@desplega.ai/agent-swarm 2.4.3 → 2.4.4

package/src/be/users.ts

@@ -22,9 +22,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { scheduleOrgDomainRecompute } from "../telemetry-identity";
 import type { User } from "../types";
-import { unregisterVolatileSecret } from "../utils/secret-scrubber";
+import { registerVolatileSecret, unregisterVolatileSecret } from "../utils/secret-scrubber";
 import { closeSessionTokenConnections } from "../utils/session-token-connections";
 import { getDbClient } from "./db";
+import type { DbExecutor } from "./db-client";
 import { validateRuntimeTokenTtlHours } from "./swarm-config-guard";
 
 // ---------------------------------------------------------------------------
@@ -547,6 +548,12 @@ export async function resolveUserByToken(plaintext: string): Promise<User | null
 
 const SESSION_TOKEN_PREFIX = "aseph_"; // agent-swarm-ephemeral
 
+/**
+ * What an agent-principal session token is bound to: one task (ACP), one
+ * runtime instance (runtime pools), or only its agent (a worker token).
+ */
+export type SessionTokenKind = "task" | "runtime" | "agent";
+
 export class InvalidRuntimeTokenError extends Error {
   constructor() {
     super("Runtime token is no longer valid");
@@ -563,14 +570,21 @@ export async function mintSessionToken(
   agentId: string,
   taskId: string,
   ttlMs: number,
-  parent?: { tokenId: string; runtimeId: string },
+  parent?: { tokenId: string; runtimeId: string | null },
 ): Promise<{ tokenId: string; plaintext: string }> {
   if (parent) {
     return await getDbClient().transaction(async (client) => {
+      // A runtime parent is matched by its runtime; an agent parent has no
+      // binding but its agent, so it is matched by the empty binding columns.
       const row = await client.get<{ expiresAt: string }>(
-        `SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND runtimeId = ?
-         AND revokedAt IS NULL AND expiresAt > ?`,
-        [parent.tokenId, agentId, parent.runtimeId, new Date().toISOString()],
+        parent.runtimeId
+          ? `SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND runtimeId = ?
+             AND revokedAt IS NULL AND expiresAt > ?`
+          : `SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND ${AGENT_TOKEN_BINDING}
+             AND revokedAt IS NULL AND expiresAt > ?`,
+        parent.runtimeId
+          ? [parent.tokenId, agentId, parent.runtimeId, new Date().toISOString()]
+          : [parent.tokenId, agentId, new Date().toISOString()],
       );
       if (!row) throw new InvalidRuntimeTokenError();
       return await insertSessionToken(
@@ -580,6 +594,8 @@ export async function mintSessionToken(
         ttlMs,
         parent.runtimeId,
         row.expiresAt,
+        null,
+        parent.runtimeId ? null : parent.tokenId,
       );
     });
   }
@@ -607,6 +623,7 @@ export async function insertSessionToken(
   parentRuntimeId: string | null = null,
   expiresAtCeiling?: string,
   controllerId: string | null = null,
+  parentTokenId: string | null = null,
 ): Promise<{ tokenId: string; plaintext: string }> {
   const plaintext = `${SESSION_TOKEN_PREFIX}${base62(randomBytes(24))}`;
   const tokenId = randomUUID().replace(/-/g, "");
@@ -619,8 +636,8 @@ export async function insertSessionToken(
 
   await getDbClient().run(
     `INSERT INTO session_tokens
-     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId, parentTokenId)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     [
       tokenId,
       hash,
@@ -632,6 +649,7 @@ export async function insertSessionToken(
       expiresAt,
       now.toISOString(),
       controllerId,
+      parentTokenId,
     ],
   );
 
