@desplega.ai/agent-swarm 2.7.5 → 2.7.7

package/src/apps/definition.ts

@@ -446,11 +446,12 @@ export const AppElementsSchema = z.record(AppNameSchema, AppElementSchema);
 
 /**
  * Preset theme id applied to the app's rendered surface. The catalog of
- * presets lives in the dashboard (`apps/ui/src/lib/themes.ts`) — the server
- * validates shape only, and the renderer resolves unknown ids to its default
- * theme, so definitions stay portable across dashboard versions whose preset
- * catalogs differ. Viewers can override it per-user via the reserved
- * `$theme` user-config key (see `user-config.ts`).
+ * presets lives in `src/themes/presets.ts` (the dashboard re-exports it from
+ * `apps/ui/src/lib/themes.ts`). App definitions are validated by shape only,
+ * and the renderer resolves unknown ids to its default theme, so definitions
+ * stay portable across dashboard versions whose preset catalogs differ.
+ * Viewers can override it per-user via the reserved `$theme` user-config key
+ * (see `user-config.ts`).
  */
 export const AppThemeIdSchema = z.string().regex(/^[a-z][a-z0-9-]{0,39}$/, {
   message: "must be a lowercase slug (letters, digits, dashes)",

package/src/be/db/page-theme-tokens.ts

@@ -0,0 +1,12 @@
+import { type Page, PageThemeTokensSchema } from "../../types";
+
+/** Stored `theme_tokens` JSON, or null when the column is empty, is not JSON, or has the wrong shape. */
+export function parsePageThemeTokens(raw: string | null): Page["themeTokens"] {
+  if (!raw) return null;
+  try {
+    const parsed = PageThemeTokensSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}

package/src/be/db/script-runs.ts

@@ -13,3 +13,26 @@ export async function getScriptRunExecutionArgs(id: string): Promise<unknown> {
   );
   return row ? openSealedJson(row.args) : undefined;
 }
+
+/** A durable run's follow-up re-delegation guard decision (see migration 266). */
+export type ScriptRunFollowUpGuard = "passed" | "same-work" | "loop-cap";
+
+export async function getScriptRunFollowUpGuard(
+  runId: string,
+): Promise<ScriptRunFollowUpGuard | null> {
+  const row = await getDbClient().get<{ followUpGuard: ScriptRunFollowUpGuard | null }>(
+    "SELECT followUpGuard FROM script_runs WHERE id = ?",
+    [runId],
+  );
+  return row?.followUpGuard ?? null;
+}
+
+export async function setScriptRunFollowUpGuard(
+  runId: string,
+  decision: ScriptRunFollowUpGuard,
+): Promise<void> {
+  await getDbClient().run("UPDATE script_runs SET followUpGuard = ? WHERE id = ?", [
+    decision,
+    runId,
+  ]);
+}

