@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/src/http/codex-oauth-accounts.ts

@@ -0,0 +1,191 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { z } from "zod";
+import { decryptSecret, getEncryptionKey } from "../be/crypto";
+import { deleteKv, deleteSwarmConfigByKey, getDbClient, getKeyStatuses, getKv } from "../be/db";
+import { retirePoolKeyStatus } from "../be/db/api-keys";
+import { deriveCodexKeySuffix } from "../providers/codex-oauth/auth-json";
+import { decodeJwt, extractChatgptPlanType } from "../providers/codex-oauth/flow";
+import { MAX_CODEX_OAUTH_SLOT } from "../providers/codex-oauth/storage";
+import {
+  CODEX_AUTH_FAILURE_BENCH_THRESHOLD,
+  CODEX_AUTH_WATCH_NAMESPACE,
+  codexAuthBenchMarkerKey,
+} from "../utils/codex-auth-failure";
+import { ensureConfigAdmin, requestSecretReadScope, runConfigWriteSideEffects } from "./config";
+import { route } from "./route-def";
+import { jsonError } from "./utils";
+
+export const CodexAccountSchema = z.object({
+  slot: z.number().int().min(0),
+  configKey: z.string(),
+  legacy: z.boolean(),
+  suffix: z.string().nullable(),
+  plan: z.string().nullable(),
+  email: z.string().nullable(),
+  status: z.enum(["ok", "needs_login", "unchecked"]),
+});
+export type CodexAccount = z.infer<typeof CodexAccountSchema>;
+
+export const CodexAccountsResponseSchema = z.object({ accounts: z.array(CodexAccountSchema) });
+export type CodexAccountsResponse = z.infer<typeof CodexAccountsResponseSchema>;
+
+const listAccounts = route({
+  method: "get",
+  path: "/api/codex-oauth/accounts",
+  pattern: ["api", "codex-oauth", "accounts"],
+  summary: "List stored Codex ChatGPT accounts",
+  tags: ["Codex OAuth"],
+  responses: {
+    200: { description: "Stored account metadata", schema: CodexAccountsResponseSchema },
+    403: { description: "Caller cannot read all secrets" },
+  },
+});
+
+const deleteAccount = route({
+  method: "delete",
+  path: "/api/codex-oauth/accounts/{slot}",
+  pattern: ["api", "codex-oauth", "accounts", null],
+  summary: "Remove a stored Codex ChatGPT account",
+  tags: ["Codex OAuth"],
+  rbac: { permission: "config.delete.any" },
+  params: z.object({ slot: z.coerce.number().int().min(0).max(MAX_CODEX_OAUTH_SLOT) }),
+  responses: {
+    200: { description: "Remaining accounts", schema: CodexAccountsResponseSchema },
+    403: { description: "Config administration and permission to read all secrets required" },
+    404: { description: "Account slot does not exist" },
+  },
+});
+
+type AccountRow = { key: string; value: string; encrypted: number };
+
+async function accountRows(): Promise<Array<AccountRow & { slot: number; legacy: boolean }>> {
+  const rows = await getDbClient().query<AccountRow>(
+    "SELECT key, value, encrypted FROM swarm_config WHERE scope = 'global' AND (key = 'codex_oauth' OR key GLOB 'codex_oauth_[0-9]*')",
+  );
+  const hasSlotZero = rows.some((row) => row.key === "codex_oauth_0");
+  return rows
+    .flatMap((row) => {
+      if (row.key === "codex_oauth") {
+        return hasSlotZero ? [] : [{ ...row, slot: 0, legacy: true }];
+      }
+      const match = /^codex_oauth_(0|[1-9]\d*)$/.exec(row.key);
+      if (!match) return [];
+      const slot = Number(match[1]);
+      return slot <= MAX_CODEX_OAUTH_SLOT ? [{ ...row, slot, legacy: false }] : [];
+    })
+    .sort((a, b) => a.slot - b.slot);
+}
+
+const AccountCredentialsSchema = z.object({
+  access: z.string().min(1),
+  refresh: z.string().min(1),
+  expires: z.number().finite(),
+  accountId: z.string().min(1),
+});
+
+function readCredentials(row: AccountRow): z.infer<typeof AccountCredentialsSchema> | null {
+  try {
+    const value = row.encrypted ? decryptSecret(row.value, getEncryptionKey()) : row.value;
+    return AccountCredentialsSchema.parse(JSON.parse(value));
+  } catch {
+    return null;
+  }
+}
+
+function accountSuffix(row: AccountRow): string | null {
+  const credentials = readCredentials(row);
