Promise<number> {
-  const versions = await getPageVersions(pageId);
-  return versions.length > 0 ? versions[0]!.version + 1 : 1;
-}
-
 /**
  * Viewer and page-supplied text sits inside a `<page_feedback>` block in the
  * task prompt. Defuse any tag of that name so the text cannot close the block
@@ -536,7 +527,7 @@ function formatFeedbackComments(comments: z.infer<typeof PageFeedbackCommentSche
 }
 
 function isDevRequest(req: IncomingMessage): boolean {
-  if (process.env.NODE_ENV === "production") return false;
+  if (getNodeEnv() === "production") return false;
   // We want `SameSite=Lax` only when the request itself comes from the same
   // local-`http://localhost` origin as the API — same-site loads tolerate
   // Lax without Secure. Anything else (including portless `*.localhost`
@@ -842,7 +833,7 @@ export async function handlePages(
     updatePageRoute.respond(res, 200, {
       id: updated.id,
       key: updated.key,
-      version: await pageEditCounter(updated.id),
+      version: await getPageEditCounter(updated.id),
     });
     return true;
   }

package/src/http/poll.ts

@@ -19,7 +19,6 @@ import {
   getTaskAttachments,
   getTaskById,
   getUnassignedTaskIdsForAgent,
-  getUserById,
   hasCapacity,
   isExtensionAgent,
   recordBudgetRefusalNotification,
@@ -27,7 +26,6 @@ import {
   updateAgentStatusFromCapacity,
   upsertChannelActivityCursor,
 } from "../be/db";
-import { renderIdentity, resolveIdentity } from "../be/identity";
 import {
   parseModelTierOverridesHeader,
   recordClaimModelResolution,
@@ -37,19 +35,14 @@ import { poolTaskRunsOnHarness } from "../be/model-validation";
 import { getRuntimeInstanceById, touchRuntimeInstance } from "../be/multi-runtime";
 import { hasCapability } from "../server";
 import { fetchChannelActivity } from "../slack/channel-activity";
+import { type TaskModelPinFields, taskModelPin } from "../tasks/model-pin";
 import { emitTaskTelemetry, resolveTriggerSurface } from "../telemetry-trigger";
-import {
-  AgentTaskSchema,
-  BudgetRefusedTriggerSchema,
-  TaskAttachmentSchema,
-  UserCommsPrefsSchema,
-  UserSchema,
-} from "../types";
+import { AgentTaskSchema, BudgetRefusedTriggerSchema, TaskAttachmentSchema } from "../types";
 import { ensure } from "../utils/business-use";
 import { isLeadChannelMonitoringEnabled } from "../utils/lead-monitor-channels";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
-import { getUserCommsPrefs } from "../utils/requester-comms";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
+import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
 import { route, runtimeInstanceHeader } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -100,27 +93,11 @@ const PollTriggerAttachmentSchema = TaskAttachmentSchema.pick({
   sizeBytes: true,
 });
 
-// Requester projection sent on `task_assigned` triggers — either the resolved
-// user's identity fields, or (when no `requestedByUserId` is recorded) just a
-// rendered `name` for the UNKNOWN-identity sentinel.
-const PollRequestedBySchema = UserSchema.pick({
-  id: true,
-  name: true,
-  email: true,
-  role: true,
-  notes: true,
-}).extend({
-  // Absent for the UNKNOWN-identity sentinel (Slack-only requester, no users row).
-  id: z.string().optional(),
-  // Structured communication preferences from `users.metadata.comms`.
-  comms: UserCommsPrefsSchema.optional(),
-});
-
 const PollTaskOfferedTriggerSchema = z.object({
   type: z.literal("task_offered"),
   taskId: z.string(),
   task: AgentTaskSchema,
-  requestedBy: PollRequestedBySchema.optional(),
+  requestedBy: TaskRequestedBySchema.optional(),
 });
 
 const PollTaskAssignedTriggerSchema = z.object({
@@ -132,7 +109,7 @@ const PollTaskAssignedTriggerSchema = z.object({
   task: AgentTaskSchema.extend({
     attachments: z.array(PollTriggerAttachmentSchema),
   }),
-  requestedBy: PollRequestedBySchema.optional(),
+  requestedBy: TaskRequestedBySchema.optional(),
 });
 
