@desplega.ai/agent-swarm 2.7.4 → 2.7.6

package/src/be/runtime-pools/db.ts

@@ -4,6 +4,7 @@ import {
   createRuntimeProvider,
   type RuntimeTargetConfig,
 } from "../../runtime-providers";
+import { poolCacheKey } from "../../runtime-providers/types";
 import type { Agent, DeliveryMode, RuntimeController, RuntimePool } from "../../types";
 import {
   RuntimeControllerCreateSchema,
@@ -17,6 +18,7 @@ import { decryptSecret, encryptSecret, getEncryptionKey } from "../crypto";
 import { createAgent, getAgentById, getAllAgents, getDbClient, upsertSwarmConfig } from "../db";
 import { type AgentRow, rowToAgent } from "../db/agents";
 import { registerStoredSecret } from "../secret-registry";
+import { getPoolCache, queuePoolCacheRelease } from "./cache-cleanup";
 import { RuntimePoolError } from "./errors";
 import { revokeControllerTokens } from "./tokens";
 
@@ -29,10 +31,11 @@ type ControllerRow = Omit<
   config: string;
   secretConfig: string | null;
 };
-type PoolRow = Omit<RuntimePool, "placements" | "env" | "resources" | "enabled"> & {
+type PoolRow = Omit<RuntimePool, "placements" | "env" | "resources" | "cache" | "enabled"> & {
   placements: string;
   env: string;
   resources: string | null;
+  cache: string | null;
   enabled: number;
 };
 const controllerColumns = `id, name, kind, placement, config, secret_config AS secretConfig,
@@ -40,7 +43,7 @@ const controllerColumns = `id, name, kind, placement, config, secret_config AS s
   created_by AS createdBy, updated_by AS updatedBy, created_at AS createdAt, updated_at AS updatedAt`;
 const poolColumns = `id, name, kind, placements, image, lifecycle, idle_minutes AS idleMinutes,
   slots_per_runtime AS slotsPerRuntime, max_runtimes AS maxRuntimes, min_runtimes AS minRuntimes,
-  delivery, env, resources, ttl_sec AS ttlSec, resolved_image AS resolvedImage, enabled,
+  delivery, env, resources, cache, ttl_sec AS ttlSec, resolved_image AS resolvedImage, enabled,
   consecutive_failures AS consecutiveFailures, circuit_open_until AS circuitOpenUntil,
   last_error AS lastError, last_error_at AS lastErrorAt, created_by AS createdBy,
   updated_by AS updatedBy, created_at AS createdAt, updated_at AS updatedAt`;
@@ -65,11 +68,13 @@ function rowToController(row: ControllerRow): RuntimeController {
   };
 }
 function rowToPool(row: PoolRow): RuntimePool {
+  const cache = row.cache ? JSON.parse(row.cache) : null;
   return {
     ...row,
     placements: JSON.parse(row.placements),
     env: JSON.parse(row.env),
     resources: row.resources ? JSON.parse(row.resources) : null,
+    cache: cache ? { mountPath: cache.mountPath } : null,
     enabled: row.enabled === 1,
   };
 }
@@ -121,6 +126,17 @@ export async function getRuntimeControllerTarget(
     E2B_MAX_CONTINUOUS_SEC: env.E2B_MAX_CONTINUOUS_SEC,
     RUNTIME_WORKER_API_URL: env.RUNTIME_WORKER_API_URL,
     PUBLIC_MCP_BASE_URL: env.PUBLIC_MCP_BASE_URL,
+    ...(controller.kind === "boxd" && controller.placement === "builtin"
+      ? {
+          BOXD_ORG: env.BOXD_ORG,
+          BOXD_BASE_URL: env.BOXD_BASE_URL,
+          BOXD_SNAPSHOT: env.BOXD_SNAPSHOT,
+          BOXD_DELETE_AFTER_SEC: env.BOXD_DELETE_AFTER_SEC,
+          BOXD_START_TIMEOUT_SEC: env.BOXD_START_TIMEOUT_SEC,
+          BOXD_STATUS_TIMEOUT_SEC: env.BOXD_STATUS_TIMEOUT_SEC,
