@desplega.ai/agent-swarm 1.158.0 → 1.160.0

package/src/tests/workflow-triggers-v2.test.ts

@@ -16,10 +16,12 @@ import { startWorkflowExecution } from "../workflows/engine";
 import { BaseExecutor, type ExecutorResult } from "../workflows/executors/base";
 import { ExecutorRegistry } from "../workflows/executors/registry";
 import {
+  decodeStandardWebhookSecret,
   handleEventTrigger,
   handleWebhookTrigger,
   logOpenWebhookTriggers,
   verifyHmacSignature,
+  verifyStandardWebhookSignature,
   verifyTimestampedHmacSignature,
   verifyTokenEquality,
   WebhookError,
@@ -211,6 +213,169 @@ describe("verifyTokenEquality", () => {
   });
 });
 
+// Official vector from github.com/standard-webhooks/standard-webhooks
+// (libraries/javascript/src/webhook.test.ts, "sign function works").
+const SW_SECRET = "MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+const SW_MSG_ID = "msg_p5jXN8AQM9LWM0D4loKWxJek";
+const SW_TIMESTAMP = 1614265330;
+const SW_PAYLOAD = '{"test": 2432232314}';
+const SW_EXPECTED_SIGNATURE = "v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OE=";
+
+function signStandardWebhook(secret: string, id: string, timestamp: number, body: string): string {
+  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
+  const digest = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${body}`);
+  return `v1,${digest.digest("base64")}`;
+}
+
+describe("verifyStandardWebhookSignature", () => {
+  const key = decodeStandardWebhookSecret(SW_SECRET)!;
+  const nowMs = SW_TIMESTAMP * 1000;
+  const headers = (signature: string, timestamp = SW_TIMESTAMP) => ({
+    id: SW_MSG_ID,
+    timestamp: String(timestamp),
+    signature,
+  });
+
+  test("official test vector passes", () => {
+    expect(signStandardWebhook(SW_SECRET, SW_MSG_ID, SW_TIMESTAMP, SW_PAYLOAD)).toBe(
+      SW_EXPECTED_SIGNATURE,
+    );
+    expect(
+      verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(SW_EXPECTED_SIGNATURE), {}, nowMs),
+    ).toBe(true);
+  });
+
+  test("secret decodes the same with and without the whsec_ prefix", () => {
+    expect(decodeStandardWebhookSecret(`whsec_${SW_SECRET}`)).toEqual(key);
+    expect(
+      verifyStandardWebhookSignature(
+        decodeStandardWebhookSecret(`whsec_${SW_SECRET}`)!,
+        SW_PAYLOAD,
+        headers(SW_EXPECTED_SIGNATURE),
+        {},
+        nowMs,
+      ),
+    ).toBe(true);
+  });
+
+  test("invalid or empty secrets decode to null", () => {
+    expect(decodeStandardWebhookSecret("whsec_")).toBeNull();
+    expect(decodeStandardWebhookSecret("")).toBeNull();
+    expect(decodeStandardWebhookSecret("not base64!")).toBeNull();
+  });
+
+  test("tampered body fails", () => {
+    expect(
+      verifyStandardWebhookSignature(
+        key,
+        '{"test": 2432232315}',
+        headers(SW_EXPECTED_SIGNATURE),
+        {},
+        nowMs,
+      ),
+    ).toBe(false);
+  });
+
+  test("re-serialized JSON body fails (verification is over raw bytes)", () => {
+    const reserialized = JSON.stringify(JSON.parse(SW_PAYLOAD));
+    expect(
+      verifyStandardWebhookSignature(key, reserialized, headers(SW_EXPECTED_SIGNATURE), {}, nowMs),
+    ).toBe(false);
+  });
+
+  test("wrong secret fails", () => {
+    const wrong = decodeStandardWebhookSecret(Buffer.alloc(24, 7).toString("base64"))!;
+    expect(
