@desplega.ai/agent-swarm 2.6.0 → 2.7.1

package/src/http/fs.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { deleteTaskAttachment, getTaskAttachments, getTaskById } from "../be/db";
 import { appendDraftTaskText } from "../be/db/tasks/draft-text";
+import { getUserGrant } from "../be/rbac-roles";
 import {
   ensureAgentFsCredentialsForAgent,
   inviteEmailToSharedOrg,
@@ -14,10 +15,10 @@ import {
 } from "../be/task-attachment-store";
 import { type FileObject, FilesError, normalizeFilesError } from "../fs/provider";
 import { getFileStorageProvider } from "../fs/registry";
-import { can, type RbacResource } from "../rbac";
+import { can, isRbacEnabled, type RbacResource } from "../rbac";
 import { type TaskAttachment, TaskAttachmentSchema } from "../types";
 import { attachmentContentDisposition } from "../utils/content-disposition";
-import { getCurrentRequestAuth } from "../utils/request-auth-context";
+import { getCurrentRequestAuth, getRequestAuth } from "../utils/request-auth-context";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { transcribeAudioNotes } from "../utils/transcription";
 import { requestPrincipal } from "./request-principal";
@@ -66,7 +67,20 @@ const agentFsCredentialStateSchema = z.object({
 
 const agentFsInviteStateSchema = z.object({
   orgId: z.string(),
-  invited: z.boolean(),
+  invited: z.boolean().describe("False only when the email already holds the requested role."),
+  status: z
+    .enum(["already_member", "added", "pending"])
+    .describe(
+      "already_member: no change. added: an existing agent-fs account joined the org. pending: the email has no account, so agent-fs created an invite the person must accept.",
+    ),
+  inviteId: z.string().optional().describe("Pending invite id (status pending)."),
+  expiresAt: z.string().optional().describe("ISO time the accept link expires (status pending)."),
+  acceptUrl: z
+    .string()
+    .optional()
+    .describe(
+      "Link the invitee opens to accept (status pending). agent-fs sends no email, so hand it to the person. Absent when agent-fs has no app URL configured.",
+    ),
 });
 
 const signedUrlResponseSchema = z.object({
@@ -112,22 +126,26 @@ const inviteMemberRoute = route({
   pattern: ["api", "fs", "members", "invite"],
   summary: "Invite an external member into the agent-fs shared org",
   description:
-    "The API server performs the invite with its own bootstrap credentials (which are API-only and never served over HTTP), provisioning the shared org/drive first when needed. Intended for the cloud control plane's Connect-to-Drive flow. No keys are returned; the invitee obtains their own key via agent-fs registration.",
+    "The API server performs the invite with its own bootstrap credentials (which are API-only and never served over HTTP), provisioning the shared org/drive first when needed. Intended for the cloud control plane's Connect-to-Drive flow. An email with an agent-fs account is added directly (status added). An email without one gets a pending invite (status pending) with an acceptUrl when agent-fs returns one; agent-fs sends no email, so the caller must hand the link to the invitee. No keys are returned; the invitee obtains their own key via agent-fs registration.",
   tags: ["FS"],
   body: z.object({
     email: z.email(),
     role: z.enum(["viewer", "editor", "admin"]).default("editor"),
   }),
   responses: {
-    200: { description: "Invite state ({ orgId, invited })", schema: agentFsInviteStateSchema },
+    200: {
+      description: "Invite state ({ orgId, invited, status, acceptUrl? })",
+      schema: agentFsInviteStateSchema,
+    },
     400: { description: "Invalid body" },
+    403: { description: "A non-admin user token named an email other than its own" },
     500: { description: "Provisioning or invite failed" },
   },
   auth: { apiKey: true },
-  rbac: {
-    ungated:
-      "Tenant API key is the org-owner credential; the invite runs under the API server's own bootstrap identity, no per-agent principal applies.",
-  },
+  // The operator key and grant-all users invite any email at any role. Other
+  // users may only join with their own account email, at a role the handler
+  // derives from their grant.
+  rbac: { permission: "fs.join.own" },
 });
 
 const listTaskFilesRoute = route({
@@ -234,6 +252,37 @@ const deleteTaskFileRoute = route({
   rbac: { permission: "task.fs.mutate" },
 });
 