@@ -648,15 +666,31 @@ export async function revokeSessionToken(tokenId: string): Promise<void> {
     if (row?.runtimeId) {
       await revokeRuntimeTokensForRuntime(row.runtimeId);
     } else {
-      await client.run(
-        "UPDATE session_tokens SET revokedAt = ? WHERE id = ? AND revokedAt IS NULL",
-        [new Date().toISOString(), tokenId],
-      );
-      getDbClient().afterCommit(() => closeSessionTokenConnections([tokenId]));
+      await revokeTokensWithChildren(client, [tokenId]);
     }
   });
 }
 
+/** Revoke tokens and the child task tokens an agent token minted. */
+async function revokeTokensWithChildren(client: DbExecutor, tokenIds: string[]) {
+  if (tokenIds.length === 0) return;
+  const placeholders = tokenIds.map(() => "?").join(", ");
+  const children = await client.query<{ id: string }>(
+    `SELECT id FROM session_tokens WHERE parentTokenId IN (${placeholders})`,
+    tokenIds,
+  );
+  const ids = [...tokenIds, ...children.map((row) => row.id)];
+  await client.run(
+    `UPDATE session_tokens SET revokedAt = ?
+     WHERE id IN (${ids.map(() => "?").join(", ")}) AND revokedAt IS NULL`,
+    [new Date().toISOString(), ...ids],
+  );
+  getDbClient().afterCommit(() => {
+    for (const id of tokenIds) unregisterVolatileSecret(`agent-token:${id}`);
+    closeSessionTokenConnections(ids);
+  });
+}
+
 export async function revokeRuntimeTokensForRuntime(runtimeId: string): Promise<void> {
   await getDbClient().transaction(async (client) => {
     const rows = await client.query<{ id: string }>(
@@ -675,6 +709,126 @@ export async function revokeRuntimeTokensForRuntime(runtimeId: string): Promise<
   });
 }
 
