@desplega.ai/agent-swarm 2.5.1 → 2.5.3

package/src/http/approval-requests.ts

@@ -1,5 +1,20 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
+import {
+  applyConfigAnswer,
+  type ConfigAnswer,
+  ConfigQuestionSettingsSchema,
+  type ConfigResult,
+  type ConfigState,
+  ConfigStateSchema,
+  isConfigQuestion,
+  keptConfigResult,
+  normalizeApprovalQuestions,
+  parseConfigAnswer,
+  readConfigState,
+  type StoredConfigQuestion,
+  skippedConfigResult,
+} from "../be/approval-config-question";
 import { resolveTaskAuditUserId } from "../be/audit-user";
 import {
   type ApprovalRequest,
@@ -16,13 +31,19 @@ import {
   recordApprovalVotes,
   resolveApprovalRequest,
 } from "../be/db";
+import { getUserGrant } from "../be/rbac-roles";
 import { findUserById } from "../be/users";
-import { can, type RbacPrincipal } from "../rbac";
+import { can, isRbacEnabled, type RbacPrincipal } from "../rbac";
 import type { User } from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
+import { scrubSecrets } from "../utils/secret-scrubber";
 import { cancelApprovalRequest } from "../workflows/approval-cancel";
-import { createApprovalFollowUpTask } from "../workflows/approval-notifications";
+import {
+  createApprovalFollowUpTask,
+  dispatchApprovalNotifications,
+} from "../workflows/approval-notifications";
 import { workflowEventBus } from "../workflows/event-bus";
+import { ensureConfigAdmin, runConfigWriteSideEffects } from "./config";
 import { bodyTask, route } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -30,7 +51,7 @@ import { jsonError } from "./utils";
 
 const QuestionSchema = z.object({
   id: z.string(),
-  type: z.enum(["approval", "text", "single-select", "multi-select", "boolean"]),
+  type: z.enum(["approval", "text", "single-select", "multi-select", "boolean", "config"]),
   label: z.string(),
   required: z.boolean().optional(),
   description: z.string().optional(),
@@ -48,8 +69,14 @@ const QuestionSchema = z.object({
   minSelections: z.number().int().min(0).optional(),
   maxSelections: z.number().int().min(1).optional(),
   defaultValue: z.boolean().optional(),
+  config: ConfigQuestionSettingsSchema.optional().describe(
+    "Config question settings. Answers are written to swarm_config and replaced by a result that never holds a secret value.",
+  ),
 });
 
+/** Create input: `label` may be omitted on a config question (it defaults to the key). */
+const QuestionInputSchema = QuestionSchema.extend({ label: z.string().optional() });
+
 export type ApprovalQuestion = z.infer<typeof QuestionSchema>;
 
 // ─── Response Schemas ────────────────────────────────────────────────────────
@@ -129,6 +156,12 @@ const ApprovalRequestSchema = z.object({
   createdBy: z.string().optional(),
   createdAt: z.string(),
   updatedAt: z.string(),
+  configState: z
+    .record(z.string(), ConfigStateSchema)
+    .optional()
+    .describe(
+      "Live state of each config question's key, by question id. Read at request time and never stored. `value` appears only for non-secret keys.",
+    ),
 });
 
 /** Slim list row (`?fields=slim`) — see `ApprovalRequestSummary`. */
@@ -139,6 +172,7 @@ const ApprovalRequestSummarySchema = ApprovalRequestSchema.omit({
   approvals: true,
   resolutionReason: true,
   notificationChannels: true,
+  configState: true,
 }).extend({ questionCount: z.number().int() });
 
 /**
@@ -148,11 +182,16 @@ const ApprovalRequestSummarySchema = ApprovalRequestSchema.omit({
  */
 async function toApprovalRequestResponse(
   request: ApprovalRequest,
+  options: { withConfigState?: boolean } = {},
 ): Promise<z.infer<typeof ApprovalRequestSchema>> {
   const approvers = request.approvers as ApproversShape;
   const approvals = request.approvals ?? null;
+  const configState = options.withConfigState
+    ? await readConfigStates(request.questions as ApprovalQuestion[])
+    : undefined;
   return {
     ...request,
+    ...(configState ? { configState } : {}),
     questions: request.questions as ApprovalQuestion[],
     approvers,
     responses: request.responses as Record<string, unknown> | null,
@@ -184,6 +223,28 @@ async function withApprovalProgress(
   );
 }
 