+  return credentials ? deriveCodexKeySuffix(credentials.access, credentials.accountId) : null;
+}
+
+async function accountsResponse(): Promise<CodexAccountsResponse> {
+  const rows = await accountRows();
+  const statuses = await getKeyStatuses("CODEX_OAUTH", "global", null);
+  const accounts: CodexAccount[] = [];
+  for (const row of rows) {
+    const account: CodexAccount = {
+      slot: row.slot,
+      configKey: row.key,
+      legacy: row.legacy,
+      suffix: null,
+      plan: null,
+      email: null,
+      status: "needs_login",
+    };
+    const credentials = readCredentials(row);
+    if (!credentials) {
+      accounts.push(account);
+      continue;
+    }
+    account.suffix = deriveCodexKeySuffix(credentials.access, credentials.accountId);
+    account.plan = extractChatgptPlanType(credentials.access);
+    const profile = decodeJwt(credentials.access)?.["https://api.openai.com/profile"];
+    if (profile && typeof profile === "object" && "email" in profile) {
+      account.email = typeof profile.email === "string" && profile.email ? profile.email : null;
+    }
+    const status = statuses.find((entry) => entry.keySuffix === account.suffix);
+    const marker = await getKv(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(account.suffix));
+    const statusBenched =
+      status &&
+      status.consecutiveAuthFailures >= CODEX_AUTH_FAILURE_BENCH_THRESHOLD &&
+      status.status === "rate_limited";
+    account.status = marker || statusBenched ? "needs_login" : status ? "ok" : "unchecked";
+    accounts.push(account);
+  }
+  return { accounts };
+}
+
+/** Both responses list account emails and plans, so both routes need this gate. */
+async function ensureSecretRead(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+  if ((await requestSecretReadScope(req)) === "all") return true;
+  jsonError(res, "Reading Codex accounts requires access to all secrets", 403);
+  return false;
+}
+
+export async function handleCodexOAuthAccounts(
+  req: IncomingMessage,
+  res: ServerResponse,
+  pathSegments: string[],
+  queryParams: URLSearchParams,
+): Promise<boolean> {
+  if (listAccounts.match(req.method, pathSegments)) {
+    const parsed = await listAccounts.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    if (!(await ensureSecretRead(req, res))) return true;
+    listAccounts.respond(res, 200, await accountsResponse());
+    return true;
+  }
+
+  if (deleteAccount.match(req.method, pathSegments)) {
+    const parsed = await deleteAccount.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    if (!(await ensureConfigAdmin(req, res, "config.delete.any"))) return true;
+    if (!(await ensureSecretRead(req, res))) return true;
+    const deletedKey = await getDbClient().transaction(async () => {
+      const rows = await accountRows();
+      const account = rows.find((row) => row.slot === parsed.params.slot);
+      if (!account || !(await deleteSwarmConfigByKey("global", null, account.key))) return null;
+      // A new sign-in takes the first free slot, so it must not inherit this
+      // account's auth bench (keyed by slot) or its bench marker.
+      const suffix = accountSuffix(account);
+      if (suffix) {
+        const remaining = rows.flatMap((row) => {
+          const keySuffix = row === account ? null : accountSuffix(row);
+          return keySuffix ? [{ keySuffix, keyIndex: row.slot }] : [];
+        });
+        await retirePoolKeyStatus("CODEX_OAUTH", suffix, remaining);
+        if (!remaining.some((row) => row.keySuffix === suffix)) {
+          await deleteKv(CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey(suffix));
+        }
+      }
+      return account.key;
+    });
+    if (deletedKey === null) {
+      jsonError(res, "Codex account slot does not exist", 404);
+      return true;
+    }
+    await runConfigWriteSideEffects("global", deletedKey, "");
+    deleteAccount.respond(res, 200, await accountsResponse());
+    return true;
+  }
+  return false;
+}