+          BOXD_TEARDOWN_TIMEOUT_SEC: env.BOXD_TEARDOWN_TIMEOUT_SEC,
+        }
+      : {}),
     ...controller.config,
     ...secrets,
   };
@@ -234,11 +250,32 @@ export async function updateRuntimeController(
     )
       throw new RuntimePoolError("Controller name already exists", 409);
     const pools = await listRuntimePools();
+    const oldConfig: Record<string, string> = JSON.parse(row.config);
+    const configChanged =
+      Object.keys(data.config).length !== Object.keys(oldConfig).length ||
+      Object.entries(data.config).some(([key, value]) => oldConfig[key] !== value);
+    const secrets = patch.secretConfig !== undefined ? controllerSecrets(row) : {};
+    const secretsChanged = Object.entries(patch.secretConfig ?? {}).some(([key, value]) =>
+      value === null ? key in secrets : secrets[key] !== value,
+    );
+    if (
+      (data.kind !== row.kind ||
+        data.placement !== row.placement ||
+        configChanged ||
+        secretsChanged) &&
+      (pools.some((pool) => pool.cache && pool.placements.includes(id)) ||
+        (await tx.get("SELECT id FROM runtime_cache_releases WHERE controller_id = ? LIMIT 1", [
+          id,
+        ])))
+    )
+      throw new RuntimePoolError(
+        "Disable pool caches and wait for cleanup before changing controller configuration or placement",
+        409,
+      );
     if (pools.some((pool) => pool.placements.includes(id) && pool.kind !== data.kind))
       throw new RuntimePoolError("Pool kind must equal controller kind");
     let encrypted = row.secretConfig;
     if (patch.secretConfig !== undefined) {
-      const secrets = controllerSecrets(row);
       for (const [key, value] of Object.entries(patch.secretConfig)) {
         if (value === null) delete secrets[key];
         else secrets[key] = value;
@@ -272,6 +309,8 @@ export async function deleteRuntimeController(id: string): Promise<void> {
     if (!(await getRuntimeController(id))) throw new RuntimePoolError("Controller not found", 404);
     if ((await listRuntimePools()).some((pool) => pool.placements.includes(id)))
       throw new RuntimePoolError("Controller has runtime pools", 409);
+    if (await tx.get("SELECT id FROM runtime_cache_releases WHERE controller_id = ? LIMIT 1", [id]))
+      throw new RuntimePoolError("Controller has pending cache cleanup", 409);
     await revokeControllerTokens(id);
     await tx.run("DELETE FROM runtime_controllers WHERE id = ?", [id]);
   });
@@ -291,6 +330,9 @@ export async function getRuntimePool(id: string): Promise<RuntimePool | null> {
 }
 async function validatePool(data: z.output<typeof RuntimePoolCreateSchema>): Promise<void> {
   supportedKind(data.kind);
+  if (data.cache && !(await createRuntimeProvider(data.kind)).traits.persistentCache) {
+    throw new RuntimePoolError(`${data.kind} does not support persistent pool caches`);
+  }
   const controller = await getRuntimeController(data.placements[0]!);
   if (!controller) throw new RuntimePoolError("Controller not found");
   if (data.kind !== controller.kind)
@@ -316,7 +358,7 @@ export async function createRuntimePool(
     if (await tx.get("SELECT id FROM runtime_pools WHERE name = ? OR id = ?", [data.name, id]))
       throw new RuntimePoolError("Pool already exists", 409);
     await tx.run(
