@desplega.ai/agent-swarm 2.4.2 → 2.4.4

package/dist/{http-r8f85xr9.js → http-4hwxv62p.js}

@@ -177,6 +177,9 @@ import {
   scheduleIntegrationsReload,
   handleCore,
   userCtx,
+  requestPrincipal,
+  agentFirstPrincipal,
+  rejectGuest,
   handleApps,
   cancelApprovalRequest,
   getUserCommsPrefs,
@@ -280,7 +283,7 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-5rk36sjf.js";
+} from "./cli-v3yr2gbg.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -446,6 +449,7 @@ import {
   reservedKeyError,
   MAX_DB_RETENTION_DAYS,
   DB_RETENTION_TUNING_BOUNDS,
+  CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS,
   validateConfigValue,
   validateExportToEnv,
   init_swarm_config_guard,
@@ -716,26 +720,26 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-d3qqdy4c.js";
+} from "./cli-p20r8w42.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-7awf1fp8.js";
-import"./cli-faypxz7q.js";
+} from "./cli-4dg55wsk.js";
+import"./cli-t7cyef5g.js";
 import {
   normalizeModelKey
-} from "./cli-h93c9vb3.js";
+} from "./cli-amyhm3gj.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-saw9a6f6.js";
+} from "./cli-xc27fwzg.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-sv5gb0yb.js";
+} from "./cli-2zqpkvtt.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -747,7 +751,7 @@ import {
   cancelWorkflowRun2,
   TriggerSchemaError,
   startWorkflowExecution2
-} from "./cli-y2x52gs2.js";
+} from "./cli-51y09c6p.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -827,14 +831,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-h38rjv87.js";
+} from "./cli-2y91wnbh.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-s6vr7r2d.js";
+} from "./cli-esxerzg7.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -862,14 +866,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-nn47d7e8.js";
-import"./cli-pkht5hap.js";
+} from "./cli-qkhc5aqy.js";
+import"./cli-1d70crsy.js";
 import {
   createApprovalFollowUpTask,
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-02qm7src.js";
+} from "./cli-q6r7t299.js";
 import"./cli-8nyhf7za.js";
 import {
   _fetchHolder,
@@ -922,15 +926,16 @@ import {
   canReadSession2,
   readableByFor2,
   SESSION_WRITE_DENIED2,
+  denyParentAttach2,
   runtimeInstanceHeader,
   bodyTask,
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-efaqv1c7.js";
+} from "./cli-cynvc9fj.js";
 import {
   isMultiRuntimeEnabled
-} from "./cli-7a91w22y.js";
+} from "./cli-e8xyjvfc.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -958,7 +963,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-n85dqg6d.js";
+} from "./cli-w6nadkh4.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -974,8 +979,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-hyfw2j1e.js";
-import"./cli-hqhzg1qq.js";
+} from "./cli-3cgngyd8.js";
+import"./cli-82d3nkc3.js";
 import {
   import_websocket,
   import_websocket_server
@@ -984,7 +989,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-8zwe9mpk.js";
+} from "./cli-dqb4n629.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1004,11 +1009,11 @@ import {
   memoryRelevance,
   isUnknownModelError,
   writeSkillsToFilesystem
-} from "./cli-ftyypbg5.js";
+} from "./cli-xj0re5tm.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-t30yj95q.js";
+} from "./cli-hj3debgw.js";
 import {
   Anthropic
 } from "./cli-er83cjbn.js";
@@ -1041,9 +1046,13 @@ import {
   mintSessionToken,
   mintRuntimeToken,
   revokeSessionToken,
+  AgentTokenExistsError,
+  mintAgentToken,
+  rotateAgentToken,
+  revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-nmqdc2t3.js";
+} from "./cli-9fhkkpj5.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import {
@@ -1057,7 +1066,7 @@ import {
   clearAuditSink,
   can,
   init_rbac
-} from "./cli-1pa3rz69.js";
+} from "./cli-ba8ne1es.js";
 import {
   isSafeBundlePath,
   init_bundle_path,
@@ -1199,20 +1208,20 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-fpmsqq59.js";
+} from "./cli-nc35pxb7.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-x5mq1fyq.js";
+} from "./cli-74c1wpm0.js";
 import {
   getSlackConfiguration,
   init_config
-} from "./cli-2wag8973.js";