+/** Live state per config question id, or undefined when there are none. */
+async function readConfigStates(
+  questions: ApprovalQuestion[],
+): Promise<Record<string, ConfigState> | undefined> {
+  const configQuestions = questions.filter(isConfigQuestion);
+  if (configQuestions.length === 0) return undefined;
+  const entries = await Promise.all(
+    configQuestions.map(async (q) => [q.id, await readConfigState(q.config)] as const),
+  );
+  return Object.fromEntries(entries);
+}
+
+/** Thrown inside the respond transaction to roll back config writes. */
+class ConfigRespondAbort extends Error {
+  constructor(
+    readonly kind: "unavailable" | "conflict",
+    message: string = kind,
+  ) {
+    super(message);
+  }
+}
+
 export async function getWorkflowApprovalUnavailableReason(
   request: ApprovalRequest,
 ): Promise<string | null> {
@@ -237,6 +298,15 @@ function hasRequiredResponse(question: ApprovalQuestion, response: unknown): boo
     }
     case "boolean":
       return typeof response === "boolean";
+    case "config": {
+      // Shape only. The respond handler checks `keep` against the live row.
+      if (typeof response !== "object" || response === null) return false;
+      const answer = response as { action?: unknown; value?: unknown };
+      if (answer.action === "keep") return true;
+      return (
+        answer.action === "set" && typeof answer.value === "string" && answer.value.trim() !== ""
+      );
+    }
   }
 }
 
@@ -260,7 +330,12 @@ const createRoute = route({
   tags: ["ApprovalRequests"],
   body: z.object({
     title: z.string().min(1),
-    questions: z.array(QuestionSchema).min(1),
+    questions: z
+      .array(QuestionInputSchema)
+      .min(1)
+      .describe(
+        'A request with a `config` question needs `approvers.policy: "any"`. The answer is written to swarm_config; the request stores only `{ key, scope, scopeId, isSecret, status, updatedAt }` (plus `value` for non-secret keys).',
+      ),
     approvers: z.object({
       users: z.array(z.string()).optional(),
       roles: z.array(z.string()).optional(),
@@ -288,7 +363,10 @@ const createRoute = route({
           target: z.string(),
         }),
       )
-      .optional(),
+      .optional()
+      .describe(
+        "Where to announce the request. A Slack target (channel or user ID) gets a card with the title, the questions and a link to the dashboard page that answers it. Slack targets need a lead agent caller (403 otherwise). Email is not supported yet and is skipped.",
+      ),
   }),
   responses: {
     201: {
@@ -296,6 +374,7 @@ const createRoute = route({
       schema: z.object({ approvalRequest: ApprovalRequestSchema }),
     },
     400: { description: "Validation error" },
+    403: { description: "Slack notifications require a lead agent" },
   },
   auth: { apiKey: true },
 });
@@ -315,6 +394,8 @@ const getByIdRoute = route({
     404: { description: "Not found" },
   },
   auth: { apiKey: true },
+  description:
+    "Includes `configState` when the request has `config` questions: the live state of each target key, read now.",
 });
 