+// ---------------------------------------------------------------------------
+// Agent tokens (long-lived, one agent, no runtime)
+// ---------------------------------------------------------------------------
+
+/** SQL predicate for an agent token: bound to its agent and nothing else. */
+const AGENT_TOKEN_BINDING =
+  "taskId IS NULL AND runtimeId IS NULL AND controllerId IS NULL AND parentRuntimeId IS NULL";
+
+/** Stored expiry of a token that does not expire. `expiresAt` is NOT NULL. */
+export const AGENT_TOKEN_NO_EXPIRY = "9999-12-31T23:59:59.999Z";
+
+/**
+ * Default agent-token lifetime in ms. `null` means the token does not expire
+ * and stays valid until it is rotated or revoked. A fixed lifetime (for
+ * example 90 days) is a one-line change here.
+ */
+export const AGENT_TOKEN_DEFAULT_TTL_MS: number | null = null;
+
+export type AgentTokenCredential = {
+  tokenId: string;
+  plaintext: string;
+  /** null when the token does not expire. */
+  expiresAt: string | null;
+};
+
+export class AgentTokenExistsError extends Error {
+  constructor() {
+    super("Agent already has an active token; rotate or revoke it");
+  }
+}
+
+function storedExpiry(ttlMs: number | null): string {
+  return ttlMs === null ? AGENT_TOKEN_NO_EXPIRY : new Date(Date.now() + ttlMs).toISOString();
+}
+
+function publicExpiry(expiresAt: string): string | null {
+  return expiresAt === AGENT_TOKEN_NO_EXPIRY ? null : expiresAt;
+}
+
+async function activeAgentTokenIds(client: DbExecutor, agentId: string) {
+  const rows = await client.query<{ id: string }>(
+    `SELECT id FROM session_tokens WHERE agentId = ? AND ${AGENT_TOKEN_BINDING}
+     AND revokedAt IS NULL AND expiresAt > ?`,
+    [agentId, new Date().toISOString()],
+  );
+  return rows.map((row) => row.id);
+}
+
+async function insertAgentToken(
+  agentId: string,
+  ttlMs: number | null,
+): Promise<AgentTokenCredential> {
+  const expiresAt = storedExpiry(ttlMs);
+  // Pass the expiry as the ceiling so it is stored exactly; a TTL recomputed
+  // from a later clock read could step past AGENT_TOKEN_NO_EXPIRY into year 10000.
+  const token = await insertSessionToken(
+    agentId,
+    null,
+    null,
+    Number.MAX_SAFE_INTEGER,
+    null,
+    expiresAt,
+  );
+  getDbClient().afterCommit(() =>
+    registerVolatileSecret(token.plaintext, `agent-token:${token.tokenId}`),
+  );
+  return { ...token, expiresAt: publicExpiry(expiresAt) };
+}
+
+/**
+ * Mint the agent-bound worker token for `agentId`. A worker runs on it in
+ * place of the swarm API key. Throws `AgentTokenExistsError` when the agent
+ * already holds an active one, so tokens do not accumulate silently.
+ */
+export async function mintAgentToken(
+  agentId: string,
+  ttlMs: number | null = AGENT_TOKEN_DEFAULT_TTL_MS,
+): Promise<AgentTokenCredential> {
+  return await getDbClient().transaction(async (client) => {
+    if ((await activeAgentTokenIds(client, agentId)).length > 0) {
+      throw new AgentTokenExistsError();
+    }
+    return await insertAgentToken(agentId, ttlMs);
+  });
+}
+
+/**
+ * Replace the agent's active token. The old token keeps working for
+ * `graceMs` so a running worker can pick up the new one, then expires. Its
+ * child task tokens expire with it, so no credential it delegated outlives
+ * it. Returns null when the agent holds no active token.
+ */
+export async function rotateAgentToken(
+  agentId: string,
+  graceMs: number,
+  ttlMs: number | null = AGENT_TOKEN_DEFAULT_TTL_MS,
+): Promise<(AgentTokenCredential & { previousExpiresAt: string }) | null> {
+  return await getDbClient().transaction(async (client) => {
+    const previous = await activeAgentTokenIds(client, agentId);
+    if (previous.length === 0) return null;
+    const previousExpiresAt = new Date(Date.now() + graceMs).toISOString();
+    const placeholders = previous.map(() => "?").join(", ");
+    await client.run(
+      `UPDATE session_tokens SET expiresAt = ?
+       WHERE (id IN (${placeholders}) OR parentTokenId IN (${placeholders})) AND expiresAt > ?`,
+      [previousExpiresAt, ...previous, ...previous, previousExpiresAt],
+    );
+    return { ...(await insertAgentToken(agentId, ttlMs)), previousExpiresAt };
+  });
+}
+
+/** Revoke every active agent token of `agentId` and their child task tokens. */
+export async function revokeAgentTokens(agentId: string): Promise<number> {
+  return await getDbClient().transaction(async (client) => {
+    const ids = await activeAgentTokenIds(client, agentId);
+    await revokeTokensWithChildren(client, ids);
+    return ids.length;
+  });
+}
+
 /**
  * Resolve a plaintext `aseph_` token to its principal. Returns null when the
  * token is unknown, revoked, or past its expiry. On a hit, touches `lastUsedAt`
@@ -685,6 +839,7 @@ export async function resolveBySessionToken(
   options: { touch?: boolean } = {},
 ): Promise<{
   tokenId: string;
+  tokenKind: SessionTokenKind;
   agentId: string;
   taskId: string | null;
   runtimeId: string | null;
@@ -704,6 +859,7 @@ export async function resolveSessionToken(
   | {
       kind: "agent";
       tokenId: string;
+      tokenKind: SessionTokenKind;
       agentId: string;
       taskId: string | null;
       runtimeId: string | null;
@@ -758,6 +914,7 @@ export async function resolveSessionToken(
   return {
     kind: "agent",
     tokenId: row.id,
+    tokenKind: row.taskId !== null ? "task" : row.runtimeId !== null ? "runtime" : "agent",
     agentId: row.agentId,
     taskId: row.taskId,
     runtimeId: row.runtimeId,

