@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/dist/{http-9c6medda.js → http-q6j4k989.js}

@@ -288,12 +288,15 @@ import {
   emitBudgetRefusalSideEffects,
   workflowModelErrors,
   patchWorkflowDefinition,
+  idempotencyKeyHeader,
+  readIdempotencyKey,
+  replayAcceptedOperation,
   resolveScriptsOnlyMode,
   ALL_CAPABILITIES,
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-4hxrf0p4.js";
+} from "./cli-pzafyqtk.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -335,7 +338,9 @@ import {
   init_asset_key_audit,
   CredentialBindingSchema,
   placeholderForConfigKey,
+  isPrivateAddress,
   assertUrlSafe,
+  init_egress_guard,
   init_credential_broker,
   encryptSecret,
   decryptSecret,
@@ -403,6 +408,7 @@ import {
   getAllTasks2,
   getTasksCount2,
   getTaskStats2,
+  getInProgressTasksByContextKey2,
   getLatestScriptRunStepTaskByContextKey2,
   init_read,
   MODEL_PROFILE_CONFIG_KEY,
@@ -454,7 +460,6 @@ import {
   updateTaskProgress2,
   IdempotencyKeyTakenError,
   workflowRequestFingerprint,
-  findAcceptedWorkflowOperation,
   assertWorkflowIdempotencyKeyUnused,
   recordAcceptedWorkflowOperation,
   init_workflow_idempotency,
@@ -521,6 +526,7 @@ import {
   searchMemoryCandidates,
   init_search_candidates,
   getEmbeddingProvider2,
+  resetEmbeddingProvider2,
   getMemoryStore2,
   init_memory,
   searchScripts,
@@ -763,7 +769,7 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-g8ka5j4j.js";
+} from "./cli-qvaa1gjp.js";
 import {
   PRIMARY_ROLE_NAMES2,
   getUserGrant2,
@@ -774,22 +780,22 @@ import {
   assertNotLastAdmin2,
   setUserRoles2,
   init_rbac_roles
-} from "./cli-a2rr0fmg.js";
-import"./cli-03gg9pd1.js";
+} from "./cli-hpkvgdad.js";
+import"./cli-typdpe8g.js";
 import {
   normalizeModelKey
-} from "./cli-5sckpqcx.js";
+} from "./cli-2sjm3t4r.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-aj8djyqt.js";
+} from "./cli-twjnyvs8.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
-} from "./cli-bqztfyve.js";
+} from "./cli-cb50g9cd.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -829,7 +835,7 @@ import {
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-3fwqy71j.js";
+} from "./cli-dv11pgpv.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -889,8 +895,10 @@ import {
   buildSandboxedCommand,
   sandboxSpawnEnv,
   readStreamCapped,
+  isExecutorAllowedByDeployment,
   MIN_SCRIPT_WALL_CLOCK_MS,
   MAX_SCRIPT_WALL_CLOCK_MS,
+  HOST_VALIDATED_ARGS,
   require_typescript2,
   checkImportAllowlist,
   runScriptWithRunCredential,
@@ -909,14 +917,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-3gfvmzht.js";
+} from "./cli-kbtdftbw.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-kf4jree9.js";
+} from "./cli-rm66vqdz.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -949,9 +957,9 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-g20jjwt4.js";
-import"./cli-gnsb1zxa.js";
-import"./cli-v49fkghp.js";
+} from "./cli-thsaq4pd.js";
+import"./cli-vhpckzvp.js";
+import"./cli-ekptgk2m.js";
 import {
   _fetchHolder,
   CLIENT_ID,
@@ -968,7 +976,7 @@ import {
 import {
   retryFailedRun2,
   cancelWorkflowRun2
-} from "./cli-3aqd4jaa.js";
+} from "./cli-3v2cyqb8.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -978,6 +986,7 @@ import {
   parseQueryParams,
   getPathSegments,
   wireHttpSpanLifecycle,
+  redactShareTokenInPath,
   safeRequestUrlForLog,
   agentWithCapacity,
   RequestBodyTooLargeError,
@@ -1007,13 +1016,15 @@ import {
   readableByFor2,
   SESSION_WRITE_DENIED2,
   hasSessionWrite2,
+  NOT_YOUR_TASK_DENIED2,
+  deniesNonOwnerTaskWrite2,
   denyParentAttach2,
   runtimeInstanceHeader,
   bodyTask,
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-art7c1zh.js";
+} from "./cli-hq2v4rr5.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -1041,7 +1052,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-gf95q3bm.js";
+} from "./cli-6vwjsetx.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -1051,14 +1062,17 @@ import"./cli-737pyqxr.js";
 import {
   startPoolRouting,
   stopPoolRouting,
+  INVITE_CODE_TTL_MS,
   DEFAULT_CONNECTOR_CODE_LABEL,
+  DEFAULT_INVITE_CODE_LABEL,
   createConnectorCode,
   exchangeConnectorCode,
+  deleteUnusedInviteCodes,
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-emhjcj2y.js";
-import"./cli-d2dpf95n.js";
+} from "./cli-5qt9vzmq.js";
+import"./cli-rg4b2g6j.js";
 import {
   import_websocket,
   import_websocket_server
@@ -1067,7 +1081,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-c2habvsf.js";
+} from "./cli-f3mzy662.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1078,7 +1092,7 @@ import {
 } from "./cli-c081bj3b.js";
 import {
   MAX_RATE_LIMIT_RESET_MS
-} from "./cli-7enjwya9.js";
+} from "./cli-vz78s5wm.js";
 import {
   isLeadChannelMonitoringEnabled,
   ORG_IDENTITY_KEYS,
@@ -1088,14 +1102,14 @@ import {
   isUnknownModelError,
   checkProviderPoolKey,
   writeSkillsToFilesystem
-} from "./cli-n7asmce6.js";
+} from "./cli-xbz6mcg4.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-6y51ryva.js";
+} from "./cli-x3cngb1h.js";
 import {
   Anthropic
-} from "./cli-rr7zx19j.js";
+} from "./cli-prcyzecg.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1112,6 +1126,7 @@ import {
   registerSessionTokenConnection,
   init_session_token_connections,
   findUserById,
+  findUserByEmail,
   getUserIdentities,
   listUserEvents,
   listUserTokens,
@@ -1132,7 +1147,7 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-esakngh8.js";
+} from "./cli-nf6k60sn.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import"./cli-1f0gp9vz.js";
@@ -1147,7 +1162,7 @@ import {
   clearAuditSink,
   can,
   init_rbac
-} from "./cli-4rvr7zfx.js";
+} from "./cli-k4awgvzm.js";
 import {
   ASSET_KEY_MAX_LENGTH,
   normalizeAssetKey,
@@ -1265,6 +1280,7 @@ import {
   PromptTemplateHistorySchema,
   ScriptScopeSchema,
   ScriptFsModeSchema,
+  ScriptExecutorNameSchema,
   ScriptRecordSchema,
   ScriptVersionRecordSchema,
   ExtensionManifestSchema,
@@ -1297,12 +1313,12 @@ import {
   KvKeySchema,
   KvEntrySchema,
   init_types
-} from "./cli-4rf0f5vg.js";
+} from "./cli-s504c3w7.js";
 import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-hfeb68z4.js";
+} from "./cli-kj69b9tw.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled
@@ -1325,7 +1341,7 @@ import {
   splitCredentialPool,
   selectCredential,
   init_credentials
-} from "./cli-1tem6ns9.js";
+} from "./cli-gt4h8cxw.js";
 import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
@@ -1339,7 +1355,7 @@ import {
   resolveTemplate,
   init_resolver,
   init_session_templates
-} from "./cli-dqygeeh5.js";
+} from "./cli-b41p764a.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -1374,25 +1390,28 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-nn6vx2mq.js";
-import {
-  realtimeBus,
-  init_bus
-} from "./cli-syfdvhkc.js";
+} from "./cli-swkx9jm2.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
+  DEFAULT_APP_URL,
   getConfiguredAppUrls,
   getAppUrl,
   getMcpBaseUrl,
   getPublicMcpBaseUrl,
   agentFsFileRoute,
+  isCombEnabled,
+  isAgentFsProxyEnabled,
   init_constants2
-} from "./cli-gf2850q7.js";
+} from "./cli-3cywb44q.js";
 import {
   parseEnvFlag,
   isEnvFlagEnabled,
   init_env_flag
 } from "./cli-cebvbc9t.js";
+import {
+  realtimeBus,
+  init_bus
+} from "./cli-syfdvhkc.js";
 import {
   getApiKey,
   init_api_key
@@ -4278,6 +4297,353 @@ async function handleActiveSessions(req, res, pathSegments, queryParams, myAgent
   return false;
 }
 
+// src/http/agentfs-proxy.ts
+init_api_key();
+init_constants2();
+import { Readable } from "node:stream";
+
+// src/http/ip-rate-limit.ts
+var PRUNE_THRESHOLD = 1e4;
+var PRUNE_INTERVAL_MS = 60000;
+var MAX_BUCKETS = 50000;
+function isPrivateAddress2(address) {
+  const ip = address.startsWith("::ffff:") ? address.slice(7) : address;
+  if (ip === "::1" || ip.startsWith("127.") || ip.startsWith("10."))
+    return true;
+  if (ip.startsWith("192.168.") || ip.startsWith("169.254."))