-      `INSERT INTO runtime_pools (id, name, kind, placements, image, lifecycle, idle_minutes, slots_per_runtime, max_runtimes, min_runtimes, delivery, env, resources, ttl_sec, enabled, created_by, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT INTO runtime_pools (id, name, kind, placements, image, lifecycle, idle_minutes, slots_per_runtime, max_runtimes, min_runtimes, delivery, env, resources, cache, ttl_sec, enabled, created_by, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         data.name,
@@ -331,6 +373,9 @@ export async function createRuntimePool(
         data.delivery,
         JSON.stringify(data.env),
         data.resources ? JSON.stringify(data.resources) : null,
+        data.cache
+          ? JSON.stringify({ ...data.cache, key: poolCacheKey(id, crypto.randomUUID()) })
+          : null,
         data.ttlSec,
         Number(data.enabled),
         actor,
@@ -364,8 +409,19 @@ export async function updateRuntimePool(
     await validatePool(data);
     if (await tx.get("SELECT id FROM runtime_pools WHERE name = ? AND id != ?", [data.name, id]))
       throw new RuntimePoolError("Pool name already exists", 409);
+    const cache = data.cache
+      ? {
+          ...data.cache,
+          key:
+            existing.cache && data.placements[0] === existing.placements[0]
+              ? (await getPoolCache(id))!.key
+              : poolCacheKey(id, crypto.randomUUID()),
+        }
+      : null;
+    if (existing.cache && (!data.cache || data.placements[0] !== existing.placements[0]))
+      await queuePoolCacheRelease(existing, actor);
     await tx.run(
-      `UPDATE runtime_pools SET name = ?, kind = ?, placements = ?, image = ?, resolved_image = ?, lifecycle = ?, idle_minutes = ?, slots_per_runtime = ?, max_runtimes = ?, min_runtimes = ?, delivery = ?, env = ?, resources = ?, ttl_sec = ?, enabled = ?, updated_by = COALESCE(?, updated_by), updated_at = ? WHERE id = ?`,
+      `UPDATE runtime_pools SET name = ?, kind = ?, placements = ?, image = ?, resolved_image = ?, lifecycle = ?, idle_minutes = ?, slots_per_runtime = ?, max_runtimes = ?, min_runtimes = ?, delivery = ?, env = ?, resources = ?, cache = ?, ttl_sec = ?, enabled = ?, updated_by = COALESCE(?, updated_by), updated_at = ? WHERE id = ?`,
       [
         data.name,
         data.kind,
@@ -384,6 +440,7 @@ export async function updateRuntimePool(
         data.delivery,
         JSON.stringify(data.env),
         data.resources ? JSON.stringify(data.resources) : null,
+        cache ? JSON.stringify(cache) : null,
         data.ttlSec,
         Number(data.enabled),
         actor,
@@ -400,7 +457,8 @@ export async function deleteRuntimePool(
   actor: string | null = null,
 ): Promise<void> {
   await getDbClient().transaction(async (tx) => {
-    if (!(await getRuntimePool(id))) throw new RuntimePoolError("Pool not found", 404);
+    const pool = await getRuntimePool(id);
+    if (!pool) throw new RuntimePoolError("Pool not found", 404);
     if (
       await tx.get(
         "SELECT id FROM runtime_instances WHERE pool_id = ? AND status != 'offline' LIMIT 1",
@@ -419,6 +477,7 @@ export async function deleteRuntimePool(
         [new Date().toISOString(), actor, id],
       );
     }
+    await queuePoolCacheRelease(pool, actor);
     await tx.run("DELETE FROM runtime_pools WHERE id = ?", [id]);
   });
 }