package/src/cli.tsx

@@ -360,6 +360,25 @@ const COMMAND_HELP: Record<
       `  ${binName} claude-managed-setup --api-url https://swarm.example.com`,
     ].join("\n"),
   },
+  "worker-token": {
+    usage: `${binName} worker-token <create|rotate|revoke> (--agent-id <id> | --name <name>) [options]`,
+    description:
+      "Manage the agent-bound token a worker runs on in place of the swarm API key. The token acts only as its agent. create and rotate print the new token to stdout once; messages go to stderr. Uses your operator swarm API key.",
+    options: [
+      "  --agent-id <id>    Agent the token is bound to",
+      "  --name <name>      Agent name; create makes the agent when no agent has this name",
+      "  --ttl-days <n>     Token lifetime (create, rotate). Default: no expiry",
+      "  --grace-sec <n>    How long the old token keeps working after rotate (default 300)",
+      "  --api-url <url>    Swarm API URL (default: MCP_BASE_URL or http://localhost:3013)",
+      "  --api-key <key>    Operator swarm API key (default: AGENT_SWARM_API_KEY or API_KEY, falling back to 123123)",
+      "  -h, --help         Show this help",
+    ].join("\n"),
+    examples: [
+      `  ${binName} worker-token create --name worker-1`,
+      `  ${binName} worker-token rotate --agent-id <agent-id> --grace-sec 600`,
+      `  ${binName} worker-token revoke --agent-id <agent-id>`,
+    ].join("\n"),
+  },
   e2b: {
     usage: `${binName} e2b <subcommand> [options]`,
     description:
@@ -445,6 +464,7 @@ function printHelp(command?: string) {
     ["docs", "Open documentation (--open to launch in browser)"],
     ["codex-login", "Authenticate Codex via ChatGPT OAuth"],
     ["claude-managed-setup", "Bootstrap Anthropic Managed Agents (agent + env + skills)"],
+    ["worker-token", "Mint, rotate, or revoke an agent-bound worker token"],
     ["e2b", "Build templates and start E2B API/worker sandboxes"],
     ["version", "Show version number"],
     ["help", "Show this help message"],
@@ -803,6 +823,10 @@ if (args.showHelp || args.command === "help" || args.command === undefined) {
   const { runClaudeManagedSetup } = await import("./commands/claude-managed-setup");
   const setupArgs = process.argv.slice(process.argv.indexOf("claude-managed-setup") + 1);
   await runClaudeManagedSetup(setupArgs);
+} else if (args.command === "worker-token") {
+  const { runWorkerToken } = await import("./commands/worker-token");
+  const tokenArgs = process.argv.slice(process.argv.indexOf("worker-token") + 1);
+  process.exit(await runWorkerToken(tokenArgs));
 } else if (args.command === "e2b") {
   const { runE2BCommand } = await import("./commands/e2b");
   const e2bArgs = process.argv.slice(process.argv.indexOf("e2b") + 1);