+    return true;
+  const match = /^172\.(\d+)\./.exec(ip);
+  if (match && Number(match[1]) >= 16 && Number(match[1]) <= 31)
+    return true;
+  const lower = ip.toLowerCase();
+  return lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+}
+function clientIp(req) {
+  const peer = req.socket.remoteAddress ?? "unknown";
+  if (!isPrivateAddress2(peer))
+    return peer;
+  const raw = req.headers["x-forwarded-for"];
+  const header = Array.isArray(raw) ? raw[raw.length - 1] : raw;
+  const hop = header?.split(",").pop()?.trim();
+  return hop || peer;
+}
+function createIpRateLimiter(options) {
+  const buckets = new Map;
+  let lastPruneAt = 0;
+  function refill(bucket, now) {
+    const elapsed = now - bucket.updatedAt;
+    bucket.tokens = Math.min(options.capacity, bucket.tokens + elapsed * options.refillPerMs);
+    bucket.updatedAt = now;
+  }
+  return {
+    take(ip, now = Date.now()) {
+      if (buckets.size > PRUNE_THRESHOLD && now - lastPruneAt >= PRUNE_INTERVAL_MS) {
+        lastPruneAt = now;
+        for (const [key, bucket] of buckets) {
+          refill(bucket, now);
+          if (bucket.tokens >= options.capacity)
+            buckets.delete(key);
+        }
+      }
+      let bucket = buckets.get(ip);
+      if (!bucket) {
+        if (buckets.size >= MAX_BUCKETS) {
+          const oldest = buckets.keys().next().value;
+          if (oldest !== undefined)
+            buckets.delete(oldest);
+        }
+        bucket = { tokens: options.capacity, updatedAt: now };
+        buckets.set(ip, bucket);
+      }
+      refill(bucket, now);
+      if (bucket.tokens < 1)
+        return false;
+      bucket.tokens -= 1;
+      return true;
+    },
+    reset() {
+      buckets.clear();
+      lastPruneAt = 0;
+    }
+  };
+}
+
+// src/http/agentfs-proxy.ts
+var API_PREFIX = "/agentfs";
+var PUBLIC_PREFIXES = ["/share/", "/site/"];
+function upstreamBase() {
+  const v = process.env.AGENT_FS_API_URL?.trim().replace(/\/+$/, "");
+  return v || null;
+}
+var REQUEST_HEADER_ALLOWLIST = [
+  "content-type",
+  "content-length",
+  "accept",
+  "if-match",
+  "if-none-match",
+  "range",
+  "x-agent-fs-message",
+  "x-agent-fs-message-encoding"
+];
+var AGENT_FS_BEARER = /^Bearer\s+af_\S+$/i;
+var RESPONSE_HEADER_ALLOWLIST = new Set([
+  "content-type",
+  "content-length",
+  "content-disposition",
+  "content-range",
+  "accept-ranges",
+  "etag",
+  "last-modified",
+  "cache-control",
+  "location",
+  "retry-after",
+  "content-security-policy",
+  "x-content-type-options",
+  "x-frame-options",
+  "referrer-policy",
+  "x-robots-tag",
+  "cross-origin-resource-policy"
+]);
+var EXPOSED_HEADERS = ["X-Agent-FS-Version", "X-Agent-FS-Content-Hash", "Content-Disposition"];
+var UNGATED = "agent-fs enforces its own af_ auth; register needs a swarm credential; swarm credentials are never forwarded";
+var OK_200 = {
+  description: "Upstream agent-fs response, streamed verbatim",
+  unstructured: "Body is streamed from agent-fs; shape and content-type vary per upstream route"
+};
+for (const method of ["get", "post", "put", "delete", "patch"]) {
+  route({
+    method,
+    path: "/agentfs/{path}",
+    pattern: ["agentfs", null],
+    exact: false,
+    summary: "Streaming pass-through proxy to agent-fs (enabled by AGENT_FS_PROXY)",
+    tags: ["Comb"],
+    responses: {
+      200: OK_200,
+      401: {
+        description: "Returned by agent-fs when credentials are missing or invalid, or by the swarm when POST /agentfs/auth/register has no swarm credential"
+      },
+      403: {
+        description: "POST /agentfs/auth/register with a user token for an email that is not the user's"
+      },
+      413: { description: "POST /agentfs/auth/register body over 16 KB" },
+      429: { description: "Too many registrations from this IP (POST /agentfs/auth/register)" },
+      502: { description: "agent-fs is unreachable" }
+    },
+    auth: { apiKey: false },
+    ...method === "get" ? {} : { rbac: { ungated: UNGATED } }
+  });
+}
+for (const prefix of ["share", "site"]) {
+  route({
+    method: "get",
+    path: `/${prefix}/{path}`,
+    pattern: [prefix, null],
+    exact: false,
+    summary: `Public agent-fs ${prefix} page, served through the API (enabled by AGENT_FS_PROXY)`,
+    tags: ["Comb"],
+    responses: {
+      200: {
+        description: `agent-fs /${prefix} response, streamed verbatim`,
+        unstructured: "HTML page or raw file streamed from agent-fs; content-type varies"
+      },
+      404: { description: "Unknown or expired link (from agent-fs), or the proxy is off" },
+      502: { description: "agent-fs is unreachable" }
+    },
+    auth: { apiKey: false }
+  });
+}
+var registerRateLimiter = createIpRateLimiter({ capacity: 5, refillPerMs: 5 / 60000 });
+var REGISTER_BODY_MAX_BYTES = 16 * 1024;
+async function checkRegister(req, res) {
+  const auth = await resolveHttpRequestAuth(req, getApiKey());
+  if (!auth || auth.page || auth.kind !== "operator" && auth.kind !== "user") {
+    jsonError(res, "Creating an agent-fs account here needs a swarm API key or user token", 401);
+    return null;
+  }
+  let body;
+  try {
+    body = await parseBody(req, REGISTER_BODY_MAX_BYTES);
+  } catch (err) {
+    if (err instanceof RequestBodyTooLargeError)
+      jsonError(res, "Request body too large", 413);
+    else
+      jsonError(res, "Invalid JSON body", 400);
+    return null;
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    jsonError(res, "Invalid JSON body", 400);
+    return null;
+  }
+  if (auth.kind === "user") {
+    const email = body.email;
+    const own = [auth.user.email, ...auth.user.emailAliases].filter((e) => typeof e === "string").map((e) => e.trim().toLowerCase());
+    if (typeof email !== "string" || !own.includes(email.trim().toLowerCase())) {
+      jsonError(res, "You can create an agent-fs account only for your own email", 403);
+      return null;
+    }
+  }
+  return JSON.stringify(body);
+}
+function routedPath(pathOnly) {
+  let decoded = pathOnly;
+  try {
+    decoded = decodeURIComponent(pathOnly);
+  } catch {}
+  return decoded.replace(/\/{2,}/g, "/").replace(/\/+$/, "");
+}
+function isNonCanonical(pathOnly) {
+  let decoded = pathOnly;
+  try {
+    decoded = decodeURIComponent(pathOnly);
+  } catch {}
+  for (const p of [pathOnly, decoded]) {
+    if (p.includes("\\"))
+      return true;
+    if (p.split("/").some((s) => s === "." || s === ".."))
+      return true;
+  }
+  return pathOnly.split("/").some((s) => /^(\.|%2e){1,2}$/i.test(s));
+}
+async function handleAgentFsProxy(req, res) {
+  const url = req.url ?? "";
+  const isApi = url.startsWith(`${API_PREFIX}/`);
+  const isPublicPage = !isApi && PUBLIC_PREFIXES.some((p) => url.startsWith(p));
+  if (!isApi && !isPublicPage)
+    return false;
+  const base = upstreamBase();
+  if (!base || !isAgentFsProxyEnabled())
+    return false;
+  const method = req.method ?? "GET";
+  const allowed = isApi ? ["GET", "POST", "PUT", "DELETE", "PATCH"] : ["GET"];
+  if (!allowed.includes(method))
+    return false;
+  const upstreamPath = isApi ? url.slice(API_PREFIX.length) : url;
+  const queryStart = upstreamPath.indexOf("?");
+  const pathOnly = queryStart === -1 ? upstreamPath : upstreamPath.slice(0, queryStart);
+  if (isNonCanonical(pathOnly)) {
+    jsonError(res, "Invalid path", 400);
+    return true;
+  }
+  const upstreamUrl = `${base}${upstreamPath}`;
+  let sentPath;
+  try {
+    const basePath = new URL(base).pathname.replace(/\/+$/, "");
+    sentPath = new URL(upstreamUrl).pathname.slice(basePath.length);
+  } catch {
+    jsonError(res, "Invalid path", 400);
+    return true;
+  }
+  const isRegister = isApi && method === "POST" && routedPath(sentPath) === "/auth/register";
+  if (isRegister && !registerRateLimiter.take(clientIp(req))) {
+    res.setHeader("Retry-After", "12");
+    jsonError(res, "rate_limited", 429);
+    return true;
+  }
+  const registerBody = isRegister ? await checkRegister(req, res) : null;
+  if (isRegister && registerBody === null)
+    return true;
+  const headers = new Headers;
+  const authorization = req.headers.authorization?.trim();
+  if (registerBody === null && authorization && AGENT_FS_BEARER.test(authorization) && authorization.replace(/^bearer\s+/i, "") !== getApiKey()) {
+    headers.set("authorization", authorization);
+  }
+  for (const name of REQUEST_HEADER_ALLOWLIST) {
+    const v = req.headers[name];
+    if (typeof v === "string")
+      headers.set(name, v);
+  }
+  if (registerBody !== null) {
+    headers.delete("content-length");
+    headers.set("content-type", "application/json");
+  }
+  const ac = new AbortController;
+  res.on("close", () => {
+    if (!res.writableEnded)
+      ac.abort();
+  });
+  const hasBody = method !== "GET" && method !== "DELETE";
+  let upstream;
+  try {
+    const init = {
+      method,
+      headers,
+      redirect: "manual",
+      signal: ac.signal
+    };
+    if (registerBody !== null) {
+      init.body = registerBody;
+    } else if (hasBody) {
+      init.body = Readable.toWeb(req);
+      init.duplex = "half";
+    }
+    upstream = await fetch(upstreamUrl, init);
+  } catch {
+    if (!res.headersSent && !res.destroyed)
+      jsonError(res, "agent-fs upstream unavailable", 502);
+    else
+      res.destroy();
+    return true;
+  }
+  if (isPublicPage) {
+    for (const name of res.getHeaderNames()) {
+      if (name.startsWith("access-control-"))
+        res.removeHeader(name);
+    }
+  }
+  const encoded = upstream.headers.has("content-encoding");
+  upstream.headers.forEach((value, name) => {
+    const n = name.toLowerCase();
+    const keep = RESPONSE_HEADER_ALLOWLIST.has(n) || n.startsWith("x-agent-fs-") || isPublicPage && n.startsWith("access-control-");
+    if (!keep)
+      return;
+    if (encoded && n === "content-length")
+      return;
+    res.setHeader(name, value);
+  });
+  if (isApi) {
+    const expose = res.getHeader("Access-Control-Expose-Headers");
+    if (typeof expose === "string" && expose !== "*") {
+      res.setHeader("Access-Control-Expose-Headers", `${expose}, ${EXPOSED_HEADERS.join(", ")}`);
+    }
+  }
+  res.writeHead(upstream.status);
+  if (!upstream.body) {
+    res.end();
+    return true;
+  }
+  await pump(upstream.body, res);
+  return true;
+}
+async function pump(body, res) {
+  const reader = body.getReader();
+  const closed = new Promise((resolve) => {
+    if (res.destroyed)
+      resolve();
+    else
+      res.once("close", () => resolve());
+  });
+  try {
+    for (;; ) {
+      if (res.destroyed)
+        break;
+      const { done, value } = await reader.read();
+      if (done) {
+        res.end();
+        break;
+      }
+      if (!res.write(value)) {
+        await Promise.race([new Promise((resolve) => res.once("drain", resolve)), closed]);
+      }
+    }
+  } catch {
+    res.destroy();
+  } finally {
+    reader.cancel().catch(() => {});
+  }
+  await closed;
+}
+
 // src/http/agents.ts
 init_src2();
 init_zod();
@@ -5651,7 +6017,11 @@ var getAvailable = route({
