@desplega.ai/agent-swarm 1.80.0 → 1.80.2

package/src/scripts-runtime/redacted.ts

@@ -0,0 +1,48 @@
+/**
+ * Defense-in-depth, not isolation. Accidental leaks through console.log,
+ * JSON.stringify, util.inspect, or returned JSON emit "<redacted>". A malicious
+ * script can still call Redacted.value() and exfiltrate the string; host-side
+ * env stripping plus scrubObject are the v1 safety net.
+ */
+declare const redactedType: unique symbol;
+
+export type Redacted<A> = object & { readonly [redactedType]?: A };
+
+export type RedactedMeta = { type: "system" | "user"; isSecret: boolean };
+
+const registry = new WeakMap<Redacted<unknown>, { value: unknown; meta: RedactedMeta }>();
+
+const proto = {
+  toString() {
+    return "<redacted>";
+  },
+  toJSON() {
+    return "<redacted>";
+  },
+  [Symbol.for("nodejs.util.inspect.custom")]() {
+    return "<redacted>";
+  },
+};
+
+function getEntry<A>(self: Redacted<A>): { value: unknown; meta: RedactedMeta } {
+  const entry = registry.get(self);
+  if (!entry) throw new Error("Redacted value was not in registry");
+  return entry;
+}
+
+export const Redacted = {
+  make<A>(value: A, meta: RedactedMeta = { type: "user", isSecret: false }): Redacted<A> {
+    const redacted = Object.create(proto) as Redacted<A>;
+    registry.set(redacted, { value, meta });
+    return redacted;
+  },
+  value<A>(self: Redacted<A>): A {
+    return getEntry(self).value as A;
+  },
+  meta<A>(self: Redacted<A>): RedactedMeta {
+    return getEntry(self).meta;
+  },
+  isSecret<A>(self: Redacted<A>): boolean {
+    return Redacted.meta(self).isSecret;
+  },
+} as const;

package/src/scripts-runtime/sdk-allowlist.ts

@@ -0,0 +1,29 @@
+export const SDK_TOOL_NAME_MAP = {
+  memory_search: "memory-search",
+  memory_get: "memory-get",
+  memory_rate: "memory_rate",
+  task_list: "get-tasks",
+  task_get: "get-task-details",
+  task_storeProgress: "store-progress",
+  kv_get: "kv-get",
+  kv_set: "kv-set",
+  kv_del: "kv-delete",
+  kv_incr: "kv-incr",
+  kv_list: "kv-list",
+  repo_list: "get-repos",
+  schedule_list: "list-schedules",
+  script_search: "script-search",
+  script_run: "script-run",
+} as const;
+
+export const SDK_ALLOWLIST = Object.keys(SDK_TOOL_NAME_MAP) as Array<
+  keyof typeof SDK_TOOL_NAME_MAP
+>;
+
+export function isSdkToolAllowed(name: string): boolean {
+  return (SDK_ALLOWLIST as readonly string[]).includes(name);
+}
+
+export function mcpToolNameForSdkMethod(name: string): string {
+  return SDK_TOOL_NAME_MAP[name as keyof typeof SDK_TOOL_NAME_MAP] ?? name;
+}

package/src/scripts-runtime/stdlib/fetch.ts

@@ -0,0 +1,46 @@
+export type RuntimeFetchOptions = RequestInit & {
+  retries?: number;
+  timeoutMs?: number;
+};
+
+export async function runtimeFetch(
+  input: string | URL | Request,
+  options: RuntimeFetchOptions = {},
+): Promise<Response> {
+  const { retries = 3, timeoutMs = 30_000, signal, ...init } = options;
+  let lastError: unknown;
+
+  for (let attempt = 0; attempt < retries; attempt++) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    const onAbort = () => controller.abort();
+    signal?.addEventListener("abort", onAbort, { once: true });
+
+    try {
+      const res = await fetch(input, { ...init, signal: controller.signal });
+      if (!res.ok && attempt < retries - 1 && res.status >= 500) {
+        lastError = new Error(`fetch failed with ${res.status}`);
+        continue;
+      }
+      return res;
+    } catch (error) {
+      lastError = error;
+      if (attempt === retries - 1) break;
+    } finally {
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+    }
+  }
+
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+
+export async function runtimeFetchJson(
+  input: string | URL | Request,
+  options: RuntimeFetchOptions = {},
+): Promise<unknown> {
+  const res = await runtimeFetch(input, options);
+  const contentType = res.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) return await res.json();
+  return await res.text();
+}