package/src/commands/worker-token.ts

@@ -0,0 +1,164 @@
+/**
+ * `agent-swarm worker-token create|rotate|revoke`: manage the agent-bound
+ * token a worker runs on in place of the swarm API key.
+ *
+ * Operator-run. It authenticates with the operator's own swarm API key and
+ * talks to the API over HTTP only. The new token goes to stdout, once, so it
+ * can be captured (`API_KEY=$(agent-swarm worker-token create --name w1)`);
+ * everything else goes to stderr.
+ */
+import { getApiKey } from "../utils/api-key";
+
+type Action = "create" | "rotate" | "revoke";
+
+export type WorkerTokenArgs = {
+  action?: Action;
+  agentId?: string;
+  name?: string;
+  apiUrl?: string;
+  apiKey?: string;
+  ttlDays?: number;
+  graceSec?: number;
+  showHelp: boolean;
+  error?: string;
+};
+
+export const WORKER_TOKEN_USAGE = `Usage:
+  agent-swarm worker-token <create|rotate|revoke> (--agent-id <id> | --name <name>) [options]
+
+Options:
+  --agent-id <id>     Agent the token is bound to
+  --name <name>       Agent name. create makes the agent when no agent has this name
+  --ttl-days <n>      Token lifetime (create, rotate). Default: no expiry
+  --grace-sec <n>     How long the old token keeps working after rotate (default 300)
+  --api-url <url>     Swarm API URL (default: MCP_BASE_URL or http://localhost:3013)
+  --api-key <key>     Operator swarm API key (default: AGENT_SWARM_API_KEY or API_KEY, falling back to 123123)
+  -h, --help          Show this help`;
+
+const ACTIONS = new Set<string>(["create", "rotate", "revoke"]);
+
+export function parseWorkerTokenArgs(args: string[]): WorkerTokenArgs {
+  const parsed: WorkerTokenArgs = { showHelp: false };
+  const number = (flag: string, value: string | undefined, min: number) => {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < min) parsed.error = `${flag} must be an integer >= ${min}`;
+    return n;
+  };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--help" || arg === "-h") parsed.showHelp = true;
+    else if (arg === "--agent-id") parsed.agentId = args[++i];
+    else if (arg === "--name") parsed.name = args[++i];
+    else if (arg === "--api-url") parsed.apiUrl = args[++i];
+    else if (arg === "--api-key") parsed.apiKey = args[++i];
+    else if (arg === "--ttl-days") parsed.ttlDays = number(arg, args[++i], 1);
+    else if (arg === "--grace-sec") parsed.graceSec = number(arg, args[++i], 0);
+    else if (!parsed.action && ACTIONS.has(arg)) parsed.action = arg as Action;
+    else parsed.error = `Unknown argument: ${arg}`;
+  }
+  if (parsed.error || parsed.showHelp) return parsed;
+  if (!parsed.action) parsed.error = "Missing action: create, rotate, or revoke";
+  else if (!parsed.agentId === !parsed.name)
+    parsed.error = "Pass exactly one of --agent-id or --name";
+  return parsed;
+}
+
+type Deps = {
+  env?: Record<string, string | undefined>;
+  fetch?: typeof fetch;
+  stdout?: (line: string) => void;
+  stderr?: (line: string) => void;
+};
+
+async function readError(res: Response): Promise<string> {
+  const text = await res.text().catch(() => "");
+  try {
+    return (JSON.parse(text) as { error?: string }).error ?? text;
+  } catch {