+      verifyStandardWebhookSignature(wrong, SW_PAYLOAD, headers(SW_EXPECTED_SIGNATURE), {}, nowMs),
+    ).toBe(false);
+  });
+
+  test("tampered webhook-id fails", () => {
+    expect(
+      verifyStandardWebhookSignature(
+        key,
+        SW_PAYLOAD,
+        { ...headers(SW_EXPECTED_SIGNATURE), id: "msg_other" },
+        {},
+        nowMs,
+      ),
+    ).toBe(false);
+  });
+
+  test("stale timestamp beyond the default 5 minute tolerance fails", () => {
+    const stale = SW_TIMESTAMP - 301;
+    const signature = signStandardWebhook(SW_SECRET, SW_MSG_ID, stale, SW_PAYLOAD);
+    expect(
+      verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(signature, stale), {}, nowMs),
+    ).toBe(false);
+    const edge = SW_TIMESTAMP - 300;
+    const edgeSignature = signStandardWebhook(SW_SECRET, SW_MSG_ID, edge, SW_PAYLOAD);
+    expect(
+      verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(edgeSignature, edge), {}, nowMs),
+    ).toBe(true);
+  });
+
+  test("future timestamp beyond tolerance fails", () => {
+    const future = SW_TIMESTAMP + 301;
+    const signature = signStandardWebhook(SW_SECRET, SW_MSG_ID, future, SW_PAYLOAD);
+    expect(
+      verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(signature, future), {}, nowMs),
+    ).toBe(false);
+  });
+
+  test("custom toleranceSeconds is honored", () => {
+    const stale = SW_TIMESTAMP - 600;
+    const signature = signStandardWebhook(SW_SECRET, SW_MSG_ID, stale, SW_PAYLOAD);
+    expect(
+      verifyStandardWebhookSignature(
+        key,
+        SW_PAYLOAD,
+        headers(signature, stale),
+        { toleranceSeconds: 900 },
+        nowMs,
+      ),
+    ).toBe(true);
+  });
+
+  test("garbled timestamp fails", () => {
+    expect(
+      verifyStandardWebhookSignature(
+        key,
+        SW_PAYLOAD,
+        { ...headers(SW_EXPECTED_SIGNATURE), timestamp: "not-a-number" },
+        {},
+        nowMs,
+      ),
+    ).toBe(false);
+  });
+
+  test("multiple signatures pass when one v1 entry matches", () => {
+    const list = [
+      "v1,Ceo5qEr07ixe2NLpvHk3FH9bwy/WavXrAFQ/9tdO6mc=",
+      "v2,Ceo5qEr07ixe2NLpvHk3FH9bwy/WavXrAFQ/9tdO6mc=",
+      SW_EXPECTED_SIGNATURE,
+      "v1a,hnO3f9T8Ytu9HwrXslvumlUpqtNVqkhqw/enGzPCXe5BdqzCInXqYXFymVJaA7AZdpXwVLPo3mNl8EM+m7TBAg==",
+    ].join(" ");
+    expect(verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(list), {}, nowMs)).toBe(true);
+  });
+
+  test("a matching digest under a non-v1 version fails", () => {
+    const digest = SW_EXPECTED_SIGNATURE.slice("v1,".length);
+    expect(
+      verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(`v2,${digest}`), {}, nowMs),
+    ).toBe(false);
+    expect(verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(digest), {}, nowMs)).toBe(false);
+  });
+
+  test("empty or partial signatures fail without throwing", () => {
+    for (const signature of ["", "v1,", "v1,dawfeoifkpqwoekfpqoekf", "v1"]) {
+      expect(verifyStandardWebhookSignature(key, SW_PAYLOAD, headers(signature), {}, nowMs)).toBe(
+        false,
+      );
+    }
+  });
+});
+
 // ─── Webhook Trigger ────────────────────────────────────────
 
 describe("handleWebhookTrigger", () => {
@@ -614,6 +779,136 @@ describe("handleWebhookTrigger — verification formats", () => {
     }
   });
 