package/src/be/db/tasks/read.ts

@@ -869,6 +869,52 @@ export function readableSessionCondition(
   };
 }
 
+/** Parent hops the row-at-a-time walk takes before it falls back to the set form. */
+const READABLE_WALK_MAX_DEPTH = 64;
+
+/**
+ * The row-at-a-time form of {@link readableSessionCondition}, for a query that
+ * stops at a LIMIT. It walks up from each row it tests to the root, so a page
+ * costs a few key lookups per row instead of the set of every hidden task,
+ * which on a large DB took hundreds of milliseconds per request. The rule is
+ * the same: the root is the first task whose parent is null or missing. A row
+ * whose walk finds no root within {@link READABLE_WALK_MAX_DEPTH} hops (a very
+ * deep chain, or a parent cycle written before migration 253) falls back to
+ * the set form, which SQLite then builds once for the statement. A count reads
+ * every row, so it keeps the set form.
+ */
+function readableSessionRowCondition(
+  userId: string | null,
+  taskIdColumn = "agent_tasks.id",
+): { sql: string; params: string[] } {
+  const otherOwner = userId
+    ? "up.requestedByUserId IS NOT NULL AND up.requestedByUserId != ?"
+    : "up.requestedByUserId IS NOT NULL";
+  const shareMatch = userId ? "(s.userId IS NULL OR s.userId = ?)" : "s.userId IS NULL";
+  const set = readableSessionCondition(userId, taskIdColumn);
+  return {
+    sql: `(CASE (
+      WITH RECURSIVE up(id, parentTaskId, requestedByUserId, scheduleId, depth) AS (
+        SELECT u.id, u.parentTaskId, u.requestedByUserId, u.scheduleId, 0
+        FROM agent_tasks u WHERE u.id = ${taskIdColumn}
+        UNION ALL
+        SELECT p.id, p.parentTaskId, p.requestedByUserId, p.scheduleId, up.depth + 1
+        FROM up JOIN agent_tasks p ON p.id = up.parentTaskId
+        WHERE up.depth < ${READABLE_WALK_MAX_DEPTH}
+      )
+      SELECT CASE WHEN ${otherOwner} AND up.scheduleId IS NULL
+          AND NOT EXISTS (SELECT 1 FROM session_shares s
+            WHERE s.rootTaskId = up.id AND s.revokedAt IS NULL AND ${shareMatch})
+        THEN 1 ELSE 0 END
+      FROM up
+      WHERE up.parentTaskId IS NULL
+        OR NOT EXISTS (SELECT 1 FROM agent_tasks p WHERE p.id = up.parentTaskId)
+      LIMIT 1
+    ) WHEN 0 THEN 1 WHEN 1 THEN 0 ELSE ${set.sql} END)`,
+    params: [...(userId ? [userId, userId] : []), ...set.params],
+  };
+}
+
 export function getAllTasks(filters?: TaskFilters): Promise<AgentTask[]>;
 export function getAllTasks(
   filters: TaskFilters | undefined,
@@ -977,6 +1023,14 @@ export async function getAllTasks(
     params.push(filters.requestedByUserId);
   }
 
+  // Without selective filters, tiny LIMITs can make SQLite choose a full
+  // scan and sort when ANALYZE statistics are absent. Keep filtered pages
+  // planner-controlled so they can use their selective indexes.
+  const pageIndex =
+    conditions.length === 0 && !filters?.readableBy && filters?.orderBy !== "createdAt"
+      ? "INDEXED BY idx_agent_tasks_last_updated"
+      : "";
+
   // Exclude system/heartbeat tasks by default. The flag is still called
   // `includeHeartbeat` for backward compat with existing API callers, but we
   // also gate boot-triage + heartbeat-checklist behind it since those are
@@ -988,7 +1042,8 @@ export async function getAllTasks(
   }
 
   if (filters?.readableBy) {
-    const readable = readableSessionCondition(filters.readableBy.userId);
+    // The page stops at LIMIT, so test only the rows it reads.
+    const readable = readableSessionRowCondition(filters.readableBy.userId);
     conditions.push(readable.sql);
     params.push(...readable.params);
   }
@@ -1009,7 +1064,7 @@ export async function getAllTasks(
   // lastUpdatedAt index for a full scan. The outer sort adds it only to fix
   // the order of exact ties inside the page.
   const query = `WITH page AS (
-      SELECT rowid AS rid FROM agent_tasks ${whereClause}
+      SELECT rowid AS rid FROM agent_tasks ${pageIndex} ${whereClause}
       ORDER BY ${orderColumns.join(", ")} LIMIT ${limit} OFFSET ${offset}
     )
     SELECT ${LIST_COLUMNS[fields]},
@@ -1865,7 +1920,44 @@ export async function getMostRecentTaskInThread(
   return row ? rowToAgentTask(row) : null;
 }
 