+} from "./cli-qeaq3j6t.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
-} from "./cli-mhywgrrz.js";
+} from "./cli-4sydckyj.js";
 import {
   interpolate,
   init_template,
@@ -1272,7 +1281,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-shvfedvm.js";
+} from "./cli-pccfmtb5.js";
 import {
   realtimeBus,
   init_bus
@@ -1285,12 +1294,12 @@ import {
   getPublicMcpBaseUrl,
   agentFsFileRoute,
   init_constants2
-} from "./cli-w9g4sz81.js";
+} from "./cli-gf2850q7.js";
 import {
   parseEnvFlag,
   isEnvFlagEnabled,
   init_env_flag
-} from "./cli-0hyhdkdk.js";
+} from "./cli-cebvbc9t.js";
 import {
   getApiKey,
   init_api_key
@@ -6511,47 +6520,6 @@ init_db2();
 init_rbac();
 init_types();
 init_request_auth_context();
-
-// src/http/request-principal.ts
-init_db3();
-init_request_auth_context();
-async function requestPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "controller")
-    return { kind: "guest" };
-  if (auth?.kind === "operator")
-    return { kind: "operator" };
-  if (auth?.kind === "user")
-    return { kind: "user", userId: auth.userId };
-  if (auth?.kind === "guest")
-    return { kind: "guest" };
-  if (!myAgentId)
-    return null;
-  const agent = await getAgentById2(myAgentId);
-  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
-}
-async function agentFirstPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "controller")
-    return { kind: "guest" };
-  if (auth?.kind === "user")
-    return { kind: "user", userId: auth.userId };
-  if (auth?.kind === "guest")
-    return { kind: "guest" };
-  const agentId = auth?.kind === "agent" ? auth.agentId : myAgentId;
-  if (!agentId)
-    return { kind: "operator" };
-  const agent = await getAgentById2(agentId);
-  return { kind: "agent", agentId, isLead: agent?.isLead === true };
-}
-function rejectGuest(req, res) {
-  if (getRequestAuth(req)?.kind !== "guest")
-    return false;
-  jsonError(res, "Forbidden", 403);
-  return true;
-}
-
-// src/http/assets.ts
 var AssetKeyAuditIssueSchema = object2({
   severity: _enum2(["fatal", "warning"]),
   code: _enum2([
@@ -8150,7 +8118,7 @@ async function requestSecretReadScope(req, resolvedScope) {
       source: "http"
     }).allow)
       return "all";
-    if (!auth.runtimeId || resolvedScope?.agentId !== auth.agentId)
+    if (auth.tokenKind === "task" || resolvedScope?.agentId !== auth.agentId)
       return "none";
     return "self";
   }
@@ -8168,7 +8136,7 @@ async function resolveSecretsRead(req, includeSecrets, resolvedScope) {
   const auth = getRequestAuth(req);
   return {
     effectiveIncludeSecrets: includeSecrets && scope !== "none",
-    includeRepoSecrets: !(auth?.kind === "agent" && auth.runtimeId && scope !== "all"),
+    includeRepoSecrets: !(auth?.kind === "agent" && auth.tokenKind !== "task" && scope !== "all"),
     secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : ""
   };
 }
@@ -8350,7 +8318,7 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     const key = parsed.query.key;
     const auth = getRequestAuth(req);
     const resolvedScope = {
-      agentId: parsed.query.agentId || (auth?.kind === "agent" && auth.runtimeId ? auth.agentId : undefined),
+      agentId: parsed.query.agentId || (auth?.kind === "agent" && auth.tokenKind !== "task" ? auth.agentId : undefined),
       repoId: parsed.query.repoId || undefined
     };
     const { effectiveIncludeSecrets, includeRepoSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets, resolvedScope);
@@ -8824,10 +8792,18 @@ async function handleCodexOAuthDevice(req, res, pathSegments, queryParams) {
 // src/http/codex-oauth-keep-warm.ts
 init_zod();
 init_db3();
+init_swarm_config_guard();
 init_api_key();
 init_codex_auth_failure();
 init_constants2();
-var KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+var DEFAULT_KEEP_WARM_MAX_AGE_HOURS = 120;
+function keepWarmMaxAgeMs(env = process.env) {
+  const raw = env.CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS?.trim();
+  const { min, max } = CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS;
+  const value = raw && /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+  const hours = value >= min && value <= max ? value : DEFAULT_KEEP_WARM_MAX_AGE_HOURS;