+  describe("standard-webhooks", () => {
+    const secret = `whsec_${Buffer.alloc(32, 3).toString("base64")}`;
+
+    async function makeStandardWorkflow(hmacSecret = secret): Promise<Workflow> {
+      return makeWorkflow({
+        triggers: [{ type: "webhook", hmacSecret, verification: { format: "standard-webhooks" } }],
+      });
+    }
+
+    function standardHeaders(body: string, signingSecret = secret): Record<string, string> {
+      const id = `msg_${crypto.randomUUID()}`;
+      const timestamp = Math.floor(Date.now() / 1000);
+      return {
+        "webhook-id": id,
+        "webhook-timestamp": String(timestamp),
+        "webhook-signature": signStandardWebhook(signingSecret, id, timestamp, body),
+      };
+    }
+
+    async function expectRejected(
+      workflowId: string,
+      body: string,
+      headers: Record<string, string>,
+      statusCode: number,
+    ): Promise<void> {
+      try {
+        await handleWebhookTrigger(workflowId, body, headers, registry);
+        expect(true).toBe(false);
+      } catch (err) {
+        expect(err).toBeInstanceOf(WebhookError);
+        expect((err as WebhookError).statusCode).toBe(statusCode);
+      }
+    }
+
+    test("starts the workflow for a correctly signed request", async () => {
+      const workflow = await makeStandardWorkflow();
+      const body = '{"event_type":"note.updated", "data": {"id":"not_123"}}';
+
+      const result = await handleWebhookTrigger(workflow.id, body, standardHeaders(body), registry);
+
+      const run = await getWorkflowRun(result.runId);
+      expect(run!.triggerData).toEqual({ event_type: "note.updated", data: { id: "not_123" } });
+    });
+
+    test("accepts a secret stored without the whsec_ prefix and mixed-case headers", async () => {
+      const workflow = await makeStandardWorkflow(secret.slice("whsec_".length));
+      const body = '{"event":"plain-secret"}';
+      const headers = standardHeaders(body);
+
+      const result = await handleWebhookTrigger(
+        workflow.id,
+        body,
+        {
+          "Webhook-Id": headers["webhook-id"]!,
+          "Webhook-Timestamp": headers["webhook-timestamp"]!,
+          "Webhook-Signature": headers["webhook-signature"]!,
+        },
+        registry,
+      );
+
+      expect(result.runId).toBeDefined();
+    });
+
+    test("resolves a secret.NAME reference", async () => {
+      const name = `SW_SECRET_${crypto.randomUUID().slice(0, 8).toUpperCase()}`;
+      await upsertSwarmConfig({ scope: "global", key: name, value: secret, isSecret: true });
+      const workflow = await makeStandardWorkflow(secretRef(name));
+      const body = '{"event":"secret-ref"}';
+
+      const result = await handleWebhookTrigger(workflow.id, body, standardHeaders(body), registry);
+
+      expect(result.runId).toBeDefined();
+    });
+
+    test("rejects a tampered body", async () => {
+      const workflow = await makeStandardWorkflow();
+      const headers = standardHeaders('{"event":"original"}');
+      await expectRejected(workflow.id, '{"event":"tampered"}', headers, 401);
+    });
+
+    test("rejects a signature made with a different secret", async () => {
+      const workflow = await makeStandardWorkflow();
+      const body = '{"event":"wrong-secret"}';
+      const other = `whsec_${Buffer.alloc(32, 9).toString("base64")}`;
+      await expectRejected(workflow.id, body, standardHeaders(body, other), 401);
+    });
+
+    test("rejects stale and future timestamps", async () => {
+      const workflow = await makeStandardWorkflow();
+      const body = '{"event":"replay"}';
+      const now = Math.floor(Date.now() / 1000);
+      for (const timestamp of [now - 3600, now + 3600]) {
+        await expectRejected(
+          workflow.id,
+          body,
+          {
+            "webhook-id": "msg_replay",
+            "webhook-timestamp": String(timestamp),
+            "webhook-signature": signStandardWebhook(secret, "msg_replay", timestamp, body),
+          },
+          401,
+        );
+      }
+    });
+
+    test("rejects a request missing any required header", async () => {
+      const workflow = await makeStandardWorkflow();
+      const body = '{"event":"missing-header"}';
+      const headers = standardHeaders(body);
+      for (const name of ["webhook-id", "webhook-timestamp", "webhook-signature"]) {
+        const partial = { ...headers };
+        delete partial[name];
+        await expectRejected(workflow.id, body, partial, 401);
+      }
+    });
+
+    test("ignores signatures on legacy fallback headers", async () => {
+      const workflow = await makeStandardWorkflow();
+      const body = '{"event":"fallback"}';
+      const { "webhook-signature": signature, ...rest } = standardHeaders(body);
+      await expectRejected(workflow.id, body, { ...rest, "x-webhook-signature": signature! }, 401);
+    });
+
+    test("fails closed with 500 when the configured secret is not base64", async () => {
+      const workflow = await makeStandardWorkflow("whsec_not base64!");
+      const body = '{"event":"bad-secret"}';
+      await expectRejected(workflow.id, body, standardHeaders(body), 500);
+    });
+  });
+
   test("verification configured without hmacSecret fails closed instead of accepting the request", async () => {
     // Bypasses the create/update Zod schema (which now also rejects this shape) to
     // exercise the runtime guard directly — e.g. for data written before this fix,
@@ -867,6 +1162,31 @@ describe("TriggerConfigSchema", () => {
     expect(result.success).toBe(true);
   });
 