package/src/be/runtime-pools/remote-controller.ts

@@ -53,6 +53,7 @@ export class RemoteController implements ControllerCommands {
   readonly renew?: ControllerCommands["renew"];
   readonly pause?: ControllerCommands["pause"];
   readonly resume?: ControllerCommands["resume"];
+  readonly releaseCache?: ControllerCommands["releaseCache"];
 
   constructor(
     readonly id: string,
@@ -61,6 +62,10 @@ export class RemoteController implements ControllerCommands {
     readonly workerApiUrl?: string,
     private readonly timeouts: { commandTimeoutMs?: number; provisionTimeoutMs?: number } = {},
   ) {
+    if (traits.persistentCache)
+      this.releaseCache = async (cache) => {
+        await this.call({ op: "release-cache", payload: cache });
+      };
     if (traits.maxTtlSec)
       this.renew = async (handle, ttlSec) =>
         z

package/src/be/runtime-pools/supervisor.ts

@@ -29,6 +29,7 @@ import {
   runtimeStaleThresholdMinutes,
 } from "../multi-runtime";
 import { mintRuntimeToken } from "../users";
+import { getPoolCache, reconcileCacheReleases } from "./cache-cleanup";
 import {
   clearRuntimeOwnerIdCache,
   ensureRuntimeOwnerId,
@@ -245,6 +246,13 @@ export async function provisionRuntime(
     if (pool.lifecycle === "per-task") env.SWARM_EXIT_AFTER_TASKS = "1";
     if (templateId) env.TEMPLATE_ID = templateId;
     const ttlSec = pool.kind === "e2b" ? poolLeaseTtl(pool, controller) : undefined;
+    const currentPoolCache = await getPoolCache(pool.id);
+    const currentCache =
+      currentPoolCache?.controllerId === pool.placements[0] ? currentPoolCache : null;
+    const cache =
+      currentCache && controller.traits.persistentCache
+        ? { key: currentCache.key, mountPath: currentCache.mountPath }
+        : undefined;
     signal?.throwIfAborted();
     const handle = await controller.provision({
       runtimeId,
@@ -255,6 +263,7 @@ export async function provisionRuntime(
       ...(ttlSec === undefined ? {} : { ttlSec }),
       env,
       resources: pool.resources ?? undefined,
+      ...(cache ? { cache } : {}),
       labels: {
         [RUNTIME_LABELS.runtimeId]: runtimeId,
         [RUNTIME_LABELS.poolId]: pool.id,
@@ -267,6 +276,25 @@ export async function provisionRuntime(
       await markRuntimeTerminated(runtimeId, "Supervisor stopped during provision");
       return false;
     }
+    const cacheWarning = currentCache
+      ? !controller.traits.persistentCache
+        ? "Controller does not support persistent caches; runtime started without cache"
+        : handle.meta?.cacheWarning
+      : undefined;
+    // A cache is optional: surface degradation without counting a provision failure.
+    const cacheErrorPrefix = "Persistent cache: ";
+    const cacheError = cacheWarning ? cacheErrorPrefix + scrubSecrets(cacheWarning) : null;
+    await getDbClient().run(
+      `UPDATE runtime_pools SET last_error = ?, last_error_at = ?
+       WHERE id = ? AND (last_error IS NULL OR substr(last_error, 1, ?) = ?)`,
+      [
+        cacheError,
+        cacheError ? new Date().toISOString() : null,
+        pool.id,
+        cacheErrorPrefix.length,
+        cacheErrorPrefix,
+      ],
+    );
     await getDbClient().run(
       "UPDATE runtime_instances SET external_handle = ?, lease_expires_at = ?, created_at = COALESCE(?, created_at), updated_at = ? WHERE id = ?",
       [
@@ -886,11 +914,14 @@ export async function reconcileOnce(
   opts: { now?: Date; getControllerCommands?: typeof getControllerCommands } = {},
 ): Promise<void> {
   if (!isRuntimePoolsEnabled() || !isMultiRuntimeEnabled() || inFlight) return;
-  tickAbort = new AbortController();
+  const tick = new AbortController();
+  tickAbort = tick;
   inFlight = reconcilePools(
     opts.now ?? new Date(),
     opts.getControllerCommands ?? getControllerCommands,
-    tickAbort.signal,
+    tick.signal,
+  ).then(() =>
+    reconcileCacheReleases(opts.getControllerCommands ?? getControllerCommands, tick.signal),
   );
   try {
     await inFlight;

package/src/be/scripts/typecheck.ts

@@ -65,6 +65,8 @@ export type AgentTaskStepConfig = {
   parentTaskId?: string;
   requestedByUserId?: string;
   outputSchema?: Record<string, unknown>;
+  /** Dispatch even when the follow-up re-delegation guard blocks this step (a run launched from a follow-up task in a Slack thread, checked at its first new step). */
+  allowRedelegation?: boolean;
   /** Wait for the dispatched task to reach a terminal status before resolving. Default: true. */
   waitForCompletion?: boolean;
   /** Max ms to wait for a terminal status before throwing. Default: 2h. Only used when waitForCompletion is true. */
@@ -315,6 +317,7 @@ export interface SwarmSdk {
   slack_downloadFile(args: { url: string }): Promise<unknown>;
   slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
   slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
+  slack_leaveThread(args: { taskId?: string; channelId?: string; threadTs?: string }): Promise<unknown>;
 