     totalKeys: exports_coerce.number().int().min(1),
     scope: string2().optional(),
     scopeId: string2().optional(),
-    model: _enum2(["fable", "opus", "sonnet", "haiku"]).optional()
+    model: _enum2(["fable", "opus", "sonnet", "haiku"]).optional(),
+    keySuffixes: string2().transform((value) => value.split(",")).optional()
+  }).refine((query) => !query.keySuffixes || query.keySuffixes.length === query.totalKeys, {
+    message: "keySuffixes must list exactly totalKeys suffixes",
+    path: ["keySuffixes"]
   }),
   responses: {
     200: {
@@ -5986,9 +6356,9 @@ async function handleApiKeys(req, res, pathSegments, queryParams) {
     const parsed = await getAvailable.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const { keyType, totalKeys, scope, scopeId, model } = parsed.query;
+    const { keyType, totalKeys, scope, scopeId, model, keySuffixes } = parsed.query;
     try {
-      const result = await getAvailableKeyIndices2(keyType, totalKeys, scope, scopeId ?? null, model);
+      const result = await getAvailableKeyIndices2(keyType, totalKeys, scope, scopeId ?? null, model, keySuffixes);
       getAvailable.respond(res, 200, {
         success: true,
         availableIndices: result.availableIndices,
@@ -8374,6 +8744,7 @@ var OnboardingStepIdSchema = _enum2([
   "agents",
   "memory",
   "integrations",
+  "files",
   "first_task"
 ]);
 var OnboardingErrorClassSchema = _enum2([
@@ -8409,6 +8780,14 @@ var OnboardingMemoryPresetSchema = _enum2([
   "custom",
   "existing"
 ]);
+var OnboardingMemoryProviderSchema = _enum2([
+  "local",
+  "openai",
+  "openrouter",
+  "vercel",
+  "azure",
+  "custom"
+]);
 var OnboardingIntegrationMethodSchema = _enum2([
   "slack",
   "github",
@@ -8417,6 +8796,7 @@ var OnboardingIntegrationMethodSchema = _enum2([
   "linear_oauth",
   "jira_oauth"
 ]);
+var OnboardingFilesMethodSchema = _enum2(["created", "connected"]);
 var OnboardingFirstTaskMethodSchema = _enum2(["suggestion", "free_form"]);
 var OnboardingStepMethodSchema = union2([
   OnboardingConnectMethodSchema,
@@ -8425,6 +8805,7 @@ var OnboardingStepMethodSchema = union2([
   OnboardingAgentsMethodSchema,
   OnboardingMemoryPresetSchema,
   OnboardingIntegrationMethodSchema,
+  OnboardingFilesMethodSchema,
   OnboardingFirstTaskMethodSchema
 ]);
 function onboardingStepStateSchema(method) {
@@ -8446,6 +8827,7 @@ var OnboardingAiStepStateSchema = onboardingStepStateSchema(OnboardingAiMethodSc
 var OnboardingAgentsStepStateSchema = onboardingStepStateSchema(OnboardingAgentsMethodSchema);
 var OnboardingMemoryStepStateSchema = onboardingStepStateSchema(OnboardingMemoryPresetSchema);
 var OnboardingIntegrationStepStateSchema = onboardingStepStateSchema(OnboardingIntegrationMethodSchema);
+var OnboardingFilesStepStateSchema = onboardingStepStateSchema(OnboardingFilesMethodSchema);
 var OnboardingFirstTaskStepStateSchema = onboardingStepStateSchema(OnboardingFirstTaskMethodSchema);
 var OnboardingStateSchema = object2({
   version: literal2(1),
@@ -8463,6 +8845,7 @@ var OnboardingStateSchema = object2({
     agents: OnboardingAgentsStepStateSchema,
     memory: OnboardingMemoryStepStateSchema,
     integrations: OnboardingIntegrationStepStateSchema,
+    files: OnboardingFilesStepStateSchema,
     first_task: OnboardingFirstTaskStepStateSchema
   })
 });
@@ -8477,7 +8860,11 @@ var OnboardingSignalsSchema = object2({
   })),
   embeddings: object2({
     configured: boolean(),
-    dimensions: number2().int().positive()
+    dimensions: number2().int().positive(),
+    model: string2().nullable(),
+    local: boolean(),
+    provider: OnboardingMemoryProviderSchema.nullable(),
+    localDefault: object2({ model: string2() }).nullable()
   }),
   integrations: object2({
     slack: boolean(),
@@ -8491,7 +8878,8 @@ var OnboardingSignalsSchema = object2({
     leadsOnline: number2().int().nonnegative(),
     workersOnline: number2().int().nonnegative()
   }),
-  firstTask: object2({ id: string2(), status: string2() }).nullable()
+  firstTask: object2({ id: string2(), status: string2() }).nullable(),
+  files: object2({ enabled: boolean() })
 });
 var OnboardingResponseSchema = object2({
   state: OnboardingStateSchema,
@@ -8524,9 +8912,14 @@ var OnboardingActionSchema = union2([
     step: literal2("integrations"),
     method: OnboardingIntegrationMethodSchema
   }).strict(),
+  object2({
+    action: literal2("complete"),
+    step: literal2("files"),
+    method: OnboardingFilesMethodSchema
+  }).strict(),
   object2({
     action: literal2("skip"),
-    step: _enum2(["name", "ai", "agents", "memory", "integrations", "first_task"])
+    step: _enum2(["name", "ai", "agents", "memory", "integrations", "files", "first_task"])
   }).strict(),
   object2({
     action: literal2("fail"),
@@ -8555,8 +8948,12 @@ var OnboardingMemoryRequestSchema = object2({
   baseUrl: OnboardingHttpUrlSchema.optional(),
   model: string2().trim().min(1).optional(),
   apiKey: string2().min(1).optional(),
-  reuseKey: _enum2(["OPENAI_API_KEY", "OPENROUTER_API_KEY"]).optional()
-}).strict();
+  reuseKey: _enum2(["OPENAI_API_KEY", "OPENROUTER_API_KEY"]).optional(),
+  restoreDefault: boolean().optional()
+}).strict().refine((body) => !body.restoreDefault || body.preset === "existing", {
+  message: "restoreDefault needs preset existing",
+  path: ["restoreDefault"]
+});
 var OnboardingMemoryResponseSchema = object2({
   ok: boolean(),
   dimensions: number2().int().positive().optional(),
@@ -8584,6 +8981,7 @@ function freshState(now, autoCompleted) {
       agents: emptyStep(),
       memory: emptyStep(),
       integrations: emptyStep(),
+      files: emptyStep(),
       first_task: emptyStep()
     }
   };
@@ -8742,6 +9140,14 @@ function deriveState(state, signals, funnelEvents) {
   }
   return changed;
 }
+function presentState(state, signals) {
+  if (signals.files.enabled || state.steps.files.status !== "todo")
+    return state;
+  return {
+    ...state,
+    steps: { ...state.steps, files: { ...state.steps.files, status: "skipped" } }
+  };
+}
 
 class OnboardingTaskNotFoundError extends Error {
 }
@@ -8811,7 +9217,7 @@ async function readOrUpdateOnboarding(loadSignals, action) {
       readOnly: true
     });
     if (!read.dirty)
-      return { state: read.state, signals: read.signals };
+      return { state: presentState(read.state, read.signals), signals: read.signals };
   }
   return await client.transaction(async () => {
     const events = [];
@@ -8826,20 +9232,30 @@ async function readOrUpdateOnboarding(loadSignals, action) {
     if (dirty)
       await persistState(state);
     queueTelemetry(events);
-    return { state, signals };
+    return { state: presentState(state, signals), signals };
   });
 }
-async function updateOnboardingMemory(preset, result, saveConfig) {
+var EMBEDDING_PREFIX_KEYS = [
+  "EMBEDDING_QUERY_PREFIX",
+  "EMBEDDING_DOCUMENT_PREFIX"
+];
+var EMBEDDING_CONFIG_KEYS = [
+  "EMBEDDING_API_BASE_URL",
+  "EMBEDDING_MODEL",
+  "EMBEDDING_API_KEY",
+  ...EMBEDDING_PREFIX_KEYS
+];
+async function updateOnboardingMemory(preset, result, change) {
   return await getDbClient2().transaction(async () => {
     const events = [];
     const loaded = await loadState(events);
     let dirty = loaded.dirty;
     const eventsForState = loaded.state.autoCompleted ? [] : events;
-    if (saveConfig) {
+    if (change?.kind === "save") {
       const configValues = [
-        ["EMBEDDING_API_BASE_URL", saveConfig.baseUrl],
-        ["EMBEDDING_MODEL", saveConfig.model],
-        ...saveConfig.apiKey ? [["EMBEDDING_API_KEY", saveConfig.apiKey]] : []
+        ["EMBEDDING_API_BASE_URL", change.baseUrl],
+        ["EMBEDDING_MODEL", change.model],
+        ...change.apiKey ? [["EMBEDDING_API_KEY", change.apiKey]] : []
       ];
       for (const [key, value] of configValues) {
         const validationError = validateConfigValue(key, value);
@@ -8849,17 +9265,26 @@ async function updateOnboardingMemory(preset, result, saveConfig) {
       await upsertSwarmConfig2({
         scope: "global",
         key: "EMBEDDING_API_BASE_URL",
-        value: saveConfig.baseUrl
+        value: change.baseUrl
       });
-      await upsertSwarmConfig2({ scope: "global", key: "EMBEDDING_MODEL", value: saveConfig.model });
-      if (saveConfig.apiKey) {
+      await upsertSwarmConfig2({ scope: "global", key: "EMBEDDING_MODEL", value: change.model });
+      if (change.apiKey) {
         await upsertSwarmConfig2({
           scope: "global",
           key: "EMBEDDING_API_KEY",
-          value: saveConfig.apiKey,
+          value: change.apiKey,
           isSecret: true
         });
       }
+      for (const { key, value } of change.prefixes) {
+        if (value === null)
+          await deleteSwarmConfigByKey2("global", null, key);
+        else
+          await upsertSwarmConfig2({ scope: "global", key, value });
+      }
+    } else if (change?.kind === "restore") {
+      for (const key of EMBEDDING_CONFIG_KEYS)
+        await deleteSwarmConfigByKey2("global", null, key);
     }
     if (result.ok) {
       dirty = completeStep(loaded.state, "memory", preset, false, eventsForState) || dirty;
@@ -8869,7 +9294,7 @@ async function updateOnboardingMemory(preset, result, saveConfig) {
     if (dirty)
       await persistState(loaded.state);
     queueTelemetry(events);
-    return saveConfig !== undefined;
+    return change !== undefined;
   });
 }
 async function updateOnboardingAiFromCodexDevice(result) {
@@ -9143,6 +9568,9 @@ async function completeFlow(flowId, credentials) {
       isSecret: true,
       description: `Codex ChatGPT OAuth credentials slot ${slot} (stored by dashboard device login)`
     });
+    const keySuffix = deriveCodexKeySuffix(credentials.access, credentials.accountId);
+    const checked = [{ keyIndex: slot, keySuffix, ok: true }];
+    await recordKeyValidation2("CODEX_OAUTH", checked, "global", null, { retireAbsent: false });
     await updateOnboardingAiFromCodexDevice({ status: "complete" });
     state.status = "complete";
     state.slot = slot;
@@ -14031,6 +14459,7 @@ ${block}`, new Date().toISOString(), taskId]);
 }
 
 // src/http/fs.ts
+init_rbac_roles();
 init_rbac();
 init_types();
 
@@ -14076,7 +14505,11 @@ var agentFsCredentialStateSchema = object2({
 });
 var agentFsInviteStateSchema = object2({
   orgId: string2(),
-  invited: boolean()
+  invited: boolean().describe("False only when the email already holds the requested role."),
+  status: _enum2(["already_member", "added", "pending"]).describe("already_member: no change. added: an existing agent-fs account joined the org. pending: the email has no account, so agent-fs created an invite the person must accept."),
+  inviteId: string2().optional().describe("Pending invite id (status pending)."),
+  expiresAt: string2().optional().describe("ISO time the accept link expires (status pending)."),
+  acceptUrl: string2().optional().describe("Link the invitee opens to accept (status pending). agent-fs sends no email, so hand it to the person. Absent when agent-fs has no app URL configured.")