 // `budget_refused` reuses the canonical `BudgetRefusedTriggerSchema` entity
@@ -204,38 +181,6 @@ const pollTriggers = route({
 const CHANNEL_ACTIVITY_INTERVAL_MS = 60_000; // Check at most once per 60s
 let lastChannelActivityCheckAt = 0;
 
-function getRequesterNotes(notes: string | undefined): string | undefined {
-  return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
-}
-
-/**
- * Resolve the requester projection for a task trigger. If the task carries a
- * machine-recorded external id (today: the Slack user field) but no
- * requestedByUserId, render the explicit UNKNOWN sentinel instead of silently
- * omitting the section: never a substituted human (Rule 33 /
- * provenance-or-silence).
- */
-async function buildTriggerRequestedBy(task: {
-  requestedByUserId?: string | null;
-  slackUserId?: string | null;
-}): Promise<z.infer<typeof PollRequestedBySchema> | undefined> {
-  const user = task.requestedByUserId ? await getUserById(task.requestedByUserId) : undefined;
-  if (user) {
-    return {
-      id: user.id,
-      name: user.name,
-      email: user.email,
-      role: user.role,
-      notes: getRequesterNotes(user.notes),
-      comms: getUserCommsPrefs(user),
-    };
-  }
-  if (task.slackUserId) {
-    return { name: renderIdentity(await resolveIdentity("slack", task.slackUserId)) };
-  }
-  return undefined;
-}
-
 /**
  * Slim attachment projection for the `task_assigned` poll trigger — just
  * enough (id, name, mimeType, sizeBytes) for the worker to build a one-shot
@@ -256,16 +201,31 @@ async function attachmentsForTrigger(
 /**
  * Claim-time model resolution (runbooks/model-tiers.md). Never blocks a claim:
  * a resolution failure leaves the worker on its own local resolution.
+ *
+ * The trigger's `model` is the task's own pin, not the column: a re-claimed
+ * row carries the model its previous session reported, and the worker treats
+ * `task.model` as a pin that beats the agent's current MODEL_OVERRIDE. The
+ * previous claim record is overwritten for the same reason.
  */
 async function claimModelFields(
-  task: { id: string; model?: string | null; modelTier?: string | null },
+  task: TaskModelPinFields & { id: string },
   agent: Parameters<typeof recordClaimModelResolution>[1],
-): Promise<Awaited<ReturnType<typeof recordClaimModelResolution>>> {
+): Promise<Awaited<ReturnType<typeof recordClaimModelResolution>> & { model: string | undefined }> {
+  const pin = taskModelPin(task);
+  const cleared = {
+    model: pin,
+    resolvedModel: undefined,
+    modelSource: undefined,
+    modelAlias: undefined,
+  };
   try {
-    return await recordClaimModelResolution(task, agent);
+    return {
+      ...cleared,
+      ...(await recordClaimModelResolution({ ...task, model: pin }, agent)),
+    };
   } catch (error) {
     console.warn(`[/api/poll] model resolution failed for task ${task.id}:`, error);
-    return {};
+    return cleared;
   }
 }
 
@@ -422,7 +382,7 @@ export async function handlePoll(
           const claimedTask = await claimOfferedTask(firstOfferedTask.id, myAgentId);
           if (claimedTask) {
             await recordRuntimeTask(claimedTask.id);
-            const offeredRequestedBy = await buildTriggerRequestedBy(claimedTask);
+            const offeredRequestedBy = await buildTaskRequestedBy(claimedTask);
             return {
               trigger: {
                 type: "task_offered",
@@ -519,8 +479,8 @@ export async function handlePoll(
             });
 
             // Resolve requesting user if available (UNKNOWN sentinel handling
-            // lives in buildTriggerRequestedBy).
-            const assignedRequestedBy = await buildTriggerRequestedBy(pendingTask);
+            // lives in buildTaskRequestedBy).
+            const assignedRequestedBy = await buildTaskRequestedBy(pendingTask);
             // The surface that started the whole chain, so the worker can tag
             // its session events with it (workers cannot read the task tree).
             const assignedTriggerSurface = await resolveTriggerSurface(
@@ -667,7 +627,7 @@ export async function handlePoll(
                     agentId: myAgentId,
                   });
                 });
-                const claimedRequestedBy = await buildTriggerRequestedBy(claimed);
+                const claimedRequestedBy = await buildTaskRequestedBy(claimed);
                 const claimedTriggerSurface = await resolveTriggerSurface(
                   claimed.id,
                   claimed.source,