+  return hours * 60 * 60 * 1000;
+}
 var slotOutcomeSchema = discriminatedUnion("outcome", [
   object2({ slot: number2(), keySuffix: string2(), outcome: literal2("warm") }),
   object2({ slot: number2(), keySuffix: string2(), outcome: literal2("refreshed") }),
@@ -8845,7 +8821,7 @@ var keepWarmRoute = route({
   path: "/api/oauth/keep-warm/codex",
   pattern: ["api", "oauth", "keep-warm", "codex"],
   summary: "Locked keep-warm refresh sweep across all Codex OAuth pool slots",
-  description: "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
+  description: "Enumerates codex_oauth_* slots and refreshes any older than CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS (default 120 hours) through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
   tags: ["OAuth"],
   responses: {
     200: {
@@ -8862,6 +8838,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
     return true;
   const apiUrl = getMcpBaseUrl();
   const apiKey = getApiKey();
+  const maxAgeMs = keepWarmMaxAgeMs();
   const slots = await loadAllCodexOAuthSlots(apiUrl, apiKey);
   const results = [];
   for (const { slot, creds } of slots) {
@@ -8872,9 +8849,7 @@ async function handleCodexOAuthKeepWarm(req, res, pathSegments) {
     }
     try {
       const beforeAccess = creds.access;
-      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, {
-        maxAgeMs: KEEP_WARM_MAX_AGE_MS
-      });
+      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, { maxAgeMs });
       if (!refreshed) {
         results.push({ slot, outcome: "no-credentials" });
       } else {
@@ -22736,10 +22711,6 @@ var updateTaskTitleRoute = route({
     ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only"
   }
 });
-async function hasSessionWrite(req, myAgentId, taskId) {
-  const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
-  return hasSessionAccess(access, "write");
-}
 async function canSteerTask(req, myAgentId, task, sessionAccess = "none") {
   const auth = getRequestAuth(req);
   const resource = {
@@ -22919,23 +22890,7 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     }
     const parentTask = parsed.body.parentTaskId ? await getTaskById2(parsed.body.parentTaskId) : null;
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
-    if (parentTask && !can({
-      principal,
-      verb: "task.parent.attach",
-      resource: {
-        kind: "task",
-        taskId: parentTask.id,
-        requestedByUserId: parentTask.requestedByUserId,
-        creatorAgentId: parentTask.creatorAgentId,
-        agentId: parentTask.agentId
-      },
-      source: "http"
-    }).allow) {
-      jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
-      return true;
-    }
-    if (parentTask && !await hasSessionWrite(req, myAgentId, parentTask.id)) {
-      jsonError(res, SESSION_WRITE_DENIED2, 403);
+    if (parentTask && await denyParentAttach2(req, res, myAgentId, parentTask, principal)) {
       return true;
     }
     if (principal.kind === "agent" && parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" }).allow) {
@@ -33147,6 +33102,7 @@ async function handleSessionData(req, res, pathSegments, queryParams, myAgentId)
 // src/http/sessions.ts
 init_zod();
 init_db3();
+init_rbac_roles();
 init_steering();
 init_users();
 init_rbac();
@@ -33203,7 +33159,7 @@ var mintSessionTokenRoute = route({
     none: "user tokens cannot mint: the handler admits only the operator key or the task's own runtime"
   },
   summary: "Mint an ephemeral task or runtime token",
-  description: "Operators can mint task or runtime tokens. Runtime tokens can mint task tokens for their own assigned tasks. Child tokens expire with their parent runtime.",
+  description: "Operators can mint task or runtime tokens. Runtime and agent tokens can mint task tokens for their own assigned tasks. A child token never outlives its parent and is revoked with it.",
   tags: ["Sessions"],
   body: object2({
     agentId: string2().min(1),
@@ -33229,7 +33185,7 @@ var mintSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token minting for its own assigned task, enforced in the handler"