+type InviteRole = "viewer" | "editor" | "admin";
+
+/**
+ * The email and role an invite runs with. The operator key and grant-all users
+ * keep the body as sent. Any other user joins only as itself: the body email
+ * must match the account email (ignoring case), the stored spelling is used,
+ * and the role is `editor` when the user may change task files, else `viewer`.
+ */
+async function resolveInvite(
+  req: IncomingMessage,
+  body: { email: string; role: InviteRole },
+): Promise<{ email: string; role: InviteRole } | { denied: string }> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || !isRbacEnabled()) return body;
+  const grant = await getUserGrant(auth.userId);
+  if (grant.grantsAll) return body;
+  const decision = can({
+    principal: { kind: "user", userId: auth.userId },
+    verb: "fs.join.own",
+    resource: { kind: "none" },
+    source: "http",
+  });
+  // Admission already required the role to hold `fs.join.own`.
+  if (!decision.allow) return { denied: decision.reason };
+  const ownEmail = auth.user.email?.trim();
+  if (!ownEmail || ownEmail.toLowerCase() !== body.email.trim().toLowerCase()) {
+    return { denied: "You can only join the shared drive with your own account email" };
+  }
+  return { email: ownEmail, role: grant.verbs.has("task.fs.mutate") ? "editor" : "viewer" };
+}
+
 export async function handleFs(
   req: IncomingMessage,
   res: ServerResponse,
@@ -264,8 +313,13 @@ export async function handleFs(
   if (inviteMemberRoute.match(req.method, pathSegments)) {
     const parsed = await inviteMemberRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
+    const invite = await resolveInvite(req, parsed.body);
+    if ("denied" in invite) {
+      jsonError(res, invite.denied, 403);
+      return true;
+    }
     try {
-      const result = await inviteEmailToSharedOrg(parsed.body.email, parsed.body.role);
+      const result = await inviteEmailToSharedOrg(invite.email, invite.role);
       inviteMemberRoute.respond(res, 200, result);
     } catch (error) {
       const message = scrubSecrets(error instanceof Error ? error.message : String(error));

package/src/http/idempotency-key.ts

@@ -8,7 +8,7 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { jsonError } from "./utils";
 
 /** Visible ASCII, at most 255 characters: room for a UUID, a ULID or a client's own scheme. */
-const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
+export const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
 
 /** Set on a response answered from an earlier accepted request. */
 export const IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";

package/src/http/inbox-state.ts

@@ -1,7 +1,10 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { z } from "zod";
 import { getDbClient, listInboxState, upsertInboxState } from "../be/db";
+import { getUserGrant } from "../be/rbac-roles";
+import { isRbacEnabled } from "../rbac";
 import { InboxItemStateSchema, InboxItemStatusSchema, InboxItemTypeSchema } from "../types";
+import { getRequestAuth } from "../utils/request-auth-context";
 import { route } from "./route-def";
 import { jsonError } from "./utils";
 
@@ -59,8 +62,10 @@ const upsertState = route({
     },
     400: { description: "Validation error" },
     401: { description: "Unauthorized" },
+    403: { description: "A non-admin user token wrote another user's state" },
   },
   auth: { apiKey: true },
+  rbac: { permission: "favorite.write.own" },
 });
 
 const bulkUpsertState = route({
@@ -80,13 +85,26 @@ const bulkUpsertState = route({
     },
     400: { description: "Validation error" },
     401: { description: "Unauthorized" },
+    403: { description: "A non-admin user token wrote another user's state" },
   },
   auth: { apiKey: true },
-  rbac: { ungated: "per-user inbox UI state, same posture as PATCH /api/inbox-state" },
+  rbac: { permission: "favorite.write.own" },
 });
 
