@desplega.ai/agent-swarm 2.6.0 → 2.7.0

package/src/be/db.ts

@@ -227,8 +227,10 @@ import { configureTaskWriteDependencies, failTask } from "./db/tasks/write";
 import { tombstoneWorkflowIdempotencyKeys } from "./db/workflow-idempotency";
 import {
   emitChildRunFinished,
+  emitRunFinished,
   getRunLineageBlock,
   getStepExecutionBlock,
+  isTerminalWorkflowRunStatus,
   rowToWorkflowRun,
   rowToWorkflowRunStep,
   WORKFLOW_RUN_SUMMARY_COLUMNS,
@@ -7994,16 +7996,33 @@ export async function updateWorkflowRun(
   updates.push("lastUpdatedAt = ?");
   params.push(new Date().toISOString());
   params.push(id);
-  const row = await getDbClient().get<WorkflowRunRow>(
-    `UPDATE workflow_runs SET ${updates.join(", ")} WHERE id = ? RETURNING *`,
-    params,
-  );
+  const update = () =>
+    getDbClient().get<WorkflowRunRow>(
+      `UPDATE workflow_runs SET ${updates.join(", ")} WHERE id = ? RETURNING *`,
+      params,
+    );
+  const endsRun = data.status !== undefined && isTerminalWorkflowRunStatus(data.status);
+  // A run that ends reads the status it replaces in the same transaction, so
+  // only a change out of a live status announces the end: a later terminal
+  // write, same status or not, does not announce it again.
+  const [previousStatus, row] = endsRun
+    ? await getDbClient().transaction(async () => {
+        const previous = await getDbClient().get<{ status: WorkflowRunStatus }>(
+          "SELECT status FROM workflow_runs WHERE id = ?",
+          [id],
+        );
+        return [previous?.status, await update()] as const;
+      })
+    : [undefined, await update()];
   if (!row) return null;
   const run = rowToWorkflowRun(row);
   if (data.status === "completed" || data.status === "failed") {
     emitWorkflowTerminalTelemetry(run);
   }
   if (row.parentStepId) emitChildRunFinished(id, row.parentStepId, run.status);
+  if (endsRun && previousStatus && !isTerminalWorkflowRunStatus(previousStatus)) {
+    emitRunFinished(id, run.workflowId, run.status);
+  }
   return run;
 }
 
@@ -11721,6 +11740,14 @@ export interface AvailableKeyIndicesResult {
  * whose `plan` cannot run the family (`planAllowsModelFamily`) is excluded
  * and reported in `seatBlockedIndices`, also when it is key-wide or
  * model-window blocked; a seat block has no reset time.
+ *
+ * With `keySuffixes` (the caller's own pool, in order), rows are matched by
+ * key suffix instead of the stored `keyIndex`, across every scope: a key has
+ * one state wherever it is pooled, and a key at the same index in another
+ * agent's pool is never blocked by it. A suffix listed more than once is read
+ * by `keyIndex` in `scope`/`scopeId`, as without the list. Returned indices
+ * are positions in `keySuffixes`. Without it, rows of `scope`/`scopeId` are
+ * read by `keyIndex`.
  */
 export async function getAvailableKeyIndices(
   keyType: string,
@@ -11728,41 +11755,58 @@ export async function getAvailableKeyIndices(
   scope = "global",
   scopeId: string | null = null,
   modelFamily?: ModelFamily,
+  keySuffixes?: string[],
 ): Promise<AvailableKeyIndicesResult> {
   const now = new Date().toISOString();
   const nowMs = Date.now();
   const client = getDbClient();
   const effectiveScopeId = scopeId ?? "";
+  const suffixes = keySuffixes?.length ? keySuffixes : undefined;
+  const rowFilter = suffixes
+    ? `keyType = ? AND keySuffix IN (${suffixes.map(() => "?").join(", ")})`
+    : "keyType = ? AND scope = ? AND scopeId = ?";
+  const rowParams = suffixes ? [keyType, ...suffixes] : [keyType, scope, effectiveScopeId];
 