-export async function findCompletedTaskInThread(
+/**
+ * One page of completed tasks in a Slack thread, most recent first. Lead
+ * `follow-up` sessions are excluded: they coordinate the work, they are not the
+ * work, so they never count as "the request was already handled". The caller
+ * matches descriptions in JS, so it pages through the whole window with the
+ * `before` keyset cursor (the last row of the previous page) instead of
+ * loading every row in one query.
+ */
+export async function findCompletedTasksInThread(
+  channelId: string,
+  threadTs: string,
+  windowMinutes: number,
+  limit = 200,
+  before?: { lastUpdatedAt: string; id: string },
+): Promise<AgentTask[]> {
+  const since = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
+  const cursorSql = before ? "AND (lastUpdatedAt < ? OR (lastUpdatedAt = ? AND id < ?))" : "";
+  const cursorParams = before ? [before.lastUpdatedAt, before.lastUpdatedAt, before.id] : [];
+  const rows = await getDbClient().query<AgentTaskRow>(
+    `SELECT * FROM agent_tasks
+       WHERE slackChannelId = ?
+       AND slackThreadTs = ?
+       AND status = 'completed'
+       AND COALESCE(taskType, '') != 'follow-up'
+       AND lastUpdatedAt > ?
+       ${cursorSql}
+       ORDER BY lastUpdatedAt DESC, id DESC
+       LIMIT ?`,
+    [channelId, threadTs, since, ...cursorParams, limit],
+  );
+  return rows.map(rowToAgentTask);
+}
+
+/**
+ * Most recent FAILED task in a Slack thread. A failure more recent than a
+ * completion means the follow-up re-delegation guard must let a retry through.
+ */
+export async function findRecentFailedTaskInThread(
   channelId: string,
   threadTs: string,
   windowMinutes: number,
@@ -1875,7 +1967,7 @@ export async function findCompletedTaskInThread(
     `SELECT * FROM agent_tasks
        WHERE slackChannelId = ?
        AND slackThreadTs = ?
-       AND status = 'completed'
+       AND status = 'failed'
        AND lastUpdatedAt > ?
        ORDER BY lastUpdatedAt DESC
        LIMIT 1`,
@@ -1884,6 +1976,41 @@ export async function findCompletedTaskInThread(
   return row ? rowToAgentTask(row) : null;
 }
 
+/**
+ * Count the dispatches one agent made into a Slack thread since the window
+ * start: each `send-task` task counts once, and each durable script run counts
+ * once however many `ctx.step.agentTask` steps it created (step tasks share the
+ * `script-run:<runId>:` contextKey prefix). A run is dated by its first step,
+ * the dispatch the guard checked, so a run that started before the window does
+ * not count again for steps it adds later. The follow-up re-delegation loop cap
+ * reads this.
+ */
+export async function countAgentDispatchesInThread(
+  channelId: string,
+  threadTs: string,
+  creatorAgentId: string,
+  windowMinutes: number,
+): Promise<number> {
+  const since = new Date(Date.now() - windowMinutes * 60 * 1000).toISOString();
+  const row = await getDbClient().get<{ c: number }>(
+    `SELECT COUNT(*) AS c FROM (
+       SELECT MIN(createdAt) AS firstAt FROM agent_tasks
+         WHERE slackChannelId = ?
+         AND slackThreadTs = ?
+         AND creatorAgentId = ?
+         AND source = 'mcp'
+         AND (createdAt > ? OR taskType = 'script-run-step')
+         GROUP BY CASE
+           WHEN taskType = 'script-run-step' AND contextKey LIKE 'script-run:%:%'
+             THEN substr(contextKey, 1, instr(substr(contextKey, 12), ':') + 10)
+           ELSE id
+         END
+     ) WHERE firstAt > ?`,
+    [channelId, threadTs, creatorAgentId, since, since],
+  );
+  return row?.c ?? 0;
+}
+
 /**
  * Find the most recent CANCELLED task in a Slack thread. Used by the
  * follow-up re-delegation guard so a cancellation (worker SIGTERM,

package/src/be/db/tasks/write.ts

@@ -394,6 +394,25 @@ export async function updateTaskTitle(
   return row ? rowToAgentTask(row) : null;
 }
 