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
+const OTHER_USER_STATE_DENIED = "You can only change your own inbox state";
+
+/**
+ * True when a user token without a grant-all role names another user's
+ * `userId`. Operator-key and admin callers keep writing any user's state.
+ */
+async function writesOtherUsersState(req: IncomingMessage, userId: string): Promise<boolean> {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "user" || auth.userId === userId || !isRbacEnabled()) return false;
+  return !(await getUserGrant(auth.userId)).grantsAll;
+}
+
 export async function handleInboxState(
   req: IncomingMessage,
   res: ServerResponse,
@@ -108,6 +126,10 @@ export async function handleInboxState(
   if (bulkUpsertState.match(req.method, pathSegments)) {
     const parsed = await bulkUpsertState.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
+    if (await writesOtherUsersState(req, parsed.body.userId)) {
+      jsonError(res, OTHER_USER_STATE_DENIED, 403);
+      return true;
+    }
     try {
       const items = await getDbClient().transaction(async () => {
         const rows = [];
@@ -126,6 +148,10 @@ export async function handleInboxState(
   if (upsertState.match(req.method, pathSegments)) {
     const parsed = await upsertState.parse(req, res, pathSegments, queryParams);
     if (!parsed) return true;
+    if (await writesOtherUsersState(req, parsed.body.userId)) {
+      jsonError(res, OTHER_USER_STATE_DENIED, 403);
+      return true;
+    }
     try {
       const item = await upsertInboxState({
         userId: parsed.body.userId,

package/src/http/index.ts

@@ -70,6 +70,7 @@ import { isEnvFlagEnabled } from "../utils/env-flag";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { initWorkflows } from "../workflows";
 import { handleActiveSessions } from "./active-sessions";
+import { handleAgentFsProxy } from "./agentfs-proxy";
 import { handleAgentRegister, handleAgentsRest } from "./agents";
 import { handleApiKeys } from "./api-keys";
 import { handleApprovalRequests } from "./approval-requests";
@@ -147,6 +148,7 @@ import {
   getPathSegments,
   httpServerSemconvAttributes,
   parseQueryParams,
+  redactShareTokenInPath,
   safeRequestUrlForLog,
   setCorsHeaders,
   warnIfCorsAllowsAnyOrigin,
@@ -319,7 +321,7 @@ const httpServer = createHttpServer(async (req, res) => {
           spanName,
           {
             "http.request.method": req.method ?? "",
-            "url.path": reqPath,
+            "url.path": redactShareTokenInPath(reqPath),
             "url.scheme": semconv["url.scheme"],
             "http.route": httpRoute,
             "server.address": semconv["server.address"],
@@ -373,6 +375,7 @@ const httpServer = createHttpServer(async (req, res) => {
         () => handlePoolKeys(req, res, pathSegments, queryParams),
         () => handleConfig(req, res, pathSegments, queryParams),
         () => handleFs(req, res, pathSegments, queryParams, myAgentId),
+        () => handleAgentFsProxy(req, res),
         () => handleComb(req, res, pathSegments, queryParams, myAgentId),
         () => handleKv(req, res, pathSegments, queryParams),
         () => handleRooms(req, res, pathSegments, queryParams),
@@ -517,7 +520,7 @@ async function shutdown() {
   await stopChatSdk();
 
   // Stop OAuth keepalive
-  if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
+  if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
     const { stopOAuthKeepalive } = await import("../oauth/keepalive");
     await stopOAuthKeepalive();
   }
@@ -847,7 +850,7 @@ httpServer
     startRuntimeSupervisor();
 
     // Start OAuth token keepalive (proactive refresh to prevent expiry)
-    if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
+    if (!isEnvFlagEnabled("OAUTH_KEEPALIVE_DISABLE", false)) {
       const { startOAuthKeepalive } = await import("../oauth/keepalive");
       startOAuthKeepalive();
     }
@@ -855,7 +858,7 @@ httpServer
     // Start generic OAuth token refresh sweep (all oauth_apps providers,
     // 15-min tick, first run ~1 min after boot). Complements the tracker-only
     // keepalive above — see src/be/oauth-refresh-sweep.ts.
-    if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
+    if (!isEnvFlagEnabled("OAUTH_REFRESH_SWEEP_DISABLE", false)) {
       const { startOAuthRefreshSweep } = await import("../be/oauth-refresh-sweep");
       startOAuthRefreshSweep();
     }

package/src/http/memory.ts

@@ -914,7 +914,7 @@ export async function handleMemory(
     try {
       const provider = getEmbeddingProvider();
       const store = getMemoryStore();
-      const queryEmbedding = await provider.embed(query);
+      const queryEmbedding = await provider.embed(query, { kind: "query" });
 