   // Auto-clear expired rate limits. Never an auth bench: only `clearAuthBench` lifts it.
   await client.run(
     `UPDATE api_key_status
      SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
-     WHERE keyType = ? AND scope = ? AND scopeId = ?
+     WHERE ${rowFilter}
        AND status = 'rate_limited' AND rateLimitedUntil <= ? AND consecutiveAuthFailures < ?`,
-    [now, keyType, scope, effectiveScopeId, now, CODEX_AUTH_FAILURE_BENCH_THRESHOLD],
+    [now, ...rowParams, now, CODEX_AUTH_FAILURE_BENCH_THRESHOLD],
   );
 
   const rows = await client.query<{
     keyIndex: number;
+    keySuffix: string;
+    scope: string;
+    scopeId: string;
     status: string;
     rateLimitWindows: string | null;
     plan: string | null;
     authFailureSeq: number;
     lastValidationFailedAt: string | null;
   }>(
-    `SELECT keyIndex, status, rateLimitWindows, plan, authFailureSeq, lastValidationFailedAt FROM api_key_status
-       WHERE keyType = ? AND scope = ? AND scopeId = ?`,
-    [keyType, scope, effectiveScopeId],
-  );
+    `SELECT keyIndex, keySuffix, scope, scopeId, status, rateLimitWindows, plan, authFailureSeq, lastValidationFailedAt FROM api_key_status
+       WHERE ${rowFilter}`,
+    rowParams,
+  );
+  // Pool positions a row applies to: the position holding its suffix, or its stored index.
+  // A suffix held by several pool members cannot tell them apart, so it falls back to
+  // the index read: only a row of the requested scope, at its stored index.
+  const positionsOf = (row: (typeof rows)[number]): number[] => {
+    if (!suffixes) return [row.keyIndex];
+    const positions = suffixes.flatMap((suffix, i) => (suffix === row.keySuffix ? [i] : []));
+    if (positions.length < 2) return positions;
+    const sameScope = row.scope === scope && row.scopeId === effectiveScopeId;
+    return sameScope && positions.includes(row.keyIndex) ? [row.keyIndex] : [];
+  };
 
   const blockedIndices = new Set(
-    rows.filter((r) => r.status === "rate_limited").map((r) => r.keyIndex),
+    rows.filter((r) => r.status === "rate_limited").flatMap(positionsOf),
   );
   const rejectedIndices = [
-    ...new Set(
-      rows.filter((row) => row.lastValidationFailedAt !== null).map((row) => row.keyIndex),
-    ),
+    ...new Set(rows.filter((row) => row.lastValidationFailedAt !== null).flatMap(positionsOf)),
   ];
   for (const index of rejectedIndices) blockedIndices.add(index);
 