 });
 var signedUrlResponseSchema = object2({
   url: string2(),
@@ -14116,21 +14549,23 @@ var inviteMemberRoute = route({
   path: "/api/fs/members/invite",
   pattern: ["api", "fs", "members", "invite"],
   summary: "Invite an external member into the agent-fs shared org",
-  description: "The API server performs the invite with its own bootstrap credentials (which are API-only and never served over HTTP), provisioning the shared org/drive first when needed. Intended for the cloud control plane's Connect-to-Drive flow. No keys are returned; the invitee obtains their own key via agent-fs registration.",
+  description: "The API server performs the invite with its own bootstrap credentials (which are API-only and never served over HTTP), provisioning the shared org/drive first when needed. Intended for the cloud control plane's Connect-to-Drive flow. An email with an agent-fs account is added directly (status added). An email without one gets a pending invite (status pending) with an acceptUrl when agent-fs returns one; agent-fs sends no email, so the caller must hand the link to the invitee. No keys are returned; the invitee obtains their own key via agent-fs registration.",
   tags: ["FS"],
   body: object2({
     email: email(),
     role: _enum2(["viewer", "editor", "admin"]).default("editor")
   }),
   responses: {
-    200: { description: "Invite state ({ orgId, invited })", schema: agentFsInviteStateSchema },
+    200: {
+      description: "Invite state ({ orgId, invited, status, acceptUrl? })",
+      schema: agentFsInviteStateSchema
+    },
     400: { description: "Invalid body" },
+    403: { description: "A non-admin user token named an email other than its own" },
     500: { description: "Provisioning or invite failed" }
   },
   auth: { apiKey: true },
-  rbac: {
-    ungated: "Tenant API key is the org-owner credential; the invite runs under the API server's own bootstrap identity, no per-agent principal applies."
-  }
+  rbac: { permission: "fs.join.own" }
 });
 var listTaskFilesRoute = route({
   method: "get",
@@ -14229,6 +14664,27 @@ var deleteTaskFileRoute = route({
   auth: { apiKey: true, agentId: true },
   rbac: { permission: "task.fs.mutate" }
 });
+async function resolveInvite(req, body) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled())
+    return body;
+  const grant = await getUserGrant2(auth.userId);
+  if (grant.grantsAll)
+    return body;
+  const decision = can({
+    principal: { kind: "user", userId: auth.userId },
+    verb: "fs.join.own",
+    resource: { kind: "none" },
+    source: "http"
+  });
+  if (!decision.allow)
+    return { denied: decision.reason };
+  const ownEmail = auth.user.email?.trim();
+  if (!ownEmail || ownEmail.toLowerCase() !== body.email.trim().toLowerCase()) {
+    return { denied: "You can only join the shared drive with your own account email" };
+  }
+  return { email: ownEmail, role: grant.verbs.has("task.fs.mutate") ? "editor" : "viewer" };
+}
 async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
   if (ensureAgentCredentialsRoute.match(req.method, pathSegments)) {
     const parsed = await ensureAgentCredentialsRoute.parse(req, res, pathSegments, queryParams);
@@ -14253,8 +14709,13 @@ async function handleFs(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await inviteMemberRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const invite = await resolveInvite(req, parsed.body);
+    if ("denied" in invite) {
+      jsonError(res, invite.denied, 403);
+      return true;
+    }
     try {
-      const result = await inviteEmailToSharedOrg(parsed.body.email, parsed.body.role);
+      const result = await inviteEmailToSharedOrg(invite.email, invite.role);
       inviteMemberRoute.respond(res, 200, result);
     } catch (error) {
       const message = scrubSecrets(error instanceof Error ? error.message : String(error));
@@ -14591,7 +15052,10 @@ async function handleHeartbeat(req, res, pathSegments) {
 // src/http/inbox-state.ts
 init_zod();
 init_db3();
+init_rbac_roles();
+init_rbac();
 init_types();
+init_request_auth_context();
 var listState = route({
   method: "get",
   path: "/api/inbox-state",
@@ -14634,9 +15098,11 @@ var upsertState = route({
       schema: object2({ item: InboxItemStateSchema })
     },
     400: { description: "Validation error" },
-    401: { description: "Unauthorized" }
+    401: { description: "Unauthorized" },
+    403: { description: "A non-admin user token wrote another user's state" }
   },
-  auth: { apiKey: true }
+  auth: { apiKey: true },
+  rbac: { permission: "favorite.write.own" }
 });
 var bulkUpsertState = route({
   method: "patch",
@@ -14654,11 +15120,19 @@ var bulkUpsertState = route({
       schema: object2({ items: array2(InboxItemStateSchema) })
     },
     400: { description: "Validation error" },
-    401: { description: "Unauthorized" }
+    401: { description: "Unauthorized" },
+    403: { description: "A non-admin user token wrote another user's state" }
   },
   auth: { apiKey: true },
-  rbac: { ungated: "per-user inbox UI state, same posture as PATCH /api/inbox-state" }
+  rbac: { permission: "favorite.write.own" }
 });
+var OTHER_USER_STATE_DENIED = "You can only change your own inbox state";
+async function writesOtherUsersState(req, userId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || auth.userId === userId || !isRbacEnabled())
+    return false;
+  return !(await getUserGrant2(auth.userId)).grantsAll;
+}
 async function handleInboxState(req, res, pathSegments, queryParams) {
   if (listState.match(req.method, pathSegments)) {
     const parsed = await listState.parse(req, res, pathSegments, queryParams);
@@ -14676,6 +15150,10 @@ async function handleInboxState(req, res, pathSegments, queryParams) {
     const parsed = await bulkUpsertState.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    if (await writesOtherUsersState(req, parsed.body.userId)) {
+      jsonError(res, OTHER_USER_STATE_DENIED, 403);
+      return true;
+    }
     try {
       const items = await getDbClient2().transaction(async () => {
         const rows = [];
@@ -14694,6 +15172,10 @@ async function handleInboxState(req, res, pathSegments, queryParams) {
     const parsed = await upsertState.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    if (await writesOtherUsersState(req, parsed.body.userId)) {
+      jsonError(res, OTHER_USER_STATE_DENIED, 403);
+      return true;
+    }
     try {
       const item = await upsertInboxState2({
         userId: parsed.body.userId,
@@ -15815,7 +16297,7 @@ import { randomUUID as randomUUID2 } from "node:crypto";
 // node_modules/@hono/node-server/dist/index.mjs
 import { Http2ServerRequest as Http2ServerRequest2, constants as h2constants } from "http2";
 import { Http2ServerRequest } from "http2";
-import { Readable } from "stream";
+import { Readable as Readable2 } from "stream";
 import crypto2 from "crypto";
 var RequestError = class extends Error {
   constructor(message, options) {
@@ -15882,7 +16364,7 @@ var newRequestFromIncoming = (method, url, headers, incoming, abortController) =
       init.body = new ReadableStream({
         async pull(controller) {
           try {
-            reader ||= Readable.toWeb(incoming).getReader();
+            reader ||= Readable2.toWeb(incoming).getReader();
             const { done, value } = await reader.read();
             if (done) {
               controller.close();
@@ -15895,7 +16377,7 @@ var newRequestFromIncoming = (method, url, headers, incoming, abortController) =
         }
       });
     } else {
-      init.body = Readable.toWeb(incoming);
+      init.body = Readable2.toWeb(incoming);
     }
   }
   return new Request2(url, init);
@@ -19795,7 +20277,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
     try {
       const provider = getEmbeddingProvider2();
       const store = getMemoryStore2();
-      const queryEmbedding = await provider.embed(query);
+      const queryEmbedding = await provider.embed(query, { kind: "query" });
       const candidateLimit = Math.min(limit, 20) * CANDIDATE_SET_MULTIPLIER;
       const candidates = await searchMemoryCandidates(store, queryEmbedding ?? new Float32Array(0), myAgentId, {
         scope,
@@ -19876,7 +20358,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
     try {
       if (query && query.trim().length > 0) {
         const provider = getEmbeddingProvider2();
-        const queryEmbedding = await provider.embed(query.trim());
+        const queryEmbedding = await provider.embed(query.trim(), { kind: "query" });
         const candidateLimit = Math.min(4096, Math.max(offset + pageLimit, pageLimit) * CANDIDATE_SET_MULTIPLIER);
         let candidates = await searchMemoryCandidates(store, queryEmbedding ?? new Float32Array(0), viewer.agentId, {
           scope,
@@ -20091,7 +20573,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
       });
       if (result.changed) {
         const provider = getEmbeddingProvider2();
-        const embedding = await provider.embed(result.memory.content);
+        const embedding = await provider.embed(result.memory.content, { kind: "document" });
         if (embedding)
           await store.updateEmbedding(result.memory.id, embedding, provider.name);
         try {
@@ -20169,7 +20651,7 @@ async function handleMemory(req, res, pathSegments, callerAgentId) {
       for (let i = 0;i < memories.length; i += batchSize) {
         const batch = memories.slice(i, i + batchSize);
         try {
-          const embeddings = await provider.embedBatch(batch.map((m) => m.content));
+          const embeddings = await provider.embedBatch(batch.map((m) => m.content), { kind: "document" });
           for (let j = 0;j < embeddings.length; j++) {
             if (embeddings[j]) {
               await store.updateEmbedding(batch[j].id, embeddings[j], provider.name);
@@ -21900,7 +22382,9 @@ init_db3();
 init_memory();
 init_constants();
 init_types();
+init_constants2();
 init_credentials();
+init_egress_guard();
 init_openrouter_base_url();
 
 // src/http/status.ts
@@ -22492,6 +22976,58 @@ async function handleStatus(req, res, pathSegments, queryParams) {