       const candidateLimit = Math.min(limit, 20) * CANDIDATE_SET_MULTIPLIER;
       const candidates = await searchMemoryCandidates(
@@ -1039,7 +1039,7 @@ export async function handleMemory(
     try {
       if (query && query.trim().length > 0) {
         const provider = getEmbeddingProvider();
-        const queryEmbedding = await provider.embed(query.trim());
+        const queryEmbedding = await provider.embed(query.trim(), { kind: "query" });
 
         const candidateLimit = Math.min(
           4096,
@@ -1289,7 +1289,7 @@ export async function handleMemory(
       });
       if (result.changed) {
         const provider = getEmbeddingProvider();
-        const embedding = await provider.embed(result.memory.content);
+        const embedding = await provider.embed(result.memory.content, { kind: "document" });
         if (embedding) await store.updateEmbedding(result.memory.id, embedding, provider.name);
         try {
           // Edit path: prune links derived from removed content (sequel links survive).
@@ -1378,7 +1378,10 @@ export async function handleMemory(
       for (let i = 0; i < memories.length; i += batchSize) {
         const batch = memories.slice(i, i + batchSize);
         try {
-          const embeddings = await provider.embedBatch(batch.map((m) => m.content));
+          const embeddings = await provider.embedBatch(
+            batch.map((m) => m.content),
+            { kind: "document" },
+          );
           for (let j = 0; j < embeddings.length; j++) {
             if (embeddings[j]) {
               await store.updateEmbedding(batch[j]!.id, embeddings[j]!, provider.name);

package/src/http/onboarding.ts

@@ -2,12 +2,15 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import OpenAI from "openai";
 import { getAutomationSetupStates } from "../be/automation-preflight";
 import { getAgentHarnessProviders, getReadyAgentCounts, getTaskById } from "../be/db";
-import { getEmbeddingProvider } from "../be/memory";
+import { getEmbeddingProvider, resetEmbeddingProvider } from "../be/memory";
 import { EMBEDDING_DIMENSIONS } from "../be/memory/constants";
 import {
+  EMBEDDING_PREFIX_KEYS,
+  type MemoryConfigChange,
   OnboardingActionSchema,
   type OnboardingErrorClass,
   type OnboardingMemoryPreset,
+  type OnboardingMemoryProvider,
   type OnboardingMemoryRequest,
   OnboardingMemoryRequestSchema,
   type OnboardingMemoryResponse,
@@ -21,16 +24,89 @@ import {
 } from "../be/onboarding";
 import { assertUrlSafe, publicEndpointSsrfOptions } from "../oauth/mcp-wrapper";
 import { ProviderNameSchema } from "../types";
+import { isCombEnabled } from "../utils/constants";
 import { splitCredentialPool } from "../utils/credentials";
+import { isPrivateAddress } from "../utils/egress-guard";
 import { getOpenRouterAttributionHeaders } from "../utils/openrouter-base-url";
 import { ensureConfigAdmin } from "./config";
-import { scheduleIntegrationsReload } from "./core";
+import {
+  getDeploymentEnvValue,
+  loadGlobalConfigsIntoEnv,
+  scheduleIntegrationsReload,
+} from "./core";
 import { route } from "./route-def";
 import { rollupCredStatusForProvider } from "./status";
 import { jsonError } from "./utils";
 
 export type { OnboardingState } from "../be/onboarding";
 