@@ -11773,14 +11817,17 @@ export async function getAvailableKeyIndices(
       // A key already blocked key-wide doesn't need a separate model-block
       // entry — it's excluded from availableIndices either way, and
       // modelBlockedIndices means "excluded only by a model-scoped block".
-      if (blockedIndices.has(row.keyIndex)) continue;
+      const positions = positionsOf(row).filter(
+        (i) => !blockedIndices.has(i) && !modelBlockedIndices.includes(i),
+      );
+      if (positions.length === 0) continue;
       const block = activeModelBlock(
         parseRateLimitWindowsJson(row.rateLimitWindows),
         modelFamily,
         nowMs,
       );
       if (!block) continue;
-      modelBlockedIndices.push(row.keyIndex);
+      modelBlockedIndices.push(...positions);
       if (earliestModelResetsAtSec === undefined || block.resetsAt < earliestModelResetsAtSec) {
         earliestModelResetsAtSec = block.resetsAt;
       }
@@ -11794,7 +11841,10 @@ export async function getAvailableKeyIndices(
   const seatBlockedIndices: number[] = [];
   if (modelFamily) {
     for (const row of rows) {
-      if (!planAllowsModelFamily(row.plan, modelFamily)) seatBlockedIndices.push(row.keyIndex);
+      if (planAllowsModelFamily(row.plan, modelFamily)) continue;
+      for (const i of positionsOf(row)) {
+        if (!seatBlockedIndices.includes(i)) seatBlockedIndices.push(i);
+      }
     }
   }
   const seatBlockedSet = new Set(seatBlockedIndices);
@@ -12143,22 +12193,30 @@ export async function clearKeyRateLimit(
   const effectiveScopeId = scopeId ?? "";
   const { keyIndex = -1, authFence = null } = opts;
   const clearAuthBench = opts.clearAuthBench === true && authFence !== null;
-  const key = [keyType, keySuffix, scope, effectiveScopeId];
   return await getDbClient().transaction(async (tx) => {
+    // The key's rows in every scope: `getAvailableKeyIndices` reads them all by suffix.
     const result = await tx.run(
       `UPDATE api_key_status
          SET status = 'available', rateLimitedUntil = NULL, updatedAt = ?
-         WHERE keyType = ? AND keySuffix = ? AND scope = ? AND scopeId = ?
+         WHERE keyType = ? AND keySuffix = ?
            AND status = 'rate_limited' AND ((? AND authFailureSeq <= ?) OR consecutiveAuthFailures < ?)`,
-      [now, ...key, clearAuthBench ? 1 : 0, authFence, CODEX_AUTH_FAILURE_BENCH_THRESHOLD],
+      [
+        now,
+        keyType,
+        keySuffix,
+        clearAuthBench ? 1 : 0,
+        authFence,
+        CODEX_AUTH_FAILURE_BENCH_THRESHOLD,
+      ],
     );
     const cleared = result.changes > 0;
     if (!clearAuthBench) return cleared;
     const lifted = await tx.query<{ keySuffix: string }>(
       `UPDATE api_key_status SET consecutiveAuthFailures = 0, updatedAt = ?1,
            status = CASE WHEN keySuffix = ?2 THEN status ELSE 'available' END, rateLimitedUntil = CASE WHEN keySuffix = ?2 THEN rateLimitedUntil END
-         WHERE keyType = ?3 AND scope = ?4 AND scopeId = ?5 AND (consecutiveAuthFailures > 0 OR status = 'rate_limited')
-           AND ((keySuffix = ?2 AND authFailureSeq <= ?7) OR (keySuffix != ?2 AND keyIndex = ?6)) RETURNING keySuffix`,
+         WHERE keyType = ?3 AND (consecutiveAuthFailures > 0 OR status = 'rate_limited')
+           AND ((keySuffix = ?2 AND authFailureSeq <= ?7)
+             OR (keySuffix != ?2 AND keyIndex = ?6 AND scope = ?4 AND scopeId = ?5)) RETURNING keySuffix`,
       [now, keySuffix, keyType, scope, effectiveScopeId, keyIndex, authFence],
     );
     const retired = lifted.filter((row) => row.keySuffix !== keySuffix);