+    ungated: "operator, or a runtime or agent token minting for its own assigned task, enforced in the handler"
   }
 });
 var revokeSessionTokenRoute = route({
@@ -33237,7 +33193,7 @@ var revokeSessionTokenRoute = route({
   path: "/api/sessions/tokens/{tokenId}",
   pattern: ["api", "sessions", "tokens", null],
   summary: "Revoke an ephemeral session token",
-  description: "Operators can revoke any ephemeral token. With runtime pools enabled, runtime tokens can revoke their own child task tokens. Repeated revocation has no effect.",
+  description: "Operators can revoke any ephemeral token. Agent tokens, and runtime tokens when runtime pools are enabled, can revoke their own child task tokens. Repeated revocation has no effect.",
   tags: ["Sessions"],
   params: object2({ tokenId: string2() }),
   responses: {
@@ -33247,9 +33203,188 @@ var revokeSessionTokenRoute = route({
   },
   auth: { apiKey: true },
   rbac: {
-    ungated: "operator or runtime token revoking its own child, enforced in the handler"
+    ungated: "operator, or a runtime or agent token revoking its own child, enforced in the handler"
   }
 });
+var AGENT_TOKEN_ROTATE_GRACE_SEC = 300;
+var AgentTokenSchema = object2({
+  agentId: string2(),
+  tokenId: string2(),
+  plaintext: string2(),
+  expiresAt: string2().nullable().describe("null when the token does not expire")
+});
+var agentTokenTtl = number2().int().positive().optional().describe("Token lifetime in ms. Omit for the default (no expiry).");
+var mintAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_mintWorkerToken",
+  summary: "Mint an agent-bound worker token",
+  description: "Returns the token once. A worker runs on it in place of the swarm API key and acts only as this agent. Creates the agent when it does not exist and `name` is given. Fails with 409 when the agent already holds an active token.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  body: object2({ name: string2().min(1).optional(), ttlMs: agentTokenTtl }).strict().optional(),
+  responses: {
+    200: {
+      description: "Minted worker token",
+      schema: AgentTokenSchema.extend({ agentCreated: boolean() })
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent not found and no name given" },
+    409: { description: "Agent already holds an active token" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var rotateAgentTokenRoute = route({
+  method: "post",
+  path: "/api/agents/{id}/token/rotate",
+  pattern: ["api", "agents", null, "token", "rotate"],
+  operationId: "agents_rotateWorkerToken",
+  summary: "Rotate an agent-bound worker token",
+  description: "Returns a new token once. The previous token keeps working for `graceSec` (default 300), then expires. Use revoke for a token that must stop now.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  body: object2({ graceSec: number2().int().min(0).max(86400).optional(), ttlMs: agentTokenTtl }).strict().optional(),
+  responses: {
+    200: {
+      description: "New worker token",
+      schema: AgentTokenSchema.extend({ previousExpiresAt: string2() })
+    },
+    403: { description: "Operator or user credentials required" },
+    404: { description: "Agent holds no active token" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var revokeAgentTokenRoute = route({
+  method: "delete",
+  path: "/api/agents/{id}/token",
+  pattern: ["api", "agents", null, "token"],
+  operationId: "agents_revokeWorkerToken",
+  summary: "Revoke an agent-bound worker token",
+  description: "Revokes every active worker token of the agent and the task tokens they minted. Open realtime connections on them close.",
+  tags: ["Sessions"],
+  params: object2({ id: string2().min(1) }),
+  responses: {
+    200: {
+      description: "Number of worker tokens revoked (0 when none was active)",
+      schema: object2({ revoked: number2().int() })
+    },
+    403: { description: "Operator or user credentials required" }
+  },
+  rbac: { permission: "agent.token.manage" }
+});
+var AGENT_TOKEN_ROUTES = [mintAgentTokenRoute, rotateAgentTokenRoute, revokeAgentTokenRoute];