+/**
+ * The embeddings endpoint runs on this server or its private network: a
+ * loopback name, a private IP, or a single-label host such as the bundled
+ * `tei` service. Unset means the hosted OpenAI default.
+ */
+function isLocalEndpoint(baseUrl: string | undefined): boolean {
+  if (!baseUrl?.trim()) return false;
+  let host: string;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return false;
+  }
+  if (!host) return false;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (isPrivateAddress(host)) return true;
+  // IPv6 literals hold colons: only a plain name can be a single label.
+  return !host.includes(".") && !host.includes(":");
+}
+
+/** The hosts of the hosted memory presets (the UI's preset list). */
+const PRESET_HOSTS: ReadonlyArray<[OnboardingMemoryProvider, (host: string) => boolean]> = [
+  ["openai", (host) => host === "api.openai.com"],
+  ["openrouter", (host) => host === "openrouter.ai"],
+  ["vercel", (host) => host === "ai-gateway.vercel.sh"],
+  [
+    "azure",
+    (host) =>
+      [".services.ai.azure.com", ".openai.azure.com", ".cognitiveservices.azure.com"].some(
+        (suffix) => host.endsWith(suffix),
+      ),
+  ],
+];
+
+/** Where an embeddings endpoint runs, from its host. Unset means the hosted OpenAI default. */
+function embeddingsProvider(baseUrl: string | undefined): OnboardingMemoryProvider {
+  if (isLocalEndpoint(baseUrl)) return "local";
+  if (!baseUrl?.trim()) return "openai";
+  let host: string;
+  try {
+    host = new URL(baseUrl.trim()).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return "custom";
+  }
+  return PRESET_HOSTS.find(([, matches]) => matches(host))?.[0] ?? "custom";
+}
+
+/**
+ * The deployment environment's own embeddings setup, before a stored config
+ * replaced it: its base URL, model, and key. The key can also be a stored
+ * OPENAI_API_KEY, as for the setup the server runs.
+ */
+function deploymentEmbeddings() {
+  return {
+    baseUrl: getDeploymentEnvValue("EMBEDDING_API_BASE_URL"),
+    model: getDeploymentEnvValue("EMBEDDING_MODEL") ?? "text-embedding-3-small",
+    apiKey: getDeploymentEnvValue("EMBEDDING_API_KEY") ?? process.env.OPENAI_API_KEY,
+  };
+}
+
+/** The local setup of the deployment environment, when it has a local endpoint and a key. */
+function localDefault(): { model: string } | null {
+  const deployment = deploymentEmbeddings();
+  if (!isLocalEndpoint(deployment.baseUrl) || !deployment.apiKey) return null;
+  return { model: deployment.model };
+}
+
 async function buildSignals(state: OnboardingState): Promise<OnboardingSignals> {
   const providers: OnboardingSignals["providers"] = [];
   for (const entry of await getAgentHarnessProviders()) {
@@ -51,12 +127,18 @@ async function buildSignals(state: OnboardingState): Promise<OnboardingSignals>
   const integrations = await getAutomationSetupStates();
   const agentCounts = await getReadyAgentCounts();
   const firstTask = state.firstTaskId ? await getTaskById(state.firstTaskId) : null;
+  const embeddingsOn = getEmbeddingProvider().isConfigured();
 
   return {
     providers,
     embeddings: {
-      configured: getEmbeddingProvider().isConfigured(),
+      configured: embeddingsOn,
       dimensions: EMBEDDING_DIMENSIONS,
+      // The model id and the host class only: never the key or the URL.
+      model: embeddingsOn ? (process.env.EMBEDDING_MODEL ?? "text-embedding-3-small") : null,
+      local: embeddingsOn && isLocalEndpoint(process.env.EMBEDDING_API_BASE_URL),
+      provider: embeddingsOn ? embeddingsProvider(process.env.EMBEDDING_API_BASE_URL) : null,
+      localDefault: localDefault(),
     },
     integrations: {
       slack: integrations.slack === "configured",
@@ -71,6 +153,7 @@ async function buildSignals(state: OnboardingState): Promise<OnboardingSignals>
       workersOnline: agentCounts.workers,
     },
     firstTask: firstTask ? { id: firstTask.id, status: firstTask.status } : null,
+    files: { enabled: isCombEnabled() },
   };
 }
 