package/src/http/comb.ts

@@ -2,7 +2,12 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { resolveHttpAuditUserId } from "../be/audit-user";
 import { getCombConfig } from "../comb/config";
-import { REVIEW_BATCH_MAX, ReviewBatchError, sendReviewBatch } from "../comb/review-batch";
+import {
+  REVIEW_BATCH_MAX,
+  REVIEW_NOTE_MAX,
+  ReviewBatchError,
+  sendReviewBatch,
+} from "../comb/review-batch";
 import { can } from "../rbac";
 import { TaskCreationBlockedError } from "../tasks/errors";
 import { scrubSecrets } from "../utils/secret-scrubber";
@@ -24,6 +29,12 @@ const resultSchema = z.object({
   skipped: z.array(skippedSchema),
   /** Comments of an earlier send whose missing "sent" reply this batch posted again. */
   repaired: z.array(z.object({ id: z.string(), taskId: z.string() })),
+  /**
+   * With a new task only. `online`: a lead got it. `offline`: every lead is offline,
+   * so the task waits for one. `none`: no lead, so the task waits
+   * unassigned in the pool.
+   */
+  lead: z.enum(["online", "offline", "none"]).optional(),
 });
 
 const batchErrorSchema = z.object({ error: z.string(), skipped: z.array(skippedSchema) });
@@ -41,7 +52,7 @@ const reviewBatchRoute = route({
   pattern: ["api", "comb", "review-batches"],
   summary: "Send agent-fs comments to the swarm as one lead task",
   description:
-    "Comb's 'Send to swarm'. The server reads each comment again from agent-fs with its bootstrap key, skips replies, resolved comments, and comments already sent, and creates ONE task for the lead. Each sent comment gets a `[comb:sent task=<id>]` reply from the swarm service account. A comment is sent at most once. When an earlier send lost its reply, the batch posts that reply again (`repaired`). Answers 404 while COMB_ENABLED is off.",
+    "Comb's 'Send to swarm'. The server reads each comment again from agent-fs with its bootstrap key, skips replies, resolved comments, and comments already sent, and creates ONE task for the lead. Each sent comment gets a `[comb:sent task=<id>]` reply from the swarm service account. A comment is sent at most once. An optional `note` from the sender goes into the task text. When an earlier send lost its reply, the batch posts that reply again (`repaired`). Answers 404 while COMB_ENABLED is off.",
   tags: ["Comb"],
   body: z.object({
     orgId: z.string().min(1),
@@ -54,6 +65,8 @@ const reviewBatchRoute = route({
       .min(1)
       .max(1024)
       .refine(isDrivePath, "scopePath must start with '/' and have no '.' or '..' segment"),
+    /** The sender's note for the lead about the whole batch. */
+    note: z.string().max(REVIEW_NOTE_MAX).optional(),
   }),
   responses: {
     200: {

package/src/http/config.ts

@@ -67,7 +67,7 @@ export function readsRepoSecrets(
   }).allow;
 }
 
-async function requestSecretReadScope(
+export async function requestSecretReadScope(
   req: IncomingMessage,
   resolvedScope?: { agentId?: string; repoId?: string },
 ): Promise<"all" | "self" | "none"> {

package/src/http/core.ts

@@ -95,6 +95,12 @@ import {
  */
 const injectedEnvOriginals = new Map<string, { original: string | undefined; injected: string }>();
 
+/** Read the deployment value without a stored config's temporary env injection. */
+export function getDeploymentEnvValue(key: string): string | undefined {
+  const tracked = injectedEnvOriginals.get(key);
+  return tracked && process.env[key] === tracked.injected ? tracked.original : process.env[key];
+}
+
 export async function loadGlobalConfigsIntoEnv(override = false): Promise<string[]> {
   const globalConfigs = await getInjectableGlobalConfigs();
   const updated: string[] = [];