package/src/be/memory/task-learning.ts

@@ -0,0 +1,155 @@
+/**
+ * Learnings captured through `store-progress`: one swarm-scope `manual` memory
+ * per learning, keyed `/learnings/<workstream>/<slug>` and tied to its task by
+ * `sourceTaskId`, so "what did we learn doing X" is one `keyPrefix` search.
+ *
+ * Source stays `manual` so nightly curation (memtax B1 reads only manual and
+ * file_index rows) picks learnings up without a new source value.
+ */
+import { getDbClient } from "@/be/db";
+import { indexMemoryContent } from "@/be/memory/index-content";
+import { contentSha256 } from "@/commands/profile-sync";
+import type { AgentTask } from "@/types";
+import { scrubSecrets } from "@/utils/secret-scrubber";
+
+/** ~500 tokens at ceil(chars / 4); also keeps a learning to one memory chunk. */
+export const LEARNING_MAX_CHARS = 2000;
+export const LEARNING_MAX_TAGS = 5;
+const LEARNINGS_ROOT = "/learnings";
+const SEGMENT_MAX_CHARS = 60;
+const KEY_ATTEMPTS = 4;
+
+export type TaskLearningInput = string | { text: string; workstream?: string; tags?: string[] };
+
+export type TaskLearningResult =
+  | { status: "stored"; memoryId: string; key: string; workstream: string }
+  | { status: "replayed"; memoryId: string; key: string }
+  | { status: "failed"; error: string };
+
+/** Lowercase kebab slug: `Agent Swarm!` -> `agent-swarm`. Empty when nothing usable is left. */
+export function toKebab(value: string, maxChars = SEGMENT_MAX_CHARS): string {
+  return value
+    .normalize("NFKD")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+/, "")
+    .slice(0, maxChars)
+    .replace(/-+$/, "");
+}
+
+/** Explicit workstream, else the repo name from `vcsRepo` (`owner/name` or a URL), else `general`. */
+export function resolveLearningWorkstream(
+  explicit: string | undefined,
+  vcsRepo: string | undefined,
+): string {
+  const fromExplicit = explicit ? toKebab(explicit) : "";
+  if (fromExplicit) return fromExplicit;
+  const repoName = vcsRepo
+    ?.trim()
+    .replace(/\/+$/, "")
+    .split("/")
+    .pop()
+    ?.replace(/\.git$/, "");
+  const fromRepo = repoName ? toKebab(repoName) : "";
+  return fromRepo || "general";
+}
+
+export async function storeTaskLearning(params: {
+  agentId: string;
+  isLead: boolean;
+  task: Pick<AgentTask, "id" | "vcsRepo">;
+  learning: TaskLearningInput;
+}): Promise<TaskLearningResult> {
+  const { agentId, isLead, task } = params;
+  const input = typeof params.learning === "string" ? { text: params.learning } : params.learning;
+  // Scrub before anything is derived: a token in the title, workstream or a tag
+  // would otherwise survive (kebab-cased) in the key and tags, and the replay
+  // hash must match the hash of the scrubbed content the store persists.
+  const text = scrubSecrets(input.text).trim();
+  if (!text) return { status: "failed", error: "learning text is empty" };
+  if (text.length > LEARNING_MAX_CHARS) {
+    return {
+      status: "failed",
+      error: `learning text is over ~500 tokens (${LEARNING_MAX_CHARS} characters); shorten it`,
+    };
+  }
+  const tags = [
+    ...new Set((input.tags ?? []).map((tag) => toKebab(scrubSecrets(tag))).filter(Boolean)),
+  ].filter((tag) => tag !== "learning");
+  if (tags.length > LEARNING_MAX_TAGS) {
+    return { status: "failed", error: `learning takes at most ${LEARNING_MAX_TAGS} tags` };
+  }
+
+  const workstream = resolveLearningWorkstream(
+    input.workstream === undefined ? undefined : scrubSecrets(input.workstream),
+    task.vcsRepo === undefined ? undefined : scrubSecrets(task.vcsRepo),
+  );
+
+  try {
+    // One write transaction for the replay check and the insert, so two
+    // overlapping calls with the same learning store it once.
+    return await getDbClient().transaction(() =>
+      insertLearning({ agentId, isLead, taskId: task.id, text, tags, workstream }),
+    );
+  } catch (err) {
+    return {
+      status: "failed",
+      error: scrubSecrets(err instanceof Error ? err.message : String(err)),
+    };
+  }
+}
+
+async function insertLearning(params: {
+  agentId: string;
+  isLead: boolean;
+  taskId: string;
+  text: string;
+  tags: string[];
+  workstream: string;
+}): Promise<TaskLearningResult> {
+  const { agentId, isLead, taskId, text, tags, workstream } = params;
+  // indexMemoryContent stores text this short as one trimmed chunk, so this
+  // hash is the row's contentHash: a replayed call finds its own earlier write.
+  const contentHash = contentSha256(text);
+  const replay = await getDbClient().get<{ id: string; key: string }>(
+    `SELECT id, key FROM agent_memory
+     WHERE sourceTaskId = ? AND contentHash = ? AND key LIKE '${LEARNINGS_ROOT}/%'
+     LIMIT 1`,
+    [taskId, contentHash],
+  );
+  if (replay) return { status: "replayed", memoryId: replay.id, key: replay.key };
+
+  const title = text.split(/\r?\n/, 1)[0]!.trim().slice(0, 200);
+  const baseKey = `${LEARNINGS_ROOT}/${workstream}/${toKebab(title) || "learning"}`;
+
+  // Keys are unique per owner and a reused key fails rather than upserts.
+  // Keep the path unique across the swarm: on a taken key, add a short suffix.
+  for (let attempt = 0; attempt < KEY_ATTEMPTS; attempt++) {
+    const key = attempt === 0 ? baseKey : `${baseKey}-${crypto.randomUUID().slice(0, 6)}`;
+    const taken = await getDbClient().get<{ id: string }>(
+      "SELECT id FROM agent_memory WHERE scope = 'swarm' AND key = ? LIMIT 1",
+      [key],
+    );
+    if (taken) continue;
+    try {
+      const result = await indexMemoryContent({
+        agentId,
+        content: text,
+        name: title,
+        scope: "swarm",
+        source: "manual",
+        sourceTaskId: taskId,
+        tags: ["learning", ...tags],
+        intent: "store-progress learning",
+        key,
+        writer: { principal: { kind: "agent", agentId, isLead }, source: "mcp" },
+      });
+      return { status: "stored", memoryId: result.memoryIds[0]!, key, workstream };
+    } catch (err) {
+      // The key is taken after all: try a suffixed one.
+      if (/UNIQUE constraint failed/i.test((err as Error).message)) continue;
+      throw err;
+    }
+  }
+  return { status: "failed", error: `no free key under ${baseKey}` };
+}