+/**
+ * Sets a generated display title only while the task has none. A rename that
+ * landed first (a person, or another API replica) wins: the row is left alone
+ * and `null` comes back. Like `updateTaskTitle`, it does not bump
+ * `lastUpdatedAt`.
+ */
+export async function setTaskTitleIfUnset(
+  taskId: string,
+  title: string,
+): Promise<AgentTask | null> {
+  const normalized = title.trim();
+  if (!normalized) return null;
+  const row = await getDbClient().get<AgentTaskRow>(
+    "UPDATE agent_tasks SET title = ? WHERE id = ? AND title IS NULL RETURNING *",
+    [normalized, taskId],
+  );
+  return row ? rowToAgentTask(row) : null;
+}
+
 export async function completeTask(
   id: string,
   output?: string,

package/src/be/db-client.ts

@@ -177,6 +177,11 @@ export type BusyRetryOptions = {
    * Defaults to `DEFAULT_FINAL_ATTEMPT_SPIN_MS`.
    */
   finalAttemptSpinMs?: number;
+  /**
+   * Longest gap between spinning probes while an external holder is
+   * detected (see `BusyGate`). Defaults to `DEFAULT_MAX_GATE_MS`.
+   */
+  maxGateMs?: number;
 };
 
 /**
@@ -247,8 +252,81 @@ function isSqliteBusy(err: unknown): boolean {
   return typeof code === "string" && code.startsWith("SQLITE_BUSY");
 }
 
+/** Ceiling on the gap between spinning probes while a holder is detected. */
+const DEFAULT_MAX_GATE_MS = 1_000;
+/** A quiet stretch this long ends a BUSY episode even without a proven write. */
+const GATE_DECAY_MS = 5_000;
+
+/**
+ * Process-wide memory of a cross-process write-lock holder.
+ *
+ * Every retrying writer used to spin `attemptSpinMs` (100ms, or 250ms for the
+ * last attempt) SYNCHRONOUSLY inside the FIFO lock on every attempt. With N
+ * writers queued behind a holder that lasts minutes, one round of attempts
+ * costs N x 100ms of blocked event loop, and each attempt waits for that
+ * whole round before its own turn. A 5-minute Litestream snapshot turned
+ * the nominal 11s retry budget into 90-105s request hangs, 3s /health and
+ * 3s page loads, although only writes were contending.
+ *
+ * The gate records a BUSY seen by a spinning probe. For the next interval
+ * (doubling from `attemptSpinMs` up to `maxGateMs`) every attempt runs with
+ * a ZERO busy_timeout: it still tries, so recovery is immediate, but it
+ * fails in microseconds instead of blocking the loop, and the async backoff
+ * sleeps do the waiting. Once the interval lapses, the next attempt is the
+ * lone spinning probe again.
+ */
+class BusyGate {
+  private openUntil = 0;
+  private streak = 0;
+  private lastBusyAt = 0;
+  private episodeStartedAt = 0;
+  private episodeProbes = 0;
+
+  constructor(
+    private readonly baseMs: number,
+    private readonly maxMs: number,
+  ) {}
+
+  /** True while attempts must not spin. */
+  isOpen(now = performance.now()): boolean {
+    return now < this.openUntil;
+  }
+
+  /** A spinning probe hit BUSY: a holder exists. Open the gate and widen it. */
+  recordBusy(now = performance.now()): void {
+    if (this.streak > 0 && now - this.lastBusyAt > GATE_DECAY_MS) this.endEpisode(now, "decayed");
+    if (this.streak === 0) {
+      this.episodeStartedAt = now;
+      this.episodeProbes = 0;
+      console.warn(
+        "[db-client] SQLITE_BUSY: another process holds the write lock; spinning at most one probe per gate interval until it releases",
+      );
+    }
+    this.streak += 1;
+    this.episodeProbes += 1;
+    this.lastBusyAt = now;
+    const interval = Math.min(this.maxMs, this.baseMs * 2 ** Math.min(this.streak - 1, 20));
+    this.openUntil = now + interval;
+  }
+
+  /** A write got through after BUSY: the holder is gone. */
+  recordRecovered(now = performance.now()): void {
+    if (this.streak === 0) return;
+    this.endEpisode(now, "released");
+  }
+
+  private endEpisode(now: number, how: "released" | "decayed"): void {
+    console.warn(
+      `[db-client] write lock ${how} after ${Math.round(now - this.episodeStartedAt)}ms (${this.episodeProbes} spinning probes)`,
+    );
+    this.streak = 0;
+    this.openUntil = 0;
+  }
+}
+
 class BunSqliteClient implements DbClient {
   private readonly lock = new FifoLock();
+  private readonly gate: BusyGate;
   private savepointSeq = 0;
   /** Lazily captured ambient busy_timeout, restored after each short-spin attempt. */
   private restoreBusyTimeoutMs: number | null = null;
@@ -256,7 +334,12 @@ class BunSqliteClient implements DbClient {
   constructor(
     private readonly getDatabase: () => Database,
     private readonly busyRetry: BusyRetryOptions = DEFAULT_BUSY_RETRY,
-  ) {}
+  ) {
+    this.gate = new BusyGate(
+      busyRetry.attemptSpinMs,
+      Math.max(busyRetry.attemptSpinMs, busyRetry.maxGateMs ?? DEFAULT_MAX_GATE_MS),
+    );
+  }
 