   // --- write: chat sdk ---
   chat_reply(args: { text: string }): Promise<unknown>;
@@ -496,6 +499,26 @@ export interface ScriptWorkflowSteps {
     label: string,
     config: { prompt: string; model?: string; schema?: Record<string, unknown> },
   ): Promise<unknown>;
+  /**
+   * Dispatch a task and journal its result under \`label\`.
+   *
+   * Resolves to the task's OUTPUT on success: the stored output string (JSON
+   * text under \`outputSchema\`, so parse it yourself), or \`null\` when the task
+   * stored none. It is never a task record: on a string, \`result.taskId\` and
+   * \`result.status\` are undefined; on \`null\`, reading them throws a TypeError.
+   * Other shapes:
+   * - \`failOnTaskFailure: false\` and the task ends failed/cancelled/superseded:
+   *   \`{ taskId, status: "failed", error }\`.
+   * - \`waitForCompletion: false\`: the first call still waits up to ~30s while
+   *   the server polls the task. Done in that window: the output, as on
+   *   success. Failed or cancelled in that window: throws, or
+   *   \`{ taskId, status: "failed", error }\` with \`failOnTaskFailure: false\`.
+   *   Still running: \`{ taskId, status }\`.
+   *
+   * To get a step's task id, query by its context key:
+   * \`SELECT id, status, output FROM agent_tasks WHERE contextKey = 'script-run:<runId>:<label>'
+   * AND taskType = 'script-run-step' ORDER BY createdAt DESC, rowid DESC LIMIT 1\`.
+   */
   agentTask(
     label: string,
     config: AgentTaskStepConfig,

package/src/be/seed/schedules-seeder.ts

@@ -76,8 +76,11 @@ import {
   computeContentHash,
   createScheduledTask,
   getScheduledTaskByName,
+  getWorkflow,
+  listWorkflows,
   updateScheduledTask,
 } from "../db";
+import { getScript } from "../scripts/db";
 import { resolveSeededEnabled } from "./automation-toggle";
 import type { Seeder, SeedItem } from "./types";
 import { canonicalJson } from "./workflows-seeder";
@@ -98,8 +101,27 @@ type ScheduleBlock = {
   cron: string;
   timezone?: string;
   enabled?: boolean;
+  /** What a fire runs. Default `agent-task`: the `## Scheduled Task` prompt becomes a task. */
+  targetType?: ScheduleTargetType;
+  /** `targetType: "workflow"`: the workflow's name, resolved to its id at apply time. */
+  workflow?: string;
+  /** `targetType: "script"`: a global script, run directly with `scriptArgs`. */
+  scriptName?: string;
+  scriptArgs?: Record<string, unknown>;
 };
 
+type ScheduleTargetType = "agent-task" | "workflow" | "script";
+const TARGET_TYPES: readonly ScheduleTargetType[] = ["agent-task", "workflow", "script"];
+
+/**
+ * The non-default target of a seeded schedule. Agent-task schedules carry none
+ * of these keys, so their seed hash is unchanged from before targets existed
+ * and recorded seed state on existing installs still matches.
+ */
+type SeedScheduleTarget =
+  | { targetType: "workflow"; workflow: string }
+  | { targetType: "script"; scriptName: string; scriptArgs: Record<string, unknown> };
+
 export type SeedSchedule = {
   name: string;
   description: string;
@@ -112,7 +134,7 @@ export type SeedSchedule = {
   params: Record<string, unknown>;
   requiredParams: string[];
   requires: AutomationIntegrationId[];
-};
+} & (SeedScheduleTarget | { targetType?: undefined });
 