package/src/be/migrations/245_script_executor.sql

@@ -0,0 +1,3 @@
+-- Optional per-script executor override ("native" | "quickjs").
+-- When NULL, the deployment's SCRIPT_EXECUTOR default applies.
+ALTER TABLE scripts ADD COLUMN executor TEXT DEFAULT NULL;

package/src/be/oauth-refresh-sweep.ts

@@ -20,6 +20,7 @@
  * same per-authorization locks in ensure-token, so overlap is safe.
  */
 import { forceRefreshAuthorizationOrThrow } from "../oauth/ensure-token";
+import { isEnvFlagEnabled } from "../utils/env-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import {
   type AuthorizationSweepRow,
@@ -138,7 +139,7 @@ async function runSweepTick(trigger: "startup" | "interval"): Promise<void> {
  * already running.
  */
 export function startOAuthRefreshSweep(): void {
-  if (process.env.OAUTH_REFRESH_SWEEP_DISABLE === "true") {
+  if (isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
     console.log("[oauth-refresh-sweep] Disabled via OAUTH_REFRESH_SWEEP_DISABLE");
     return;
   }

package/src/be/scripts/boot-reembed.ts

@@ -26,6 +26,7 @@ type ScriptRow = {
   isScratch: number;
   typeChecked: number;
   fsMode: "none" | "workspace-rw";
+  executor: "native" | "quickjs" | null;
   createdByAgentId: string | null;
   createdAt: string;
   updatedAt: string;
@@ -37,6 +38,7 @@ function toScriptRecord(row: ScriptRow) {
     scopeId: row.scopeId ?? null,
     isScratch: row.isScratch === 1,
     typeChecked: row.typeChecked === 1,
+    executor: row.executor ?? null,
     createdByAgentId: row.createdByAgentId ?? null,
   };
 }

package/src/be/scripts/db.ts

@@ -3,6 +3,7 @@ import type {
   ScriptApiAuthMode,
   ScriptApiRecord,
   ScriptApiWithSecret,
+  ScriptExecutorName,
   ScriptFsMode,
   ScriptRecord,
   ScriptScope,
@@ -36,6 +37,7 @@ type ScriptWriteArgs = ScriptIdentity & {
   isScratch?: boolean;
   typeChecked?: boolean;
   fsMode?: ScriptFsMode;
+  executor?: ScriptExecutorName | null;
   agentId?: string | null;
   changeReason?: string | null;
   embeddingMode?: "sync" | "skip";
@@ -62,6 +64,7 @@ function rowToScript(row: ScriptRow): ScriptRecord {
     scopeId: row.scopeId ?? null,
     isScratch: row.isScratch === 1,
     typeChecked: row.typeChecked === 1,
+    executor: row.executor ?? null,
     createdByAgentId: row.createdByAgentId ?? null,
   };
 }
@@ -113,6 +116,7 @@ export async function insertScript(args: ScriptWriteArgs): Promise<ScriptRecord>
   const scopeId = normalizeScopeId(args.scope, args.scopeId);
   const contentHash = computeContentHash(args.source);
   const fsMode = args.fsMode ?? "none";
+  const executor = args.executor ?? null;
   const isScratch = args.isScratch ? 1 : 0;
   const typeChecked = args.typeChecked ? 1 : 0;
 
