@desplega.ai/agent-swarm 2.6.0 → 2.7.0

package/dist/{http-9c6medda.js → http-haj1nd6k.js}

@@ -288,12 +288,15 @@ import {
   emitBudgetRefusalSideEffects,
   workflowModelErrors,
   patchWorkflowDefinition,
+  idempotencyKeyHeader,
+  readIdempotencyKey,
+  replayAcceptedOperation,
   resolveScriptsOnlyMode,
   ALL_CAPABILITIES,
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-4hxrf0p4.js";
+} from "./cli-6a9qfa8b.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -454,7 +457,6 @@ import {
   updateTaskProgress2,
   IdempotencyKeyTakenError,
   workflowRequestFingerprint,
-  findAcceptedWorkflowOperation,
   assertWorkflowIdempotencyKeyUnused,
   recordAcceptedWorkflowOperation,
   init_workflow_idempotency,
@@ -763,7 +765,7 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-48gxjmcz.js";
 import {
   PRIMARY_ROLE_NAMES2,
   getUserGrant2,
@@ -774,22 +776,22 @@ import {
   assertNotLastAdmin2,
   setUserRoles2,
   init_rbac_roles
-} from "./cli-a2rr0fmg.js";
-import"./cli-03gg9pd1.js";
+} from "./cli-8wmj18cz.js";
+import"./cli-rd5m70gj.js";
 import {
   normalizeModelKey
-} from "./cli-5sckpqcx.js";
+} from "./cli-d20qvpr2.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-aj8djyqt.js";
+} from "./cli-60sty27p.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-bqztfyve.js";
+} from "./cli-8mbc9za9.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -829,7 +831,7 @@ import {
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-3fwqy71j.js";
+} from "./cli-j0ppywdr.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -889,8 +891,10 @@ import {
   buildSandboxedCommand,
   sandboxSpawnEnv,
   readStreamCapped,
+  isExecutorAllowedByDeployment,
   MIN_SCRIPT_WALL_CLOCK_MS,
   MAX_SCRIPT_WALL_CLOCK_MS,
+  HOST_VALIDATED_ARGS,
   require_typescript2,
   checkImportAllowlist,
   runScriptWithRunCredential,
@@ -909,14 +913,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-3gfvmzht.js";
+} from "./cli-j9bpmykh.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-kf4jree9.js";
+} from "./cli-aypd09nf.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -949,9 +953,9 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-g20jjwt4.js";
-import"./cli-gnsb1zxa.js";
-import"./cli-v49fkghp.js";
+} from "./cli-m30k9777.js";
+import"./cli-s09j9vp5.js";
+import"./cli-1m9x8dr5.js";
 import {
   _fetchHolder,
   CLIENT_ID,
@@ -968,7 +972,7 @@ import {
 import {
   retryFailedRun2,
   cancelWorkflowRun2
-} from "./cli-3aqd4jaa.js";
+} from "./cli-twctnkng.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -1013,7 +1017,7 @@ import {
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-art7c1zh.js";
+} from "./cli-wqr7cea4.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -1041,7 +1045,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-gf95q3bm.js";
+} from "./cli-6srv653c.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -1057,8 +1061,8 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-emhjcj2y.js";
-import"./cli-d2dpf95n.js";
+} from "./cli-he9gbdx0.js";
+import"./cli-qj442fws.js";
 import {
   import_websocket,
   import_websocket_server
@@ -1067,7 +1071,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-c2habvsf.js";
+} from "./cli-9gsm2rzp.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1078,7 +1082,7 @@ import {
 } from "./cli-c081bj3b.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
-} from "./cli-7enjwya9.js";
+} from "./cli-vz78s5wm.js";
 import {
   isLeadChannelMonitoringEnabled,
   ORG_IDENTITY_KEYS,
@@ -1088,11 +1092,11 @@ import {
   isUnknownModelError,
   checkProviderPoolKey,
   writeSkillsToFilesystem
-} from "./cli-n7asmce6.js";
+} from "./cli-6mgdba42.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-6y51ryva.js";
+} from "./cli-b3yzyc57.js";
 import {
   Anthropic
 } from "./cli-rr7zx19j.js";
@@ -1132,7 +1136,7 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-a89zdqz9.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import"./cli-1f0gp9vz.js";
@@ -1265,6 +1269,7 @@ import {
   PromptTemplateHistorySchema,
   ScriptScopeSchema,
   ScriptFsModeSchema,
+  ScriptExecutorNameSchema,
   ScriptRecordSchema,
   ScriptVersionRecordSchema,
   ExtensionManifestSchema,
@@ -1297,12 +1302,12 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-4rf0f5vg.js";