 export type ScheduleTemplateSource = { config: string; content: string };
 type ScheduleSeedItem = SeedItem & { schedule: SeedSchedule };
@@ -167,10 +189,21 @@ function parseScheduleSource(source: ScheduleTemplateSource): SeedSchedule | nul
   const block = JSON.parse(blockMatch[1]) as ScheduleBlock;
   const afterBlock = scheduleStart + blockMatch.index! + blockMatch[0].length;
   const taskHeading = source.content.indexOf("## Scheduled Task", afterBlock);
-  const taskTemplate = source.content
-    .slice(taskHeading >= 0 ? taskHeading + "## Scheduled Task".length : afterBlock)
-    .trim();
-  if (!taskTemplate) throw new Error(`Schedule template ${config.name} has no task prompt`);
+  const target = parseScheduleTarget(config.name, block);
+  let taskTemplate = "";
+  if (target) {
+    // A workflow or script fire never reads a prompt: shipping one is a mistake.
+    if (taskHeading >= 0) {
+      throw new Error(
+        `Schedule template ${config.name} targets a ${target.targetType} but ships a ## Scheduled Task prompt it would ignore`,
+      );
+    }
+  } else {
+    taskTemplate = source.content
+      .slice(taskHeading >= 0 ? taskHeading + "## Scheduled Task".length : afterBlock)
+      .trim();
+    if (!taskTemplate) throw new Error(`Schedule template ${config.name} has no task prompt`);
+  }
 
   const requires = config.requires ?? [];
   const requiredParams = config.placeholders ?? [];
@@ -196,7 +229,37 @@ function parseScheduleSource(source: ScheduleTemplateSource): SeedSchedule | nul
     params: {},
     requiredParams,
     requires,
+    ...target,
+  };
+}
+
+/** Validate the block's target fields. Returns null for the default agent-task target. */
+function parseScheduleTarget(name: string, block: ScheduleBlock): SeedScheduleTarget | null {
+  const targetType = block.targetType ?? "agent-task";
+  if (!TARGET_TYPES.includes(targetType)) {
+    throw new Error(`Schedule template ${name} has unknown targetType "${targetType}"`);
+  }
+  const stray = (fields: (keyof ScheduleBlock)[]) => {
+    const set = fields.filter((field) => block[field] !== undefined);
+    if (set.length > 0) {
+      throw new Error(
+        `Schedule template ${name} (targetType ${targetType}) sets ${set.join(", ")}, which it would ignore`,
+      );
+    }
   };
+  switch (targetType) {
+    case "agent-task":
+      stray(["workflow", "scriptName", "scriptArgs"]);
+      return null;
+    case "workflow":
+      stray(["scriptName", "scriptArgs"]);
+      if (!block.workflow) throw new Error(`Schedule template ${name} has no workflow name`);
+      return { targetType, workflow: block.workflow };
+    case "script":
+      stray(["workflow"]);
+      if (!block.scriptName) throw new Error(`Schedule template ${name} has no scriptName`);
+      return { targetType, scriptName: block.scriptName, scriptArgs: block.scriptArgs ?? {} };
+  }
 }
 
 export function loadSeedSchedules(
@@ -212,7 +275,27 @@ function scheduleSeedHash(schedule: SeedSchedule): string {
   return computeContentHash(canonicalJson(schedule));
 }
 
-function scheduleFromRow(schedule: ScheduledTask): SeedSchedule {
+async function scheduleTargetFromRow(
+  schedule: ScheduledTask,
+): Promise<SeedScheduleTarget | undefined> {
+  switch (schedule.targetType) {
+    case "workflow": {
+      const workflow = schedule.workflowId ? await getWorkflow(schedule.workflowId) : null;
+      // A dangling id can never equal a seeded name, so the row reads as edited.
+      return { targetType: "workflow", workflow: workflow?.name ?? `id:${schedule.workflowId}` };
+    }
+    case "script":
+      return {
+        targetType: "script",
+        scriptName: schedule.scriptName ?? "",
+        scriptArgs: schedule.scriptArgs ?? {},
+      };
+    default:
+      return undefined;
+  }
+}
+
+async function scheduleFromRow(schedule: ScheduledTask): Promise<SeedSchedule> {
   return {
     name: schedule.name,
     description: schedule.description ?? "",
@@ -225,9 +308,48 @@ function scheduleFromRow(schedule: ScheduledTask): SeedSchedule {
     params: schedule.params ?? {},
     requiredParams: schedule.requiredParams ?? [],
     requires: schedule.requires ?? [],
+    ...(await scheduleTargetFromRow(schedule)),
   };
 }
 