+  test("accepts standard-webhooks verification and defaults its tolerance to 300s", () => {
+    const result = TriggerConfigSchema.safeParse({
+      type: "webhook",
+      hmacSecret: "secret.STANDARD_WEBHOOK_SECRET",
+      verification: { format: "standard-webhooks" },
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success && result.data.type === "webhook") {
+      expect(result.data.verification).toEqual({
+        format: "standard-webhooks",
+        toleranceSeconds: 300,
+      });
+    }
+  });
+
+  test("rejects standard-webhooks verification without hmacSecret", () => {
+    const result = TriggerConfigSchema.safeParse({
+      type: "webhook",
+      verification: { format: "standard-webhooks" },
+    });
+
+    expect(result.success).toBe(false);
+  });
+
   test("accepts a webhook trigger with neither hmacSecret nor verification (intentionally unauthenticated)", () => {
     const result = TriggerConfigSchema.safeParse({ type: "webhook" });
 

package/src/tools/model-catalog/index.ts

@@ -0,0 +1,137 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import * as z from "zod";
+import { getAgentById } from "@/be/db";
+import { upsertModelCatalogOverlay } from "@/be/model-catalog-store";
+import { requestModelCatalogRefresh } from "@/be/pricing-refresh";
+import { can } from "@/rbac";
+import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
+
+async function denyUnlessCatalogWriter(agentId: string): Promise<string | null> {
+  const agent = await getAgentById(agentId);
+  const decision = can({
+    principal: { kind: "agent", agentId, isLead: agent?.isLead ?? false },
+    verb: "models.catalog.write",
+    resource: { kind: "none" },
+    source: "mcp",
+  });
+  return decision.allow ? null : "Writing the model catalog requires the lead agent.";
+}
+
+export const registerModelCatalogRefreshTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "model-catalog-refresh",
+    {
+      title: "Refresh Model Catalog",
+      description:
+        "Refresh the swarm model catalog (and pricing rows) from models.dev, like `pi update --models`. Without force, skips the network when the last check is under 4h old. A forced refresh is accepted once per minute; a second one inside that window returns `skipped-cooldown` with `retryAfterMs`. Lead agent only. Returns the status, model count, and newly added provider/modelId keys.",
+      annotations: { idempotentHint: true, openWorldHint: true },
+      inputSchema: z.object({
+        force: z
+          .boolean()
+          .optional()
+          .describe(
+            "Fetch even if the last check is under 4h old (default false). Rate limited to one per minute.",
+          ),
+      }),
+      outputSchema: swarmToolOutputSchema({
+        status: z.string().optional(),
+        models: z.number().optional(),
+        added: z.array(z.string()).optional(),
+        checkedAt: z.number().nullable().optional(),
+        retryAfterMs: z.number().optional(),
+      }),
+    },
+    async ({ force }, requestInfo) => {
+      if (!requestInfo.agentId) {
+        return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+      }
+      const denied = await denyUnlessCatalogWriter(requestInfo.agentId);
+      if (denied) return toolErr(denied);
+
+      const result = await requestModelCatalogRefresh({ force });
+      const data = {
+        status: result.status,
+        models: result.models,
+        added: result.added,
+        checkedAt: result.checkedAt,
+        retryAfterMs: result.retryAfterMs,