 }
 
 // src/http/onboarding.ts
+function isLocalEndpoint(baseUrl) {
+  if (!baseUrl?.trim())
+    return false;
+  let host;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  if (!host)
+    return false;
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return true;
+  if (isPrivateAddress(host))
+    return true;
+  return !host.includes(".") && !host.includes(":");
+}
+var PRESET_HOSTS = [
+  ["openai", (host) => host === "api.openai.com"],
+  ["openrouter", (host) => host === "openrouter.ai"],
+  ["vercel", (host) => host === "ai-gateway.vercel.sh"],
+  [
+    "azure",
+    (host) => [".services.ai.azure.com", ".openai.azure.com", ".cognitiveservices.azure.com"].some((suffix) => host.endsWith(suffix))
+  ]
+];
+function embeddingsProvider(baseUrl) {
+  if (isLocalEndpoint(baseUrl))
+    return "local";
+  if (!baseUrl?.trim())
+    return "openai";
+  let host;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return "custom";
+  }
+  return PRESET_HOSTS.find(([, matches]) => matches(host))?.[0] ?? "custom";
+}
+function deploymentEmbeddings() {
+  return {
+    baseUrl: getDeploymentEnvValue("EMBEDDING_API_BASE_URL"),
+    model: getDeploymentEnvValue("EMBEDDING_MODEL") ?? "text-embedding-3-small",
+    apiKey: getDeploymentEnvValue("EMBEDDING_API_KEY") ?? process.env.OPENAI_API_KEY
+  };
+}
+function localDefault() {
+  const deployment = deploymentEmbeddings();
+  if (!isLocalEndpoint(deployment.baseUrl) || !deployment.apiKey)
+    return null;
+  return { model: deployment.model };
+}
 async function buildSignals(state) {
   const providers = [];
   for (const entry of await getAgentHarnessProviders2()) {
@@ -22512,11 +23048,16 @@ async function buildSignals(state) {
   const integrations = await getAutomationSetupStates();
   const agentCounts = await getReadyAgentCounts2();
   const firstTask = state.firstTaskId ? await getTaskById2(state.firstTaskId) : null;
+  const embeddingsOn = getEmbeddingProvider2().isConfigured();
   return {
     providers,
     embeddings: {
-      configured: getEmbeddingProvider2().isConfigured(),
-      dimensions: EMBEDDING_DIMENSIONS
+      configured: embeddingsOn,
+      dimensions: EMBEDDING_DIMENSIONS,
+      model: embeddingsOn ? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small" : null,
+      local: embeddingsOn && isLocalEndpoint(process.env.EMBEDDING_API_BASE_URL),
+      provider: embeddingsOn ? embeddingsProvider(process.env.EMBEDDING_API_BASE_URL) : null,
+      localDefault: localDefault()
     },
     integrations: {
       slack: integrations.slack === "configured",
@@ -22530,7 +23071,8 @@ async function buildSignals(state) {
       leadsOnline: agentCounts.leads,
       workersOnline: agentCounts.workers
     },
-    firstTask: firstTask ? { id: firstTask.id, status: firstTask.status } : null
+    firstTask: firstTask ? { id: firstTask.id, status: firstTask.status } : null,
+    files: { enabled: isCombEnabled() }
   };
 }
 var getOnboarding = route({
@@ -22627,19 +23169,34 @@ function memoryErrorMessage(errorClass, status) {
       return `The endpoint returned an error${statusSuffix}.`;
   }
 }
-async function updateMemoryState(preset, result, saveConfig) {
-  const configSaved = await updateOnboardingMemory(preset, result, saveConfig);
-  if (configSaved)
-    scheduleIntegrationsReload();
+async function updateMemoryState(preset, result, change) {
+  const configChanged = await updateOnboardingMemory(preset, result, change);
+  if (!configChanged)
+    return;
+  if (change?.kind === "restore") {
+    await loadGlobalConfigsIntoEnv(true);
+    resetEmbeddingProvider2();
+  }
+  scheduleIntegrationsReload();
+}
+function prefixChanges(model) {
+  const sameModel = model === getDeploymentEnvValue("EMBEDDING_MODEL");
+  return EMBEDDING_PREFIX_KEYS.filter((key) => getDeploymentEnvValue(key)).map((key) => ({
+    key,
+    value: sameModel ? null : ""
+  }));
 }
 async function handleMemoryProbe(body) {
   const explicitKey = body.apiKey;
   const preset = body.preset === "openai" || body.preset === "openrouter" || body.preset === "vercel" ? MEMORY_PRESETS[body.preset] : undefined;
-  const baseUrl = body.preset === "existing" ? process.env.EMBEDDING_API_BASE_URL : body.baseUrl ?? preset?.baseUrl ?? process.env.EMBEDDING_API_BASE_URL ?? "https://api.openai.com/v1";
-  const model = body.preset === "existing" ? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small" : body.model ?? preset?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small";
+  const restore = body.preset === "existing" && body.restoreDefault === true;
+  const deployment = restore ? deploymentEmbeddings() : null;
+  const baseUrl = body.preset === "existing" ? deployment ? deployment.baseUrl : process.env.EMBEDDING_API_BASE_URL : body.baseUrl ?? preset?.baseUrl ?? process.env.EMBEDDING_API_BASE_URL ?? "https://api.openai.com/v1";
+  const model = body.preset === "existing" ? deployment?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small" : body.model ?? preset?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small";
+  const configuredEndpoint = body.preset === "existing" && !!baseUrl && baseUrl === getDeploymentEnvValue("EMBEDDING_API_BASE_URL");
   let endpoint;
   try {
-    endpoint = assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
+    endpoint = configuredEndpoint ? new URL(baseUrl ?? "") : assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
   } catch {
     return {
       ok: false,
@@ -22651,7 +23208,7 @@ async function handleMemoryProbe(body) {
   const reuseHost = body.reuseKey === "OPENAI_API_KEY" ? "api.openai.com" : body.reuseKey === "OPENROUTER_API_KEY" ? "openrouter.ai" : undefined;
   const canReuseKey = reuseHost === undefined || endpoint.hostname === reuseHost;
   const reusedKey = !explicitKey && body.reuseKey && canReuseKey ? process.env[body.reuseKey] : undefined;
-  const implicitKey = body.preset === "existing" ? process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY : undefined;
+  const implicitKey = body.preset === "existing" ? deployment ? deployment.apiKey : process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY : undefined;
   const apiKey = splitCredentialPool(explicitKey ?? reusedKey ?? implicitKey ?? "")[0];
   if (!apiKey) {
     return {
@@ -22689,10 +23246,12 @@ async function handleMemoryProbe(body) {
       };
     }
     const keyToSave = explicitKey || reusedKey ? apiKey : undefined;
-    await updateMemoryState(body.preset, { ok: true }, body.preset === "existing" ? undefined : {
+    await updateMemoryState(body.preset, { ok: true }, body.preset === "existing" ? restore ? { kind: "restore" } : undefined : {
+      kind: "save",
       baseUrl: baseUrl ?? "https://api.openai.com/v1",
       model,
-      apiKey: keyToSave
+      apiKey: keyToSave,
+      prefixes: prefixChanges(model)
     });
     return { ok: true, dimensions, latencyMs };
   } catch (error) {
@@ -22971,6 +23530,7 @@ init_request_auth_context();
 init_zod();
 init_db3();
 init_model_profiles();
+init_rbac_roles();
 init_steering();
 init_users();
 init_rbac();
@@ -23147,6 +23707,7 @@ var createTask = route({
   path: "/api/tasks",
   pattern: ["api", "tasks"],
   session: bodyTask("parentTaskId"),
+  rbac: { permission: "task.create.own" },
   summary: "Create a new task",
   tags: ["Tasks"],
   body: object2({
@@ -23253,6 +23814,7 @@ var cancelTaskRoute = route({
   path: "/api/tasks/{id}/cancel",
   pattern: ["api", "tasks", null, "cancel"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.cancel.own" },
   summary: "Cancel a pending or in-progress task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -23503,6 +24065,7 @@ var pauseTaskRoute = route({
   path: "/api/tasks/{id}/pause",
   pattern: ["api", "tasks", null, "pause"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Pause an in-progress task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -23518,6 +24081,7 @@ var resumeTaskRoute = route({
   path: "/api/tasks/{id}/resume",
   pattern: ["api", "tasks", null, "resume"],
   session: { taskParam: "id" },
+  rbac: { permission: "task.action.own" },
   summary: "Resume a paused task",
   tags: ["Tasks"],
   params: object2({ id: string2() }),
@@ -23587,9 +24151,7 @@ var updateTaskTitleRoute = route({
     404: { description: "Task not found" }
   },
   auth: { apiKey: true },
-  rbac: {
-    ungated: "mirrors the pre-RBAC PATCH /api/tasks/{id}/vcs sibling route: bearer auth only"
-  }
+  rbac: { permission: "task.action.own" }
 });
 async function canSteerTask(req, myAgentId, task, sessionAccess = "none") {
   const auth = getRequestAuth(req);
@@ -23659,6 +24221,34 @@ async function resolveTaskWritePrincipal(req, myAgentId) {
   const agent = await getAgentById2(agentId);
   return { kind: "agent", agentId, isLead: agent?.isLead === true };
 }
+async function mayBindChatThread(principal) {
+  if (principal.kind === "operator")
+    return true;
+  if (principal.kind === "user") {
+    if (!isRbacEnabled())
+      return true;
+    const grant = await getUserGrant2(principal.userId);
+    return grant.grantsAll || grant.verbs.has("integration.chat.post");
+  }
+  return can({
+    principal,
+    verb: "integration.chat.post",
+    resource: { kind: "none" },
+    source: "http"
+  }).allow;
+}
+async function deniesForeignContext(req, contextKey) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled())
+    return false;
+  if ((await getUserGrant2(auth.userId)).grantsAll)
+    return false;
+  for (const task of await getInProgressTasksByContextKey2(contextKey)) {
+    if (await deniesNonOwnerTaskWrite2(req, task))
+      return true;
+  }
+  return false;
+}
 async function resolveTaskRequester(req, myAgentId, bodyUserId, trustedUserId) {
   const trusted = trustedUserId === undefined ? await resolveHttpAuditUserId(req, myAgentId) : trustedUserId;
   if (trusted)
@@ -23774,8 +24364,12 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     if (parentTask && await denyParentAttach2(req, res, myAgentId, parentTask, principal)) {
       return true;
     }
-    if (principal.kind === "agent" && parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !can({ principal, verb: "integration.chat.post", resource: { kind: "none" }, source: "http" }).allow) {