+    return text;
+  }
+}
+
+/** Runs the command. Returns the process exit code. */
+export async function runWorkerToken(args: string[], deps: Deps = {}): Promise<number> {
+  const env = deps.env ?? process.env;
+  const doFetch = deps.fetch ?? fetch;
+  const stdout = deps.stdout ?? ((line: string) => console.log(line));
+  const stderr = deps.stderr ?? ((line: string) => console.error(line));
+  const parsed = parseWorkerTokenArgs(args);
+  if (parsed.showHelp) {
+    stdout(WORKER_TOKEN_USAGE);
+    return 0;
+  }
+  if (parsed.error) {
+    stderr(`${parsed.error}\n\n${WORKER_TOKEN_USAGE}`);
+    return 1;
+  }
+
+  const apiUrl = (parsed.apiUrl ?? env.MCP_BASE_URL ?? "http://localhost:3013").replace(/\/+$/, "");
+  const apiKey = parsed.apiKey ?? (getApiKey(env) || "123123");
+  const headers = { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" };
+
+  let agentId = parsed.agentId;
+  let name: string | undefined;
+  if (!agentId) {
+    const res = await doFetch(`${apiUrl}/api/agents`, { headers });
+    if (!res.ok) {
+      stderr(`Listing agents failed (${res.status}): ${await readError(res)}`);
+      return 1;
+    }
+    const { agents } = (await res.json()) as { agents: { id: string; name: string }[] };
+    const matches = agents.filter((agent) => agent.name === parsed.name);
+    if (matches.length > 1) {
+      stderr(`Several agents are named "${parsed.name}"; pass --agent-id instead`);
+      return 1;
+    }
+    agentId = matches[0]?.id;
+    if (!agentId) {
+      if (parsed.action !== "create") {
+        stderr(`No agent is named "${parsed.name}"`);
+        return 1;
+      }
+      agentId = crypto.randomUUID();
+      name = parsed.name;
+    }
+  }
+
+  const base = `${apiUrl}/api/agents/${encodeURIComponent(agentId)}/token`;
+  const ttlMs = parsed.ttlDays === undefined ? undefined : parsed.ttlDays * 86_400_000;
+  const res =
+    parsed.action === "revoke"
+      ? await doFetch(base, { method: "DELETE", headers })
+      : await doFetch(parsed.action === "rotate" ? `${base}/rotate` : base, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(
+            parsed.action === "rotate" ? { graceSec: parsed.graceSec, ttlMs } : { name, ttlMs },
+          ),
+        });
+  if (!res.ok) {
+    stderr(`worker-token ${parsed.action} failed (${res.status}): ${await readError(res)}`);
+    return 1;
+  }
+
+  if (parsed.action === "revoke") {
+    const { revoked } = (await res.json()) as { revoked: number };
+    stderr(`Revoked ${revoked} worker token(s) of agent ${agentId}.`);
+    return 0;
+  }
+  const token = (await res.json()) as {
+    plaintext: string;
+    expiresAt: string | null;
+    agentCreated?: boolean;
+    previousExpiresAt?: string;
+  };
+  if (token.agentCreated) stderr(`Created agent ${agentId} (${name}).`);
+  stderr(
+    `Worker token for agent ${agentId}, ${token.expiresAt ? `expires ${token.expiresAt}` : "no expiry"}.`,
+  );
+  if (token.previousExpiresAt)
+    stderr(`The previous token stops working at ${token.previousExpiresAt}.`);
+  stderr(`Set it as the worker's API_KEY with AGENT_ID=${agentId}. It is shown only once.`);
+  stdout(token.plaintext);
+  return 0;
+}