+      };
+      if (result.status === "error") {
+        return toolErr(`Model catalog refresh failed: ${result.error ?? "unknown error"}`, {
+          data,
+        });
+      }
+      const addedText = result.added.length > 0 ? ` Added: ${result.added.join(", ")}.` : "";
+      return toolOk(
+        `Model catalog ${result.status}: ${result.models} model(s), ${result.added.length} new.`,
+        {
+          details: `status=${result.status}; models=${result.models}; added=${result.added.length}.${addedText}`,
+          data,
+        },
+      );
+    },
+  );
+};
+
+export const registerModelCatalogOverlayUpsertTool = (server: McpServer) => {
+  createToolRegistrar(server)(
+    "model-catalog-overlay-upsert",
+    {
+      title: "Upsert Model Catalog Overlay",
+      description:
+        "Add or update hand-verified facts for one model (e.g. a launch models.dev has not listed yet). Overlay fields win over models.dev; overlay prices fill pricing-table gaps so cost recompute prices the model. The row auto-expires once models.dev matches every fact you set.",
+      annotations: { idempotentHint: true },
+      inputSchema: z.object({
+        provider: z
+          .string()
+          .min(1)
+          .describe(
+            "models.dev provider id: anthropic, openai, openrouter, amazon-bedrock, opencode.",
+          ),
+        modelId: z
+          .string()
+          .min(1)
+          .describe("Model id as models.dev keys it (e.g. claude-opus-5-5)."),
+        name: z.string().optional().describe("Display name."),
+        releaseDate: z.string().optional().describe("Release date, YYYY-MM-DD."),
+        contextWindow: z.number().int().positive().optional().describe("Context window, tokens."),
+        maxOutput: z.number().int().positive().optional().describe("Max output tokens."),
+        reasoningOptions: z
+          .array(z.object({ type: z.string(), values: z.array(z.string()).optional() }))
+          .optional()
+          .describe("Reasoning options, models.dev shape: [{type, values?}]."),
+        pricing: z
+          .object({
+            input: z.number().nonnegative().optional(),
+            output: z.number().nonnegative().optional(),
+            cache_read: z.number().nonnegative().optional(),
+            cache_write: z.number().nonnegative().optional(),
+          })
+          .optional()
+          .describe("USD per million tokens."),
+        reason: z.string().min(1).describe("Why this overlay exists (source of the facts)."),
+        verifiedBy: z.string().optional().describe("Who verified the facts (URL, person, agent)."),
+      }),
+      outputSchema: swarmToolOutputSchema({
+        overlay: z.looseObject({}).optional(),
+      }),
+    },
+    async (input, requestInfo) => {
+      if (!requestInfo.agentId) {
+        return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+      }
+      const denied = await denyUnlessCatalogWriter(requestInfo.agentId);
+      if (denied) return toolErr(denied);
+      try {
+        const overlay = await upsertModelCatalogOverlay(input);
+        return toolOk(`Overlay for ${input.provider}/${input.modelId} saved.`, {
+          details: `Overlay for ${input.provider}/${input.modelId} saved (reason: ${input.reason}). It expires when models.dev matches every fact set.`,
+          data: { overlay },
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown error";
+        return toolErr(`Failed to save overlay: ${message}`);
+      }
+    },
+  );
+};