@@ -195,10 +278,31 @@ function memoryErrorMessage(errorClass: OnboardingErrorClass, status?: number):
 async function updateMemoryState(
   preset: OnboardingMemoryPreset,
   result: { ok: true } | { ok: false; errorClass: OnboardingErrorClass },
-  saveConfig?: { baseUrl: string; model: string; apiKey?: string },
+  change?: MemoryConfigChange,
 ): Promise<void> {
-  const configSaved = await updateOnboardingMemory(preset, result, saveConfig);
-  if (configSaved) scheduleIntegrationsReload();
+  const configChanged = await updateOnboardingMemory(preset, result, change);
+  if (!configChanged) return;
+  if (change?.kind === "restore") {
+    // Apply the deployment setup before the response: the next GET shows it
+    // in use. Memory search stays on, so the reload starts no backfill.
+    await loadGlobalConfigsIntoEnv(true);
+    resetEmbeddingProvider();
+  }
+  scheduleIntegrationsReload();
+}
+
+/**
+ * The task prefixes of a saved setup. A prefix of the deployment environment
+ * belongs to its model (nomic needs `search_query: `): another model gets an
+ * empty stored prefix over it, and the same model gets the deployment prefix
+ * back (the stored row is deleted).
+ */
+function prefixChanges(model: string): Extract<MemoryConfigChange, { kind: "save" }>["prefixes"] {
+  const sameModel = model === getDeploymentEnvValue("EMBEDDING_MODEL");
+  return EMBEDDING_PREFIX_KEYS.filter((key) => getDeploymentEnvValue(key)).map((key) => ({
+    key,
+    value: sameModel ? null : "",
+  }));
 }
 
 async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<OnboardingMemoryResponse> {
@@ -207,21 +311,39 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     body.preset === "openai" || body.preset === "openrouter" || body.preset === "vercel"
       ? MEMORY_PRESETS[body.preset]
       : undefined;
+  // `existing` tests the setup the server runs. With `restoreDefault` it
+  // tests the deployment environment's setup, which applies once the stored
+  // config is gone.
+  const restore = body.preset === "existing" && body.restoreDefault === true;
+  const deployment = restore ? deploymentEmbeddings() : null;
   const baseUrl =
     body.preset === "existing"
-      ? process.env.EMBEDDING_API_BASE_URL
+      ? deployment
+        ? deployment.baseUrl
+        : process.env.EMBEDDING_API_BASE_URL
       : (body.baseUrl ??
         preset?.baseUrl ??
         process.env.EMBEDDING_API_BASE_URL ??
         "https://api.openai.com/v1");
   const model =
     body.preset === "existing"
-      ? (process.env.EMBEDDING_MODEL ?? "text-embedding-3-small")
+      ? (deployment?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small")
       : (body.model ?? preset?.model ?? process.env.EMBEDDING_MODEL ?? "text-embedding-3-small");
 
+  // Preset `existing` tests the server's own EMBEDDING_API_BASE_URL. When it is
+  // the deployment environment's value, the URL is operator config, not request
+  // input, so a private endpoint (a local TEI at http://tei:80/v1) is allowed. A
+  // value stored through `/api/config` and every URL that can come from the
+  // request still pass the SSRF check.
+  const configuredEndpoint =
+    body.preset === "existing" &&
+    !!baseUrl &&
+    baseUrl === getDeploymentEnvValue("EMBEDDING_API_BASE_URL");
   let endpoint: URL;
   try {
-    endpoint = assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
+    endpoint = configuredEndpoint
+      ? new URL(baseUrl ?? "")
+      : assertUrlSafe(baseUrl ?? "", publicEndpointSsrfOptions());
   } catch {
     // Input rejections are not probe outcomes: the step state stays as is.
     return {
@@ -243,7 +365,9 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
     !explicitKey && body.reuseKey && canReuseKey ? process.env[body.reuseKey] : undefined;
   const implicitKey =
     body.preset === "existing"
-      ? (process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY)
+      ? deployment
+        ? deployment.apiKey
+        : (process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY)
       : undefined;
   // Test and save the same pool member.
   const apiKey = splitCredentialPool(explicitKey ?? reusedKey ?? implicitKey ?? "")[0];
@@ -290,11 +414,15 @@ async function handleMemoryProbe(body: OnboardingMemoryRequest): Promise<Onboard
       body.preset,
       { ok: true },
       body.preset === "existing"
-        ? undefined
+        ? restore
+          ? { kind: "restore" }
+          : undefined
         : {
+            kind: "save",
             baseUrl: baseUrl ?? "https://api.openai.com/v1",
             model,
             apiKey: keyToSave,
+            prefixes: prefixChanges(model),
           },
     );
     return { ok: true, dimensions, latencyMs };

package/src/http/pages-public.ts

@@ -308,13 +308,45 @@ function getAppBaseUrl(): string {
   return getAppUrl(LOCAL_PAGE_APP_URL);
 }
 