+} from "./cli-9pshx6rd.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-hfeb68z4.js";
+} from "./cli-x37r7qwf.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
@@ -1325,7 +1330,7 @@ import {
   splitCredentialPool,
   selectCredential,
   init_credentials
-} from "./cli-1tem6ns9.js";
+} from "./cli-gt4h8cxw.js";
 import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
@@ -1339,7 +1344,7 @@ import {
   resolveTemplate,
   init_resolver,
   init_session_templates
-} from "./cli-dqygeeh5.js";
+} from "./cli-f1e0ptjj.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -1374,7 +1379,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-nn6vx2mq.js";
+} from "./cli-ptfq202x.js";
 import {
   realtimeBus,
   init_bus
@@ -5651,7 +5656,11 @@ var getAvailable = route({
     totalKeys: exports_coerce.number().int().min(1),
     scope: string2().optional(),
     scopeId: string2().optional(),
-    model: _enum2(["fable", "opus", "sonnet", "haiku"]).optional()
+    model: _enum2(["fable", "opus", "sonnet", "haiku"]).optional(),
+    keySuffixes: string2().transform((value) => value.split(",")).optional()
+  }).refine((query) => !query.keySuffixes || query.keySuffixes.length === query.totalKeys, {
+    message: "keySuffixes must list exactly totalKeys suffixes",
+    path: ["keySuffixes"]
   }),
   responses: {
     200: {
@@ -5986,9 +5995,9 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     const parsed = await getAvailable.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const { keyType, totalKeys, scope, scopeId, model } = parsed.query;
+    const { keyType, totalKeys, scope, scopeId, model, keySuffixes } = parsed.query;
     try {
-      const result = await getAvailableKeyIndices2(keyType, totalKeys, scope, scopeId ?? null, model);
+      const result = await getAvailableKeyIndices2(keyType, totalKeys, scope, scopeId ?? null, model, keySuffixes);
       getAvailable.respond(res, 200, {
         success: true,
         availableIndices: result.availableIndices,
@@ -26840,7 +26849,26 @@ var LOCAL_PAGE_APP_URL = "http://localhost:5274";
 function getAppBaseUrl2() {
   return getAppUrl(LOCAL_PAGE_APP_URL);
 }
-function buildCsp() {
+var FRAME_ANCESTOR_SOURCE_RE = /^(?:https?:\/\/)?(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::(?:\d{1,5}|\*))?$/i;
+var cachedFrameAncestors = null;
+function getPageFrameAncestors() {
+  const raw = process.env.PAGES_FRAME_ANCESTORS ?? "";
+  if (cachedFrameAncestors?.raw === raw)
+    return cachedFrameAncestors.origins;
+  const origins = [];
+  for (const entry of raw.split(/[\s,]+/)) {
+    const value = entry.replace(/\/+$/, "");
+    if (!value)
+      continue;
+    if (FRAME_ANCESTOR_SOURCE_RE.test(value))
+      origins.push(value);
+    else
+      console.warn(`[pages] ignoring invalid PAGES_FRAME_ANCESTORS entry: ${entry}`);
+  }
+  cachedFrameAncestors = { raw, origins };
+  return origins;
+}
+function buildCsp(page) {
   const configured = getConfiguredAppUrls();
   const devFallbacks = getNodeEnv() === "production" ? [] : [
     "http://localhost:5274",
@@ -26850,7 +26878,8 @@ function buildCsp() {
     "https://*.localhost",
     "http://*.localhost"
   ];
-  const ancestors = Array.from(new Set([...configured, ...devFallbacks]));
+  const embedders = page.authMode === "public" ? getPageFrameAncestors() : [];
+  const ancestors = Array.from(new Set([...configured, ...devFallbacks, ...embedders]));
   return [
     "default-src 'self'",
     "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://cdn.jsdelivr.net https://unpkg.com",
@@ -27016,7 +27045,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
       const headers = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-store",
-        "Content-Security-Policy": buildCsp(),
+        "Content-Security-Policy": buildCsp(page),
         "X-Content-Type-Options": "nosniff"
       };
       if (inlineSetCookie.length > 0)
@@ -27040,7 +27069,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
   const headers = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
-    "Content-Security-Policy": buildCsp(),
+    "Content-Security-Policy": buildCsp(page),
     "X-Content-Type-Options": "nosniff"
   };
   if (inlineSetCookie.length > 0)
@@ -32852,7 +32881,8 @@ var upsertBodySchema = object2({
   description: string2().default(""),