@@ -120,10 +124,10 @@ export async function insertScript(args: ScriptWriteArgs): Promise<ScriptRecord>
     const row = await tx.get<ScriptRow>(
       `INSERT INTO scripts (
           id, "key", name, scope, scopeId, source, description, intent, signatureJson,
-          argsJsonSchema, contentHash, isScratch, typeChecked, fsMode, createdByAgentId, createdAt, updatedAt,
+          argsJsonSchema, contentHash, isScratch, typeChecked, fsMode, executor, createdByAgentId, createdAt, updatedAt,
           created_by, updated_by
         )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         RETURNING *`,
       [
         id,
@@ -140,6 +144,7 @@ export async function insertScript(args: ScriptWriteArgs): Promise<ScriptRecord>
         isScratch,
         typeChecked,
         fsMode,
+        executor,
         args.agentId ?? null,
         now,
         now,
@@ -189,6 +194,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
   const contentHash = computeContentHash(args.source);
   if (existing.contentHash === contentHash) {
     const fsMode = args.fsMode ?? existing.fsMode;
+    const executor = args.executor !== undefined ? args.executor : existing.executor;
     const isScratch = args.isScratch ?? existing.isScratch;
     const typeChecked = args.typeChecked ?? existing.typeChecked;
     const argsJsonSchema =
@@ -206,6 +212,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
       isScratch;
     if (
       fsMode !== existing.fsMode ||
+      executor !== existing.executor ||
       isScratch !== existing.isScratch ||
       typeChecked !== existing.typeChecked ||
       trackedMetadataChanged ||
@@ -214,7 +221,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
       const row = await getDbClient().get<ScriptRow>(
         `UPDATE scripts
         SET description = ?, intent = ?, signatureJson = ?, argsJsonSchema = ?,
-          isScratch = ?, typeChecked = ?, fsMode = ?, updatedAt = ?, updated_by = ?
+          isScratch = ?, typeChecked = ?, fsMode = ?, executor = ?, updatedAt = ?, updated_by = ?
         WHERE id = ?
         RETURNING *`,
         [
@@ -225,6 +232,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
           isScratch ? 1 : 0,
           typeChecked ? 1 : 0,
           fsMode,
+          executor ?? null,
           new Date().toISOString(),
           args.createdBy ?? null,
           existing.id,
@@ -253,6 +261,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
   const now = new Date().toISOString();
   const newVersion = existing.version + 1;
   const fsMode = args.fsMode ?? existing.fsMode;
+  const executor = args.executor !== undefined ? args.executor : existing.executor;
   const isScratch = args.isScratch ?? existing.isScratch;
   const typeChecked = args.typeChecked ?? existing.typeChecked;
   const argsJsonSchema =
@@ -262,7 +271,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
     const row = await tx.get<ScriptRow>(
       `UPDATE scripts
         SET source = ?, description = ?, intent = ?, signatureJson = ?, argsJsonSchema = ?,
-          contentHash = ?, version = ?, isScratch = ?, typeChecked = ?, fsMode = ?, updatedAt = ?, updated_by = ?
+          contentHash = ?, version = ?, isScratch = ?, typeChecked = ?, fsMode = ?, executor = ?, updatedAt = ?, updated_by = ?
         WHERE id = ?
         RETURNING *`,
       [
@@ -276,6 +285,7 @@ export async function upsertScriptByName(args: ScriptWriteArgs): Promise<UpsertS
         isScratch ? 1 : 0,
         typeChecked ? 1 : 0,
         fsMode,
+        executor ?? null,
         now,
         args.createdBy ?? null,
         existing.id,

package/src/be/scripts/embeddings.ts

@@ -28,6 +28,7 @@ type ScriptEmbeddingCandidateRow = ScriptEmbeddingRow & {
   isScratch: number;
   typeChecked: number;
   fsMode: "none" | "workspace-rw";
+  executor: "native" | "quickjs" | null;
   createdByAgentId: string | null;
   createdAt: string;
   updatedAt: string;
@@ -70,6 +71,7 @@ function rowToScript(row: ScriptEmbeddingCandidateRow): ScriptRecord {
     isScratch: row.isScratch === 1,
     typeChecked: row.typeChecked === 1,
     fsMode: row.fsMode,
+    executor: row.executor ?? null,
     createdByAgentId: row.createdByAgentId ?? null,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,