+// CSP host-source without a path: optional http(s) scheme, a host that may
+// start with a `*.` wildcard label, and an optional port (digits or `*`).
+// Bare `*`, keywords (`'none'`, `'self'`) and anything carrying `;` or a path
+// are rejected so a bad env value cannot widen or break the policy.
+const FRAME_ANCESTOR_SOURCE_RE =
+  /^(?:https?:\/\/)?(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*(?::(?:\d{1,5}|\*))?$/i;
+
+let cachedFrameAncestors: { raw: string; origins: string[] } | null = null;
+
+/**
+ * Parse `PAGES_FRAME_ANCESTORS`: extra origins allowed to iframe PUBLIC pages
+ * (for example a marketing site embedding a chart). Comma or space separated.
+ * Invalid entries are dropped with one warning per distinct env value; the
+ * parse is cached on the raw string so a config reload picks up changes
+ * without re-warning on every request.
+ */
+export function getPageFrameAncestors(): string[] {
+  const raw = process.env.PAGES_FRAME_ANCESTORS ?? "";
+  if (cachedFrameAncestors?.raw === raw) return cachedFrameAncestors.origins;
+  const origins: string[] = [];
+  for (const entry of raw.split(/[\s,]+/)) {
+    const value = entry.replace(/\/+$/, "");
+    if (!value) continue;
+    if (FRAME_ANCESTOR_SOURCE_RE.test(value)) origins.push(value);
+    else console.warn(`[pages] ignoring invalid PAGES_FRAME_ANCESTORS entry: ${entry}`);
+  }
+  cachedFrameAncestors = { raw, origins };
+  return origins;
+}
+
 /**
  * Build the `Content-Security-Policy` for the served HTML. Allows inline
  * scripts (required for `BROWSER_SDK_JS`) but locks down everything else to
  * `'self'`. The SPA iframes the page in step-6 with `sandbox="allow-scripts
- * allow-forms"`; the CSP is a defence-in-depth layer.
+ * allow-forms"`; the CSP is a defence-in-depth layer. `PAGES_FRAME_ANCESTORS`
+ * applies only to public pages: authed and password pages stay embeddable by
+ * the app origins alone.
  */
-function buildCsp(): string {
+function buildCsp(page: Page): string {
   // `frame-ancestors` lists every origin allowed to iframe `/p/:id`. We must
   // include the SPA origin(s). Configured app URLs may be comma-separated so
   // portless dev (`https://ui.swarm.localhost`), a Vite port (`http://localhost:5274`),
@@ -333,7 +365,8 @@ function buildCsp(): string {
           "https://*.localhost",
           "http://*.localhost",
         ];
-  const ancestors = Array.from(new Set([...configured, ...devFallbacks]));
+  const embedders = page.authMode === "public" ? getPageFrameAncestors() : [];
+  const ancestors = Array.from(new Set([...configured, ...devFallbacks, ...embedders]));
   // Allow Tailwind Play CDN (`cdn.tailwindcss.com`) for scripts, Google
   // Fonts (`fonts.googleapis.com` stylesheets + `fonts.gstatic.com` font
   // files) for the swarm default typography, and same-origin /@swarm/api/*
@@ -609,7 +642,7 @@ export async function handlePagesPublic(
       const headers: Record<string, string | string[]> = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-store",
-        "Content-Security-Policy": buildCsp(),
+        "Content-Security-Policy": buildCsp(page),
         "X-Content-Type-Options": "nosniff",
       };
       if (inlineSetCookie.length > 0) headers["Set-Cookie"] = inlineSetCookie;
@@ -642,7 +675,7 @@ export async function handlePagesPublic(
   const headers: Record<string, string | string[]> = {
     "Content-Type": "text/html; charset=utf-8",
     "Cache-Control": "no-store",
-    "Content-Security-Policy": buildCsp(),
+    "Content-Security-Policy": buildCsp(page),
     // Defence-in-depth: prevent MIME sniffing and clickjacking outside the SPA.
     "X-Content-Type-Options": "nosniff",
   };