-      jsonError(res, "Permission denied: only a lead can bind a task to a chat thread.", 403);
+    if (parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && chatThreadOfContextKey(parsed.body.contextKey) && !await mayBindChatThread(principal)) {
+      jsonError(res, "Permission denied: only a lead or an admin can bind a task to a chat thread.", 403);
+      return true;
+    }
+    if (parsed.body.contextKey && parsed.body.contextKey !== parentTask?.contextKey && await deniesForeignContext(req, parsed.body.contextKey)) {
+      jsonError(res, "You don't have access to the tasks in this context.", 403);
       return true;
     }
     let assetKey;
@@ -23895,6 +24489,10 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (await deniesNonOwnerTaskWrite2(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED2, 403);
+      return true;
+    }
     const principal = await resolveTaskWritePrincipal(req, myAgentId);
     if (principal.kind === "agent" && !can({
       principal,
@@ -24386,6 +24984,10 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (await deniesNonOwnerTaskWrite2(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED2, 403);
+      return true;
+    }
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;
@@ -24446,6 +25048,15 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await updateTaskTitleRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const existing = await getTaskById2(parsed.params.id);
+    if (!existing) {
+      jsonError(res, "Task not found", 404);
+      return true;
+    }
+    if (await deniesNonOwnerTaskWrite2(req, existing)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED2, 403);
+      return true;
+    }
     const task = await updateTaskTitle2(parsed.params.id, parsed.body.title);
     if (!task) {
       jsonError(res, "Task not found", 404);
@@ -24463,6 +25074,10 @@ async function handleTasks(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (await deniesNonOwnerTaskWrite2(req, task)) {
+      jsonError(res, NOT_YOUR_TASK_DENIED2, 403);
+      return true;
+    }
     if (myAgentId && task.agentId !== myAgentId) {
       jsonError(res, "Task belongs to another agent", 403);
       return true;
@@ -26840,7 +27455,26 @@ var LOCAL_PAGE_APP_URL = "http://localhost:5274";
 function getAppBaseUrl2() {
   return getAppUrl(LOCAL_PAGE_APP_URL);
 }
-function buildCsp() {
+var FRAME_ANCESTOR_SOURCE_RE = /^(?:https?:\/\/)?(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::(?:\d{1,5}|\*))?$/i;
+var cachedFrameAncestors = null;
+function getPageFrameAncestors() {
+  const raw = process.env.PAGES_FRAME_ANCESTORS ?? "";
+  if (cachedFrameAncestors?.raw === raw)
+    return cachedFrameAncestors.origins;
+  const origins = [];
+  for (const entry of raw.split(/[\s,]+/)) {
+    const value = entry.replace(/\/+$/, "");
+    if (!value)
+      continue;
+    if (FRAME_ANCESTOR_SOURCE_RE.test(value))
+      origins.push(value);
+    else
+      console.warn(`[pages] ignoring invalid PAGES_FRAME_ANCESTORS entry: ${entry}`);
+  }
+  cachedFrameAncestors = { raw, origins };
+  return origins;
+}
+function buildCsp(page) {
   const configured = getConfiguredAppUrls();
   const devFallbacks = getNodeEnv() === "production" ? [] : [
     "http://localhost:5274",
@@ -26850,7 +27484,8 @@ function buildCsp() {
     "https://*.localhost",
     "http://*.localhost"
   ];
-  const ancestors = Array.from(new Set([...configured, ...devFallbacks]));
+  const embedders = page.authMode === "public" ? getPageFrameAncestors() : [];
+  const ancestors = Array.from(new Set([...configured, ...devFallbacks, ...embedders]));
   return [
     "default-src 'self'",
     "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://cdn.jsdelivr.net https://unpkg.com",
@@ -27016,7 +27651,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
       const headers = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-store",
-        "Content-Security-Policy": buildCsp(),
+        "Content-Security-Policy": buildCsp(page),
         "X-Content-Type-Options": "nosniff"
       };
       if (inlineSetCookie.length > 0)
@@ -27040,7 +27675,7 @@ async function handlePagesPublic(req, res, pathSegments, queryParams) {
   const headers = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
-    "Content-Security-Policy": buildCsp(),
+    "Content-Security-Policy": buildCsp(page),
     "X-Content-Type-Options": "nosniff"
   };
   if (inlineSetCookie.length > 0)
@@ -32852,7 +33487,8 @@ var upsertBodySchema = object2({
   description: string2().default(""),
   intent: string2().default(""),
   scope: ScriptScopeSchema.default("agent"),
-  fsMode: ScriptFsModeSchema.default("none")
+  fsMode: ScriptFsModeSchema.default("none"),
+  executor: ScriptExecutorNameSchema.nullable().optional()
 });
 var runBodySchema = object2({
   name: scriptNameSchema.optional(),
@@ -32861,6 +33497,7 @@ var runBodySchema = object2({
   intent: string2().default(""),
   scope: ScriptScopeSchema.optional(),
   fsMode: ScriptFsModeSchema.default("none"),
+  executor: ScriptExecutorNameSchema.nullable().optional(),
   idempotencyKey: string2().max(200).optional()
 }).refine((body) => Boolean(body.name) !== Boolean(body.source), {
   message: "Provide exactly one of name or source"
@@ -33309,6 +33946,10 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
         return true;
       }
     }
+    if (parsed.body.executor && !isExecutorAllowedByDeployment(parsed.body.executor)) {
+      jsonError(res, 'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"', 400);
+      return true;
+    }
     const secretRefusal = refuseSourceWithSecrets(parsed.body.source);
     if (secretRefusal) {
       json(res, secretRefusal, 400);
@@ -33336,6 +33977,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       signatureJson: signatureJsonFor(parsed.body.source),
       argsJsonSchema,
       fsMode: parsed.body.fsMode,
+      executor: parsed.body.executor,
       agentId: agent.id,
       isScratch: false,
       typeChecked: true,
@@ -33373,6 +34015,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
     }
     let source = parsed.body.source;
     let fsMode = parsed.body.fsMode;
+    let executor = parsed.body.executor ?? null;
     let namedScript = null;
     if (parsed.body.name) {
       const script = await resolveScript(parsed.body.name, agent.id, parsed.body.scope);
@@ -33383,11 +34026,16 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       namedScript = script;
       source = script.source;
       fsMode = script.fsMode;
+      executor = parsed.body.executor !== undefined ? parsed.body.executor : script.executor;
     }
     if (fsMode === "workspace-rw") {
       jsonError(res, "workspace-rw scripts are not supported by /api/scripts/run in v1", 501);
       return true;
     }
+    if (executor && !isExecutorAllowedByDeployment(executor)) {
+      jsonError(res, 'Executor "native" is not permitted when deployment SCRIPT_EXECUTOR="quickjs"', 400);
+      return true;
+    }
     const startedAt = new Date().toISOString();
     const runStartTouch = namedScript?.isScratch ? await touchScratchScriptLastUsed(namedScript.id) : null;
     const credentials = await buildScriptCredentialBindingsWithFailures({ agentId: agent.id });
@@ -33395,6 +34043,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       source,
       args: parsed.body.args,
       fsMode,
+      executor,
       agentId: agent.id,
       runtimeInstanceId,
       egressSecrets: credentials.egressSecrets,
@@ -33523,6 +34172,7 @@ async function handleScripts(req, res, pathSegments, queryParams, agentId) {
       isScratch: script.isScratch,
       typeChecked: script.typeChecked,
       fsMode: script.fsMode,
+      executor: script.executor,
       createdByAgentId: script.createdByAgentId,
       createdAt: script.createdAt,
       updatedAt: script.updatedAt
@@ -34775,7 +35425,7 @@ var triageSessionListRoute = route({
     401: { description: "Unauthorized" }
   },
   auth: { apiKey: true },
-  rbac: { ungated: "per-user inbox UI state, same posture as PATCH /api/inbox-state" }
+  rbac: { permission: "favorite.write.own" }
 });
 var SESSION_MOVE_LIMIT = 200;
 var SESSION_MOVE_OWNER_ONLY = "Only the session owner can move this group";
@@ -34784,9 +35434,7 @@ var SessionMoveResultSchema = object2({
   moved: array2(string2()),
   skipped: array2(object2({ rootTaskId: string2(), reason: string2() }))
 });
-var sessionMoveRbac = {
-  ungated: "per-session access, per-task task.fs.mutate, and asset-key write checks in the handler, as PATCH /api/assets/task/{id}/key"
-};
+var sessionMoveRbac = { permission: "task.fs.mutate" };
 var sessionMoveResponses = {
   400: { description: "Invalid namespace or request" },
   403: { description: "Personal destination not authorized" },
@@ -34858,6 +35506,8 @@ async function checkSessionMove(rootTaskId, actor, req, myAgentId, options = {})
       return { reason: SESSION_MOVE_UNAVAILABLE };
     if (!hasSessionAccess(access, "write"))
       return { reason: "Session write access required" };
+    if (await deniesNonOwnerTaskWrite2(req, root))
+      return { reason: NOT_YOUR_TASK_DENIED2 };
   }
   if (root.parentTaskId)
     return { reason: "Task is not a session root" };
@@ -36945,7 +37595,7 @@ var uiEvent = route({
     401: { description: "Unauthorized" },
     403: { description: "Guest page sessions cannot send events" }
   },
-  rbac: { ungated: "any authenticated dashboard user; event name allowlisted" }
+  rbac: { permission: "favorite.write.own" }
 });
 var enableTelemetry = route({
   method: "post",
@@ -37869,76 +38519,11 @@ init_zod();
 init_db3();
 init_rbac_roles();
 init_users();
+init_rbac();
 init_types();
+init_constants2();
+init_egress_guard();
 init_request_auth_context();
-
-// src/http/ip-rate-limit.ts
-var PRUNE_THRESHOLD = 1e4;
-var PRUNE_INTERVAL_MS = 60000;
-var MAX_BUCKETS = 50000;
-function isPrivateAddress(address) {
-  const ip = address.startsWith("::ffff:") ? address.slice(7) : address;
-  if (ip === "::1" || ip.startsWith("127.") || ip.startsWith("10."))