package/src/tools/schedules/create-schedule.ts

@@ -11,6 +11,7 @@ import {
   getWorkflow,
   isExtensionAgent,
 } from "@/be/db";
+import { explicitModelErrorForAgent } from "@/be/model-validation";
 import { getScript } from "@/be/scripts/db";
 import { calculateNextRun } from "@/scheduler";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
@@ -104,11 +105,17 @@ export const createScheduleInputSchema = z.object({
     .min(1)
     .optional()
     .describe(
-      "Concrete model override for tasks created by this schedule. Interpreted by each assignee's harness/provider and does not switch providers. Prefer modelTier for portable intent.",
+      "Concrete model override for tasks created by this schedule. Interpreted by each assignee's harness/provider and does not switch providers. Prefer modelTier for portable intent. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected.",
     ),
   modelTier: ModelTierSchema.optional().describe(
     "Portable model tier for tasks created by this schedule: 'smol', 'regular', 'smart', or 'ultra'. Resolved by each assignee's harness/provider at run time.",
   ),
+  allowCustomModel: z
+    .boolean()
+    .optional()
+    .describe(
+      "Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.",
+    ),
 });
 
 const scheduleDataShape = {
@@ -177,6 +184,7 @@ export const registerCreateScheduleTool = (server: McpServer) => {
         enabled,
         model,
         modelTier,
+        allowCustomModel,
       },
       requestInfo,
       _meta,
@@ -263,8 +271,15 @@ export const registerCreateScheduleTool = (server: McpServer) => {
         }
       }
 
+      const normalizedModel = splitLegacyModelAlias({ model, modelTier });
+      const modelError = await explicitModelErrorForAgent({
+        model: normalizedModel.model,
+        allowCustomModel,
+        agentId: targetAgentId,
+      });
+      if (modelError) return toolErr(modelError);
+
       try {
-        const normalizedModel = splitLegacyModelAlias({ model, modelTier });
         // Calculate initial nextRunAt
         let nextRunAt: string | undefined;
         if (enabled === false) {

package/src/tools/schedules/patch-schedule.ts

@@ -12,6 +12,7 @@ import {
   isExtensionAgent,
   updateScheduledTask,
 } from "@/be/db";
+import { explicitModelErrorForAgent } from "@/be/model-validation";
 import { mergeScheduleTiming, validateRecurringTiming } from "@/be/schedules/validate";
 import { getScript } from "@/be/scripts/db";
 import { calculateNextRun } from "@/scheduler";
@@ -69,10 +70,18 @@ export const patchScheduleInputSchema = z.object({
     .min(1)
     .nullable()
     .optional()
-    .describe("Concrete model override for tasks created by this schedule. Set to null to clear."),
+    .describe(
+      "Concrete model override for tasks created by this schedule. Set to null to clear. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected.",
+    ),
   modelTier: ModelTierSchema.nullable()
     .optional()
     .describe("Portable model tier for tasks created by this schedule. Set to null to clear."),
+  allowCustomModel: z
+    .boolean()
+    .optional()
+    .describe(
+      "Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.",
+    ),
 });
 
 const scheduleDataShape = {
@@ -140,6 +149,7 @@ export const registerPatchScheduleTool = (server: McpServer) => {
         enabled,
         model,
         modelTier,
+        allowCustomModel,
       },
       requestInfo,
       _meta,
@@ -247,12 +257,32 @@ export const registerPatchScheduleTool = (server: McpServer) => {
         if (targetAgentId !== undefined) updateData.targetAgentId = targetAgentId;
         if (timezone !== undefined) updateData.timezone = timezone;
         if (enabled !== undefined) updateData.enabled = enabled;
+        // A move to another agent re-judges the stored model against the new harness.
+        const agentChanged =
+          targetAgentId !== undefined && targetAgentId !== schedule.targetAgentId;
         if (model !== undefined || modelTier !== undefined) {
           const normalizedModel = splitLegacyModelAlias({ model, modelTier });
+          // A model the schedule already stores is not re-judged, so an unrelated edit still saves.
+          if (normalizedModel.model !== schedule.model || agentChanged) {
+            const modelError = await explicitModelErrorForAgent({
+              model: normalizedModel.model,
+              allowCustomModel: allowCustomModel || normalizedModel.model === schedule.model,
+              agentId: targetAgentId ?? schedule.targetAgentId,
+            });
+            if (modelError) return toolErr(modelError);
+          }
           if (model !== undefined) updateData.model = normalizedModel.model ?? null;
           if (modelTier !== undefined || normalizedModel.modelTier) {
             updateData.modelTier = normalizedModel.modelTier ?? null;
           }
+        } else if (agentChanged && schedule.model) {
+          // Harness only: the stored id already passed the catalog check when it was written.
+          const modelError = await explicitModelErrorForAgent({
+            model: schedule.model,
+            allowCustomModel: true,
+            agentId: targetAgentId ?? schedule.targetAgentId,
+          });
+          if (modelError) return toolErr(modelError);
         }
 