package/src/http/fleet-benchmark.ts

@@ -11,7 +11,7 @@ import {
   localTasksPerWeek,
 } from "../fleet-benchmark";
 import { isTelemetryEnabled } from "../telemetry";
-import { COMPANY_TEAM_SIZES, COMPANY_USE_CASES } from "../utils/company-profile";
+import { COMPANY_TEAM_SIZES, COMPANY_USE_CASES, reportedUseCase } from "../utils/company-profile";
 import { normalizeOrgWebsite } from "../utils/org-website";
 import { globalConfig } from "./global-config";
 import { rejectGuest } from "./request-principal";
@@ -188,6 +188,9 @@ export async function buildFleetBenchmarkResponse(
     normalizeOrgWebsite(website) && team.success && use.success
       ? { teamSize: team.data, useCase: use.data }
       : null;
+  // The proxy answers 400 for a use case its catalog does not list yet, so
+  // that use case compares against the whole fleet.
+  const proxyPeerGroup = peerGroup && reportedUseCase(peerGroup.useCase) ? peerGroup : null;
   const empty = {
     level: peerGroup ? ("full" as const) : ("basic" as const),
     peerGroup: null,
@@ -215,7 +218,7 @@ export async function buildFleetBenchmarkResponse(
   if (finishedTasks < FLEET_MIN_FINISHED_TASKS)
     return { ...empty, state: "not_enough_tasks", local };
 
-  const fleet = await fleetBenchmarks(now.getTime(), peerGroup);
+  const fleet = await fleetBenchmarks(now.getTime(), proxyPeerGroup);
   const responsePeerGroup =
     peerGroup && fleet?.peer_group
       ? {

package/src/http/idempotency-key.ts

@@ -8,7 +8,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { jsonError } from "./utils";
 
 /** Visible ASCII, at most 255 characters: room for a UUID, a ULID or a client's own scheme. */
-const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
+export const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
 
 /** Set on a response answered from an earlier accepted request. */
 export const IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";

package/src/http/index.ts

@@ -76,6 +76,7 @@ import { handleApprovalRequests } from "./approval-requests";
 import { handleApps } from "./apps";
 import { handleAssets } from "./assets";
 import { handleBudgets } from "./budgets";
+import { handleCodexOAuthAccounts } from "./codex-oauth-accounts";
 import { handleCodexOAuthDevice } from "./codex-oauth-device";
 import { handleCodexOAuthKeepWarm } from "./codex-oauth-keep-warm";
 import { handleComb } from "./comb";
@@ -115,6 +116,7 @@ import { handlePageProxy } from "./page-proxy";
 import { handlePages } from "./pages";
 import { handlePagesPublic } from "./pages-public";
 import { handlePoll } from "./poll";
+import { handlePoolKeys } from "./pool-keys";
 import { handlePricing } from "./pricing";
 import { handlePromptTemplates } from "./prompt-templates";
 import { handleRanking } from "./ranking";
@@ -360,6 +362,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleStatus(req, res, pathSegments, queryParams),
         () => handleOnboarding(req, res, pathSegments, queryParams),
         () => handleCodexOAuthDevice(req, res, pathSegments, queryParams),
+        () => handleCodexOAuthAccounts(req, res, pathSegments, queryParams),
         () => handleActiveSessions(req, res, pathSegments, queryParams, myAgentId),
         () => handlePricing(req, res, pathSegments, queryParams, myAgentId),
         () => handleSchedules(req, res, pathSegments, queryParams, myAgentId),
@@ -367,6 +370,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handleWorkflowEvents(req, res, pathSegments, queryParams),
         () => handleApprovalRequests(req, res, pathSegments, queryParams),
         () => handleApps(req, res, pathSegments, queryParams, myAgentId),
+        () => handlePoolKeys(req, res, pathSegments, queryParams),
         () => handleConfig(req, res, pathSegments, queryParams),
         () => handleFs(req, res, pathSegments, queryParams, myAgentId),
         () => handleComb(req, res, pathSegments, queryParams, myAgentId),
@@ -513,7 +517,7 @@ async function shutdown() {
   await stopChatSdk();
 
   // Stop OAuth keepalive
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
     const { stopOAuthKeepalive } = await import("../oauth/keepalive");
     await stopOAuthKeepalive();
   }
@@ -843,7 +847,7 @@ httpServer
     startRuntimeSupervisor();
 