-    return true;
-  if (ip.startsWith("192.168.") || ip.startsWith("169.254."))
-    return true;
-  const match = /^172\.(\d+)\./.exec(ip);
-  if (match && Number(match[1]) >= 16 && Number(match[1]) <= 31)
-    return true;
-  const lower = ip.toLowerCase();
-  return lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
-}
-function clientIp(req) {
-  const peer = req.socket.remoteAddress ?? "unknown";
-  if (!isPrivateAddress(peer))
-    return peer;
-  const raw = req.headers["x-forwarded-for"];
-  const header = Array.isArray(raw) ? raw[raw.length - 1] : raw;
-  const hop = header?.split(",").pop()?.trim();
-  return hop || peer;
-}
-function createIpRateLimiter(options) {
-  const buckets = new Map;
-  let lastPruneAt = 0;
-  function refill(bucket, now) {
-    const elapsed = now - bucket.updatedAt;
-    bucket.tokens = Math.min(options.capacity, bucket.tokens + elapsed * options.refillPerMs);
-    bucket.updatedAt = now;
-  }
-  return {
-    take(ip, now = Date.now()) {
-      if (buckets.size > PRUNE_THRESHOLD && now - lastPruneAt >= PRUNE_INTERVAL_MS) {
-        lastPruneAt = now;
-        for (const [key, bucket] of buckets) {
-          refill(bucket, now);
-          if (bucket.tokens >= options.capacity)
-            buckets.delete(key);
-        }
-      }
-      let bucket = buckets.get(ip);
-      if (!bucket) {
-        if (buckets.size >= MAX_BUCKETS) {
-          const oldest = buckets.keys().next().value;
-          if (oldest !== undefined)
-            buckets.delete(oldest);
-        }
-        bucket = { tokens: options.capacity, updatedAt: now };
-        buckets.set(ip, bucket);
-      }
-      refill(bucket, now);
-      if (bucket.tokens < 1)
-        return false;
-      bucket.tokens -= 1;
-      return true;
-    },
-    reset() {
-      buckets.clear();
-      lastPruneAt = 0;
-    }
-  };
-}
-
-// src/http/users.ts
 async function composeUser(userId, recentEventLimit = 5) {
   const user = await getUserById2(userId);
   if (!user)
@@ -38010,7 +38595,12 @@ var whoamiRoute = route({
       description: "Authenticated principal",
       schema: object2({
         kind: _enum2(["operator", "user"]),
-        user: union2([UserSchema, _null()])
+        user: union2([UserSchema, _null()]),
+        grants: object2({
+          grantsAll: boolean(),
+          verbs: array2(string2()),
+          roles: array2(string2())
+        }).optional()
       })
     },
     401: { description: "Unauthorized" }
@@ -38259,6 +38849,72 @@ var exchangeConnectorCodeRoute = route({
     ungated: "the single-use code is the credential; the minted token carries the user's own grant and is admitted on use"
   }
 });
+var INVITE_ROLES = ["requester", "viewer", "admin"];
+var createInviteRoute = route({
+  method: "post",
+  path: "/api/invites",
+  pattern: ["api", "invites"],
+  summary: "Invite a teammate with a one-time API link",
+  description: "Creates an invited user with the given role (requester by default) and returns a 7-day single-use API link. The API redirects to the current APP_URL dashboard with the code in the URL fragment. The browser exchanges the code at POST /api/invites/exchange for a personal MCP token. Re-inviting an invited user replaces the role and link. Active or suspended users return 409 user_exists. No email is sent.",
+  tags: ["Users"],
+  body: object2({
+    email: email(),
+    name: string2().trim().min(1).max(200).optional(),
+    role: _enum2(INVITE_ROLES).default("requester")
+  }),
+  responses: {
+    201: {
+      description: "The invited user, API link, dashboard URL, expiry and API reachability",
+      schema: object2({
+        user: ComposedUserSchema.nullable(),
+        inviteUrl: string2(),
+        appUrl: string2(),
+        expiresAt: string2(),
+        apiReachable: _enum2(["public", "local"])
+      })
+    },
+    401: { description: "Unauthorized" },
+    403: { description: "Not allowed to manage roles" },
+    409: { description: "The email belongs to an active or suspended user" }
+  },
+  auth: { apiKey: true },
+  rbac: { permission: "user.role.manage" }
+});
+var openInviteRoute = route({
+  method: "get",
+  path: "/invite/{code}",
+  pattern: ["invite", null],
+  summary: "Open an invite in the configured dashboard",
+  description: "Redirects to the current APP_URL dashboard with the code in the URL fragment. Does not validate or consume the invite.",
+  tags: ["Users"],
+  params: object2({ code: string2() }),
+  responses: {
+    302: { description: "Redirect to the dashboard", unstructured: "Dashboard redirect" },
+    404: { description: "Malformed code (code_invalid)" }
+  },
+  auth: { apiKey: false }
+});
+var exchangeInviteCodeRoute = route({
+  method: "post",
+  path: "/api/invites/exchange",
+  pattern: ["api", "invites", "exchange"],
+  summary: "Exchange an invite code for the invited user's MCP token",
+  description: "Unauthenticated: the single-use invite code is the credential. Rate limited per IP. Activates the invited user. Unknown, expired, used and connector codes, and codes for users who are no longer invited, all return 404 code_invalid.",
+  tags: ["Users"],
+  body: object2({ code: string2().min(1).max(256) }),
+  maxBodyBytes: 1024,
+  responses: {
+    200: {
+      description: "Minted MCP token for the invited user",
+      schema: object2({ token: string2(), userId: string2() })
+    },
+    404: { description: "Code unknown, malformed, expired, already used or not an invite" },
+    413: { description: "Request body too large" },
+    429: { description: "Rate limited" }
+  },
+  auth: { apiKey: false },
+  rbac: { ungated: "the one-time invite code is the credential" }
+});
 var connectorDiscoveryRoute = route({
   method: "get",
   path: "/api/connector/discovery",
@@ -38439,6 +39095,26 @@ var connectorExchangeRateLimiter = createIpRateLimiter({
   capacity: 10,
   refillPerMs: 10 / 60000
 });
+var inviteExchangeRateLimiter = createIpRateLimiter({
+  capacity: 10,
+  refillPerMs: 10 / 60000
+});
+function apiReachability(apiUrl) {
+  let host;
+  try {
+    host = assertUrlSafe(apiUrl, { allowInsecure: true }).hostname.toLowerCase();
+  } catch {
+    return "local";
+  }
+  if (!host.includes(".") && !host.includes(":"))
+    return "local";
+  if (/\.(local|internal|lan|home\.arpa)\.?$/.test(host))
+    return "local";
+  return "public";
+}
+
+class InviteUserExistsError extends Error {
+}
 async function handleUsers(req, res, pathSegments, queryParams) {
   if (whoamiRoute.match(req.method, pathSegments)) {
     const parsed = await whoamiRoute.parse(req, res, pathSegments, queryParams);
@@ -38446,9 +39122,26 @@ async function handleUsers(req, res, pathSegments, queryParams) {
       return true;
     const auth = getRequestAuth(req);
     if (auth?.kind === "user") {
-      whoamiRoute.respond(res, 200, { kind: "user", user: auth.user });
+      const [grant, roles] = await Promise.all([
+        getUserGrant2(auth.user.id),
+        listUserRoles2(auth.user.id)
+      ]);
+      const grantsAll = !isRbacEnabled() || grant.grantsAll;
+      whoamiRoute.respond(res, 200, {
+        kind: "user",
+        user: auth.user,
+        grants: {
+          grantsAll,
+          verbs: grantsAll ? [] : [...grant.verbs].sort(),
+          roles: roles.map((role) => role.name)
+        }
+      });
     } else {
-      whoamiRoute.respond(res, 200, { kind: "operator", user: null });
+      whoamiRoute.respond(res, 200, {
+        kind: "operator",
+        user: null,
+        grants: { grantsAll: true, verbs: [], roles: [] }
+      });
     }
     return true;
   }
@@ -38652,6 +39345,110 @@ async function handleUsers(req, res, pathSegments, queryParams) {
     }
     return true;
   }
+  if (createInviteRoute.match(req.method, pathSegments)) {
+    const parsed = await createInviteRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!await ensureRoleManager(req, res))
+      return true;
+    const actor = getOperatorActor(req, res);
+    if (!actor)
+      return true;
+    const { email: email2, name, role } = parsed.body;
+    const actorUserId = actor.kind === "user" ? actor.id : null;
+    let invited;
+    try {
+      invited = await getDbClient2().transaction(async () => {
+        const existing = await findUserByEmail(email2);
+        if (existing && existing.status !== "invited")
+          throw new InviteUserExistsError;
+        let userId;
+        if (existing) {
+          userId = existing.id;
+          await deleteUnusedInviteCodes(userId);
+        } else {
+          const user = await createUser2({
+            name: name ?? (email2.split("@")[0] || email2),
+            email: email2,
+            status: "invited"
+          });
+          userId = user.id;
+          await recordIdentityEvent(userId, "identity_added", actor, null, {
+            email: email2,
+            source: "invite"
+          });
+        }
+        const { before, after } = await setUserRoles2(userId, [role], actorUserId);
+        if (before.join(",") !== after.join(",")) {
+          await recordIdentityEvent(userId, "profile_changed", actor, { rbacRoles: before }, { rbacRoles: after });
+        }
+        const { code, expiresAt } = await createConnectorCode(userId, DEFAULT_INVITE_CODE_LABEL, actor, new Date, { kind: "invite", ttlMs: INVITE_CODE_TTL_MS });
+        return { userId, code, expiresAt };
+      });
+    } catch (err) {
+      if (err instanceof InviteUserExistsError) {
+        jsonError(res, "user_exists", 409);
+        return true;
+      }
+      jsonError(res, "Failed to create invite", 500);
+      return true;
+    }
+    const apiUrl = await resolveMcpBaseUrl();
+    const appUrl = await resolveAppUrl() ?? DEFAULT_APP_URL;
+    const inviteUrl = `${apiUrl}/invite/${invited.code}`;
+    createInviteRoute.respond(res, 201, {
+      user: await composeUser(invited.userId),
+      inviteUrl,
+      appUrl,
+      expiresAt: invited.expiresAt,
+      apiReachable: apiReachability(apiUrl)
+    });
+    return true;
+  }
+  if (openInviteRoute.match(req.method, pathSegments)) {
+    const parsed = await openInviteRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const { code } = parsed.params;
+    if (!/^[A-Za-z0-9_-]{16,256}$/.test(code)) {