package/src/scripts-runtime/stdlib/glob.ts

@@ -0,0 +1,8 @@
+export async function glob(pattern: string, cwd = process.cwd()): Promise<string[]> {
+  const globber = new Bun.Glob(pattern);
+  const matches: string[] = [];
+  for await (const match of globber.scan({ cwd })) {
+    matches.push(match);
+  }
+  return matches;
+}

package/src/scripts-runtime/stdlib/grep.ts

@@ -0,0 +1,34 @@
+export type GrepMatch = {
+  path: string;
+  line: number;
+  text: string;
+};
+
+export async function grep(pattern: string, cwd = process.cwd()): Promise<GrepMatch[]> {
+  const proc = Bun.spawn(["rg", "--line-number", "--no-heading", pattern, "."], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+
+  if (exitCode === 1) return [];
+  if (exitCode !== 0) {
+    const message = stderr.includes("No such file or directory")
+      ? "rg is not available on PATH"
+      : stderr.trim() || `rg exited with ${exitCode}`;
+    throw new Error(message);
+  }
+
+  return stdout
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const [path = "", lineNo = "0", ...rest] = line.split(":");
+      return { path, line: Number(lineNo), text: rest.join(":") };
+    });
+}

package/src/scripts-runtime/stdlib/index.ts

@@ -0,0 +1,16 @@
+import { Redacted } from "../redacted";
+import { runtimeFetch, runtimeFetchJson } from "./fetch";
+import { glob } from "./glob";
+import { grep } from "./grep";
+import { table } from "./table";
+
+export const stdlib = {
+  fetch: runtimeFetch,
+  fetchJson: runtimeFetchJson,
+  grep,
+  glob,
+  table,
+  Redacted,
+};
+
+export { runtimeFetch as fetch, runtimeFetchJson as fetchJson, glob, grep, table, Redacted };

package/src/scripts-runtime/stdlib/table.ts

@@ -0,0 +1,17 @@
+export function table(rows: Array<Record<string, unknown>>): string {
+  if (rows.length === 0) return "";
+
+  const headers = Array.from(new Set(rows.flatMap((row) => Object.keys(row))));
+  const renderedRows = rows.map((row) => headers.map((header) => String(row[header] ?? "")));
+  const widths = headers.map((header, index) =>
+    Math.max(header.length, ...renderedRows.map((row) => row[index]?.length ?? 0)),
+  );
+
+  const render = (cells: string[]) =>
+    cells.map((cell, index) => cell.padEnd(widths[index] ?? 0)).join("  ");
+  return [
+    render(headers),
+    render(widths.map((width) => "-".repeat(width))),
+    ...renderedRows.map(render),
+  ].join("\n");
+}

package/src/scripts-runtime/swarm-config.ts

@@ -0,0 +1,35 @@
+import type { SwarmConfigPayload } from "./executors/types";
+import { Redacted, type Redacted as RedactedValue } from "./redacted";
+
+export class SwarmConfig {
+  readonly apiKey: RedactedValue<string>;
+  readonly agentId: RedactedValue<string>;
+  readonly mcpBaseUrl: RedactedValue<string>;
+
+  private readonly userValues: Map<string, RedactedValue<string>>;
+
+  constructor(payload: SwarmConfigPayload) {
+    this.apiKey = Redacted.make(payload.system.apiKey.value, {
+      type: "system",
+      isSecret: payload.system.apiKey.isSecret,
+    });
+    this.agentId = Redacted.make(payload.system.agentId.value, {
+      type: "system",
+      isSecret: payload.system.agentId.isSecret,
+    });
+    this.mcpBaseUrl = Redacted.make(payload.system.mcpBaseUrl.value, {
+      type: "system",
+      isSecret: payload.system.mcpBaseUrl.isSecret,
+    });
+    this.userValues = new Map(
+      Object.entries(payload.user ?? {}).map(([key, value]) => [
+        key,
+        Redacted.make(value.value, { type: "user", isSecret: value.isSecret }),
+      ]),
+    );
+  }
+
+  get<T = string>(key: string): RedactedValue<T> | undefined {
+    return this.userValues.get(key) as RedactedValue<T> | undefined;
+  }
+}