     // Start OAuth token keepalive (proactive refresh to prevent expiry)
-    if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
+    if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
       const { startOAuthKeepalive } = await import("../oauth/keepalive");
       startOAuthKeepalive();
     }
@@ -851,7 +855,7 @@ httpServer
     // Start generic OAuth token refresh sweep (all oauth_apps providers,
     // 15-min tick, first run ~1 min after boot). Complements the tracker-only
     // keepalive above — see src/be/oauth-refresh-sweep.ts.
-    if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
+    if (!isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
       const { startOAuthRefreshSweep } = await import("../be/oauth-refresh-sweep");
       startOAuthRefreshSweep();
     }
@@ -898,6 +902,13 @@ httpServer
       .catch((err) => {
         console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
       });
+
+    // Source key backfill is idempotent, resumable, and non-fatal.
+    import("../be/session-source-backfill")
+      .then(({ runSessionSourceBackfill }) => runSessionSourceBackfill())
+      .catch((err) => {
+        console.error("[session-source-backfill] startup run failed (non-fatal):", err);
+      });
   })
   .on("error", (err) => {
     console.error("HTTP Server Error:", err);

package/src/http/integrations.ts

@@ -8,6 +8,7 @@ import {
   registerTelegramWebhook,
 } from "../integrations/chat-sdk/status";
 import { buildSlackManifest } from "../slack/manifest";
+import { selectCredential } from "../utils/credentials";
 import { ensureHttpPermission } from "./config";
 import { resolveConfigValue, resolveMcpBaseUrl } from "./config-values";
 import { route } from "./route-def";
@@ -231,7 +232,10 @@ export function createIntegrationsHandler(deps: TestConnectionDeps = {}) {
       }
 
       try {
-        const client = buildClient(apiKey);
+        // A comma pool is one key per call, as the runner does.
+        const client = buildClient(
+          selectCredential(apiKey, undefined, "ANTHROPIC_API_KEY").selected,
+        );
         const agent = await client.beta.agents.retrieve(agentId);
         // `agent.model` is `BetaManagedAgentsModelConfig` ({id, speed}). Flatten
         // to a string so the UI can render it directly without type guards.

package/src/http/kv.ts

@@ -12,7 +12,11 @@ import {
   upsertKv,
 } from "../be/db";
 import { mcpOverflowAuthError } from "../kv-overflow";
-import { reservedNamespaceError, reservedRoomKeyError } from "../kv-reserved-namespaces";
+import {
+  privateNamespaceError,
+  reservedNamespaceError,
+  reservedRoomKeyError,
+} from "../kv-reserved-namespaces";
 import { hasKvViewArgs, resolveKvView } from "../kv-view";
 import { can } from "../rbac";
 import { agentContextKey, pageContextKey } from "../tasks/context-key";
@@ -405,8 +409,9 @@ function authorizeRead(
   namespace: string,
   ctx: AuthCtx,
 ): { status: number; message: string } | null {
-  const overflowAuthErr = mcpOverflowAuthError(namespace, ctx.callerAgentId);
-  return overflowAuthErr ? { status: 403, message: overflowAuthErr } : null;
+  const readErr =
+    privateNamespaceError(namespace) ?? mcpOverflowAuthError(namespace, ctx.callerAgentId);
+  return readErr ? { status: 403, message: readErr } : null;
 }
 
 function encodeValueOrError(

package/src/http/onboarding.ts

@@ -21,6 +21,7 @@ import {
 } from "../be/onboarding";
 import { assertUrlSafe, publicEndpointSsrfOptions } from "../oauth/mcp-wrapper";
 import { ProviderNameSchema } from "../types";
+import { splitCredentialPool } from "../utils/credentials";
 import { getOpenRouterAttributionHeaders } from "../utils/openrouter-base-url";
 import { ensureConfigAdmin } from "./config";
 import { scheduleIntegrationsReload } from "./core";
@@ -36,11 +37,14 @@ async function buildSignals(state: OnboardingState): Promise<OnboardingSignals>
     const provider = ProviderNameSchema.safeParse(entry.provider);
     if (!provider.success) continue;
     const rollup = await rollupCredStatusForProvider(provider.data);
+    const live = rollup.latestLiveTest;
     providers.push({
       provider: provider.data,
       state: rollup.state,
       workers: rollup.workers,
       verifiedWorkers: rollup.verifiedWorkers,
+      error: live && !live.ok ? (live.error ?? null) : null,
+      warning: live?.ok ? (live.warning ?? null) : null,
     });
   }
 
