@andreprado/agentkit 0.1.1 → 0.2.0

package/src/index.ts

@@ -1,4 +1,4 @@
-export type AgentRuntime = "local" | "edge";
+export type AgentRuntime = "local";
 export type AgentProviderName = "test" | "openai" | "openai-codex" | "anthropic" | "openrouter" | "opencode" | "opencode-go" | "custom";
 export type AccessMode = "private" | "token" | "public";
 export type ToolVisibility = "user" | "internal";
@@ -275,38 +275,12 @@ export type AgentChannel =
   | GenericWebhookChannelConfig
   | GenericWebhookOutputChannelConfig;
 
-export type IntegrationTagsConfig = {
-  enable?: string[];
-  disable?: string[];
-};
-
-export type ComposioManagedIntegrationInput = {
-  name?: string;
-  toolkits: string[];
-  tools?: Record<string, string[]>;
-  tags?: IntegrationTagsConfig;
-  confirmExternalWrites?: boolean;
-};
-
-export type ComposioManagedIntegration = {
-  type: "composio";
-  provider: "composio";
-  mode: "managed";
-  name: string;
-  toolkits: string[];
-  tools?: Record<string, string[]>;
-  tags?: IntegrationTagsConfig;
-  confirmExternalWrites?: boolean;
-};
-
-export type AgentIntegration = ComposioManagedIntegration;
-
 export type AgentDatabaseConfig =
   | {
       driver: "none";
     }
   | {
-      driver: "turso";
+      driver: "sqlite";
       schema?: string;
       migrations?: string;
     };
@@ -316,8 +290,7 @@ export type AgentFilesConfig =
       driver: "none";
     }
   | {
-      driver: "r2";
-      bucket?: string;
+      driver: "local";
       prefix?: string;
       maxUploadBytes?: number;
     };
@@ -417,10 +390,10 @@ export type ToolRenderContext<Input = unknown> = {
 };
 
 export type ToolRuntimeContext = {
-  environment: "local" | "hosted" | "eval" | "test";
+  environment: "local" | "eval" | "test";
   invocation: "chat" | "tool" | "dev" | "channel" | "eval" | "sync";
-  target: "bun" | "cloudflare";
-  database: "sqlite" | "turso" | "none";
+  target: "bun";
+  database: "sqlite" | "none";
 };
 
 export type ToolClockContext = {
@@ -472,7 +445,6 @@ export type AgentConfig = {
   instructions: string;
   secrets: string[];
   tools?: AgentTool[];
-  integrations?: AgentIntegration[];
   channels?: AgentChannel[];
   transcription?: AgentTranscriptionConfig;
   knowledge?: AgentKnowledgeConfig;
@@ -495,25 +467,6 @@ export function defineTool<Input = unknown, Output = unknown>(tool: AgentTool<In
   return tool;
 }
 
-export function composioManaged(input: ComposioManagedIntegrationInput): ComposioManagedIntegration {
-  const name = normalizeIntegrationName(input.name ?? "composio", "composio integration name");
-  const toolkits = normalizeToolkitList(input.toolkits, "composioManaged.toolkits");
-  const tools = input.tools ? normalizeComposioToolMap(input.tools, toolkits) : undefined;
-  const tags = input.tags ? normalizeIntegrationTags(input.tags) : undefined;
-  const confirmExternalWrites = input.confirmExternalWrites;
-
-  return {
-    type: "composio",
-    provider: "composio",
-    mode: "managed",
-    name,
-    toolkits,
-    ...(tools ? { tools } : {}),
-    ...(tags ? { tags } : {}),
-    ...(confirmExternalWrites === undefined ? {} : { confirmExternalWrites }),
-  };
-}
-
 export function websiteChannel(input: WebsiteChannelInput): WebsiteChannelConfig {
   return {
     type: "website",
@@ -663,109 +616,6 @@ function normalizeSecretName(secret: string, context: string): string {
   return secret;
 }
 
-function normalizeIntegrationName(value: string, context: string): string {
-  const name = value.trim();
-
-  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
-    throw new Error(`${context} must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.`);
-  }
-
-  return name;
-}
-
-function normalizeToolkitList(values: string[], context: string): string[] {
-  if (!Array.isArray(values) || values.length === 0) {
-    throw new Error(`${context} must include at least one toolkit slug.`);
-  }
-
-  const toolkits = new Set<string>();
-
-  for (const value of values) {
-    if (typeof value !== "string") {
-      throw new Error(`${context} entries must be toolkit slug strings.`);
-    }
-
-    const toolkit = value.trim().toLowerCase();
-
-    if (!/^[a-z][a-z0-9_-]*$/.test(toolkit)) {
-      throw new Error(`${context} entries must start with a letter and contain only letters, numbers, underscores, and hyphens.`);
-    }
-
-    toolkits.add(toolkit);
-  }
-
-  return Array.from(toolkits).sort();
-}
-
-function normalizeComposioToolMap(values: Record<string, string[]>, toolkits: string[]): Record<string, string[]> | undefined {
-  const toolkitSet = new Set(toolkits);
-  const normalized: Record<string, string[]> = {};
-
-  for (const [rawToolkit, rawTools] of Object.entries(values)) {
-    const toolkit = rawToolkit.trim().toLowerCase();
-
-    if (!toolkitSet.has(toolkit)) {
-      throw new Error(`composioManaged.tools.${rawToolkit} must reference a toolkit listed in composioManaged.toolkits.`);
-    }
-
-    if (!Array.isArray(rawTools) || rawTools.length === 0) {
-      throw new Error(`composioManaged.tools.${rawToolkit} must include at least one Composio action slug.`);
-    }
-
-    const tools = new Set<string>();
-
-    for (const rawTool of rawTools) {
-      if (typeof rawTool !== "string") {
-        throw new Error(`composioManaged.tools.${rawToolkit} entries must be Composio action slug strings.`);
-      }
-
-      const tool = rawTool.trim().toUpperCase();
-
-      if (!/^[A-Z][A-Z0-9_]*$/.test(tool)) {
-        throw new Error(`composioManaged.tools.${rawToolkit} entries must be uppercase Composio action slugs.`);
-      }
-
-      tools.add(tool);
-    }
-
-    normalized[toolkit] = Array.from(tools).sort();
-  }
-
-  return Object.keys(normalized).length > 0 ? normalized : undefined;
-}
-
-function normalizeIntegrationTags(tags: IntegrationTagsConfig): IntegrationTagsConfig {
-  const normalized: IntegrationTagsConfig = {};
-
-  if (tags.enable !== undefined) {
-    normalized.enable = normalizeTagList(tags.enable, "composioManaged.tags.enable");
-  }
-
-  if (tags.disable !== undefined) {
-    normalized.disable = normalizeTagList(tags.disable, "composioManaged.tags.disable");
-  }
-
-  return normalized;
-}
-
-function normalizeTagList(values: string[], context: string): string[] {
-  if (!Array.isArray(values)) {
-    throw new Error(`${context} must be an array of tag strings.`);
-  }
-
-  return Array.from(
-    new Set(
-      values.map((value) => {
-        if (typeof value !== "string" || value.trim().length === 0) {
-          throw new Error(`${context} entries must be non-empty strings.`);
-        }
-
-        return value.trim();
-      }),
-    ),
-  ).sort();
-}
-
 function normalizeChannelBuffer(input: ChannelBufferInput, context: string): ChannelBufferConfig {
   if (input.mode === "off") {
     return { mode: "off" };
@@ -928,8 +778,6 @@ export { getConversationTraceFromCwd } from "./runtime/traces";
 export { runToolFromCwd } from "./runtime/tool-runner";
 export { startAgentDevServer } from "./runtime/dev-server";
 export { inspectAgentCapsule } from "./runtime/inspect";
-export { buildAgentCapsule } from "./runtime/build";
-export { deployBuildToAgentKitCloud } from "./runtime/deploy";
 export { AgentKitError } from "./runtime/errors";
 export type {
   ChannelAdapter,

package/src/providers/pi.ts

@@ -117,7 +117,9 @@ export function providerToolResultText(result: {
   visibility?: "user" | "internal";
   rendered?: { text?: string };
   output: unknown;
+  modelText?: string;
 }): string {
+  if (result.modelText !== undefined) return result.modelText;
   if (result.visibility === "internal") {
     return `Internal tool ${result.name} completed.`;
   }

package/src/runtime/channels/discord.ts

@@ -124,9 +124,9 @@ export const discordChannelAdapter: ChannelAdapter = {
       }
 
       return {
-        status: "waiting_for_provider_event",
+        status: "needs_setup",
         checkedAt: new Date().toISOString(),
-        message: "Invite the Discord bot to a server and enable Message Content Intent.",
+        message: "AgentKit does not connect to the Discord Gateway. Use interactions or run your own Gateway bridge to forward authenticated bot events; inviting the bot alone is insufficient. Bridge connectivity cannot be verified here.",
       };
     }
 

package/src/runtime/chat.ts

@@ -6,9 +6,8 @@ import type { ConversationRecord, ConversationSummary, PersistedChatRun } from "
 import type { LoadedAgentCapsule } from "./config";
 import { loadAgentCapsule } from "./config";
 import { openPreparedCapsuleStore } from "./database";
-import { loadCapsuleEnv } from "./env";
+import { collectSecretValues, loadCapsuleEnv } from "./env";
 import { AgentKitError, isAgentKitError } from "./errors";
-import { createManagedComposioTools } from "./integrations/composio";
 import { syncConfiguredKnowledgeSources } from "./knowledge/ingest";
 import { appendKnowledgePromptPolicy } from "./knowledge/prompt-policy";
 import { createKnowledgeSearchTool } from "./knowledge/tool";
@@ -46,6 +45,7 @@ export async function runAgentMessage(
 
   const adapter = getProviderAdapter(capsule.config.provider);
   const env = await loadCapsuleEnv(capsule.root);
+  const secretValues = collectSecretValues(capsule.config, env);
   await syncConfiguredKnowledgeSources(capsule);
   const conversationId = normalizeConversationId(options.conversationId);
   const { store } = await openPreparedCapsuleStore(capsule);
@@ -81,6 +81,7 @@ export async function runAgentMessage(
       runId: run.id,
       conversationId: conversation.id,
       env,
+      secretValues,
       signal: options.signal,
       clock,
       runtime: {
@@ -140,6 +141,7 @@ export async function runAgentMessage(
         status: "failed",
         errorCode: isAgentKitError(error) ? error.code : "runtime_error",
         errorMessage: error instanceof Error ? error.message : String(error),
+        secretValues,
       });
     }
 
@@ -150,7 +152,7 @@ export async function runAgentMessage(
 }
 
 function withKnowledgeTools(capsule: LoadedAgentCapsule): NonNullable<LoadedAgentCapsule["config"]["tools"]> {
-  const tools = [...createManagedComposioTools(capsule.config), ...(capsule.config.tools ?? [])];
+  const tools = capsule.config.tools ?? [];
   const knowledgeTool = createKnowledgeSearchTool(capsule);
 
   if (knowledgeTool) {

package/src/runtime/config.ts

@@ -17,17 +17,15 @@ import type {
   TelegramAllowedUpdate,
   AgentKnowledgeEmbeddingProvider,
   ChannelBufferMode,
-  AgentIntegration,
   ChannelAudioMode,
   TranscriptionProviderName,
   ChannelReplyRouteConfig,
 } from "../index";
-import { MANAGED_COMPOSIO_TOOL_NAME } from "./integrations/composio";
 import { AgentKitError } from "./errors";
 import { isValidTimeZone } from "./prompt-context";
 
 const CONFIG_FILE = "agentkit.config.ts";
-const AGENT_RUNTIMES = new Set<AgentRuntime>(["local", "edge"]);
+const AGENT_RUNTIMES = new Set<AgentRuntime>(["local"]);
 const PROVIDERS = new Set<AgentProviderName>(["test", "openai", "openai-codex", "anthropic", "openrouter", "opencode", "opencode-go", "custom"]);
 const ACCESS_MODES = new Set<AccessMode>(["private", "token", "public"]);
 const TOOL_VISIBILITIES = new Set<ToolVisibility>(["user", "internal"]);
@@ -41,9 +39,6 @@ const KNOWLEDGE_EMBEDDING_PROVIDERS = new Set<AgentKnowledgeEmbeddingProvider>([
 const TRANSCRIPTION_PROVIDERS = new Set<TranscriptionProviderName>(["test", "openai", "groq"]);
 const CHANNEL_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 const CHANNEL_REPLY_PATH_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
-const INTEGRATION_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
-const COMPOSIO_TOOLKIT_PATTERN = /^[a-z][a-z0-9_-]*$/;
-const COMPOSIO_TOOL_SLUG_PATTERN = /^[A-Z][A-Z0-9_]*$/;
 const SECRET_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
 const HTTP_HEADER_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9-]*$/;
 const moduleDir = dirname(fileURLToPath(import.meta.url));
@@ -125,7 +120,7 @@ function resolveLocalStoragePath(root: string, config: AgentConfig): string | un
 
 // Every import of the config goes through a uniquely named temp module, and
 // Node never evicts imported modules. Re-importing on each request (the dev and
-// container servers load the capsule per request) grows memory without bound,
+// local servers load the capsule per request) grows memory without bound,
 // so reuse the import while the config source is unchanged. Edits still reload.
 const configModuleCache = new Map<string, { source: string; value: Promise<unknown> }>();
 
@@ -228,7 +223,7 @@ function validateAgentConfig(value: unknown): asserts value is AgentConfig {
   expectString(value.name, "name");
 
   if (!AGENT_RUNTIMES.has(value.runtime as AgentRuntime)) {
-    throw invalidConfig('runtime must be "local" or "edge".');
+    throw invalidConfig('runtime must be "local". Hosted runtimes are no longer supported.');
   }
 
   if (!isRecord(value.provider)) {
@@ -267,9 +262,11 @@ function validateAgentConfig(value: unknown): asserts value is AgentConfig {
     }
   }
 
-  validateIntegrations(value.integrations, value.runtime as AgentRuntime, value.tools);
+  if (value.integrations !== undefined) {
+    throw invalidConfig("Managed integrations are no longer supported. Connect external services through defineTool.");
+  }
   validateTranscriptionConfig(value.transcription);
-  validateChannels(value.channels, value.runtime as AgentRuntime, Boolean(value.transcription));
+  validateChannels(value.channels, Boolean(value.transcription));
   validateKnowledgeConfig(value.knowledge);
 
   if (!isRecord(value.access) || !ACCESS_MODES.has(value.access.mode as AccessMode)) {
@@ -296,133 +293,6 @@ function validateAgentConfig(value: unknown): asserts value is AgentConfig {
   validateFilesConfig(value.storage.files);
 }
 
-function validateIntegrations(
-  value: unknown,
-  runtime: AgentRuntime,
-  tools: AgentConfig["tools"] = [],
-): void {
-  if (value === undefined) {
-    return;
-  }
-
-  if (!Array.isArray(value)) {
-    throw invalidConfig("integrations must be an array when provided.");
-  }
-
-  if (value.length > 0 && runtime !== "edge") {
-    throw invalidConfig('managed integrations require runtime: "edge". Use BYO defineTool wrappers for local-only integrations.');
-  }
-
-  let composioCount = 0;
-
-  for (const [index, integration] of value.entries()) {
-    if (!isRecord(integration)) {
-      throw invalidConfig(`integrations[${index}] must be an object.`);
-    }
-
-    if (integration.provider !== "composio" || integration.type !== "composio" || integration.mode !== "managed") {
-      throw invalidConfig(`integrations[${index}] must be composioManaged({...}) or { type: "composio", provider: "composio", mode: "managed", ... }.`);
-    }
-
-    composioCount += 1;
-    validateComposioManagedIntegration(integration as unknown as AgentIntegration, index);
-  }
-
-  if (composioCount > 1) {
-    throw invalidConfig("Only one managed Composio integration is supported per agent.");
-  }
-
-  const hasExplicitComposioTools = value.some(
-    (integration) => isRecord(integration) && integration.provider === "composio" && isRecord(integration.tools),
-  );
-
-  if (hasExplicitComposioTools && tools.some((tool) => isRecord(tool) && tool.name === MANAGED_COMPOSIO_TOOL_NAME)) {
-    throw invalidConfig(`tools must not declare reserved managed Composio tool name "${MANAGED_COMPOSIO_TOOL_NAME}".`);
-  }
-}
-
-function validateComposioManagedIntegration(value: AgentIntegration, index: number): void {
-  expectString(value.name, `integrations[${index}].name`);
-
-  if (!INTEGRATION_NAME_PATTERN.test(value.name)) {
-    throw invalidConfig(`integrations[${index}].name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.`);
-  }
-
-  if (!Array.isArray(value.toolkits) || value.toolkits.length === 0) {
-    throw invalidConfig(`integrations[${index}].toolkits must include at least one Composio toolkit slug.`);
-  }
-
-  const toolkits = new Set<string>();
-
-  for (const [toolkitIndex, toolkit] of value.toolkits.entries()) {
-    expectString(toolkit, `integrations[${index}].toolkits[${toolkitIndex}]`);
-
-    if (!COMPOSIO_TOOLKIT_PATTERN.test(toolkit)) {
-      throw invalidConfig(`integrations[${index}].toolkits[${toolkitIndex}] must be a lowercase Composio toolkit slug.`);
-    }
-
-    if (toolkits.has(toolkit)) {
-      throw invalidConfig(`integrations[${index}].toolkits must not contain duplicates.`);
-    }
-
-    toolkits.add(toolkit);
-  }
-
-  if (value.tools !== undefined) {
-    if (!isRecord(value.tools)) {
-      throw invalidConfig(`integrations[${index}].tools must be an object when provided.`);
-    }
-
-    for (const [toolkit, tools] of Object.entries(value.tools)) {
-      if (!toolkits.has(toolkit)) {
-        throw invalidConfig(`integrations[${index}].tools.${toolkit} must reference a toolkit listed in integrations[${index}].toolkits.`);
-      }
-
-      if (!Array.isArray(tools) || tools.length === 0) {
-        throw invalidConfig(`integrations[${index}].tools.${toolkit} must include at least one Composio action slug.`);
-      }
-
-      const seenTools = new Set<string>();
-
-      for (const [toolIndex, tool] of tools.entries()) {
-        expectString(tool, `integrations[${index}].tools.${toolkit}[${toolIndex}]`);
-
-        if (!COMPOSIO_TOOL_SLUG_PATTERN.test(tool)) {
-          throw invalidConfig(`integrations[${index}].tools.${toolkit}[${toolIndex}] must be an uppercase Composio action slug.`);
-        }
-
-        if (seenTools.has(tool)) {
-          throw invalidConfig(`integrations[${index}].tools.${toolkit} must not contain duplicates.`);
-        }
-
-        seenTools.add(tool);
-      }
-    }
-  }
-
-  if (value.tags !== undefined) {
-    validateIntegrationTags(value.tags, `integrations[${index}].tags`);
-  }
-
-  if (value.confirmExternalWrites !== undefined && typeof value.confirmExternalWrites !== "boolean") {
-    throw invalidConfig(`integrations[${index}].confirmExternalWrites must be a boolean when provided.`);
-  }
-}
-
-function validateIntegrationTags(value: unknown, label: string): void {
-  if (!isRecord(value)) {
-    throw invalidConfig(`${label} must be an object when provided.`);
-  }
-
-  if (value.enable !== undefined) {
-    expectStringArray(value.enable, `${label}.enable`);
-  }
-
-  if (value.disable !== undefined) {
-    expectStringArray(value.disable, `${label}.disable`);
-  }
-}
-
 function validateTranscriptionConfig(value: unknown): void {
   if (value === undefined) {
     return;
@@ -591,7 +461,7 @@ function validateKnowledgeRetrieval(value: unknown): void {
   }
 }
 
-function validateChannels(value: unknown, runtime: AgentRuntime, hasTranscriptionConfig: boolean): void {
+function validateChannels(value: unknown, hasTranscriptionConfig: boolean): void {
   if (value === undefined) {
     return;
   }
@@ -600,10 +470,6 @@ function validateChannels(value: unknown, runtime: AgentRuntime, hasTranscriptio
     throw invalidConfig("channels must be an array when provided.");
   }
 
-  if (value.length > 0 && runtime !== "edge") {
-    throw invalidConfig('channels require runtime: "edge".');
-  }
-
   const names = new Set<string>();
 
   for (const [index, channel] of value.entries()) {
@@ -1045,8 +911,8 @@ function validateDatabaseConfig(value: unknown): void {
     throw invalidConfig("storage.database must be an object when provided.");
   }
 
-  if (value.driver !== "none" && value.driver !== "turso") {
-    throw invalidConfig('storage.database.driver must be "none" or "turso".');
+  if (value.driver !== "none" && value.driver !== "sqlite") {
+    throw invalidConfig('storage.database.driver must be "none" or "sqlite".');
   }
 
   if (value.schema !== undefined && typeof value.schema !== "string") {
@@ -1067,12 +933,12 @@ function validateFilesConfig(value: unknown): void {
     throw invalidConfig("storage.files must be an object when provided.");
   }
 
-  if (value.driver !== "none" && value.driver !== "r2") {
-    throw invalidConfig('storage.files.driver must be "none" or "r2".');
+  if (value.driver !== "none" && value.driver !== "local") {
+    throw invalidConfig('storage.files.driver must be "none" or "local".');
   }
 
-  if (value.bucket !== undefined && typeof value.bucket !== "string") {
-    throw invalidConfig("storage.files.bucket must be a string when provided.");
+  if (value.bucket !== undefined) {
+    throw invalidConfig("storage.files.bucket is no longer supported. Files are stored locally.");
   }
 
   if (value.prefix !== undefined && typeof value.prefix !== "string") {

package/src/runtime/database.ts

@@ -47,7 +47,7 @@ export async function applyCapsuleDatabaseMigrations(
 ): Promise<LocalDatabasePrepareResult["migrations"]> {
   const database = capsule.config.storage.database;
 
-  if (!database || database.driver !== "turso") {
+  if (!database || database.driver !== "sqlite") {
     return {
       configured: false,
       path: null,
@@ -125,7 +125,7 @@ export async function applyCapsuleDatabaseSchema(
 ): Promise<LocalDatabasePrepareResult["schema"]> {
   const database = capsule.config.storage.database;
 
-  if (!database || database.driver !== "turso" || !database.schema) {
+  if (!database || database.driver !== "sqlite" || !database.schema) {
     return {
       configured: false,
       applied: false,

package/src/runtime/dev-server.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { createServer as createHttpServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { createServer as createNetServer } from "node:net";
-import { dirname, join, relative, resolve } from "node:path";
+import { dirname, relative, resolve } from "node:path";
 import { Readable } from "node:stream";
 
 import { openCapsuleStore, type ConversationRecord } from "../storage/sqlite";
@@ -423,6 +423,7 @@ async function authorizeDevRoute(
 
   const env = await loadCapsuleEnv(capsule.root);
 
+  // Preserve the legacy deploy_not_ready code for clients handling missing local credentials.
   if (kind === "admin") {
     return authorizeBearerSecret(request, body, env.AGENTKIT_PRIVATE_TOKEN, {
       missingCode: "deploy_not_ready",
@@ -438,15 +439,15 @@ async function authorizeDevRoute(
   if (capsule.config.access.mode === "private") {
     return authorizeBearerSecret(request, body, env.AGENTKIT_PRIVATE_TOKEN, {
       missingCode: "deploy_not_ready",
-      missingMessage: "Private deploy requires AGENTKIT_PRIVATE_TOKEN to be set.",
-      unauthorizedMessage: "Missing or invalid deploy access token.",
+      missingMessage: "Private access requires AGENTKIT_PRIVATE_TOKEN to be set.",
+      unauthorizedMessage: "Missing or invalid access token.",
     });
   }
 
   return authorizeBearerSecret(request, body, env.AGENTKIT_ACCESS_TOKEN, {
     missingCode: "deploy_not_ready",
-    missingMessage: "Token deploy requires AGENTKIT_ACCESS_TOKEN to be set.",
-    unauthorizedMessage: "Missing or invalid deploy access token.",
+    missingMessage: "Token access requires AGENTKIT_ACCESS_TOKEN to be set.",
+    unauthorizedMessage: "Missing or invalid access token.",
   });
 }
 
@@ -492,7 +493,6 @@ function readRequestAccessToken(request: Request, body: unknown): string {
 
   const header =
     request.headers.get("x-agentkit-access-token") ??
-    request.headers.get("x-agentkit-deploy-access-token") ??
     "";
   const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : header;
   if (token.trim()) {
@@ -900,7 +900,7 @@ async function flushDevChannelBuffer(
       },
     });
   } catch {
-    // Local channel buffering is best-effort; hosted delivery logs own production failures.
+    // Local channel buffering is best-effort; the buffer is not a durable delivery queue.
   }
 }
 
@@ -911,7 +911,7 @@ function unrefTimer(timer: ReturnType<typeof setTimeout>): void {
 }
 
 async function handleLocalFile(capsule: LoadedAgentCapsule, request: Request, rawKey: string): Promise<Response> {
-  if (capsule.config.storage.files?.driver !== "r2") {
+  if (capsule.config.storage.files?.driver !== "local") {
     throw new AgentKitError("files_not_configured", "File storage is not configured for this Agent Capsule.");
   }
 

package/src/runtime/env.ts

@@ -3,6 +3,17 @@ import { join } from "node:path";
 
 import { AgentKitError } from "./errors";
 
+export function collectSecretValues(
+  scope: { secrets?: string[]; tools?: Array<{ secrets?: string[] }> } | undefined,
+  env: Record<string, string | undefined>,
+): string[] {
+  const names = [...(scope?.secrets ?? []), ...(scope?.tools ?? []).flatMap((tool) => tool.secrets ?? [])];
+  return names.flatMap((name) => {
+    const value = env[name];
+    return value ? [value] : [];
+  });
+}
+
 export async function loadCapsuleEnv(
   root: string,
   baseEnv: Record<string, string | undefined> = process.env,