package/src/http/requested-by.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+import { getUserById } from "../be/db";
+import { renderIdentity, resolveIdentity } from "../be/identity";
+import { UserCommsPrefsSchema, UserSchema } from "../types";
+import { getUserCommsPrefs } from "../utils/requester-comms";
+
+// Requester projection sent with a task to the worker that runs it (poll
+// triggers, paused-task resume) — either the resolved user's identity fields,
+// or (when no `requestedByUserId` is recorded) just a rendered `name` for the
+// UNKNOWN-identity sentinel.
+export const TaskRequestedBySchema = UserSchema.pick({
+  id: true,
+  name: true,
+  email: true,
+  role: true,
+  notes: true,
+}).extend({
+  // Absent for the UNKNOWN-identity sentinel (Slack-only requester, no users row).
+  id: z.string().optional(),
+  // Structured communication preferences from `users.metadata.comms`.
+  comms: UserCommsPrefsSchema.optional(),
+});
+
+function getRequesterNotes(notes: string | undefined): string | undefined {
+  return typeof notes === "string" && notes.trim().length > 0 ? notes : undefined;
+}
+
+/**
+ * Resolve the requester projection for a task. If the task carries a
+ * machine-recorded external id (today: the Slack user field) but no
+ * requestedByUserId, render the explicit UNKNOWN sentinel instead of silently
+ * omitting the section: never a substituted human (Rule 33 /
+ * provenance-or-silence).
+ */
+export async function buildTaskRequestedBy(task: {
+  requestedByUserId?: string | null;
+  slackUserId?: string | null;
+}): Promise<z.infer<typeof TaskRequestedBySchema> | undefined> {
+  const user = task.requestedByUserId ? await getUserById(task.requestedByUserId) : undefined;
+  if (user) {
+    return {
+      id: user.id,
+      name: user.name,
+      email: user.email,
+      role: user.role,
+      notes: getRequesterNotes(user.notes),
+      comms: getUserCommsPrefs(user),
+    };
+  }
+  if (task.slackUserId) {
+    return { name: renderIdentity(await resolveIdentity("slack", task.slackUserId)) };
+  }
+  return undefined;
+}

package/src/http/route-def.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import type { PermissionVerb } from "../rbac";
+import { getNodeEnv } from "../utils/node-env";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { jsonError, matchRoute, parseBody, RequestBodyTooLargeError } from "./utils";
 
@@ -310,13 +311,13 @@ export function describeRequestRoute(
  * endpoint down outside tests (2026-08-18 incident — a single priority='high'
  * row 500'd every task listing). When the gate is on outside tests
  * (NODE_ENV=development, or VALIDATE_HTTP_RESPONSES=true), `respond()` logs
- * the violation and sends the response anyway. Note: the compiled Bun binary
- * defaults NODE_ENV to "development", so deploys must also set
- * NODE_ENV=production explicitly (see the deploy-env change in the fix PR).
+ * the violation and sends the response anyway. NODE_ENV is read at runtime
+ * (`getNodeEnv`), so the compiled binary with NODE_ENV unset leaves the gate
+ * off unless VALIDATE_HTTP_RESPONSES=true.
  */
 const VALIDATE_RESPONSES =
-  process.env.NODE_ENV === "test" ||
-  process.env.NODE_ENV === "development" ||
+  getNodeEnv() === "test" ||
+  getNodeEnv() === "development" ||
   process.env.VALIDATE_HTTP_RESPONSES === "true";
 
 export function route<
@@ -343,7 +344,7 @@ export function route<
               result.error.issues
                 .map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`)
                 .join("; ");
-            if (process.env.NODE_ENV === "test") {
+            if (getNodeEnv() === "test") {
               throw new Error(detail);
             }
             console.error(`[route-def] ${scrubSecrets(detail)}`);

package/src/http/script-connection-proxy.ts

@@ -3,7 +3,9 @@ import { z } from "zod";
 import { getAgentById } from "@/be/db";
 import { callMcpServerTool } from "@/be/mcp-proxy";
 import { getScriptConnectionById } from "@/be/script-connections";
+import { resolveSqlDsn, runReadOnlyQuery } from "@/be/sql-connections";
 import { can } from "@/rbac";
+import { scrubSecrets } from "@/utils/secret-scrubber";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -51,6 +53,37 @@ const mcpCallRoute = route({
   },
 });
 