package/src/scripts-runtime/swarm-sdk.ts

@@ -0,0 +1,197 @@
+import { scrubObject } from "../utils/secret-scrubber";
+import { Redacted } from "./redacted";
+import { isSdkToolAllowed } from "./sdk-allowlist";
+import type { SwarmConfig } from "./swarm-config";
+
+type BridgeRequest = {
+  method: string;
+  path: string;
+  body?: unknown;
+};
+
+function headers(config: SwarmConfig): Record<string, string> {
+  return {
+    Authorization: `Bearer ${Redacted.value(config.apiKey)}`,
+    "X-Agent-ID": Redacted.value(config.agentId),
+    "Content-Type": "application/json",
+  };
+}
+
+function argsRecord(args: unknown): Record<string, unknown> {
+  return args && typeof args === "object" ? (args as Record<string, unknown>) : {};
+}
+
+function appendQuery(path: string, query: Record<string, unknown>): string {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === undefined || value === null) continue;
+    params.set(key, String(value));
+  }
+  const encoded = params.toString();
+  return encoded ? `${path}?${encoded}` : path;
+}
+
+function kvPath(args: Record<string, unknown>, keyRequired = true): string {
+  const key = typeof args.key === "string" ? args.key : undefined;
+  if (keyRequired && !key) throw new Error("kv tool requires string `key`");
+  const namespace = typeof args.namespace === "string" ? args.namespace : undefined;
+  if (namespace) {
+    return key
+      ? `/api/kv/_/${encodeURIComponent(namespace)}/${encodeURIComponent(key)}`
+      : `/api/kv/_/${encodeURIComponent(namespace)}`;
+  }
+  return key ? `/api/kv/${encodeURIComponent(key)}` : "/api/kv";
+}
+
+function bridgeRequestFor(name: string, args: unknown): BridgeRequest {
+  const body = argsRecord(args);
+  switch (name) {
+    case "memory_search":
+      return { method: "POST", path: "/api/memory/search", body };
+    case "memory_get": {
+      const memoryId = typeof body.memoryId === "string" ? body.memoryId : undefined;
+      if (!memoryId) throw new Error("memory_get requires string `memoryId`");
+      return { method: "GET", path: `/api/memory/${encodeURIComponent(memoryId)}` };
+    }
+    case "memory_rate": {
+      const event = {
+        memoryId: body.id,
+        signal: body.useful === false ? -1 : 1,
+        weight: 1,
+        source: "explicit-self",
+        reasoning: body.note ?? "",
+        ...(typeof body.taskId === "string" ? { taskId: body.taskId } : {}),
+        ...(typeof body.referencesSource === "string"
+          ? { referencesSource: body.referencesSource }
+          : {}),
+      };
+      return { method: "POST", path: "/api/memory/rate", body: { events: [event] } };
+    }
+    case "task_list":
+      return { method: "GET", path: appendQuery("/api/tasks", body) };
+    case "task_get": {
+      const taskId = typeof body.taskId === "string" ? body.taskId : undefined;
+      if (!taskId) throw new Error("task_get requires string `taskId`");
+      return { method: "GET", path: `/api/tasks/${encodeURIComponent(taskId)}` };
+    }
+    case "task_storeProgress": {
+      const taskId = typeof body.taskId === "string" ? body.taskId : undefined;
+      if (!taskId) throw new Error("task_storeProgress requires string `taskId`");
+      if (body.status === "completed" || body.status === "failed") {
+        return {
+          method: "POST",
+          path: `/api/tasks/${encodeURIComponent(taskId)}/finish`,
+          body: {
+            status: body.status,
+            output: body.output,
+            failureReason: body.failureReason,
+          },