 const respondRoute = route({
@@ -323,7 +404,7 @@ const respondRoute = route({
   pattern: ["api", "approval-requests", null, "respond"],
   summary: "Submit a response to an approval request",
   description:
-    "Only a person may answer: a user token, a page session signed for a user, or the shared key with no agent identity (recorded as `operator`). The responder is taken from the credential. When the request lists `approvers.users` or `approvers.roles`, a user must match one of them. A rejection resolves the request at once; approvals resolve it when the `any`, `all` or `{ min: N }` policy is met, and until then it stays pending with the answer recorded in `approvals`.",
+    'Only a person may answer: a user token, a page session signed for a user, or the shared key with no agent identity (recorded as `operator`). The responder is taken from the credential. When the request lists `approvers.users` or `approvers.roles`, a user must match one of them. A rejection resolves the request at once; approvals resolve it when the `any`, `all` or `{ min: N }` policy is met, and until then it stays pending with the answer recorded in `approvals`. A `config` question takes `{ action: "set", value }`, `{ action: "keep" }` (key must exist) or `{ action: "skip" }` (optional questions only); `set` also needs the config write permission. The value is written only when the request is approved, and the stored answer is the result, never a secret value.',
   tags: ["ApprovalRequests"],
   params: z.object({ id: z.string().uuid() }),
   body: z.object({
@@ -479,11 +560,47 @@ export async function handleApprovalRequests(
       return true;
     }
 
+    // Config answers (D6) are checked here and replaced by their results (D7)
+    // before the vote exists, so no plaintext reaches any stored or sent copy.
+    const configQuestions = questions.filter(isConfigQuestion);
+    const configAnswers = new Map<
+      string,
+      { question: StoredConfigQuestion; answer: ConfigAnswer }
+    >();
+    for (const question of configQuestions) {
+      const state = await readConfigState(question.config);
+      const answer = parseConfigAnswer(question, parsed.body.responses[question.id], state);
+      if (!answer.ok) {
+        jsonError(res, answer.error, 400);
+        return true;
+      }
+      configAnswers.set(question.id, { question, answer: answer.answer });
+    }
+    if (configAnswers.size > 0 && approvers.policy !== "any") {
+      jsonError(res, 'Config questions need approvers.policy "any"', 409);
+      return true;
+    }
+    if ([...configAnswers.values()].some(({ answer }) => answer.action === "set")) {
+      if (!(await ensureConfigAdmin(req, res, "config.write.any"))) return true;
+      // Admission only checked `approval.respond`; `ensureConfigAdmin` passes
+      // every user, so check the config write grant here as PUT /api/config would.
+      const auth = getRequestAuth(req);
+      if (auth?.kind === "user" && isRbacEnabled()) {
+        const grant = await getUserGrant(auth.userId);
+        if (!grant.grantsAll && !grant.verbs.has("config.write.any")) {
+          jsonError(res, "Forbidden: setting a config value needs 'config.write.any'", 403);
+          return true;
+        }
+      }
+    }
+    const safeResponses: Record<string, unknown> = { ...parsed.body.responses };
+    for (const id of configAnswers.keys()) delete safeResponses[id];
+
     // Determine status from responses: if any approval question has approved: false → rejected
     let status: "approved" | "rejected" = "approved";
     for (const q of questions) {
       if (q.type === "approval") {
-        const answer = parsed.body.responses[q.id] as { approved?: boolean } | undefined;
+        const answer = safeResponses[q.id] as { approved?: boolean } | undefined;
         if (answer && answer.approved === false) {
           status = "rejected";
           break;
@@ -492,38 +609,89 @@ export async function handleApprovalRequests(
     }
 