+const SqlQueryEnvelopeSchema = z.union([
+  z.object({
+    ok: z.literal(true),
+    rows: z.array(z.record(z.string(), z.unknown())),
+    rowCount: z.number(),
+    truncated: z.boolean(),
+  }),
+  z.object({ ok: z.literal(false), error: z.string() }),
+]);
+
+const sqlQueryRoute = route({
+  method: "post",
+  path: "/api/script-connections/{id}/sql-query",
+  pattern: ["api", "script-connections", null, "sql-query"],
+  summary: "Run one read-only query on a SQL script connection",
+  tags: ["Script Connections"],
+  auth: { apiKey: true, agentId: true },
+  rbac: { permission: "script-connection.invoke" },
+  params: z.object({ id: z.string().uuid() }),
+  body: z.object({
+    sql: z.string().min(1).max(100_000),
+    params: z.array(z.unknown()).max(100).optional(),
+  }),
+  responses: {
+    200: { description: "Query rows or a scrubbed error", schema: SqlQueryEnvelopeSchema },
+    400: { description: "Invalid SQL connection or request" },
+    403: { description: "Not allowed to invoke this SQL connection" },
+    404: { description: "Script connection or agent not found" },
+  },
+});
+
 function connectionScopeMatches(
   connection: { scope: string; scopeId: string | null },
   agentId: string,
@@ -75,9 +108,12 @@ export async function handleScriptConnectionProxy(
   queryParams: URLSearchParams,
   agentId: string | undefined,
 ): Promise<boolean> {
-  if (!mcpCallRoute.match(req.method, pathSegments)) return false;
+  const isSql = sqlQueryRoute.match(req.method, pathSegments);
+  if (!isSql && !mcpCallRoute.match(req.method, pathSegments)) return false;
 
-  const parsed = await mcpCallRoute.parse(req, res, pathSegments, queryParams);
+  const parsed = isSql
+    ? await sqlQueryRoute.parse(req, res, pathSegments, queryParams)
+    : await mcpCallRoute.parse(req, res, pathSegments, queryParams);
   if (!parsed) return true;
 
   if (!agentId) {
@@ -111,14 +147,25 @@ export async function handleScriptConnectionProxy(
     jsonError(res, "Script connection is disabled", 403);
     return true;
   }
-  if (connection.kind !== "mcp") {
-    jsonError(res, "Script connection is not an MCP connection", 400);
+  if (connection.kind !== (isSql ? "sql" : "mcp")) {
+    jsonError(res, `Script connection is not ${isSql ? "a SQL" : "an MCP"} connection`, 400);
     return true;
   }
   if (!connectionScopeMatches(connection, agentId, syntheticPrincipal)) {
     jsonError(res, "Script connection is not available to this agent", 403);
     return true;
   }
+  if ("sql" in parsed.body) {
+    try {
+      const dsn = await resolveSqlDsn(connection, agentId);
+      const result = await runReadOnlyQuery(dsn, parsed.body.sql, parsed.body.params);
+      sqlQueryRoute.respond(res, 200, { ok: true, ...result });
+    } catch (err) {
+      const error = scrubSecrets(err instanceof Error ? err.message : String(err));
+      sqlQueryRoute.respond(res, 200, { ok: false, error });
+    }
+    return true;
+  }
   if (!connection.mcpServerId) {
     jsonError(res, "Script MCP connection is missing mcpServerId", 400);
     return true;

package/src/http/script-connections.ts

@@ -38,6 +38,7 @@ import {
   type ScriptConnectionKind,
   type ScriptConnectionRecord,
   type ScriptCredentialBindingRecord,
+  SqlDsnInputSchema,
   setScriptConnectionEnabled,
   upsertCredentialBinding,
   upsertScriptConnection,
@@ -80,7 +81,7 @@ const providerSchema = z
   .regex(/^[A-Za-z0-9_-]+$/);
 
 const scopeSchema = z.enum(["global", "agent", "repo"]);
-const connectionKindSchema = z.enum(["openapi", "graphql", "mcp"]);
+const connectionKindSchema = z.enum(["openapi", "graphql", "mcp", "sql"]);
 