   intent: string2().default(""),
   scope: ScriptScopeSchema.default("agent"),
-  fsMode: ScriptFsModeSchema.default("none")
+  fsMode: ScriptFsModeSchema.default("none"),
+  executor: ScriptExecutorNameSchema.nullable().optional()
 });
 var runBodySchema = object2({
   name: scriptNameSchema.optional(),
@@ -32861,6 +32891,7 @@ var runBodySchema = object2({
   intent: string2().default(""),
   scope: ScriptScopeSchema.optional(),
   fsMode: ScriptFsModeSchema.default("none"),
+  executor: ScriptExecutorNameSchema.nullable().optional(),
   idempotencyKey: string2().max(200).optional()
 }).refine((body) => Boolean(body.name) !== Boolean(body.source), {
   message: "Provide exactly one of name or source"
@@ -33309,6 +33340,10 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
         return true;
       }
     }
+    if (parsed.body.executor && !isExecutorAllowedByDeployment(parsed.body.executor)) {
+      jsonError(res, 'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"', 400);
+      return true;
+    }
     const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
     if (secretRefusal) {
       json(res, secretRefusal, 400);
@@ -33336,6 +33371,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       signatureJson: signatureJsonFor(parsed.body.source),
       argsJsonSchema,
       fsMode: parsed.body.fsMode,
+      executor: parsed.body.executor,
       agentId: agent.id,
       isScratch: false,
       typeChecked: true,
@@ -33373,6 +33409,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     }
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
+    let executor = parsed.body.executor ?? null;
     let namedScript = null;
     if (parsed.body.name) {
       const script = await resolveScript(parsed.body.name, agent.id, parsed.body.scope);
@@ -33383,11 +33420,16 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       namedScript = script;
       source = script.source;
       fsMode = script.fsMode;
+      executor = parsed.body.executor !== undefined ? parsed.body.executor : script.executor;
     }
     if (fsMode === "workspace-rw") {
       jsonError(res, "workspace-rw scripts are not supported by /api/scripts/run in v1", 501);
       return true;
     }
+    if (executor && !isExecutorAllowedByDeployment(executor)) {
+      jsonError(res, 'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"', 400);
+      return true;
+    }
     const startedAt = new Date().toISOString();
     const runStartTouch = namedScript?.isScratch ? await touchScratchScriptLastUsed(namedScript.id) : null;
     const credentials = await buildScriptCredentialBindingsWithFailures({ agentId: agent.id });
@@ -33395,6 +33437,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       source,
       args: parsed.body.args,
       fsMode,
+      executor,
       agentId: agent.id,
       runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
@@ -33523,6 +33566,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       isScratch: script.isScratch,
       typeChecked: script.typeChecked,
       fsMode: script.fsMode,
+      executor: script.executor,
       createdByAgentId: script.createdByAgentId,
       createdAt: script.createdAt,
       updatedAt: script.updatedAt
@@ -40006,63 +40050,6 @@ init_db3();
 init_workflow_idempotency();
 init_workflow_runs();
 init_types();
-
-// src/http/idempotency-key.ts
-init_zod();
-init_workflow_idempotency();
-init_request_auth_context();
-var IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
-var IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";
-var idempotencyKeyHeader = (accepted) => object2({
-  "Idempotency-Key": string2().regex(IDEMPOTENCY_KEY_PATTERN).optional().describe("Optional client-generated key, 1-255 visible ASCII characters (a UUID works). " + `The first request the server accepts under a key ${accepted}; a retry with the same key ` + "and an equivalent body gets that request's status and body back (with " + `\`${IDEMPOTENT_REPLAYED_HEADER}: true\`) and changes nothing. The key is scoped to the ` + "caller's identity and this operation; it is not a credential. The same key with a " + "different body is a 409. A request rejected before it is accepted (validation, auth, " + "not found, disabled) does not use up the key. Accepted keys do not expire.")