     const responderId = responderKey(responder.responder);
-    const vote: ApprovalVote = {
-      responder: responderId,
-      approved: status === "approved",
-      responses: parsed.body.responses,
-      ...(parsed.body.respondedBy ? { claimedRespondedBy: parsed.body.respondedBy } : {}),
-      respondedAt: new Date().toISOString(),
-    };
+    const respondedAt = new Date().toISOString();
+    const configWrites: { result: ConfigResult; value: string }[] = [];
     // One write transaction (BEGIN IMMEDIATE) so concurrent answers to an
     // `all` / `{ min: N }` request append in turn and never drop each other.
-    const outcome = await getDbClient().transaction(async () => {
-      const current = await getApprovalRequestById(parsed.params.id);
-      if (!current || current.status !== "pending") return { kind: "unavailable" as const };
-      const prior = current.approvals ?? [];
-      if (prior.some((v) => v.responder === responderId)) return { kind: "duplicate" as const };
-      const votes = [...prior, vote];
-      if (status === "rejected" || (await approvalQuorumMet(approvers, votes))) {
-        const resolved = await resolveApprovalRequest(
-          parsed.params.id,
-          { status, responses: parsed.body.responses, approvals: votes, resolvedBy: responderId },
-          { requireActionableWorkflow: true },
-        );
-        return resolved
-          ? { kind: "resolved" as const, request: resolved }
+    // Config writes share it, so a lost race writes nothing.
+    const outcome = await getDbClient()
+      .transaction(async () => {
+        const current = await getApprovalRequestById(parsed.params.id);
+        if (!current || current.status !== "pending") return { kind: "unavailable" as const };
+        const prior = current.approvals ?? [];
+        if (prior.some((v) => v.responder === responderId)) return { kind: "duplicate" as const };
+
+        // Config values are written only when the request resolves approved (D8).
+        const responses = { ...safeResponses };
+        for (const [id, { question, answer }] of configAnswers) {
+          if (status === "rejected" || answer.action === "skip") {
+            responses[id] = skippedConfigResult(question);
+          } else if (answer.action === "keep") {
+            const kept = await keptConfigResult(question);
+            if (!kept) {
+              throw new ConfigRespondAbort(
+                "conflict",
+                `config question "${id}": the key was removed before the answer was saved`,
+              );
+            }
+            responses[id] = kept;
+          } else {
+            const written = await applyConfigAnswer(question, answer.value);
+            configWrites.push({ result: written, value: answer.value });
+            responses[id] = written;
+          }
+        }
+
+        const vote: ApprovalVote = {
+          responder: responderId,
+          approved: status === "approved",
+          responses,
+          ...(parsed.body.respondedBy ? { claimedRespondedBy: parsed.body.respondedBy } : {}),
+          respondedAt,
+        };
+        const votes = [...prior, vote];
+        if (status === "rejected" || (await approvalQuorumMet(approvers, votes))) {
+          const resolved = await resolveApprovalRequest(
+            parsed.params.id,
+            { status, responses, approvals: votes, resolvedBy: responderId },
+            { requireActionableWorkflow: true },
+          );
+          if (!resolved && configWrites.length > 0) throw new ConfigRespondAbort("unavailable");
+          return resolved
+            ? { kind: "resolved" as const, request: resolved }
+            : { kind: "unavailable" as const };
+        }
+        const recorded = (await recordApprovalVotes(parsed.params.id, votes))
+          ? await getApprovalRequestById(parsed.params.id)
+          : null;
+        return recorded
+          ? { kind: "recorded" as const, request: recorded }
           : { kind: "unavailable" as const };
+      })
+      .catch((error: unknown) => {
+        if (!(error instanceof ConfigRespondAbort)) throw error;
+        // Rolled back: nothing was written.
+        configWrites.length = 0;
+        return error.kind === "conflict"
+          ? { kind: "conflict" as const, message: error.message }
+          : { kind: "unavailable" as const };
+      });
+
+    if (outcome.kind === "conflict") {
+      jsonError(res, outcome.message, 409);
+      return true;
+    }
+    // The transaction has committed: run what PUT /api/config runs after a write.
+    for (const { result, value } of configWrites) {
+      try {
+        await runConfigWriteSideEffects(result.scope, result.key, value);
+      } catch (err) {
+        console.error(
+          "[approval-requests] Config side effects failed:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        );
       }
-      const recorded = (await recordApprovalVotes(parsed.params.id, votes))
-        ? await getApprovalRequestById(parsed.params.id)
-        : null;
-      return recorded
-        ? { kind: "recorded" as const, request: recorded }
-        : { kind: "unavailable" as const };
-    });
+    }
 
     if (outcome.kind === "duplicate") {
       jsonError(res, "You already answered this approval request", 409);
@@ -568,7 +736,7 @@ export async function handleApprovalRequests(
     await createApprovalFollowUpTask(updated, "hitl.follow_up");
 
     respondRoute.respond(res, 200, {
-      approvalRequest: await toApprovalRequestResponse(updated),
+      approvalRequest: await toApprovalRequestResponse(updated, { withConfigState: true }),
     });
     return true;
   }
@@ -578,7 +746,7 @@ export async function handleApprovalRequests(
     const parsed = await cancelRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
 