 const idParamsSchema = z.object({ id: z.string().uuid() });
 const providerParamsSchema = z.object({ provider: providerSchema });
@@ -133,6 +134,7 @@ const upsertConnectionBodySchema = z.discriminatedUnion("kind", [
     kind: z.literal("mcp"),
     mcpServerId: z.string().uuid(),
   }),
+  connectionBaseBodySchema.extend({ kind: z.literal("sql"), dsn: SqlDsnInputSchema.optional() }),
 ]);
 
 const disableConnectionBodySchema = z.object({ enabled: z.boolean() });
@@ -232,7 +234,7 @@ const connectionAuthTypeResponseSchema = z.enum(["none", "bearer", "header", "qu
 // value (never written via this handler's upsert path, but readable via the
 // list/get routes for rows written elsewhere) — wider than the HTTP-body-only
 // `connectionKindSchema` above.
-const connectionRecordKindSchema = z.enum(["raw", "openapi", "mcp", "graphql"]);
+const connectionRecordKindSchema = z.enum(["raw", "openapi", "mcp", "graphql", "sql"]);
 
 const bindingSummarySchema = z.object({
   id: z.string(),
@@ -2062,6 +2064,7 @@ export async function handleScriptConnections(
           ? existingOpenapiConnection?.openapiSpecFetchedAt
           : undefined,
         mcpServerId: parsed.body.kind === "mcp" ? parsed.body.mcpServerId : null,
+        sqlDsn: parsed.body.kind === "sql" ? parsed.body.dsn : undefined,
         enabled,
         agentId,
         userId,

package/src/http/scripts.ts

@@ -765,6 +765,7 @@ export async function handleScripts(
       runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
       failedBindings: credentials.failedBindings,
+      userConfig: credentials.userConfig,
       apiConnections: getScriptApiConnectionDescriptors({ agentId: agent.id }),
       mcpConnections: getScriptMcpConnectionDescriptors({ agentId: agent.id }),
     });

package/src/http/session-cost-recompute.ts

@@ -31,6 +31,8 @@ interface SessionCostRecomputeInput {
   provider?: PricingProvider;
   model: string;
   harnessCostUsd: number;
+  /** `harnessCostUsd` is the provider's bill, not a token estimate. */
+  harnessCostBilled?: boolean;
   inputTokens: number;
   outputTokens: number;
   cacheReadTokens: number;
@@ -187,8 +189,16 @@ export async function recomputeSessionCost(
   // every request was billed through Amp, so it wins over the token price,
   // which still fills the per-model breakdown. Grok's `costUsdTicks` is the
   // same kind of report: what xAI billed, long-context tiers included.
-  if ((input.provider === "amp" || input.provider === "grok") && input.harnessCostUsd > 0) {
-    const priced = await recomputeSessionCost({ ...input, harnessCostUsd: 0 }, lookupRate);
+  // opencode on OpenRouter sends OpenRouter's `usage.cost` sum, flagged as
+  // billed: the routed endpoint can cost many times the list price.
+  if (
+    (input.provider === "amp" || input.provider === "grok" || input.harnessCostBilled) &&
+    input.harnessCostUsd > 0
+  ) {
+    const priced = await recomputeSessionCost(
+      { ...input, harnessCostUsd: 0, harnessCostBilled: false },
+      lookupRate,
+    );
     return {
       totalCostUsd: input.harnessCostUsd,
       costSource: "harness",

package/src/http/session-data.ts

@@ -179,6 +179,9 @@ const createSessionCostRoute = route({
     sessionId: z.string().min(1),
     agentId: z.string().min(1),
     totalCostUsd: z.number(),
+    // The adapter's totalCostUsd is the provider's bill (e.g. OpenRouter's
+    // `usage.cost`), so it wins over the pricing table.
+    harnessCostBilled: z.boolean().optional(),
     taskId: z.string().optional(),
     // Phase 3: non-negative — the recompute no longer clamps, so negative
     // token counts must be rejected at the wire instead of pricing below $0.
@@ -397,6 +400,7 @@ export async function handleSessionData(
           provider: parsed.body.provider,
           model,
           harnessCostUsd: parsed.body.totalCostUsd,
+          harnessCostBilled: parsed.body.harnessCostBilled,
           inputTokens,
           outputTokens,
           cacheReadTokens: cachedInputTokens,