-});
-function idempotencyPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  switch (auth?.kind) {
-    case "user":
-      return `user:${auth.userId}`;
-    case "agent":
-      return `agent:${auth.agentId}`;
-    case "controller":
-      return `controller:${auth.controllerId}`;
-    case "guest":
-      return null;
-    default:
-      return myAgentId ? `agent:${myAgentId}` : "operator";
-  }
-}
-function readIdempotencyKey(req, res, myAgentId) {
-  const raw = req.headers["idempotency-key"];
-  if (raw === undefined)
-    return;
-  const key = Array.isArray(raw) ? raw.join(", ") : raw;
-  if (!IDEMPOTENCY_KEY_PATTERN.test(key)) {
-    jsonError(res, "Idempotency-Key must be 1-255 visible ASCII characters", 400);
-    return null;
-  }
-  const principal = idempotencyPrincipal(req, myAgentId);
-  if (!principal) {
-    jsonError(res, "Idempotency-Key needs an identified caller", 400);
-    return null;
-  }
-  return { principal, key };
-}
-async function replayAcceptedOperation(res, claim, send) {
-  const accepted = await findAcceptedWorkflowOperation(claim);
-  if (!accepted)
-    return false;
-  if (accepted.fingerprint !== claim.fingerprint) {
-    jsonError(res, "Idempotency-Key was already used for a different request", 409);
-  } else if (accepted.resourceDeletedAt !== null) {
-    jsonError(res, "The workflow this Idempotency-Key created or triggered was deleted; send a new key to start over", 410);
-  } else {
-    res.setHeader(IDEMPOTENT_REPLAYED_HEADER, "true");
-    send(accepted.body);
-  }
-  return true;
-}
-
-// src/http/workflows.ts
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
   warnings: array2(string2()).optional()
@@ -40256,6 +40243,9 @@ var triggerWorkflowRoute = route({
   description: "With an `Idempotency-Key`, a retry returns the accepted run's `runId` and `skipped` without starting, resuming or waiting for anything, even after the workflow was disabled or edited and whatever state the run is in now.",
   tags: ["Workflows"],
   params: object2({ id: string2() }),
+  query: object2({
+    wait: _enum2(["true", "false"]).optional().describe("Default true: respond after the run's instant steps ran, when it finishes or parks at its first async step. " + "false: respond as soon as the run is committed and walk it in the background.")
+  }),
   headers: idempotencyKeyHeader("starts one run"),
   responses: {
     201: {
@@ -40854,6 +40844,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       runId = await startWorkflowExecution2(workflow, body, getExecutorRegistry2(), {
         triggerType: "api",
         requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined,
+        detach: parsed.query.wait === "false",
         accept: claim ? async (run) => {
           const response = { runId: run.runId, skipped: run.skipped };
           await recordAcceptedWorkflowOperation(claim, {
@@ -41098,6 +41089,7 @@ async function handleX(req, res, pathSegments) {
     jsonError(res, "workspace-rw scripts are not supported", 501);
     return true;
   }
+  let hostValidatedArgs = false;
   if (script.argsJsonSchema) {
     try {
       const schema = JSON.parse(script.argsJsonSchema);
@@ -41111,6 +41103,7 @@ async function handleX(req, res, pathSegments) {
         });
         return true;
       }
+      hostValidatedArgs = true;
     } catch {}
   }
   const timeoutMs = resolveTimeoutMs(req);
@@ -41122,7 +41115,9 @@ async function handleX(req, res, pathSegments) {
   const output = await runScriptWithRunCredential({
     source: script.source,
     args: args ?? null,
+    [HOST_VALIDATED_ARGS]: hostValidatedArgs,
     fsMode: "none",
+    executor: script.executor,
     agentId: endpoint.agentId,
     timeoutMs,
     egressSecrets: credentials.egressSecrets,
@@ -41373,7 +41368,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-r2za39ef.js");
+var { attachControllerTransport } = await import("./controllers-connect-nep9h2xv.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -41402,7 +41397,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-38t35h0n.js");
+    const { stopScheduler } = await import("./index-zyq8ct52.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -41413,8 +41408,8 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp2();
   await stopChatSdk();
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-em0117bp.js");
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
+    const { stopOAuthKeepalive } = await import("./keepalive-xdvsamvj.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -41494,21 +41489,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-ca84dhnn.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-yb75wv33.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-dw2tgb53.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-ca84dhnn.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-ca84dhnn.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -41516,7 +41511,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-qhjf2htm.js");
+  const { runAllSeeders } = await import("./index-jwt2bj6f.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -41579,42 +41574,42 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-38t35h0n.js");
-    const { getExecutorRegistry } = await import("./index-k0yt1tvq.js");
+    const { startScheduler } = await import("./index-zyq8ct52.js");
+    const { getExecutorRegistry } = await import("./index-z5h22pes.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-yqgbfgaj.js");
+    const { startHeartbeat } = await import("./index-y1ajx04a.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-em0117bp.js");
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
+    const { startOAuthKeepalive } = await import("./keepalive-xdvsamvj.js");
     startOAuthKeepalive();
   }
-  if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-xysj4yse.js");
+  if (!isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-jd4r7zbs.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-f4nn561n.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-5h37a2c2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-6c1sjfnr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-7h78vmvv.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-d4w9gajf.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-8mawd4gw.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
-  import("./session-source-backfill-qgtc86z1.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
+  import("./session-source-backfill-424wzv0r.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
     console.error("[session-source-backfill] startup run failed (non-fatal):", err);
   });
 }).on("error", (err) => {