-    const { principal, resolvedBy } = await approvalCancelPrincipal(req);
+    const { principal, resolvedBy } = await approvalCallerPrincipal(req);
     const result = await cancelApprovalRequest({
       id: parsed.params.id,
       reason: parsed.body.reason,
@@ -609,7 +777,7 @@ export async function handleApprovalRequests(
     }
 
     getByIdRoute.respond(res, 200, {
-      approvalRequest: await toApprovalRequestResponse(request),
+      approvalRequest: await toApprovalRequestResponse(request, { withConfigState: true }),
     });
     return true;
   }
@@ -619,6 +787,26 @@ export async function handleApprovalRequests(
     const parsed = await createRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
 
+    // Posting to Slack is lead-only everywhere else (slack-post); a caller that
+    // may not post must not reach an arbitrary channel through this route.
+    if (parsed.body.notifications?.some((notification) => notification.channel === "slack")) {
+      const { principal } = await approvalCallerPrincipal(req);
+      const decision = can({ principal, verb: "integration.slack.post", source: "http" });
+      if (!decision.allow) {
+        jsonError(res, SLACK_NOTIFICATION_REFUSED, 403);
+        return true;
+      }
+    }
+
+    const normalized = await normalizeApprovalQuestions(parsed.body.questions, {
+      approvers: parsed.body.approvers,
+    });
+    if (!normalized.ok) {
+      jsonError(res, normalized.error, 400);
+      return true;
+    }
+    const questions = normalized.questions;
+
     const id = crypto.randomUUID();
     // Prefer a trusted authenticated user (never client-controlled); else fall
     // back to the ownership-validated sourceTaskId the request body carries.
@@ -632,7 +820,7 @@ export async function handleApprovalRequests(
     const request = await createApprovalRequest({
       id,
       title: parsed.body.title,
-      questions: parsed.body.questions,
+      questions,
       approvers: parsed.body.approvers,
       workflowRunId: parsed.body.workflowRunId,
       workflowRunStepId: parsed.body.workflowRunStepId,
@@ -642,6 +830,24 @@ export async function handleApprovalRequests(
       createdBy,
     });
 
+    // Fire-and-forget: Slack must not delay or fail the 201. Workflow HITL
+    // requests are created by the executor directly, so they never post here.
+    const notifications = parsed.body.notifications;
+    if (notifications?.length && request.status === "pending") {
+      dispatchApprovalNotifications({
+        requestId: request.id,
+        title: request.title,
+        questions,
+        timeoutSeconds: parsed.body.timeoutSeconds,
+        notifications,
+      }).catch((err) => {
+        console.error(
+          "[approval-requests] Unexpected error dispatching notifications:",
+          scrubSecrets(err instanceof Error ? err.message : String(err)),
+        );
+      });
+    }
+
     createRoute.respond(res, 201, {
       approvalRequest: await toApprovalRequestResponse(request),
     });
@@ -668,7 +874,9 @@ export async function handleApprovalRequests(
 
     const requests = await listApprovalRequests(filters);
     listRoute.respond(res, 200, {
-      approvalRequests: await Promise.all(requests.map(toApprovalRequestResponse)),
+      approvalRequests: await Promise.all(
+        requests.map((request) => toApprovalRequestResponse(request)),
+      ),
     });
     return true;
   }
@@ -676,11 +884,14 @@ export async function handleApprovalRequests(
   return false;
 }
 
+const SLACK_NOTIFICATION_REFUSED =
+  "Slack notifications require lead privileges (integration.slack.post). Create the request without them, or ask the lead to post the link.";
+
 /**
- * The caller of the cancel route. The shared API key with an `X-Agent-ID`
- * header identifies that agent, as on the create route.
+ * The caller of the create and cancel routes. The shared API key with an
+ * `X-Agent-ID` header identifies that agent.
  */
-async function approvalCancelPrincipal(
+async function approvalCallerPrincipal(
   req: IncomingMessage,
 ): Promise<{ principal: RbacPrincipal; resolvedBy: string | null }> {
   const auth = getRequestAuth(req);

package/src/http/config.ts

@@ -21,10 +21,7 @@ import {
   internalConfigKeyError,
   isApiOnlyConfigKey,
   isInternalConfigKey,
-  isReservedConfigKey,
-  reservedKeyError,
-  validateConfigValue,
-  validateExportToEnv,
+  validateConfigEntry,
 } from "../be/swarm-config-guard";
 import { can, isRbacEnabled, type PermissionVerb } from "../rbac";
 import { SwarmConfigSchema } from "../types";
@@ -145,6 +142,25 @@ export async function ensureConfigAdmin(
   );
 }
 