+async function ensureAgentTokenManager(req, res, agentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "operator" && auth?.kind !== "user") {
+    jsonError(res, "Worker tokens require operator or user credentials", 403);
+    return false;
+  }
+  const header = req.headers["x-agent-id"];
+  const decision = can({
+    principal: await agentFirstPrincipal(req, Array.isArray(header) ? header[0] : header),
+    verb: "agent.token.manage",
+    resource: { kind: "agent", agentId },
+    source: "http"
+  });
+  if (!decision.allow) {
+    jsonError(res, decision.reason, 403);
+    return false;
+  }
+  if (auth.kind === "user" && isRbacEnabled()) {
+    const grant = await getUserGrant2(auth.userId);
+    if (!grant.grantsAll) {
+      const target = await getAgentById2(agentId);
+      const targetActsOnAny = can({
+        principal: { kind: "agent", agentId, isLead: target?.isLead ?? false },
+        verb: "agent.act.any",
+        resource: { kind: "agent", agentId },
+        source: "http"
+      }).allow;
+      if (targetActsOnAny) {
+        jsonError(res, "A lead agent's worker token requires a grant-all role", 403);
+        return false;
+      }
+      const missing = ["agent.act.any", "config.read.secrets"].filter((verb) => !grant.verbs.has(verb));
+      if (missing.length > 0) {
+        jsonError(res, `Worker tokens also require: ${missing.join(", ")}`, 403);
+        return false;
+      }
+    }
+  }
+  return true;
+}
+async function handleAgentTokens(req, res, pathSegments, queryParams) {
+  const matched = AGENT_TOKEN_ROUTES.find((def) => def.match(req.method, pathSegments));
+  if (!matched)
+    return false;
+  if (!await ensureAgentTokenManager(req, res, pathSegments[2]))
+    return true;
+  res.setHeader("Cache-Control", "no-store");
+  if (matched === mintAgentTokenRoute) {
+    const parsed = await mintAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const agentId = parsed.params.id;
+    const result = await getDbClient2().transaction(async () => {
+      let agentCreated = false;
+      if (!await getAgentById2(agentId)) {
+        if (!parsed.body?.name)
+          return { status: 404 };
+        await createAgent2({
+          id: agentId,
+          name: parsed.body.name,
+          isLead: false,
+          status: "offline",
+          capabilities: [],
+          maxTasks: 1
+        });
+        agentCreated = true;
+      }
+      return {
+        status: 200,
+        agentCreated,
+        token: await mintAgentToken(agentId, parsed.body?.ttlMs)
+      };
+    }).catch((error) => {
+      if (error instanceof AgentTokenExistsError)
+        return { status: 409 };
+      throw error;
+    });
+    if (result.status === 404) {
+      jsonError(res, "Agent not found; pass name to create it", 404);
+      return true;
+    }
+    if (result.status === 409) {
+      jsonError(res, "Agent already holds an active worker token; rotate or revoke it", 409);
+      return true;
+    }
+    mintAgentTokenRoute.respond(res, 200, {
+      agentId,
+      ...result.token,
+      agentCreated: result.agentCreated
+    });
+    return true;
+  }
+  if (matched === rotateAgentTokenRoute) {
+    const parsed = await rotateAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const graceSec = parsed.body?.graceSec ?? AGENT_TOKEN_ROTATE_GRACE_SEC;
+    const token = await rotateAgentToken(parsed.params.id, graceSec * 1000, parsed.body?.ttlMs);
+    if (!token) {
+      jsonError(res, "Agent holds no active worker token", 404);
+      return true;
+    }
+    rotateAgentTokenRoute.respond(res, 200, { agentId: parsed.params.id, ...token });
+    return true;
+  }
+  const parsed = await revokeAgentTokenRoute.parse(req, res, pathSegments, queryParams);
+  if (!parsed)
+    return true;
+  revokeAgentTokenRoute.respond(res, 200, { revoked: await revokeAgentTokens(parsed.params.id) });
+  return true;
+}
 var listSessions = route({
   method: "get",
   path: "/api/sessions",
@@ -33347,9 +33482,11 @@ async function accessForRoot(actor, root) {
   return actor.kind === "bypass" ? "owner" : sessionAccessForRoot(actor.userId, root);
 }
 async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