   query<T>(sql: string, params: DbParam[] = []): Promise<T[]> {
     return this.execute(sql, (db) => db.query<T, DbParam[]>(sql).all(...params));
@@ -352,6 +435,7 @@ class BunSqliteClient implements DbClient {
           // not. The short spin keeps the driver's synchronous busy wait off
           // the event loop; the real waiting is the caller's async backoff.
           this.shortSpin(db, () => db.run("BEGIN IMMEDIATE"), finalAttempt);
+          this.gate.recordRecovered();
         } catch (err) {
           if (isSqliteBusy(err)) return { ok: false, busyBegin: err };
           throw err;
@@ -366,7 +450,7 @@ class BunSqliteClient implements DbClient {
         // is exact. The open transaction pins the connection, so these
         // retries hold the FIFO lock and their sleeps block queued work;
         // WAL-mode COMMIT BUSY is rare enough for that to be acceptable.
-        await this.retryHoldingLock(() => this.shortSpin(db, () => db.run("COMMIT")));
+        await this.retryHoldingLock(() => this.shortSpin(db, () => db.run("COMMIT"), false, false));
       }
       for (const hook of ctx.afterCommit) this.scheduleHook(hook);
       return { ok: true, value: result };
@@ -468,11 +552,17 @@ class BunSqliteClient implements DbClient {
         if (!willRetry) warnIfSlowStatement(sql, ms);
       }
     };
+    // The first call opens the database and applies migrations; resolve it
+    // before the timer, so boot work is not logged as this statement's cost.
+    // Outside a transaction it resolves inside the retry loop, so a boot that
+    // hits SQLITE_BUSY boots again.
     const ctx = txContext.getStore();
     if (ctx && !ctx.closed) {
-      return timed(() => op(this.getDatabase()));
+      const db = this.getDatabase();
+      return timed(() => op(db));
     }
     let sleptMs = 0;
+    let sawBusy = false;
     for (let attemptIndex = 0; ; attemptIndex++) {
       const next = this.busyRetry.backoffMs[attemptIndex];
       const canRetryAfter = next !== undefined && sleptMs + next <= this.busyRetry.maxWaitMs;
@@ -482,12 +572,15 @@ class BunSqliteClient implements DbClient {
         // A top-level single statement is atomic, so a repeat on BUSY is
         // exact. The final attempt spins `finalAttemptSpinMs` (see
         // transaction()).
-        return timed(
-          () => this.shortSpin(this.getDatabase(), () => op(this.getDatabase()), !canRetryAfter),
-          canRetryAfter,
-        );
+        const db = this.getDatabase();
+        const result = timed(() => this.shortSpin(db, () => op(db), !canRetryAfter), canRetryAfter);
+        // A statement that was BUSY earlier in this call and now landed is a
+        // write that got through: the external holder is gone.
+        if (sawBusy) this.gate.recordRecovered();
+        return result;
       } catch (err) {
         if (!isSqliteBusy(err) || !canRetryAfter || next === undefined) throw err;
+        sawBusy = true;
         backoff = next;
         sleptMs += next;
       } finally {
@@ -506,17 +599,27 @@ class BunSqliteClient implements DbClient {
    * lock is held, so the set/attempt/restore sequence cannot interleave with
    * other client work.
    */
-  private shortSpin<T>(db: Database, attempt: () => T, finalAttempt = false): T {
+  private shortSpin<T>(db: Database, attempt: () => T, finalAttempt = false, gateable = true): T {
     if (this.restoreBusyTimeoutMs === null) {
       const row = db.query<{ timeout: number }, []>("PRAGMA busy_timeout").get();
       this.restoreBusyTimeoutMs = row?.timeout ?? 5000;
     }
-    const spinMs = finalAttempt
-      ? (this.busyRetry.finalAttemptSpinMs ?? DEFAULT_FINAL_ATTEMPT_SPIN_MS)
-      : this.busyRetry.attemptSpinMs;
+    // While a holder is known (BusyGate) the attempt runs without a spin: it
+    // still tries, so a released lock is taken at once, but a held one costs
+    // microseconds of event loop instead of a full spin per queued writer.
+    // Only the spinning probe that follows a lapsed gate reports BUSY back.
+    const gated = gateable && this.gate.isOpen();
+    const spinMs = gated
+      ? 0
+      : finalAttempt
+        ? (this.busyRetry.finalAttemptSpinMs ?? DEFAULT_FINAL_ATTEMPT_SPIN_MS)
+        : this.busyRetry.attemptSpinMs;
     db.exec(`PRAGMA busy_timeout = ${spinMs}`);
     try {
       return attempt();
+    } catch (err) {
+      if (gateable && !gated && isSqliteBusy(err)) this.gate.recordBusy();
+      throw err;
     } finally {
       db.exec(`PRAGMA busy_timeout = ${this.restoreBusyTimeoutMs}`);
     }