package/src/http/apps.ts

@@ -62,14 +62,16 @@ import {
   rollbackApp,
   snapshotApp,
 } from "../apps/version";
-import { getAgentById, getAppVersion, getAppVersions } from "../be/db";
+import { getAgentById, getAppVersion, getAppVersions, getTaskById } from "../be/db";
 import type { RbacPrincipal, RbacResource } from "../rbac";
 import { can } from "../rbac";
 import { AgentTaskStatusSchema } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { scrubObject } from "../utils/secret-scrubber";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
-import { route } from "./route-def";
+import { agentFirstPrincipal } from "./request-principal";
+import { bodyTask, route } from "./route-def";
+import { denyParentAttach } from "./session-access";
 import { BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError } from "./utils";
 
 const MAX_APP_BODY_BYTES = 5 * 1024 * 1024;
@@ -618,17 +620,27 @@ const runActionRoute = route({
   method: "post",
   path: "/api/apps/{id}/actions/{name}",
   pattern: ["api", "apps", null, "actions", null],
+  // A task-kind action may chain under `body.parentTaskId`: a user caller needs
+  // write access to that session, as for POST /api/tasks.
+  session: bodyTask("parentTaskId"),
   summary: "Run a custom app action",
   description: "Runs the saved script, or creates the agent task, named by the app definition.",
   tags: ["Apps"],
   params: z.object({ id: z.string().min(1), name: AppNameSchema }),
-  body: z.object({ input: z.record(z.string(), z.unknown()).optional() }),
+  body: z.object({
+    input: z.record(z.string(), z.unknown()).optional(),
+    /** Chains the new task off an existing one. Task-kind actions only: a script or sync action rejects it (400). */
+    parentTaskId: z.string().min(1).optional(),
+  }),
   responses: {
     200: { description: "Action invoked", schema: runActionResultSchema },
-    400: { description: "Invalid action input or stale script reference" },
+    400: {
+      description:
+        "Invalid action input, stale script reference, or parentTaskId on a non-task action",
+    },
     403: { description: "Permission denied" },
     409: { description: "App definition needs repair" },
-    404: { description: "App or action not found" },
+    404: { description: "App, action, or parent task not found" },
   },
   rbac: { permission: "app.use" },
 });
@@ -1382,10 +1394,36 @@ export async function handleApps(
       return true;
     }
     if (definitionNeedsRepair(res, app)) return true;
+    if (parsed.body.parentTaskId) {
+      // `parentTaskId` only means something to a task-kind action: a script or
+      // sync action rejects it rather than silently dropping it. An unknown
+      // action keeps `runAppAction`'s 404.
+      const actions = app.definition.actions;
+      const action =
+        actions && Object.hasOwn(actions, parsed.params.name)
+          ? actions[parsed.params.name]
+          : undefined;
+      if (action && action.kind !== "task") {
+        jsonError(res, "parentTaskId is only supported for task-kind actions", 400);
+        return true;
+      }
+      if (action) {
+        const parentTask = await getTaskById(parsed.body.parentTaskId);
+        if (!parentTask) {
+          jsonError(res, "parent task not found", 404);
+          return true;
+        }
+        // The same gate as POST /api/tasks: without it an app action would
+        // chain under any task past `task.parent.attach`.
+        const principal = await agentFirstPrincipal(req, myAgentId);
+        if (await denyParentAttach(req, res, myAgentId, parentTask, principal)) return true;
+      }
+    }
     const output = await runAppAction({
       app,
       name: parsed.params.name,
       input: parsed.body.input,
+      parentTaskId: parsed.body.parentTaskId,
       caller,
       actor,
     });

package/src/http/codex-oauth-keep-warm.ts

@@ -12,9 +12,10 @@
  * when a task happens to draw it within `REFRESH_SKEW_MS` of expiry — which
  * for an idle/rarely-drawn slot can be never, letting its refresh token sit
  * unexercised well past OpenAI's ~8-day session-staleness guidance. This
- * sweep calls the SAME `getValidCodexOAuth` with `opts.maxAgeMs` ≈ 7 days so
- * every slot refreshes on a roughly-weekly cadence regardless of task draw
- * frequency — zero logic duplication, all lock/persist/quarantine behavior
+ * sweep calls the SAME `getValidCodexOAuth` with `opts.maxAgeMs` (default 5
+ * days, `CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS`) so every slot refreshes on a
+ * fixed cadence regardless of task draw frequency — zero logic
+ * duplication, all lock/persist/quarantine behavior
  * reused verbatim (see storage.ts doc comment; hand-rolling a refresher here
  * would re-create the 2026-06-19 race).
  *
@@ -25,6 +26,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { getKv } from "../be/db";
+import { CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS } from "../be/swarm-config-guard";
 import { deriveCodexKeySuffix } from "../providers/codex-oauth/auth-json.js";
 import { getValidCodexOAuth, loadAllCodexOAuthSlots } from "../providers/codex-oauth/storage.js";
 import { getApiKey } from "../utils/api-key";
@@ -32,8 +34,25 @@ import { CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey } from "../utils/co
 import { getMcpBaseUrl } from "../utils/constants";
 import { route } from "./route-def";
 