+        };
+      }
+      return {
+        method: "POST",
+        path: `/api/tasks/${encodeURIComponent(taskId)}/progress`,
+        body: { progress: body.progress ?? "" },
+      };
+    }
+    case "kv_get":
+      return { method: "GET", path: kvPath(body) };
+    case "kv_set":
+      return {
+        method: "PUT",
+        path: kvPath(body),
+        body: {
+          value: body.value,
+          valueType: body.valueType,
+          expiresInSec: body.expiresInSec ?? body.ttlSeconds,
+        },
+      };
+    case "kv_del":
+      return { method: "DELETE", path: kvPath(body) };
+    case "kv_incr":
+      return { method: "POST", path: `${kvPath(body)}/incr`, body: { by: body.by } };
+    case "kv_list":
+      return {
+        method: "GET",
+        path: appendQuery(kvPath(body, false), {
+          prefix: body.prefix,
+          limit: body.limit,
+          offset: body.offset,
+        }),
+      };
+    case "repo_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/repos", { autoClone: body.autoClone, name: body.name }),
+      };
+    case "schedule_list":
+      return {
+        method: "GET",
+        path: appendQuery("/api/schedules", {
+          enabled: body.enabled,
+          name: body.name,
+          scheduleType: body.scheduleType,
+          hideCompleted: body.hideCompleted,
+        }),
+      };
+    case "script_search":
+      return { method: "POST", path: "/api/scripts/search", body };
+    case "script_run":
+      return { method: "POST", path: "/api/scripts/run", body };
+    default:
+      throw new Error(`Tool '${name}' is not exposed through the scripts SDK bridge`);
+  }
+}
+
+async function callBridgeApi(
+  name: string,
+  args: unknown,
+  config: SwarmConfig,
+  options: { throwOnError?: boolean } = {},
+): Promise<unknown> {
+  const baseUrl = Redacted.value(config.mcpBaseUrl).replace(/\/$/, "");
+  const request = bridgeRequestFor(name, args);
+
+  const res = await fetch(`${baseUrl}${request.path}`, {
+    method: request.method,
+    headers: headers(config),
+    body: request.body === undefined ? undefined : JSON.stringify(request.body),
+  });
+  const text = await res.text();
+  const data = text ? JSON.parse(text) : {};
+  if (!res.ok && options.throwOnError) {
+    const message =
+      data && typeof data === "object" && "error" in data
+        ? String((data as { error: unknown }).error)
+        : `api failed with ${res.status}`;
+    throw new Error(`swarm-sdk: ${name} failed with ${res.status}: ${message}`);
+  }
+  return scrubObject({ success: res.ok, status: res.status, data });
+}
+
+async function callTool(name: string, args: unknown, config: SwarmConfig): Promise<unknown> {
+  if (!isSdkToolAllowed(name)) {
+    throw new Error(
+      `Tool '${name}' is not exposed to scripts (lifecycle/cred tool); use the MCP surface directly if you're an agent`,
+    );
+  }
+
+  if (name === "script_search" || name === "script_run") {
+    return callBridgeApi(name, args, config, { throwOnError: true });
+  }
+
+  return callBridgeApi(name, args, config);
+}
+
+export function createSwarmSdk(
+  config: SwarmConfig,
+): Record<string, (args?: unknown) => Promise<unknown>> {
+  const target: Record<string, unknown> = {};
+  return new Proxy(target, {
+    get(target, prop) {
+      if (typeof prop !== "string") return undefined;
+      if (prop in target) return target[prop];
+      return (args?: unknown) => callTool(prop, args, config);
+    },
+  }) as Record<string, (args?: unknown) => Promise<unknown>>;
+}