package/src/be/scripts/run-saved.ts

@@ -50,6 +50,7 @@ export async function runSavedScriptAsAgent(
         source: args.script.source,
         args: args.input,
         fsMode: args.script.fsMode,
+        executor: args.script.executor,
         agentId: args.agentId,
         egressSecrets: credentials.egressSecrets,
         failedBindings: credentials.failedBindings,

package/src/be/scripts/typecheck.ts

@@ -33,6 +33,7 @@ export const SCRIPT_SDK_TYPES = `
 export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
 export type ScriptScope = "agent" | "global";
 export type ScriptFsMode = "none" | "workspace-rw";
+export type ScriptExecutorName = "native" | "quickjs";
 export type ScriptApiRawOptions = { raw: true };
 export type ScriptApiDefaultOptions = { raw?: false };
 export type RoutingReason = "skill" | "continuity" | "overflow" | "human_pinned" | "reroute_fault";
@@ -224,7 +225,7 @@ export interface SwarmSdk {
   schedule_list(args?: { enabled?: boolean; name?: string; scheduleType?: "recurring" | "one_time"; targetType?: "agent-task" | "workflow" | "script"; workflowId?: string; scriptName?: string; hideCompleted?: boolean; consecutiveErrorsMin?: number; lastRunStatus?: "failed" | "succeeded"; includeFull?: boolean }): Promise<unknown>;
   // --- scripts ---
   script_search(args: { query?: string; scope?: ScriptScope; limit?: number }): Promise<unknown>;
-  script_run(args: { name?: string; source?: string; args?: unknown; intent?: string; scope?: ScriptScope; fsMode?: ScriptFsMode; idempotencyKey?: string }): Promise<unknown>;
+  script_run(args: { name?: string; source?: string; args?: unknown; intent?: string; scope?: ScriptScope; fsMode?: ScriptFsMode; executor?: ScriptExecutorName | null; idempotencyKey?: string }): Promise<unknown>;
   // --- swarm / agent ---
   swarm_get(args?: { includeFull?: boolean }): Promise<unknown>;
   agent_info(args?: Record<string, unknown>): Promise<unknown>;
@@ -341,7 +342,12 @@ export interface SwarmSdk {
   workflow_patch(args: Record<string, unknown>): Promise<unknown>;
   workflow_patchNode(args: Record<string, unknown>): Promise<unknown>;
   workflow_delete(args: { id: string }): Promise<unknown>;
-  workflow_trigger(args: { id: string; triggerData?: Record<string, unknown> }): Promise<unknown>;
+  workflow_trigger(args: {
+    id: string;
+    triggerData?: Record<string, unknown>;
+    wait?: boolean;
+    idempotencyKey?: string;
+  }): Promise<unknown>;
   workflow_retryRun(args: { id: string }): Promise<unknown>;
   workflow_cancelRun(args: { id: string }): Promise<unknown>;
 
@@ -351,7 +357,7 @@ export interface SwarmSdk {
   prompt_preview(args: Record<string, unknown>): Promise<unknown>;
 
   // --- write: scripts ---
-  script_upsert(args: { name: string; source: string; description?: string; intent?: string; scope?: ScriptScope; fsMode?: ScriptFsMode }): Promise<unknown>;
+  script_upsert(args: { name: string; source: string; description?: string; intent?: string; scope?: ScriptScope; fsMode?: ScriptFsMode; executor?: ScriptExecutorName | null }): Promise<unknown>;
   script_delete(args: { name: string; scope?: ScriptScope }): Promise<unknown>;
   script_queryTypes(args: { name: string; scope?: ScriptScope }): Promise<unknown>;
   script_launchRun(args: { source: string; args?: unknown; idempotencyKey?: string; scriptName?: string; requestedByUserId?: string }): Promise<unknown>;