package/src/be/db.ts

@@ -198,6 +198,7 @@ import {
 } from "./db/context-versions";
 import { clearAgentModelProfileOnOverrideChange } from "./db/model-profiles";
 import { pageSearchSql } from "./db/page-search";
+import { parsePageThemeTokens } from "./db/page-theme-tokens";
 import { getDb, getDbClient } from "./db/runtime";
 import {
   assertAssetKeyMovesAllowed,
@@ -313,7 +314,11 @@ export {
   getContextVersionHistory,
   getLatestContextVersion,
 } from "./db/context-versions";
-export { getScriptRunExecutionArgs } from "./db/script-runs";
+export {
+  getScriptRunExecutionArgs,
+  getScriptRunFollowUpGuard,
+  setScriptRunFollowUpGuard,
+} from "./db/script-runs";
 export {
   AssetKeyMovesBlockedError,
   assertAssetKeyMovesAllowed,
@@ -336,12 +341,14 @@ export {
 } from "./db/runtime";
 
 export {
+  countAgentDispatchesInThread,
   type ExistingTrackerContextWork,
   type ExistingTrackerContextWorkReason,
   findActiveTasksByVcs,
-  findCompletedTaskInThread,
+  findCompletedTasksInThread,
   findExistingLinearTrackerContextWork,
   findRecentCancelledTaskInThread,
+  findRecentFailedTaskInThread,
   findTaskByGitHub,
   findTaskByVcs,
   getAgentCurrentTask,
@@ -407,6 +414,7 @@ export {
   recordTaskProviderIfUnset,
   resetOrphanedInProgressTasksForAgent,
   resumeTask,
+  setTaskTitleIfUnset,
   settleSupersededTaskDependents,
   startTask,
   supersedeTask,
@@ -8613,6 +8621,9 @@ type PageRow = {
   createdAt: string;
   updatedAt: string;
   view_count: number;
+  theme: string | null;
+  theme_tokens: string | null;
+  design_version: number;
 };
 