package/src/scripts-runtime/types/stdlib.d.ts

@@ -0,0 +1,104 @@
+declare module "stdlib" {
+  export interface Redacted<T> {
+    readonly __redactedBrand?: T;
+    toString(): "<redacted>";
+    toJSON(): "<redacted>";
+  }
+  export const Redacted: {
+    value<T>(self: Redacted<T>): T;
+    meta<T>(self: Redacted<T>): { type: "system" | "user"; isSecret: boolean };
+    isSecret<T>(self: Redacted<T>): boolean;
+  };
+  export function fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+  export function fetchJson(input: string | URL | Request, init?: RequestInit): Promise<unknown>;
+  export function grep(pattern: string, files?: string | string[]): Promise<string>;
+  export function glob(pattern: string): Promise<string[]>;
+  export function table(rows: Array<Record<string, unknown>>): string;
+}
+
+declare module "swarm-sdk" {
+  export type JsonValue =
+    | null
+    | boolean
+    | number
+    | string
+    | JsonValue[]
+    | { [key: string]: JsonValue };
+  export type ScriptScope = "agent" | "global";
+  export type ScriptFsMode = "none" | "workspace-rw";
+
+  export interface Redacted<T> {
+    readonly __redactedBrand?: T;
+    toString(): "<redacted>";
+    toJSON(): "<redacted>";
+  }
+
+  export interface RedactedStatic {
+    value<T>(self: Redacted<T>): T;
+    meta<T>(self: Redacted<T>): { type: "system" | "user"; isSecret: boolean };
+    isSecret<T>(self: Redacted<T>): boolean;
+  }
+
+  export interface SwarmConfig {
+    apiKey: Redacted<string>;
+    agentId: Redacted<string>;
+    mcpBaseUrl: Redacted<string>;
+    get<T = string>(key: string): Redacted<T> | undefined;
+  }
+
+  export interface SwarmSdk {
+    memory_search(args: {
+      query: string;
+      scope?: "all" | "agent" | "swarm";
+      limit?: number;
+      source?: string;
+    }): Promise<unknown>;
+    memory_get(args: { memoryId: string }): Promise<unknown>;
+    memory_rate(args: { id: string; useful: boolean; note?: string }): Promise<unknown>;
+    task_list(args?: Record<string, unknown>): Promise<unknown>;
+    task_get(args: { taskId: string }): Promise<unknown>;
+    task_storeProgress(args: Record<string, unknown>): Promise<unknown>;
+    kv_get(args: { key: string; namespace?: string }): Promise<unknown>;
+    kv_set(args: {
+      key: string;
+      value: unknown;
+      namespace?: string;
+      ttlSeconds?: number;
+      valueType?: "string" | "json" | "integer";
+    }): Promise<unknown>;
+    kv_del(args: { key: string; namespace?: string }): Promise<unknown>;
+    kv_incr(args: { key: string; by?: number; namespace?: string }): Promise<unknown>;
+    kv_list(args?: { prefix?: string; namespace?: string; limit?: number }): Promise<unknown>;
+    repo_list(args?: Record<string, unknown>): Promise<unknown>;
+    schedule_list(args?: Record<string, unknown>): Promise<unknown>;
+    script_search(args: { query?: string; scope?: ScriptScope; limit?: number }): Promise<unknown>;
+    script_run(args: {
+      name?: string;
+      source?: string;
+      args?: unknown;
+      intent?: string;
+      scope?: ScriptScope;
+      fsMode?: ScriptFsMode;
+    }): Promise<unknown>;
+  }
+
+  export interface ScriptStdlib {
+    fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+    fetchJson(input: string | URL | Request, init?: RequestInit): Promise<unknown>;
+    grep(pattern: string, files?: string | string[]): Promise<string>;
+    glob(pattern: string): Promise<string[]>;
+    table(rows: Array<Record<string, unknown>>): string;
+    Redacted: RedactedStatic;
+  }
+
+  export interface ScriptLogger extends Console {}
+
+  export interface ScriptContext {
+    swarm: SwarmSdk & { config: SwarmConfig };
+    stdlib: ScriptStdlib;
+    logger: ScriptLogger;
+  }
+
+  // biome-ignore lint/suspicious/noExplicitAny: scripts may narrow their args type at the entrypoint.
+  export type ScriptMain = (args: any, ctx: ScriptContext) => unknown | Promise<unknown>;
+}