package/src/be/seed-skills/index.ts

@@ -208,6 +208,12 @@ import stepRunningConfig from "../../../templates/skills/step-running/config.jso
 import stepRunningContent from "../../../templates/skills/step-running/content.md" with {
   type: "text",
 };
+import swarmDocsConfig from "../../../templates/skills/swarm-docs/config.json" with {
+  type: "text",
+};
+import swarmDocsContent from "../../../templates/skills/swarm-docs/content.md" with {
+  type: "text",
+};
 import swarmExtensionsConfig from "../../../templates/skills/swarm-extensions/config.json" with {
   type: "text",
 };
@@ -367,6 +373,7 @@ const BUILT_IN_SKILL_SOURCES = [
   { config: reviewingConfig, body: reviewingContent },
   { config: scheduledTaskResilienceConfig, body: scheduledTaskResilienceContent },
   { config: schedulingConfig, body: schedulingContent },
+  { config: swarmDocsConfig, body: swarmDocsContent },
   { config: swarmExtensionsConfig, body: swarmExtensionsContent },
   { config: scriptBuilderConfig, body: scriptBuilderContent },
   { config: scriptWorkflowsConfig, body: scriptWorkflowsContent },

package/src/commands/onboard/compose-generator.ts

@@ -243,9 +243,11 @@ export function generateCompose(state: OnboardState): string {
     lines.push(`      - "${port}:3000"`);
     lines.push("");
     lines.push("    volumes:");
-    lines.push("      - swarm_logs:/app/logs");
-    lines.push("      - swarm_shared:/app/shared");
-    lines.push(`      - swarm_${svc.sanitizedName}:/app/agent`);
+    // Same targets as docker-compose.example.yml: the worker logs to /logs and
+    // keeps its clones and files under /workspace.
+    lines.push("      - swarm_logs:/logs");
+    lines.push("      - swarm_shared:/workspace/shared");
+    lines.push(`      - swarm_${svc.sanitizedName}:/workspace/personal`);
     if (state.provider === "bedrock" && state.awsProfile) {
       lines.push(engine === "podman" ? AWS_PROFILE_VOLUME_SELINUX : AWS_PROFILE_VOLUME);
     }

package/src/commands/provider-credentials.ts

@@ -49,6 +49,7 @@ import {
   CREDENTIAL_POOL_VARS,
   splitCredentialPool,
 } from "../utils/credentials";
+import { isEnvFlagEnabled } from "../utils/env-flag";
 import {
   checkAnthropicApiKey,
   checkDeepSeekApiKey,
@@ -664,7 +665,7 @@ export async function validateProviderCredentials(
  * the dashboard surfaces "unreported".
  */
 export function isCredCheckDisabled(env: NodeJS.ProcessEnv): boolean {
-  return env.CRED_CHECK_DISABLE === "1";
+  return isEnvFlagEnabled("CRED_CHECK_DISABLE", false, env);
 }
 
 /**

package/src/heartbeat/heartbeat.ts

@@ -83,6 +83,7 @@ import { DEFAULT_OPENROUTER_BASE_URL, getOpenRouterBaseUrl } from "../utils/open
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { getExecutorRegistry } from "../workflows";
 import { recoverIncompleteRuns } from "../workflows/recovery";
+import { probeScriptRunner } from "./script-runner-probe";
 // Side-effect import: registers heartbeat event templates in the in-memory registry
 import "./templates";
 
@@ -1703,8 +1704,20 @@ export async function defaultChecklistGateRunner(
   scriptName: string,
   leadAgentId: string,
   signal: AbortSignal,
-  deps: Parameters<typeof runSavedScriptAsAgent>[1] = {},
+  deps: Parameters<typeof runSavedScriptAsAgent>[1] & {
+    probe?: typeof probeScriptRunner;
+  } = {},
 ): Promise<unknown> {
+  try {
+    const unhealthy = await (deps.probe ?? probeScriptRunner)(leadAgentId);
+    if (unhealthy) return unhealthy;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      quiet: false,
+      reason: `script-runner-unhealthy: ${scrubSecrets(message)}`.slice(0, 300),
+    };
+  }
   const script = await getScript({ name: scriptName, scope: "global" });
   if (!script) throw new Error(`global script "${scriptName}" not found`);
   const output = await runSavedScriptAsAgent(