+/** Resolve a seeded target to row fields, failing the item when its target is missing. */
+async function resolveTargetFields(schedule: SeedSchedule) {
+  switch (schedule.targetType) {
+    case "workflow": {
+      const name = schedule.workflow;
+      const workflow = (await listWorkflows()).find((candidate) => candidate.name === name);
+      if (!workflow) throw new Error(`Workflow "${name}" not found`);
+      return {
+        targetType: "workflow" as const,
+        workflowId: workflow.id,
+        scriptName: null,
+        scriptArgs: null,
+        taskTemplate: null,
+      };
+    }
+    case "script": {
+      if (!(await getScript({ name: schedule.scriptName, scope: "global" }))) {
+        throw new Error(`Global script "${schedule.scriptName}" not found`);
+      }
+      return {
+        targetType: "script" as const,
+        workflowId: null,
+        scriptName: schedule.scriptName,
+        scriptArgs: schedule.scriptArgs,
+        taskTemplate: null,
+      };
+    }
+    default:
+      return {
+        targetType: "agent-task" as const,
+        workflowId: null,
+        scriptName: null,
+        scriptArgs: null,
+        taskTemplate: schedule.taskTemplate,
+      };
+  }
+}
+
 function nextRunAt(schedule: SeedSchedule): string | null {
   try {
     // Disabled templates can await a required timezone parameter. Validate the
@@ -263,7 +385,7 @@ export function createSchedulesSeeder(
 
     async upstreamHash(item): Promise<string | null> {
       const existing = await getScheduledTaskByName(item.key);
-      return existing ? scheduleSeedHash(scheduleFromRow(existing)) : null;
+      return existing ? scheduleSeedHash(await scheduleFromRow(existing)) : null;
     },
 
     async apply(item): Promise<void> {
@@ -274,8 +396,7 @@ export function createSchedulesSeeder(
         cronExpression: schedule.cronExpression,
         timezone: schedule.timezone,
         enabled: schedule.enabled,
-        targetType: "agent-task" as const,
-        taskTemplate: schedule.taskTemplate,
+        ...(await resolveTargetFields(schedule)),
         taskType: schedule.taskType,
         tags: schedule.tags,
         params: schedule.params,
@@ -284,11 +405,16 @@ export function createSchedulesSeeder(
       };
       const existing = await getScheduledTaskByName(schedule.name);
       if (existing) {
+        // Nulls clear the previous target's fields when a template changes target.
         await updateScheduledTask(existing.id, { ...data, nextRunAt: resolvedNextRunAt });
       } else {
         await createScheduledTask({
           name: schedule.name,
           ...data,
+          workflowId: data.workflowId ?? undefined,
+          scriptName: data.scriptName ?? undefined,
+          scriptArgs: data.scriptArgs ?? undefined,
+          taskTemplate: data.taskTemplate ?? undefined,
           nextRunAt: resolvedNextRunAt ?? undefined,
         });
       }

package/src/be/seed/workflows-seeder.ts

@@ -71,10 +71,18 @@ import type {
   TriggerConfig,
   Workflow,
   WorkflowDefinition,
+  WorkflowSnapshot,
 } from "../../types";
 import { validateDefinition } from "../../workflows/definition";
-import { computeContentHash, createWorkflow, listWorkflows, updateWorkflow } from "../db";
+import {
+  computeContentHash,
+  createWorkflow,
+  getWorkflowVersions,
+  listWorkflows,
+  updateWorkflow,
+} from "../db";
 import { resolveSeededEnabled } from "./automation-toggle";
+import { getSeedState } from "./state-db";
 import type { Seeder, SeedItem } from "./types";
 
 type AutomationTemplateConfig = {
@@ -220,6 +228,62 @@ function workflowFromRow(workflow: Workflow): SeedWorkflow {
   };
 }
 