package/src/scripts-runtime/types/swarm-sdk.d.ts

@@ -0,0 +1,86 @@
+declare module "swarm-sdk" {
+  export type JsonValue =
+    | null
+    | boolean
+    | number
+    | string
+    | JsonValue[]
+    | { [key: string]: JsonValue };
+  export type ScriptScope = "agent" | "global";
+  export type ScriptFsMode = "none" | "workspace-rw";
+
+  export interface Redacted<T> {
+    readonly __redactedBrand?: T;
+    toString(): "<redacted>";
+    toJSON(): "<redacted>";
+  }
+
+  export interface RedactedStatic {
+    value<T>(self: Redacted<T>): T;
+    meta<T>(self: Redacted<T>): { type: "system" | "user"; isSecret: boolean };
+    isSecret<T>(self: Redacted<T>): boolean;
+  }
+
+  export interface SwarmConfig {
+    apiKey: Redacted<string>;
+    agentId: Redacted<string>;
+    mcpBaseUrl: Redacted<string>;
+    get<T = string>(key: string): Redacted<T> | undefined;
+  }
+
+  export interface SwarmSdk {
+    memory_search(args: {
+      query: string;
+      scope?: "all" | "agent" | "swarm";
+      limit?: number;
+      source?: string;
+    }): Promise<unknown>;
+    memory_get(args: { memoryId: string }): Promise<unknown>;
+    memory_rate(args: { id: string; useful: boolean; note?: string }): Promise<unknown>;
+    task_list(args?: Record<string, unknown>): Promise<unknown>;
+    task_get(args: { taskId: string }): Promise<unknown>;
+    task_storeProgress(args: Record<string, unknown>): Promise<unknown>;
+    kv_get(args: { key: string; namespace?: string }): Promise<unknown>;
+    kv_set(args: {
+      key: string;
+      value: unknown;
+      namespace?: string;
+      ttlSeconds?: number;
+      valueType?: "string" | "json" | "integer";
+    }): Promise<unknown>;
+    kv_del(args: { key: string; namespace?: string }): Promise<unknown>;
+    kv_incr(args: { key: string; by?: number; namespace?: string }): Promise<unknown>;
+    kv_list(args?: { prefix?: string; namespace?: string; limit?: number }): Promise<unknown>;
+    repo_list(args?: Record<string, unknown>): Promise<unknown>;
+    schedule_list(args?: Record<string, unknown>): Promise<unknown>;
+    script_search(args: { query?: string; scope?: ScriptScope; limit?: number }): Promise<unknown>;
+    script_run(args: {
+      name?: string;
+      source?: string;
+      args?: unknown;
+      intent?: string;
+      scope?: ScriptScope;
+      fsMode?: ScriptFsMode;
+    }): Promise<unknown>;
+  }
+
+  export interface ScriptStdlib {
+    fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+    fetchJson(input: string | URL | Request, init?: RequestInit): Promise<unknown>;
+    grep(pattern: string, files?: string | string[]): Promise<string>;
+    glob(pattern: string): Promise<string[]>;
+    table(rows: Array<Record<string, unknown>>): string;
+    Redacted: RedactedStatic;
+  }
+
+  export interface ScriptLogger extends Console {}
+
+  export interface ScriptContext {
+    swarm: SwarmSdk & { config: SwarmConfig };
+    stdlib: ScriptStdlib;
+    logger: ScriptLogger;
+  }
+
+  // biome-ignore lint/suspicious/noExplicitAny: scripts may narrow their args type at the entrypoint.
+  export type ScriptMain = (args: any, ctx: ScriptContext) => unknown | Promise<unknown>;
+}

package/src/server.ts

@@ -68,6 +68,11 @@ import {
   registerRunScheduleNowTool,
   registerUpdateScheduleTool,
 } from "./tools/schedules";
+import { registerScriptDeleteTool } from "./tools/script-delete";
+import { registerScriptQueryTypesTool } from "./tools/script-query-types";
+import { registerScriptRunTool } from "./tools/script-run";
+import { registerScriptSearchTool } from "./tools/script-search";
+import { registerScriptUpsertTool } from "./tools/script-upsert";
 import { registerSendTaskTool } from "./tools/send-task";
 // Skills capability
 import {
@@ -202,6 +207,13 @@ export function createServer() {
   registerDeletePromptTemplateTool(server);
   registerPreviewPromptTemplateTool(server);
 
+  // Reusable script catalog tools - always registered (HTTP MCP only in v1).
+  registerScriptSearchTool(server);
+  registerScriptRunTool(server);
+  registerScriptUpsertTool(server);
+  registerScriptDeleteTool(server);
+  registerScriptQueryTypesTool(server);
+
   // Slack integration tools (always registered, will no-op if Slack not configured)
   registerSlackReplyTool(server);
   registerSlackReadTool(server);