+/**
+ * What a committed config write triggers beyond the row itself. Shared by
+ * `PUT /api/config` and HITL `config` answers.
+ */
+export async function runConfigWriteSideEffects(
+  scope: "global" | "agent" | "repo",
+  key: string,
+  value: string,
+): Promise<void> {
+  if (scope !== "global") return;
+  if (key === "SWARM_ORG_WEBSITE") await fillOrgLogoFromWebsite(value);
+  await syncRankingAfterConfigChange(key, value);
+  // Auto-reload integrations when a global-scoped config changes so callers
+  // (CLI, automation, dashboard) don't have to remember to hit /reload.
+  // Debounced to coalesce sequential single-key upserts from the dashboard
+  // batch save (no bulk endpoint exists).
+  scheduleIntegrationsReload();
+}
+
 /**
  * The general form of `ensureConfigAdmin`: operators and users pass, guests
  * get a plain 403, and an agent principal (session identity first, then the
@@ -484,28 +500,7 @@ export async function handleConfig(
     if (!(await ensureConfigAdmin(req, res, "config.write.any"))) return true;
     const { scope, scopeId, key, value, isSecret, envPath, description, exportToEnv } = parsed.body;
 
-    if (scope === "global" && scopeId) {
-      jsonError(res, "Global scope must not have scopeId", 400);
-      return true;
-    }
-
-    if ((scope === "agent" || scope === "repo") && !scopeId) {
-      jsonError(res, "Agent/repo scope requires scopeId", 400);
-      return true;
-    }
-
-    if (isReservedConfigKey(key)) {
-      jsonError(res, reservedKeyError(key).message, 400);
-      return true;
-    }
-
-    if (isInternalConfigKey(key)) {
-      jsonError(res, internalConfigKeyError(key).message, 400);
-      return true;
-    }
-
-    const validationError =
-      validateConfigValue(key, value) ?? validateExportToEnv(key, exportToEnv);
+    const validationError = validateConfigEntry({ scope, scopeId, key, value, exportToEnv });
     if (validationError) {
       jsonError(res, validationError, 400);
       return true;
@@ -523,17 +518,7 @@ export async function handleConfig(
         description: description || null,
         exportToEnv,
       });
-      // Auto-reload integrations when a global-scoped config changes so callers
-      // (CLI, automation, dashboard) don't have to remember to hit /reload.
-      // Debounced to coalesce sequential single-key upserts from the dashboard
-      // batch save (no bulk endpoint exists).
-      if (scope === "global" && key === "SWARM_ORG_WEBSITE") {
-        await fillOrgLogoFromWebsite(String(value));
-      }
-      if (scope === "global") await syncRankingAfterConfigChange(key, String(value));
-      if (scope === "global") {
-        scheduleIntegrationsReload();
-      }
+      await runConfigWriteSideEffects(scope, key, String(value));
       const result = includeSecrets || !config.isSecret ? config : maskSecrets([config])[0]!;
       upsertConfig.respond(res, 200, result);
     } catch (error) {

package/src/http/index.ts

@@ -139,6 +139,7 @@ import { handleTasks } from "./tasks";
 import { handleTelemetryUi } from "./telemetry-ui";
 import { handleTrackers } from "./trackers";
 import { handleUsedBy } from "./used-by";
+import { handleUserRoles } from "./user-roles";
 import { handleUsers } from "./users";
 import {
   getPathSegments,
@@ -404,6 +405,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleRuntimePools(req, res, pathSegments, queryParams, myAgentId),
         () => handleExtensions(req, res, pathSegments, queryParams, myAgentId),
         () => handleFavorites(req, res, pathSegments, queryParams, myAgentId),
+        () => handleUserRoles(req, res, pathSegments, queryParams),
         () => handleUsers(req, res, pathSegments, queryParams),
         () => handleSessions(req, res, pathSegments, queryParams, myAgentId),
         () => handleInboxState(req, res, pathSegments, queryParams),