+  if (await handleAgentTokens(req, res, pathSegments, queryParams))
+    return true;
   if (mintSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
-    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.runtimeId)) {
+    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && auth.tokenKind !== "task")) {
       jsonError(res, "Unauthorized", 401);
       return true;
     }
@@ -33394,7 +33531,7 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
   }
   if (revokeSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
-    if (auth?.kind !== "operator" && !(isRuntimePoolsEnabled() && auth?.kind === "agent" && auth.runtimeId)) {
+    if (auth?.kind !== "operator" && !(auth?.kind === "agent" && (auth.tokenKind === "agent" || auth.tokenKind === "runtime" && isRuntimePoolsEnabled()))) {
       jsonError(res, "Unauthorized", 401);
       return true;
     }
@@ -33403,7 +33540,8 @@ async function handleSessions(req, res, pathSegments, queryParams, myAgentId) {
       return true;
     const revoked = await getDbClient2().transaction(async (client) => {
       if (auth.kind === "agent") {
-        const child = await client.get("SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND parentRuntimeId = ? AND taskId IS NOT NULL", [parsed.params.tokenId, auth.agentId, auth.runtimeId]);
+        const child = await client.get(`SELECT id FROM session_tokens WHERE id = ? AND agentId = ? AND taskId IS NOT NULL
+           AND ${auth.runtimeId ? "parentRuntimeId" : "parentTokenId"} = ?`, [parsed.params.tokenId, auth.agentId, auth.runtimeId ?? auth.tokenId]);
         if (!child)
           return false;
       }
@@ -39126,7 +39264,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-5fym8sw1.js");
+var { attachControllerTransport } = await import("./controllers-connect-mwzx1fh6.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -39155,7 +39293,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-aex0eba9.js");
+    const { stopScheduler } = await import("./index-hg0x2cdv.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -39167,7 +39305,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-64c0f34c.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-hrh7xnr9.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -39247,21 +39385,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-g5hfc1x8.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-9ks8hce7.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-1nek2w7b.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-j38dehfs.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-g5hfc1x8.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-9ks8hce7.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-g5hfc1x8.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-9ks8hce7.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -39269,7 +39407,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-y7rbcrc1.js");
+  const { runAllSeeders } = await import("./index-97q4xn03.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -39331,39 +39469,39 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-aex0eba9.js");
-    const { getExecutorRegistry } = await import("./index-vzvfqzfj.js");
+    const { startScheduler } = await import("./index-hg0x2cdv.js");
+    const { getExecutorRegistry } = await import("./index-gdh8jrdm.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-5jecgp3n.js");
+    const { startHeartbeat } = await import("./index-thm0y6a8.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-64c0f34c.js");
+    const { startOAuthKeepalive } = await import("./keepalive-hrh7xnr9.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-36hs2v4h.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-zm0yj4sj.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-6yn53ms9.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-srp6v6af.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-7fcka4z5.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-xns7h5h9.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-pm1580ax.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-3qqrh2mz.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {