@desplega.ai/agent-swarm 1.158.0 → 1.159.0

package/src/http/tasks.ts

@@ -27,6 +27,7 @@ import {
   pauseTask,
   promoteDraftTask,
   resumeTask,
+  settleSupersededTaskDependents,
   supersedeTask,
   updateAgentStatusFromCapacity,
   updateTaskClaudeSessionId,
@@ -34,6 +35,7 @@ import {
   updateTaskTitle,
   updateTaskVcs,
 } from "../be/db";
+import { explicitModelErrorForAgent } from "../be/model-validation";
 import {
   getTaskSteeringFields,
   markSteeringUndeliverable,
@@ -102,6 +104,9 @@ const AgentTaskSummarySchema = AgentTaskSchema.pick({
   scheduleId: true,
   model: true,
   modelTier: true,
+  resolvedModel: true,
+  modelSource: true,
+  modelAlias: true,
   effort: true,
   provider: true,
   requestedByUserId: true,
@@ -266,6 +271,11 @@ const createTask = route({
       requestedByUserId: z.string().optional(),
       model: z.string().optional(),
       modelTier: ModelTierSchema.optional(),
+      /**
+       * Accept a `model` the catalog does not list. Without it an unknown id is a 400; with it
+       * the id is stored as given (a fresh launch, a private deployment).
+       */
+      allowCustomModel: z.boolean().optional(),
       effort: ReasoningEffortSchema.optional(),
       /**
        * Create in `draft` status instead of the normal pending/unassigned/offered
@@ -287,7 +297,10 @@ const createTask = route({
     }),
   responses: {
     201: { description: "Task created", schema: AgentTaskSchema },
-    400: { description: "Validation error, or agentId/offeredTo targets an extension identity" },
+    400: {
+      description:
+        "Validation error, an unknown `model` (set `allowCustomModel` to store a custom id), or agentId/offeredTo targets an extension identity",
+    },
     422: {
       description: "Task creation blocked by an extension",
       schema: z.object({
@@ -860,6 +873,17 @@ export async function handleTasks(
       if (lead) defaultAgentId = lead.id;
     }
 
+    const modelError = await explicitModelErrorForAgent({
+      model: splitLegacyModelAlias({ model: parsed.body.model, modelTier: parsed.body.modelTier })
+        .model,
+      allowCustomModel: parsed.body.allowCustomModel,
+      agentId: defaultAgentId,
+    });
+    if (modelError) {
+      jsonError(res, modelError, 400);
+      return true;
+    }
+
     const parentTask = parsed.body.parentTaskId
       ? await getTaskById(parsed.body.parentTaskId)
       : null;
@@ -1750,6 +1774,7 @@ export async function handleTasks(
     // `skipped` covers parent_not_found / lead_not_found edge cases — the
     // supersede already landed, so log + roll forward without a resume task.
     if (followUp.kind !== "created") {
+      await settleSupersededTaskDependents(parsed.params.id, null);
       console.warn(
         `[Supersede] Task ${parsed.params.id.slice(0, 8)} superseded but resume creation skipped (${
           followUp.kind === "skipped" ? followUp.reason : followUp.kind

package/src/http/usage-cache.ts

@@ -3,30 +3,71 @@
  * `/api/attribution/by-person`). Each open usage page polls them, and every
  * reply aggregates the whole window.
  *
- * A key holds the request filters plus a data version (see
- * `getUsageDataVersion`), so a new session or task misses the cache at once.
- * Changes to existing rows (a task re-attributed to another requester) show
- * after at most `USAGE_CACHE_TTL_MS`. A credential plan or name change
- * clears the cache.
+ * A key holds only the request filters. An entry is fresh for
+ * `USAGE_CACHE_TTL_MS` (the time bucket). Past that it is served as-is while one
+ * background load revalidates it, until its total age reaches
+ * `USAGE_CACHE_MAX_STALE_MS`; an older or missing entry blocks on a load.
+ * Concurrent misses for one key share that load.
+ *
+ * The key deliberately carries no data version. The old one changed on every
+ * new task or session, and the swarm creates one every few seconds, so it
+ * almost never hit. The cost is staleness: the first request past the bucket
+ * still gets the old value and only starts the refresh, so a new session shows
+ * up on the request after that. A client polling once per bucket sees it about
+ * one poll later. A credential plan or name change clears the cache.
  */
 
 export const USAGE_CACHE_TTL_MS = 30_000;
+export const USAGE_CACHE_MAX_STALE_MS = 120_000;
 const MAX_ENTRIES = 100;
 
-const entries = new Map<string, { expiresAt: number; value: unknown }>();
+const entries = new Map<string, { fetchedAt: number; value: unknown }>();
+const loading = new Map<string, Promise<unknown>>();
+// Bumped by `clearUsageCache`, so a load that started before the clear cannot
+// write its (now outdated) result back.
+let generation = 0;
+
+function load<T>(key: string, loader: () => Promise<T>): Promise<T> {
+  const running = loading.get(key);
+  if (running) return running as Promise<T>;
+
+  const startedIn = generation;
+  const promise: Promise<T> = Promise.resolve()
+    .then(loader)
+    .then((value) => {
+      if (startedIn === generation) {
+        entries.delete(key);
+        // Map order is insertion order, so the first key is the oldest entry.
+        if (entries.size >= MAX_ENTRIES) entries.delete(entries.keys().next().value as string);
+        entries.set(key, { fetchedAt: Date.now(), value });
+      }
+      return value;
+    })
+    .finally(() => {
+      if (loading.get(key) === promise) loading.delete(key);
+    });
+  loading.set(key, promise);
+  return promise;
+}
 
-export async function cachedUsageReport<T>(key: string, load: () => Promise<T>): Promise<T> {
-  const now = Date.now();
+export async function cachedUsageReport<T>(key: string, loader: () => Promise<T>): Promise<T> {
   const hit = entries.get(key);
-  if (hit && hit.expiresAt > now) return hit.value as T;
-  const value = await load();
-  entries.delete(key);
-  // Map order is insertion order, so the first key is the oldest entry.
-  if (entries.size >= MAX_ENTRIES) entries.delete(entries.keys().next().value as string);
-  entries.set(key, { expiresAt: now + USAGE_CACHE_TTL_MS, value });
-  return value;
+  if (hit) {
+    const age = Date.now() - hit.fetchedAt;
+    if (age < USAGE_CACHE_TTL_MS) return hit.value as T;
+    if (age < USAGE_CACHE_MAX_STALE_MS) {
+      // Keep serving the stale value; a failed refresh retries on the next request.
+      load(key, loader).catch((error) => {
+        console.error(`[usage-cache] background refresh failed for ${key.split(":")[0]}:`, error);
+      });
+      return hit.value as T;
+    }
+  }
+  return load(key, loader);
 }
 
 export function clearUsageCache(): void {
+  generation++;
   entries.clear();
+  loading.clear();
 }

package/src/http/workflows.ts

@@ -21,6 +21,7 @@ import {
   CooldownConfigSchema,
   InputValueSchema,
   TriggerConfigSchema,
+  type WorkflowDefinition,
   WorkflowDefinitionSchema,
   WorkflowEdgeSchema,
   WorkflowNodePatchSchema,
@@ -37,6 +38,7 @@ import { definitionNodeIds, generateEdges, validateDefinition } from "../workflo
 import { TriggerSchemaError } from "../workflows/engine";
 import { validateJsonSchema } from "../workflows/json-schema-validator";
 import { patchWorkflowDefinition } from "../workflows/patch-definition";
+import { workflowSaveWarnings } from "../workflows/readiness";
 import { cancelWorkflowRun, retryFailedRun } from "../workflows/resume";
 import { handleWebhookTrigger, WebhookError } from "../workflows/triggers";
 import { snapshotAndUpdateWorkflow } from "../workflows/version";
@@ -49,6 +51,14 @@ import { jsonError, parseBody, triggerSchemaErrorResponse } from "./utils";
 /** `Workflow` decorated with the caller-scoped favorite flag (always set once `withFavoriteFlags` runs). */
 const WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: z.boolean() });
 
+/**
+ * `Workflow` returned by a save (create / update / patch). `warnings` is present only when the
+ * save succeeded but a node cannot run yet, e.g. a system-one-decision node whose provider key is not configured.
+ */
+const WorkflowSaveResponseSchema = WorkflowSchema.extend({
+  warnings: z.array(z.string()).optional(),
+});
+
 /** `/api/workflows` slim list item — mirrors `WorkflowSummary` in src/types.ts (no exported schema there). */
 const WorkflowSummarySchema = WorkflowSchema.omit({
   definition: true,
@@ -85,6 +95,14 @@ const WorkflowRunPageSchema = z.object({
 
 const SuccessResponseSchema = z.object({ success: z.literal(true) });
 
+/** Adds `warnings` to a just-saved workflow when a node in it cannot run yet. */
+async function withSaveWarnings<T extends { definition: WorkflowDefinition }>(
+  workflow: T,
+): Promise<T & { warnings?: string[] }> {
+  const warnings = await workflowSaveWarnings(workflow.definition, getExecutorRegistry());
+  return warnings.length > 0 ? { ...workflow, warnings } : workflow;
+}
+
 // ─── Route Definitions ───────────────────────────────────────────────────────
 
 const listWorkflowsRoute = route({
@@ -137,7 +155,7 @@ const createWorkflowRoute = route({
     vcsRepo: z.string().min(1).optional(),
   }),
   responses: {
-    201: { description: "Workflow created", schema: WorkflowSchema },
+    201: { description: "Workflow created", schema: WorkflowSaveResponseSchema },
     400: { description: "Invalid definition" },
   },
 });
@@ -188,7 +206,10 @@ const updateWorkflowRoute = route({
     enabled: z.boolean().optional(),
   }),
   responses: {
-    200: { description: "Workflow updated (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow updated (version snapshot created)",
+      schema: WorkflowSaveResponseSchema,
+    },
     400: { description: "Invalid definition" },
     404: { description: "Workflow not found" },
   },
@@ -203,7 +224,10 @@ const patchWorkflowRoute = route({
   params: z.object({ id: z.string() }),
   body: WorkflowPatchSchema.extend({ key: AssetKeySchema.optional() }),
   responses: {
-    200: { description: "Workflow patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Workflow patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema,
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow not found" },
   },
@@ -218,7 +242,10 @@ const patchWorkflowNodeRoute = route({
   params: z.object({ id: z.string(), nodeId: z.string() }),
   body: WorkflowNodePatchSchema,
   responses: {
-    200: { description: "Node patched (version snapshot created)", schema: WorkflowSchema },
+    200: {
+      description: "Node patched (version snapshot created)",
+      schema: WorkflowSaveResponseSchema,
+    },
     400: { description: "Invalid patch or resulting definition" },
     404: { description: "Workflow or node not found" },
   },
@@ -583,7 +610,7 @@ export async function handleWorkflows(
       },
       "api",
     );
-    createWorkflowRoute.respond(res, 201, workflow);
+    createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
     return true;
   }
 
@@ -638,7 +665,7 @@ export async function handleWorkflows(
       );
       return true;
     }
-    patchWorkflowNodeRoute.respond(res, 200, result.workflow);
+    patchWorkflowNodeRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
 
@@ -695,7 +722,7 @@ export async function handleWorkflows(
       );
       return true;
     }
-    patchWorkflowRoute.respond(res, 200, result.workflow);
+    patchWorkflowRoute.respond(res, 200, await withSaveWarnings(result.workflow));
     return true;
   }
 
@@ -766,7 +793,7 @@ export async function handleWorkflows(
       res.end();
       return true;
     }
-    updateWorkflowRoute.respond(res, 200, workflow);
+    updateWorkflowRoute.respond(res, 200, await withSaveWarnings(workflow));
     return true;
   }
 

package/src/prompts/session-templates.ts

@@ -202,6 +202,7 @@ agent-fs is the shared drive between agents and people. Documents (reports, dige
 Pages: only for polished artifacts shared with a wider audience or explicitly requested; see \`pages\` skill.
 A tool a person will use, with data and actions: build an app. See the \`apps\` skill.
 Link env: \`APP_URL\` for pages, \`MCP_BASE_URL\` for the API, \`AGENT_FS_LIVE_URL\` for files. Report missing variables.
+For a file anyone outside the swarm opens, use an \`agent-fs share-create\` link; \`AGENT_FS_LIVE_URL\` links are for signed-in teammates.
 `,
   variables: [],
   category: "system",

package/src/providers/claude-managed-models.ts

@@ -1,48 +1,32 @@
 /**
- * Pricing table for Anthropic-managed Claude models, mirroring the layout of
- * `src/providers/codex-models.ts`. Rates are USD per million tokens (Mtok)
- * sourced from https://platform.claude.com/docs/en/about-claude/pricing
- * (verified 2026-09-02).
+ * Anthropic-managed Claude model facts, read from the model catalog
+ * (model-catalog phase 4). Rates are USD per million tokens (Mtok).
  *
- * The managed-agents API does NOT report dollar cost on the `span.model_request_end`
- * event — only token counts (`input_tokens`, `output_tokens`,
- * `cache_read_input_tokens`, `cache_creation_input_tokens`). Phase 4 of the
- * provider plan computes USD locally via {@link computeClaudeManagedCostUsd},
- * then folds in Anthropic's $0.08/session-hour runtime fee inside the adapter.
+ * There is no hand-maintained model list or price table any more: both come
+ * from the runtime catalog (`src/utils/runtime-model-catalog.ts` — the API's
+ * `model_catalog` + overlay rows, pulled over HTTP; the vendored models.dev
+ * snapshot offline). A new Claude model is listed and priced as soon as it
+ * lands in `model_catalog`, with no code change and no redeploy.
  *
- * Bump this file when Anthropic publishes new rates or new models.
+ * The managed-agents API does NOT report dollar cost on the
+ * `span.model_request_end` event — only token counts. The adapter computes
+ * USD locally via {@link computeClaudeManagedCostUsd}, then folds in
+ * Anthropic's $0.08/session-hour runtime fee. The API server recomputes the
+ * canonical price against the pricing table.
  *
  * Cache nomenclature mapping:
- * - `cache_read_input_tokens`        → "cache hit" rate     (cheapest)
- * - `cache_creation_input_tokens`    → "cache write" rate   (input × 1.25 for 5m TTL)
- * - regular `input_tokens` (uncached) → standard input rate
- *
- * Anthropic's pricing page lists 5-minute and 1-hour cache TTLs separately;
- * managed-agents currently uses the 5-minute breakpoint by default, which is
- * the rate captured here. If a future SDK release surfaces TTL on the usage
- * payload, refine these by TTL.
+ * - `cache_read_input_tokens`        → catalog `cache_read`
+ * - `cache_creation_input_tokens`    → catalog `cache_write` (5-minute TTL)
+ * - regular `input_tokens` (uncached) → catalog `input`
  */
+import { harnessModelIds } from "@desplega/model-catalog";
+import { runtimeCatalogModel, runtimeCatalogSection } from "../utils/runtime-model-catalog";
 
-/** Models supported by the managed-agents surface for the swarm worker. */
-export const CLAUDE_MANAGED_MODELS = [
-  "claude-fable-5-1",
-  "claude-mythos-5-1",
-  "claude-opus-5-5",
-  "claude-opus-5",
-  "claude-fable-5",
-  "claude-mythos-5",
-  "claude-sonnet-5-5",
-  "claude-sonnet-5",
-  "claude-sonnet-4-6",
-  "claude-opus-4-8",
-  "claude-opus-4-7",
-  "claude-opus-4-6",
-  "claude-haiku-4-5",
-] as const;
-
-export type ClaudeManagedModel = (typeof CLAUDE_MANAGED_MODELS)[number];
+/** Managed-agents-selectable Claude models from the catalog, newest first. */
+export function listClaudeManagedModels(): string[] {
+  return harnessModelIds("claude-managed", runtimeCatalogSection("anthropic"));
+}
 
-/** Token rates per million tokens (USD). */
 export interface ClaudeManagedTokenPricing {
   /** USD per million uncached input tokens. */
   inputPerMillion: number;
@@ -54,131 +38,39 @@ export interface ClaudeManagedTokenPricing {
   cacheWritePerMillion: number;
 }
 
-/** Pricing per million tokens (USD), including an optional scheduled rate change. */
-export interface ClaudeManagedModelPricing extends ClaudeManagedTokenPricing {
-  scheduledChange?: {
-    /** ISO timestamp at which the replacement rates take effect. */
-    effectiveAt: string;
-    pricing: ClaudeManagedTokenPricing;
-  };
-}
+export type ClaudeManagedModelPricing = ClaudeManagedTokenPricing;
 
 /**
- * Anthropic public list pricing. Source:
- * https://platform.claude.com/docs/en/about-claude/pricing
- *
- * - claude-fable-5-1:  $10 / $50 / $0.25 / $12.50  (verified 2026-09-02)
- * - claude-mythos-5-1: $10 / $50 / $0.25 / $12.50  (invite only, verified 2026-09-02)
- * - claude-fable-5:   $10 / $50 / $1.00 / $12.50   (verified 2026-06-10)
- * - claude-mythos-5:  $10 / $50 / $1.00 / $12.50   (limited availability, verified 2026-06-10)
- * - claude-opus-5-5:  $4 / $20 / $0.20 / $5.00     (verified 2026-09-22)
- * - claude-opus-5:    $5 / $25 / $0.50 / $6.25     (verified 2026-07-25)
- * - claude-sonnet-5-5: $2 / $10 / $0.20 / $2.50    (verified 2026-09-28)
- * - claude-sonnet-5:  $2 / $10 / $0.20 / $2.50     (standard rate, verified 2026-08-29)
- * - claude-sonnet-4-6: $3 / $15 / $0.30 / $3.75    (in / out / cache-read / cache-write)
- * - claude-opus-4-8:   $5 / $25 / $0.50 / $6.25    (verified 2026-05-28)
- * - claude-opus-4-7:   $15 / $75 / $1.50 / $18.75  (STALE — was correct at launch, Anthropic has since dropped Opus to $5/$25)
- * - claude-opus-4-6:   $5 / $25 / $0.50 / $6.25    (verified 2026-05-28)
- * - claude-haiku-4-5:  $1 / $5 / $0.10 / $1.25
+ * Catalog pricing for a managed model. Dated ids fall back to their undated
+ * family id. Missing cache rates follow Anthropic's published multipliers
+ * (read = 0.1 × input, 5-minute write = 1.25 × input).
  */
-export const CLAUDE_MANAGED_MODEL_PRICING: Record<ClaudeManagedModel, ClaudeManagedModelPricing> = {
-  "claude-fable-5-1": {
-    inputPerMillion: 10.0,
-    outputPerMillion: 50.0,
-    cacheReadPerMillion: 0.25,
-    cacheWritePerMillion: 12.5,
-  },
-  "claude-mythos-5-1": {
-    inputPerMillion: 10.0,
-    outputPerMillion: 50.0,
-    cacheReadPerMillion: 0.25,
-    cacheWritePerMillion: 12.5,
-  },
-  "claude-opus-5-5": {
-    inputPerMillion: 4.0,
-    outputPerMillion: 20.0,
-    cacheReadPerMillion: 0.2,
-    cacheWritePerMillion: 5.0,
-  },
-  "claude-opus-5": {
-    inputPerMillion: 5.0,
-    outputPerMillion: 25.0,
-    cacheReadPerMillion: 0.5,
-    cacheWritePerMillion: 6.25,
-  },
-  "claude-fable-5": {
-    inputPerMillion: 10.0,
-    outputPerMillion: 50.0,
-    cacheReadPerMillion: 1.0,
-    cacheWritePerMillion: 12.5,
-  },
-  "claude-mythos-5": {
-    inputPerMillion: 10.0,
-    outputPerMillion: 50.0,
-    cacheReadPerMillion: 1.0,
-    cacheWritePerMillion: 12.5,
-  },
-  "claude-sonnet-5-5": {
-    inputPerMillion: 2.0,
-    outputPerMillion: 10.0,
-    cacheReadPerMillion: 0.2,
-    cacheWritePerMillion: 2.5,
-  },
-  "claude-sonnet-5": {
-    inputPerMillion: 2.0,
-    outputPerMillion: 10.0,
-    cacheReadPerMillion: 0.2,
-    cacheWritePerMillion: 2.5,
-  },
-  "claude-sonnet-4-6": {
-    inputPerMillion: 3.0,
-    outputPerMillion: 15.0,
-    cacheReadPerMillion: 0.3,
-    cacheWritePerMillion: 3.75,
-  },
-  "claude-opus-4-8": {
-    inputPerMillion: 5.0,
-    outputPerMillion: 25.0,
-    cacheReadPerMillion: 0.5,
-    cacheWritePerMillion: 6.25,
-  },
-  "claude-opus-4-7": {
-    inputPerMillion: 15.0,
-    outputPerMillion: 75.0,
-    cacheReadPerMillion: 1.5,
-    cacheWritePerMillion: 18.75,
-  },
-  "claude-opus-4-6": {
-    inputPerMillion: 5.0,
-    outputPerMillion: 25.0,
-    cacheReadPerMillion: 0.5,
-    cacheWritePerMillion: 6.25,
-  },
-  "claude-haiku-4-5": {
-    inputPerMillion: 1.0,
-    outputPerMillion: 5.0,
-    cacheReadPerMillion: 0.1,
-    cacheWritePerMillion: 1.25,
-  },
-};
+export function getClaudeManagedModelPricing(model: string): ClaudeManagedModelPricing | undefined {
+  const cost =
+    runtimeCatalogModel("anthropic", model)?.cost ??
+    runtimeCatalogModel("anthropic", model.replace(/-\d{8}$/, ""))?.cost;
+  if (typeof cost?.input !== "number" || typeof cost.output !== "number") return undefined;
+  return {
+    inputPerMillion: cost.input,
+    outputPerMillion: cost.output,
+    cacheReadPerMillion: typeof cost.cache_read === "number" ? cost.cache_read : cost.input * 0.1,
+    cacheWritePerMillion:
+      typeof cost.cache_write === "number" ? cost.cache_write : cost.input * 1.25,
+  };
+}
 
-/**
- * Models we've already warned about — keeps `console.warn` from spamming the
- * worker logs when an old session keeps replaying through `span.model_request_end`
- * events with an unrecognized model string.
- */
+/** One warning per model per process for unpriced models. */
 const warnedUnknownModels = new Set<string>();
 
 /**
  * Compute USD cost for one Claude managed-agents session, given the SDK's
  * accumulated token counts.
  *
- * Returns `0` (with a deduplicated `console.warn`) for unknown model strings —
- * we'd rather under-report than make up a number on a typo.
+ * Returns `0` (with a deduplicated `console.warn`) for models the catalog does
+ * not price — we'd rather under-report than make up a number on a typo.
  *
- * Note: the runtime $0.08/session-hour fee is NOT folded in here. The adapter
- * computes that separately because it depends on the session's wallclock
- * `durationMs`, which is provider-state, not token-state.
+ * Note: the runtime $0.08/session-hour fee is NOT folded in here; the adapter
+ * computes it from the session's wallclock.
  */
 export function computeClaudeManagedCostUsd(
   model: string,
@@ -186,24 +78,18 @@ export function computeClaudeManagedCostUsd(
   outputTokens: number,
   cacheReadTokens: number,
   cacheWriteTokens: number,
-  pricedAtMs: number = Date.now(),
 ): number {
-  const configuredPricing = CLAUDE_MANAGED_MODEL_PRICING[model as ClaudeManagedModel];
-  if (!configuredPricing) {
+  const pricing = getClaudeManagedModelPricing(model);
+  if (!pricing) {
     if (!warnedUnknownModels.has(model)) {
       warnedUnknownModels.add(model);
       console.warn(
-        `[claude-managed-models] Unknown model "${model}" — returning $0 cost. ` +
-          `Add it to CLAUDE_MANAGED_MODEL_PRICING in src/providers/claude-managed-models.ts.`,
+        `[claude-managed-models] Unpriced model "${model}" — returning $0 cost. ` +
+          "Add it to the model catalog (refresh or overlay row).",
       );
     }
     return 0;
   }
-  const pricing =
-    configuredPricing.scheduledChange &&
-    pricedAtMs >= Date.parse(configuredPricing.scheduledChange.effectiveAt)
-      ? configuredPricing.scheduledChange.pricing
-      : configuredPricing;
   const inputCost = (inputTokens / 1_000_000) * pricing.inputPerMillion;
   const outputCost = (outputTokens / 1_000_000) * pricing.outputPerMillion;
   const cacheReadCost = (cacheReadTokens / 1_000_000) * pricing.cacheReadPerMillion;

package/src/providers/codex-adapter.ts

@@ -558,16 +558,16 @@ export async function buildCodexConfig(
   // at `~/.codex/config.toml` (Phase 6). Repeating them here makes local dev
   // (no baseline file) behave identically to the Docker worker.
   //
-  // `features.hooks` / `features.plugin_hooks` enable Codex's hook system and
-  // the hooks contributed by installed Codex plugins (context-mode's plugin:
-  // routing injection, PreToolUse safety blocks, output capture).
+  // Keep ChatGPT apps/connectors disabled because their `codex_apps` tools use
+  // the worker's host OAuth identity. Hooks remain enabled for Codex steering
+  // and the installed context-mode plugin.
   return {
     model,
     approval_policy: "never",
     sandbox_mode: "danger-full-access",
     skip_git_repo_check: true,
     show_raw_agent_reasoning: false,
-    features: { hooks: true, plugin_hooks: true },
+    features: { apps: false, hooks: true, plugin_hooks: true },
     mcp_servers: mcpServers as CodexConfig,
     ...reasoningConfig,
   };