@@ -241,7 +245,8 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     body.preset === "existing"
       ? (process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY)
       : undefined;
-  const apiKey = explicitKey ?? reusedKey ?? implicitKey;
+  // Test and save the same pool member.
+  const apiKey = splitCredentialPool(explicitKey ?? reusedKey ?? implicitKey ?? "")[0];
 
   if (!apiKey) {
     return {

package/src/http/pages-public.ts

@@ -308,13 +308,45 @@ function getAppBaseUrl(): string {
   return getAppUrl(LOCAL_PAGE_APP_URL);
 }
 
+// CSP host-source without a path: optional http(s) scheme, a host that may
+// start with a `*.` wildcard label, and an optional port (digits or `*`).
+// Bare `*`, keywords (`'none'`, `'self'`) and anything carrying `;` or a path
+// are rejected so a bad env value cannot widen or break the policy.
+const FRAME_ANCESTOR_SOURCE_RE =
+  /^(?:https?:\/\/)?(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::(?:\d{1,5}|\*))?$/i;
+
+let cachedFrameAncestors: { raw: string; origins: string[] } | null = null;
+
+/**
+ * Parse `PAGES_FRAME_ANCESTORS`: extra origins allowed to iframe PUBLIC pages
+ * (for example a marketing site embedding a chart). Comma or space separated.
+ * Invalid entries are dropped with one warning per distinct env value; the
+ * parse is cached on the raw string so a config reload picks up changes
+ * without re-warning on every request.
+ */
+export function getPageFrameAncestors(): string[] {
+  const raw = process.env.PAGES_FRAME_ANCESTORS ?? "";
+  if (cachedFrameAncestors?.raw === raw) return cachedFrameAncestors.origins;
+  const origins: string[] = [];
+  for (const entry of raw.split(/[\s,]+/)) {
+    const value = entry.replace(/\/+$/, "");
+    if (!value) continue;
+    if (FRAME_ANCESTOR_SOURCE_RE.test(value)) origins.push(value);
+    else console.warn(`[pages] ignoring invalid PAGES_FRAME_ANCESTORS entry: ${entry}`);
+  }
+  cachedFrameAncestors = { raw, origins };
+  return origins;
+}
+
 /**
  * Build the `Content-Security-Policy` for the served HTML. Allows inline
  * scripts (required for `BROWSER_SDK_JS`) but locks down everything else to
  * `'self'`. The SPA iframes the page in step-6 with `sandbox="allow-scripts
- * allow-forms"`; the CSP is a defence-in-depth layer.
+ * allow-forms"`; the CSP is a defence-in-depth layer. `PAGES_FRAME_ANCESTORS`
+ * applies only to public pages: authed and password pages stay embeddable by
+ * the app origins alone.
  */
-function buildCsp(): string {
+function buildCsp(page: Page): string {
   // `frame-ancestors` lists every origin allowed to iframe `/p/:id`. We must
   // include the SPA origin(s). Configured app URLs may be comma-separated so
   // portless dev (`https://ui.swarm.localhost`), a Vite port (`http://localhost:5274`),
@@ -333,7 +365,8 @@ function buildCsp(): string {
           "https://*.localhost",
           "http://*.localhost",
         ];
-  const ancestors = Array.from(new Set([...configured, ...devFallbacks]));
+  const embedders = page.authMode === "public" ? getPageFrameAncestors() : [];
+  const ancestors = Array.from(new Set([...configured, ...devFallbacks, ...embedders]));
   // Allow Tailwind Play CDN (`cdn.tailwindcss.com`) for scripts, Google
   // Fonts (`fonts.googleapis.com` stylesheets + `fonts.gstatic.com` font
   // files) for the swarm default typography, and same-origin /@swarm/api/*
@@ -609,7 +642,7 @@ export async function handlePagesPublic(
       const headers: Record<string, string | string[]> = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-store",
-        "Content-Security-Policy": buildCsp(),
+        "Content-Security-Policy": buildCsp(page),
         "X-Content-Type-Options": "nosniff",
       };
       if (inlineSetCookie.length > 0) headers["Set-Cookie"] = inlineSetCookie;
@@ -642,7 +675,7 @@ export async function handlePagesPublic(
   const headers: Record<string, string | string[]> = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
-    "Content-Security-Policy": buildCsp(),
+    "Content-Security-Policy": buildCsp(page),
     // Defence-in-depth: prevent MIME sniffing and clickjacking outside the SPA.
     "X-Content-Type-Options": "nosniff",
   };