+      jsonError(res, "code_invalid", 404);
+      return true;
+    }
+    const apiUrl = await resolveMcpBaseUrl();
+    const appUrl = await resolveAppUrl() ?? DEFAULT_APP_URL;
+    res.writeHead(302, {
+      Location: `${appUrl}/join?swarm=${encodeURIComponent(apiUrl)}#code=${code}`,
+      "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer"
+    });
+    res.end();
+    return true;
+  }
+  if (exchangeInviteCodeRoute.match(req.method, pathSegments)) {
+    if (!inviteExchangeRateLimiter.take(clientIp(req))) {
+      res.setHeader("Retry-After", "6");
+      jsonError(res, "rate_limited", 429);
+      return true;
+    }
+    const parsed = await exchangeInviteCodeRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    if (!CONNECTOR_CODE_PATTERN.test(parsed.body.code)) {
+      jsonError(res, "code_invalid", 404);
+      return true;
+    }
+    try {
+      const result = await exchangeConnectorCode(parsed.body.code, { kind: "invite" });
+      if (!result) {
+        jsonError(res, "code_invalid", 404);
+        return true;
+      }
+      exchangeInviteCodeRoute.respond(res, 200, result);
+    } catch {
+      jsonError(res, "Failed to exchange code", 500);
+    }
+    return true;
+  }
   if (revokeUserMcpTokenRoute.match(req.method, pathSegments)) {
     const parsed = await revokeUserMcpTokenRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -40006,63 +40803,6 @@ init_db3();
 init_workflow_idempotency();
 init_workflow_runs();
 init_types();
-
-// src/http/idempotency-key.ts
-init_zod();
-init_workflow_idempotency();
-init_request_auth_context();
-var IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
-var IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";
-var idempotencyKeyHeader = (accepted) => object2({
-  "Idempotency-Key": string2().regex(IDEMPOTENCY_KEY_PATTERN).optional().describe("Optional client-generated key, 1-255 visible ASCII characters (a UUID works). " + `The first request the server accepts under a key ${accepted}; a retry with the same key ` + "and an equivalent body gets that request's status and body back (with " + `\`${IDEMPOTENT_REPLAYED_HEADER}: true\`) and changes nothing. The key is scoped to the ` + "caller's identity and this operation; it is not a credential. The same key with a " + "different body is a 409. A request rejected before it is accepted (validation, auth, " + "not found, disabled) does not use up the key. Accepted keys do not expire.")
-});
-function idempotencyPrincipal(req, myAgentId) {
-  const auth = getRequestAuth(req);
-  switch (auth?.kind) {
-    case "user":
-      return `user:${auth.userId}`;
-    case "agent":
-      return `agent:${auth.agentId}`;
-    case "controller":
-      return `controller:${auth.controllerId}`;
-    case "guest":
-      return null;
-    default:
-      return myAgentId ? `agent:${myAgentId}` : "operator";
-  }
-}
-function readIdempotencyKey(req, res, myAgentId) {
-  const raw = req.headers["idempotency-key"];
-  if (raw === undefined)
-    return;
-  const key = Array.isArray(raw) ? raw.join(", ") : raw;
-  if (!IDEMPOTENCY_KEY_PATTERN.test(key)) {
-    jsonError(res, "Idempotency-Key must be 1-255 visible ASCII characters", 400);
-    return null;
-  }
-  const principal = idempotencyPrincipal(req, myAgentId);
-  if (!principal) {
-    jsonError(res, "Idempotency-Key needs an identified caller", 400);
-    return null;
-  }
-  return { principal, key };
-}
-async function replayAcceptedOperation(res, claim, send) {
-  const accepted = await findAcceptedWorkflowOperation(claim);
-  if (!accepted)
-    return false;
-  if (accepted.fingerprint !== claim.fingerprint) {
-    jsonError(res, "Idempotency-Key was already used for a different request", 409);
-  } else if (accepted.resourceDeletedAt !== null) {
-    jsonError(res, "The workflow this Idempotency-Key created or triggered was deleted; send a new key to start over", 410);
-  } else {
-    res.setHeader(IDEMPOTENT_REPLAYED_HEADER, "true");
-    send(accepted.body);
-  }
-  return true;
-}
-
-// src/http/workflows.ts
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
   warnings: array2(string2()).optional()
@@ -40256,6 +40996,9 @@ var triggerWorkflowRoute = route({
   description: "With an `Idempotency-Key`, a retry returns the accepted run's `runId` and `skipped` without starting, resuming or waiting for anything, even after the workflow was disabled or edited and whatever state the run is in now.",
   tags: ["Workflows"],
   params: object2({ id: string2() }),
+  query: object2({
+    wait: _enum2(["true", "false"]).optional().describe("Default true: respond after the run's instant steps ran, when it finishes or parks at its first async step. " + "false: respond as soon as the run is committed and walk it in the background.")
+  }),
   headers: idempotencyKeyHeader("starts one run"),
   responses: {
     201: {
@@ -40854,6 +41597,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       runId = await startWorkflowExecution2(workflow, body, getExecutorRegistry2(), {
         triggerType: "api",
         requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined,
+        detach: parsed.query.wait === "false",
         accept: claim ? async (run) => {
           const response = { runId: run.runId, skipped: run.skipped };
           await recordAcceptedWorkflowOperation(claim, {
@@ -41098,6 +41842,7 @@ async function handleX(req, res, pathSegments) {
     jsonError(res, "workspace-rw scripts are not supported", 501);
     return true;
   }
+  let hostValidatedArgs = false;
   if (script.argsJsonSchema) {
     try {
       const schema = JSON.parse(script.argsJsonSchema);
@@ -41111,6 +41856,7 @@ async function handleX(req, res, pathSegments) {
         });
         return true;
       }
+      hostValidatedArgs = true;
     } catch {}
   }
   const timeoutMs = resolveTimeoutMs(req);
@@ -41122,7 +41868,9 @@ async function handleX(req, res, pathSegments) {
   const output = await runScriptWithRunCredential({
     source: script.source,
     args: args ?? null,
+    [HOST_VALIDATED_ARGS]: hostValidatedArgs,
     fsMode: "none",
+    executor: script.executor,
     agentId: endpoint.agentId,
     timeoutMs,
     egressSecrets: credentials.egressSecrets,
@@ -41255,7 +42003,7 @@ var httpServer = createHttpServer(async (req, res) => {
     const semconv = httpServerSemconvAttributes(req);
     const span = skipSpan ? null : startSpan2(spanName, {
       "http.request.method": req.method ?? "",
-      "url.path": reqPath,
+      "url.path": redactShareTokenInPath(reqPath),
       "url.scheme": semconv["url.scheme"],
       "http.route": httpRoute,
       "server.address": semconv["server.address"],
@@ -41299,6 +42047,7 @@ var httpServer = createHttpServer(async (req, res) => {
         () => handlePoolKeys(req, res, pathSegments, queryParams),
         () => handleConfig(req, res, pathSegments, queryParams),
         () => handleFs(req, res, pathSegments, queryParams, myAgentId),
+        () => handleAgentFsProxy(req, res),
         () => handleComb(req, res, pathSegments, queryParams, myAgentId),
         () => handleKv(req, res, pathSegments, queryParams),
         () => handleRooms(req, res, pathSegments, queryParams),
@@ -41373,7 +42122,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-r2za39ef.js");
+var { attachControllerTransport } = await import("./controllers-connect-ajvh9h0v.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -41402,7 +42151,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-38t35h0n.js");
+    const { stopScheduler } = await import("./index-ch0c1xff.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -41413,8 +42162,8 @@ async function shutdown() {
   await stopScriptRunSupervisor();
   await stopSlackApp2();
   await stopChatSdk();
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-em0117bp.js");
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
+    const { stopOAuthKeepalive } = await import("./keepalive-zzc3hks1.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -41494,21 +42243,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-r3kwwv8b.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-yb75wv33.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-wkpwhgvs.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-r3kwwv8b.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-9bmkspyw.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-r3kwwv8b.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -41516,7 +42265,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-qhjf2htm.js");
+  const { runAllSeeders } = await import("./index-ejqdkkqx.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -41579,42 +42328,42 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-38t35h0n.js");
-    const { getExecutorRegistry } = await import("./index-k0yt1tvq.js");
+    const { startScheduler } = await import("./index-ch0c1xff.js");
+    const { getExecutorRegistry } = await import("./index-5nb266jr.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-yqgbfgaj.js");
+    const { startHeartbeat } = await import("./index-ed8dy8rn.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-em0117bp.js");
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
+    const { startOAuthKeepalive } = await import("./keepalive-zzc3hks1.js");
     startOAuthKeepalive();
   }
-  if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-xysj4yse.js");
+  if (!isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-7qt0g55z.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-f4nn561n.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-k5y5xbj0.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-6c1sjfnr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-fxfw17m2.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-d4w9gajf.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-se41j9fd.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
-  import("./session-source-backfill-qgtc86z1.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
+  import("./session-source-backfill-62202awe.js").then(({ runSessionSourceBackfill }) => runSessionSourceBackfill()).catch((err) => {
     console.error("[session-source-backfill] startup run failed (non-fatal):", err);
   });
 }).on("error", (err) => {