 function rowToPage(row: PageRow): Page {
@@ -8630,6 +8641,9 @@ function rowToPage(row: PageRow): Page {
     needsCredentials: row.needsCredentials
       ? (JSON.parse(row.needsCredentials) as string[])
       : undefined,
+    theme: row.theme ?? null,
+    themeTokens: parsePageThemeTokens(row.theme_tokens),
+    designVersion: typeof row.design_version === "number" ? row.design_version : 1,
     viewCount: typeof row.view_count === "number" ? row.view_count : 0,
     createdAt: normalizeDateRequired(row.createdAt),
     updatedAt: normalizeDateRequired(row.updatedAt),
@@ -8647,13 +8661,17 @@ export async function createPage(data: {
   passwordHash?: string;
   body: string;
   needsCredentials?: string[];
+  theme?: string | null;
+  themeTokens?: Page["themeTokens"];
+  /** Defaults to 2 (the swarm design system). Rows inserted outside this function default to 1. */
+  designVersion?: number;
 }): Promise<Page> {
   // Match the historical SQL default ID shape while making the value
   // available before insert so the default namespace can include it.
   const id = crypto.randomUUID().replace(/-/g, "");
   const row = await getDbClient().get<PageRow>(
-    `INSERT INTO pages (id, "key", agentId, slug, title, description, contentType, authMode, passwordHash, body, needsCredentials)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+    `INSERT INTO pages (id, "key", agentId, slug, title, description, contentType, authMode, passwordHash, body, needsCredentials, theme, theme_tokens, design_version)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
     [
       id,
       normalizeAssetKey(data.key ?? defaultAssetKey("page", id)),
@@ -8666,6 +8684,9 @@ export async function createPage(data: {
       data.passwordHash ?? null,
       data.body,
       data.needsCredentials ? JSON.stringify(data.needsCredentials) : null,
+      data.theme ?? null,
+      data.themeTokens ? JSON.stringify(data.themeTokens) : null,
+      data.designVersion ?? 2,
     ],
   );
   if (!row) throw new Error("Failed to create page");
@@ -8852,6 +8873,11 @@ export async function updatePage(
     body?: string;
     needsCredentials?: string[] | null;
     slug?: string;
+    /** undefined keeps the stored value, null clears it. */
+    theme?: string | null;
+    /** undefined keeps the stored value, null clears it. */
+    themeTokens?: Page["themeTokens"];
+    designVersion?: number;
   },
 ): Promise<Page | null> {
   const updates: string[] = [];
@@ -8892,6 +8918,18 @@ export async function updatePage(
     updates.push("slug = ?");
     params.push(data.slug);
   }
+  if (data.theme !== undefined) {
+    updates.push("theme = ?");
+    params.push(data.theme);
+  }
+  if (data.themeTokens !== undefined) {
+    updates.push("theme_tokens = ?");
+    params.push(data.themeTokens ? JSON.stringify(data.themeTokens) : null);
+  }
+  if (data.designVersion !== undefined) {
+    updates.push("design_version = ?");
+    params.push(data.designVersion);
+  }
   if (updates.length === 0) return getPage(id);
   updates.push("updatedAt = ?");
   params.push(new Date().toISOString());
@@ -14116,6 +14154,7 @@ type ScriptRunRow = {
   last_heartbeat_at: string | null;
   idempotencyKey: string | null;
   requestedByUserId: string | null;
+  sourceTaskId: string | null;
   created_by: string | null;
   updated_by: string | null;
 };
@@ -14160,6 +14199,7 @@ function rowToScriptRun(row: ScriptRunRow): ScriptRun {
     lastHeartbeatAt: row.last_heartbeat_at ?? undefined,
     idempotencyKey: row.idempotencyKey ?? undefined,
     requestedByUserId: row.requestedByUserId ?? undefined,
+    sourceTaskId: row.sourceTaskId ?? undefined,
   };
 }
 
@@ -14188,6 +14228,7 @@ export async function createScriptRun(data: {
   scriptName?: string;
   idempotencyKey?: string;
   requestedByUserId?: string;
+  sourceTaskId?: string;
   createdBy?: string;
   updatedBy?: string;
 }): Promise<{ run: ScriptRun; existing: boolean }> {
@@ -14202,8 +14243,9 @@ export async function createScriptRun(data: {
 
   const row = await client.get<ScriptRunRow>(
     `INSERT INTO script_runs
-        (id, agentId, scriptName, source, args, idempotencyKey, requestedByUserId, created_by, updated_by)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        (id, agentId, scriptName, source, args, idempotencyKey, requestedByUserId, sourceTaskId,
+         created_by, updated_by)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        RETURNING *`,
     [
       data.id,
@@ -14216,6 +14258,7 @@ export async function createScriptRun(data: {
       sealJson(data.args ?? null),
       data.idempotencyKey ?? null,
       data.requestedByUserId ?? null,
+      data.sourceTaskId ?? null,
       data.createdBy ?? null,
       data.updatedBy ?? data.createdBy ?? null,
     ],