         // Recalculate nextRunAt based on schedule type

package/src/tools/schedules/update-schedule.ts

@@ -12,6 +12,7 @@ import {
   isExtensionAgent,
   updateScheduledTask,
 } from "@/be/db";
+import { explicitModelErrorForAgent } from "@/be/model-validation";
 import { mergeScheduleTiming, validateRecurringTiming } from "@/be/schedules/validate";
 import { getScript } from "@/be/scripts/db";
 import { calculateNextRun } from "@/scheduler";
@@ -69,10 +70,18 @@ export const updateScheduleInputSchema = z.object({
     .min(1)
     .nullable()
     .optional()
-    .describe("Concrete model override for tasks created by this schedule. Set to null to clear."),
+    .describe(
+      "Concrete model override for tasks created by this schedule. Set to null to clear. The model must run on the assignee's harness (an Anthropic model on a Claude agent, an OpenAI model on a Codex agent); a mismatch is rejected.",
+    ),
   modelTier: ModelTierSchema.nullable()
     .optional()
     .describe("Portable model tier for tasks created by this schedule. Set to null to clear."),
+  allowCustomModel: z
+    .boolean()
+    .optional()
+    .describe(
+      "Accept a `model` the model catalog does not list. Without it an unknown model id is rejected. Only for ids the catalog cannot know yet.",
+    ),
 });
 
 const scheduleDataShape = {
@@ -139,6 +148,7 @@ export const registerUpdateScheduleTool = (server: McpServer) => {
         enabled,
         model,
         modelTier,
+        allowCustomModel,
       },
       requestInfo,
       _meta,
@@ -246,12 +256,32 @@ export const registerUpdateScheduleTool = (server: McpServer) => {
         if (targetAgentId !== undefined) updateData.targetAgentId = targetAgentId;
         if (timezone !== undefined) updateData.timezone = timezone;
         if (enabled !== undefined) updateData.enabled = enabled;
+        // A move to another agent re-judges the stored model against the new harness.
+        const agentChanged =
+          targetAgentId !== undefined && targetAgentId !== schedule.targetAgentId;
         if (model !== undefined || modelTier !== undefined) {
           const normalizedModel = splitLegacyModelAlias({ model, modelTier });
+          // A model the schedule already stores is not re-judged, so an unrelated edit still saves.
+          if (normalizedModel.model !== schedule.model || agentChanged) {
+            const modelError = await explicitModelErrorForAgent({
+              model: normalizedModel.model,
+              allowCustomModel: allowCustomModel || normalizedModel.model === schedule.model,
+              agentId: targetAgentId ?? schedule.targetAgentId,
+            });
+            if (modelError) return toolErr(modelError);
+          }
           if (model !== undefined) updateData.model = normalizedModel.model ?? null;
           if (modelTier !== undefined || normalizedModel.modelTier) {
             updateData.modelTier = normalizedModel.modelTier ?? null;
           }
+        } else if (agentChanged && schedule.model) {
+          // Harness only: the stored id already passed the catalog check when it was written.
+          const modelError = await explicitModelErrorForAgent({
+            model: schedule.model,
+            allowCustomModel: true,
+            agentId: targetAgentId ?? schedule.targetAgentId,
+          });
+          if (modelError) return toolErr(modelError);
         }
 
         // Recalculate nextRunAt based on schedule type