-/** ~weekly refresh cadence, comfortably inside OpenAI's ~8-day staleness window given the 10-day TTL. */
-const KEEP_WARM_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Default refresh age. The old 7-day value lost a slot whose ChatGPT session
+ * OpenAI ended at about 6 days 20 hours, before the first attempt. 5 days
+ * leaves 44 hours of margin, so even a daily trigger refreshes by 6 days.
+ */
+const DEFAULT_KEEP_WARM_MAX_AGE_HOURS = 120;
+
+/**
+ * Read on every sweep, never at module load, so a stored override applies on
+ * config reload without a restart. A non-integer or out-of-range value falls
+ * back to the default; the config API rejects writes outside the same bounds.
+ */
+export function keepWarmMaxAgeMs(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env.CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS?.trim();
+  const { min, max } = CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS;
+  const value = raw && /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+  const hours = value >= min && value <= max ? value : DEFAULT_KEEP_WARM_MAX_AGE_HOURS;
+  return hours * 60 * 60 * 1000;
+}
 
 type SlotOutcome =
   | { slot: number; keySuffix: string; outcome: "warm" | "refreshed" }
@@ -61,7 +80,7 @@ const keepWarmRoute = route({
   pattern: ["api", "oauth", "keep-warm", "codex"],
   summary: "Locked keep-warm refresh sweep across all Codex OAuth pool slots",
   description:
-    "Enumerates codex_oauth_* slots and refreshes any older than ~7 days through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
+    "Enumerates codex_oauth_* slots and refreshes any older than CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS (default 120 hours) through the same locked getValidCodexOAuth path used at task time. Skips slots with a codex-auth-watch bench marker (auth-failure bench or codex-auth-expiry-watch).",
   tags: ["OAuth"],
   responses: {
     200: {
@@ -82,6 +101,7 @@ export async function handleCodexOAuthKeepWarm(
 
   const apiUrl = getMcpBaseUrl();
   const apiKey = getApiKey();
+  const maxAgeMs = keepWarmMaxAgeMs();
   const slots = await loadAllCodexOAuthSlots(apiUrl, apiKey);
   const results: SlotOutcome[] = [];
 
@@ -95,9 +115,7 @@ export async function handleCodexOAuthKeepWarm(
 
     try {
       const beforeAccess = creds.access;
-      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, {
-        maxAgeMs: KEEP_WARM_MAX_AGE_MS,
-      });
+      const refreshed = await getValidCodexOAuth(apiUrl, apiKey, slot, { maxAgeMs });
       if (!refreshed) {
         results.push({ slot, outcome: "no-credentials" });
       } else {

package/src/http/config.ts

@@ -86,7 +86,9 @@ async function requestSecretReadScope(
       }).allow
     )
       return "all";
-    if (!auth.runtimeId || resolvedScope?.agentId !== auth.agentId) return "none";
+    // Runtime and agent tokens stand in for a worker and read their own agent's
+    // scope. Task tokens are ACP harness credentials and read no secrets.
+    if (auth.tokenKind === "task" || resolvedScope?.agentId !== auth.agentId) return "none";
     return "self";
   }
   if (auth?.kind === "guest") return "none";
@@ -107,7 +109,7 @@ async function resolveSecretsRead(
   const auth = getRequestAuth(req);
   return {
     effectiveIncludeSecrets: includeSecrets && scope !== "none",
-    includeRepoSecrets: !(auth?.kind === "agent" && auth.runtimeId && scope !== "all"),
+    includeRepoSecrets: !(auth?.kind === "agent" && auth.tokenKind !== "task" && scope !== "all"),
     secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : "",
   };
 }
@@ -363,7 +365,7 @@ export async function handleConfig(
     const resolvedScope = {
       agentId:
         parsed.query.agentId ||
-        (auth?.kind === "agent" && auth.runtimeId ? auth.agentId : undefined),
+        (auth?.kind === "agent" && auth.tokenKind !== "task" ? auth.agentId : undefined),
       repoId: parsed.query.repoId || undefined,
     };
     const { effectiveIncludeSecrets, includeRepoSecrets, secretsNote } = await resolveSecretsRead(