+function workflowFromSnapshot(snapshot: WorkflowSnapshot): SeedWorkflow {
+  return {
+    name: snapshot.name,
+    description: snapshot.description ?? "",
+    enabled: snapshot.enabled,
+    definition: snapshot.definition,
+    triggers: snapshot.triggers,
+    cooldown: snapshot.cooldown,
+    input: snapshot.input,
+    triggerSchema: snapshot.triggerSchema,
+    params: snapshot.params ?? {},
+    requiredParams: snapshot.requiredParams ?? [],
+    requires: snapshot.requires ?? [],
+  };
+}
+
+/**
+ * What a run executes, without the settings an operator is told to change:
+ * inputs (plain data, resolved the same for every caller), on/off, cooldown,
+ * description and event triggers.
+ */
+function executableSurface(workflow: SeedWorkflow): string {
+  const {
+    input: _input,
+    enabled: _enabled,
+    cooldown: _cooldown,
+    description: _description,
+    triggers: _triggers,
+    ...surface
+  } = workflow;
+  return canonicalJson(surface);
+}
+
+/**
+ * Whether a live workflow still runs seed source: `pristine` while what it
+ * executes matches what the seeder last wrote for its name, `edited` once
+ * anyone changed that, `unseeded` for a workflow the seeder never wrote.
+ * Operator settings (see `executableSurface`) keep it `pristine`. The seeded
+ * state is the live row itself or, once edited, the version snapshot taken
+ * before the first edit; an edit with no such snapshot counts as `edited`.
+ */
+export async function seededWorkflowState(
+  workflow: Workflow,
+): Promise<"pristine" | "edited" | "unseeded"> {
+  const state = await getSeedState("workflow", workflow.name);
+  if (!state) return "unseeded";
+  const live = workflowFromRow(workflow);
+  if (workflowSeedHash(live) === state.seededHash) return "pristine";
+  for (const version of await getWorkflowVersions(workflow.id)) {
+    const seeded = workflowFromSnapshot(version.snapshot);
+    if (workflowSeedHash(seeded) !== state.seededHash) continue;
+    return executableSurface(seeded) === executableSurface(live) ? "pristine" : "edited";
+  }
+  return "edited";
+}
+
 export function createWorkflowsSeeder(
   sources: readonly WorkflowTemplateSource[] = BUILT_IN_WORKFLOW_SOURCES,
 ): Seeder<WorkflowSeedItem> {

package/src/be/seed-pricing.ts

@@ -299,6 +299,8 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
     // strips the prefix, so we seed the bare id under `pi` too. Without this
     // every gh-copilot-backed pi run fell through to `costSource='unpriced'`.
     add(id, projectCostBlock("pi", id, model.cost));
+    // fx runs a bare OpenAI id on its `openai` custom connection.
+    add(id, projectCostBlock("fx", id, model.cost));
   }
 
   // ---- Cursor (bare vendor ids through Cursor's hosted inference) --------
@@ -358,6 +360,13 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
         anthropicBilled: id.startsWith("anthropic/"),
       }),
     );
+    // fx runs `openrouter/<id>` on its OpenRouter custom connection.
+    add(
+      id,
+      projectCostBlock("fx", id, model.cost, {
+        anthropicBilled: id.startsWith("anthropic/"),
+      }),
+    );
     // Gemini specifically: also project under the 'gemini' provider so
     // internal-ai callers that tag with provider='gemini' find a hit.
     if (id.startsWith("google/")) {
@@ -369,6 +378,20 @@ export function buildModelsDevSeedRows(cache: ModelsDevCache): PricingSeedRow[]
     }
   }
 
+  // ---- fx on Vercel AI Gateway (`vercel/<vendor>/<id>`) -------------------
+  // The prefix is stripped at lookup, so a gateway id lands on the same key as
+  // its OpenRouter twin. OpenRouter's row wins where both list the model (one
+  // source per key); the gateway section fills the ids OpenRouter lacks.
+  for (const [id, model] of Object.entries(cache.vercel?.models ?? {})) {
+    if (!model?.cost || openrouter[id]?.cost) continue;
+    add(
+      id,
+      projectCostBlock("fx", id, model.cost, {
+        anthropicBilled: id.startsWith("anthropic/"),
+      }),
+    );
+  }
+
   // ---- OpenAI-compatible registry providers ($0 flat-rate subscriptions) --
   // pi and opencode run these as `<provider>/<id>`. The models.dev `nan`
   // section and the registry-synthesized `helmcode` section