package/src/http/schedules.ts

@@ -19,6 +19,7 @@ import {
 import { explicitModelErrorForAgent } from "../be/model-validation";
 import { mergeScheduleTiming, validateRecurringTiming } from "../be/schedules/validate";
 import { getScript } from "../be/scripts/db";
+import { can } from "../rbac";
 import { calculateNextRun, dispatchScheduleTarget } from "../scheduler/scheduler";
 import {
   AgentTaskSchema,
@@ -30,6 +31,7 @@ import {
   splitLegacyModelAlias,
 } from "../types";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
+import { agentFirstPrincipal } from "./request-principal";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -219,6 +221,7 @@ const updateSchedule = route({
   responses: {
     200: { description: "Schedule updated", schema: ScheduledTaskSchema.nullable() },
     400: { description: "Validation error" },
+    403: { description: "Deferral owned by another agent" },
     404: { description: "Schedule not found" },
     409: { description: "Duplicate name" },
   },
@@ -237,6 +240,7 @@ const patchSchedule = route({
   responses: {
     200: { description: "Schedule patched", schema: ScheduledTaskSchema.nullable() },
     400: { description: "Validation error" },
+    403: { description: "Deferral owned by another agent" },
     404: { description: "Schedule not found" },
     409: { description: "Duplicate name" },
   },
@@ -559,6 +563,28 @@ export async function handleSchedules(
       jsonError(res, "Schedule not found", 404);
       return true;
     }
+    // A deferral continues its owner's task, in that task's chat thread when
+    // it has one (src/scheduler/schedule-task.ts). An agent may change it only
+    // as its owner or a lead, as in the patch-schedule and update-schedule tools.
+    if (existing.taskType === "deferred") {
+      const principal = await agentFirstPrincipal(req, myAgentId);
+      if (
+        principal.kind === "agent" &&
+        !can({
+          principal,
+          verb: "schedule.deferral.update.any",
+          resource: { kind: "owned", ownerAgentId: existing.createdByAgentId },
+          source: "http",
+        }).allow
+      ) {
+        jsonError(
+          res,
+          `Schedule "${existing.name}" defers another agent's task. Only that agent or a lead can change it.`,
+          403,
+        );
+        return true;
+      }
+    }
     // A move to another agent re-judges the stored model against the new harness.
     const agentChanged =
       parsed.body.targetAgentId !== undefined &&

package/src/http/scripts.ts

@@ -32,6 +32,7 @@ import {
 } from "../be/scripts/db";
 import { searchScripts } from "../be/scripts/embeddings";
 import { extractArgsJsonSchema } from "../be/scripts/extract-schema";
+import { runScriptWithRunCredential } from "../be/scripts/run-credential";
 import { refuseSourceWithSecrets } from "../be/scripts/source-secrets";
 import {
   scriptSdkTypesWithGeneratedApis,
@@ -40,7 +41,6 @@ import {
 } from "../be/scripts/typecheck";
 import { can } from "../rbac";
 import { extractScriptSignature, type ScriptSignature } from "../scripts-runtime/extract-signature";
-import { runScript } from "../scripts-runtime/loader";
 import { checkQuickJSCompat, quickJSCompatWarnings } from "../scripts-runtime/quickjs-compat";
 import {
   ScriptApiAuthModeSchema,
@@ -782,7 +782,7 @@ export async function handleScripts(
       ? await touchScratchScriptLastUsed(namedScript.id)
       : null;
     const credentials = await buildScriptCredentialBindingsWithFailures({ agentId: agent.id });
-    const output = await runScript({
+    const output = await runScriptWithRunCredential({
       source: source as string,
       args: parsed.body.args,
       fsMode,